Harden build/publish, algorithm, and tests without changing the API

[Acro]

Backward-compatible hardening of the library. The public default-export signature, the default concurrency of 5, input-order results, Promise.all error semantics, and as const tuple return-type inference are all unchanged (verified with a type test). Version bumped to 2.2.0 (additive feature + fixes).

Critical fixes (were quietly breaking or fragile)

• Publish never ran tsc. "prepublish": "tsc" sat outside scripts (npm ignores it) and prepublish is deprecated. Build now runs via prepare + a build script.
• dist/ shipping was non-deterministic. dist/ is git-ignored with no .npmignore and no files field, so npm falls back to .gitignore. Added "files": ["dist"]; npm pack --dry-run now yields a deterministic 5-file / ~5.6 kB tarball (the published 2.1.0 ships 10 files including src/, test/, and tsconfig.json).
• License mismatch. LICENSE is MIT but package.json said ISC — and npm currently advertises ISC. Set to MIT to match the actual license file.

Correctness / robustness

• Concurrency limit validation. limit || 5 with no validation made limit = -1 / 2.5 throw a cryptic RangeError. Now normalized: non-positive / non-integer values fall back to the default of 5 (preserves the old 0 → 5 behaviour). limit is now optional.
• Iterative worker pool. Replaced async recursion (which retained a promise chain per worker) with a while loop. Same output; no retained chains. Tested with 1000 jobs.

Quality / DX

• Added a dependency-free 11-case assertion test suite — including an explicit sustained max concurrency test (proves a finished job is replaced immediately, i.e. a true sliding pool, not batching) and wired up npm test.
• Added a GitHub Actions CI matrix (Node 16/18/20/22).
• Added a named parallel export and DEFAULT_CONCURRENCY alongside the unchanged default export.
• Modernized tsconfig (dropped deprecated/unused options), var → const/let, refreshed README to document ordering and error behaviour.

Backward-compatibility: verified against the real dependent

The only published dependent is @paperbits/core (@paperbits/amp declares the dep but has no call site). It pins ^2.1.0, so it will pick up 2.2.0 automatically. Its actual usage, at all 3 call sites, is:

import parallel from "await-parallel-limit";      // default export
await parallel(tasks, maxParallelPublisingTasks);  // maxParallelPublisingTasks = 30; return value discarded

• Default export, positive-integer limit (30), result never read → every changed surface (optional limit, 0→5 fallback, tuple typing, named export) is a no-op for them.
• Head-to-head runtime diff (published 2.1.0 vs. this branch, 100 thunks @ limit 30): happy path identical — peak concurrency 30, all 100 complete, input order preserved; error path — both fail-fast with the same error at the same point.

Not included (deliberately — breaking or judgment calls)

• AbortSignal support and a settle-all / stopOnError: false mode (change/extend semantics — worth a 3.0 or opt-in option).
• Dual ESM/CJS build with an exports map.

Testing

• npm test → 11/11 passing (build + assertions).
• npm pack --dry-run → tarball contains dist/index.js, dist/index.d.ts, LICENSE, README.md, package.json.
• Type test confirms parallel(jobs as const, 2) still infers an ordered tuple.
• Runtime-equivalence check vs. published 2.1.0 on the @paperbits/core call shape.

🤖 Generated with Claude Code