@browsercore/profiles 0.1.4 → 0.1.9

package/README.md

@@ -1,15 +1,14 @@
 # @browsercore/profiles
 
-
 [![npm version](https://img.shields.io/npm/v/@browsercore/profiles)](https://www.npmjs.com/package/@browsercore/profiles)
-[![coverage](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/jverneuer/browsercore-profiles/main/coverage/badge.json)](https://github.com/jverneuer/browsercore-profiles/blob/main/COVERAGE.md)
+[![coverage](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/jverneuer/browsercore-profiles/coverage/coverage/badge.json)](https://github.com/jverneuer/browsercore-profiles/blob/main/COVERAGE.md)
 [![lint](https://img.shields.io/github/actions/workflow/status/jverneuer/browsercore-profiles/ci.yml?label=lint)](https://github.com/jverneuer/browsercore-profiles/actions/workflows/ci.yml)
 
-Browser fingerprint definitions (TLS / HTTP/2 / HTTP/1.1). Pure data — no protocol implementation.
+Browser fingerprint definitions (TLS / HTTP/2 / HTTP/1.1). Pure data — no protocol implementation lives here. Higher layers read these definitions and translate them into bytes, header order, and SETTINGS frames.
 
 ## Responsibility
 
-Define WHAT a browser fingerprint looks like so that higher layers (tls, http1, http2) can translate it into bytes, header order, and SETTINGS frames. Adding a new Chrome version means adding a new entry here — protocol implementations never change.
+Define WHAT a browser fingerprint looks like: ordered cipher suites, TLS extension order, GREASE behavior, HTTP/2 SETTINGS, and HTTP/1.1 header order. Adding a new Chrome version means adding a new entry here — protocol implementations never change.
 
 ## What it does NOT know about
 
@@ -18,34 +17,64 @@ Define WHAT a browser fingerprint looks like so that higher layers (tls, http1,
 - Sockets or I/O
 - Cookies
 
-## Public API
+## Install
+
+```bash
+npm install @browsercore/profiles
+```
+
+## Quick usage
 
 ```ts
 import { getProfile, listProfiles, registerProfile } from "@browsercore/profiles";
+import type { ProfileId } from "@browsercore/profiles";
 
 const chrome = getProfile("chrome-140" as ProfileId);
 console.log(chrome.tls.cipherSuites); // ordered cipher list
-console.log(chrome.http2.settings);   // HTTP/2 SETTINGS frame values
+console.log(chrome.http2.settings); // HTTP/2 SETTINGS frame values
 
-const all = listProfiles(); // ["chrome-120", "chrome-128", ...]
+const all = listProfiles(); // ["chrome-120", "chrome-128", ...] — insertion order
 
 registerProfile(myCustomProfile); // extensibility hook
 ```
 
-## Types
+## Public API
 
 | Export | Kind | Purpose |
 | --- | --- | --- |
+| `getProfile()` | function | Look up a profile by id (throws `UnknownProfileError` if absent) |
+| `listProfiles()` | function | List every registered id, in insertion order |
+| `registerProfile()` | function | Register or overwrite a custom profile at runtime |
+| `diffProfiles()` | function | Field-by-field diff of two profiles, reporting each differing path |
+| `DiffOptions` | interface | Diff tuning (e.g. order-sensitive vs. multiset array comparison) |
+| `ProfileDiff` | interface | A single difference located by its dotted path |
+| `buildExpectedClientHello()` | function | Project a profile's TLS fields onto expected wire codes |
+| `validateProfileAgainstCapture()` | function | Validate a profile against a captured ClientHello |
+| `ValidationResult` | interface | `{ ok, diffs }` outcome of validation |
+| `TlsCapture` | interface | A captured ClientHello parsed out of a packet capture |
+| `ClientHelloExpected` | interface | The wire values a profile's ClientHello should carry |
 | `BrowserProfile` | interface | Complete fingerprint across TLS + HTTP/2 + HTTP/1.1 |
 | `TlsProfile` | interface | Cipher order, extensions, GREASE, signature algorithms |
 | `Http2Profile` | interface | SETTINGS, window sizes, priority |
+| `Http2Settings` | interface | HTTP/2 numeric settings (RFC 9113 §6.5.1) |
+| `Http2Priority` | interface | Stream priority descriptor |
 | `Http1Profile` | interface | Default headers, header order, accept-encoding |
-| `ProfileId` | branded string | Opaque profile identifier |
+| `ProfileId` | branded type | Opaque profile identifier (`"chrome-140"`) |
 | `ProfileName` | literal union | `"chrome" \| "firefox" \| "safari" \| "edge"` |
-| `getProfile()` | function | Look up a profile by id |
-| `listProfiles()` | function | List all registered ids |
-| `registerProfile()` | function | Add a custom profile at runtime |
+| `ChromeProfiles` / `FirefoxProfiles` / `SafariProfiles` / `EdgeProfiles` | const maps | Per-browser profile definitions |
+| `assertNever()` | function | Exhaustiveness check for switches over unions |
+| `ProfileError` | class | Base typed error (matched on `kind`) |
 | `UnknownProfileError` | class | Thrown when a profile id is not found |
+| `ValidationError` | class | Thrown on an unknown profile value or bad capture |
+
+## Shipped profiles
+
+| Browser | Profiles |
+| --- | --- |
+| Chrome | `chrome-120`, `chrome-128`, `chrome-140` |
+| Firefox | `firefox-120`, `firefox-128`, `firefox-135` |
+| Safari | `safari-17`, `safari-18` |
+| Edge | `edge-120`, `edge-128` |
 
 ## Dependency graph
 
@@ -53,4 +82,73 @@ registerProfile(myCustomProfile); // extensibility hook
 @browsercore/profiles
 ```
 
-No other `@browsercore/*` packages and no Node built-ins are imported. This is a pure data package.
+No other `@browsercore/*` runtime packages and no Node built-ins are imported. This is a pure data package. `@browsercore/dev` is a dev-only dependency that supplies shared build / lint / test configuration (see [Shared config](#shared-config)).
+
+## Source layout
+
+```
+src/
+├─ index.ts            Public API surface — re-exports from the rest of the package
+├─ index.internal.ts   Barrel re-exporting the per-browser profile maps
+├─ registry.ts         getProfile / listProfiles / registerProfile (Map-backed)
+├─ diff.ts             diffProfiles — field-by-field diff of two profiles
+├─ validate.ts         buildExpectedClientHello / validateProfileAgainstCapture
+├─ codes.ts            IANA TLS registry codes (cipher suites, groups, versions, sig schemes)
+├─ errors.ts           ProfileError / UnknownProfileError / ValidationError
+├─ types.ts            BrowserProfile + per-layer profile interfaces
+├─ utils.ts            assertNever / createId
+└─ profiles/           Per-browser profile definitions
+   ├─ chrome.ts        chrome-120, chrome-128, chrome-140
+   ├─ firefox.ts       firefox-120, firefox-128, firefox-135
+   ├─ safari.ts        safari-17, safari-18
+   └─ edge.ts          edge-120, edge-128
+```
+
+## Development
+
+Requires **Node >= 26**. ESM only (`"type": "module"`).
+
+```sh
+npm install      # installs @browsercore/dev (file:../dev) + siblings
+npm run build    # tsc -p tsconfig.build.json (emit to dist/)
+npm run typecheck
+npm run lint     # oxlint --type-aware src/
+npm test         # vitest run
+```
+
+Run a single test file:
+
+```sh
+npx vitest run tests/profiles.test.ts
+```
+
+Run tests by name pattern:
+
+```sh
+npx vitest run -t "returns a known Chrome profile by id"
+```
+
+Generate a coverage report:
+
+```sh
+npm test -- --coverage
+node ../dev/bin/coverage-md.mjs   # writes COVERAGE.md + coverage/badge.json
+```
+
+### Shared config
+
+This package adopts `@browsercore/dev`, the shared config package for the
+`@browsercore/*` family. Configuration is centralized — this repo only wires it in:
+
+| Concern | Mechanism |
+| --- | --- |
+| TypeScript strict flags | `tsconfig.json` extends `@browsercore/dev/tsconfig.base.json` |
+| Vitest config | `vitest.config.ts` calls `definePackageConfig({ name: "profiles" })` |
+| Oxlint config | `oxlint.config.ts` extends `@browsercore/dev/oxlint` |
+| Coverage report | `coverage-md` bin from `@browsercore/dev` |
+
+`@browsercore/dev` is declared as a devDependency via `"@browsercore/dev": "file:../dev"`.
+
+## License
+
+MIT

package/dist/codes.d.ts

@@ -0,0 +1,40 @@
+/**
+ * IANA TLS registry codes used to project profile names onto wire values.
+ *
+ * These are the canonical 2-byte codes from the IANA TLS parameter registries.
+ * Only the codes referenced by the shipped profiles are mapped here — an
+ * unknown name is a bug in a profile definition and surfaces as a
+ * {@link ValidationError} at projection time, so the tables double as an
+ * allow-list that keeps profile data honest.
+ *
+ * Registries:
+ *   - Cipher suites: tls-parameters.xhtml#tls-parameters-4
+ *   - Named groups:   tls-parameters.xhtml#tls-parameters-8
+ *   - Signature schemes: tls-parameters.xhtml#tls-parameters-16
+ */
+/**
+ * The name Chrome/Edge use in their cipher list to mark a GREASE slot (RFC 8701).
+ * The real value is randomized per-connection (0x0a0a..0xfafa); validation accepts
+ * any GREASE-pattern byte pair at a slot marked with this placeholder.
+ */
+export declare const CIPHER_GREASE_PLACEHOLDER = "TLS_GREASE_RESERVED_0";
+/** Selected IANA TLS Cipher Suite codes, keyed by the canonical suite name used in profiles. */
+export declare const CIPHER_SUITE_CODES: Readonly<Record<string, number>>;
+/** Selected IANA TLS Supported Groups (named groups) codes. */
+export declare const NAMED_GROUP_CODES: Readonly<Record<string, number>>;
+/** Selected IANA TLS SignatureScheme codes. */
+export declare const SIGNATURE_SCHEME_CODES: Readonly<Record<string, number>>;
+/** IANA TLS ProtocolVersion codes for the supported_versions extension. */
+export declare const VERSION_CODES: Readonly<Record<string, number>>;
+/**
+ * Map a cipher-suite name to its 2-byte IANA wire code.
+ *
+ * This is the single projection seam from a profile's cipher name to the bytes
+ * a ClientHello carries. It throws on an unknown name rather than returning a
+ * sentinel: 0x0000 would be ambiguous (it collides with
+ * TLS_EMPTY_RENEGOTIATION_INFO_SCSV), and a silent default would hide a bug in
+ * a profile definition. An unknown name is therefore always an error here,
+ * never a 0x0000 fallback.
+ */
+export declare function cipherSuiteToWire(name: string): number;
+//# sourceMappingURL=codes.d.ts.map

package/dist/codes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codes.d.ts","sourceRoot":"","sources":["../src/codes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,0BAA0B,CAAC;AAEjE,gGAAgG;AAChG,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAkC/D,CAAC;AAEF,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAY9D,CAAC;AAEF,+CAA+C;AAC/C,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAanE,CAAC;AAEF,2EAA2E;AAC3E,eAAO,MAAM,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAK1D,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMtD"}

package/dist/codes.js

@@ -0,0 +1,111 @@
+/**
+ * IANA TLS registry codes used to project profile names onto wire values.
+ *
+ * These are the canonical 2-byte codes from the IANA TLS parameter registries.
+ * Only the codes referenced by the shipped profiles are mapped here — an
+ * unknown name is a bug in a profile definition and surfaces as a
+ * {@link ValidationError} at projection time, so the tables double as an
+ * allow-list that keeps profile data honest.
+ *
+ * Registries:
+ *   - Cipher suites: tls-parameters.xhtml#tls-parameters-4
+ *   - Named groups:   tls-parameters.xhtml#tls-parameters-8
+ *   - Signature schemes: tls-parameters.xhtml#tls-parameters-16
+ */
+import { ProfileError } from "./errors.js";
+/**
+ * The name Chrome/Edge use in their cipher list to mark a GREASE slot (RFC 8701).
+ * The real value is randomized per-connection (0x0a0a..0xfafa); validation accepts
+ * any GREASE-pattern byte pair at a slot marked with this placeholder.
+ */
+export const CIPHER_GREASE_PLACEHOLDER = "TLS_GREASE_RESERVED_0";
+/** Selected IANA TLS Cipher Suite codes, keyed by the canonical suite name used in profiles. */
+export const CIPHER_SUITE_CODES = {
+    // GREASE: real value is randomized per-connection (0x0a0a..0xfafa). We use the
+    // first canonical GREASE code for the expected representation; validation
+    // accepts any GREASE-pattern value at a GREASE slot.
+    [CIPHER_GREASE_PLACEHOLDER]: 0x0a0a,
+    TLS_AES_128_GCM_SHA256: 0x1301,
+    TLS_AES_256_GCM_SHA384: 0x1302,
+    TLS_CHACHA20_POLY1305_SHA256: 0x1303,
+    TLS_AES_128_CCM_SHA256: 0x1304,
+    TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256: 0xc02b,
+    TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256: 0xc02f,
+    TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384: 0xc02c,
+    TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384: 0xc030,
+    TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256: 0xcca9,
+    TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256: 0xcca8,
+    TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA: 0xc013,
+    TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA: 0xc014,
+    TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA: 0xc009,
+    TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA: 0xc00a,
+    TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256: 0xc023,
+    TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384: 0xc024,
+    TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256: 0xc027,
+    TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384: 0xc028,
+    TLS_RSA_WITH_AES_128_GCM_SHA256: 0x009c,
+    TLS_RSA_WITH_AES_256_GCM_SHA384: 0x009d,
+    TLS_RSA_WITH_AES_128_CBC_SHA: 0x002f,
+    TLS_RSA_WITH_AES_256_CBC_SHA: 0x0035,
+    TLS_RSA_WITH_AES_128_CBC_SHA256: 0x003c,
+    TLS_RSA_WITH_AES_256_CBC_SHA256: 0x003d,
+    // Safari legacy tail: 3DES ciphers (RFC 3268). BoringSSL dropped these, but
+    // curl-impersonate restores them so Safari's ClientHello matches byte-for-byte.
+    TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA: 0xc008,
+    TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA: 0xc012,
+    TLS_RSA_WITH_3DES_EDE_CBC_SHA: 0x000a,
+};
+/** Selected IANA TLS Supported Groups (named groups) codes. */
+export const NAMED_GROUP_CODES = {
+    x25519: 0x001d,
+    secp256r1: 0x0017,
+    secp384r1: 0x0018,
+    secp521r1: 0x0019,
+    ffdhe2048: 0x0100,
+    ffdhe3072: 0x0101,
+    // Chrome 124+ adds the hybrid post-quantum group. The draft Kyber768 code
+    // (0x6399) shipped in Chrome 124–130; the final MLKEM768 code (0x11ec) has
+    // been used since Chrome 131. Both appear at the front of the group list.
+    X25519Kyber768: 0x6399,
+    X25519MLKEM768: 0x11ec,
+};
+/** Selected IANA TLS SignatureScheme codes. */
+export const SIGNATURE_SCHEME_CODES = {
+    ecdsa_secp256r1_sha256: 0x0403,
+    ecdsa_secp384r1_sha384: 0x0503,
+    ecdsa_secp521r1_sha512: 0x0603,
+    ecdsa_sha1: 0x0203,
+    rsa_pss_rsae_sha256: 0x0804,
+    rsa_pss_rsae_sha384: 0x0805,
+    rsa_pss_rsae_sha512: 0x0806,
+    rsa_pkcs1_sha256: 0x0401,
+    rsa_pkcs1_sha384: 0x0501,
+    rsa_pkcs1_sha512: 0x0601,
+    rsa_pkcs1_sha1: 0x0201,
+    ed25519: 0x0807,
+};
+/** IANA TLS ProtocolVersion codes for the supported_versions extension. */
+export const VERSION_CODES = {
+    "TLS 1.3": 0x0304,
+    "TLS 1.2": 0x0303,
+    "TLS 1.1": 0x0302,
+    "TLS 1.0": 0x0301,
+};
+/**
+ * Map a cipher-suite name to its 2-byte IANA wire code.
+ *
+ * This is the single projection seam from a profile's cipher name to the bytes
+ * a ClientHello carries. It throws on an unknown name rather than returning a
+ * sentinel: 0x0000 would be ambiguous (it collides with
+ * TLS_EMPTY_RENEGOTIATION_INFO_SCSV), and a silent default would hide a bug in
+ * a profile definition. An unknown name is therefore always an error here,
+ * never a 0x0000 fallback.
+ */
+export function cipherSuiteToWire(name) {
+    const code = CIPHER_SUITE_CODES[name];
+    if (code === undefined) {
+        throw new ProfileError("UnknownCipherSuite", `Unknown cipher suite: ${name}`);
+    }
+    return code;
+}
+//# sourceMappingURL=codes.js.map

package/dist/codes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codes.js","sourceRoot":"","sources":["../src/codes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,uBAAuB,CAAC;AAEjE,gGAAgG;AAChG,MAAM,CAAC,MAAM,kBAAkB,GAAqC;IAChE,+EAA+E;IAC/E,0EAA0E;IAC1E,qDAAqD;IACrD,CAAC,yBAAyB,CAAC,EAAE,MAAM;IACnC,sBAAsB,EAAE,MAAM;IAC9B,sBAAsB,EAAE,MAAM;IAC9B,4BAA4B,EAAE,MAAM;IACpC,sBAAsB,EAAE,MAAM;IAC9B,uCAAuC,EAAE,MAAM;IAC/C,qCAAqC,EAAE,MAAM;IAC7C,uCAAuC,EAAE,MAAM;IAC/C,qCAAqC,EAAE,MAAM;IAC7C,6CAA6C,EAAE,MAAM;IACrD,2CAA2C,EAAE,MAAM;IACnD,kCAAkC,EAAE,MAAM;IAC1C,kCAAkC,EAAE,MAAM;IAC1C,oCAAoC,EAAE,MAAM;IAC5C,oCAAoC,EAAE,MAAM;IAC5C,uCAAuC,EAAE,MAAM;IAC/C,uCAAuC,EAAE,MAAM;IAC/C,qCAAqC,EAAE,MAAM;IAC7C,qCAAqC,EAAE,MAAM;IAC7C,+BAA+B,EAAE,MAAM;IACvC,+BAA+B,EAAE,MAAM;IACvC,4BAA4B,EAAE,MAAM;IACpC,4BAA4B,EAAE,MAAM;IACpC,+BAA+B,EAAE,MAAM;IACvC,+BAA+B,EAAE,MAAM;IACvC,4EAA4E;IAC5E,gFAAgF;IAChF,qCAAqC,EAAE,MAAM;IAC7C,mCAAmC,EAAE,MAAM;IAC3C,6BAA6B,EAAE,MAAM;CACxC,CAAC;AAEF,+DAA+D;AAC/D,MAAM,CAAC,MAAM,iBAAiB,GAAqC;IAC/D,MAAM,EAAE,MAAM;IACd,SAAS,EAAE,MAAM;IACjB,SAAS,EAAE,MAAM;IACjB,SAAS,EAAE,MAAM;IACjB,SAAS,EAAE,MAAM;IACjB,SAAS,EAAE,MAAM;IACjB,0EAA0E;IAC1E,2EAA2E;IAC3E,0EAA0E;IAC1E,cAAc,EAAE,MAAM;IACtB,cAAc,EAAE,MAAM;CACzB,CAAC;AAEF,+CAA+C;AAC/C,MAAM,CAAC,MAAM,sBAAsB,GAAqC;IACpE,sBAAsB,EAAE,MAAM;IAC9B,sBAAsB,EAAE,MAAM;IAC9B,sBAAsB,EAAE,MAAM;IAC9B,UAAU,EAAE,MAAM;IAClB,mBAAmB,EAAE,MAAM;IAC3B,mBAAmB,EAAE,MAAM;IAC3B,mBAAmB,EAAE,MAAM;IAC3B,gBAAgB,EAAE,MAAM;IACxB,gBAAgB,EAAE,MAAM;IACxB,gBAAgB,EAAE,MAAM;IACxB,cAAc,EAAE,MAAM;IACtB,OAAO,EAAE,MAAM;CAClB,CAAC;AAEF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,aAAa,GAAqC;IAC3D,SAAS,EAAE,MAAM;IACjB,SAAS,EAAE,MAAM;IACjB,SAAS,EAAE,MAAM;IACjB,SAAS,EAAE,MAAM;CACpB,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC1C,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACrB,MAAM,IAAI,YAAY,CAAC,oBAAoB,EAAE,yBAAyB,IAAI,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC"}

package/dist/diff.js.map

@@ -1 +1 @@
-{"version":3,"file":"diff.js","sourceRoot":"","sources":["../src/diff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAiCH,oGAAoG;AACpG,SAAS,QAAQ,CAAC,CAAU;IACxB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC;AAC/C,CAAC;AAED,8FAA8F;AAC9F,SAAS,OAAO,CAAC,CAAU;IACvB,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED,4BAA4B;AAC5B,SAAS,IAAI,CAAC,GAAkB,EAAE,IAAY,EAAE,CAAU,EAAE,CAAW;IACnE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED,qFAAqF;AACrF,SAAS,SAAS,CACd,CAAsC,EACtC,CAAsC;IAEtC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChB,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,SAAS,IAAI,CACT,IAAY,EACZ,CAAU,EACV,CAAU,EACV,OAAoB,EACpB,GAAkB;IAElB,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACV,OAAO;IACX,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAExB,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QACf,SAAS,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QACpC,OAAO;IACX,CAAC;IACD,oEAAoE;IACpE,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QACf,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACtB,OAAO;IACX,CAAC;IAED,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YAChC,MAAM,SAAS,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;YACvD,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC1D,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;gBACf,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YAClD,CAAC;iBAAM,IAAI,IAAI,EAAE,CAAC;gBACd,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACjC,CAAC;iBAAM,CAAC;gBACJ,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5C,CAAC;QACL,CAAC;QACD,OAAO;IACX,CAAC;IAED,sDAAsD;IACtD,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAC1B,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS,CACd,IAAY,EACZ,CAAsB,EACtB,CAAsB,EACtB,OAAoB,EACpB,GAAkB;IAElB,IAAI,OAAO,CAAC,iBAAiB,IAAI,IAAI,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;YAClC,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;YAC1B,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;YAC1B,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;gBACf,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YAC9C,CAAC;iBAAM,IAAI,IAAI,EAAE,CAAC;gBACd,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/B,CAAC;iBAAM,CAAC;gBACJ,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1C,CAAC;QACL,CAAC;QACD,OAAO;IACX,CAAC;IAED,2EAA2E;IAC3E,4CAA4C;IAC5C,MAAM,OAAO,GAAG,CAAC,CAAU,EAAU,EAAE,CACnC,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAE/D,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAChD,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAEhD,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC;IAC9C,IAAI,KAAK,EAAE,CAAC;QACR,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5B,KAAK,GAAG,KAAK,CAAC;gBACd,MAAM;YACV,CAAC;QACL,CAAC;IACL,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1B,CAAC;AACL,CAAC;AAED,6FAA6F;AAC7F,SAAS,eAAe,CAAC,KAAc;IACnC,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC7B,IAAI,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAClB,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC1C,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CACxB,CAAiB,EACjB,CAAiB,EACjB,OAAO,GAAgB,EAAE;IAEzB,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,IAAI,CAAC,EAAE,EAAE,CAAwB,EAAE,CAAwB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3E,OAAO,GAAG,CAAC;AACf,CAAC"}
+{"version":3,"file":"diff.js","sourceRoot":"","sources":["../src/diff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAoCH,oGAAoG;AACpG,SAAS,QAAQ,CAAC,CAAU;IACxB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC;AAC/C,CAAC;AAED,8FAA8F;AAC9F,SAAS,OAAO,CAAC,CAAU;IACvB,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED,4BAA4B;AAC5B,SAAS,IAAI,CAAC,GAAkB,EAAE,IAAY,EAAE,CAAU,EAAE,CAAW;IACnE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED,qFAAqF;AACrF,SAAS,SAAS,CAAC,CAAa,EAAE,CAAa;IAC3C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChB,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,SAAS,IAAI,CACT,IAAY,EACZ,CAAU,EACV,CAAU,EACV,OAAoB,EACpB,GAAkB;IAElB,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACV,OAAO;IACX,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAExB,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QACf,SAAS,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QACpC,OAAO;IACX,CAAC;IACD,oEAAoE;IACpE,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QACf,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACtB,OAAO;IACX,CAAC;IAED,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YAChC,MAAM,SAAS,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;YACvD,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC1D,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;gBACf,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YAClD,CAAC;iBAAM,IAAI,IAAI,EAAE,CAAC;gBACd,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACjC,CAAC;iBAAM,CAAC;gBACJ,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5C,CAAC;QACL,CAAC;QACD,OAAO;IACX,CAAC;IAED,sDAAsD;IACtD,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAC1B,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS,CACd,IAAY,EACZ,CAAsB,EACtB,CAAsB,EACtB,OAAoB,EACpB,GAAkB;IAElB,IAAI,OAAO,CAAC,iBAAiB,IAAI,IAAI,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;YAClC,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;YAC1B,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;YAC1B,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;gBACf,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YAC9C,CAAC;iBAAM,IAAI,IAAI,EAAE,CAAC;gBACd,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/B,CAAC;iBAAM,CAAC;gBACJ,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1C,CAAC;QACL,CAAC;QACD,OAAO;IACX,CAAC;IAED,2EAA2E;IAC3E,4CAA4C;IAC5C,MAAM,OAAO,GAAG,CAAC,CAAU,EAAU,EAAE,CACnC,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAE/D,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAChD,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAEhD,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC;IAC9C,IAAI,KAAK,EAAE,CAAC;QACR,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5B,KAAK,GAAG,KAAK,CAAC;gBACd,MAAM;YACV,CAAC;QACL,CAAC;IACL,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1B,CAAC;AACL,CAAC;AAED,6FAA6F;AAC7F,SAAS,eAAe,CAAC,KAAc;IACnC,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC7B,IAAI,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAClB,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC1C,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CACxB,CAAiB,EACjB,CAAiB,EACjB,OAAO,GAAgB,EAAE;IAEzB,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC7B,OAAO,GAAG,CAAC;AACf,CAAC"}

package/dist/index.d.ts

@@ -9,7 +9,8 @@ export { getProfile, listProfiles, registerProfile, } from "./registry.js";
 export { diffProfiles, } from "./diff.js";
 export type { DiffOptions, ProfileDiff, } from "./diff.js";
 export { buildExpectedClientHello, validateProfileAgainstCapture, ValidationError, } from "./validate.js";
-export type { TlsCapture, ClientHelloExpected, } from "./validate.js";
+export type { TlsCapture, ClientHelloExpected, ValidationResult, } from "./validate.js";
+export { cipherSuiteToWire, CIPHER_GREASE_PLACEHOLDER, CIPHER_SUITE_CODES, NAMED_GROUP_CODES, SIGNATURE_SCHEME_CODES, VERSION_CODES, } from "./codes.js";
 export { ChromeProfiles, FirefoxProfiles, SafariProfiles, EdgeProfiles, } from "./index.internal.js";
 export { ProfileError, UnknownProfileError, } from "./errors.js";
 export type { BrowserProfile, Http1Profile, Http2Profile, Http2Settings, Http2Priority, ProfileId, ProfileName, TlsProfile, } from "./types.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACH,UAAU,EACV,YAAY,EACZ,eAAe,GAClB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACH,YAAY,GACf,MAAM,WAAW,CAAC;AAEnB,YAAY,EACR,WAAW,EACX,WAAW,GACd,MAAM,WAAW,CAAC;AAEnB,OAAO,EACH,wBAAwB,EACxB,6BAA6B,EAC7B,eAAe,GAClB,MAAM,eAAe,CAAC;AAEvB,YAAY,EACR,UAAU,EACV,mBAAmB,GACtB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACH,cAAc,EACd,eAAe,EACf,cAAc,EACd,YAAY,GACf,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACH,YAAY,EACZ,mBAAmB,GACtB,MAAM,aAAa,CAAC;AAErB,YAAY,EACR,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,aAAa,EACb,SAAS,EACT,WAAW,EACX,UAAU,GACb,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACH,UAAU,EACV,YAAY,EACZ,eAAe,GAClB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACH,YAAY,GACf,MAAM,WAAW,CAAC;AAEnB,YAAY,EACR,WAAW,EACX,WAAW,GACd,MAAM,WAAW,CAAC;AAEnB,OAAO,EACH,wBAAwB,EACxB,6BAA6B,EAC7B,eAAe,GAClB,MAAM,eAAe,CAAC;AAEvB,YAAY,EACR,UAAU,EACV,mBAAmB,EACnB,gBAAgB,GACnB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACH,iBAAiB,EACjB,yBAAyB,EACzB,kBAAkB,EAClB,iBAAiB,EACjB,sBAAsB,EACtB,aAAa,GAChB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACH,cAAc,EACd,eAAe,EACf,cAAc,EACd,YAAY,GACf,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACH,YAAY,EACZ,mBAAmB,GACtB,MAAM,aAAa,CAAC;AAErB,YAAY,EACR,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,aAAa,EACb,SAAS,EACT,WAAW,EACX,UAAU,GACb,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -8,6 +8,7 @@
 export { getProfile, listProfiles, registerProfile, } from "./registry.js";
 export { diffProfiles, } from "./diff.js";
 export { buildExpectedClientHello, validateProfileAgainstCapture, ValidationError, } from "./validate.js";
+export { cipherSuiteToWire, CIPHER_GREASE_PLACEHOLDER, CIPHER_SUITE_CODES, NAMED_GROUP_CODES, SIGNATURE_SCHEME_CODES, VERSION_CODES, } from "./codes.js";
 export { ChromeProfiles, FirefoxProfiles, SafariProfiles, EdgeProfiles, } from "./index.internal.js";
 export { ProfileError, UnknownProfileError, } from "./errors.js";
 export { assertNever } from "./utils.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACH,UAAU,EACV,YAAY,EACZ,eAAe,GAClB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACH,YAAY,GACf,MAAM,WAAW,CAAC;AAOnB,OAAO,EACH,wBAAwB,EACxB,6BAA6B,EAC7B,eAAe,GAClB,MAAM,eAAe,CAAC;AAOvB,OAAO,EACH,cAAc,EACd,eAAe,EACf,cAAc,EACd,YAAY,GACf,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACH,YAAY,EACZ,mBAAmB,GACtB,MAAM,aAAa,CAAC;AAarB,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACH,UAAU,EACV,YAAY,EACZ,eAAe,GAClB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACH,YAAY,GACf,MAAM,WAAW,CAAC;AAOnB,OAAO,EACH,wBAAwB,EACxB,6BAA6B,EAC7B,eAAe,GAClB,MAAM,eAAe,CAAC;AAQvB,OAAO,EACH,iBAAiB,EACjB,yBAAyB,EACzB,kBAAkB,EAClB,iBAAiB,EACjB,sBAAsB,EACtB,aAAa,GAChB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACH,cAAc,EACd,eAAe,EACf,cAAc,EACd,YAAY,GACf,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACH,YAAY,EACZ,mBAAmB,GACtB,MAAM,aAAa,CAAC;AAarB,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC"}

package/dist/profiles/chrome.d.ts

@@ -1,10 +1,23 @@
 /**
  * Chrome fingerprint definitions.
  *
- * TLS values mirror real Chrome ClientHello captures (JA3 / JA4 style). Chrome
- * enables GREASE (RFC 8701), advertises TLS 1.3, and sends a stable cipher order
- * per release. HTTP/2 settings track Chrome's real SETTINGS frame. Values are
- * accurate for the listed versions unless noted otherwise.
+ * TLS values are byte-accurate against real curl-impersonate ClientHello
+ * captures. The authoritative ground truth is the lwthiker/curl-impersonate
+ * wire captures (testing-worktree/captures/_probe/output/chrome*.json) together
+ * with their reported ja3 / ja4 / peetprint fingerprints. Every value here is
+ * verified against those captures:
+ *
+ *   - chrome-120: ja3 698f6d684588ddc1217dfb4454916129, peetprint
+ *     8ad9325e12f531d2983b78860de7b0ec (no post-quantum group).
+ *   - chrome-124..130: X25519Kyber768 (0x6399) added to supported_groups.
+ *   - chrome-131+: X25519MLKEM768 (0x11ec) replaces Kyber768; the
+ *     application_settings extension moves from 17513 to 17613.
+ *
+ * Chrome permutes its extension order at runtime (tls_permute_extensions), so
+ * `extensionOrder` stores the canonical pre-permutation seed that
+ * curl-impersonate configures — matching the peetprint's normalized order.
+ * GREASE slots are tracked separately via the `grease` flag; the runtime
+ * randomizes the actual 0x?a?a values per RFC 8701.
  */
 import type { BrowserProfile } from "../types.js";
 export declare const chrome120: BrowserProfile;

package/dist/profiles/chrome.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"chrome.d.ts","sourceRoot":"","sources":["../../src/profiles/chrome.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAa,MAAM,aAAa,CAAC;AAkD7D,eAAO,MAAM,SAAS,EAAE,cAoDvB,CAAC;AAEF,eAAO,MAAM,SAAS,EAAE,cAoDvB,CAAC;AAEF,eAAO,MAAM,SAAS,EAAE,cAoDvB,CAAC;AAEF,eAAO,MAAM,cAAc;;;;CAIjB,CAAC"}
+{"version":3,"file":"chrome.d.ts","sourceRoot":"","sources":["../../src/profiles/chrome.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAa,MAAM,aAAa,CAAC;AAwF7D,eAAO,MAAM,SAAS,EAAE,cA+BvB,CAAC;AAEF,eAAO,MAAM,SAAS,EAAE,cA+BvB,CAAC;AAEF,eAAO,MAAM,SAAS,EAAE,cA+BvB,CAAC;AAEF,eAAO,MAAM,cAAc;;;;CAIjB,CAAC"}

package/dist/profiles/chrome.js

@@ -1,19 +1,39 @@
 /**
  * Chrome fingerprint definitions.
  *
- * TLS values mirror real Chrome ClientHello captures (JA3 / JA4 style). Chrome
- * enables GREASE (RFC 8701), advertises TLS 1.3, and sends a stable cipher order
- * per release. HTTP/2 settings track Chrome's real SETTINGS frame. Values are
- * accurate for the listed versions unless noted otherwise.
+ * TLS values are byte-accurate against real curl-impersonate ClientHello
+ * captures. The authoritative ground truth is the lwthiker/curl-impersonate
+ * wire captures (testing-worktree/captures/_probe/output/chrome*.json) together
+ * with their reported ja3 / ja4 / peetprint fingerprints. Every value here is
+ * verified against those captures:
+ *
+ *   - chrome-120: ja3 698f6d684588ddc1217dfb4454916129, peetprint
+ *     8ad9325e12f531d2983b78860de7b0ec (no post-quantum group).
+ *   - chrome-124..130: X25519Kyber768 (0x6399) added to supported_groups.
+ *   - chrome-131+: X25519MLKEM768 (0x11ec) replaces Kyber768; the
+ *     application_settings extension moves from 17513 to 17613.
+ *
+ * Chrome permutes its extension order at runtime (tls_permute_extensions), so
+ * `extensionOrder` stores the canonical pre-permutation seed that
+ * curl-impersonate configures — matching the peetprint's normalized order.
+ * GREASE slots are tracked separately via the `grease` flag; the runtime
+ * randomizes the actual 0x?a?a values per RFC 8701.
  */
 /** TLS 1.3 GREASE placeholder cipher (0x?a?a) Chrome inserts at the top of the list. */
 const GREASE = "TLS_GREASE_RESERVED_0";
+/**
+ * Canonical (pre-permutation) Chrome extension order.
+ *
+ * Mirrors the peetprint-normalized order `0-10-11-13-16-APP_SETTINGS-18-23-27-
+ * 35-43-45-5-51-65037-65281`. The only version-dependent slot is the
+ * application_settings extension: 17513 (application_settings_old) through
+ * chrome ~131, then 17613 (application_settings) from chrome ~132 onward.
+ */
+const chromeExtensionOrder = (appSettings) => [
+    0, 10, 11, 13, 16, appSettings, 18, 23, 27, 35, 43, 45, 5, 51, 65037, 65281,
+];
 const chromeTlsBase = {
-    extensionOrder: [
-        0, 10, 11, 13, 16, 17513, 18, 23, 27, 35, 41, 43, 45, 5, 51, 65281,
-    ],
     supportedVersions: ["TLS 1.3", "TLS 1.2"],
-    keyShareGroups: ["x25519", "secp256r1"],
     signatureAlgorithms: [
         "ecdsa_secp256r1_sha256",
         "rsa_pss_rsae_sha256",
@@ -21,6 +41,8 @@ const chromeTlsBase = {
         "ecdsa_secp384r1_sha384",
         "rsa_pss_rsae_sha384",
         "rsa_pkcs1_sha384",
+        "rsa_pss_rsae_sha512",
+        "rsa_pkcs1_sha512",
     ],
     grease: true,
 };
@@ -30,6 +52,14 @@ const chromeHttp2Base = {
     headerTableSize: 65536,
     weight: 256,
 };
+const chromeHttp2Settings = {
+    headerTableSize: 65536,
+    enablePush: false,
+    maxConcurrentStreams: 100,
+    initialWindowSize: 6291456,
+    maxFrameSize: 16384,
+    maxHeaderListSize: 262144,
+};
 const chromeHttp1Base = {
     connection: "keep-alive",
     acceptEncoding: "gzip, deflate, br",
@@ -50,40 +80,37 @@ const chromeHttp1Base = {
         "accept-language",
     ],
 };
+const chromeCipherSuites = [
+    GREASE,
+    "TLS_AES_128_GCM_SHA256",
+    "TLS_AES_256_GCM_SHA384",
+    "TLS_CHACHA20_POLY1305_SHA256",
+    "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
+    "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+    "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
+    "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
+    "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
+    "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
+    "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
+    "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
+    "TLS_RSA_WITH_AES_128_GCM_SHA256",
+    "TLS_RSA_WITH_AES_256_GCM_SHA384",
+    "TLS_RSA_WITH_AES_128_CBC_SHA",
+    "TLS_RSA_WITH_AES_256_CBC_SHA",
+];
 export const chrome120 = {
     id: "chrome-120",
     name: "chrome",
     version: "120.0.6099.71",
     tls: {
         ...chromeTlsBase,
-        cipherSuites: [
-            GREASE,
-            "TLS_AES_128_GCM_SHA256",
-            "TLS_AES_256_GCM_SHA384",
-            "TLS_CHACHA20_POLY1305_SHA256",
-            "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
-            "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
-            "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
-            "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
-            "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
-            "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
-            "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
-            "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
-            "TLS_RSA_WITH_AES_128_GCM_SHA256",
-            "TLS_RSA_WITH_AES_256_GCM_SHA384",
-            "TLS_RSA_WITH_AES_128_CBC_SHA",
-            "TLS_RSA_WITH_AES_256_CBC_SHA",
-        ],
+        extensionOrder: chromeExtensionOrder(17513),
+        keyShareGroups: ["x25519", "secp256r1", "secp384r1"],
+        cipherSuites: chromeCipherSuites,
     },
     http2: {
         ...chromeHttp2Base,
-        settings: {
-            headerTableSize: 65536,
-            enablePush: false,
-            maxConcurrentStreams: 100,
-            initialWindowSize: 6291456,
-            maxFrameSize: 16384,
-        },
+        settings: chromeHttp2Settings,
     },
     http1: {
         ...chromeHttp1Base,
@@ -108,34 +135,13 @@ export const chrome128 = {
     version: "128.0.6613.137",
     tls: {
         ...chromeTlsBase,
-        cipherSuites: [
-            GREASE,
-            "TLS_AES_128_GCM_SHA256",
-            "TLS_AES_256_GCM_SHA384",
-            "TLS_CHACHA20_POLY1305_SHA256",
-            "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
-            "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
-            "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
-            "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
-            "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
-            "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
-            "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
-            "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
-            "TLS_RSA_WITH_AES_128_GCM_SHA256",
-            "TLS_RSA_WITH_AES_256_GCM_SHA384",
-            "TLS_RSA_WITH_AES_128_CBC_SHA",
-            "TLS_RSA_WITH_AES_256_CBC_SHA",
-        ],
+        extensionOrder: chromeExtensionOrder(17513),
+        keyShareGroups: ["X25519Kyber768", "x25519", "secp256r1", "secp384r1"],
+        cipherSuites: chromeCipherSuites,
     },
     http2: {
         ...chromeHttp2Base,
-        settings: {
-            headerTableSize: 65536,
-            enablePush: false,
-            maxConcurrentStreams: 100,
-            initialWindowSize: 6291456,
-            maxFrameSize: 16384,
-        },
+        settings: chromeHttp2Settings,
     },
     http1: {
         ...chromeHttp1Base,
@@ -160,34 +166,13 @@ export const chrome140 = {
     version: "140.0.7339.18",
     tls: {
         ...chromeTlsBase,
-        cipherSuites: [
-            GREASE,
-            "TLS_AES_128_GCM_SHA256",
-            "TLS_AES_256_GCM_SHA384",
-            "TLS_CHACHA20_POLY1305_SHA256",
-            "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
-            "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
-            "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
-            "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
-            "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
-            "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
-            "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
-            "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
-            "TLS_RSA_WITH_AES_128_GCM_SHA256",
-            "TLS_RSA_WITH_AES_256_GCM_SHA384",
-            "TLS_RSA_WITH_AES_128_CBC_SHA",
-            "TLS_RSA_WITH_AES_256_CBC_SHA",
-        ],
+        extensionOrder: chromeExtensionOrder(17613),
+        keyShareGroups: ["X25519MLKEM768", "x25519", "secp256r1", "secp384r1"],
+        cipherSuites: chromeCipherSuites,
     },
     http2: {
         ...chromeHttp2Base,
-        settings: {
-            headerTableSize: 65536,
-            enablePush: false,
-            maxConcurrentStreams: 100,
-            initialWindowSize: 6291456,
-            maxFrameSize: 16384,
-        },
+        settings: chromeHttp2Settings,
     },
     http1: {
         ...chromeHttp1Base,