return "related_content";
    }

    // ===================================================================================
    //                                                                       Query Control
    //                                                                       =============
    public void functionScore(OperatorCall<RelatedContentCQ> queryLambda,

        return "key_match";
    }

    // ===================================================================================
    //                                                                       Query Control
    //                                                                       =============
    public void functionScore(OperatorCall<KeyMatchCQ> queryLambda, ScoreFunctionCall<ScoreFunctionCreator<KeyMatchCQ>> functionsLambda,

	// Populated by the system.
	// Read-only.
	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
	// +optional
	ResourceVersion string `json:"resourceVersion,omitempty" protobuf:"bytes,2,opt,name=resourceVersion"`

      --service-account-signing-key-file="${SERVICE_ACCOUNT_KEY}" \
      --enable-admission-plugins="${ENABLE_ADMISSION_PLUGINS}" \
      --disable-admission-plugins="${DISABLE_ADMISSION_PLUGINS}" \
      --admission-control-config-file="${ADMISSION_CONTROL_CONFIG_FILE}" \
      --bind-address="${API_BIND_ADDR}" \
      --secure-port="${API_SECURE_PORT}" \
      --tls-cert-file="${CERT_DIR}/serving-kube-apiserver.crt" \

        return "job_log";
    }

    // ===================================================================================
    //                                                                       Query Control
    //                                                                       =============
    public void functionScore(OperatorCall<JobLogCQ> queryLambda, ScoreFunctionCall<ScoreFunctionCreator<JobLogCQ>> functionsLambda,

					// "/sa/a". Since the namespace is ignored, we use ns2.B for our denied app (rather than ns2.A).
					// We'll only need the service account for TCP, since we send headers in all other protocols
					// to control the server's behavior.
					allowed := apps.Ns1.A
					var denied echo.Instances
					if provider.IsProtocolSupported(protocol.TCP) {
						denied = apps.Ns2.B
					}

					from := allowed.Append(denied)

// functions. All other functions that require or produce a *loader should pass
// or return it as an explicit parameter.
var loaded *loader

// PackageOpts control the behavior of the LoadPackages function.
type PackageOpts struct {
	// TidyGoVersion is the Go version to which the go.mod file should be updated
	// after packages have been loaded.
	//

        return importAffectsUsagesOfClassesWithSameName(classToImport, importAllInParent)
    }

    /**
     * Same as above, but for more general callable symbols.
     *
     * Currently only checks constructor calls, assuming `true` for everything else.
     */

        return "access_token";
    }

    // ===================================================================================
    //                                                                       Query Control
    //                                                                       =============
    public void functionScore(OperatorCall<AccessTokenCQ> queryLambda,

     * the second version is the newer.
     */
    private static int compareModelVersions(String first, String second) {
        // we use a dedicated comparator because we control our model version scheme.
        String[] firstSegments = first.split("\\.");
        String[] secondSegments = second.split("\\.");
        for (int i = 0; i < Math.max(firstSegments.length, secondSegments.length); i++) {