tapimo 0.14.0 → 0.15.0

package/src/internal/VercelOidc.test.ts

@@ -0,0 +1,188 @@
+import * as jose from 'jose'
+import { defineChain } from 'viem'
+import { tempoMainnet } from 'viem/tempo/chains'
+
+import * as VercelOidc from './VercelOidc.js'
+
+const chainId = 421_700_001
+const issuer = 'https://oidc.vercel.com/privy'
+const kid = 'vercel-test-key'
+const zone = defineChain({
+  ...tempoMainnet,
+  id: chainId,
+  name: 'privy',
+  rpcUrls: { default: { http: ['https://example.com'] } },
+  sourceId: tempoMainnet.id,
+})
+const options = {
+  enforce: true,
+  environments: ['preview', 'production'],
+  issuer,
+  orgIds: ['org_privy', 'org_privy_secondary'],
+  projectIds: ['prj_privy', 'prj_privy_secondary'],
+  teamId: 'team_privy',
+} satisfies VercelOidc.create.Options
+
+describe('create', () => {
+  test('defaults to shadow evaluation', async () => {
+    const policy = VercelOidc.create({
+      environments: options.environments,
+      issuer: options.issuer,
+      orgIds: options.orgIds,
+      projectIds: options.projectIds,
+      teamId: options.teamId,
+    })
+
+    await expect(policy.verify(request(), zone)).resolves.toMatchObject({
+      enforce: false,
+      outcome: 'denied',
+      reason: 'missing',
+    })
+  })
+
+  test('verifies the bearer identity independently from the API key', async () => {
+    const { policy, privateKey } = await setup()
+
+    const credential = await sign(privateKey, { project_id: 'prj_privy_secondary' })
+    await expect(policy.verify(request(credential), zone)).resolves.toMatchObject({
+      chainId,
+      environment: 'production',
+      enforce: true,
+      outcome: 'authorized',
+      reason: 'authorized',
+      token: {
+        header: { alg: 'RS256', kid, typ: 'JWT' },
+        payload: {
+          aud: String(chainId),
+          environment: 'production',
+          exp: expect.any(Number),
+          iat: expect.any(Number),
+          iss: issuer,
+          owner_id: 'team_privy',
+          project_id: 'prj_privy_secondary',
+        },
+      },
+    })
+    const preview = await sign(privateKey, { environment: 'preview' })
+    await expect(policy.verify(request(preview), zone)).resolves.toMatchObject({
+      chainId,
+      environment: 'preview',
+      outcome: 'authorized',
+    })
+  })
+
+  test('rejects a token minted for another Zone', async () => {
+    const { policy, privateKey } = await setup()
+    const credential = await sign(privateKey)
+
+    await expect(
+      policy.verify(request(credential), { ...zone, id: chainId + 1 }),
+    ).resolves.toMatchObject({
+      chainId: chainId + 1,
+      outcome: 'denied',
+      reason: 'invalid',
+    })
+  })
+
+  test('reports missing, invalid, and forbidden credentials', async () => {
+    const { policy, privateKey } = await setup()
+    const forbidden = await sign(privateKey, { project_id: 'prj_other' })
+
+    await expect(policy.verify(request(), zone)).resolves.toMatchObject({
+      outcome: 'denied',
+      reason: 'missing',
+    })
+    await expect(policy.verify(request('invalid'), zone)).resolves.toMatchObject({
+      outcome: 'denied',
+      reason: 'invalid',
+    })
+    await expect(policy.verify(request(forbidden), zone)).resolves.toMatchObject({
+      outcome: 'denied',
+      reason: 'forbidden',
+    })
+  })
+
+  test('reports signing-key service failures without exposing the cause', async () => {
+    const { privateKey } = await jose.generateKeyPair('RS256')
+    const policy = VercelOidc.create(options, {
+      jwks: () => async () => {
+        throw new Error('sensitive upstream detail')
+      },
+    })
+    await expect(policy.verify(request(await sign(privateKey)), zone)).resolves.toMatchObject({
+      outcome: 'error',
+      reason: 'verification_unavailable',
+    })
+  })
+})
+
+describe('authorizationError', () => {
+  test.each([
+    ['missing', 401, 'Authentication required.'],
+    ['invalid', 401, 'Authentication required.'],
+    ['forbidden', 403, 'Access denied.'],
+    ['verification_unavailable', 500, 'Internal server error.'],
+  ] as const)('maps %s to %s', (reason, status, message) => {
+    expect(
+      VercelOidc.authorizationError({ chainId, enforce: true, outcome: 'denied', reason }),
+    ).toMatchObject({ message, status })
+  })
+
+  test('accepts an authorized identity', () => {
+    expect(
+      VercelOidc.authorizationError({
+        chainId,
+        enforce: true,
+        outcome: 'authorized',
+        reason: 'authorized',
+      }),
+    ).toBeUndefined()
+  })
+
+  test('accepts failed shadow evaluations', () => {
+    expect(
+      VercelOidc.authorizationError({
+        chainId,
+        enforce: false,
+        outcome: 'denied',
+        reason: 'missing',
+      }),
+    ).toBeUndefined()
+  })
+})
+
+async function setup() {
+  const { privateKey, publicKey } = await jose.generateKeyPair('RS256', { extractable: true })
+  const jwks = jose.createLocalJWKSet({
+    keys: [{ ...(await jose.exportJWK(publicKey)), kid }],
+  })
+  return { policy: VercelOidc.create(options, { jwks: () => jwks }), privateKey }
+}
+
+type Claims = {
+  environment?: string | undefined
+  project_id?: string | undefined
+}
+
+async function sign(privateKey: jose.CryptoKey, claims: Claims = {}) {
+  return new jose.SignJWT({
+    environment: claims.environment ?? 'production',
+    owner_id: 'team_privy',
+    project_id: 'prj_privy',
+    ...claims,
+  })
+    .setProtectedHeader({ alg: 'RS256', kid, typ: 'JWT' })
+    .setIssuer(issuer)
+    .setAudience(String(chainId))
+    .setIssuedAt()
+    .setExpirationTime('1h')
+    .sign(privateKey)
+}
+
+function request(credential?: string) {
+  const headers = new Headers({ 'tempo-api-key': 'tempo:sk:existing' })
+  if (credential) headers.set('authorization', `Bearer ${credential}`)
+  return new Request('https://api.tempo.xyz', {
+    headers,
+  })
+}

package/src/internal/VercelOidc.ts

@@ -0,0 +1,193 @@
+import * as jose from 'jose'
+import type { Chain } from 'viem'
+import * as z from 'zod/mini'
+
+import type * as Auth from './Auth.js'
+
+namespace schema {
+  export const Token = z.object({
+    header: z.object({
+      alg: z.optional(z.string()),
+      kid: z.optional(z.string()),
+      typ: z.optional(z.string()),
+    }),
+    payload: z.object({
+      aud: z.optional(z.union([z.string(), z.readonly(z.array(z.string()))])),
+      environment: z.optional(z.string()),
+      exp: z.optional(z.number()),
+      iat: z.optional(z.number()),
+      iss: z.optional(z.string()),
+      nbf: z.optional(z.number()),
+      owner: z.optional(z.string()),
+      owner_id: z.optional(z.string()),
+      project: z.optional(z.string()),
+      project_id: z.optional(z.string()),
+      sub: z.optional(z.string()),
+      user_id: z.optional(z.string()),
+    }),
+  })
+
+  export const Options = z.object({
+    enforce: z._default(z.boolean(), false),
+    environments: z
+      .readonly(z.array(z.enum(['development', 'preview', 'production'])))
+      .check(z.minLength(1)),
+    issuer: z.url(),
+    orgIds: z.readonly(z.array(z.string().check(z.minLength(1)))).check(z.minLength(1)),
+    projectIds: z.readonly(z.array(z.string().check(z.minLength(1)))).check(z.minLength(1)),
+    teamId: z.string().check(z.minLength(1)),
+  })
+}
+
+/** Builds an authorization policy for Vercel workload identities accessing mainnet Zones. */
+export function create(options: create.Options, internals: create.Internals = {}): create.Policy {
+  const identity = schema.Options.parse(options)
+  const enforce = identity.enforce
+  const jwks =
+    internals.jwks?.(identity.issuer) ??
+    jose.createRemoteJWKSet(new URL('/.well-known/jwks', identity.issuer))
+
+  async function verify(request: Request, zone: Chain): Promise<Result> {
+    const authorization = request.headers.get('authorization')
+    const credential = /^Bearer\s+(.+)$/i.exec(authorization ?? '')?.[1]
+    if (!credential) return result(enforce, zone.id, 'denied', 'missing')
+    const token = decode(credential)
+    if (!token) return result(enforce, zone.id, 'denied', 'invalid')
+
+    try {
+      const { payload } = await jose.jwtVerify(credential, jwks, {
+        algorithms: ['RS256'],
+        audience: String(zone.id),
+        issuer: identity.issuer,
+        requiredClaims: ['exp'],
+      })
+      const environment = identity.environments.find(
+        (environment) => environment === payload['environment'],
+      )
+      if (
+        environment === undefined ||
+        payload['owner_id'] !== identity.teamId ||
+        !identity.projectIds.includes(String(payload['project_id']))
+      )
+        return result(enforce, zone.id, 'denied', 'forbidden', token)
+      return {
+        ...result(enforce, zone.id, 'authorized', 'authorized', token),
+        environment,
+      }
+    } catch (cause) {
+      if (isInvalidCredentialError(cause))
+        return result(enforce, zone.id, 'denied', 'invalid', token)
+      return result(enforce, zone.id, 'error', 'verification_unavailable', token)
+    }
+  }
+
+  return {
+    applies: (principal) =>
+      principal?.type === 'api_key' && identity.orgIds.includes(principal.orgId),
+    verify,
+  }
+}
+
+/** Returns the HTTP error for a failed workload-identity evaluation. */
+export function authorizationError(result: Result): authorizationError.Options | undefined {
+  if (!result.enforce || result.reason === 'authorized') return undefined
+  if (result.reason === 'forbidden')
+    return {
+      code: 'forbidden',
+      message: 'Access denied.',
+      status: 403,
+    }
+  if (result.reason === 'verification_unavailable')
+    return {
+      code: 'internal_error',
+      message: 'Internal server error.',
+      status: 500,
+    }
+  return {
+    code: 'unauthorized',
+    message: 'Authentication required.',
+    status: 401,
+  }
+}
+
+export declare namespace authorizationError {
+  /** Public error returned when workload-identity authorization fails. */
+  type Options =
+    | { code: 'forbidden'; message: string; status: 403 }
+    | { code: 'internal_error'; message: string; status: 500 }
+    | { code: 'unauthorized'; message: string; status: 401 }
+}
+
+export declare namespace create {
+  /** Test-only key resolver injection. */
+  type Internals = {
+    /** Resolves an issuer's signing keys without a remote fetch. */
+    jwks?: ((issuer: string) => jose.JWTVerifyGetKey) | undefined
+  }
+
+  /** Vercel OIDC verifier configuration grouped by authoritative Zone. */
+  type Options = z.input<typeof schema.Options>
+
+  /** Selects organizations for enforcement and verifies their workload identities. */
+  type Policy = {
+    /** Whether the request principal belongs to a configured organization. */
+    applies: (principal: Auth.Principal | null) => boolean
+    /** Verifies a request's bearer identity against an authoritative Zone. */
+    verify: Verifier
+  }
+
+  /** Verifies a request's bearer identity against an authoritative Zone. */
+  type Verifier = (request: Request, zone: Chain) => Promise<Result>
+}
+
+/** Sanitized Vercel OIDC evaluation emitted with the canonical request log. */
+export type Result = {
+  /** Authoritative Zone chain id evaluated by the policy. */
+  chainId: number
+  /** Whether this evaluation blocks failed requests. */
+  enforce: boolean
+  /** Verified deployment environment, present after successful verification. */
+  environment?: 'development' | 'preview' | 'production' | undefined
+  /** Verification outcome. */
+  outcome: 'authorized' | 'denied' | 'error'
+  /** Sanitized evaluation reason. */
+  reason: 'authorized' | 'forbidden' | 'invalid' | 'missing' | 'verification_unavailable'
+  /** Decoded Vercel JWT fields. The encoded credential and signature are never logged. */
+  token?: z.output<typeof schema.Token> | undefined
+}
+
+function result(
+  enforce: boolean,
+  chainId: number,
+  outcome: Result['outcome'],
+  reason: Result['reason'],
+  token?: Result['token'],
+): Result {
+  if (token) return { chainId, enforce, outcome, reason, token }
+  return { chainId, enforce, outcome, reason }
+}
+
+function decode(credential: string): Result['token'] {
+  try {
+    const parsed = schema.Token.safeParse({
+      header: jose.decodeProtectedHeader(credential),
+      payload: jose.decodeJwt(credential),
+    })
+    return parsed.success ? parsed.data : undefined
+  } catch {
+    return undefined
+  }
+}
+
+function isInvalidCredentialError(cause: unknown) {
+  return (
+    cause instanceof jose.errors.JOSEAlgNotAllowed ||
+    cause instanceof jose.errors.JOSENotSupported ||
+    cause instanceof jose.errors.JWKSNoMatchingKey ||
+    cause instanceof jose.errors.JWSInvalid ||
+    cause instanceof jose.errors.JWSSignatureVerificationFailed ||
+    cause instanceof jose.errors.JWTClaimValidationFailed ||
+    cause instanceof jose.errors.JWTExpired ||
+    cause instanceof jose.errors.JWTInvalid
+  )
+}

package/src/internal/VerifiedTokens.test.ts

@@ -1,6 +1,8 @@
-import type { Context } from 'hono'
+import { Context } from 'hono'
+import { sql } from 'kysely'
 
 import * as TestApp from '../../test/App.js'
+import * as Runtime from '../../test/runtime.js'
 import type * as App from '../App.js'
 import * as Db from '../db/Db.js'
 import * as core_VerifiedTokens from '../db/tables/verifiedTokens.js'
@@ -31,9 +33,11 @@ const unreachable = () =>
 // Minimal context serving the verified-tokens feature config and the app db
 // (both the fresh and cached bindings, as `App.create` sets them).
 function context(db: Db.Db, config?: App.data.VerifiedTokens): Context<App.Environment> {
-  return {
-    get: (key: string) => (key === 'verifiedTokens' ? (config ?? {}) : key === 'db' || key === 'dbCached' ? db : undefined), // prettier-ignore
-  } as unknown as Context<App.Environment>
+  const c = new Context<App.Environment>(new Request('http://localhost'))
+  c.set('db', db)
+  c.set('dbCached', db)
+  c.set('verifiedTokens', config ?? {})
+  return c
 }
 
 const flush = () => new Promise((resolve) => setTimeout(resolve, 0))
@@ -144,8 +148,7 @@ describe('read', () => {
 })
 
 describe('snapshot', () => {
-  // Minimal context stub: `Timing.time` only reads the optional `serverTiming`.
-  const unconfigured = { get: () => undefined } as unknown as Context<App.Environment>
+  const unconfigured = new Context<App.Environment>(new Request('http://localhost'))
 
   test('serves an empty snapshot when the feature is unconfigured', async () => {
     const snapshot = await VerifiedTokens.snapshot(unconfigured, 4217)
@@ -204,6 +207,57 @@ describe('snapshot', () => {
     expect(snapshot.version).toBe('empty')
     expect(snapshot.list).toEqual([])
   })
+
+  test('does not wait for another request to release its database connection', async () => {
+    const chainId = 421700001
+    const db = TestApp.database()
+    await seed(db, chainId, 'v1', tokens)
+    const { rows } = await sql<{ schema: string }>`select current_schema() as schema`.execute(
+      db.kysely,
+    )
+    const blocked = Db.postgres({
+      connectionString: Runtime.postgresUrl,
+      maxConnections: 1,
+      schema: rows[0]!.schema,
+    })
+    const acquired = Promise.withResolvers<void>()
+    const release = Promise.withResolvers<void>()
+    const occupied = blocked.transaction(async () => {
+      acquired.resolve()
+      await release.promise
+    })
+    await acquired.promise
+    const c = context(blocked)
+    const pending = VerifiedTokens.snapshot(c, chainId)
+    const joined = VerifiedTokens.snapshot(c, chainId)
+    const timeout = Promise.withResolvers<string>()
+    const timer = setTimeout(() => timeout.resolve('blocked'), 5_000)
+    try {
+      await expect(
+        Promise.race([
+          VerifiedTokens.snapshot(context(db), chainId).then((snapshot) => snapshot.version),
+          timeout.promise,
+        ]),
+      ).resolves.toMatchInlineSnapshot(`"v1"`)
+      VerifiedTokens.prime(
+        chainId,
+        VerifiedTokens.compile({
+          chainId,
+          tokens,
+          updatedAt: '2024-01-02T00:00:00.000Z',
+          version: 'v2',
+        }),
+      )
+    } finally {
+      clearTimeout(timer)
+      release.resolve()
+      await Promise.all([occupied, pending, joined]).finally(() => blocked.close())
+    }
+    expect(await pending).toBe(await joined)
+    expect((await VerifiedTokens.snapshot(context(db), chainId)).version).toMatchInlineSnapshot(
+      `"v2"`,
+    )
+  })
 })
 
 const newToken = {

package/src/internal/VerifiedTokens.ts

@@ -437,9 +437,9 @@ type Cell = {
 }
 const cells = new Map<ChainId, Cell>()
 
-// Coalesce concurrent refreshes per chain within one isolate so a soft-stale
-// burst triggers a single head check, not one per in-flight request.
-const refreshes = new Map<ChainId, Promise<Snapshot>>()
+// Database I/O belongs to its request. Sharing a pending refresh lets a
+// canceled or stalled request block later readers in the same isolate.
+const refreshes = new WeakMap<Context<App.Environment>, Map<ChainId, Promise<Snapshot>>>()
 
 /**
  * Primes this isolate's in-memory snapshot for a chain. The writer isolate calls
@@ -450,24 +450,24 @@ export function prime(chainId: ChainId, snapshot: Snapshot): void {
   cells.set(chainId, { checkedAt: Date.now(), snapshot })
 }
 
-// Single-flight wrapper around `refreshCell`: concurrent stale/cold reads for a
-// chain share one in-flight refresh.
+// Coalesce repeated lookups within the request that owns the database I/O.
 function refresh(
   c: Context<App.Environment>,
-  db: Db.Db,
   chainId: ChainId,
   cell: Cell | undefined,
 ): Promise<Snapshot> {
-  const existing = refreshes.get(chainId)
+  const pending = refreshes.get(c) ?? new Map<ChainId, Promise<Snapshot>>()
+  refreshes.set(c, pending)
+  const existing = pending.get(chainId)
   if (existing) return existing
   const flight = (async () => {
     try {
-      return await refreshCell(c, db, chainId, cell)
+      return await refreshCell(c, Db.get(c.get('dbCached')), chainId, cell)
     } finally {
-      refreshes.delete(chainId)
+      pending.delete(chainId)
     }
   })()
-  refreshes.set(chainId, flight)
+  pending.set(chainId, flight)
   return flight
 }
 
@@ -486,7 +486,8 @@ async function refreshCell(
   if (!cell) {
     const loaded = await Timing.time(c, 'verified_snapshot', () => read(db, chainId))
     const snapshot = loaded ?? emptySnapshot(chainId)
-    cells.set(chainId, { checkedAt: Date.now(), snapshot })
+    // A concurrent refresh or publish may already have replaced this cell.
+    if (cells.get(chainId) === cell) cells.set(chainId, { checkedAt: Date.now(), snapshot })
     return snapshot
   }
 
@@ -496,30 +497,26 @@ async function refreshCell(
     const head = await Timing.time(c, 'verified_head', () => readHead(db, chainId))
     // Unchanged version (or head not yet present): keep snapshot, bump checkedAt.
     if (!head || head.version === cell.snapshot.version) {
-      cells.set(chainId, { checkedAt: Date.now(), snapshot: cell.snapshot })
+      if (cells.get(chainId) === cell)
+        cells.set(chainId, { checkedAt: Date.now(), snapshot: cell.snapshot })
       return cell.snapshot
     }
     // Version changed: reload the current list (kept on a racing delete).
     const snapshot =
       (await Timing.time(c, 'verified_snapshot', () => read(db, chainId))) ?? cell.snapshot
-    cells.set(chainId, { checkedAt: Date.now(), snapshot })
+    if (cells.get(chainId) === cell) cells.set(chainId, { checkedAt: Date.now(), snapshot })
     return snapshot
   } catch (error) {
     console.error('[verified-tokens] refresh failed; serving last good snapshot', error)
-    cells.set(chainId, { checkedAt: Date.now(), snapshot: cell.snapshot })
+    if (cells.get(chainId) === cell)
+      cells.set(chainId, { checkedAt: Date.now(), snapshot: cell.snapshot })
     return cell.snapshot
   }
 }
 
 /**
- * Returns the compiled verified-token {@link Snapshot} for a chain.
- *
- * When the verified-tokens feature is unconfigured, serves an empty snapshot.
- * When configured, serves a per-isolate snapshot backed by the app database,
- * refreshed on a soft TTL: fresh lookups do zero database I/O; soft-stale
- * lookups return the current snapshot immediately and refresh in the background
- * (single-flight, head-only unless the version changed); a cold isolate loads
- * from the database (an empty snapshot when no head exists).
+ * Returns a chain's compiled verified-token snapshot. Fresh reads use memory,
+ * stale reads refresh in the request's background, and cold reads load from the database.
  */
 export async function snapshot(c: Context<App.Environment>, chainId: ChainId): Promise<Snapshot> {
   return Timing.time(c, 'verified_tokens', () => {
@@ -535,7 +532,7 @@ export async function snapshot(c: Context<App.Environment>, chainId: ChainId): P
 
     // Soft-stale: serve immediately, refresh in the background. Never blocks.
     if (cell) {
-      const inflight = refresh(c, Db.get(c.get('dbCached')), chainId, cell)
+      const inflight = refresh(c, chainId, cell)
       // Workers cancel post-response I/O unless kept alive via `waitUntil`;
       // without it the refresh dies mid-query and publishes never propagate.
       // Node has no execution context, and fire-and-forget survives there.
@@ -548,7 +545,7 @@ export async function snapshot(c: Context<App.Environment>, chainId: ChainId): P
     }
 
     // Cold: must load before the first response.
-    return refresh(c, Db.get(c.get('dbCached')), chainId, undefined)
+    return refresh(c, chainId, undefined)
   })
 }
 

package/src/internal/Viem.batch.test.ts

@@ -0,0 +1,80 @@
+import * as http from 'node:http'
+
+import * as Viem from './Viem.js'
+
+describe('createBatchClient', () => {
+  test('cancels an in-flight batch without cancelling another batch or its deadline', async () => {
+    const started = Promise.withResolvers<void>()
+    let received = 0
+    const server = http.createServer((request) => {
+      request.resume()
+      if (++received === 2) started.resolve()
+    })
+    await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve))
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    try {
+      const address = server.address()
+      if (!address || typeof address === 'string') throw new Error('Expected a TCP server address.')
+      const client = Viem.createBatchClient({ rpc: { url: `http://127.0.0.1:${address.port}` } })
+      const controller = new AbortController()
+      const cancelled = client
+        .request({ method: 'eth_blockNumber' }, { retryCount: 0, signal: controller.signal })
+        .catch((error) => error)
+      const active = client
+        .request({ method: 'eth_blockNumber' }, { retryCount: 0 })
+        .catch((error) => error)
+      await vi.advanceTimersByTimeAsync(0)
+      await started.promise
+      controller.abort()
+      await expect(cancelled).resolves.toHaveProperty('name', 'AbortError')
+      await vi.advanceTimersByTimeAsync(10_000)
+      await expect(active).resolves.toHaveProperty('name', 'TimeoutError')
+    } finally {
+      vi.useRealTimers()
+      server.closeAllConnections()
+      await new Promise<void>((resolve, reject) =>
+        server.close((error) => (error ? reject(error) : resolve())),
+      )
+    }
+  })
+
+  test.each([false, true])(
+    'times out a stalled batch with caller signal %s',
+    async (withSignal) => {
+      const started = Promise.withResolvers<void>()
+      const server = http.createServer((request) => {
+        request.resume()
+        started.resolve()
+      })
+      await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve))
+      vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+      try {
+        const address = server.address()
+        if (!address || typeof address === 'string')
+          throw new Error('Expected a TCP server address.')
+        const client = Viem.createBatchClient({ rpc: { url: `http://127.0.0.1:${address.port}` } })
+        let failure: unknown
+        const pending = client
+          .request(
+            { method: 'eth_blockNumber' },
+            { retryCount: 0, ...(withSignal ? { signal: new AbortController().signal } : {}) },
+          )
+          .catch((error) => {
+            failure = error
+          })
+        await vi.advanceTimersByTimeAsync(0)
+        await started.promise
+        await vi.advanceTimersByTimeAsync(10_000)
+        await vi.waitFor(() => expect(failure).toHaveProperty('name', 'TimeoutError'))
+        await pending
+        expect(Viem.requestFailure(failure)?.failure).toBe('timeout')
+      } finally {
+        vi.useRealTimers()
+        server.closeAllConnections()
+        await new Promise<void>((resolve, reject) =>
+          server.close((error) => (error ? reject(error) : resolve())),
+        )
+      }
+    },
+  )
+})