Configuration

The fields in ~/.warden/config.json.

config.json is public vault metadata, signed by the vault key — a tamper of any field fails closed on open. Change fields with warden config set (it re-signs); never hand-edit.

Field	Meaning
`owner`	Owner Sui address — the revoke/approve identity; warrants inherit it. Set at `init` via `--owner`.
`rpc_url`	Sui JSON-RPC endpoint for on-chain reads + pricing. Unset → the Mysten public fullnode.
`unlock_mode`	`password`, `password+seal`, or `seal`.
`approval.method`	`owner-wallet-onchain` (alias `owner-wallet`), `owner-wallet-offchain`, or `telegram`.
`approval.owner`	Approver address for `owner-wallet-offchain` (anchored in the signed config).
`approval.timeout_secs`	How long a hold waits before failing closed. Default `300`.
`pricing`	How to value coins for `notional_usd` (static per-coin or a Pyth feed). Unpriceable coins fail closed.
`vault_seal`	Seal binding (network, package, registry, owner) for `seal` / `password+seal` modes.

warden config set --approval-method owner-wallet-offchain   # owner is fixed at init — only rpc_url / approval are mutable
# run `warden config set --help` for the mutable fields

The config is verified token-only against the cached vault public key on every open, so tampering with rpc_url, pricing, or approval is detected and rejected.