Everything the console can do, from the terminal.

Show the local config file, with every secret masked (never printed in full).

Point the CLI at an Authra deployment. Persists to ~/.authra/config.json.

Prove ownership of a wallet with one signature, that alone creates a workspace and mints a scoped issuer key. No console visit, no admin approval.

Issue a root delegation: a capped, expiring authority you grant to yourself, off your own owner key. Prints the address to fund with test USDC.

--cap <usdc>

: Daily spend cap in human USDC, e.g. 5 for 5 USDC/day. Ignored if --policy-file is set.

--name <str>

: Label shown in the console and in `authra list`. Default: "authra-cli root".

--token 0x…

: ERC-20 to cap. Default: this deployment's verified Base Sepolia test USDC.

--policy-file <path>

: Escape hatch: a full custom policy JSON (any shape the policy engine understands, e.g. a DEX router target with erc20BalanceCap instead of a plain transfer cap) instead of the built-in transfer-cap shape.

Warm up both smart accounts in the root chain (a real UserOp deploys them). Needed once before a redemption can validate the full signature chain back to the root.

Redelegate a narrower, capped slice of the last-issued root to a freshly generated hired-agent identity. The child is checked to be a provable subset of the parent before it's ever issued.

--cap <usdc>

: Must attenuate the parent's own cap; issuance fails if it doesn't.

--parent <id>

: Delegation id to hire under. Default: the last root `issue` stored locally.

--policy-file <path>

: Same escape hatch as `issue`: full custom policy for the child.

The kill switch. Cascades: revoking a root immediately cuts off everything hired under it, even though the child delegation itself is never touched directly.

Read an ERC-20 balance. Defaults to the root delegator, the account funds actually move from, so you can confirm funding before running deploy/transfer/demo.

Discover delegations already granted to a key you hold (e.g. one issued through the console rather than the CLI) by proving ownership via a signature and storing the match as "hired".

--key 0x…

: The private key to prove ownership with. Default: the CLI's stored owner key.

--select <id>

: Pick a specific delegation when more than one comes back. Default: the first.

Spend under a delegation, a real ERC-20 transfer. Prints ALLOWED with a tx hash, or DENIED with the exact failed caveat.

--as root|hired

: Which stored delegation to redeem under. Default: hired.

--to 0x…

: Recipient. Default: your own owner address.

The general escape hatch: redeem any policy-allowed encoded call, not just a plain transfer. transfer and swap are both just this with the calldata pre-built for you.

A real Uniswap V3 exactInputSingle swap, the same pool this project's own trading demo verified live (Base Sepolia test USDC to WETH, 0.05% fee tier). Requires a delegation whose policy already allows the router: issue/hire one with --policy-file, or use `demo --scenario swap` which builds it for you.

Recent activity for the workspace, the same feed the console's Activity page shows, read from the terminal.

The full record for one event, exactly as the console's forensic drawer renders it. Every field is trust-tagged chain-verified, authra-attested, or agent-reported, never presented as fact beyond what's actually verifiable.

Every identity and delegation in the workspace, not just the last one the CLI happens to remember locally.

Enable this workspace's automatic ACP issuance watcher. Reads the ACP contract's own events directly (no dependency on Virtuals' registration-gated notification feed), auto-issues a delegation the moment a job's budget is set, and auto-revokes on completion, rejection, or expiry.

--ceiling <usdc>

: Tripwire: the watcher refuses to issue if its dedicated address's real balance exceeds this. Default: 10.

Show every configured watcher for this workspace and its last sweep.

The full loop, narrated: signup → issue → deploy → hire → spend → revoke → the SAME spend retried and denied, proving revocation cascades without the child ever being touched directly.

The trading version of the same loop. Builds a router-scoped policy for you (an erc20BalanceCap on the Uniswap router, not a plain transfer cap) so it works standalone, then B trades on Uniswap instead of transferring.