@kairoguard/sdk 0.0.9 → 0.0.10

package/dist/cli.js

@@ -198,6 +198,16 @@ async function cmdVaultProvision(args) {
     const res = await kairo.provision(walletId, policyId, stableId);
     console.log(JSON.stringify(res, null, 2));
 }
+async function cmdReaffirm(args) {
+    const walletId = requireFlag(args, "--wallet-id", "dwalletId");
+    const cfg = requireConfig();
+    const kairo = new KairoClient({
+        apiKey: cfg.apiKey,
+        backendUrl: cfg.backendUrl,
+    });
+    const res = await kairo.reaffirmBinding(walletId);
+    console.log(JSON.stringify(res, null, 2));
+}
 async function cmdReceiptMint(args) {
     const policyId = requireFlag(args, "--policy-id", "objectId");
     const bindingId = requireFlag(args, "--binding-id", "objectId");
@@ -264,6 +274,7 @@ Wallet & Policy:
   policy-details --policy-id <id>   Get policy details
   vault-status --wallet-id <id>     Check vault registration
   vault-provision --wallet-id <id> --policy-id <id> [--stable-id <id>]
+  reaffirm --wallet-id <id>         Reaffirm a wallet's current policy binding
   receipt-mint --policy-id <id> --binding-id <id> --destination <hex> --intent-hash <hex>
 
 Utility:
@@ -294,6 +305,8 @@ async function main() {
             return cmdVaultStatus(rest);
         case "vault-provision":
             return cmdVaultProvision(rest);
+        case "reaffirm":
+            return cmdReaffirm(rest);
         case "receipt-mint":
             return cmdReceiptMint(rest);
         case "audit":

package/dist/client.d.ts

@@ -196,7 +196,6 @@ export declare class KairoClient {
     private mintPolicyReceipt;
     private resolvePolicyVersion;
     private isReaffirmRequiredError;
-    private requestSignWithReaffirmRetry;
     private computeUserSignMessageWithExtensionFallback;
     private rebuildSigningMaterialFromChain;
     private resolveEvmRpcUrl;

package/dist/client.js

@@ -237,13 +237,25 @@ export class KairoClient {
         if (!wallet.bindingObjectId?.startsWith("0x")) {
             throw new Error("Wallet is missing bindingObjectId. Provision the wallet before reaffirming.");
         }
-        const result = await this.backend.reaffirmPolicyBinding({
-            bindingObjectId: wallet.bindingObjectId,
-        });
-        return {
-            digest: result.digest,
-            activeVersionObjectId: result.activeVersionObjectId,
-        };
+        try {
+            const result = await this.backend.reaffirmPolicyBinding({
+                bindingObjectId: wallet.bindingObjectId,
+            });
+            return {
+                digest: result.digest,
+                activeVersionObjectId: result.activeVersionObjectId,
+            };
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            const governedGuardTriggered = /binding is governed/i.test(message) ||
+                /requires governance receipt flow/i.test(message) ||
+                /execute-and-reaffirm/i.test(message);
+            if (governedGuardTriggered) {
+                throw new Error("Binding is governed and cannot be directly reaffirmed. Complete governance execute-and-reaffirm first, then retry signing.");
+            }
+            throw error;
+        }
     }
     /**
      * Governance-first policy update: creates a new policy + version, then proposes
@@ -431,36 +443,52 @@ export class KairoClient {
             destinationHex: "0x0000000000000000000000000000000000000000",
             nativeValue: 0n,
         };
-        const policyReceiptId = await this.mintPolicyReceipt(wallet, policyContext);
+        const initialPolicyReceiptId = await this.mintPolicyReceipt(wallet, policyContext);
         const dWalletCapId = wallet.dWalletCapId;
         if (!dWalletCapId) {
             throw new Error("Wallet record is missing dWalletCapId. Recreate/provision this wallet before signing.");
         }
-        const resolvedPolicyVersion = await this.resolvePolicyVersion(wallet, opts?.policyVersion);
-        const req = await this.requestSignWithReaffirmRetry(wallet, {
-            dWalletId: wallet.walletId,
-            dWalletCapId,
-            encryptedUserSecretKeyShareId: wallet.encryptedUserSecretKeyShareId ?? "",
-            userOutputSignature: [],
-            presignId,
-            messageHex: messageHexNoPrefix,
-            userSignMessage: Array.from(userSignMessage),
-            policyReceiptId,
-            policyBindingObjectId: wallet.bindingObjectId,
-            policyObjectId: wallet.policyObjectId,
-            policyVersion: resolvedPolicyVersion,
-            ethTx: opts?.ethTx,
-        });
-        if (!req.success) {
-            throw new Error(`Failed to request sign for wallet ${walletId}`);
+        if (!presignId) {
+            throw new Error("Missing presignId after presign creation.");
         }
-        const signStatus = await this.pollSignStatus(req.requestId);
-        return {
-            requestId: req.requestId,
-            signId: signStatus.signId,
-            presignId,
-            signatureHex: ensureHexPrefix(signStatus.signatureHex),
+        const resolvedPolicyVersion = await this.resolvePolicyVersion(wallet, opts?.policyVersion);
+        const submitAndPoll = async (policyReceiptId) => {
+            const req = await this.backend.requestSign({
+                dWalletId: wallet.walletId,
+                dWalletCapId,
+                encryptedUserSecretKeyShareId: wallet.encryptedUserSecretKeyShareId ?? "",
+                userOutputSignature: [],
+                presignId,
+                messageHex: messageHexNoPrefix,
+                userSignMessage: Array.from(userSignMessage),
+                policyReceiptId,
+                policyBindingObjectId: wallet.bindingObjectId,
+                policyObjectId: wallet.policyObjectId,
+                policyVersion: resolvedPolicyVersion,
+                ethTx: opts?.ethTx,
+            });
+            if (!req.success) {
+                throw new Error(`Failed to request sign for wallet ${walletId}`);
+            }
+            const signStatus = await this.pollSignStatus(req.requestId);
+            return {
+                requestId: req.requestId,
+                signId: signStatus.signId,
+                presignId,
+                signatureHex: ensureHexPrefix(signStatus.signatureHex),
+            };
         };
+        try {
+            return await submitAndPoll(initialPolicyReceiptId);
+        }
+        catch (error) {
+            if (!this.isReaffirmRequiredError(error))
+                throw error;
+            await this.reaffirmBinding(wallet.walletId);
+            // Reaffirm changes active binding version; mint a fresh receipt bound to the new version.
+            const retriedPolicyReceiptId = await this.mintPolicyReceipt(wallet, policyContext);
+            return submitAndPoll(retriedPolicyReceiptId);
+        }
     }
     async signEvm(params) {
         const wallet = this.requireWalletRecord(params.walletId);
@@ -711,17 +739,6 @@ export class KairoClient {
         const message = err instanceof Error ? err.message : String(err);
         return /requires confirmation/i.test(message) || /reaffirm/i.test(message);
     }
-    async requestSignWithReaffirmRetry(wallet, payload) {
-        try {
-            return await this.backend.requestSign(payload);
-        }
-        catch (error) {
-            if (!this.isReaffirmRequiredError(error))
-                throw error;
-            await this.reaffirmBinding(wallet.walletId);
-            return this.backend.requestSign(payload);
-        }
-    }
     async computeUserSignMessageWithExtensionFallback(wallet, protocolParams, presignBytes, messageBytes) {
         try {
             return await createUserSignMessageWithPublicOutput(protocolParams, new Uint8Array(wallet.userPublicOutput), new Uint8Array(wallet.userSecretKeyShare), presignBytes, messageBytes, Hash.KECCAK256, SignatureAlgorithm.ECDSASecp256k1, Curve.SECP256K1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kairoguard/sdk",
-  "version": "0.0.9",
+  "version": "0.0.10",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",