fix: validate simulator create_key capabilities

[goanpeca]

Summary

• Validate simulator b2_create_key keyName values through the shared simulator validation layer: 1..100 characters and B2's letters/digits/hyphen grammar.
• Validate capability names against the Capability enum and reject empty capability lists.
• Validate bucketIds, bucketId, namePrefix, and validDurationInSeconds request shapes before scope/expiration logic so malformed create-key requests return structured bad_request responses.
• Use the issued creator token as the create-key grant source of truth; the implicit master credential now advertises the full Capability enum so clients see the same grant ceiling create-key enforces.
• Reject child capabilities, bucketIds, or namePrefix scopes broader than the creator grant in default and strictAuth modes when the request uses an issued application-key token.
• Derive stored key accountId values from the authenticated account and reject mismatched request accountIds.
• Use the simulator clock for create-key expiration timestamps.
• Export KEY_NAME_MIN and KEY_NAME_MAX from the simulator entry point and document the simulator behavior change in the changelog.

Linked issue

• Closes simulator: create_key does not validate or constrain capabilities #18

Tests run

• /Users/gpenacastellanos/miniforge3/condabin/conda run -n b2-sdk-typescript-issue-18 pnpm exec vitest run src/simulator/fidelity.test.ts src/simulator/validation.test.ts
• /Users/gpenacastellanos/miniforge3/condabin/conda run -n b2-sdk-typescript-issue-18 pnpm run typecheck
• /Users/gpenacastellanos/miniforge3/condabin/conda run -n b2-sdk-typescript-issue-18 pnpm exec biome check src/simulator/index.ts src/simulator/fidelity.test.ts
• /Users/gpenacastellanos/miniforge3/condabin/conda run -n b2-sdk-typescript-issue-18 pnpm exec biome check CHANGELOG.md src/simulator/index.ts
• pnpm run lint
• pnpm test

Follow-up notes

• Default simulator mode now rejects malformed b2_create_key capability/keyName/scope/duration inputs and constrains child-key capabilities, bucketIds, and namePrefix when the request uses an auth token issued for a stored application key.

[Copilot]

Pull request overview

Improves B2Simulator fidelity for b2_create_key by validating requested capabilities against the SDK’s Capability set, enforcing capability-subset rules for child keys (when strictAuth is enabled), and enforcing B2’s keyName length bounds.

Changes:

• Validate b2_create_key.capabilities as a known Capability[] before storing keys, rejecting unknown capability strings.
• In strictAuth mode, reject keys whose requested capabilities exceed the creating token’s grant.
• Enforce keyName length bounds (1..100) and add regression tests for these behaviors.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
src/simulator/index.ts	Adds capability and keyName validation for b2_create_key, and enforces creator-grant capability subset checks in strict auth mode.
src/simulator/fidelity.test.ts	Adds regression tests covering unknown capabilities, creator-grant enforcement, and keyName length bounds.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.