assertThat(encoding.encode(decoded.getBytes(UTF_8), offset, len)).isEqualTo(encoded);
  }

  private static void testDecodes(BaseEncoding encoding, String encoded, String decoded) {
    assertThat(encoding.canDecode(encoded)).isTrue();
    assertThat(encoding.decode(encoded)).isEqualTo(decoded.getBytes(UTF_8));
  }

    assertThat(encoding.encode(decoded.getBytes(UTF_8), offset, len)).isEqualTo(encoded);
  }

  private static void testDecodes(BaseEncoding encoding, String encoded, String decoded) {
    assertThat(encoding.canDecode(encoded)).isTrue();
    assertThat(encoding.decode(encoded)).isEqualTo(decoded.getBytes(UTF_8));
  }

      ).decodeBase64()!!

    val decoded = CertificateAdapters.privateKeyInfo.fromDer(privateKeyInfoByteString)

    assertThat(decoded.version).isEqualTo(0L)
    assertThat(decoded.algorithmIdentifier).isEqualTo(AlgorithmIdentifier(RSA_ENCRYPTION, null))
    assertThat(decoded.privateKey.size).isEqualTo(607)

    val encoded = CertificateAdapters.privateKeyInfo.toDer(decoded)

            String encoded = permissionHelper.encode(value);
            if (encoded != null) {
                String decoded = permissionHelper.decode(encoded);
                assertNotNull("Decoded value should not be null for: " + value, decoded);
                assertEquals("Decoded value should match original: " + value + " -> " + encoded + " -> " + decoded, value, decoded);
            }
        }
    }

      encodeBase64Lines(pkcs1Bytes())
      append("-----END RSA PRIVATE KEY-----\n")
    }
  }

  private fun pkcs1Bytes(): ByteString {
    val decoded = CertificateAdapters.privateKeyInfo.fromDer(keyPair.private.encoded.toByteString())
    return decoded.privateKey
  }

  /** Build a held certificate with reasonable defaults. */
  class Builder {
    private var notBefore = -1L
    private var notAfter = -1L

  val normalized = normalizeNfc(bufferB.readUtf8())
  bufferA.writeUtf8(normalized)

  // 3. For each label, convert/validate Punycode.
  val decoded = Punycode.decode(bufferA.readUtf8()) ?: return null

  // 4.1 Validate.

  // Must be NFC.
  if (decoded != normalizeNfc(decoded)) return null

  // TODO: Must not begin with a combining mark.
  // TODO: Each character must be 'valid' or 'deviation'. Not mapped.

    bytesIn.writeByte(0x40) // Literal indexed
    bytesIn.writeByte(0x88) // Literal name Huffman encoded 8 bytes
    // decodes to custom-key which is length 10
    bytesIn.write("25a849e95ba97d7f".decodeHex())
    bytesIn.writeByte(0x89) // Literal value Huffman encoded 9 bytes
    // decodes to custom-value which is length 12
    bytesIn.write("25a849e95bb8e8b4bf".decodeHex())
  }

   *
   * Otherwise if the response has a `Content-Type` header that specifies a charset, that is used
   * to determine the charset of the response bytes.
   *
   * Otherwise the response bytes are decoded as UTF-8.
   */
  fun charStream(): Reader =
    reader ?: BomAwareReader(source(), charset()).also {
      reader = it
    }

  /**
   * Returns the response as a string.
   *

            }
        }
        return u;
    }

    /**
     * Decodes a URL as a name using appropriate character encoding.
     * Handles encoding detection from parent URLs and configuration settings.
     *
     * @param url the URL to decode
     * @param escapePlus whether to escape plus signs before decoding
     * @return the decoded URL name, or original URL if decoding fails
     */

        return permission;
    }

    /**
     * Decodes a search role format string back to a permission string.
     * Reverses the encoding process to restore original permission format.
     *
     * @param value the encoded permission string to decode
     * @return the decoded permission string, or null if the input is blank or invalid
     */
    public String decode(final String value) {
        if (StringUtil.isBlank(value)) {