## PeerAuthentication and ztunnel

  }

  private fun connectHttp2(
    peer: MockHttp2Peer,
    realConnection: RealConnection,
    maxConcurrentStreams: Int,
  ): Http2Connection {
    // Write the mocking script.
    val settings1 = Settings()
    settings1[Settings.MAX_CONCURRENT_STREAMS] = maxConcurrentStreams
    peer.sendFrame().settings(settings1)
    peer.acceptFrame() // ACK
    peer.sendFrame().ping(false, 2, 0)

    shouldntImpactConnection[Settings.INITIAL_WINDOW_SIZE] = 3368
    peer.sendFrame().settings(initial)
    peer.acceptFrame() // ACK
    peer.sendFrame().settings(shouldntImpactConnection)
    peer.acceptFrame() // ACK 2
    peer.acceptFrame() // HEADERS
    peer.play()
    val connection = connect(peer)

    // Verify the peer received the second ACK.
    val ackFrame = peer.takeFrame()

  /** Returns a possibly-empty list of certificates that identify this peer. */
  @get:JvmName("localCertificates") val localCertificates: List<Certificate>,
  // Delayed provider of peerCertificates, to allow lazy cleaning.
  peerCertificatesFn: () -> List<Certificate>,
) {
  /** Returns a possibly-empty list of certificates that identify the remote peer. */
  @get:JvmName("peerCertificates")

   * dependency on those interfaces.
   */
  private class AlpnProvider(
    /** This peer's supported protocols. */
    private val protocols: List<String>,
  ) : InvocationHandler {
    /** Set when remote peer notifies ALPN is unsupported. */
    var unsupported: Boolean = false

    /** The protocol the server selected. */
    var selected: String? = null

    // ConnectionPool.
    taskRunner.newQueue().execute(name = connectionName, block = readerRunnable)
  }

  /** Merges [settings] into this peer's settings and sends them to the remote peer. */
  @Throws(IOException::class)
  fun setSettings(settings: Settings) {
    writer.withLock {
      this.withLock {
        if (isShutdown) {
          throw ConnectionShutdownException()

  fun writeTimeout(): Timeout = writeTimeout

  /** Returns a source that reads data from the peer. */
  fun getSource(): Source = source

  /**
   * Returns a sink that can be used to write data to the peer.
   *
   * @throws IllegalStateException if this stream was initiated by the peer and a [writeHeaders] has
   *     not yet been sent.
   */
  fun getSink(): Sink {
    this.withLock {

 *    from the peer.
 *
 * Web sockets may fail due to HTTP upgrade problems, connectivity problems, or if either peer
 * chooses to short-circuit the graceful shutdown process:
 *
 *  * **Canceled:** the web socket connection failed. Messages that were successfully enqueued by
 *    either peer may not have been transmitted to the other.
 *

     * the held certificate, further certificates are included in the handshake so the peer can
     * build a trusted path to a trusted root certificate.
     *
     * The chain should include all intermediate certificates but does not need the root certificate
     * that we expect to be known by the remote peer. The peer already has that certificate so
     * transmitting it is unnecessary.
     */
    fun heldCertificate(

    webSocket: WebSocket,
    bytes: ByteString,
  ) {
  }

  /**
   * Invoked when the remote peer has indicated that no more incoming messages will be transmitted.
   */
  open fun onClosing(
    webSocket: WebSocket,
    code: Int,
    reason: String,
  ) {
  }

  /**
   * Invoked when both peers have indicated that no more messages will be transmitted and the