}

    /**
     * Decodes a base64 encoded ID back to the original object name.
     *
     * @param id the encoded ID to decode
     * @return the decoded object name
     */
    protected static String decodeId(final String id) {
        if (id == null) {
            return StringUtil.EMPTY;
        }

      return decode(certificatePem, pkcs8Base64)
    }

    private fun decode(
      certificatePem: String,
      pkcs8Base64Text: String,
    ): HeldCertificate {
      val certificate = certificatePem.decodeCertificatePem()

      val pkcs8Bytes =
        pkcs8Base64Text.decodeBase64()
          ?: throw IllegalArgumentException("failed to decode private key")

    }
  }

  /**
   * This decodes a value into its contents using a preceding member of the same SEQUENCE. For
   * example, extensions type IDs specify what types to use for the corresponding values.
   *
   * If the hint is unknown [chooser] should return null which will cause the value to be decoded as
   * an opaque byte string.
   *

            if (encoded != null) {
                String decoded = permissionHelper.decode(encoded);
                assertNotNull("Decoded value should not be null for: " + value, decoded);
                assertEquals("Decoded value should match original: " + value + " -> " + encoded + " -> " + decoded, value, decoded);
            }
        }
    }

    public void test_encode_withLongValues() {

    }
  }

  private static void testEncoding(BaseEncoding encoding, String decoded, String encoded) {
    testEncodes(encoding, decoded, encoded);
    testDecodes(encoding, encoded, decoded);
  }

  private static void testEncodes(BaseEncoding encoding, String decoded, String encoded) {
    assertThat(encoding.encode(decoded.getBytes(UTF_8))).isEqualTo(encoded);
  }

  private static void testEncodesWithOffset(

            }
        }
        return u;
    }

    /**
     * Decodes a URL as a name using appropriate character encoding.
     * Handles encoding detection from parent URLs and configuration settings.
     *
     * @param url the URL to decode
     * @param escapePlus whether to escape plus signs before decoding
     * @return the decoded URL name, or original URL if decoding fails
     */

        return permission;
    }

    /**
     * Decodes a search role format string back to a permission string.
     * Reverses the encoding process to restore original permission format.
     *
     * @param value the encoded permission string to decode
     * @return the decoded permission string, or null if the input is blank or invalid
     */
    public String decode(final String value) {
        if (StringUtil.isBlank(value)) {

  val normalized = normalizeNfc(bufferB.readUtf8())
  bufferA.writeUtf8(normalized)

  // 3. For each label, convert/validate Punycode.
  val decoded = Punycode.decode(bufferA.readUtf8()) ?: return null

  // 4.1 Validate.

  // Must be NFC.
  if (decoded != normalizeNfc(decoded)) return null

  // TODO: Must not begin with a combining mark.
  // TODO: Each character must be 'valid' or 'deviation'. Not mapped.

    }

    /**
     * Decodes a Base64 string to bytes.
     *
     * @param base64String the Base64 string to decode
     * @return the decoded bytes, or null if input is null
     */
    protected byte[] decodeBase64(String base64String) {
        if (base64String == null) {
            return null;
        }
        try {
            return BASE64_DECODER.decode(base64String);

    }
  }

  private static void testEncoding(BaseEncoding encoding, String decoded, String encoded) {
    testEncodes(encoding, decoded, encoded);
    testDecodes(encoding, encoded, decoded);
  }

  private static void testEncodes(BaseEncoding encoding, String decoded, String encoded) {
    assertThat(encoding.encode(decoded.getBytes(UTF_8))).isEqualTo(encoded);
  }

  private static void testEncodesWithOffset(