fix: enforce simulator object lock updates

[goanpeca]

Summary

• Enforce simulator object-lock updates against bucket fileLockEnabled, compliance weakening, governance bypass requirements, strict-auth bypassGovernance capability, and legal-hold value validation.
• Validate raw b2_update_file_retention payloads before assignment so invalid modes, omitted/non-finite/past timestamps, and malformed null-mode payloads cannot remove or invalidate retention.
• Use wall-clock time for retention timestamp validation so Object Lock policy is not coupled to the simulator auth-token virtual clock.
• Require governance bypass for governance-to-compliance transitions and for governance delete bypass in strict-auth mode before simulator state is mutated.
• Add regression tests with stable B2 error status/code assertions for lock-disabled buckets, compliance/governance weakening, malformed retention payloads, governance conversion, strict-auth bypass capability, invalid legal holds, protected deletes, and expired governance retention deletes without bypass.
• Keep the expired-governance delete regression compatible with both Vitest and Bun by stubbing Date.now() directly.
• Align integration Vitest hookTimeout with the 120s test timeout so real B2 setup on Node 24 is not killed at 10s.

Linked issue

Closes #16

Tests run

• pnpm exec vitest run src/object-lock.test.ts
• pnpm exec vitest run src/object-lock.test.ts src/client.test.ts
• bun test --timeout 180000 src/object-lock.test.ts
• bun test --timeout 180000 src/
• B2_APPLICATION_KEY_ID= B2_APPLICATION_KEY= pnpm test:integration
• pnpm run typecheck
• pnpm run lint
• pnpm test

Follow-up notes

None.

[Copilot]

Pull request overview

This pull request tightens B2Simulator’s behavior around Object Lock updates so SDK tests exercise the same invalid transitions that real B2 rejects (retention updates on lock-disabled buckets, retention weakening rules, and strict-auth bypass capability enforcement), closing issue #16.

Changes:

• Enforce fileLockEnabled on b2_update_file_retention and b2_update_file_legal_hold in the simulator and validate legal-hold values.
• Block compliance retention weakening/removal; require bypassGovernance (and bypassGovernance capability in strict-auth) for governance weakening.
• Add/adjust tests to cover the above behavior and ensure test buckets opt into file lock.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
src/simulator/index.ts	Adds Object Lock enforcement and validation for retention/legal-hold update handlers, including strict-auth bypass capability checks.
src/object-lock.test.ts	Adds regression tests for lock-disabled buckets, compliance/governance weakening rules, strict-auth bypass capability, and legalHold validation.
src/client.test.ts	Updates retention/legal-hold tests to create lock-enabled buckets to match new simulator enforcement.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.