}
		newKey, err := GlobalKMS.GenerateKey(ctx, &kms.GenerateKeyRequest{
			Name:           newKeyID,
			AssociatedData: kmsCtx,
		})
		if err != nil {
			return err
		}

		sealedKey := objectKey.Seal(newKey.Plaintext, crypto.GenerateIV(rand.Reader), crypto.S3KMS.String(), bucket, object)
		crypto.S3KMS.CreateMetadata(metadata, newKey.KeyID, newKey.Ciphertext, sealedKey, cryptoCtx)
		return nil

                // Try to add new param
                paramMap.put("newKey", "newValue");
                return paramMap.size();
            }
        });

        // Execute first time
        Object result1 = scriptExecutor.execute("modifyEngine", "script1");
        assertEquals(2, result1); // executor + newKey

        // Execute second time - params should be fresh

   * the position of the new key if it was previously present.
   */
  private void replaceKeyInEntry(int entry, @ParametricNullness K newKey, boolean force) {
    checkArgument(entry != ABSENT);
    int newKeyHash = smearedHash(newKey);
    int newKeyIndex = findEntryByKey(newKey, newKeyHash);

    int newPredecessor = lastInInsertionOrder;
    int newSuccessor = ENDPOINT;
    if (newKeyIndex != ABSENT) {

        TestFessTransformer transformer = new TestFessTransformer();
        Map<String, Object> dataMap = new HashMap<>();

        transformer.putResultDataBody(dataMap, "newKey", "newValue");

        assertEquals("newValue", dataMap.get("newKey"));
        assertEquals(1, dataMap.size());
    }

    /**
     * Test putResultDataBody with null handling
     */
    @Test

            int newVersion = currentVersion + 1;

            // Derive new key from current key
            String rotationLabel = String.format("KeyRotation-v%d", newVersion);
            byte[] newKey = deriveKey(currentKey, rotationLabel, String.valueOf(System.currentTimeMillis()).getBytes(), currentKey.length);

            // Archive old key (keep last version for rollback)

    // with MD5 or 512-bit RSA; that's insecure!
    //
    // openssl req \
    //   -x509 \
    //   -md5 \
    //   -nodes \
    //   -days 1 \
    //   -newkey rsa:512 \
    //   -keyout privateKey.key \
    //   -out certificate.crt
    val certificatePem =
      """
      |-----BEGIN CERTIFICATE-----
      |MIIBFzCBwgIJAIVAqagcVN7/MA0GCSqGSIb3DQEBBAUAMBMxETAPBgNVBAMMCGNh

        StringBuilder newkey = new StringBuilder();

        for (int i = 0; i < key.length(); i++) {
            char c = key.charAt(i);

            if (contains(SEPARATORS, c) || contains(WHITE_SPACE, c)) {
                // escape the separator
                newkey.append('\\');
                newkey.append(c);
            } else {
                newkey.append(c);
            }
        }

        StringBuilder newkey = new StringBuilder();

        for (int i = 0; i < key.length(); i++) {
            char c = key.charAt(i);

            if (contains(SEPARATORS, c) || contains(WHITE_SPACE, c)) {
                // escape the separator
                newkey.append('\\');
                newkey.append(c);
            } else {
                newkey.append(c);
            }
        }

		writeErrorResponse(ctx, w, errorCodes.ToAPIErr(ErrInvalidSSECustomerAlgorithm), r.URL)
		return
	}

	var oldKey, newKey []byte
	var newKeyID string
	var kmsCtx kms.Context
	var objEncKey crypto.ObjectKey
	sseCopyKMS := crypto.S3KMS.IsEncrypted(srcInfo.UserDefined)
	sseCopyS3 := crypto.S3.IsEncrypted(srcInfo.UserDefined)

// Use Call to initiate a clientside call.
func NewSingleHandler[Req, Resp RoundTripper](h HandlerID, newReq func() Req, newResp func() Resp) *SingleHandler[Req, Resp] {
	s := SingleHandler[Req, Resp]{id: h}
	s.newReq, s.recycleReq = recycleFunc[Req](newReq)
	s.newResp, s.recycleResp = recycleFunc[Resp](newResp)
	if _, ok := any(newReq()).(Recycler); ok {
		s.callReuseReq = true
	}
	return &s
}