@browsercore/testing 0.1.3 → 0.2.0

package/captures/_probe/validate_golden.py

@@ -0,0 +1,97 @@
+#!/usr/bin/env python3
+"""Validate reconstructed SETTINGS frames + meta.json schema compliance."""
+import os, json, struct, sys
+
+# Reuse the library's meta.json schema check (parseCaptureMeta) if importable,
+# else replicate minimally.
+sys.path.insert(0, "/Users/matte/projects/browsercore/testing/src")
+try:
+    from golden.golden import parseCaptureMeta
+    HAS_LIB = True
+except Exception as e:
+    HAS_LIB = False
+    print(f"Note: could not import library golden loader ({e}); using local schema check")
+
+CAPTURES = "/Users/matte/projects/browsercore/testing/captures"
+ORACLE_OUT = os.path.join(CAPTURES, "_probe", "output")
+
+SETTING_IDS_REV = {1:"HEADER_TABLE_SIZE",2:"ENABLE_PUSH",3:"MAX_CONCURRENT_STREAMS",
+                   4:"INITIAL_WINDOW_SIZE",5:"MAX_FRAME_SIZE",6:"MAX_HEADER_LIST_SIZE",
+                   8:"ENABLE_CONNECT_PROTOCOL",9:"NO_RFC7540_PRIORITIES"}
+
+def parse_settings(data):
+    # HTTP/2 frame: length(3)+type(1)+flags(1)+stream(4)
+    assert len(data) >= 9, "settings frame too short"
+    length = struct.unpack(">I", b'\x00'+data[0:3])[0]
+    ftype = data[3]
+    flags = data[4]
+    stream = struct.unpack(">I", data[5:9])[0]
+    assert ftype == 0x04, f"expected SETTINGS (0x04) got 0x{ftype:02x}"
+    assert stream == 0, "SETTINGS must be on stream 0"
+    payload = data[9:]
+    assert len(payload) == length, f"payload len {len(payload)} != frame length {length}"
+    settings = []
+    for i in range(0, len(payload), 6):
+        sid = struct.unpack(">H", payload[i:i+2])[0]
+        val = struct.unpack(">I", payload[i+2:i+6])[0]
+        settings.append((SETTING_IDS_REV.get(sid, f"UNKNOWN({sid})"), val))
+    return {"flags": flags, "settings": settings}
+
+def load_oracle_settings(oracle_name):
+    for suffix in ["", "_fresh"]:
+        p = os.path.join(ORACLE_OUT, f"{oracle_name}{suffix}.json")
+        if os.path.exists(p):
+            with open(p) as f: return json.load(f)
+    return None
+
+VALID_RECORDS = {"client_hello","settings","headers","server_hello"}
+VALID_PROTOCOLS = {"tls","http2","http1","tcp"}
+VALID_SOURCES = {"curl-impersonate","real-browser"}
+VALID_REASONS = {"ephemeral_key","nonce","grease","random"}
+
+def local_validate_meta(meta, path):
+    assert meta["source"] in VALID_SOURCES, f"bad source {meta['source']}"
+    assert meta["protocol"] in VALID_PROTOCOLS, f"bad protocol {meta['protocol']}"
+    assert meta["record"] in VALID_RECORDS, f"bad record {meta['record']}"
+    assert isinstance(meta["description"], str)
+    assert isinstance(meta["createdAt"], str)
+    assert isinstance(meta["profile"], str)
+    for rf in meta["randomizedFields"]:
+        assert rf["reason"] in VALID_REASONS
+        assert isinstance(rf["byteOffset"], int) and rf["byteOffset"] >= 0
+        assert isinstance(rf["length"], int) and rf["length"] >= 0
+
+PROFILES = [("chrome-131","chrome131"), ("firefox-133","firefox133"), ("safari-17","safari170")]
+all_ok = True
+for gname, oracle in PROFILES:
+    print(f"\n=== {gname} ===")
+    # Validate meta.json schema (both local and library if available)
+    for proto in ["tls","http2"]:
+        mp = os.path.join(CAPTURES, gname, proto, "client_hello.meta.json" if proto=="tls" else "settings.meta.json")
+        with open(mp) as f: meta = json.load(f)
+        try:
+            local_validate_meta(meta, mp)
+            if HAS_LIB:
+                parseCaptureMeta(meta, f"{gname}/{proto}/{'client_hello' if proto=='tls' else 'settings'}")
+            print(f"  {proto} meta.json: SCHEMA OK")
+        except Exception as e:
+            print(f"  {proto} meta.json: SCHEMA FAIL: {e}")
+            all_ok = False
+    # Validate settings frame
+    sp = os.path.join(CAPTURES, gname, "http2", "settings.bin")
+    with open(sp,"rb") as f: sdata=f.read()
+    parsed = parse_settings(sdata)
+    od = load_oracle_settings(oracle)
+    oracle_settings = od["http2"]["sent_frames"][0]["settings"]  # first SETTINGS
+    # Compare
+    oracle_pairs = [tuple(s.split(" = ",1)) for s in oracle_settings]
+    parsed_pairs = [(k,str(v)) for k,v in parsed["settings"]]
+    oracle_pairs_str = [(k,str(v)) for k,v in oracle_pairs]
+    if parsed_pairs == oracle_pairs_str:
+        print(f"  settings.bin: MATCHES oracle ({len(parsed_pairs)} settings)")
+    else:
+        print(f"  settings.bin: MISMATCH")
+        print(f"    parsed:   {parsed_pairs}")
+        print(f"    oracle:   {oracle_pairs_str}")
+        all_ok = False
+print(f"\n{'ALL VALID' if all_ok else 'VALIDATION FAILED'}")

package/captures/_probe/verify_capture.py

@@ -0,0 +1,68 @@
+#!/usr/bin/env python3
+"""Verify captured ClientHello bytes reproduce oracle JA3/JA4."""
+import os, json, hashlib, struct
+
+RAW = "/Users/matte/projects/browsercore/testing/captures/_probe/raw_bytes"
+OUT = "/Users/matte/projects/browsercore/testing/captures/_probe/output"
+
+# Replicate our library's exact parseClientHello + computeJa3
+def parse_client_hello(d):
+    pos = 5  # TLS record wrapper
+    assert d[0] == 0x16 and d[5] == 0x01
+    handshake_len = struct.unpack(">I", b'\x00'+d[6:9])[0]
+    pos = 9
+    end = 9 + handshake_len
+    version = struct.unpack(">H", d[pos:pos+2])[0]; pos += 2
+    pos += 32  # random
+    sid_len = d[pos]; pos += 1 + sid_len
+    cs_len = struct.unpack(">H", d[pos:pos+2])[0]; pos += 2
+    ciphers = []
+    for i in range(0, cs_len, 2):
+        ciphers.append(struct.unpack(">H", d[pos+i:pos+i+2])[0])
+    pos += cs_len
+    comp_len = d[pos]; pos += 1 + comp_len
+    ext_types=[]; sg=[]; ecpf=[]
+    if pos + 2 <= end:
+        ext_len = struct.unpack(">H", d[pos:pos+2])[0]; pos += 2
+        ext_end = pos + ext_len
+        while pos + 4 <= ext_end:
+            et = struct.unpack(">H", d[pos:pos+2])[0]
+            el = struct.unpack(">H", d[pos+2:pos+4])[0]
+            pos += 4
+            ext_types.append(et)
+            if et == 0x000a and el >= 4:
+                ll = struct.unpack(">H", d[pos:pos+2])[0]
+                for i in range(0,ll,2): sg.append(struct.unpack(">H", d[pos+2+i:pos+4+i])[0])
+            elif et == 0x000b and el >= 1:
+                ll = d[pos]
+                for i in range(ll): ecpf.append(d[pos+1+i])
+            pos += el
+    return version, ciphers, ext_types, sg, ecpf
+
+def ja3(segments):
+    s = ",".join(segments)
+    return hashlib.md5(s.encode()).hexdigest(), s
+
+MAP = [("chrome-131", "chrome131"), ("firefox-133", "firefox133"), ("safari-17", "safari170")]
+
+for cap_name, oracle_name in MAP:
+    with open(os.path.join(RAW, f"{cap_name}_client_hello.bin"),"rb") as f:
+        d = f.read()
+    ver, ciphers, exts, sg, ecpf = parse_client_hello(d)
+    # JA3 segments use decimal of GREASE as-is (GREASE values included in JA3 string)
+    j3s = [str(ver), "-".join(str(c) for c in ciphers), "-".join(str(e) for e in exts), "-".join(str(g) for g in sg), "-".join(str(f) for f in ecpf)]
+    md5, j3str = ja3(j3s)
+    # oracle values
+    od = json.load(open(os.path.join(OUT, f"{oracle_name}.json")))
+    oracle_ja3 = od['tls']['ja3_hash']
+    oracle_ja3_str = od['tls']['ja3']
+    match = "MATCH" if md5 == oracle_ja3 else "MISMATCH"
+    print(f"{cap_name}: captured_ja3={md5} oracle_ja3={oracle_ja3}  [{match}]")
+    print(f"  captured JA3 str: {j3str}")
+    print(f"  oracle  JA3 str:  {oracle_ja3_str}")
+    print(f"  version=0x{ver:04x} ciphers={len(ciphers)} exts={len(exts)}")
+    # GREASE check
+    grease_exts = [hex(e) for e in exts if (e & 0x0f0f) == 0x0a0a]
+    grease_ciphers = [hex(c) for c in ciphers if (c & 0x0f0f) == 0x0a0a]
+    print(f"  GREASE ciphers: {grease_ciphers}  GREASE exts: {grease_exts}")
+    print()

package/captures/chrome-131/http2/settings.meta.json

@@ -0,0 +1,9 @@
+{
+    "source": "curl-impersonate",
+    "profile": "chrome-131",
+    "protocol": "http2",
+    "record": "settings",
+    "description": "First HTTP/2 SETTINGS frame sent by curl-impersonate chrome131. HTTP/2 SETTINGS are not randomized, so the ignore-list is empty.",
+    "randomizedFields": [],
+    "createdAt": "2026-08-04T00:28:49Z"
+}

package/captures/chrome-131/oracle_capture.reference.json

@@ -0,0 +1,224 @@
+{
+  "donate": "Please consider donating to keep this API running. Visit https://tls.peet.ws",
+  "ip": "92.218.110.236:59988",
+  "http_version": "h2",
+  "method": "GET",
+  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36",
+  "tls": {
+    "ciphers": [
+      "TLS_GREASE (0x4A4A)",
+      "TLS_AES_128_GCM_SHA256",
+      "TLS_AES_256_GCM_SHA384",
+      "TLS_CHACHA20_POLY1305_SHA256",
+      "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
+      "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+      "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
+      "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
+      "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
+      "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
+      "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
+      "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
+      "TLS_RSA_WITH_AES_128_GCM_SHA256",
+      "TLS_RSA_WITH_AES_256_GCM_SHA384",
+      "TLS_RSA_WITH_AES_128_CBC_SHA",
+      "TLS_RSA_WITH_AES_256_CBC_SHA"
+    ],
+    "extensions": [
+      {
+        "name": "TLS_GREASE (0x5a5a)"
+      },
+      {
+        "name": "compress_certificate (27)",
+        "algorithms": [
+          "brotli (2)"
+        ]
+      },
+      {
+        "name": "key_share (51)",
+        "shared_keys": [
+          {
+            "TLS_GREASE (0x2a2a)": "00"
+          },
+          {
+            "X25519MLKEM768 (4588)": "1dccada64a898dea92fce03760679badbb30ded95e9d3c1f9c745b4f8436c31a83c0b7ca40b24483888670bb33c8f604fee6c95549091436808740783090bcf4420f4a6064ae4c52b536c80cb42f8449449999913b5129194a3f7e6b8cddb085aae78b680a61cab901a812a5f53716666aa5b7e8a0e0ab3635f75918f430cc0c18c0904d628522c5960ba7ec24f23214bf691d2060affeb51ef4b452779ab4d4b32f1e7943c74043d4abbf0c038d7ac52e90b1b9276545cf5022f4565e5886a12423143b5b9c5ad386f3914748403e627017b4311255c45e44aa856d1437d722765ae25db9894e9e9b6c0de318a147c03c5644ba9512fe928c75304d1c0bc02956c57069c9ff22b115412f79f83849d109a36211364825dea05a0c20541dca064d0b21a34858f306360f27c0f91195c0bb72edf2b84e7b1941ea3eb3cc6d19712988979536930c0f4c2d935620fd86200f929d0f78ab6c785789e06b1b6432935173de1c60b57b79fd325e81429a6d63c604055bc66ac3e9ba5d8cfac53d623e5e7c6215d873b4f2273f4c4c3b792cd868cac6b199c2298965e6ac0c357535d0cb753202b409700f81cc9a229ec8a36432081af4902c454916b7b5b2f154259f3a1f351c954448782bfc2ddcebc2803881a6884670e381c427a47e60631ce8a02e88ada2b6ce2d518564c1c5b5289d14550faed0a761975f701877006808e2708501b74cf75143e7d30054d7970c21ce0bc0b340b1c5a2a96903e88eaacc876f19b69e33ca73a5a937e83f07098fb0c2a2ea970929c94f6598c993c7bdef26a19fdcc30b80bff44829ad8a0268e0cf3818567f3705be746ce5d186e9929431706db7128feb97403e6250617ccbbe508913a2a549ab976707c9dbf5595f9cc7147484478962c8cbcfb5d3b10401c50be5c1ffa44121e10eee698537991f21ca8020732af42bc5e453396b1c39d73a5e0f776aca009a05726a5c2c1f89e5a7e0469f77022bdd44076d50c0e47b98c6f85182890f81010e046a2ed1a88f78931750f0b230579a85c44039e59e80093e8619cb89f1c5bb28883f218a70f66284c9445ba919d3d94bae5654282027eee399fb45a7f7c052abbc5c33a95058124914e2cfa1478162ec6ec1e66f52ea93af66ce16d83fa5cb4d0d9c2825d53f70991e9eb95d848b3170ab9ba4b35d00b73afae59fdfa19bd691bd302c202038046fbb611816ce9b75c70529aa21f131900145c0910e7c580b39b0a51226bb2aa01b4ce16d0fb19d6bbcae71f94dec1a128c43b2e3c8905dac0586f48bd84a1473017d6b953574d360dc302341c28248b1bda9a26eb709d019938ee01cc18e2b2332179416b500a8c100f6471a841458a8a53fbe9c4fac465287538415e824bb4b2d981bbb8f0b436879b1ad1c9f448a60278799f07941b4866d06e778ca300c8989b9f0065090ac510a8a016446a50de71686a75e51e32ea1983813f7b20c0c43a61a7f093209b81115cea11330769626531e52c3b8025c2abd317ff6204a4da76a08bc8f06ec784ab9909ca61adde0bbae3582b07b84950477eff1c354ccb526c57fb3f8bf55632a77367342da76f0969345047981881d57507075b9c74bf531491412acf86b296d9a0ba118dc28ba3988ef2bc890d6224d22b3e227146b4125e934bc7e162b33ec4d23c4d4ebfeb47d89c34c186aa32d9fdd9af8dc786ca108e6b258"
+          },
+          {
+            "X25519 (29)": "39c652ecafe34c95a52b59b23734a6e76fea4c8449990cc73371f4c384d8756a"
+          }
+        ]
+      },
+      {
+        "name": "server_name (0)",
+        "server_name": "tls.peet.ws"
+      },
+      {
+        "name": "signature_algorithms (13)",
+        "signature_algorithms": [
+          "ecdsa_secp256r1_sha256",
+          "rsa_pss_rsae_sha256",
+          "rsa_pkcs1_sha256",
+          "ecdsa_secp384r1_sha384",
+          "rsa_pss_rsae_sha384",
+          "rsa_pkcs1_sha384",
+          "rsa_pss_rsae_sha512",
+          "rsa_pkcs1_sha512"
+        ]
+      },
+      {
+        "name": "supported_versions (43)",
+        "versions": [
+          "TLS_GREASE (0x7a7a)",
+          "TLS 1.3",
+          "TLS 1.2"
+        ]
+      },
+      {
+        "name": "extensionRenegotiationInfo (boringssl) (65281)",
+        "data": "00"
+      },
+      {
+        "name": "psk_key_exchange_modes (45)",
+        "PSK_Key_Exchange_Mode": "PSK with (EC)DHE key establishment (psk_dhe_ke) (1)"
+      },
+      {
+        "name": "status_request (5)",
+        "status_request": {
+          "certificate_status_type": "OSCP (1)",
+          "responder_id_list_length": 0,
+          "request_extensions_length": 0
+        }
+      },
+      {
+        "name": "extensionEncryptedClientHello (boringssl) (65037)",
+        "data": "0000010001730020237d34614940b7b222815f71403f87df482731e32bff7c5d8451d2a8436a21490090c2bac74a80b07c823ff04a68504530212817163e79ef93800ef535483576ad06510e4891387db4f6259a4f428e9fd636d4df00f4096976aa8248c9e3f8f786479aa2942dc0b2b4b5c086cf949b903f3a465543d3c686ea0055715a4fac9ada361c3872fe930f76e00c440502fe494a24d69dbe6bc0928d4be7c6026fdb2285335ed45dc177eb2e60dc1f634ea45b6cce"
+      },
+      {
+        "name": "application_layer_protocol_negotiation (16)",
+        "protocols": [
+          "h2",
+          "http/1.1"
+        ]
+      },
+      {
+        "name": "signed_certificate_timestamp (18)"
+      },
+      {
+        "name": "ec_point_formats (11)",
+        "elliptic_curves_point_formats": [
+          "0x00"
+        ]
+      },
+      {
+        "name": "supported_groups (10)",
+        "supported_groups": [
+          "TLS_GREASE (0x2a2a)",
+          "X25519MLKEM768 (4588)",
+          "X25519 (29)",
+          "P-256 (23)",
+          "P-384 (24)"
+        ]
+      },
+      {
+        "name": "session_ticket (35)",
+        "data": ""
+      },
+      {
+        "name": "extended_master_secret (23)",
+        "master_secret_data": "",
+        "extended_master_secret_data": ""
+      },
+      {
+        "name": "application_settings_old (17513)",
+        "protocols": [
+          "h2"
+        ]
+      },
+      {
+        "name": "TLS_GREASE (0x2a2a)"
+      }
+    ],
+    "tls_version_record": "771",
+    "tls_version_negotiated": "772",
+    "ja3": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-51-0-13-43-65281-45-5-65037-16-18-11-10-35-23-17513,4588-29-23-24,0",
+    "ja3_hash": "fb519300321e7e157792ac8d3a77e9ee",
+    "ja4": "t13d1516h2_8daaf6152771_02713d6af862",
+    "ja4_r": "t13d1516h2_002f,0035,009c,009d,1301,1302,1303,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0012,0017,001b,0023,002b,002d,0033,4469,fe0d,ff01_0403,0804,0401,0503,0805,0501,0806,0601",
+    "peetprint": "GREASE-772-771|2-1.1|GREASE-4588-29-23-24|1027-2052-1025-1283-2053-1281-2054-1537|1|2|GREASE-4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53|0-10-11-13-16-17513-18-23-27-35-43-45-5-51-65037-65281-GREASE-GREASE",
+    "peetprint_hash": "7466733991096b3f4e6c0e79b0083559",
+    "client_random": "863163dc7e5a1c86f1a8249603bd85722d3c89daac25212b4167f08d6e83f109",
+    "session_id": "02030897d9c146d208efbcdf654e4fd13b2bd2559109dfdb47a3b57bf498c383"
+  },
+  "http2": {
+    "akamai_fingerprint": "1:65536;2:0;4:6291456;6:262144|15663105|0|m,a,s,p",
+    "akamai_fingerprint_hash": "52d84b11737d980aef856699f885ca86",
+    "sent_frames": [
+      {
+        "frame_type": "SETTINGS",
+        "length": 24,
+        "settings": [
+          "HEADER_TABLE_SIZE = 65536",
+          "ENABLE_PUSH = 0",
+          "INITIAL_WINDOW_SIZE = 6291456",
+          "MAX_HEADER_LIST_SIZE = 262144"
+        ]
+      },
+      {
+        "frame_type": "WINDOW_UPDATE",
+        "length": 4,
+        "increment": 15663105
+      },
+      {
+        "frame_type": "HEADERS",
+        "stream_id": 1,
+        "length": 462,
+        "headers": [
+          ":method: GET",
+          ":authority: tls.peet.ws",
+          ":scheme: https",
+          ":path: /api/all",
+          "sec-ch-ua: \"Google Chrome\";v=\"131\", \"Chromium\";v=\"131\", \"Not_A Brand\";v=\"24\"",
+          "sec-ch-ua-mobile: ?0",
+          "sec-ch-ua-platform: \"macOS\"",
+          "upgrade-insecure-requests: 1",
+          "user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36",
+          "accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
+          "sec-fetch-site: none",
+          "sec-fetch-mode: navigate",
+          "sec-fetch-user: ?1",
+          "sec-fetch-dest: document",
+          "accept-encoding: gzip, deflate, br, zstd",
+          "accept-language: en-US,en;q=0.9",
+          "priority: u=0, i"
+        ],
+        "flags": [
+          "EndStream (0x1)",
+          "EndHeaders (0x4)",
+          "Priority (0x20)"
+        ],
+        "priority": {
+          "weight": 256,
+          "depends_on": 0,
+          "exclusive": 1
+        }
+      }
+    ]
+  },
+  "tcpip": {
+    "cap_length": 1024,
+    "dst_port": 443,
+    "src_port": 59988,
+    "ip": {
+      "tos": 74,
+      "ttl": 44,
+      "ip_version": 4,
+      "dst_ip": "205.185.123.167",
+      "src_ip": "92.218.110.236"
+    },
+    "tcp": {
+      "ack": 3744637131,
+      "checksum": 7175,
+      "seq": 552557913,
+      "window": 2061
+    }
+  }
+}

package/captures/chrome-131/tls/client_hello.meta.json

@@ -0,0 +1,20 @@
+{
+    "source": "curl-impersonate",
+    "profile": "chrome-131",
+    "protocol": "tls",
+    "record": "client_hello",
+    "description": "TLS 1.3 ClientHello generated by curl-impersonate against tls.peet.ws impersonating chrome131. Captured via transparent SOCKS5 relay with correct SNI. Fields below are intentionally randomized per RFC 8446/8701 and must be masked during golden comparison (Cat 14).",
+    "randomizedFields": [
+        {
+            "byteOffset": 12,
+            "length": 32,
+            "reason": "random"
+        },
+        {
+            "byteOffset": 112,
+            "length": 1641,
+            "reason": "grease"
+        }
+    ],
+    "createdAt": "2026-08-04T00:28:49Z"
+}

package/captures/chrome-140/http2/settings.meta.json

@@ -0,0 +1,9 @@
+{
+    "source": "curl-impersonate",
+    "profile": "chrome-140",
+    "protocol": "http2",
+    "record": "settings",
+    "description": "First HTTP/2 SETTINGS frame sent by curl-impersonate --chrome-140. HTTP/2 SETTINGS are not randomized, so the ignore-list is empty.",
+    "randomizedFields": [],
+    "createdAt": "2026-08-02T00:00:00Z"
+}

package/captures/chrome-140/tls/client_hello.meta.json

@@ -0,0 +1,12 @@
+{
+    "source": "curl-impersonate",
+    "profile": "chrome-140",
+    "protocol": "tls",
+    "record": "client_hello",
+    "description": "TLS 1.3 ClientHello generated by curl-impersonate --chrome-140 against example.com. Fields below are intentionally randomized per RFC 8446 and must be masked during golden comparison (Cat 14).",
+    "randomizedFields": [
+        { "byteOffset": 12, "length": 32, "reason": "random" },
+        { "byteOffset": 49, "length": 32, "reason": "ephemeral_key" }
+    ],
+    "createdAt": "2026-08-02T00:00:00Z"
+}

package/captures/firefox-128/tls/client_hello.meta.json

@@ -0,0 +1,12 @@
+{
+    "source": "curl-impersonate",
+    "profile": "firefox-128",
+    "protocol": "tls",
+    "record": "client_hello",
+    "description": "TLS 1.3 ClientHello generated by curl-impersonate --firefox-128 against example.com.",
+    "randomizedFields": [
+        { "byteOffset": 12, "length": 32, "reason": "random" },
+        { "byteOffset": 49, "length": 32, "reason": "ephemeral_key" }
+    ],
+    "createdAt": "2026-08-02T00:00:00Z"
+}

package/captures/firefox-133/http2/settings.meta.json

@@ -0,0 +1,9 @@
+{
+    "source": "curl-impersonate",
+    "profile": "firefox-133",
+    "protocol": "http2",
+    "record": "settings",
+    "description": "First HTTP/2 SETTINGS frame sent by curl-impersonate firefox133. HTTP/2 SETTINGS are not randomized, so the ignore-list is empty.",
+    "randomizedFields": [],
+    "createdAt": "2026-08-04T00:28:49Z"
+}