@blamejs/blamejs-shop 0.5.12 → 0.5.13

package/lib/vendor/blamejs/test/layer-0-primitives/sigv4-bucket-ops.test.js

@@ -39,6 +39,16 @@ function _baseConfig(port, overrides) {
 function _fakeS3(behavior) {
   behavior = behavior || {};
   var requests = [];
+  // Emit an S3-style <Error> body with a chosen status/code. Used by the
+  // failure-path tests so every PUT-based bucket op can be driven into its
+  // error/audit-failure branch without hand-rolling the XML per call site.
+  function sendXmlErr(res, spec) {
+    res.writeHead(spec.status, { "Content-Type": "application/xml" });
+    res.end(
+      "<Error><Code>" + spec.code + "</Code>" +
+      "<Message>" + (spec.message || spec.code) + "</Message></Error>"
+    );
+  }
   var server = http.createServer(function (req, res) {
     var chunks = [];
     req.on("data", function (c) { chunks.push(c); });
@@ -52,6 +62,12 @@ function _fakeS3(behavior) {
 
       // ListBuckets — GET / on the service URL.
       if (req.method === "GET" && path === "/" && !req.headers.host.startsWith("test-bucket")) {
+        if (behavior.onList) {
+          var lr = behavior.onList();
+          res.writeHead(lr.statusCode || 200, lr.headers || { "Content-Type": "application/xml" });
+          res.end(lr.body || "");
+          return;
+        }
         res.writeHead(200, { "Content-Type": "application/xml" });
         res.end(
           "<?xml version='1.0' encoding='UTF-8'?>" +
@@ -77,6 +93,7 @@ function _fakeS3(behavior) {
         return;
       }
       if (req.method === "PUT" && parsed.searchParams.has("cors")) {
+        if (behavior.corsErr) { sendXmlErr(res, behavior.corsErr); return; }
         res.writeHead(200);
         res.end();
         return;
@@ -89,6 +106,10 @@ function _fakeS3(behavior) {
           res.end(ol.body || "");
           return;
         }
+        if (req.method === "PUT" && behavior.objectLockPutErr) {
+          sendXmlErr(res, behavior.objectLockPutErr);
+          return;
+        }
         // PUT just acks
         res.writeHead(200);
         res.end();
@@ -102,6 +123,10 @@ function _fakeS3(behavior) {
           res.end(ret.body || "");
           return;
         }
+        if (req.method === "PUT" && behavior.retentionPutErr) {
+          sendXmlErr(res, behavior.retentionPutErr);
+          return;
+        }
         res.writeHead(200);
         res.end();
         return;
@@ -114,6 +139,10 @@ function _fakeS3(behavior) {
           res.end(lh.body || "");
           return;
         }
+        if (req.method === "PUT" && behavior.legalHoldPutErr) {
+          sendXmlErr(res, behavior.legalHoldPutErr);
+          return;
+        }
         res.writeHead(200);
         res.end();
         return;
@@ -231,6 +260,8 @@ function testBucketNameValidation() {
   shouldThrow("rejects trailing hyphen",  "bucket-");
   shouldThrow("rejects underscore",       "my_bucket");
   shouldThrow("rejects consecutive dots", "my..bucket");
+  shouldThrow("rejects non-string name",  123);
+  shouldThrow("rejects null name",        null);
   // Valid names should not throw.
   v("valid-bucket-name");
   v("vbn1");
@@ -649,6 +680,8 @@ async function testSetObjectRetentionValidation() {
       check("retention validation: " + label,
             threw && codeRe.test(threw.code || ""));
     }
+    await shouldThrow("rejects null opts",
+      null, /INVALID_RETENTION/);
     await shouldThrow("rejects missing mode",
       { retainUntil: new Date(Date.now() + 1000) }, /INVALID_RETENTION/);
     await shouldThrow("rejects bad mode",
@@ -1019,6 +1052,594 @@ function testCanonicalPathSingleEncodeForS3() {
         sigv4.awsUriEncode("photo-\u{1F600}.jpg", true) === "photo-%F0%9F%98%80.jpg");
 }
 
+// ---- Factory default-resolution branches ----
+
+function testFactoryDefaultsAndTrailingSlash() {
+  // Missing secretAccessKey — the third required-credential guard (region +
+  // accessKeyId are already covered; this closes the trio).
+  var threwSecret = null;
+  try {
+    bucketOps.create({ region: "us-east-1", accessKeyId: "x" });
+  } catch (e) { threwSecret = e; }
+  check("factory: missing secretAccessKey rejected",
+        threwSecret && /INVALID_CONFIG/.test(threwSecret.code || ""));
+
+  // No endpoint / allowedProtocols / allowInternal supplied — the factory
+  // must fill each default (endpoint → https://s3.<region>.amazonaws.com,
+  // allowedProtocols → ALLOW_HTTP_TLS, allowInternal → null) and still
+  // return a usable ops object. No request is made here so no network is hit.
+  var opsDefault = bucketOps.create({
+    region:          "us-east-1",
+    accessKeyId:     "AKIAIOSFODNN7EXAMPLE",
+    secretAccessKey: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
+  });
+  check("factory: defaults resolve to a usable ops object (protocol sigv4)",
+        opsDefault && opsDefault.protocol === "sigv4");
+  check("factory: default ops exposes create()",
+        typeof opsDefault.create === "function");
+
+  // Trailing slash on the endpoint is trimmed so the derived bucket URLs
+  // don't grow a double slash.
+  var opsSlash = bucketOps.create({
+    region:           "us-east-1",
+    accessKeyId:      "x",
+    secretAccessKey:  "y",
+    endpoint:         "http://127.0.0.1:1/",
+    allowedProtocols: b.safeUrl.ALLOW_HTTP_ALL,
+    allowInternal:    true,
+  });
+  check("factory: trailing-slash endpoint accepted (slash trimmed)",
+        opsSlash && opsSlash.protocol === "sigv4");
+}
+
+// ---- Lifecycle XML builder — adversarial / optional-field branches ----
+
+function testLifecycleXmlAdversarial() {
+  function shouldThrow(label, rules, codeRe) {
+    var threw = null;
+    try { bucketOps._buildLifecycleXmlForTest(rules); } catch (e) { threw = e; }
+    check("lifecycle-adv: " + label,  threw && codeRe.test(threw.code || ""));
+  }
+  // Length cap fires before the per-rule loop, so the rule contents are
+  // irrelevant — a 1001-length array trips the S3 1000-rule ceiling.
+  var tooMany = [];
+  for (var i = 0; i < 1001; i++) tooMany.push({ expiration: { days: 1 } });
+  shouldThrow("rejects > 1000 rules", tooMany, /INVALID_LIFECYCLE/);
+  shouldThrow("rejects non-object rule", [null], /INVALID_LIFECYCLE/);
+  shouldThrow("rejects empty-string id",
+    [{ id: "", status: "Enabled", expiration: { days: 1 } }], /INVALID_LIFECYCLE/);
+  shouldThrow("rejects non-string id",
+    [{ id: 5, status: "Enabled", expiration: { days: 1 } }], /INVALID_LIFECYCLE/);
+  shouldThrow("rejects abortIncompleteMultipartUpload.daysAfterInitiation = 0",
+    [{ status: "Enabled",
+       abortIncompleteMultipartUpload: { daysAfterInitiation: 0 } }],
+    /INVALID_LIFECYCLE/);
+
+  // Optional expiration sub-fields (date + expiredObjectDeleteMarker) and
+  // transition.date each emit their own element.
+  var xml = bucketOps._buildLifecycleXmlForTest([{
+    status: "Enabled",
+    expiration: { date: "2030-01-01T00:00:00.000Z", expiredObjectDeleteMarker: true },
+    transition: { date: "2029-01-01T00:00:00.000Z", storageClass: "GLACIER" },
+  }]);
+  check("lifecycle-adv: Expiration Date element emitted",
+        /<Date>2030-01-01T00:00:00\.000Z<\/Date>/.test(xml));
+  check("lifecycle-adv: ExpiredObjectDeleteMarker element emitted",
+        /<ExpiredObjectDeleteMarker>true<\/ExpiredObjectDeleteMarker>/.test(xml));
+  check("lifecycle-adv: Transition Date element emitted",
+        /<Transition><Date>2029-01-01T00:00:00\.000Z<\/Date>/.test(xml));
+
+  // expiredObjectDeleteMarker:false takes the falsy ternary arm.
+  var xmlFalse = bucketOps._buildLifecycleXmlForTest([{
+    status: "Enabled",
+    expiration: { days: 5, expiredObjectDeleteMarker: false },
+  }]);
+  check("lifecycle-adv: ExpiredObjectDeleteMarker false arm emitted",
+        /<ExpiredObjectDeleteMarker>false<\/ExpiredObjectDeleteMarker>/.test(xmlFalse));
+
+  // Omitting status defaults it to Enabled (the `rule.status || "Enabled"` arm).
+  var xmlNoStatus = bucketOps._buildLifecycleXmlForTest([{
+    expiration: { days: 1 },
+  }]);
+  check("lifecycle-adv: omitted status defaults to Enabled",
+        /<Status>Enabled<\/Status>/.test(xmlNoStatus));
+}
+
+// ---- CORS XML builder — adversarial / optional-field / size-cap branches ----
+
+function testCorsXmlAdversarial() {
+  function shouldThrow(label, rules, codeRe) {
+    var threw = null;
+    try { bucketOps._buildCorsXmlForTest(rules); } catch (e) { threw = e; }
+    check("cors-adv: " + label,  threw && codeRe.test(threw.code || ""));
+  }
+  var tooMany = [];
+  for (var i = 0; i < 101; i++) {
+    tooMany.push({ allowedOrigins: ["*"], allowedMethods: ["GET"] });
+  }
+  shouldThrow("rejects > 100 rules", tooMany, /INVALID_CORS_RULE/);
+  shouldThrow("rejects non-object rule", [null], /INVALID_CORS_RULE/);
+
+  // A rule with an id emits <ID>; the escaped-content path is exercised too.
+  var xml = bucketOps._buildCorsXmlForTest([{
+    id: "rule-1",
+    allowedOrigins: ["https://a.example.com"],
+    allowedMethods: ["GET"],
+  }]);
+  check("cors-adv: rule ID element emitted", /<ID>rule-1<\/ID>/.test(xml));
+
+  // Size cap: a single valid rule with thousands of allowed headers pushes the
+  // serialized body past the 64 KB S3 ceiling.
+  var bigHeaders = [];
+  for (var h = 0; h < 3000; h++) bigHeaders.push("x-custom-header-" + h);
+  var threwBig = null;
+  try {
+    bucketOps._buildCorsXmlForTest([{
+      allowedOrigins: ["*"],
+      allowedMethods: ["GET"],
+      allowedHeaders: bigHeaders,
+    }]);
+  } catch (e) { threwBig = e; }
+  check("cors-adv: > 64 KB configuration rejected",
+        threwBig && /INVALID_CORS_RULE/.test(threwBig.code || "") &&
+        /64 KB/.test(threwBig.message || ""));
+}
+
+// ---- Object-key length guard ----
+
+async function testObjectKeyTooLong() {
+  var fake = _fakeS3();
+  var port = await listenOnRandomPort(fake.server);
+  try {
+    var ops = bucketOps.create(_baseConfig(port));
+    var longKey = new Array(1100).join("k"); // 1099 bytes > 1 KiB S3 limit
+    var threw = null;
+    try { await ops.getObjectRetention("my-bucket", longKey); }
+    catch (e) { threw = e; }
+    check("object-key: > 1024 bytes rejected with INVALID_KEY",
+          threw && /INVALID_KEY/.test(threw.code || ""));
+  } finally {
+    await new Promise(function (r) { fake.server.close(function () { r(); }); });
+  }
+}
+
+// ---- ListBuckets XML-shape branches: empty + single ----
+
+async function testListBucketsEmptyAndSingle() {
+  var fakeEmpty = _fakeS3({
+    onList: function () {
+      return { statusCode: 200, body:
+        "<?xml version='1.0'?><ListAllMyBucketsResult><Buckets></Buckets>" +
+        "<Owner><ID>op</ID></Owner></ListAllMyBucketsResult>" };
+    },
+  });
+  var portE = await listenOnRandomPort(fakeEmpty.server);
+  try {
+    var opsE = bucketOps.create(_baseConfig(portE));
+    var none = await opsE.list();
+    check("list: empty Buckets container yields []", Array.isArray(none) && none.length === 0);
+  } finally {
+    await new Promise(function (r) { fakeEmpty.server.close(function () { r(); }); });
+  }
+
+  // A 200 whose body lacks the ListAllMyBucketsResult root (unexpected
+  // backend response) degrades to [] via the `doc.<Root> || {}` default arm
+  // rather than throwing.
+  var fakeGarbage = _fakeS3({
+    onList: function () {
+      return { statusCode: 200, body: "<?xml version='1.0'?><Unexpected/>" };
+    },
+  });
+  var portG = await listenOnRandomPort(fakeGarbage.server);
+  try {
+    var opsG = bucketOps.create(_baseConfig(portG));
+    var garbage = await opsG.list();
+    check("list: body without ListAllMyBucketsResult root yields []",
+          Array.isArray(garbage) && garbage.length === 0);
+  } finally {
+    await new Promise(function (r) { fakeGarbage.server.close(function () { r(); }); });
+  }
+
+  // A single <Bucket> is surfaced by the XML parser as an object, not an
+  // array — the wrap-in-array branch must still produce a one-element list.
+  // The bucket omits CreationDate + BucketRegion so the null-default arms of
+  // both fields are exercised.
+  var fakeOne = _fakeS3({
+    onList: function () {
+      return { statusCode: 200, body:
+        "<?xml version='1.0'?><ListAllMyBucketsResult><Buckets>" +
+        "<Bucket><Name>solo</Name></Bucket>" +
+        "</Buckets></ListAllMyBucketsResult>" };
+    },
+  });
+  var portO = await listenOnRandomPort(fakeOne.server);
+  try {
+    var opsO = bucketOps.create(_baseConfig(portO));
+    var one = await opsO.list();
+    check("list: single Bucket wrapped into a one-element array",
+          one.length === 1 && one[0].name === "solo");
+    check("list: single-bucket region defaults to null when absent",
+          one[0].region === null);
+    check("list: single-bucket creationDate defaults to null when absent",
+          one[0].creationDate === null);
+  } finally {
+    await new Promise(function (r) { fakeOne.server.close(function () { r(); }); });
+  }
+}
+
+// ---- Object-lock config: years path + adversarial validation ----
+
+async function testObjectLockYearsAndValidation() {
+  var fake = _fakeS3({
+    onGetObjectLock: function () {
+      return { statusCode: 200, body:
+        '<?xml version="1.0"?><ObjectLockConfiguration>' +
+        '<ObjectLockEnabled>Enabled</ObjectLockEnabled>' +
+        '<Rule><DefaultRetention><Mode>GOVERNANCE</Mode><Days>10</Days></DefaultRetention></Rule>' +
+        '</ObjectLockConfiguration>' };
+    },
+  });
+  var port = await listenOnRandomPort(fake.server);
+  try {
+    var ops = bucketOps.create(_baseConfig(port));
+
+    // years-based config: exercises the <Years> XML arm + the years echo
+    // in the success result (days stays null).
+    var rv = await ops.setObjectLockConfiguration("my-bucket",
+      { mode: "COMPLIANCE", years: 3 });
+    check("object-lock years: applied", rv.applied === true);
+    check("object-lock years: years echoed, days null",
+          rv.years === 3 && rv.days === null);
+    var putReq = fake.requests[fake.requests.length - 1];
+    check("object-lock years: body carries <Years>3</Years>",
+          /<Years>3<\/Years>/.test(putReq.body.toString("utf8")));
+
+    // getObjectLockConfiguration returning Days (not Years) drives the
+    // Number(def.Days) parse arm.
+    var got = await ops.getObjectLockConfiguration("my-bucket");
+    check("object-lock get: Days parsed as number",
+          got.days === 10 && got.years === null && got.mode === "GOVERNANCE");
+
+    async function shouldThrow(label, opts, codeRe) {
+      var threw = null;
+      try { await ops.setObjectLockConfiguration("my-bucket", opts); }
+      catch (e) { threw = e; }
+      check("object-lock validation: " + label, threw && codeRe.test(threw.code || ""));
+    }
+    await shouldThrow("rejects non-object cfg", null, /INVALID_OBJECT_LOCK/);
+    await shouldThrow("rejects neither days nor years",
+      { mode: "GOVERNANCE" }, /INVALID_OBJECT_LOCK/);
+    await shouldThrow("rejects negative years",
+      { mode: "GOVERNANCE", years: -1 }, /INVALID_OBJECT_LOCK/);
+    await shouldThrow("rejects fractional years",
+      { mode: "GOVERNANCE", years: 1.5 }, /INVALID_OBJECT_LOCK/);
+  } finally {
+    await new Promise(function (r) { fake.server.close(function () { r(); }); });
+  }
+}
+
+// ---- PUT-op failure branches: throws + failure-audit emission ----
+
+async function testPutOpFailurePaths() {
+  var auditCap = _captureAudit();
+  var obsCap   = _captureObs();
+  var fake = _fakeS3({
+    lifecycleErr:    { status: 500, code: "InternalError" },
+    corsErr:         { status: 500, code: "InternalError" },
+    objectLockPutErr:{ status: 500, code: "InternalError" },
+    retentionPutErr: { status: 500, code: "InternalError" },
+    legalHoldPutErr: { status: 500, code: "InternalError" },
+    // GET-before-PUT in setObjectRetention must resolve to "not configured"
+    // so the flow falls through to the failing PUT.
+    onGetObjectRetention: function () {
+      return { statusCode: 400, body:
+        '<?xml version="1.0"?><Error><Code>NoSuchObjectLockConfiguration</Code>' +
+        '<Message>no retention</Message></Error>' };
+    },
+  });
+  var port = await listenOnRandomPort(fake.server);
+  try {
+    var ops = bucketOps.create(Object.assign({}, _baseConfig(port), {
+      audit:         auditCap,
+      observability: obsCap,
+    }));
+
+    async function expectFailure(label, action, fn) {
+      var threw = null;
+      try { await fn(); } catch (e) { threw = e; }
+      check("put-fail: " + label + " throws on 5xx", threw !== null);
+      var rows = auditCap.byAction(action).filter(function (r) { return r.outcome === "failure"; });
+      check("put-fail: " + label + " emits failure audit row", rows.length >= 1);
+      check("put-fail: " + label + " emits failure obs counter",
+            obsCap.byName(action).some(function (e) {
+              return e.labels && e.labels.outcome === "failure";
+            }));
+    }
+
+    await expectFailure("setLifecycle", "objectstore.bucket.setLifecycle", function () {
+      return ops.setLifecycle("logs", [{ status: "Enabled",
+        abortIncompleteMultipartUpload: { daysAfterInitiation: 7 } }]);
+    });
+    await expectFailure("setCorsRules", "objectstore.bucket.setCorsRules", function () {
+      return ops.setCorsRules("public", [{
+        allowedOrigins: ["https://a.example.com"], allowedMethods: ["GET"] }]);
+    });
+    await expectFailure("setObjectLockConfiguration",
+      "objectstore.bucket.setObjectLockConfiguration", function () {
+        return ops.setObjectLockConfiguration("my-bucket", { mode: "GOVERNANCE", days: 30 });
+      });
+    await expectFailure("setObjectRetention", "objectstore.object.setRetention", function () {
+      return ops.setObjectRetention("my-bucket", "k",
+        { mode: "GOVERNANCE", retainUntil: new Date(Date.now() + 60000) });
+    });
+    await expectFailure("setObjectLegalHold", "objectstore.object.setLegalHold", function () {
+      return ops.setObjectLegalHold("my-bucket", "k", "ON");
+    });
+  } finally {
+    await new Promise(function (r) { fake.server.close(function () { r(); }); });
+  }
+}
+
+// ---- GET-op re-throw when the error is NOT a "not configured" state ----
+
+async function testGetOpsRethrowRealError() {
+  function realErr() {
+    return { statusCode: 500, body:
+      '<?xml version="1.0"?><Error><Code>InternalError</Code>' +
+      '<Message>backend exploded</Message></Error>' };
+  }
+  var fake = _fakeS3({
+    onGetObjectLock:      realErr,
+    onGetObjectRetention: realErr,
+    onGetLegalHold:       realErr,
+  });
+  var port = await listenOnRandomPort(fake.server);
+  try {
+    var ops = bucketOps.create(_baseConfig(port));
+
+    var threwLock = null;
+    try { await ops.getObjectLockConfiguration("my-bucket"); }
+    catch (e) { threwLock = e; }
+    check("get-rethrow: getObjectLockConfiguration re-throws a 500 (not swallowed)",
+          threwLock && threwLock.statusCode === 500);
+
+    var threwRet = null;
+    try { await ops.getObjectRetention("my-bucket", "k"); }
+    catch (e) { threwRet = e; }
+    check("get-rethrow: getObjectRetention re-throws a 500 (not swallowed)",
+          threwRet && threwRet.statusCode === 500);
+
+    var threwLh = null;
+    try { await ops.getObjectLegalHold("my-bucket", "k"); }
+    catch (e) { threwLh = e; }
+    check("get-rethrow: getObjectLegalHold re-throws a 500 (not swallowed)",
+          threwLh && threwLh.statusCode === 500);
+  } finally {
+    await new Promise(function (r) { fake.server.close(function () { r(); }); });
+  }
+}
+
+// ---- get* defensive parse defaults (unexpected / empty backend document) ----
+
+async function testGetOpsParseDefaults() {
+  // A 200 whose body lacks the expected root element (a quirk of some
+  // S3-compatible stores) must degrade to clean nulls, not throw — exercising
+  // the `doc.<Root> || {}` and `<field> || null` default arms.
+  function otherDoc() {
+    return { statusCode: 200, body: '<?xml version="1.0"?><Unexpected/>' };
+  }
+  var fake = _fakeS3({
+    onGetObjectLock:      otherDoc,
+    onGetObjectRetention: otherDoc,
+    onGetLegalHold:       otherDoc,
+  });
+  var port = await listenOnRandomPort(fake.server);
+  try {
+    var ops = bucketOps.create(_baseConfig(port));
+
+    var lock = await ops.getObjectLockConfiguration("my-bucket");
+    check("parse-defaults: object-lock unexpected doc → enabled:false + null fields",
+          lock.enabled === false && lock.mode === null &&
+          lock.days === null && lock.years === null);
+
+    var ret = await ops.getObjectRetention("my-bucket", "k");
+    check("parse-defaults: retention unexpected doc → mode:null, retainUntil:null",
+          ret.mode === null && ret.retainUntil === null);
+
+    var lh = await ops.getObjectLegalHold("my-bucket", "k");
+    check("parse-defaults: legal-hold unexpected doc → status:null",
+          lh.status === null);
+  } finally {
+    await new Promise(function (r) { fake.server.close(function () { r(); }); });
+  }
+}
+
+// ---- createBucket generic (non-409) failure + auditFailures:false ----
+
+async function testCreateGenericFailureAndAuditFailuresOff() {
+  // A non-409 failure is NOT remapped to a BUCKET_* code — the raw HTTP
+  // error surfaces, and the failure-audit row carries its code.
+  var auditCap = _captureAudit();
+  var fake = _fakeS3({ createErr: { status: 500, code: "InternalError" } });
+  var port = await listenOnRandomPort(fake.server);
+  try {
+    var ops = bucketOps.create(Object.assign({}, _baseConfig(port), { audit: auditCap }));
+    var threw = null;
+    try { await ops.create("boom"); } catch (e) { threw = e; }
+    check("create-generic-fail: non-409 error surfaces raw (HTTP_ERROR)",
+          threw && threw.statusCode === 500 &&
+          !/BUCKET_ALREADY_OWNED|BUCKET_NAME_TAKEN/.test(threw.code || ""));
+    var rows = auditCap.byAction("objectstore.bucket.create")
+      .filter(function (r) { return r.outcome === "failure"; });
+    check("create-generic-fail: failure audit row emitted", rows.length === 1);
+  } finally {
+    await new Promise(function (r) { fake.server.close(function () { r(); }); });
+  }
+
+  // auditFailures:false suppresses the failure audit row while the op still
+  // throws and the observability counter still fires.
+  var auditCap2 = _captureAudit();
+  var obsCap2   = _captureObs();
+  var fake2 = _fakeS3({ createErr: { status: 500, code: "InternalError" } });
+  var port2 = await listenOnRandomPort(fake2.server);
+  try {
+    var ops2 = bucketOps.create(Object.assign({}, _baseConfig(port2), {
+      audit:         auditCap2,
+      observability: obsCap2,
+      auditFailures: false,
+    }));
+    var threw2 = null;
+    try { await ops2.create("boom2"); } catch (e) { threw2 = e; }
+    check("auditFailures:false: op still throws", threw2 !== null);
+    check("auditFailures:false: no failure audit row emitted",
+          auditCap2.byAction("objectstore.bucket.create").length === 0);
+    check("auditFailures:false: obs failure counter still fires",
+          obsCap2.byName("objectstore.bucket.create").some(function (e) {
+            return e.labels && e.labels.outcome === "failure";
+          }));
+  } finally {
+    await new Promise(function (r) { fake2.server.close(function () { r(); }); });
+  }
+}
+
+// ---- deleteBucket generic (non-404, non-409) failure ----
+
+async function testDeleteGenericFailure() {
+  var auditCap = _captureAudit();
+  var fake = _fakeS3({ deleteErr: { status: 500, code: "InternalError" } });
+  var port = await listenOnRandomPort(fake.server);
+  try {
+    var ops = bucketOps.create(Object.assign({}, _baseConfig(port), { audit: auditCap }));
+    var threw = null;
+    try { await ops.delete("boom"); } catch (e) { threw = e; }
+    check("delete-generic-fail: non-404/409 error surfaces + throws",
+          threw && threw.statusCode === 500);
+    var rows = auditCap.byAction("objectstore.bucket.delete")
+      .filter(function (r) { return r.outcome === "failure"; });
+    check("delete-generic-fail: failure audit row emitted", rows.length === 1);
+  } finally {
+    await new Promise(function (r) { fake.server.close(function () { r(); }); });
+  }
+}
+
+// ---- setObjectRetention COMPLIANCE pre-check (WORM defense-in-depth) ----
+
+async function testSetObjectRetentionComplianceGuards() {
+  // Existing retention on the object is COMPLIANCE, 30 days out. The client-
+  // side pre-check (GET-before-PUT) must refuse a bypass and refuse any
+  // shortening — even before the backend gets the PUT.
+  var existingUntil = new Date(Date.now() + 30 * 24 * 60 * 60 * 1000);
+  var fake = _fakeS3({
+    onGetObjectRetention: function () {
+      return { statusCode: 200, body:
+        '<?xml version="1.0"?><Retention><Mode>COMPLIANCE</Mode>' +
+        '<RetainUntilDate>' + existingUntil.toISOString() + '</RetainUntilDate></Retention>' };
+    },
+  });
+  var port = await listenOnRandomPort(fake.server);
+  try {
+    var ops = bucketOps.create(_baseConfig(port));
+
+    // bypassGovernance against a COMPLIANCE lock — refused client-side.
+    var threwBypass = null;
+    try {
+      await ops.setObjectRetention("my-bucket", "k", {
+        mode:             "COMPLIANCE",
+        retainUntil:      new Date(Date.now() + 60 * 24 * 60 * 60 * 1000),
+        bypassGovernance: true,
+      });
+    } catch (e) { threwBypass = e; }
+    check("compliance-guard: bypassGovernance on COMPLIANCE is refused",
+          threwBypass && /compliance-bypass-refused/.test(threwBypass.code || ""));
+
+    // Proposing an EARLIER retainUntil (shortening) — refused client-side.
+    var threwShort = null;
+    try {
+      await ops.setObjectRetention("my-bucket", "k", {
+        mode:        "COMPLIANCE",
+        retainUntil: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000),
+      });
+    } catch (e) { threwShort = e; }
+    check("compliance-guard: shortening a COMPLIANCE retention is refused",
+          threwShort && /compliance-shortening-refused/.test(threwShort.code || ""));
+
+    // EXTENDING (later retainUntil, no bypass) is allowed — the pre-check
+    // passes and the PUT proceeds.
+    var extended = await ops.setObjectRetention("my-bucket", "k", {
+      mode:        "COMPLIANCE",
+      retainUntil: new Date(Date.now() + 90 * 24 * 60 * 60 * 1000),
+    });
+    check("compliance-guard: extending a COMPLIANCE retention proceeds to PUT",
+          extended.applied === true);
+  } finally {
+    await new Promise(function (r) { fake.server.close(function () { r(); }); });
+  }
+}
+
+// The pre-check GET is value-add, NOT load-bearing: when it fails with a
+// non-compliance error the flow falls through to the PUT so the backend's own
+// enforcement is authoritative.
+async function testSetObjectRetentionPreCheckFallsThrough() {
+  var fake = _fakeS3({
+    onGetObjectRetention: function () {
+      return { statusCode: 500, body:
+        '<?xml version="1.0"?><Error><Code>InternalError</Code>' +
+        '<Message>pre-check backend error</Message></Error>' };
+    },
+    // No retentionPutErr → the PUT itself succeeds.
+  });
+  var port = await listenOnRandomPort(fake.server);
+  try {
+    var ops = bucketOps.create(_baseConfig(port));
+    var rv = await ops.setObjectRetention("my-bucket", "k", {
+      mode:        "GOVERNANCE",
+      retainUntil: new Date(Date.now() + 60000),
+    });
+    check("pre-check-fallthrough: a failed GET pre-check still lets the PUT proceed",
+          rv.applied === true && rv.mode === "GOVERNANCE");
+  } finally {
+    await new Promise(function (r) { fake.server.close(function () { r(); }); });
+  }
+}
+
+// ---- Virtual-hosted-style URL construction (pathStyle:false) ----
+
+async function testVirtualHostStyleUrlConstruction() {
+  // With pathStyle:false the bucket name is prepended as a subdomain of the
+  // endpoint host (`<bucket>.<host>`) for both bucket-level and object-level
+  // URLs — the else arm of _bucketUrl / _objectUrl. Against an IPv4 endpoint
+  // the WHATWG URL host-setter refuses the subdomain prefix (you cannot make
+  // an IP literal into a domain), so the constructed URL keeps the IP host and
+  // the request still lands on the fake server. The subresource query + path
+  // are what we assert; the branch under test is exercised either way.
+  var fake = _fakeS3();
+  var port = await listenOnRandomPort(fake.server);
+  try {
+    var ops = bucketOps.create(_baseConfig(port, { pathStyle: false }));
+
+    // Bucket-level: virtual-host addressing sets pathname "/" (no /<bucket>/
+    // prefix). Against the IP endpoint the create still completes.
+    var created = await ops.create("vh-bucket");
+    check("vhost: bucket-level create completes via the else-arm URL builder",
+          created.created === true);
+    var createReq = fake.requests[fake.requests.length - 1];
+    check("vhost: bucket-level URL uses root path (no path-style /<bucket>/ prefix)",
+          createReq.url === "/" && createReq.method === "PUT");
+
+    // Object-level: pathname is "/<key>" (no /<bucket>/ prefix). The
+    // legal-hold subresource query survives the virtual-host code path.
+    fake.requests.length = 0;
+    var held = await ops.setObjectLegalHold("vh-bucket", "some-key", "ON");
+    check("vhost: object-level legal-hold completes via the else-arm URL builder",
+          held.applied === true && held.status === "ON");
+    var objReq = fake.requests[fake.requests.length - 1];
+    check("vhost: object-level URL is /<key> (no /<bucket>/ prefix) + carries ?legal-hold",
+          objReq.url.indexOf("/some-key") === 0 && objReq.url.indexOf("legal-hold") !== -1);
+  } finally {
+    await new Promise(function (r) { fake.server.close(function () { r(); }); });
+  }
+}
+
 // bucketOps dispatches every request through the shared httpClient keep-alive
 // transport pool; a cached client socket finalizes its destroy on a later
 // event-loop turn, past the forked worker's grace window. Reset the pool, then
@@ -1068,6 +1689,21 @@ async function run() {
     await testAuditObservabilityWiring();
     await testAuditSuccessFalseDisablesSuccessAudit();
     await testPerCallActorOverrideHonored();
+    // Uncovered error / adversarial / defensive / option-default branches.
+    testFactoryDefaultsAndTrailingSlash();
+    testLifecycleXmlAdversarial();
+    testCorsXmlAdversarial();
+    await testObjectKeyTooLong();
+    await testListBucketsEmptyAndSingle();
+    await testObjectLockYearsAndValidation();
+    await testPutOpFailurePaths();
+    await testGetOpsRethrowRealError();
+    await testGetOpsParseDefaults();
+    await testCreateGenericFailureAndAuditFailuresOff();
+    await testDeleteGenericFailure();
+    await testSetObjectRetentionComplianceGuards();
+    await testSetObjectRetentionPreCheckFallsThrough();
+    await testVirtualHostStyleUrlConstruction();
   } finally {
     await _drainTcpHandles();
   }