zx-bulk-release 3.1.11 → 3.1.13

package/CHANGELOG.md

@@ -1,3 +1,13 @@
+## [3.1.13](https://github.com/semrel-extra/zx-bulk-release/compare/v3.1.12...v3.1.13) (2026-04-20)
+
+### Fixes & improvements
+* fix(config): force using file urls for dynamic import (win issue) ([78d32e6](https://github.com/semrel-extra/zx-bulk-release/commit/78d32e6b5ac8b8dbbe359e829e1b498ef193c2e6))
+
+## [3.1.12](https://github.com/semrel-extra/zx-bulk-release/compare/v3.1.11...v3.1.12) (2026-04-13)
+
+### Fixes & improvements
+* refactor: inline queuefy ([dcb3b36](https://github.com/semrel-extra/zx-bulk-release/commit/dcb3b3655a9200a861672be7a8d23e82110465a9))
+
 ## [3.1.11](https://github.com/semrel-extra/zx-bulk-release/compare/v3.1.10...v3.1.11) (2026-04-13)
 
 ### Fixes & improvements

package/README.md

@@ -437,8 +437,8 @@ See [DELIVER_SPEC.md](./docs/DELIVER_SPEC.md) for the full protocol specificatio
 ### Credential flow
 ```
 depot (build phase)                          courier (deliver phase)
-  manifest: { token: '${{NPM_TOKEN}}' }  →    resolveManifest(manifest, env)
-                                                 → { token: 'actual-secret' }
+  manifest: { token: '${{NPM_TOKEN}}' }  ->   resolveManifest(manifest, env)
+                                                 -> { token: 'actual-secret' }
 ```
 Template credentials (`${{ENV_VAR}}`) are written into manifests at pack time. Courier resolves them from `process.env` at delivery time. This means the build phase never sees real secrets — including git push credentials (`GH_TOKEN`, `GIT_COMMITTER_NAME`, `GIT_COMMITTER_EMAIL`) which are now resolved by the `git-tag` channel at delivery time.
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "zx-bulk-release",
   "alias": "bulk-release",
-  "version": "3.1.11",
+  "version": "3.1.13",
   "description": "zx-based alternative for multi-semantic-release",
   "type": "module",
   "exports": {
@@ -21,6 +21,7 @@
     "test": "npm run test:unit",
     "test:unit": "vitest run --dir src/test/js --exclude '**/integration*' --exclude '**/fixtures/**' --exclude '**/utils/**'",
     "test:it": "node ./src/test/js/integration.test.js",
+    "test:smoke": "node src/test/smoke/api.test.js && node src/test/smoke/cli.test.js",
     "test:cov": "vitest run --coverage --dir src/test/js --exclude '**/fixtures/**' --exclude '**/utils/**'",
     "docs": "mkdir -p docs && cp ./README.md ./docs/README.md",
     "publish:beta": "npm publish --tag beta --no-git-tag-version",
@@ -28,14 +29,13 @@
   },
   "dependencies": {
     "@semrel-extra/topo": "^1.14.1",
-    "queuefy": "^1.2.1",
     "tar-stream": "^3.1.8",
     "zx-extra": "4.0.20"
   },
   "devDependencies": {
     "@vitest/coverage-v8": "^4.1.4",
     "esbuild": "^0.28.0",
-    "verdaccio": "6.5.0",
+    "verdaccio": "6.5.2",
     "vitest": "^4.1.4"
   },
   "publishConfig": {

package/src/main/js/config.js

@@ -1,3 +1,4 @@
+import { pathToFileURL } from 'node:url'
 import { fs, path, YAML } from 'zx'
 import { asArray, camelize, memoizeBy } from './util.js'
 import { GH_URL, resolveGhApiUrl } from './post/api/gh.js'
@@ -32,7 +33,7 @@ export const getPkgConfig = async (cwd, env) =>
 export const cosmiconfig = (name, {searchPlaces}) => {
   const load = async (filePath) => {
     if (filePath.endsWith('.js') || filePath.endsWith('.cjs'))
-      return (await import(filePath)).default
+      return (await import(pathToFileURL(filePath).href)).default
     const raw = await fs.readFile(filePath, 'utf8')
     if (filePath.endsWith('.yaml') || filePath.endsWith('.yml'))
       return YAML.parse(raw)

package/src/main/js/post/courier/channels/changelog.js

@@ -1,5 +1,5 @@
 import {fs, path} from 'zx-extra'
-import {queuefy} from 'queuefy'
+import {queuefy} from '../../../util.js'
 import {api} from '../../api/index.js'
 import {log} from '../../log.js'
 import {hasHigherVersion} from '../seniority.js'

package/src/main/js/post/courier/channels/gh-pages.js

@@ -1,5 +1,5 @@
 import {path} from 'zx-extra'
-import {queuefy} from 'queuefy'
+import {queuefy} from '../../../util.js'
 import {log} from '../../log.js'
 import {api} from '../../api/index.js'
 import {hasHigherVersion} from '../seniority.js'

package/src/main/js/post/courier/channels/meta.js

@@ -1,4 +1,4 @@
-import {queuefy} from 'queuefy'
+import {queuefy} from '../../../util.js'
 import {log} from '../../log.js'
 import {api} from '../../api/index.js'
 import {getArtifactPath, isAssetMode, prepareMeta} from '../../depot/generators/meta.js'

package/src/main/js/post/release.js

@@ -1,7 +1,7 @@
 import os from 'node:os'
 import {createRequire} from 'node:module'
 import {$, within} from 'zx-extra'
-import {queuefy} from 'queuefy'
+import {queuefy} from '../util.js'
 
 import {createReport, log} from './log.js'
 import {topo} from './depot/deps.js'

package/src/main/js/util.js

@@ -73,18 +73,23 @@ export const camelize = s => s.replace(/-./g, x => x[1].toUpperCase())
 
 export const asArray = v => Array.isArray(v) ? v : [v]
 
-export const pool = async (tasks, concurrency, fn) => {
-  const active = new Set()
-  let i = 0
-  await new Promise((resolve, reject) => {
-    const next = () => {
-      if (i >= tasks.length && active.size === 0) return resolve()
-      while (active.size < concurrency && i < tasks.length) {
-        const t = tasks[i++]
-        const p = fn(t).then(() => { active.delete(p); next() }, reject)
-        active.add(p)
-      }
-    }
+export const queuefy = (fn, concurrency = 1) => {
+  const queue = []
+  let active = 0
+  const next = () => {
+    if (active >= concurrency || queue.length === 0) return
+    active++
+    const {args, resolve, reject} = queue.shift()
+    Promise.resolve().then(() => fn(...args)).then(
+      v => { active--; resolve(v); next() },
+      e => { active--; reject(e); next() }
+    )
+  }
+  return (...args) => new Promise((resolve, reject) => {
+    queue.push({args, resolve, reject})
     next()
   })
 }
+
+export const pool = async (tasks, concurrency, fn) =>
+  Promise.all(tasks.map(queuefy(fn, concurrency)))