code: func decodeContinue(continueValue, keyPrefix string) (fromKey string, rv int64, err error) {
  	data, err := base64.RawURLEncoding.DecodeString(continueValue)
  	if err != nil {
  		return "", 0, fmt.Errorf("continue key is not valid: %v", err)
  	}
  	var c continueToken
  	if err := json.Unmarshal(data, &c); err != nil {
  		return "", 0, fmt.Errorf("continue key is not valid: %v", err)
  	}
  	switch c.APIVersion {
  	case "meta.k8s.io/v1":
  		if c.ResourceVersion == 0 {
  			return "", 0, fmt.Errorf("continue key is not valid: incorrect encoded start resourceVersion (version meta.k8s.io/v1)")
  		}
  		if len(c.StartKey) == 0 {
  			return "", 0, fmt.Errorf("continue key is not valid: encoded start key empty (version meta.k8s.io/v1)")
  		}
  		// defend against path traversal attacks by clients - path.Clean will ensure that startKey cannot
  		// be at a higher level of the hierarchy, and so when we append the key prefix we will end up with
  		// continue start key that is fully qualified and cannot range over anything less specific than
  		// keyPrefix.
  		key := c.StartKey
  		if !strings.HasPrefix(key, "/") {
  			key = "/" + key
  		}
  		cleaned := path.Clean(key)
  		if cleaned != key {
  			return "", 0, fmt.Errorf("continue key is not valid: %s", c.StartKey)
  		}
  		return keyPrefix + cleaned[1:], c.ResourceVersion, nil
  	default:
  		return "", 0, fmt.Errorf("continue key is not valid: server does not recognize this encoded version %q", c.APIVersion)
  	}
  }
docs: // parseFrom transforms an encoded predicate from into a versioned struct.
  // TODO: return a typed error that instructs clients that they must relist