#!/usr/bin/env bash

# XHR/fetch variant of curl_chrome131 (2026-06-19).
# IDENTICAL TLS/JA3/HTTP2 fingerprint as curl_chrome131, but WITHOUT the
# document-navigation request headers. The base wrapper hardcodes a top-level
# navigation header block (Accept: text/html, Sec-Fetch-Site: none,
# Sec-Fetch-Mode: navigate, Sec-Fetch-User: ?1, Sec-Fetch-Dest: document,
# Upgrade-Insecure-Requests: 1). Those are CORRECT for the warm GET (a real page
# load) but WRONG for the GraphQL XHR POSTs — and because the caller appends its
# own XHR headers, HTTP/2 MERGES the duplicates into impossible values the PX
# enforcer keys on (e.g. `sec-fetch-site: none,same-origin`). This variant emits
# ONLY the headers a fetch() shares with a navigation (sec-ch-ua client hints,
# UA, accept-encoding) and lets the caller supply accept / content-type /
# sec-fetch-* / accept-language / priority as SINGLE, coherent values.

# Find the directory of this script
dir=${0%/*}

"$dir/curl-impersonate" \
    --ciphers TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA:AES256-SHA \
    --curves X25519MLKEM768:X25519:P-256:P-384 \
    -H 'sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"' \
    -H 'sec-ch-ua-mobile: ?0' \
    -H 'sec-ch-ua-platform: "macOS"' \
    -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36' \
    -H 'Accept-Encoding: gzip, deflate, br, zstd' \
    --split-cookies \
    --http2 \
    --http2-settings '1:65536;2:0;4:6291456;6:262144' \
    --http2-window-update 15663105 \
    --http2-stream-weight 256 \
    --http2-stream-exclusive 1 \
    --compressed \
    --ech true \
    --tlsv1.2 --alps --tls-permute-extensions \
    --cert-compression brotli \
    --tls-grease \
    --tls-signed-cert-timestamps \
    "$@"
