#!/usr/bin/env bash
# curl_chrome131, TLS/HTTP2 fingerprint ONLY — no baked-in request headers.
#
# Why this exists: `curl_chrome131` hardcodes a header set (Sec-Fetch-Site: none, Accept, UA, …)
# suited to a one-shot fetch. Inside a multi-step funnel those values are wrong, and you cannot
# correct them with -H: curl APPENDS a second copy rather than replacing, so the request goes out
# carrying BOTH `Sec-Fetch-Site: none` and your value. Measured, not assumed — a duplicated
# Sec-Fetch-Site is a worse signature than the wrong one.
#
# So: identical TLS/H2 flags (the JA3 is the whole point of curl-impersonate), zero headers. The
# caller supplies every header, per request kind.
#
# 🛑 The TLS fingerprint here is Chrome 131's. Any User-Agent / sec-ch-ua the caller sends must say
#    131 too — claiming 151 over a 131 handshake is an incoherence, not an upgrade.

dir=${0%/*}

"$dir/curl-impersonate" \
    --ciphers TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA:AES256-SHA \
    --curves X25519MLKEM768:X25519:P-256:P-384 \
    --split-cookies \
    --http2 \
    --http2-settings '1:65536;2:0;4:6291456;6:262144' \
    --http2-window-update 15663105 \
    --http2-stream-weight 256 \
    --http2-stream-exclusive 1 \
    --compressed \
    --ech true \
    --tlsv1.2 --alps --tls-permute-extensions \
    --cert-compression brotli \
    --tls-grease \
    --tls-signed-cert-timestamps \
    "$@"
