Guard Cidr
CIDR identifier-safety primitive (KIND="identifier"). Validates user-supplied CIDR notation strings (IPv4 + IPv6) destined for network allowlists, ACLs, security-group rules, and tenant- boundary configuration. Consumes ctx.identifier (or ctx.cidr).
Shape and prefix-bound enforcement: every CIDR splits into address/mask. IPv4 must be strict dotted-decimal (no leading zeros — octal-form 0177.0.0.1 is refused at the parser; that class is owned by b.guardDomain). IPv4 mask is [0-32]; IPv6 mask is [0-128]; out-of-range and non-numeric masks refuse. IPv6 supports :: zero-group compression with the standard "at most one ::" rule.
Reserved-block awareness: IPv4 ranges per RFC 1918 (private 10/8, 172.16/12, 192.168/16), loopback 127/8, link-local 169.254/16, multicast 224/4, reserved class-E 240/4, documentation 192.0.2/24, 198.51.100/24, 203.0.113/24, benchmarking 198.18/15, and CGNAT 100.64/10. IPv6 ranges: loopback ::1, unspecified ::/128, ULA fc00::/7, link-local fe80::/10, multicast ff00::/8, IPv4-mapped ::ffff:0:0/96, documentation 2001:db8::/32, teredo 2001::/32, deprecated 6to4 2002::/16. IPv4-mapped IPv6 trips dual-stack allowlist confusion (CVE-2021-22931 class) and refuses under strict.
Network-address alignment: 10.0.0.1/24 has host bits set under a /24 mask when the canonical network is 10.0.0.0/24. Common typo class — refused under strict, audited under balanced. BIDI / control / null-byte / zero-width are universal-refuse at every profile (codepoint-class catalog).
Profiles: strict / balanced / permissive. Compliance postures: hipaa / pci-dss / gdpr / soc2.
b.guardCidr.validate(input, opts?) #
{
profile: "strict"|"balanced"|"permissive",
compliancePosture: "hipaa"|"pci-dss"|"gdpr"|"soc2",
family: "either"|"ipv4-only"|"ipv6-only",
networkAlignmentPolicy: "reject"|"audit"|"allow",
reservedRangesPolicy: "reject"|"audit"|"allow",
ipv4MappedIpv6Policy: "reject"|"audit"|"allow",
requireMaskPolicy: "reject-bare-ip"|"audit-bare-ip"|"allow-bare-ip",
maxBytes: number, // CIDR string byte cap (default 64)
}Inspect a CIDR notation string and return { ok, issues }. Each issue carries { kind, severity, ruleId, snippet } with severity in "warn"|"high"|"critical". Detected: malformed address shape, octet-out-of-range, mask-out-of-range, network-address misalignment, reserved-range membership, IPv4-mapped-IPv6 confusion, family mismatch, bare IP without /mask, BIDI / control / null-byte / zero-width codepoints. Pure inspection — never mutates input or throws.
var rv = b.guardCidr.validate("10.0.0.0/8", { profile: "strict" });
rv.ok; // → false
rv.issues.some(function (i) { return i.kind === "reserved-range"; }); // → true
var clean = b.guardCidr.validate("8.8.8.0/24", { profile: "strict" });
clean.ok; // → trueb.guardCidr.sanitize(input, opts?) #
{
profile: "strict"|"balanced"|"permissive",
compliancePosture: "hipaa"|"pci-dss"|"gdpr"|"soc2",
}Normalize a CIDR string when no critical/high issues fire. Throws GuardCidrError on any high/critical refusal (reserved-range, misalignment under strict, BIDI / null-byte / control bytes). Safe transforms applied otherwise: lowercase IPv6 hex groups, preserve mask form. IPv4 is returned unchanged (no canonical casing).
var safe = b.guardCidr.sanitize("2001:DB8::/32", { profile: "permissive" });
safe; // → "2001:db8::/32"
var v4 = b.guardCidr.sanitize("8.8.8.0/24", { profile: "strict" });
v4; // → "8.8.8.0/24"b.guardCidr.compliancePosture(name) #
Look up a compliance-posture overlay by name (one of "hipaa" / "pci-dss" / "gdpr" / "soc2"). Returns a fresh clone of the posture overlay so the caller may mutate it freely without disturbing the shared table. Throws GuardCidrError with code "cidr.bad-posture" when the name is not one this guard maps. Wired by gateContract.defineGuard through gateContract.lookupCompliancePosture, so the clone semantics and error code are identical across every guard in the family.
var posture = b.guardCidr.compliancePosture("hipaa");
posture; // → overlay clone (mutable)
try {
b.guardCidr.compliancePosture("not-a-regime");
} catch (e) {
e.code; // → "cidr.bad-posture"
}b.guardCidr.buildProfile(opts) #
{
extends: string|string[], // base profile name(s) to compose
...: any guard key, // inline override of resolved keys
}Compose a derived profile from one or more named bases plus inline overrides, resolving names through this guard's own PROFILES table. opts.extends is a base profile name ("strict" / "balanced" / "permissive") or an array of names — later entries shadow earlier ones, and inline opts keys win last. Wired by gateContract.defineGuard through gateContract.makeProfileBuilder, so operator-defined profiles stay traceable to a baseline instead of a hand-typed dictionary.
var custom = b.guardCidr.buildProfile({ extends: "strict" });
custom; // → composed profile objectb.guardCidr.loadRulePack(pack) #
Register an operator-supplied rule pack with this guard's rule-pack registry. The pack is identified by pack.id (a non-empty string) and stored for later dispatch by gates that opt in via opts.rulePackId. Returns the pack unchanged on success; throws GuardCidrError with code "cidr.bad-opt" when pack is missing or pack.id is not a non-empty string. Wired by gateContract.defineGuard through gateContract.makeRulePackLoader, so storage shape and validation are identical across the family.
var pack = b.guardCidr.loadRulePack({ id: "tenant-policy", rules: [] });
pack.id; // → "tenant-policy"b.guardCidr.gate(opts?) #
{
profile: string, // one of PROFILES; default this guard's default
compliancePosture: string, // overlay one of hipaa/pci-dss/gdpr/soc2
mode: string, // one of gateContract MODES; default "enforce"
}Build the guard's request-boundary gate — a contract-shaped object exposing check(ctx) that host primitives call at their byte moment. This is the factory default chain: serve when no issue, audit-only for info / warn issues, and refuse for any high / critical issue, dispatched to the right ctx field by the guard's KIND. Wired by gateContract.defineGuard through gateContract.buildGuardGate; a guard whose gate diverges (a bespoke sanitize-and-reserialize chain, for example) ships its own gate block instead of this template.
var gate = b.guardCidr.gate({ profile: "strict" });
var decision = await gate.check({ bytes: Buffer.from("...") });
decision.action; // → "serve" | "refuse" | …b.guardCidr.resolveOpts(opts?) #
{
profile: string, // one of PROFILES; default this guard's default
compliancePosture: string, // overlay one of hipaa/pci-dss/gdpr/soc2
}Resolve caller opts against this guard's PROFILES + compliance-posture overlays into the fully-defaulted option set the guard runs on — the same resolution validate / sanitize / gate apply internally. Wired by gateContract.defineGuard from the guard's binding config (profiles / postures / defaults / error class), so a guard's bespoke gate calls resolveOpts instead of re-declaring the per-guard resolver wrapper. Throws GuardCidrError with code "cidr.bad-opt" / "cidr.bad-posture" on an unknown profile or posture name.
var resolved = b.guardCidr.resolveOpts({ profile: "strict" });
resolved.profile; // → "strict"Last updated 2026-08-08T16:39:49.652Z by seeder.