@idos-network/kwil-infra 4.0.0 → 5.0.0

package/src/actions/actions.ts

@@ -435,6 +435,100 @@ export const actionSchema: Record<string, ActionSchemaElement[]> = {
       type: DataType.Text,
     },
   ],
+  get_user_as_mm_operator: [
+    {
+      name: "storage_token",
+      type: DataType.Text,
+    },
+  ],
+  create_user_as_mm_operator: [
+    {
+      name: "id",
+      type: DataType.Uuid,
+    },
+    {
+      name: "recipient_encryption_public_key",
+      type: DataType.Text,
+    },
+    {
+      name: "wallet_id",
+      type: DataType.Uuid,
+    },
+    {
+      name: "storage_token",
+      type: DataType.Text,
+    },
+  ],
+  get_credentials_as_mm_operator: [
+    {
+      name: "user_id",
+      type: DataType.Uuid,
+    },
+    {
+      name: "storage_token",
+      type: DataType.Text,
+    },
+  ],
+  create_preliminary_credential_as_mm_operator: [
+    {
+      name: "request_id",
+      type: DataType.Uuid,
+    },
+    {
+      name: "user_id",
+      type: DataType.Uuid,
+    },
+    {
+      name: "credential_id",
+      type: DataType.Uuid,
+    },
+    {
+      name: "issuer_auth_public_key",
+      type: DataType.Text,
+    },
+    {
+      name: "encryptor_public_key",
+      type: DataType.Text,
+    },
+    {
+      name: "content_uri",
+      type: DataType.Text,
+    },
+    {
+      name: "content_size",
+      type: DataType.Int,
+    },
+    {
+      name: "content_hash",
+      type: DataType.Text,
+    },
+    {
+      name: "public_notes",
+      type: DataType.Text,
+    },
+    {
+      name: "public_notes_signature",
+      type: DataType.Text,
+    },
+    {
+      name: "broader_signature",
+      type: DataType.Text,
+    },
+    {
+      name: "storage_token",
+      type: DataType.Text,
+    },
+  ],
+  request_user_wipe_as_mm_operator: [
+    {
+      name: "user_id",
+      type: DataType.Uuid,
+    },
+    {
+      name: "storage_token",
+      type: DataType.Text,
+    },
+  ],
   add_attribute_as_inserter: [
     {
       name: "id",
@@ -770,33 +864,27 @@ export const UpsertWalletAsInserterInputSchema: z.ZodObject<{
   user_id: z.ZodUUID;
   address: z.ZodString;
   public_key: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-  wallet_type: z.ZodType<WalletType>;
-  not_before: z.ZodOptional<z.ZodNullable<z.ZodISODateTime>>;
-  not_after: z.ZodOptional<z.ZodNullable<z.ZodISODateTime>>;
+  wallet_type: z.ZodType<AddWalletType>;
+  not_before: z.ZodISODateTime;
+  not_after: z.ZodISODateTime;
   signature: z.ZodString;
-}> = z
-  .object({
-    id: z.uuid(),
-    user_id: z.uuid(),
-    address: z.string(),
-    public_key: z.string().nullish(),
-    wallet_type: walletTypeSchema,
-    not_before: rfc3339DateTimeSchema.nullish(),
-    not_after: rfc3339DateTimeSchema.nullish(),
-    signature: z.string(),
-  })
-  .refine((v) => (v.wallet_type === "MM") === (v.not_before == null), {
-    path: ["not_before"],
-    message: "not_before must be null when wallet_type is MM, and set otherwise",
-  })
-  .refine((v) => (v.wallet_type === "MM") === (v.not_after == null), {
-    path: ["not_after"],
-    message: "not_after must be null when wallet_type is MM, and set otherwise",
-  });
+}> = z.object({
+  id: z.uuid(),
+  user_id: z.uuid(),
+  address: z.string(),
+  public_key: z.string().nullish(),
+  wallet_type: addWalletTypeSchema,
+  not_before: rfc3339DateTimeSchema,
+  not_after: rfc3339DateTimeSchema,
+  signature: z.string(),
+});
 
 export type UpsertWalletAsInserterInput = z.infer<typeof UpsertWalletAsInserterInputSchema>;
 
-/**  WALLET ACTIONS */
+/**
+ *  WALLET ACTIONS
+ *  Existing MM wallets count too: a key can't be both an MM wallet and another wallet.
+ */
 export async function upsertWalletAsInserter(
   kwilClient: KwilActionClient,
   params: UpsertWalletAsInserterInput,
@@ -918,6 +1006,10 @@ export const RemoveWalletInputSchema: z.ZodObject<{
 
 export type RemoveWalletInput = z.infer<typeof RemoveWalletInputSchema>;
 
+/**
+ *  A user may have an MM wallet next to others (created before MM operators). Without it
+ *  the user is no longer an MM user, and its ukyc:// credentials could never be wiped.
+ */
 export async function removeWallet(
   kwilClient: KwilActionClient,
   params: RemoveWalletInput,
@@ -995,6 +1087,10 @@ export type CreatePreliminaryCredentialInput = z.infer<
   typeof CreatePreliminaryCredentialInputSchema
 >;
 
+/**
+ *  Refused for MM users, also when signed in with another wallet: their MM operator stages
+ *  their credentials (create_preliminary_credential_as_mm_operator), with their storage token.
+ */
 export async function createPreliminaryCredential(
   kwilClient: KwilActionClient,
   params: CreatePreliminaryCredentialInput,
@@ -1194,6 +1290,7 @@ export const SharePreliminaryCredentialInputSchema: z.ZodObject<{
 
 export type SharePreliminaryCredentialInput = z.infer<typeof SharePreliminaryCredentialInputSchema>;
 
+/**  Refused for MM users, also when signed in with another wallet: their credentials can't be shared. */
 export async function sharePreliminaryCredential(
   kwilClient: KwilActionClient,
   params: SharePreliminaryCredentialInput,
@@ -1266,6 +1363,7 @@ export type CreatePreliminaryCredentialsByDwgInput = z.infer<
  *  Delegated write credential actions
  *  For access grant
  *  We will use the same ids for preliminary credentials as for credentials, so we need to check if they already exist
+ *  MM users are managed by their MM operator only.
  *  We capture gas upfront to prevent the real credential from being created if the gas is not enough
  *  The gas can be refunded fully or partially
  *  Temporary: an issuer is not an inserter/caller. A user grants a DWG to an issuer_key;
@@ -1445,6 +1543,198 @@ export async function getSiblingCredentialId(
     .then((result) => result[0]);
 }
 
+export const GetUserAsMmOperatorInputSchema: z.ZodObject<{
+  storage_token: z.ZodString;
+}> = z.object({
+  storage_token: z.string(),
+});
+
+export type GetUserAsMmOperatorInput = z.infer<typeof GetUserAsMmOperatorInputSchema>;
+
+export const GetUserAsMmOperatorOutputSchema: z.ZodObject<{
+  id: z.ZodUUID;
+  recipient_encryption_public_key: z.ZodString;
+  frozen: z.ZodBoolean;
+}> = z.object({
+  id: z.uuid(),
+  recipient_encryption_public_key: z.string(),
+  frozen: z.boolean(),
+});
+
+export type GetUserAsMmOperatorOutput = z.infer<typeof GetUserAsMmOperatorOutputSchema>;
+
+/**
+ *  MM OPERATOR ACTIONS
+ *  An MM operator (see mm_operators) creates MM users, stages their ukyc:// credentials and
+ *  freezes them for a data wipe. It only acts on the MM users it created, and every action
+ *  also needs a valid UKYC storage token ($storage_token, the bare base64url envelope) minted
+ *  by the user's app: the operator key alone can't do anything to an MM user. Tokens are
+ *  verified at @block_timestamp (the last block's time in view calls).
+ */
+export async function getUserAsMmOperator(
+  kwilClient: KwilActionClient,
+  params: GetUserAsMmOperatorInput,
+): Promise<GetUserAsMmOperatorOutput[]> {
+  const inputs = GetUserAsMmOperatorInputSchema.parse(params);
+  return await kwilClient.call<GetUserAsMmOperatorOutput[]>({
+    name: "get_user_as_mm_operator",
+    inputs,
+  });
+}
+
+export const CreateUserAsMmOperatorInputSchema: z.ZodObject<{
+  id: z.ZodUUID;
+  recipient_encryption_public_key: z.ZodString;
+  wallet_id: z.ZodUUID;
+  storage_token: z.ZodString;
+}> = z.object({
+  id: z.uuid(),
+  recipient_encryption_public_key: z.string(),
+  wallet_id: z.uuid(),
+  storage_token: z.string(),
+});
+
+export type CreateUserAsMmOperatorInput = z.infer<typeof CreateUserAsMmOperatorInputSchema>;
+
+/**  The MM wallet key is the storage token's signing key (write token). */
+export async function createUserAsMmOperator(
+  kwilClient: KwilActionClient,
+  params: CreateUserAsMmOperatorInput,
+): Promise<void> {
+  const inputs = CreateUserAsMmOperatorInputSchema.parse(params);
+  await kwilClient.execute({
+    name: "create_user_as_mm_operator",
+    inputs,
+    description: "Create an MM user with its MM wallet as an MM operator",
+  });
+}
+
+export const GetCredentialsAsMmOperatorInputSchema: z.ZodObject<{
+  user_id: z.ZodUUID;
+  storage_token: z.ZodString;
+}> = z.object({
+  user_id: z.uuid(),
+  storage_token: z.string(),
+});
+
+export type GetCredentialsAsMmOperatorInput = z.infer<typeof GetCredentialsAsMmOperatorInputSchema>;
+
+export const GetCredentialsAsMmOperatorOutputSchema: z.ZodObject<{
+  id: z.ZodUUID;
+  user_id: z.ZodUUID;
+  public_notes: z.ZodString;
+  content_uri: z.ZodString;
+  content_size: z.ZodNumber;
+  encryptor_public_key: z.ZodString;
+  issuer_auth_public_key: z.ZodString;
+  inserter_type: z.ZodString;
+  inserter_id: z.ZodString;
+}> = z.object({
+  id: z.uuid(),
+  user_id: z.uuid(),
+  public_notes: z.string(),
+  content_uri: z.string(),
+  content_size: z.number(),
+  encryptor_public_key: z.string(),
+  issuer_auth_public_key: z.string(),
+  inserter_type: z.string(),
+  inserter_id: z.string(),
+});
+
+export type GetCredentialsAsMmOperatorOutput = z.infer<
+  typeof GetCredentialsAsMmOperatorOutputSchema
+>;
+
+/**  Needs a read token of the user for the user's storage. */
+export async function getCredentialsAsMmOperator(
+  kwilClient: KwilActionClient,
+  params: GetCredentialsAsMmOperatorInput,
+): Promise<GetCredentialsAsMmOperatorOutput[]> {
+  const inputs = GetCredentialsAsMmOperatorInputSchema.parse(params);
+  return await kwilClient.call<GetCredentialsAsMmOperatorOutput[]>({
+    name: "get_credentials_as_mm_operator",
+    inputs,
+  });
+}
+
+export const CreatePreliminaryCredentialAsMmOperatorInputSchema: z.ZodObject<{
+  request_id: z.ZodUUID;
+  user_id: z.ZodUUID;
+  credential_id: z.ZodUUID;
+  issuer_auth_public_key: z.ZodString;
+  encryptor_public_key: z.ZodString;
+  content_uri: z.ZodString;
+  content_size: z.ZodNumber;
+  content_hash: z.ZodString;
+  public_notes: z.ZodString;
+  public_notes_signature: z.ZodString;
+  broader_signature: z.ZodString;
+  storage_token: z.ZodString;
+}> = z.object({
+  request_id: z.uuid(),
+  user_id: z.uuid(),
+  credential_id: z.uuid(),
+  issuer_auth_public_key: z.string(),
+  encryptor_public_key: z.string(),
+  content_uri: blobContentUriSchema,
+  content_size: contentSizeSchema,
+  content_hash: z.string(),
+  public_notes: z.string(),
+  public_notes_signature: z.string(),
+  broader_signature: z.string(),
+  storage_token: z.string(),
+});
+
+export type CreatePreliminaryCredentialAsMmOperatorInput = z.infer<
+  typeof CreatePreliminaryCredentialAsMmOperatorInputSchema
+>;
+
+/**
+ *  Like create_preliminary_credential, for an MM user. The issuer signs with the user's MM
+ *  wallet public key as the recipient wallet. Needs a write token of the user; the content URI's
+ *  storage must be the token's storage and the user's storage (the first credential defines it).
+ */
+export async function createPreliminaryCredentialAsMmOperator(
+  kwilClient: KwilActionClient,
+  params: CreatePreliminaryCredentialAsMmOperatorInput,
+): Promise<void> {
+  const inputs = CreatePreliminaryCredentialAsMmOperatorInputSchema.parse(params);
+  await kwilClient.execute({
+    name: "create_preliminary_credential_as_mm_operator",
+    inputs,
+    description: "Create a preliminary ukyc:// credential for an MM user as its MM operator",
+  });
+}
+
+export const RequestUserWipeAsMmOperatorInputSchema: z.ZodObject<{
+  user_id: z.ZodUUID;
+  storage_token: z.ZodString;
+}> = z.object({
+  user_id: z.uuid(),
+  storage_token: z.string(),
+});
+
+export type RequestUserWipeAsMmOperatorInput = z.infer<
+  typeof RequestUserWipeAsMmOperatorInputSchema
+>;
+
+/**
+ *  Freezes the MM user: no new credentials, no reads, no finalize. The gateway deletes the
+ *  user once the UKYC storage is deleted (finalize_mm_user_wipe_as_gateway). No cancel.
+ *  Needs a delete token of the user for the user's storage, also when already requested.
+ */
+export async function requestUserWipeAsMmOperator(
+  kwilClient: KwilActionClient,
+  params: RequestUserWipeAsMmOperatorInput,
+): Promise<void> {
+  const inputs = RequestUserWipeAsMmOperatorInputSchema.parse(params);
+  await kwilClient.execute({
+    name: "request_user_wipe_as_mm_operator",
+    inputs,
+    description: "Request a data wipe of an MM user as its MM operator",
+  });
+}
+
 export const AddAttributeAsInserterInputSchema: z.ZodObject<{
   id: z.ZodUUID;
   user_id: z.ZodUUID;

package/src/create-kgw-authenticated-fetch.test.ts

@@ -1,7 +1,6 @@
 // @vitest-environment node
 
 import { type KwilSigner, NodeKwil } from "@idos-network/kwil-js";
-import { base64UrlEncode, utf8Encode } from "@idos-network/utils/codecs";
 import { describe, expect, it, vi } from "vitest";
 
 import {
@@ -9,19 +8,6 @@ import {
   createKgwAuthenticatedFetch,
 } from "./create-kgw-authenticated-fetch";
 import { KwilActionClient } from "./create-kwil-client";
-import { createMmTokenAuth } from "./mm-token/create-mm-token-kwil-signer";
-
-const mmEnvelopeToken = base64UrlEncode(
-  utf8Encode(
-    JSON.stringify({
-      payload: {
-        signing_public_key: base64UrlEncode(new Uint8Array(32).fill(7)),
-        storage_id: "storage-abc",
-      },
-      signature: base64UrlEncode(new Uint8Array(64).fill(9)),
-    }),
-  ),
-);
 
 function createTestClient(
   initialCookie?: string,
@@ -279,6 +265,33 @@ describe("createKgwAuthenticatedFetch", () => {
     expect(cookieHeader(fetchFn.mock.calls[0])).toBe("kgw_session=valid; Path=/");
   });
 
+  it.each(["MM_TOKEN_INVALID", "MM_TOKEN_EXPIRED"])(
+    "does not reauthenticate when blob-gateway rejects the storage token (%s)",
+    async (code) => {
+      const { authFetch, fetchFn, refresh } = createTestClient("kgw_session=valid; Path=/");
+      fetchFn.mockResolvedValueOnce(Response.json({ error: "token", code }, { status: 401 }));
+
+      const response = await authFetch("https://blob.example/blob/v1/storage");
+
+      expect(response.status).toBe(401);
+      await expect(response.json()).resolves.toMatchObject({ code });
+      expect(refresh).not.toHaveBeenCalled();
+      expect(fetchFn).toHaveBeenCalledTimes(1);
+    },
+  );
+
+  it("logs in to KGW again when blob-gateway reports a missing session", async () => {
+    const { authFetch, fetchFn, refresh } = createTestClient("kgw_session=expired; Path=/");
+    fetchFn.mockResolvedValueOnce(
+      Response.json({ error: "session", code: "WIPE_UNAUTHORIZED" }, { status: 401 }),
+    );
+
+    await authFetch("https://blob.example/blob/v1/storage", { method: "DELETE" });
+
+    expect(refresh).toHaveBeenCalledTimes(1);
+    expect(fetchFn).toHaveBeenCalledTimes(2);
+  });
+
   it("shares one refresh across parallel auth failures", async () => {
     const { authFetch, fetchFn, refresh } = createTestClient("kgw_session=expired; Path=/");
     fetchFn
@@ -347,17 +360,7 @@ describe("createKgwAuthenticatedBlobGateway", () => {
     return new KwilActionClient(nodeKwil);
   }
 
-  it("infers UKYC authorization from an MM signer", () => {
-    const gateway = createKgwAuthenticatedBlobGateway({
-      url: "https://blob.example",
-      kwilClient: kgwSessionClient(),
-      signer: createMmTokenAuth(mmEnvelopeToken),
-    });
-
-    expect(gateway.hasAccessToken).toBe(true);
-  });
-
-  it("accepts an explicit MM authority for a non-MM signer, and none otherwise", () => {
+  it("sends a storage token only when one is given", () => {
     const kwilClient = kgwSessionClient();
     const signer = {} as KwilSigner;
 
@@ -366,7 +369,7 @@ describe("createKgwAuthenticatedBlobGateway", () => {
         url: "https://blob.example",
         kwilClient,
         signer,
-        mmAuth: createMmTokenAuth(mmEnvelopeToken),
+        accessToken: "storage-token",
       }).hasAccessToken,
     ).toBe(true);
     expect(
@@ -374,4 +377,21 @@ describe("createKgwAuthenticatedBlobGateway", () => {
         .hasAccessToken,
     ).toBe(false);
   });
+
+  it("sends the KGW cookie and the storage token on the same request", async () => {
+    const fetchFn = vi.fn<typeof fetch>(async () => new Response(null, { status: 204 }));
+    const gateway = createKgwAuthenticatedBlobGateway({
+      url: "https://blob.example",
+      kwilClient: kgwSessionClient(),
+      signer: {} as KwilSigner,
+      fetchFn,
+    }).withAccessToken("storage-token");
+
+    await gateway.deleteStorage();
+
+    const [, init] = fetchFn.mock.calls[0];
+    const headers = new Headers(init?.headers);
+    expect(headers.get("Cookie")).toBe("kgw_session=valid; Path=/");
+    expect(headers.get("Authorization")).toBe("AccessToken storage-token");
+  });
 });

package/src/create-kgw-authenticated-fetch.ts

@@ -2,9 +2,6 @@ import { type KwilSigner, NodeKwil } from "@idos-network/kwil-js";
 import { BlobGateway, type BlobGatewayParams } from "@idos-network/utils/blob-gateway";
 
 import type { KwilActionClient } from "./create-kwil-client";
-import type { MmTokenAuth } from "./mm-token/create-mm-token-kwil-signer";
-
-import { isMmTokenAuth } from "./mm-token/create-mm-token-kwil-signer";
 
 const KGW_AUTH_ERROR_CODE = -901;
 
@@ -23,10 +20,10 @@ export type CreateKgwAuthenticatedBlobGatewayParams = CreateKgwAuthenticatedFetc
   url: string;
   maxFetchBytes?: BlobGatewayParams["maxFetchBytes"];
   /**
-   * UKYC storage authority for blob requests. Defaults to `signer` when that signer
-   * is itself an MM authentication object, so the capability is never passed twice.
+   * UKYC storage token, sent as `Authorization: AccessToken <token>` next to the KGW session
+   * cookie. Only MM operators use it; `BlobGateway.withAccessToken()` swaps it per request.
    */
-  mmAuth?: MmTokenAuth;
+  accessToken?: string;
 };
 
 type KgwSessionNodeKwil = NodeKwil & {
@@ -37,16 +34,13 @@ type KgwSessionNodeKwil = NodeKwil & {
 export function createKgwAuthenticatedBlobGateway({
   url,
   maxFetchBytes,
-  mmAuth,
+  accessToken,
   ...fetchParams
 }: CreateKgwAuthenticatedBlobGatewayParams): BlobGateway {
-  const storageAuth =
-    mmAuth ?? (isMmTokenAuth(fetchParams.signer) ? fetchParams.signer : undefined);
-
   return new BlobGateway({
     url,
     maxFetchBytes,
-    accessToken: storageAuth?.accessToken,
+    accessToken,
     fetchFn: createKgwAuthenticatedFetch(fetchParams),
   });
 }
@@ -302,20 +296,22 @@ function withCookie(
   return [input, { ...init, headers }];
 }
 
-async function defaultKgwAuthFailurePredicate(response: Response): Promise<boolean> {
-  if (response.status === 401) {
-    return true;
-  }
+// blob-gateway also answers 401 for a bad UKYC storage token. A new KGW session doesn't fix that.
+const STORAGE_TOKEN_AUTH_ERROR_CODES = new Set(["MM_TOKEN_INVALID", "MM_TOKEN_EXPIRED"]);
 
+async function defaultKgwAuthFailurePredicate(response: Response): Promise<boolean> {
   const contentType = response.headers.get("content-type");
   if (!contentType?.includes("application/json")) {
-    return false;
+    return response.status === 401;
   }
 
   try {
-    const body = (await response.json()) as { error?: { code?: number } };
+    const body = (await response.json()) as { code?: unknown; error?: { code?: number } };
+    if (response.status === 401) {
+      return !(typeof body.code === "string" && STORAGE_TOKEN_AUTH_ERROR_CODES.has(body.code));
+    }
     return body.error?.code === KGW_AUTH_ERROR_CODE;
   } catch {
-    return false;
+    return response.status === 401;
   }
 }

package/src/create-kwil-client.test.ts

@@ -0,0 +1,40 @@
+import type { NodeKwil } from "@idos-network/kwil-js";
+
+import { describe, expect, it, vi } from "vitest";
+
+import { KwilActionClient, KwilCallError } from "./create-kwil-client";
+
+function clientAnswering(data: { result?: unknown[]; error?: string }) {
+  const call = vi.fn(async () => ({ status: 200, data }));
+  return new KwilActionClient({ call } as unknown as NodeKwil);
+}
+
+const params = { name: "get_user_as_mm_operator", inputs: { storage_token: "t" } } as const;
+
+describe("KwilActionClient.call", () => {
+  it("resolves to an empty result for a failed view by default", async () => {
+    const client = clientAnswering({ result: [], error: "storage token: expired" });
+
+    await expect(client.call(params)).resolves.toEqual([]);
+  });
+
+  it("throws KwilCallError with the action error when throwOnCallError is set", async () => {
+    const client = clientAnswering({ result: [], error: "storage token: expired" });
+    client.throwOnCallError = true;
+
+    const error = await client.call(params).catch((e: unknown) => e);
+
+    expect(error).toBeInstanceOf(KwilCallError);
+    expect(error).toMatchObject({
+      actionName: "get_user_as_mm_operator",
+      message: "storage token: expired",
+    });
+  });
+
+  it("returns the rows of a successful view when throwOnCallError is set", async () => {
+    const client = clientAnswering({ result: [{ id: "1" }] });
+    client.throwOnCallError = true;
+
+    await expect(client.call(params)).resolves.toEqual([{ id: "1" }]);
+  });
+});

package/src/create-kwil-client.ts

@@ -36,12 +36,33 @@ type AllKwilExecuteAction = {
 
 type KwilExecuteActionRequestParams = AllKwilExecuteAction[ActionName];
 
+/**
+ * A view action ran but failed (its `error()` or a runtime error). kwild reports that in the
+ * call response's `error` field, not as an HTTP/RPC error, so it is only thrown when
+ * `KwilActionClient.throwOnCallError` is set.
+ */
+export class KwilCallError extends Error {
+  readonly name = "KwilCallError";
+
+  constructor(
+    readonly actionName: string,
+    message: string,
+  ) {
+    super(message);
+  }
+}
+
 /**
  * A client for interacting with kwil with type-safe abstractions for `call` and `execute`.
  * Has utility methods for creating actions and setting a signer.
  */
 export class KwilActionClient {
   signer?: KwilSigner;
+  /**
+   * When true, `call` throws `KwilCallError` if the view action reports an error. When false
+   * (default) such a call resolves to its (empty) result, as it always has.
+   */
+  throwOnCallError = false;
   readonly client: NodeKwil | WebKwil;
 
   constructor(client: NodeKwil | WebKwil) {
@@ -81,6 +102,10 @@ export class KwilActionClient {
     };
 
     const response = await this.client.call(action as CallBody, signer);
+    const actionError = response?.data?.error;
+    if (this.throwOnCallError && actionError) {
+      throw new KwilCallError(params.name, actionError);
+    }
     return response?.data?.result as T;
   }