fingerprint

type AkamaiPresence struct {
	Settings        *HTTP2Settings
	PseudoOrder     []string
	SeenSettings    map[uint16]bool // SETTINGS IDs that appeared in the string
	HasWindowUpdate bool            // WINDOW_UPDATE field had a value
	HasStreamWeight bool            // PRIORITY field had a non-zero weight
}

type ClientHints struct {
	// Low-entropy hints (always sent by Chrome)
	UA         string // Sec-Ch-Ua
	UAMobile   string // Sec-Ch-Ua-Mobile
	UAPlatform string // Sec-Ch-Ua-Platform

	// High-entropy hints (only sent after Accept-CH)
	UAArch            string // Sec-Ch-Ua-Arch
	UABitness         string // Sec-Ch-Ua-Bitness
	UAFullVersionList string // Sec-Ch-Ua-Full-Version-List
	UAModel           string // Sec-Ch-Ua-Model
	UAPlatformVersion string // Sec-Ch-Ua-Platform-Version
	UAWow64           string // Sec-Ch-Ua-Wow64
}

type ClientHintsProfile struct {
	FullVersionList string // sec-ch-ua-full-version-list; "" -> derived from sec-ch-ua (brands/order/GREASE preserved, versions expanded)
	PlatformVersion string // sec-ch-ua-platform-version override; "" -> platform default (Linux is "")
	Arch            string // sec-ch-ua-arch; "" -> platform default
	Bitness         string // sec-ch-ua-bitness; "" -> platform default
	Model           string // sec-ch-ua-model; "" -> platform default (desktop is "")
	Wow64           string // sec-ch-ua-wow64; "" -> "?0"
}

type ClientHintsSpec struct {
	FullVersionList string `json:"full_version_list,omitempty"` // sec-ch-ua-full-version-list (exact build from a real capture)
	PlatformVersion string `json:"platform_version,omitempty"`  // sec-ch-ua-platform-version override
	Arch            string `json:"arch,omitempty"`              // sec-ch-ua-arch
	Bitness         string `json:"bitness,omitempty"`           // sec-ch-ua-bitness
	Model           string `json:"model,omitempty"`             // sec-ch-ua-model
	Wow64           string `json:"wow64,omitempty"`             // sec-ch-ua-wow64
}

type FetchDest string

type FetchMode string

type FetchSite string

type H2FingerprintConfig struct {
	HPACKHeaderOrder    []string // HPACK wire encoding order. nil = Chrome 143 default.
	HPACKIndexingPolicy string   // "chrome"/"never"/"always"/"default". "" = "chrome".
	HPACKNeverIndex     []string // Headers never HPACK-indexed. nil = Chrome default.
	StreamPriorityMode  string   // "chrome"/"default". "" = "chrome".
	DisableCookieSplit  *bool    // nil = true (single field). Chrome+Firefox crumble (false); Safari single (true).
	SettingsOrder       []uint16 // H2 SETTINGS frame ID order. nil = dynamic from HTTP2Settings.
	PseudoHeaderOrder   []string // Pseudo-header order. nil = heuristic (Chrome m,a,s,p / Safari m,s,p,a).

	// PriorityTable maps sec-fetch-dest values to RFC 7540 stream priorities and
	// the matching RFC 9218 priority: header value. Populated for browsers (e.g.
	// Chrome 147 desktop) that emit a different urgency per resource type.
	//
	// When nil, the transport uses HTTP2Settings.StreamWeight / StreamExclusive
	// for every request — the legacy single-weight behaviour. When non-nil, the
	// transport selects an entry based on the request's sec-fetch-dest header,
	// derives the H2 wire weight from urgency via PriorityFromUrgency, and
	// injects the priority: header per the RFC 9218 emission rules.
	//
	// Map keys are sec-fetch-dest values exactly as Chrome emits them
	// ("document", "image", "script", "empty", etc.). Lookups are case-sensitive.
	PriorityTable map[string]ResourcePriority
}

type H3FingerprintConfig struct {
	QPACKMaxTableCapacity     *uint64 // nil = 65536 (Chrome). Safari heuristic fallback.
	QPACKBlockedStreams       *uint64 // nil = 100
	MaxFieldSectionSize       *uint64 // nil = 262144 (Chrome). 0 to omit (Safari).
	EnableDatagrams           *bool   // nil = true (Chrome). Safari heuristic fallback.
	QUICInitialPacketSize     *uint16 // nil = 1250 (Chrome). MASQUE overrides to 1350.
	QUICMaxIncomingStreams    *int64  // nil = 100
	QUICMaxIncomingUniStreams *int64  // nil = 103
	QUICAllow0RTT             *bool   // nil = true
	QUICChromeStyleInitial    *bool   // nil = true
	QUICDisableHelloScramble  *bool   // nil = true
	QUICTransportParamOrder   string  // "chrome"/"random". "" = "chrome".
	QUICConnectionIDLength    *int    // nil = 0 (Chrome empty SCID). Firefox uses 8.
	QUICMaxDatagramFrameSize  *uint64 // nil = 65536 (Chrome). 0 to use quic-go default (16383).
	MaxResponseHeaderBytes    *uint64 // nil = 262144
	SendGreaseFrames          *bool   // nil = true

	// QUIC flow-control windows. quic-go translates these to wire transport
	// parameters initial_max_data (4) and initial_max_stream_data_* (5/6/7).
	// nil = quic-go default (~7.5 MB conn, ~512 KB stream). Safari/iOS Chrome
	// uses larger conn (16 MB) and smaller per-stream (2 MB) — set both to
	// match.
	QUICInitialStreamReceiveWindow     *uint64 // nil = quic-go default. iOS Chrome sends 2097152.
	QUICInitialConnectionReceiveWindow *uint64 // nil = quic-go default. iOS Chrome sends 16777216.
}

type HTTP2SettingSpec struct {
	ID    uint16 `json:"id"`
	Value uint32 `json:"value"`
}

type HTTP2Settings struct {
	HeaderTableSize      uint32
	EnablePush           bool
	MaxConcurrentStreams uint32
	InitialWindowSize    uint32
	MaxFrameSize         uint32
	MaxHeaderListSize    uint32
	// Window update and stream settings
	ConnectionWindowUpdate uint32
	StreamWeight           uint16 // Chrome sends 255 on wire (set to 256, code does -1)
	StreamExclusive        bool
	// RFC 9218 - disables RFC 7540 stream priorities
	NoRFC7540Priorities bool
}

type HTTP2Spec struct {
	// Akamai string (parsed first, then individual fields overlay)
	Akamai string `json:"akamai,omitempty"`

	// Individual SETTINGS fields (overlay on top of akamai if both set)
	HeaderTableSize        *uint32 `json:"header_table_size,omitempty"`
	EnablePush             *bool   `json:"enable_push,omitempty"`
	MaxConcurrentStreams   *uint32 `json:"max_concurrent_streams,omitempty"`
	InitialWindowSize      *uint32 `json:"initial_window_size,omitempty"`
	MaxFrameSize           *uint32 `json:"max_frame_size,omitempty"`
	MaxHeaderListSize      *uint32 `json:"max_header_list_size,omitempty"`
	ConnectionWindowUpdate *uint32 `json:"connection_window_update,omitempty"`
	StreamWeight           *uint16 `json:"stream_weight,omitempty"`
	StreamExclusive        *bool   `json:"stream_exclusive,omitempty"`
	NoRFC7540Priorities    *bool   `json:"no_rfc7540_priorities,omitempty"`

	// H2 fingerprinting config
	Settings      []HTTP2SettingSpec `json:"settings,omitempty"`
	SettingsOrder []uint16           `json:"settings_order,omitempty"`
	PseudoOrder   []string           `json:"pseudo_order,omitempty"`

	// HPACK config
	HPACKHeaderOrder    []string `json:"hpack_header_order,omitempty"`
	HPACKIndexingPolicy *string  `json:"hpack_indexing_policy,omitempty"` // "chrome","never","always","default"
	HPACKNeverIndex     []string `json:"hpack_never_index,omitempty"`
	StreamPriorityMode  *string  `json:"stream_priority_mode,omitempty"` // "chrome","default"
	DisableCookieSplit  *bool    `json:"disable_cookie_split,omitempty"`

	// PriorityTable maps sec-fetch-dest values to per-resource priority
	// settings. When populated, the transport emits a per-request RFC 7540
	// stream weight (derived from urgency) and RFC 9218 priority: header
	// for each request based on its sec-fetch-dest. When omitted, the
	// preset's static StreamWeight / StreamExclusive is used for every
	// request (legacy single-weight behaviour).
	PriorityTable map[string]ResourcePrioritySpec `json:"priority_table,omitempty"`
}

type HTTP3Spec struct {
	QPACKMaxTableCapacity     *uint64 `json:"qpack_max_table_capacity,omitempty"`
	QPACKBlockedStreams       *uint64 `json:"qpack_blocked_streams,omitempty"`
	MaxFieldSectionSize       *uint64 `json:"max_field_section_size,omitempty"`
	EnableDatagrams           *bool   `json:"enable_datagrams,omitempty"`
	QUICInitialPacketSize     *uint16 `json:"quic_initial_packet_size,omitempty"`
	QUICMaxIncomingStreams    *int64  `json:"quic_max_incoming_streams,omitempty"`
	QUICMaxIncomingUniStreams *int64  `json:"quic_max_incoming_uni_streams,omitempty"`
	QUICAllow0RTT             *bool   `json:"quic_allow_0rtt,omitempty"`
	QUICChromeStyleInitial    *bool   `json:"quic_chrome_style_initial,omitempty"`
	QUICDisableHelloScramble  *bool   `json:"quic_disable_hello_scramble,omitempty"`
	QUICTransportParamOrder   *string `json:"quic_transport_param_order,omitempty"` // "chrome","random"
	QUICConnectionIDLength    *int    `json:"quic_connection_id_length,omitempty"`
	QUICMaxDatagramFrameSize  *uint64 `json:"quic_max_datagram_frame_size,omitempty"`
	MaxResponseHeaderBytes    *uint64 `json:"max_response_header_bytes,omitempty"`
	SendGreaseFrames          *bool   `json:"send_grease_frames,omitempty"`

	// QUIC flow-control windows. These map to quic.Config fields and ultimately
	// to wire transport parameters initial_max_data (4) and initial_max_stream_data_*
	// (5/6/7). nil = quic-go default. iOS Chrome / Safari uses larger conn (16 MiB)
	// + smaller per-stream (2 MiB) than Chrome desktop.
	QUICInitialStreamReceiveWindow     *uint64 `json:"quic_initial_stream_receive_window,omitempty"`
	QUICInitialConnectionReceiveWindow *uint64 `json:"quic_initial_connection_receive_window,omitempty"`
}

type HeaderCoherence struct {
	// contains filtered or unexported fields
}

type HeaderPair struct {
	Key   string
	Value string
}

type HeaderPairSpec struct {
	Key   string `json:"key"`
	Value string `json:"value"`
}

type HeaderSpec struct {
	UserAgent string            `json:"user_agent,omitempty"`
	Values    map[string]string `json:"values,omitempty"`
	Order     []HeaderPairSpec  `json:"order,omitempty"`
}

type JA3Extras struct {
	SignatureAlgorithms           []tls.SignatureScheme
	DelegatedCredentialAlgorithms []tls.SignatureScheme // for ext 34; nil = Chrome defaults
	ALPN                          []string
	CertCompAlgs                  []tls.CertCompressionAlgo
	PermuteExtensions             bool
	RecordSizeLimit               uint16 // default: 0x4001
	KeyShareCurves                int    // number of curves to send key shares for; 0 = 1 (default)
}

type JA3ExtrasSpec struct {
	SignatureAlgorithms           []uint16 `json:"signature_algorithms,omitempty"`
	DelegatedCredentialAlgorithms []uint16 `json:"delegated_credential_algorithms,omitempty"`
	ALPN                          []string `json:"alpn,omitempty"`
	CertCompression               []string `json:"cert_compression,omitempty"`
	PermuteExtensions             *bool    `json:"permute_extensions,omitempty"`
	RecordSizeLimit               *uint16  `json:"record_size_limit,omitempty"`
	KeyShareCurves                *int     `json:"key_share_curves,omitempty"`
}

type PlatformInfo struct {
	UserAgentOS        string // e.g., "(Windows NT 10.0; Win64; x64)" or "(X11; Linux x86_64)"
	Platform           string // e.g., "Windows", "Linux", "macOS"
	Arch               string // e.g., "x86", "arm"
	PlatformVersion    string // e.g., "10.0.0", "6.12.0", "14.7.0"
	FirefoxUserAgentOS string // Firefox has slightly different format
}

type PoolSpec struct {
	Name     string       `json:"name"`
	Strategy string       `json:"strategy"` // "random" or "round-robin"
	Presets  []PresetSpec `json:"presets"`
}

type PoolStrategy int

type Preset struct {
	Name                 string
	ClientHelloID        tls.ClientHelloID // For TCP/TLS (HTTP/1.1, HTTP/2)
	PSKClientHelloID     tls.ClientHelloID // For TCP/TLS with PSK (session resumption)
	QUICClientHelloID    tls.ClientHelloID // For QUIC/HTTP/3 (different TLS extensions)
	QUICPSKClientHelloID tls.ClientHelloID // For QUIC/HTTP/3 with PSK (session resumption)
	UserAgent            string
	Headers              map[string]string  // For backward compatibility
	HeaderOrder          []HeaderPair       // Ordered headers for HTTP/2
	ClientHints          ClientHintsProfile // High-entropy UA client hint overrides; empty fields are derived from sec-ch-ua (see Preset.ResolveClientHints)
	HTTP2Settings        HTTP2Settings
	TCPFingerprint       TCPFingerprint
	SupportHTTP3         bool
	DisableHTTP2         bool                 // When true, auto mode skips HTTP/2 and goes straight to HTTP/1.1 (zero value = H2 enabled)
	H2Config             *H2FingerprintConfig // nil = Chrome defaults for all H2 fingerprinting
	H3Config             *H3FingerprintConfig // nil = Chrome defaults for all H3/QUIC fingerprinting
	JA3                  string               // JA3 fingerprint string. When set, parsed fresh per connection instead of using ClientHelloID.
	JA3Extras            *JA3Extras           // Supplements JA3 parsing. nil = Chrome defaults.
	BasedOn              string               // For custom presets: name of the parent preset (used by inheritance-loop detection). Empty for built-ins.

	// SignatureAlgorithms, when non-empty, replaces the signature_algorithms
	// extension emitted on TCP (HTTP/1.1 + HTTP/2), on top of whatever base spec
	// the ClientHelloID (or JA3) produces. It lets a preset keep a byte-exact
	// hand-tuned base spec (correct ALPS/ECH/key_share/GREASE ordering) while
	// changing ONLY the sig-algs — e.g. adding Chrome 150's ML-DSA post-quantum
	// codepoints (0x0904-0x0906) on top of the Chrome 146 base. Values are raw
	// SignatureScheme (uint16) codepoints, so schemes uTLS has no named constant
	// for (like ML-DSA) are still emitted verbatim.
	SignatureAlgorithms []tls.SignatureScheme

	// QUICSignatureAlgorithms is the HTTP/3 (QUIC) counterpart of
	// SignatureAlgorithms. It is separate because a browser's QUIC ClientHello can
	// advertise a DIFFERENT sig-algs set than its TCP one — e.g. Chrome 150 sends
	// ML-DSA on TCP but NOT on QUIC (QUIC anti-amplification limits make large PQ
	// certificate chains impractical), and adds rsa_pkcs1_sha1 there instead.
	// Empty = leave the QUIC base ClientHelloID untouched.
	QUICSignatureAlgorithms []tls.SignatureScheme
}

type PresetFile struct {
	Version int         `json:"version"`
	Preset  *PresetSpec `json:"preset,omitempty"`
	Pool    *PoolSpec   `json:"pool,omitempty"`
}

type PresetInfo struct {
	Protocols []string `json:"protocols"`
}

type PresetPool struct {
	// contains filtered or unexported fields
}

type PresetSpec struct {
	Name        string           `json:"name"`
	BasedOn     string           `json:"based_on,omitempty"`
	TLS         *TLSSpec         `json:"tls,omitempty"`
	HTTP2       *HTTP2Spec       `json:"http2,omitempty"`
	HTTP3       *HTTP3Spec       `json:"http3,omitempty"`
	Headers     *HeaderSpec      `json:"headers,omitempty"`
	ClientHints *ClientHintsSpec `json:"client_hints,omitempty"`
	TCP         *TCPSpec         `json:"tcp,omitempty"`
	Protocol    *ProtocolSpec    `json:"protocols,omitempty"`
}

type ProtocolSpec struct {
	HTTP3 *bool `json:"http3,omitempty"`
	// Aliases / extra toggles. H3 is an alias for HTTP3. H2=false disables HTTP/2
	// in auto mode (the preset goes straight to HTTP/1.1). Accepting "h2"/"h3"
	// matches what users naturally write; previously only "http3" was honored.
	H3 *bool `json:"h3,omitempty"`
	H2 *bool `json:"h2,omitempty"`
}

type RequestContext struct {
	// Mode is the fetch mode (navigate, cors, no-cors, same-origin)
	Mode FetchMode
	// Dest is the resource destination type
	Dest FetchDest
	// Site is the relationship between request origin and target
	Site FetchSite
	// IsUserTriggered indicates if the request was user-initiated (affects Sec-Fetch-User)
	IsUserTriggered bool
	// Referrer is the page that initiated the request (for Sec-Fetch-Site calculation)
	Referrer string
	// TargetURL is the URL being requested
	TargetURL string
}

type ResourcePriority struct {
	Urgency     uint8 // 0–7; 3 = default (no `u=` on header)
	Incremental bool  // RFC 9218 `i` parameter
	EmitHeader  bool  // false → suppress the priority: HTTP header entirely
}

type ResourcePrioritySpec struct {
	Urgency     uint8 `json:"urgency"`
	Incremental bool  `json:"incremental"`
	EmitHeader  bool  `json:"emit_header"`
}

type SecFetchHeaders struct {
	Site string
	Mode string
	Dest string
	User string // "?1" for user-triggered, empty otherwise
}

type TCPFingerprint struct {
	TTL         int  // IP Time-To-Live: 128=Windows, 64=Linux/macOS/iOS/Android
	MSS         int  // TCP Maximum Segment Size: 1460 for standard Ethernet
	WindowSize  int  // TCP Window Size in SYN: 64240=Win10/11, 65535=Linux/macOS
	WindowScale int  // TCP Window Scale option: 8=Win10/11, 7=Linux/Android, 6=macOS/iOS
	DFBit       bool // IP Don't Fragment flag
}

type TCPSpec struct {
	Platform    string `json:"platform,omitempty"` // "Windows","macOS","Linux" — shorthand
	TTL         *int   `json:"ttl,omitempty"`
	MSS         *int   `json:"mss,omitempty"`
	WindowSize  *int   `json:"window_size,omitempty"`
	WindowScale *int   `json:"window_scale,omitempty"`
	DFBit       *bool  `json:"df_bit,omitempty"`
}

type TLSSpec struct {
	// Mutually exclusive: use client_hello OR ja3, not both
	ClientHello        string `json:"client_hello,omitempty"`      // e.g., "chrome-146-windows"
	PSKClientHello     string `json:"psk_client_hello,omitempty"`  // e.g., "chrome-146-windows-psk"
	QUICClientHello    string `json:"quic_client_hello,omitempty"` // e.g., "chrome-146-quic"
	QUICPSKClientHello string `json:"quic_psk_client_hello,omitempty"`

	JA3           string         `json:"ja3,omitempty"` // JA3 string
	JA3ExtrasSpec *JA3ExtrasSpec `json:"ja3_extras,omitempty"`

	// Individual extension data (supplements client_hello or ja3)
	SignatureAlgorithms           []uint16 `json:"signature_algorithms,omitempty"`      // TCP (H1/H2) sig-algs override; overrides the ClientHelloID base
	QUICSignatureAlgorithms       []uint16 `json:"quic_signature_algorithms,omitempty"` // HTTP/3 (QUIC) sig-algs override; separate because a browser's QUIC set can differ (e.g. Chrome 150 sends ML-DSA on TCP only)
	DelegatedCredentialAlgorithms []uint16 `json:"delegated_credential_algorithms,omitempty"`
	ALPN                          []string `json:"alpn,omitempty"`
	CertCompression               []string `json:"cert_compression,omitempty"` // "brotli", "zlib", "zstd"
	PermuteExtensions             *bool    `json:"permute_extensions,omitempty"`
	RecordSizeLimit               *uint16  `json:"record_size_limit,omitempty"`
	KeyShareCurves                *int     `json:"key_share_curves,omitempty"` // number of curves to send key shares for; nil/0 = 1
}