above. See [Jetty's overview][jetty_8_252] of the API change and its consequences.

 *  New: `MultipartReader` is a streaming decoder for [MIME multipart (RFC 2045)][rfc_2045]
    messages. It complements `MultipartBody` which is our streaming encoder.

    ```kotlin
    val response: Response = call.execute()
    val multipartReader = MultipartReader(response.body!!)

    multipartReader.use {

  val normalized = normalizeNfc(bufferB.readUtf8())
  bufferA.writeUtf8(normalized)

  // 3. For each label, convert/validate Punycode.
  val decoded = Punycode.decode(bufferA.readUtf8()) ?: return null

  // 4.1 Validate.

  // Must be NFC.
  if (decoded != normalizeNfc(decoded)) return null

  // TODO: Must not begin with a combining mark.
  // TODO: Each character must be 'valid' or 'deviation'. Not mapped.

import java.net.ProtocolException
import okio.Buffer
import okio.BufferedSource
import okio.ByteString
import okio.ForwardingSource
import okio.Source
import okio.buffer

/**
 * Streaming decoder of data encoded following Abstract Syntax Notation One (ASN.1). There are
 * multiple variants of ASN.1, including:
 *
 *  * DER: Distinguished Encoding Rules. This further constrains ASN.1 for deterministic encoding.

  }

  @Test fun `cannot decode malformed utc time`() {
    val bytes = "170d3139313231362333303231305a".decodeHex()
    assertFailsWith<ProtocolException> {
      Adapters.UTC_TIME.fromDer(bytes)
    }.also { expected ->
      assertThat(expected).hasMessage("Failed to parse UTCTime 191216#30210Z")
    }
  }

  @Test fun `cannot decode generalized time with offset`() {

      |-----END PRIVATE KEY-----
      |
      """.trimMargin()
    try {
      decode(certificatePem)
      fail<Any>()
    } catch (expected: IllegalArgumentException) {
      assertThat(expected.message).isEqualTo("string does not include a private key")
    }
    try {
      decode(pkcs8Pem)
      fail<Any>()
    } catch (expected: IllegalArgumentException) {

 *
 * Supported on OpenJDK 9+ via SSLParameters and SSLSocket features.
 *
 * ### Trust Manager Extraction
 *
 * Supported on Android 2.3+ and OpenJDK 7+. There are no public APIs to recover the trust
 * manager that was used to create an [SSLSocketFactory].
 *
 * Not supported by choice on JDK9+ due to access checks.
 *
 * ### Android Cleartext Permit Detection
 *

      val randomAccessFile = RandomAccessFile(file, "rw")
      val result = Relay(randomAccessFile, upstream, 0L, metadata, bufferMaxSize)

      // Write a dirty header. That way if we crash we won't attempt to recover this.
      randomAccessFile.setLength(0L)
      result.writeHeader(PREFIX_DIRTY, -1L, -1L)

      return result
    }

    /**
     * Creates a relay that reads a recorded stream from [file].
     *

      return decode(certificatePem, pkcs8Base64)
    }

    private fun decode(
      certificatePem: String,
      pkcs8Base64Text: String,
    ): HeldCertificate {
      val certificate = certificatePem.decodeCertificatePem()

      val pkcs8Bytes =
        pkcs8Base64Text.decodeBase64()
          ?: throw IllegalArgumentException("failed to decode private key")

    }
  }

  /**
   * This decodes a value into its contents using a preceding member of the same SEQUENCE. For
   * example, extensions type IDs specify what types to use for the corresponding values.
   *
   * If the hint is unknown [chooser] should return null which will cause the value to be decoded as
   * an opaque byte string.
   *

   */
  @Throws(IOException::class)
  internal fun connectTunnel(): ConnectResult {
    val nextTunnelRequest =
      createTunnel()
        ?: return ConnectResult(plan = this) // Success.

    // The proxy decided to close the connection after an auth challenge. Retry with different
    // auth credentials.
    rawSocket?.closeQuietly()

    val nextAttempt = attempt + 1
    return when {