@cloudbitmaps/core 0.18.1 → 0.18.3

package/dist/index.js

@@ -70,7 +70,7 @@ import {
   validateUserNamespace,
   validateUserRef,
   webCryptoEntropy
-} from "./chunk-K4EXZDMU.js";
+} from "./chunk-ML6AT53O.js";
 
 // src/core/bit-route.ts
 var U32_MAX = 4294967295;
@@ -78,7 +78,7 @@ var CHUNK_COUNT = 65536;
 var LOW_16 = 65535;
 function splitId(id) {
   if (!Number.isInteger(id) || id < 0 || id > U32_MAX) {
-    throw new ValidationError(`id must be an integer in 0..${U32_MAX}; got ${id}`);
+    throw new ValidationError(`an id must be an integer from 0 to ${U32_MAX}`);
   }
   return { chunkKey: id >>> 16, remainder: id & LOW_16 };
 }
@@ -428,8 +428,7 @@ function windowOf(range) {
     ["through", through]
   ]) {
     if (bound !== void 0 && (!Number.isInteger(bound) || bound < 0 || bound > U32_MAX)) {
-      const got = typeof bound === "number" ? String(bound) : `a ${typeof bound}`;
-      throw new ValidationError(`${name} must be an integer in 0..${U32_MAX}; got ${got}`);
+      throw new ValidationError(`${name} must be an integer from 0 to ${U32_MAX}`);
     }
   }
   const lo = after === void 0 ? 0 : after + 1;
@@ -1531,10 +1530,16 @@ async function aboveEverything(ref, deps, record) {
   for await (const key of deps.storage.list(ref)) {
     if (key.generation > highest) highest = key.generation;
   }
+  return numberAbove(highest);
+}
+function numberAbove(highest) {
+  if (highest >= Number.MAX_SAFE_INTEGER) {
+    throw new IntegrityError("the segment has no generation number left above its highest");
+  }
   return highest + 1;
 }
 async function nextLoadGeneration(ref, deps, row) {
-  const generation = (row?.currentGen ?? -1) + 1;
+  const generation = numberAbove(row?.currentGen ?? -1);
   try {
     await deps.storage.getTail({ namespace: ref.namespace, segment: ref.segment, generation }, 0);
   } catch (err) {
@@ -2289,7 +2294,7 @@ async function* listSegments(registry, options = {}) {
 }
 
 // src/drivers/backends.ts
-import { join as join3 } from "node:path";
+import { join as join4 } from "node:path";
 
 // src/drivers/memory.ts
 import { createHash } from "node:crypto";
@@ -2467,11 +2472,30 @@ function genObjectKey(key) {
 // src/drivers/localfs/storage.ts
 import { constants as FS2 } from "node:fs";
 import { createHash as createHash2, randomUUID } from "node:crypto";
-import { link, mkdir, open as open2, readdir, unlink } from "node:fs/promises";
-import { dirname } from "node:path";
+import { link, mkdir, open as open2, readdir as readdir2, unlink } from "node:fs/promises";
+import { dirname as dirname2 } from "node:path";
 
 // src/drivers/localfs/paths.ts
 import { join } from "node:path";
+var MAX_COMPONENT_BYTES = 255;
+var TEMP_SUFFIX_BYTES = 1 + 36 + 4;
+function assertFits(component, extraBytes) {
+  if (component.length + extraBytes > MAX_COMPONENT_BYTES) {
+    throw new ValidationError(
+      `a name is too long for a file name on this backend: the namespace, or the segment with its generation and the temp file's suffix, must fit in ${MAX_COMPONENT_BYTES} bytes once encoded`
+    );
+  }
+}
+function assertStorageNamesFit(key) {
+  validateSegmentRef(key);
+  assertFits(namespacePathPart(key.namespace), 0);
+  assertFits(storageObjectFilename(key.segment, key.generation), TEMP_SUFFIX_BYTES);
+}
+function assertRegistryNamesFit(ref) {
+  validateSegmentRef(ref);
+  assertFits(namespacePathPart(ref.namespace), 0);
+  assertFits(`${encodeNameForPath(ref.segment)}${REGISTRY_SUFFIX}`, TEMP_SUFFIX_BYTES);
+}
 function segmentsDir(root, ref) {
   validateSegmentRef(ref);
   return join(root, namespacePathPart(ref.namespace), "segments");
@@ -2531,10 +2555,15 @@ function parseNamespaceDir(entry) {
   return { namespace };
 }
 
+// src/drivers/localfs/exact-case.ts
+import { readdir, realpath, stat } from "node:fs/promises";
+import { dirname, join as join2, parse, relative, resolve, sep } from "node:path";
+
 // src/drivers/localfs/fs-util.ts
 import { constants as FS } from "node:fs";
 import { open } from "node:fs/promises";
 var isCode = (err, code) => err instanceof Error && err.code === code;
+var isAbsent = (err) => isCode(err, "ENOENT") || isCode(err, "ENOTDIR") || isCode(err, "ENAMETOOLONG");
 var TRANSIENT_FS_CODES = /* @__PURE__ */ new Set(["EBUSY", "EAGAIN", "EMFILE", "ENFILE", "ETIMEDOUT"]);
 var isFsTransient = (err) => err instanceof Error && TRANSIENT_FS_CODES.has(err.code ?? "");
 var mapFsError = (err) => isFsTransient(err) ? new TransientError(`transient filesystem fault: ${err.code}`, { cause: err }) : err;
@@ -2551,18 +2580,138 @@ async function fsyncDir(dir) {
   }
 }
 
+// src/drivers/localfs/exact-case.ts
+function firstCaseDifference(expected, actual) {
+  const shared = Math.min(expected.length, actual.length);
+  for (let i = 0; i < shared; i++) {
+    const want = expected[i];
+    const have = actual[i];
+    if (want !== have) return want.toLowerCase() === have.toLowerCase() ? i : -1;
+  }
+  return -1;
+}
+var swapCase = (s) => [...s].map((c) => c === c.toLowerCase() ? c.toUpperCase() : c.toLowerCase()).join("");
+var components = (path) => path.split(sep).filter((c) => c !== "");
+function caseVariantError() {
+  return new ValidationError(
+    "names differ only by case on a case-insensitive filesystem: a name that differs only by case from one already stored is the same file here, so it is refused rather than written over"
+  );
+}
+var ExactCase = class {
+  constructor(root) {
+    this.root = root;
+  }
+  root;
+  /** `undefined` until the root holds an entry to try; then fixed, as a filesystem does not change its mind. */
+  insensitive;
+  /**
+   * Whether the root's filesystem folds case, learned from an entry already in the root: the entry's name with its
+   * case swapped is the same file or it is not. An empty or absent root holds nothing to alias, so it is not
+   * insensitive yet, and is looked at again on the next call.
+   */
+  async foldsCase() {
+    if (this.insensitive !== void 0) return this.insensitive;
+    let names;
+    try {
+      names = await readdir(this.root);
+    } catch (err) {
+      if (isAbsent(err)) return this.foldsAtAncestor();
+      throw err;
+    }
+    for (const name of names) {
+      const swapped = swapCase(name);
+      if (swapped === name) continue;
+      const own = await stat(join2(this.root, name), { bigint: true }).catch(() => void 0);
+      if (own === void 0) continue;
+      const other = await stat(join2(this.root, swapped), { bigint: true }).catch(() => void 0);
+      this.insensitive = other !== void 0 && other.ino === own.ino && other.dev === own.dev;
+      return this.insensitive;
+    }
+    return this.foldsAtAncestor();
+  }
+  /**
+   * The same question asked of the root's own name, or the nearest existing directory above it, when the root holds
+   * nothing to try: a root with no entries has none to alias yet, but two names created at once still would. Not
+   * remembered, since it is the volume above the root that answers.
+   */
+  async foldsAtAncestor() {
+    let dir = resolve(this.root);
+    for (; ; ) {
+      const top = parse(dir).root;
+      const parts = components(relative(top, dir));
+      let at = parts.length - 1;
+      while (at >= 0 && swapCase(parts[at]) === parts[at]) at--;
+      if (at === -1) return false;
+      const swapped = [...parts];
+      swapped[at] = swapCase(parts[at]);
+      let own;
+      try {
+        own = await stat(dir, { bigint: true });
+      } catch (err) {
+        if (!isAbsent(err)) return false;
+        const parent = dirname(dir);
+        if (parent === dir) return false;
+        dir = parent;
+        continue;
+      }
+      const other = await stat(join2(top, ...swapped), { bigint: true }).catch(() => void 0);
+      return other !== void 0 && other.ino === own.ino && other.dev === own.dev;
+    }
+  }
+  /** Whether the root's filesystem folds case: names that differ only by case are one file there. */
+  folds() {
+    return this.foldsCase();
+  }
+  /**
+   * `true` when `path` (inside the root) is, on disk, a path whose name differs only by case from the one given:
+   * the deepest part of it that exists is resolved to its real name and compared exactly. A path that does not exist
+   * yet, or that nothing differs from, is `false`.
+   */
+  async differs(path) {
+    if (!await this.foldsCase()) return false;
+    const rootAbs = resolve(this.root);
+    let probe = resolve(path);
+    let real;
+    for (; ; ) {
+      if (probe === rootAbs || !relative(rootAbs, probe) || relative(rootAbs, probe).startsWith("..")) {
+        return false;
+      }
+      try {
+        real = await realpath(probe);
+        break;
+      } catch (err) {
+        if (!isAbsent(err)) throw err;
+        probe = dirname(probe);
+      }
+    }
+    const realRoot = await realpath(rootAbs).catch(() => void 0);
+    if (realRoot === void 0) return false;
+    const actual = relative(realRoot, real);
+    if (actual.startsWith("..")) return false;
+    return firstCaseDifference(components(relative(rootAbs, probe)), components(actual)) !== -1;
+  }
+  /** Refuse a write to `path` when its real name differs from it only by case. */
+  async refuseVariant(path) {
+    if (await this.differs(path)) throw caseVariantError();
+  }
+};
+
 // src/drivers/localfs/storage.ts
 var LocalFsStorageDriver = class {
   constructor(root) {
     this.root = root;
+    this.exactCase = new ExactCase(root);
   }
   root;
+  exactCase;
   capabilities() {
     return { rangeRead: true, maxObjectBytes: Number.MAX_SAFE_INTEGER, conditionalPut: false };
   }
   async putImmutable(key, write) {
     const finalPath = storageObjectPath(this.root, key);
-    await mkdir(dirname(finalPath), { recursive: true });
+    assertStorageNamesFit(key);
+    await this.exactCase.refuseVariant(finalPath);
+    await mkdir(dirname2(finalPath), { recursive: true });
     const tmpPath = `${finalPath}.${randomUUID()}.tmp`;
     const handle = await open2(tmpPath, FS2.O_CREAT | FS2.O_EXCL | FS2.O_WRONLY | O_NOFOLLOW);
     const hash = createHash2("sha256");
@@ -2599,7 +2748,7 @@ var LocalFsStorageDriver = class {
     }
     await unlink(tmpPath).catch(() => {
     });
-    await fsyncDir(dirname(finalPath));
+    await fsyncDir(dirname2(finalPath));
     return { size, sha256: hash.digest("hex") };
   }
   async getRange(key, offset, length) {
@@ -2634,17 +2783,20 @@ var LocalFsStorageDriver = class {
     }
   }
   async delete(key) {
-    await unlink(storageObjectPath(this.root, key)).catch((err) => {
-      if (!isCode(err, "ENOENT")) throw mapFsError(err);
+    const path = storageObjectPath(this.root, key);
+    if (await this.exactCase.differs(path)) return;
+    await unlink(path).catch((err) => {
+      if (!isAbsent(err)) throw mapFsError(err);
     });
   }
   async *list(ref) {
     const dir = segmentsDir(this.root, ref);
+    if (await this.exactCase.differs(dir)) return;
     let names;
     try {
-      names = await readdir(dir);
+      names = await readdir2(dir);
     } catch (err) {
-      if (isCode(err, "ENOENT")) return;
+      if (isAbsent(err)) return;
       throw mapFsError(err);
     }
     for (const name of names) {
@@ -2655,10 +2807,14 @@ var LocalFsStorageDriver = class {
     }
   }
   async openRead(key) {
+    const path = storageObjectPath(this.root, key);
+    if (await this.exactCase.differs(path)) {
+      throw new NotFoundError(`no such generation: ${key.segment}.${key.generation}`);
+    }
     try {
-      return await open2(storageObjectPath(this.root, key), FS2.O_RDONLY | O_NOFOLLOW);
+      return await open2(path, FS2.O_RDONLY | O_NOFOLLOW);
     } catch (err) {
-      if (isCode(err, "ENOENT")) {
+      if (isAbsent(err)) {
         throw new NotFoundError(`no such generation: ${key.segment}.${key.generation}`);
       }
       if (isCode(err, "ELOOP")) {
@@ -2674,20 +2830,20 @@ var LocalFsStorageDriver = class {
 // src/drivers/localfs/registry.ts
 import { constants as FS3 } from "node:fs";
 import { randomUUID as randomUUID2 } from "node:crypto";
-import { mkdir as mkdir2, open as open3, readdir as readdir2, realpath, rename, unlink as unlink2 } from "node:fs/promises";
-import { basename, dirname as dirname2, join as join2, resolve } from "node:path";
+import { mkdir as mkdir2, open as open3, readdir as readdir3, realpath as realpath2, rename, unlink as unlink2 } from "node:fs/promises";
+import { basename, dirname as dirname3, join as join3, resolve as resolve2 } from "node:path";
 var DEFAULT_MAX_ROW_BYTES = 1 * 1024 * 1024;
 var rowChains = /* @__PURE__ */ new Map();
 async function rowLockKey(path) {
-  const abs = resolve(path);
+  const abs = resolve2(path);
   const tail = [basename(abs)];
-  let dir = dirname2(abs);
+  let dir = dirname3(abs);
   for (; ; ) {
     try {
-      return join2(await realpath(dir), ...tail);
+      return join3(await realpath2(dir), ...tail);
     } catch (err) {
-      const parent = dirname2(dir);
-      if (!isCode(err, "ENOENT") || parent === dir) throw mapFsError(err);
+      const parent = dirname3(dir);
+      if (!isAbsent(err) || parent === dir) throw mapFsError(err);
       tail.unshift(basename(dir));
       dir = parent;
     }
@@ -2696,12 +2852,14 @@ async function rowLockKey(path) {
 var LocalFsRegistryDriver = class {
   constructor(root, options = {}) {
     this.root = root;
+    this.exactCase = new ExactCase(root);
     this.now = options.now ?? (() => Date.now());
     this.entropy = options.entropy ?? webCryptoEntropy;
   }
   root;
   now;
   entropy;
+  exactCase;
   /**
    * `conditionalDelete`: a delete reads the row, checks it, and unlinks it under the row's lock, which every writer on
    * the root in this process takes, so no write can land between the check and the unlink.
@@ -2716,6 +2874,7 @@ var LocalFsRegistryDriver = class {
   async create(ref, record) {
     const checked = validateNewRegistryRecord(record);
     const path = registryRowPath(this.root, ref);
+    assertRegistryNamesFit(ref);
     return this.withRowLock(path, async () => {
       const current = await this.readRow(path);
       if (current !== null && !current.deleted) {
@@ -2733,6 +2892,7 @@ var LocalFsRegistryDriver = class {
   async compareAndSwap(ref, expected, patch) {
     const checked = validateRegistryPatch(patch);
     const path = registryRowPath(this.root, ref);
+    assertRegistryNamesFit(ref);
     return this.withRowLock(path, async () => {
       const current = await this.readRow(path);
       if (current === null || current.deleted || current.record.token !== expected) {
@@ -2750,11 +2910,12 @@ var LocalFsRegistryDriver = class {
   async *list(namespace) {
     for (const ns of await this.namespaceDirs(namespace)) {
       const dir = registryDir(this.root, ns);
+      if (await this.exactCase.differs(dir)) continue;
       let names;
       try {
-        names = await readdir2(dir);
+        names = await readdir3(dir);
       } catch (err) {
-        if (isCode(err, "ENOENT")) continue;
+        if (isAbsent(err)) continue;
         throw mapFsError(err);
       }
       for (const name of names) {
@@ -2791,14 +2952,14 @@ var LocalFsRegistryDriver = class {
     } catch (err) {
       if (!isCode(err, "ENOENT")) throw mapFsError(err);
     }
-    await fsyncDir(dirname2(path));
+    await fsyncDir(dirname3(path));
   }
   /** Namespaces to scan: just the one requested, or every namespace dir under the root. */
   async namespaceDirs(namespace) {
     if (namespace !== void 0) return [namespace];
     let entries;
     try {
-      entries = await readdir2(this.root);
+      entries = await readdir3(this.root);
     } catch (err) {
       if (isCode(err, "ENOENT")) return [];
       throw mapFsError(err);
@@ -2813,9 +2974,10 @@ var LocalFsRegistryDriver = class {
   async readRow(path) {
     let handle;
     try {
+      if (await this.exactCase.differs(path)) return null;
       handle = await open3(path, FS3.O_RDONLY | O_NOFOLLOW);
     } catch (err) {
-      if (isCode(err, "ENOENT") || isCode(err, "ELOOP")) return null;
+      if (isAbsent(err) || isCode(err, "ELOOP")) return null;
       throw mapFsError(err);
     }
     try {
@@ -2830,7 +2992,8 @@ var LocalFsRegistryDriver = class {
     }
   }
   async writeRow(path, deleted, record) {
-    await mkdir2(dirname2(path), { recursive: true });
+    await this.exactCase.refuseVariant(path);
+    await mkdir2(dirname3(path), { recursive: true });
     const out = Buffer.from(serializeRegistryEnvelope({ deleted, record }), "utf8");
     if (out.length > DEFAULT_MAX_ROW_BYTES) {
       throw new ValidationError(
@@ -2855,11 +3018,12 @@ var LocalFsRegistryDriver = class {
       });
       throw mapFsError(err);
     });
-    await fsyncDir(dirname2(path));
+    await fsyncDir(dirname3(path));
   }
   /** Serialize callbacks for a row so read-modify-write is atomic across every instance in the process. */
   async withRowLock(path, fn) {
-    const key = await rowLockKey(path);
+    const resolved = await rowLockKey(path);
+    const key = await this.exactCase.folds() ? resolved.toLowerCase() : resolved;
     const prev = rowChains.get(key) ?? Promise.resolve();
     const result = prev.then(fn, fn);
     const tail = result.then(
@@ -2887,9 +3051,9 @@ var MemoryStorage = class {
 var LocalFsStorage = class {
   constructor(root, options = {}) {
     this.root = root;
-    this.storage = new LocalFsStorageDriver(join3(root, "storage"));
+    this.storage = new LocalFsStorageDriver(join4(root, "storage"));
     this.registry = new LocalFsRegistryDriver(
-      join3(root, "registry"),
+      join4(root, "registry"),
       options.now === void 0 ? {} : { now: options.now }
     );
     brandAsBackend(this);
@@ -4028,9 +4192,7 @@ function overCap(what, length) {
 }
 function prepareLoadInput(input, codec, subject = "a load") {
   if (typeof input !== "object" || input === null) {
-    throw new ValidationError(
-      `${subject} takes ids, { serialized } or { bitmap }; got ${String(input)}`
-    );
+    throw new ValidationError(`${subject} takes ids, { serialized } or { bitmap }`);
   }
   const tag = tagOf(input);
   if (tag === "Uint8Array" || tag === "Uint8ClampedArray") {
@@ -5736,7 +5898,7 @@ function* rangeCheckedAtWrite(chunks) {
     const max = chunk.bitmap.maximum?.();
     if (max !== void 0 && max > MAX_REMAINDER) {
       throw new ValidationError(
-        `chunk ${chunk.chunkKey} holds ${max}, outside the 16-bit range [0, ${MAX_REMAINDER}]`
+        `a chunk holds a value outside the 16-bit range [0, ${MAX_REMAINDER}]`
       );
     }
     yield chunk;
@@ -5748,18 +5910,14 @@ async function collectChunks(input, codec, clock) {
   let last = -1;
   for await (const chunk of input.chunks) {
     if (typeof chunk !== "object" || chunk === null) {
-      throw new ValidationError(
-        `a chunk must be an object with a chunkKey and a bitmap; got ${String(chunk)}`
-      );
+      throw new ValidationError("a chunk must be an object with a chunkKey and a bitmap");
     }
     const { chunkKey, bitmap } = chunk;
     if (codec.owns?.(bitmap) !== true) {
-      throw new ValidationError(
-        `chunk ${String(chunkKey)}: its bitmap is not one this load's codec made`
-      );
+      throw new ValidationError(`a chunk's bitmap is not one this load's codec made`);
     }
     if (!Number.isInteger(chunkKey) || chunkKey < 0 || chunkKey > MAX_REMAINDER) {
-      throw new ValidationError(`a chunk's key must be an integer in [0, 65535]; got ${chunkKey}`);
+      throw new ValidationError("a chunk's key must be an integer in [0, 65535]");
     }
     if (chunkKey <= last) {
       throw new ValidationError(`chunk ${chunkKey} does not ascend: the last was ${last}`);
@@ -5768,7 +5926,7 @@ async function collectChunks(input, codec, clock) {
     const max = bitmap.maximum?.();
     if (max !== void 0 && max > MAX_REMAINDER) {
       throw new ValidationError(
-        `chunk ${chunkKey} holds ${max}, outside the 16-bit range [0, ${MAX_REMAINDER}]`
+        `a chunk holds a value outside the 16-bit range [0, ${MAX_REMAINDER}]`
       );
     }
     chunks.push({ chunkKey, bitmap });
@@ -6792,11 +6950,7 @@ var FeedCursor = class {
     const key = record.key;
     const operands = record.operands;
     if (typeof key !== "number" || !Number.isInteger(key) || key < 0 || key >= KEY_IDS) {
-      this.refuse(
-        typeof key === "number" ? key : "?",
-        void 0,
-        "the key must be an integer from 0 to 65535"
-      );
+      this.refuse("?", void 0, "the key must be an integer from 0 to 65535");
     }
     if (key < this.prevKey) {
       this.refuse(
@@ -7031,7 +7185,9 @@ function compileCombineMany(request) {
     ["after", request.after],
     ["through", request.through]
   ]) {
-    if (bound !== void 0) integerIn(bound, 0, U32_MAX, name);
+    if (bound !== void 0 && (!Number.isInteger(bound) || bound < 0 || bound > U32_MAX)) {
+      throw new ValidationError(`${name} must be an integer from 0 to ${U32_MAX}`);
+    }
   }
   const index = /* @__PURE__ */ new Map();
   operands.forEach((op, i) => index.set(op.name, i));
@@ -7170,7 +7326,7 @@ var Gate = class {
     return this.peak;
   }
   async run(task) {
-    if (this.active >= this.limit) await new Promise((resolve2) => this.waiting.push(resolve2));
+    if (this.active >= this.limit) await new Promise((resolve3) => this.waiting.push(resolve3));
     else this.active++;
     if (this.active > this.peak) this.peak = this.active;
     try {
@@ -8097,7 +8253,7 @@ var Run = class {
     const wake = () => {
       const now = waiters;
       waiters = [];
-      for (const resolve2 of now) resolve2();
+      for (const resolve3 of now) resolve3();
     };
     const worker = async () => {
       for (; ; ) {
@@ -8116,7 +8272,7 @@ var Run = class {
         const transient = o.serialized;
         let admitted = this.ledger.tryCharge(transient);
         while (!admitted && inFlight > 0) {
-          await new Promise((resolve2) => waiters.push(resolve2));
+          await new Promise((resolve3) => waiters.push(resolve3));
           admitted = this.ledger.tryCharge(transient);
         }
         if (!admitted) {
@@ -8414,7 +8570,7 @@ var HeldChunks = class {
       const { chunkKey, payload, cardinality } = chunk;
       if (!Number.isInteger(chunkKey) || chunkKey < 0 || chunkKey > MAX_REMAINDER || chunkKey <= last) {
         throw new ValidationError(
-          `a held chunk's key must be an integer in [0, 65535] above the last; got ${String(chunkKey)}`
+          `a held chunk's key must be an integer in [0, 65535] above the last`
         );
       }
       assertChunkCardinalityInRange(cardinality);
@@ -9008,11 +9164,11 @@ var InProcessKeystore = class {
       if (k.length !== KEY_BYTES)
         throw new ValidationError(`KEK "${id}" must be ${KEY_BYTES} bytes, got ${k.length}`);
     }
-    if (!(options.activeKeyId in options.keys))
-      throw new ValidationError(`activeKeyId "${options.activeKeyId}" is not in keys`);
-    if (options.recoveryKeyId !== void 0 && !(options.recoveryKeyId in options.keys))
-      throw new ValidationError(`recoveryKeyId "${options.recoveryKeyId}" is not in keys`);
     this.keys = new Map(entries.map(([id, k]) => [id, Buffer.from(k)]));
+    if (!this.keys.has(options.activeKeyId))
+      throw new ValidationError(`activeKeyId "${String(options.activeKeyId)}" is not in keys`);
+    if (options.recoveryKeyId !== void 0 && !this.keys.has(options.recoveryKeyId))
+      throw new ValidationError(`recoveryKeyId "${String(options.recoveryKeyId)}" is not in keys`);
     this.activeKeyId = options.activeKeyId;
     this.recoveryKeyId = options.recoveryKeyId === options.activeKeyId ? void 0 : options.recoveryKeyId;
   }