chain: Array<out X509Certificate>,
    authType: String,
    host: String,
  ): List<Certificate> {
    if (host in insecureHosts) return listOf()
    try {
      val method =
        checkServerTrustedMethod
          ?: throw CertificateException("Failed to call checkServerTrusted")
      return method.invoke(delegate, chain, authType, host) as List<Certificate>
    } catch (e: InvocationTargetException) {

  fun setup(server: MockWebServer) {
    this.server = server

    // BCX509ExtendedTrustManager not supported in TlsUtil.newTrustManager
    platform.assumeNotBouncyCastle()
  }

  @Test fun `untrusted host in insecureHosts connects successfully`() {
    val serverCertificates = platform.localhostHandshakeCertificates()
    server.useHttps(serverCertificates.sslSocketFactory())
    server.enqueue(MockResponse())

    // 3.5 MBytes so this test can pass on devices with little memory.
    server.bodyLimit = 7 * 512 * 1024
    val connection = server.url("/").toUrl().openConnection() as HttpURLConnection
    connection.setRequestMethod("POST")
    connection.setDoOutput(true)
    connection.setFixedLengthStreamingMode(1024 * 1024 * 1024) // 1 GB
    connection.connect()
    val out = connection.outputStream
    val data = ByteArray(1024 * 1024)

    val encoded = encodeQuery("google.com", TYPE_A)
    assertThat(encoded).isEqualTo("AAABAAABAAAAAAAABmdvb2dsZQNjb20AAAEAAQ")
  }

  private fun encodeQuery(
    host: String,
    type: Int,
  ): String {
    return DnsRecordCodec.encodeQuery(host, type).base64Url().replace("=", "")
  }

  @Test
  fun testGoogleDotComEncodingWithIPv6() {
    val encoded = encodeQuery("google.com", TYPE_AAAA)

/**
 * Android implementation of CertificateChainCleaner using direct Android API calls.
 * Not used if X509TrustManager doesn't implement [X509TrustManager.checkServerTrusted] with
 * an additional host param.
 */
internal class AndroidCertificateChainCleaner(
  private val trustManager: X509TrustManager,
  private val x509TrustManagerExtensions: X509TrustManagerExtensions,
) : CertificateChainCleaner() {

import okhttp3.curl.Main
import okhttp3.internal.http.StatusLine
import okio.sink

internal fun Main.commonCreateRequest(): Request {
  val request = Request.Builder()

  val requestMethod = method ?: if (data != null) "POST" else "GET"

  val url = url ?: throw IOException("No url provided")

  request.url(url)

  data?.let {
    request.method(requestMethod, it.toRequestBody(mediaType()))
  }

 *
 * Tasks control their recurrence schedule. The [runOnce] function returns -1L to signify that the
 * task should not be executed again. Otherwise it returns a delay until the next execution.
 *
 * A task has at most one next execution. If the same task instance is scheduled multiple times, the
 * earliest one wins. This applies to both executions scheduled with [TaskRunner.Queue.schedule] and
 * those implied by the returned execution delay.
 *

          } catch (e: Exception) {
            false
          }
        }
        .build()

    val request =
      Request.Builder()
        .url("https://sni.cloudflaressl.com/cdn-cgi/trace")
        .header("Host", "cloudflare-dns.com")
        .build()
    client.newCall(request).execute().use { response ->
      assertThat(response.code).isEqualTo(200)
      assertThat(response.protocol).isEqualTo(Protocol.HTTP_2)

      val statusParts = status.split(' ', limit = 3)
      require(statusParts.size >= 2) { "Unexpected status: $status" }
      return statusParts[2]
    }

  val headers: Headers
  val trailers: Headers

  // At most one of (body,webSocketListener,streamHandler) is non-null.
  val body: MockResponseBody?
  val webSocketListener: WebSocketListener?
  val streamHandler: StreamHandler?

  val inTunnel: Boolean

fun Request.Builder.commonGet(): Request.Builder = method("GET", null)

fun Request.Builder.commonHead(): Request.Builder = method("HEAD", null)

fun Request.Builder.commonPost(body: RequestBody): Request.Builder = method("POST", body)

fun Request.Builder.commonDelete(body: RequestBody?): Request.Builder = method("DELETE", body)

fun Request.Builder.commonPut(body: RequestBody): Request.Builder = method("PUT", body)