) as SSLSocket

        val tlsEquipPlan = planWithCurrentOrInitialConnectionSpec(connectionSpecs, sslSocket)
        val connectionSpec = connectionSpecs[tlsEquipPlan.connectionSpecIndex]

        // Figure out the next connection spec in case we need a retry.
        retryTlsConnection = tlsEquipPlan.nextConnectionSpec(connectionSpecs, sslSocket)

        connectionSpec.apply(sslSocket, isFallback = tlsEquipPlan.isTlsFallback)

internal fun checkOffsetAndCount(
  arrayLength: Long,
  offset: Long,
  count: Long,
) {
  if (offset or count < 0L || offset > arrayLength || arrayLength - offset < count) {
    throw ArrayIndexOutOfBoundsException("length=$arrayLength, offset=$offset, count=$offset")
  }
}

val commonEmptyHeaders: Headers = Headers.headersOf()

      frameHeader(
        streamId = 0,
        length = settings.size() * 6,
        type = TYPE_SETTINGS,
        flags = FLAG_NONE,
      )
      for (i in 0 until Settings.COUNT) {
        if (!settings.isSet(i)) continue
        val id =
          when (i) {
            4 -> 3 // SETTINGS_MAX_CONCURRENT_STREAMS renumbered.
            7 -> 4 // SETTINGS_INITIAL_WINDOW_SIZE renumbered.

  }

  override fun checkServerTrusted(
    chain: Array<out X509Certificate>,
    authType: String,
  ) = throw CertificateException("Unsupported operation")

  override fun checkClientTrusted(
    chain: Array<out X509Certificate>,
    authType: String?,
  ) = throw CertificateException("Unsupported operation")

  override fun checkClientTrusted(
    chain: Array<out X509Certificate>,
    authType: String,
    engine: SSLEngine?,

    )
    val expected = "a%2B%3D%26+b=c%2B%3D%26+d&space%2C+the=final+frontier&%2525=%2525"
    assertThat(body.contentLength()).isEqualTo(expected.length.toLong())
    val out = Buffer()
    body.writeTo(out)
    assertThat(out.readUtf8()).isEqualTo(expected)
  }

  @Test
  fun addEncoded() {
    val body =
      FormBody.Builder()
        .addEncoded("a+=& b", "c+=& d")
        .addEncoded("e+=& f", "g+=& h")

      Headers responseHeaders = response.headers();
      for (int i = 0; i < responseHeaders.size(); i++) {
        System.out.println(responseHeaders.name(i) + ": " + responseHeaders.value(i));
      }

      System.out.println(response.body().string());
    }
  }

  public static void main(String... args) throws Exception {
    new SynchronousGet().run();
  }

      object : WebSocketListener() {
        override fun onFailure(
          webSocket: WebSocket,
          t: Throwable,
          response: Response?,
        ) {
          if (attempts.count > 0) {
            clientListener.setNextEventDelegate(this)
            webSockets.add(client.newWebSocket(request, clientListener))
            attempts.countDown()
          }
        }
      }

    }
    var count = 0
    while (!data.exhausted()) {
      assertFailsWith<ProtocolException> {
        clientReader.processNextFrame()
      }.also { expected ->
        assertThat(expected.message!!)
          .matches(Regex("Code \\d+ is reserved and may not be used."))
      }
      count++
    }
    assertThat(count).isEqualTo(1988)
  }

   * match "*.com" or similar. This was a nonstandard check that we've since dropped. It is the CA's
   * responsibility to not hand out certificates that match so broadly.
   */
  @Test fun wildcardsDoesNotNeedTwoDots() {
    // openssl req -x509 -nodes -days 36500 -subj '/CN=*.com' -newkey rsa:512 -out cert.pem
    val session =
      session(
        """
        -----BEGIN CERTIFICATE-----

      sessionFactory.start();
    }

    HttpUrl authorizeUrl = sessionFactory.newAuthorizeUrl(scopes, team, session -> {
      initOauthSession(session);
      System.out.printf("session granted: %s\n", session);
    });

    System.out.printf("open this URL in a browser: %s\n", authorizeUrl);
  }

  /** Set the OAuth session for this client. */
  public synchronized void initOauthSession(OAuthSession session) {