Seal Skill

Integrate Seal — Mysten Labs' decentralized secrets management service. Seal encrypts data client-side with identity-based encryption (IBE) and delegates decryption-key release to a threshold of off-chain key servers that evaluate onchain access policies written in Move. Storage is orthogonal: ciphertext lives wherever needed (Walrus, Sui objects, S3). Follow these rules precisely.

Not for: wallet private keys, regulated PHI, classified/government secrets. Seal's trust model assumes t-of-n key servers are honest — it is not suitable when a single compromised server must never leak plaintext. See the Security section.

This skill covers both sides of a Seal integration: the Move package that defines who can decrypt, and the TypeScript SDK that performs encryption and decryption.

1. Mental model (read first)

Seal is not "encrypt with a key and store the key somewhere." The flow is:

1. The Move package defines one or more seal_approve* entry functions. Each takes an identity id: vector<u8> plus any objects it needs, and aborts if access is denied.
2. Encrypt data client-side against a chosen identity id and a set of key servers with a threshold t. The SDK produces ciphertext and a symmetric key.
3. To decrypt, the client builds a PTB that calls the seal_approve* function and asks t key servers to release a derived decryption key. Each key server dry-runs the PTB on a full node; if the function does not abort, the server returns its share.
4. The client reconstructs the decryption key from t shares and decrypts locally.