@bymax-one/nest-queue 1.2.0 → 1.2.3

package/CHANGELOG.md

@@ -7,6 +7,71 @@ versioning follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ---
 
+## [1.2.3] — 2026-09-05
+
+**Nothing that runs in this package changed.** A fresh build of the release commit was packed and
+compared against the published 1.2.2 tarball: `dist/` is identical file for file, and `package.json`
+differs only in the version string. The remaining difference is this CHANGELOG entry, which ships
+because `CHANGELOG.md` does.
+
+It exists because the estate releases on a cadence, so a library whose artifact is unchanged
+publishes anyway and says so rather than implying a benefit it does not deliver. **There is no
+reason to upgrade from 1.2.2**, and a consumer on `^1.2.0` gains nothing by resolving to it.
+
+### Internal
+
+Not shipped — `files` is `dist`, `LICENSE`, `README.md`, `CHANGELOG.md`, and the only file touched
+since 1.2.2 is `AGENTS.md`:
+
+- The shared review-rules block was synchronised with its canonical copy, bringing in an invariant
+  for keys built from more than one field — the generalised form of the deduplication defect this
+  package corrected in 1.2.2.
+- Two repository-specific review rules were corrected: one rested its case on a defect that had
+  since been fixed, so the claim had become false; the other required an authorship finding to
+  quote a resolvable commit id, a criterion the shared block superseded by placing author and
+  committer identity out of scope entirely.
+
+## [1.2.2] — 2026-09-04
+
+**1.2.1 was tagged but never published**, so this release carries its documentation fix as well
+as the one below. `dist/` changes here for the first time since 1.2.0 — JSDoc reaches the emitted
+`.d.ts`, so a doc-block correction is a change to the published types.
+
+### Fixed
+
+- **The `enqueue` deduplication example asserted a safety property it did not provide.** It showed
+  `` `${tenantId}:reindex:${term}` `` and stated that "one tenant's term cannot suppress another's".
+  Two variable fields joined by a delimiter either may contain do not produce a unique key: with
+  `` `${tenantId}:${term}` ``, the pairs `('a', 'b:c')` and `('a:b', 'c')` both yield `a:b:c`. The
+  guidance now percent-encodes every variable field, and the claim states what the construction
+  delivers. This is documentation a consumer copies into their own key-building code, which is why
+  the shape mattered more than whether `:reindex:` in particular was reachable.
+- Carried from 1.2.1: **the `MetricsService` example in `README.md` called two methods that do not
+  exist**, `getMetrics(name)` and `getAll([names])`, where the service exposes `get(name)` and a
+  no-argument `getAll()`.
+
+### Internal
+
+Not shipped, listed because the tag covers them: bullmq raised from 6.0.10 to 6.3.4 in the
+workspace override; `fast-uri`, `qs` and `fastify` floors raised past published advisories; the
+README-snippet gate now type-checks through receivers; `AGENTS.md` and its sync workflow added.
+
+## [1.2.1] — 2026-08-30
+
+Documentation only. `dist/` is byte-identical to `1.2.0`; the published tarball was unpacked and
+diffed against a fresh build to confirm it rather than assert it. The release exists because
+`README.md` ships inside the package, so a fix that stays on `main` leaves the npm page — where
+the example is actually read — still wrong.
+
+### Fixed
+
+- **The `MetricsService` example in `README.md` called two methods that do not exist.** It showed
+  `getMetrics(name)` and `getAll([names])`; the service exposes `get(name)` and a no-argument
+  `getAll()` returning `readonly QueueMetrics[]` for every queue currently cached by
+  `QueueService`. Code copied from that example failed to compile, and the wrong `getAll` signature
+  also implied a per-call queue filter the API does not offer. Every other call in the README was
+  checked against the source in the same pass and is correct.
+
 ## [1.2.0] — 2026-08-10
 
 **Breaking, shipped as a minor by choice.** The peer ranges move to the next major of each
@@ -487,6 +552,9 @@ v6 peer range.
 
 ---
 
+[1.2.3]: https://github.com/bymaxone/nest-queue/compare/v1.2.2...v1.2.3
+[1.2.2]: https://github.com/bymaxone/nest-queue/compare/v1.2.1...v1.2.2
+[1.2.1]: https://github.com/bymaxone/nest-queue/compare/v1.2.0...v1.2.1
 [1.2.0]: https://github.com/bymaxone/nest-queue/compare/v1.0.11...v1.2.0
 [1.0.11]: https://github.com/bymaxone/nest-queue/compare/v1.0.10...v1.0.11
 [1.0.10]: https://github.com/bymaxone/nest-queue/compare/v1.0.9...v1.0.10

package/README.md

@@ -400,8 +400,8 @@ BymaxQueueModule.forRoot({
 import { MetricsService } from '@bymax-one/nest-queue'
 import type { QueueMetrics } from '@bymax-one/nest-queue'
 
-const metrics: QueueMetrics = await this.metricsService.getMetrics('email')
-const all = await this.metricsService.getAll(['email', 'notifications'])
+const metrics: QueueMetrics = await this.metricsService.get('email')
+const all: readonly QueueMetrics[] = await this.metricsService.getAll()
 ```
 
 ---

package/dist/server/index.cjs

@@ -392,7 +392,13 @@ exports.QueueService = class QueueService {
    * The deduplication `id` is a shared key across the queue, so a multi-tenant
    * producer MUST scope it by tenant: keyed on the value alone
    * (`` `reindex:${term}` ``), tenant A enqueuing a term suppresses tenant B's job
-   * for the same term. Include the tenant (`` `${tenantId}:reindex:${term}` ``).
+   * for the same term.
+   *
+   * Scoping alone is not enough. Two variable fields joined by a delimiter that
+   * either may contain do not produce a unique key: with `` `${tenantId}:${term}` ``,
+   * the pairs `('a', 'b:c')` and `('a:b', 'c')` both yield `a:b:c`. Percent-encode
+   * every variable field so the delimiter cannot appear inside one:
+   * `` `${encodeURIComponent(tenantId)}:${encodeURIComponent(term)}` ``.
    *
    * Deduplication modes (`deduplication: { id, ttl?, extend?, replace?, keepLastIfActive? }`):
    *  - Simple `{ id }` — collapse duplicates until the in-flight job completes or fails.
@@ -407,10 +413,11 @@ exports.QueueService = class QueueService {
    * @param data - Typed job payload.
    * @param options - Per-job BullMQ options (priority, delay, `jobId`, `deduplication`, ...).
    * @returns The created job.
-   * @example Throttle: at most one reindex per term every 5 seconds. The dedup key
-   *   carries the tenant so one tenant's term cannot suppress another's.
+   * @example Throttle: at most one reindex per term every 5 seconds. Both variable
+   *   fields are percent-encoded, so no other tenant/term pair can build this key.
+   *   const dedupId = `${encodeURIComponent(tenantId)}:reindex:${encodeURIComponent(term)}`
    *   await queueService.enqueue('search', 'reindex', { term }, {
-   *     deduplication: { id: `${tenantId}:reindex:${term}`, ttl: 5_000 },
+   *     deduplication: { id: dedupId, ttl: 5_000 },
    *   })
    */
   async enqueue(queueName, jobName, data, options) {

package/dist/server/index.d.cts

@@ -433,7 +433,13 @@ declare class QueueService {
      * The deduplication `id` is a shared key across the queue, so a multi-tenant
      * producer MUST scope it by tenant: keyed on the value alone
      * (`` `reindex:${term}` ``), tenant A enqueuing a term suppresses tenant B's job
-     * for the same term. Include the tenant (`` `${tenantId}:reindex:${term}` ``).
+     * for the same term.
+     *
+     * Scoping alone is not enough. Two variable fields joined by a delimiter that
+     * either may contain do not produce a unique key: with `` `${tenantId}:${term}` ``,
+     * the pairs `('a', 'b:c')` and `('a:b', 'c')` both yield `a:b:c`. Percent-encode
+     * every variable field so the delimiter cannot appear inside one:
+     * `` `${encodeURIComponent(tenantId)}:${encodeURIComponent(term)}` ``.
      *
      * Deduplication modes (`deduplication: { id, ttl?, extend?, replace?, keepLastIfActive? }`):
      *  - Simple `{ id }` — collapse duplicates until the in-flight job completes or fails.
@@ -448,10 +454,11 @@ declare class QueueService {
      * @param data - Typed job payload.
      * @param options - Per-job BullMQ options (priority, delay, `jobId`, `deduplication`, ...).
      * @returns The created job.
-     * @example Throttle: at most one reindex per term every 5 seconds. The dedup key
-     *   carries the tenant so one tenant's term cannot suppress another's.
+     * @example Throttle: at most one reindex per term every 5 seconds. Both variable
+     *   fields are percent-encoded, so no other tenant/term pair can build this key.
+     *   const dedupId = `${encodeURIComponent(tenantId)}:reindex:${encodeURIComponent(term)}`
      *   await queueService.enqueue('search', 'reindex', { term }, {
-     *     deduplication: { id: `${tenantId}:reindex:${term}`, ttl: 5_000 },
+     *     deduplication: { id: dedupId, ttl: 5_000 },
      *   })
      */
     enqueue<TData = unknown, TResult = unknown>(queueName: string, jobName: string, data: TData, options?: JobsOptions): Promise<TypedJob<TData, TResult>>;

package/dist/server/index.d.ts

@@ -433,7 +433,13 @@ declare class QueueService {
      * The deduplication `id` is a shared key across the queue, so a multi-tenant
      * producer MUST scope it by tenant: keyed on the value alone
      * (`` `reindex:${term}` ``), tenant A enqueuing a term suppresses tenant B's job
-     * for the same term. Include the tenant (`` `${tenantId}:reindex:${term}` ``).
+     * for the same term.
+     *
+     * Scoping alone is not enough. Two variable fields joined by a delimiter that
+     * either may contain do not produce a unique key: with `` `${tenantId}:${term}` ``,
+     * the pairs `('a', 'b:c')` and `('a:b', 'c')` both yield `a:b:c`. Percent-encode
+     * every variable field so the delimiter cannot appear inside one:
+     * `` `${encodeURIComponent(tenantId)}:${encodeURIComponent(term)}` ``.
      *
      * Deduplication modes (`deduplication: { id, ttl?, extend?, replace?, keepLastIfActive? }`):
      *  - Simple `{ id }` — collapse duplicates until the in-flight job completes or fails.
@@ -448,10 +454,11 @@ declare class QueueService {
      * @param data - Typed job payload.
      * @param options - Per-job BullMQ options (priority, delay, `jobId`, `deduplication`, ...).
      * @returns The created job.
-     * @example Throttle: at most one reindex per term every 5 seconds. The dedup key
-     *   carries the tenant so one tenant's term cannot suppress another's.
+     * @example Throttle: at most one reindex per term every 5 seconds. Both variable
+     *   fields are percent-encoded, so no other tenant/term pair can build this key.
+     *   const dedupId = `${encodeURIComponent(tenantId)}:reindex:${encodeURIComponent(term)}`
      *   await queueService.enqueue('search', 'reindex', { term }, {
-     *     deduplication: { id: `${tenantId}:reindex:${term}`, ttl: 5_000 },
+     *     deduplication: { id: dedupId, ttl: 5_000 },
      *   })
      */
     enqueue<TData = unknown, TResult = unknown>(queueName: string, jobName: string, data: TData, options?: JobsOptions): Promise<TypedJob<TData, TResult>>;

package/dist/server/index.mjs

@@ -390,7 +390,13 @@ var QueueService = class {
    * The deduplication `id` is a shared key across the queue, so a multi-tenant
    * producer MUST scope it by tenant: keyed on the value alone
    * (`` `reindex:${term}` ``), tenant A enqueuing a term suppresses tenant B's job
-   * for the same term. Include the tenant (`` `${tenantId}:reindex:${term}` ``).
+   * for the same term.
+   *
+   * Scoping alone is not enough. Two variable fields joined by a delimiter that
+   * either may contain do not produce a unique key: with `` `${tenantId}:${term}` ``,
+   * the pairs `('a', 'b:c')` and `('a:b', 'c')` both yield `a:b:c`. Percent-encode
+   * every variable field so the delimiter cannot appear inside one:
+   * `` `${encodeURIComponent(tenantId)}:${encodeURIComponent(term)}` ``.
    *
    * Deduplication modes (`deduplication: { id, ttl?, extend?, replace?, keepLastIfActive? }`):
    *  - Simple `{ id }` — collapse duplicates until the in-flight job completes or fails.
@@ -405,10 +411,11 @@ var QueueService = class {
    * @param data - Typed job payload.
    * @param options - Per-job BullMQ options (priority, delay, `jobId`, `deduplication`, ...).
    * @returns The created job.
-   * @example Throttle: at most one reindex per term every 5 seconds. The dedup key
-   *   carries the tenant so one tenant's term cannot suppress another's.
+   * @example Throttle: at most one reindex per term every 5 seconds. Both variable
+   *   fields are percent-encoded, so no other tenant/term pair can build this key.
+   *   const dedupId = `${encodeURIComponent(tenantId)}:reindex:${encodeURIComponent(term)}`
    *   await queueService.enqueue('search', 'reindex', { term }, {
-   *     deduplication: { id: `${tenantId}:reindex:${term}`, ttl: 5_000 },
+   *     deduplication: { id: dedupId, ttl: 5_000 },
    *   })
    */
   async enqueue(queueName, jobName, data, options) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bymax-one/nest-queue",
-  "version": "1.2.0",
+  "version": "1.2.3",
   "description": "NestJS dynamic module wrapping BullMQ — typed jobs, flows, job schedulers, deduplication, OpenTelemetry, graceful shutdown",
   "author": "Bymax One <support@bymax.one>",
   "license": "MIT",
@@ -100,8 +100,8 @@
     "@nestjs/common": "^11.1.28",
     "@nestjs/core": "^11.1.28",
     "@nestjs/testing": "^11.1.28",
-    "@stryker-mutator/core": "^9.6.1",
-    "@stryker-mutator/jest-runner": "^9.6.1",
+    "@stryker-mutator/core": "^10.0.0",
+    "@stryker-mutator/jest-runner": "^10.0.0",
     "@types/jest": "^30.0.0",
     "@types/node": "^26.2.0",
     "bullmq": "^6.0.0",