@bymax-one/nest-queue 1.0.9 → 1.0.11

package/CHANGELOG.md

@@ -7,6 +7,57 @@ versioning follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ---
 
+## [1.0.11] — 2026-08-10
+
+**Documentation only.** The shipped declaration comments change (`dts` preserves them); no runtime
+code changed.
+
+### Fixed
+
+- The deduplication example — in the `QueueService` JSDoc and in
+  `docs/technical_specification.md` — now scopes the dedup `id` by tenant
+  (`` `${tenantId}:reindex:${term}` ``). The `id` is a shared key across the queue, so a
+  multi-tenant producer keying on the value alone lets one tenant's enqueue suppress another
+  tenant's job for the same value; the example previously demonstrated exactly that.
+
+## [1.0.10] — 2026-08-06
+
+**Documentation and tooling only.** `dist/` is byte-identical to `1.0.9`; no source file
+changed.
+
+### Fixed
+
+- The quality bullet claimed "no suppression comments" while the source carries five
+  `// Stryker disable` comments. The claim was about type suppressions and read as false to
+  anyone who grepped for it; it now says what is true — no `@ts-ignore` and no
+  `eslint-disable`.
+
+### Security
+
+- **The OSV scan was passing because it had nothing to read.** The workflow ran
+  `osv-scanner` with no `actions/checkout` step, so it walked an empty workspace and
+  reported "No package sources found" and "No lockfiles found" before exiting 0. A green
+  check meant the scanner found no files, which is indistinguishable from finding no
+  vulnerabilities. With the checkout in place it scans the lockfile, which is how the next
+  item was found.
+- **`js-yaml` is patched to the fixed release** (GHSA-5p4m-2wfm-xmqj, CVSS 7.5). The
+  override floors here already scoped it per major but admitted `3.15.0` and `4.3.0`, both
+  covered by the advisory; they are raised to `^3.15.1` and `^4.3.1`. It reaches this repo
+  only through `jest` -> `babel-plugin-istanbul` -> `@istanbuljs/load-nyc-config`, and
+  `dependencies` is empty, so nothing here ships it and no consumer was exposed. `dist/` is
+  unaffected.
+
+### Added
+
+- `check:mutants` gate (`scripts/check-mutation-directives.mjs`) — validates every
+  `// Stryker` comment against the grammar Stryker's own parser accepts, rejecting a reason
+  written after `--` instead of a colon (silently dropped, and the report then shows
+  `Ignored using a comment`), a reason wrapped onto a second comment line (the report keeps
+  only the first fragment), and a mutator name Stryker does not know, which matches nothing
+  and so silences nothing. Wired into CI and `prepublishOnly`.
+- `docs/mutation_testing_plan.md` carries the suppression policy now shared, word for word,
+  across the `@bymax-one/nest-*` libraries.
+
 ## [1.0.9] — 2026-08-06
 
 **Published-artifact change, not a behavioural one.** `dist/` differs from `1.0.8` — this
@@ -405,6 +456,8 @@ v6 peer range.
 
 ---
 
+[1.0.11]: https://github.com/bymaxone/nest-queue/compare/v1.0.10...v1.0.11
+[1.0.10]: https://github.com/bymaxone/nest-queue/compare/v1.0.9...v1.0.10
 [1.0.9]: https://github.com/bymaxone/nest-queue/compare/v1.0.8...v1.0.9
 [1.0.8]: https://github.com/bymaxone/nest-queue/compare/v1.0.7...v1.0.8
 [1.0.7]: https://github.com/bymaxone/nest-queue/compare/v1.0.6...v1.0.7

package/README.md

@@ -87,7 +87,7 @@ peer dependencies, so you control exact versions and the supply-chain surface st
 - ✅ **Stable error catalog** — namespaced codes exported from both subpaths, so a frontend maps a `code` without importing the server
 - ✅ **Dual-format output** — ESM + CJS with declarations for each format, verified against the packed tarball on every PR
 - ✅ **Opt-in observability** — OpenTelemetry passthrough via `bullmq-otel`, plus a `MetricsService` with a configurable TTL cache
-- ✅ **Typed end to end** — TypeScript `strict` with `exactOptionalPropertyTypes` and `noUncheckedIndexedAccess`; zero `any`, no suppression comments
+- ✅ **Typed end to end** — TypeScript `strict` with `exactOptionalPropertyTypes` and `noUncheckedIndexedAccess`; zero `any`, no `@ts-ignore` and no `eslint-disable`
 
 ---
 

package/dist/server/index.cjs

@@ -378,6 +378,11 @@ exports.QueueService = class QueueService {
    * **producers** and do not change the at-least-once guarantee on the
    * **consumer** side.
    *
+   * The deduplication `id` is a shared key across the queue, so a multi-tenant
+   * producer MUST scope it by tenant: keyed on the value alone
+   * (`` `reindex:${term}` ``), tenant A enqueuing a term suppresses tenant B's job
+   * for the same term. Include the tenant (`` `${tenantId}:reindex:${term}` ``).
+   *
    * Deduplication modes (`deduplication: { id, ttl?, extend?, replace?, keepLastIfActive? }`):
    *  - Simple `{ id }` — collapse duplicates until the in-flight job completes or fails.
    *  - Throttle `{ id, ttl }` — ignore duplicates for `ttl` milliseconds.
@@ -391,9 +396,10 @@ exports.QueueService = class QueueService {
    * @param data - Typed job payload.
    * @param options - Per-job BullMQ options (priority, delay, `jobId`, `deduplication`, ...).
    * @returns The created job.
-   * @example Throttle: at most one reindex per term every 5 seconds.
+   * @example Throttle: at most one reindex per term every 5 seconds. The dedup key
+   *   carries the tenant so one tenant's term cannot suppress another's.
    *   await queueService.enqueue('search', 'reindex', { term }, {
-   *     deduplication: { id: `reindex:${term}`, ttl: 5_000 },
+   *     deduplication: { id: `${tenantId}:reindex:${term}`, ttl: 5_000 },
    *   })
    */
   async enqueue(queueName, jobName, data, options) {

package/dist/server/index.d.cts

@@ -421,6 +421,11 @@ declare class QueueService {
      * **producers** and do not change the at-least-once guarantee on the
      * **consumer** side.
      *
+     * The deduplication `id` is a shared key across the queue, so a multi-tenant
+     * producer MUST scope it by tenant: keyed on the value alone
+     * (`` `reindex:${term}` ``), tenant A enqueuing a term suppresses tenant B's job
+     * for the same term. Include the tenant (`` `${tenantId}:reindex:${term}` ``).
+     *
      * Deduplication modes (`deduplication: { id, ttl?, extend?, replace?, keepLastIfActive? }`):
      *  - Simple `{ id }` — collapse duplicates until the in-flight job completes or fails.
      *  - Throttle `{ id, ttl }` — ignore duplicates for `ttl` milliseconds.
@@ -434,9 +439,10 @@ declare class QueueService {
      * @param data - Typed job payload.
      * @param options - Per-job BullMQ options (priority, delay, `jobId`, `deduplication`, ...).
      * @returns The created job.
-     * @example Throttle: at most one reindex per term every 5 seconds.
+     * @example Throttle: at most one reindex per term every 5 seconds. The dedup key
+     *   carries the tenant so one tenant's term cannot suppress another's.
      *   await queueService.enqueue('search', 'reindex', { term }, {
-     *     deduplication: { id: `reindex:${term}`, ttl: 5_000 },
+     *     deduplication: { id: `${tenantId}:reindex:${term}`, ttl: 5_000 },
      *   })
      */
     enqueue<TData = unknown, TResult = unknown>(queueName: string, jobName: string, data: TData, options?: JobsOptions): Promise<TypedJob<TData, TResult>>;

package/dist/server/index.d.ts

@@ -421,6 +421,11 @@ declare class QueueService {
      * **producers** and do not change the at-least-once guarantee on the
      * **consumer** side.
      *
+     * The deduplication `id` is a shared key across the queue, so a multi-tenant
+     * producer MUST scope it by tenant: keyed on the value alone
+     * (`` `reindex:${term}` ``), tenant A enqueuing a term suppresses tenant B's job
+     * for the same term. Include the tenant (`` `${tenantId}:reindex:${term}` ``).
+     *
      * Deduplication modes (`deduplication: { id, ttl?, extend?, replace?, keepLastIfActive? }`):
      *  - Simple `{ id }` — collapse duplicates until the in-flight job completes or fails.
      *  - Throttle `{ id, ttl }` — ignore duplicates for `ttl` milliseconds.
@@ -434,9 +439,10 @@ declare class QueueService {
      * @param data - Typed job payload.
      * @param options - Per-job BullMQ options (priority, delay, `jobId`, `deduplication`, ...).
      * @returns The created job.
-     * @example Throttle: at most one reindex per term every 5 seconds.
+     * @example Throttle: at most one reindex per term every 5 seconds. The dedup key
+     *   carries the tenant so one tenant's term cannot suppress another's.
      *   await queueService.enqueue('search', 'reindex', { term }, {
-     *     deduplication: { id: `reindex:${term}`, ttl: 5_000 },
+     *     deduplication: { id: `${tenantId}:reindex:${term}`, ttl: 5_000 },
      *   })
      */
     enqueue<TData = unknown, TResult = unknown>(queueName: string, jobName: string, data: TData, options?: JobsOptions): Promise<TypedJob<TData, TResult>>;

package/dist/server/index.mjs

@@ -376,6 +376,11 @@ var QueueService = class {
    * **producers** and do not change the at-least-once guarantee on the
    * **consumer** side.
    *
+   * The deduplication `id` is a shared key across the queue, so a multi-tenant
+   * producer MUST scope it by tenant: keyed on the value alone
+   * (`` `reindex:${term}` ``), tenant A enqueuing a term suppresses tenant B's job
+   * for the same term. Include the tenant (`` `${tenantId}:reindex:${term}` ``).
+   *
    * Deduplication modes (`deduplication: { id, ttl?, extend?, replace?, keepLastIfActive? }`):
    *  - Simple `{ id }` — collapse duplicates until the in-flight job completes or fails.
    *  - Throttle `{ id, ttl }` — ignore duplicates for `ttl` milliseconds.
@@ -389,9 +394,10 @@ var QueueService = class {
    * @param data - Typed job payload.
    * @param options - Per-job BullMQ options (priority, delay, `jobId`, `deduplication`, ...).
    * @returns The created job.
-   * @example Throttle: at most one reindex per term every 5 seconds.
+   * @example Throttle: at most one reindex per term every 5 seconds. The dedup key
+   *   carries the tenant so one tenant's term cannot suppress another's.
    *   await queueService.enqueue('search', 'reindex', { term }, {
-   *     deduplication: { id: `reindex:${term}`, ttl: 5_000 },
+   *     deduplication: { id: `${tenantId}:reindex:${term}`, ttl: 5_000 },
    *   })
    */
   async enqueue(queueName, jobName, data, options) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bymax-one/nest-queue",
-  "version": "1.0.9",
+  "version": "1.0.11",
   "description": "NestJS dynamic module wrapping BullMQ — typed jobs, flows, job schedulers, deduplication, OpenTelemetry, graceful shutdown",
   "author": "Bymax One <support@bymax.one>",
   "license": "MIT",
@@ -56,15 +56,16 @@
   "scripts": {
     "build": "pnpm clean && tsup",
     "check:exports": "attw --pack .",
+    "check:mutants": "node scripts/check-mutation-directives.mjs",
     "check:published": "node scripts/check-published-surface.mjs",
     "clean": "rm -rf dist coverage",
     "lint": "eslint src scripts test",
     "lint:fix": "eslint src scripts test --fix",
     "mutation": "stryker run",
+    "mutation:full": "node -e \"require('node:fs').rmSync('reports/stryker-incremental.json',{force:true,recursive:true})\" && stryker run",
     "mutation:dry-run": "stryker run --dryRunOnly",
-    "mutation:incremental": "stryker run --incremental",
     "prepare": "husky",
-    "prepublishOnly": "pnpm clean && pnpm typecheck && pnpm test:types && pnpm lint && pnpm test:cov:all && pnpm build && pnpm check:published",
+    "prepublishOnly": "pnpm clean && pnpm typecheck && pnpm test:types && pnpm lint && pnpm check:mutants && pnpm test:cov:all && pnpm build && pnpm check:published",
     "release": "npm publish --provenance --access public",
     "size": "node scripts/check-size.mjs",
     "smoke": "node scripts/dogfood-smoke-test.mjs",