@keyhive/keyhive 0.1.0-alpha.4 → 0.1.0-alpha.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@keyhive/keyhive",
-  "version": "0.1.0-alpha.4",
+  "version": "0.1.0-alpha.5",
   "description": "",
   "main": "pkg/keyhive_wasm.js",
   "keywords": [],

package/pkg/keyhive_wasm.d.ts

@@ -9,16 +9,6 @@ export class Access {
     static tryFromString(s: string): Access | undefined;
 }
 
-/**
- * The result of adding a member: the membership delegation.
- */
-export class AddMemberUpdate {
-    private constructor();
-    free(): void;
-    [Symbol.dispose](): void;
-    readonly delegation: SignedDelegation;
-}
-
 export class Agent {
     private constructor();
     free(): void;
@@ -127,16 +117,14 @@ export class ContactCard {
 
 /**
  * Plaintext plus the application secret key that decrypted it.
- *
- * The key lets the consumer recover the blob's external predecessor-secret
- * chain and chain further encryptions onto it, without re-entering CGKA.
  */
-export class DecryptedWithKey {
+export class DecryptedKeyed {
     private constructor();
     free(): void;
     [Symbol.dispose](): void;
     /**
      * The 32-byte application secret key used to decrypt this content.
+     * Treat as secret: do not log or persist unencrypted.
      */
     readonly applicationSecret: Uint8Array;
     readonly plaintext: Uint8Array;
@@ -192,8 +180,7 @@ export class Encrypted {
     [Symbol.dispose](): void;
     /**
      * Decrypt this content with an explicit 32-byte application secret key,
-     * bypassing CGKA. The consumer uses this to follow the external
-     * predecessor-secret chain once it has recovered a blob's key.
+     * bypassing CGKA.
      */
     decryptWithKey(key: Uint8Array): Uint8Array;
     static fromBytes(bytes: Uint8Array): Encrypted;
@@ -212,11 +199,19 @@ export class EncryptedContentWithUpdate {
     [Symbol.dispose](): void;
     encrypted_content(): Encrypted;
     update_op(): SignedCgkaOperation | undefined;
+}
+
+/**
+ * Encrypted content plus the application secret key it was encrypted under.
+ */
+export class EncryptedKeyed {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    encrypted_content(): Encrypted;
+    update_op(): SignedCgkaOperation | undefined;
     /**
      * The 32-byte application secret key used to encrypt this content.
-     *
-     * Lets the consumer build the external predecessor-secret chain and chain
-     * further encryptions onto this blob.
      */
     readonly applicationSecret: Uint8Array;
 }
@@ -313,7 +308,7 @@ export class Keyhive {
     free(): void;
     [Symbol.dispose](): void;
     accessForDoc(id: Identifier, doc_id: DocumentId): Promise<Access | undefined>;
-    addMember(to_add: Agent, membered: Membered, access: Access, other_relevant_docs: Document[]): Promise<AddMemberUpdate>;
+    addMember(to_add: Agent, membered: Membered, access: Access, other_relevant_docs: Document[]): Promise<SignedDelegation>;
     /**
      * Returns all agent events with deduplicated storage and two-tier indirection
      * for membership, prekey, and CGKA ops.
@@ -334,14 +329,9 @@ export class Keyhive {
     /**
      * Force a PCS key rotation and return the new leaf secret, serialized as a
      * one-entry `BTreeMap<ShareKey, ShareSecretKey>` (the exact format
-     * `importPrekeySecrets` accepts). A sibling instance of this identity can
-     * install it to derive the rotated key without re-importing the whole bundle.
+     * `importPrekeySecrets` accepts).
      */
     forcePcsUpdate(doc: Document): Promise<Uint8Array>;
-    /**
-     * Generate a document. Whether it provides forward secrecy is determined by
-     * this peer's forward-secrecy policy (chosen at `Keyhive.init`).
-     */
     generateDocument(coparents: Peer[], initial_content_ref_head: ChangeId, more_initial_content_refs: ChangeId[]): Promise<Document>;
     generateGroup(js_coparents: Peer[]): Promise<Group>;
     getAgent(id: Identifier): Promise<Agent | undefined>;
@@ -352,9 +342,6 @@ export class Keyhive {
     importPrekeySecrets(bytes: Uint8Array): Promise<void>;
     ingestArchive(archive: Archive): Promise<void>;
     ingestEventsBytes(events_bytes_array: Array<any>): Promise<Array<any>>;
-    /**
-     * Initialize a peer.
-     */
     static init(signer: Signer, ciphertext_store: CiphertextStore, event_handler: Function): Promise<Keyhive>;
     intoArchive(): Promise<Archive>;
     membershipOpsForAgent(agent: Agent): Promise<Map<any, any>>;
@@ -369,13 +356,15 @@ export class Keyhive {
     tryDecrypt(doc: Document, encrypted: Encrypted): Promise<Uint8Array>;
     /**
      * Decrypt content and also return the 32-byte application secret key used.
-     *
-     * The consumer follows the external predecessor-secret chain from this key
-     * with `Encrypted.decryptWithKey`, avoiding further CGKA dives.
      */
-    tryDecryptWithKey(doc: Document, encrypted: Encrypted): Promise<DecryptedWithKey>;
+    tryDecryptKeyed(doc: Document, encrypted: Encrypted): Promise<DecryptedKeyed>;
     tryEncrypt(doc: Document, content_ref: ChangeId, js_pred_refs: ChangeId[], content: Uint8Array): Promise<EncryptedContentWithUpdate>;
     tryEncryptArchive(doc: Document, content_ref: ChangeId, pred_refs: ChangeId[], content: Uint8Array): Promise<EncryptedContentWithUpdate>;
+    /**
+     * Encrypt content and also return the application secret key it was
+     * encrypted under.
+     */
+    tryEncryptKeyed(doc: Document, content_ref: ChangeId, js_pred_refs: ChangeId[], content: Uint8Array): Promise<EncryptedKeyed>;
     tryPcsKeyHash(doc: Document): Promise<Uint8Array | undefined>;
     trySign(data: Uint8Array): Promise<Signed>;
     readonly id: IndividualId;
@@ -542,12 +531,6 @@ export function setPanicHook(): void;
 export function symmetricDecrypt(key: Uint8Array, blob: Uint8Array): Uint8Array;
 
 /**
- * AEAD-encrypt `plaintext` under a 32-byte `key`.
- *
- * `associated_data` flavors the synthetic nonce (e.g. the document or content
- * id) so identical plaintext under the same key in different contexts produces
- * distinct ciphertext. Returns `nonce(24) || ciphertext` (the ciphertext
- * includes the Poly1305 tag). The nonce is carried in the output, so
- * [`symmetric_decrypt`] does not need the associated data.
+ * Encrypt `plaintext` under a 32-byte `key`, returning `nonce(24) || ciphertext`.
  */
 export function symmetricEncrypt(key: Uint8Array, plaintext: Uint8Array, associated_data: Uint8Array): Uint8Array;

package/pkg/keyhive_wasm.js

@@ -5,5 +5,5 @@ import { __wbg_set_wasm } from "./keyhive_wasm_bg.js";
 __wbg_set_wasm(wasm);
 wasm.__wbindgen_start();
 export {
-    Access, AddMemberUpdate, Agent, AllAgentEvents, Archive, CannotParseEd25519SigningKey, CannotParseIdentifier, Capability, CgkaOperation, ChangeId, CiphertextStore, ContactCard, DecryptedWithKey, Delegation, DocContentRefs, Document, DocumentId, Encrypted, EncryptedContentWithUpdate, Event, GenerateWebCryptoError, Group, GroupId, History, Identifier, Individual, IndividualId, Invocation, Keyhive, Membered, Membership, Peer, Revocation, ShareKey, Signed, SignedCgkaOperation, SignedDelegation, SignedInvocation, SignedRevocation, Signer, Stats, Summary, setPanicHook, symmetricDecrypt, symmetricEncrypt
+    Access, Agent, AllAgentEvents, Archive, CannotParseEd25519SigningKey, CannotParseIdentifier, Capability, CgkaOperation, ChangeId, CiphertextStore, ContactCard, DecryptedKeyed, Delegation, DocContentRefs, Document, DocumentId, Encrypted, EncryptedContentWithUpdate, EncryptedKeyed, Event, GenerateWebCryptoError, Group, GroupId, History, Identifier, Individual, IndividualId, Invocation, Keyhive, Membered, Membership, Peer, Revocation, ShareKey, Signed, SignedCgkaOperation, SignedDelegation, SignedInvocation, SignedRevocation, Signer, Stats, Summary, setPanicHook, symmetricDecrypt, symmetricEncrypt
 } from "./keyhive_wasm_bg.js";

package/pkg/keyhive_wasm_bg.js

@@ -43,36 +43,6 @@ export class Access {
 }
 if (Symbol.dispose) Access.prototype[Symbol.dispose] = Access.prototype.free;
 
-/**
- * The result of adding a member: the membership delegation.
- */
-export class AddMemberUpdate {
-    static __wrap(ptr) {
-        const obj = Object.create(AddMemberUpdate.prototype);
-        obj.__wbg_ptr = ptr;
-        AddMemberUpdateFinalization.register(obj, obj.__wbg_ptr, obj);
-        return obj;
-    }
-    __destroy_into_raw() {
-        const ptr = this.__wbg_ptr;
-        this.__wbg_ptr = 0;
-        AddMemberUpdateFinalization.unregister(this);
-        return ptr;
-    }
-    free() {
-        const ptr = this.__destroy_into_raw();
-        wasm.__wbg_addmemberupdate_free(ptr, 0);
-    }
-    /**
-     * @returns {SignedDelegation}
-     */
-    get delegation() {
-        const ret = wasm.addmemberupdate_delegation(this.__wbg_ptr);
-        return SignedDelegation.__wrap(ret);
-    }
-}
-if (Symbol.dispose) AddMemberUpdate.prototype[Symbol.dispose] = AddMemberUpdate.prototype.free;
-
 export class Agent {
     static __wrap(ptr) {
         const obj = Object.create(Agent.prototype);
@@ -584,33 +554,31 @@ if (Symbol.dispose) ContactCard.prototype[Symbol.dispose] = ContactCard.prototyp
 
 /**
  * Plaintext plus the application secret key that decrypted it.
- *
- * The key lets the consumer recover the blob's external predecessor-secret
- * chain and chain further encryptions onto it, without re-entering CGKA.
  */
-export class DecryptedWithKey {
+export class DecryptedKeyed {
     static __wrap(ptr) {
-        const obj = Object.create(DecryptedWithKey.prototype);
+        const obj = Object.create(DecryptedKeyed.prototype);
         obj.__wbg_ptr = ptr;
-        DecryptedWithKeyFinalization.register(obj, obj.__wbg_ptr, obj);
+        DecryptedKeyedFinalization.register(obj, obj.__wbg_ptr, obj);
         return obj;
     }
     __destroy_into_raw() {
         const ptr = this.__wbg_ptr;
         this.__wbg_ptr = 0;
-        DecryptedWithKeyFinalization.unregister(this);
+        DecryptedKeyedFinalization.unregister(this);
         return ptr;
     }
     free() {
         const ptr = this.__destroy_into_raw();
-        wasm.__wbg_decryptedwithkey_free(ptr, 0);
+        wasm.__wbg_decryptedkeyed_free(ptr, 0);
     }
     /**
      * The 32-byte application secret key used to decrypt this content.
+     * Treat as secret: do not log or persist unencrypted.
      * @returns {Uint8Array}
      */
     get applicationSecret() {
-        const ret = wasm.decryptedwithkey_applicationSecret(this.__wbg_ptr);
+        const ret = wasm.decryptedkeyed_applicationSecret(this.__wbg_ptr);
         var v1 = getArrayU8FromWasm0(ret[0], ret[1]).slice();
         wasm.__wbindgen_free(ret[0], ret[1] * 1, 1);
         return v1;
@@ -619,13 +587,13 @@ export class DecryptedWithKey {
      * @returns {Uint8Array}
      */
     get plaintext() {
-        const ret = wasm.decryptedwithkey_plaintext(this.__wbg_ptr);
+        const ret = wasm.decryptedkeyed_plaintext(this.__wbg_ptr);
         var v1 = getArrayU8FromWasm0(ret[0], ret[1]).slice();
         wasm.__wbindgen_free(ret[0], ret[1] * 1, 1);
         return v1;
     }
 }
-if (Symbol.dispose) DecryptedWithKey.prototype[Symbol.dispose] = DecryptedWithKey.prototype.free;
+if (Symbol.dispose) DecryptedKeyed.prototype[Symbol.dispose] = DecryptedKeyed.prototype.free;
 
 export class Delegation {
     static __wrap(ptr) {
@@ -908,8 +876,7 @@ export class Encrypted {
     }
     /**
      * Decrypt this content with an explicit 32-byte application secret key,
-     * bypassing CGKA. The consumer uses this to follow the external
-     * predecessor-secret chain once it has recovered a blob's key.
+     * bypassing CGKA.
      * @param {Uint8Array} key
      * @returns {Uint8Array}
      */
@@ -1005,15 +972,49 @@ export class EncryptedContentWithUpdate {
         const ptr = this.__destroy_into_raw();
         wasm.__wbg_encryptedcontentwithupdate_free(ptr, 0);
     }
+    /**
+     * @returns {Encrypted}
+     */
+    encrypted_content() {
+        const ret = wasm.encryptedcontentwithupdate_encrypted_content(this.__wbg_ptr);
+        return Encrypted.__wrap(ret);
+    }
+    /**
+     * @returns {SignedCgkaOperation | undefined}
+     */
+    update_op() {
+        const ret = wasm.encryptedcontentwithupdate_update_op(this.__wbg_ptr);
+        return ret === 0 ? undefined : SignedCgkaOperation.__wrap(ret);
+    }
+}
+if (Symbol.dispose) EncryptedContentWithUpdate.prototype[Symbol.dispose] = EncryptedContentWithUpdate.prototype.free;
+
+/**
+ * Encrypted content plus the application secret key it was encrypted under.
+ */
+export class EncryptedKeyed {
+    static __wrap(ptr) {
+        const obj = Object.create(EncryptedKeyed.prototype);
+        obj.__wbg_ptr = ptr;
+        EncryptedKeyedFinalization.register(obj, obj.__wbg_ptr, obj);
+        return obj;
+    }
+    __destroy_into_raw() {
+        const ptr = this.__wbg_ptr;
+        this.__wbg_ptr = 0;
+        EncryptedKeyedFinalization.unregister(this);
+        return ptr;
+    }
+    free() {
+        const ptr = this.__destroy_into_raw();
+        wasm.__wbg_encryptedkeyed_free(ptr, 0);
+    }
     /**
      * The 32-byte application secret key used to encrypt this content.
-     *
-     * Lets the consumer build the external predecessor-secret chain and chain
-     * further encryptions onto this blob.
      * @returns {Uint8Array}
      */
     get applicationSecret() {
-        const ret = wasm.encryptedcontentwithupdate_applicationSecret(this.__wbg_ptr);
+        const ret = wasm.encryptedkeyed_applicationSecret(this.__wbg_ptr);
         var v1 = getArrayU8FromWasm0(ret[0], ret[1]).slice();
         wasm.__wbindgen_free(ret[0], ret[1] * 1, 1);
         return v1;
@@ -1022,18 +1023,18 @@ export class EncryptedContentWithUpdate {
      * @returns {Encrypted}
      */
     encrypted_content() {
-        const ret = wasm.encryptedcontentwithupdate_encrypted_content(this.__wbg_ptr);
+        const ret = wasm.encryptedkeyed_encrypted_content(this.__wbg_ptr);
         return Encrypted.__wrap(ret);
     }
     /**
      * @returns {SignedCgkaOperation | undefined}
      */
     update_op() {
-        const ret = wasm.encryptedcontentwithupdate_update_op(this.__wbg_ptr);
+        const ret = wasm.encryptedkeyed_update_op(this.__wbg_ptr);
         return ret === 0 ? undefined : SignedCgkaOperation.__wrap(ret);
     }
 }
-if (Symbol.dispose) EncryptedContentWithUpdate.prototype[Symbol.dispose] = EncryptedContentWithUpdate.prototype.free;
+if (Symbol.dispose) EncryptedKeyed.prototype[Symbol.dispose] = EncryptedKeyed.prototype.free;
 
 export class Event {
     static __wrap(ptr) {
@@ -1483,7 +1484,7 @@ export class Keyhive {
      * @param {Membered} membered
      * @param {Access} access
      * @param {Document[]} other_relevant_docs
-     * @returns {Promise<AddMemberUpdate>}
+     * @returns {Promise<SignedDelegation>}
      */
     addMember(to_add, membered, access, other_relevant_docs) {
         _assertClass(to_add, Agent);
@@ -1556,8 +1557,7 @@ export class Keyhive {
     /**
      * Force a PCS key rotation and return the new leaf secret, serialized as a
      * one-entry `BTreeMap<ShareKey, ShareSecretKey>` (the exact format
-     * `importPrekeySecrets` accepts). A sibling instance of this identity can
-     * install it to derive the rotated key without re-importing the whole bundle.
+     * `importPrekeySecrets` accepts).
      * @param {Document} doc
      * @returns {Promise<Uint8Array>}
      */
@@ -1567,8 +1567,6 @@ export class Keyhive {
         return ret;
     }
     /**
-     * Generate a document. Whether it provides forward secrecy is determined by
-     * this peer's forward-secrecy policy (chosen at `Keyhive.init`).
      * @param {Peer[]} coparents
      * @param {ChangeId} initial_content_ref_head
      * @param {ChangeId[]} more_initial_content_refs
@@ -1693,7 +1691,6 @@ export class Keyhive {
         return ret;
     }
     /**
-     * Initialize a peer.
      * @param {Signer} signer
      * @param {CiphertextStore} ciphertext_store
      * @param {Function} event_handler
@@ -1802,17 +1799,14 @@ export class Keyhive {
     }
     /**
      * Decrypt content and also return the 32-byte application secret key used.
-     *
-     * The consumer follows the external predecessor-secret chain from this key
-     * with `Encrypted.decryptWithKey`, avoiding further CGKA dives.
      * @param {Document} doc
      * @param {Encrypted} encrypted
-     * @returns {Promise<DecryptedWithKey>}
+     * @returns {Promise<DecryptedKeyed>}
      */
-    tryDecryptWithKey(doc, encrypted) {
+    tryDecryptKeyed(doc, encrypted) {
         _assertClass(doc, Document);
         _assertClass(encrypted, Encrypted);
-        const ret = wasm.keyhive_tryDecryptWithKey(this.__wbg_ptr, doc.__wbg_ptr, encrypted.__wbg_ptr);
+        const ret = wasm.keyhive_tryDecryptKeyed(this.__wbg_ptr, doc.__wbg_ptr, encrypted.__wbg_ptr);
         return ret;
     }
     /**
@@ -1849,6 +1843,25 @@ export class Keyhive {
         const ret = wasm.keyhive_tryEncryptArchive(this.__wbg_ptr, doc.__wbg_ptr, content_ref.__wbg_ptr, ptr0, len0, ptr1, len1);
         return ret;
     }
+    /**
+     * Encrypt content and also return the application secret key it was
+     * encrypted under.
+     * @param {Document} doc
+     * @param {ChangeId} content_ref
+     * @param {ChangeId[]} js_pred_refs
+     * @param {Uint8Array} content
+     * @returns {Promise<EncryptedKeyed>}
+     */
+    tryEncryptKeyed(doc, content_ref, js_pred_refs, content) {
+        _assertClass(doc, Document);
+        _assertClass(content_ref, ChangeId);
+        const ptr0 = passArrayJsValueToWasm0(js_pred_refs, wasm.__wbindgen_malloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passArray8ToWasm0(content, wasm.__wbindgen_malloc);
+        const len1 = WASM_VECTOR_LEN;
+        const ret = wasm.keyhive_tryEncryptKeyed(this.__wbg_ptr, doc.__wbg_ptr, content_ref.__wbg_ptr, ptr0, len0, ptr1, len1);
+        return ret;
+    }
     /**
      * @param {Document} doc
      * @returns {Promise<Uint8Array | undefined>}
@@ -2662,13 +2675,7 @@ export function symmetricDecrypt(key, blob) {
 }
 
 /**
- * AEAD-encrypt `plaintext` under a 32-byte `key`.
- *
- * `associated_data` flavors the synthetic nonce (e.g. the document or content
- * id) so identical plaintext under the same key in different contexts produces
- * distinct ciphertext. Returns `nonce(24) || ciphertext` (the ciphertext
- * includes the Poly1305 tag). The nonce is carried in the output, so
- * [`symmetric_decrypt`] does not need the associated data.
+ * Encrypt `plaintext` under a 32-byte `key`, returning `nonce(24) || ciphertext`.
  * @param {Uint8Array} key
  * @param {Uint8Array} plaintext
  * @param {Uint8Array} associated_data
@@ -2749,10 +2756,6 @@ export function __wbg_add_6c7b67a080be853e(arg0, arg1) {
     const ret = arg0.add(arg1);
     return ret;
 }
-export function __wbg_addmemberupdate_new(arg0) {
-    const ret = AddMemberUpdate.__wrap(arg0);
-    return ret;
-}
 export function __wbg_agent_new(arg0) {
     const ret = Agent.__wrap(arg0);
     return ret;
@@ -2819,8 +2822,8 @@ export function __wbg_debug_3003e89da631cad7(arg0, arg1) {
         wasm.__wbindgen_free(deferred0_0, deferred0_1, 1);
     }
 }
-export function __wbg_decryptedwithkey_new(arg0) {
-    const ret = DecryptedWithKey.__wrap(arg0);
+export function __wbg_decryptedkeyed_new(arg0) {
+    const ret = DecryptedKeyed.__wrap(arg0);
     return ret;
 }
 export function __wbg_doccontentrefs_new(arg0) {
@@ -2835,6 +2838,10 @@ export function __wbg_encryptedcontentwithupdate_new(arg0) {
     const ret = EncryptedContentWithUpdate.__wrap(arg0);
     return ret;
 }
+export function __wbg_encryptedkeyed_new(arg0) {
+    const ret = EncryptedKeyed.__wrap(arg0);
+    return ret;
+}
 export function __wbg_error_8b62d3db440cf4a8(arg0, arg1) {
     let deferred0_0;
     let deferred0_1;
@@ -3170,7 +3177,7 @@ export function __wbg_warn_9d7408e9659996aa(arg0, arg1, arg2, arg3, arg4, arg5,
     }
 }
 export function __wbindgen_cast_0000000000000001(arg0, arg1) {
-    // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [Externref], shim_idx: 712, ret: Result(Unit), inner_ret: Some(Result(Unit)) }, mutable: true }) -> Externref`.
+    // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [Externref], shim_idx: 716, ret: Result(Unit), inner_ret: Some(Result(Unit)) }, mutable: true }) -> Externref`.
     const ret = makeMutClosure(arg0, arg1, wasm_bindgen__convert__closures_____invoke__h9887d5ab72723f8a);
     return ret;
 }
@@ -3263,9 +3270,6 @@ function wasm_bindgen__convert__closures_____invoke__h58982df154245cbc(arg0, arg
 const AccessFinalization = (typeof FinalizationRegistry === 'undefined')
     ? { register: () => {}, unregister: () => {} }
     : new FinalizationRegistry(ptr => wasm.__wbg_access_free(ptr, 1));
-const AddMemberUpdateFinalization = (typeof FinalizationRegistry === 'undefined')
-    ? { register: () => {}, unregister: () => {} }
-    : new FinalizationRegistry(ptr => wasm.__wbg_addmemberupdate_free(ptr, 1));
 const AgentFinalization = (typeof FinalizationRegistry === 'undefined')
     ? { register: () => {}, unregister: () => {} }
     : new FinalizationRegistry(ptr => wasm.__wbg_agent_free(ptr, 1));
@@ -3296,9 +3300,9 @@ const CiphertextStoreFinalization = (typeof FinalizationRegistry === 'undefined'
 const ContactCardFinalization = (typeof FinalizationRegistry === 'undefined')
     ? { register: () => {}, unregister: () => {} }
     : new FinalizationRegistry(ptr => wasm.__wbg_contactcard_free(ptr, 1));
-const DecryptedWithKeyFinalization = (typeof FinalizationRegistry === 'undefined')
+const DecryptedKeyedFinalization = (typeof FinalizationRegistry === 'undefined')
     ? { register: () => {}, unregister: () => {} }
-    : new FinalizationRegistry(ptr => wasm.__wbg_decryptedwithkey_free(ptr, 1));
+    : new FinalizationRegistry(ptr => wasm.__wbg_decryptedkeyed_free(ptr, 1));
 const DelegationFinalization = (typeof FinalizationRegistry === 'undefined')
     ? { register: () => {}, unregister: () => {} }
     : new FinalizationRegistry(ptr => wasm.__wbg_delegation_free(ptr, 1));
@@ -3317,6 +3321,9 @@ const EncryptedFinalization = (typeof FinalizationRegistry === 'undefined')
 const EncryptedContentWithUpdateFinalization = (typeof FinalizationRegistry === 'undefined')
     ? { register: () => {}, unregister: () => {} }
     : new FinalizationRegistry(ptr => wasm.__wbg_encryptedcontentwithupdate_free(ptr, 1));
+const EncryptedKeyedFinalization = (typeof FinalizationRegistry === 'undefined')
+    ? { register: () => {}, unregister: () => {} }
+    : new FinalizationRegistry(ptr => wasm.__wbg_encryptedkeyed_free(ptr, 1));
 const EventFinalization = (typeof FinalizationRegistry === 'undefined')
     ? { register: () => {}, unregister: () => {} }
     : new FinalizationRegistry(ptr => wasm.__wbg_event_free(ptr, 1));