@fhevm/sdk 0.0.1 → 1.0.0-alpha.1

package/core/host-contracts/persistAllowed.ts

@@ -0,0 +1,68 @@
+import type { ChecksummedAddress } from '../types/primitives.js';
+import type { FhevmRuntime } from '../types/coreFhevmRuntime.js';
+import type { Handle } from '../types/encryptedTypes-p.js';
+import type { HandleAccountPair } from '../types/other-p.js';
+import { persistAllowedAbi } from './abi-fragments/fragments.js';
+import { getTrustedClient } from '../runtime/CoreFhevm-p.js';
+import { executeWithBatching } from '../base/promise.js';
+
+////////////////////////////////////////////////////////////////////////////////
+
+type Context = {
+  readonly runtime: FhevmRuntime;
+  readonly client: NonNullable<object>;
+  readonly options: { readonly batchRpcCalls: boolean };
+};
+
+type Parameters = {
+  readonly address: ChecksummedAddress;
+  readonly pairs: readonly HandleAccountPair[];
+};
+
+type ReturnType = boolean[];
+
+////////////////////////////////////////////////////////////////////////////////
+
+export async function persistAllowed(context: Context, parameters: Parameters): Promise<ReturnType> {
+  const { address, pairs } = parameters;
+
+  const rpcCalls = pairs.map(
+    (pair) => () =>
+      _persistAllowed(context, {
+        address,
+        handle: pair.handle,
+        account: pair.account,
+      }),
+  );
+
+  const results = await executeWithBatching(rpcCalls, context.options.batchRpcCalls);
+
+  return results;
+}
+
+////////////////////////////////////////////////////////////////////////////////
+
+async function _persistAllowed(
+  context: Context,
+  parameters: {
+    readonly address: ChecksummedAddress;
+    readonly handle: Handle;
+    readonly account: ChecksummedAddress;
+  },
+): Promise<boolean> {
+  const { address, handle, account } = parameters;
+  const trustedClient = getTrustedClient(context);
+
+  const res = await context.runtime.ethereum.readContract(trustedClient, {
+    address: address,
+    abi: persistAllowedAbi,
+    args: [handle.bytes32Hex, account],
+    functionName: persistAllowedAbi[0].name,
+  });
+
+  if (typeof res !== 'boolean') {
+    throw new Error(`Invalid isAllowedForDecryption result.`);
+  }
+
+  return res;
+}

package/core/host-contracts/readCoprocessorSignersContext-p.ts

@@ -0,0 +1,34 @@
+import type { ChecksummedAddress } from '../types/primitives.js';
+import type { FhevmRuntime } from '../types/coreFhevmRuntime.js';
+import type { CoprocessorSignersContext } from '../types/coprocessorSignersContext.js';
+import { createCoprocessorSignersContext } from './CoprocessorSignersContext-p.js';
+import { getCoprocessorContextSignersAndThreshold } from './getCoprocessorContextSignersAndThreshold-p.js';
+
+////////////////////////////////////////////////////////////////////////////////
+
+type Context = {
+  readonly runtime: FhevmRuntime;
+  readonly client: NonNullable<object>;
+  readonly options: { readonly batchRpcCalls: boolean };
+};
+
+type Parameters = {
+  readonly address: ChecksummedAddress;
+};
+
+type ReturnType = CoprocessorSignersContext;
+
+////////////////////////////////////////////////////////////////////////////////
+
+export async function readCoprocessorSignersContext(context: Context, parameters: Parameters): Promise<ReturnType> {
+  // TTL-Cached
+  const c = await getCoprocessorContextSignersAndThreshold(context, parameters);
+
+  const data = createCoprocessorSignersContext(new WeakRef(context.runtime), {
+    ...parameters,
+    coprocessorSigners: c.signers,
+    coprocessorSignerThreshold: c.threshold,
+  });
+
+  return data;
+}

package/core/host-contracts/readKmsSignersContext-p.ts

@@ -0,0 +1,221 @@
+import type { KmsSignersContext } from '../types/kmsSignersContext.js';
+import type { BytesHex, ChecksummedAddress, Uint256BigInt, Uint8Number } from '../types/primitives.js';
+import type { FhevmRuntime } from '../types/coreFhevmRuntime.js';
+import {
+  assertIsKmsSignersContext,
+  createKmsSignersContext,
+  kmsSignersContextToExtraData,
+} from './KmsSignersContext-p.js';
+import { getCurrentKmsContextId } from './getCurrentKmsContextId-p.js';
+import { getVersion, isVersionStrictlyBefore } from './HostContractVersion-p.js';
+import { assertIsKmsExtraData, fromKmsExtraData, toKmsExtraData } from '../kms/kmsExtraData.js';
+import { getKmsContextSignersAndThresholdFromExtraData } from './getKmsContextSignersAndThresholdFromExtraData-p.js';
+import { getKmsSignersAndThreshold } from './getKmsContextSignersAndThreshold-p.js';
+
+////////////////////////////////////////////////////////////////////////////////
+
+type Context = {
+  readonly runtime: FhevmRuntime;
+  readonly client: NonNullable<object>;
+  readonly options: { readonly batchRpcCalls: boolean };
+};
+
+type Parameters = {
+  readonly address: ChecksummedAddress;
+  readonly forceRefresh?: boolean | undefined;
+  readonly kmsContextId?: Uint256BigInt | undefined;
+};
+
+type ReturnType = KmsSignersContext;
+
+////////////////////////////////////////////////////////////////////////////////
+
+export async function readKmsSignersContext(context: Context, parameters: Parameters): Promise<ReturnType> {
+  const kmsVerifierContractAddress = parameters.address;
+
+  // TTL-cached
+  const version = await getVersion(context, {
+    address: kmsVerifierContractAddress,
+  });
+
+  if (isVersionStrictlyBefore(version, { major: 0, minor: 2 })) {
+    return _readKmsSignersContextV1(context, parameters);
+  } else {
+    return _readKmsSignersContext(context, parameters);
+  }
+}
+
+////////////////////////////////////////////////////////////////////////////////
+
+async function _readKmsSignersContextV1(context: Context, parameters: Parameters): Promise<ReturnType> {
+  if (parameters.kmsContextId !== undefined && parameters.kmsContextId !== 0n) {
+    throw new Error('Impossible on v1');
+  }
+
+  // TTL-Cached
+  const c = await getKmsSignersAndThreshold(context, parameters);
+
+  const data = createKmsSignersContext(new WeakRef(context.runtime), {
+    ...parameters,
+    kmsContextId: 0n as Uint256BigInt,
+    kmsSigners: c.signers,
+    kmsSignerThreshold: c.threshold,
+  });
+
+  return data;
+}
+
+////////////////////////////////////////////////////////////////////////////////
+
+async function _readKmsSignersContext(context: Context, parameters: Parameters): Promise<ReturnType> {
+  let kmsContextId: Uint256BigInt;
+  if (parameters.kmsContextId !== undefined) {
+    if (parameters.kmsContextId === 0n) {
+      throw new Error('Impossible on v2');
+    }
+    kmsContextId = parameters.kmsContextId;
+  } else {
+    // TTL-Cached
+    kmsContextId = await getCurrentKmsContextId(context, parameters);
+  }
+
+  return _readKmsSignersContextForContextId(context, {
+    ...parameters,
+    kmsContextId,
+  });
+}
+
+async function _readKmsSignersContextForContextId(
+  context: Context,
+  parameters: Parameters & { readonly kmsContextId: Uint256BigInt },
+): Promise<ReturnType> {
+  const { kmsContextId } = parameters;
+  const extraData = toKmsExtraData({
+    version: 1 as Uint8Number,
+    kmsContextId,
+  });
+
+  // Permanent-Cached
+  const c = await getKmsContextSignersAndThresholdFromExtraData(context, {
+    ...parameters,
+    extraData,
+  });
+
+  const data = createKmsSignersContext(new WeakRef(context.runtime), {
+    ...parameters,
+    kmsContextId,
+    kmsSigners: c.signers,
+    kmsSignerThreshold: c.threshold,
+  });
+
+  return data;
+}
+
+////////////////////////////////////////////////////////////////////////////////
+
+/**
+ * Reconciles the KMS signers context used by the SDK with the one the relayer
+ * actually used when forwarding the decryption request to KMS nodes.
+ *
+ * The returned {@link KmsSignersContext} provides the signers and threshold
+ * needed to verify the KMS signcrypted shares and reconstruct the decrypted values.
+ *
+ * ### Assumptions
+ *
+ * - The relayer **cannot be trusted**.
+ * - On-chain data is the **source of truth**.
+ *
+ * ### Nomenclature
+ *
+ * - `requestedExtraData` — `kmsSignersContextToExtraData(requestedKmsSignersContext)`.
+ * - `relayerKmsContextId` — `fromKmsExtraData(relayerExtraData).kmsContextId`.
+ *
+ * ### Resolution (checked in order)
+ *
+ * 1. `relayerExtraData === requestedExtraData` → exact byte match, return
+ *    `requestedKmsSignersContext`. This is the **only** path that trusts cached data.
+ * 2. Serialization version mismatch → **always throw**. The SDK and relayer must
+ *    agree on the `extraData` encoding format, even if the context ID is the same.
+ * 3. Context IDs differ → **full on-chain refetch**. The cached context is never
+ *    reused, because any mismatch means on-chain state may have diverged
+ *    (rotation, destruction, signer changes, etc.).
+ *    - Context is **valid** on-chain (current or non-destroyed) → return it.
+ *    - Context is **destroyed or out of range** → throw.
+ *
+ * ### Modes
+ *
+ * - `'strict'` — Accept step 1 (exact match) or `relayerKmsContextId === currentKmsContextId`.
+ *   Rejects valid-but-not-current contexts.
+ * - `'loose'` — Accept any on-chain valid context (non-destroyed, in range),
+ *   regardless of whether it is current. Covers context rotations in either direction.
+ */
+
+////////////////////////////////////////////////////////////////////////////////
+
+export type ReconcileMode = 'strict' | 'loose';
+
+export async function reconcileKmsSignersContext(
+  context: Context,
+  parameters: {
+    readonly address: ChecksummedAddress;
+    readonly requestedKmsSignersContext: KmsSignersContext;
+    readonly relayerExtraData: BytesHex;
+    readonly mode: ReconcileMode;
+  },
+): Promise<KmsSignersContext> {
+  const { address, requestedKmsSignersContext, relayerExtraData, mode } = parameters;
+
+  assertIsKmsExtraData(relayerExtraData, {});
+  assertIsKmsSignersContext(requestedKmsSignersContext, {});
+
+  const requestedExtraData = kmsSignersContextToExtraData(requestedKmsSignersContext);
+
+  // 1. Exact match — the relayer used the same context as the SDK.
+  if (relayerExtraData === requestedExtraData) {
+    return requestedKmsSignersContext;
+  }
+
+  // Bytes differ — extract and compare serialization versions.
+  const relayerKmsExtraData = fromKmsExtraData(relayerExtraData);
+  const requestedKmsExtraData = fromKmsExtraData(requestedExtraData);
+
+  // Reject if extraData serialization version differs.
+  if (relayerKmsExtraData.version !== requestedKmsExtraData.version) {
+    throw new Error(
+      `ExtraData serialization version mismatch: SDK uses v${requestedKmsExtraData.version}, ` +
+        `relayer returned v${relayerKmsExtraData.version}. ` +
+        `The SDK and relayer must agree on the extraData encoding format.`,
+    );
+  }
+
+  // Versions match but context IDs differ — verify the relayer's context on-chain.
+  const relayerKmsContextId = relayerKmsExtraData.kmsContextId;
+
+  // 2. In strict mode, only accept if the relayer used the current on-chain context.
+  if (mode === 'strict') {
+    // `readKmsSignersContext` with `forceRefresh` fetches the current context.
+    // If `relayerKmsContextId` matches current, we're good.
+    const currentContext = await readKmsSignersContext(context, {
+      address,
+      forceRefresh: true,
+    });
+
+    if (currentContext.id !== relayerKmsContextId) {
+      throw new Error(
+        `Strict reconciliation failed: relayer used context ${relayerKmsContextId}, ` +
+          `but the current on-chain context is ${currentContext.id}.`,
+      );
+    }
+
+    return currentContext;
+  }
+
+  // 3. Loose mode — accept any valid (non-destroyed, in-range) context.
+  //    `readKmsSignersContext` with `forceRefresh` + specific `kmsContextId` will
+  //    throw if the context is destroyed or out of range.
+  return readKmsSignersContext(context, {
+    address,
+    kmsContextId: relayerKmsContextId,
+    forceRefresh: true,
+  });
+}

package/core/key/FheEncryptionKeyCache-p.ts

@@ -0,0 +1,326 @@
+import type { FhevmRuntime } from '../types/coreFhevmRuntime.js';
+import type {
+  FheEncryptionKeyWasm,
+  FheEncryptionKeyBytes,
+  FheEncryptionKeyMetadata,
+} from '../types/fheEncryptionKey.js';
+
+////////////////////////////////////////////////////////////////////////////////
+
+/**
+ * A live mutable cache entry (placeholder).
+ *
+ * Callers hold a reference and observe state changes across awaits.
+ * - `resolvedKind`: kind of the currently available value ("bytes" | "wasm"),
+ *   or `undefined` if no value has resolved yet.
+ * - `value`: the resolved data, or `undefined` while no value is available.
+ * - `pendingKind`: kind of the value being fetched/converted ("bytes" | "wasm"),
+ *   or `undefined` if idle.
+ * - `pendingOp`: type of in-flight operation ("fetching" | "converting"),
+ *   or `undefined` if idle.
+ * - `ready`: the promise to await. When it resolves, `value` is populated,
+ *   `resolvedKind` is updated, and `pendingKind`/`pendingOp` are `undefined`.
+ */
+export interface CacheEntry {
+  readonly resolvedKind: 'bytes' | 'wasm' | undefined;
+  readonly value: FheEncryptionKeyBytes | FheEncryptionKeyWasm | undefined;
+  readonly pendingKind: 'bytes' | 'wasm' | undefined;
+  readonly pendingOp: 'fetching' | 'converting' | undefined;
+  readonly ready: Promise<void>;
+  readonly owner: WeakRef<FhevmRuntime>;
+}
+
+export class CacheEntryImpl implements CacheEntry {
+  resolvedKind: 'bytes' | 'wasm' | undefined;
+  value: FheEncryptionKeyBytes | FheEncryptionKeyWasm | undefined;
+  pendingKind: 'bytes' | 'wasm' | undefined;
+  pendingOp: 'fetching' | 'converting' | undefined;
+  metadata: FheEncryptionKeyMetadata;
+  ready!: Promise<void>;
+  owner!: WeakRef<FhevmRuntime>;
+
+  /** @internal promise on the future value being resolved. Do not use externally. */
+  _pending!: Promise<FheEncryptionKeyBytes | FheEncryptionKeyWasm>;
+  /** @internal debug: true if `_pending` has been chained from (e.g. by ensureWasm). */
+  _pendingChained: boolean;
+
+  constructor(owner: FhevmRuntime, metadata: FheEncryptionKeyMetadata) {
+    this.owner = new WeakRef(owner);
+    this.resolvedKind = undefined;
+    this.value = undefined;
+    this.pendingKind = undefined;
+    this.pendingOp = undefined;
+    this.metadata = metadata;
+    this._pendingChained = false;
+  }
+}
+
+////////////////////////////////////////////////////////////////////////////////
+
+/**
+ * Asserts that two relayerUrls match.
+ * Prevents mixing keys from different relayers in the same cache slot.
+ */
+function _assertRelayerUrlMatch(actualRelayerUrl: string, expectedRelayerUrl: string): void {
+  if (actualRelayerUrl !== expectedRelayerUrl) {
+    throw new Error(
+      `FheEncryptionKey relayerUrl mismatch: expected "${expectedRelayerUrl}" but got "${actualRelayerUrl}". ` +
+        'The FheEncryptionKey must originate from the same relayer.',
+    );
+  }
+}
+
+/** Debug: if resolvedKind is "wasm", there must be no pending operation. */
+function _assertWasmIsTerminal(entry: CacheEntry): void {
+  if (entry.resolvedKind === 'wasm' && entry.pendingKind !== undefined) {
+    throw new Error("Debug: resolvedKind is 'wasm' but pendingKind is " + JSON.stringify(entry.pendingKind));
+  }
+}
+
+////////////////////////////////////////////////////////////////////////////////
+
+/**
+ * Global cache for FHE public key parameters.
+ *
+ * Keyed by relayer URL. Each entry is a live mutable placeholder that callers
+ * hold a reference to and observe state changes across awaits.
+ */
+export class FheEncryptionKeyCache {
+  readonly #cache = new Map<string, CacheEntryImpl>();
+
+  ////////////////////////////////////////////////////////////////////////////////
+
+  get(relayerUrl: string): CacheEntry | undefined {
+    return this.#cache.get(relayerUrl);
+  }
+
+  has(relayerUrl: string): boolean {
+    return this.#cache.has(relayerUrl);
+  }
+
+  remove(relayerUrl: string): boolean {
+    const entry = this.#cache.get(relayerUrl);
+    if (entry !== undefined) {
+      this.#invalidate(entry);
+    }
+    return this.#cache.delete(relayerUrl);
+  }
+
+  clear(): void {
+    for (const entry of this.#cache.values()) {
+      this.#invalidate(entry);
+    }
+    this.#cache.clear();
+  }
+
+  /** Stale-ify an entry so in-flight callbacks hit the guard and get swallowed. */
+  #invalidate(entry: CacheEntryImpl): void {
+    entry.ready = Promise.resolve();
+    entry.pendingKind = undefined;
+    entry.pendingOp = undefined;
+  }
+
+  ////////////////////////////////////////////////////////////////////////////////
+
+  setBytes(owner: FhevmRuntime, relayerUrl: string, bytes: FheEncryptionKeyBytes): void {
+    // First write wins: if an entry already exists (resolved or in-flight),
+    // skip to avoid creating a closure over the 50MB bytes unnecessarily.
+    if (this.#cache.has(relayerUrl)) {
+      return;
+    }
+    _assertRelayerUrlMatch(bytes.metadata.relayerUrl, relayerUrl);
+    // The closure over `bytes` is ephemeral: ensureBytes calls the fetcher
+    // immediately, the promise resolves synchronously, and the closure becomes
+    // unreachable. No extra copy of the 50MB data is retained.
+    this.ensureBytes({
+      owner,
+      relayerUrl,
+      fetcher: () => Promise.resolve(bytes),
+      metadata: bytes.metadata,
+    });
+  }
+
+  ////////////////////////////////////////////////////////////////////////////////
+
+  /**
+   * Ensures the cache has an entry for the given relayer URL.
+   *
+   * **First write wins**: if an entry already exists (resolved or in-flight,
+   * bytes or wasm), it is kept as-is and the fetcher is never called.
+   * Only when no entry exists is the fetcher invoked to start a new fetch.
+   *
+   * To force a re-fetch, call `remove(relayerUrl)` before `ensureBytes`.
+   */
+  ensureBytes(parameters: {
+    readonly owner: FhevmRuntime;
+    readonly relayerUrl: string;
+    readonly fetcher: () => Promise<FheEncryptionKeyBytes>;
+    readonly metadata: FheEncryptionKeyMetadata;
+  }): void {
+    const { owner, relayerUrl, fetcher, metadata } = parameters;
+    if (this.#cache.has(relayerUrl)) {
+      return;
+    }
+
+    const entry = new CacheEntryImpl(owner, metadata);
+    const pendingValue = fetcher();
+
+    entry.pendingKind = 'bytes';
+    entry.pendingOp = 'fetching';
+    entry._pending = pendingValue;
+    entry.ready = this.#makeReady(relayerUrl, entry, 'bytes', pendingValue);
+
+    this.#cache.set(relayerUrl, entry);
+  }
+
+  ////////////////////////////////////////////////////////////////////////////////
+
+  /**
+   * Upgrade a bytes entry to wasm in-place by deserializing.
+   * If already wasm (pending or resolved), returns the existing entry.
+   * Chains from `_pending` so it works whether bytes are resolved or still pending.
+   * Idempotent: repeated calls return the same entry.
+   */
+  ensureWasm(parameters: {
+    readonly owner: FhevmRuntime;
+    readonly relayerUrl: string;
+    readonly deserializeFn: (bytes: FheEncryptionKeyBytes) => Promise<FheEncryptionKeyWasm>;
+  }): void {
+    const { relayerUrl, deserializeFn } = parameters;
+
+    const entry = this.#cache.get(relayerUrl);
+    if (entry === undefined) {
+      return;
+    }
+
+    if (entry.resolvedKind === 'wasm' || entry.pendingKind === 'wasm') {
+      return;
+    }
+
+    _assertWasmIsTerminal(entry);
+
+    if (entry._pendingChained) {
+      throw new Error('Debug: _pending was already chained from');
+    }
+    entry._pendingChained = true;
+
+    const pendingValue = entry._pending.then((bytes) => {
+      _assertWasmIsTerminal(entry);
+      return deserializeFn(bytes as FheEncryptionKeyBytes);
+    });
+
+    entry.pendingKind = 'wasm';
+    entry.pendingOp = 'converting';
+    entry._pending = pendingValue;
+    entry.ready = this.#makeReady(relayerUrl, entry, 'wasm', pendingValue);
+  }
+
+  /**
+   * Get bytes from the cache, converting from wasm if necessary.
+   *
+   * - No entry → `undefined`
+   * - Resolved bytes → return immediately
+   * - Resolved wasm → serialize to bytes and return
+   * - Pending bytes → await, return resolved bytes
+   * - Pending wasm → await, serialize to bytes and return
+   */
+  async resolveBytes(parameters: {
+    readonly relayerUrl: string;
+    readonly serializeFn?: ((parameters: FheEncryptionKeyWasm) => Promise<FheEncryptionKeyBytes>) | undefined;
+  }): Promise<FheEncryptionKeyBytes | undefined> {
+    const { relayerUrl, serializeFn } = parameters;
+
+    const entry = this.#cache.get(relayerUrl);
+    if (entry === undefined) {
+      return undefined;
+    }
+
+    // Bytes already available — return immediately, don't wait for pending wasm
+    if (entry.resolvedKind === 'bytes') {
+      return entry.value as FheEncryptionKeyBytes;
+    }
+
+    // Wasm already available — serialize to bytes
+    if (entry.resolvedKind === 'wasm') {
+      if (serializeFn === undefined) {
+        throw new Error('Cannot convert wasm to bytes: serialize function not provided');
+      }
+      return serializeFn(entry.value as FheEncryptionKeyWasm);
+    }
+
+    if (entry.pendingKind === undefined) {
+      return undefined;
+    }
+
+    await entry.ready;
+
+    // Re-read after potential await — entry is mutable across await boundaries.
+    // Cast needed: TS narrows out "bytes" from the early return above,
+    // but the entry can become "bytes" during the await.
+    const kind = entry.resolvedKind as 'bytes' | 'wasm' | undefined;
+
+    if (kind === 'bytes') {
+      return entry.value as FheEncryptionKeyBytes;
+    }
+
+    if (kind === 'wasm') {
+      if (serializeFn === undefined) {
+        throw new Error('Cannot convert wasm to bytes: serialize function not provided');
+      }
+      return serializeFn(entry.value as FheEncryptionKeyWasm);
+    }
+
+    return undefined;
+  }
+
+  ////////////////////////////////////////////////////////////////////////////////
+
+  /**
+   * Create a `ready` promise that updates entry state on resolution,
+   * self-evicts on rejection (if still current), and swallows stale errors.
+   */
+  #makeReady(
+    relayerUrl: string,
+    entry: CacheEntryImpl,
+    resolvedKind: 'bytes' | 'wasm',
+    pendingValue: Promise<FheEncryptionKeyBytes | FheEncryptionKeyWasm>,
+  ): Promise<void> {
+    // `ready` is referenced inside the callbacks before this assignment completes,
+    // but callbacks are closures that capture the variable binding, not the value.
+    // Promise callbacks always run as microtasks (asynchronously), so `ready`
+    // is guaranteed to be assigned by the time any callback executes.
+    const ready: Promise<void> = pendingValue.then(
+      (resolved) => {
+        if (entry.ready !== ready) {
+          return; // stale: a newer operation replaced us
+        }
+        // Verify the resolved value's metadata matches the cache key.
+        // Catches bugs where a fetcher/deserializer returns data for a different relayer.
+        _assertRelayerUrlMatch(resolved.metadata.relayerUrl, relayerUrl);
+        entry.resolvedKind = resolvedKind;
+        entry.value = resolved;
+        entry.pendingKind = undefined;
+        entry.pendingOp = undefined;
+        _assertWasmIsTerminal(entry);
+      },
+      (err: unknown) => {
+        if (entry.ready !== ready) {
+          return; // stale: swallow the error
+        }
+        // Clean up pending state
+        entry.pendingKind = undefined;
+        entry.pendingOp = undefined;
+        // Self-evict
+        if (this.#cache.get(relayerUrl) === entry) {
+          this.#cache.delete(relayerUrl);
+        }
+        throw err;
+      },
+    );
+    return ready;
+  }
+}
+
+////////////////////////////////////////////////////////////////////////////////
+
+export const globalFheEncryptionKeyCache = new FheEncryptionKeyCache();