Govern the wallet.
Then let it move.

npm install arcanum-sdk viem

import { ArcanumClient } from "arcanum-sdk";
import { ARC_MAINNET_RPC_URL, arcMainnet, usdcErc20 } from "arcanum-sdk/chains";
import { formatUnits } from "viem";

const walletAddress = process.env.GUARDED_WALLET;
const vendorAddress = process.env.VENDOR_ADDRESS;
if (!walletAddress || !vendorAddress) {
  throw new Error("Set GUARDED_WALLET and VENDOR_ADDRESS first.");
}

// The SDK chain definition is sourced from Arc's current Mainnet config.
// Arc's native USDC gas balance uses 18 decimals.
const client = new ArcanumClient({
  walletAddress,
  chain: arcMainnet,
  rpcUrl: process.env.ARC_MAINNET_RPC ?? ARC_MAINNET_RPC_URL,
});

const policy = await client.getPolicy();
// GuardedWallet policy and ERC20 USDC amounts use six-decimal token units.
console.log("Per-tx cap:", formatUnits(policy.perTxCap, 6), "USDC");

const allowed = await client.simulate({
  to: vendorAddress,
  amount: usdcErc20(1),
});
console.log("Vendor verdict:", allowed.verdict, allowed.reason);

const denied = await client.simulate({
  to: vendorAddress,
  amount: usdcErc20(1000000),
});
console.log("Large payment verdict:", denied.verdict, denied.reason);

import { WalletFactoryAbi } from "arcanum-sdk";
import { ARC_MAINNET_RPC_URL, arcMainnet } from "arcanum-sdk/chains";
import { createWalletClient, http, parseUnits } from "viem";
import { privateKeyToAccount } from "viem/accounts";

const operatorKey = process.env.OPERATOR_KEY;
const agentSigner = process.env.AGENT_SIGNER_ADDRESS;
if (!operatorKey || !agentSigner) {
  throw new Error("Set OPERATOR_KEY and AGENT_SIGNER_ADDRESS first.");
}

// The operator account owns the Doctrine. Arc native USDC gas uses 18 decimals;
// GuardedWallet policy values below are ERC20 USDC base units (6 decimals).
const account = privateKeyToAccount(operatorKey);
const walletClient = createWalletClient({
  account,
  chain: arcMainnet,
  transport: http(process.env.ARC_MAINNET_RPC ?? ARC_MAINNET_RPC_URL),
});

// Current Arc Mainnet deployment manifest:
// packages/contracts/deployments/arc-mainnet.json
const WALLET_FACTORY = "0x7077A28C003D9274d45263b04Ac9cB9a58Ab5342";

const policy = {
  perTxCap: parseUnits("50", 6),
  daily24hCap: parseUnits("500", 6),
  monthlyCap: parseUnits("5000", 6), // wallet-wide monthly cap
  allowedCategories: 0b11111n,
  escalationThreshold: parseUnits("25", 6),
  requireAllowlist: true,
  freezeOnBlockedVendor: true,
};

const council = [account.address]; // use additional approvers for a real quorum

const txHash = await walletClient.writeContract({
  address: WALLET_FACTORY,
  abi: WalletFactoryAbi,
  functionName: "createWallet",
  args: [account.address, "ResearchAgent", policy, [agentSigner], council, 1, 3600],
});
console.log("Deployed:", txHash);