fix: avoid CORS declaration interop requirement

[cexbrayat]

Description

@types/cors declares the package with export =. PR #1903 added exported CORS types that caused TypeScript to preserve the source default import in lib/common/providers/https.d.ts.

Default-importing an export = module in a published declaration forces consumers to enable esModuleInterop. Use a namespace import instead so that compiler-option requirement does not leak into consumer projects. The explicit .default invocation preserves the existing runtime behavior with the repository's current TypeScript and tsdown configuration.

This fixes the declaration regression visible in firebase-functions@7.3.0.

The packaging test now compiles a real packed consumer without esModuleInterop to prevent regressions.

[gemini-code-assist]

Code Review

This pull request adds packaging tests to verify TypeScript declarations without esModuleInterop and updates the cors import in src/common/providers/https.ts to use namespace imports. The review feedback suggests improving runtime compatibility for the cors call by adding a fallback for cors.default and simplifying the Node.js script execution in scripts/test-packaging.sh by directly interpolating the script directory.

[gemini-code-assist]

Directly calling cors.default assumes that the module loader or bundler always wraps the CommonJS module in an ES module compatibility layer that defines the default property.

However, in some environments (such as running tests directly on source files, or using certain toolchains/bundlers where esModuleInterop is disabled or behaves differently), cors.default might be undefined at runtime, leading to a TypeError: cors.default is not a function.

Using a fallback like (cors.default || cors) ensures maximum compatibility and robustness across different runtimes and build configurations.

      const corsFn = (cors.default || cors) as any;
      corsFn(corsOptions)(req, res, () => {
        resolve(wrapped(req, res));
      });

[gemini-code-assist]

Instead of using the process.argv[1] trick to pass the path to the inline Node script, you can directly interpolate the $SCRIPT_DIR variable into the double-quoted Node script string. This is much cleaner, more readable, and standard for bash scripts.

Suggested change

	TYPESCRIPT_VERSION=$(node -p "require(process.argv[1]).devDependencies.typescript" "$SCRIPT_DIR/../package.json")
	TYPESCRIPT_VERSION=$(node -p "require('$SCRIPT_DIR/../package.json').devDependencies.typescript")

[cexbrayat]

Let me know if the gemini feedback should be applied (and if the packaging test is useful).