@idos-network/kwil-infra 1.2.0 → 2.2.0

package/src/facesign/facesign-signer.ts

@@ -2,6 +2,7 @@
 const POST_MESSAGE_DELAY_MS = 300;
 // Safety net: reject proposals if the enclave doesn't respond within this window.
 const PROPOSAL_TIMEOUT_MS = 10 * 60 * 1000; // 10 minutes
+const RESET_TIMEOUT_MS = 15_000;
 
 export interface FaceSignMetadata {
   name: string;
@@ -27,6 +28,8 @@ export class FaceSignSignerProvider {
   #resolveSessionProposal: ((response: SessionResponse) => void) | null = null;
   #rejectSessionProposal: ((error: Error) => void) | null = null;
   #resolveAddressRequest: ((address: string | null) => void) | null = null;
+  #resolveReset: (() => void) | null = null;
+  #rejectReset: ((error: Error) => void) | null = null;
 
   #messageListener: ((event: MessageEvent) => void) | null = null;
   #messageListenerInitialized = false;
@@ -86,6 +89,14 @@ export class FaceSignSignerProvider {
         const payload = event.data.data;
         this.#resolveAddressRequest?.(payload?.address ?? null);
       }
+
+      if (event.data?.type === "reset_complete") {
+        if (event.data.data?.ok) {
+          this.#resolveReset?.();
+        } else {
+          this.#rejectReset?.(new Error("FaceSign enclave failed to delete its key"));
+        }
+      }
     };
 
     window.addEventListener("message", this.#messageListener);
@@ -220,6 +231,43 @@ export class FaceSignSignerProvider {
     }
   }
 
+  async reset(): Promise<void> {
+    this.#setupMessageListener();
+    const deadline = Date.now() + RESET_TIMEOUT_MS;
+
+    try {
+      await this.#ensureEnclave(deadline - Date.now());
+      await new Promise<void>((resolve, reject) => {
+        const timer = setTimeout(
+          () => {
+            reject(new Error("FaceSign reset timed out"));
+          },
+          Math.max(deadline - Date.now(), 0),
+        );
+
+        this.#resolveReset = () => {
+          clearTimeout(timer);
+          this.#resolveReset = null;
+          this.#rejectReset = null;
+          resolve();
+        };
+        this.#rejectReset = (error) => {
+          clearTimeout(timer);
+          this.#resolveReset = null;
+          this.#rejectReset = null;
+          reject(error);
+        };
+
+        this.#iframe?.contentWindow?.postMessage(
+          { type: "reset", data: { id: ++this.#proposalId } },
+          this.#enclaveOrigin,
+        );
+      });
+    } finally {
+      this.destroy();
+    }
+  }
+
   hide(): void {
     this.#cancelPendingProposals();
     this.#hideEnclave();
@@ -269,7 +317,7 @@ export class FaceSignSignerProvider {
     return container;
   }
 
-  #ensureEnclave(): Promise<void> {
+  #ensureEnclave(timeoutMs = PROPOSAL_TIMEOUT_MS): Promise<void> {
     if (this.#iframe?.contentWindow) {
       return Promise.resolve();
     }
@@ -277,7 +325,7 @@ export class FaceSignSignerProvider {
     return new Promise<void>((resolve, reject) => {
       const timer = setTimeout(() => {
         reject(new Error("FaceSign enclave failed to load"));
-      }, PROPOSAL_TIMEOUT_MS);
+      }, timeoutMs);
 
       if (!this.#container) {
         this.#container = this.#createContainer();

package/src/index.ts

@@ -1,5 +1,7 @@
 export * from "./create-kwil-client";
+export * from "./create-kgw-authenticated-fetch";
 export * from "./create-kwil-signer";
+export * from "./mm-token/create-mm-token-kwil-signer";
 export {
   getNearFullAccessPublicKeys,
   implicitAddressFromPublicKey,

package/src/mm-token/create-mm-token-kwil-signer.test.ts

@@ -0,0 +1,148 @@
+import { base64UrlEncode, utf8Encode } from "@idos-network/utils/codecs";
+import { describe, expect, it } from "vitest";
+
+import {
+  createMmTokenAuth,
+  isMmTokenAuth,
+  mmTokenCredentialContentUri,
+  mmTokenStorageId,
+  type MmTokenEnvelope,
+} from "./create-mm-token-kwil-signer.js";
+
+const signingPublicKeyBytes = new Uint8Array(Array.from({ length: 32 }, (_, index) => index + 1));
+const signatureBytes = new Uint8Array(Array.from({ length: 64 }, (_, index) => index + 64));
+
+function createEnvelope(overrides: Partial<MmTokenEnvelope> = {}): MmTokenEnvelope {
+  return {
+    payload: {
+      version: 1,
+      aud: ["metamask:user-storage:ukyc", "idos:kwil"],
+      signing_public_key: base64UrlEncode(signingPublicKeyBytes),
+      storage_id: "storage-abc",
+    },
+    signature: base64UrlEncode(signatureBytes),
+    ...overrides,
+  };
+}
+
+function encodeEnvelope(envelope: MmTokenEnvelope): string {
+  return base64UrlEncode(utf8Encode(JSON.stringify(envelope)));
+}
+
+async function signMessage(signer: ReturnType<typeof createMmTokenAuth>): Promise<Uint8Array> {
+  return await (signer.signer as (message: Uint8Array) => Promise<Uint8Array>)(
+    new Uint8Array([1, 2, 3]),
+  );
+}
+
+describe("createMmTokenAuth", () => {
+  it("uses mm_token auth type and decoded signing_public_key bytes as identity", () => {
+    const signer = createMmTokenAuth(encodeEnvelope(createEnvelope()));
+
+    expect(signer.signatureType).toBe("mm_token");
+    expect(signer.identifier).toEqual(signingPublicKeyBytes);
+  });
+
+  it("returns the exact encoded envelope bytes from signMessage", async () => {
+    const encoded = encodeEnvelope(createEnvelope());
+    const signer = createMmTokenAuth(encoded);
+
+    expect(await signMessage(signer)).toEqual(utf8Encode(encoded));
+  });
+
+  it("accepts a decoded envelope object and returns its encoded form", async () => {
+    const envelope = createEnvelope();
+    const signer = createMmTokenAuth(envelope);
+
+    expect(await signMessage(signer)).toEqual(utf8Encode(encodeEnvelope(envelope)));
+  });
+
+  it("rejects raw JSON envelope strings (must be base64url-encoded)", () => {
+    expect(() => createMmTokenAuth(JSON.stringify(createEnvelope()))).toThrow(
+      "Invalid mm_token envelope encoding",
+    );
+  });
+
+  it("rejects invalid signature length", () => {
+    expect(() =>
+      createMmTokenAuth(
+        encodeEnvelope(createEnvelope({ signature: base64UrlEncode(new Uint8Array(63)) })),
+      ),
+    ).toThrow("Invalid mm_token signature length: expected 64, got 63");
+  });
+
+  it("rejects signing_public_key with the wrong byte length", () => {
+    expect(() =>
+      createMmTokenAuth(
+        encodeEnvelope(
+          createEnvelope({
+            payload: {
+              version: 1,
+              signing_public_key: base64UrlEncode(new Uint8Array(31)),
+            },
+          }),
+        ),
+      ),
+    ).toThrow("Invalid mm_token signing_public_key length: expected 32, got 31");
+  });
+
+  it("carries the exact encoded capability as a non-enumerable access token", () => {
+    const encoded = encodeEnvelope(createEnvelope());
+    const auth = createMmTokenAuth(encoded);
+
+    expect(auth.accessToken).toBe(encoded);
+    expect(isMmTokenAuth(auth)).toBe(true);
+    // Blob authorization must not leak through logging or serialization.
+    expect(Object.keys(auth)).not.toContain("accessToken");
+    expect(JSON.stringify(auth)).not.toContain(encoded);
+  });
+
+  it("re-encodes a decoded envelope object into the access token", () => {
+    const envelope = createEnvelope();
+
+    expect(createMmTokenAuth(envelope).accessToken).toBe(encodeEnvelope(envelope));
+  });
+
+  it("does not recognize a non-MM signer as MM authentication", () => {
+    expect(isMmTokenAuth({ identifier: "a", signer: () => {}, signatureType: "ed25519" })).toBe(
+      false,
+    );
+  });
+
+  it("keeps the token payload and exposes its storage_id", () => {
+    const signer = createMmTokenAuth(encodeEnvelope(createEnvelope()));
+
+    expect(signer.mmTokenPayload.storage_id).toBe("storage-abc");
+    expect(mmTokenStorageId(signer)).toBe("storage-abc");
+  });
+
+  it("builds the credential ukyc:// URI from a base64url-encoded token", () => {
+    const credentialId = "0198c21d-79cb-7000-8000-000000000001";
+    const encodedToken = encodeEnvelope(createEnvelope());
+    const signer = createMmTokenAuth(encodedToken);
+    const credential = {
+      id: credentialId,
+      content_uri: mmTokenCredentialContentUri(signer, credentialId),
+    };
+
+    expect(credential).toEqual({
+      id: credentialId,
+      content_uri: `ukyc://storage-abc/blobs/${credentialId}`,
+    });
+  });
+
+  it("fails when the token payload has no storage_id", () => {
+    const signer = createMmTokenAuth(
+      encodeEnvelope(
+        createEnvelope({
+          payload: {
+            version: 1,
+            signing_public_key: base64UrlEncode(signingPublicKeyBytes),
+          },
+        }),
+      ),
+    );
+
+    expect(() => mmTokenStorageId(signer)).toThrow("mm_token payload is missing storage_id");
+  });
+});

package/src/mm-token/create-mm-token-kwil-signer.ts

@@ -0,0 +1,166 @@
+import { KwilSigner } from "@idos-network/kwil-js";
+import { createUkycContentUri } from "@idos-network/utils/blob-gateway";
+import {
+  base64UrlDecode,
+  base64UrlEncode,
+  utf8Decode,
+  utf8Encode,
+} from "@idos-network/utils/codecs";
+
+const ED25519_PUBLIC_KEY_BYTES = 32;
+const ED25519_SIGNATURE_BYTES = 64;
+
+/** Decoded UKYC capability envelope. KGW signature data is base64url(JSON of this). */
+export interface MmTokenEnvelope {
+  payload: MmTokenPayload | Record<string, unknown>;
+  signature: string;
+}
+
+export interface MmTokenPayload {
+  signing_public_key: string;
+  storage_id?: string;
+  [key: string]: unknown;
+}
+
+/**
+ * One MM/UKYC capability, valid both as a KGW `mm_token` signer and as the
+ * `Authorization: AccessToken …` credential for UKYC blob requests.
+ */
+export type MmTokenAuth = KwilSigner & {
+  readonly mmTokenPayload: MmTokenPayload | Record<string, unknown>;
+  /** Exact encoded envelope KGW and UKYC storage verify. Non-enumerable, so it stays out of logs. */
+  readonly accessToken: string;
+  /**
+   * A capability signs its own envelope, never an arbitrary message. Declared so callers
+   * handling a `Wallet` union can keep asking wallets for a message signature.
+   */
+  readonly signMessage?: undefined;
+};
+
+export function isMmTokenAuth(value: unknown): value is MmTokenAuth {
+  return (
+    value !== null &&
+    typeof value === "object" &&
+    "signatureType" in value &&
+    value.signatureType === "mm_token" &&
+    "identifier" in value &&
+    "signer" in value &&
+    typeof (value as Partial<MmTokenAuth>).accessToken === "string"
+  );
+}
+
+/** `storage_id` from the capability token used to construct this signer. */
+export function mmTokenStorageId(signer: KwilSigner): string {
+  const storageId = (signer as Partial<MmTokenAuth>).mmTokenPayload?.storage_id;
+  if (typeof storageId !== "string" || !storageId.trim()) {
+    throw new Error("mm_token payload is missing storage_id");
+  }
+  return storageId.trim();
+}
+
+export function mmTokenCredentialContentUri(signer: KwilSigner, credentialId: string): string {
+  return createUkycContentUri(mmTokenStorageId(signer), credentialId);
+}
+
+function isMmTokenEnvelope(value: unknown): value is MmTokenEnvelope {
+  return (
+    value !== null &&
+    typeof value === "object" &&
+    "payload" in value &&
+    value.payload !== null &&
+    typeof value.payload === "object" &&
+    !Array.isArray(value.payload) &&
+    "signature" in value &&
+    typeof value.signature === "string"
+  );
+}
+
+function parseJson<T>(bytes: Uint8Array, errorMessage: string): T {
+  try {
+    return JSON.parse(utf8Decode(bytes)) as T;
+  } catch (error) {
+    throw new Error(errorMessage, { cause: error });
+  }
+}
+
+function decodeBase64Url(value: string, errorMessage: string): Uint8Array {
+  try {
+    return base64UrlDecode(value);
+  } catch (error) {
+    throw new Error(errorMessage, { cause: error });
+  }
+}
+
+/**
+ * Build the MM authentication object for one UKYC capability.
+ *
+ * Pass the MetaMask-issued capability token as a **base64url-encoded** envelope string
+ * (what KGW verifies). A decoded `{ payload, signature }` object is also accepted and
+ * will be re-encoded.
+ *
+ * `signMessage` always returns the UTF-8 bytes of that encoded string — KGW ignores the
+ * request message and only verifies the envelope.
+ */
+export function createMmTokenAuth(encodedEnvelope: string | MmTokenEnvelope): MmTokenAuth {
+  let encodedToken: string;
+  let envelope: MmTokenEnvelope;
+
+  if (typeof encodedEnvelope === "string") {
+    const trimmed = encodedEnvelope.trim();
+    if (!trimmed) {
+      throw new Error("Invalid mm_token envelope: empty");
+    }
+    encodedToken = trimmed;
+    const envelopeBytes = decodeBase64Url(trimmed, "Invalid mm_token envelope encoding");
+    const parsed = parseJson<unknown>(envelopeBytes, "Invalid mm_token envelope JSON");
+    if (!isMmTokenEnvelope(parsed)) {
+      throw new Error("Invalid mm_token envelope: expected payload object and signature string");
+    }
+    envelope = parsed;
+  } else {
+    if (!isMmTokenEnvelope(encodedEnvelope)) {
+      throw new Error("Invalid mm_token envelope: expected payload object and signature string");
+    }
+    envelope = encodedEnvelope;
+    encodedToken = base64UrlEncode(utf8Encode(JSON.stringify(envelope)));
+  }
+
+  // KGW Verify receives UTF-8 of the base64url string, not the decoded JSON bytes.
+  const signatureData = utf8Encode(encodedToken);
+
+  const tokenSignatureBytes = decodeBase64Url(
+    envelope.signature,
+    "Invalid mm_token envelope signature encoding",
+  );
+  if (tokenSignatureBytes.length !== ED25519_SIGNATURE_BYTES) {
+    throw new Error(
+      `Invalid mm_token signature length: expected ${ED25519_SIGNATURE_BYTES}, got ${tokenSignatureBytes.length}`,
+    );
+  }
+
+  const signingPublicKey = envelope.payload.signing_public_key;
+  if (typeof signingPublicKey !== "string") {
+    throw new Error("Invalid mm_token payload: missing signing_public_key");
+  }
+
+  const signingPublicKeyBytes = decodeBase64Url(
+    signingPublicKey,
+    "Invalid mm_token signing_public_key encoding",
+  );
+
+  if (signingPublicKeyBytes.length !== ED25519_PUBLIC_KEY_BYTES) {
+    throw new Error(
+      `Invalid mm_token signing_public_key length: expected ${ED25519_PUBLIC_KEY_BYTES}, got ${signingPublicKeyBytes.length}`,
+    );
+  }
+
+  const auth = Object.assign(
+    new KwilSigner(async () => signatureData.slice(), signingPublicKeyBytes, "mm_token"),
+    { mmTokenPayload: envelope.payload },
+  );
+
+  return Object.defineProperty(auth, "accessToken", {
+    value: encodedToken,
+    enumerable: false,
+  }) as MmTokenAuth;
+}

package/src/near/create-near-wallet-kwil-signer.ts

@@ -119,7 +119,7 @@ function createNearWalletSigner(
 
 export function implicitAddressFromPublicKey(publicKey: string): string {
   const key_without_prefix = publicKey.replace(/^ed25519:/, "");
-  return hexEncode(bs58Decode(key_without_prefix));
+  return hexEncode(bs58Decode(key_without_prefix), true);
 }
 
 export async function getNearFullAccessPublicKeys(

package/src/signature-verification/index.test.ts

@@ -107,4 +107,22 @@ describe("verifySignature", () => {
 
     expect(result).toBe(true);
   });
+
+  it("rejects MM wallets without trusted capability validation", async () => {
+    vi.clearAllMocks();
+
+    const result = await verifySignature({
+      address: "mm-signing-public-key",
+      signature: "",
+      message: "",
+      wallet_type: "MM",
+      public_key: ["mm-signing-public-key"],
+    });
+
+    expect(result).toBe(false);
+    expect(verifyEvmSignature).not.toHaveBeenCalled();
+    expect(verifyNearSignature).not.toHaveBeenCalled();
+    expect(verifyRippleSignature).not.toHaveBeenCalled();
+    expect(verifyStellarSignature).not.toHaveBeenCalled();
+  });
 });

package/src/signature-verification/index.ts

@@ -18,9 +18,15 @@ export interface WalletSignature {
 
 export const verifySignature = async (walletPayload: WalletSignature): Promise<boolean> => {
   invariant(walletPayload.address, "Wallet address is required");
+  invariant(walletPayload.wallet_type, "Wallet type is required");
+
+  if (walletPayload.wallet_type === "MM") {
+    // MM authentication requires capability validation by a trusted service such as KGW.
+    return false;
+  }
+
   invariant(walletPayload.message, "Wallet message is required");
   invariant(walletPayload.signature, "Wallet signature is required");
-  invariant(walletPayload.wallet_type, "Wallet type is required");
 
   if (walletPayload.wallet_type !== "EVM") {
     invariant(walletPayload.public_key?.[0], "Wallet public_key is required for non-EVM wallets");

package/src/wait-for-kwil-tx.test.ts

@@ -0,0 +1,92 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import { waitForKwilTx } from "./wait-for-kwil-tx";
+
+describe("waitForKwilTx", () => {
+  afterEach(() => {
+    vi.useRealTimers();
+    vi.restoreAllMocks();
+  });
+
+  it("resolves when height > 0 and tx_result.code is 0", async () => {
+    const txInfo = vi
+      .fn()
+      .mockResolvedValueOnce({ data: { height: 0, tx_result: { code: 0, log: "" } } })
+      .mockResolvedValueOnce({
+        data: { height: 42, tx_result: { code: 0, log: "success" } },
+      });
+
+    vi.useFakeTimers();
+    const waitPromise = waitForKwilTx(txInfo, "0xabc", 5_000);
+    await vi.runAllTimersAsync();
+
+    await expect(waitPromise).resolves.toBeUndefined();
+    expect(txInfo).toHaveBeenCalledTimes(2);
+  });
+
+  it("throws KwilTxFailedError when height > 0 and tx_result.code is non-zero", async () => {
+    const txInfo = vi.fn().mockResolvedValue({
+      data: { height: 10, tx_result: { code: 7, log: "action failed" } },
+    });
+
+    await expect(waitForKwilTx(txInfo, "0xdef", 5_000)).rejects.toMatchObject({
+      name: "KwilTxFailedError",
+      txHash: "0xdef",
+      code: 7,
+      log: "action failed",
+      height: 10,
+    });
+    expect(txInfo).toHaveBeenCalledTimes(1);
+  });
+
+  it("retries transient txInfo errors until the tx is finalized", async () => {
+    const txInfo = vi
+      .fn()
+      .mockRejectedValueOnce(new Error("not found"))
+      .mockResolvedValueOnce({
+        data: { height: 3, tx_result: { code: 0, log: "ok" } },
+      });
+
+    vi.useFakeTimers();
+    const waitPromise = waitForKwilTx(txInfo, "0x123", 5_000);
+    await vi.runAllTimersAsync();
+
+    await expect(waitPromise).resolves.toBeUndefined();
+    expect(txInfo).toHaveBeenCalledTimes(2);
+  });
+
+  it("throws KwilTxPollTimeoutError when the deadline is exceeded", async () => {
+    const txInfo = vi.fn().mockResolvedValue({
+      data: { height: 0, tx_result: { code: 0, log: "" } },
+    });
+
+    vi.useFakeTimers();
+    const waitPromise = waitForKwilTx(txInfo, "0x999", 1_000);
+    const assertion = expect(waitPromise).rejects.toMatchObject({
+      name: "KwilTxPollTimeoutError",
+      txHash: "0x999",
+      deadlineMs: 1_000,
+    });
+    await vi.runAllTimersAsync();
+
+    await assertion;
+    expect(txInfo.mock.calls.length).toBeGreaterThan(1);
+  });
+
+  it("includes the last poll error when timing out after persistent failures", async () => {
+    const pollError = new Error("network down");
+    const txInfo = vi.fn().mockRejectedValue(pollError);
+
+    vi.useFakeTimers();
+    const waitPromise = waitForKwilTx(txInfo, "0xbad", 1_000);
+    const assertion = expect(waitPromise).rejects.toMatchObject({
+      name: "KwilTxPollTimeoutError",
+      txHash: "0xbad",
+      message: expect.stringContaining("last error: network down"),
+      cause: pollError,
+    });
+    await vi.runAllTimersAsync();
+
+    await assertion;
+  });
+});

package/src/wait-for-kwil-tx.ts

@@ -0,0 +1,111 @@
+const KWIL_TX_POLL_DEADLINE_MS = 90_000;
+const INITIAL_POLL_INTERVAL_MS = 300;
+const POLL_BACKOFF_FACTOR = 1.5;
+const MAX_POLL_INTERVAL_MS = 2_000;
+const MAX_POLL_JITTER_MS = 100;
+
+export type KwilTxInfo = {
+  height: number;
+  tx_result: {
+    code: number;
+    log: string;
+  };
+};
+
+export class KwilTxFailedError extends Error {
+  readonly name = "KwilTxFailedError";
+
+  constructor(
+    readonly txHash: string,
+    readonly code: number,
+    readonly log: string,
+    readonly height: number,
+  ) {
+    super(`Kwil transaction ${txHash} failed at height ${height} (code ${code}): ${log}`);
+  }
+}
+
+export class KwilTxPollTimeoutError extends Error {
+  readonly name = "KwilTxPollTimeoutError";
+
+  constructor(
+    readonly txHash: string,
+    readonly deadlineMs: number,
+    options?: { cause?: unknown },
+  ) {
+    const lastError =
+      options?.cause instanceof Error
+        ? options.cause.message
+        : options?.cause != null
+          ? String(options.cause)
+          : undefined;
+    super(
+      lastError
+        ? `Timed out after ${deadlineMs}ms waiting for Kwil transaction ${txHash}: last error: ${lastError}`
+        : `Timed out after ${deadlineMs}ms waiting for Kwil transaction ${txHash}`,
+      options?.cause !== undefined ? { cause: options.cause } : undefined,
+    );
+  }
+}
+
+function sleep(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+function nextPollIntervalMs(currentIntervalMs: number): number {
+  return Math.min(currentIntervalMs * POLL_BACKOFF_FACTOR, MAX_POLL_INTERVAL_MS);
+}
+
+function pollIntervalWithJitter(intervalMs: number): number {
+  return intervalMs + Math.floor(Math.random() * (MAX_POLL_JITTER_MS + 1));
+}
+
+function isTxFinalized(txInfo: KwilTxInfo): boolean {
+  return txInfo.height > 0;
+}
+
+export async function waitForKwilTx(
+  txInfo: (txHash: string) => Promise<{ data?: KwilTxInfo }>,
+  txHash: string,
+  deadlineMs: number = KWIL_TX_POLL_DEADLINE_MS,
+): Promise<void> {
+  const deadlineAt = Date.now() + deadlineMs;
+  let intervalMs = INITIAL_POLL_INTERVAL_MS;
+  let lastPollError: unknown;
+
+  while (Date.now() < deadlineAt) {
+    let data: KwilTxInfo | undefined;
+
+    // Transient poll failures (e.g. "not found" before the node indexes the tx) are
+    // recorded and retried. Terminal tx failures are decided below, outside this catch.
+    try {
+      data = (await txInfo(txHash)).data;
+    } catch (error) {
+      lastPollError = error;
+    }
+
+    // height > 0 means the tx was included. Then code 0 is success; anything else is final failure.
+    if (data && isTxFinalized(data)) {
+      if (data.tx_result.code !== 0) {
+        throw new KwilTxFailedError(txHash, data.tx_result.code, data.tx_result.log, data.height);
+      }
+      return;
+    }
+
+    // Not finalized yet (or last poll errored) — back off and try again until the deadline.
+    const waitMs = pollIntervalWithJitter(intervalMs);
+    const remainingMs = deadlineAt - Date.now();
+    if (remainingMs <= 0) {
+      break;
+    }
+
+    await sleep(Math.min(waitMs, remainingMs));
+    intervalMs = nextPollIntervalMs(intervalMs);
+  }
+
+  throw new KwilTxPollTimeoutError(
+    txHash,
+    deadlineMs,
+    lastPollError !== undefined ? { cause: lastPollError } : undefined,
+  );
+}

package/tsdown.config.ts

@@ -2,6 +2,7 @@ import { defineConfig } from "tsdown";
 
 export default defineConfig({
   dts: true,
+  minify: true,
   entry: [
     "./src/index.ts",
     "./src/actions/index.ts",

package/vitest.config.ts

@@ -1,6 +1,10 @@
 import { defineConfig } from "vitest/config";
+
+import { coverageConfig } from "../../vitest.shared";
+
 export default defineConfig({
   test: {
     environment: "jsdom",
+    coverage: coverageConfig,
   },
 });