@mysten/seal 1.2.4 → 1.3.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +8 -0
- package/dist/bcs.d.mts +21 -21
- package/dist/client.mjs +1 -1
- package/dist/client.mjs.map +1 -1
- package/dist/types.d.mts +5 -1
- package/dist/types.d.mts.map +1 -1
- package/dist/version.mjs +1 -1
- package/dist/version.mjs.map +1 -1
- package/docs/index.md +44 -1
- package/package.json +2 -2
package/CHANGELOG.md
CHANGED
package/dist/bcs.d.mts
CHANGED
|
@@ -1,37 +1,37 @@
|
|
|
1
|
-
import * as
|
|
1
|
+
import * as _mysten_bcs3 from "@mysten/bcs";
|
|
2
2
|
|
|
3
3
|
//#region src/bcs.d.ts
|
|
4
4
|
/**
|
|
5
5
|
* The encrypted object format. Should be aligned with the Rust implementation.
|
|
6
6
|
*/
|
|
7
|
-
declare const EncryptedObject:
|
|
8
|
-
version:
|
|
9
|
-
packageId:
|
|
10
|
-
id:
|
|
11
|
-
services:
|
|
7
|
+
declare const EncryptedObject: _mysten_bcs3.BcsStruct<{
|
|
8
|
+
version: _mysten_bcs3.BcsType<number, number, "u8">;
|
|
9
|
+
packageId: _mysten_bcs3.BcsType<string, string | Uint8Array<ArrayBufferLike>, "bytes[32]">;
|
|
10
|
+
id: _mysten_bcs3.BcsType<string, string, string>;
|
|
11
|
+
services: _mysten_bcs3.BcsType<[string, number][], Iterable<readonly [string | Uint8Array<ArrayBufferLike>, number]> & {
|
|
12
12
|
length: number;
|
|
13
13
|
}, string>;
|
|
14
|
-
threshold:
|
|
15
|
-
encryptedShares:
|
|
16
|
-
BonehFranklinBLS12381:
|
|
17
|
-
nonce:
|
|
18
|
-
encryptedShares:
|
|
14
|
+
threshold: _mysten_bcs3.BcsType<number, number, "u8">;
|
|
15
|
+
encryptedShares: _mysten_bcs3.BcsEnum<{
|
|
16
|
+
BonehFranklinBLS12381: _mysten_bcs3.BcsStruct<{
|
|
17
|
+
nonce: _mysten_bcs3.BcsType<Uint8Array<ArrayBufferLike>, Iterable<number>, "bytes[96]">;
|
|
18
|
+
encryptedShares: _mysten_bcs3.BcsType<Uint8Array<ArrayBufferLike>[], Iterable<Iterable<number>> & {
|
|
19
19
|
length: number;
|
|
20
20
|
}, string>;
|
|
21
|
-
encryptedRandomness:
|
|
21
|
+
encryptedRandomness: _mysten_bcs3.BcsType<Uint8Array<ArrayBufferLike>, Iterable<number>, "bytes[32]">;
|
|
22
22
|
}, string>;
|
|
23
23
|
}, "IBEEncryptions">;
|
|
24
|
-
ciphertext:
|
|
25
|
-
Aes256Gcm:
|
|
26
|
-
blob:
|
|
27
|
-
aad:
|
|
24
|
+
ciphertext: _mysten_bcs3.BcsEnum<{
|
|
25
|
+
Aes256Gcm: _mysten_bcs3.BcsStruct<{
|
|
26
|
+
blob: _mysten_bcs3.BcsType<Uint8Array<ArrayBufferLike>, Iterable<number>, "vector<u8>">;
|
|
27
|
+
aad: _mysten_bcs3.BcsType<Uint8Array<ArrayBufferLike> | null, Iterable<number> | null | undefined, "Option<vector<u8>>">;
|
|
28
28
|
}, string>;
|
|
29
|
-
Hmac256Ctr:
|
|
30
|
-
blob:
|
|
31
|
-
aad:
|
|
32
|
-
mac:
|
|
29
|
+
Hmac256Ctr: _mysten_bcs3.BcsStruct<{
|
|
30
|
+
blob: _mysten_bcs3.BcsType<Uint8Array<ArrayBufferLike>, Iterable<number>, "vector<u8>">;
|
|
31
|
+
aad: _mysten_bcs3.BcsType<Uint8Array<ArrayBufferLike> | null, Iterable<number> | null | undefined, "Option<vector<u8>>">;
|
|
32
|
+
mac: _mysten_bcs3.BcsType<Uint8Array<ArrayBufferLike>, Iterable<number>, "bytes[32]">;
|
|
33
33
|
}, string>;
|
|
34
|
-
Plain:
|
|
34
|
+
Plain: _mysten_bcs3.BcsStruct<{}, string>;
|
|
35
35
|
}, "Ciphertext">;
|
|
36
36
|
}, string>;
|
|
37
37
|
//#endregion
|
package/dist/client.mjs
CHANGED
|
@@ -24,7 +24,7 @@ var SealClient = class {
|
|
|
24
24
|
if (options.serverConfigs.some((s) => s.apiKeyName && !s.apiKey || !s.apiKeyName && s.apiKey)) throw new InvalidClientOptionsError("Both apiKeyName and apiKey must be provided or not provided for all key servers");
|
|
25
25
|
this.#configs = new Map(options.serverConfigs.map((server) => [server.objectId, server]));
|
|
26
26
|
this.#totalWeight = options.serverConfigs.map((server) => server.weight).reduce((sum, term) => sum + term, 0);
|
|
27
|
-
this.#verifyKeyServers = options.verifyKeyServers ??
|
|
27
|
+
this.#verifyKeyServers = options.verifyKeyServers ?? false;
|
|
28
28
|
this.#timeout = options.timeout ?? 1e4;
|
|
29
29
|
}
|
|
30
30
|
/**
|
package/dist/client.mjs.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"client.mjs","names":["#suiClient","#configs","#totalWeight","#verifyKeyServers","#timeout","#getWeightedKeyServers","#createEncryptionInput","#validateEncryptionServices","#cachedKeys","#weight","#keyServers","#loadKeyServers","#cachedPublicKeys"],"sources":["../src/client.ts"],"sourcesContent":["// Copyright (c) Mysten Labs, Inc.\n// SPDX-License-Identifier: Apache-2.0\n\nimport { EncryptedObject } from './bcs.js';\nimport { G1Element, G2Element } from './bls12381.js';\nimport { decrypt } from './decrypt.js';\nimport type { EncryptionInput } from './dem.js';\nimport { AesGcm256, Hmac256Ctr } from './dem.js';\nimport { DemType, encrypt, KemType } from './encrypt.js';\nimport {\n\tInconsistentKeyServersError,\n\tInvalidClientOptionsError,\n\tInvalidKeyServerError,\n\tInvalidPackageError,\n\tInvalidThresholdError,\n\ttoMajorityError,\n\tTooManyFailedFetchKeyRequestsError,\n} from './error.js';\nimport { BonehFranklinBLS12381Services } from './ibe.js';\nimport {\n\tBonehFranklinBLS12381DerivedKey,\n\tretrieveKeyServers,\n\tverifyKeyServer,\n\tfetchKeysForAllIds,\n} from './key-server.js';\nimport type { DerivedKey, KeyServer } from './key-server.js';\nimport type {\n\tDecryptOptions,\n\tEncryptOptions,\n\tFetchKeysOptions,\n\tGetDerivedKeysOptions,\n\tKeyCacheKey,\n\tKeyServerConfig,\n\tSealClientOptions,\n\tSealCompatibleClient,\n\tSealOptions,\n} from './types.js';\nimport { createFullId, count } from './utils.js';\n\nexport function seal<Name = 'seal'>({ name = 'seal' as Name, ...options }: SealOptions<Name>) {\n\treturn {\n\t\tname,\n\t\tregister: (client: SealCompatibleClient) => {\n\t\t\treturn new SealClient({\n\t\t\t\tsuiClient: client,\n\t\t\t\t...options,\n\t\t\t});\n\t\t},\n\t};\n}\n\nexport class SealClient {\n\t#suiClient: SealCompatibleClient;\n\t#configs: Map<string, KeyServerConfig>;\n\t#keyServers: Promise<Map<string, KeyServer>> | null = null;\n\t#verifyKeyServers: boolean;\n\t// A caching map for: fullId:object_id -> partial key.\n\t#cachedKeys = new Map<KeyCacheKey, G1Element>();\n\t#cachedPublicKeys = new Map<string, G2Element>();\n\t#timeout: number;\n\t#totalWeight: number;\n\n\tconstructor(options: SealClientOptions) {\n\t\tthis.#suiClient = options.suiClient;\n\n\t\tif (\n\t\t\tnew Set(options.serverConfigs.map((s) => s.objectId)).size !== options.serverConfigs.length\n\t\t) {\n\t\t\tthrow new InvalidClientOptionsError('Duplicate object IDs');\n\t\t}\n\n\t\tif (\n\t\t\toptions.serverConfigs.some((s) => (s.apiKeyName && !s.apiKey) || (!s.apiKeyName && s.apiKey))\n\t\t) {\n\t\t\tthrow new InvalidClientOptionsError(\n\t\t\t\t'Both apiKeyName and apiKey must be provided or not provided for all key servers',\n\t\t\t);\n\t\t}\n\n\t\tthis.#configs = new Map(options.serverConfigs.map((server) => [server.objectId, server]));\n\t\tthis.#totalWeight = options.serverConfigs\n\t\t\t.map((server) => server.weight)\n\t\t\t.reduce((sum, term) => sum + term, 0);\n\n\t\tthis.#verifyKeyServers = options.verifyKeyServers ?? true;\n\t\tthis.#timeout = options.timeout ?? 10_000;\n\t}\n\n\t/**\n\t * Return an encrypted message under the identity.\n\t *\n\t * @param kemType - The type of KEM to use.\n\t * @param demType - The type of DEM to use.\n\t * @param threshold - The threshold for the TSS encryption.\n\t * @param packageId - the packageId namespace.\n\t * @param id - the identity to use.\n\t * @param data - the data to encrypt.\n\t * @param aad - optional additional authenticated data.\n\t * @returns The bcs bytes of the encrypted object containing all metadata and the 256-bit symmetric key that was used to encrypt the object.\n\t * \tSince the symmetric key can be used to decrypt, it should not be shared but can be used e.g. for backup.\n\t */\n\tasync encrypt({\n\t\tkemType = KemType.BonehFranklinBLS12381DemCCA,\n\t\tdemType = DemType.AesGcm256,\n\t\tthreshold,\n\t\tpackageId,\n\t\tid,\n\t\tdata,\n\t\taad = new Uint8Array(),\n\t}: EncryptOptions) {\n\t\tconst packageObj = await this.#suiClient.core.getObject({ objectId: packageId });\n\t\tif (String(packageObj.object.version) !== '1') {\n\t\t\tthrow new InvalidPackageError(`Package ${packageId} is not the first version`);\n\t\t}\n\n\t\treturn encrypt({\n\t\t\tkeyServers: await this.#getWeightedKeyServers(),\n\t\t\tkemType,\n\t\t\tthreshold,\n\t\t\tpackageId,\n\t\t\tid,\n\t\t\tencryptionInput: this.#createEncryptionInput(\n\t\t\t\tdemType,\n\t\t\t\tdata as Uint8Array<ArrayBuffer>,\n\t\t\t\taad as Uint8Array<ArrayBuffer>,\n\t\t\t),\n\t\t});\n\t}\n\n\t#createEncryptionInput(\n\t\ttype: DemType,\n\t\tdata: Uint8Array<ArrayBuffer>,\n\t\taad: Uint8Array<ArrayBuffer>,\n\t): EncryptionInput {\n\t\tswitch (type) {\n\t\t\tcase DemType.AesGcm256:\n\t\t\t\treturn new AesGcm256(data, aad);\n\t\t\tcase DemType.Hmac256Ctr:\n\t\t\t\treturn new Hmac256Ctr(data, aad);\n\t\t}\n\t}\n\n\t/**\n\t * Decrypt the given encrypted bytes using cached keys.\n\t * Calls fetchKeys in case one or more of the required keys is not cached yet.\n\t * The function throws an error if the client's key servers are not a subset of\n\t * the encrypted object's key servers or if the threshold cannot be met.\n\t *\n\t * If checkShareConsistency is true, the decrypted shares are checked for consistency, meaning that\n\t * any combination of at least threshold shares should either succesfully combine to the plaintext or fail.\n\t * This is useful in case the encryptor is not trusted and the decryptor wants to ensure all decryptors\n\t * receive the same output (e.g., for onchain encrypted voting).\n\t *\n\t * @param data - The encrypted bytes to decrypt.\n\t * @param sessionKey - The session key to use.\n\t * @param txBytes - The transaction bytes to use (that calls seal_approve* functions).\n\t * @param checkShareConsistency - If true, the shares are checked for consistency.\n\t * @param checkLEEncoding - If true, the encryption is also checked using an LE encoded nonce.\n\t * @returns - The decrypted plaintext corresponding to ciphertext.\n\t */\n\tasync decrypt({\n\t\tdata,\n\t\tsessionKey,\n\t\ttxBytes,\n\t\tcheckShareConsistency,\n\t\tcheckLEEncoding,\n\t}: DecryptOptions) {\n\t\tconst encryptedObject = EncryptedObject.parse(data);\n\n\t\tthis.#validateEncryptionServices(\n\t\t\tencryptedObject.services.map((s) => s[0]),\n\t\t\tencryptedObject.threshold,\n\t\t);\n\n\t\tawait this.fetchKeys({\n\t\t\tids: [encryptedObject.id],\n\t\t\ttxBytes,\n\t\t\tsessionKey,\n\t\t\tthreshold: encryptedObject.threshold,\n\t\t});\n\n\t\tif (checkShareConsistency) {\n\t\t\tconst publicKeys = await this.getPublicKeys(\n\t\t\t\tencryptedObject.services.map(([objectId, _]) => objectId),\n\t\t\t);\n\t\t\treturn decrypt({\n\t\t\t\tencryptedObject,\n\t\t\t\tkeys: this.#cachedKeys,\n\t\t\t\tpublicKeys,\n\t\t\t\tcheckLEEncoding: false, // We intentionally do not support other encodings here\n\t\t\t});\n\t\t}\n\t\treturn decrypt({ encryptedObject, keys: this.#cachedKeys, checkLEEncoding });\n\t}\n\n\t#weight(objectId: string) {\n\t\treturn this.#configs.get(objectId)?.weight ?? 0;\n\t}\n\n\t#validateEncryptionServices(services: string[], threshold: number) {\n\t\t// Check that the client's key servers are a subset of the encrypted object's key servers.\n\t\tif (\n\t\t\tservices.some((objectId) => {\n\t\t\t\tconst countInClient = this.#weight(objectId);\n\t\t\t\treturn countInClient > 0 && countInClient !== count(services, objectId);\n\t\t\t})\n\t\t) {\n\t\t\tthrow new InconsistentKeyServersError(\n\t\t\t\t`Client's key servers must be a subset of the encrypted object's key servers`,\n\t\t\t);\n\t\t}\n\t\t// Check that the threshold can be met with the client's key servers.\n\t\tif (threshold > this.#totalWeight) {\n\t\t\tthrow new InvalidThresholdError(\n\t\t\t\t`Invalid threshold ${threshold} for ${this.#totalWeight} servers`,\n\t\t\t);\n\t\t}\n\t}\n\n\tasync getKeyServers(): Promise<Map<string, KeyServer>> {\n\t\tif (!this.#keyServers) {\n\t\t\tthis.#keyServers = this.#loadKeyServers().catch((error) => {\n\t\t\t\tthis.#keyServers = null;\n\t\t\t\tthrow error;\n\t\t\t});\n\t\t}\n\t\treturn this.#keyServers;\n\t}\n\n\t/**\n\t * Get the public keys for the given services.\n\t * If all public keys are not in the cache, they are retrieved.\n\t *\n\t * @param services - The services to get the public keys for.\n\t * @returns The public keys for the given services in the same order as the given services.\n\t */\n\tasync getPublicKeys(services: string[]): Promise<G2Element[]> {\n\t\tconst keyServers = await this.getKeyServers();\n\n\t\t// Collect the key servers not already in store or cache.\n\t\tconst missingKeyServers = services.filter(\n\t\t\t(objectId) => !keyServers.has(objectId) && !this.#cachedPublicKeys.has(objectId),\n\t\t);\n\n\t\t// If there are missing key servers, retrieve them and update the cache.\n\t\tif (missingKeyServers.length > 0) {\n\t\t\t(\n\t\t\t\tawait retrieveKeyServers({\n\t\t\t\t\tobjectIds: missingKeyServers,\n\t\t\t\t\tclient: this.#suiClient,\n\t\t\t\t\tconfigs: this.#configs,\n\t\t\t\t})\n\t\t\t).forEach((keyServer) =>\n\t\t\t\tthis.#cachedPublicKeys.set(keyServer.objectId, G2Element.fromBytes(keyServer.pk)),\n\t\t\t);\n\t\t}\n\n\t\treturn services.map((objectId) => {\n\t\t\tconst keyServer = keyServers.get(objectId);\n\t\t\tif (keyServer) {\n\t\t\t\treturn G2Element.fromBytes(keyServer.pk);\n\t\t\t}\n\t\t\treturn this.#cachedPublicKeys.get(objectId)!;\n\t\t});\n\t}\n\n\t/**\n\t * Returns a list of key servers with multiplicity according to their weights.\n\t * The list is used for encryption.\n\t */\n\tasync #getWeightedKeyServers() {\n\t\tconst keyServers = await this.getKeyServers();\n\t\tconst keyServersWithMultiplicity = [];\n\t\tfor (const [objectId, config] of this.#configs) {\n\t\t\tconst keyServer = keyServers.get(objectId)!;\n\t\t\tfor (let i = 0; i < config.weight; i++) {\n\t\t\t\tkeyServersWithMultiplicity.push(keyServer);\n\t\t\t}\n\t\t}\n\t\treturn keyServersWithMultiplicity;\n\t}\n\n\tasync #loadKeyServers(): Promise<Map<string, KeyServer>> {\n\t\tconst keyServers = await retrieveKeyServers({\n\t\t\tobjectIds: [...this.#configs.keys()],\n\t\t\tclient: this.#suiClient,\n\t\t\tconfigs: this.#configs,\n\t\t});\n\n\t\tif (keyServers.length === 0) {\n\t\t\tthrow new InvalidKeyServerError('No key servers found');\n\t\t}\n\n\t\tif (this.#verifyKeyServers) {\n\t\t\tawait Promise.all(\n\t\t\t\tkeyServers.map(async (server) => {\n\t\t\t\t\t// Skip /service verification for committee key server type since the request goes through an aggregator.\n\t\t\t\t\tif (server.serverType === 'Committee') {\n\t\t\t\t\t\treturn;\n\t\t\t\t\t}\n\t\t\t\t\tconst config = this.#configs.get(server.objectId);\n\t\t\t\t\tif (!(await verifyKeyServer(server, this.#timeout, config?.apiKeyName, config?.apiKey))) {\n\t\t\t\t\t\tthrow new InvalidKeyServerError(`Key server ${server.objectId} is not valid`);\n\t\t\t\t\t}\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\treturn new Map(keyServers.map((server) => [server.objectId, server]));\n\t}\n\n\t/**\n\t * Fetch keys from the key servers and update the cache.\n\t *\n\t * It is recommended to call this function once for all ids of all encrypted objects if\n\t * there are multiple, then call decrypt for each object. This avoids calling fetchKey\n\t * individually for each decrypt.\n\t *\n\t * @param ids - The ids of the encrypted objects.\n\t * @param txBytes - The transaction bytes to use (that calls seal_approve* functions).\n\t * @param sessionKey - The session key to use.\n\t * @param threshold - The threshold for the TSS encryptions. The function returns when a threshold of key servers had returned keys for all ids.\n\t */\n\tasync fetchKeys({ ids, txBytes, sessionKey, threshold }: FetchKeysOptions) {\n\t\tif (threshold > this.#totalWeight || threshold < 1) {\n\t\t\tthrow new InvalidThresholdError(\n\t\t\t\t`Invalid threshold ${threshold} servers with weights ${JSON.stringify(this.#configs)}`,\n\t\t\t);\n\t\t}\n\t\tconst keyServers = await this.getKeyServers();\n\t\tconst fullIds = ids.map((id) => createFullId(sessionKey.getPackageId(), id));\n\n\t\t// Count a server as completed if it has keys for all fullIds.\n\t\t// Duplicated key server ids will be counted towards the threshold.\n\t\tlet completedWeight = 0;\n\t\tconst remainingKeyServers = [];\n\t\tlet remainingKeyServersWeight = 0;\n\t\tfor (const objectId of keyServers.keys()) {\n\t\t\tif (fullIds.every((fullId) => this.#cachedKeys.has(`${fullId}:${objectId}`))) {\n\t\t\t\tcompletedWeight += this.#weight(objectId);\n\t\t\t} else {\n\t\t\t\tremainingKeyServers.push(objectId);\n\t\t\t\tremainingKeyServersWeight += this.#weight(objectId);\n\t\t\t}\n\t\t}\n\n\t\t// Return early if we have enough keys from cache.\n\t\tif (completedWeight >= threshold) {\n\t\t\treturn;\n\t\t}\n\n\t\tconst certificate = await sessionKey.getCertificate();\n\t\tconst signedRequest = await sessionKey.createRequestParams(txBytes);\n\n\t\tconst controller = new AbortController();\n\t\tconst errors: Error[] = [];\n\n\t\tconst keyFetches = remainingKeyServers.map(async (objectId) => {\n\t\t\tconst server = keyServers.get(objectId)!;\n\t\t\ttry {\n\t\t\t\tconst config = this.#configs.get(objectId);\n\t\t\t\tconst allKeys = await fetchKeysForAllIds({\n\t\t\t\t\turl: server.url,\n\t\t\t\t\trequestSignature: signedRequest.requestSignature,\n\t\t\t\t\ttransactionBytes: txBytes,\n\t\t\t\t\tencKey: signedRequest.encKey,\n\t\t\t\t\tencKeyPk: signedRequest.encKeyPk,\n\t\t\t\t\tencVerificationKey: signedRequest.encVerificationKey,\n\t\t\t\t\tcertificate,\n\t\t\t\t\ttimeout: this.#timeout,\n\t\t\t\t\tapiKeyName: config?.apiKeyName,\n\t\t\t\t\tapiKey: config?.apiKey,\n\t\t\t\t\tsignal: controller.signal,\n\t\t\t\t});\n\t\t\t\t// Check validity of the keys and add them to the cache.\n\t\t\t\tfor (const { fullId, key } of allKeys) {\n\t\t\t\t\tconst keyElement = G1Element.fromBytes(key);\n\t\t\t\t\tif (\n\t\t\t\t\t\t!BonehFranklinBLS12381Services.verifyUserSecretKey(\n\t\t\t\t\t\t\tkeyElement,\n\t\t\t\t\t\t\tfullId,\n\t\t\t\t\t\t\tG2Element.fromBytes(server.pk),\n\t\t\t\t\t\t)\n\t\t\t\t\t) {\n\t\t\t\t\t\tconsole.warn('Received invalid key from key server ' + server.objectId);\n\t\t\t\t\t\tcontinue;\n\t\t\t\t\t}\n\t\t\t\t\tthis.#cachedKeys.set(`${fullId}:${server.objectId}`, keyElement);\n\t\t\t\t}\n\n\t\t\t\t// Check if all the receivedIds are consistent with the requested fullIds.\n\t\t\t\t// If so, consider the key server got all keys and mark as completed.\n\t\t\t\tif (fullIds.every((fullId) => this.#cachedKeys.has(`${fullId}:${server.objectId}`))) {\n\t\t\t\t\tcompletedWeight += this.#weight(objectId);\n\n\t\t\t\t\t// Return early if the completed servers is more than the threshold.\n\t\t\t\t\tif (completedWeight >= threshold) {\n\t\t\t\t\t\tcontroller.abort();\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t} catch (error) {\n\t\t\t\tif (!controller.signal.aborted) {\n\t\t\t\t\terrors.push(error as Error);\n\t\t\t\t}\n\t\t\t} finally {\n\t\t\t\t// If there are too many errors that the threshold is not attainable, return early with error.\n\t\t\t\tremainingKeyServersWeight -= this.#weight(objectId);\n\t\t\t\tif (remainingKeyServersWeight < threshold - completedWeight) {\n\t\t\t\t\tcontroller.abort(new TooManyFailedFetchKeyRequestsError());\n\t\t\t\t}\n\t\t\t}\n\t\t});\n\n\t\tawait Promise.allSettled(keyFetches);\n\n\t\tif (completedWeight < threshold) {\n\t\t\tthrow toMajorityError(errors);\n\t\t}\n\t}\n\n\t/**\n\t * Get derived keys from the given services.\n\t *\n\t * @param id - The id of the encrypted object.\n\t * @param txBytes - The transaction bytes to use (that calls seal_approve* functions).\n\t * @param sessionKey - The session key to use.\n\t * @param threshold - The threshold.\n\t * @returns - Derived keys for the given services that are in the cache as a \"service object ID\" -> derived key map. If the call is succesful, exactly threshold keys will be returned.\n\t */\n\tasync getDerivedKeys({\n\t\tkemType = KemType.BonehFranklinBLS12381DemCCA,\n\t\tid,\n\t\ttxBytes,\n\t\tsessionKey,\n\t\tthreshold,\n\t}: GetDerivedKeysOptions): Promise<Map<string, DerivedKey>> {\n\t\tswitch (kemType) {\n\t\t\tcase KemType.BonehFranklinBLS12381DemCCA:\n\t\t\t\tconst keyServers = await this.getKeyServers();\n\t\t\t\tif (threshold > this.#totalWeight) {\n\t\t\t\t\tthrow new InvalidThresholdError(\n\t\t\t\t\t\t`Invalid threshold ${threshold} for ${this.#totalWeight} servers`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tawait this.fetchKeys({\n\t\t\t\t\tids: [id],\n\t\t\t\t\ttxBytes,\n\t\t\t\t\tsessionKey,\n\t\t\t\t\tthreshold,\n\t\t\t\t});\n\n\t\t\t\t// After calling fetchKeys, we can be sure that there are at least `threshold` of the required keys in the cache.\n\t\t\t\t// It is also checked there that the KeyServerType is BonehFranklinBLS12381 for all services.\n\n\t\t\t\tconst fullId = createFullId(sessionKey.getPackageId(), id);\n\n\t\t\t\tconst derivedKeys = new Map();\n\t\t\t\tlet weight = 0;\n\t\t\t\tfor (const objectId of keyServers.keys()) {\n\t\t\t\t\t// The code below assumes that the KeyServerType is BonehFranklinBLS12381.\n\t\t\t\t\tconst cachedKey = this.#cachedKeys.get(`${fullId}:${objectId}`);\n\t\t\t\t\tif (cachedKey) {\n\t\t\t\t\t\tderivedKeys.set(objectId, new BonehFranklinBLS12381DerivedKey(cachedKey));\n\t\t\t\t\t\tweight += this.#weight(objectId);\n\t\t\t\t\t\tif (weight >= threshold) {\n\t\t\t\t\t\t\t// We have enough keys, so we can stop.\n\t\t\t\t\t\t\tbreak;\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\treturn derivedKeys;\n\t\t}\n\t}\n}\n"],"mappings":";;;;;;;;;;;AAmDA,IAAa,aAAb,MAAwB;CACvB;CACA;CACA,cAAsD;CACtD;CAEA,8BAAc,IAAI,KAA6B;CAC/C,oCAAoB,IAAI,KAAwB;CAChD;CACA;CAEA,YAAY,SAA4B;AACvC,QAAKA,YAAa,QAAQ;AAE1B,MACC,IAAI,IAAI,QAAQ,cAAc,KAAK,MAAM,EAAE,SAAS,CAAC,CAAC,SAAS,QAAQ,cAAc,OAErF,OAAM,IAAI,0BAA0B,uBAAuB;AAG5D,MACC,QAAQ,cAAc,MAAM,MAAO,EAAE,cAAc,CAAC,EAAE,UAAY,CAAC,EAAE,cAAc,EAAE,OAAQ,CAE7F,OAAM,IAAI,0BACT,kFACA;AAGF,QAAKC,UAAW,IAAI,IAAI,QAAQ,cAAc,KAAK,WAAW,CAAC,OAAO,UAAU,OAAO,CAAC,CAAC;AACzF,QAAKC,cAAe,QAAQ,cAC1B,KAAK,WAAW,OAAO,OAAO,CAC9B,QAAQ,KAAK,SAAS,MAAM,MAAM,EAAE;AAEtC,QAAKC,mBAAoB,QAAQ,oBAAoB;AACrD,QAAKC,UAAW,QAAQ,WAAW;;;;;;;;;;;;;;;CAgBpC,MAAM,QAAQ,EACb,UAAU,QAAQ,6BAClB,UAAU,QAAQ,WAClB,WACA,WACA,IACA,MACA,MAAM,IAAI,YAAY,IACJ;EAClB,MAAM,aAAa,MAAM,MAAKJ,UAAW,KAAK,UAAU,EAAE,UAAU,WAAW,CAAC;AAChF,MAAI,OAAO,WAAW,OAAO,QAAQ,KAAK,IACzC,OAAM,IAAI,oBAAoB,WAAW,UAAU,2BAA2B;AAG/E,SAAO,QAAQ;GACd,YAAY,MAAM,MAAKK,uBAAwB;GAC/C;GACA;GACA;GACA;GACA,iBAAiB,MAAKC,sBACrB,SACA,MACA,IACA;GACD,CAAC;;CAGH,uBACC,MACA,MACA,KACkB;AAClB,UAAQ,MAAR;GACC,KAAK,QAAQ,UACZ,QAAO,IAAI,UAAU,MAAM,IAAI;GAChC,KAAK,QAAQ,WACZ,QAAO,IAAI,WAAW,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;CAsBnC,MAAM,QAAQ,EACb,MACA,YACA,SACA,uBACA,mBACkB;EAClB,MAAM,kBAAkB,gBAAgB,MAAM,KAAK;AAEnD,QAAKC,2BACJ,gBAAgB,SAAS,KAAK,MAAM,EAAE,GAAG,EACzC,gBAAgB,UAChB;AAED,QAAM,KAAK,UAAU;GACpB,KAAK,CAAC,gBAAgB,GAAG;GACzB;GACA;GACA,WAAW,gBAAgB;GAC3B,CAAC;AAEF,MAAI,uBAAuB;GAC1B,MAAM,aAAa,MAAM,KAAK,cAC7B,gBAAgB,SAAS,KAAK,CAAC,UAAU,OAAO,SAAS,CACzD;AACD,UAAO,QAAQ;IACd;IACA,MAAM,MAAKC;IACX;IACA,iBAAiB;IACjB,CAAC;;AAEH,SAAO,QAAQ;GAAE;GAAiB,MAAM,MAAKA;GAAa;GAAiB,CAAC;;CAG7E,QAAQ,UAAkB;AACzB,SAAO,MAAKP,QAAS,IAAI,SAAS,EAAE,UAAU;;CAG/C,4BAA4B,UAAoB,WAAmB;AAElE,MACC,SAAS,MAAM,aAAa;GAC3B,MAAM,gBAAgB,MAAKQ,OAAQ,SAAS;AAC5C,UAAO,gBAAgB,KAAK,kBAAkB,MAAM,UAAU,SAAS;IACtE,CAEF,OAAM,IAAI,4BACT,8EACA;AAGF,MAAI,YAAY,MAAKP,YACpB,OAAM,IAAI,sBACT,qBAAqB,UAAU,OAAO,MAAKA,YAAa,UACxD;;CAIH,MAAM,gBAAiD;AACtD,MAAI,CAAC,MAAKQ,WACT,OAAKA,aAAc,MAAKC,gBAAiB,CAAC,OAAO,UAAU;AAC1D,SAAKD,aAAc;AACnB,SAAM;IACL;AAEH,SAAO,MAAKA;;;;;;;;;CAUb,MAAM,cAAc,UAA0C;EAC7D,MAAM,aAAa,MAAM,KAAK,eAAe;EAG7C,MAAM,oBAAoB,SAAS,QACjC,aAAa,CAAC,WAAW,IAAI,SAAS,IAAI,CAAC,MAAKE,iBAAkB,IAAI,SAAS,CAChF;AAGD,MAAI,kBAAkB,SAAS,EAC9B,EACC,MAAM,mBAAmB;GACxB,WAAW;GACX,QAAQ,MAAKZ;GACb,SAAS,MAAKC;GACd,CAAC,EACD,SAAS,cACV,MAAKW,iBAAkB,IAAI,UAAU,UAAU,UAAU,UAAU,UAAU,GAAG,CAAC,CACjF;AAGF,SAAO,SAAS,KAAK,aAAa;GACjC,MAAM,YAAY,WAAW,IAAI,SAAS;AAC1C,OAAI,UACH,QAAO,UAAU,UAAU,UAAU,GAAG;AAEzC,UAAO,MAAKA,iBAAkB,IAAI,SAAS;IAC1C;;;;;;CAOH,OAAMP,wBAAyB;EAC9B,MAAM,aAAa,MAAM,KAAK,eAAe;EAC7C,MAAM,6BAA6B,EAAE;AACrC,OAAK,MAAM,CAAC,UAAU,WAAW,MAAKJ,SAAU;GAC/C,MAAM,YAAY,WAAW,IAAI,SAAS;AAC1C,QAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,IAClC,4BAA2B,KAAK,UAAU;;AAG5C,SAAO;;CAGR,OAAMU,iBAAmD;EACxD,MAAM,aAAa,MAAM,mBAAmB;GAC3C,WAAW,CAAC,GAAG,MAAKV,QAAS,MAAM,CAAC;GACpC,QAAQ,MAAKD;GACb,SAAS,MAAKC;GACd,CAAC;AAEF,MAAI,WAAW,WAAW,EACzB,OAAM,IAAI,sBAAsB,uBAAuB;AAGxD,MAAI,MAAKE,iBACR,OAAM,QAAQ,IACb,WAAW,IAAI,OAAO,WAAW;AAEhC,OAAI,OAAO,eAAe,YACzB;GAED,MAAM,SAAS,MAAKF,QAAS,IAAI,OAAO,SAAS;AACjD,OAAI,CAAE,MAAM,gBAAgB,QAAQ,MAAKG,SAAU,QAAQ,YAAY,QAAQ,OAAO,CACrF,OAAM,IAAI,sBAAsB,cAAc,OAAO,SAAS,eAAe;IAE7E,CACF;AAEF,SAAO,IAAI,IAAI,WAAW,KAAK,WAAW,CAAC,OAAO,UAAU,OAAO,CAAC,CAAC;;;;;;;;;;;;;;CAetE,MAAM,UAAU,EAAE,KAAK,SAAS,YAAY,aAA+B;AAC1E,MAAI,YAAY,MAAKF,eAAgB,YAAY,EAChD,OAAM,IAAI,sBACT,qBAAqB,UAAU,wBAAwB,KAAK,UAAU,MAAKD,QAAS,GACpF;EAEF,MAAM,aAAa,MAAM,KAAK,eAAe;EAC7C,MAAM,UAAU,IAAI,KAAK,OAAO,aAAa,WAAW,cAAc,EAAE,GAAG,CAAC;EAI5E,IAAI,kBAAkB;EACtB,MAAM,sBAAsB,EAAE;EAC9B,IAAI,4BAA4B;AAChC,OAAK,MAAM,YAAY,WAAW,MAAM,CACvC,KAAI,QAAQ,OAAO,WAAW,MAAKO,WAAY,IAAI,GAAG,OAAO,GAAG,WAAW,CAAC,CAC3E,oBAAmB,MAAKC,OAAQ,SAAS;OACnC;AACN,uBAAoB,KAAK,SAAS;AAClC,gCAA6B,MAAKA,OAAQ,SAAS;;AAKrD,MAAI,mBAAmB,UACtB;EAGD,MAAM,cAAc,MAAM,WAAW,gBAAgB;EACrD,MAAM,gBAAgB,MAAM,WAAW,oBAAoB,QAAQ;EAEnE,MAAM,aAAa,IAAI,iBAAiB;EACxC,MAAM,SAAkB,EAAE;EAE1B,MAAM,aAAa,oBAAoB,IAAI,OAAO,aAAa;GAC9D,MAAM,SAAS,WAAW,IAAI,SAAS;AACvC,OAAI;IACH,MAAM,SAAS,MAAKR,QAAS,IAAI,SAAS;IAC1C,MAAM,UAAU,MAAM,mBAAmB;KACxC,KAAK,OAAO;KACZ,kBAAkB,cAAc;KAChC,kBAAkB;KAClB,QAAQ,cAAc;KACtB,UAAU,cAAc;KACxB,oBAAoB,cAAc;KAClC;KACA,SAAS,MAAKG;KACd,YAAY,QAAQ;KACpB,QAAQ,QAAQ;KAChB,QAAQ,WAAW;KACnB,CAAC;AAEF,SAAK,MAAM,EAAE,QAAQ,SAAS,SAAS;KACtC,MAAM,aAAa,UAAU,UAAU,IAAI;AAC3C,SACC,CAAC,8BAA8B,oBAC9B,YACA,QACA,UAAU,UAAU,OAAO,GAAG,CAC9B,EACA;AACD,cAAQ,KAAK,0CAA0C,OAAO,SAAS;AACvE;;AAED,WAAKI,WAAY,IAAI,GAAG,OAAO,GAAG,OAAO,YAAY,WAAW;;AAKjE,QAAI,QAAQ,OAAO,WAAW,MAAKA,WAAY,IAAI,GAAG,OAAO,GAAG,OAAO,WAAW,CAAC,EAAE;AACpF,wBAAmB,MAAKC,OAAQ,SAAS;AAGzC,SAAI,mBAAmB,UACtB,YAAW,OAAO;;YAGZ,OAAO;AACf,QAAI,CAAC,WAAW,OAAO,QACtB,QAAO,KAAK,MAAe;aAEnB;AAET,iCAA6B,MAAKA,OAAQ,SAAS;AACnD,QAAI,4BAA4B,YAAY,gBAC3C,YAAW,MAAM,IAAI,oCAAoC,CAAC;;IAG3D;AAEF,QAAM,QAAQ,WAAW,WAAW;AAEpC,MAAI,kBAAkB,UACrB,OAAM,gBAAgB,OAAO;;;;;;;;;;;CAa/B,MAAM,eAAe,EACpB,UAAU,QAAQ,6BAClB,IACA,SACA,YACA,aAC2D;AAC3D,UAAQ,SAAR;GACC,KAAK,QAAQ;IACZ,MAAM,aAAa,MAAM,KAAK,eAAe;AAC7C,QAAI,YAAY,MAAKP,YACpB,OAAM,IAAI,sBACT,qBAAqB,UAAU,OAAO,MAAKA,YAAa,UACxD;AAEF,UAAM,KAAK,UAAU;KACpB,KAAK,CAAC,GAAG;KACT;KACA;KACA;KACA,CAAC;IAKF,MAAM,SAAS,aAAa,WAAW,cAAc,EAAE,GAAG;IAE1D,MAAM,8BAAc,IAAI,KAAK;IAC7B,IAAI,SAAS;AACb,SAAK,MAAM,YAAY,WAAW,MAAM,EAAE;KAEzC,MAAM,YAAY,MAAKM,WAAY,IAAI,GAAG,OAAO,GAAG,WAAW;AAC/D,SAAI,WAAW;AACd,kBAAY,IAAI,UAAU,IAAI,gCAAgC,UAAU,CAAC;AACzE,gBAAU,MAAKC,OAAQ,SAAS;AAChC,UAAI,UAAU,UAEb;;;AAIH,WAAO"}
|
|
1
|
+
{"version":3,"file":"client.mjs","names":["#suiClient","#configs","#totalWeight","#verifyKeyServers","#timeout","#getWeightedKeyServers","#createEncryptionInput","#validateEncryptionServices","#cachedKeys","#weight","#keyServers","#loadKeyServers","#cachedPublicKeys"],"sources":["../src/client.ts"],"sourcesContent":["// Copyright (c) Mysten Labs, Inc.\n// SPDX-License-Identifier: Apache-2.0\n\nimport { EncryptedObject } from './bcs.js';\nimport { G1Element, G2Element } from './bls12381.js';\nimport { decrypt } from './decrypt.js';\nimport type { EncryptionInput } from './dem.js';\nimport { AesGcm256, Hmac256Ctr } from './dem.js';\nimport { DemType, encrypt, KemType } from './encrypt.js';\nimport {\n\tInconsistentKeyServersError,\n\tInvalidClientOptionsError,\n\tInvalidKeyServerError,\n\tInvalidPackageError,\n\tInvalidThresholdError,\n\ttoMajorityError,\n\tTooManyFailedFetchKeyRequestsError,\n} from './error.js';\nimport { BonehFranklinBLS12381Services } from './ibe.js';\nimport {\n\tBonehFranklinBLS12381DerivedKey,\n\tretrieveKeyServers,\n\tverifyKeyServer,\n\tfetchKeysForAllIds,\n} from './key-server.js';\nimport type { DerivedKey, KeyServer } from './key-server.js';\nimport type {\n\tDecryptOptions,\n\tEncryptOptions,\n\tFetchKeysOptions,\n\tGetDerivedKeysOptions,\n\tKeyCacheKey,\n\tKeyServerConfig,\n\tSealClientOptions,\n\tSealCompatibleClient,\n\tSealOptions,\n} from './types.js';\nimport { createFullId, count } from './utils.js';\n\nexport function seal<Name = 'seal'>({ name = 'seal' as Name, ...options }: SealOptions<Name>) {\n\treturn {\n\t\tname,\n\t\tregister: (client: SealCompatibleClient) => {\n\t\t\treturn new SealClient({\n\t\t\t\tsuiClient: client,\n\t\t\t\t...options,\n\t\t\t});\n\t\t},\n\t};\n}\n\nexport class SealClient {\n\t#suiClient: SealCompatibleClient;\n\t#configs: Map<string, KeyServerConfig>;\n\t#keyServers: Promise<Map<string, KeyServer>> | null = null;\n\t#verifyKeyServers: boolean;\n\t// A caching map for: fullId:object_id -> partial key.\n\t#cachedKeys = new Map<KeyCacheKey, G1Element>();\n\t#cachedPublicKeys = new Map<string, G2Element>();\n\t#timeout: number;\n\t#totalWeight: number;\n\n\tconstructor(options: SealClientOptions) {\n\t\tthis.#suiClient = options.suiClient;\n\n\t\tif (\n\t\t\tnew Set(options.serverConfigs.map((s) => s.objectId)).size !== options.serverConfigs.length\n\t\t) {\n\t\t\tthrow new InvalidClientOptionsError('Duplicate object IDs');\n\t\t}\n\n\t\tif (\n\t\t\toptions.serverConfigs.some((s) => (s.apiKeyName && !s.apiKey) || (!s.apiKeyName && s.apiKey))\n\t\t) {\n\t\t\tthrow new InvalidClientOptionsError(\n\t\t\t\t'Both apiKeyName and apiKey must be provided or not provided for all key servers',\n\t\t\t);\n\t\t}\n\n\t\tthis.#configs = new Map(options.serverConfigs.map((server) => [server.objectId, server]));\n\t\tthis.#totalWeight = options.serverConfigs\n\t\t\t.map((server) => server.weight)\n\t\t\t.reduce((sum, term) => sum + term, 0);\n\n\t\tthis.#verifyKeyServers = options.verifyKeyServers ?? false;\n\t\tthis.#timeout = options.timeout ?? 10_000;\n\t}\n\n\t/**\n\t * Return an encrypted message under the identity.\n\t *\n\t * @param kemType - The type of KEM to use.\n\t * @param demType - The type of DEM to use.\n\t * @param threshold - The threshold for the TSS encryption.\n\t * @param packageId - the packageId namespace.\n\t * @param id - the identity to use.\n\t * @param data - the data to encrypt.\n\t * @param aad - optional additional authenticated data.\n\t * @returns The bcs bytes of the encrypted object containing all metadata and the 256-bit symmetric key that was used to encrypt the object.\n\t * \tSince the symmetric key can be used to decrypt, it should not be shared but can be used e.g. for backup.\n\t */\n\tasync encrypt({\n\t\tkemType = KemType.BonehFranklinBLS12381DemCCA,\n\t\tdemType = DemType.AesGcm256,\n\t\tthreshold,\n\t\tpackageId,\n\t\tid,\n\t\tdata,\n\t\taad = new Uint8Array(),\n\t}: EncryptOptions) {\n\t\tconst packageObj = await this.#suiClient.core.getObject({ objectId: packageId });\n\t\tif (String(packageObj.object.version) !== '1') {\n\t\t\tthrow new InvalidPackageError(`Package ${packageId} is not the first version`);\n\t\t}\n\n\t\treturn encrypt({\n\t\t\tkeyServers: await this.#getWeightedKeyServers(),\n\t\t\tkemType,\n\t\t\tthreshold,\n\t\t\tpackageId,\n\t\t\tid,\n\t\t\tencryptionInput: this.#createEncryptionInput(\n\t\t\t\tdemType,\n\t\t\t\tdata as Uint8Array<ArrayBuffer>,\n\t\t\t\taad as Uint8Array<ArrayBuffer>,\n\t\t\t),\n\t\t});\n\t}\n\n\t#createEncryptionInput(\n\t\ttype: DemType,\n\t\tdata: Uint8Array<ArrayBuffer>,\n\t\taad: Uint8Array<ArrayBuffer>,\n\t): EncryptionInput {\n\t\tswitch (type) {\n\t\t\tcase DemType.AesGcm256:\n\t\t\t\treturn new AesGcm256(data, aad);\n\t\t\tcase DemType.Hmac256Ctr:\n\t\t\t\treturn new Hmac256Ctr(data, aad);\n\t\t}\n\t}\n\n\t/**\n\t * Decrypt the given encrypted bytes using cached keys.\n\t * Calls fetchKeys in case one or more of the required keys is not cached yet.\n\t * The function throws an error if the client's key servers are not a subset of\n\t * the encrypted object's key servers or if the threshold cannot be met.\n\t *\n\t * If checkShareConsistency is true, the decrypted shares are checked for consistency, meaning that\n\t * any combination of at least threshold shares should either succesfully combine to the plaintext or fail.\n\t * This is useful in case the encryptor is not trusted and the decryptor wants to ensure all decryptors\n\t * receive the same output (e.g., for onchain encrypted voting).\n\t *\n\t * @param data - The encrypted bytes to decrypt.\n\t * @param sessionKey - The session key to use.\n\t * @param txBytes - The transaction bytes to use (that calls seal_approve* functions).\n\t * @param checkShareConsistency - If true, the shares are checked for consistency.\n\t * @param checkLEEncoding - If true, the encryption is also checked using an LE encoded nonce.\n\t * @returns - The decrypted plaintext corresponding to ciphertext.\n\t */\n\tasync decrypt({\n\t\tdata,\n\t\tsessionKey,\n\t\ttxBytes,\n\t\tcheckShareConsistency,\n\t\tcheckLEEncoding,\n\t}: DecryptOptions) {\n\t\tconst encryptedObject = EncryptedObject.parse(data);\n\n\t\tthis.#validateEncryptionServices(\n\t\t\tencryptedObject.services.map((s) => s[0]),\n\t\t\tencryptedObject.threshold,\n\t\t);\n\n\t\tawait this.fetchKeys({\n\t\t\tids: [encryptedObject.id],\n\t\t\ttxBytes,\n\t\t\tsessionKey,\n\t\t\tthreshold: encryptedObject.threshold,\n\t\t});\n\n\t\tif (checkShareConsistency) {\n\t\t\tconst publicKeys = await this.getPublicKeys(\n\t\t\t\tencryptedObject.services.map(([objectId, _]) => objectId),\n\t\t\t);\n\t\t\treturn decrypt({\n\t\t\t\tencryptedObject,\n\t\t\t\tkeys: this.#cachedKeys,\n\t\t\t\tpublicKeys,\n\t\t\t\tcheckLEEncoding: false, // We intentionally do not support other encodings here\n\t\t\t});\n\t\t}\n\t\treturn decrypt({ encryptedObject, keys: this.#cachedKeys, checkLEEncoding });\n\t}\n\n\t#weight(objectId: string) {\n\t\treturn this.#configs.get(objectId)?.weight ?? 0;\n\t}\n\n\t#validateEncryptionServices(services: string[], threshold: number) {\n\t\t// Check that the client's key servers are a subset of the encrypted object's key servers.\n\t\tif (\n\t\t\tservices.some((objectId) => {\n\t\t\t\tconst countInClient = this.#weight(objectId);\n\t\t\t\treturn countInClient > 0 && countInClient !== count(services, objectId);\n\t\t\t})\n\t\t) {\n\t\t\tthrow new InconsistentKeyServersError(\n\t\t\t\t`Client's key servers must be a subset of the encrypted object's key servers`,\n\t\t\t);\n\t\t}\n\t\t// Check that the threshold can be met with the client's key servers.\n\t\tif (threshold > this.#totalWeight) {\n\t\t\tthrow new InvalidThresholdError(\n\t\t\t\t`Invalid threshold ${threshold} for ${this.#totalWeight} servers`,\n\t\t\t);\n\t\t}\n\t}\n\n\tasync getKeyServers(): Promise<Map<string, KeyServer>> {\n\t\tif (!this.#keyServers) {\n\t\t\tthis.#keyServers = this.#loadKeyServers().catch((error) => {\n\t\t\t\tthis.#keyServers = null;\n\t\t\t\tthrow error;\n\t\t\t});\n\t\t}\n\t\treturn this.#keyServers;\n\t}\n\n\t/**\n\t * Get the public keys for the given services.\n\t * If all public keys are not in the cache, they are retrieved.\n\t *\n\t * @param services - The services to get the public keys for.\n\t * @returns The public keys for the given services in the same order as the given services.\n\t */\n\tasync getPublicKeys(services: string[]): Promise<G2Element[]> {\n\t\tconst keyServers = await this.getKeyServers();\n\n\t\t// Collect the key servers not already in store or cache.\n\t\tconst missingKeyServers = services.filter(\n\t\t\t(objectId) => !keyServers.has(objectId) && !this.#cachedPublicKeys.has(objectId),\n\t\t);\n\n\t\t// If there are missing key servers, retrieve them and update the cache.\n\t\tif (missingKeyServers.length > 0) {\n\t\t\t(\n\t\t\t\tawait retrieveKeyServers({\n\t\t\t\t\tobjectIds: missingKeyServers,\n\t\t\t\t\tclient: this.#suiClient,\n\t\t\t\t\tconfigs: this.#configs,\n\t\t\t\t})\n\t\t\t).forEach((keyServer) =>\n\t\t\t\tthis.#cachedPublicKeys.set(keyServer.objectId, G2Element.fromBytes(keyServer.pk)),\n\t\t\t);\n\t\t}\n\n\t\treturn services.map((objectId) => {\n\t\t\tconst keyServer = keyServers.get(objectId);\n\t\t\tif (keyServer) {\n\t\t\t\treturn G2Element.fromBytes(keyServer.pk);\n\t\t\t}\n\t\t\treturn this.#cachedPublicKeys.get(objectId)!;\n\t\t});\n\t}\n\n\t/**\n\t * Returns a list of key servers with multiplicity according to their weights.\n\t * The list is used for encryption.\n\t */\n\tasync #getWeightedKeyServers() {\n\t\tconst keyServers = await this.getKeyServers();\n\t\tconst keyServersWithMultiplicity = [];\n\t\tfor (const [objectId, config] of this.#configs) {\n\t\t\tconst keyServer = keyServers.get(objectId)!;\n\t\t\tfor (let i = 0; i < config.weight; i++) {\n\t\t\t\tkeyServersWithMultiplicity.push(keyServer);\n\t\t\t}\n\t\t}\n\t\treturn keyServersWithMultiplicity;\n\t}\n\n\tasync #loadKeyServers(): Promise<Map<string, KeyServer>> {\n\t\tconst keyServers = await retrieveKeyServers({\n\t\t\tobjectIds: [...this.#configs.keys()],\n\t\t\tclient: this.#suiClient,\n\t\t\tconfigs: this.#configs,\n\t\t});\n\n\t\tif (keyServers.length === 0) {\n\t\t\tthrow new InvalidKeyServerError('No key servers found');\n\t\t}\n\n\t\tif (this.#verifyKeyServers) {\n\t\t\tawait Promise.all(\n\t\t\t\tkeyServers.map(async (server) => {\n\t\t\t\t\t// Skip /service verification for committee key server type since the request goes through an aggregator.\n\t\t\t\t\tif (server.serverType === 'Committee') {\n\t\t\t\t\t\treturn;\n\t\t\t\t\t}\n\t\t\t\t\tconst config = this.#configs.get(server.objectId);\n\t\t\t\t\tif (!(await verifyKeyServer(server, this.#timeout, config?.apiKeyName, config?.apiKey))) {\n\t\t\t\t\t\tthrow new InvalidKeyServerError(`Key server ${server.objectId} is not valid`);\n\t\t\t\t\t}\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\treturn new Map(keyServers.map((server) => [server.objectId, server]));\n\t}\n\n\t/**\n\t * Fetch keys from the key servers and update the cache.\n\t *\n\t * It is recommended to call this function once for all ids of all encrypted objects if\n\t * there are multiple, then call decrypt for each object. This avoids calling fetchKey\n\t * individually for each decrypt.\n\t *\n\t * @param ids - The ids of the encrypted objects.\n\t * @param txBytes - The transaction bytes to use (that calls seal_approve* functions).\n\t * @param sessionKey - The session key to use.\n\t * @param threshold - The threshold for the TSS encryptions. The function returns when a threshold of key servers had returned keys for all ids.\n\t */\n\tasync fetchKeys({ ids, txBytes, sessionKey, threshold }: FetchKeysOptions) {\n\t\tif (threshold > this.#totalWeight || threshold < 1) {\n\t\t\tthrow new InvalidThresholdError(\n\t\t\t\t`Invalid threshold ${threshold} servers with weights ${JSON.stringify(this.#configs)}`,\n\t\t\t);\n\t\t}\n\t\tconst keyServers = await this.getKeyServers();\n\t\tconst fullIds = ids.map((id) => createFullId(sessionKey.getPackageId(), id));\n\n\t\t// Count a server as completed if it has keys for all fullIds.\n\t\t// Duplicated key server ids will be counted towards the threshold.\n\t\tlet completedWeight = 0;\n\t\tconst remainingKeyServers = [];\n\t\tlet remainingKeyServersWeight = 0;\n\t\tfor (const objectId of keyServers.keys()) {\n\t\t\tif (fullIds.every((fullId) => this.#cachedKeys.has(`${fullId}:${objectId}`))) {\n\t\t\t\tcompletedWeight += this.#weight(objectId);\n\t\t\t} else {\n\t\t\t\tremainingKeyServers.push(objectId);\n\t\t\t\tremainingKeyServersWeight += this.#weight(objectId);\n\t\t\t}\n\t\t}\n\n\t\t// Return early if we have enough keys from cache.\n\t\tif (completedWeight >= threshold) {\n\t\t\treturn;\n\t\t}\n\n\t\tconst certificate = await sessionKey.getCertificate();\n\t\tconst signedRequest = await sessionKey.createRequestParams(txBytes);\n\n\t\tconst controller = new AbortController();\n\t\tconst errors: Error[] = [];\n\n\t\tconst keyFetches = remainingKeyServers.map(async (objectId) => {\n\t\t\tconst server = keyServers.get(objectId)!;\n\t\t\ttry {\n\t\t\t\tconst config = this.#configs.get(objectId);\n\t\t\t\tconst allKeys = await fetchKeysForAllIds({\n\t\t\t\t\turl: server.url,\n\t\t\t\t\trequestSignature: signedRequest.requestSignature,\n\t\t\t\t\ttransactionBytes: txBytes,\n\t\t\t\t\tencKey: signedRequest.encKey,\n\t\t\t\t\tencKeyPk: signedRequest.encKeyPk,\n\t\t\t\t\tencVerificationKey: signedRequest.encVerificationKey,\n\t\t\t\t\tcertificate,\n\t\t\t\t\ttimeout: this.#timeout,\n\t\t\t\t\tapiKeyName: config?.apiKeyName,\n\t\t\t\t\tapiKey: config?.apiKey,\n\t\t\t\t\tsignal: controller.signal,\n\t\t\t\t});\n\t\t\t\t// Check validity of the keys and add them to the cache.\n\t\t\t\tfor (const { fullId, key } of allKeys) {\n\t\t\t\t\tconst keyElement = G1Element.fromBytes(key);\n\t\t\t\t\tif (\n\t\t\t\t\t\t!BonehFranklinBLS12381Services.verifyUserSecretKey(\n\t\t\t\t\t\t\tkeyElement,\n\t\t\t\t\t\t\tfullId,\n\t\t\t\t\t\t\tG2Element.fromBytes(server.pk),\n\t\t\t\t\t\t)\n\t\t\t\t\t) {\n\t\t\t\t\t\tconsole.warn('Received invalid key from key server ' + server.objectId);\n\t\t\t\t\t\tcontinue;\n\t\t\t\t\t}\n\t\t\t\t\tthis.#cachedKeys.set(`${fullId}:${server.objectId}`, keyElement);\n\t\t\t\t}\n\n\t\t\t\t// Check if all the receivedIds are consistent with the requested fullIds.\n\t\t\t\t// If so, consider the key server got all keys and mark as completed.\n\t\t\t\tif (fullIds.every((fullId) => this.#cachedKeys.has(`${fullId}:${server.objectId}`))) {\n\t\t\t\t\tcompletedWeight += this.#weight(objectId);\n\n\t\t\t\t\t// Return early if the completed servers is more than the threshold.\n\t\t\t\t\tif (completedWeight >= threshold) {\n\t\t\t\t\t\tcontroller.abort();\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t} catch (error) {\n\t\t\t\tif (!controller.signal.aborted) {\n\t\t\t\t\terrors.push(error as Error);\n\t\t\t\t}\n\t\t\t} finally {\n\t\t\t\t// If there are too many errors that the threshold is not attainable, return early with error.\n\t\t\t\tremainingKeyServersWeight -= this.#weight(objectId);\n\t\t\t\tif (remainingKeyServersWeight < threshold - completedWeight) {\n\t\t\t\t\tcontroller.abort(new TooManyFailedFetchKeyRequestsError());\n\t\t\t\t}\n\t\t\t}\n\t\t});\n\n\t\tawait Promise.allSettled(keyFetches);\n\n\t\tif (completedWeight < threshold) {\n\t\t\tthrow toMajorityError(errors);\n\t\t}\n\t}\n\n\t/**\n\t * Get derived keys from the given services.\n\t *\n\t * @param id - The id of the encrypted object.\n\t * @param txBytes - The transaction bytes to use (that calls seal_approve* functions).\n\t * @param sessionKey - The session key to use.\n\t * @param threshold - The threshold.\n\t * @returns - Derived keys for the given services that are in the cache as a \"service object ID\" -> derived key map. If the call is succesful, exactly threshold keys will be returned.\n\t */\n\tasync getDerivedKeys({\n\t\tkemType = KemType.BonehFranklinBLS12381DemCCA,\n\t\tid,\n\t\ttxBytes,\n\t\tsessionKey,\n\t\tthreshold,\n\t}: GetDerivedKeysOptions): Promise<Map<string, DerivedKey>> {\n\t\tswitch (kemType) {\n\t\t\tcase KemType.BonehFranklinBLS12381DemCCA:\n\t\t\t\tconst keyServers = await this.getKeyServers();\n\t\t\t\tif (threshold > this.#totalWeight) {\n\t\t\t\t\tthrow new InvalidThresholdError(\n\t\t\t\t\t\t`Invalid threshold ${threshold} for ${this.#totalWeight} servers`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tawait this.fetchKeys({\n\t\t\t\t\tids: [id],\n\t\t\t\t\ttxBytes,\n\t\t\t\t\tsessionKey,\n\t\t\t\t\tthreshold,\n\t\t\t\t});\n\n\t\t\t\t// After calling fetchKeys, we can be sure that there are at least `threshold` of the required keys in the cache.\n\t\t\t\t// It is also checked there that the KeyServerType is BonehFranklinBLS12381 for all services.\n\n\t\t\t\tconst fullId = createFullId(sessionKey.getPackageId(), id);\n\n\t\t\t\tconst derivedKeys = new Map();\n\t\t\t\tlet weight = 0;\n\t\t\t\tfor (const objectId of keyServers.keys()) {\n\t\t\t\t\t// The code below assumes that the KeyServerType is BonehFranklinBLS12381.\n\t\t\t\t\tconst cachedKey = this.#cachedKeys.get(`${fullId}:${objectId}`);\n\t\t\t\t\tif (cachedKey) {\n\t\t\t\t\t\tderivedKeys.set(objectId, new BonehFranklinBLS12381DerivedKey(cachedKey));\n\t\t\t\t\t\tweight += this.#weight(objectId);\n\t\t\t\t\t\tif (weight >= threshold) {\n\t\t\t\t\t\t\t// We have enough keys, so we can stop.\n\t\t\t\t\t\t\tbreak;\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\treturn derivedKeys;\n\t\t}\n\t}\n}\n"],"mappings":";;;;;;;;;;;AAmDA,IAAa,aAAb,MAAwB;CACvB;CACA;CACA,cAAsD;CACtD;CAEA,8BAAc,IAAI,KAA6B;CAC/C,oCAAoB,IAAI,KAAwB;CAChD;CACA;CAEA,YAAY,SAA4B;AACvC,QAAKA,YAAa,QAAQ;AAE1B,MACC,IAAI,IAAI,QAAQ,cAAc,KAAK,MAAM,EAAE,SAAS,CAAC,CAAC,SAAS,QAAQ,cAAc,OAErF,OAAM,IAAI,0BAA0B,uBAAuB;AAG5D,MACC,QAAQ,cAAc,MAAM,MAAO,EAAE,cAAc,CAAC,EAAE,UAAY,CAAC,EAAE,cAAc,EAAE,OAAQ,CAE7F,OAAM,IAAI,0BACT,kFACA;AAGF,QAAKC,UAAW,IAAI,IAAI,QAAQ,cAAc,KAAK,WAAW,CAAC,OAAO,UAAU,OAAO,CAAC,CAAC;AACzF,QAAKC,cAAe,QAAQ,cAC1B,KAAK,WAAW,OAAO,OAAO,CAC9B,QAAQ,KAAK,SAAS,MAAM,MAAM,EAAE;AAEtC,QAAKC,mBAAoB,QAAQ,oBAAoB;AACrD,QAAKC,UAAW,QAAQ,WAAW;;;;;;;;;;;;;;;CAgBpC,MAAM,QAAQ,EACb,UAAU,QAAQ,6BAClB,UAAU,QAAQ,WAClB,WACA,WACA,IACA,MACA,MAAM,IAAI,YAAY,IACJ;EAClB,MAAM,aAAa,MAAM,MAAKJ,UAAW,KAAK,UAAU,EAAE,UAAU,WAAW,CAAC;AAChF,MAAI,OAAO,WAAW,OAAO,QAAQ,KAAK,IACzC,OAAM,IAAI,oBAAoB,WAAW,UAAU,2BAA2B;AAG/E,SAAO,QAAQ;GACd,YAAY,MAAM,MAAKK,uBAAwB;GAC/C;GACA;GACA;GACA;GACA,iBAAiB,MAAKC,sBACrB,SACA,MACA,IACA;GACD,CAAC;;CAGH,uBACC,MACA,MACA,KACkB;AAClB,UAAQ,MAAR;GACC,KAAK,QAAQ,UACZ,QAAO,IAAI,UAAU,MAAM,IAAI;GAChC,KAAK,QAAQ,WACZ,QAAO,IAAI,WAAW,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;CAsBnC,MAAM,QAAQ,EACb,MACA,YACA,SACA,uBACA,mBACkB;EAClB,MAAM,kBAAkB,gBAAgB,MAAM,KAAK;AAEnD,QAAKC,2BACJ,gBAAgB,SAAS,KAAK,MAAM,EAAE,GAAG,EACzC,gBAAgB,UAChB;AAED,QAAM,KAAK,UAAU;GACpB,KAAK,CAAC,gBAAgB,GAAG;GACzB;GACA;GACA,WAAW,gBAAgB;GAC3B,CAAC;AAEF,MAAI,uBAAuB;GAC1B,MAAM,aAAa,MAAM,KAAK,cAC7B,gBAAgB,SAAS,KAAK,CAAC,UAAU,OAAO,SAAS,CACzD;AACD,UAAO,QAAQ;IACd;IACA,MAAM,MAAKC;IACX;IACA,iBAAiB;IACjB,CAAC;;AAEH,SAAO,QAAQ;GAAE;GAAiB,MAAM,MAAKA;GAAa;GAAiB,CAAC;;CAG7E,QAAQ,UAAkB;AACzB,SAAO,MAAKP,QAAS,IAAI,SAAS,EAAE,UAAU;;CAG/C,4BAA4B,UAAoB,WAAmB;AAElE,MACC,SAAS,MAAM,aAAa;GAC3B,MAAM,gBAAgB,MAAKQ,OAAQ,SAAS;AAC5C,UAAO,gBAAgB,KAAK,kBAAkB,MAAM,UAAU,SAAS;IACtE,CAEF,OAAM,IAAI,4BACT,8EACA;AAGF,MAAI,YAAY,MAAKP,YACpB,OAAM,IAAI,sBACT,qBAAqB,UAAU,OAAO,MAAKA,YAAa,UACxD;;CAIH,MAAM,gBAAiD;AACtD,MAAI,CAAC,MAAKQ,WACT,OAAKA,aAAc,MAAKC,gBAAiB,CAAC,OAAO,UAAU;AAC1D,SAAKD,aAAc;AACnB,SAAM;IACL;AAEH,SAAO,MAAKA;;;;;;;;;CAUb,MAAM,cAAc,UAA0C;EAC7D,MAAM,aAAa,MAAM,KAAK,eAAe;EAG7C,MAAM,oBAAoB,SAAS,QACjC,aAAa,CAAC,WAAW,IAAI,SAAS,IAAI,CAAC,MAAKE,iBAAkB,IAAI,SAAS,CAChF;AAGD,MAAI,kBAAkB,SAAS,EAC9B,EACC,MAAM,mBAAmB;GACxB,WAAW;GACX,QAAQ,MAAKZ;GACb,SAAS,MAAKC;GACd,CAAC,EACD,SAAS,cACV,MAAKW,iBAAkB,IAAI,UAAU,UAAU,UAAU,UAAU,UAAU,GAAG,CAAC,CACjF;AAGF,SAAO,SAAS,KAAK,aAAa;GACjC,MAAM,YAAY,WAAW,IAAI,SAAS;AAC1C,OAAI,UACH,QAAO,UAAU,UAAU,UAAU,GAAG;AAEzC,UAAO,MAAKA,iBAAkB,IAAI,SAAS;IAC1C;;;;;;CAOH,OAAMP,wBAAyB;EAC9B,MAAM,aAAa,MAAM,KAAK,eAAe;EAC7C,MAAM,6BAA6B,EAAE;AACrC,OAAK,MAAM,CAAC,UAAU,WAAW,MAAKJ,SAAU;GAC/C,MAAM,YAAY,WAAW,IAAI,SAAS;AAC1C,QAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,IAClC,4BAA2B,KAAK,UAAU;;AAG5C,SAAO;;CAGR,OAAMU,iBAAmD;EACxD,MAAM,aAAa,MAAM,mBAAmB;GAC3C,WAAW,CAAC,GAAG,MAAKV,QAAS,MAAM,CAAC;GACpC,QAAQ,MAAKD;GACb,SAAS,MAAKC;GACd,CAAC;AAEF,MAAI,WAAW,WAAW,EACzB,OAAM,IAAI,sBAAsB,uBAAuB;AAGxD,MAAI,MAAKE,iBACR,OAAM,QAAQ,IACb,WAAW,IAAI,OAAO,WAAW;AAEhC,OAAI,OAAO,eAAe,YACzB;GAED,MAAM,SAAS,MAAKF,QAAS,IAAI,OAAO,SAAS;AACjD,OAAI,CAAE,MAAM,gBAAgB,QAAQ,MAAKG,SAAU,QAAQ,YAAY,QAAQ,OAAO,CACrF,OAAM,IAAI,sBAAsB,cAAc,OAAO,SAAS,eAAe;IAE7E,CACF;AAEF,SAAO,IAAI,IAAI,WAAW,KAAK,WAAW,CAAC,OAAO,UAAU,OAAO,CAAC,CAAC;;;;;;;;;;;;;;CAetE,MAAM,UAAU,EAAE,KAAK,SAAS,YAAY,aAA+B;AAC1E,MAAI,YAAY,MAAKF,eAAgB,YAAY,EAChD,OAAM,IAAI,sBACT,qBAAqB,UAAU,wBAAwB,KAAK,UAAU,MAAKD,QAAS,GACpF;EAEF,MAAM,aAAa,MAAM,KAAK,eAAe;EAC7C,MAAM,UAAU,IAAI,KAAK,OAAO,aAAa,WAAW,cAAc,EAAE,GAAG,CAAC;EAI5E,IAAI,kBAAkB;EACtB,MAAM,sBAAsB,EAAE;EAC9B,IAAI,4BAA4B;AAChC,OAAK,MAAM,YAAY,WAAW,MAAM,CACvC,KAAI,QAAQ,OAAO,WAAW,MAAKO,WAAY,IAAI,GAAG,OAAO,GAAG,WAAW,CAAC,CAC3E,oBAAmB,MAAKC,OAAQ,SAAS;OACnC;AACN,uBAAoB,KAAK,SAAS;AAClC,gCAA6B,MAAKA,OAAQ,SAAS;;AAKrD,MAAI,mBAAmB,UACtB;EAGD,MAAM,cAAc,MAAM,WAAW,gBAAgB;EACrD,MAAM,gBAAgB,MAAM,WAAW,oBAAoB,QAAQ;EAEnE,MAAM,aAAa,IAAI,iBAAiB;EACxC,MAAM,SAAkB,EAAE;EAE1B,MAAM,aAAa,oBAAoB,IAAI,OAAO,aAAa;GAC9D,MAAM,SAAS,WAAW,IAAI,SAAS;AACvC,OAAI;IACH,MAAM,SAAS,MAAKR,QAAS,IAAI,SAAS;IAC1C,MAAM,UAAU,MAAM,mBAAmB;KACxC,KAAK,OAAO;KACZ,kBAAkB,cAAc;KAChC,kBAAkB;KAClB,QAAQ,cAAc;KACtB,UAAU,cAAc;KACxB,oBAAoB,cAAc;KAClC;KACA,SAAS,MAAKG;KACd,YAAY,QAAQ;KACpB,QAAQ,QAAQ;KAChB,QAAQ,WAAW;KACnB,CAAC;AAEF,SAAK,MAAM,EAAE,QAAQ,SAAS,SAAS;KACtC,MAAM,aAAa,UAAU,UAAU,IAAI;AAC3C,SACC,CAAC,8BAA8B,oBAC9B,YACA,QACA,UAAU,UAAU,OAAO,GAAG,CAC9B,EACA;AACD,cAAQ,KAAK,0CAA0C,OAAO,SAAS;AACvE;;AAED,WAAKI,WAAY,IAAI,GAAG,OAAO,GAAG,OAAO,YAAY,WAAW;;AAKjE,QAAI,QAAQ,OAAO,WAAW,MAAKA,WAAY,IAAI,GAAG,OAAO,GAAG,OAAO,WAAW,CAAC,EAAE;AACpF,wBAAmB,MAAKC,OAAQ,SAAS;AAGzC,SAAI,mBAAmB,UACtB,YAAW,OAAO;;YAGZ,OAAO;AACf,QAAI,CAAC,WAAW,OAAO,QACtB,QAAO,KAAK,MAAe;aAEnB;AAET,iCAA6B,MAAKA,OAAQ,SAAS;AACnD,QAAI,4BAA4B,YAAY,gBAC3C,YAAW,MAAM,IAAI,oCAAoC,CAAC;;IAG3D;AAEF,QAAM,QAAQ,WAAW,WAAW;AAEpC,MAAI,kBAAkB,UACrB,OAAM,gBAAgB,OAAO;;;;;;;;;;;CAa/B,MAAM,eAAe,EACpB,UAAU,QAAQ,6BAClB,IACA,SACA,YACA,aAC2D;AAC3D,UAAQ,SAAR;GACC,KAAK,QAAQ;IACZ,MAAM,aAAa,MAAM,KAAK,eAAe;AAC7C,QAAI,YAAY,MAAKP,YACpB,OAAM,IAAI,sBACT,qBAAqB,UAAU,OAAO,MAAKA,YAAa,UACxD;AAEF,UAAM,KAAK,UAAU;KACpB,KAAK,CAAC,GAAG;KACT;KACA;KACA;KACA,CAAC;IAKF,MAAM,SAAS,aAAa,WAAW,cAAc,EAAE,GAAG;IAE1D,MAAM,8BAAc,IAAI,KAAK;IAC7B,IAAI,SAAS;AACb,SAAK,MAAM,YAAY,WAAW,MAAM,EAAE;KAEzC,MAAM,YAAY,MAAKM,WAAY,IAAI,GAAG,OAAO,GAAG,WAAW;AAC/D,SAAI,WAAW;AACd,kBAAY,IAAI,UAAU,IAAI,gCAAgC,UAAU,CAAC;AACzE,gBAAU,MAAKC,OAAQ,SAAS;AAChC,UAAI,UAAU,UAEb;;;AAIH,WAAO"}
|
package/dist/types.d.mts
CHANGED
|
@@ -20,7 +20,11 @@ interface SealClientOptions {
|
|
|
20
20
|
suiClient: SealCompatibleClient;
|
|
21
21
|
/** Array of key server configs consisting of objectId, weight, optional API key name and API key */
|
|
22
22
|
serverConfigs: KeyServerConfig[];
|
|
23
|
-
/**
|
|
23
|
+
/**
|
|
24
|
+
* Whether to verify the key servers' authenticity.
|
|
25
|
+
* Note: /service verification is skipped for committee key servers (serverType === 'Committee')
|
|
26
|
+
* since their requests go through an aggregator.
|
|
27
|
+
*/
|
|
24
28
|
verifyKeyServers?: boolean;
|
|
25
29
|
/** Timeout in milliseconds for network requests. */
|
|
26
30
|
timeout?: number;
|
package/dist/types.d.mts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.mts","names":[],"sources":["../src/types.ts"],"mappings":";;;;;KAQY,oBAAA,GAAuB,oBAAA;EAClC,IAAA,EAAM,UAAA;AAAA;AAAA,
|
|
1
|
+
{"version":3,"file":"types.d.mts","names":[],"sources":["../src/types.ts"],"mappings":";;;;;KAQY,oBAAA,GAAuB,oBAAA;EAClC,IAAA,EAAM,UAAA;AAAA;AAAA,UAkBU,eAAA;EAChB,QAAA;EACA,MAAA;EACA,UAAA;EACA,MAAA;EAOgB;;EAJhB,aAAA;AAAA;;UAIgB,iBAAA;EAChB,SAAA,EAAW,oBAAA;EAEI;EAAf,aAAA,EAAe,eAAA;EAQf;;;AAGD;;EALC,gBAAA;EAOU;EALV,OAAA;AAAA;AAAA,UAGgB,cAAA;EAcA;EAZhB,OAAA,GAAU,OAAA;EAAV;EAEA,OAAA,GAAU,OAAA;EAAV;EAEA,SAAA;EAAA;EAEA,SAAA;EAEA;EAAA,EAAA;EAEM;EAAN,IAAA,EAAM,UAAA;EAEA;EAAN,GAAA,GAAM,UAAA;AAAA;AAAA,UAGU,cAAA;EAAc;EAE9B,IAAA,EAAM,UAAA;EAAA;EAEN,UAAA,EAAY,UAAA;EAEH;EAAT,OAAA,EAAS,UAAA;EAAU;EAEnB,qBAAA;EANM;EAQN,eAAA;AAAA;AAAA,UAGgB,gBAAA;EAPP;EAST,GAAA;EALA;EAOA,OAAA,EAAS,UAAA;EAPM;EASf,UAAA,EAAY,UAAA;EANoB;EAQhC,SAAA;AAAA;AAAA,UAGgB,qBAAA;EAChB,OAAA,GAAU,OAAA;EARD;EAUT,EAAA;EARY;EAUZ,OAAA,EAAS,UAAA;EARA;EAUT,UAAA,EAAY,UAAA;EAPI;EAShB,SAAA;AAAA"}
|
package/dist/version.mjs
CHANGED
package/dist/version.mjs.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"version.mjs","names":[],"sources":["../src/version.ts"],"sourcesContent":["// Copyright (c) Mysten Labs, Inc.\n// SPDX-License-Identifier: Apache-2.0\n\n// This file is generated by genversion.mjs. Do not edit it directly.\n\nexport const PACKAGE_VERSION = '1.
|
|
1
|
+
{"version":3,"file":"version.mjs","names":[],"sources":["../src/version.ts"],"sourcesContent":["// Copyright (c) Mysten Labs, Inc.\n// SPDX-License-Identifier: Apache-2.0\n\n// This file is generated by genversion.mjs. Do not edit it directly.\n\nexport const PACKAGE_VERSION = '1.3.1';\n"],"mappings":";AAKA,MAAa,kBAAkB"}
|
package/docs/index.md
CHANGED
|
@@ -36,10 +36,53 @@ const client = new SuiGrpcClient({
|
|
|
36
36
|
|
|
37
37
|
The `seal()` function accepts the following options:
|
|
38
38
|
|
|
39
|
-
- **`serverConfigs`** (required) - Array of key server configurations
|
|
39
|
+
- **`serverConfigs`** (required) - Array of key server configurations (see
|
|
40
|
+
[Choosing key servers](#choosing-key-servers)). Each entry contains:
|
|
41
|
+
- **`objectId`** (required) - The key server object ID
|
|
42
|
+
- **`weight`** (required) - How many times the key server can contribute towards reaching the
|
|
43
|
+
decryption threshold
|
|
44
|
+
- **`aggregatorUrl`** (required for decentralized servers) - The aggregator endpoint URL
|
|
45
|
+
- **`apiKeyName`** and **`apiKey`** (optional) - Required if the server requires API key
|
|
46
|
+
authentication
|
|
40
47
|
- **`verifyKeyServers`** (optional) - Whether to verify key server authenticity (default: `true`)
|
|
41
48
|
- **`timeout`** (optional) - Timeout in milliseconds for network requests (default: `10000`)
|
|
42
49
|
|
|
50
|
+
## Choosing key servers
|
|
51
|
+
|
|
52
|
+
Seal supports two server types, **independent** and **decentralized** (committee mode), which you
|
|
53
|
+
can use individually or in combination. Each key server counts as one server in your threshold
|
|
54
|
+
configuration. Decentralized servers require an `aggregatorUrl`, because all fetch key calls go
|
|
55
|
+
through an aggregator:
|
|
56
|
+
|
|
57
|
+
```ts
|
|
58
|
+
const client = new SuiGrpcClient({
|
|
59
|
+
network: 'testnet',
|
|
60
|
+
baseUrl: 'https://fullnode.testnet.sui.io:443',
|
|
61
|
+
}).$extend(
|
|
62
|
+
seal({
|
|
63
|
+
serverConfigs: [
|
|
64
|
+
// Decentralized (committee mode) server
|
|
65
|
+
{
|
|
66
|
+
objectId: '0xb012378c9f3799fb5b1a7083da74a4069e3c3f1c93de0b27212a5799ce1e1e98',
|
|
67
|
+
aggregatorUrl: 'https://seal-aggregator-testnet.mystenlabs.com',
|
|
68
|
+
weight: 1,
|
|
69
|
+
},
|
|
70
|
+
// Independent server
|
|
71
|
+
{
|
|
72
|
+
objectId: '0x73d05d62c18d9374e3ea529e8e0ed6161da1a141a94d3f76ae3fe4e99356db75',
|
|
73
|
+
weight: 1,
|
|
74
|
+
},
|
|
75
|
+
],
|
|
76
|
+
}),
|
|
77
|
+
);
|
|
78
|
+
```
|
|
79
|
+
|
|
80
|
+
If a server requires API key authentication, include `apiKeyName` and `apiKey` in its configuration
|
|
81
|
+
object. The SDK sends these as an HTTP header in the format `apiKeyName: apiKey`.
|
|
82
|
+
|
|
83
|
+
For more details on server types, verified key servers, and API key authentication, see
|
|
84
|
+
[Using Seal](https://seal-docs.wal.app/UsingSeal) in the main Seal documentation.
|
|
85
|
+
|
|
43
86
|
## Basic usage
|
|
44
87
|
|
|
45
88
|
### Encrypting data
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@mysten/seal",
|
|
3
|
-
"version": "1.
|
|
3
|
+
"version": "1.3.1",
|
|
4
4
|
"description": "Seal SDK",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"author": "Mysten Labs <build@mystenlabs.com>",
|
|
@@ -40,7 +40,7 @@
|
|
|
40
40
|
"@mysten/bcs": "^2.1.0"
|
|
41
41
|
},
|
|
42
42
|
"peerDependencies": {
|
|
43
|
-
"@mysten/sui": "^2.20.
|
|
43
|
+
"@mysten/sui": "^2.20.4"
|
|
44
44
|
},
|
|
45
45
|
"scripts": {
|
|
46
46
|
"clean": "rm -rf tsconfig.tsbuildinfo ./dist",
|