c.Lock()
		defer c.Unlock()

		if c.watchCache.resourceVersion < rv {
			t.Fatalf("Can't compact into a future version: %v", resourceVersion)
		}

		if len(c.watchers.allWatchers) > 0 || len(c.watchers.valueWatchers) > 0 {
			// We could consider terminating those watchers, but given
			// watchcache doesn't really support compaction and we don't
			// exercise it in tests, we just throw an error here.

	if useExtendedJwt {
		out.Value = &matcher.ValueMatcher{
			MatchPattern: &matcher.ValueMatcher_OrMatch{
				OrMatch: &matcher.OrMatcher{
					ValueMatchers: []*matcher.ValueMatcher{
						{
							MatchPattern: &matcher.ValueMatcher_ListMatch{
								ListMatch: listMatcher,
							},
						},
						value,
					},
				},
			},
		}
	} else {
		out.Value = &matcher.ValueMatcher{

func OrMatcher(matchers []*matcher.ValueMatcher) *matcher.ValueMatcher {
	if len(matchers) == 1 {
		return matchers[0]
	}
	return &matcher.ValueMatcher{
		MatchPattern: &matcher.ValueMatcher_OrMatch{
			OrMatch: &matcher.OrMatcher{
				ValueMatchers: matchers,
			},
		},
	}
}

// StringMatcherRegex creates a regex string matcher for regex.

				{
					Segment: &matcher.MetadataMatcher_PathSegment_Key{
						Key: "key2",
					},
				},
			},
			Value: &matcher.ValueMatcher{
				MatchPattern: &matcher.ValueMatcher_ListMatch{
					ListMatch: &matcher.ListMatcher{
						MatchPattern: &matcher.ListMatcher_OneOf{
							OneOf: &matcher.ValueMatcher{
								MatchPattern: &matcher.ValueMatcher_StringMatch{
									StringMatch: &matcher.StringMatcher{

	return MetadataValueMatcherForJWTClaim(claim, &matcherpb.ValueMatcher{
		MatchPattern: &matcherpb.ValueMatcher_StringMatch{
			StringMatch: m,
		},
	})
}

func MetadataValueMatcherForJWTClaim(claim string, m *matcherpb.ValueMatcher) *matcherpb.MetadataMatcher {
	return &matcherpb.MetadataMatcher{
		Filter: filters.EnvoyJwtFilterName,