sui-seallisted

# Seal Skill Integrate [Seal](https://seal-docs.wal.app) — Mysten Labs' decentralized secrets management service. Seal encrypts data client-side with **identity-based encryption (IBE)** and delegates decryption-key release to a **threshold of off-chain key servers** that evaluate **onchain access policies** written in Move. Storage is orthogonal: ciphertext lives wherever needed (Walrus, Sui objects, S3). Follow these rules precisely. > **Not for**: wallet private keys, regulated PHI, classified/government secrets. Seal's trust model assumes `t-of-n` key servers are honest — it is not suitable when a single compromised server must never leak plaintext. See the Security section. This skill covers both sides of a Seal integration: the Move package that defines who can decrypt, and the TypeScript SDK that performs encryption and decryption. --- ## 1. Mental model (read first) Seal is not "encrypt with a key and store the key somewhere." The flow is: 1. The Move package defines one or more `seal_approve*` entry functions. Each takes an identity `id: vector<u8>` plus any objects it needs, and **aborts** if access is denied. 2. **Encrypt** data client-side against a chosen identity `id` and a set of key servers with a threshold `t`. The SDK produces ciphertext and a symmetric key. 3. To **decrypt**, the client builds a PTB that calls the `seal_approve*` function and asks `t` key servers to release a derived decryption key. Each key server dry-runs the PTB on a full node; if