@bymax-one/nest-queue 1.0.8 → 1.0.10

package/CHANGELOG.md

@@ -7,6 +7,60 @@ versioning follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ---
 
+## [1.0.10] — 2026-08-06
+
+**Documentation and tooling only.** `dist/` is byte-identical to `1.0.9`; no source file
+changed.
+
+### Fixed
+
+- The quality bullet claimed "no suppression comments" while the source carries five
+  `// Stryker disable` comments. The claim was about type suppressions and read as false to
+  anyone who grepped for it; it now says what is true — no `@ts-ignore` and no
+  `eslint-disable`.
+
+### Security
+
+- **The OSV scan was passing because it had nothing to read.** The workflow ran
+  `osv-scanner` with no `actions/checkout` step, so it walked an empty workspace and
+  reported "No package sources found" and "No lockfiles found" before exiting 0. A green
+  check meant the scanner found no files, which is indistinguishable from finding no
+  vulnerabilities. With the checkout in place it scans the lockfile, which is how the next
+  item was found.
+- **`js-yaml` is patched to the fixed release** (GHSA-5p4m-2wfm-xmqj, CVSS 7.5). The
+  override floors here already scoped it per major but admitted `3.15.0` and `4.3.0`, both
+  covered by the advisory; they are raised to `^3.15.1` and `^4.3.1`. It reaches this repo
+  only through `jest` -> `babel-plugin-istanbul` -> `@istanbuljs/load-nyc-config`, and
+  `dependencies` is empty, so nothing here ships it and no consumer was exposed. `dist/` is
+  unaffected.
+
+### Added
+
+- `check:mutants` gate (`scripts/check-mutation-directives.mjs`) — validates every
+  `// Stryker` comment against the grammar Stryker's own parser accepts, rejecting a reason
+  written after `--` instead of a colon (silently dropped, and the report then shows
+  `Ignored using a comment`), a reason wrapped onto a second comment line (the report keeps
+  only the first fragment), and a mutator name Stryker does not know, which matches nothing
+  and so silences nothing. Wired into CI and `prepublishOnly`.
+- `docs/mutation_testing_plan.md` carries the suppression policy now shared, word for word,
+  across the `@bymax-one/nest-*` libraries.
+
+## [1.0.9] — 2026-08-06
+
+**Published-artifact change, not a behavioural one.** `dist/` differs from `1.0.8` — this
+bundler preserves comments and the source gained mutation-suppression notes — but no runtime
+path changed. Measured by building both revisions and diffing the output.
+
+### Documentation
+
+- The mutation badge and README said **99.06%**; the measured score is **99.68%**.
+
+### Tests
+
+- The withheld Redis connection now has the shape of its guarantee asserted: that the property is
+  non-enumerable, that redefining it throws, and that the URL's password stays out of both
+  `JSON.stringify` and `inspect({ showHidden: true })`.
+
 ## [1.0.8] — 2026-08-04
 
 **Runtime change.** `dist/` differs from `1.0.7`.
@@ -389,6 +443,8 @@ v6 peer range.
 
 ---
 
+[1.0.10]: https://github.com/bymaxone/nest-queue/compare/v1.0.9...v1.0.10
+[1.0.9]: https://github.com/bymaxone/nest-queue/compare/v1.0.8...v1.0.9
 [1.0.8]: https://github.com/bymaxone/nest-queue/compare/v1.0.7...v1.0.8
 [1.0.7]: https://github.com/bymaxone/nest-queue/compare/v1.0.6...v1.0.7
 [1.0.6]: https://github.com/bymaxone/nest-queue/releases/tag/v1.0.6

package/README.md

@@ -14,7 +14,7 @@
   <a href="https://www.npmjs.com/package/@bymax-one/nest-queue"><img src="https://img.shields.io/npm/dm/@bymax-one/nest-queue?style=flat-square&colorA=000000&colorB=000000" alt="npm downloads" /></a>
   <a href="https://github.com/bymaxone/nest-queue/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/bymaxone/nest-queue/ci.yml?branch=main&style=flat-square&colorA=000000&label=CI" alt="CI status" /></a>
   <a href="https://github.com/bymaxone/nest-queue/actions/workflows/ci.yml"><img src="https://img.shields.io/badge/coverage-100%25-brightgreen?style=flat-square&colorA=000000" alt="coverage" /></a>
-  <a href="https://github.com/bymaxone/nest-queue/blob/main/docs/mutation_testing_results.md"><img src="https://img.shields.io/badge/mutation-99.06%25-brightgreen?style=flat-square&colorA=000000" alt="mutation score" /></a>
+  <a href="https://github.com/bymaxone/nest-queue/blob/main/docs/mutation_testing_results.md"><img src="https://img.shields.io/badge/mutation-99.68%25-brightgreen?style=flat-square&colorA=000000" alt="mutation score" /></a>
   <a href="https://scorecard.dev/viewer/?uri=github.com/bymaxone/nest-queue"><img src="https://api.scorecard.dev/projects/github.com/bymaxone/nest-queue/badge?style=flat-square" alt="OpenSSF Scorecard" /></a>
   <a href="https://github.com/bymaxone/nest-queue/blob/main/LICENSE"><img src="https://img.shields.io/github/license/bymaxone/nest-queue?style=flat-square&colorA=000000&colorB=000000" alt="license" /></a>
   <a href="https://www.typescriptlang.org/"><img src="https://img.shields.io/badge/TypeScript-strict-3178C6?style=flat-square&logo=typescript&logoColor=white" alt="TypeScript" /></a>
@@ -87,7 +87,7 @@ peer dependencies, so you control exact versions and the supply-chain surface st
 - ✅ **Stable error catalog** — namespaced codes exported from both subpaths, so a frontend maps a `code` without importing the server
 - ✅ **Dual-format output** — ESM + CJS with declarations for each format, verified against the packed tarball on every PR
 - ✅ **Opt-in observability** — OpenTelemetry passthrough via `bullmq-otel`, plus a `MetricsService` with a configurable TTL cache
-- ✅ **Typed end to end** — TypeScript `strict` with `exactOptionalPropertyTypes` and `noUncheckedIndexedAccess`; zero `any`, no suppression comments
+- ✅ **Typed end to end** — TypeScript `strict` with `exactOptionalPropertyTypes` and `noUncheckedIndexedAccess`; zero `any`, no `@ts-ignore` and no `eslint-disable`
 
 ---
 
@@ -796,7 +796,7 @@ key will do it twice at some point.
 ## 🧪 Testing & Quality
 
 - **100% line/branch coverage** on every implemented file (hard CI gate).
-- **Mutation score 99.06%** (Stryker `break 95`) — see [`docs/mutation_testing_results.md`](docs/mutation_testing_results.md).
+- **Mutation score 99.68%** (Stryker `break 95`) — see [`docs/mutation_testing_results.md`](docs/mutation_testing_results.md).
 - **Real-Redis E2E** via Testcontainers (workers, flows, schedulers, deduplication, retries,
   DLQ, graceful shutdown).
 - **Type-level API tests** (`pnpm test:types`) pin the published signatures, so a refactor

package/dist/server/index.cjs

@@ -141,6 +141,7 @@ function applyDefaults(opts) {
   Object.defineProperty(base, "connection", {
     get: () => connection,
     enumerable: false,
+    // Stryker disable next-line BooleanLiteral: equivalent HERE — this object is `Object.freeze`d on the way out, and freezing makes every property non-configurable regardless. The flag stays because it states the guarantee at the point the accessor is defined, and because the sibling packages that withhold secrets the same way are NOT frozen, where it is load-bearing
     configurable: false
   });
   return Object.freeze(base);
@@ -1333,10 +1334,15 @@ QueueLifecycle = __decorateClass([
 ], QueueLifecycle);
 
 // src/server/bymax-queue.module.ts
-var { ConfigurableModuleClass, MODULE_OPTIONS_TOKEN, OPTIONS_TYPE, ASYNC_OPTIONS_TYPE } = new common.ConfigurableModuleBuilder({ moduleName: "BymaxQueue" }).setClassMethodName("forRoot").setFactoryMethodName("createQueueOptions").setExtras({ isGlobal: true }, (definition, extras) => ({
-  ...definition,
-  global: extras.isGlobal
-})).build();
+var { ConfigurableModuleClass, MODULE_OPTIONS_TOKEN, OPTIONS_TYPE, ASYNC_OPTIONS_TYPE } = (
+  // The `moduleName` shapes the generated token's description only — a label read in Nest's DI
+  // error output, never compared against anything. Mutation testing reports it as surviving for
+  // that reason; no Stryker directive attaches inside this builder chain, so the note lives here.
+  new common.ConfigurableModuleBuilder({ moduleName: "BymaxQueue" }).setClassMethodName("forRoot").setFactoryMethodName("createQueueOptions").setExtras({ isGlobal: true }, (definition, extras) => ({
+    ...definition,
+    global: extras.isGlobal
+  })).build()
+);
 exports.BymaxQueueModule = class BymaxQueueModule extends ConfigurableModuleClass {
   /**
    * Synchronous registration. Validates options, resolves defaults, and wires the

package/dist/server/index.mjs

@@ -139,6 +139,7 @@ function applyDefaults(opts) {
   Object.defineProperty(base, "connection", {
     get: () => connection,
     enumerable: false,
+    // Stryker disable next-line BooleanLiteral: equivalent HERE — this object is `Object.freeze`d on the way out, and freezing makes every property non-configurable regardless. The flag stays because it states the guarantee at the point the accessor is defined, and because the sibling packages that withhold secrets the same way are NOT frozen, where it is load-bearing
     configurable: false
   });
   return Object.freeze(base);
@@ -1331,10 +1332,15 @@ QueueLifecycle = __decorateClass([
 ], QueueLifecycle);
 
 // src/server/bymax-queue.module.ts
-var { ConfigurableModuleClass, MODULE_OPTIONS_TOKEN, OPTIONS_TYPE, ASYNC_OPTIONS_TYPE } = new ConfigurableModuleBuilder({ moduleName: "BymaxQueue" }).setClassMethodName("forRoot").setFactoryMethodName("createQueueOptions").setExtras({ isGlobal: true }, (definition, extras) => ({
-  ...definition,
-  global: extras.isGlobal
-})).build();
+var { ConfigurableModuleClass, MODULE_OPTIONS_TOKEN, OPTIONS_TYPE, ASYNC_OPTIONS_TYPE } = (
+  // The `moduleName` shapes the generated token's description only — a label read in Nest's DI
+  // error output, never compared against anything. Mutation testing reports it as surviving for
+  // that reason; no Stryker directive attaches inside this builder chain, so the note lives here.
+  new ConfigurableModuleBuilder({ moduleName: "BymaxQueue" }).setClassMethodName("forRoot").setFactoryMethodName("createQueueOptions").setExtras({ isGlobal: true }, (definition, extras) => ({
+    ...definition,
+    global: extras.isGlobal
+  })).build()
+);
 var BymaxQueueModule = class extends ConfigurableModuleClass {
   /**
    * Synchronous registration. Validates options, resolves defaults, and wires the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bymax-one/nest-queue",
-  "version": "1.0.8",
+  "version": "1.0.10",
   "description": "NestJS dynamic module wrapping BullMQ — typed jobs, flows, job schedulers, deduplication, OpenTelemetry, graceful shutdown",
   "author": "Bymax One <support@bymax.one>",
   "license": "MIT",
@@ -56,6 +56,7 @@
   "scripts": {
     "build": "pnpm clean && tsup",
     "check:exports": "attw --pack .",
+    "check:mutants": "node scripts/check-mutation-directives.mjs",
     "check:published": "node scripts/check-published-surface.mjs",
     "clean": "rm -rf dist coverage",
     "lint": "eslint src scripts test",
@@ -64,7 +65,7 @@
     "mutation:dry-run": "stryker run --dryRunOnly",
     "mutation:incremental": "stryker run --incremental",
     "prepare": "husky",
-    "prepublishOnly": "pnpm clean && pnpm typecheck && pnpm test:types && pnpm lint && pnpm test:cov:all && pnpm build && pnpm check:published",
+    "prepublishOnly": "pnpm clean && pnpm typecheck && pnpm test:types && pnpm lint && pnpm check:mutants && pnpm test:cov:all && pnpm build && pnpm check:published",
     "release": "npm publish --provenance --access public",
     "size": "node scripts/check-size.mjs",
     "smoke": "node scripts/dogfood-smoke-test.mjs",
@@ -146,7 +147,7 @@
       "prettier --write"
     ]
   },
-  "packageManager": "pnpm@11.0.0",
+  "packageManager": "pnpm@11.20.0",
   "engines": {
     "node": ">=24.0.0"
   },