## Privileges required

    }
}

private class KtFirResolveExtensionScope(
    private val analysisSession: KtFirAnalysisSession,
    private val tools: List<LLFirResolveExtensionTool>,
) : KtScope {
    init {
        require(tools.isNotEmpty())
    }

    override val token: KtLifetimeToken get() = analysisSession.token

    override fun getCallableSymbols(nameFilter: KtScopeNameFilter): Sequence<KtCallableSymbol> = withValidityAssertion {

        val targetModules = computeTargetModules(mainFirFile.llFirModuleData.ktModule)
        val (targetFiles, dependencyFiles) = filesToCompile.partition { firResolveSession.getModule(it) in targetModules }
        require(targetFiles.isNotEmpty())

        val jvmIrDeserializer = JvmIrDeserializerImpl()
        val diagnosticReporter = DiagnosticReporterFactory.createPendingReporter()

        shortenOptions: ShortenOptions,
        classShortenStrategy: (KtClassLikeSymbol) -> ShortenStrategy,
        callableShortenStrategy: (KtCallableSymbol) -> ShortenStrategy
    ): ShortenCommand {
        require(!file.isCompiled) { "No sense to collect references for shortening in compiled file $file" }

        val declarationToVisit = file.findSmallestElementOfTypeContainingSelection<KtDeclaration>(selection)
            ?: file

                        throw new IllegalStateException(e);
                    }
                }
            }
            throw new IllegalArgumentException("The use of session scoped proxies require "
                    + "a org.eclipse.sisu.Typed or javax.enterprise.inject.Typed annotation");
        }
    }

    /**
     * A provider wrapping an existing provider with a cache

        firExplicitReceiver = explicitReceiver?.let(::findReceiverFirExpression)
    }

    override fun computeApplicability(candidate: KtCallableSymbol): KtExtensionApplicabilityResult {
        require(candidate is KtFirSymbol<*>)

        analysisSession.withValidityAssertion {
            val firSymbol = candidate.firSymbol as FirCallableSymbol<*>
            firSymbol.lazyResolveToPhase(FirResolvePhase.STATUS)

          }
          else -> null
        }
      }

    // If the call's connection wasn't released, reuse it. We don't call connectionAcquired() here
    // because we already acquired it.
    if (connectionUser.candidateConnection() != null) {
      check(toClose == null)
      return ReusePlan(candidate)
    }

    // The call's connection was released.
    toClose?.closeQuietly()

In our testing, even the most generous representations give custom types a 10x edge (in size, allocations, and CPU time) over Envoy types.
In addition, they are more clear and strictly typed; using Envoy types would require us to put a lot of information in untyped `metadata` maps.

With this in mind, Ztunnel supports two xDS resources: `Address` and `Authorization`.

### Address Type

    if (flushHeaders) {
      connection.flush()
    }
  }

  fun enqueueTrailers(trailers: Headers) {
    this.withLock {
      check(!sink.finished) { "already finished" }
      require(trailers.size != 0) { "trailers.size() == 0" }
      this.sink.trailers = trailers
    }
  }

  fun readTimeout(): Timeout = readTimeout

  fun writeTimeout(): Timeout = writeTimeout

      # Note the pod will be crashlooping, so this may take a few minutes to become fully functional based on when the retry occurs.
      # This requires no RBAC privilege, but does require `securityContext.privileged/CAP_SYS_ADMIN`.
      repairPods: true

      initContainerName: "istio-validation"

      brokenPodLabelKey: "cni.istio.io/uninitialized"
      brokenPodLabelValue: "true"