chore(package): build before packaging so a stale bundle cannot ship

CONTRIBUTING.md

@@ -39,7 +39,7 @@ esbuild into `dist/`:
 - Or build and install a `.vsix`:
 
   ```bash
-  pnpm package                                    # → quoll-<version>.vsix
+  pnpm package                                    # build → quoll-<version>.vsix
   code --install-extension quoll-<version>.vsix --force
   ```
 

README.md

@@ -87,7 +87,7 @@ Prefer to build from source? Clone the repo and package the `.vsix` yourself:
 git clone https://github.com/mtskf/quoll.git
 cd quoll
 pnpm install
-pnpm package        # produces quoll-<version>.vsix
+pnpm package        # builds, then produces quoll-<version>.vsix
 code --install-extension quoll-*.vsix
 ```
 
@@ -153,7 +153,7 @@ Contributions are welcome. The project is a single-root pnpm package (extension
 ```bash
 pnpm install        # install all deps
 pnpm build          # full build (tsc + esbuild → dist/)
-pnpm package        # produce a .vsix via vsce
+pnpm package        # build + produce a .vsix via vsce
 pnpm test           # run the vitest unit suite
 ```
 

package.json

@@ -325,7 +325,7 @@
     "test:e2e:run": "node test/extension/build.mjs && node ./out/test-e2e/launch.js",
     "test": "pnpm test:unit && pnpm test:browser && pnpm test:e2e",
     "test:watch": "vitest",
-    "package": "pnpm vsce package --no-dependencies && node scripts/audit-vsix.mjs quoll-$(node -p \"require('./package.json').version\").vsix"
+    "package": "pnpm build && pnpm vsce package --no-dependencies && node scripts/audit-vsix.mjs quoll-$(node -p \"require('./package.json').version\").vsix"
   },
   "dependencies": {
     "@codemirror/commands": "^6.10.3",

test/build/package-script-audits-vsix.test.ts

@@ -24,6 +24,13 @@ const pkg = JSON.parse(
 describe("pnpm package audit wiring", () => {
   const packageScript: string = pkg.scripts.package;
 
+  it("builds before packaging", () => {
+    // vsce zips whatever is in dist/ and the audit checks presence, not
+    // freshness — without the leading build a stale bundle ships as a
+    // passing .vsix. Chained with `&&` so a failed type-check stops here.
+    expect(packageScript.startsWith("pnpm build && ")).toBe(true);
+  });
+
   it("packages the .vsix", () => {
     expect(packageScript).toContain("vsce package");
   });