@absol-labs/agent 0.6.0 → 0.7.0

package/src/wallet/autonomous-wallet-broker.ts

@@ -0,0 +1,764 @@
+import { createPublicKey, randomUUID, verify } from "node:crypto";
+
+import {
+  formatRequestForAuthorizationSignature,
+  type PrivyClient,
+} from "@privy-io/node";
+import { streamEscrowV2Abi } from "@absol-labs/shared";
+import {
+  decodeFunctionData,
+  getAddress,
+  isAddress,
+  type Address,
+  type Hex,
+} from "viem";
+import { z } from "zod";
+
+import {
+  autonomousProofBytes,
+  AUTONOMOUS_WALLET_CHAIN_ID,
+  AUTONOMOUS_WALLET_VERSION,
+  type AutonomousWalletBroker as AutonomousWalletClientBroker,
+  type AutonomousWalletProof,
+  type PreparedPrivyRequest,
+} from "./autonomous-wallet-protocol.js";
+import { invocationCapabilitySchema } from "../capability/invocation-capability.js";
+import {
+  invocationCapabilityDomainName,
+  invocationCapabilityDomainVersion,
+} from "../capability/invocation-capability.js";
+import {
+  PRIVY_POLICY_MAX_DURATION_SECONDS,
+  PRIVY_POLICY_MAX_RATE_USDC,
+  PRIVY_POLICY_MAX_TOTAL_USDC,
+  PRIVY_BROKER_ESCROW,
+  PRIVY_BROKER_USDC,
+  type BrokerStreamReader,
+} from "./privy-session-broker.js";
+
+const transactionSchema = z.object({
+  from: z.string().refine(isAddress),
+  to: z.string().refine(isAddress),
+  data: z.string().regex(/^0x[0-9a-fA-F]*$/),
+  value: z.union([z.string(), z.number(), z.bigint()]).optional(),
+  chainId: z.union([z.string(), z.number()]).optional(),
+});
+
+const typedDataSchema = z.object({
+  domain: z.object({
+    name: z.string(),
+    version: z.string(),
+    chainId: z.union([z.string(), z.number()]),
+    verifyingContract: z.string().refine(isAddress),
+  }),
+  primaryType: z.literal("InvocationCapability"),
+  types: z.record(z.array(z.object({ name: z.string(), type: z.string() }))),
+  message: z.record(z.unknown()),
+});
+
+export interface AutonomousWalletBrokerStore {
+  findProvisionByPublicKey(
+    publicKey: string,
+  ): Promise<AutonomousWalletProvision | null>;
+  findProvisionByNonce(
+    nonce: string,
+  ): Promise<AutonomousWalletProvision | null>;
+  putProvision(provision: AutonomousWalletProvision): Promise<void>;
+  getPrepared(requestId: string): Promise<AutonomousPreparedRequest | null>;
+  putPrepared(request: AutonomousPreparedRequest): Promise<void>;
+  completePrepared(
+    requestId: string,
+    result: Hex,
+    consumedAt: number,
+  ): Promise<AutonomousPreparedRequest | null>;
+}
+
+export interface AutonomousWalletProvision {
+  readonly publicKey: string;
+  readonly nonce: string;
+  readonly walletId: string;
+  readonly address: Address;
+  readonly policyId: string;
+}
+
+export interface AutonomousPreparedRequest extends PreparedPrivyRequest {
+  readonly publicKey: string;
+  readonly idempotencyKey: string;
+  readonly requestExpiryMs: number;
+  readonly body: Record<string, unknown>;
+  readonly consumedAt?: number;
+  readonly result?: Hex;
+}
+
+export interface AutonomousPrivyProvider {
+  createWallet(input: {
+    readonly publicKey: string;
+    readonly policyId: string;
+    readonly idempotencyKey: string;
+  }): Promise<{
+    readonly walletId: string;
+    readonly address: Address;
+    readonly policyId: string;
+  }>;
+  executeRpc(input: {
+    readonly walletId: string;
+    readonly body: Record<string, unknown>;
+    readonly idempotencyKey: string;
+    readonly requestExpiryMs: number;
+    readonly signature: string;
+  }): Promise<Hex>;
+}
+
+export class AutonomousWalletBrokerError extends Error {
+  constructor(
+    readonly code:
+      | "invalid-request"
+      | "unauthorized"
+      | "replay"
+      | "policy-denied"
+      | "provider-error",
+    message: string,
+    options?: { readonly cause?: unknown },
+  ) {
+    super(message, options);
+    this.name = "AutonomousWalletBrokerError";
+  }
+}
+
+export interface AutonomousWalletBrokerOptions {
+  readonly appId: string;
+  /** The one policy that is approved for Metrik autonomous wallets. */
+  readonly policyId: string;
+  readonly provider: AutonomousPrivyProvider;
+  readonly store: AutonomousWalletBrokerStore;
+  readonly streamReader: BrokerStreamReader;
+  readonly nowSeconds?: () => number;
+  readonly proofMaxAgeSeconds?: number;
+  readonly requestTtlSeconds?: number;
+  /** Must match the base URL used by the Privy client, without a trailing slash. */
+  readonly privyApiBaseUrl?: string;
+}
+
+/**
+ * Broker for the agent-owned path. The server knows the wallet ID and Privy
+ * app credentials, but never receives or stores the agent's private key. Every
+ * RPC is frozen into a short-lived request; the agent signs those exact bytes,
+ * then the broker forwards that signature as Privy's authorization context.
+ */
+export class AutonomousWalletBroker implements AutonomousWalletClientBroker {
+  private readonly locks = new Map<string, Promise<void>>();
+  private readonly nowSeconds: () => number;
+  private readonly proofMaxAge: number;
+  private readonly requestTtl: number;
+  private readonly privyApiBaseUrl: string;
+
+  constructor(private readonly options: AutonomousWalletBrokerOptions) {
+    if (options.appId.trim() === "" || options.policyId.trim() === "") {
+      throw new AutonomousWalletBrokerError(
+        "invalid-request",
+        "Privy app id and fixed policy id are required",
+      );
+    }
+    this.nowSeconds =
+      options.nowSeconds ?? (() => Math.floor(Date.now() / 1_000));
+    this.proofMaxAge = options.proofMaxAgeSeconds ?? 300;
+    this.requestTtl = options.requestTtlSeconds ?? 60;
+    if (
+      !Number.isInteger(this.proofMaxAge) ||
+      this.proofMaxAge < 1 ||
+      !Number.isInteger(this.requestTtl) ||
+      this.requestTtl < 1
+    ) {
+      throw new AutonomousWalletBrokerError(
+        "invalid-request",
+        "proof and request TTLs must be positive integers",
+      );
+    }
+    const base = options.privyApiBaseUrl ?? "https://api.privy.io";
+    const url = new URL(base);
+    if (url.protocol !== "https:")
+      throw new AutonomousWalletBrokerError(
+        "invalid-request",
+        "Privy API URL must use HTTPS",
+      );
+    url.search = "";
+    url.hash = "";
+    this.privyApiBaseUrl = url.toString().replace(/\/$/, "");
+  }
+
+  async provision(
+    input: Parameters<AutonomousWalletClientBroker["provision"]>[0],
+  ) {
+    // A single provisioning lock closes both the public-key and nonce races.
+    // Provisioning is rare and Privy is the dominant latency, so serializing it
+    // is preferable to creating two wallets for concurrent conflicting proofs.
+    return this.withLock("provision", () => this.provisionUnlocked(input));
+  }
+
+  private async provisionUnlocked(
+    input: Parameters<AutonomousWalletClientBroker["provision"]>[0],
+  ) {
+    if (
+      input.appId !== this.options.appId ||
+      input.chainId !== AUTONOMOUS_WALLET_CHAIN_ID
+    ) {
+      throw new AutonomousWalletBrokerError(
+        "invalid-request",
+        "autonomous wallet request is for an unsupported app or chain",
+      );
+    }
+    if (input.proof.nonce !== input.idempotencyKey) {
+      throw new AutonomousWalletBrokerError(
+        "unauthorized",
+        "proof nonce does not match idempotency key",
+      );
+    }
+    verifyProof(
+      input.proof,
+      input.publicKey,
+      this.options.appId,
+      this.nowSeconds(),
+      this.proofMaxAge,
+    );
+    const byNonce = await this.options.store.findProvisionByNonce(
+      input.idempotencyKey,
+    );
+    if (byNonce !== null) {
+      if (byNonce.publicKey !== input.publicKey)
+        throw new AutonomousWalletBrokerError(
+          "replay",
+          "provisioning nonce is already bound to another key",
+        );
+      return byNonce;
+    }
+    const existing = await this.options.store.findProvisionByPublicKey(
+      input.publicKey,
+    );
+    if (existing !== null) {
+      if (existing.nonce !== input.idempotencyKey)
+        throw new AutonomousWalletBrokerError(
+          "replay",
+          "public key is already bound to another provisioning nonce",
+        );
+      return existing;
+    }
+    let created: Awaited<ReturnType<AutonomousPrivyProvider["createWallet"]>>;
+    try {
+      created = await this.options.provider.createWallet({
+        publicKey: input.publicKey,
+        policyId: this.options.policyId,
+        idempotencyKey: input.idempotencyKey,
+      });
+    } catch (error) {
+      throw new AutonomousWalletBrokerError(
+        "provider-error",
+        "Privy rejected autonomous wallet creation",
+        { cause: error },
+      );
+    }
+    if (created.policyId !== this.options.policyId) {
+      throw new AutonomousWalletBrokerError(
+        "provider-error",
+        "Privy returned a wallet without the approved Metrik policy",
+      );
+    }
+    const result: AutonomousWalletProvision = {
+      ...created,
+      publicKey: input.publicKey,
+      nonce: input.idempotencyKey,
+    };
+    await this.options.store.putProvision(result);
+    return result;
+  }
+
+  async prepare(
+    input: Parameters<AutonomousWalletClientBroker["prepare"]>[0],
+  ): Promise<PreparedPrivyRequest> {
+    const provision = await this.options.store.findProvisionByPublicKey(
+      input.publicKey,
+    );
+    if (provision === null || provision.walletId !== input.walletId)
+      throw new AutonomousWalletBrokerError(
+        "unauthorized",
+        "wallet is not bound to this public key",
+      );
+    const body = await buildRpcBody(
+      input.method,
+      input.params,
+      provision.address,
+      this.options.streamReader,
+      this.nowSeconds(),
+    );
+    const requestExpiryMs = (this.nowSeconds() + this.requestTtl) * 1_000;
+    const idempotencyKey = randomUUID();
+    const requestId = randomUUID();
+    const payload = formatRequestForAuthorizationSignature({
+      version: 1,
+      method: "POST",
+      url: `${this.privyApiBaseUrl}/v1/wallets/${input.walletId}/rpc`,
+      body,
+      headers: {
+        "privy-app-id": this.options.appId,
+        "privy-idempotency-key": idempotencyKey,
+        "privy-request-expiry": String(requestExpiryMs),
+      },
+    });
+    const prepared: AutonomousPreparedRequest = {
+      requestId,
+      walletId: input.walletId,
+      publicKey: input.publicKey,
+      method: input.method,
+      payload: Buffer.from(payload).toString("base64"),
+      expiresAt: Math.floor(requestExpiryMs / 1_000),
+      requestExpiryMs,
+      idempotencyKey,
+      body,
+    };
+    await this.options.store.putPrepared(prepared);
+    return prepared;
+  }
+
+  async execute(
+    input: Parameters<AutonomousWalletClientBroker["execute"]>[0],
+  ): Promise<Hex> {
+    return this.withLock(input.requestId, async () => {
+      const prepared = await this.options.store.getPrepared(input.requestId);
+      if (prepared === null)
+        throw new AutonomousWalletBrokerError(
+          "replay",
+          "prepared request was already consumed or does not exist",
+        );
+      if (prepared.publicKey !== input.publicKey)
+        throw new AutonomousWalletBrokerError(
+          "unauthorized",
+          "request signer does not match the prepared public key",
+        );
+      if (prepared.result !== undefined) return prepared.result;
+      if (prepared.consumedAt !== undefined)
+        throw new AutonomousWalletBrokerError(
+          "replay",
+          "prepared request was already consumed",
+        );
+      if (this.nowSeconds() >= prepared.expiresAt)
+        throw new AutonomousWalletBrokerError(
+          "replay",
+          "prepared request has expired",
+        );
+      verifyP256Signature(
+        prepared.publicKey,
+        Buffer.from(prepared.payload, "base64"),
+        input.signature,
+      );
+      let result: Hex;
+      try {
+        result = await this.options.provider.executeRpc({
+          walletId: prepared.walletId,
+          body: prepared.body,
+          idempotencyKey: prepared.idempotencyKey,
+          requestExpiryMs: prepared.requestExpiryMs,
+          signature: input.signature,
+        });
+      } catch (error) {
+        throw new AutonomousWalletBrokerError(
+          "provider-error",
+          "Privy rejected the agent authorization signature",
+          { cause: error },
+        );
+      }
+      const completed = await this.options.store.completePrepared(
+        input.requestId,
+        result,
+        this.nowSeconds(),
+      );
+      if (completed === null)
+        throw new AutonomousWalletBrokerError(
+          "replay",
+          "prepared request disappeared before completion",
+        );
+      return result;
+    });
+  }
+
+  private async withLock<T>(
+    id: string,
+    operation: () => Promise<T>,
+  ): Promise<T> {
+    const previous = this.locks.get(id) ?? Promise.resolve();
+    let release!: () => void;
+    const next = new Promise<void>((resolve) => {
+      release = resolve;
+    });
+    const queued = previous.then(() => next);
+    this.locks.set(id, queued);
+    await previous;
+    try {
+      return await operation();
+    } finally {
+      release();
+      if (this.locks.get(id) === queued) this.locks.delete(id);
+    }
+  }
+}
+
+/** Adapts the installed @privy-io/node client without giving it an agent key. */
+export function createPrivyAutonomousProvider(
+  client: PrivyClient,
+): AutonomousPrivyProvider {
+  return {
+    async createWallet(input) {
+      const wallet = await client.wallets().create({
+        chain_type: "ethereum",
+        owner: { public_key: input.publicKey },
+        policy_ids: [input.policyId],
+        idempotency_key: input.idempotencyKey,
+      });
+      return {
+        walletId: wallet.id,
+        address: getAddress(wallet.address),
+        policyId: wallet.policy_ids[0] ?? "",
+      };
+    },
+    async executeRpc(input) {
+      const response: unknown = await client.wallets().rpc(input.walletId, {
+        ...input.body,
+        authorization_context: { signatures: [input.signature] },
+        idempotency_key: input.idempotencyKey,
+        request_expiry: input.requestExpiryMs,
+      } as never);
+      const data = (response as { readonly data?: unknown }).data;
+      if (data === null || typeof data !== "object")
+        throw new Error("Privy returned an invalid RPC response");
+      const record = data as Record<string, unknown>;
+      const result = record.hash ?? record.signature;
+      if (typeof result !== "string" || !/^0x[0-9a-fA-F]+$/.test(result))
+        throw new Error("Privy returned no transaction/signature result");
+      return result as Hex;
+    },
+  };
+}
+
+export class InMemoryAutonomousWalletBrokerStore implements AutonomousWalletBrokerStore {
+  private readonly provisions = new Map<string, AutonomousWalletProvision>();
+  private readonly prepared = new Map<string, AutonomousPreparedRequest>();
+  async findProvisionByPublicKey(key: string) {
+    return this.provisions.get(key) ?? null;
+  }
+  async findProvisionByNonce(nonce: string) {
+    return [...this.provisions.values()].find((p) => p.nonce === nonce) ?? null;
+  }
+  async putProvision(value: AutonomousWalletProvision) {
+    this.provisions.set(value.publicKey, value);
+  }
+  async getPrepared(id: string) {
+    return this.prepared.get(id) ?? null;
+  }
+  async putPrepared(value: AutonomousPreparedRequest) {
+    this.prepared.set(value.requestId, value);
+  }
+  async completePrepared(id: string, result: Hex, consumedAt: number) {
+    const value = this.prepared.get(id);
+    if (value === undefined) return null;
+    if (value.result !== undefined) return value;
+    const consumed = { ...value, consumedAt, result };
+    this.prepared.set(id, consumed);
+    return consumed;
+  }
+}
+
+function verifyProof(
+  proof: AutonomousWalletProof,
+  publicKey: string,
+  appId: string,
+  now: number,
+  maxAge: number,
+): void {
+  if (
+    proof.version !== AUTONOMOUS_WALLET_VERSION ||
+    proof.appId !== appId ||
+    proof.chainId !== AUTONOMOUS_WALLET_CHAIN_ID ||
+    proof.publicKey !== publicKey ||
+    !Number.isSafeInteger(proof.issuedAt) ||
+    proof.issuedAt > now + 30 ||
+    proof.issuedAt < now - maxAge ||
+    !/^[A-Za-z0-9+/]+={0,2}$/.test(proof.signature)
+  )
+    throw new AutonomousWalletBrokerError(
+      "unauthorized",
+      "invalid autonomous wallet proof",
+    );
+  try {
+    const key = parseP256PublicKey(publicKey);
+    if (
+      !verify(
+        "sha256",
+        autonomousProofBytes(proof),
+        key,
+        Buffer.from(proof.signature, "base64"),
+      )
+    )
+      throw new Error("signature mismatch");
+  } catch (error) {
+    throw new AutonomousWalletBrokerError(
+      "unauthorized",
+      "invalid autonomous wallet proof signature",
+      { cause: error },
+    );
+  }
+}
+
+function verifyP256Signature(
+  publicKey: string,
+  payload: Uint8Array,
+  signature: string,
+): void {
+  try {
+    const key = parseP256PublicKey(publicKey);
+    if (
+      !isStrictBase64(signature) ||
+      !verify("sha256", payload, key, Buffer.from(signature, "base64"))
+    ) {
+      throw new Error("signature mismatch");
+    }
+  } catch (error) {
+    throw new AutonomousWalletBrokerError(
+      "unauthorized",
+      "invalid prepared-request signature",
+      { cause: error },
+    );
+  }
+}
+
+function parseP256PublicKey(value: string) {
+  if (!isStrictBase64(value))
+    throw new Error("public key is not strict base64");
+  const key = createPublicKey({
+    key: Buffer.from(value, "base64"),
+    format: "der",
+    type: "spki",
+  });
+  if (
+    key.asymmetricKeyType !== "ec" ||
+    key.asymmetricKeyDetails?.namedCurve !== "prime256v1"
+  ) {
+    throw new Error("public key is not a P-256 key");
+  }
+  return key;
+}
+
+function isStrictBase64(value: string): boolean {
+  if (!/^[A-Za-z0-9+/]+={0,2}$/.test(value) || value.length % 4 === 1)
+    return false;
+  const decoded = Buffer.from(value, "base64");
+  return decoded.length > 0 && decoded.toString("base64") === value;
+}
+
+async function buildRpcBody(
+  method: "eth_sendTransaction" | "eth_signTypedData_v4",
+  params: readonly unknown[],
+  address: Address,
+  streamReader: BrokerStreamReader,
+  now: number,
+): Promise<Record<string, unknown>> {
+  if (method === "eth_sendTransaction") {
+    const tx = transactionSchema.parse(params[0]);
+    if (tx.from.toLowerCase() !== address.toLowerCase())
+      throw new AutonomousWalletBrokerError(
+        "policy-denied",
+        "transaction sender does not match wallet",
+      );
+    assertChain(tx.chainId);
+    assertZeroValue(tx.value);
+    const target = getAddress(tx.to).toLowerCase();
+    if (target === PRIVY_BROKER_USDC.toLowerCase()) {
+      assertUsdcApproval(tx.data as Hex);
+    } else if (target === PRIVY_BROKER_ESCROW.toLowerCase()) {
+      await assertEscrowMethod(tx.data as Hex, address, streamReader);
+    } else {
+      throw new AutonomousWalletBrokerError(
+        "policy-denied",
+        "transaction target is not allowlisted",
+      );
+    }
+    const { chainId: _chainId, ...transaction } = tx;
+    return {
+      method,
+      chain_type: "ethereum",
+      caip2: "eip155:84532",
+      params: { transaction: normalizeJson(transaction) },
+    };
+  }
+  const signer = params[0];
+  const typed =
+    typeof params[1] === "string"
+      ? (JSON.parse(params[1]) as unknown)
+      : params[1];
+  if (
+    typeof signer !== "string" ||
+    signer.toLowerCase() !== address.toLowerCase()
+  )
+    throw new AutonomousWalletBrokerError(
+      "policy-denied",
+      "typed-data signer does not match wallet",
+    );
+  const parsed = typedDataSchema.parse(typed);
+  if (
+    parsed.domain.chainId !== AUTONOMOUS_WALLET_CHAIN_ID &&
+    Number(parsed.domain.chainId) !== AUTONOMOUS_WALLET_CHAIN_ID
+  )
+    throw new AutonomousWalletBrokerError(
+      "policy-denied",
+      "typed data is not for Base Sepolia",
+    );
+  if (
+    parsed.domain.name !== invocationCapabilityDomainName ||
+    parsed.domain.version !== invocationCapabilityDomainVersion ||
+    parsed.domain.verifyingContract.toLowerCase() !==
+      PRIVY_BROKER_ESCROW.toLowerCase()
+  )
+    throw new AutonomousWalletBrokerError(
+      "policy-denied",
+      "only Metrik invocation capabilities may be signed",
+    );
+  const capability = invocationCapabilitySchema.parse({
+    ...parsed.message,
+    expiry:
+      typeof parsed.message.expiry === "string"
+        ? Number(parsed.message.expiry)
+        : parsed.message.expiry,
+  });
+  if (
+    capability.buyer.toLowerCase() !== address.toLowerCase() ||
+    capability.expiry <= now ||
+    capability.expiry > now + 120
+  ) {
+    throw new AutonomousWalletBrokerError(
+      "policy-denied",
+      "capability buyer or expiry is outside the autonomous wallet policy",
+    );
+  }
+  const stream = await streamReader.getStream(capability.streamId as Hex);
+  if (
+    stream.status !== "active" ||
+    stream.buyer.toLowerCase() !== address.toLowerCase() ||
+    stream.serviceRef.toLowerCase() !== capability.serviceRef.toLowerCase()
+  ) {
+    throw new AutonomousWalletBrokerError(
+      "policy-denied",
+      "capability does not match an active buyer stream",
+    );
+  }
+  return {
+    method,
+    chain_type: "ethereum",
+    caip2: "eip155:84532",
+    params: { typed_data: normalizeJson(parsed) },
+  };
+}
+
+function normalizeJson(value: unknown): unknown {
+  if (typeof value === "bigint") return `0x${value.toString(16)}`;
+  if (Array.isArray(value)) return value.map(normalizeJson);
+  if (value !== null && typeof value === "object") {
+    return Object.fromEntries(
+      Object.entries(value).map(([key, item]) => [key, normalizeJson(item)]),
+    );
+  }
+  return value;
+}
+
+function assertChain(value: string | number | undefined): void {
+  if (value === undefined) return;
+  const parsed =
+    typeof value === "number"
+      ? value
+      : value.startsWith("0x")
+        ? Number.parseInt(value.slice(2), 16)
+        : Number(value);
+  if (parsed !== AUTONOMOUS_WALLET_CHAIN_ID)
+    throw new AutonomousWalletBrokerError(
+      "policy-denied",
+      "transaction is not for Base Sepolia",
+    );
+}
+
+function assertZeroValue(value: string | number | bigint | undefined): void {
+  if (value === undefined) return;
+  try {
+    if (BigInt(value) !== 0n) throw new Error("nonzero");
+  } catch (error) {
+    throw new AutonomousWalletBrokerError(
+      "policy-denied",
+      "native-token transfers are not allowed",
+      { cause: error },
+    );
+  }
+}
+
+function assertUsdcApproval(data: Hex): void {
+  try {
+    const decoded = decodeFunctionData({
+      abi: [
+        {
+          type: "function",
+          name: "approve",
+          stateMutability: "nonpayable",
+          inputs: [
+            { name: "spender", type: "address" },
+            { name: "amount", type: "uint256" },
+          ],
+          outputs: [{ name: "", type: "bool" }],
+        },
+      ] as const,
+      data,
+    });
+    const [spender, amount] = decoded.args;
+    if (
+      spender.toLowerCase() !== PRIVY_BROKER_ESCROW.toLowerCase() ||
+      amount > 1_000_000n
+    )
+      throw new Error("approval outside Metrik policy");
+  } catch (error) {
+    throw new AutonomousWalletBrokerError(
+      "policy-denied",
+      "USDC approval is not an allowlisted escrow approval",
+      { cause: error },
+    );
+  }
+}
+
+async function assertEscrowMethod(
+  data: Hex,
+  address: Address,
+  streamReader: BrokerStreamReader,
+): Promise<void> {
+  try {
+    const decoded = decodeFunctionData({ abi: streamEscrowV2Abi, data });
+    if (decoded.functionName === "openStream") {
+      const [, , deposit, rate, duration] = decoded.args;
+      if (
+        deposit > PRIVY_POLICY_MAX_TOTAL_USDC ||
+        rate > PRIVY_POLICY_MAX_RATE_USDC ||
+        duration > BigInt(PRIVY_POLICY_MAX_DURATION_SECONDS)
+      ) {
+        throw new Error("openStream exceeds the fixed Metrik policy");
+      }
+      return;
+    }
+    if (
+      decoded.functionName !== "close" &&
+      decoded.functionName !== "reclaim" &&
+      decoded.functionName !== "reclaimUnverified"
+    ) {
+      throw new Error("escrow method is not allowlisted");
+    }
+    const stream = await streamReader.getStream(decoded.args[0]);
+    if (stream.buyer.toLowerCase() !== address.toLowerCase())
+      throw new Error("autonomous wallet is not the stream buyer");
+  } catch (error) {
+    throw new AutonomousWalletBrokerError(
+      "policy-denied",
+      "escrow call is outside the fixed Metrik policy",
+      { cause: error },
+    );
+  }
+}