@meddleware/seal-ui 0.0.31 → 0.0.33

package/CHANGELOG.md

@@ -3,6 +3,18 @@
 All notable changes to `@meddleware/seal-ui` are documented here.
 Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versioning follows [Semantic Versioning](https://semver.org/).
 
+## [0.0.33] - 2026-10-09
+
+### Changed
+
+- Manifest check validates the policy type and params against the network's registry (seal-client 0.0.19 `parseSealedManifest(text, registry)`); depends on access-gate-client ^0.0.8, seal-client ^0.0.19, ui ^0.1.31, design-tokens ^0.1.9, eslint-config ^0.0.2
+
+## [0.0.32] - 2026-10-08
+
+### Changed
+
+- Operator-only discovery by default (opt-in for other publishers), refuse non-linked gates when sealing, publisher result handling; seal-client 0.0.16, access-gate-client 0.0.6, walrus-client 0.0.26
+
 ## [0.0.31] - 2026-10-03
 
 ### Changed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meddleware/seal-ui",
-  "version": "0.0.31",
+  "version": "0.0.33",
   "homepage": "https://docs.meddleware.co.uk/blockchain/sui/sealed-storage/",
   "description": "Standalone Vue 3 SPA for Sealed Storage — client-side Seal encryption + access-gated, decentralised Walrus storage on Sui.",
   "author": "MeddleWare <dev@meddleware.co.uk>",
@@ -44,12 +44,12 @@
     "access": "public"
   },
   "dependencies": {
-    "@meddleware/access-gate-client": "^0.0.4",
-    "@meddleware/design-tokens": "^0.1.8",
-    "@meddleware/seal-client": "^0.0.15",
-    "@meddleware/ui": "^0.1.30",
-    "@meddleware/walrus-client": "^0.0.25",
-    "@mysten/sui": "^2.33.1",
+    "@meddleware/access-gate-client": "^0.0.8",
+    "@meddleware/design-tokens": "^0.1.9",
+    "@meddleware/seal-client": "^0.0.19",
+    "@meddleware/ui": "^0.1.31",
+    "@meddleware/walrus-client": "^0.0.26",
+    "@mysten/sui": "^2.33.2",
     "@mysten/wallet-standard": "^0.21.0",
     "vue": "^3.5.43"
   },
@@ -57,6 +57,7 @@
     "@meddleware/wallet-adapter": ">=0.0.12 <0.2.0"
   },
   "devDependencies": {
+    "@meddleware/eslint-config": "^0.0.2",
     "@meddleware/wallet-adapter": "^0.0.13",
     "@types/node": "~24.12.2",
     "@vitejs/plugin-vue": "^6.0.9",

package/src/components/SealView.vue

@@ -242,7 +242,7 @@ const decValues = ref<Record<string, string | boolean>>({})
 // AND enforce that it targets the network this app is built for — a manifest sealed on another
 // network references a package + committee that don't exist here and can never decrypt. The
 // `decManifestError` is surfaced next to the input so a rejection explains itself.
-const decCheck = computed(() => checkManifestForNetwork(decManifestText.value, network.value))
+const decCheck = computed(() => checkManifestForNetwork(decManifestText.value, network.value, registry.value))
 const decManifest = computed<SealedManifest | null>(() => decCheck.value.manifest)
 const decManifestError = computed<string | null>(() => decCheck.value.error)
 const decProvider = computed(() =>
@@ -394,6 +394,8 @@ const unlockGateId = ref('')
 const discovered = ref<SealedContentPointer[]>([])
 const unlockNftId = ref('')
 const unlockSoulbound = ref(false)
+// Seal gives confidentiality, not authenticity: by default only the gate operator's pointers are listed.
+const includeOthers = ref(false)
 
 async function performDiscover(): Promise<void> {
   errorMsg.value = null
@@ -405,7 +407,7 @@ async function performDiscover(): Promise<void> {
   busy.value = true
   try {
     status.value = 'Searching for sealed content…'
-    discovered.value = await discoverSealedContent(unlockGateId.value)
+    discovered.value = await discoverSealedContent(unlockGateId.value, { includeOthers: includeOthers.value })
     status.value = discovered.value.length
       ? `Found ${discovered.value.length} item(s).`
       : 'No sealed content published for this gate.'
@@ -621,6 +623,10 @@ async function performUnlock(item: SealedContentPointer): Promise<void> {
           <button v-if="!unlockGateManual" type="button" class="link link--spaced" @click="unlockGateManual = true; unlockGateId = ''">Enter ID manually</button>
           <button v-else type="button" class="link link--spaced" @click="unlockGateManual = false; unlockGateId = ''">← Back to picker</button>
         </template>
+        <label class="field checkbox">
+          <input type="checkbox" v-model="includeOthers" />
+          <span>Also list content published by other addresses (unverified: anyone can publish to a gate)</span>
+        </label>
         <button type="button" class="primary" :disabled="busy || !unlockGateId" @click="performDiscover">
           {{ busy ? 'Working…' : 'Find sealed content' }}
         </button>
@@ -642,6 +648,7 @@ async function performUnlock(item: SealedContentPointer): Promise<void> {
 
           <article v-for="item in discovered" :key="item.contentId" class="card discovered">
             <h3 class="discovered__title">{{ item.label || '(untitled)' }}</h3>
+            <p v-if="includeOthers" class="muted muted--sm">Published by {{ item.publisher }}: decrypting proves it was sealed to this gate, not who wrote it.</p>
             <p class="muted discovered__blob">blob {{ item.blobId }}</p>
             <button type="button" class="primary" :disabled="busy || !account || !unlockNftId" @click="performUnlock(item)">
               Unlock &amp; download

package/src/manifest-guard.ts

@@ -1,4 +1,4 @@
-import { parseSealedManifest, type SealedManifest } from '@meddleware/seal-client'
+import { parseSealedManifest, type PolicyRegistry, type SealedManifest } from '@meddleware/seal-client'
 
 /**
  * Result of validating a pasted/loaded manifest: either the parsed manifest, or a human-readable
@@ -12,8 +12,10 @@ export type ManifestCheck =
  * Validate a manifest string for use on `network`. Rejects a malformed shape (via the shared
  * `parseSealedManifest` schema guard) and a manifest sealed for a different network — the latter
  * references a policy package + key-server committee that don't exist here and can never decrypt.
+ * With the network's policy `registry`, the policy type must be registered and its params must parse,
+ * so a bad manifest fails here instead of at transaction build time.
  */
-export function checkManifestForNetwork(text: string, network: string): ManifestCheck {
+export function checkManifestForNetwork(text: string, network: string, registry?: PolicyRegistry): ManifestCheck {
   if (!text.trim()) return { manifest: null, error: null }
   try {
     const manifest = parseSealedManifest(text)
@@ -23,7 +25,7 @@ export function checkManifestForNetwork(text: string, network: string): Manifest
         error: `This manifest is for '${manifest.network}', but this app is on '${network}'. It cannot be decrypted here.`,
       }
     }
-    return { manifest, error: null }
+    return { manifest: registry ? parseSealedManifest(manifest, registry) : manifest, error: null }
   } catch (e) {
     return { manifest: null, error: e instanceof Error ? e.message : 'Invalid manifest.' }
   }

package/src/seal.ts

@@ -44,6 +44,8 @@ export async function getSealController(): Promise<SealController> {
         policyConfigId: cfg.seal.policyConfigId,
         threshold: cfg.threshold,
         serverConfigs: cfg.servers,
+        // Sealing to a gate of another access_gate package can never be unlocked: refuse it.
+        accessGateOriginalId: cfg.accessGateOriginalId || undefined,
       },
       registryFor(cfg),
     )

package/src/sealed-content.ts

@@ -1,22 +1,37 @@
 // Discover on-chain SealedContent pointers for a gate with seal-client's `listSealedContent`
 // (exact event type at the deployment's original id; BCS-decoded). Reads the read-indexer when
 // VITE_INDEXER_URL is set — display data only, falling back to the full node.
-import { listSealedContent, type SealedContentPointer } from '@meddleware/seal-client'
+import { gateOperators, listSealedContent, type SealedContentPointer } from '@meddleware/seal-client'
 import { getSuiClient } from './wallet.js'
 import { activeConfig, INDEXER_URL } from './config.js'
 
 /** Most pointers listed for one gate. */
 export const MAX_DISCOVERED = 200
 
-/** Published pointers for `gateId` on the active network, newest first. */
-export async function discoverSealedContent(gateId: string): Promise<SealedContentPointer[]> {
+/**
+ * Published pointers for `gateId` on the active network, newest first.
+ *
+ * Seal gives confidentiality, not authenticity: anyone can seal content to a gate and publish a
+ * pointer for it, and a pass holder decrypts it successfully. So by default only the gate
+ * operator's pointers are listed (`gateOperators`); `includeOthers` lists every publisher's, for the
+ * view to label as unverified.
+ */
+export async function discoverSealedContent(
+  gateId: string,
+  opts: { includeOthers?: boolean } = {},
+): Promise<SealedContentPointer[]> {
   const cfg = activeConfig.value
   if (!cfg.seal) throw new Error(cfg.problem ?? `Sealed Storage is not available on ${cfg.network}.`)
-  const page = await listSealedContent(getSuiClient(), {
+  const client = getSuiClient()
+  const publishers = opts.includeOthers
+    ? undefined
+    : await gateOperators(client as never, gateId, cfg.accessGateOriginalId)
+  const page = await listSealedContent(client, {
     originalId: cfg.seal.originalId,
     gateId,
     limit: MAX_DISCOVERED,
     indexer: INDEXER_URL ? { url: INDEXER_URL, network: cfg.network } : undefined,
+    ...(publishers ? { publishers } : {}),
   })
   return page.pointers
 }

package/src/walrus.ts

@@ -16,12 +16,18 @@ export async function storeBlob(bytes: Uint8Array, opts: { sendObjectTo: string
         `set VITE_WALRUS_PUBLISHER_${cfg.network.toUpperCase()} to an operator-run publisher.`,
     )
   }
-  return storeBlobViaPublisher(bytes, {
+  const stored = await storeBlobViaPublisher(bytes, {
     publisher: cfg.walrusPublisher,
     epochs: WALRUS_EPOCHS,
     sendObjectTo: opts.sendObjectTo,
     maxBytes: WALRUS_MAX_UPLOAD_BYTES,
   })
+  // Ciphertext carries a random Seal identity, so it cannot already be stored; if a publisher says it
+  // is, the user would own no Blob object to extend, so refuse rather than hand back a dead pointer.
+  if (stored.kind !== 'newlyCreated') {
+    throw new Error('The publisher reported this blob as already stored, so no Blob object was created for you. Try again.')
+  }
+  return stored.blobId
 }
 
 /** Read the ciphertext back, with the aggregator's strict consistency check. */