Release process: add a built-artifact (dist/bundle) check to catch runtime regressions before publish

从针对 npm pack 输出的拟议检查开始，尤其是 dist/index.js、包的 exports/main/module 路径，以及 Node ESM 和 CommonJS import 命令。定义一个发布前 gate，涵盖动态 require 和外部检查、入口点加载、tarball 路径完整性以及 bundle 大小比较；运行时 smoke 应用和 .d.ts diff 是相关的后续工作。完成的标准是在发布前由 release 流程检测到 #759 中描述的回归。

Motivation

#759 (the App Router / Vite client crash in 4.2.4 and 4.2.5) shipped because the build-tooling migration silently changed the built ESM output: use-sync-external-store/shim (CJS) started getting bundled into the ESM dist, producing a dynamic require() that throws in any browser bundle (Calling \require` for "react" in an environment that doesn't expose the require function`). The source was unchanged; only the emitted artifact regressed, and nothing in the release flow compared the artifact before publish.

This is the second dist-level regression to ship as a patch: #749 already proposes a published .d.ts diff to catch the type side (the 4.2.4 ObservableStatus break). This issue covers the runtime/bundle side. Together they form a built-artifact diff gate.

Proposed pre-publish checks

A concrete checklist for a pre-publish gate (each item derived from auditing the 4.2.6 release by hand). Items marked would have caught #759.

1. No dynamic require( / CJS-interop shims in the ESM dist. Grep dist/index.js for \brequire\b, __require, createRequire, __commonJS. (Would have caught #759: require count went 0 at 4.2.3 to 3 at 4.2.4+.)
2. Externals are not inlined. Only rxfire / rxjs / tslib should be bundled; react, firebase/*, @firebase/*, and use-sync-external-store/shim must stay external import specifiers. Catches accidental bundling that causes duplicate-instance bugs.
3. Both entry points load. node --input-type=module -e "import('reactfire')" and node -e "require('reactfire')" (in a fixture with react + firebase installed) must resolve without throwing. Catches missing/renamed files and broken imports.
4. exports map integrity. Every path referenced by exports / main / module exists in the packed tarball.
5. Bundle-size delta vs previous latest. npm pack the current latest, compare dist size; flag large jumps (a proxy for accidental inlining).
6. Published .d.ts diff vs previous version. Type-side counterpart, tracked in #749; catches the 4.2.4 ObservableStatus break class.
7. Runtime smoke render in CI (strongest). A minimal Next App Router (turbopack) and Vite app that renders a data hook against the packed build; fails on the #759 crash. This is the check that catches runtime regressions the static greps miss.

Items 1 to 5 are cheap and scriptable against npm pack output; 7 is the higher-value integration check.

Related

• #749 (published .d.ts diff, the type-side counterpart)
• #759 / #760 (the regression this would have caught, and its fix)