Gas sponsorship

Gasless on-chain writes — no SUI, no sui CLI, for the everyday flow.

Warden's on-chain writes are gas-sponsored by default: you don't need SUI in a wallet, and you don't need the sui CLI installed. The owner (or the vault key) still authorizes every transaction — a sponsor only pays the gas.

What's sponsored

Command	On-chain call	Signed by
`warden init` (seal modes) · `warden register`	`registry::register_vault`	the vault key
`warden warrant issue --mode token+onchain` · `warden register`	`registry::register_warrant`	the vault key
`warden warrant revoke` (on-chain)	`registry::revoke_warrant`	the owner (Move requires `sender == owner`)
`warden audit anchor`	`audit::create` + `audit::anchor`	the vault key

revoke is sponsored only for a keystore owner (the owner's key is local). A wallet owner revokes in warden ui — their wallet signs in the browser.

How it works

The CLI builds a move-call spec and sends it to the sponsor relay — the relay holds the Enoki key.
The relay builds the gasless transaction kind and asks Enoki to sponsor it (gas from Enoki's sponsor address).
The CLI signs the transaction in-process (the vault key, or the owner's keystore key for revoke) — never the gas, just authorization.
The relay submits via Enoki. The on-chain sender is you; the gas is paid by the sponsor.

The relay never sees a private key; the CLI never needs SUI or the sui CLI.

Configuration

Env	Meaning
`WARDEN_SPONSOR_URL`	The relay base URL. Defaults to `https://warden.ws`. Set it empty (`WARDEN_SPONSOR_URL=`) to opt out → self-paid via `sui client call` (needs the `sui` CLI + a funded keystore).

Sponsorship is currently testnet-only (the relay hard-gates it). On mainnet, opt out and self-pay, or run a relay you've extended.

Self-hosting the relay

The relay is part of this site (the Next.js app under web/warden-website), exposing POST /api/sponsor and POST /api/execute. To run your own:

Set ENOKI_PRIVATE_API_KEY in the app's environment.
On that Enoki key, set the allowlist to Warden's move targets — registry::register_vault, registry::register_warrant, registry::revoke_warrant, approval::create, audit::create, audit::anchor (on your deployed package) — plus testnet and a per-tx gas cap.
Point the CLI at it with WARDEN_SPONSOR_URL=https://your-host.

The relay only ever sponsors Warden's own functions (the client can't name the package), rate-limits per IP, and refuses anything but testnet.

When the `sui` CLI is still needed