@meddleware/seal-ui 0.0.21 → 0.0.23

package/README.md

@@ -21,15 +21,20 @@ package; the client seam is [`@meddleware/seal-client`](https://github.com/meddl
 
 ## Configure (build-time `VITE_*`)
 
+The `seal_policies` and `access_gate` ids come from the published `deployments` (seal-client and
+access-gate-client) for the active network; they are not configuration.
+
 | Var | Meaning |
 | --- | --- |
-| `VITE_NETWORK` | `testnet` (default) or `mainnet` (pending) |
-| `VITE_SEAL_PACKAGE_ID_{NET}` | Published `seal_policies` package id |
+| `VITE_NETWORK` | Network the standalone build selects: `testnet` (default) or `mainnet`. Embedded, the host's selector rules. |
 | `VITE_SEAL_SERVER_OBJECT_IDS_{NET}` | CSV of key-server object ids (the committee) |
 | `VITE_SEAL_AGGREGATOR_URLS_{NET}` | CSV of aggregator URLs (index-aligned) |
-| `VITE_SEAL_THRESHOLD` | `t` in t-of-n (default 2) |
-| `VITE_WALRUS_PUBLISHER_{NET}` / `VITE_WALRUS_AGGREGATOR_{NET}` | Walrus HTTP endpoints (defaults provided) |
-| `VITE_RPC_{NET}` | Sui RPC URL override |
+| `VITE_SEAL_AGGREGATOR_API_KEY_{NET}` | Enoki API key sent as `X-API-Key` to aggregator-backed servers (required by the mainnet aggregator; publishable, baked into the bundle) |
+| `VITE_SEAL_THRESHOLD_{NET}` | `t` over the configured servers; a committee behind an aggregator counts as one (default testnet 2, mainnet 1). An out-of-range value disables sealing on that network with an explanation |
+| `VITE_WALRUS_PUBLISHER_{NET}` | Walrus HTTP publisher. Testnet has a default; **mainnet has none** (Walrus runs no public mainnet publisher), so set an operator-run publisher |
+| `VITE_WALRUS_AGGREGATOR_{NET}` | Walrus HTTP aggregator (Mysten reference endpoints by default) |
+| `VITE_WALRUS_MAX_UPLOAD_BYTES` | Largest ciphertext sent to the publisher (default 10 MiB, the public-publisher limit) |
+| `VITE_INDEXER_URL` | Optional read-indexer for sealed-content discovery (display data; falls back to the full node) |
 
 ## Develop
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meddleware/seal-ui",
-  "version": "0.0.21",
+  "version": "0.0.23",
   "homepage": "https://docs.meddleware.co.uk/blockchain/sui/sealed-storage/",
   "description": "Standalone Vue 3 SPA for Sealed Storage — client-side Seal encryption + access-gated, decentralised Walrus storage on Sui.",
   "author": "MeddleWare <dev@meddleware.co.uk>",
@@ -44,15 +44,20 @@
     "access": "public"
   },
   "dependencies": {
+    "@meddleware/access-gate-client": "^0.0.1",
     "@meddleware/design-tokens": "^0.1.7",
-    "@meddleware/seal-client": "^0.0.8",
+    "@meddleware/seal-client": "^0.0.9",
     "@meddleware/ui": "^0.1.28",
-    "@meddleware/wallet-adapter": "^0.0.10",
+    "@meddleware/walrus-client": "^0.0.20",
     "@mysten/sui": "^2.33.1",
     "@mysten/wallet-standard": "^0.21.0",
     "vue": "^3.5.43"
   },
+  "peerDependencies": {
+    "@meddleware/wallet-adapter": ">=0.0.12 <0.2.0"
+  },
   "devDependencies": {
+    "@meddleware/wallet-adapter": "^0.0.12",
     "@types/node": "~24.12.2",
     "@vitejs/plugin-vue": "^6.0.9",
     "@vue/eslint-config-typescript": "^14.9.0",
@@ -71,7 +76,7 @@
     "stylelint-config-standard": "^40.0.0",
     "typescript": "~6.0.0",
     "vite": "^8.3.0",
-    "vitest": "~5.0.1",
+    "vitest": "~5.0.2",
     "vue-eslint-parser": "^10.4.1",
     "vue-tsc": "~3.3.11"
   },

package/src/App.vue

@@ -2,7 +2,7 @@
 // Standalone shell for the Sealed Storage SPA: app header + footer wrapping the core tool view.
 // The core UI lives in SealView.vue (also exported for inline embedding in the dashboard).
 import { AppHeader, AppFooter, ColorModeControl, useColorMode } from '@meddleware/ui'
-import { NETWORK } from './config.js'
+import { network } from './config.js'
 import SealView from './components/SealView.vue'
 
 const { mode, set } = useColorMode('dark')
@@ -14,17 +14,17 @@ const DEV_URL  = import.meta.env.VITE_DEV_URL  || 'https://dev.meddleware.co.uk/
   <div class="app">
     <AppHeader variant="dark">
       <template #brand>
-        <span>🔒 Sealed Storage</span>
+        <h1 class="brand-title">🔒 Sealed Storage</h1>
       </template>
       <template #actions>
-        <span class="badge">{{ NETWORK }}</span>
+        <span class="badge">{{ network }}</span>
         <ColorModeControl :model-value="mode" @update:model-value="set" />
       </template>
     </AppHeader>
 
-    <div class="app__content">
+    <main class="app__content">
       <SealView />
-    </div>
+    </main>
 
     <AppFooter :docs-url="DOCS_URL" :dev-url="DEV_URL" />
   </div>
@@ -56,4 +56,10 @@ const DEV_URL  = import.meta.env.VITE_DEV_URL  || 'https://dev.meddleware.co.uk/
   color: var(--muted);
   border: 1px solid var(--border);
 }
+
+/* The app title is the page's h1; keep the header's own type styles. */
+.brand-title {
+  font: inherit;
+  margin: 0;
+}
 </style>

package/src/components/SealView.vue

@@ -9,9 +9,8 @@
 // globals via main.ts → styles.css.
 import { computed, onMounted, ref, watch } from 'vue'
 import { AppTabNav, UiStepper, UiTabPanel, UiToolIntro, type AppTab, type StepperStep } from '@meddleware/ui'
-import { Transaction } from '@mysten/sui/transactions'
 import {
-  buildPublishSealedContentTx,
+  buildPublishSealedContentTransaction,
   type SealedManifest,
   type SealPolicyProvider,
   type SealedContentPointer,
@@ -20,15 +19,18 @@ import {
 import { checkManifestForNetwork } from '../manifest-guard.js'
 import { WalletGuard } from '@meddleware/wallet-adapter'
 import { useWallet, getSuiClient } from '../wallet.js'
-import { registry, getSealController } from '../seal.js'
+import { registry, getSealController, clearSealSessions } from '../seal.js'
 import { storeBlob, readBlob } from '../walrus.js'
 import { discoverSealedContent } from '../sealed-content.js'
-import { NETWORK, SEAL_CONFIGURED, SEAL_PACKAGE_ID } from '../config.js'
+import { activeConfig, network } from '../config.js'
 
 const { account, signPersonalMessage, signAndExecute } = useWallet()
 
-const providers = registry.list() as SealPolicyProvider[]
-const disabled = computed(() => !SEAL_CONFIGURED)
+const providers = computed(() => registry.value.list() as SealPolicyProvider[])
+
+/** Shown inside each tab panel until a wallet is connected. */
+const GUARD_MESSAGE = 'Connect a Sui wallet to encrypt and decrypt sealed content.'
+const disabled = computed(() => activeConfig.value.problem !== null)
 
 const TABS: AppTab[] = [
   { id: 'encrypt', label: 'Encrypt' },
@@ -65,7 +67,7 @@ watch(tab, () => {
 // Force manual mode so the pre-set ID renders in the text input immediately, before suggestions load.
 onMounted(() => {
   const gate = new URLSearchParams(location.search).get('gate')
-  if (gate && providers.some((p) => p.type === 'nft-gate')) {
+  if (gate && providers.value.some((p) => p.type === 'nft-gate')) {
     encType.value = 'nft-gate'
     encValues.value = { ...encValues.value, gateId: gate }
     encGateManual.value = true
@@ -83,6 +85,15 @@ function coerce(kind: string, raw: string | boolean): unknown {
   return String(raw)
 }
 
+/**
+ * A download filename derived from an untrusted label (on-chain pointers are written by anyone):
+ * keep word characters, dots and dashes, cap the length, and never start with a dot.
+ */
+function safeFileName(label: string | undefined, fallback: string): string {
+  const cleaned = (label ?? '').replace(/[^\w.-]/g, '_').replace(/^\.+/, '').slice(0, 100)
+  return cleaned || fallback
+}
+
 function triggerDownload(blob: Blob, name: string): void {
   const url = URL.createObjectURL(blob)
   const a = document.createElement('a')
@@ -108,8 +119,8 @@ async function fetchGateSuggestions(provider: SealPolicyProvider | null): Promis
 }
 
 // ── Encrypt ──────────────────────────────────────────────────────────────────
-const encType = ref(providers[0]?.type ?? '')
-const encProvider = computed(() => providers.find((p) => p.type === encType.value) ?? null)
+const encType = ref(providers.value[0]?.type ?? '')
+const encProvider = computed(() => providers.value.find((p) => p.type === encType.value) ?? null)
 const encValues = ref<Record<string, string | boolean>>({})
 
 /** One input per policy field; its type follows the field kind (v-model handles each type). */
@@ -126,6 +137,23 @@ function onEncFile(e: Event): void {
   encFile.value = (e.target as HTMLInputElement).files?.[0] ?? null
 }
 
+// SessionKeys are per address: drop them whenever the wallet disconnects or switches account.
+watch(
+  () => account.value?.address,
+  (next, prev) => {
+    if (prev && next !== prev) clearSealSessions()
+  },
+)
+
+// A network switch invalidates everything shown for the previous network.
+watch(network, () => {
+  manifest.value = null
+  publishDigest.value = null
+  discovered.value = []
+  status.value = null
+  errorMsg.value = null
+})
+
 watch(
   [() => account.value?.address, encProvider],
   async ([, provider]) => {
@@ -143,10 +171,10 @@ watch(
 )
 
 watch(
-  [() => account.value?.address, tab],
+  [() => account.value?.address, tab, network],
   async ([, t]) => {
     if (t !== 'unlock') return
-    const nftGateProvider = providers.find((p) => p.type === 'nft-gate') ?? null
+    const nftGateProvider = providers.value.find((p) => p.type === 'nft-gate') ?? null
     unlockGateLoading.value = true
     unlockGateManual.value = false
     try {
@@ -181,12 +209,14 @@ async function performEncrypt(): Promise<void> {
     const data = new Uint8Array(await encFile.value.arrayBuffer())
     const { id, ciphertext } = await (await getSealController()).encrypt(provider.type, params, data)
     status.value = 'Storing ciphertext on Walrus…'
-    const blobId = await storeBlob(ciphertext)
+    const owner = account.value?.address
+    if (!owner) throw new Error('Connect your wallet to store the ciphertext.')
+    const blobId = await storeBlob(ciphertext, { sendObjectTo: owner })
     manifest.value = {
       policyType: provider.type,
       id,
       blobId,
-      network: NETWORK,
+      network: network.value,
       params,
       label: encLabel.value || encFile.value.name,
     }
@@ -202,7 +232,7 @@ async function performEncrypt(): Promise<void> {
 function downloadManifest(): void {
   if (!manifest.value) return
   const blob = new Blob([JSON.stringify(manifest.value, null, 2)], { type: 'application/json' })
-  triggerDownload(blob, `${manifest.value.label ?? 'sealed'}.seal.json`)
+  triggerDownload(blob, `${safeFileName(manifest.value.label, 'sealed')}.seal.json`)
 }
 
 // ── Decrypt ──────────────────────────────────────────────────────────────────
@@ -212,11 +242,11 @@ const decValues = ref<Record<string, string | boolean>>({})
 // AND enforce that it targets the network this app is built for — a manifest sealed on another
 // network references a package + committee that don't exist here and can never decrypt. The
 // `decManifestError` is surfaced next to the input so a rejection explains itself.
-const decCheck = computed(() => checkManifestForNetwork(decManifestText.value, NETWORK))
+const decCheck = computed(() => checkManifestForNetwork(decManifestText.value, network.value))
 const decManifest = computed<SealedManifest | null>(() => decCheck.value.manifest)
 const decManifestError = computed<string | null>(() => decCheck.value.error)
 const decProvider = computed(() =>
-  decManifest.value ? (providers.find((p) => p.type === decManifest.value?.policyType) ?? null) : null,
+  decManifest.value ? (providers.value.find((p) => p.type === decManifest.value?.policyType) ?? null) : null,
 )
 
 async function onManifestFile(e: Event): Promise<void> {
@@ -254,7 +284,7 @@ async function performDecrypt(): Promise<void> {
       address: account.value.address,
       signPersonalMessage,
     })
-    triggerDownload(new Blob([plaintext.slice().buffer as ArrayBuffer]), m.label ?? 'decrypted')
+    triggerDownload(new Blob([plaintext.slice().buffer as ArrayBuffer]), safeFileName(m.label, 'decrypted'))
     status.value = 'Decrypted — download started.'
   } catch (e) {
     errorMsg.value = e instanceof Error ? e.message : String(e)
@@ -280,8 +310,9 @@ async function performPublish(): Promise<void> {
   busy.value = true
   try {
     status.value = 'Publishing on-chain pointer — approve the transaction in your wallet…'
-    const tx = new Transaction()
-    buildPublishSealedContentTx(tx, SEAL_PACKAGE_ID, {
+    const seal = activeConfig.value.seal
+    if (!seal) throw new Error(activeConfig.value.problem ?? 'Sealed Storage is not available on this network.')
+    const tx = buildPublishSealedContentTransaction(seal.publishedAt, {
       gateId: String(m.params.gateId),
       blobId: m.blobId,
       sealId: m.id,
@@ -347,7 +378,7 @@ async function performUnlock(item: SealedContentPointer): Promise<void> {
       ciphertext,
       { address: account.value.address, signPersonalMessage },
     )
-    triggerDownload(new Blob([plaintext.slice().buffer as ArrayBuffer]), item.label || 'decrypted')
+    triggerDownload(new Blob([plaintext.slice().buffer as ArrayBuffer]), safeFileName(item.label, 'decrypted'))
     status.value = 'Decrypted — download started.'
   } catch (e) {
     errorMsg.value = e instanceof Error ? e.message : String(e)
@@ -362,26 +393,18 @@ async function performUnlock(item: SealedContentPointer): Promise<void> {
 
     <UiToolIntro>Client-side encrypted, access-gated storage on Walrus + Sui.</UiToolIntro>
 
-    <p v-if="!SEAL_CONFIGURED" class="notice notice--warn">
-      <template v-if="NETWORK === 'mainnet'">
-        Seal is not configured for mainnet. Set
-        <code>VITE_SEAL_PACKAGE_ID_MAINNET</code>,
-        <code>VITE_SEAL_SERVER_OBJECT_IDS_MAINNET</code>, and
-        <code>VITE_SEAL_AGGREGATOR_URLS_MAINNET</code>, then redeploy.
-      </template>
-      <template v-else>
-        This deployment has no Seal policy package or key-server committee configured
-        (<code>VITE_SEAL_PACKAGE_ID_*</code> / <code>VITE_SEAL_SERVER_OBJECT_IDS_*</code>).
-      </template>
-    </p>
+    <p v-if="activeConfig.problem" class="notice notice--warn">{{ activeConfig.problem }}</p>
 
-    <WalletGuard message="Connect a Sui wallet to encrypt and decrypt sealed content.">
-    <AppTabNav v-model="tab" :tabs="TABS" id-prefix="seal" aria-label="Sealed storage" class="seal-tabs" />
+    <!-- The tab list and every panel always render (each tab controls a live panel); the wallet
+         prompt replaces only a panel's content until a wallet is connected. Panels stay mounted
+         (v-show) so each tab keeps its state. -->
+    <AppTabNav v-model="tab" :tabs="TABS" id-prefix="seal" aria-label="Sealed storage" all-panels class="seal-tabs" />
 
     <p v-if="errorMsg" class="notice notice--error" role="alert">{{ errorMsg }}</p>
 
     <!-- Encrypt -->
     <UiTabPanel v-show="tab === 'encrypt'" id-prefix="seal" tab="encrypt" class="card">
+    <WalletGuard :message="GUARD_MESSAGE">
       <UiStepper :steps="ENC_STEPS" v-model="encStep" />
 
       <!-- Step 0: Policy -->
@@ -488,10 +511,12 @@ async function performUnlock(item: SealedContentPointer): Promise<void> {
           <button type="button" class="link" @click="encStep--">Back</button>
         </div>
       </template>
+    </WalletGuard>
     </UiTabPanel>
 
     <!-- Unlock -->
     <UiTabPanel v-show="tab === 'unlock'" id-prefix="seal" tab="unlock" class="card">
+    <WalletGuard :message="GUARD_MESSAGE">
       <UiStepper :steps="UNLOCK_STEPS" v-model="unlockStep" />
 
       <!-- Step 0: Gate selector -->
@@ -548,10 +573,12 @@ async function performUnlock(item: SealedContentPointer): Promise<void> {
           <button type="button" class="link" @click="unlockStep--; discovered = []">Back</button>
         </div>
       </template>
+    </WalletGuard>
     </UiTabPanel>
 
     <!-- Decrypt -->
     <UiTabPanel v-show="tab === 'decrypt'" id-prefix="seal" tab="decrypt" class="card">
+    <WalletGuard :message="GUARD_MESSAGE">
       <UiStepper :steps="DEC_STEPS" v-model="decStep" />
 
       <!-- Step 0: Manifest input -->
@@ -600,6 +627,7 @@ async function performUnlock(item: SealedContentPointer): Promise<void> {
           </button>
         </div>
       </template>
+    </WalletGuard>
     </UiTabPanel>
 
     <p v-if="status" class="status muted">{{ status }}</p>
@@ -608,7 +636,6 @@ async function performUnlock(item: SealedContentPointer): Promise<void> {
       Decryption keys are released by a threshold committee of independent key servers. If enough
       servers are unreachable, decryption pauses — storage and retrieval are unaffected.
     </p>
-    </WalletGuard>
 </template>
 
 <style scoped>

package/src/config.ts

@@ -1,117 +1,141 @@
-// Build-time configuration (Vite inlines VITE_* at build). All values are baked into the static
-// bundle via Docker --build-arg. See Dockerfile for the full list.
+// Configuration. The network is wallet-adapter's shared runtime selector (the standalone build
+// selects VITE_NETWORK in main.ts; embedded, the host's selector rules). Everything network-specific
+// is resolved for that network:
+//   - package ids (seal_policies, access_gate) come from the published `deployments` — never env;
+//   - the key-server committee, threshold and Walrus endpoints are operator settings baked in as
+//     VITE_*_{NET} build vars, with Mysten defaults where they exist.
+import { computed } from 'vue'
 import type { KeyServerConfig } from '@meddleware/seal-client'
+import { SEAL_POLICIES_DEPLOYMENTS, type SealPoliciesDeployment } from '@meddleware/seal-client/deployments'
+import { ACCESS_GATE_DEPLOYMENTS, type AccessGateDeployment } from '@meddleware/access-gate-client/deployments'
+import { useNetwork } from '@meddleware/wallet-adapter'
 
-export type Network = 'testnet' | 'mainnet'
+type EnvSource = Record<string, string | undefined>
+const env: EnvSource = (import.meta as unknown as { env?: EnvSource }).env ?? {}
 
-const env = (import.meta as unknown as { env?: Record<string, string | undefined> }).env ?? {}
-
-export const NETWORK: Network = (env.VITE_NETWORK as Network) || 'testnet'
-
-/** Read a per-network var, e.g. netEnv('VITE_SEAL_PACKAGE_ID') → VITE_SEAL_PACKAGE_ID_TESTNET. */
-function netEnv(base: string): string | undefined {
-  return env[`${base}_${NETWORK.toUpperCase()}`]
-}
+/** The active network (read-only ref). */
+export const network = useNetwork().network
 
 function csv(v: string | undefined): string[] {
   return (v ?? '').split(',').map((s) => s.trim()).filter(Boolean)
 }
 
-export const RPC_URLS: Record<Network, string> = {
-  testnet: env.VITE_RPC_TESTNET || 'https://fullnode.testnet.sui.io:443',
-  mainnet: env.VITE_RPC_MAINNET || 'https://fullnode.mainnet.sui.io:443',
+/**
+ * Mysten key-server defaults. Testnet: the decentralized committee (via its aggregator) plus two
+ * independent servers. Mainnet: the verified 5-of-8 committee behind the mainnet aggregator, which
+ * needs an Enoki API key (`VITE_SEAL_AGGREGATOR_API_KEY_MAINNET`, a publishable client key scoped
+ * to Seal — it is baked into the bundle). A committee counts as ONE server.
+ */
+const SERVER_DEFAULTS: Record<string, { ids: string[]; aggs: string[]; threshold: number }> = {
+  testnet: {
+    ids: [
+      '0xb012378c9f3799fb5b1a7083da74a4069e3c3f1c93de0b27212a5799ce1e1e98',
+      '0x73d05d62c18d9374e3ea529e8e0ed6161da1a141a94d3f76ae3fe4e99356db75',
+      '0xf5d14a81a982144ae441cd7d64b09027f116a468bd36e7eca494f750591623c8',
+    ],
+    aggs: ['https://seal-aggregator-testnet.mystenlabs.com'],
+    threshold: 2,
+  },
+  mainnet: {
+    ids: ['0x686098f1439237fff9f36b99c7329683c22979d2005c2465cb891acb012a7595'],
+    aggs: ['https://seal-aggregator-mainnet.mystenlabs.com'],
+    threshold: 1,
+  },
 }
 
-/** Published `seal_policies` package id for this network (required to encrypt/decrypt). */
-export const SEAL_PACKAGE_ID: string =
-  netEnv('VITE_SEAL_PACKAGE_ID') ||
-  // Meddleware's canonical testnet deployment — override with VITE_SEAL_PACKAGE_ID_TESTNET
-  (NETWORK === 'testnet'
-    ? '0x42cc181f851ef702c1fddc9b925553f03b71784edff49d80fbc260055f86d612'
-    : '')
-
 /**
- * Threshold `t` in the t-of-n committee.
- *   Testnet default: 2 (matches the 3-server testnet committee)
- *   Mainnet default: 5 (matches the 5-of-8 Mysten Labs mainnet committee)
+ * Walrus HTTP endpoints. Walrus runs no public publisher on mainnet (a publisher pays SUI + WAL
+ * itself), so mainnet has no publisher default: set `VITE_WALRUS_PUBLISHER_MAINNET` to an
+ * operator-run authenticated publisher.
  */
-export const SEAL_THRESHOLD = Number(
-  env.VITE_SEAL_THRESHOLD || (NETWORK === 'mainnet' ? '5' : '2'),
-)
+const WALRUS_DEFAULTS: Record<string, { publisher: string; aggregator: string }> = {
+  testnet: {
+    publisher: 'https://publisher.walrus-testnet.walrus.space',
+    aggregator: 'https://aggregator.walrus-testnet.walrus.space',
+  },
+  mainnet: { publisher: '', aggregator: 'https://aggregator.walrus-mainnet.walrus.space' },
+}
 
 /**
- * The key-server committee. Object ids and aggregator URLs are supplied as parallel CSV lists
- * (index-aligned); aggregatorUrl is required for decentralized (committee-type) servers only —
- * independent servers derive their URL from the on-chain object and do not need one.
- *
- * Testnet defaults — three verified Mysten Labs servers:
- *   [0] Decentralized (Mysten aggregator) — requires aggregatorUrl
- *   [1] Independent server 1
- *   [2] Independent server 2
- * Override via VITE_SEAL_SERVER_OBJECT_IDS_TESTNET / VITE_SEAL_AGGREGATOR_URLS_TESTNET.
- *
- * Mainnet defaults — Mysten Labs 5-of-8 decentralized committee:
- *   Committee object: 0x686098f1439237fff9f36b99c7329683c22979d2005c2465cb891acb012a7595
- *   Aggregator: https://seal-aggregator-mainnet.mystenlabs.com
- *   NOTE: The mainnet aggregator requires an Enoki API key (X-API-Key header).
- *   Override via VITE_SEAL_SERVER_OBJECT_IDS_MAINNET / VITE_SEAL_AGGREGATOR_URLS_MAINNET.
- *   When independent open-mode key servers become available on mainnet, they can be added here.
+ * The threshold error for a committee, or null when the pair is valid. A threshold no committee could
+ * meet (or a non-integer one) is reported instead of failing at the first decrypt.
  */
-export const SEAL_SERVERS: KeyServerConfig[] = (() => {
-  const defaults: Record<Network, { ids: string[]; aggs: string[] }> = {
-    testnet: {
-      ids: [
-        '0xb012378c9f3799fb5b1a7083da74a4069e3c3f1c93de0b27212a5799ce1e1e98',
-        '0x73d05d62c18d9374e3ea529e8e0ed6161da1a141a94d3f76ae3fe4e99356db75',
-        '0xf5d14a81a982144ae441cd7d64b09027f116a468bd36e7eca494f750591623c8',
-      ],
-      aggs: ['https://seal-aggregator-testnet.mystenlabs.com'],
-    },
-    mainnet: {
-      ids: ['0x686098f1439237fff9f36b99c7329683c22979d2005c2465cb891acb012a7595'],
-      aggs: ['https://seal-aggregator-mainnet.mystenlabs.com'],
-    },
+export function thresholdError(threshold: number, servers: readonly { weight?: number }[]): string | null {
+  const total = servers.reduce((sum, s) => sum + (s.weight ?? 1), 0)
+  if (servers.length === 0) return null // no committee — reported as its own problem
+  if (!Number.isInteger(threshold) || threshold < 1 || threshold > total) {
+    return `The Seal threshold must be an integer in [1, ${total}] for ${servers.length} configured server(s); got ${threshold}`
   }
+  return null
+}
 
-  const envIds = csv(netEnv('VITE_SEAL_SERVER_OBJECT_IDS'))
-  const envAggs = csv(netEnv('VITE_SEAL_AGGREGATOR_URLS'))
-  const ids = envIds.length > 0 ? envIds : defaults[NETWORK].ids
-  const aggs = envAggs.length > 0 ? envAggs : defaults[NETWORK].aggs
-  return ids.map((objectId, i) => ({ objectId, weight: 1, aggregatorUrl: aggs[i] }))
-})()
+/** Everything sealing needs on one network. */
+export interface SealConfig {
+  network: string
+  /** The `seal_policies` deployment, or null where none is recorded. */
+  seal: SealPoliciesDeployment | null
+  /** The `access_gate` original id ('' where none is recorded; gate suggestions are then off). */
+  accessGateOriginalId: string
+  servers: KeyServerConfig[]
+  threshold: number
+  walrusPublisher: string
+  walrusAggregator: string
+  /** Why sealing is unavailable on this network, or null when it is configured. */
+  problem: string | null
+}
 
-/** Walrus HTTP publisher/aggregator for storing/reading the opaque ciphertext blob. */
-export const WALRUS_PUBLISHER: string =
-  netEnv('VITE_WALRUS_PUBLISHER') ||
-  (NETWORK === 'mainnet'
-    ? 'https://publisher.walrus.space'
-    : 'https://publisher.walrus-testnet.walrus.space')
+/** Resolve the configuration for `net` (pure; `envSource` is injectable for tests). */
+export function sealConfig(net: string, envSource: EnvSource = env): SealConfig {
+  const NET = net.toUpperCase()
+  const netEnv = (base: string) => envSource[`${base}_${NET}`]
+  const seal = (SEAL_POLICIES_DEPLOYMENTS as Record<string, SealPoliciesDeployment>)[net] ?? null
+  const accessGate = (ACCESS_GATE_DEPLOYMENTS as Record<string, AccessGateDeployment>)[net] ?? null
 
-export const WALRUS_AGGREGATOR: string =
-  netEnv('VITE_WALRUS_AGGREGATOR') ||
-  (NETWORK === 'mainnet'
-    ? 'https://aggregator.walrus.space'
-    : 'https://aggregator.walrus-testnet.walrus.space')
+  const defaults = SERVER_DEFAULTS[net]
+  const envIds = csv(netEnv('VITE_SEAL_SERVER_OBJECT_IDS'))
+  const envAggs = csv(netEnv('VITE_SEAL_AGGREGATOR_URLS'))
+  const ids = envIds.length ? envIds : (defaults?.ids ?? [])
+  const aggs = envAggs.length ? envAggs : (defaults?.aggs ?? [])
+  const apiKey = netEnv('VITE_SEAL_AGGREGATOR_API_KEY')
+  const servers: KeyServerConfig[] = ids.map((objectId, i) => {
+    const aggregatorUrl = aggs[i]
+    return aggregatorUrl && apiKey
+      ? { objectId, weight: 1, aggregatorUrl, apiKeyName: 'X-API-Key', apiKey }
+      : { objectId, weight: 1, aggregatorUrl }
+  })
+  const rawThreshold = netEnv('VITE_SEAL_THRESHOLD')
+  const threshold = rawThreshold ? Number(rawThreshold) : (defaults?.threshold ?? 1)
+
+  const walrus = WALRUS_DEFAULTS[net]
+  const problem = !seal
+    ? `Sealed Storage is not available on ${net}: no seal_policies deployment is recorded for it.`
+    : servers.length === 0
+      ? `Sealed Storage is not configured on ${net}: set VITE_SEAL_SERVER_OBJECT_IDS_${NET} (and VITE_SEAL_AGGREGATOR_URLS_${NET} for a committee).`
+      : thresholdError(threshold, servers)
+
+  return {
+    network: net,
+    seal,
+    accessGateOriginalId: accessGate?.originalId ?? '',
+    servers,
+    threshold,
+    walrusPublisher: netEnv('VITE_WALRUS_PUBLISHER') || walrus?.publisher || '',
+    walrusAggregator: netEnv('VITE_WALRUS_AGGREGATOR') || walrus?.aggregator || '',
+    problem,
+  }
+}
 
-/** Default blob lifetime (Walrus storage epochs). */
-export const WALRUS_EPOCHS = Number(env.VITE_WALRUS_EPOCHS || '5')
+/** The configuration for the active network. */
+export const activeConfig = computed(() => sealConfig(network.value))
 
 /**
- * Meddleware's deployed `access_gate` package IDs per network.
- * Used by the nft-gate provider's `suggest()` to list AdminCap-owned gates for the connected wallet.
- * Kept in sync with access-gate-ui/src/constants.ts (same deployment).
+ * Largest ciphertext the app sends to the publisher. Public publishers cap requests at 10 MiB;
+ * an operator-run publisher may allow more via VITE_WALRUS_MAX_UPLOAD_BYTES.
  */
-export const ACCESS_GATE_PACKAGE_ID: Record<Network, string> = {
-  testnet: '0x1a81ca177db039585e575beeeee4759466e55910e936a6733e38dbb65025eea4',
-  mainnet: '',
-}
+export const WALRUS_MAX_UPLOAD_BYTES = Number(env.VITE_WALRUS_MAX_UPLOAD_BYTES || String(10 * 1024 * 1024))
 
-/** True when the on-chain policy package + committee are configured for the active network. */
-export const SEAL_CONFIGURED = Boolean(SEAL_PACKAGE_ID) && SEAL_SERVERS.length > 0
+/** Default blob lifetime (Walrus storage epochs). */
+export const WALRUS_EPOCHS = Number(env.VITE_WALRUS_EPOCHS || '5')
 
-/**
- * True when the active network has no Seal committee configured (empty package ID or no servers).
- * On mainnet, populate VITE_SEAL_PACKAGE_ID_MAINNET + VITE_SEAL_SERVER_OBJECT_IDS_MAINNET +
- * VITE_SEAL_AGGREGATOR_URLS_MAINNET to enable sealing — no code change required.
- */
-export const MAINNET_PENDING = !SEAL_CONFIGURED
+/** Optional read-indexer for sealed-content discovery (display data; falls back to the full node). */
+export const INDEXER_URL: string = env.VITE_INDEXER_URL || ''

package/src/main.ts

@@ -4,7 +4,14 @@ import '@meddleware/design-tokens/seasons.css'
 import '@meddleware/ui/base.css'
 import './styles.css'
 import { useSeason } from '@meddleware/ui'
+import { useNetwork } from '@meddleware/wallet-adapter'
 import App from './App.vue'
 
+// The standalone build targets one network; select it in the shared selector so the client, the
+// ids, the key servers and the Walrus endpoints all agree. (Embedded, the host's selector rules.)
+const env = (import.meta as unknown as { env?: Record<string, string | undefined> }).env ?? {}
+const built = env.VITE_NETWORK || 'testnet'
+if (built === 'testnet' || built === 'mainnet') useNetwork().setNetwork(built)
+
 useSeason()
 createApp(App).mount('#app')

package/src/seal.ts

@@ -1,31 +1,60 @@
-// Wires the shared @meddleware/seal-client into this app: one registry (drives the policy picker)
-// and one SealController (encrypt/decrypt over the configured committee). Module singletons.
+// Wires the shared @meddleware/seal-client into this app: a policy registry (drives the picker)
+// and a SealController (encrypt/decrypt over the configured committee), each per network.
 //
 // SealController is loaded lazily (dynamic import) so @mysten/seal and @noble/curves are kept
 // out of the initial bundle — they're only needed when the user triggers encrypt/decrypt.
+import { computed } from 'vue'
 import { createDefaultRegistry, type PolicyRegistry } from '@meddleware/seal-client'
 import type { SealController } from '@meddleware/seal-client/controller'
 import { getSuiClient } from './wallet.js'
-import { NETWORK, SEAL_PACKAGE_ID, SEAL_THRESHOLD, SEAL_SERVERS, ACCESS_GATE_PACKAGE_ID } from './config.js'
+import { activeConfig, type SealConfig } from './config.js'
 
-/** The policy registry (nft-gate + time-lock as peers). Iterate `list()` to render the picker. */
-export const registry: PolicyRegistry = createDefaultRegistry(ACCESS_GATE_PACKAGE_ID[NETWORK])
+const registries = new Map<string, PolicyRegistry>()
+const controllers = new Map<string, SealController>()
 
-let controller: SealController | null = null
+/** The policy registry for a network (nft-gate + time-lock as peers). */
+export function registryFor(cfg: SealConfig): PolicyRegistry {
+  let r = registries.get(cfg.network)
+  if (!r) {
+    r = createDefaultRegistry(cfg.accessGateOriginalId)
+    registries.set(cfg.network, r)
+  }
+  return r
+}
+
+/** The registry for the active network. Iterate `list()` to render the picker. */
+export const registry = computed(() => registryFor(activeConfig.value))
 
-/** Lazily build the SealController from build-time config + the shared registry. */
+/**
+ * The SealController for the active network, built on first use.
+ *
+ * @throws {Error} when sealing is not configured on the active network (the reason is the message).
+ */
 export async function getSealController(): Promise<SealController> {
-  if (!controller) {
+  const cfg = activeConfig.value
+  if (cfg.problem || !cfg.seal) throw new Error(cfg.problem ?? `Sealed Storage is not available on ${cfg.network}.`)
+  let c = controllers.get(cfg.network)
+  if (!c) {
     const { SealController } = await import('@meddleware/seal-client/controller')
-    controller = new SealController(
+    c = new SealController(
       {
         suiClient: getSuiClient(),
-        packageId: SEAL_PACKAGE_ID,
-        threshold: SEAL_THRESHOLD,
-        serverConfigs: SEAL_SERVERS,
+        originalId: cfg.seal.originalId,
+        publishedAt: cfg.seal.publishedAt,
+        threshold: cfg.threshold,
+        serverConfigs: cfg.servers,
       },
-      registry,
+      registryFor(cfg),
     )
+    controllers.set(cfg.network, c)
   }
-  return controller
+  return c
+}
+
+/**
+ * Drop every cached SessionKey (wallet disconnected or switched account). A no-op before a
+ * controller has been loaded, so calling it never pulls `@mysten/seal` into the bundle.
+ */
+export function clearSealSessions(): void {
+  for (const c of controllers.values()) c.clearSession()
 }

package/src/sealed-content.ts

@@ -1,45 +1,22 @@
-// Discover on-chain SealedContent pointers for a gate by indexing the SealedContentPublished
-// event. Uses the gRPC client's listEvents + a client-side gate_id filter (no indexer needed).
-import { sealedContentEventType, type SealedContentPointer } from '@meddleware/seal-client'
+// Discover on-chain SealedContent pointers for a gate with seal-client's `listSealedContent`
+// (exact event type at the deployment's original id; BCS-decoded). Reads the read-indexer when
+// VITE_INDEXER_URL is set — display data only, falling back to the full node.
+import { listSealedContent, type SealedContentPointer } from '@meddleware/seal-client'
 import { getSuiClient } from './wallet.js'
-import { SEAL_PACKAGE_ID } from './config.js'
+import { activeConfig, INDEXER_URL } from './config.js'
 
-function normId(id: string): string {
-  const lower = id.toLowerCase()
-  return lower.startsWith('0x') ? lower : `0x${lower}`
-}
-
-interface RawEvent {
-  content_id?: string
-  gate_id?: string
-  blob_id?: string
-  seal_id?: string
-  label?: string
-  publisher?: string
-}
+/** Most pointers listed for one gate. */
+export const MAX_DISCOVERED = 200
 
-/** All published pointers whose `gate_id` matches, newest first. */
+/** Published pointers for `gateId` on the active network, newest first. */
 export async function discoverSealedContent(gateId: string): Promise<SealedContentPointer[]> {
-  if (!SEAL_PACKAGE_ID) throw new Error('Seal policy package is not configured.')
-  const client = getSuiClient()
-  // gRPC listEvents returns ascending by default (no cursor → no descending option); reverse at end.
-  const res = await client.listEvents({
-    filter: { eventType: sealedContentEventType(SEAL_PACKAGE_ID) },
-    limit: 200,
+  const cfg = activeConfig.value
+  if (!cfg.seal) throw new Error(cfg.problem ?? `Sealed Storage is not available on ${cfg.network}.`)
+  const page = await listSealedContent(getSuiClient(), {
+    originalId: cfg.seal.originalId,
+    gateId,
+    limit: MAX_DISCOVERED,
+    indexer: INDEXER_URL ? { url: INDEXER_URL, network: cfg.network } : undefined,
   })
-  const target = normId(gateId)
-  const out: SealedContentPointer[] = []
-  for (const ev of res.events) {
-    const p = ev.json as RawEvent | undefined
-    if (!p?.gate_id || normId(p.gate_id) !== target) continue
-    out.push({
-      contentId: p.content_id ?? '',
-      gateId: p.gate_id,
-      blobId: p.blob_id ?? '',
-      sealId: p.seal_id ?? '',
-      label: p.label ?? '',
-      publisher: p.publisher ?? '',
-    })
-  }
-  return out.reverse()
+  return page.pointers
 }

package/src/walrus.ts

@@ -1,30 +1,32 @@
-// Ciphertext storage via the Walrus HTTP publisher/aggregator. The blob is opaque (already
-// Seal-encrypted), so we need no wallet, no wasm, and no @mysten/walrus SDK here — just fetch.
-// (Routing uploads through the Meddleware relay to capture the tip/commission is a documented
-// follow-up; see the Sealed Storage plan.)
-import { WALRUS_PUBLISHER, WALRUS_AGGREGATOR, WALRUS_EPOCHS } from './config.js'
+// Ciphertext storage via the Walrus HTTP publisher/aggregator (@meddleware/walrus-client/http). The
+// blob is opaque (already Seal-encrypted), so no wallet, wasm or @mysten/walrus is involved. This
+// module only applies the active network's endpoints and the app's limits.
+import { readBlob as readViaAggregator, storeBlobViaPublisher } from '@meddleware/walrus-client/http'
+import { activeConfig, WALRUS_EPOCHS, WALRUS_MAX_UPLOAD_BYTES } from './config.js'
 
-interface PublishResponse {
-  newlyCreated?: { blobObject?: { blobId?: string } }
-  alreadyCertified?: { blobId?: string }
-}
-
-/** Store bytes on Walrus; returns the blob id. */
-export async function storeBlob(bytes: Uint8Array, epochs = WALRUS_EPOCHS): Promise<string> {
-  const res = await fetch(`${WALRUS_PUBLISHER}/v1/blobs?epochs=${epochs}`, {
-    method: 'PUT',
-    body: bytes as BodyInit,
+/**
+ * Store the ciphertext as a permanent blob whose `Blob` object goes to `sendObjectTo` (the user, not
+ * the publisher). Returns the blob id.
+ */
+export async function storeBlob(bytes: Uint8Array, opts: { sendObjectTo: string }): Promise<string> {
+  const cfg = activeConfig.value
+  if (!cfg.walrusPublisher) {
+    throw new Error(
+      `No Walrus publisher is configured for ${cfg.network}. Walrus runs no public mainnet publisher; ` +
+        `set VITE_WALRUS_PUBLISHER_${cfg.network.toUpperCase()} to an operator-run publisher.`,
+    )
+  }
+  return storeBlobViaPublisher(bytes, {
+    publisher: cfg.walrusPublisher,
+    epochs: WALRUS_EPOCHS,
+    sendObjectTo: opts.sendObjectTo,
+    maxBytes: WALRUS_MAX_UPLOAD_BYTES,
   })
-  if (!res.ok) throw new Error(`Walrus publisher error ${res.status}: ${await res.text()}`)
-  const json = (await res.json()) as PublishResponse
-  const blobId = json.newlyCreated?.blobObject?.blobId ?? json.alreadyCertified?.blobId
-  if (!blobId) throw new Error('Walrus publisher returned no blob id.')
-  return blobId
 }
 
-/** Read bytes back from Walrus by blob id. */
-export async function readBlob(blobId: string): Promise<Uint8Array> {
-  const res = await fetch(`${WALRUS_AGGREGATOR}/v1/blobs/${encodeURIComponent(blobId)}`)
-  if (!res.ok) throw new Error(`Walrus aggregator error ${res.status}`)
-  return new Uint8Array(await res.arrayBuffer())
+/** Read the ciphertext back, with the aggregator's strict consistency check. */
+export function readBlob(blobId: string): Promise<Uint8Array> {
+  const cfg = activeConfig.value
+  if (!cfg.walrusAggregator) throw new Error(`No Walrus aggregator is configured for ${cfg.network}.`)
+  return readViaAggregator(blobId, { aggregator: cfg.walrusAggregator })
 }