ci: verify the packed package with publint, attw and size-limit

Replaces the bespoke 700-line release gate with off-the-shelf tooling,
keeping only the one check nothing off-the-shelf covers.

Two new jobs run against the packed tarball the publish job uploads
verbatim, so they check the exact bytes that ship:

  Verify package        publint --strict, attw, size-limit
  Verify package loads   entry-load.mjs on React 18 and 19

publint and attw cannot see the #759 class: their output is identical
across 4.2.3 through 4.2.6, because that regression was a require call
inlined into the body of a structurally valid ESM file. Loading the
package is the only thing that catches it, which is why entry-load.mjs
survives.

They do catch two live consumer-facing bugs the bespoke gate never did.
Published 4.2.6 gives TypeScript CJS consumers under node16 resolution
no type declarations at all, and the package declared no sideEffects.
Both are fixed here: types conditions on both exports branches, a
duplicated .d.cts, and sideEffects false.

Also repoints the size-limit config, which named TSDX-era filenames the
vite build stopped emitting, so npm run size was checking nothing.

publint runs with --strict because it exits 0 on warnings, and the
missing types condition is a warning. attw ignores
internal-resolution-error via .attw.json: the emitted .d.ts use
extensionless relative imports, which is a real pre-existing bug with
its own fix, and ignoring the one rule keeps every other resolution
check enforcing.

Addresses #765 items 1 to 5. Item 6 is #749 and lands separately.

Author: tyler-reitz

.attw.json

@@ -0,0 +1,4 @@
+{
+  "$schema": "https://cdn.jsdelivr.net/npm/@arethetypeswrong/cli@0.18.5/config-schema.json",
+  "ignoreRules": ["internal-resolution-error"]
+}

.eslintrc.json

@@ -23,6 +23,22 @@
         "@typescript-eslint",
         "no-only-tests"
     ],
+    "overrides": [
+        {
+            "files": ["**/*.mjs"],
+            "env": {
+                "browser": false,
+                "node": true
+            },
+            "globals": {
+                "describe": "readonly",
+                "it": "readonly",
+                "expect": "readonly",
+                "beforeEach": "readonly",
+                "afterEach": "readonly"
+            }
+        }
+    ],
     "rules": {
         "no-only-tests/no-only-tests": "error",
         "@typescript-eslint/no-explicit-any": "warn",

.github/workflows/test.yaml

@@ -46,6 +46,68 @@ jobs:
             publish.sh
             unpack.sh
           retention-days: 1
+  verify-package:
+    runs-on: ubuntu-latest
+    needs: build
+    name: Verify package
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+      - name: Setup node
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: '24'
+          cache: 'npm'
+      - name: Install deps
+        run: npm ci
+      - name: 'Download Artifacts'
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      # Unpacking makes the repo root the shipped package, which is what the
+      # next two steps need: publint takes a directory, and size-limit reads
+      # dist/, which is gitignored and so absent from a fresh checkout.
+      - name: Expand Artifact
+        run: |
+          chmod +x reactfire-${{ github.run_id }}/unpack.sh
+          ./reactfire-${{ github.run_id }}/unpack.sh
+      # --strict because publint exits 0 on warnings, and the manifest problems
+      # worth gating on (a missing types condition, for one) are warnings.
+      - name: Lint package
+        run: npm run lint:package
+      # Points at the tarball rather than re-packing, so it checks the exact
+      # bytes that ship. .attw.json ignores internal-resolution-error, because
+      # the emitted .d.ts use extensionless relative imports, which node16
+      # resolution rejects. That is a real pre-existing bug with its own fix;
+      # ignoring the one rule keeps every other resolution check enforcing.
+      - name: Lint types
+        run: npm run lint:types -- reactfire-${{ github.run_id }}/reactfire.tgz
+      - name: Bundle size
+        run: npm run size
+  verify-loads:
+    runs-on: ubuntu-latest
+    needs: build
+    name: Verify package loads (React ${{ matrix.react }})
+    strategy:
+      matrix:
+        react: ['18', '19']
+      fail-fast: false
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+      - name: Setup node
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: '24'
+      - name: 'Download Artifacts'
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      # Installs the packed tarball into a throwaway project with real react and
+      # firebase, then actually loads both entry points. No npm ci: the script
+      # builds its own dependency tree, which is why it is a separate job.
+      - name: Entry-point load test
+        run: node scripts/entry-load.mjs reactfire-${{ github.run_id }}/reactfire.tgz --react ${{ matrix.react }}
   test:
     runs-on: ubuntu-latest
     needs: build
@@ -116,7 +178,7 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     name: Publish (NPM)
-    needs: test
+    needs: [test, verify-package, verify-loads]
     if: ${{ github.ref == 'refs/heads/main' || github.event_name == 'release' }}
     steps:
       - name: Setup node