warden warrant

Issue, list, and revoke the capabilities you hand to agents.

warden warrant issue --mode token+onchain --name trading-bot \
  --wallets trade-wallet --policy spend-limits
warden warrant list

• issue --mode <token|token+onchain> with optional --name, --secrets, --wallets, --policy, --owner, --expires-days — issue a scoped warrant; the bearer token prints once.
• list — token hash, scope, expiry, bound policy, signature validity (no secrets).
• verify --warrant <token|id|name> — check one warrant's manifest signature + bound policy (local, no chain).
• revoke <token|id|name> — delete the capability locally and flip revoked on-chain (the kill-switch). On-chain registration + revoke are gas-sponsored by default (no SUI / sui CLI); revoke is sponsored for a keystore owner, while a wallet owner revokes in warden ui (the wallet signs).

See Warrants.