@mark1russell7/netdiag 0.1.0 → 0.1.1

package/build/index.js

@@ -1,165 +1,19 @@
-import { _ as layerRank, a as FLOOR, c as STRENGTHS, d as diagnose, f as expand, g as isLayer, h as LAYERS, i as STANDARD_FEATURES, l as UNKNOWN, m as predictive, n as STANDARD_CATALOG_SPEC, o as NONE, p as explain, r as STANDARD_FAULTS, s as PARTS, t as STANDARD_CATALOG, u as compileCatalog } from "./diagnosis-BTa-Dfwl.js";
-import { BlockList, isIP } from "node:net";
+import { _ as explain, a as STANDARD_CATALOG, b as isLayer, c as STANDARD_FEATURES, d as PARTS, f as STRENGTHS, g as expand, h as diagnose, i as scoreLab, l as FLOOR, m as compileCatalog, n as labGate, o as STANDARD_CATALOG_SPEC, p as UNKNOWN, r as labRecordOf, s as STANDARD_FAULTS, t as LAB_RECORD_FORMAT, u as NONE, v as predictive, x as layerRank, y as LAYERS } from "./diagnosis-a4hRzFxp.js";
+import { C as observe, D as parseTarget, E as hostKind, O as sameTarget, S as isFactOf, T as formatTarget, _ as TRACE_OUTCOMES, a as ECHO_OUTCOMES, b as defineFactKind, c as HTTP_RESPONSE, d as PATH_REPORT, f as PATH_TRACE, g as TOOL_KINDS, h as TLS_HANDSHAKE, i as DNS_OUTCOMES, k as target, l as ICMP_ECHO, m as TCP_CONNECT, n as CONNECT_OUTCOMES, o as HANDSHAKE_OUTCOMES, p as RECORD_TYPES, r as DNS_ANSWER, s as HTTP_OUTCOMES, t as CERT_PROBLEMS, u as NATIVE_KINDS, v as TRUSTS, w as canonicalHost, x as factsOf, y as defineProbe } from "./kinds-CQv769lK.js";
+import { ADDRESS_CLASSES, addressClass, addressFamily, addressKind, canonicalAddress, cidrContains, cidrSet, formatCidr, parseCidr } from "./address.js";
+import { connect, isIP } from "node:net";
 import { err, ok } from "@mark1russell7/optional";
-// src/target.ts
-/** The ports of the URL schemes that a target can have. */
-const SCHEME_PORTS = /* @__PURE__ */ new Map([
-	["http:", 80],
-	["https:", 443],
-	["ws:", 80],
-	["wss:", 443],
-	["dns:", 53],
-	["tls:", 443]
-]);
-/** This function gives the kind of a host in its canonical form. */
-function hostKind(host) {
-	const family = isIP(host);
-	if (family === 4) return "ipv4";
-	if (family === 6) return "ipv6";
-	return "name";
-}
-/** This function gives the canonical form of a host: lower case, with no final dot and no brackets. */
-function canonicalHost(host) {
-	let text = host.trim().toLowerCase();
-	if (text.startsWith("[") && text.endsWith("]")) text = text.slice(1, -1);
-	if (text.endsWith(".")) text = text.slice(0, -1);
-	return text;
-}
-/** This function makes a target from a host and an optional port. */
-function target(host, port) {
-	const canonical = canonicalHost(host);
-	return port === void 0 ? {
-		host: canonical,
-		kind: hostKind(canonical)
-	} : {
-		host: canonical,
-		kind: hostKind(canonical),
-		port
-	};
-}
-/** This function gives the text of a target: `host`, `host:port`, or `[address]:port` for an IPv6 address. */
-function formatTarget(t) {
-	const host = t.kind === "ipv6" && t.port !== void 0 ? `[${t.host}]` : t.host;
-	return t.port === void 0 ? host : `${host}:${t.port}`;
-}
-/** This function tells if two targets have the same host and the same port. */
-function sameTarget(a, b) {
-	return a.host === b.host && a.port === b.port;
-}
-const LABEL = /^(?!-)[a-z0-9-]{1,63}(?<!-)$/;
-function validName(host) {
-	if (host.length === 0 || host.length > 253) return false;
-	return host.split(".").every((label) => LABEL.test(label) || label === "_" || /^_[a-z0-9-]{1,62}$/.test(label));
-}
-function portOf(text) {
-	if (!/^\d{1,5}$/.test(text)) return void 0;
-	const port = Number(text);
-	return port >= 1 && port <= 65535 ? port : void 0;
-}
-/**
-* This function reads a target from the text that a user gives.
-*
-* It accepts a URL (`https://example.com/a`), a host (`example.com`) and a host with a port (`example.com:8443`).
-* It also accepts an IPv4 address, and an IPv6 address in brackets with a port (`[2001:db8::1]:443`).
-* A URL with a known scheme and no port gets the port of its scheme.
-*/
-function parseTarget(text) {
-	const input = text.trim();
-	if (input.length === 0) return err("The target is empty.");
-	if (input.includes("://")) {
-		let url;
-		try {
-			url = new URL(input);
-		} catch {
-			return err(`"${input}" is not a valid URL.`);
-		}
-		const host = canonicalHost(url.hostname);
-		if (host.length === 0) return err(`The URL "${input}" has no host.`);
-		return checked(host, url.port === "" ? SCHEME_PORTS.get(url.protocol) : Number(url.port), input);
-	}
-	if (isIP(input) === 6) return checked(canonicalHost(input), void 0, input);
-	const bracket = /^\[([^\]]+)\](?::(.*))?$/.exec(input);
-	if (bracket !== null) {
-		const host = bracket[1] ?? "";
-		if (isIP(host) !== 6) return err(`"${host}" is not an IPv6 address.`);
-		if (bracket[2] === void 0) return checked(canonicalHost(host), void 0, input);
-		const port = portOf(bracket[2]);
-		return port === void 0 ? err(`"${bracket[2]}" is not a port from 1 to 65535.`) : checked(canonicalHost(host), port, input);
-	}
-	const colon = input.lastIndexOf(":");
-	if (colon === -1) return checked(canonicalHost(input), void 0, input);
-	const port = portOf(input.slice(colon + 1));
-	if (port === void 0) return err(`"${input.slice(colon + 1)}" is not a port from 1 to 65535.`);
-	return checked(canonicalHost(input.slice(0, colon)), port, input);
-}
-function checked(host, port, input) {
-	const kind = hostKind(host);
-	if (kind === "name" && !validName(host)) return err(`"${input}" has no valid host name.`);
-	return ok(port === void 0 ? {
-		host,
-		kind
-	} : {
-		host,
-		kind,
-		port
-	});
-}
-// src/fact.ts
-const KIND_NAME = /^[a-z][a-z0-9]*(?:[.-][a-z0-9]+)*$/;
-/** This function makes a fact kind. The name has lower-case words with dots, for example `tls.handshake`. */
-function defineFactKind(spec) {
-	if (!KIND_NAME.test(spec.kind)) throw new RangeError(`"${spec.kind}" is not a valid name of a fact kind`);
-	return Object.freeze({ ...spec });
-}
-/** This function tells if a fact is of a kind, and if its value passes the check of the kind. */
-function isFactOf(kind, fact) {
-	return fact.kind === kind.kind && fact.layer === kind.layer && kind.check(fact.value);
-}
-/** This function gives the facts of one kind, in their order. */
-function factsOf(kind, facts) {
-	return facts.filter((fact) => isFactOf(kind, fact));
-}
-/** This function makes an observation with a type check of its value against its kind. */
-function observe(kind, subject, value, time) {
-	return time === void 0 ? {
-		kind,
-		subject,
-		value
-	} : {
-		kind,
-		subject,
-		value,
-		time
-	};
-}
-// src/probe.ts
-/** This function makes a probe, and examines its fields. */
-function defineProbe(probe) {
-	if (!/^[a-z][a-z0-9]*(?:[.-][a-z0-9]+)*$/.test(probe.id)) throw new RangeError(`"${probe.id}" is not a valid probe id`);
-	if (probe.kinds.length === 0) throw new RangeError(`The probe "${probe.id}" gives no kind of fact`);
-	return probe;
-}
+import { Resolver } from "node:dns/promises";
+import { X509Certificate } from "node:crypto";
+import { request } from "node:http";
+import * as tls from "node:tls";
 // src/scope.ts
 /** The default limit of the different ports of one host in one runner. */
 const DEFAULT_MAX_PORTS_PER_HOST = 8;
-function parseRange(cidr) {
-	const slash = cidr.indexOf("/");
-	const address = canonicalHost(slash === -1 ? cidr : cidr.slice(0, slash));
-	const family = isIP(address);
-	if (family === 0) return err(`"${cidr}" is not an IP address or a CIDR range.`);
-	const max = family === 4 ? 32 : 128;
-	const prefixText = slash === -1 ? String(max) : cidr.slice(slash + 1);
-	if (!/^\d{1,3}$/.test(prefixText) || Number(prefixText) > max) return err(`"${cidr}" has no prefix from 0 to ${max}.`);
-	return ok({
-		address,
-		prefix: Number(prefixText),
-		family: family === 4 ? "ipv4" : "ipv6"
-	});
-}
 /** This function gives the problems of a grant, or an empty list for a correct grant. */
 function grantProblems(grant) {
 	if (grant.kind === "range") {
-		const range = parseRange(grant.cidr);
+		const range = parseCidr(grant.cidr);
 		return range.tag === "err" ? [range.error] : [];
 	}
 	const host = canonicalHost(grant.host);
@@ -228,11 +82,8 @@ function grantFor(scope, peer) {
 			continue;
 		}
 		if (family === 0) continue;
-		const range = parseRange(grant.cidr);
-		if (range.tag === "err" || range.value.family === "ipv4" !== (family === 4)) continue;
-		const list = new BlockList();
-		list.addSubnet(range.value.address, range.value.prefix, range.value.family);
-		if (list.check(host, family === 4 ? "ipv4" : "ipv6")) return grant;
+		const range = parseCidr(grant.cidr);
+		if (range.tag === "ok" && cidrContains(range.value, host)) return grant;
 	}
 }
 /**
@@ -431,6 +282,1078 @@ function createRunner(options) {
 		run
 	};
 }
-export { DEFAULT_MAX_PORTS_PER_HOST, FLOOR, LAYERS, NONE, PARTS, STANDARD_CATALOG, STANDARD_CATALOG_SPEC, STANDARD_FAULTS, STANDARD_FEATURES, STRENGTHS, UNKNOWN, canonicalHost, compileCatalog, createRunner, decideScope, defineFactKind, defineProbe, diagnose, expand, explain, factsOf, formatTarget, grantProblems, hostKind, isFactOf, isLayer, layerRank, namedGrant, observe, parseTarget, predictive, resolvedGrant, sameTarget, scopeOf, target, widen };
+// src/probes/socket.ts
+/** The time limit of a probe run, when its input gives none: 5 seconds. */
+const DEFAULT_TIMEOUT_MS = 5e3;
+const defaultDial = (options) => connect(options);
+/** This function gives the dial of the options. */
+function dialOf(options) {
+	return options.dial ?? defaultDial;
+}
+/** This function gives the error code of a thrown value, for example `ECONNREFUSED`. */
+function codeOf(thrown) {
+	if (typeof thrown !== "object" || thrown === null) return void 0;
+	const code = thrown.code;
+	return typeof code === "string" && code.length > 0 ? code : void 0;
+}
+function syscallOf(thrown) {
+	if (typeof thrown !== "object" || thrown === null) return void 0;
+	const syscall = thrown.syscall;
+	return typeof syscall === "string" ? syscall : void 0;
+}
+/** This function gives the peer of a probe that connects. It throws for an address that is not an IP address. */
+function peerOf(address, port) {
+	if (isIP(address) === 0) throw new TypeError(`"${address}" is not an IP address. Get the addresses of a name with the DNS probe first.`);
+	if (!Number.isInteger(port) || port < 1 || port > 65535) throw new RangeError(`${port} is not a port from 1 to 65535.`);
+	return target(address, port);
+}
+/** This function gives the time limit of an input. It throws for a limit that is not a positive number. */
+function timeoutOf(timeoutMs) {
+	const limit = timeoutMs ?? 5e3;
+	if (!Number.isFinite(limit) || limit <= 0) throw new RangeError(`The time limit ${limit} is not a positive number of milliseconds.`);
+	return limit;
+}
+/** This function starts the watch of a probe run. */
+function watch(context, timeoutMs) {
+	let expired = false;
+	let current;
+	const stop = () => {
+		current?.destroy();
+	};
+	const cancel = context.clock.after(timeoutMs, () => {
+		expired = true;
+		stop();
+	});
+	context.signal.addEventListener("abort", stop, { once: true });
+	return {
+		expired: () => expired,
+		guard(socket) {
+			current = socket;
+			if (expired || context.signal.aborted) socket.destroy();
+		},
+		close() {
+			cancel();
+			context.signal.removeEventListener("abort", stop);
+		}
+	};
+}
+const ignore = () => void 0;
+/** This function maps an error code of a TCP connect to its outcome. */
+function connectOutcome(code) {
+	switch (code) {
+		case "ECONNREFUSED": return "refused";
+		case "ETIMEDOUT": return "timeout";
+		case "EHOSTUNREACH":
+		case "ENETUNREACH":
+		case "EHOSTDOWN":
+		case "ENETDOWN": return "unreachable";
+		case "ECONNRESET": return "reset";
+		default: return "error";
+	}
+}
+/**
+* This function tells how a stream ended before its phase was complete.
+*
+* Node.js gives the code `ECONNRESET` for a TCP reset, with the system call that read it. It gives the same code with
+* no system call when the peer closed the connection with a FIN.
+*/
+function endOf(thrown, expired) {
+	if (expired) return "timeout";
+	const code = codeOf(thrown);
+	if (code === "EPIPE") return "reset";
+	if (code !== "ECONNRESET") return void 0;
+	return syscallOf(thrown) === void 0 ? "closed" : "reset";
+}
+const NOT_TLS = /* @__PURE__ */ new Set([
+	"ERR_SSL_WRONG_VERSION_NUMBER",
+	"ERR_SSL_PACKET_LENGTH_TOO_LONG",
+	"ERR_SSL_HTTP_REQUEST",
+	"ERR_SSL_RECORD_LAYER_FAILURE"
+]);
+const MISMATCH = /* @__PURE__ */ new Set([
+	"ERR_SSL_UNSUPPORTED_PROTOCOL",
+	"ERR_SSL_NO_PROTOCOLS_AVAILABLE",
+	"ERR_SSL_NO_SHARED_CIPHER",
+	"ERR_SSL_WRONG_SSL_VERSION"
+]);
+/** This function maps an error of a TLS handshake to its outcome. */
+function handshakeOutcome(thrown, expired) {
+	const end = endOf(thrown, expired);
+	if (end !== void 0) return end;
+	const code = codeOf(thrown) ?? "";
+	if (NOT_TLS.has(code)) return "not-tls";
+	if (code.includes("_ALERT_") || MISMATCH.has(code)) return "alert";
+	return "error";
+}
+/** This function maps the authorization error of a TLS socket to the problem of the certificate. */
+function certProblem(code) {
+	switch (code) {
+		case "CERT_HAS_EXPIRED": return "expired";
+		case "CERT_NOT_YET_VALID": return "not-yet-valid";
+		case "ERR_TLS_CERT_ALTNAME_INVALID":
+		case "HOSTNAME_MISMATCH": return "name";
+		case "DEPTH_ZERO_SELF_SIGNED_CERT":
+		case "SELF_SIGNED_CERT_IN_CHAIN":
+		case "UNABLE_TO_GET_ISSUER_CERT":
+		case "UNABLE_TO_GET_ISSUER_CERT_LOCALLY":
+		case "UNABLE_TO_VERIFY_LEAF_SIGNATURE":
+		case "CERT_UNTRUSTED": return "untrusted";
+		case "CERT_REVOKED": return "revoked";
+		default: return "other";
+	}
+}
+/** This function connects to an address and a port, and gives the socket when it connected. */
+function connectPhase(dial, address, port, w, clock) {
+	const family = isIP(address) === 6 ? 6 : 4;
+	const start = clock.now();
+	return new Promise((resolve) => {
+		const socket = dial({
+			host: address,
+			port,
+			family
+		});
+		socket.on("error", ignore);
+		let done = false;
+		const finish = (outcome, code) => {
+			if (done) return;
+			done = true;
+			const phase = {
+				address,
+				port,
+				family,
+				start,
+				end: clock.now(),
+				outcome,
+				...code === void 0 ? {} : { code }
+			};
+			if (outcome === "connected") resolve({
+				socket,
+				phase
+			});
+			else {
+				socket.destroy();
+				resolve({ phase });
+			}
+		};
+		socket.once("connect", () => finish("connected"));
+		socket.once("error", (error) => w.expired() ? finish("timeout") : finish(connectOutcome(codeOf(error)), codeOf(error)));
+		socket.once("close", () => w.expired() ? finish("timeout") : finish("error", "ECLOSED"));
+		w.guard(socket);
+	});
+}
+/** This function gives the observation of a TCP phase. */
+function tcpObservation(phase) {
+	const { start, end, ...rest } = phase;
+	return observe(TCP_CONNECT, target(phase.address, phase.port), {
+		...rest,
+		ms: end - start
+	}, {
+		start,
+		end
+	});
+}
+function systemRoots() {
+	const get = tls.getCACertificates;
+	if (typeof get !== "function") return [];
+	try {
+		const roots = get.call(tls, "system");
+		return Array.isArray(roots) ? roots.filter((root) => typeof root === "string") : [];
+	} catch {
+		return [];
+	}
+}
+/**
+* This function makes the store of trust of a TLS probe. It has the public roots of Node.js, the roots of the computer
+* and the roots that the user gives. A chain that ends at a public root has the trust `public`. A chain that ends at a
+* different root of the store has the trust `private`, for example the root of a proxy that examines TLS. The roots
+* in `extraPublic` count as public roots.
+*/
+function trustStore(extraRoots = [], extraPublic = []) {
+	const local = [...systemRoots(), ...extraRoots];
+	const publicRoots = new Set([...tls.rootCertificates, ...extraPublic].flatMap(fingerprintOf));
+	const privateRoots = new Set(local.flatMap(fingerprintOf).filter((fingerprint) => !publicRoots.has(fingerprint)));
+	return {
+		context: tls.createSecureContext({ ca: [
+			...tls.rootCertificates,
+			...extraPublic,
+			...local
+		] }),
+		publicRoots,
+		privateRoots
+	};
+}
+function fingerprintOf(pem) {
+	try {
+		return [new X509Certificate(pem).fingerprint256];
+	} catch {
+		return [];
+	}
+}
+function text(value) {
+	if (value === void 0) return "";
+	return Array.isArray(value) ? value.join(", ") : value;
+}
+function isoTime(value) {
+	const time = new Date(value);
+	return Number.isNaN(time.getTime()) ? value : time.toISOString();
+}
+function namesOf(subjectAltName) {
+	if (subjectAltName === void 0 || subjectAltName.length === 0) return [];
+	return subjectAltName.split(", ").map((entry) => entry.replace(/^(?:DNS|IP Address):/, "")).filter((entry) => entry.length > 0);
+}
+function isSelfSigned(raw) {
+	try {
+		const certificate = new X509Certificate(raw);
+		return certificate.issuer === certificate.subject && certificate.verify(certificate.publicKey);
+	} catch {
+		return false;
+	}
+}
+function certificateOf(socket, store) {
+	const leaf = socket.getPeerCertificate(true);
+	if (Object.keys(leaf).length === 0) return void 0;
+	let top = leaf;
+	let chain = 1;
+	const seen = /* @__PURE__ */ new Set([leaf.fingerprint256]);
+	while (top.issuerCertificate !== void 0 && !seen.has(top.issuerCertificate.fingerprint256)) {
+		top = top.issuerCertificate;
+		seen.add(top.fingerprint256);
+		chain += 1;
+	}
+	const authorized = socket.authorized;
+	const trust = store.publicRoots.has(top.fingerprint256) ? "public" : store.privateRoots.has(top.fingerprint256) || authorized ? "private" : "none";
+	const reason = socket.authorizationError;
+	return {
+		subject: text(leaf.subject.CN) || text(leaf.subject.O),
+		issuer: text(leaf.issuer.CN) || text(leaf.issuer.O),
+		names: namesOf(leaf.subjectaltname),
+		validFrom: isoTime(leaf.valid_from),
+		validTo: isoTime(leaf.valid_to),
+		fingerprint256: leaf.fingerprint256,
+		selfSigned: isSelfSigned(leaf.raw),
+		chain,
+		trust,
+		...authorized ? {} : { problem: certProblem(reason instanceof Error ? codeOf(reason) ?? reason.message : String(reason)) }
+	};
+}
+/**
+* This function does a TLS handshake on a connected socket. It does not refuse a certificate that is not valid: it
+* gives the outcome `cert-error` and the problem of the certificate.
+*/
+function handshakePhase(socket, input, store, w, clock) {
+	const start = clock.now();
+	const servername = input.servername !== void 0 && isIP(input.servername) === 0 ? input.servername : void 0;
+	return new Promise((resolve) => {
+		const secure = tls.connect({
+			socket,
+			host: input.address,
+			...servername === void 0 ? {} : { servername },
+			...input.alpn === void 0 ? {} : { ALPNProtocols: [...input.alpn] },
+			secureContext: store.context,
+			rejectUnauthorized: false
+		});
+		secure.on("error", ignore);
+		let done = false;
+		const base = {
+			...servername === void 0 ? {} : { servername },
+			start
+		};
+		const finish = (phase, ok) => {
+			if (done) return;
+			done = true;
+			if (ok) resolve({
+				secure,
+				phase
+			});
+			else {
+				secure.destroy();
+				resolve({ phase });
+			}
+		};
+		secure.once("secureConnect", () => {
+			const cipher = secure.getCipher().name;
+			const protocol = secure.getProtocol() ?? void 0;
+			const alpn = typeof secure.alpnProtocol === "string" ? secure.alpnProtocol : void 0;
+			const certificate = certificateOf(secure, store);
+			finish({
+				...base,
+				end: clock.now(),
+				outcome: secure.authorized ? "ok" : "cert-error",
+				...protocol === void 0 ? {} : { protocol },
+				...cipher.length === 0 ? {} : { cipher },
+				...alpn === void 0 ? {} : { alpn },
+				...certificate === void 0 ? {} : { certificate }
+			}, true);
+		});
+		secure.once("error", (error) => {
+			const code = codeOf(error);
+			finish({
+				...base,
+				end: clock.now(),
+				outcome: handshakeOutcome(error, w.expired()),
+				...code === void 0 ? {} : { code }
+			}, false);
+		});
+		secure.once("close", () => finish({
+			...base,
+			end: clock.now(),
+			outcome: w.expired() ? "timeout" : "closed"
+		}, false));
+		w.guard(secure);
+	});
+}
+/** This function gives the observation of a TLS phase. */
+function tlsObservation(address, port, phase) {
+	const { start, end, ...rest } = phase;
+	return observe(TLS_HANDSHAKE, target(address, port), {
+		address,
+		port,
+		...rest,
+		ms: end - start
+	}, {
+		start,
+		end
+	});
+}
+/** The fields of a response head that an HTTP fact keeps. */
+const KEPT_FIELDS = [
+	"server",
+	"via",
+	"location",
+	"content-type",
+	"content-length",
+	"alt-svc",
+	"x-cache",
+	"cf-ray"
+];
+function httpOutcome(thrown, expired) {
+	const end = endOf(thrown, expired);
+	if (end !== void 0) return end;
+	return (codeOf(thrown) ?? "").startsWith("HPE_") ? "protocol" : "error";
+}
+/** This function sends one HTTP/1.1 request on a connected socket, and reads the response up to a limit of bytes. */
+function exchangePhase(socket, input, w, clock) {
+	return new Promise((resolve) => {
+		let done = false;
+		let head;
+		let status;
+		let version;
+		let fields = {};
+		let bytes = 0;
+		let truncated = false;
+		const start = clock.now();
+		const finish = (outcome, code) => {
+			if (done) return;
+			done = true;
+			resolve({
+				method: input.method,
+				host: input.host,
+				path: input.path,
+				start,
+				...head === void 0 ? {} : { head },
+				end: clock.now(),
+				outcome,
+				...status === void 0 ? {} : { status },
+				...version === void 0 ? {} : { version },
+				fields,
+				bytes,
+				truncated,
+				...code === void 0 ? {} : { code }
+			});
+			socket.destroy();
+		};
+		const req = request({
+			createConnection: () => socket,
+			method: input.method,
+			path: input.path,
+			headers: {
+				host: input.host,
+				"user-agent": "netdiag",
+				accept: "*/*",
+				connection: "close"
+			}
+		});
+		req.on("error", (error) => finish(httpOutcome(error, w.expired()), codeOf(error)));
+		req.on("close", () => finish(w.expired() ? "timeout" : "closed"));
+		req.on("response", (res) => {
+			head = clock.now();
+			status = res.statusCode;
+			version = res.httpVersion;
+			fields = Object.fromEntries(KEPT_FIELDS.flatMap((name) => {
+				const value = res.headers[name];
+				return value === void 0 ? [] : [[name, Array.isArray(value) ? value.join(", ") : value]];
+			}));
+			res.on("data", (chunk) => {
+				bytes += chunk.length;
+				if (bytes >= input.maxBytes) {
+					truncated = true;
+					finish("response");
+				}
+			});
+			res.on("end", () => finish("response"));
+			res.on("error", (error) => finish(httpOutcome(error, w.expired()), codeOf(error)));
+		});
+		req.end();
+	});
+}
+/** This function gives the observation of an HTTP phase. */
+function httpObservation(address, port, scheme, phase) {
+	const { start, end, head, ...rest } = phase;
+	const time = {
+		start,
+		end
+	};
+	return observe(HTTP_RESPONSE, target(address, port), {
+		address,
+		port,
+		scheme,
+		...rest,
+		...head === void 0 ? {} : { ttfbMs: head - start },
+		ms: end - start
+	}, time);
+}
+// src/probes/native.ts
+const NATIVE = {
+	available: true,
+	version: process.versions.node
+};
+function native() {
+	return Promise.resolve(NATIVE);
+}
+/** This function maps an error code of a DNS query to its outcome. */
+function dnsOutcome(code) {
+	switch (code) {
+		case "ENOTFOUND": return "nxdomain";
+		case "ENODATA": return "nodata";
+		case "ESERVFAIL": return "servfail";
+		case "EREFUSED": return "refused";
+		case "ETIMEOUT": return "timeout";
+		case "ECONNREFUSED": return "unreachable";
+		default: return "error";
+	}
+}
+/**
+* The DNS probe sends one query for the addresses of a name to one resolver. Its peer is the resolver, not the name.
+* The query uses no search domain.
+*/
+const DNS_PROBE = defineProbe({
+	id: "dns.query",
+	version: "1",
+	summary: "One DNS query for the A or AAAA records of a name, to one resolver.",
+	layer: "dns",
+	mode: "active",
+	kinds: [DNS_ANSWER],
+	peers(input) {
+		if (isIP(input.name) !== 0) throw new TypeError(`"${input.name}" is an address, not a name.`);
+		return [peerOf(input.resolver, input.port ?? 53)];
+	},
+	available: native,
+	async run(input, context) {
+		const record = input.record ?? "A";
+		const limit = timeoutOf(input.timeoutMs);
+		const server = formatTarget(target(input.resolver, input.port ?? 53));
+		const resolver = new Resolver({
+			timeout: limit,
+			tries: 1
+		});
+		resolver.setServers([server]);
+		let expired = false;
+		const stop = () => resolver.cancel();
+		const cancel = context.clock.after(limit, () => {
+			expired = true;
+			stop();
+		});
+		context.signal.addEventListener("abort", stop, { once: true });
+		const start = context.clock.now();
+		const base = {
+			name: input.name,
+			record,
+			resolver: server,
+			start
+		};
+		try {
+			const answers = record === "A" ? await resolver.resolve4(input.name, { ttl: true }) : await resolver.resolve6(input.name, { ttl: true });
+			const raw = {
+				...base,
+				end: context.clock.now(),
+				outcome: "ok",
+				addresses: answers.map((answer) => answer.address),
+				...answers.length === 0 ? {} : { ttl: Math.min(...answers.map((answer) => answer.ttl)) }
+			};
+			context.signal.throwIfAborted();
+			return raw;
+		} catch (thrown) {
+			context.signal.throwIfAborted();
+			const code = codeOf(thrown);
+			return {
+				...base,
+				end: context.clock.now(),
+				outcome: expired ? "timeout" : dnsOutcome(code),
+				addresses: [],
+				...code === void 0 ? {} : { code }
+			};
+		} finally {
+			cancel();
+			context.signal.removeEventListener("abort", stop);
+		}
+	},
+	parse(raw) {
+		const { start, end, ...rest } = raw;
+		return [observe(DNS_ANSWER, target(raw.name), {
+			...rest,
+			ms: end - start
+		}, {
+			start,
+			end
+		})];
+	}
+});
+/** This function makes the TCP probe. It connects, and then it closes the connection. */
+function tcpProbe(options = {}) {
+	const dial = dialOf(options);
+	return defineProbe({
+		id: "tcp.connect",
+		version: "1",
+		summary: "One TCP connect to an IP address and a port.",
+		layer: "tcp",
+		mode: "active",
+		kinds: [TCP_CONNECT],
+		peers: (input) => [peerOf(input.address, input.port)],
+		available: native,
+		async run(input, context) {
+			const w = watch(context, timeoutOf(input.timeoutMs));
+			try {
+				const { socket, phase } = await connectPhase(dial, input.address, input.port, w, context.clock);
+				socket?.destroy();
+				context.signal.throwIfAborted();
+				return { tcp: phase };
+			} finally {
+				w.close();
+			}
+		},
+		parse: (raw) => [tcpObservation(raw.tcp)]
+	});
+}
+/** The TCP probe with the `connect` of `node:net`. */
+const TCP_PROBE = tcpProbe();
+function lazyStore(options) {
+	let store;
+	return () => store ??= trustStore(options.roots ?? [], options.publicRoots ?? []);
+}
+/**
+* This function makes the TLS probe. It measures the TCP connect and the TLS handshake apart. It examines the
+* certificate, and it does not refuse a certificate that is not valid.
+*/
+function tlsProbe(options = {}) {
+	const dial = dialOf(options);
+	const store = lazyStore(options);
+	return defineProbe({
+		id: "tls.handshake",
+		version: "1",
+		summary: "One TCP connect and one TLS handshake, with the certificate of the server.",
+		layer: "tls",
+		mode: "active",
+		kinds: [TCP_CONNECT, TLS_HANDSHAKE],
+		peers: (input) => [peerOf(input.address, input.port ?? 443)],
+		available: native,
+		async run(input, context) {
+			const port = input.port ?? 443;
+			const w = watch(context, timeoutOf(input.timeoutMs));
+			try {
+				const { socket, phase } = await connectPhase(dial, input.address, port, w, context.clock);
+				if (socket === void 0) {
+					context.signal.throwIfAborted();
+					return { tcp: phase };
+				}
+				const handshake = await handshakePhase(socket, {
+					address: input.address,
+					servername: input.servername,
+					alpn: input.alpn
+				}, store(), w, context.clock);
+				handshake.secure?.destroy();
+				context.signal.throwIfAborted();
+				return {
+					tcp: phase,
+					tls: handshake.phase
+				};
+			} finally {
+				w.close();
+			}
+		},
+		parse(raw) {
+			const observations = [tcpObservation(raw.tcp)];
+			if (raw.tls !== void 0) observations.push(tlsObservation(raw.tcp.address, raw.tcp.port, raw.tls));
+			return observations;
+		}
+	});
+}
+/** The TLS probe with the public roots and the roots of the computer. */
+const TLS_PROBE = tlsProbe();
+/** The limit of the bytes of a body that the HTTP probe reads, when its input gives none: 64 KiB. */
+const DEFAULT_MAX_BYTES = 65536;
+function hostField(input, port) {
+	const host = input.host ?? (isIP(input.address) === 6 ? `[${input.address}]` : input.address);
+	return port === (input.scheme === "https" ? 443 : 80) ? host : `${host}:${port}`;
+}
+/**
+* This function makes the HTTP probe. It sends one request, follows no redirect, and reads the body up to a limit. It
+* gives the facts of each phase: TCP, TLS for `https`, and HTTP. For `https`, it sends the request only when the
+* certificate passes its check.
+*/
+function httpProbe(options = {}) {
+	const dial = dialOf(options);
+	const store = lazyStore(options);
+	const portOf = (input) => input.port ?? (input.scheme === "https" ? 443 : 80);
+	return defineProbe({
+		id: "http.request",
+		version: "1",
+		summary: "One HTTP/1.1 request, with the time of each phase: TCP, TLS and the first byte.",
+		layer: "http",
+		mode: "active",
+		kinds: [
+			TCP_CONNECT,
+			TLS_HANDSHAKE,
+			HTTP_RESPONSE
+		],
+		peers(input) {
+			const path = input.path ?? "/";
+			if (!path.startsWith("/") || /[\s]/.test(path)) throw new TypeError(`"${path}" is not a path that starts with "/" and has no space.`);
+			return [peerOf(input.address, portOf(input))];
+		},
+		available: native,
+		async run(input, context) {
+			const port = portOf(input);
+			const maxBytes = input.maxBytes ?? 65536;
+			if (!Number.isInteger(maxBytes) || maxBytes < 1) throw new RangeError(`The limit of bytes ${maxBytes} is not a positive integer.`);
+			const w = watch(context, timeoutOf(input.timeoutMs));
+			try {
+				const { socket, phase: tcp } = await connectPhase(dial, input.address, port, w, context.clock);
+				if (socket === void 0) {
+					context.signal.throwIfAborted();
+					return {
+						scheme: input.scheme,
+						tcp
+					};
+				}
+				let stream = socket;
+				let secured;
+				if (input.scheme === "https") {
+					const handshake = await handshakePhase(socket, {
+						address: input.address,
+						servername: input.host,
+						alpn: ["http/1.1"]
+					}, store(), w, context.clock);
+					secured = handshake.phase;
+					if (handshake.secure === void 0 || secured.outcome !== "ok") {
+						handshake.secure?.destroy();
+						context.signal.throwIfAborted();
+						return {
+							scheme: input.scheme,
+							tcp,
+							tls: secured
+						};
+					}
+					stream = handshake.secure;
+				}
+				const http = await exchangePhase(stream, {
+					method: input.method ?? "GET",
+					host: hostField(input, port),
+					path: input.path ?? "/",
+					maxBytes
+				}, w, context.clock);
+				context.signal.throwIfAborted();
+				return {
+					scheme: input.scheme,
+					tcp,
+					...secured === void 0 ? {} : { tls: secured },
+					http
+				};
+			} finally {
+				w.close();
+			}
+		},
+		parse(raw) {
+			const { address, port } = raw.tcp;
+			const observations = [tcpObservation(raw.tcp)];
+			if (raw.tls !== void 0) observations.push(tlsObservation(address, port, raw.tls));
+			if (raw.http !== void 0) observations.push(httpObservation(address, port, raw.scheme, raw.http));
+			return observations;
+		}
+	});
+}
+/** The HTTP probe with the public roots and the roots of the computer. */
+const HTTP_PROBE = httpProbe();
+// src/readers.ts
+/** The bins of the feature `tcp.time`, in milliseconds. A connect of 900 ms or more sent its SYN again. */
+const TCP_TIME_BINS = [
+	{
+		below: 150,
+		value: "short"
+	},
+	{
+		below: 900,
+		value: "long"
+	},
+	{ value: "retry" }
+];
+/** The bins of the feature `tls.ratio`: the time of the TLS handshake divided by the time of the TCP connect. */
+const TLS_RATIO_BINS = [
+	{
+		below: 3,
+		value: "low"
+	},
+	{
+		below: 8,
+		value: "mid"
+	},
+	{ value: "high" }
+];
+/** The bins of the feature `http.ttfb`: the time to the first byte divided by the time of the TCP connect. */
+const HTTP_TTFB_BINS = [
+	{
+		below: 4,
+		value: "low"
+	},
+	{
+		below: 20,
+		value: "mid"
+	},
+	{ value: "high" }
+];
+/**
+* The smallest time of a TCP connect in a ratio, in milliseconds. On a local link, a ratio with a smaller time measures
+* only the cost of the cryptography.
+*/
+const MIN_CONNECT_MS = 1;
+/** The value of the feature `dns.answer` for each outcome of a DNS query. `nodata` tells that the name exists. */
+const DNS_ANSWER_VALUES = {
+	ok: "ok",
+	nodata: "ok",
+	nxdomain: "nxdomain",
+	servfail: "servfail",
+	refused: "refused",
+	timeout: "timeout",
+	unreachable: "unreachable"
+};
+/** The value of the feature `tcp.connect` for each outcome of a TCP connect. */
+const TCP_CONNECT_VALUES = {
+	connected: "connected",
+	refused: "refused",
+	timeout: "timeout",
+	unreachable: "unreachable",
+	reset: "reset"
+};
+/**
+* The value of the feature `tls.handshake` for each outcome of a TLS handshake. The catalog has no value for `not-tls`
+* and `closed` yet. The lab runs (ND-7) tell which faults cause them.
+*/
+const TLS_HANDSHAKE_VALUES = {
+	ok: "ok",
+	"cert-error": "cert-error",
+	alert: "alert",
+	timeout: "timeout",
+	reset: "reset"
+};
+/** The value of the feature `tls.trust` for each trust. A chain that ends at no root of the store has no public root. */
+const TLS_TRUST_VALUES = {
+	public: "public",
+	private: "private",
+	none: "private"
+};
+/** The value of the feature `icmp.reply` for each outcome of the ICMP echo requests to an address. */
+const ICMP_REPLY_VALUES = {
+	reply: "reply",
+	none: "none",
+	unreachable: "unreachable"
+};
+/**
+* The value of the feature `gateway.reply` for each outcome of the ICMP echo requests to the gateway. When this computer
+* tells that the gateway is unreachable, the gateway gives no reply.
+*/
+const GATEWAY_REPLY_VALUES = {
+	reply: "reply",
+	none: "none",
+	unreachable: "none"
+};
+/**
+* The bins of the feature `path.loss`, on the share of the echo requests with a reply. A share of 1 has no loss. A share
+* of 0.95 or more has a loss of up to 5 %.
+*/
+const PATH_LOSS_BINS = [
+	{
+		below: .95,
+		value: "high"
+	},
+	{
+		below: 1,
+		value: "some"
+	},
+	{ value: "none" }
+];
+/**
+* The smallest number of echo requests that gives the feature `path.loss`. With 20 requests, one lost request is a loss
+* of 5 %. With no reply, the feature `icmp.reply` tells the result, not `path.loss`.
+*/
+const LOSS_MIN_SENT = 20;
+/** The suffixes of the names of local networks and of the special-use names (RFC 6761, RFC 6762 and RFC 8375). */
+const LOCAL_SUFFIXES = [
+	"local",
+	"localhost",
+	"test",
+	"invalid",
+	"example",
+	"home.arpa",
+	"internal",
+	"lan",
+	"home",
+	"corp",
+	"intranet",
+	"private"
+];
+/** This function gives the value of the first bin that holds `x`. */
+function binOf(bins, x) {
+	for (const bin of bins) if (bin.below === void 0 || x < bin.below) return bin.value;
+	throw new RangeError("The last bin has a limit.");
+}
+/** This function tells if a name is a local name: a name with one label, or a name with a local suffix. */
+function isLocalName(name) {
+	const lower = name.toLowerCase().replace(/\.$/, "");
+	if (!lower.includes(".")) return true;
+	return LOCAL_SUFFIXES.some((suffix) => lower === suffix || lower.endsWith(`.${suffix}`));
+}
+const READ_KINDS = [
+	["dns", DNS_ANSWER],
+	["tcp", TCP_CONNECT],
+	["tls", TLS_HANDSHAKE],
+	["http", HTTP_RESPONSE],
+	["icmp", ICMP_ECHO],
+	["report", PATH_REPORT],
+	["trace", PATH_TRACE]
+];
+/**
+* This function changes facts into evidence for the model.
+*
+* - The reader gives one evidence for each feature, subject and role. When a subject has more facts, the last fact decides.
+* - For `dns.answer`, one answer `ok` of a name and a resolver decides. For `dns.address`, one private address decides.
+* - The order of the facts is the order of the runner. A ratio uses the last TCP connect before the handshake or the request.
+* - An ICMP echo fact gives `gateway.reply` for the gateway, and `icmp.reply` for each other address.
+* - An ICMP echo fact with replies to `LOSS_MIN_SENT` requests or more gives `path.loss`. A report of `mtr` gives it from
+*   the last hop, when the address answered there.
+* - A trace of `traceroute` gives no evidence. The catalog has no feature for the hops of a path.
+*/
+function readEvidence(facts, options = {}) {
+	const primaryOf = options.primary ?? (() => true);
+	const slots = /* @__PURE__ */ new Map();
+	const skipped = [];
+	const sorted = {
+		dns: [],
+		tcp: [],
+		tls: [],
+		http: [],
+		icmp: [],
+		report: [],
+		trace: []
+	};
+	for (const fact of facts) {
+		const entry = READ_KINDS.find(([, kind]) => kind.kind === fact.kind);
+		if (entry === void 0) skipped.push({
+			fact: fact.id,
+			reason: `netdiag has no reader for the kind ${fact.kind}.`
+		});
+		else if (!entry[1].check(fact.value)) skipped.push({
+			fact: fact.id,
+			reason: `The value does not pass the check of the kind ${fact.kind}.`
+		});
+		else sorted[entry[0]].push(fact);
+	}
+	/** This function puts a value in the slot of a feature and a group. A `sticky` value stays when a later fact disagrees. */
+	const note = (feature, group, fact, value, sticky) => {
+		const primary = primaryOf(fact);
+		const key = `${feature}\u0000${primary ? 1 : 0}\u0000${group}`;
+		const slot = slots.get(key);
+		if (slot === void 0) slots.set(key, {
+			feature,
+			primary,
+			value,
+			facts: [fact.id]
+		});
+		else {
+			if (slot.value !== sticky) slot.value = value;
+			slot.facts.push(fact.id);
+		}
+	};
+	const skip = (fact, feature, outcome) => {
+		skipped.push({
+			fact: fact.id,
+			reason: `The outcome "${outcome}" of ${fact.kind} has no value of the feature ${feature}.`
+		});
+	};
+	for (const fact of sorted.dns) {
+		const answer = fact.value;
+		const group = `${answer.name.toLowerCase()}\u0000${answer.resolver}`;
+		const value = DNS_ANSWER_VALUES[answer.outcome];
+		if (value === void 0) {
+			skip(fact, "dns.answer", answer.outcome);
+			continue;
+		}
+		note("dns.answer", group, fact, value, "ok");
+		if (answer.addresses.length > 0 && !isLocalName(answer.name)) note("dns.address", group, fact, answer.addresses.map(addressKind).includes("private") ? "private" : "public", "private");
+	}
+	readFamily(sorted, primaryOf, note);
+	const subject = (value) => `${value.address}\u0000${value.port}`;
+	for (const fact of sorted.tcp) {
+		const connect = fact.value;
+		const value = TCP_CONNECT_VALUES[connect.outcome];
+		if (value === void 0) {
+			skip(fact, "tcp.connect", connect.outcome);
+			continue;
+		}
+		note("tcp.connect", subject(connect), fact, value);
+		if (connect.outcome === "connected") note("tcp.time", subject(connect), fact, binOf(TCP_TIME_BINS, connect.ms));
+	}
+	const connectBefore = (fact, value) => {
+		let best;
+		for (const tcp of sorted.tcp) {
+			if (!(tcp.value.address === value.address && tcp.value.port === value.port && primaryOf(tcp) === primaryOf(fact)) || tcp.value.outcome !== "connected" || tcp.time.end > fact.time.start) continue;
+			if (best === void 0 || tcp.time.end >= best.time.end) best = tcp;
+		}
+		return best;
+	};
+	const ratio = (ms, tcp) => ms / Math.max(tcp.value.ms, 1);
+	for (const fact of sorted.tls) {
+		const handshake = fact.value;
+		const group = `${subject(handshake)}\u0000${handshake.servername ?? ""}`;
+		const value = TLS_HANDSHAKE_VALUES[handshake.outcome];
+		if (value === void 0) {
+			skip(fact, "tls.handshake", handshake.outcome);
+			continue;
+		}
+		note("tls.handshake", group, fact, value);
+		if (handshake.certificate !== void 0) note("tls.trust", group, fact, TLS_TRUST_VALUES[handshake.certificate.trust]);
+		const tcp = handshake.outcome === "ok" || handshake.outcome === "cert-error" ? connectBefore(fact, handshake) : void 0;
+		if (tcp !== void 0) note("tls.ratio", group, fact, binOf(TLS_RATIO_BINS, ratio(handshake.ms, tcp)));
+	}
+	for (const fact of sorted.http) {
+		const response = fact.value;
+		const group = [
+			subject(response),
+			response.scheme,
+			response.host,
+			response.method,
+			response.path
+		].join("\0");
+		const status = statusValue(response);
+		if (status === void 0) {
+			skip(fact, "http.status", response.outcome === "response" ? `response ${response.status ?? ""}`.trim() : response.outcome);
+			continue;
+		}
+		note("http.status", group, fact, status);
+		const tcp = response.ttfbMs === void 0 ? void 0 : connectBefore(fact, response);
+		if (tcp !== void 0 && response.ttfbMs !== void 0) note("http.ttfb", group, fact, binOf(HTTP_TTFB_BINS, ratio(response.ttfbMs, tcp)));
+	}
+	const gateway = options.gateway === void 0 ? void 0 : canonicalAddress(options.gateway);
+	for (const fact of sorted.icmp) {
+		const echo = fact.value;
+		const address = canonicalAddress(echo.address);
+		const isGateway = address === gateway;
+		const feature = isGateway ? "gateway.reply" : "icmp.reply";
+		const value = (isGateway ? GATEWAY_REPLY_VALUES : ICMP_REPLY_VALUES)[echo.outcome];
+		if (value === void 0) {
+			skip(fact, feature, echo.outcome);
+			continue;
+		}
+		note(feature, address, fact, value);
+	}
+	const lossFacts = /* @__PURE__ */ new Set([...sorted.icmp, ...sorted.report]);
+	for (const fact of facts) {
+		if (!lossFacts.has(fact)) continue;
+		const loss = lossOf(fact);
+		if (typeof loss === "string") skipped.push({
+			fact: fact.id,
+			reason: loss
+		});
+		else if (loss !== void 0) note("path.loss", loss.address, fact, binOf(PATH_LOSS_BINS, loss.share));
+	}
+	for (const fact of sorted.trace) skipped.push({
+		fact: fact.id,
+		reason: "The catalog has no feature for the hops of a path. The lab runs fit such a feature later."
+	});
+	return {
+		evidence: [...slots.values()].map(({ feature, value, primary, facts: ids }) => ({
+			feature,
+			value,
+			primary,
+			facts: ids
+		})),
+		skipped
+	};
+}
+/**
+* This function gives the share of the probes with an answer, for the feature `path.loss`. It gives a reason when a report
+* of `mtr` gives no evidence, and `undefined` when an echo fact gives no share.
+*/
+function lossOf(fact) {
+	if (isFactOf(ICMP_ECHO, fact)) {
+		const echo = fact.value;
+		return echo.received > 0 && echo.sent >= 20 ? {
+			address: canonicalAddress(echo.address),
+			share: echo.received / echo.sent
+		} : void 0;
+	}
+	if (!isFactOf(PATH_REPORT, fact)) return void 0;
+	const report = fact.value;
+	const last = report.hops.at(-1);
+	if (report.outcome !== "reached" || last === void 0) return `The outcome "${report.outcome}" of ${fact.kind} has no value of the feature path.loss.`;
+	if (last.sent < 20) return `The last hop of the report has ${last.sent} probes. The feature path.loss needs 20 probes or more.`;
+	return {
+		address: canonicalAddress(report.address),
+		share: last.received / last.sent
+	};
+}
+function statusValue(response) {
+	if (response.outcome === "error") return void 0;
+	if (response.outcome !== "response") return "none";
+	const status = response.status ?? 0;
+	if (status >= 200 && status < 400) return "ok";
+	if (status >= 400 && status < 500) return "client-error";
+	if (status >= 500 && status < 600) return "server-error";
+}
+/**
+* This function gives the feature `ip.family` for a name with IPv4 and IPv6 addresses. It needs a TCP connect to an
+* address of each family.
+*/
+function readFamily(sorted, primaryOf, note) {
+	const names = /* @__PURE__ */ new Map();
+	for (const fact of sorted.dns) {
+		if (fact.value.outcome !== "ok") continue;
+		const key = `${primaryOf(fact) ? 1 : 0}\u0000${fact.value.name.toLowerCase()}`;
+		const entry = names.get(key) ?? {
+			v4: /* @__PURE__ */ new Set(),
+			v6: /* @__PURE__ */ new Set(),
+			facts: [],
+			primary: primaryOf(fact)
+		};
+		for (const address of fact.value.addresses) (fact.value.record === "A" ? entry.v4 : entry.v6).add(address);
+		entry.facts.push(fact);
+		names.set(key, entry);
+	}
+	for (const [key, entry] of names) {
+		if (entry.v4.size === 0 || entry.v6.size === 0) continue;
+		const tried = sorted.tcp.filter((tcp) => primaryOf(tcp) === entry.primary && (entry.v4.has(tcp.value.address) || entry.v6.has(tcp.value.address)));
+		const works = (family) => {
+			const connects = tried.filter((tcp) => family.has(tcp.value.address));
+			return connects.length === 0 ? void 0 : connects.some((tcp) => tcp.value.outcome === "connected");
+		};
+		const v4 = works(entry.v4);
+		const v6 = works(entry.v6);
+		if (v4 === void 0 || v6 === void 0 || !v4 && !v6) continue;
+		const value = v4 && v6 ? "both" : v4 ? "ipv4-only" : "ipv6-only";
+		const [first, ...rest] = [...entry.facts, ...tried];
+		if (first === void 0) continue;
+		note("ip.family", key, first, value);
+		for (const fact of rest) note("ip.family", key, fact, value);
+	}
+}
+export { ADDRESS_CLASSES, CERT_PROBLEMS, CONNECT_OUTCOMES, DEFAULT_MAX_BYTES, DEFAULT_MAX_PORTS_PER_HOST, DEFAULT_TIMEOUT_MS, DNS_ANSWER, DNS_ANSWER_VALUES, DNS_OUTCOMES, DNS_PROBE, ECHO_OUTCOMES, FLOOR, GATEWAY_REPLY_VALUES, HANDSHAKE_OUTCOMES, HTTP_OUTCOMES, HTTP_PROBE, HTTP_RESPONSE, HTTP_TTFB_BINS, ICMP_ECHO, ICMP_REPLY_VALUES, KEPT_FIELDS, LAB_RECORD_FORMAT, LAYERS, LOCAL_SUFFIXES, LOSS_MIN_SENT, MIN_CONNECT_MS, NATIVE_KINDS, NONE, PARTS, PATH_LOSS_BINS, PATH_REPORT, PATH_TRACE, RECORD_TYPES, STANDARD_CATALOG, STANDARD_CATALOG_SPEC, STANDARD_FAULTS, STANDARD_FEATURES, STRENGTHS, TCP_CONNECT, TCP_CONNECT_VALUES, TCP_PROBE, TCP_TIME_BINS, TLS_HANDSHAKE, TLS_HANDSHAKE_VALUES, TLS_PROBE, TLS_RATIO_BINS, TLS_TRUST_VALUES, TOOL_KINDS, TRACE_OUTCOMES, TRUSTS, UNKNOWN, addressClass, addressFamily, addressKind, binOf, canonicalAddress, canonicalHost, certProblem, cidrContains, cidrSet, compileCatalog, connectOutcome, createRunner, decideScope, defineFactKind, defineProbe, diagnose, dnsOutcome, expand, explain, factsOf, formatCidr, formatTarget, grantProblems, handshakeOutcome, hostKind, httpProbe, isFactOf, isLayer, isLocalName, labGate, labRecordOf, layerRank, namedGrant, observe, parseCidr, parseTarget, predictive, readEvidence, resolvedGrant, sameTarget, scopeOf, scoreLab, target, tcpProbe, tlsProbe, widen };
 
 //# sourceMappingURL=index.js.map