Merge pull request #523 from pimlicolabs/fix/type-checks

Fix published package leaking raw .ts sources into consumer type-chec…

Author: plusminushalf

.changeset/brave-donuts-shine.md

@@ -0,0 +1,5 @@
+---
+"@pimlico/mock-paymaster": patch
+---
+
+Internal: paymaster lookups by entryPoint now go through a narrowing helper; the package compiles under `noUncheckedIndexedAccess`.

.changeset/tidy-moons-repair.md

@@ -0,0 +1,5 @@
+---
+"permissionless": patch
+---
+
+Fixed published-package type-checking for consumers on legacy `moduleResolution: "node"` (node10): every exported subpath directory now ships a proxy package.json pointing at the compiled `_types`/`_esm`/`_cjs` output, so `tsc` resolves declarations instead of pulling raw `.ts` sources into the consumer's program (#522). Barrel subpath modules (`actions/{erc7579,pimlico,passkeyServer,etherspot,smartAccount}` and `clients/{pimlico,passkeyServer}`) moved from single files into directories with index files — package-specifier imports are unaffected, only private deep imports of `_esm`/`_cjs`/`_types` file paths change. Test files and vitest config are no longer included in the npm tarball; `.ts` sources are still shipped for debuggability. The codebase now compiles under `noUncheckedIndexedAccess`, so sources stay error-free even when consumer projects type-check them with that flag enabled.

.changeset/wild-camels-check.md

@@ -0,0 +1,5 @@
+---
+"@permissionless/wagmi": patch
+---
+
+Fixed `useAvailableCapabilities` to return `undefined` instead of throwing when the connected chain has no capabilities entry, and hardened receipt handling in `useWaitForTransactionReceipt`. The package now compiles under `noUncheckedIndexedAccess`.

.github/fixtures/type-consumer/.gitignore

@@ -0,0 +1,3 @@
+node_modules
+package-lock.json
+*.tgz

.github/fixtures/type-consumer/consumer.ts

@@ -0,0 +1,27 @@
+// Imports every exported subpath of the permissionless package so that tsc
+// resolves each one. If raw .ts sources ever leak back into consumer programs
+// (missing subpath proxy package.json, see issue #522) or the published .d.ts
+// surface breaks under strict flags, these imports fail to type-check.
+export * as permissionless from "permissionless"
+export * as accounts from "permissionless/accounts"
+export * as accountsBiconomy from "permissionless/accounts/biconomy"
+export * as accountsEtherspot from "permissionless/accounts/etherspot"
+export * as accountsKernel from "permissionless/accounts/kernel"
+export * as accountsLight from "permissionless/accounts/light"
+export * as accountsNexus from "permissionless/accounts/nexus"
+export * as accountsSafe from "permissionless/accounts/safe"
+export * as accountsSimple from "permissionless/accounts/simple"
+export * as accountsThirdweb from "permissionless/accounts/thirdweb"
+export * as accountsTrust from "permissionless/accounts/trust"
+export * as actions from "permissionless/actions"
+export * as actionsErc7579 from "permissionless/actions/erc7579"
+export * as actionsEtherspot from "permissionless/actions/etherspot"
+export * as actionsPasskeyServer from "permissionless/actions/passkeyServer"
+export * as actionsPimlico from "permissionless/actions/pimlico"
+export * as actionsSmartAccount from "permissionless/actions/smartAccount"
+export * as clients from "permissionless/clients"
+export * as clientsPasskeyServer from "permissionless/clients/passkeyServer"
+export * as clientsPimlico from "permissionless/clients/pimlico"
+export * as errors from "permissionless/errors"
+export * as experimentalPimlico from "permissionless/experimental/pimlico"
+export * as utils from "permissionless/utils"

.github/fixtures/type-consumer/package.json

@@ -0,0 +1,10 @@
+{
+    "name": "type-consumer-fixture",
+    "private": true,
+    "description": "Type-checks the packed permissionless tarball the way consumers do (issue #522). The tarball is installed at CI time by the package-types workflow job.",
+    "devDependencies": {
+        "ox": "0.11.3",
+        "typescript": "5.9.3",
+        "viem": "2.51.3"
+    }
+}

.github/fixtures/type-consumer/tsconfig.bundler.json

@@ -0,0 +1,20 @@
+{
+    // Modern resolution follows the exports map to the published .d.ts files.
+    // skipLibCheck is off and the strictest consumer flags are on, so this
+    // verifies the declaration surface stays clean for the pickiest setups.
+    "compilerOptions": {
+        "target": "ES2022",
+        "module": "esnext",
+        "moduleResolution": "bundler",
+        "strict": true,
+        "noUncheckedIndexedAccess": true,
+        "exactOptionalPropertyTypes": true,
+        "skipLibCheck": false,
+        "noEmit": true,
+        // Keep the program hermetic: without this, tsc auto-includes every
+        // node_modules/@types package from parent directories (the monorepo
+        // root), so unrelated workspace typings leak into this fixture.
+        "types": []
+    },
+    "files": ["consumer.ts"]
+}

.github/fixtures/type-consumer/tsconfig.node10.json

@@ -0,0 +1,22 @@
+{
+    // Legacy node10 resolution ignores the exports map for subpaths, so it
+    // only finds .d.ts declarations through the per-directory proxy
+    // package.json files. Raw .ts sources leaking into the program error out
+    // even with skipLibCheck enabled, which isolates the signal to exactly
+    // the regression this fixture guards against (issue #522).
+    "compilerOptions": {
+        "target": "ES2021",
+        "module": "commonjs",
+        "moduleResolution": "node10",
+        "strict": true,
+        "noUncheckedIndexedAccess": true,
+        "esModuleInterop": true,
+        "skipLibCheck": true,
+        "noEmit": true,
+        // Keep the program hermetic: without this, tsc auto-includes every
+        // node_modules/@types package from parent directories (the monorepo
+        // root), so unrelated workspace typings leak into this fixture.
+        "types": []
+    },
+    "files": ["consumer.ts"]
+}

.github/workflows/on-pull-request.yml

@@ -46,6 +46,48 @@ jobs:
       - name: Build
         run: bun run build
 
+  package-types:
+    name: Package types (node10 + bundler consumers)
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Clone repository
+        uses: actions/checkout@v6
+
+      - name: Install dependencies
+        uses: ./.github/actions/install-dependencies
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "22"
+
+      - name: Build permissionless
+        run: bun run build:permissionless:tsgo
+
+      - name: Pack tarball into fixture
+        working-directory: packages/permissionless
+        run: npm pack --pack-destination ../../.github/fixtures/type-consumer
+
+      - name: Install fixture dependencies
+        working-directory: .github/fixtures/type-consumer
+        run: |
+          npm install --no-package-lock
+          npm install --no-package-lock --no-save ./permissionless-*.tgz
+
+      - name: Type-check as a node10 consumer
+        working-directory: .github/fixtures/type-consumer
+        run: npx tsc -p tsconfig.node10.json
+
+      - name: Type-check as a bundler consumer
+        working-directory: .github/fixtures/type-consumer
+        run: npx tsc -p tsconfig.bundler.json
+
+      - name: Lint package publishing metadata (advisory)
+        working-directory: packages/permissionless
+        continue-on-error: true
+        run: npx --yes publint --strict
+
   docker-e2e:
     name: E2E-Coverage
     runs-on: ubuntu-latest

packages/mock-paymaster/relay.ts

@@ -181,6 +181,17 @@ const handleMethod = async ({
         [entryPoint08Address]: paymaster08
     }
 
+    const getPaymaster = (entryPoint: Address): Address => {
+        const paymaster = epToPaymaster[entryPoint]
+        if (paymaster === undefined) {
+            throw new RpcError(
+                "EntryPoint not supported",
+                ValidationErrors.InvalidFields
+            )
+        }
+        return paymaster
+    }
+
     if (parsedBody.method === "pm_sponsorUserOperation") {
         const params = pmSponsorUserOperationParamsSchema.safeParse(
             parsedBody.params
@@ -201,7 +212,7 @@ const handleMethod = async ({
             userOperation,
             paymasterMode: { mode: "verifying" },
             bundler: bundlerClient,
-            paymaster: epToPaymaster[entryPoint],
+            paymaster: getPaymaster(entryPoint),
             publicClient,
             paymasterSigner,
             estimateGas: true
@@ -242,7 +253,7 @@ const handleMethod = async ({
         return {
             ...getDummyPaymasterData({
                 is06,
-                paymaster: epToPaymaster[entryPoint],
+                paymaster: getPaymaster(entryPoint),
                 paymasterMode
             }),
             ...dummyPaymasterGas,
@@ -268,7 +279,7 @@ const handleMethod = async ({
             signer: paymasterSigner,
             userOp: userOperation as UserOperation,
             paymasterMode: getPaymasterMode(data),
-            paymaster: epToPaymaster[entryPoint],
+            paymaster: getPaymaster(entryPoint),
             publicClient
         })
     }