fix(client): keep client.d.ts free of `any`, and make the guard that says so run

main is currently red on public-surface-types.test.ts. This is my regression from #1130 plus the reason it got through.

The leak

PaginateOptions, added in #1130, declared:

tx?: { unsafe: (sql: string, params?: any[]) => any }

I copied that from the implementation rather than from the positional overload sitting next to it, which says unknown. It published one any into client.d.ts — the file an app touches on every query, which #1117 took to zero and pinned there.

Narrowed to unknown. The implementation casts at the single point where it hands the handle to the existing opts bag.

Why CI didn't catch it

The more useful half. That guard reads dist/*.d.ts and opened with:

if (!existsSync(DIST)) return

The CI test job never ran bun run build. So dist/ was never there, and the guard has never checked anything in CI — it has passed by doing nothing on every run since it was written. A test that cannot fail is worse than no test, because it reads as coverage.

Locally it had the opposite failure: a dist/ built before the change under test asserts against code that is no longer there. That produced a red suite twice this week for a checkout predating #1117 — on a defect Chris had already fixed.

The fix

dist/ is now classified rather than merely tested for existence:

Under CI, missing or stale can only mean the build step didn't run, so silently skipping is precisely how a real leak ships. Everywhere else it's a skip that says why, instead of asserting against output that describes different code.

And the CI test job now builds first, so the guard has something to read.

Verification

Both directions, with dist/ deliberately staled:

$ bun test public-surface-types.test.ts
[public-surface] skipped: dist/ is stale. Run `bun run build` to check the published types.
 2 pass, 0 fail

$ CI=1 bun test public-surface-types.test.ts
error: [public-surface] dist/ is stale in CI — the build step must run before these tests…
 (fail)

And the original symptom is gone: client.d.ts back to 0, total back to 18.

Full suite 2131 pass / 0 fail, typecheck clean, pickier 0 errors.

🤖 Generated with Claude Code