@meddleware/seal-ui 0.0.26 → 0.0.27

package/CHANGELOG.md

@@ -3,6 +3,20 @@
 All notable changes to `@meddleware/seal-ui` are documented here.
 Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versioning follows [Semantic Versioning](https://semver.org/).
 
+## [0.0.27] - 2026-10-02
+
+- **Mainnet key servers** (workspace ADR-0002, D24): three keyless Open-mode servers run by
+  independent operators — Overclock, NodeInfra, H2O Nodes — at threshold 2, replacing the planned
+  Enoki committee. Mainnet sealing still waits for the mainnet `seal_policies` package.
+- **No API key path.** `VITE_SEAL_AGGREGATOR_API_KEY_{NET}` is gone; a key in a `VITE_*` var would ship
+  in the bundle. A test proves no server is ever configured with one.
+- **Custody notice.** `VITE_SEAL_KEY_CUSTODY_{NET}` (`independent` by default, or `operator` for the
+  self-hosted fallback) — with `operator`, the view says the site's operator could decrypt.
+- **Re-seal** (Decrypt tab): decrypts content with the key servers it was sealed to and seals it again
+  for the current ones, producing a new manifest (`@meddleware/seal-client` 0.0.12).
+- The publish workflow passes the mainnet server ids, threshold and custody variables, so switching
+  servers is a repository-variable change.
+
 ## [0.0.26] - 2026-10-02
 
 - Targets the version-gated `seal_policies` (testnet `0x61c4aa…`) through `@meddleware/seal-client`

package/README.md

@@ -29,8 +29,8 @@ access-gate-client) for the active network; they are not configuration.
 | `VITE_NETWORK` | Network the standalone build selects: `testnet` (default) or `mainnet`. Embedded, the host's selector rules. |
 | `VITE_SEAL_SERVER_OBJECT_IDS_{NET}` | CSV of key-server object ids (the committee) |
 | `VITE_SEAL_AGGREGATOR_URLS_{NET}` | CSV of aggregator URLs (index-aligned) |
-| `VITE_SEAL_AGGREGATOR_API_KEY_{NET}` | Enoki API key sent as `X-API-Key` to aggregator-backed servers (required by the mainnet aggregator; publishable, baked into the bundle) |
-| `VITE_SEAL_THRESHOLD_{NET}` | `t` over the configured servers; a committee behind an aggregator counts as one (default testnet 2, mainnet 1). An out-of-range value disables sealing on that network with an explanation |
+| `VITE_SEAL_KEY_CUSTODY_{NET}` | `independent` (default) or `operator`. Set `operator` only when the operator's own key server is in use (the self-hosted fallback); the view then warns that the operator could decrypt |
+| `VITE_SEAL_THRESHOLD_{NET}` | `t` over the configured servers; a committee behind an aggregator counts as one (default 2 on testnet and mainnet). An out-of-range value disables sealing on that network with an explanation |
 | `VITE_WALRUS_PUBLISHER_{NET}` | Walrus HTTP publisher. Testnet has a default; **mainnet has none** (Walrus runs no public mainnet publisher), so set an operator-run publisher |
 | `VITE_WALRUS_AGGREGATOR_{NET}` | Walrus HTTP aggregator (Mysten reference endpoints by default) |
 | `VITE_WALRUS_MAX_UPLOAD_BYTES` | Largest ciphertext sent to the publisher (default 10 MiB, the public-publisher limit) |
@@ -52,7 +52,14 @@ npm run build           # vue-tsc + vite → dist/
 docker build -t seal-ui .
 ```
 
-Committee mode is testnet-only today; mainnet stays disabled with an in-app notice until it ships.
+Key servers (workspace ADR-0002): testnet uses Mysten's committee and two Open-mode servers; mainnet
+uses three keyless Open-mode servers run by independent operators (Overclock, NodeInfra, H2O Nodes)
+at threshold 2. No server needs an API key, and none is ever put in the bundle. Mainnet sealing stays
+disabled with an in-app notice until the mainnet `seal_policies` package is published.
+
+**Re-seal.** Content can only be decrypted by the key servers it was sealed to. The Decrypt tab's
+re-seal action decrypts it with those servers and seals it again for the current ones, so content can
+move off a provider that withdraws while the others still answer.
 
 ## License
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meddleware/seal-ui",
-  "version": "0.0.26",
+  "version": "0.0.27",
   "homepage": "https://docs.meddleware.co.uk/blockchain/sui/sealed-storage/",
   "description": "Standalone Vue 3 SPA for Sealed Storage — client-side Seal encryption + access-gated, decentralised Walrus storage on Sui.",
   "author": "MeddleWare <dev@meddleware.co.uk>",
@@ -46,7 +46,7 @@
   "dependencies": {
     "@meddleware/access-gate-client": "^0.0.2",
     "@meddleware/design-tokens": "^0.1.7",
-    "@meddleware/seal-client": "^0.0.11",
+    "@meddleware/seal-client": "^0.0.12",
     "@meddleware/ui": "^0.1.28",
     "@meddleware/walrus-client": ">=0.0.21 <0.2.0",
     "@mysten/sui": "^2.33.1",

package/src/components/SealView.vue

@@ -19,7 +19,7 @@ import {
 import { checkManifestForNetwork } from '../manifest-guard.js'
 import { WalletGuard } from '@meddleware/wallet-adapter'
 import { useWallet, getSuiClient } from '../wallet.js'
-import { registry, getSealController, clearSealSessions } from '../seal.js'
+import { registry, getSealController, clearSealSessions, resealCiphertext } from '../seal.js'
 import { storeBlob, readBlob } from '../walrus.js'
 import { discoverSealedContent } from '../sealed-content.js'
 import { activeConfig, network } from '../config.js'
@@ -293,6 +293,67 @@ async function performDecrypt(): Promise<void> {
   }
 }
 
+// ── Re-seal onto the current key servers ─────────────────────────────────────
+// Content can only be decrypted by the key servers it was sealed to. Re-sealing decrypts it with
+// those servers and encrypts it again for the current ones, so it survives a change of providers
+// (workspace ADR-0002). The result is a new blob and manifest; the old ones keep needing the old
+// servers.
+async function performReseal(): Promise<void> {
+  errorMsg.value = null
+  status.value = null
+  const m = decManifest.value
+  const provider = decProvider.value
+  if (!m || !provider) {
+    errorMsg.value = 'Paste or upload a valid manifest.'
+    return
+  }
+  if (!account.value) {
+    errorMsg.value = 'Connect your wallet to re-seal.'
+    return
+  }
+  busy.value = true
+  try {
+    const encryptParams: Record<string, unknown> = { ...(m.params ?? {}) }
+    const decryptParams: Record<string, unknown> = { ...encryptParams }
+    for (const f of provider.describe().decryptFields) {
+      const v = decValues.value[f.name]
+      if (v !== undefined && v !== '') decryptParams[f.name] = coerce(f.kind, v)
+      if (f.required && (decryptParams[f.name] === undefined || decryptParams[f.name] === '')) {
+        throw new Error(`${f.label} is required.`)
+      }
+    }
+    status.value = 'Fetching ciphertext from Walrus…'
+    const ciphertext = await readBlob(m.blobId)
+    status.value = 'Requesting keys from the original key servers — approve the signature in your wallet…'
+    const resealed = await resealCiphertext(m.policyType, decryptParams, encryptParams, m.id, ciphertext, {
+      address: account.value.address,
+      signPersonalMessage,
+    })
+    if (!resealed) {
+      status.value = 'This content is already sealed to the current key servers; nothing to do.'
+      return
+    }
+    status.value = 'Storing the re-sealed ciphertext on Walrus…'
+    const blobId = await storeBlob(resealed.ciphertext, { sendObjectTo: account.value.address })
+    manifest.value = {
+      policyType: m.policyType,
+      id: resealed.id,
+      blobId,
+      network: network.value,
+      params: encryptParams,
+      label: m.label,
+    }
+    publishDigest.value = null
+    status.value = 'Re-sealed. Download the new manifest; the old one still needs the old key servers.'
+    tab.value = 'encrypt'
+    encStep.value = 2
+  } catch (e) {
+    errorMsg.value = e instanceof Error ? e.message : String(e)
+  } finally {
+    busy.value = false
+  }
+}
+
 // ── Publish an on-chain discovery pointer (nft-gate content only) ─────────────
 const publishDigest = ref<string | null>(null)
 
@@ -394,6 +455,10 @@ async function performUnlock(item: SealedContentPointer): Promise<void> {
     <UiToolIntro>Client-side encrypted, access-gated storage on Walrus + Sui.</UiToolIntro>
 
     <p v-if="activeConfig.problem" class="notice notice--warn">{{ activeConfig.problem }}</p>
+    <p v-else-if="activeConfig.custody === 'operator'" class="notice notice--warn">
+      On {{ activeConfig.network }}, content is sealed with a key server run by this site's operator,
+      who could therefore decrypt it. Do not seal anything you would not share with the operator.
+    </p>
 
     <!-- The tab list and every panel always render (each tab controls a live panel); the wallet
          prompt replaces only a panel's content until a wallet is connected. Panels stay mounted
@@ -626,6 +691,15 @@ async function performUnlock(item: SealedContentPointer): Promise<void> {
             {{ busy ? 'Working…' : 'Decrypt' }}
           </button>
         </div>
+        <p class="muted muted--spaced">
+          Moving to new key servers? Re-sealing decrypts this content with the servers it was sealed to
+          and seals it again for the current ones, producing a new manifest.
+        </p>
+        <div class="nav-row">
+          <button type="button" class="link" :disabled="busy || disabled || !decProvider" @click="performReseal">
+            Re-seal for the current key servers
+          </button>
+        </div>
       </template>
     </WalletGuard>
     </UiTabPanel>

package/src/config.ts

@@ -21,10 +21,11 @@ function csv(v: string | undefined): string[] {
 }
 
 /**
- * Mysten key-server defaults. Testnet: the decentralized committee (via its aggregator) plus two
- * independent servers. Mainnet: the verified 5-of-8 committee behind the mainnet aggregator, which
- * needs an Enoki API key (`VITE_SEAL_AGGREGATOR_API_KEY_MAINNET`, a publishable client key scoped
- * to Seal — it is baked into the bundle). A committee counts as ONE server.
+ * Key-server defaults (workspace ADR-0002). Testnet: Mysten's decentralized committee (via its
+ * aggregator) plus Mysten's two Open-mode servers, threshold 2. Mainnet (D24): three keyless
+ * Open-mode servers run by independent operators — Overclock, NodeInfra, H2O Nodes — at threshold 2,
+ * so no single operator can decrypt and one may be down. No server needs an API key, so none is ever
+ * configured in the bundle. A committee behind an aggregator counts as ONE server.
  */
 const SERVER_DEFAULTS: Record<string, { ids: string[]; aggs: string[]; threshold: number }> = {
   testnet: {
@@ -37,9 +38,13 @@ const SERVER_DEFAULTS: Record<string, { ids: string[]; aggs: string[]; threshold
     threshold: 2,
   },
   mainnet: {
-    ids: ['0x686098f1439237fff9f36b99c7329683c22979d2005c2465cb891acb012a7595'],
-    aggs: ['https://seal-aggregator-mainnet.mystenlabs.com'],
-    threshold: 1,
+    ids: [
+      '0x145540d931f182fef76467dd8074c9839aea126852d90d18e1556fcbbd1208b6', // Overclock (Open)
+      '0x1afb3a57211ceff8f6781757821847e3ddae73f64e78ec8cd9349914ad985475', // NodeInfra (Open)
+      '0x4a65b4ff7ba8f4b538895ee35959f982a95f0db7e2a202ec989d261ea927286a', // H2O Nodes (Open)
+    ],
+    aggs: [],
+    threshold: 2,
   },
 }
 
@@ -69,6 +74,14 @@ export function thresholdError(threshold: number, servers: readonly { weight?: n
   return null
 }
 
+/**
+ * Who could decrypt content sealed on a network. `independent` (the default): key servers run by
+ * parties other than this app's operator, at a threshold no single one meets. `operator`: the
+ * operator's own key server is in use (the ADR-0002 fallback), so the operator could decrypt; the
+ * view says so.
+ */
+export type KeyCustody = 'independent' | 'operator'
+
 /** Everything sealing needs on one network. */
 export interface SealConfig {
   network: string
@@ -78,6 +91,7 @@ export interface SealConfig {
   accessGateOriginalId: string
   servers: KeyServerConfig[]
   threshold: number
+  custody: KeyCustody
   walrusPublisher: string
   walrusAggregator: string
   /** Why sealing is unavailable on this network, or null when it is configured. */
@@ -96,22 +110,24 @@ export function sealConfig(net: string, envSource: EnvSource = env): SealConfig
   const envAggs = csv(netEnv('VITE_SEAL_AGGREGATOR_URLS'))
   const ids = envIds.length ? envIds : (defaults?.ids ?? [])
   const aggs = envAggs.length ? envAggs : (defaults?.aggs ?? [])
-  const apiKey = netEnv('VITE_SEAL_AGGREGATOR_API_KEY')
-  const servers: KeyServerConfig[] = ids.map((objectId, i) => {
-    const aggregatorUrl = aggs[i]
-    return aggregatorUrl && apiKey
-      ? { objectId, weight: 1, aggregatorUrl, apiKeyName: 'X-API-Key', apiKey }
-      : { objectId, weight: 1, aggregatorUrl }
-  })
+  // Never an API key: a key in a VITE_* var ships in the public bundle (seal-ui audit I5).
+  const servers: KeyServerConfig[] = ids.map((objectId, i) => ({ objectId, weight: 1, aggregatorUrl: aggs[i] }))
   const rawThreshold = netEnv('VITE_SEAL_THRESHOLD')
   const threshold = rawThreshold ? Number(rawThreshold) : (defaults?.threshold ?? 1)
 
+  const rawCustody = netEnv('VITE_SEAL_KEY_CUSTODY') ?? 'independent'
+  const custody: KeyCustody = rawCustody === 'operator' ? 'operator' : 'independent'
+  const custodyError =
+    rawCustody === 'independent' || rawCustody === 'operator'
+      ? null
+      : `VITE_SEAL_KEY_CUSTODY_${NET} must be "independent" or "operator"; got "${rawCustody}"`
+
   const walrus = WALRUS_DEFAULTS[net]
-  const problem = !seal
+  const problem = custodyError ?? (!seal
     ? `Sealed Storage is not available on ${net}: no seal_policies deployment is recorded for it.`
     : servers.length === 0
       ? `Sealed Storage is not configured on ${net}: set VITE_SEAL_SERVER_OBJECT_IDS_${NET} (and VITE_SEAL_AGGREGATOR_URLS_${NET} for a committee).`
-      : thresholdError(threshold, servers)
+      : thresholdError(threshold, servers))
 
   return {
     network: net,
@@ -119,12 +135,27 @@ export function sealConfig(net: string, envSource: EnvSource = env): SealConfig
     accessGateOriginalId: accessGate?.originalId ?? '',
     servers,
     threshold,
+    custody,
     walrusPublisher: netEnv('VITE_WALRUS_PUBLISHER') || walrus?.publisher || '',
     walrusAggregator: netEnv('VITE_WALRUS_AGGREGATOR') || walrus?.aggregator || '',
     problem,
   }
 }
 
+/**
+ * The aggregator URL for a committee server on `net`, from the current configuration or the
+ * defaults (independent servers publish their URL on-chain and need none). Used to reach the servers
+ * an older ciphertext was sealed to.
+ */
+export function aggregatorUrlFor(net: string, objectId: string, envSource: EnvSource = env): string | undefined {
+  const norm = (id: string) => `0x${id.toLowerCase().replace(/^0x/, '').padStart(64, '0')}`
+  const fromConfig = sealConfig(net, envSource).servers.find((s) => norm(s.objectId) === norm(objectId))
+  if (fromConfig?.aggregatorUrl) return fromConfig.aggregatorUrl
+  const d = SERVER_DEFAULTS[net]
+  const i = d ? d.ids.findIndex((id) => norm(id) === norm(objectId)) : -1
+  return i >= 0 ? d?.aggs[i] : undefined
+}
+
 /** The configuration for the active network. */
 export const activeConfig = computed(() => sealConfig(network.value))
 

package/src/seal.ts

@@ -7,7 +7,7 @@ import { computed } from 'vue'
 import { createDefaultRegistry, type PolicyRegistry } from '@meddleware/seal-client'
 import type { SealController } from '@meddleware/seal-client/controller'
 import { getSuiClient } from './wallet.js'
-import { activeConfig, type SealConfig } from './config.js'
+import { activeConfig, aggregatorUrlFor, type SealConfig } from './config.js'
 
 const registries = new Map<string, PolicyRegistry>()
 const controllers = new Map<string, SealController>()
@@ -52,6 +52,50 @@ export async function getSealController(): Promise<SealController> {
   return c
 }
 
+/** A ciphertext re-sealed onto the active network's key servers. */
+export interface Resealed {
+  id: string
+  ciphertext: Uint8Array
+}
+
+/**
+ * Re-seal `ciphertext` (identity `id`, sealed under policy `policyType`) onto the active network's
+ * current key servers: decrypt with a controller for the servers its header records, then encrypt
+ * the plaintext under `encryptParams` with the current controller. Returns `null` when it is already
+ * sealed to the current servers. The plaintext never leaves this function.
+ *
+ * @throws {Error} if sealing is unavailable, the ciphertext belongs to another policy package, or the
+ *   original servers cannot release the key.
+ */
+export async function resealCiphertext(
+  policyType: string,
+  decryptParams: Record<string, unknown>,
+  encryptParams: Record<string, unknown>,
+  id: string,
+  ciphertext: Uint8Array,
+  opts: { address: string; signPersonalMessage: (message: Uint8Array) => Promise<{ signature: string }> },
+): Promise<Resealed | null> {
+  const cfg = activeConfig.value
+  if (cfg.problem || !cfg.seal) throw new Error(cfg.problem ?? `Sealed Storage is not available on ${cfg.network}.`)
+  const { SealController, describeCiphertext, sealedUnderServers } = await import('@meddleware/seal-client/controller')
+  const info = describeCiphertext(ciphertext)
+  if (sealedUnderServers(info, cfg.servers, cfg.threshold)) return null
+  const original = new SealController(
+    {
+      suiClient: getSuiClient(),
+      originalId: cfg.seal.originalId,
+      publishedAt: cfg.seal.publishedAt,
+      policyConfigId: cfg.seal.policyConfigId,
+      threshold: info.threshold,
+      serverConfigs: info.servers.map((s) => ({ ...s, aggregatorUrl: aggregatorUrlFor(cfg.network, s.objectId) })),
+    },
+    registryFor(cfg),
+  )
+  const plaintext = await original.decrypt(policyType, decryptParams, id, ciphertext, opts)
+  original.clearSession()
+  return (await getSealController()).encrypt(policyType, encryptParams, plaintext)
+}
+
 /**
  * Drop every cached SessionKey (wallet disconnected or switched account). A no-op before a
  * controller has been loaded, so calling it never pulls `@mysten/seal` into the bundle.