@0xarshia/policyvault

@arshiaxbt/policyvault

Spend USDC from a PolicyVault on Base under owner-set limits.

Private keys stay in your environment. The website never asks for them.

npm i @arshiaxbt/policyvault

import { createPolicyAgent } from '@arshiaxbt/policyvault';

const agent = createPolicyAgent({
  vaultId: 0n,
  agentPrivateKey: process.env.AGENT_PRIVATE_KEY as `0x${string}`,
});

await agent.spend('0xMerchant…', 0.05, 'exa-search');

Contract (Base): 0xA99bfE8D56A42C4060568C681804D08432Ab2bD5
Builder Code: bc_aby8yf1k

Publish (first time)

The scope must match your npm username exactly (npm whoami).

cd sdk
npm whoami
# if it prints something other than arshiaxbt, edit package.json "name" to @THAT_NAME/policyvault

npm publish --access public --otp=YOUR_2FA_CODE

If you still get 404, your token cannot create packages — create a Granular Access Token with:

• Read and write
• Allow create new packages / unrestricted packages
• Bypass 2FA for automation (optional if you pass --otp)

Then:

npm config set //registry.npmjs.org/:_authToken=npm_YOUR_TOKEN
npm publish --access public --otp=YOUR_2FA_CODE