fix(deps): require use-sync-external-store ^1.5.0 so the ESM build loads in Node

dist/index.js imports `use-sync-external-store/shim`, which is kept
external. Before 1.5.0 the package had no `exports` map, so Node's ESM
resolver treats `/shim` as a directory and throws
ERR_UNSUPPORTED_DIR_IMPORT. That breaks anything that loads the ESM build
without a bundler: Vitest tests in apps that use reactfire, SSR that keeps
dependencies external, and plain Node scripts. The CJS build is fine.

Raise the floor to ^1.5.0 (lockfile: 1.2.0 -> 1.7.0), and add a build
job step that loads the built package with Node as both ESM and CJS so
this can't regress unnoticed.

Author: jhuleatt

.github/workflows/test.yaml

@@ -37,6 +37,12 @@ jobs:
       - name: Build
         id: pack-dir
         run: ./build.sh
+      # Load the built package with Node's own module resolution (not a bundler's), the way
+      # Vitest, SSR, and plain Node consumers do. Catches imports that only bundlers can resolve.
+      - name: Check that the built package loads in Node
+        run: |
+          node --input-type=module -e "await import('reactfire')"
+          node -e "require('reactfire')"
       - name: 'Upload Artifact'
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:

package-lock.json

@@ -109,7 +109,7 @@
   "dependencies": {
     "rxfire": "^6.1.0",
     "rxjs": "^6.6.3 || ^7.0.1",
-    "use-sync-external-store": "^1.2.0"
+    "use-sync-external-store": "^1.5.0"
   },
   "allowScripts": {
     "@firebase/util@1.12.1": true,