Matt Lloyd <******@****.***> 1745728257 +0100

        value = "key.with.dots=value\nkey_with_underscores=value with spaces\nkey-with-dashes=value@#$%";
        paramMap = ParameterUtil.parse(value);
        assertEquals(3, paramMap.size());
        assertEquals("value", paramMap.get("key.with.dots"));
        assertEquals("value with spaces", paramMap.get("key_with_underscores"));
        assertEquals("value@#$%", paramMap.get("key-with-dashes"));
    }

    @Test

  }

  @Test
  fun validateKey() {
    var key = ""
    assertFailsWith<IllegalArgumentException> {
      key = "has_space "
      cache.edit(key)
    }.also { expected ->
      assertThat(expected.message).isEqualTo("keys must match regex [a-z0-9_-]{1,120}: \"$key\"")
    }
    assertFailsWith<IllegalArgumentException> {
      key = "has_CR\r"
      cache.edit(key)
    }.also { expected ->

}

// SealedKey represents a sealed object key. It can be stored
// at an untrusted location.
type SealedKey struct {
	Key       [64]byte // The encrypted and authenticated object-key.
	IV        [32]byte // The random IV used to encrypt the object-key.
	Algorithm string   // The sealing algorithm used to encrypt the object key.
}

// Seal encrypts the ObjectKey using the 256 bit external key and IV. The sealed

	}
	return NewBuiltin(keyID, key)
}

// NewBuiltin returns a single-key KMS that derives new DEKs from the
// given key.
func NewBuiltin(keyID string, key []byte) (*KMS, error) {
	if len(key) != 32 {
		return nil, errors.New("kms: invalid key length " + strconv.Itoa(len(key)))
	}
	return &KMS{
		Type:       Builtin,
		DefaultKey: keyID,
		conn: secretKey{
			keyID: keyID,
			key:   key,
		},

                if (_klen == key.length()) {
                    match = _key.equals(key);
                } else if (_klen < key.length()) {
                    match = _key.regionMatches(0, key, 0, _klen) && key.charAt(_klen) == '\\';
                }

                if (match) {
                    dr = (DfsReferral) referrals.map.get(_key);
                }
            }
        }

	for key := range headers {
		lkey := strings.ToLower(key)
		if !strings.HasPrefix(lkey, "x-amz-") {
			continue
		}
		keys = append(keys, lkey)
		keyval[lkey] = strings.Join(headers[key], ",")
	}
	sort.Strings(keys)
	var canonicalHeaders []string
	for _, key := range keys {
		canonicalHeaders = append(canonicalHeaders, key+":"+keyval[key])
	}

	*sync.RWMutex

	// map of kid to public key
	pkMap map[string]any
}

func (pk *publicKeys) parseAndAdd(b io.Reader) error {
	var jwk JWKS
	err := json.NewDecoder(b).Decode(&jwk)
	if err != nil {
		return err
	}

	for _, key := range jwk.Keys {
		pkey, err := key.DecodePublicKey()
		if err != nil {
			return err
		}
		pk.add(key.Kid, pkey)
	}

	return nil
}

  }

  private long runAddSingleThread(int reps) {
    Random random = new Random();
    int nKeys = keys.size();
    long blah = 0;
    for (int i = 0; i < reps; i++) {
      Integer key = keys.get(random.nextInt(nKeys));
      int delta = random.nextInt(5);
      blah += delta;
      multiset.add(key, delta);
    }
    return blah;
  }

  private long runAddRemoveSingleThread(int reps) {

        // Absent key -> CIFSException
        CIFSException noKey = assertThrows(CIFSException.class, session::getSessionKey);
        assertTrue(noKey.getMessage().contains("No session key"));

        // Set a key via reflection and verify retrieval
        byte[] key = new byte[] { 1, 2, 3, 4 };
        setField(session, "sessionKey", key);
        assertArrayEquals(key, session.getSessionKey());
    }