}

  @Test
  public void testWildcardAndExclusion() {
    // *.ck is a public suffix
    assertThat(PublicSuffixPatterns.TRIE.findSuffixIndex(ImmutableList.of("foo", "ck")))
        .isEqualTo(0);
    assertThat(PublicSuffixPatterns.TRIE.findSuffixIndex(ImmutableList.of("bar", "foo", "ck")))
        .isEqualTo(1);

    // !www.ck is an exception, so ck is the suffix

        assertObjectNotNull("ck", ck);
        if (ck.equals(ConditionKey.CK_GREATER_THAN)) {
            builder.gt(value);
        } else if (ck.equals(ConditionKey.CK_GREATER_EQUAL)) {
            builder.gte(value);
        } else if (ck.equals(ConditionKey.CK_LESS_THAN)) {
            builder.lt(value);
        } else if (ck.equals(ConditionKey.CK_LESS_EQUAL)) {

        assertObjectNotNull("ck", ck);
        if (ck.equals(ConditionKey.CK_GREATER_THAN)) {
            builder.gt(value);
        } else if (ck.equals(ConditionKey.CK_GREATER_EQUAL)) {
            builder.gte(value);
        } else if (ck.equals(ConditionKey.CK_LESS_THAN)) {
            builder.lt(value);
        } else if (ck.equals(ConditionKey.CK_LESS_EQUAL)) {

        assertObjectNotNull("ck", ck);
        if (ck.equals(ConditionKey.CK_GREATER_THAN)) {
            builder.gt(value);
        } else if (ck.equals(ConditionKey.CK_GREATER_EQUAL)) {
            builder.gte(value);
        } else if (ck.equals(ConditionKey.CK_LESS_THAN)) {
            builder.lt(value);
        } else if (ck.equals(ConditionKey.CK_LESS_EQUAL)) {

IsLatest: true, Deleted: false, DataDir: "5e0153cc-621a-4267-8cb6-4919140d53b3", XLV1: false, ModTime: UTCNow(), Size: 3430, Mode: 0x0, Metadata: map[string]string{"X-Minio-Internal-Server-Side-Encryption-Iv": "jIJPsrkkVYYMvc7edBrNl+7zcM7+ZwXqMb/YAjBO/ck=", "X-Minio-Internal-Server-Side-Encryption-S3-Kms-Key-Id": "my-minio-key", "X-Minio-Internal-Server-Side-Encryption-S3-Kms-Sealed-Key": "IAAfAP2p7ZLv3UpLwBnsKkF2mtWba0qoY42tymK0szRgGvAxBNcXyHXYooe9dQpeeEJWgKUa/8R61oCy1mFwIg==", "X-Minio-Internal-S...

      // Excluded match (!rule). If this bit is set, it means the current path is NOT a public
      // suffix, even if a previous rule matched. For example, "!www.ck" would exclude "www.ck"
      // from being a public suffix, leaving "ck" as the suffix.
      if (isExcludedMatch(metadata)) {
        bestResult = i + 1;
      }

      // Exact match. If the exact type bits are set, this node itself is a public suffix.

    // TLD with a wildcard rule and exceptions.
    checkPublicSuffix("ck", null)
    checkPublicSuffix("test.ck", null)
    checkPublicSuffix("b.test.ck", "b.test.ck")
    checkPublicSuffix("a.b.test.ck", "b.test.ck")
    checkPublicSuffix("www.ck", "www.ck")
    checkPublicSuffix("www.www.ck", "www.ck")
    // US K12.
    checkPublicSuffix("us", null)
    checkPublicSuffix("test.us", "test.us")

			delete(c, subSys)
			return nil
		}
		return err
	}

	ck, ok := c[subSys][tgt]
	if !ok {
		return Error[ErrConfigNotFound]("sub-system %s:%s already deleted or does not exist", subSys, tgt)
	}

	if len(inputs) == 2 {
		currKVS := ck.Clone()
		defKVS := DefaultKVS[subSys]
		for delKey := range strings.FieldsSeq(inputs[1]) {
			_, ok := currKVS.Lookup(delKey)

          "\u7f51\u7edc.Cn", // "网络.Cn"
          "co.uk",
          "co.uk.", // Trailing dot
          "co\uFF61uk", // Alternate dot character
          "com",
          "gov.ck",
          "org.ck",
          "org.mK",
          "us",
          // keep-sorted end
          "j\u00f8rpeland.no", // "jorpeland.no" (first o slashed)
          "xn--jrpeland-54a.no" // IDNA (punycode) encoding of above

          "\u7f51\u7edc.Cn", // "网络.Cn"
          "co.uk",
          "co.uk.", // Trailing dot
          "co\uFF61uk", // Alternate dot character
          "com",
          "gov.ck",
          "org.ck",
          "org.mK",
          "us",
          // keep-sorted end
          "j\u00f8rpeland.no", // "jorpeland.no" (first o slashed)
          "xn--jrpeland-54a.no" // IDNA (punycode) encoding of above