/**
     *
     * @param reader a reader object.
     * @param strict a strict object.
     * @throws IOException IOException if any.
     * @throws XmlPullParserException XmlPullParserException if
     * any.
     * @return Model
     */
    public Model read(Reader reader, boolean strict) throws IOException, XmlPullParserException {
        return read(reader, strict, null);
    } // -- Model read( Reader, boolean )

    /**

						},
					},
				},
				{
					// There is only authN policy that enables mTLS (Strict).
					// The request should be denied because the client is always using plain text.
					name: "STRICT",
					config: `apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: mtls
spec:
  mtls:
    mode: STRICT`,
					expected: []expect{
						{
							port:              ports.TCPWorkloadOnly,

            strict(methodShouldNotBeAnnotatedMessage { type(TypeWithAnnotatedNonGetterMethods.canonicalName).kind('method').method('doSomething').annotation('Large').includeLink() }),
            strict(methodShouldNotBeAnnotatedMessage { type(TypeWithAnnotatedNonGetterMethods.canonicalName).kind('setter').method('setSomething').annotation('Large').includeLink() }),

	// browserHSTSSeconds setting name for Strict-Transport-Security response header, amount of seconds for 'max-age'
	browserHSTSSeconds = "hsts_seconds"
	// browserHSTSIncludeSubdomains setting name for Strict-Transport-Security response header 'includeSubDomains' flag (true or false)
	browserHSTSIncludeSubdomains = "hsts_include_subdomains"
	// browserHSTSPreload setting name for Strict-Transport-Security response header 'preload' flag (true or false)

	}

	if err := StructToMessage(value, obj, strict); err != nil {
		return nil, fmt.Errorf("Envoy filter: %v", err) // nolint: stylecheck
	}
	return obj, nil
}

func StructToMessage(pbst *structpb.Struct, out proto.Message, strict bool) error {
	if pbst == nil {
		return errors.New("nil struct")
	}

	buf, err := protomarshal.MarshalProtoNames(pbst)
	if err != nil {
		return err

	runtime.Serializer
	recognizer.RecognizingDecoder
}

var _ Serializer = &serializer{}

type options struct {
	strict bool
}

type Option func(*options)

func Strict(s bool) Option {
	return func(opts *options) {
		opts.strict = s
	}
}

type serializer struct {
	metaFactory metaFactory
	creater     runtime.ObjectCreater
	typer       runtime.ObjectTyper
	options     options
}

import spock.lang.Specification

class NodeStateTest extends Specification {

    int idIdx = 0
    NodeState root = nextNode()

    def "uses empty strict version constraints object if no strict versions are defined"() {
        Set<ModuleIdentifier> constraintsSet = []

        when:
        root.maybeCollectStrictVersions(constraintsSet, edge(root, false).dependencyState)

						{
							MatchType: &security.StringMatch_Presence{},
						},
					},
				},
			},
		})
	}

	// If we have a strict policy and all of the ports are strict, it's effectively a strict policy
	// so we can exit early and have the WorkloadRbac xDS server push its static strict policy.
	// Note that this doesn't actually attach the policy to any workload; it just makes it available
	// to ztunnel in case a workload needs it.

                "{\"bool\":{\"should\":[{\"geo_distance\":{\"location\":[151.0,35.0],\"distance\":1000.0,\"distance_type\":\"arc\",\"validation_method\":\"STRICT\",\"ignore_unmapped\":false,\"boost\":1.0}},{\"geo_distance\":{\"location\":[150.0,34.0],\"distance\":10000.0,\"distance_type\":\"arc\",\"validation_method\":\"STRICT\",\"ignore_unmapped\":false,\"boost\":1.0}}],\"adjust_pure_negative\":true,\"boost\":1.0}}";

    }

    public ScopedServiceRegistry(
        Class<? extends Scope> scope,
        boolean strict,
        String displayName,
        ServiceRegistry... parents
    ) {
        super(displayName, parents);
        addServiceValidator(scope, strict);
    }

    /**
     * Validator implements a special type of service ({@link AnnotatedServiceLifecycleHandler})