@celilo/e2e 0.10.4 → 0.11.1

package/src/vantage.test.ts

@@ -36,10 +36,12 @@ const LAN: Vantage = 'internalDevice';
 
 describe('resolveFrom', () => {
   test('defaults method to system, passes through ips', async () => {
-    const probe = new VantageProbe(fakeTransport({ resolve: async () => ({ ips: ['192.168.0.253'] }) }));
+    const probe = new VantageProbe(
+      fakeTransport({ resolve: async () => ({ ips: ['10.226.1.253'] }) }),
+    );
     const r = await probe.resolveFrom({ from: LAN, name: 'www.example.com' });
     expect(r.method).toBe('system');
-    expect(r.ips).toEqual(['192.168.0.253']);
+    expect(r.ips).toEqual(['10.226.1.253']);
   });
 });
 
@@ -51,7 +53,9 @@ describe('assertResolves / assertNxdomain', () => {
     );
   });
   test('assertNxdomain throws when a public vantage CAN see an internal-only name', async () => {
-    const probe = new VantageProbe(fakeTransport({ resolve: async () => ({ ips: ['10.0.20.5'] }) }));
+    const probe = new VantageProbe(
+      fakeTransport({ resolve: async () => ({ ips: ['10.226.20.5'] }) }),
+    );
     await expect(
       probe.assertNxdomain({ from: 'publicInternet', name: 'authentik.internal' }),
     ).rejects.toThrow(/expected NXDOMAIN/);
@@ -60,100 +64,150 @@ describe('assertResolves / assertNxdomain', () => {
 
 describe('assertResolvesInZone — the killer verb', () => {
   test('ISS-0101: www at caddy DMZ container IP FAILS from internalDevice', async () => {
-    const probe = new VantageProbe(fakeTransport({ resolve: async () => ({ ips: ['10.0.10.10'] }) }));
+    const probe = new VantageProbe(
+      fakeTransport({ resolve: async () => ({ ips: ['10.226.10.10'] }) }),
+    );
     await expect(
       probe.assertResolvesInZone({ from: LAN, name: 'www.example.com', zone: 'internal' }),
     ).rejects.toThrow(/ISS-0101/);
   });
 
   test('www at the firewall natIp PASSES from internalDevice (the right answer)', async () => {
-    const probe = new VantageProbe(fakeTransport({ resolve: async () => ({ ips: ['192.168.0.253'] }) }));
-    const r = await probe.assertResolvesInZone({ from: LAN, name: 'www.example.com', zone: 'internal' });
-    expect(r.ips).toEqual(['192.168.0.253']);
+    const probe = new VantageProbe(
+      fakeTransport({ resolve: async () => ({ ips: ['10.226.1.253'] }) }),
+    );
+    const r = await probe.assertResolvesInZone({
+      from: LAN,
+      name: 'www.example.com',
+      zone: 'internal',
+    });
+    expect(r.ips).toEqual(['10.226.1.253']);
   });
 
   test('public vantage expecting a public answer passes; a leaked zone IP fails', async () => {
-    const ok = new VantageProbe(fakeTransport({ resolve: async () => ({ ips: ['100.100.0.100'] }) }));
-    await ok.assertResolvesInZone({ from: 'publicInternet', name: 'www.example.com', zone: 'public' });
+    const ok = new VantageProbe(
+      fakeTransport({ resolve: async () => ({ ips: ['100.100.0.100'] }) }),
+    );
+    await ok.assertResolvesInZone({
+      from: 'publicInternet',
+      name: 'www.example.com',
+      zone: 'public',
+    });
 
-    const leaked = new VantageProbe(fakeTransport({ resolve: async () => ({ ips: ['192.168.0.253'] }) }));
+    const leaked = new VantageProbe(
+      fakeTransport({ resolve: async () => ({ ips: ['10.226.1.253'] }) }),
+    );
     await expect(
-      leaked.assertResolvesInZone({ from: 'publicInternet', name: 'www.example.com', zone: 'public' }),
+      leaked.assertResolvesInZone({
+        from: 'publicInternet',
+        name: 'www.example.com',
+        zone: 'public',
+      }),
     ).rejects.toThrow(VantageAssertionError);
   });
 
   test('any one leaked IP among several fails the whole answer', async () => {
     const probe = new VantageProbe(
-      fakeTransport({ resolve: async () => ({ ips: ['192.168.0.253', '10.0.30.9'] }) }),
+      fakeTransport({ resolve: async () => ({ ips: ['10.226.1.253', '10.226.30.9'] }) }),
     );
     await expect(
       probe.assertResolvesInZone({ from: LAN, name: 'www.example.com', zone: 'internal' }),
-    ).rejects.toThrow(/10\.0\.30\.9/);
+    ).rejects.toThrow(/10\.226\.30\.9/);
   });
 });
 
 describe('assertResolvesTo — exact-IP DNS correctness', () => {
   test('passes when the resolver returns the expected IP (via a specific server)', async () => {
-    const probe = new VantageProbe(fakeTransport({ resolve: async () => ({ ips: ['192.168.0.53'] }) }));
+    const probe = new VantageProbe(
+      fakeTransport({ resolve: async () => ({ ips: ['10.226.1.53'] }) }),
+    );
     const r = await probe.assertResolvesTo({
       from: 'internalDevice',
       name: 'host.infra.example.com',
       method: 'dns',
-      server: '192.168.0.10',
-      expected: '192.168.0.53',
+      server: '10.226.1.10',
+      expected: '10.226.1.53',
     });
-    expect(r.ips).toEqual(['192.168.0.53']);
+    expect(r.ips).toEqual(['10.226.1.53']);
   });
 
   test('fails (naming the server) when the expected IP is absent', async () => {
-    const probe = new VantageProbe(fakeTransport({ resolve: async () => ({ ips: ['10.0.10.99'] }) }));
+    const probe = new VantageProbe(
+      fakeTransport({ resolve: async () => ({ ips: ['10.226.10.99'] }) }),
+    );
     await expect(
       probe.assertResolvesTo({
         from: 'internalDevice',
         name: 'host.infra.example.com',
         method: 'dns',
-        server: '192.168.0.10',
-        expected: '192.168.0.53',
+        server: '10.226.1.10',
+        expected: '10.226.1.53',
       }),
-    ).rejects.toThrow(/via 192\.168\.0\.10.*expected to include \[192\.168\.0\.53\]/);
+    ).rejects.toThrow(/via 10\.226\.1\.10.*expected to include \[10\.226\.1\.53\]/);
   });
 
   test('accepts an array of expected IPs (all must be present)', async () => {
-    const probe = new VantageProbe(fakeTransport({ resolve: async () => ({ ips: ['1.2.3.4', '5.6.7.8'] }) }));
-    await probe.assertResolvesTo({ from: 'publicInternet', name: 'x', expected: ['1.2.3.4', '5.6.7.8'] });
+    const probe = new VantageProbe(
+      fakeTransport({ resolve: async () => ({ ips: ['1.2.3.4', '5.6.7.8'] }) }),
+    );
+    await probe.assertResolvesTo({
+      from: 'publicInternet',
+      name: 'x',
+      expected: ['1.2.3.4', '5.6.7.8'],
+    });
     await expect(
-      probe.assertResolvesTo({ from: 'publicInternet', name: 'x', expected: ['1.2.3.4', '9.9.9.9'] }),
+      probe.assertResolvesTo({
+        from: 'publicInternet',
+        name: 'x',
+        expected: ['1.2.3.4', '9.9.9.9'],
+      }),
     ).rejects.toThrow(/9\.9\.9\.9/);
   });
 });
 
 describe('reachability + isolation (§D6)', () => {
   test('assertReachable throws when the connection fails (ISS-0111 git-ssh:2222)', async () => {
-    const probe = new VantageProbe(fakeTransport({ tcpConnect: async () => ({ connected: false, detail: 'timeout' }) }));
-    await expect(probe.assertReachable({ from: LAN, host: 'git-ssh.example.com', port: 2222 })).rejects.toThrow(
-      /timeout/,
+    const probe = new VantageProbe(
+      fakeTransport({ tcpConnect: async () => ({ connected: false, detail: 'timeout' }) }),
     );
+    await expect(
+      probe.assertReachable({ from: LAN, host: 'git-ssh.example.com', port: 2222 }),
+    ).rejects.toThrow(/timeout/);
   });
   test('assertUnreachable throws when isolation is violated', async () => {
-    const probe = new VantageProbe(fakeTransport({ tcpConnect: async () => ({ connected: true }) }));
-    await expect(probe.assertUnreachable({ from: 'appSystem', host: '10.0.30.5', port: 443 })).rejects.toThrow(
-      /zone isolation/,
+    const probe = new VantageProbe(
+      fakeTransport({ tcpConnect: async () => ({ connected: true }) }),
     );
+    await expect(
+      probe.assertUnreachable({ from: 'appSystem', host: '10.226.30.5', port: 443 }),
+    ).rejects.toThrow(/zone isolation/);
   });
   test('the reachable/unreachable happy paths do not throw', async () => {
-    const reachable = new VantageProbe(fakeTransport({ tcpConnect: async () => ({ connected: true }) }));
-    await reachable.assertReachable({ from: LAN, host: '192.168.0.253', port: 443 });
-    const blocked = new VantageProbe(fakeTransport({ tcpConnect: async () => ({ connected: false }) }));
-    await blocked.assertUnreachable({ from: 'appSystem', host: '10.0.30.5', port: 443 });
+    const reachable = new VantageProbe(
+      fakeTransport({ tcpConnect: async () => ({ connected: true }) }),
+    );
+    await reachable.assertReachable({ from: LAN, host: '10.226.1.253', port: 443 });
+    const blocked = new VantageProbe(
+      fakeTransport({ tcpConnect: async () => ({ connected: false }) }),
+    );
+    await blocked.assertUnreachable({ from: 'appSystem', host: '10.226.30.5', port: 443 });
   });
 });
 
 describe('assertHttps — cert provenance', () => {
   test('self-signed cert is rejected (catches --insecure / skip-cert cheats)', async () => {
     const probe = new VantageProbe(
-      fakeTransport({ httpsRequest: async () => ({ status: 200, body: 'ok', cert: realCert({ selfSigned: true }) }) }),
+      fakeTransport({
+        httpsRequest: async () => ({
+          status: 200,
+          body: 'ok',
+          cert: realCert({ selfSigned: true }),
+        }),
+      }),
+    );
+    await expect(probe.assertHttps({ from: LAN, url: 'https://www.example.com' })).rejects.toThrow(
+      /self-signed/,
     );
-    await expect(probe.assertHttps({ from: LAN, url: 'https://www.example.com' })).rejects.toThrow(/self-signed/);
   });
   test('wrong CA issuer is rejected', async () => {
     const probe = new VantageProbe(fakeTransport());
@@ -188,13 +242,13 @@ describe('inspectResolution', () => {
     const probe = new VantageProbe(
       fakeTransport({
         inspectResolution: async () => ({
-          resolvConf: 'nameserver 192.168.0.253',
-          hostsLines: ['10.0.10.10 auth.example.com'],
+          resolvConf: 'nameserver 10.226.1.253',
+          hostsLines: ['10.226.10.10 auth.example.com'],
         }),
       }),
     );
     const r = await probe.inspectResolution({ from: 'dmzSystem', name: 'auth.example.com' });
-    expect(r.hostsLines).toContain('10.0.10.10 auth.example.com');
-    expect(r.resolvConf).toContain('192.168.0.253');
+    expect(r.hostsLines).toContain('10.226.10.10 auth.example.com');
+    expect(r.resolvConf).toContain('10.226.1.253');
   });
 });

package/src/vantage.ts

@@ -14,7 +14,7 @@
  * elsewhere, so the verbs stay pure and unit-testable without Docker.
  */
 
-import { type Vantage, type Zone } from './types';
+import type { Vantage, Zone } from './types';
 import { classifyIp } from './zone-classifier';
 
 // `Vantage` is topology vocabulary — defined in ./types alongside Zone — and re-exported
@@ -64,11 +64,23 @@ export interface ResolutionInspection {
  * are the ONLY place raw shell / network calls live; the verbs below never touch I/O.
  */
 export interface ProbeTransport {
-  resolve(opts: { from: Vantage; name: string; method: ResolveMethod; server?: string }): Promise<{ ips: string[] }>;
-  tcpConnect(opts: { from: Vantage; host: string; port: number }): Promise<{ connected: boolean; detail?: string }>;
+  resolve(opts: { from: Vantage; name: string; method: ResolveMethod; server?: string }): Promise<{
+    ips: string[];
+  }>;
+  tcpConnect(opts: { from: Vantage; host: string; port: number }): Promise<{
+    connected: boolean;
+    detail?: string;
+  }>;
   ping(opts: { from: Vantage; target: string }): Promise<{ alive: boolean }>;
-  httpsRequest(opts: { from: Vantage; url: string }): Promise<{ status: number; body: string; cert: CertInfo }>;
-  inspectResolution(opts: { from: Vantage; name: string }): Promise<{ resolvConf: string; hostsLines: string[] }>;
+  httpsRequest(opts: { from: Vantage; url: string }): Promise<{
+    status: number;
+    body: string;
+    cert: CertInfo;
+  }>;
+  inspectResolution(opts: { from: Vantage; name: string }): Promise<{
+    resolvConf: string;
+    hostsLines: string[];
+  }>;
 }
 
 /** Thrown when a vantage assertion fails. Messages name the bug class they guard. */
@@ -163,10 +175,7 @@ export class VantageProbe {
     if (offenders.length > 0) {
       const detail = offenders.map((ip) => `${ip} (${describeZone(ip)})`).join(', ');
       throw new VantageAssertionError(
-        `${opts.name} from ${opts.from} resolved to ${detail}, expected zone "${opts.zone}". ` +
-          'A managed-zone container IP is unroutable from outside that zone — this is the ' +
-          'e2e-green/prod-broke class (ISS-0101, ISS-0111). The right answer from a consumer ' +
-          'vantage is the firewall natIp (internal) or a public address.',
+        `${opts.name} from ${opts.from} resolved to ${detail}, expected zone "${opts.zone}". A managed-zone container IP is unroutable from outside that zone — this is the e2e-green/prod-broke class (ISS-0101, ISS-0111). The right answer from a consumer vantage is the firewall natIp (internal) or a public address.`,
       );
     }
     return result;
@@ -178,7 +187,9 @@ export class VantageProbe {
    * the internal split-horizon resolver vs the public resolver). Used by the DNS suites to
    * check a DDNS-registered IP, an nsupdate'd A record, or a split-horizon answer.
    */
-  async assertResolvesTo(opts: ResolveOpts & { expected: string | string[] }): Promise<ResolveResult> {
+  async assertResolvesTo(
+    opts: ResolveOpts & { expected: string | string[] },
+  ): Promise<ResolveResult> {
     const result = await this.assertResolves(opts);
     const expected = Array.isArray(opts.expected) ? opts.expected : [opts.expected];
     const missing = expected.filter((ip) => !result.ips.includes(ip));
@@ -201,9 +212,7 @@ export class VantageProbe {
     const { connected, detail } = await this.transport.tcpConnect(opts);
     if (!connected) {
       throw new VantageAssertionError(
-        `${opts.host}:${opts.port} was NOT reachable from ${opts.from}` +
-          (detail ? ` (${detail})` : '') +
-          ', expected a successful TCP connection.',
+        `${opts.host}:${opts.port} was NOT reachable from ${opts.from}${detail ? ` (${detail})` : ''}, expected a successful TCP connection.`,
       );
     }
   }
@@ -213,8 +222,7 @@ export class VantageProbe {
     const { connected } = await this.transport.tcpConnect(opts);
     if (connected) {
       throw new VantageAssertionError(
-        `${opts.host}:${opts.port} WAS reachable from ${opts.from}, expected it to be blocked ` +
-          '(zone isolation / firewall boundary violated).',
+        `${opts.host}:${opts.port} WAS reachable from ${opts.from}, expected it to be blocked (zone isolation / firewall boundary violated).`,
       );
     }
   }
@@ -229,8 +237,7 @@ export class VantageProbe {
 
     if (res.cert.selfSigned) {
       throw new VantageAssertionError(
-        `${opts.url} from ${opts.from} presented a self-signed cert (issuer "${res.cert.issuer}"). ` +
-          'A real cert from the e2e CA (Pebble / Let’s Encrypt) is required — no --insecure.',
+        `${opts.url} from ${opts.from} presented a self-signed cert (issuer "${res.cert.issuer}"). A real cert from the e2e CA (Pebble / Let’s Encrypt) is required — no --insecure.`,
       );
     }
     if (opts.expectCN && res.cert.cn !== opts.expectCN) {

package/src/wait-for-run.ts

@@ -10,7 +10,7 @@
  * decides whether to spawn cele2e themselves or just observe.
  */
 
-import { defineEvents, openBus, type Bus, type BusEvent } from '@celilo/event-bus';
+import { type Bus, type BusEvent, defineEvents, openBus } from '@celilo/event-bus';
 
 export type WaitResult =
   | {

package/src/zone-classifier.test.ts

@@ -1,13 +1,22 @@
 import { describe, expect, test } from 'bun:test';
-import { classifyIp, inCidr, isPublicLeakSafe, isSegmentedZoneIp, parseIpv4 } from './zone-classifier';
+import {
+  classifyIp,
+  inCidr,
+  isPublicLeakSafe,
+  isSegmentedZoneIp,
+  parseIpv4,
+} from './zone-classifier';
 
 describe('parseIpv4', () => {
   test('parses dotted-quad to unsigned 32-bit', () => {
     expect(parseIpv4('0.0.0.0')).toBe(0);
     expect(parseIpv4('255.255.255.255')).toBe(0xffffffff);
-    // High first octet must not go negative (sign-bit overflow guard).
-    expect(parseIpv4('192.168.0.253')).toBe(((192 << 24) | (168 << 16) | (0 << 8) | 253) >>> 0);
-    expect(parseIpv4('192.168.0.253')).toBeGreaterThan(0);
+    // High first octet must not go negative (sign-bit overflow guard). A pure
+    // arithmetic fixture, deliberately NOT an address from the sim plan: it used
+    // to be the sim's internal natIp, so the guard would have quietly
+    // evaporated the moment that zone was renumbered into 10/8 (#539).
+    expect(parseIpv4('200.100.50.253')).toBe(((200 << 24) | (100 << 16) | (50 << 8) | 253) >>> 0);
+    expect(parseIpv4('200.100.50.253')).toBeGreaterThan(0);
   });
   test('rejects malformed / out-of-range', () => {
     expect(parseIpv4('not.an.ip')).toBeNull();
@@ -18,24 +27,26 @@ describe('parseIpv4', () => {
 
 describe('inCidr', () => {
   test('membership within /24', () => {
-    expect(inCidr('10.0.10.5', '10.0.10.0/24')).toBe(true);
-    expect(inCidr('10.0.10.255', '10.0.10.0/24')).toBe(true);
-    expect(inCidr('10.0.11.1', '10.0.10.0/24')).toBe(false);
+    expect(inCidr('10.226.10.5', '10.226.10.0/24')).toBe(true);
+    expect(inCidr('10.226.10.255', '10.226.10.0/24')).toBe(true);
+    expect(inCidr('10.226.11.1', '10.226.10.0/24')).toBe(false);
   });
-  test('high-octet subnet (192.168) — no sign-bit bug', () => {
-    expect(inCidr('192.168.0.253', '192.168.0.0/24')).toBe(true);
-    expect(inCidr('192.168.1.1', '192.168.0.0/24')).toBe(false);
+  test('high-octet subnet — no sign-bit bug', () => {
+    // Arithmetic fixture, not a sim address: a first octet >= 128 is what trips
+    // the sign bit, and no address in the sim plan has one any more.
+    expect(inCidr('200.100.50.253', '200.100.50.0/24')).toBe(true);
+    expect(inCidr('200.100.51.1', '200.100.50.0/24')).toBe(false);
   });
 });
 
 describe('classifyIp', () => {
   test('managed zones (the segmented ones)', () => {
-    expect(classifyIp('10.0.10.10')).toEqual({ kind: 'zone', zone: 'dmz' }); // caddy
-    expect(classifyIp('10.0.20.30')).toEqual({ kind: 'zone', zone: 'app' }); // authentik
-    expect(classifyIp('10.0.30.5')).toEqual({ kind: 'zone', zone: 'secure' });
+    expect(classifyIp('10.226.10.10')).toEqual({ kind: 'zone', zone: 'dmz' }); // caddy
+    expect(classifyIp('10.226.20.30')).toEqual({ kind: 'zone', zone: 'app' }); // authentik
+    expect(classifyIp('10.226.30.5')).toEqual({ kind: 'zone', zone: 'secure' });
   });
   test('internal zone (the LAN — natIp lives here)', () => {
-    expect(classifyIp('192.168.0.253')).toEqual({ kind: 'zone', zone: 'internal' });
+    expect(classifyIp('10.226.1.253')).toEqual({ kind: 'zone', zone: 'internal' });
   });
   test('public: the CGNAT stand-in and real public space', () => {
     expect(classifyIp('100.100.0.100')).toEqual({ kind: 'public' }); // sim firewall external
@@ -56,9 +67,9 @@ describe('classifyIp', () => {
 
 describe('isSegmentedZoneIp', () => {
   test('dmz/app/secure are segmented; internal and public are not', () => {
-    expect(isSegmentedZoneIp('10.0.10.10')).toBe(true); // caddy DMZ — the ISS-0101/0111 bug value
-    expect(isSegmentedZoneIp('10.0.20.30')).toBe(true);
-    expect(isSegmentedZoneIp('192.168.0.253')).toBe(false); // internal IS the LAN
+    expect(isSegmentedZoneIp('10.226.10.10')).toBe(true); // caddy DMZ — the ISS-0101/0111 bug value
+    expect(isSegmentedZoneIp('10.226.20.30')).toBe(true);
+    expect(isSegmentedZoneIp('10.226.1.253')).toBe(false); // internal IS the LAN
     expect(isSegmentedZoneIp('100.100.0.100')).toBe(false); // public
   });
 });
@@ -67,16 +78,16 @@ describe('isPublicLeakSafe (CLAUDE.md inviolable rule #1)', () => {
   test('only public addresses are leak-safe', () => {
     expect(isPublicLeakSafe('100.100.0.100')).toBe(true);
     expect(isPublicLeakSafe('8.8.8.8')).toBe(true);
-    expect(isPublicLeakSafe('10.0.10.10')).toBe(false); // managed segmented zone
-    expect(isPublicLeakSafe('192.168.0.253')).toBe(false); // internal/RFC-1918 must not leak
+    expect(isPublicLeakSafe('10.226.10.10')).toBe(false); // managed segmented zone
+    expect(isPublicLeakSafe('10.226.1.253')).toBe(false); // internal/RFC-1918 must not leak
     expect(isPublicLeakSafe('0.0.0.0')).toBe(false); // reserved sentinel
   });
 
   test('the ISS-0101 scenario: a fronted name resolving to caddy DMZ IP is NOT leak-safe', () => {
     // www.<domain> from a LAN device must be the natIp (internal) or public, never
     // caddy's DMZ container IP. The doctor + e2e share this judgment.
-    const wwwResolvedWrong = '10.0.10.10';
+    const wwwResolvedWrong = '10.226.10.10';
     expect(isSegmentedZoneIp(wwwResolvedWrong)).toBe(true);
-    expect(classifyIp('192.168.0.253').kind).toBe('zone'); // the RIGHT answer (natIp, internal)
+    expect(classifyIp('10.226.1.253').kind).toBe('zone'); // the RIGHT answer (natIp, internal)
   });
 });

package/src/zone-classifier.ts

@@ -10,12 +10,13 @@
  *
  * Classification uses `ZONE_SUBNETS` (exact) + a reserved-range check — deliberately
  * NOT a blanket RFC-1918/CGNAT ban: the sim's "public" IP is a CGNAT stand-in
- * (100.100.0.100), so in this topology 10.x / 192.168.x are *zones* and 100.x is
- * *public*. (A real deployment would additionally treat RFC-1918 + RFC-6598 as
- * non-public; that's the caller's policy, layered on top of this primitive.)
+ * (100.100.0.100), so in this topology the RFC-1918 zones under
+ * `SIM_PRIVATE_SUPERNET` are *zones* and 100.x is *public*. (A real deployment
+ * would additionally treat RFC-1918 + RFC-6598 as non-public; that's the
+ * caller's policy, layered on top of this primitive.)
  */
 
-import { type Zone, ZONE_SUBNETS } from './types';
+import { ZONE_SUBNETS, type Zone } from './types';
 
 export type ZoneClass =
   | { kind: 'zone'; zone: Zone }
@@ -52,7 +53,7 @@ export function parseIpv4(ip: string): number | null {
   return ((octets[0] << 24) | (octets[1] << 16) | (octets[2] << 8) | octets[3]) >>> 0;
 }
 
-/** True if `ip` falls within `cidr` (e.g. "10.0.10.0/24"). */
+/** True if `ip` falls within `cidr` (e.g. "10.226.10.0/24"). */
 export function inCidr(ip: string, cidr: string): boolean {
   const [base, bitsStr] = cidr.split('/');
   const bits = Number(bitsStr);
@@ -61,7 +62,7 @@ export function inCidr(ip: string, cidr: string): boolean {
   if (ipN === null || baseN === null || Number.isNaN(bits) || bits < 0 || bits > 32) return false;
   if (bits === 0) return true;
   const mask = (0xffffffff << (32 - bits)) >>> 0;
-  return (ipN & mask) >>> 0 === ((baseN & mask) >>> 0);
+  return (ipN & mask) >>> 0 === (baseN & mask) >>> 0;
 }
 
 /** Classify a resolved IPv4 against the e2e topology. */