val normalized = normalizeNfc(bufferB.readUtf8())
  bufferA.writeUtf8(normalized)

  // 3. For each label, convert/validate Punycode.
  val decoded = Punycode.decode(bufferA.readUtf8()) ?: return null

  // 4.1 Validate.

  // Must be NFC.
  if (decoded != normalizeNfc(decoded)) return null

  // TODO: Must not begin with a combining mark.
  // TODO: Each character must be 'valid' or 'deviation'. Not mapped.

- `X-Amz-Server-Side-Encryption-Customer-Key`: Base64 encoded new key.
- `X-Amz-Copy-Source-Server-Side-Encryption-Customer-Key`: Base64 encoded current key.

Such a special COPY request is also known as S3 SSE-C key rotation.

### Server-Side Encryption with a KMS

	// Total object size.
	Size int64

	// Actual size is the real size of the object uploaded by client.
	ActualSize *int64

	// IsDir indicates if the object is prefix.
	IsDir bool

	// Hex encoded unique entity tag of the object.
	ETag string

	// Version ID of this object.
	VersionID string

	// IsLatest indicates if this is the latest current version

	}

	var value any
	switch val := v.(type) {
	case []byte:
		// TODO: only strings are supported in s3select output (not
		// binary arrays) - perhaps we need to check the annotation to
		// ensure it's UTF8 encoded.
		value = string(val)
	case [12]byte:
		// TODO: This is returned for the parquet INT96 type. We just
		// treat it same as []byte (but AWS S3 treats it as a large int)
		// - fix this later.
		value = string(val[:])

    public fun body(body: MockResponseBody): Builder =
      apply {
        setHeader("Content-Length", body.contentLength)
        this.body = body
      }

    /** Sets the response body to the UTF-8 encoded bytes of [body]. */
    public fun body(body: String): Builder = body(Buffer().writeUtf8(body))

    public fun socketHandler(socketHandler: SocketHandler): Builder =
      apply {

  private const val INITIAL_BIAS = 72
  private const val INITIAL_N = 0x80

  /**
   * Returns null if any label is oversized so much that the encoder cannot encode it without
   * integer overflow. This will not return null for labels that fit within the DNS size
   * limits.
   */
  fun encode(string: String): String? {
    var pos = 0
    val limit = string.length
    val result = Buffer()

    while (pos < limit) {

    void testWriteUShortNegative() {
        byte[] dest = new byte[2];
        NtlmMessage.writeUShort(dest, 0, -2);
        assertArrayEquals(new byte[] { -2, -1 }, dest, "Negative short should be encoded unsigned");
    }

    @Test
    @DisplayName("writeSecurityBuffer writes zero length buffer unchanged")
    void testWriteSecurityBufferZeroLength() {
        byte[] dest = new byte[10];

        ],
        reason: Annotated[
            Union[str, None],
            Doc(
                """
                The reason to close the WebSocket connection.

                It is UTF-8-encoded data. The interpretation of the reason is up to the
                application, it is not specified by the WebSocket specification.

                It could contain text that could be human-readable or interpretable

 */
@Suppress("UNCHECKED_CAST") // This needs to cast decoded collections.
internal object CertificateAdapters {
  /**
   * ```
   * Time ::= CHOICE {
   *   utcTime        UTCTime,
   *   generalTime    GeneralizedTime
   * }
   * ```
   *
   * RFC 5280, section 4.1.2.5:
   *
   * > CAs conforming to this profile MUST always encode certificate validity dates through the year

  @Deprecated(
    message = "moved to val",
    replaceWith = ReplaceWith(expression = "subtype"),
    level = DeprecationLevel.ERROR,
  )
  fun subtype(): String = subtype

  /**
   * Returns the encoded media type, like "text/plain; charset=utf-8", appropriate for use in a
   * Content-Type header.
   */
  override fun toString(): String = mediaType