)
    }

    throw SSLPeerUnverifiedException("Certificate chain too long: $result")
  }

  /**
   * Returns true if [toVerify] was signed by [signingCert]'s public key.
   *
   * @param minIntermediates the minimum number of intermediate certificates in [signingCert]. This
   *     is -1 if signing cert is a lone self-signed certificate.
   */
  private fun verifySignature(
    toVerify: X509Certificate,

  fun isCanceled(): Boolean

  /** Returns a plan to attempt. */
  @Throws(IOException::class)
  fun plan(): Plan

  /**
   * Returns true if there's more route plans to try.
   *
   * @param failedConnection an optional connection that was resulted in a failure. If the failure
   *     is recoverable, the connection's route may be recovered for the retry.
   */

     *
     * **This feature is not supported on Android API levels less than 24.** Prior releases lacked
     * a mechanism to trust some hosts and not others.
     *
     * @param hostname the exact hostname from the URL for insecure connections.
     */
    fun addInsecureHost(hostname: String) =
      apply {
        insecureHosts += hostname
      }

      }

    /**
     * Configure this client to allow protocol redirects from HTTPS to HTTP and from HTTP to HTTPS.
     * Redirects are still first restricted by [followRedirects].  Defaults to true.
     *
     * @param followProtocolRedirects whether to follow redirects between HTTPS and HTTP.
     */
    fun followSslRedirects(followProtocolRedirects: Boolean) =
      apply {
        this.followSslRedirects = followProtocolRedirects

  @Deprecated(
    message = "moved to val",
    replaceWith = ReplaceWith(expression = "secure"),
    level = DeprecationLevel.ERROR,
  )
  fun secure(): Boolean = secure

  /**
   * @param forObsoleteRfc2965 true to include a leading `.` on the domain pattern. This is
   *     necessary for `example.com` to match `www.example.com` under RFC 2965. This extra dot is
   *     ignored by more recent specifications.
   */

          message.startsWith("Using PSK to derive early secret") -> Type.Handshake
          else -> Type.Unknown
        }

    override fun toString(): String {
      return if (param != null) {
        message + "\n" + param
      } else {
        message
      }
    }
  }

  private fun quietDebug(message: JsseDebugMessage) {
    if (message.message.startsWith("Ignore")) {
      return
    }

 *
 * @param alreadyEncoded true to leave '%' as-is; false to convert it to '%25'.
 * @param strict true to encode '%' if it is not the prefix of a valid percent encoding.
 * @param plusIsSpace true to encode '+' as "%2B" if it is not already encoded.
 * @param unicodeAllowed true to leave non-ASCII codepoint unencoded.
 * @param charset which charset to use, null equals UTF-8.
 */

   * and returns it. Callers should use this to verify the request was sent as intended within the
   * given time.
   *
   * @param timeout how long to wait before giving up, in units of [unit]
   * @param unit a [TimeUnit] determining how to interpret the [timeout] parameter
   * @return the head of the request queue
   */
  @Throws(InterruptedException::class)
  fun takeRequest(

  /**
   * Invoked prior to a proxy selection.
   *
   * This will be invoked for route selection regardless of whether the client
   * is configured with a single proxy, a proxy selector, or neither.
   *
   * @param url a URL with only the scheme, hostname, and port specified.
   */
  open fun proxySelectStart(
    call: Call,
    url: HttpUrl,
  ) {
  }

  /**
   * Invoked after proxy selection.
   *

/**
 * DNS implementation based on android.net.DnsResolver, which submits a request for
 * A or AAAA records, and returns the addresses or exception.
 *
 * Two instances must be used to get all results for an address.
 *
 * @param network network to use, if not selects the default network.
 */
@RequiresApi(Build.VERSION_CODES.Q)
@ExperimentalOkHttpApi
class AndroidAsyncDns(
  private val dnsClass: AsyncDns.DnsClass,