fn get_asset(env: soroban_sdk::Env) -> Resultfn is_frozen(env: soroban_sdk::Env) -> boolKeep the account and its code from being archived. Every call to the account does this as well; this exists so nobody has to make a payment just to keep it alive.
fn extend_ttl(env: soroban_sdk::Env)The recorded payment with this nonce, for as long as it counts toward the velocity window.
fn get_payment(
env: soroban_sdk::Env,
nonce: soroban_sdk::BytesN<32>,
) -> Optionfn is_merchant(env: soroban_sdk::Env, merchant_pubkey: soroban_sdk::BytesN<32>) -> boolfn __check_auth(
env: soroban_sdk::Env,
signature_payload: soroban_sdk::BytesN<32>,
signature: PolicySignature,
auth_context: soroban_sdk::Vec,
) -> Result<(), PolicyError> fn add_merchant(
env: soroban_sdk::Env,
merchant_pubkey: soroban_sdk::BytesN<32>,
) -> Result<(), PolicyError>fn get_recovery(env: soroban_sdk::Env) -> ResultCreate the account.
Everything that decides where money can go is fixed here and cannot be changed later: the owner passkey and the domain it belongs to, the token the account pays in, and the address the owner can recover the balance to. The limits can only be lowered afterwards. There is no upgrade path; a different policy means a different account.
fn __constructor(
env: soroban_sdk::Env,
owner: soroban_sdk::BytesN<65>,
rp_id_hash: soroban_sdk::BytesN<32>,
agent_signer: soroban_sdk::BytesN<32>,
asset: soroban_sdk::Address,
recovery: soroban_sdk::Address,
velocity_config: VelocityConfig,
) -> Result<(), PolicyError>Announce the proof of intent for a payment the account authorized.
The content comes from what the account recorded while it verified the payment, not from the caller, so calling this can only ever publish the truth, and only once.
fn publish_proof(
env: soroban_sdk::Env,
nonce: soroban_sdk::BytesN<32>,
) -> Result<(), PolicyError>Move the account's whole balance of a token to the recovery address.
This is the emergency exit. It only works on a frozen account, so it is always the second deliberate step, and the destination was fixed when the account was created, so nobody can point it anywhere else. The delegated signer cannot reach it: it is an owner action, and the agent path only ever authorizes a single agreed transfer.
fn recover_funds(
env: soroban_sdk::Env,
token: soroban_sdk::Address,
) -> ResultReplace the limits with tighter ones. Any attempt to loosen even one of them is refused, so the limits the account was created with are a ceiling for as long as it exists.
fn reduce_limits(
env: soroban_sdk::Env,
config: VelocityConfig,
) -> Result<(), PolicyError>fn freeze_payments(env: soroban_sdk::Env) -> Result<(), PolicyError>fn remove_merchant(
env: soroban_sdk::Env,
merchant_pubkey: soroban_sdk::BytesN<32>,
) -> Result<(), PolicyError>fn get_agent_signer(
env: soroban_sdk::Env,
) -> Result, PolicyError> Let payments through again.
The velocity window is left exactly as it is. Payments made before the freeze keep counting until they age out, so freezing and restoring cannot be used to reset the budget.
fn restore_payments(env: soroban_sdk::Env) -> Result<(), PolicyError>fn set_agent_signer(
env: soroban_sdk::Env,
new_pubkey: soroban_sdk::BytesN<32>,
) -> Result<(), PolicyError>fn get_velocity_state(env: soroban_sdk::Env) -> VelocityStatefn get_velocity_config(env: soroban_sdk::Env) -> Resultfn revoke_agent_signer(env: soroban_sdk::Env) -> Result<(), PolicyError>