@celilo/e2e 0.11.0 → 0.11.1

package/src/shared-infra.ts

@@ -11,9 +11,13 @@
  */
 
 import { execSync } from 'node:child_process';
-import { join } from 'node:path';
 import { copyFileSync, existsSync, rmSync, statSync, writeFileSync } from 'node:fs';
-import { generateSharedInfraYaml, SHARED_PROJECT_NAME, SHARED_NETWORKS } from './docker-compose-generator';
+import { join } from 'node:path';
+import {
+  SHARED_NETWORKS,
+  SHARED_PROJECT_NAME,
+  generateSharedInfraYaml,
+} from './docker-compose-generator';
 import { ensureRegistryServerBundle } from './registry-bundle';
 
 const SHARED_COMPOSE_FILE = 'docker-compose.shared.yml';
@@ -37,8 +41,10 @@ function run(cmd: string, opts?: { cwd?: string; timeout?: number }): string {
  */
 function nukeE2eResources(e2eDir: string): void {
   try {
-    run(`docker compose -f ${SHARED_COMPOSE_FILE} -p ${SHARED_PROJECT_NAME} down --volumes --remove-orphans`,
-      { cwd: e2eDir, timeout: 30_000 });
+    run(
+      `docker compose -f ${SHARED_COMPOSE_FILE} -p ${SHARED_PROJECT_NAME} down --volumes --remove-orphans`,
+      { cwd: e2eDir, timeout: 30_000 },
+    );
   } catch {}
   try {
     const ids = run('docker ps -aq --filter name=celilo-e2e', { timeout: 10_000 });
@@ -49,11 +55,17 @@ function nukeE2eResources(e2eDir: string): void {
       .split('\n')
       .filter((n) => n.startsWith('celilo-e2e'));
     for (const net of nets) {
-      try { run(`docker network rm ${net}`, { timeout: 5_000 }); } catch {}
+      try {
+        run(`docker network rm ${net}`, { timeout: 5_000 });
+      } catch {}
     }
   } catch {}
-  try { run('docker network prune -f', { timeout: 10_000 }); } catch {}
-  try { run('docker volume prune -f', { timeout: 10_000 }); } catch {}
+  try {
+    run('docker network prune -f', { timeout: 10_000 });
+  } catch {}
+  try {
+    run('docker volume prune -f', { timeout: 10_000 });
+  } catch {}
 }
 
 /**
@@ -117,7 +129,9 @@ export async function ensureSharedInfra(): Promise<void> {
       }
     } catch {
       // DNS check failed — restart shared infra
-      console.log('[progress:start] shared infra DNS check failed, restarting | shared infra restarted');
+      console.log(
+        '[progress:start] shared infra DNS check failed, restarting | shared infra restarted',
+      );
       await stopSharedInfra();
     }
   }
@@ -130,7 +144,9 @@ export async function ensureSharedInfra(): Promise<void> {
   // This self-heals orphans left by a crashed / cross-path / cross-checkout
   // prior run (e.g. a botched-mount container that wedges the next `up`),
   // which the old compose-project-scoped `down` couldn't see (#212).
-  console.log('[progress:start] cleaning up stale shared infrastructure | shared infra cleanup complete');
+  console.log(
+    '[progress:start] cleaning up stale shared infrastructure | shared infra cleanup complete',
+  );
   nukeE2eResources(e2eDir);
 
   // Refresh the bundled registry-server source so Dockerfile.registry's
@@ -161,12 +177,16 @@ export async function ensureSharedInfra(): Promise<void> {
 
   // Build and start
   console.log('[progress:start] building shared infrastructure images | shared images built');
-  run(`docker compose -f ${SHARED_COMPOSE_FILE} -p ${SHARED_PROJECT_NAME} build`,
-    { cwd: e2eDir, timeout: 300_000 });
+  run(`docker compose -f ${SHARED_COMPOSE_FILE} -p ${SHARED_PROJECT_NAME} build`, {
+    cwd: e2eDir,
+    timeout: 300_000,
+  });
 
   console.log('[progress:start] starting shared infrastructure | shared infra started');
-  run(`docker compose -f ${SHARED_COMPOSE_FILE} -p ${SHARED_PROJECT_NAME} up -d`,
-    { cwd: e2eDir, timeout: 120_000 });
+  run(`docker compose -f ${SHARED_COMPOSE_FILE} -p ${SHARED_PROJECT_NAME} up -d`, {
+    cwd: e2eDir,
+    timeout: 120_000,
+  });
 
   // Wait for DNS convergence — robustly. The old single 60s window with no
   // recovery was an intermittent build-infra failure on the builder (#319:
@@ -196,23 +216,29 @@ export async function ensureSharedInfra(): Promise<void> {
     if (Date.now() - lastRestart > 45_000) {
       console.log('[progress:sub] DNS not converged yet — restarting namecheap-dns');
       try {
-        run(`docker compose -f ${SHARED_COMPOSE_FILE} -p ${SHARED_PROJECT_NAME} restart namecheap-dns`,
-          { cwd: e2eDir, timeout: 30_000 });
+        run(
+          `docker compose -f ${SHARED_COMPOSE_FILE} -p ${SHARED_PROJECT_NAME} restart namecheap-dns`,
+          { cwd: e2eDir, timeout: 30_000 },
+        );
       } catch {}
       lastRestart = Date.now();
     }
-    await new Promise(r => setTimeout(r, 2000));
+    await new Promise((r) => setTimeout(r, 2000));
   }
   // Diagnostics before failing, so the log shows WHY it didn't converge.
   let psOut = '';
   try {
-    psOut = run(`docker compose -f ${SHARED_COMPOSE_FILE} -p ${SHARED_PROJECT_NAME} ps`,
-      { cwd: e2eDir, timeout: 10_000 });
+    psOut = run(`docker compose -f ${SHARED_COMPOSE_FILE} -p ${SHARED_PROJECT_NAME} ps`, {
+      cwd: e2eDir,
+      timeout: 10_000,
+    });
   } catch {}
   let dnsLog = '';
   try {
-    dnsLog = run(`docker compose -f ${SHARED_COMPOSE_FILE} -p ${SHARED_PROJECT_NAME} logs --tail 40 namecheap-dns`,
-      { cwd: e2eDir, timeout: 10_000 });
+    dnsLog = run(
+      `docker compose -f ${SHARED_COMPOSE_FILE} -p ${SHARED_PROJECT_NAME} logs --tail 40 namecheap-dns`,
+      { cwd: e2eDir, timeout: 10_000 },
+    );
   } catch {}
   throw new Error(
     `Timeout waiting for shared infrastructure DNS convergence (${dnsTimeout / 1000}s)\n` +
@@ -227,8 +253,10 @@ export async function stopSharedInfra(): Promise<void> {
   console.log('[progress:start] stopping shared infrastructure | shared infra stopped');
   const e2eDir = getE2eDir();
   try {
-    run(`docker compose -f ${SHARED_COMPOSE_FILE} -p ${SHARED_PROJECT_NAME} down --volumes --remove-orphans`,
-      { cwd: e2eDir, timeout: 60_000 });
+    run(
+      `docker compose -f ${SHARED_COMPOSE_FILE} -p ${SHARED_PROJECT_NAME} down --volumes --remove-orphans`,
+      { cwd: e2eDir, timeout: 60_000 },
+    );
   } catch {
     // Best effort
   }

package/src/socks-proxy.ts

@@ -165,8 +165,7 @@ async function waitForTcpAccept(port: number, timeoutMs = 10_000): Promise<void>
     await new Promise((r) => setTimeout(r, 100));
   }
   throw new Error(
-    `SOCKS proxy on 127.0.0.1:${port} never accepted connections within ${timeoutMs}ms` +
-      (lastErr ? ` (last error: ${lastErr})` : ''),
+    `SOCKS proxy on 127.0.0.1:${port} never accepted connections within ${timeoutMs}ms${lastErr ? ` (last error: ${lastErr})` : ''}`,
   );
 }
 
@@ -233,8 +232,7 @@ function ensureProxyImage(): void {
   const dockerfilePath = join(PACKAGE_ROOT, PROXY_DOCKERFILE);
   if (!existsSync(dockerfilePath)) {
     throw new Error(
-      `SOCKS proxy Dockerfile not found at ${dockerfilePath}. ` +
-        `Expected it to ship with the @celilo/e2e package.`,
+      `SOCKS proxy Dockerfile not found at ${dockerfilePath}. Expected it to ship with the @celilo/e2e package.`,
     );
   }
 
@@ -247,18 +245,17 @@ function ensureProxyImage(): void {
     });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    throw new Error(
-      `Failed to build ${PROXY_IMAGE} from ${PROXY_DOCKERFILE}: ${msg}`,
-    );
+    throw new Error(`Failed to build ${PROXY_IMAGE} from ${PROXY_DOCKERFILE}: ${msg}`);
   }
 }
 
 function inspectContainer(name: string): boolean {
   try {
-    const result = execSync(
-      `docker inspect -f '{{.State.Running}}' ${name} 2>/dev/null`,
-      { timeout: 5_000, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] },
-    );
+    const result = execSync(`docker inspect -f '{{.State.Running}}' ${name} 2>/dev/null`, {
+      timeout: 5_000,
+      encoding: 'utf-8',
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
     return result.trim() === 'true';
   } catch {
     return false;
@@ -276,15 +273,15 @@ async function waitForContainerListening(name: string): Promise<void> {
   let lastInspect = '';
   while (Date.now() < deadline) {
     try {
-      lastInspect = execSync(
-        `docker inspect -f '{{.State.Status}} {{.State.ExitCode}}' ${name}`,
-        { timeout: 3_000, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] },
-      ).trim();
+      lastInspect = execSync(`docker inspect -f '{{.State.Status}} {{.State.ExitCode}}' ${name}`, {
+        timeout: 3_000,
+        encoding: 'utf-8',
+        stdio: ['pipe', 'pipe', 'pipe'],
+      }).trim();
     } catch {
       // Container may have already self-removed (--rm) after exiting
       throw new Error(
-        `SOCKS proxy container '${name}' disappeared during startup. ` +
-          `It likely exited immediately. Check the image's required env vars.`,
+        `SOCKS proxy container '${name}' disappeared during startup. It likely exited immediately. Check the image's required env vars.`,
       );
     }
     const [status] = lastInspect.split(/\s+/);

package/src/vantage-helpers.ts

@@ -52,7 +52,11 @@ export async function assertFrontedServicePositives(
   const url = `https://${expectation.fqdn}${expectation.path ?? ''}`;
 
   // The internet sees the service at a public IP and a valid HTTPS endpoint.
-  await probe.assertResolvesInZone({ from: 'publicInternet', name: expectation.fqdn, zone: 'public' });
+  await probe.assertResolvesInZone({
+    from: 'publicInternet',
+    name: expectation.fqdn,
+    zone: 'public',
+  });
   await probe.assertHttps({
     from: 'publicInternet',
     url,

package/src/vantage.test.ts

@@ -36,7 +36,9 @@ const LAN: Vantage = 'internalDevice';
 
 describe('resolveFrom', () => {
   test('defaults method to system, passes through ips', async () => {
-    const probe = new VantageProbe(fakeTransport({ resolve: async () => ({ ips: ['10.226.1.253'] }) }));
+    const probe = new VantageProbe(
+      fakeTransport({ resolve: async () => ({ ips: ['10.226.1.253'] }) }),
+    );
     const r = await probe.resolveFrom({ from: LAN, name: 'www.example.com' });
     expect(r.method).toBe('system');
     expect(r.ips).toEqual(['10.226.1.253']);
@@ -51,7 +53,9 @@ describe('assertResolves / assertNxdomain', () => {
     );
   });
   test('assertNxdomain throws when a public vantage CAN see an internal-only name', async () => {
-    const probe = new VantageProbe(fakeTransport({ resolve: async () => ({ ips: ['10.226.20.5'] }) }));
+    const probe = new VantageProbe(
+      fakeTransport({ resolve: async () => ({ ips: ['10.226.20.5'] }) }),
+    );
     await expect(
       probe.assertNxdomain({ from: 'publicInternet', name: 'authentik.internal' }),
     ).rejects.toThrow(/expected NXDOMAIN/);
@@ -60,25 +64,45 @@ describe('assertResolves / assertNxdomain', () => {
 
 describe('assertResolvesInZone — the killer verb', () => {
   test('ISS-0101: www at caddy DMZ container IP FAILS from internalDevice', async () => {
-    const probe = new VantageProbe(fakeTransport({ resolve: async () => ({ ips: ['10.226.10.10'] }) }));
+    const probe = new VantageProbe(
+      fakeTransport({ resolve: async () => ({ ips: ['10.226.10.10'] }) }),
+    );
     await expect(
       probe.assertResolvesInZone({ from: LAN, name: 'www.example.com', zone: 'internal' }),
     ).rejects.toThrow(/ISS-0101/);
   });
 
   test('www at the firewall natIp PASSES from internalDevice (the right answer)', async () => {
-    const probe = new VantageProbe(fakeTransport({ resolve: async () => ({ ips: ['10.226.1.253'] }) }));
-    const r = await probe.assertResolvesInZone({ from: LAN, name: 'www.example.com', zone: 'internal' });
+    const probe = new VantageProbe(
+      fakeTransport({ resolve: async () => ({ ips: ['10.226.1.253'] }) }),
+    );
+    const r = await probe.assertResolvesInZone({
+      from: LAN,
+      name: 'www.example.com',
+      zone: 'internal',
+    });
     expect(r.ips).toEqual(['10.226.1.253']);
   });
 
   test('public vantage expecting a public answer passes; a leaked zone IP fails', async () => {
-    const ok = new VantageProbe(fakeTransport({ resolve: async () => ({ ips: ['100.100.0.100'] }) }));
-    await ok.assertResolvesInZone({ from: 'publicInternet', name: 'www.example.com', zone: 'public' });
+    const ok = new VantageProbe(
+      fakeTransport({ resolve: async () => ({ ips: ['100.100.0.100'] }) }),
+    );
+    await ok.assertResolvesInZone({
+      from: 'publicInternet',
+      name: 'www.example.com',
+      zone: 'public',
+    });
 
-    const leaked = new VantageProbe(fakeTransport({ resolve: async () => ({ ips: ['10.226.1.253'] }) }));
+    const leaked = new VantageProbe(
+      fakeTransport({ resolve: async () => ({ ips: ['10.226.1.253'] }) }),
+    );
     await expect(
-      leaked.assertResolvesInZone({ from: 'publicInternet', name: 'www.example.com', zone: 'public' }),
+      leaked.assertResolvesInZone({
+        from: 'publicInternet',
+        name: 'www.example.com',
+        zone: 'public',
+      }),
     ).rejects.toThrow(VantageAssertionError);
   });
 
@@ -94,7 +118,9 @@ describe('assertResolvesInZone — the killer verb', () => {
 
 describe('assertResolvesTo — exact-IP DNS correctness', () => {
   test('passes when the resolver returns the expected IP (via a specific server)', async () => {
-    const probe = new VantageProbe(fakeTransport({ resolve: async () => ({ ips: ['10.226.1.53'] }) }));
+    const probe = new VantageProbe(
+      fakeTransport({ resolve: async () => ({ ips: ['10.226.1.53'] }) }),
+    );
     const r = await probe.assertResolvesTo({
       from: 'internalDevice',
       name: 'host.infra.example.com',
@@ -106,7 +132,9 @@ describe('assertResolvesTo — exact-IP DNS correctness', () => {
   });
 
   test('fails (naming the server) when the expected IP is absent', async () => {
-    const probe = new VantageProbe(fakeTransport({ resolve: async () => ({ ips: ['10.226.10.99'] }) }));
+    const probe = new VantageProbe(
+      fakeTransport({ resolve: async () => ({ ips: ['10.226.10.99'] }) }),
+    );
     await expect(
       probe.assertResolvesTo({
         from: 'internalDevice',
@@ -119,31 +147,49 @@ describe('assertResolvesTo — exact-IP DNS correctness', () => {
   });
 
   test('accepts an array of expected IPs (all must be present)', async () => {
-    const probe = new VantageProbe(fakeTransport({ resolve: async () => ({ ips: ['1.2.3.4', '5.6.7.8'] }) }));
-    await probe.assertResolvesTo({ from: 'publicInternet', name: 'x', expected: ['1.2.3.4', '5.6.7.8'] });
+    const probe = new VantageProbe(
+      fakeTransport({ resolve: async () => ({ ips: ['1.2.3.4', '5.6.7.8'] }) }),
+    );
+    await probe.assertResolvesTo({
+      from: 'publicInternet',
+      name: 'x',
+      expected: ['1.2.3.4', '5.6.7.8'],
+    });
     await expect(
-      probe.assertResolvesTo({ from: 'publicInternet', name: 'x', expected: ['1.2.3.4', '9.9.9.9'] }),
+      probe.assertResolvesTo({
+        from: 'publicInternet',
+        name: 'x',
+        expected: ['1.2.3.4', '9.9.9.9'],
+      }),
     ).rejects.toThrow(/9\.9\.9\.9/);
   });
 });
 
 describe('reachability + isolation (§D6)', () => {
   test('assertReachable throws when the connection fails (ISS-0111 git-ssh:2222)', async () => {
-    const probe = new VantageProbe(fakeTransport({ tcpConnect: async () => ({ connected: false, detail: 'timeout' }) }));
-    await expect(probe.assertReachable({ from: LAN, host: 'git-ssh.example.com', port: 2222 })).rejects.toThrow(
-      /timeout/,
+    const probe = new VantageProbe(
+      fakeTransport({ tcpConnect: async () => ({ connected: false, detail: 'timeout' }) }),
     );
+    await expect(
+      probe.assertReachable({ from: LAN, host: 'git-ssh.example.com', port: 2222 }),
+    ).rejects.toThrow(/timeout/);
   });
   test('assertUnreachable throws when isolation is violated', async () => {
-    const probe = new VantageProbe(fakeTransport({ tcpConnect: async () => ({ connected: true }) }));
-    await expect(probe.assertUnreachable({ from: 'appSystem', host: '10.226.30.5', port: 443 })).rejects.toThrow(
-      /zone isolation/,
+    const probe = new VantageProbe(
+      fakeTransport({ tcpConnect: async () => ({ connected: true }) }),
     );
+    await expect(
+      probe.assertUnreachable({ from: 'appSystem', host: '10.226.30.5', port: 443 }),
+    ).rejects.toThrow(/zone isolation/);
   });
   test('the reachable/unreachable happy paths do not throw', async () => {
-    const reachable = new VantageProbe(fakeTransport({ tcpConnect: async () => ({ connected: true }) }));
+    const reachable = new VantageProbe(
+      fakeTransport({ tcpConnect: async () => ({ connected: true }) }),
+    );
     await reachable.assertReachable({ from: LAN, host: '10.226.1.253', port: 443 });
-    const blocked = new VantageProbe(fakeTransport({ tcpConnect: async () => ({ connected: false }) }));
+    const blocked = new VantageProbe(
+      fakeTransport({ tcpConnect: async () => ({ connected: false }) }),
+    );
     await blocked.assertUnreachable({ from: 'appSystem', host: '10.226.30.5', port: 443 });
   });
 });
@@ -151,9 +197,17 @@ describe('reachability + isolation (§D6)', () => {
 describe('assertHttps — cert provenance', () => {
   test('self-signed cert is rejected (catches --insecure / skip-cert cheats)', async () => {
     const probe = new VantageProbe(
-      fakeTransport({ httpsRequest: async () => ({ status: 200, body: 'ok', cert: realCert({ selfSigned: true }) }) }),
+      fakeTransport({
+        httpsRequest: async () => ({
+          status: 200,
+          body: 'ok',
+          cert: realCert({ selfSigned: true }),
+        }),
+      }),
+    );
+    await expect(probe.assertHttps({ from: LAN, url: 'https://www.example.com' })).rejects.toThrow(
+      /self-signed/,
     );
-    await expect(probe.assertHttps({ from: LAN, url: 'https://www.example.com' })).rejects.toThrow(/self-signed/);
   });
   test('wrong CA issuer is rejected', async () => {
     const probe = new VantageProbe(fakeTransport());

package/src/vantage.ts

@@ -14,7 +14,7 @@
  * elsewhere, so the verbs stay pure and unit-testable without Docker.
  */
 
-import { type Vantage, type Zone } from './types';
+import type { Vantage, Zone } from './types';
 import { classifyIp } from './zone-classifier';
 
 // `Vantage` is topology vocabulary — defined in ./types alongside Zone — and re-exported
@@ -64,11 +64,23 @@ export interface ResolutionInspection {
  * are the ONLY place raw shell / network calls live; the verbs below never touch I/O.
  */
 export interface ProbeTransport {
-  resolve(opts: { from: Vantage; name: string; method: ResolveMethod; server?: string }): Promise<{ ips: string[] }>;
-  tcpConnect(opts: { from: Vantage; host: string; port: number }): Promise<{ connected: boolean; detail?: string }>;
+  resolve(opts: { from: Vantage; name: string; method: ResolveMethod; server?: string }): Promise<{
+    ips: string[];
+  }>;
+  tcpConnect(opts: { from: Vantage; host: string; port: number }): Promise<{
+    connected: boolean;
+    detail?: string;
+  }>;
   ping(opts: { from: Vantage; target: string }): Promise<{ alive: boolean }>;
-  httpsRequest(opts: { from: Vantage; url: string }): Promise<{ status: number; body: string; cert: CertInfo }>;
-  inspectResolution(opts: { from: Vantage; name: string }): Promise<{ resolvConf: string; hostsLines: string[] }>;
+  httpsRequest(opts: { from: Vantage; url: string }): Promise<{
+    status: number;
+    body: string;
+    cert: CertInfo;
+  }>;
+  inspectResolution(opts: { from: Vantage; name: string }): Promise<{
+    resolvConf: string;
+    hostsLines: string[];
+  }>;
 }
 
 /** Thrown when a vantage assertion fails. Messages name the bug class they guard. */
@@ -163,10 +175,7 @@ export class VantageProbe {
     if (offenders.length > 0) {
       const detail = offenders.map((ip) => `${ip} (${describeZone(ip)})`).join(', ');
       throw new VantageAssertionError(
-        `${opts.name} from ${opts.from} resolved to ${detail}, expected zone "${opts.zone}". ` +
-          'A managed-zone container IP is unroutable from outside that zone — this is the ' +
-          'e2e-green/prod-broke class (ISS-0101, ISS-0111). The right answer from a consumer ' +
-          'vantage is the firewall natIp (internal) or a public address.',
+        `${opts.name} from ${opts.from} resolved to ${detail}, expected zone "${opts.zone}". A managed-zone container IP is unroutable from outside that zone — this is the e2e-green/prod-broke class (ISS-0101, ISS-0111). The right answer from a consumer vantage is the firewall natIp (internal) or a public address.`,
       );
     }
     return result;
@@ -178,7 +187,9 @@ export class VantageProbe {
    * the internal split-horizon resolver vs the public resolver). Used by the DNS suites to
    * check a DDNS-registered IP, an nsupdate'd A record, or a split-horizon answer.
    */
-  async assertResolvesTo(opts: ResolveOpts & { expected: string | string[] }): Promise<ResolveResult> {
+  async assertResolvesTo(
+    opts: ResolveOpts & { expected: string | string[] },
+  ): Promise<ResolveResult> {
     const result = await this.assertResolves(opts);
     const expected = Array.isArray(opts.expected) ? opts.expected : [opts.expected];
     const missing = expected.filter((ip) => !result.ips.includes(ip));
@@ -201,9 +212,7 @@ export class VantageProbe {
     const { connected, detail } = await this.transport.tcpConnect(opts);
     if (!connected) {
       throw new VantageAssertionError(
-        `${opts.host}:${opts.port} was NOT reachable from ${opts.from}` +
-          (detail ? ` (${detail})` : '') +
-          ', expected a successful TCP connection.',
+        `${opts.host}:${opts.port} was NOT reachable from ${opts.from}${detail ? ` (${detail})` : ''}, expected a successful TCP connection.`,
       );
     }
   }
@@ -213,8 +222,7 @@ export class VantageProbe {
     const { connected } = await this.transport.tcpConnect(opts);
     if (connected) {
       throw new VantageAssertionError(
-        `${opts.host}:${opts.port} WAS reachable from ${opts.from}, expected it to be blocked ` +
-          '(zone isolation / firewall boundary violated).',
+        `${opts.host}:${opts.port} WAS reachable from ${opts.from}, expected it to be blocked (zone isolation / firewall boundary violated).`,
       );
     }
   }
@@ -229,8 +237,7 @@ export class VantageProbe {
 
     if (res.cert.selfSigned) {
       throw new VantageAssertionError(
-        `${opts.url} from ${opts.from} presented a self-signed cert (issuer "${res.cert.issuer}"). ` +
-          'A real cert from the e2e CA (Pebble / Let’s Encrypt) is required — no --insecure.',
+        `${opts.url} from ${opts.from} presented a self-signed cert (issuer "${res.cert.issuer}"). A real cert from the e2e CA (Pebble / Let’s Encrypt) is required — no --insecure.`,
       );
     }
     if (opts.expectCN && res.cert.cn !== opts.expectCN) {

package/src/wait-for-run.ts

@@ -10,7 +10,7 @@
  * decides whether to spawn cele2e themselves or just observe.
  */
 
-import { defineEvents, openBus, type Bus, type BusEvent } from '@celilo/event-bus';
+import { type Bus, type BusEvent, defineEvents, openBus } from '@celilo/event-bus';
 
 export type WaitResult =
   | {

package/src/zone-classifier.test.ts

@@ -1,5 +1,11 @@
 import { describe, expect, test } from 'bun:test';
-import { classifyIp, inCidr, isPublicLeakSafe, isSegmentedZoneIp, parseIpv4 } from './zone-classifier';
+import {
+  classifyIp,
+  inCidr,
+  isPublicLeakSafe,
+  isSegmentedZoneIp,
+  parseIpv4,
+} from './zone-classifier';
 
 describe('parseIpv4', () => {
   test('parses dotted-quad to unsigned 32-bit', () => {

package/src/zone-classifier.ts

@@ -16,7 +16,7 @@
  * caller's policy, layered on top of this primitive.)
  */
 
-import { type Zone, ZONE_SUBNETS } from './types';
+import { ZONE_SUBNETS, type Zone } from './types';
 
 export type ZoneClass =
   | { kind: 'zone'; zone: Zone }
@@ -62,7 +62,7 @@ export function inCidr(ip: string, cidr: string): boolean {
   if (ipN === null || baseN === null || Number.isNaN(bits) || bits < 0 || bits > 32) return false;
   if (bits === 0) return true;
   const mask = (0xffffffff << (32 - bits)) >>> 0;
-  return (ipN & mask) >>> 0 === ((baseN & mask) >>> 0);
+  return (ipN & mask) >>> 0 === (baseN & mask) >>> 0;
 }
 
 /** Classify a resolved IPv4 against the e2e topology. */