-spec cipher_atom_to_code(atom()) -> integer().

Convert an internal cipher atom to its TLS cipher suite code.

Used when building ServerHello to send the correct suite to the client.

-spec cipher_code_to_atom(integer()) -> atom().

Convert a TLS cipher suite code to its internal atom.

-spec extract_group_key(atom(), [{integer(), binary()}] | undefined) -> binary() | undefined.

Extract the client's key_share public key for a given group atom.

-spec group_atom(integer()) -> atom() | integer().

Named-group wire code to atom. An unknown code stays an integer.

-spec negotiate_alpn([binary()], [binary()]) -> binary() | undefined.

Server: pick the first server protocol the client also offered.

-spec select_cipher([integer()], [atom()]) -> atom().

Server: select a cipher suite from the client's list.

ClientCipherSuites is a list of TLS cipher suite codes (integers), converted to atoms for internal use. The server's own order decides, so a deployment that must not negotiate a particular suite can say so; without this the preference was fixed in code and a ciphers option had nowhere to take effect.

-spec select_key_share_group([atom()], [{integer(), binary()}] | undefined, [atom()]) ->
                                {direct, atom()} | {hrr, atom()} | none.

Decide the key-exchange group for a ClientHello (RFC 8446 §4.1.4).

Returns {direct, Group} when the client already sent a usable key_share, {hrr, Group} when a HelloRetryRequest is needed, or none when there is no group both sides support.