if err != nil {
			log.Warnf("Starting with invalid K8S JWT token: %v", err)
		} else {
			if iss == "" {
				iss = tok.Iss
			}
			if len(tok.Aud) > 0 && len(aud) == 0 {
				aud = tok.Aud[0]
			}
		}
	}

	// TODO: if not set, parse Istiod's own token (if present) and get the issuer. The same issuer is used

internal class KaFirIntersectionType(
    override val coneType: ConeIntersectionType,
    private val builder: KaSymbolByFirBuilder,
) : KaIntersectionType(), KaFirType {
    override val token: KaLifetimeToken get() = builder.token

    override val conjuncts: List<KaType> by cached {
        coneType.intersectedTypes.map { conjunct -> builder.typeBuilder.buildKtType(conjunct) }
    }

internal class KaFirFunctionalType(
    override val coneType: ConeClassLikeTypeImpl,
    private val builder: KaSymbolByFirBuilder,
) : KaFunctionalType(), KaFirType {
    override val token: KaLifetimeToken get() = builder.token

    override val classId: ClassId get() = withValidityAssertion { coneType.lookupTag.classId }

    override val symbol: KaClassLikeSymbol by cached {

	if err != nil {
		c.Fatalf("bucket create error: %v", err)
	}

	// Generate web identity STS token by interacting with OpenID IDP.
	token, err := MockOpenIDTestUserInteraction(ctx, testAppParams, "******@****.***", "dillon")
	if err != nil {
		c.Fatalf("mock user err: %v", err)
	}
	// fmt.Printf("TOKEN: %s\n", token)

	webID := cr.STSWebIdentity{
		Client:      s.TestSuiteCommon.client,

      priorityClassName: system-node-critical
      terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
      volumes:
      - name: istio-token
        projected:
          sources:
          - serviceAccountToken:
              path: istio-token
              expirationSeconds: 43200
              audience: istio-ca
      - name: istiod-ca-cert
        configMap:
          name: istio-ca-root-cert

            ?: KaFe10NeverRestoringSymbolPointer()
    }

    override val returnType: KaType
        get() = withValidityAssertion { owningProperty.returnType }

    override val token: KaLifetimeToken
        get() = owningProperty.token

    override val annotations: KaAnnotationList
        get() = withValidityAssertion {
            KaFe10AnnotationList.create(descriptor?.annotations ?: Annotations.EMPTY, analysisContext)

internal class KaFirTypeParameterType(
    override val coneType: ConeTypeParameterType,
    private val builder: KaSymbolByFirBuilder,
) : KaTypeParameterType(), KaFirType {
    override val token: KaLifetimeToken get() = builder.token
    override val name: Name get() = withValidityAssertion { coneType.lookupTag.name }
    override val symbol: KaTypeParameterSymbol by cached {

internal class KaFirFlexibleType(
    override val coneType: ConeFlexibleType,
    private val builder: KaSymbolByFirBuilder,
) : KaFlexibleType(), KaFirType {
    override val token: KaLifetimeToken get() = builder.token

    override val lowerBound: KaType get() = withValidityAssertion { builder.typeBuilder.buildKtType(coneType.lowerBound) }

internal class KaFirUsualClassType(
    override val coneType: ConeClassLikeTypeImpl,
    private val builder: KaSymbolByFirBuilder,
) : KaUsualClassType(), KaFirType {
    override val token: KaLifetimeToken get() = builder.token

    override val classId: ClassId get() = withValidityAssertion { coneType.lookupTag.classId }

    override val symbol: KaClassLikeSymbol
        get() = withValidityAssertion {

internal class KaFirErrorType(
    override val coneType: ConeErrorType,
    private val builder: KaSymbolByFirBuilder,
) : KaErrorType, KaFirType {
    override val token: KaLifetimeToken get() = builder.token

    override val nullability: KaTypeNullability get() = withValidityAssertion { coneType.nullability.asKtNullability() }

    @KaAnalysisNonPublicApi
    override val errorMessage: String