}

graal {
  mainClass("okhttp3.curl.MainCommandLineKt")
  outputName("okcurl")
  graalVersion(libs.versions.graalvm.get())
  javaVersion("11")

  option("--no-fallback")

  if (Os.isFamily(Os.FAMILY_WINDOWS)) {
    // May be possible without, but autodetection is problematic on Windows 10
    // see https://github.com/palantir/gradle-graal
    // see https://www.graalvm.org/docs/reference-manual/native-image/#prerequisites

      .build()
  }

  fun buildCleanBrowsing(bootstrapClient: OkHttpClient): DnsOverHttps {
    return DnsOverHttps.Builder()
      .client(bootstrapClient)
      .url("https://doh.cleanbrowsing.org/doh/family-filter/".toHttpUrl())
      .includeIPv6(false)
      .build()
  }

  private fun buildChantra(bootstrapClient: OkHttpClient): DnsOverHttps {
    return DnsOverHttps.Builder()
      .client(bootstrapClient)

  ) {
    val pins = findMatchingPins(hostname)
    if (pins.isEmpty()) return

    val peerCertificates = cleanedPeerCertificatesFn()

    for (peerCertificate in peerCertificates) {
      // Lazily compute the hashes for each certificate.
      var sha1: ByteString? = null
      var sha256: ByteString? = null

      for (pin in pins) {
        when (pin.hashAlgorithm) {
          "sha256" -> {

  /**
   * Invoked as soon as a call causes a connection to be started.
   */
  open fun connectStart(
    route: Route,
    call: Call,
  ) {}

  /**
   * Invoked when a connection fails to be established.
   */
  open fun connectFailed(
    route: Route,
    call: Call,
    failure: IOException,
  ) {}

  /**
   * Invoked as soon as a connection is successfully established.
   */

/**
 * Returns true if new reads and writes should be attempted on this.
 *
 * Unfortunately Java's networking APIs don't offer a good health check, so we go on our own by
 * attempting to read with a short timeout. If the fails immediately we know the socket is
 * unhealthy.
 *
 * @param source the source used to read bytes from the socket.
 */
internal fun Socket.isHealthy(source: BufferedSource): Boolean {
  return try {

    assertThat(verifier.verify("a.bar.com", session)).isFalse()
  }

  /**
   * Ignored due to incompatibilities between Android and Java on how non-ASCII subject alt names
   * are parsed. Android fails to parse these, which means we fall back to the CN. The RI does parse
   * them, so the CN is unused.
   */
  @Test fun verifyNonAsciiSubjectAlt() {
    // Expecting actual:
    //  ["bar.com", "花子.co.jp"]

  }

  @Throws(IOException::class)
  override fun close() {
    source.close()
  }

  /**
   * Decompression of the header block occurs above the framing layer. This class lazily reads
   * continuation frames as they are needed by [Hpack.Reader.readHeaders].
   */
  internal class ContinuationSource(
    private val source: BufferedSource,
  ) : Source {
    var length: Int = 0

      client.newBuilder()
        .readTimeout(Duration.ofSeconds(10)) // Confirm we fail before the read timeout.
        .pingInterval(Duration.ofMillis(500))
        .build()

    // Set up the server to ignore the socket. It won't respond to pings!
    server.enqueue(MockResponse(socketPolicy = StallSocketAtStart))

    // Make a call. It'll fail as soon as our pings detect a problem.

  limit: Int,
  encodeSet: String,
  alreadyEncoded: Boolean,
  strict: Boolean,
  plusIsSpace: Boolean,
  unicodeAllowed: Boolean,
  charset: Charset?,
) {
  var encodedCharBuffer: Buffer? = null // Lazily allocated.
  var codePoint: Int
  var i = pos
  while (i < limit) {
    codePoint = input.codePointAt(i)
    if (alreadyEncoded && (
        codePoint == '\t'.code || codePoint == '\n'.code ||

  private var isFinalFrame = false
  private var isControlFrame = false
  private var readingCompressedMessage = false

  private val controlFrameBuffer = Buffer()
  private val messageFrameBuffer = Buffer()

  /** Lazily initialized on first use. */
  private var messageInflater: MessageInflater? = null

  // Masks are only a concern for server writers.
  private val maskKey: ByteArray? = if (isClient) null else ByteArray(4)