[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_151":152,"_153":154},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_18":19,"_17":-7,"_114":-5,"_20":115,"_22":116,"_117":118,"_119":120,"_25":121,"_24":-5,"_122":-5,"_123":-5,"_124":53,"_125":126,"_127":44,"_128":-5,"_129":-5,"_130":131},"routes/_app.x.$handle.$name.branch.$branch.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":-7,"_25":26,"_27":-5,"_28":-5,"_29":-5,"_30":-5,"_31":-5},"handle","d5bd8981","name","ant","branchName","main","version","path","","project",{"_33":61,"_13":14,"_45":62,"_63":-5,"_64":53,"_65":66,"_67":66,"_68":19,"_69":-5,"_70":71,"_72":-5,"_73":53,"_74":-5,"_75":-5,"_76":77,"_78":79,"_80":-5,"_81":-5,"_82":-5,"_83":-5,"_84":85,"_86":85,"_87":88,"_89":88,"_90":88,"_91":85,"_92":85,"_93":94,"_95":96,"_97":98,"_99":53},"tree",[56],"file","contents",[32],"upstream","pull","ahead","behind","envVars",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_18":55},"id","d5fe2e41-731e-4d37-86ba-a015a445cc49","new-file-7708.ts","fileId","88506e7a-6423-11f1-95c5-1607ee4eb77e","parentId","branchId","e979ac07-8975-43d0-b939-92de3622e7a4","branchVersion",17,"latest",true,"createdAt",["D",1781023965888],3,"fileType","http","content","/**\n * VERSION: 2.2.0\n * GITHUB: https://github.com/TheGreatAzizi/Secure-DNS-over-HTTPS-Cloudflare-Worker\n * Runtime: Cloudflare Workers Module Syntax\n */\n\nconst VERSION = '2.2.0';\n\nconst CONFIG = {\n DNS_PATH: '/dns-query',\n DEFAULT_PROFILE: 'all',\n CACHE_TTL_SECONDS: 300,\n MAX_CACHE_ENTRIES: 5000,\n MAX_THROTTLE_ENTRIES: 20000,\n MAX_DNS_MESSAGE_BYTES: 4096,\n RATE_LIMIT_WINDOW_MS: 60_000,\n RATE_LIMIT_MAX_REQUESTS: 250,\n UPSTREAM_TIMEOUT_MS: 1800,\n RACE_COUNT: 4,\n SCORE_START: 100,\n SCORE_MIN: 0,\n SCORE_MAX: 100,\n SCORE_SUCCESS_DELTA: 1,\n SCORE_FAILURE_DELTA: 15,\n SCORE_TIMEOUT_DELTA: 10\n};\n\nconst ALL_DNS_UPSTREAMS = [\n 'https://cloudflare-dns.com/dns-query', 'https://1.1.1.1/dns-query',\n 'https://1.0.0.1/dns-query', 'https://mozilla.cloudflare-dns.com/dns-query',\n 'https://security.cloudflare-dns.com/dns-query', 'https://family.cloudflare-dns.com/dns-query',\n 'https://dns64.cloudflare-dns.com/dns-query', 'https://brave.cloudflare-dns.com/dns-query',\n 'https://dns.google/dns-query', 'https://8888.google/dns-query',\n 'https://dns64.dns.google/dns-query', 'https://dns.quad9.net/dns-query',\n 'https://dns9.quad9.net/dns-query', 'https://dns10.quad9.net/dns-query',\n 'https://dns11.quad9.net/dns-query', 'https://dns12.quad9.net/dns-query',\n 'https://dns.nextdns.io/dns-query', 'https://doh.opendns.com/dns-query',\n 'https://doh.familyshield.opendns.com/dns-query', 'https://doh.umbrella.com/dns-query',\n 'https://dns.adguard-dns.com/dns-query', 'https://unfiltered.adguard-dns.com/dns-query',\n 'https://family.adguard-dns.com/dns-query', 'https://doh.mullvad.net/dns-query',\n 'https://adblock.doh.mullvad.net/dns-query', 'https://base.dns.mullvad.net/dns-query',\n 'https://extended.dns.mullvad.net/dns-query', 'https://all.dns.mullvad.net/dns-query',\n 'https://family.dns.mullvad.net/dns-query', 'https://freedns.controld.com/p0',\n 'https://freedns.controld.com/p1', 'https://freedns.controld.com/p2',\n 'https://freedns.controld.com/p3', 'https://freedns.controld.com/family',\n 'https://freedns.controld.com/uncensored', 'https://sky.rethinkdns.com/dns-query',\n 'https://doh.cleanbrowsing.org/doh/security-filter/', 'https://doh.cleanbrowsing.org/doh/adult-filter/',\n 'https://doh.cleanbrowsing.org/doh/family-filter/', 'https://zero.dns0.eu/dns-query',\n 'https://kids.dns0.eu/dns-query', 'https://private.canadianshield.cira.ca/dns-query',\n 'https://protected.canadianshield.cira.ca/dns-query', 'https://family.canadianshield.cira.ca/dns-query',\n 'https://protective.joindns4.eu/dns-query', 'https://child.joindns4.eu/dns-query',\n 'https://noads.joindns4.eu/dns-query', 'https://child-noads.joindns4.eu/dns-query',\n 'https://unfiltered.joindns4.eu/dns-query', 'https://wikimedia-dns.org/dns-query',\n 'https://doh.wikimedia.org/dns-query', 'https://dns.switch.ch/dns-query',\n 'https://dns.digitale-gesellschaft.ch/dns-query', 'https://doh.libredns.gr/dns-query',\n 'https://doh.libredns.gr/noads', 'https://odvr.nic.cz/dns-query',\n 'https://doh.ffmuc.net/dns-query', 'https://doh.applied-privacy.net/query',\n 'https://dns.aa.net.uk/dns-query', 'https://dns.alidns.com/dns-query',\n 'https://dns.twnic.tw/dns-query', 'https://dns.pub/dns-query',\n 'https://doh.360.cn/dns-query', 'https://public.dns.iij.jp/dns-query',\n 'https://doh.dns.sb/dns-query', 'https://doh.pub/dns-query',\n 'https://ordns.he.net/dns-query', 'https://dns.brahma.world/dns-query',\n 'https://dns.cfiec.net/dns-query', 'https://dns.dnshome.de/dns-query',\n 'https://dnsforge.de/dns-query', 'https://clean.dnsforge.de/dns-query',\n 'https://hard.dnsforge.de/dns-query', 'https://doh-fi.blahdns.com/dns-query',\n 'https://doh-jp.blahdns.com/dns-query', 'https://doh-de.blahdns.com/dns-query',\n 'https://doh-sg.blahdns.com/dns-query', 'https://doh.centraleu.pi-dns.com/dns-query',\n 'https://doh.westus.pi-dns.com/dns-query', 'https://doh.eastus.pi-dns.com/dns-query',\n 'https://doh.northeu.pi-dns.com/dns-query', 'https://doh.tiar.app/dns-query',\n 'https://doh.tiarap.org/dns-query', 'https://jp.tiar.app/dns-query',\n 'https://jp.tiarap.org/dns-query', 'https://dns.containerpi.com/dns-query',\n 'https://dns.rubyfish.cn/dns-query', 'https://doh.armadillodns.net/dns-query',\n 'https://commons.host/dns-query', 'https://doh.crypto.sx/dns-query',\n 'https://dns.dnswarden.com/uncensored', 'https://resolver-eu.lelux.fi/dns-query',\n 'https://doh.bortzmeyer.fr/dns-query', 'https://dns.oszx.co/dns-query',\n 'https://ada.openbld.net/dns-query', 'https://ric.openbld.net/dns-query',\n 'https://luna.openbld.net/dns-query', 'https://fra01.dnscry.pt/dns-query',\n 'https://lon01.dnscry.pt/dns-query', 'https://nyc01.dnscry.pt/dns-query',\n 'https://par01.dnscry.pt/dns-query', 'https://ams01.dnscry.pt/dns-query',\n 'https://sin01.dnscry.pt/dns-query', 'https://syd01.dnscry.pt/dns-query',\n 'https://tok01.dnscry.pt/dns-query', 'https://sea01.dnscry.pt/dns-query',\n 'https://lax01.dnscry.pt/dns-query', 'https://anycast.uncensoreddns.org/dns-query',\n 'https://unicast.uncensoreddns.org/dns-query', 'https://dns.njal.la/dns-query',\n 'https://freedom.mydns.network/dns-query', 'https://paranoia.mydns.network/dns-query',\n 'https://adblock.mydns.network/dns-query', 'https://family.mydns.network/dns-query',\n 'https://dns.comss.one/dns-query', 'https://router.comss.one/dns-query',\n 'https://ca01.dns4me.net', 'https://ca02.dns4me.net',\n 'https://us01.dns4me.net', 'https://us02.dns4me.net',\n 'https://uk01.dns4me.net', 'https://au01.dns4me.net',\n 'https://sg01.dns4me.net', 'https://de01.dns4me.net',\n 'https://dnspub.restena.lu/dns-query', 'https://safeservedns.com/dns-query',\n 'https://dns.rabbitdns.org/dns-query', 'https://security.rabbitdns.org/dns-query',\n 'https://family.rabbitdns.org/dns-query', 'https://v.recipes/dns-query',\n 'https://v.recipes/dns-adblock', 'https://v.recipes/dns-ecs',\n 'https://dns.surfsharkdns.com/dns-query', 'https://dns.blokada.org/dns-query',\n 'https://root.hagezi.org/dns-query', 'https://wurzn.hagezi.org/dns-query',\n 'https://juuri.hagezi.org/dns-query', 'https://eu1.dns.lavate.ch/dns-query',\n 'https://doh.seby.io/dns-query', 'https://resolver1.absolight.net/dns-query',\n 'https://resolver2.absolight.net/dns-query', 'https://per.adfilter.net/dns-query',\n 'https://syd.adfilter.net/dns-query', 'https://adl.adfilter.net/dns-query',\n 'https://ns0.fdn.fr/dns-query', 'https://ns1.fdn.fr/dns-query',\n 'https://dns.technitium.com/dns-query', 'https://dns.telekom.de/dns-query',\n 'https://dns.aquilenet.fr/dns-query', 'https://doh.lacontrevoie.fr/dns-query',\n 'https://dns.belnet.be/dns-query', 'https://dns1.in-berlin.de/dns-query',\n 'https://dns2.in-berlin.de/dns-query', 'https://resolver.dnsprivacy.org.uk/dns-query',\n 'https://resolver.sunet.se/dns-query', 'https://ns1.opennameserver.org/dns-query',\n 'https://dns.froth.zone/dns-query', 'https://dns.stormycloud.org/dns-query',\n 'https://adfree.usableprivacy.net/dns-query', 'https://doh.dns4all.eu/dns-query',\n 'https://dns.smartguard.io/dns-query', 'https://privacy.plumedns.com/dns-query',\n 'https://dns.bitdefender.net/dns-query', 'https://dns.cctld.kg/dns-query',\n 'https://doh.lv/dns-query', 'https://doh.nic.lv/dns-query',\n 'https://japan.dnsovertor.cc/dns-query', 'https://chuncheon.dnsovertor.cc/dns-query',\n 'https://seoul.dnsovertor.cc/dns-query', 'https://dns.cert.ee/dns-query',\n 'https://secure.hafnova.com/dns-query', 'https://dns.kescher.at/dns-query',\n 'https://ibuki.cgnat.net/dns-query', 'https://doh.li/dns-query',\n 'https://dns4eu.online/dns-query', 'https://dns.elemental.software/dns-query',\n 'https://doth.huque.com/dns-query', 'https://zdn.ro/dns-query',\n 'https://doh.zknt.org/dns-query', 'https://ns2.4netguides.org/dns-query',\n 'https://dukun.de/dns-query', 'https://dns.cynthialabs.net/dns-query'\n];\n\nconst RESOLVER_PROFILES = {\n // General mode: no separation. /dns-query uses this full pool by default.\n all: ALL_DNS_UPSTREAMS,\n\n // Optional separated profiles are still available for users who want predictable policy behavior.\n default: [\n 'https://cloudflare-dns.com/dns-query',\n 'https://1.1.1.1/dns-query',\n 'https://1.0.0.1/dns-query',\n 'https://mozilla.cloudflare-dns.com/dns-query',\n 'https://brave.cloudflare-dns.com/dns-query',\n 'https://dns.google/dns-query',\n 'https://8888.google/dns-query',\n 'https://dns.quad9.net/dns-query',\n 'https://dns11.quad9.net/dns-query',\n 'https://doh.mullvad.net/dns-query',\n 'https://base.dns.mullvad.net/dns-query',\n 'https://unfiltered.adguard-dns.com/dns-query',\n 'https://freedns.controld.com/p0',\n 'https://freedns.controld.com/uncensored',\n 'https://wikimedia-dns.org/dns-query',\n 'https://doh.wikimedia.org/dns-query',\n 'https://dns.switch.ch/dns-query',\n 'https://odvr.nic.cz/dns-query'\n ],\n\n security: [\n 'https://security.cloudflare-dns.com/dns-query',\n 'https://dns.quad9.net/dns-query',\n 'https://dns9.quad9.net/dns-query',\n 'https://dns10.quad9.net/dns-query',\n 'https://dns11.quad9.net/dns-query',\n 'https://dns12.quad9.net/dns-query',\n 'https://protected.canadianshield.cira.ca/dns-query',\n 'https://doh.cleanbrowsing.org/doh/security-filter/',\n 'https://zero.dns0.eu/dns-query',\n 'https://protective.joindns4.eu/dns-query',\n 'https://safeservedns.com/dns-query',\n 'https://security.rabbitdns.org/dns-query',\n 'https://dns.bitdefender.net/dns-query',\n 'https://dns.cert.ee/dns-query'\n ],\n\n family: [\n 'https://family.cloudflare-dns.com/dns-query',\n 'https://family.adguard-dns.com/dns-query',\n 'https://doh.familyshield.opendns.com/dns-query',\n 'https://freedns.controld.com/family',\n 'https://doh.cleanbrowsing.org/doh/adult-filter/',\n 'https://doh.cleanbrowsing.org/doh/family-filter/',\n 'https://kids.dns0.eu/dns-query',\n 'https://family.canadianshield.cira.ca/dns-query',\n 'https://child.joindns4.eu/dns-query',\n 'https://child-noads.joindns4.eu/dns-query',\n 'https://family.dns.mullvad.net/dns-query',\n 'https://family.mydns.network/dns-query',\n 'https://family.rabbitdns.org/dns-query'\n ],\n\n adblock: [\n 'https://dns.adguard-dns.com/dns-query',\n 'https://adblock.doh.mullvad.net/dns-query',\n 'https://doh.libredns.gr/noads',\n 'https://noads.joindns4.eu/dns-query',\n 'https://child-noads.joindns4.eu/dns-query',\n 'https://adblock.mydns.network/dns-query',\n 'https://dns.blokada.org/dns-query',\n 'https://root.hagezi.org/dns-query',\n 'https://wurzn.hagezi.org/dns-query',\n 'https://juuri.hagezi.org/dns-query',\n 'https://v.recipes/dns-adblock',\n 'https://adfree.usableprivacy.net/dns-query'\n ],\n\n dns64: [\n 'https://dns64.cloudflare-dns.com/dns-query',\n 'https://dns64.dns.google/dns-query'\n ]\n};\n\nconst APP_STATE = {\n resolversByProfile: buildResolverState(RESOLVER_PROFILES),\n cache: new Map(),\n throttle: new Map()\n};\n\nfunction buildResolverState(profiles) {\n const state = {};\n\n for (const [profile, urls] of Object.entries(profiles)) {\n state[profile] = urls.map((url) => ({\n url,\n score: CONFIG.SCORE_START,\n ok: 0,\n fail: 0,\n timeout: 0,\n lastLatencyMs: null,\n lastError: null\n }));\n }\n\n return state;\n}\n\nexport default {\n async fetch(req, env, ctx) {\n const url = new URL(req.url);\n const clientIP = getClientIP(req);\n\n if (url.pathname === CONFIG.DNS_PATH) {\n if (checkSpam(clientIP)) {\n return textResponse('Rate limit exceeded', 429, {\n 'cache-control': 'no-store'\n });\n }\n\n return handleDNS(req, url);\n }\n\n if (url.pathname === '/health') {\n return jsonResponse(getHealthSnapshot(), 200, {\n 'cache-control': 'no-store'\n });\n }\n\n if (url.pathname === '/' || url.pathname === '/index.html') {\n return renderUI(url.host);\n }\n\n return textResponse('Not found', 404);\n }\n};\n\nasync function handleDNS(req, url) {\n const methodError = validateMethod(req.method);\n if (methodError) return methodError;\n\n let payload;\n\n try {\n payload = await readDNSPayload(req, url);\n } catch (err) {\n return textResponse(err.message || 'Invalid DNS query', err.status || 400, {\n 'cache-control': 'no-store'\n });\n }\n\n if (!payload || payload.byteLength === 0) {\n return textResponse('Empty DNS query', 400, { 'cache-control': 'no-store' });\n }\n\n if (payload.byteLength > CONFIG.MAX_DNS_MESSAGE_BYTES) {\n return textResponse('DNS message too large', 413, { 'cache-control': 'no-store' });\n }\n\n const parsed = parseDNSQuestion(payload);\n if (!parsed.ok) {\n return textResponse(parsed.error, 400, { 'cache-control': 'no-store' });\n }\n\n const profile = pickProfile(url);\n const resolvers = APP_STATE.resolversByProfile[profile] || APP_STATE.resolversByProfile[CONFIG.DEFAULT_PROFILE];\n const cacheKey = await makeCacheKey(profile, parsed.questionKey);\n const hit = getCache(cacheKey);\n\n if (hit) {\n const responseBody = patchDNSResponseID(hit.body, parsed.id);\n return dnsResponse(responseBody, {\n 'x-cache': 'HIT',\n 'x-profile': profile\n });\n }\n\n const racers = selectRacers(resolvers);\n\n try {\n const winner = await raceResolvers(racers, payload, parsed.id);\n\n if (isCacheableDNSResponse(winner.body)) {\n setCache(cacheKey, normalizeDNSResponseID(winner.body), CONFIG.CACHE_TTL_SECONDS);\n }\n\n return dnsResponse(winner.body, {\n 'x-cache': 'MISS',\n 'x-profile': profile,\n 'x-winner': sanitizeHeaderValue(winner.url),\n 'x-winner-lat': `${winner.latencyMs}ms`\n });\n } catch (err) {\n return textResponse('Global resolving failed', 502, {\n 'cache-control': 'no-store',\n 'x-profile': profile\n });\n }\n}\n\nfunction validateMethod(method) {\n if (method !== 'GET' && method !== 'POST') {\n return textResponse('Method not allowed', 405, {\n allow: 'GET, POST',\n 'cache-control': 'no-store'\n });\n }\n\n return null;\n}\n\nasync function readDNSPayload(req, url) {\n if (req.method === 'GET') {\n const q = url.searchParams.get('dns');\n if (!q) throw httpError('Missing dns query parameter', 400);\n return decodeBase64Url(q);\n }\n\n const contentType = req.headers.get('content-type') || '';\n if (!contentType.toLowerCase().includes('application/dns-message')) {\n throw httpError('POST requires content-type: application/dns-message', 415);\n }\n\n return new Uint8Array(await req.arrayBuffer());\n}\n\nfunction decodeBase64Url(input) {\n if (!/^[A-Za-z0-9_-]+$/.test(input)) {\n throw httpError('Invalid base64url DNS query', 400);\n }\n\n let normalized = input.replace(/-/g, '+').replace(/_/g, '/');\n normalized += '='.repeat((4 - (normalized.length % 4)) % 4);\n\n try {\n return Uint8Array.from(atob(normalized), (c) => c.charCodeAt(0));\n } catch (_) {\n throw httpError('Invalid base64url DNS query', 400);\n }\n}\n\nfunction parseDNSQuestion(packet) {\n const bytes = packet instanceof Uint8Array ? packet : new Uint8Array(packet);\n\n if (bytes.byteLength < 12) {\n return { ok: false, error: 'DNS message too short' };\n }\n\n const id = (bytes[0] << 8) | bytes[1];\n const flags = (bytes[2] << 8) | bytes[3];\n const qdcount = (bytes[4] << 8) | bytes[5];\n\n if ((flags & 0x8000) !== 0) {\n return { ok: false, error: 'DNS query expected, got response' };\n }\n\n if (qdcount !== 1) {\n return { ok: false, error: 'Exactly one DNS question is required' };\n }\n\n let offset = 12;\n const labels = [];\n\n while (offset < bytes.length) {\n const len = bytes[offset++];\n\n if (len === 0) break;\n\n if ((len & 0xc0) !== 0) {\n return { ok: false, error: 'Compressed question names are not accepted' };\n }\n\n if (len > 63 || offset + len > bytes.length) {\n return { ok: false, error: 'Invalid DNS question name' };\n }\n\n let label = '';\n for (let i = 0; i < len; i++) {\n const ch = bytes[offset++];\n label += String.fromCharCode(ch).toLowerCase();\n }\n\n labels.push(label);\n }\n\n if (offset + 4 > bytes.length) {\n return { ok: false, error: 'Incomplete DNS question' };\n }\n\n const qtype = (bytes[offset] << 8) | bytes[offset + 1];\n const qclass = (bytes[offset + 2] << 8) | bytes[offset + 3];\n const qname = labels.join('.') || '.';\n\n return {\n ok: true,\n id,\n qname,\n qtype,\n qclass,\n questionKey: `${qname}|${qtype}|${qclass}`\n };\n}\n\nfunction normalizeDNSResponseID(responseBuffer) {\n const bytes = new Uint8Array(responseBuffer);\n const copy = new Uint8Array(bytes.length);\n copy.set(bytes);\n copy[0] = 0;\n copy[1] = 0;\n return copy.buffer;\n}\n\nfunction patchDNSResponseID(responseBuffer, queryID) {\n const bytes = new Uint8Array(responseBuffer);\n const copy = new Uint8Array(bytes.length);\n copy.set(bytes);\n copy[0] = (queryID >> 8) & 0xff;\n copy[1] = queryID & 0xff;\n return copy.buffer;\n}\n\nfunction isCacheableDNSResponse(responseBuffer) {\n const bytes = new Uint8Array(responseBuffer);\n\n if (bytes.length < 12) return false;\n\n const flags = (bytes[2] << 8) | bytes[3];\n const isResponse = (flags & 0x8000) !== 0;\n const rcode = flags & 0x000f;\n\n if (!isResponse) return false;\n\n // Cache NOERROR and NXDOMAIN only. Avoid caching SERVFAIL, REFUSED, etc.\n return rcode === 0 || rcode === 3;\n}\n\nfunction pickProfile(url) {\n const raw = (url.searchParams.get('profile') || CONFIG.DEFAULT_PROFILE).toLowerCase();\n return APP_STATE.resolversByProfile[raw] ? raw : CONFIG.DEFAULT_PROFILE;\n}\n\nfunction selectRacers(resolvers) {\n return [...resolvers]\n .sort((a, b) => {\n if (b.score !== a.score) return b.score - a.score;\n const aLat = a.lastLatencyMs ?? Number.MAX_SAFE_INTEGER;\n const bLat = b.lastLatencyMs ?? Number.MAX_SAFE_INTEGER;\n return aLat - bLat;\n })\n .slice(0, Math.max(1, Math.min(CONFIG.RACE_COUNT, resolvers.length)));\n}\n\nasync function raceResolvers(nodes, packet, expectedID) {\n const controllers = nodes.map(() => new AbortController());\n\n try {\n const attempts = nodes.map((node, index) => relay(node, packet, expectedID, controllers[index].signal));\n const winner = await Promise.any(attempts);\n\n for (const controller of controllers) {\n controller.abort('winner-selected');\n }\n\n return winner;\n } finally {\n for (const controller of controllers) {\n controller.abort('race-finished');\n }\n }\n}\n\nasync function relay(node, packet, expectedID, signal) {\n const started = Date.now();\n const timeoutController = new AbortController();\n const timeout = setTimeout(() => timeoutController.abort('timeout'), CONFIG.UPSTREAM_TIMEOUT_MS);\n const combinedSignal = anySignal([signal, timeoutController.signal]);\n\n try {\n const res = await fetch(node.url, {\n method: 'POST',\n headers: {\n accept: 'application/dns-message',\n 'content-type': 'application/dns-message'\n },\n body: packet,\n signal: combinedSignal\n });\n\n if (!res.ok) {\n penalize(node, CONFIG.SCORE_FAILURE_DELTA, `HTTP ${res.status}`);\n throw new Error(`Upstream HTTP ${res.status}`);\n }\n\n const body = await res.arrayBuffer();\n const validation = validateDNSResponse(body, expectedID);\n\n if (!validation.ok) {\n penalize(node, CONFIG.SCORE_FAILURE_DELTA, validation.error);\n throw new Error(validation.error);\n }\n\n const latencyMs = Date.now() - started;\n reward(node, latencyMs);\n\n return {\n url: node.url,\n body,\n latencyMs\n };\n } catch (err) {\n const message = String(err && err.message ? err.message : err);\n\n if (message.includes('abort') || message.includes('timeout') || timeoutController.signal.aborted) {\n node.timeout += 1;\n penalize(node, CONFIG.SCORE_TIMEOUT_DELTA, 'timeout');\n } else {\n penalize(node, CONFIG.SCORE_FAILURE_DELTA, message);\n }\n\n throw err;\n } finally {\n clearTimeout(timeout);\n }\n}\n\nfunction validateDNSResponse(responseBuffer, expectedID) {\n const bytes = new Uint8Array(responseBuffer);\n\n if (bytes.length < 12) return { ok: false, error: 'Upstream returned short DNS response' };\n\n const id = (bytes[0] << 8) | bytes[1];\n const flags = (bytes[2] << 8) | bytes[3];\n\n if (id !== expectedID) return { ok: false, error: 'Upstream response ID mismatch' };\n if ((flags & 0x8000) === 0) return { ok: false, error: 'Upstream returned a DNS query, not response' };\n\n return { ok: true };\n}\n\nfunction anySignal(signals) {\n const controller = new AbortController();\n\n function abortFrom(signal) {\n if (!controller.signal.aborted) {\n controller.abort(signal.reason || 'aborted');\n }\n }\n\n for (const signal of signals) {\n if (!signal) continue;\n if (signal.aborted) {\n abortFrom(signal);\n break;\n }\n signal.addEventListener('abort', () => abortFrom(signal), { once: true });\n }\n\n return controller.signal;\n}\n\nfunction reward(node, latencyMs) {\n node.ok += 1;\n node.lastLatencyMs = latencyMs;\n node.lastError = null;\n node.score = clamp(node.score + CONFIG.SCORE_SUCCESS_DELTA, CONFIG.SCORE_MIN, CONFIG.SCORE_MAX);\n}\n\nfunction penalize(node, amount, error) {\n node.fail += 1;\n node.lastError = String(error || 'unknown').slice(0, 80);\n node.score = clamp(node.score - amount, CONFIG.SCORE_MIN, CONFIG.SCORE_MAX);\n}\n\nasync function makeCacheKey(profile, questionKey) {\n const input = `${profile}|${questionKey}`;\n const bytes = new TextEncoder().encode(input);\n const digest = await crypto.subtle.digest('SHA-256', bytes);\n return [...new Uint8Array(digest)].map((x) => x.toString(16).padStart(2, '0')).join('');\n}\n\nfunction getCache(key) {\n const item = APP_STATE.cache.get(key);\n if (!item) return null;\n\n if (Date.now() > item.expiresAt) {\n APP_STATE.cache.delete(key);\n return null;\n }\n\n // Simple LRU behavior: refresh insertion order on hit.\n APP_STATE.cache.delete(key);\n APP_STATE.cache.set(key, item);\n return item;\n}\n\nfunction setCache(key, body, ttlSeconds) {\n APP_STATE.cache.set(key, {\n body,\n expiresAt: Date.now() + ttlSeconds * 1000\n });\n\n trimMap(APP_STATE.cache, CONFIG.MAX_CACHE_ENTRIES);\n}\n\nfunction checkSpam(ip) {\n const now = Date.now();\n const current = APP_STATE.throttle.get(ip);\n let stats = current || { count: 0, resetAt: now + CONFIG.RATE_LIMIT_WINDOW_MS };\n\n if (now > stats.resetAt) {\n stats = { count: 0, resetAt: now + CONFIG.RATE_LIMIT_WINDOW_MS };\n }\n\n stats.count += 1;\n APP_STATE.throttle.set(ip, stats);\n\n trimMap(APP_STATE.throttle, CONFIG.MAX_THROTTLE_ENTRIES);\n\n return stats.count > CONFIG.RATE_LIMIT_MAX_REQUESTS;\n}\n\nfunction trimMap(map, maxEntries) {\n while (map.size > maxEntries) {\n const oldestKey = map.keys().next().value;\n map.delete(oldestKey);\n }\n}\n\nfunction getClientIP(req) {\n return req.headers.get('CF-Connecting-IP')\n || req.headers.get('x-forwarded-for')?.split(',')[0]?.trim()\n || 'unknown';\n}\n\nfunction getHealthSnapshot() {\n const profiles = {};\n\n for (const [profile, nodes] of Object.entries(APP_STATE.resolversByProfile)) {\n profiles[profile] = nodes.map((node) => ({\n url: node.url,\n score: node.score,\n ok: node.ok,\n fail: node.fail,\n timeout: node.timeout,\n lastLatencyMs: node.lastLatencyMs,\n lastError: node.lastError\n }));\n }\n\n return {\n version: VERSION,\n cacheEntries: APP_STATE.cache.size,\n throttleEntries: APP_STATE.throttle.size,\n profiles\n };\n}\n\nfunction dnsResponse(body, extraHeaders = {}) {\n return new Response(body, {\n status: 200,\n headers: {\n 'content-type': 'application/dns-message',\n 'cache-control': 'no-store',\n ...extraHeaders\n }\n });\n}\n\nfunction textResponse(text, status = 200, headers = {}) {\n return new Response(text, {\n status,\n headers: {\n 'content-type': 'text/plain; charset=utf-8',\n ...headers\n }\n });\n}\n\nfunction jsonResponse(data, status = 200, headers = {}) {\n return new Response(JSON.stringify(data, null, 2), {\n status,\n headers: {\n 'content-type': 'application/json; charset=utf-8',\n ...headers\n }\n });\n}\n\nfunction httpError(message, status) {\n const err = new Error(message);\n err.status = status;\n return err;\n}\n\nfunction clamp(value, min, max) {\n return Math.max(min, Math.min(max, value));\n}\n\nfunction sanitizeHeaderValue(value) {\n return String(value).replace(/[\\r\\n]/g, '').slice(0, 200);\n}\n\nfunction escapeHtml(value) {\n return String(value).replace(/[&<>\"']/g, (ch) => ({\n '&': '&',\n '<': '<',\n '>': '>',\n '\"': '"',\n \"'\": '''\n }[ch]));\n}\n\nfunction renderUI(host) {\n const safeHost = escapeHtml(host);\n const endpoint = `https://${safeHost}${CONFIG.DNS_PATH}`;\n\n return new Response(`\n\n\n \n \n Secure DNS over HTTPS (DoH) Pro\n 🛡️\">\n \n \n\n\n\n \n

\n \n \n

\n\n

Secure DNS over HTTPS

Edge Resolve Network • 8-Way Concurrent Racing

\n\n

\n Endpoint URL\n \n

\n \n

\n\n \n

\n \n\n

\n \n

Setup for Chromium Browsers

1. Open Browser Settings and type \"DNS\" in the search box.

2. Select Security > Scroll to Use Secure DNS.

3. Choose \"With Custom\" provider.

4. Paste your Neptune URL from the copy-box above.

5. Test by visiting a DNS-restricted website.

\n\n \n

Setup for Firefox

1. Open Firefox Settings and scroll down to Network Settings.

2. Click Settings... and check \"Enable DNS over HTTPS\" at the bottom.

3. Set provider to Custom and paste your unique URL.

4. Select \"Max Protection\" for stronger browser-level DNS privacy.

\n\n \n

Android / iOS Logic

This resolver is a DoH (HTTPS-based) service, which modern phones handle differently than system-wide settings.

A) For Mobile Browsers: Open Browser settings (Chrome/Firefox/Edge) on your phone and follow the desktop steps. This is the best and fastest way.

B) For System-wide Apps: We recommend using RethinkDNS or Intra apps. In these apps, set the DNS type to DoH and provide your unique Neptune link.

\n\n \n

\n ⭐ Why ONLY Browser-level DOH? (Crucial Tip)\n

Most operating systems (Windows settings, Android \"Private DNS\", or Apple Profiles) natively expect DNS-over-TLS (DoT) which runs on Port 853. Since this worker is built on Cloudflare Edge (Serverless), it strictly provides DNS-over-HTTPS (DoH) running on Port 443.

The Issue: You cannot paste an https:// link into many native DNS settings. It will usually result in an \"Invalid Hostname\" error. Systems there expect a simple domain, but this service requires the full path for HTTPS resolution.

The Solution: Browsers (Chrome, Edge, Firefox) have their own independent DoH clients. They are compatible with Port 443 workers and provide browser-level encrypted DNS. DoH encrypts DNS queries between your browser and this endpoint, but it does not hide destination IPs or guarantee bypass on every network.

\n\n \n

\n\n \n\n`, {\n status: 200,\n headers: {\n 'content-type': 'text/html; charset=utf-8',\n 'cache-control': 'no-store',\n 'x-content-type-options': 'nosniff',\n 'referrer-policy': 'no-referrer'\n }\n });\n}","deleted",false,"label",[35],{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":57,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_58":59,"_18":60},["D",1781023965888],"children",[],[35],"d723f20e-f7b2-4f5f-8e1f-e120b757e186",["D",1781023644111],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","userId","21a9ec73-655f-46b9-b09c-1662761e5b8c","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019ead46-263e-74ae-9324-90882b4b45b3","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_113":19},"org",{"_11":12,"_108":19,"_109":19,"_70":71,"_110":111,"_112":53},"branch",{"_17":42,"_13":16,"_33":40,"_100":61,"_101":-5,"_102":-5,"_103":-5,"_104":-5,"_105":-5,"_106":14,"_107":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_33":61,"_13":14,"_45":147,"_63":-5,"_64":53,"_65":66,"_67":66,"_68":19,"_69":-5,"_70":71,"_72":-5,"_73":53,"_74":-5,"_75":-5,"_76":77,"_78":79,"_80":-5,"_81":-5,"_82":-5,"_83":-5,"_84":85,"_86":85,"_87":88,"_89":88,"_90":88,"_91":85,"_92":85,"_93":148,"_95":149,"_97":150,"_99":53},[144],"files",[144],"counts",{"_134":77,"_135":136,"_137":77,"_31":138,"_139":140},[132],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_18":133},[35],"pulls","branches",1,"forks",{"_141":77,"_143":77},"connections",{"_141":77,"_142":77},"count","unfilledCount","emptyCount",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":57,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_58":145,"_18":146},[],[35],["D",1781023644111],{"_11":12,"_113":19},{"_11":12,"_108":19,"_109":19,"_70":71,"_110":111,"_112":53},{"_17":42,"_13":16,"_33":40,"_100":61,"_101":-5,"_102":-5,"_103":-5,"_104":-5,"_105":-5,"_106":14,"_107":12},"ctx",{"_93":-5,"_129":184,"_185":186,"_187":188,"_189":53,"_190":53,"_191":53,"_192":44,"_193":-5,"_194":-7,"_195":-7,"_196":77,"_197":53,"_198":53,"_199":-5,"_200":53,"_201":53,"_202":53,"_203":-5},"ENV",{"_155":156,"_157":158,"_159":16,"_160":161,"_162":163,"_164":165,"_166":167,"_168":169,"_170":171,"_172":173,"_174":175,"_176":177,"_178":179,"_180":181,"_182":183},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]