deps: github.com/hashicorp/terraform@sdk-v0.11-with-go-modules

Updated via: go get github.com/hashicorp/terraform@sdk-v0.11-with-go-modules and go mod tidy

313 files changed, 35484 insertions, 4076 deletions

diff --git a/vendor/github.com/hashicorp/go-cleanhttp/cleanhttp.go b/vendor/github.com/hashicorp/go-cleanhttp/cleanhttp.go
index 7d8a57c..8d306bf 100644
--- a/vendor/github.com/hashicorp/go-cleanhttp/cleanhttp.go
+++ b/vendor/github.com/hashicorp/go-cleanhttp/cleanhttp.go
@@ -26,6 +26,7 @@ func DefaultPooledTransport() *http.Transport {
                 DialContext: (&net.Dialer{
                         Timeout:   30 * time.Second,
                         KeepAlive: 30 * time.Second,
+                        DualStack: true,
                 }).DialContext,
                 MaxIdleConns:          100,
                 IdleConnTimeout:       90 * time.Second,
diff --git a/vendor/github.com/hashicorp/go-cleanhttp/go.mod b/vendor/github.com/hashicorp/go-cleanhttp/go.mod
new file mode 100644
index 0000000..310f075
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-cleanhttp/go.mod
@@ -0,0 +1 @@
+module github.com/hashicorp/go-cleanhttp
diff --git a/vendor/github.com/hashicorp/go-cleanhttp/handlers.go b/vendor/github.com/hashicorp/go-cleanhttp/handlers.go
new file mode 100644
index 0000000..7eda377
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-cleanhttp/handlers.go
@@ -0,0 +1,43 @@
+package cleanhttp
+
+import (
+        "net/http"
+        "strings"
+        "unicode"
+)
+
+// HandlerInput provides input options to cleanhttp's handlers
+type HandlerInput struct {
+        ErrStatus int
+}
+
+// PrintablePathCheckHandler is a middleware that ensures the request path
+// contains only printable runes.
+func PrintablePathCheckHandler(next http.Handler, input *HandlerInput) http.Handler {
+        // Nil-check on input to make it optional
+        if input == nil {
+                input = &HandlerInput{
+                        ErrStatus: http.StatusBadRequest,
+                }
+        }
+
+        // Default to http.StatusBadRequest on error
+        if input.ErrStatus == 0 {
+                input.ErrStatus = http.StatusBadRequest
+        }
+
+        return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+                // Check URL path for non-printable characters
+                idx := strings.IndexFunc(r.URL.Path, func(c rune) bool {
+                        return !unicode.IsPrint(c)
+                })
+
+                if idx != -1 {
+                        w.WriteHeader(input.ErrStatus)
+                        return
+                }
+
+                next.ServeHTTP(w, r)
+                return
+        })
+}
diff --git a/vendor/github.com/hashicorp/go-getter/.travis.yml b/vendor/github.com/hashicorp/go-getter/.travis.yml
index 4438286..da804c2 100644
--- a/vendor/github.com/hashicorp/go-getter/.travis.yml
+++ b/vendor/github.com/hashicorp/go-getter/.travis.yml
@@ -10,8 +10,14 @@ addons:
 language: go
 
 go:
-  - 1.5
+  - 1.8.x
+  - 1.9.x
+  - master
 
 branches:
   only:
     - master
+
+matrix:
+  allow_failures:
+    - go: master
diff --git a/vendor/github.com/hashicorp/go-getter/README.md b/vendor/github.com/hashicorp/go-getter/README.md
index 4a0b6a6..40ace74 100644
--- a/vendor/github.com/hashicorp/go-getter/README.md
+++ b/vendor/github.com/hashicorp/go-getter/README.md
@@ -21,8 +21,7 @@ URLs. For example: "github.com/hashicorp/go-getter" would turn into a
 Git URL. Or "./foo" would turn into a file URL. These are extensible.
 
 This library is used by [Terraform](https://terraform.io) for
-downloading modules, [Otto](https://ottoproject.io) for dependencies and
-Appfile imports, and [Nomad](https://nomadproject.io) for downloading
+downloading modules and [Nomad](https://nomadproject.io) for downloading
 binaries.
 
 ## Installation and Usage
@@ -119,6 +118,37 @@ The protocol-specific options are documented below the URL format
 section. But because they are part of the URL, we point it out here so
 you know they exist.
 
+### Subdirectories
+
+If you want to download only a specific subdirectory from a downloaded
+directory, you can specify a subdirectory after a double-slash `//`.
+go-getter will first download the URL specified _before_ the double-slash
+(as if you didn't specify a double-slash), but will then copy the
+path after the double slash into the target directory.
+
+For example, if you're downloading this GitHub repository, but you only
+want to download the `test-fixtures` directory, you can do the following:
+
+```
+https://github.com/hashicorp/go-getter.git//test-fixtures
+```
+
+If you downloaded this to the `/tmp` directory, then the file
+`/tmp/archive.gz` would exist. Notice that this file is in the `test-fixtures`
+directory in this repository, but because we specified a subdirectory,
+go-getter automatically copied only that directory contents.
+
+Subdirectory paths may contain may also use filesystem glob patterns.
+The path must match _exactly one_ entry or go-getter will return an error.
+This is useful if you're not sure the exact directory name but it follows
+a predictable naming structure.
+
+For example, the following URL would also work:
+
+```
+https://github.com/hashicorp/go-getter.git//test-*
+```
+
 ### Checksumming
 
 For file downloads of any protocol, go-getter can automatically verify
@@ -154,9 +184,11 @@ The following archive formats are supported:
 
   * `tar.gz` and `tgz`
   * `tar.bz2` and `tbz2`
+  * `tar.xz` and `txz`
   * `zip`
   * `gz`
   * `bz2`
+  * `xz`
 
 For example, an example URL is shown below:
 
@@ -200,6 +232,9 @@ The options below are available to all protocols:
   * `checksum` - Checksum to verify the downloaded file or archive. See
     the entire section on checksumming above for format and more details.
 
+  * `filename` - When in file download mode, allows specifying the name of the
+    downloaded file on disk. Has no effect in directory mode.
+
 ### Local Files (`file`)
 
 None
@@ -222,13 +257,17 @@ None
 
 ### HTTP (`http`)
 
-None
+#### Basic Authentication
+
+To use HTTP basic authentication with go-getter, simply prepend `username:password@` to the
+hostname in the URL such as `https://Aladdin:OpenSesame@www.example.com/index.html`. All special
+characters, including the username and password, must be URL encoded.
 
 ### S3 (`s3`)
 
 S3 takes various access configurations in the URL. Note that it will also
-read these from standard AWS environment variables if they're set. If
-the query parameters are present, these take priority.
+read these from standard AWS environment variables if they're set. S3 compliant servers like Minio
+are also supported. If the query parameters are present, these take priority.
 
   * `aws_access_key_id` - AWS access key.
   * `aws_access_key_secret` - AWS access key secret.
@@ -240,6 +279,14 @@ If you use go-getter and want to use an EC2 IAM Instance Profile to avoid
 using credentials, then just omit these and the profile, if available will
 be used automatically.
 
+### Using S3 with Minio
+ If you use go-gitter for Minio support, you must consider the following:
+
+  * `aws_access_key_id` (required) - Minio access key.
+  * `aws_access_key_secret` (required) - Minio access key secret.
+  * `region` (optional - defaults to us-east-1) - Region identifier to use.
+  * `version` (optional - defaults to Minio default) - Configuration file format.
+
 #### S3 Bucket Examples
 
 S3 has several addressing schemes used to reference your bucket. These are
@@ -250,4 +297,5 @@ Some examples for these addressing schemes:
 - s3::https://s3-eu-west-1.amazonaws.com/bucket/foo
 - bucket.s3.amazonaws.com/foo
 - bucket.s3-eu-west-1.amazonaws.com/foo/bar
+- "s3::http://127.0.0.1:9000/test-bucket/hello.txt?aws_access_key_id=KEYID&aws_access_key_secret=SECRETKEY&region=us-east-2"
 
diff --git a/vendor/github.com/hashicorp/go-getter/appveyor.yml b/vendor/github.com/hashicorp/go-getter/appveyor.yml
index 159dad4..ec48d45 100644
--- a/vendor/github.com/hashicorp/go-getter/appveyor.yml
+++ b/vendor/github.com/hashicorp/go-getter/appveyor.yml
@@ -1,5 +1,5 @@
 version: "build-{branch}-{build}"
-image: Visual Studio 2015
+image: Visual Studio 2017
 clone_folder: c:\gopath\github.com\hashicorp\go-getter
 environment:
   GOPATH: c:\gopath
diff --git a/vendor/github.com/hashicorp/go-getter/client.go b/vendor/github.com/hashicorp/go-getter/client.go
index 876812a..300301c 100644
--- a/vendor/github.com/hashicorp/go-getter/client.go
+++ b/vendor/github.com/hashicorp/go-getter/client.go
@@ -17,6 +17,7 @@ import (
         "strings"
 
         urlhelper "github.com/hashicorp/go-getter/helper/url"
+        "github.com/hashicorp/go-safetemp"
 )
 
 // Client is a client for downloading things.
@@ -100,17 +101,14 @@ func (c *Client) Get() error {
         dst := c.Dst
         src, subDir := SourceDirSubdir(src)
         if subDir != "" {
-                tmpDir, err := ioutil.TempDir("", "tf")
+                td, tdcloser, err := safetemp.Dir("", "getter")
                 if err != nil {
                         return err
                 }
-                if err := os.RemoveAll(tmpDir); err != nil {
-                        return err
-                }
-                defer os.RemoveAll(tmpDir)
+                defer tdcloser.Close()
 
                 realDst = dst
-                dst = tmpDir
+                dst = td
         }
 
         u, err := urlhelper.Parse(src)
@@ -232,7 +230,18 @@ func (c *Client) Get() error {
                 // Destination is the base name of the URL path in "any" mode when
                 // a file source is detected.
                 if mode == ClientModeFile {
-                        dst = filepath.Join(dst, filepath.Base(u.Path))
+                        filename := filepath.Base(u.Path)
+
+                        // Determine if we have a custom file name
+                        if v := q.Get("filename"); v != "" {
+                                // Delete the query parameter if we have it.
+                                q.Del("filename")
+                                u.RawQuery = q.Encode()
+
+                                filename = v
+                        }
+
+                        dst = filepath.Join(dst, filename)
                 }
         }
 
@@ -305,7 +314,13 @@ func (c *Client) Get() error {
                         return err
                 }
 
-                return copyDir(realDst, filepath.Join(dst, subDir), false)
+                // Process any globs
+                subDir, err := SubdirGlob(dst, subDir)
+                if err != nil {
+                        return err
+                }
+
+                return copyDir(realDst, subDir, false)
         }
 
         return nil
diff --git a/vendor/github.com/hashicorp/go-getter/decompress.go b/vendor/github.com/hashicorp/go-getter/decompress.go
index d18174c..198bb0e 100644
--- a/vendor/github.com/hashicorp/go-getter/decompress.go
+++ b/vendor/github.com/hashicorp/go-getter/decompress.go
@@ -1,7 +1,15 @@
 package getter
 
+import (
+        "strings"
+)
+
 // Decompressor defines the interface that must be implemented to add
 // support for decompressing a type.
+//
+// Important: if you're implementing a decompressor, please use the
+// containsDotDot helper in this file to ensure that files can't be
+// decompressed outside of the specified directory.
 type Decompressor interface {
         // Decompress should decompress src to dst. dir specifies whether dst
         // is a directory or single file. src is guaranteed to be a single file
@@ -16,14 +24,35 @@ var Decompressors map[string]Decompressor
 func init() {
         tbzDecompressor := new(TarBzip2Decompressor)
         tgzDecompressor := new(TarGzipDecompressor)
+        txzDecompressor := new(TarXzDecompressor)
 
         Decompressors = map[string]Decompressor{
                 "bz2":     new(Bzip2Decompressor),
                 "gz":      new(GzipDecompressor),
+                "xz":      new(XzDecompressor),
                 "tar.bz2": tbzDecompressor,
                 "tar.gz":  tgzDecompressor,
+                "tar.xz":  txzDecompressor,
                 "tbz2":    tbzDecompressor,
                 "tgz":     tgzDecompressor,
+                "txz":     txzDecompressor,
                 "zip":     new(ZipDecompressor),
         }
 }
+
+// containsDotDot checks if the filepath value v contains a ".." entry.
+// This will check filepath components by splitting along / or \. This
+// function is copied directly from the Go net/http implementation.
+func containsDotDot(v string) bool {
+        if !strings.Contains(v, "..") {
+                return false
+        }
+        for _, ent := range strings.FieldsFunc(v, isSlashRune) {
+                if ent == ".." {
+                        return true
+                }
+        }
+        return false
+}
+
+func isSlashRune(r rune) bool { return r == '/' || r == '\\' }
diff --git a/vendor/github.com/hashicorp/go-getter/decompress_gzip.go b/vendor/github.com/hashicorp/go-getter/decompress_gzip.go
index 2001054..5ebf709 100644
--- a/vendor/github.com/hashicorp/go-getter/decompress_gzip.go
+++ b/vendor/github.com/hashicorp/go-getter/decompress_gzip.go
@@ -9,7 +9,7 @@ import (
 )
 
 // GzipDecompressor is an implementation of Decompressor that can
-// decompress bz2 files.
+// decompress gzip files.
 type GzipDecompressor struct{}
 
 func (d *GzipDecompressor) Decompress(dst, src string, dir bool) error {
diff --git a/vendor/github.com/hashicorp/go-getter/decompress_tar.go b/vendor/github.com/hashicorp/go-getter/decompress_tar.go
new file mode 100644
index 0000000..39cb392
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-getter/decompress_tar.go
@@ -0,0 +1,138 @@
+package getter
+
+import (
+        "archive/tar"
+        "fmt"
+        "io"
+        "os"
+        "path/filepath"
+)
+
+// untar is a shared helper for untarring an archive. The reader should provide
+// an uncompressed view of the tar archive.
+func untar(input io.Reader, dst, src string, dir bool) error {
+        tarR := tar.NewReader(input)
+        done := false
+        dirHdrs := []*tar.Header{}
+        for {
+                hdr, err := tarR.Next()
+                if err == io.EOF {
+                        if !done {
+                                // Empty archive
+                                return fmt.Errorf("empty archive: %s", src)
+                        }
+
+                        break
+                }
+                if err != nil {
+                        return err
+                }
+
+                if hdr.Typeflag == tar.TypeXGlobalHeader || hdr.Typeflag == tar.TypeXHeader {
+                        // don't unpack extended headers as files
+                        continue
+                }
+
+                path := dst
+                if dir {
+                        // Disallow parent traversal
+                        if containsDotDot(hdr.Name) {
+                                return fmt.Errorf("entry contains '..': %s", hdr.Name)
+                        }
+
+                        path = filepath.Join(path, hdr.Name)
+                }
+
+                if hdr.FileInfo().IsDir() {
+                        if !dir {
+                                return fmt.Errorf("expected a single file: %s", src)
+                        }
+
+                        // A directory, just make the directory and continue unarchiving...
+                        if err := os.MkdirAll(path, 0755); err != nil {
+                                return err
+                        }
+
+                        // Record the directory information so that we may set its attributes
+                        // after all files have been extracted
+                        dirHdrs = append(dirHdrs, hdr)
+
+                        continue
+                } else {
+                        // There is no ordering guarantee that a file in a directory is
+                        // listed before the directory
+                        dstPath := filepath.Dir(path)
+
+                        // Check that the directory exists, otherwise create it
+                        if _, err := os.Stat(dstPath); os.IsNotExist(err) {
+                                if err := os.MkdirAll(dstPath, 0755); err != nil {
+                                        return err
+                                }
+                        }
+                }
+
+                // We have a file. If we already decoded, then it is an error
+                if !dir && done {
+                        return fmt.Errorf("expected a single file, got multiple: %s", src)
+                }
+
+                // Mark that we're done so future in single file mode errors
+                done = true
+
+                // Open the file for writing
+                dstF, err := os.Create(path)
+                if err != nil {
+                        return err
+                }
+                _, err = io.Copy(dstF, tarR)
+                dstF.Close()
+                if err != nil {
+                        return err
+                }
+
+                // Chmod the file
+                if err := os.Chmod(path, hdr.FileInfo().Mode()); err != nil {
+                        return err
+                }
+
+                // Set the access and modification time
+                if err := os.Chtimes(path, hdr.AccessTime, hdr.ModTime); err != nil {
+                        return err
+                }
+        }
+
+        // Adding a file or subdirectory changes the mtime of a directory
+        // We therefore wait until we've extracted everything and then set the mtime and atime attributes
+        for _, dirHdr := range dirHdrs {
+                path := filepath.Join(dst, dirHdr.Name)
+                if err := os.Chtimes(path, dirHdr.AccessTime, dirHdr.ModTime); err != nil {
+                        return err
+                }
+        }
+
+        return nil
+}
+
+// tarDecompressor is an implementation of Decompressor that can
+// unpack tar files.
+type tarDecompressor struct{}
+
+func (d *tarDecompressor) Decompress(dst, src string, dir bool) error {
+        // If we're going into a directory we should make that first
+        mkdir := dst
+        if !dir {
+                mkdir = filepath.Dir(dst)
+        }
+        if err := os.MkdirAll(mkdir, 0755); err != nil {
+                return err
+        }
+
+        // File first
+        f, err := os.Open(src)
+        if err != nil {
+                return err
+        }
+        defer f.Close()
+
+        return untar(f, dst, src, dir)
+}
diff --git a/vendor/github.com/hashicorp/go-getter/decompress_tbz2.go b/vendor/github.com/hashicorp/go-getter/decompress_tbz2.go
index c46ed44..5391b5c 100644
--- a/vendor/github.com/hashicorp/go-getter/decompress_tbz2.go
+++ b/vendor/github.com/hashicorp/go-getter/decompress_tbz2.go
@@ -1,10 +1,7 @@
 package getter
 
 import (
-        "archive/tar"
         "compress/bzip2"
-        "fmt"
-        "io"
         "os"
         "path/filepath"
 )
@@ -32,64 +29,5 @@ func (d *TarBzip2Decompressor) Decompress(dst, src string, dir bool) error {
 
         // Bzip2 compression is second
         bzipR := bzip2.NewReader(f)
-
-        // Once bzip decompressed we have a tar format
-        tarR := tar.NewReader(bzipR)
-        done := false
-        for {
-                hdr, err := tarR.Next()
-                if err == io.EOF {
-                        if !done {
-                                // Empty archive
-                                return fmt.Errorf("empty archive: %s", src)
-                        }
-
-                        return nil
-                }
-                if err != nil {
-                        return err
-                }
-
-                path := dst
-                if dir {
-                        path = filepath.Join(path, hdr.Name)
-                }
-
-                if hdr.FileInfo().IsDir() {
-                        if dir {
-                                return fmt.Errorf("expected a single file: %s", src)
-                        }
-
-                        // A directory, just make the directory and continue unarchiving...
-                        if err := os.MkdirAll(path, 0755); err != nil {
-                                return err
-                        }
-
-                        continue
-                }
-
-                // We have a file. If we already decoded, then it is an error
-                if !dir && done {
-                        return fmt.Errorf("expected a single file, got multiple: %s", src)
-                }
-
-                // Mark that we're done so future in single file mode errors
-                done = true
-
-                // Open the file for writing
-                dstF, err := os.Create(path)
-                if err != nil {
-                        return err
-                }
-                _, err = io.Copy(dstF, tarR)
-                dstF.Close()
-                if err != nil {
-                        return err
-                }
-
-                // Chmod the file
-                if err := os.Chmod(path, hdr.FileInfo().Mode()); err != nil {
-                        return err
-                }
-        }
+        return untar(bzipR, dst, src, dir)
 }
diff --git a/vendor/github.com/hashicorp/go-getter/decompress_testing.go b/vendor/github.com/hashicorp/go-getter/decompress_testing.go
index 686d6c2..91cf33d 100644
--- a/vendor/github.com/hashicorp/go-getter/decompress_testing.go
+++ b/vendor/github.com/hashicorp/go-getter/decompress_testing.go
@@ -11,7 +11,9 @@ import (
         "runtime"
         "sort"
         "strings"
-        "testing"
+        "time"
+
+        "github.com/mitchellh/go-testing-interface"
 )
 
 // TestDecompressCase is a single test case for testing decompressors
@@ -21,10 +23,11 @@ type TestDecompressCase struct {
         Err     bool     // Err is whether we expect an error or not
         DirList []string // DirList is the list of files for Dir mode
         FileMD5 string   // FileMD5 is the expected MD5 for a single file
+        Mtime *time.Time // Mtime is the optionally expected mtime for a single file (or all files if in Dir mode)
 }
 
 // TestDecompressor is a helper function for testing generic decompressors.
-func TestDecompressor(t *testing.T, d Decompressor, cases []TestDecompressCase) {
+func TestDecompressor(t testing.T, d Decompressor, cases []TestDecompressCase) {
         for _, tc := range cases {
                 t.Logf("Testing: %s", tc.Input)
 
@@ -67,6 +70,14 @@ func TestDecompressor(t *testing.T, d Decompressor, cases []TestDecompressCase)
                                         }
                                 }
 
+                                if tc.Mtime != nil {
+                                        actual := fi.ModTime()
+                                        expected := *tc.Mtime
+                                        if actual != expected {
+                                                t.Fatalf("err %s: expected mtime '%s' for %s, got '%s'", tc.Input, expected.String(), dst, actual.String())
+                                        }
+                                }
+
                                 return
                         }
 
@@ -83,11 +94,26 @@ func TestDecompressor(t *testing.T, d Decompressor, cases []TestDecompressCase)
                         if !reflect.DeepEqual(actual, expected) {
                                 t.Fatalf("bad %s\n\n%#v\n\n%#v", tc.Input, actual, expected)
                         }
+                        // Check for correct atime/mtime
+                        for _, dir := range actual {
+                                path := filepath.Join(dst, dir)
+                                if tc.Mtime != nil {
+                                        fi, err := os.Stat(path)
+                                        if err != nil {
+                                                t.Fatalf("err: %s", err)
+                                        }
+                                        actual := fi.ModTime()
+                                        expected := *tc.Mtime
+                                        if actual != expected {
+                                                t.Fatalf("err %s: expected mtime '%s' for %s, got '%s'", tc.Input, expected.String(), path, actual.String())
+                                        }
+                                }
+                        }
                 }()
         }
 }
 
-func testListDir(t *testing.T, path string) []string {
+func testListDir(t testing.T, path string) []string {
         var result []string
         err := filepath.Walk(path, func(sub string, info os.FileInfo, err error) error {
                 if err != nil {
@@ -102,7 +128,7 @@ func testListDir(t *testing.T, path string) []string {
 
                 // If it is a dir, add trailing sep
                 if info.IsDir() {
-                        sub += "/"
+                        sub += string(os.PathSeparator)
                 }
 
                 result = append(result, sub)
@@ -116,7 +142,7 @@ func testListDir(t *testing.T, path string) []string {
         return result
 }
 
-func testMD5(t *testing.T, path string) string {
+func testMD5(t testing.T, path string) string {
         f, err := os.Open(path)
         if err != nil {
                 t.Fatalf("err: %s", err)
diff --git a/vendor/github.com/hashicorp/go-getter/decompress_tgz.go b/vendor/github.com/hashicorp/go-getter/decompress_tgz.go
index e8b1c31..65eb70d 100644
--- a/vendor/github.com/hashicorp/go-getter/decompress_tgz.go
+++ b/vendor/github.com/hashicorp/go-getter/decompress_tgz.go
@@ -1,10 +1,8 @@
 package getter
 
 import (
-        "archive/tar"
         "compress/gzip"
         "fmt"
-        "io"
         "os"
         "path/filepath"
 )
@@ -37,63 +35,5 @@ func (d *TarGzipDecompressor) Decompress(dst, src string, dir bool) error {
         }
         defer gzipR.Close()
 
-        // Once gzip decompressed we have a tar format
-        tarR := tar.NewReader(gzipR)
-        done := false
-        for {
-                hdr, err := tarR.Next()
-                if err == io.EOF {
-                        if !done {
-                                // Empty archive
-                                return fmt.Errorf("empty archive: %s", src)
-                        }
-
-                        return nil
-                }
-                if err != nil {
-                        return err
-                }
-
-                path := dst
-                if dir {
-                        path = filepath.Join(path, hdr.Name)
-                }
-
-                if hdr.FileInfo().IsDir() {
-                        if !dir {
-                                return fmt.Errorf("expected a single file: %s", src)
-                        }
-
-                        // A directory, just make the directory and continue unarchiving...
-                        if err := os.MkdirAll(path, 0755); err != nil {
-                                return err
-                        }
-
-                        continue
-                }
-
-                // We have a file. If we already decoded, then it is an error
-                if !dir && done {
-                        return fmt.Errorf("expected a single file, got multiple: %s", src)
-                }
-
-                // Mark that we're done so future in single file mode errors
-                done = true
-
-                // Open the file for writing
-                dstF, err := os.Create(path)
-                if err != nil {
-                        return err
-                }
-                _, err = io.Copy(dstF, tarR)
-                dstF.Close()
-                if err != nil {
-                        return err
-                }
-
-                // Chmod the file
-                if err := os.Chmod(path, hdr.FileInfo().Mode()); err != nil {
-                        return err
-                }
-        }
+        return untar(gzipR, dst, src, dir)
 }
diff --git a/vendor/github.com/hashicorp/go-getter/decompress_txz.go b/vendor/github.com/hashicorp/go-getter/decompress_txz.go
new file mode 100644
index 0000000..5e151c1
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-getter/decompress_txz.go
@@ -0,0 +1,39 @@
+package getter
+
+import (
+        "fmt"
+        "os"
+        "path/filepath"
+
+        "github.com/ulikunitz/xz"
+)
+
+// TarXzDecompressor is an implementation of Decompressor that can
+// decompress tar.xz files.
+type TarXzDecompressor struct{}
+
+func (d *TarXzDecompressor) Decompress(dst, src string, dir bool) error {
+        // If we're going into a directory we should make that first
+        mkdir := dst
+        if !dir {
+                mkdir = filepath.Dir(dst)
+        }
+        if err := os.MkdirAll(mkdir, 0755); err != nil {
+                return err
+        }
+
+        // File first
+        f, err := os.Open(src)
+        if err != nil {
+                return err
+        }
+        defer f.Close()
+
+        // xz compression is second
+        txzR, err := xz.NewReader(f)
+        if err != nil {
+                return fmt.Errorf("Error opening an xz reader for %s: %s", src, err)
+        }
+
+        return untar(txzR, dst, src, dir)
+}
diff --git a/vendor/github.com/hashicorp/go-getter/decompress_xz.go b/vendor/github.com/hashicorp/go-getter/decompress_xz.go
new file mode 100644
index 0000000..4e37aba
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-getter/decompress_xz.go
@@ -0,0 +1,49 @@
+package getter
+
+import (
+        "fmt"
+        "io"
+        "os"
+        "path/filepath"
+
+        "github.com/ulikunitz/xz"
+)
+
+// XzDecompressor is an implementation of Decompressor that can
+// decompress xz files.
+type XzDecompressor struct{}
+
+func (d *XzDecompressor) Decompress(dst, src string, dir bool) error {
+        // Directory isn't supported at all
+        if dir {
+                return fmt.Errorf("xz-compressed files can only unarchive to a single file")
+        }
+
+        // If we're going into a directory we should make that first
+        if err := os.MkdirAll(filepath.Dir(dst), 0755); err != nil {
+                return err
+        }
+
+        // File first
+        f, err := os.Open(src)
+        if err != nil {
+                return err
+        }
+        defer f.Close()
+
+        // xz compression is second
+        xzR, err := xz.NewReader(f)
+        if err != nil {
+                return err
+        }
+
+        // Copy it out
+        dstF, err := os.Create(dst)
+        if err != nil {
+                return err
+        }
+        defer dstF.Close()
+
+        _, err = io.Copy(dstF, xzR)
+        return err
+}
diff --git a/vendor/github.com/hashicorp/go-getter/decompress_zip.go b/vendor/github.com/hashicorp/go-getter/decompress_zip.go
index a065c07..b0e70ca 100644
--- a/vendor/github.com/hashicorp/go-getter/decompress_zip.go
+++ b/vendor/github.com/hashicorp/go-getter/decompress_zip.go
@@ -42,6 +42,11 @@ func (d *ZipDecompressor) Decompress(dst, src string, dir bool) error {
         for _, f := range zipR.File {
                 path := dst
                 if dir {
+                        // Disallow parent traversal
+                        if containsDotDot(f.Name) {
+                                return fmt.Errorf("entry contains '..': %s", f.Name)
+                        }
+
                         path = filepath.Join(path, f.Name)
                 }
 
diff --git a/vendor/github.com/hashicorp/go-getter/detect.go b/vendor/github.com/hashicorp/go-getter/detect.go
index 481b737..c369551 100644
--- a/vendor/github.com/hashicorp/go-getter/detect.go
+++ b/vendor/github.com/hashicorp/go-getter/detect.go
@@ -72,12 +72,18 @@ func Detect(src string, pwd string, ds []Detector) (string, error) {
                                 subDir = detectSubdir
                         }
                 }
+
                 if subDir != "" {
                         u, err := url.Parse(result)
                         if err != nil {
                                 return "", fmt.Errorf("Error parsing URL: %s", err)
                         }
                         u.Path += "//" + subDir
+
+                        // a subdir may contain wildcards, but in order to support them we
+                        // have to ensure the path isn't escaped.
+                        u.RawPath = u.Path
+
                         result = u.String()
                 }
 
diff --git a/vendor/github.com/hashicorp/go-getter/detect_file.go b/vendor/github.com/hashicorp/go-getter/detect_file.go
index 756ea43..4ef41ea 100644
--- a/vendor/github.com/hashicorp/go-getter/detect_file.go
+++ b/vendor/github.com/hashicorp/go-getter/detect_file.go
@@ -32,7 +32,7 @@ func (d *FileDetector) Detect(src, pwd string) (string, bool, error) {
                                 return "", true, err
                         }
                         if fi.Mode()&os.ModeSymlink != 0 {
-                                pwd, err = os.Readlink(pwd)
+                                pwd, err = filepath.EvalSymlinks(pwd)
                                 if err != nil {
                                         return "", true, err
                                 }
diff --git a/vendor/github.com/hashicorp/go-getter/get.go b/vendor/github.com/hashicorp/go-getter/get.go
index c3236f5..e6053d9 100644
--- a/vendor/github.com/hashicorp/go-getter/get.go
+++ b/vendor/github.com/hashicorp/go-getter/get.go
@@ -18,6 +18,8 @@ import (
         "os/exec"
         "regexp"
         "syscall"
+
+        cleanhttp "github.com/hashicorp/go-cleanhttp"
 )
 
 // Getter defines the interface that schemes must implement to download
@@ -49,8 +51,13 @@ var Getters map[string]Getter
 // syntax is schema::url, example: git::https://foo.com
 var forcedRegexp = regexp.MustCompile(`^([A-Za-z0-9]+)::(.+)$`)
 
+// httpClient is the default client to be used by HttpGetters.
+var httpClient = cleanhttp.DefaultClient()
+
 func init() {
-        httpGetter := &HttpGetter{Netrc: true}
+        httpGetter := &HttpGetter{
+                Netrc: true,
+        }
 
         Getters = map[string]Getter{
                 "file":  new(FileGetter),
diff --git a/vendor/github.com/hashicorp/go-getter/get_git.go b/vendor/github.com/hashicorp/go-getter/get_git.go
index 0728139..cb1d029 100644
--- a/vendor/github.com/hashicorp/go-getter/get_git.go
+++ b/vendor/github.com/hashicorp/go-getter/get_git.go
@@ -11,6 +11,7 @@ import (
         "strings"
 
         urlhelper "github.com/hashicorp/go-getter/helper/url"
+        "github.com/hashicorp/go-safetemp"
         "github.com/hashicorp/go-version"
 )
 
@@ -105,13 +106,11 @@ func (g *GitGetter) Get(dst string, u *url.URL) error {
 // GetFile for Git doesn't support updating at this time. It will download
 // the file every time.
 func (g *GitGetter) GetFile(dst string, u *url.URL) error {
-        td, err := ioutil.TempDir("", "getter-git")
+        td, tdcloser, err := safetemp.Dir("", "getter")
         if err != nil {
                 return err
         }
-        if err := os.RemoveAll(td); err != nil {
-                return err
-        }
+        defer tdcloser.Close()
 
         // Get the filename, and strip the filename from the URL so we can
         // just get the repository directly.
@@ -180,17 +179,34 @@ func (g *GitGetter) fetchSubmodules(dst, sshKeyFile string) error {
 // setupGitEnv sets up the environment for the given command. This is used to
 // pass configuration data to git and ssh and enables advanced cloning methods.
 func setupGitEnv(cmd *exec.Cmd, sshKeyFile string) {
-        var sshOpts []string
+        const gitSSHCommand = "GIT_SSH_COMMAND="
+        var sshCmd []string
+
+        // If we have an existing GIT_SSH_COMMAND, we need to append our options.
+        // We will also remove our old entry to make sure the behavior is the same
+        // with versions of Go < 1.9.
+        env := os.Environ()
+        for i, v := range env {
+                if strings.HasPrefix(v, gitSSHCommand) {
+                        sshCmd = []string{v}
+
+                        env[i], env[len(env)-1] = env[len(env)-1], env[i]
+                        env = env[:len(env)-1]
+                        break
+                }
+        }
+
+        if len(sshCmd) == 0 {
+                sshCmd = []string{gitSSHCommand + "ssh"}
+        }
 
         if sshKeyFile != "" {
                 // We have an SSH key temp file configured, tell ssh about this.
-                sshOpts = append(sshOpts, "-i", sshKeyFile)
+                sshCmd = append(sshCmd, "-i", sshKeyFile)
         }
 
-        cmd.Env = append(os.Environ(),
-                // Set the ssh command to use for clones.
-                "GIT_SSH_COMMAND=ssh "+strings.Join(sshOpts, " "),
-        )
+        env = append(env, strings.Join(sshCmd, " "))
+        cmd.Env = env
 }
 
 // checkGitVersion is used to check the version of git installed on the system
diff --git a/vendor/github.com/hashicorp/go-getter/get_hg.go b/vendor/github.com/hashicorp/go-getter/get_hg.go
index 820bdd4..f386922 100644
--- a/vendor/github.com/hashicorp/go-getter/get_hg.go
+++ b/vendor/github.com/hashicorp/go-getter/get_hg.go
@@ -2,7 +2,6 @@ package getter
 
 import (
         "fmt"
-        "io/ioutil"
         "net/url"
         "os"
         "os/exec"
@@ -10,6 +9,7 @@ import (
         "runtime"
 
         urlhelper "github.com/hashicorp/go-getter/helper/url"
+        "github.com/hashicorp/go-safetemp"
 )
 
 // HgGetter is a Getter implementation that will download a module from
@@ -64,13 +64,13 @@ func (g *HgGetter) Get(dst string, u *url.URL) error {
 // GetFile for Hg doesn't support updating at this time. It will download
 // the file every time.
 func (g *HgGetter) GetFile(dst string, u *url.URL) error {
-        td, err := ioutil.TempDir("", "getter-hg")
+        // Create a temporary directory to store the full source. This has to be
+        // a non-existent directory.
+        td, tdcloser, err := safetemp.Dir("", "getter")
         if err != nil {
                 return err
         }
-        if err := os.RemoveAll(td); err != nil {
-                return err
-        }
+        defer tdcloser.Close()
 
         // Get the filename, and strip the filename from the URL so we can
         // just get the repository directly.
diff --git a/vendor/github.com/hashicorp/go-getter/get_http.go b/vendor/github.com/hashicorp/go-getter/get_http.go
index 3c02034..d2e2879 100644
--- a/vendor/github.com/hashicorp/go-getter/get_http.go
+++ b/vendor/github.com/hashicorp/go-getter/get_http.go
@@ -4,12 +4,13 @@ import (
         "encoding/xml"
         "fmt"
         "io"
-        "io/ioutil"
         "net/http"
         "net/url"
         "os"
         "path/filepath"
         "strings"
+
+        "github.com/hashicorp/go-safetemp"
 )
 
 // HttpGetter is a Getter implementation that will download from an HTTP
@@ -36,6 +37,10 @@ type HttpGetter struct {
         // Netrc, if true, will lookup and use auth information found
         // in the user's netrc file if available.
         Netrc bool
+
+        // Client is the http.Client to use for Get requests.
+        // This defaults to a cleanhttp.DefaultClient if left unset.
+        Client *http.Client
 }
 
 func (g *HttpGetter) ClientMode(u *url.URL) (ClientMode, error) {
@@ -57,13 +62,17 @@ func (g *HttpGetter) Get(dst string, u *url.URL) error {
                 }
         }
 
+        if g.Client == nil {
+                g.Client = httpClient
+        }
+
         // Add terraform-get to the parameter.
         q := u.Query()
         q.Add("terraform-get", "1")
         u.RawQuery = q.Encode()
 
         // Get the URL
-        resp, err := http.Get(u.String())
+        resp, err := g.Client.Get(u.String())
         if err != nil {
                 return err
         }
@@ -98,7 +107,18 @@ func (g *HttpGetter) Get(dst string, u *url.URL) error {
 }
 
 func (g *HttpGetter) GetFile(dst string, u *url.URL) error {
-        resp, err := http.Get(u.String())
+        if g.Netrc {
+                // Add auth from netrc if we can
+                if err := addAuthFromNetrc(u); err != nil {
+                        return err
+                }
+        }
+
+        if g.Client == nil {
+                g.Client = httpClient
+        }
+
+        resp, err := g.Client.Get(u.String())
         if err != nil {
                 return err
         }
@@ -116,29 +136,40 @@ func (g *HttpGetter) GetFile(dst string, u *url.URL) error {
         if err != nil {
                 return err
         }
-        defer f.Close()
 
-        _, err = io.Copy(f, resp.Body)
+        n, err := io.Copy(f, resp.Body)
+        if err == nil && n < resp.ContentLength {
+                err = io.ErrShortWrite
+        }
+        if err1 := f.Close(); err == nil {
+                err = err1
+        }
         return err
 }
 
 // getSubdir downloads the source into the destination, but with
 // the proper subdir.
 func (g *HttpGetter) getSubdir(dst, source, subDir string) error {
-        // Create a temporary directory to store the full source
-        td, err := ioutil.TempDir("", "tf")
+        // Create a temporary directory to store the full source. This has to be
+        // a non-existent directory.
+        td, tdcloser, err := safetemp.Dir("", "getter")
         if err != nil {
                 return err
         }
-        defer os.RemoveAll(td)
+        defer tdcloser.Close()
 
         // Download that into the given directory
         if err := Get(td, source); err != nil {
                 return err
         }
 
+        // Process any globbing
+        sourcePath, err := SubdirGlob(td, subDir)
+        if err != nil {
+                return err
+        }
+
         // Make sure the subdir path actually exists
-        sourcePath := filepath.Join(td, subDir)
         if _, err := os.Stat(sourcePath); err != nil {
                 return fmt.Errorf(
                         "Error downloading %s: %s", source, err)
diff --git a/vendor/github.com/hashicorp/go-getter/get_s3.go b/vendor/github.com/hashicorp/go-getter/get_s3.go
index d3bffeb..ebb3217 100644
--- a/vendor/github.com/hashicorp/go-getter/get_s3.go
+++ b/vendor/github.com/hashicorp/go-getter/get_s3.go
@@ -28,7 +28,7 @@ func (g *S3Getter) ClientMode(u *url.URL) (ClientMode, error) {
         }
 
         // Create client config
-        config := g.getAWSConfig(region, creds)
+        config := g.getAWSConfig(region, u, creds)
         sess := session.New(config)
         client := s3.New(sess)
 
@@ -84,7 +84,7 @@ func (g *S3Getter) Get(dst string, u *url.URL) error {
                 return err
         }
 
-        config := g.getAWSConfig(region, creds)
+        config := g.getAWSConfig(region, u, creds)
         sess := session.New(config)
         client := s3.New(sess)
 
@@ -139,7 +139,7 @@ func (g *S3Getter) GetFile(dst string, u *url.URL) error {
                 return err
         }
 
-        config := g.getAWSConfig(region, creds)
+        config := g.getAWSConfig(region, u, creds)
         sess := session.New(config)
         client := s3.New(sess)
         return g.getObject(client, dst, bucket, path, version)
@@ -174,7 +174,7 @@ func (g *S3Getter) getObject(client *s3.S3, dst, bucket, key, version string) er
         return err
 }
 
-func (g *S3Getter) getAWSConfig(region string, creds *credentials.Credentials) *aws.Config {
+func (g *S3Getter) getAWSConfig(region string, url *url.URL, creds *credentials.Credentials) *aws.Config {
         conf := &aws.Config{}
         if creds == nil {
                 // Grab the metadata URL
@@ -195,6 +195,14 @@ func (g *S3Getter) getAWSConfig(region string, creds *credentials.Credentials) *
                         })
         }
 
+        if creds != nil {
+                conf.Endpoint = &url.Host
+                conf.S3ForcePathStyle = aws.Bool(true)
+                if url.Scheme == "http" {
+                        conf.DisableSSL = aws.Bool(true)
+                }
+        }
+
         conf.Credentials = creds
         if region != "" {
                 conf.Region = aws.String(region)
@@ -204,29 +212,48 @@ func (g *S3Getter) getAWSConfig(region string, creds *credentials.Credentials) *
 }
 
 func (g *S3Getter) parseUrl(u *url.URL) (region, bucket, path, version string, creds *credentials.Credentials, err error) {
-        // Expected host style: s3.amazonaws.com. They always have 3 parts,
-        // although the first may differ if we're accessing a specific region.
-        hostParts := strings.Split(u.Host, ".")
-        if len(hostParts) != 3 {
-                err = fmt.Errorf("URL is not a valid S3 URL")
-                return
-        }
+        // This just check whether we are dealing with S3 or
+        // any other S3 compliant service. S3 has a predictable
+        // url as others do not
+        if strings.Contains(u.Host, "amazonaws.com") {
+                // Expected host style: s3.amazonaws.com. They always have 3 parts,
+                // although the first may differ if we're accessing a specific region.
+                hostParts := strings.Split(u.Host, ".")
+                if len(hostParts) != 3 {
+                        err = fmt.Errorf("URL is not a valid S3 URL")
+                        return
+                }
 
-        // Parse the region out of the first part of the host
-        region = strings.TrimPrefix(strings.TrimPrefix(hostParts[0], "s3-"), "s3")
-        if region == "" {
-                region = "us-east-1"
-        }
+                // Parse the region out of the first part of the host
+                region = strings.TrimPrefix(strings.TrimPrefix(hostParts[0], "s3-"), "s3")
+                if region == "" {
+                        region = "us-east-1"
+                }
 
-        pathParts := strings.SplitN(u.Path, "/", 3)
-        if len(pathParts) != 3 {
-                err = fmt.Errorf("URL is not a valid S3 URL")
-                return
-        }
+                pathParts := strings.SplitN(u.Path, "/", 3)
+                if len(pathParts) != 3 {
+                        err = fmt.Errorf("URL is not a valid S3 URL")
+                        return
+                }
+
+                bucket = pathParts[1]
+                path = pathParts[2]
+                version = u.Query().Get("version")
 
-        bucket = pathParts[1]
-        path = pathParts[2]
-        version = u.Query().Get("version")
+        } else {
+                pathParts := strings.SplitN(u.Path, "/", 3)
+                if len(pathParts) != 3 {
+                        err = fmt.Errorf("URL is not a valid S3 complaint URL")
+                        return
+                }
+                bucket = pathParts[1]
+                path = pathParts[2]
+                version = u.Query().Get("version")
+                region = u.Query().Get("region")
+                if region == "" {
+                        region = "us-east-1"
+                }
+        }
 
         _, hasAwsId := u.Query()["aws_access_key_id"]
         _, hasAwsSecret := u.Query()["aws_access_key_secret"]
diff --git a/vendor/github.com/hashicorp/go-getter/source.go b/vendor/github.com/hashicorp/go-getter/source.go
index 4d5ee3c..c63f2bb 100644
--- a/vendor/github.com/hashicorp/go-getter/source.go
+++ b/vendor/github.com/hashicorp/go-getter/source.go
@@ -1,6 +1,8 @@
 package getter
 
 import (
+        "fmt"
+        "path/filepath"
         "strings"
 )
 
@@ -34,3 +36,27 @@ func SourceDirSubdir(src string) (string, string) {
 
         return src, subdir
 }
+
+// SubdirGlob returns the actual subdir with globbing processed.
+//
+// dst should be a destination directory that is already populated (the
+// download is complete) and subDir should be the set subDir. If subDir
+// is an empty string, this returns an empty string.
+//
+// The returned path is the full absolute path.
+func SubdirGlob(dst, subDir string) (string, error) {
+        matches, err := filepath.Glob(filepath.Join(dst, subDir))
+        if err != nil {
+                return "", err
+        }
+
+        if len(matches) == 0 {
+                return "", fmt.Errorf("subdir %q not found", subDir)
+        }
+
+        if len(matches) > 1 {
+                return "", fmt.Errorf("subdir %q matches multiple paths", subDir)
+        }
+
+        return matches[0], nil
+}
diff --git a/vendor/github.com/hashicorp/go-hclog/LICENSE b/vendor/github.com/hashicorp/go-hclog/LICENSE
new file mode 100644
index 0000000..abaf1e4
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-hclog/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2017 HashiCorp
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/vendor/github.com/hashicorp/go-hclog/README.md b/vendor/github.com/hashicorp/go-hclog/README.md
new file mode 100644
index 0000000..614342b
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-hclog/README.md
@@ -0,0 +1,123 @@
+# go-hclog
+
+[![Go Documentation](http://img.shields.io/badge/go-documentation-blue.svg?style=flat-square)][godocs]
+
+[godocs]: https://godoc.org/github.com/hashicorp/go-hclog
+
+`go-hclog` is a package for Go that provides a simple key/value logging
+interface for use in development and production environments.
+
+It provides logging levels that provide decreased output based upon the
+desired amount of output, unlike the standard library `log` package.
+
+It does not provide `Printf` style logging, only key/value logging that is
+exposed as arguments to the logging functions for simplicity.
+
+It provides a human readable output mode for use in development as well as
+JSON output mode for production.
+
+## Stability Note
+
+While this library is fully open source and HashiCorp will be maintaining it
+(since we are and will be making extensive use of it), the API and output
+format is subject to minor changes as we fully bake and vet it in our projects.
+This notice will be removed once it's fully integrated into our major projects
+and no further changes are anticipated.
+
+## Installation and Docs
+
+Install using `go get github.com/hashicorp/go-hclog`.
+
+Full documentation is available at
+http://godoc.org/github.com/hashicorp/go-hclog
+
+## Usage
+
+### Use the global logger
+
+```go
+hclog.Default().Info("hello world")
+```
+
+```text
+2017-07-05T16:15:55.167-0700 [INFO ] hello world
+```
+
+(Note timestamps are removed in future examples for brevity.)
+
+### Create a new logger
+
+```go
+appLogger := hclog.New(&hclog.LoggerOptions{
+        Name:  "my-app",
+        Level: hclog.LevelFromString("DEBUG"),
+})
+```
+
+### Emit an Info level message with 2 key/value pairs
+
+```go
+input := "5.5"
+_, err := strconv.ParseInt(input, 10, 32)
+if err != nil {
+        appLogger.Info("Invalid input for ParseInt", "input", input, "error", err)
+}
+```
+
+```text
+... [INFO ] my-app: Invalid input for ParseInt: input=5.5 error="strconv.ParseInt: parsing "5.5": invalid syntax"
+```
+
+### Create a new Logger for a major subsystem
+
+```go
+subsystemLogger := appLogger.Named("transport")
+subsystemLogger.Info("we are transporting something")
+```
+
+```text
+... [INFO ] my-app.transport: we are transporting something
+```
+
+Notice that logs emitted by `subsystemLogger` contain `my-app.transport`,
+reflecting both the application and subsystem names.
+
+### Create a new Logger with fixed key/value pairs
+
+Using `With()` will include a specific key-value pair in all messages emitted
+by that logger.
+
+```go
+requestID := "5fb446b6-6eba-821d-df1b-cd7501b6a363"
+requestLogger := subsystemLogger.With("request", requestID)
+requestLogger.Info("we are transporting a request")
+```
+
+```text
+... [INFO ] my-app.transport: we are transporting a request: request=5fb446b6-6eba-821d-df1b-cd7501b6a363
+```
+
+This allows sub Loggers to be context specific without having to thread that
+into all the callers.
+
+### Use this with code that uses the standard library logger
+
+If you want to use the standard library's `log.Logger` interface you can wrap
+`hclog.Logger` by calling the `StandardLogger()` method. This allows you to use
+it with the familiar `Println()`, `Printf()`, etc. For example:
+
+```go
+stdLogger := appLogger.StandardLogger(&hclog.StandardLoggerOptions{
+        InferLevels: true,
+})
+// Printf() is provided by stdlib log.Logger interface, not hclog.Logger
+stdLogger.Printf("[DEBUG] %+v", stdLogger)
+```
+
+```text
+... [DEBUG] my-app: &{mu:{state:0 sema:0} prefix: flag:0 out:0xc42000a0a0 buf:[]}
+```
+
+Notice that if `appLogger` is initialized with the `INFO` log level _and_ you
+specify `InferLevels: true`, you will not see any output here. You must change
+`appLogger` to `DEBUG` to see output. See the docs for more information.
diff --git a/vendor/github.com/hashicorp/go-hclog/global.go b/vendor/github.com/hashicorp/go-hclog/global.go
new file mode 100644
index 0000000..55ce439
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-hclog/global.go
@@ -0,0 +1,34 @@
+package hclog
+
+import (
+        "sync"
+)
+
+var (
+        protect sync.Once
+        def     Logger
+
+        // The options used to create the Default logger. These are
+        // read only when the Default logger is created, so set them
+        // as soon as the process starts.
+        DefaultOptions = &LoggerOptions{
+                Level:  DefaultLevel,
+                Output: DefaultOutput,
+        }
+)
+
+// Return a logger that is held globally. This can be a good starting
+// place, and then you can use .With() and .Name() to create sub-loggers
+// to be used in more specific contexts.
+func Default() Logger {
+        protect.Do(func() {
+                def = New(DefaultOptions)
+        })
+
+        return def
+}
+
+// A short alias for Default()
+func L() Logger {
+        return Default()
+}
diff --git a/vendor/github.com/hashicorp/go-hclog/int.go b/vendor/github.com/hashicorp/go-hclog/int.go
new file mode 100644
index 0000000..9f90c28
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-hclog/int.go
@@ -0,0 +1,385 @@
+package hclog
+
+import (
+        "bufio"
+        "encoding/json"
+        "fmt"
+        "log"
+        "os"
+        "runtime"
+        "strconv"
+        "strings"
+        "sync"
+        "time"
+)
+
+var (
+        _levelToBracket = map[Level]string{
+                Debug: "[DEBUG]",
+                Trace: "[TRACE]",
+                Info:  "[INFO ]",
+                Warn:  "[WARN ]",
+                Error: "[ERROR]",
+        }
+)
+
+// Given the options (nil for defaults), create a new Logger
+func New(opts *LoggerOptions) Logger {
+        if opts == nil {
+                opts = &LoggerOptions{}
+        }
+
+        output := opts.Output
+        if output == nil {
+                output = os.Stderr
+        }
+
+        level := opts.Level
+        if level == NoLevel {
+                level = DefaultLevel
+        }
+
+        return &intLogger{
+                m:      new(sync.Mutex),
+                json:   opts.JSONFormat,
+                caller: opts.IncludeLocation,
+                name:   opts.Name,
+                w:      bufio.NewWriter(output),
+                level:  level,
+        }
+}
+
+// The internal logger implementation. Internal in that it is defined entirely
+// by this package.
+type intLogger struct {
+        json   bool
+        caller bool
+        name   string
+
+        // this is a pointer so that it's shared by any derived loggers, since
+        // those derived loggers share the bufio.Writer as well.
+        m     *sync.Mutex
+        w     *bufio.Writer
+        level Level
+
+        implied []interface{}
+}
+
+// Make sure that intLogger is a Logger
+var _ Logger = &intLogger{}
+
+// The time format to use for logging. This is a version of RFC3339 that
+// contains millisecond precision
+const TimeFormat = "2006-01-02T15:04:05.000Z0700"
+
+// Log a message and a set of key/value pairs if the given level is at
+// or more severe that the threshold configured in the Logger.
+func (z *intLogger) Log(level Level, msg string, args ...interface{}) {
+        if level < z.level {
+                return
+        }
+
+        t := time.Now()
+
+        z.m.Lock()
+        defer z.m.Unlock()
+
+        if z.json {
+                z.logJson(t, level, msg, args...)
+        } else {
+                z.log(t, level, msg, args...)
+        }
+
+        z.w.Flush()
+}
+
+// Cleanup a path by returning the last 2 segments of the path only.
+func trimCallerPath(path string) string {
+        // lovely borrowed from zap
+        // nb. To make sure we trim the path correctly on Windows too, we
+        // counter-intuitively need to use '/' and *not* os.PathSeparator here,
+        // because the path given originates from Go stdlib, specifically
+        // runtime.Caller() which (as of Mar/17) returns forward slashes even on
+        // Windows.
+        //
+        // See https://github.com/golang/go/issues/3335
+        // and https://github.com/golang/go/issues/18151
+        //
+        // for discussion on the issue on Go side.
+        //
+
+        // Find the last separator.
+        //
+        idx := strings.LastIndexByte(path, '/')
+        if idx == -1 {
+                return path
+        }
+
+        // Find the penultimate separator.
+        idx = strings.LastIndexByte(path[:idx], '/')
+        if idx == -1 {
+                return path
+        }
+
+        return path[idx+1:]
+}
+
+// Non-JSON logging format function
+func (z *intLogger) log(t time.Time, level Level, msg string, args ...interface{}) {
+        z.w.WriteString(t.Format(TimeFormat))
+        z.w.WriteByte(' ')
+
+        s, ok := _levelToBracket[level]
+        if ok {
+                z.w.WriteString(s)
+        } else {
+                z.w.WriteString("[UNKN ]")
+        }
+
+        if z.caller {
+                if _, file, line, ok := runtime.Caller(3); ok {
+                        z.w.WriteByte(' ')
+                        z.w.WriteString(trimCallerPath(file))
+                        z.w.WriteByte(':')
+                        z.w.WriteString(strconv.Itoa(line))
+                        z.w.WriteByte(':')
+                }
+        }
+
+        z.w.WriteByte(' ')
+
+        if z.name != "" {
+                z.w.WriteString(z.name)
+                z.w.WriteString(": ")
+        }
+
+        z.w.WriteString(msg)
+
+        args = append(z.implied, args...)
+
+        var stacktrace CapturedStacktrace
+
+        if args != nil && len(args) > 0 {
+                if len(args)%2 != 0 {
+                        cs, ok := args[len(args)-1].(CapturedStacktrace)
+                        if ok {
+                                args = args[:len(args)-1]
+                                stacktrace = cs
+                        } else {
+                                args = append(args, "<unknown>")
+                        }
+                }
+
+                z.w.WriteByte(':')
+
+        FOR:
+                for i := 0; i < len(args); i = i + 2 {
+                        var val string
+
+                        switch st := args[i+1].(type) {
+                        case string:
+                                val = st
+                        case int:
+                                val = strconv.FormatInt(int64(st), 10)
+                        case int64:
+                                val = strconv.FormatInt(int64(st), 10)
+                        case int32:
+                                val = strconv.FormatInt(int64(st), 10)
+                        case int16:
+                                val = strconv.FormatInt(int64(st), 10)
+                        case int8:
+                                val = strconv.FormatInt(int64(st), 10)
+                        case uint:
+                                val = strconv.FormatUint(uint64(st), 10)
+                        case uint64:
+                                val = strconv.FormatUint(uint64(st), 10)
+                        case uint32:
+                                val = strconv.FormatUint(uint64(st), 10)
+                        case uint16:
+                                val = strconv.FormatUint(uint64(st), 10)
+                        case uint8:
+                                val = strconv.FormatUint(uint64(st), 10)
+                        case CapturedStacktrace:
+                                stacktrace = st
+                                continue FOR
+                        default:
+                                val = fmt.Sprintf("%v", st)
+                        }
+
+                        z.w.WriteByte(' ')
+                        z.w.WriteString(args[i].(string))
+                        z.w.WriteByte('=')
+
+                        if strings.ContainsAny(val, " \t\n\r") {
+                                z.w.WriteByte('"')
+                                z.w.WriteString(val)
+                                z.w.WriteByte('"')
+                        } else {
+                                z.w.WriteString(val)
+                        }
+                }
+        }
+
+        z.w.WriteString("\n")
+
+        if stacktrace != "" {
+                z.w.WriteString(string(stacktrace))
+        }
+}
+
+// JSON logging function
+func (z *intLogger) logJson(t time.Time, level Level, msg string, args ...interface{}) {
+        vals := map[string]interface{}{
+                "@message":   msg,
+                "@timestamp": t.Format("2006-01-02T15:04:05.000000Z07:00"),
+        }
+
+        var levelStr string
+        switch level {
+        case Error:
+                levelStr = "error"
+        case Warn:
+                levelStr = "warn"
+        case Info:
+                levelStr = "info"
+        case Debug:
+                levelStr = "debug"
+        case Trace:
+                levelStr = "trace"
+        default:
+                levelStr = "all"
+        }
+
+        vals["@level"] = levelStr
+
+        if z.name != "" {
+                vals["@module"] = z.name
+        }
+
+        if z.caller {
+                if _, file, line, ok := runtime.Caller(3); ok {
+                        vals["@caller"] = fmt.Sprintf("%s:%d", file, line)
+                }
+        }
+
+        if args != nil && len(args) > 0 {
+                if len(args)%2 != 0 {
+                        cs, ok := args[len(args)-1].(CapturedStacktrace)
+                        if ok {
+                                args = args[:len(args)-1]
+                                vals["stacktrace"] = cs
+                        } else {
+                                args = append(args, "<unknown>")
+                        }
+                }
+
+                for i := 0; i < len(args); i = i + 2 {
+                        if _, ok := args[i].(string); !ok {
+                                // As this is the logging function not much we can do here
+                                // without injecting into logs...
+                                continue
+                        }
+                        vals[args[i].(string)] = args[i+1]
+                }
+        }
+
+        err := json.NewEncoder(z.w).Encode(vals)
+        if err != nil {
+                panic(err)
+        }
+}
+
+// Emit the message and args at DEBUG level
+func (z *intLogger) Debug(msg string, args ...interface{}) {
+        z.Log(Debug, msg, args...)
+}
+
+// Emit the message and args at TRACE level
+func (z *intLogger) Trace(msg string, args ...interface{}) {
+        z.Log(Trace, msg, args...)
+}
+
+// Emit the message and args at INFO level
+func (z *intLogger) Info(msg string, args ...interface{}) {
+        z.Log(Info, msg, args...)
+}
+
+// Emit the message and args at WARN level
+func (z *intLogger) Warn(msg string, args ...interface{}) {
+        z.Log(Warn, msg, args...)
+}
+
+// Emit the message and args at ERROR level
+func (z *intLogger) Error(msg string, args ...interface{}) {
+        z.Log(Error, msg, args...)
+}
+
+// Indicate that the logger would emit TRACE level logs
+func (z *intLogger) IsTrace() bool {
+        return z.level == Trace
+}
+
+// Indicate that the logger would emit DEBUG level logs
+func (z *intLogger) IsDebug() bool {
+        return z.level <= Debug
+}
+
+// Indicate that the logger would emit INFO level logs
+func (z *intLogger) IsInfo() bool {
+        return z.level <= Info
+}
+
+// Indicate that the logger would emit WARN level logs
+func (z *intLogger) IsWarn() bool {
+        return z.level <= Warn
+}
+
+// Indicate that the logger would emit ERROR level logs
+func (z *intLogger) IsError() bool {
+        return z.level <= Error
+}
+
+// Return a sub-Logger for which every emitted log message will contain
+// the given key/value pairs. This is used to create a context specific
+// Logger.
+func (z *intLogger) With(args ...interface{}) Logger {
+        var nz intLogger = *z
+
+        nz.implied = append(nz.implied, args...)
+
+        return &nz
+}
+
+// Create a new sub-Logger that a name decending from the current name.
+// This is used to create a subsystem specific Logger.
+func (z *intLogger) Named(name string) Logger {
+        var nz intLogger = *z
+
+        if nz.name != "" {
+                nz.name = nz.name + "." + name
+        }
+
+        return &nz
+}
+
+// Create a new sub-Logger with an explicit name. This ignores the current
+// name. This is used to create a standalone logger that doesn't fall
+// within the normal hierarchy.
+func (z *intLogger) ResetNamed(name string) Logger {
+        var nz intLogger = *z
+
+        nz.name = name
+
+        return &nz
+}
+
+// Create a *log.Logger that will send it's data through this Logger. This
+// allows packages that expect to be using the standard library log to actually
+// use this logger.
+func (z *intLogger) StandardLogger(opts *StandardLoggerOptions) *log.Logger {
+        if opts == nil {
+                opts = &StandardLoggerOptions{}
+        }
+
+        return log.New(&stdlogAdapter{z, opts.InferLevels}, "", 0)
+}
diff --git a/vendor/github.com/hashicorp/go-hclog/log.go b/vendor/github.com/hashicorp/go-hclog/log.go
new file mode 100644
index 0000000..6bb16ba
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-hclog/log.go
@@ -0,0 +1,138 @@
+package hclog
+
+import (
+        "io"
+        "log"
+        "os"
+        "strings"
+)
+
+var (
+        DefaultOutput = os.Stderr
+        DefaultLevel  = Info
+)
+
+type Level int
+
+const (
+        // This is a special level used to indicate that no level has been
+        // set and allow for a default to be used.
+        NoLevel Level = 0
+
+        // The most verbose level. Intended to be used for the tracing of actions
+        // in code, such as function enters/exits, etc.
+        Trace Level = 1
+
+        // For programmer lowlevel analysis.
+        Debug Level = 2
+
+        // For information about steady state operations.
+        Info Level = 3
+
+        // For information about rare but handled events.
+        Warn Level = 4
+
+        // For information about unrecoverable events.
+        Error Level = 5
+)
+
+// LevelFromString returns a Level type for the named log level, or "NoLevel" if
+// the level string is invalid. This facilitates setting the log level via
+// config or environment variable by name in a predictable way.
+func LevelFromString(levelStr string) Level {
+        // We don't care about case. Accept "INFO" or "info"
+        levelStr = strings.ToLower(strings.TrimSpace(levelStr))
+        switch levelStr {
+        case "trace":
+                return Trace
+        case "debug":
+                return Debug
+        case "info":
+                return Info
+        case "warn":
+                return Warn
+        case "error":
+                return Error
+        default:
+                return NoLevel
+        }
+}
+
+// The main Logger interface. All code should code against this interface only.
+type Logger interface {
+        // Args are alternating key, val pairs
+        // keys must be strings
+        // vals can be any type, but display is implementation specific
+        // Emit a message and key/value pairs at the TRACE level
+        Trace(msg string, args ...interface{})
+
+        // Emit a message and key/value pairs at the DEBUG level
+        Debug(msg string, args ...interface{})
+
+        // Emit a message and key/value pairs at the INFO level
+        Info(msg string, args ...interface{})
+
+        // Emit a message and key/value pairs at the WARN level
+        Warn(msg string, args ...interface{})
+
+        // Emit a message and key/value pairs at the ERROR level
+        Error(msg string, args ...interface{})
+
+        // Indicate if TRACE logs would be emitted. This and the other Is* guards
+        // are used to elide expensive logging code based on the current level.
+        IsTrace() bool
+
+        // Indicate if DEBUG logs would be emitted. This and the other Is* guards
+        IsDebug() bool
+
+        // Indicate if INFO logs would be emitted. This and the other Is* guards
+        IsInfo() bool
+
+        // Indicate if WARN logs would be emitted. This and the other Is* guards
+        IsWarn() bool
+
+        // Indicate if ERROR logs would be emitted. This and the other Is* guards
+        IsError() bool
+
+        // Creates a sublogger that will always have the given key/value pairs
+        With(args ...interface{}) Logger
+
+        // Create a logger that will prepend the name string on the front of all messages.
+        // If the logger already has a name, the new value will be appended to the current
+        // name. That way, a major subsystem can use this to decorate all it's own logs
+        // without losing context.
+        Named(name string) Logger
+
+        // Create a logger that will prepend the name string on the front of all messages.
+        // This sets the name of the logger to the value directly, unlike Named which honor
+        // the current name as well.
+        ResetNamed(name string) Logger
+
+        // Return a value that conforms to the stdlib log.Logger interface
+        StandardLogger(opts *StandardLoggerOptions) *log.Logger
+}
+
+type StandardLoggerOptions struct {
+        // Indicate that some minimal parsing should be done on strings to try
+        // and detect their level and re-emit them.
+        // This supports the strings like [ERROR], [ERR] [TRACE], [WARN], [INFO],
+        // [DEBUG] and strip it off before reapplying it.
+        InferLevels bool
+}
+
+type LoggerOptions struct {
+        // Name of the subsystem to prefix logs with
+        Name string
+
+        // The threshold for the logger. Anything less severe is supressed
+        Level Level
+
+        // Where to write the logs to. Defaults to os.Stdout if nil
+        Output io.Writer
+
+        // Control if the output should be in JSON.
+        JSONFormat bool
+
+        // Intclude file and line information in each log line
+        IncludeLocation bool
+}
diff --git a/vendor/github.com/hashicorp/go-hclog/stacktrace.go b/vendor/github.com/hashicorp/go-hclog/stacktrace.go
new file mode 100644
index 0000000..8af1a3b
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-hclog/stacktrace.go
@@ -0,0 +1,108 @@
+// Copyright (c) 2016 Uber Technologies, Inc.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+// THE SOFTWARE.
+
+package hclog
+
+import (
+        "bytes"
+        "runtime"
+        "strconv"
+        "strings"
+        "sync"
+)
+
+var (
+        _stacktraceIgnorePrefixes = []string{
+                "runtime.goexit",
+                "runtime.main",
+        }
+        _stacktracePool = sync.Pool{
+                New: func() interface{} {
+                        return newProgramCounters(64)
+                },
+        }
+)
+
+// A stacktrace gathered by a previous call to log.Stacktrace. If passed
+// to a logging function, the stacktrace will be appended.
+type CapturedStacktrace string
+
+// Gather a stacktrace of the current goroutine and return it to be passed
+// to a logging function.
+func Stacktrace() CapturedStacktrace {
+        return CapturedStacktrace(takeStacktrace())
+}
+
+func takeStacktrace() string {
+        programCounters := _stacktracePool.Get().(*programCounters)
+        defer _stacktracePool.Put(programCounters)
+
+        var buffer bytes.Buffer
+
+        for {
+                // Skip the call to runtime.Counters and takeStacktrace so that the
+                // program counters start at the caller of takeStacktrace.
+                n := runtime.Callers(2, programCounters.pcs)
+                if n < cap(programCounters.pcs) {
+                        programCounters.pcs = programCounters.pcs[:n]
+                        break
+                }
+                // Don't put the too-short counter slice back into the pool; this lets
+                // the pool adjust if we consistently take deep stacktraces.
+                programCounters = newProgramCounters(len(programCounters.pcs) * 2)
+        }
+
+        i := 0
+        frames := runtime.CallersFrames(programCounters.pcs)
+        for frame, more := frames.Next(); more; frame, more = frames.Next() {
+                if shouldIgnoreStacktraceFunction(frame.Function) {
+                        continue
+                }
+                if i != 0 {
+                        buffer.WriteByte('\n')
+                }
+                i++
+                buffer.WriteString(frame.Function)
+                buffer.WriteByte('\n')
+                buffer.WriteByte('\t')
+                buffer.WriteString(frame.File)
+                buffer.WriteByte(':')
+                buffer.WriteString(strconv.Itoa(int(frame.Line)))
+        }
+
+        return buffer.String()
+}
+
+func shouldIgnoreStacktraceFunction(function string) bool {
+        for _, prefix := range _stacktraceIgnorePrefixes {
+                if strings.HasPrefix(function, prefix) {
+                        return true
+                }
+        }
+        return false
+}
+
+type programCounters struct {
+        pcs []uintptr
+}
+
+func newProgramCounters(size int) *programCounters {
+        return &programCounters{make([]uintptr, size)}
+}
diff --git a/vendor/github.com/hashicorp/go-hclog/stdlog.go b/vendor/github.com/hashicorp/go-hclog/stdlog.go
new file mode 100644
index 0000000..2bb927f
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-hclog/stdlog.go
@@ -0,0 +1,62 @@
+package hclog
+
+import (
+        "bytes"
+        "strings"
+)
+
+// Provides a io.Writer to shim the data out of *log.Logger
+// and back into our Logger. This is basically the only way to
+// build upon *log.Logger.
+type stdlogAdapter struct {
+        hl          Logger
+        inferLevels bool
+}
+
+// Take the data, infer the levels if configured, and send it through
+// a regular Logger
+func (s *stdlogAdapter) Write(data []byte) (int, error) {
+        str := string(bytes.TrimRight(data, " \t\n"))
+
+        if s.inferLevels {
+                level, str := s.pickLevel(str)
+                switch level {
+                case Trace:
+                        s.hl.Trace(str)
+                case Debug:
+                        s.hl.Debug(str)
+                case Info:
+                        s.hl.Info(str)
+                case Warn:
+                        s.hl.Warn(str)
+                case Error:
+                        s.hl.Error(str)
+                default:
+                        s.hl.Info(str)
+                }
+        } else {
+                s.hl.Info(str)
+        }
+
+        return len(data), nil
+}
+
+// Detect, based on conventions, what log level this is
+func (s *stdlogAdapter) pickLevel(str string) (Level, string) {
+        switch {
+        case strings.HasPrefix(str, "[DEBUG]"):
+                return Debug, strings.TrimSpace(str[7:])
+        case strings.HasPrefix(str, "[TRACE]"):
+                return Trace, strings.TrimSpace(str[7:])
+        case strings.HasPrefix(str, "[INFO]"):
+                return Info, strings.TrimSpace(str[6:])
+        case strings.HasPrefix(str, "[WARN]"):
+                return Warn, strings.TrimSpace(str[7:])
+        case strings.HasPrefix(str, "[ERROR]"):
+                return Error, strings.TrimSpace(str[7:])
+        case strings.HasPrefix(str, "[ERR]"):
+                return Error, strings.TrimSpace(str[5:])
+        default:
+                return Info, str
+        }
+}
diff --git a/vendor/github.com/hashicorp/go-plugin/README.md b/vendor/github.com/hashicorp/go-plugin/README.md
index 2058cfb..e4558db 100644
--- a/vendor/github.com/hashicorp/go-plugin/README.md
+++ b/vendor/github.com/hashicorp/go-plugin/README.md
@@ -1,10 +1,9 @@
 # Go Plugin System over RPC
 
 `go-plugin` is a Go (golang) plugin system over RPC. It is the plugin system
-that has been in use by HashiCorp tooling for over 3 years. While initially
-created for [Packer](https://www.packer.io), it has since been used by
-[Terraform](https://www.terraform.io) and [Otto](https://www.ottoproject.io),
-with plans to also use it for [Nomad](https://www.nomadproject.io) and
+that has been in use by HashiCorp tooling for over 4 years. While initially
+created for [Packer](https://www.packer.io), it is additionally in use by
+[Terraform](https://www.terraform.io), [Nomad](https://www.nomadproject.io), and
 [Vault](https://www.vaultproject.io).
 
 While the plugin system is over RPC, it is currently only designed to work
@@ -24,6 +23,11 @@ interface as if it were going to run in the same process. For a plugin user:
 you just use and call functions on an interface as if it were in the same
 process. This plugin system handles the communication in between.
 
+**Cross-language support.** Plugins can be written (and consumed) by
+almost every major language. This library supports serving plugins via
+[gRPC](http://www.grpc.io). gRPC-based plugins enable plugins to be written
+in any language.
+
 **Complex arguments and return values are supported.** This library
 provides APIs for handling complex arguments and return values such
 as interfaces, `io.Reader/Writer`, etc. We do this by giving you a library
@@ -37,7 +41,10 @@ and the plugin can call back into the host process.
 **Built-in Logging.** Any plugins that use the `log` standard library
 will have log data automatically sent to the host process. The host
 process will mirror this output prefixed with the path to the plugin
-binary. This makes debugging with plugins simple.
+binary. This makes debugging with plugins simple. If the host system
+uses [hclog](https://github.com/hashicorp/go-hclog) then the log data
+will be structured. If the plugin also uses hclog, logs from the plugin
+will be sent to the host hclog and be structured.
 
 **Protocol Versioning.** A very basic "protocol version" is supported that
 can be incremented to invalidate any previous plugins. This is useful when
@@ -62,13 +69,18 @@ This requires the host/plugin to know this is possible and daemonize
 properly. `NewClient` takes a `ReattachConfig` to determine if and how to
 reattach.
 
+**Cryptographically Secure Plugins.** Plugins can be verified with an expected
+checksum and RPC communications can be configured to use TLS. The host process
+must be properly secured to protect this configuration.
+
 ## Architecture
 
 The HashiCorp plugin system works by launching subprocesses and communicating
-over RPC (using standard `net/rpc`). A single connection is made between
-any plugin and the host process, and we use a
-[connection multiplexing](https://github.com/hashicorp/yamux)
-library to multiplex any other connections on top.
+over RPC (using standard `net/rpc` or [gRPC](http://www.grpc.io)). A single
+connection is made between any plugin and the host process. For net/rpc-based
+plugins, we use a [connection multiplexing](https://github.com/hashicorp/yamux)
+library to multiplex any other connections on top. For gRPC-based plugins,
+the HTTP2 protocol handles multiplexing.
 
 This architecture has a number of benefits:
 
@@ -76,8 +88,8 @@ This architecture has a number of benefits:
     panic the plugin user.
 
   * Plugins are very easy to write: just write a Go application and `go build`.
-    Theoretically you could also use another language as long as it can
-    communicate the Go `net/rpc` protocol but this hasn't yet been tried.
+    Or use any other language to write a gRPC server with a tiny amount of
+    boilerplate to support go-plugin.
 
   * Plugins are very easy to install: just put the binary in a location where
     the host will find it (depends on the host but this library also provides
@@ -85,8 +97,8 @@ This architecture has a number of benefits:
 
   * Plugins can be relatively secure: The plugin only has access to the
     interfaces and args given to it, not to the entire memory space of the
-    process. More security features are planned (see the coming soon section
-    below).
+    process. Additionally, go-plugin can communicate with the plugin over
+    TLS.
 
 ## Usage
 
@@ -97,10 +109,9 @@ high-level steps that must be done. Examples are available in the
   1. Choose the interface(s) you want to expose for plugins.
 
   2. For each interface, implement an implementation of that interface
-     that communicates over an `*rpc.Client` (from the standard `net/rpc`
-     package) for every function call. Likewise, implement the RPC server
-     struct this communicates to which is then communicating to a real,
-     concrete implementation.
+     that communicates over a `net/rpc` connection or other a
+     [gRPC](http://www.grpc.io) connection or both. You'll have to implement
+     both a client and server implementation.
 
   3. Create a `Plugin` implementation that knows how to create the RPC
      client/server for a given plugin type.
@@ -125,10 +136,6 @@ improvements we can make.
 
 At this point in time, the roadmap for the plugin system is:
 
-**Cryptographically Secure Plugins.** We'll implement signing plugins
-and loading signed plugins in order to allow Vault to make use of multi-process
-in a secure way.
-
 **Semantic Versioning.** Plugins will be able to implement a semantic version.
 This plugin system will give host processes a system for constraining
 versions. This is in addition to the protocol versioning already present
diff --git a/vendor/github.com/hashicorp/go-plugin/client.go b/vendor/github.com/hashicorp/go-plugin/client.go
index 9f8a0f2..b3e3b78 100644
--- a/vendor/github.com/hashicorp/go-plugin/client.go
+++ b/vendor/github.com/hashicorp/go-plugin/client.go
@@ -2,8 +2,12 @@ package plugin
 
 import (
         "bufio"
+        "context"
+        "crypto/subtle"
+        "crypto/tls"
         "errors"
         "fmt"
+        "hash"
         "io"
         "io/ioutil"
         "log"
@@ -17,6 +21,8 @@ import (
         "sync/atomic"
         "time"
         "unicode"
+
+        hclog "github.com/hashicorp/go-hclog"
 )
 
 // If this is 1, then we've called CleanupClients. This can be used
@@ -35,6 +41,22 @@ var (
         // ErrProcessNotFound is returned when a client is instantiated to
         // reattach to an existing process and it isn't found.
         ErrProcessNotFound = errors.New("Reattachment process not found")
+
+        // ErrChecksumsDoNotMatch is returned when binary's checksum doesn't match
+        // the one provided in the SecureConfig.
+        ErrChecksumsDoNotMatch = errors.New("checksums did not match")
+
+        // ErrSecureNoChecksum is returned when an empty checksum is provided to the
+        // SecureConfig.
+        ErrSecureConfigNoChecksum = errors.New("no checksum provided")
+
+        // ErrSecureNoHash is returned when a nil Hash object is provided to the
+        // SecureConfig.
+        ErrSecureConfigNoHash = errors.New("no hash implementation provided")
+
+        // ErrSecureConfigAndReattach is returned when both Reattach and
+        // SecureConfig are set.
+        ErrSecureConfigAndReattach = errors.New("only one of Reattach or SecureConfig can be set")
 )
 
 // Client handles the lifecycle of a plugin application. It launches
@@ -55,7 +77,10 @@ type Client struct {
         l           sync.Mutex
         address     net.Addr
         process     *os.Process
-        client      *RPCClient
+        client      ClientProtocol
+        protocol    Protocol
+        logger      hclog.Logger
+        doneCtx     context.Context
 }
 
 // ClientConfig is the configuration used to initialize a new
@@ -79,6 +104,13 @@ type ClientConfig struct {
         Cmd      *exec.Cmd
         Reattach *ReattachConfig
 
+        // SecureConfig is configuration for verifying the integrity of the
+        // executable. It can not be used with Reattach.
+        SecureConfig *SecureConfig
+
+        // TLSConfig is used to enable TLS on the RPC client.
+        TLSConfig *tls.Config
+
         // Managed represents if the client should be managed by the
         // plugin package or not. If true, then by calling CleanupClients,
         // it will automatically be cleaned up. Otherwise, the client
@@ -109,14 +141,74 @@ type ClientConfig struct {
         // sync any of these streams.
         SyncStdout io.Writer
         SyncStderr io.Writer
+
+        // AllowedProtocols is a list of allowed protocols. If this isn't set,
+        // then only netrpc is allowed. This is so that older go-plugin systems
+        // can show friendly errors if they see a plugin with an unknown
+        // protocol.
+        //
+        // By setting this, you can cause an error immediately on plugin start
+        // if an unsupported protocol is used with a good error message.
+        //
+        // If this isn't set at all (nil value), then only net/rpc is accepted.
+        // This is done for legacy reasons. You must explicitly opt-in to
+        // new protocols.
+        AllowedProtocols []Protocol
+
+        // Logger is the logger that the client will used. If none is provided,
+        // it will default to hclog's default logger.
+        Logger hclog.Logger
 }
 
 // ReattachConfig is used to configure a client to reattach to an
 // already-running plugin process. You can retrieve this information by
 // calling ReattachConfig on Client.
 type ReattachConfig struct {
-        Addr net.Addr
-        Pid  int
+        Protocol Protocol
+        Addr     net.Addr
+        Pid      int
+}
+
+// SecureConfig is used to configure a client to verify the integrity of an
+// executable before running. It does this by verifying the checksum is
+// expected. Hash is used to specify the hashing method to use when checksumming
+// the file.  The configuration is verified by the client by calling the
+// SecureConfig.Check() function.
+//
+// The host process should ensure the checksum was provided by a trusted and
+// authoritative source. The binary should be installed in such a way that it
+// can not be modified by an unauthorized user between the time of this check
+// and the time of execution.
+type SecureConfig struct {
+        Checksum []byte
+        Hash     hash.Hash
+}
+
+// Check takes the filepath to an executable and returns true if the checksum of
+// the file matches the checksum provided in the SecureConfig.
+func (s *SecureConfig) Check(filePath string) (bool, error) {
+        if len(s.Checksum) == 0 {
+                return false, ErrSecureConfigNoChecksum
+        }
+
+        if s.Hash == nil {
+                return false, ErrSecureConfigNoHash
+        }
+
+        file, err := os.Open(filePath)
+        if err != nil {
+                return false, err
+        }
+        defer file.Close()
+
+        _, err = io.Copy(s.Hash, file)
+        if err != nil {
+                return false, err
+        }
+
+        sum := s.Hash.Sum(nil)
+
+        return subtle.ConstantTimeCompare(sum, s.Checksum) == 1, nil
 }
 
 // This makes sure all the managed subprocesses are killed and properly
@@ -174,7 +266,22 @@ func NewClient(config *ClientConfig) (c *Client) {
                 config.SyncStderr = ioutil.Discard
         }
 
-        c = &Client{config: config}
+        if config.AllowedProtocols == nil {
+                config.AllowedProtocols = []Protocol{ProtocolNetRPC}
+        }
+
+        if config.Logger == nil {
+                config.Logger = hclog.New(&hclog.LoggerOptions{
+                        Output: hclog.DefaultOutput,
+                        Level:  hclog.Trace,
+                        Name:   "plugin",
+                })
+        }
+
+        c = &Client{
+                config: config,
+                logger: config.Logger,
+        }
         if config.Managed {
                 managedClientsLock.Lock()
                 managedClients = append(managedClients, c)
@@ -184,11 +291,11 @@ func NewClient(config *ClientConfig) (c *Client) {
         return
 }
 
-// Client returns an RPC client for the plugin.
+// Client returns the protocol client for this connection.
 //
-// Subsequent calls to this will return the same RPC client.
-func (c *Client) Client() (*RPCClient, error) {
-        addr, err := c.Start()
+// Subsequent calls to this will return the same client.
+func (c *Client) Client() (ClientProtocol, error) {
+        _, err := c.Start()
         if err != nil {
                 return nil, err
         }
@@ -200,29 +307,18 @@ func (c *Client) Client() (*RPCClient, error) {
                 return c.client, nil
         }
 
-        // Connect to the client
-        conn, err := net.Dial(addr.Network(), addr.String())
-        if err != nil {
-                return nil, err
-        }
-        if tcpConn, ok := conn.(*net.TCPConn); ok {
-                // Make sure to set keep alive so that the connection doesn't die
-                tcpConn.SetKeepAlive(true)
-        }
+        switch c.protocol {
+        case ProtocolNetRPC:
+                c.client, err = newRPCClient(c)
 
-        // Create the actual RPC client
-        c.client, err = NewRPCClient(conn, c.config.Plugins)
-        if err != nil {
-                conn.Close()
-                return nil, err
+        case ProtocolGRPC:
+                c.client, err = newGRPCClient(c.doneCtx, c)
+
+        default:
+                return nil, fmt.Errorf("unknown server protocol: %s", c.protocol)
         }
 
-        // Begin the stream syncing so that stdin, out, err work properly
-        err = c.client.SyncStreams(
-                c.config.SyncStdout,
-                c.config.SyncStderr)
         if err != nil {
-                c.client.Close()
                 c.client = nil
                 return nil, err
         }
@@ -274,8 +370,7 @@ func (c *Client) Kill() {
                         if err != nil {
                                 // If there was an error just log it. We're going to force
                                 // kill in a moment anyways.
-                                log.Printf(
-                                        "[WARN] plugin: error closing client during Kill: %s", err)
+                                c.logger.Warn("error closing client during Kill", "err", err)
                         }
                 }
         }
@@ -318,13 +413,21 @@ func (c *Client) Start() (addr net.Addr, err error) {
         {
                 cmdSet := c.config.Cmd != nil
                 attachSet := c.config.Reattach != nil
+                secureSet := c.config.SecureConfig != nil
                 if cmdSet == attachSet {
                         return nil, fmt.Errorf("Only one of Cmd or Reattach must be set")
                 }
+
+                if secureSet && attachSet {
+                        return nil, ErrSecureConfigAndReattach
+                }
         }
 
         // Create the logging channel for when we kill
         c.doneLogging = make(chan struct{})
+        // Create a context for when we kill
+        var ctxCancel context.CancelFunc
+        c.doneCtx, ctxCancel = context.WithCancel(context.Background())
 
         if c.config.Reattach != nil {
                 // Verify the process still exists. If not, then it is an error
@@ -350,7 +453,7 @@ func (c *Client) Start() (addr net.Addr, err error) {
                         pidWait(pid)
 
                         // Log so we can see it
-                        log.Printf("[DEBUG] plugin: reattached plugin process exited\n")
+                        c.logger.Debug("reattached plugin process exited")
 
                         // Mark it
                         c.l.Lock()
@@ -359,11 +462,19 @@ func (c *Client) Start() (addr net.Addr, err error) {
 
                         // Close the logging channel since that doesn't work on reattach
                         close(c.doneLogging)
+
+                        // Cancel the context
+                        ctxCancel()
                 }(p.Pid)
 
                 // Set the address and process
                 c.address = c.config.Reattach.Addr
                 c.process = p
+                c.protocol = c.config.Reattach.Protocol
+                if c.protocol == "" {
+                        // Default the protocol to net/rpc for backwards compatibility
+                        c.protocol = ProtocolNetRPC
+                }
 
                 return c.address, nil
         }
@@ -384,7 +495,15 @@ func (c *Client) Start() (addr net.Addr, err error) {
         cmd.Stderr = stderr_w
         cmd.Stdout = stdout_w
 
-        log.Printf("[DEBUG] plugin: starting plugin: %s %#v", cmd.Path, cmd.Args)
+        if c.config.SecureConfig != nil {
+                if ok, err := c.config.SecureConfig.Check(cmd.Path); err != nil {
+                        return nil, fmt.Errorf("error verifying checksum: %s", err)
+                } else if !ok {
+                        return nil, ErrChecksumsDoNotMatch
+                }
+        }
+
+        c.logger.Debug("starting plugin", "path", cmd.Path, "args", cmd.Args)
         err = cmd.Start()
         if err != nil {
                 return
@@ -418,12 +537,15 @@ func (c *Client) Start() (addr net.Addr, err error) {
                 cmd.Wait()
 
                 // Log and make sure to flush the logs write away
-                log.Printf("[DEBUG] plugin: %s: plugin process exited\n", cmd.Path)
+                c.logger.Debug("plugin process exited", "path", cmd.Path)
                 os.Stderr.Sync()
 
                 // Mark that we exited
                 close(exitCh)
 
+                // Cancel the context, marking that we exited
+                ctxCancel()
+
                 // Set that we exited, which takes a lock
                 c.l.Lock()
                 defer c.l.Unlock()
@@ -465,7 +587,7 @@ func (c *Client) Start() (addr net.Addr, err error) {
         timeout := time.After(c.config.StartTimeout)
 
         // Start looking for the address
-        log.Printf("[DEBUG] plugin: waiting for RPC address for: %s", cmd.Path)
+        c.logger.Debug("waiting for RPC address", "path", cmd.Path)
         select {
         case <-timeout:
                 err = errors.New("timeout while waiting for plugin to start")
@@ -475,7 +597,7 @@ func (c *Client) Start() (addr net.Addr, err error) {
                 // Trim the line and split by "|" in order to get the parts of
                 // the output.
                 line := strings.TrimSpace(string(lineBytes))
-                parts := strings.SplitN(line, "|", 4)
+                parts := strings.SplitN(line, "|", 6)
                 if len(parts) < 4 {
                         err = fmt.Errorf(
                                 "Unrecognized remote plugin message: %s\n\n"+
@@ -495,7 +617,7 @@ func (c *Client) Start() (addr net.Addr, err error) {
 
                         if int(coreProtocol) != CoreProtocolVersion {
                                 err = fmt.Errorf("Incompatible core API version with plugin. "+
-                                        "Plugin version: %s, Ours: %d\n\n"+
+                                        "Plugin version: %s, Core version: %d\n\n"+
                                         "To fix this, the plugin usually only needs to be recompiled.\n"+
                                         "Please report this to the plugin author.", parts[0], CoreProtocolVersion)
                                 return
@@ -513,7 +635,7 @@ func (c *Client) Start() (addr net.Addr, err error) {
                 // Test the API version
                 if uint(protocol) != c.config.ProtocolVersion {
                         err = fmt.Errorf("Incompatible API version with plugin. "+
-                                "Plugin version: %s, Ours: %d", parts[1], c.config.ProtocolVersion)
+                                "Plugin version: %s, Core version: %d", parts[1], c.config.ProtocolVersion)
                         return
                 }
 
@@ -525,6 +647,27 @@ func (c *Client) Start() (addr net.Addr, err error) {
                 default:
                         err = fmt.Errorf("Unknown address type: %s", parts[3])
                 }
+
+                // If we have a server type, then record that. We default to net/rpc
+                // for backwards compatibility.
+                c.protocol = ProtocolNetRPC
+                if len(parts) >= 5 {
+                        c.protocol = Protocol(parts[4])
+                }
+
+                found := false
+                for _, p := range c.config.AllowedProtocols {
+                        if p == c.protocol {
+                                found = true
+                                break
+                        }
+                }
+                if !found {
+                        err = fmt.Errorf("Unsupported plugin protocol %q. Supported: %v",
+                                c.protocol, c.config.AllowedProtocols)
+                        return
+                }
+
         }
 
         c.address = addr
@@ -555,9 +698,57 @@ func (c *Client) ReattachConfig() *ReattachConfig {
         }
 
         return &ReattachConfig{
-                Addr: c.address,
-                Pid:  c.config.Cmd.Process.Pid,
+                Protocol: c.protocol,
+                Addr:     c.address,
+                Pid:      c.config.Cmd.Process.Pid,
+        }
+}
+
+// Protocol returns the protocol of server on the remote end. This will
+// start the plugin process if it isn't already started. Errors from
+// starting the plugin are surpressed and ProtocolInvalid is returned. It
+// is recommended you call Start explicitly before calling Protocol to ensure
+// no errors occur.
+func (c *Client) Protocol() Protocol {
+        _, err := c.Start()
+        if err != nil {
+                return ProtocolInvalid
+        }
+
+        return c.protocol
+}
+
+func netAddrDialer(addr net.Addr) func(string, time.Duration) (net.Conn, error) {
+        return func(_ string, _ time.Duration) (net.Conn, error) {
+                // Connect to the client
+                conn, err := net.Dial(addr.Network(), addr.String())
+                if err != nil {
+                        return nil, err
+                }
+                if tcpConn, ok := conn.(*net.TCPConn); ok {
+                        // Make sure to set keep alive so that the connection doesn't die
+                        tcpConn.SetKeepAlive(true)
+                }
+
+                return conn, nil
+        }
+}
+
+// dialer is compatible with grpc.WithDialer and creates the connection
+// to the plugin.
+func (c *Client) dialer(_ string, timeout time.Duration) (net.Conn, error) {
+        conn, err := netAddrDialer(c.address)("", timeout)
+        if err != nil {
+                return nil, err
         }
+
+        // If we have a TLS config we wrap our connection. We only do this
+        // for net/rpc since gRPC uses its own mechanism for TLS.
+        if c.protocol == ProtocolNetRPC && c.config.TLSConfig != nil {
+                conn = tls.Client(conn, c.config.TLSConfig)
+        }
+
+        return conn, nil
 }
 
 func (c *Client) logStderr(r io.Reader) {
@@ -566,9 +757,31 @@ func (c *Client) logStderr(r io.Reader) {
                 line, err := bufR.ReadString('\n')
                 if line != "" {
                         c.config.Stderr.Write([]byte(line))
-
                         line = strings.TrimRightFunc(line, unicode.IsSpace)
-                        log.Printf("[DEBUG] plugin: %s: %s", filepath.Base(c.config.Cmd.Path), line)
+
+                        l := c.logger.Named(filepath.Base(c.config.Cmd.Path))
+
+                        entry, err := parseJSON(line)
+                        // If output is not JSON format, print directly to Debug
+                        if err != nil {
+                                l.Debug(line)
+                        } else {
+                                out := flattenKVPairs(entry.KVPairs)
+
+                                l = l.With("timestamp", entry.Timestamp.Format(hclog.TimeFormat))
+                                switch hclog.LevelFromString(entry.Level) {
+                                case hclog.Trace:
+                                        l.Trace(entry.Message, out...)
+                                case hclog.Debug:
+                                        l.Debug(entry.Message, out...)
+                                case hclog.Info:
+                                        l.Info(entry.Message, out...)
+                                case hclog.Warn:
+                                        l.Warn(entry.Message, out...)
+                                case hclog.Error:
+                                        l.Error(entry.Message, out...)
+                                }
+                        }
                 }
 
                 if err == io.EOF {
diff --git a/vendor/github.com/hashicorp/go-plugin/grpc_broker.go b/vendor/github.com/hashicorp/go-plugin/grpc_broker.go
new file mode 100644
index 0000000..49fd21c
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-plugin/grpc_broker.go
@@ -0,0 +1,455 @@
+package plugin
+
+import (
+        "context"
+        "crypto/tls"
+        "errors"
+        "fmt"
+        "log"
+        "net"
+        "sync"
+        "sync/atomic"
+        "time"
+
+        "github.com/oklog/run"
+        "google.golang.org/grpc"
+        "google.golang.org/grpc/credentials"
+)
+
+// streamer interface is used in the broker to send/receive connection
+// information.
+type streamer interface {
+        Send(*ConnInfo) error
+        Recv() (*ConnInfo, error)
+        Close()
+}
+
+// sendErr is used to pass errors back during a send.
+type sendErr struct {
+        i  *ConnInfo
+        ch chan error
+}
+
+// gRPCBrokerServer is used by the plugin to start a stream and to send
+// connection information to/from the plugin. Implements GRPCBrokerServer and
+// streamer interfaces.
+type gRPCBrokerServer struct {
+        // send is used to send connection info to the gRPC stream.
+        send chan *sendErr
+
+        // recv is used to receive connection info from the gRPC stream.
+        recv chan *ConnInfo
+
+        // quit closes down the stream.
+        quit chan struct{}
+
+        // o is used to ensure we close the quit channel only once.
+        o sync.Once
+}
+
+func newGRPCBrokerServer() *gRPCBrokerServer {
+        return &gRPCBrokerServer{
+                send: make(chan *sendErr),
+                recv: make(chan *ConnInfo),
+                quit: make(chan struct{}),
+        }
+}
+
+// StartStream implements the GRPCBrokerServer interface and will block until
+// the quit channel is closed or the context reports Done. The stream will pass
+// connection information to/from the client.
+func (s *gRPCBrokerServer) StartStream(stream GRPCBroker_StartStreamServer) error {
+        doneCh := stream.Context().Done()
+        defer s.Close()
+
+        // Proccess send stream
+        go func() {
+                for {
+                        select {
+                        case <-doneCh:
+                                return
+                        case <-s.quit:
+                                return
+                        case se := <-s.send:
+                                err := stream.Send(se.i)
+                                se.ch <- err
+                        }
+                }
+        }()
+
+        // Process receive stream
+        for {
+                i, err := stream.Recv()
+                if err != nil {
+                        return err
+                }
+                select {
+                case <-doneCh:
+                        return nil
+                case <-s.quit:
+                        return nil
+                case s.recv <- i:
+                }
+        }
+
+        return nil
+}
+
+// Send is used by the GRPCBroker to pass connection information into the stream
+// to the client.
+func (s *gRPCBrokerServer) Send(i *ConnInfo) error {
+        ch := make(chan error)
+        defer close(ch)
+
+        select {
+        case <-s.quit:
+                return errors.New("broker closed")
+        case s.send <- &sendErr{
+                i:  i,
+                ch: ch,
+        }:
+        }
+
+        return <-ch
+}
+
+// Recv is used by the GRPCBroker to pass connection information that has been
+// sent from the client from the stream to the broker.
+func (s *gRPCBrokerServer) Recv() (*ConnInfo, error) {
+        select {
+        case <-s.quit:
+                return nil, errors.New("broker closed")
+        case i := <-s.recv:
+                return i, nil
+        }
+}
+
+// Close closes the quit channel, shutting down the stream.
+func (s *gRPCBrokerServer) Close() {
+        s.o.Do(func() {
+                close(s.quit)
+        })
+}
+
+// gRPCBrokerClientImpl is used by the client to start a stream and to send
+// connection information to/from the client. Implements GRPCBrokerClient and
+// streamer interfaces.
+type gRPCBrokerClientImpl struct {
+        // client is the underlying GRPC client used to make calls to the server.
+        client GRPCBrokerClient
+
+        // send is used to send connection info to the gRPC stream.
+        send chan *sendErr
+
+        // recv is used to receive connection info from the gRPC stream.
+        recv chan *ConnInfo
+
+        // quit closes down the stream.
+        quit chan struct{}
+
+        // o is used to ensure we close the quit channel only once.
+        o sync.Once
+}
+
+func newGRPCBrokerClient(conn *grpc.ClientConn) *gRPCBrokerClientImpl {
+        return &gRPCBrokerClientImpl{
+                client: NewGRPCBrokerClient(conn),
+                send:   make(chan *sendErr),
+                recv:   make(chan *ConnInfo),
+                quit:   make(chan struct{}),
+        }
+}
+
+// StartStream implements the GRPCBrokerClient interface and will block until
+// the quit channel is closed or the context reports Done. The stream will pass
+// connection information to/from the plugin.
+func (s *gRPCBrokerClientImpl) StartStream() error {
+        ctx, cancelFunc := context.WithCancel(context.Background())
+        defer cancelFunc()
+        defer s.Close()
+
+        stream, err := s.client.StartStream(ctx)
+        if err != nil {
+                return err
+        }
+        doneCh := stream.Context().Done()
+
+        go func() {
+                for {
+                        select {
+                        case <-doneCh:
+                                return
+                        case <-s.quit:
+                                return
+                        case se := <-s.send:
+                                err := stream.Send(se.i)
+                                se.ch <- err
+                        }
+                }
+        }()
+
+        for {
+                i, err := stream.Recv()
+                if err != nil {
+                        return err
+                }
+                select {
+                case <-doneCh:
+                        return nil
+                case <-s.quit:
+                        return nil
+                case s.recv <- i:
+                }
+        }
+
+        return nil
+}
+
+// Send is used by the GRPCBroker to pass connection information into the stream
+// to the plugin.
+func (s *gRPCBrokerClientImpl) Send(i *ConnInfo) error {
+        ch := make(chan error)
+        defer close(ch)
+
+        select {
+        case <-s.quit:
+                return errors.New("broker closed")
+        case s.send <- &sendErr{
+                i:  i,
+                ch: ch,
+        }:
+        }
+
+        return <-ch
+}
+
+// Recv is used by the GRPCBroker to pass connection information that has been
+// sent from the plugin to the broker.
+func (s *gRPCBrokerClientImpl) Recv() (*ConnInfo, error) {
+        select {
+        case <-s.quit:
+                return nil, errors.New("broker closed")
+        case i := <-s.recv:
+                return i, nil
+        }
+}
+
+// Close closes the quit channel, shutting down the stream.
+func (s *gRPCBrokerClientImpl) Close() {
+        s.o.Do(func() {
+                close(s.quit)
+        })
+}
+
+// GRPCBroker is responsible for brokering connections by unique ID.
+//
+// It is used by plugins to create multiple gRPC connections and data
+// streams between the plugin process and the host process.
+//
+// This allows a plugin to request a channel with a specific ID to connect to
+// or accept a connection from, and the broker handles the details of
+// holding these channels open while they're being negotiated.
+//
+// The Plugin interface has access to these for both Server and Client.
+// The broker can be used by either (optionally) to reserve and connect to
+// new streams. This is useful for complex args and return values,
+// or anything else you might need a data stream for.
+type GRPCBroker struct {
+        nextId   uint32
+        streamer streamer
+        streams  map[uint32]*gRPCBrokerPending
+        tls      *tls.Config
+        doneCh   chan struct{}
+        o        sync.Once
+
+        sync.Mutex
+}
+
+type gRPCBrokerPending struct {
+        ch     chan *ConnInfo
+        doneCh chan struct{}
+}
+
+func newGRPCBroker(s streamer, tls *tls.Config) *GRPCBroker {
+        return &GRPCBroker{
+                streamer: s,
+                streams:  make(map[uint32]*gRPCBrokerPending),
+                tls:      tls,
+                doneCh:   make(chan struct{}),
+        }
+}
+
+// Accept accepts a connection by ID.
+//
+// This should not be called multiple times with the same ID at one time.
+func (b *GRPCBroker) Accept(id uint32) (net.Listener, error) {
+        listener, err := serverListener()
+        if err != nil {
+                return nil, err
+        }
+
+        err = b.streamer.Send(&ConnInfo{
+                ServiceId: id,
+                Network:   listener.Addr().Network(),
+                Address:   listener.Addr().String(),
+        })
+        if err != nil {
+                return nil, err
+        }
+
+        return listener, nil
+}
+
+// AcceptAndServe is used to accept a specific stream ID and immediately
+// serve a gRPC server on that stream ID. This is used to easily serve
+// complex arguments. Each AcceptAndServe call opens a new listener socket and
+// sends the connection info down the stream to the dialer. Since a new
+// connection is opened every call, these calls should be used sparingly.
+// Multiple gRPC server implementations can be registered to a single
+// AcceptAndServe call.
+func (b *GRPCBroker) AcceptAndServe(id uint32, s func([]grpc.ServerOption) *grpc.Server) {
+        listener, err := b.Accept(id)
+        if err != nil {
+                log.Printf("[ERR] plugin: plugin acceptAndServe error: %s", err)
+                return
+        }
+        defer listener.Close()
+
+        var opts []grpc.ServerOption
+        if b.tls != nil {
+                opts = []grpc.ServerOption{grpc.Creds(credentials.NewTLS(b.tls))}
+        }
+
+        server := s(opts)
+
+        // Here we use a run group to close this goroutine if the server is shutdown
+        // or the broker is shutdown.
+        var g run.Group
+        {
+                // Serve on the listener, if shutting down call GracefulStop.
+                g.Add(func() error {
+                        return server.Serve(listener)
+                }, func(err error) {
+                        server.GracefulStop()
+                })
+        }
+        {
+                // block on the closeCh or the doneCh. If we are shutting down close the
+                // closeCh.
+                closeCh := make(chan struct{})
+                g.Add(func() error {
+                        select {
+                        case <-b.doneCh:
+                        case <-closeCh:
+                        }
+                        return nil
+                }, func(err error) {
+                        close(closeCh)
+                })
+        }
+
+        // Block until we are done
+        g.Run()
+}
+
+// Close closes the stream and all servers.
+func (b *GRPCBroker) Close() error {
+        b.streamer.Close()
+        b.o.Do(func() {
+                close(b.doneCh)
+        })
+        return nil
+}
+
+// Dial opens a connection by ID.
+func (b *GRPCBroker) Dial(id uint32) (conn *grpc.ClientConn, err error) {
+        var c *ConnInfo
+
+        // Open the stream
+        p := b.getStream(id)
+        select {
+        case c = <-p.ch:
+                close(p.doneCh)
+        case <-time.After(5 * time.Second):
+                return nil, fmt.Errorf("timeout waiting for connection info")
+        }
+
+        var addr net.Addr
+        switch c.Network {
+        case "tcp":
+                addr, err = net.ResolveTCPAddr("tcp", c.Address)
+        case "unix":
+                addr, err = net.ResolveUnixAddr("unix", c.Address)
+        default:
+                err = fmt.Errorf("Unknown address type: %s", c.Address)
+        }
+        if err != nil {
+                return nil, err
+        }
+
+        return dialGRPCConn(b.tls, netAddrDialer(addr))
+}
+
+// NextId returns a unique ID to use next.
+//
+// It is possible for very long-running plugin hosts to wrap this value,
+// though it would require a very large amount of calls. In practice
+// we've never seen it happen.
+func (m *GRPCBroker) NextId() uint32 {
+        return atomic.AddUint32(&m.nextId, 1)
+}
+
+// Run starts the brokering and should be executed in a goroutine, since it
+// blocks forever, or until the session closes.
+//
+// Uses of GRPCBroker never need to call this. It is called internally by
+// the plugin host/client.
+func (m *GRPCBroker) Run() {
+        for {
+                stream, err := m.streamer.Recv()
+                if err != nil {
+                        // Once we receive an error, just exit
+                        break
+                }
+
+                // Initialize the waiter
+                p := m.getStream(stream.ServiceId)
+                select {
+                case p.ch <- stream:
+                default:
+                }
+
+                go m.timeoutWait(stream.ServiceId, p)
+        }
+}
+
+func (m *GRPCBroker) getStream(id uint32) *gRPCBrokerPending {
+        m.Lock()
+        defer m.Unlock()
+
+        p, ok := m.streams[id]
+        if ok {
+                return p
+        }
+
+        m.streams[id] = &gRPCBrokerPending{
+                ch:     make(chan *ConnInfo, 1),
+                doneCh: make(chan struct{}),
+        }
+        return m.streams[id]
+}
+
+func (m *GRPCBroker) timeoutWait(id uint32, p *gRPCBrokerPending) {
+        // Wait for the stream to either be picked up and connected, or
+        // for a timeout.
+        select {
+        case <-p.doneCh:
+        case <-time.After(5 * time.Second):
+        }
+
+        m.Lock()
+        defer m.Unlock()
+
+        // Delete the stream so no one else can grab it
+        delete(m.streams, id)
+}
diff --git a/vendor/github.com/hashicorp/go-plugin/grpc_broker.pb.go b/vendor/github.com/hashicorp/go-plugin/grpc_broker.pb.go
new file mode 100644
index 0000000..d490daf
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-plugin/grpc_broker.pb.go
@@ -0,0 +1,190 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// source: grpc_broker.proto
+
+/*
+Package plugin is a generated protocol buffer package.
+
+It is generated from these files:
+        grpc_broker.proto
+
+It has these top-level messages:
+        ConnInfo
+*/
+package plugin
+
+import proto "github.com/golang/protobuf/proto"
+import fmt "fmt"
+import math "math"
+
+import (
+        context "golang.org/x/net/context"
+        grpc "google.golang.org/grpc"
+)
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ = proto.Marshal
+var _ = fmt.Errorf
+var _ = math.Inf
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the proto package it is being compiled against.
+// A compilation error at this line likely means your copy of the
+// proto package needs to be updated.
+const _ = proto.ProtoPackageIsVersion2 // please upgrade the proto package
+
+type ConnInfo struct {
+        ServiceId uint32 `protobuf:"varint,1,opt,name=service_id,json=serviceId" json:"service_id,omitempty"`
+        Network   string `protobuf:"bytes,2,opt,name=network" json:"network,omitempty"`
+        Address   string `protobuf:"bytes,3,opt,name=address" json:"address,omitempty"`
+}
+
+func (m *ConnInfo) Reset()                    { *m = ConnInfo{} }
+func (m *ConnInfo) String() string            { return proto.CompactTextString(m) }
+func (*ConnInfo) ProtoMessage()               {}
+func (*ConnInfo) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{0} }
+
+func (m *ConnInfo) GetServiceId() uint32 {
+        if m != nil {
+                return m.ServiceId
+        }
+        return 0
+}
+
+func (m *ConnInfo) GetNetwork() string {
+        if m != nil {
+                return m.Network
+        }
+        return ""
+}
+
+func (m *ConnInfo) GetAddress() string {
+        if m != nil {
+                return m.Address
+        }
+        return ""
+}
+
+func init() {
+        proto.RegisterType((*ConnInfo)(nil), "plugin.ConnInfo")
+}
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ context.Context
+var _ grpc.ClientConn
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+const _ = grpc.SupportPackageIsVersion4
+
+// Client API for GRPCBroker service
+
+type GRPCBrokerClient interface {
+        StartStream(ctx context.Context, opts ...grpc.CallOption) (GRPCBroker_StartStreamClient, error)
+}
+
+type gRPCBrokerClient struct {
+        cc *grpc.ClientConn
+}
+
+func NewGRPCBrokerClient(cc *grpc.ClientConn) GRPCBrokerClient {
+        return &gRPCBrokerClient{cc}
+}
+
+func (c *gRPCBrokerClient) StartStream(ctx context.Context, opts ...grpc.CallOption) (GRPCBroker_StartStreamClient, error) {
+        stream, err := grpc.NewClientStream(ctx, &_GRPCBroker_serviceDesc.Streams[0], c.cc, "/plugin.GRPCBroker/StartStream", opts...)
+        if err != nil {
+                return nil, err
+        }
+        x := &gRPCBrokerStartStreamClient{stream}
+        return x, nil
+}
+
+type GRPCBroker_StartStreamClient interface {
+        Send(*ConnInfo) error
+        Recv() (*ConnInfo, error)
+        grpc.ClientStream
+}
+
+type gRPCBrokerStartStreamClient struct {
+        grpc.ClientStream
+}
+
+func (x *gRPCBrokerStartStreamClient) Send(m *ConnInfo) error {
+        return x.ClientStream.SendMsg(m)
+}
+
+func (x *gRPCBrokerStartStreamClient) Recv() (*ConnInfo, error) {
+        m := new(ConnInfo)
+        if err := x.ClientStream.RecvMsg(m); err != nil {
+                return nil, err
+        }
+        return m, nil
+}
+
+// Server API for GRPCBroker service
+
+type GRPCBrokerServer interface {
+        StartStream(GRPCBroker_StartStreamServer) error
+}
+
+func RegisterGRPCBrokerServer(s *grpc.Server, srv GRPCBrokerServer) {
+        s.RegisterService(&_GRPCBroker_serviceDesc, srv)
+}
+
+func _GRPCBroker_StartStream_Handler(srv interface{}, stream grpc.ServerStream) error {
+        return srv.(GRPCBrokerServer).StartStream(&gRPCBrokerStartStreamServer{stream})
+}
+
+type GRPCBroker_StartStreamServer interface {
+        Send(*ConnInfo) error
+        Recv() (*ConnInfo, error)
+        grpc.ServerStream
+}
+
+type gRPCBrokerStartStreamServer struct {
+        grpc.ServerStream
+}
+
+func (x *gRPCBrokerStartStreamServer) Send(m *ConnInfo) error {
+        return x.ServerStream.SendMsg(m)
+}
+
+func (x *gRPCBrokerStartStreamServer) Recv() (*ConnInfo, error) {
+        m := new(ConnInfo)
+        if err := x.ServerStream.RecvMsg(m); err != nil {
+                return nil, err
+        }
+        return m, nil
+}
+
+var _GRPCBroker_serviceDesc = grpc.ServiceDesc{
+        ServiceName: "plugin.GRPCBroker",
+        HandlerType: (*GRPCBrokerServer)(nil),
+        Methods:     []grpc.MethodDesc{},
+        Streams: []grpc.StreamDesc{
+                {
+                        StreamName:    "StartStream",
+                        Handler:       _GRPCBroker_StartStream_Handler,
+                        ServerStreams: true,
+                        ClientStreams: true,
+                },
+        },
+        Metadata: "grpc_broker.proto",
+}
+
+func init() { proto.RegisterFile("grpc_broker.proto", fileDescriptor0) }
+
+var fileDescriptor0 = []byte{
+        // 170 bytes of a gzipped FileDescriptorProto
+        0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0x12, 0x4c, 0x2f, 0x2a, 0x48,
+        0x8e, 0x4f, 0x2a, 0xca, 0xcf, 0x4e, 0x2d, 0xd2, 0x2b, 0x28, 0xca, 0x2f, 0xc9, 0x17, 0x62, 0x2b,
+        0xc8, 0x29, 0x4d, 0xcf, 0xcc, 0x53, 0x8a, 0xe5, 0xe2, 0x70, 0xce, 0xcf, 0xcb, 0xf3, 0xcc, 0x4b,
+        0xcb, 0x17, 0x92, 0xe5, 0xe2, 0x2a, 0x4e, 0x2d, 0x2a, 0xcb, 0x4c, 0x4e, 0x8d, 0xcf, 0x4c, 0x91,
+        0x60, 0x54, 0x60, 0xd4, 0xe0, 0x0d, 0xe2, 0x84, 0x8a, 0x78, 0xa6, 0x08, 0x49, 0x70, 0xb1, 0xe7,
+        0xa5, 0x96, 0x94, 0xe7, 0x17, 0x65, 0x4b, 0x30, 0x29, 0x30, 0x6a, 0x70, 0x06, 0xc1, 0xb8, 0x20,
+        0x99, 0xc4, 0x94, 0x94, 0xa2, 0xd4, 0xe2, 0x62, 0x09, 0x66, 0x88, 0x0c, 0x94, 0x6b, 0xe4, 0xcc,
+        0xc5, 0xe5, 0x1e, 0x14, 0xe0, 0xec, 0x04, 0xb6, 0x5a, 0xc8, 0x94, 0x8b, 0x3b, 0xb8, 0x24, 0xb1,
+        0xa8, 0x24, 0xb8, 0xa4, 0x28, 0x35, 0x31, 0x57, 0x48, 0x40, 0x0f, 0xe2, 0x08, 0x3d, 0x98, 0x0b,
+        0xa4, 0x30, 0x44, 0x34, 0x18, 0x0d, 0x18, 0x93, 0xd8, 0xc0, 0x4e, 0x36, 0x06, 0x04, 0x00, 0x00,
+        0xff, 0xff, 0x7b, 0x5d, 0xfb, 0xe1, 0xc7, 0x00, 0x00, 0x00,
+}
diff --git a/vendor/github.com/hashicorp/go-plugin/grpc_broker.proto b/vendor/github.com/hashicorp/go-plugin/grpc_broker.proto
new file mode 100644
index 0000000..f578348
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-plugin/grpc_broker.proto
@@ -0,0 +1,14 @@
+syntax = "proto3";
+package plugin;
+
+message ConnInfo {
+    uint32 service_id = 1;
+    string network = 2;
+    string address = 3;
+}
+
+service GRPCBroker {
+    rpc StartStream(stream ConnInfo) returns (stream ConnInfo);
+}
+
+
diff --git a/vendor/github.com/hashicorp/go-plugin/grpc_client.go b/vendor/github.com/hashicorp/go-plugin/grpc_client.go
new file mode 100644
index 0000000..44294d0
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-plugin/grpc_client.go
@@ -0,0 +1,107 @@
+package plugin
+
+import (
+        "crypto/tls"
+        "fmt"
+        "net"
+        "time"
+
+        "golang.org/x/net/context"
+        "google.golang.org/grpc"
+        "google.golang.org/grpc/credentials"
+        "google.golang.org/grpc/health/grpc_health_v1"
+)
+
+func dialGRPCConn(tls *tls.Config, dialer func(string, time.Duration) (net.Conn, error)) (*grpc.ClientConn, error) {
+        // Build dialing options.
+        opts := make([]grpc.DialOption, 0, 5)
+
+        // We use a custom dialer so that we can connect over unix domain sockets
+        opts = append(opts, grpc.WithDialer(dialer))
+
+        // go-plugin expects to block the connection
+        opts = append(opts, grpc.WithBlock())
+
+        // Fail right away
+        opts = append(opts, grpc.FailOnNonTempDialError(true))
+
+        // If we have no TLS configuration set, we need to explicitly tell grpc
+        // that we're connecting with an insecure connection.
+        if tls == nil {
+                opts = append(opts, grpc.WithInsecure())
+        } else {
+                opts = append(opts, grpc.WithTransportCredentials(
+                        credentials.NewTLS(tls)))
+        }
+
+        // Connect. Note the first parameter is unused because we use a custom
+        // dialer that has the state to see the address.
+        conn, err := grpc.Dial("unused", opts...)
+        if err != nil {
+                return nil, err
+        }
+
+        return conn, nil
+}
+
+// newGRPCClient creates a new GRPCClient. The Client argument is expected
+// to be successfully started already with a lock held.
+func newGRPCClient(doneCtx context.Context, c *Client) (*GRPCClient, error) {
+        conn, err := dialGRPCConn(c.config.TLSConfig, c.dialer)
+        if err != nil {
+                return nil, err
+        }
+
+        // Start the broker.
+        brokerGRPCClient := newGRPCBrokerClient(conn)
+        broker := newGRPCBroker(brokerGRPCClient, c.config.TLSConfig)
+        go broker.Run()
+        go brokerGRPCClient.StartStream()
+
+        return &GRPCClient{
+                Conn:    conn,
+                Plugins: c.config.Plugins,
+                doneCtx: doneCtx,
+                broker:  broker,
+        }, nil
+}
+
+// GRPCClient connects to a GRPCServer over gRPC to dispense plugin types.
+type GRPCClient struct {
+        Conn    *grpc.ClientConn
+        Plugins map[string]Plugin
+
+        doneCtx context.Context
+        broker  *GRPCBroker
+}
+
+// ClientProtocol impl.
+func (c *GRPCClient) Close() error {
+        c.broker.Close()
+        return c.Conn.Close()
+}
+
+// ClientProtocol impl.
+func (c *GRPCClient) Dispense(name string) (interface{}, error) {
+        raw, ok := c.Plugins[name]
+        if !ok {
+                return nil, fmt.Errorf("unknown plugin type: %s", name)
+        }
+
+        p, ok := raw.(GRPCPlugin)
+        if !ok {
+                return nil, fmt.Errorf("plugin %q doesn't support gRPC", name)
+        }
+
+        return p.GRPCClient(c.doneCtx, c.broker, c.Conn)
+}
+
+// ClientProtocol impl.
+func (c *GRPCClient) Ping() error {
+        client := grpc_health_v1.NewHealthClient(c.Conn)
+        _, err := client.Check(context.Background(), &grpc_health_v1.HealthCheckRequest{
+                Service: GRPCServiceName,
+        })
+
+        return err
+}
diff --git a/vendor/github.com/hashicorp/go-plugin/grpc_server.go b/vendor/github.com/hashicorp/go-plugin/grpc_server.go
new file mode 100644
index 0000000..3a72739
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-plugin/grpc_server.go
@@ -0,0 +1,132 @@
+package plugin
+
+import (
+        "bytes"
+        "crypto/tls"
+        "encoding/json"
+        "fmt"
+        "io"
+        "net"
+
+        "google.golang.org/grpc"
+        "google.golang.org/grpc/credentials"
+        "google.golang.org/grpc/health"
+        "google.golang.org/grpc/health/grpc_health_v1"
+)
+
+// GRPCServiceName is the name of the service that the health check should
+// return as passing.
+const GRPCServiceName = "plugin"
+
+// DefaultGRPCServer can be used with the "GRPCServer" field for Server
+// as a default factory method to create a gRPC server with no extra options.
+func DefaultGRPCServer(opts []grpc.ServerOption) *grpc.Server {
+        return grpc.NewServer(opts...)
+}
+
+// GRPCServer is a ServerType implementation that serves plugins over
+// gRPC. This allows plugins to easily be written for other languages.
+//
+// The GRPCServer outputs a custom configuration as a base64-encoded
+// JSON structure represented by the GRPCServerConfig config structure.
+type GRPCServer struct {
+        // Plugins are the list of plugins to serve.
+        Plugins map[string]Plugin
+
+        // Server is the actual server that will accept connections. This
+        // will be used for plugin registration as well.
+        Server func([]grpc.ServerOption) *grpc.Server
+
+        // TLS should be the TLS configuration if available. If this is nil,
+        // the connection will not have transport security.
+        TLS *tls.Config
+
+        // DoneCh is the channel that is closed when this server has exited.
+        DoneCh chan struct{}
+
+        // Stdout/StderrLis are the readers for stdout/stderr that will be copied
+        // to the stdout/stderr connection that is output.
+        Stdout io.Reader
+        Stderr io.Reader
+
+        config GRPCServerConfig
+        server *grpc.Server
+        broker *GRPCBroker
+}
+
+// ServerProtocol impl.
+func (s *GRPCServer) Init() error {
+        // Create our server
+        var opts []grpc.ServerOption
+        if s.TLS != nil {
+                opts = append(opts, grpc.Creds(credentials.NewTLS(s.TLS)))
+        }
+        s.server = s.Server(opts)
+
+        // Register the health service
+        healthCheck := health.NewServer()
+        healthCheck.SetServingStatus(
+                GRPCServiceName, grpc_health_v1.HealthCheckResponse_SERVING)
+        grpc_health_v1.RegisterHealthServer(s.server, healthCheck)
+
+        // Register the broker service
+        brokerServer := newGRPCBrokerServer()
+        RegisterGRPCBrokerServer(s.server, brokerServer)
+        s.broker = newGRPCBroker(brokerServer, s.TLS)
+        go s.broker.Run()
+
+        // Register all our plugins onto the gRPC server.
+        for k, raw := range s.Plugins {
+                p, ok := raw.(GRPCPlugin)
+                if !ok {
+                        return fmt.Errorf("%q is not a GRPC-compatible plugin", k)
+                }
+
+                if err := p.GRPCServer(s.broker, s.server); err != nil {
+                        return fmt.Errorf("error registring %q: %s", k, err)
+                }
+        }
+
+        return nil
+}
+
+// Stop calls Stop on the underlying grpc.Server
+func (s *GRPCServer) Stop() {
+        s.server.Stop()
+}
+
+// GracefulStop calls GracefulStop on the underlying grpc.Server
+func (s *GRPCServer) GracefulStop() {
+        s.server.GracefulStop()
+}
+
+// Config is the GRPCServerConfig encoded as JSON then base64.
+func (s *GRPCServer) Config() string {
+        // Create a buffer that will contain our final contents
+        var buf bytes.Buffer
+
+        // Wrap the base64 encoding with JSON encoding.
+        if err := json.NewEncoder(&buf).Encode(s.config); err != nil {
+                // We panic since ths shouldn't happen under any scenario. We
+                // carefully control the structure being encoded here and it should
+                // always be successful.
+                panic(err)
+        }
+
+        return buf.String()
+}
+
+func (s *GRPCServer) Serve(lis net.Listener) {
+        // Start serving in a goroutine
+        go s.server.Serve(lis)
+
+        // Wait until graceful completion
+        <-s.DoneCh
+}
+
+// GRPCServerConfig is the extra configuration passed along for consumers
+// to facilitate using GRPC plugins.
+type GRPCServerConfig struct {
+        StdoutAddr string `json:"stdout_addr"`
+        StderrAddr string `json:"stderr_addr"`
+}
diff --git a/vendor/github.com/hashicorp/go-plugin/log_entry.go b/vendor/github.com/hashicorp/go-plugin/log_entry.go
new file mode 100644
index 0000000..2996c14
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-plugin/log_entry.go
@@ -0,0 +1,73 @@
+package plugin
+
+import (
+        "encoding/json"
+        "time"
+)
+
+// logEntry is the JSON payload that gets sent to Stderr from the plugin to the host
+type logEntry struct {
+        Message   string        `json:"@message"`
+        Level     string        `json:"@level"`
+        Timestamp time.Time     `json:"timestamp"`
+        KVPairs   []*logEntryKV `json:"kv_pairs"`
+}
+
+// logEntryKV is a key value pair within the Output payload
+type logEntryKV struct {
+        Key   string      `json:"key"`
+        Value interface{} `json:"value"`
+}
+
+// flattenKVPairs is used to flatten KVPair slice into []interface{}
+// for hclog consumption.
+func flattenKVPairs(kvs []*logEntryKV) []interface{} {
+        var result []interface{}
+        for _, kv := range kvs {
+                result = append(result, kv.Key)
+                result = append(result, kv.Value)
+        }
+
+        return result
+}
+
+// parseJSON handles parsing JSON output
+func parseJSON(input string) (*logEntry, error) {
+        var raw map[string]interface{}
+        entry := &logEntry{}
+
+        err := json.Unmarshal([]byte(input), &raw)
+        if err != nil {
+                return nil, err
+        }
+
+        // Parse hclog-specific objects
+        if v, ok := raw["@message"]; ok {
+                entry.Message = v.(string)
+                delete(raw, "@message")
+        }
+
+        if v, ok := raw["@level"]; ok {
+                entry.Level = v.(string)
+                delete(raw, "@level")
+        }
+
+        if v, ok := raw["@timestamp"]; ok {
+                t, err := time.Parse("2006-01-02T15:04:05.000000Z07:00", v.(string))
+                if err != nil {
+                        return nil, err
+                }
+                entry.Timestamp = t
+                delete(raw, "@timestamp")
+        }
+
+        // Parse dynamic KV args from the hclog payload.
+        for k, v := range raw {
+                entry.KVPairs = append(entry.KVPairs, &logEntryKV{
+                        Key:   k,
+                        Value: v,
+                })
+        }
+
+        return entry, nil
+}
diff --git a/vendor/github.com/hashicorp/go-plugin/plugin.go b/vendor/github.com/hashicorp/go-plugin/plugin.go
index 37c8fd6..79d9674 100644
--- a/vendor/github.com/hashicorp/go-plugin/plugin.go
+++ b/vendor/github.com/hashicorp/go-plugin/plugin.go
@@ -9,7 +9,11 @@
 package plugin
 
 import (
+        "context"
+        "errors"
         "net/rpc"
+
+        "google.golang.org/grpc"
 )
 
 // Plugin is the interface that is implemented to serve/connect to an
@@ -23,3 +27,32 @@ type Plugin interface {
         // serving that communicates to the server end of the plugin.
         Client(*MuxBroker, *rpc.Client) (interface{}, error)
 }
+
+// GRPCPlugin is the interface that is implemented to serve/connect to
+// a plugin over gRPC.
+type GRPCPlugin interface {
+        // GRPCServer should register this plugin for serving with the
+        // given GRPCServer. Unlike Plugin.Server, this is only called once
+        // since gRPC plugins serve singletons.
+        GRPCServer(*GRPCBroker, *grpc.Server) error
+
+        // GRPCClient should return the interface implementation for the plugin
+        // you're serving via gRPC. The provided context will be canceled by
+        // go-plugin in the event of the plugin process exiting.
+        GRPCClient(context.Context, *GRPCBroker, *grpc.ClientConn) (interface{}, error)
+}
+
+// NetRPCUnsupportedPlugin implements Plugin but returns errors for the
+// Server and Client functions. This will effectively disable support for
+// net/rpc based plugins.
+//
+// This struct can be embedded in your struct.
+type NetRPCUnsupportedPlugin struct{}
+
+func (p NetRPCUnsupportedPlugin) Server(*MuxBroker) (interface{}, error) {
+        return nil, errors.New("net/rpc plugin protocol not supported")
+}
+
+func (p NetRPCUnsupportedPlugin) Client(*MuxBroker, *rpc.Client) (interface{}, error) {
+        return nil, errors.New("net/rpc plugin protocol not supported")
+}
diff --git a/vendor/github.com/hashicorp/go-plugin/protocol.go b/vendor/github.com/hashicorp/go-plugin/protocol.go
new file mode 100644
index 0000000..0cfc19e
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-plugin/protocol.go
@@ -0,0 +1,45 @@
+package plugin
+
+import (
+        "io"
+        "net"
+)
+
+// Protocol is an enum representing the types of protocols.
+type Protocol string
+
+const (
+        ProtocolInvalid Protocol = ""
+        ProtocolNetRPC  Protocol = "netrpc"
+        ProtocolGRPC    Protocol = "grpc"
+)
+
+// ServerProtocol is an interface that must be implemented for new plugin
+// protocols to be servers.
+type ServerProtocol interface {
+        // Init is called once to configure and initialize the protocol, but
+        // not start listening. This is the point at which all validation should
+        // be done and errors returned.
+        Init() error
+
+        // Config is extra configuration to be outputted to stdout. This will
+        // be automatically base64 encoded to ensure it can be parsed properly.
+        // This can be an empty string if additional configuration is not needed.
+        Config() string
+
+        // Serve is called to serve connections on the given listener. This should
+        // continue until the listener is closed.
+        Serve(net.Listener)
+}
+
+// ClientProtocol is an interface that must be implemented for new plugin
+// protocols to be clients.
+type ClientProtocol interface {
+        io.Closer
+
+        // Dispense dispenses a new instance of the plugin with the given name.
+        Dispense(string) (interface{}, error)
+
+        // Ping checks that the client connection is still healthy.
+        Ping() error
+}
diff --git a/vendor/github.com/hashicorp/go-plugin/rpc_client.go b/vendor/github.com/hashicorp/go-plugin/rpc_client.go
index 29f9bf0..f30a4b1 100644
--- a/vendor/github.com/hashicorp/go-plugin/rpc_client.go
+++ b/vendor/github.com/hashicorp/go-plugin/rpc_client.go
@@ -1,6 +1,7 @@
 package plugin
 
 import (
+        "crypto/tls"
         "fmt"
         "io"
         "net"
@@ -19,6 +20,42 @@ type RPCClient struct {
         stdout, stderr net.Conn
 }
 
+// newRPCClient creates a new RPCClient. The Client argument is expected
+// to be successfully started already with a lock held.
+func newRPCClient(c *Client) (*RPCClient, error) {
+        // Connect to the client
+        conn, err := net.Dial(c.address.Network(), c.address.String())
+        if err != nil {
+                return nil, err
+        }
+        if tcpConn, ok := conn.(*net.TCPConn); ok {
+                // Make sure to set keep alive so that the connection doesn't die
+                tcpConn.SetKeepAlive(true)
+        }
+
+        if c.config.TLSConfig != nil {
+                conn = tls.Client(conn, c.config.TLSConfig)
+        }
+
+        // Create the actual RPC client
+        result, err := NewRPCClient(conn, c.config.Plugins)
+        if err != nil {
+                conn.Close()
+                return nil, err
+        }
+
+        // Begin the stream syncing so that stdin, out, err work properly
+        err = result.SyncStreams(
+                c.config.SyncStdout,
+                c.config.SyncStderr)
+        if err != nil {
+                result.Close()
+                return nil, err
+        }
+
+        return result, nil
+}
+
 // NewRPCClient creates a client from an already-open connection-like value.
 // Dial is typically used instead.
 func NewRPCClient(conn io.ReadWriteCloser, plugins map[string]Plugin) (*RPCClient, error) {
@@ -121,3 +158,13 @@ func (c *RPCClient) Dispense(name string) (interface{}, error) {
 
         return p.Client(c.broker, rpc.NewClient(conn))
 }
+
+// Ping pings the connection to ensure it is still alive.
+//
+// The error from the RPC call is returned exactly if you want to inspect
+// it for further error analysis. Any error returned from here would indicate
+// that the connection to the plugin is not healthy.
+func (c *RPCClient) Ping() error {
+        var empty struct{}
+        return c.control.Call("Control.Ping", true, &empty)
+}
diff --git a/vendor/github.com/hashicorp/go-plugin/rpc_server.go b/vendor/github.com/hashicorp/go-plugin/rpc_server.go
index 3984dc8..5bb18dd 100644
--- a/vendor/github.com/hashicorp/go-plugin/rpc_server.go
+++ b/vendor/github.com/hashicorp/go-plugin/rpc_server.go
@@ -34,10 +34,14 @@ type RPCServer struct {
         lock sync.Mutex
 }
 
-// Accept accepts connections on a listener and serves requests for
-// each incoming connection. Accept blocks; the caller typically invokes
-// it in a go statement.
-func (s *RPCServer) Accept(lis net.Listener) {
+// ServerProtocol impl.
+func (s *RPCServer) Init() error { return nil }
+
+// ServerProtocol impl.
+func (s *RPCServer) Config() string { return "" }
+
+// ServerProtocol impl.
+func (s *RPCServer) Serve(lis net.Listener) {
         for {
                 conn, err := lis.Accept()
                 if err != nil {
@@ -122,6 +126,14 @@ type controlServer struct {
         server *RPCServer
 }
 
+// Ping can be called to verify the connection (and likely the binary)
+// is still alive to a plugin.
+func (c *controlServer) Ping(
+        null bool, response *struct{}) error {
+        *response = struct{}{}
+        return nil
+}
+
 func (c *controlServer) Quit(
         null bool, response *struct{}) error {
         // End the server
diff --git a/vendor/github.com/hashicorp/go-plugin/server.go b/vendor/github.com/hashicorp/go-plugin/server.go
index b5c5270..1e808b9 100644
--- a/vendor/github.com/hashicorp/go-plugin/server.go
+++ b/vendor/github.com/hashicorp/go-plugin/server.go
@@ -1,6 +1,8 @@
 package plugin
 
 import (
+        "crypto/tls"
+        "encoding/base64"
         "errors"
         "fmt"
         "io/ioutil"
@@ -11,6 +13,10 @@ import (
         "runtime"
         "strconv"
         "sync/atomic"
+
+        "github.com/hashicorp/go-hclog"
+
+        "google.golang.org/grpc"
 )
 
 // CoreProtocolVersion is the ProtocolVersion of the plugin system itself.
@@ -45,14 +51,41 @@ type ServeConfig struct {
         // HandshakeConfig is the configuration that must match clients.
         HandshakeConfig
 
+        // TLSProvider is a function that returns a configured tls.Config.
+        TLSProvider func() (*tls.Config, error)
+
         // Plugins are the plugins that are served.
         Plugins map[string]Plugin
+
+        // GRPCServer should be non-nil to enable serving the plugins over
+        // gRPC. This is a function to create the server when needed with the
+        // given server options. The server options populated by go-plugin will
+        // be for TLS if set. You may modify the input slice.
+        //
+        // Note that the grpc.Server will automatically be registered with
+        // the gRPC health checking service. This is not optional since go-plugin
+        // relies on this to implement Ping().
+        GRPCServer func([]grpc.ServerOption) *grpc.Server
+
+        // Logger is used to pass a logger into the server. If none is provided the
+        // server will create a default logger.
+        Logger hclog.Logger
+}
+
+// Protocol returns the protocol that this server should speak.
+func (c *ServeConfig) Protocol() Protocol {
+        result := ProtocolNetRPC
+        if c.GRPCServer != nil {
+                result = ProtocolGRPC
+        }
+
+        return result
 }
 
 // Serve serves the plugins given by ServeConfig.
 //
 // Serve doesn't return until the plugin is done being executed. Any
-// errors will be outputted to the log.
+// errors will be outputted to os.Stderr.
 //
 // This is the method that plugins should call in their main() functions.
 func Serve(opts *ServeConfig) {
@@ -77,6 +110,16 @@ func Serve(opts *ServeConfig) {
         // Logging goes to the original stderr
         log.SetOutput(os.Stderr)
 
+        logger := opts.Logger
+        if logger == nil {
+                // internal logger to os.Stderr
+                logger = hclog.New(&hclog.LoggerOptions{
+                        Level:      hclog.Trace,
+                        Output:     os.Stderr,
+                        JSONFormat: true,
+                })
+        }
+
         // Create our new stdout, stderr files. These will override our built-in
         // stdout/stderr so that it works across the stream boundary.
         stdout_r, stdout_w, err := os.Pipe()
@@ -93,30 +136,86 @@ func Serve(opts *ServeConfig) {
         // Register a listener so we can accept a connection
         listener, err := serverListener()
         if err != nil {
-                log.Printf("[ERR] plugin: plugin init: %s", err)
+                logger.Error("plugin init error", "error", err)
                 return
         }
-        defer listener.Close()
+
+        // Close the listener on return. We wrap this in a func() on purpose
+        // because the "listener" reference may change to TLS.
+        defer func() {
+                listener.Close()
+        }()
+
+        var tlsConfig *tls.Config
+        if opts.TLSProvider != nil {
+                tlsConfig, err = opts.TLSProvider()
+                if err != nil {
+                        logger.Error("plugin tls init", "error", err)
+                        return
+                }
+        }
 
         // Create the channel to tell us when we're done
         doneCh := make(chan struct{})
 
-        // Create the RPC server to dispense
-        server := &RPCServer{
-                Plugins: opts.Plugins,
-                Stdout:  stdout_r,
-                Stderr:  stderr_r,
-                DoneCh:  doneCh,
+        // Build the server type
+        var server ServerProtocol
+        switch opts.Protocol() {
+        case ProtocolNetRPC:
+                // If we have a TLS configuration then we wrap the listener
+                // ourselves and do it at that level.
+                if tlsConfig != nil {
+                        listener = tls.NewListener(listener, tlsConfig)
+                }
+
+                // Create the RPC server to dispense
+                server = &RPCServer{
+                        Plugins: opts.Plugins,
+                        Stdout:  stdout_r,
+                        Stderr:  stderr_r,
+                        DoneCh:  doneCh,
+                }
+
+        case ProtocolGRPC:
+                // Create the gRPC server
+                server = &GRPCServer{
+                        Plugins: opts.Plugins,
+                        Server:  opts.GRPCServer,
+                        TLS:     tlsConfig,
+                        Stdout:  stdout_r,
+                        Stderr:  stderr_r,
+                        DoneCh:  doneCh,
+                }
+
+        default:
+                panic("unknown server protocol: " + opts.Protocol())
         }
 
+        // Initialize the servers
+        if err := server.Init(); err != nil {
+                logger.Error("protocol init", "error", err)
+                return
+        }
+
+        // Build the extra configuration
+        extra := ""
+        if v := server.Config(); v != "" {
+                extra = base64.StdEncoding.EncodeToString([]byte(v))
+        }
+        if extra != "" {
+                extra = "|" + extra
+        }
+
+        logger.Debug("plugin address", "network", listener.Addr().Network(), "address", listener.Addr().String())
+
         // Output the address and service name to stdout so that core can bring it up.
-        log.Printf("[DEBUG] plugin: plugin address: %s %s\n",
-                listener.Addr().Network(), listener.Addr().String())
-        fmt.Printf("%d|%d|%s|%s\n",
+        fmt.Printf("%d|%d|%s|%s|%s%s\n",
                 CoreProtocolVersion,
                 opts.ProtocolVersion,
                 listener.Addr().Network(),
-                listener.Addr().String())
+                listener.Addr().String(),
+                opts.Protocol(),
+                extra)
         os.Stdout.Sync()
 
         // Eat the interrupts
@@ -127,9 +226,7 @@ func Serve(opts *ServeConfig) {
                 for {
                         <-ch
                         newCount := atomic.AddInt32(&count, 1)
-                        log.Printf(
-                                "[DEBUG] plugin: received interrupt signal (count: %d). Ignoring.",
-                                newCount)
+                        logger.Debug("plugin received interrupt signal, ignoring", "count", newCount)
                 }
         }()
 
@@ -137,10 +234,8 @@ func Serve(opts *ServeConfig) {
         os.Stdout = stdout_w
         os.Stderr = stderr_w
 
-        // Serve
-        go server.Accept(listener)
-
-        // Wait for the graceful exit
+        // Accept connections and wait for completion
+        go server.Serve(listener)
         <-doneCh
 }
 
diff --git a/vendor/github.com/hashicorp/go-plugin/testing.go b/vendor/github.com/hashicorp/go-plugin/testing.go
index 9086a1b..df29593 100644
--- a/vendor/github.com/hashicorp/go-plugin/testing.go
+++ b/vendor/github.com/hashicorp/go-plugin/testing.go
@@ -2,9 +2,12 @@ package plugin
 
 import (
         "bytes"
+        "context"
         "net"
         "net/rpc"
-        "testing"
+
+        "github.com/mitchellh/go-testing-interface"
+        "google.golang.org/grpc"
 )
 
 // The testing file contains test helpers that you can use outside of
@@ -12,7 +15,7 @@ import (
 
 // TestConn is a helper function for returning a client and server
 // net.Conn connected to each other.
-func TestConn(t *testing.T) (net.Conn, net.Conn) {
+func TestConn(t testing.T) (net.Conn, net.Conn) {
         // Listen to any local port. This listener will be closed
         // after a single connection is established.
         l, err := net.Listen("tcp", "127.0.0.1:0")
@@ -46,7 +49,7 @@ func TestConn(t *testing.T) (net.Conn, net.Conn) {
 }
 
 // TestRPCConn returns a rpc client and server connected to each other.
-func TestRPCConn(t *testing.T) (*rpc.Client, *rpc.Server) {
+func TestRPCConn(t testing.T) (*rpc.Client, *rpc.Server) {
         clientConn, serverConn := TestConn(t)
 
         server := rpc.NewServer()
@@ -58,7 +61,7 @@ func TestRPCConn(t *testing.T) (*rpc.Client, *rpc.Server) {
 
 // TestPluginRPCConn returns a plugin RPC client and server that are connected
 // together and configured.
-func TestPluginRPCConn(t *testing.T, ps map[string]Plugin) (*RPCClient, *RPCServer) {
+func TestPluginRPCConn(t testing.T, ps map[string]Plugin) (*RPCClient, *RPCServer) {
         // Create two net.Conns we can use to shuttle our control connection
         clientConn, serverConn := TestConn(t)
 
@@ -74,3 +77,78 @@ func TestPluginRPCConn(t *testing.T, ps map[string]Plugin) (*RPCClient, *RPCServ
 
         return client, server
 }
+
+// TestGRPCConn returns a gRPC client conn and grpc server that are connected
+// together and configured. The register function is used to register services
+// prior to the Serve call. This is used to test gRPC connections.
+func TestGRPCConn(t testing.T, register func(*grpc.Server)) (*grpc.ClientConn, *grpc.Server) {
+        // Create a listener
+        l, err := net.Listen("tcp", "127.0.0.1:0")
+        if err != nil {
+                t.Fatalf("err: %s", err)
+        }
+
+        server := grpc.NewServer()
+        register(server)
+        go server.Serve(l)
+
+        // Connect to the server
+        conn, err := grpc.Dial(
+                l.Addr().String(),
+                grpc.WithBlock(),
+                grpc.WithInsecure())
+        if err != nil {
+                t.Fatalf("err: %s", err)
+        }
+
+        // Connection successful, close the listener
+        l.Close()
+
+        return conn, server
+}
+
+// TestPluginGRPCConn returns a plugin gRPC client and server that are connected
+// together and configured. This is used to test gRPC connections.
+func TestPluginGRPCConn(t testing.T, ps map[string]Plugin) (*GRPCClient, *GRPCServer) {
+        // Create a listener
+        l, err := net.Listen("tcp", "127.0.0.1:0")
+        if err != nil {
+                t.Fatalf("err: %s", err)
+        }
+
+        // Start up the server
+        server := &GRPCServer{
+                Plugins: ps,
+                Server:  DefaultGRPCServer,
+                Stdout:  new(bytes.Buffer),
+                Stderr:  new(bytes.Buffer),
+        }
+        if err := server.Init(); err != nil {
+                t.Fatalf("err: %s", err)
+        }
+        go server.Serve(l)
+
+        // Connect to the server
+        conn, err := grpc.Dial(
+                l.Addr().String(),
+                grpc.WithBlock(),
+                grpc.WithInsecure())
+        if err != nil {
+                t.Fatalf("err: %s", err)
+        }
+
+        brokerGRPCClient := newGRPCBrokerClient(conn)
+        broker := newGRPCBroker(brokerGRPCClient, nil)
+        go broker.Run()
+        go brokerGRPCClient.StartStream()
+
+        // Create the client
+        client := &GRPCClient{
+                Conn:    conn,
+                Plugins: ps,
+                broker:  broker,
+                doneCtx: context.Background(),
+        }
+
+        return client, server
+}
diff --git a/vendor/github.com/hashicorp/go-safetemp/LICENSE b/vendor/github.com/hashicorp/go-safetemp/LICENSE
new file mode 100644
index 0000000..be2cc4d
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-safetemp/LICENSE
@@ -0,0 +1,362 @@
+Mozilla Public License, version 2.0
+
+1. Definitions
+
+1.1. "Contributor"
+
+     means each individual or legal entity that creates, contributes to the
+     creation of, or owns Covered Software.
+
+1.2. "Contributor Version"
+
+     means the combination of the Contributions of others (if any) used by a
+     Contributor and that particular Contributor's Contribution.
+
+1.3. "Contribution"
+
+     means Covered Software of a particular Contributor.
+
+1.4. "Covered Software"
+
+     means Source Code Form to which the initial Contributor has attached the
+     notice in Exhibit A, the Executable Form of such Source Code Form, and
+     Modifications of such Source Code Form, in each case including portions
+     thereof.
+
+1.5. "Incompatible With Secondary Licenses"
+     means
+
+     a. that the initial Contributor has attached the notice described in
+        Exhibit B to the Covered Software; or
+
+     b. that the Covered Software was made available under the terms of
+        version 1.1 or earlier of the License, but not also under the terms of
+        a Secondary License.
+
+1.6. "Executable Form"
+
+     means any form of the work other than Source Code Form.
+
+1.7. "Larger Work"
+
+     means a work that combines Covered Software with other material, in a
+     separate file or files, that is not Covered Software.
+
+1.8. "License"
+
+     means this document.
+
+1.9. "Licensable"
+
+     means having the right to grant, to the maximum extent possible, whether
+     at the time of the initial grant or subsequently, any and all of the
+     rights conveyed by this License.
+
+1.10. "Modifications"
+
+     means any of the following:
+
+     a. any file in Source Code Form that results from an addition to,
+        deletion from, or modification of the contents of Covered Software; or
+
+     b. any new file in Source Code Form that contains any Covered Software.
+
+1.11. "Patent Claims" of a Contributor
+
+      means any patent claim(s), including without limitation, method,
+      process, and apparatus claims, in any patent Licensable by such
+      Contributor that would be infringed, but for the grant of the License,
+      by the making, using, selling, offering for sale, having made, import,
+      or transfer of either its Contributions or its Contributor Version.
+
+1.12. "Secondary License"
+
+      means either the GNU General Public License, Version 2.0, the GNU Lesser
+      General Public License, Version 2.1, the GNU Affero General Public
+      License, Version 3.0, or any later versions of those licenses.
+
+1.13. "Source Code Form"
+
+      means the form of the work preferred for making modifications.
+
+1.14. "You" (or "Your")
+
+      means an individual or a legal entity exercising rights under this
+      License. For legal entities, "You" includes any entity that controls, is
+      controlled by, or is under common control with You. For purposes of this
+      definition, "control" means (a) the power, direct or indirect, to cause
+      the direction or management of such entity, whether by contract or
+      otherwise, or (b) ownership of more than fifty percent (50%) of the
+      outstanding shares or beneficial ownership of such entity.
+
+
+2. License Grants and Conditions
+
+2.1. Grants
+
+     Each Contributor hereby grants You a world-wide, royalty-free,
+     non-exclusive license:
+
+     a. under intellectual property rights (other than patent or trademark)
+        Licensable by such Contributor to use, reproduce, make available,
+        modify, display, perform, distribute, and otherwise exploit its
+        Contributions, either on an unmodified basis, with Modifications, or
+        as part of a Larger Work; and
+
+     b. under Patent Claims of such Contributor to make, use, sell, offer for
+        sale, have made, import, and otherwise transfer either its
+        Contributions or its Contributor Version.
+
+2.2. Effective Date
+
+     The licenses granted in Section 2.1 with respect to any Contribution
+     become effective for each Contribution on the date the Contributor first
+     distributes such Contribution.
+
+2.3. Limitations on Grant Scope
+
+     The licenses granted in this Section 2 are the only rights granted under
+     this License. No additional rights or licenses will be implied from the
+     distribution or licensing of Covered Software under this License.
+     Notwithstanding Section 2.1(b) above, no patent license is granted by a
+     Contributor:
+
+     a. for any code that a Contributor has removed from Covered Software; or
+
+     b. for infringements caused by: (i) Your and any other third party's
+        modifications of Covered Software, or (ii) the combination of its
+        Contributions with other software (except as part of its Contributor
+        Version); or
+
+     c. under Patent Claims infringed by Covered Software in the absence of
+        its Contributions.
+
+     This License does not grant any rights in the trademarks, service marks,
+     or logos of any Contributor (except as may be necessary to comply with
+     the notice requirements in Section 3.4).
+
+2.4. Subsequent Licenses
+
+     No Contributor makes additional grants as a result of Your choice to
+     distribute the Covered Software under a subsequent version of this
+     License (see Section 10.2) or under the terms of a Secondary License (if
+     permitted under the terms of Section 3.3).
+
+2.5. Representation
+
+     Each Contributor represents that the Contributor believes its
+     Contributions are its original creation(s) or it has sufficient rights to
+     grant the rights to its Contributions conveyed by this License.
+
+2.6. Fair Use
+
+     This License is not intended to limit any rights You have under
+     applicable copyright doctrines of fair use, fair dealing, or other
+     equivalents.
+
+2.7. Conditions
+
+     Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted in
+     Section 2.1.
+
+
+3. Responsibilities
+
+3.1. Distribution of Source Form
+
+     All distribution of Covered Software in Source Code Form, including any
+     Modifications that You create or to which You contribute, must be under
+     the terms of this License. You must inform recipients that the Source
+     Code Form of the Covered Software is governed by the terms of this
+     License, and how they can obtain a copy of this License. You may not
+     attempt to alter or restrict the recipients' rights in the Source Code
+     Form.
+
+3.2. Distribution of Executable Form
+
+     If You distribute Covered Software in Executable Form then:
+
+     a. such Covered Software must also be made available in Source Code Form,
+        as described in Section 3.1, and You must inform recipients of the
+        Executable Form how they can obtain a copy of such Source Code Form by
+        reasonable means in a timely manner, at a charge no more than the cost
+        of distribution to the recipient; and
+
+     b. You may distribute such Executable Form under the terms of this
+        License, or sublicense it under different terms, provided that the
+        license for the Executable Form does not attempt to limit or alter the
+        recipients' rights in the Source Code Form under this License.
+
+3.3. Distribution of a Larger Work
+
+     You may create and distribute a Larger Work under terms of Your choice,
+     provided that You also comply with the requirements of this License for
+     the Covered Software. If the Larger Work is a combination of Covered
+     Software with a work governed by one or more Secondary Licenses, and the
+     Covered Software is not Incompatible With Secondary Licenses, this
+     License permits You to additionally distribute such Covered Software
+     under the terms of such Secondary License(s), so that the recipient of
+     the Larger Work may, at their option, further distribute the Covered
+     Software under the terms of either this License or such Secondary
+     License(s).
+
+3.4. Notices
+
+     You may not remove or alter the substance of any license notices
+     (including copyright notices, patent notices, disclaimers of warranty, or
+     limitations of liability) contained within the Source Code Form of the
+     Covered Software, except that You may alter any license notices to the
+     extent required to remedy known factual inaccuracies.
+
+3.5. Application of Additional Terms
+
+     You may choose to offer, and to charge a fee for, warranty, support,
+     indemnity or liability obligations to one or more recipients of Covered
+     Software. However, You may do so only on Your own behalf, and not on
+     behalf of any Contributor. You must make it absolutely clear that any
+     such warranty, support, indemnity, or liability obligation is offered by
+     You alone, and You hereby agree to indemnify every Contributor for any
+     liability incurred by such Contributor as a result of warranty, support,
+     indemnity or liability terms You offer. You may include additional
+     disclaimers of warranty and limitations of liability specific to any
+     jurisdiction.
+
+4. Inability to Comply Due to Statute or Regulation
+
+   If it is impossible for You to comply with any of the terms of this License
+   with respect to some or all of the Covered Software due to statute,
+   judicial order, or regulation then You must: (a) comply with the terms of
+   this License to the maximum extent possible; and (b) describe the
+   limitations and the code they affect. Such description must be placed in a
+   text file included with all distributions of the Covered Software under
+   this License. Except to the extent prohibited by statute or regulation,
+   such description must be sufficiently detailed for a recipient of ordinary
+   skill to be able to understand it.
+
+5. Termination
+
+5.1. The rights granted under this License will terminate automatically if You
+     fail to comply with any of its terms. However, if You become compliant,
+     then the rights granted under this License from a particular Contributor
+     are reinstated (a) provisionally, unless and until such Contributor
+     explicitly and finally terminates Your grants, and (b) on an ongoing
+     basis, if such Contributor fails to notify You of the non-compliance by
+     some reasonable means prior to 60 days after You have come back into
+     compliance. Moreover, Your grants from a particular Contributor are
+     reinstated on an ongoing basis if such Contributor notifies You of the
+     non-compliance by some reasonable means, this is the first time You have
+     received notice of non-compliance with this License from such
+     Contributor, and You become compliant prior to 30 days after Your receipt
+     of the notice.
+
+5.2. If You initiate litigation against any entity by asserting a patent
+     infringement claim (excluding declaratory judgment actions,
+     counter-claims, and cross-claims) alleging that a Contributor Version
+     directly or indirectly infringes any patent, then the rights granted to
+     You by any and all Contributors for the Covered Software under Section
+     2.1 of this License shall terminate.
+
+5.3. In the event of termination under Sections 5.1 or 5.2 above, all end user
+     license agreements (excluding distributors and resellers) which have been
+     validly granted by You or Your distributors under this License prior to
+     termination shall survive termination.
+
+6. Disclaimer of Warranty
+
+   Covered Software is provided under this License on an "as is" basis,
+   without warranty of any kind, either expressed, implied, or statutory,
+   including, without limitation, warranties that the Covered Software is free
+   of defects, merchantable, fit for a particular purpose or non-infringing.
+   The entire risk as to the quality and performance of the Covered Software
+   is with You. Should any Covered Software prove defective in any respect,
+   You (not any Contributor) assume the cost of any necessary servicing,
+   repair, or correction. This disclaimer of warranty constitutes an essential
+   part of this License. No use of  any Covered Software is authorized under
+   this License except under this disclaimer.
+
+7. Limitation of Liability
+
+   Under no circumstances and under no legal theory, whether tort (including
+   negligence), contract, or otherwise, shall any Contributor, or anyone who
+   distributes Covered Software as permitted above, be liable to You for any
+   direct, indirect, special, incidental, or consequential damages of any
+   character including, without limitation, damages for lost profits, loss of
+   goodwill, work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses, even if such party shall have been
+   informed of the possibility of such damages. This limitation of liability
+   shall not apply to liability for death or personal injury resulting from
+   such party's negligence to the extent applicable law prohibits such
+   limitation. Some jurisdictions do not allow the exclusion or limitation of
+   incidental or consequential damages, so this exclusion and limitation may
+   not apply to You.
+
+8. Litigation
+
+   Any litigation relating to this License may be brought only in the courts
+   of a jurisdiction where the defendant maintains its principal place of
+   business and such litigation shall be governed by laws of that
+   jurisdiction, without reference to its conflict-of-law provisions. Nothing
+   in this Section shall prevent a party's ability to bring cross-claims or
+   counter-claims.
+
+9. Miscellaneous
+
+   This License represents the complete agreement concerning the subject
+   matter hereof. If any provision of this License is held to be
+   unenforceable, such provision shall be reformed only to the extent
+   necessary to make it enforceable. Any law or regulation which provides that
+   the language of a contract shall be construed against the drafter shall not
+   be used to construe this License against a Contributor.
+
+
+10. Versions of the License
+
+10.1. New Versions
+
+      Mozilla Foundation is the license steward. Except as provided in Section
+      10.3, no one other than the license steward has the right to modify or
+      publish new versions of this License. Each version will be given a
+      distinguishing version number.
+
+10.2. Effect of New Versions
+
+      You may distribute the Covered Software under the terms of the version
+      of the License under which You originally received the Covered Software,
+      or under the terms of any subsequent version published by the license
+      steward.
+
+10.3. Modified Versions
+
+      If you create software not governed by this License, and you want to
+      create a new license for such software, you may create and use a
+      modified version of this License if you rename the license and remove
+      any references to the name of the license steward (except to note that
+      such modified license differs from this License).
+
+10.4. Distributing Source Code Form that is Incompatible With Secondary
+      Licenses If You choose to distribute Source Code Form that is
+      Incompatible With Secondary Licenses under the terms of this version of
+      the License, the notice described in Exhibit B of this License must be
+      attached.
+
+Exhibit A - Source Code Form License Notice
+
+      This Source Code Form is subject to the
+      terms of the Mozilla Public License, v.
+      2.0. If a copy of the MPL was not
+      distributed with this file, You can
+      obtain one at
+      http://mozilla.org/MPL/2.0/.
+
+If it is not possible or desirable to put the notice in a particular file,
+then You may include the notice in a location (such as a LICENSE file in a
+relevant directory) where a recipient would be likely to look for such a
+notice.
+
+You may add additional accurate notices of copyright ownership.
+
+Exhibit B - "Incompatible With Secondary Licenses" Notice
+
+      This Source Code Form is "Incompatible
+      With Secondary Licenses", as defined by
+      the Mozilla Public License, v. 2.0.
diff --git a/vendor/github.com/hashicorp/go-safetemp/README.md b/vendor/github.com/hashicorp/go-safetemp/README.md
new file mode 100644
index 0000000..02ece33
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-safetemp/README.md
@@ -0,0 +1,10 @@
+# go-safetemp
+[![Godoc](https://godoc.org/github.com/hashcorp/go-safetemp?status.svg)](https://godoc.org/github.com/hashicorp/go-safetemp)
+
+Functions for safely working with temporary directories and files.
+
+## Why?
+
+The Go standard library provides the excellent `ioutil` package for
+working with temporary directories and files. This library builds on top
+of that to provide safe abstractions above that.
diff --git a/vendor/github.com/hashicorp/go-safetemp/safetemp.go b/vendor/github.com/hashicorp/go-safetemp/safetemp.go
new file mode 100644
index 0000000..c4ae72b
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-safetemp/safetemp.go
@@ -0,0 +1,40 @@
+package safetemp
+
+import (
+        "io"
+        "io/ioutil"
+        "os"
+        "path/filepath"
+)
+
+// Dir creates a new temporary directory that isn't yet created. This
+// can be used with calls that expect a non-existent directory.
+//
+// The directory is created as a child of a temporary directory created
+// within the directory dir starting with prefix. The temporary directory
+// returned is always named "temp". The parent directory has the specified
+// prefix.
+//
+// The returned io.Closer should be used to clean up the returned directory.
+// This will properly remove the returned directory and any other temporary
+// files created.
+//
+// If an error is returned, the Closer does not need to be called (and will
+// be nil).
+func Dir(dir, prefix string) (string, io.Closer, error) {
+        // Create the temporary directory
+        td, err := ioutil.TempDir(dir, prefix)
+        if err != nil {
+                return "", nil, err
+        }
+
+        return filepath.Join(td, "temp"), pathCloser(td), nil
+}
+
+// pathCloser implements io.Closer to remove the given path on Close.
+type pathCloser string
+
+// Close deletes this path.
+func (p pathCloser) Close() error {
+        return os.RemoveAll(string(p))
+}
diff --git a/vendor/github.com/hashicorp/go-uuid/.travis.yml b/vendor/github.com/hashicorp/go-uuid/.travis.yml
new file mode 100644
index 0000000..7698490
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-uuid/.travis.yml
@@ -0,0 +1,12 @@
+language: go
+
+sudo: false
+
+go:
+  - 1.4
+  - 1.5
+  - 1.6
+  - tip
+
+script:
+  - go test -bench . -benchmem -v ./...
diff --git a/vendor/github.com/hashicorp/go-uuid/README.md b/vendor/github.com/hashicorp/go-uuid/README.md
index 21fdda4..fbde8b9 100644
--- a/vendor/github.com/hashicorp/go-uuid/README.md
+++ b/vendor/github.com/hashicorp/go-uuid/README.md
@@ -1,6 +1,6 @@
-# uuid
+# uuid [![Build Status](https://travis-ci.org/hashicorp/go-uuid.svg?branch=master)](https://travis-ci.org/hashicorp/go-uuid)
 
-Generates UUID-format strings using purely high quality random bytes.
+Generates UUID-format strings using high quality, _purely random_ bytes. It is **not** intended to be RFC compliant, merely to use a well-understood string representation of a 128-bit value. It can also parse UUID-format strings into their component bytes.
 
 Documentation
 =============
diff --git a/vendor/github.com/hashicorp/go-uuid/go.mod b/vendor/github.com/hashicorp/go-uuid/go.mod
new file mode 100644
index 0000000..dd57f9d
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-uuid/go.mod
@@ -0,0 +1 @@
+module github.com/hashicorp/go-uuid
diff --git a/vendor/github.com/hashicorp/go-uuid/uuid.go b/vendor/github.com/hashicorp/go-uuid/uuid.go
index 322b522..ff9364c 100644
--- a/vendor/github.com/hashicorp/go-uuid/uuid.go
+++ b/vendor/github.com/hashicorp/go-uuid/uuid.go
@@ -6,13 +6,21 @@ import (
         "fmt"
 )
 
-// GenerateUUID is used to generate a random UUID
-func GenerateUUID() (string, error) {
-        buf := make([]byte, 16)
+// GenerateRandomBytes is used to generate random bytes of given size.
+func GenerateRandomBytes(size int) ([]byte, error) {
+        buf := make([]byte, size)
         if _, err := rand.Read(buf); err != nil {
-                return "", fmt.Errorf("failed to read random bytes: %v", err)
+                return nil, fmt.Errorf("failed to read random bytes: %v", err)
         }
+        return buf, nil
+}
 
+// GenerateUUID is used to generate a random UUID
+func GenerateUUID() (string, error) {
+        buf, err := GenerateRandomBytes(16)
+        if err != nil {
+                return "", err
+        }
         return FormatUUID(buf)
 }
 
diff --git a/vendor/github.com/hashicorp/go-version/.travis.yml b/vendor/github.com/hashicorp/go-version/.travis.yml
index 9f30eec..542ca8b 100644
--- a/vendor/github.com/hashicorp/go-version/.travis.yml
+++ b/vendor/github.com/hashicorp/go-version/.travis.yml
@@ -6,6 +6,8 @@ go:
   - 1.2
   - 1.3
   - 1.4
+  - 1.9
+  - "1.10"
   
 script:
   - go test 
diff --git a/vendor/github.com/hashicorp/go-version/constraint.go b/vendor/github.com/hashicorp/go-version/constraint.go
index 8c73df0..d055759 100644
--- a/vendor/github.com/hashicorp/go-version/constraint.go
+++ b/vendor/github.com/hashicorp/go-version/constraint.go
@@ -2,6 +2,7 @@ package version
 
 import (
         "fmt"
+        "reflect"
         "regexp"
         "strings"
 )
@@ -113,6 +114,26 @@ func parseSingle(v string) (*Constraint, error) {
         }, nil
 }
 
+func prereleaseCheck(v, c *Version) bool {
+        switch vPre, cPre := v.Prerelease() != "", c.Prerelease() != ""; {
+        case cPre && vPre:
+                // A constraint with a pre-release can only match a pre-release version
+                // with the same base segments.
+                return reflect.DeepEqual(c.Segments64(), v.Segments64())
+
+        case !cPre && vPre:
+                // A constraint without a pre-release can only match a version without a
+                // pre-release.
+                return false
+
+        case cPre && !vPre:
+                // OK, except with the pessimistic operator
+        case !cPre && !vPre:
+                // OK
+        }
+        return true
+}
+
 //-------------------------------------------------------------------
 // Constraint functions
 //-------------------------------------------------------------------
@@ -126,22 +147,27 @@ func constraintNotEqual(v, c *Version) bool {
 }
 
 func constraintGreaterThan(v, c *Version) bool {
-        return v.Compare(c) == 1
+        return prereleaseCheck(v, c) && v.Compare(c) == 1
 }
 
 func constraintLessThan(v, c *Version) bool {
-        return v.Compare(c) == -1
+        return prereleaseCheck(v, c) && v.Compare(c) == -1
 }
 
 func constraintGreaterThanEqual(v, c *Version) bool {
-        return v.Compare(c) >= 0
+        return prereleaseCheck(v, c) && v.Compare(c) >= 0
 }
 
 func constraintLessThanEqual(v, c *Version) bool {
-        return v.Compare(c) <= 0
+        return prereleaseCheck(v, c) && v.Compare(c) <= 0
 }
 
 func constraintPessimistic(v, c *Version) bool {
+        // Using a pessimistic constraint with a pre-release, restricts versions to pre-releases
+        if !prereleaseCheck(v, c) || (c.Prerelease() != "" && v.Prerelease() == "") {
+                return false
+        }
+
         // If the version being checked is naturally less than the constraint, then there
         // is no way for the version to be valid against the constraint
         if v.LessThan(c) {
diff --git a/vendor/github.com/hashicorp/go-version/go.mod b/vendor/github.com/hashicorp/go-version/go.mod
new file mode 100644
index 0000000..f528555
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-version/go.mod
@@ -0,0 +1 @@
+module github.com/hashicorp/go-version
diff --git a/vendor/github.com/hashicorp/go-version/version.go b/vendor/github.com/hashicorp/go-version/version.go
index ae2f6b6..4d1e6e2 100644
--- a/vendor/github.com/hashicorp/go-version/version.go
+++ b/vendor/github.com/hashicorp/go-version/version.go
@@ -15,8 +15,8 @@ var versionRegexp *regexp.Regexp
 // The raw regular expression string used for testing the validity
 // of a version.
 const VersionRegexpRaw string = `v?([0-9]+(\.[0-9]+)*?)` +
-        `(-?([0-9A-Za-z\-]+(\.[0-9A-Za-z\-]+)*))?` +
-        `(\+([0-9A-Za-z\-]+(\.[0-9A-Za-z\-]+)*))?` +
+        `(-([0-9]+[0-9A-Za-z\-~]*(\.[0-9A-Za-z\-~]+)*)|(-?([A-Za-z\-~]+[0-9A-Za-z\-~]*(\.[0-9A-Za-z\-~]+)*)))?` +
+        `(\+([0-9A-Za-z\-~]+(\.[0-9A-Za-z\-~]+)*))?` +
         `?`
 
 // Version represents a single version.
@@ -25,6 +25,7 @@ type Version struct {
         pre      string
         segments []int64
         si       int
+        original string
 }
 
 func init() {
@@ -59,11 +60,17 @@ func NewVersion(v string) (*Version, error) {
                 segments = append(segments, 0)
         }
 
+        pre := matches[7]
+        if pre == "" {
+                pre = matches[4]
+        }
+
         return &Version{
-                metadata: matches[7],
-                pre:      matches[4],
+                metadata: matches[10],
+                pre:      pre,
                 segments: segments,
                 si:       si,
+                original: v,
         }, nil
 }
 
@@ -166,24 +173,42 @@ func comparePart(preSelf string, preOther string) int {
                 return 0
         }
 
+        var selfInt int64
+        selfNumeric := true
+        selfInt, err := strconv.ParseInt(preSelf, 10, 64)
+        if err != nil {
+                selfNumeric = false
+        }
+
+        var otherInt int64
+        otherNumeric := true
+        otherInt, err = strconv.ParseInt(preOther, 10, 64)
+        if err != nil {
+                otherNumeric = false
+        }
+
         // if a part is empty, we use the other to decide
         if preSelf == "" {
-                _, notIsNumeric := strconv.ParseInt(preOther, 10, 64)
-                if notIsNumeric == nil {
+                if otherNumeric {
                         return -1
                 }
                 return 1
         }
 
         if preOther == "" {
-                _, notIsNumeric := strconv.ParseInt(preSelf, 10, 64)
-                if notIsNumeric == nil {
+                if selfNumeric {
                         return 1
                 }
                 return -1
         }
 
-        if preSelf > preOther {
+        if selfNumeric && !otherNumeric {
+                return -1
+        } else if !selfNumeric && otherNumeric {
+                return 1
+        } else if !selfNumeric && !otherNumeric && preSelf > preOther {
+                return 1
+        } else if selfInt > otherInt {
                 return 1
         }
 
@@ -283,11 +308,19 @@ func (v *Version) Segments() []int {
 // for a version "1.2.3-beta", segments will return a slice of
 // 1, 2, 3.
 func (v *Version) Segments64() []int64 {
-        return v.segments
+        result := make([]int64, len(v.segments))
+        copy(result, v.segments)
+        return result
 }
 
 // String returns the full version string included pre-release
 // and metadata information.
+//
+// This value is rebuilt according to the parsed segments and other
+// information. Therefore, ambiguities in the version string such as
+// prefixed zeroes (1.04.0 => 1.4.0), `v` prefix (v1.0.0 => 1.0.0), and
+// missing parts (1.0 => 1.0.0) will be made into a canonicalized form
+// as shown in the parenthesized examples.
 func (v *Version) String() string {
         var buf bytes.Buffer
         fmtParts := make([]string, len(v.segments))
@@ -306,3 +339,9 @@ func (v *Version) String() string {
 
         return buf.String()
 }
+
+// Original returns the original parsed version as-is, including any
+// potential whitespace, `v` prefix, etc.
+func (v *Version) Original() string {
+        return v.original
+}
diff --git a/vendor/github.com/hashicorp/hcl2/LICENSE b/vendor/github.com/hashicorp/hcl2/LICENSE
new file mode 100644
index 0000000..82b4de9
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/LICENSE
@@ -0,0 +1,353 @@
+Mozilla Public License, version 2.0
+
+1. Definitions
+
+1.1. “Contributor”
+
+     means each individual or legal entity that creates, contributes to the
+     creation of, or owns Covered Software.
+
+1.2. “Contributor Version”
+
+     means the combination of the Contributions of others (if any) used by a
+     Contributor and that particular Contributor’s Contribution.
+
+1.3. “Contribution”
+
+     means Covered Software of a particular Contributor.
+
+1.4. “Covered Software”
+
+     means Source Code Form to which the initial Contributor has attached the
+     notice in Exhibit A, the Executable Form of such Source Code Form, and
+     Modifications of such Source Code Form, in each case including portions
+     thereof.
+
+1.5. “Incompatible With Secondary Licenses”
+     means
+
+     a. that the initial Contributor has attached the notice described in
+        Exhibit B to the Covered Software; or
+
+     b. that the Covered Software was made available under the terms of version
+        1.1 or earlier of the License, but not also under the terms of a
+        Secondary License.
+
+1.6. “Executable Form”
+
+     means any form of the work other than Source Code Form.
+
+1.7. “Larger Work”
+
+     means a work that combines Covered Software with other material, in a separate
+     file or files, that is not Covered Software.
+
+1.8. “License”
+
+     means this document.
+
+1.9. “Licensable”
+
+     means having the right to grant, to the maximum extent possible, whether at the
+     time of the initial grant or subsequently, any and all of the rights conveyed by
+     this License.
+
+1.10. “Modifications”
+
+     means any of the following:
+
+     a. any file in Source Code Form that results from an addition to, deletion
+        from, or modification of the contents of Covered Software; or
+
+     b. any new file in Source Code Form that contains any Covered Software.
+
+1.11. “Patent Claims” of a Contributor
+
+      means any patent claim(s), including without limitation, method, process,
+      and apparatus claims, in any patent Licensable by such Contributor that
+      would be infringed, but for the grant of the License, by the making,
+      using, selling, offering for sale, having made, import, or transfer of
+      either its Contributions or its Contributor Version.
+
+1.12. “Secondary License”
+
+      means either the GNU General Public License, Version 2.0, the GNU Lesser
+      General Public License, Version 2.1, the GNU Affero General Public
+      License, Version 3.0, or any later versions of those licenses.
+
+1.13. “Source Code Form”
+
+      means the form of the work preferred for making modifications.
+
+1.14. “You” (or “Your”)
+
+      means an individual or a legal entity exercising rights under this
+      License. For legal entities, “You” includes any entity that controls, is
+      controlled by, or is under common control with You. For purposes of this
+      definition, “control” means (a) the power, direct or indirect, to cause
+      the direction or management of such entity, whether by contract or
+      otherwise, or (b) ownership of more than fifty percent (50%) of the
+      outstanding shares or beneficial ownership of such entity.
+
+
+2. License Grants and Conditions
+
+2.1. Grants
+
+     Each Contributor hereby grants You a world-wide, royalty-free,
+     non-exclusive license:
+
+     a. under intellectual property rights (other than patent or trademark)
+        Licensable by such Contributor to use, reproduce, make available,
+        modify, display, perform, distribute, and otherwise exploit its
+        Contributions, either on an unmodified basis, with Modifications, or as
+        part of a Larger Work; and
+
+     b. under Patent Claims of such Contributor to make, use, sell, offer for
+        sale, have made, import, and otherwise transfer either its Contributions
+        or its Contributor Version.
+
+2.2. Effective Date
+
+     The licenses granted in Section 2.1 with respect to any Contribution become
+     effective for each Contribution on the date the Contributor first distributes
+     such Contribution.
+
+2.3. Limitations on Grant Scope
+
+     The licenses granted in this Section 2 are the only rights granted under this
+     License. No additional rights or licenses will be implied from the distribution
+     or licensing of Covered Software under this License. Notwithstanding Section
+     2.1(b) above, no patent license is granted by a Contributor:
+
+     a. for any code that a Contributor has removed from Covered Software; or
+
+     b. for infringements caused by: (i) Your and any other third party’s
+        modifications of Covered Software, or (ii) the combination of its
+        Contributions with other software (except as part of its Contributor
+        Version); or
+
+     c. under Patent Claims infringed by Covered Software in the absence of its
+        Contributions.
+
+     This License does not grant any rights in the trademarks, service marks, or
+     logos of any Contributor (except as may be necessary to comply with the
+     notice requirements in Section 3.4).
+
+2.4. Subsequent Licenses
+
+     No Contributor makes additional grants as a result of Your choice to
+     distribute the Covered Software under a subsequent version of this License
+     (see Section 10.2) or under the terms of a Secondary License (if permitted
+     under the terms of Section 3.3).
+
+2.5. Representation
+
+     Each Contributor represents that the Contributor believes its Contributions
+     are its original creation(s) or it has sufficient rights to grant the
+     rights to its Contributions conveyed by this License.
+
+2.6. Fair Use
+
+     This License is not intended to limit any rights You have under applicable
+     copyright doctrines of fair use, fair dealing, or other equivalents.
+
+2.7. Conditions
+
+     Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted in
+     Section 2.1.
+
+
+3. Responsibilities
+
+3.1. Distribution of Source Form
+
+     All distribution of Covered Software in Source Code Form, including any
+     Modifications that You create or to which You contribute, must be under the
+     terms of this License. You must inform recipients that the Source Code Form
+     of the Covered Software is governed by the terms of this License, and how
+     they can obtain a copy of this License. You may not attempt to alter or
+     restrict the recipients’ rights in the Source Code Form.
+
+3.2. Distribution of Executable Form
+
+     If You distribute Covered Software in Executable Form then:
+
+     a. such Covered Software must also be made available in Source Code Form,
+        as described in Section 3.1, and You must inform recipients of the
+        Executable Form how they can obtain a copy of such Source Code Form by
+        reasonable means in a timely manner, at a charge no more than the cost
+        of distribution to the recipient; and
+
+     b. You may distribute such Executable Form under the terms of this License,
+        or sublicense it under different terms, provided that the license for
+        the Executable Form does not attempt to limit or alter the recipients’
+        rights in the Source Code Form under this License.
+
+3.3. Distribution of a Larger Work
+
+     You may create and distribute a Larger Work under terms of Your choice,
+     provided that You also comply with the requirements of this License for the
+     Covered Software. If the Larger Work is a combination of Covered Software
+     with a work governed by one or more Secondary Licenses, and the Covered
+     Software is not Incompatible With Secondary Licenses, this License permits
+     You to additionally distribute such Covered Software under the terms of
+     such Secondary License(s), so that the recipient of the Larger Work may, at
+     their option, further distribute the Covered Software under the terms of
+     either this License or such Secondary License(s).
+
+3.4. Notices
+
+     You may not remove or alter the substance of any license notices (including
+     copyright notices, patent notices, disclaimers of warranty, or limitations
+     of liability) contained within the Source Code Form of the Covered
+     Software, except that You may alter any license notices to the extent
+     required to remedy known factual inaccuracies.
+
+3.5. Application of Additional Terms
+
+     You may choose to offer, and to charge a fee for, warranty, support,
+     indemnity or liability obligations to one or more recipients of Covered
+     Software. However, You may do so only on Your own behalf, and not on behalf
+     of any Contributor. You must make it absolutely clear that any such
+     warranty, support, indemnity, or liability obligation is offered by You
+     alone, and You hereby agree to indemnify every Contributor for any
+     liability incurred by such Contributor as a result of warranty, support,
+     indemnity or liability terms You offer. You may include additional
+     disclaimers of warranty and limitations of liability specific to any
+     jurisdiction.
+
+4. Inability to Comply Due to Statute or Regulation
+
+   If it is impossible for You to comply with any of the terms of this License
+   with respect to some or all of the Covered Software due to statute, judicial
+   order, or regulation then You must: (a) comply with the terms of this License
+   to the maximum extent possible; and (b) describe the limitations and the code
+   they affect. Such description must be placed in a text file included with all
+   distributions of the Covered Software under this License. Except to the
+   extent prohibited by statute or regulation, such description must be
+   sufficiently detailed for a recipient of ordinary skill to be able to
+   understand it.
+
+5. Termination
+
+5.1. The rights granted under this License will terminate automatically if You
+     fail to comply with any of its terms. However, if You become compliant,
+     then the rights granted under this License from a particular Contributor
+     are reinstated (a) provisionally, unless and until such Contributor
+     explicitly and finally terminates Your grants, and (b) on an ongoing basis,
+     if such Contributor fails to notify You of the non-compliance by some
+     reasonable means prior to 60 days after You have come back into compliance.
+     Moreover, Your grants from a particular Contributor are reinstated on an
+     ongoing basis if such Contributor notifies You of the non-compliance by
+     some reasonable means, this is the first time You have received notice of
+     non-compliance with this License from such Contributor, and You become
+     compliant prior to 30 days after Your receipt of the notice.
+
+5.2. If You initiate litigation against any entity by asserting a patent
+     infringement claim (excluding declaratory judgment actions, counter-claims,
+     and cross-claims) alleging that a Contributor Version directly or
+     indirectly infringes any patent, then the rights granted to You by any and
+     all Contributors for the Covered Software under Section 2.1 of this License
+     shall terminate.
+
+5.3. In the event of termination under Sections 5.1 or 5.2 above, all end user
+     license agreements (excluding distributors and resellers) which have been
+     validly granted by You or Your distributors under this License prior to
+     termination shall survive termination.
+
+6. Disclaimer of Warranty
+
+   Covered Software is provided under this License on an “as is” basis, without
+   warranty of any kind, either expressed, implied, or statutory, including,
+   without limitation, warranties that the Covered Software is free of defects,
+   merchantable, fit for a particular purpose or non-infringing. The entire
+   risk as to the quality and performance of the Covered Software is with You.
+   Should any Covered Software prove defective in any respect, You (not any
+   Contributor) assume the cost of any necessary servicing, repair, or
+   correction. This disclaimer of warranty constitutes an essential part of this
+   License. No use of  any Covered Software is authorized under this License
+   except under this disclaimer.
+
+7. Limitation of Liability
+
+   Under no circumstances and under no legal theory, whether tort (including
+   negligence), contract, or otherwise, shall any Contributor, or anyone who
+   distributes Covered Software as permitted above, be liable to You for any
+   direct, indirect, special, incidental, or consequential damages of any
+   character including, without limitation, damages for lost profits, loss of
+   goodwill, work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses, even if such party shall have been
+   informed of the possibility of such damages. This limitation of liability
+   shall not apply to liability for death or personal injury resulting from such
+   party’s negligence to the extent applicable law prohibits such limitation.
+   Some jurisdictions do not allow the exclusion or limitation of incidental or
+   consequential damages, so this exclusion and limitation may not apply to You.
+
+8. Litigation
+
+   Any litigation relating to this License may be brought only in the courts of
+   a jurisdiction where the defendant maintains its principal place of business
+   and such litigation shall be governed by laws of that jurisdiction, without
+   reference to its conflict-of-law provisions. Nothing in this Section shall
+   prevent a party’s ability to bring cross-claims or counter-claims.
+
+9. Miscellaneous
+
+   This License represents the complete agreement concerning the subject matter
+   hereof. If any provision of this License is held to be unenforceable, such
+   provision shall be reformed only to the extent necessary to make it
+   enforceable. Any law or regulation which provides that the language of a
+   contract shall be construed against the drafter shall not be used to construe
+   this License against a Contributor.
+
+
+10. Versions of the License
+
+10.1. New Versions
+
+      Mozilla Foundation is the license steward. Except as provided in Section
+      10.3, no one other than the license steward has the right to modify or
+      publish new versions of this License. Each version will be given a
+      distinguishing version number.
+
+10.2. Effect of New Versions
+
+      You may distribute the Covered Software under the terms of the version of
+      the License under which You originally received the Covered Software, or
+      under the terms of any subsequent version published by the license
+      steward.
+
+10.3. Modified Versions
+
+      If you create software not governed by this License, and you want to
+      create a new license for such software, you may create and use a modified
+      version of this License if you rename the license and remove any
+      references to the name of the license steward (except to note that such
+      modified license differs from this License).
+
+10.4. Distributing Source Code Form that is Incompatible With Secondary Licenses
+      If You choose to distribute Source Code Form that is Incompatible With
+      Secondary Licenses under the terms of this version of the License, the
+      notice described in Exhibit B of this License must be attached.
+
+Exhibit A - Source Code Form License Notice
+
+      This Source Code Form is subject to the
+      terms of the Mozilla Public License, v.
+      2.0. If a copy of the MPL was not
+      distributed with this file, You can
+      obtain one at
+      http://mozilla.org/MPL/2.0/.
+
+If it is not possible or desirable to put the notice in a particular file, then
+You may include the notice in a location (such as a LICENSE file in a relevant
+directory) where a recipient would be likely to look for such a notice.
+
+You may add additional accurate notices of copyright ownership.
+
+Exhibit B - “Incompatible With Secondary Licenses” Notice
+
+      This Source Code Form is “Incompatible
+      With Secondary Licenses”, as defined by
+      the Mozilla Public License, v. 2.0.
diff --git a/vendor/github.com/hashicorp/hcl2/gohcl/decode.go b/vendor/github.com/hashicorp/hcl2/gohcl/decode.go
new file mode 100644
index 0000000..3a149a8
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/gohcl/decode.go
@@ -0,0 +1,304 @@
+package gohcl
+
+import (
+        "fmt"
+        "reflect"
+
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty/convert"
+        "github.com/zclconf/go-cty/cty/gocty"
+)
+
+// DecodeBody extracts the configuration within the given body into the given
+// value. This value must be a non-nil pointer to either a struct or
+// a map, where in the former case the configuration will be decoded using
+// struct tags and in the latter case only attributes are allowed and their
+// values are decoded into the map.
+//
+// The given EvalContext is used to resolve any variables or functions in
+// expressions encountered while decoding. This may be nil to require only
+// constant values, for simple applications that do not support variables or
+// functions.
+//
+// The returned diagnostics should be inspected with its HasErrors method to
+// determine if the populated value is valid and complete. If error diagnostics
+// are returned then the given value may have been partially-populated but
+// may still be accessed by a careful caller for static analysis and editor
+// integration use-cases.
+func DecodeBody(body hcl.Body, ctx *hcl.EvalContext, val interface{}) hcl.Diagnostics {
+        rv := reflect.ValueOf(val)
+        if rv.Kind() != reflect.Ptr {
+                panic(fmt.Sprintf("target value must be a pointer, not %s", rv.Type().String()))
+        }
+
+        return decodeBodyToValue(body, ctx, rv.Elem())
+}
+
+func decodeBodyToValue(body hcl.Body, ctx *hcl.EvalContext, val reflect.Value) hcl.Diagnostics {
+        et := val.Type()
+        switch et.Kind() {
+        case reflect.Struct:
+                return decodeBodyToStruct(body, ctx, val)
+        case reflect.Map:
+                return decodeBodyToMap(body, ctx, val)
+        default:
+                panic(fmt.Sprintf("target value must be pointer to struct or map, not %s", et.String()))
+        }
+}
+
+func decodeBodyToStruct(body hcl.Body, ctx *hcl.EvalContext, val reflect.Value) hcl.Diagnostics {
+        schema, partial := ImpliedBodySchema(val.Interface())
+
+        var content *hcl.BodyContent
+        var leftovers hcl.Body
+        var diags hcl.Diagnostics
+        if partial {
+                content, leftovers, diags = body.PartialContent(schema)
+        } else {
+                content, diags = body.Content(schema)
+        }
+        if content == nil {
+                return diags
+        }
+
+        tags := getFieldTags(val.Type())
+
+        if tags.Remain != nil {
+                fieldIdx := *tags.Remain
+                field := val.Type().Field(fieldIdx)
+                fieldV := val.Field(fieldIdx)
+                switch {
+                case bodyType.AssignableTo(field.Type):
+                        fieldV.Set(reflect.ValueOf(leftovers))
+                case attrsType.AssignableTo(field.Type):
+                        attrs, attrsDiags := leftovers.JustAttributes()
+                        if len(attrsDiags) > 0 {
+                                diags = append(diags, attrsDiags...)
+                        }
+                        fieldV.Set(reflect.ValueOf(attrs))
+                default:
+                        diags = append(diags, decodeBodyToValue(leftovers, ctx, fieldV)...)
+                }
+        }
+
+        for name, fieldIdx := range tags.Attributes {
+                attr := content.Attributes[name]
+                field := val.Type().Field(fieldIdx)
+                fieldV := val.Field(fieldIdx)
+
+                if attr == nil {
+                        if !exprType.AssignableTo(field.Type) {
+                                continue
+                        }
+
+                        // As a special case, if the target is of type hcl.Expression then
+                        // we'll assign an actual expression that evalues to a cty null,
+                        // so the caller can deal with it within the cty realm rather
+                        // than within the Go realm.
+                        synthExpr := hcl.StaticExpr(cty.NullVal(cty.DynamicPseudoType), body.MissingItemRange())
+                        fieldV.Set(reflect.ValueOf(synthExpr))
+                        continue
+                }
+
+                switch {
+                case attrType.AssignableTo(field.Type):
+                        fieldV.Set(reflect.ValueOf(attr))
+                case exprType.AssignableTo(field.Type):
+                        fieldV.Set(reflect.ValueOf(attr.Expr))
+                default:
+                        diags = append(diags, DecodeExpression(
+                                attr.Expr, ctx, fieldV.Addr().Interface(),
+                        )...)
+                }
+        }
+
+        blocksByType := content.Blocks.ByType()
+
+        for typeName, fieldIdx := range tags.Blocks {
+                blocks := blocksByType[typeName]
+                field := val.Type().Field(fieldIdx)
+
+                ty := field.Type
+                isSlice := false
+                isPtr := false
+                if ty.Kind() == reflect.Slice {
+                        isSlice = true
+                        ty = ty.Elem()
+                }
+                if ty.Kind() == reflect.Ptr {
+                        isPtr = true
+                        ty = ty.Elem()
+                }
+
+                if len(blocks) > 1 && !isSlice {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  fmt.Sprintf("Duplicate %s block", typeName),
+                                Detail: fmt.Sprintf(
+                                        "Only one %s block is allowed. Another was defined at %s.",
+                                        typeName, blocks[0].DefRange.String(),
+                                ),
+                                Subject: &blocks[1].DefRange,
+                        })
+                        continue
+                }
+
+                if len(blocks) == 0 {
+                        if isSlice || isPtr {
+                                val.Field(fieldIdx).Set(reflect.Zero(field.Type))
+                        } else {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  fmt.Sprintf("Missing %s block", typeName),
+                                        Detail:   fmt.Sprintf("A %s block is required.", typeName),
+                                        Subject:  body.MissingItemRange().Ptr(),
+                                })
+                        }
+                        continue
+                }
+
+                switch {
+
+                case isSlice:
+                        elemType := ty
+                        if isPtr {
+                                elemType = reflect.PtrTo(ty)
+                        }
+                        sli := reflect.MakeSlice(reflect.SliceOf(elemType), len(blocks), len(blocks))
+
+                        for i, block := range blocks {
+                                if isPtr {
+                                        v := reflect.New(ty)
+                                        diags = append(diags, decodeBlockToValue(block, ctx, v.Elem())...)
+                                        sli.Index(i).Set(v)
+                                } else {
+                                        diags = append(diags, decodeBlockToValue(block, ctx, sli.Index(i))...)
+                                }
+                        }
+
+                        val.Field(fieldIdx).Set(sli)
+
+                default:
+                        block := blocks[0]
+                        if isPtr {
+                                v := reflect.New(ty)
+                                diags = append(diags, decodeBlockToValue(block, ctx, v.Elem())...)
+                                val.Field(fieldIdx).Set(v)
+                        } else {
+                                diags = append(diags, decodeBlockToValue(block, ctx, val.Field(fieldIdx))...)
+                        }
+
+                }
+
+        }
+
+        return diags
+}
+
+func decodeBodyToMap(body hcl.Body, ctx *hcl.EvalContext, v reflect.Value) hcl.Diagnostics {
+        attrs, diags := body.JustAttributes()
+        if attrs == nil {
+                return diags
+        }
+
+        mv := reflect.MakeMap(v.Type())
+
+        for k, attr := range attrs {
+                switch {
+                case attrType.AssignableTo(v.Type().Elem()):
+                        mv.SetMapIndex(reflect.ValueOf(k), reflect.ValueOf(attr))
+                case exprType.AssignableTo(v.Type().Elem()):
+                        mv.SetMapIndex(reflect.ValueOf(k), reflect.ValueOf(attr.Expr))
+                default:
+                        ev := reflect.New(v.Type().Elem())
+                        diags = append(diags, DecodeExpression(attr.Expr, ctx, ev.Interface())...)
+                        mv.SetMapIndex(reflect.ValueOf(k), ev.Elem())
+                }
+        }
+
+        v.Set(mv)
+
+        return diags
+}
+
+func decodeBlockToValue(block *hcl.Block, ctx *hcl.EvalContext, v reflect.Value) hcl.Diagnostics {
+        var diags hcl.Diagnostics
+
+        ty := v.Type()
+
+        switch {
+        case blockType.AssignableTo(ty):
+                v.Elem().Set(reflect.ValueOf(block))
+        case bodyType.AssignableTo(ty):
+                v.Elem().Set(reflect.ValueOf(block.Body))
+        case attrsType.AssignableTo(ty):
+                attrs, attrsDiags := block.Body.JustAttributes()
+                if len(attrsDiags) > 0 {
+                        diags = append(diags, attrsDiags...)
+                }
+                v.Elem().Set(reflect.ValueOf(attrs))
+        default:
+                diags = append(diags, decodeBodyToValue(block.Body, ctx, v)...)
+
+                if len(block.Labels) > 0 {
+                        blockTags := getFieldTags(ty)
+                        for li, lv := range block.Labels {
+                                lfieldIdx := blockTags.Labels[li].FieldIndex
+                                v.Field(lfieldIdx).Set(reflect.ValueOf(lv))
+                        }
+                }
+
+        }
+
+        return diags
+}
+
+// DecodeExpression extracts the value of the given expression into the given
+// value. This value must be something that gocty is able to decode into,
+// since the final decoding is delegated to that package.
+//
+// The given EvalContext is used to resolve any variables or functions in
+// expressions encountered while decoding. This may be nil to require only
+// constant values, for simple applications that do not support variables or
+// functions.
+//
+// The returned diagnostics should be inspected with its HasErrors method to
+// determine if the populated value is valid and complete. If error diagnostics
+// are returned then the given value may have been partially-populated but
+// may still be accessed by a careful caller for static analysis and editor
+// integration use-cases.
+func DecodeExpression(expr hcl.Expression, ctx *hcl.EvalContext, val interface{}) hcl.Diagnostics {
+        srcVal, diags := expr.Value(ctx)
+
+        convTy, err := gocty.ImpliedType(val)
+        if err != nil {
+                panic(fmt.Sprintf("unsuitable DecodeExpression target: %s", err))
+        }
+
+        srcVal, err = convert.Convert(srcVal, convTy)
+        if err != nil {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Unsuitable value type",
+                        Detail:   fmt.Sprintf("Unsuitable value: %s", err.Error()),
+                        Subject:  expr.StartRange().Ptr(),
+                        Context:  expr.Range().Ptr(),
+                })
+                return diags
+        }
+
+        err = gocty.FromCtyValue(srcVal, val)
+        if err != nil {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Unsuitable value type",
+                        Detail:   fmt.Sprintf("Unsuitable value: %s", err.Error()),
+                        Subject:  expr.StartRange().Ptr(),
+                        Context:  expr.Range().Ptr(),
+                })
+        }
+
+        return diags
+}
diff --git a/vendor/github.com/hashicorp/hcl2/gohcl/doc.go b/vendor/github.com/hashicorp/hcl2/gohcl/doc.go
new file mode 100644
index 0000000..8500214
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/gohcl/doc.go
@@ -0,0 +1,49 @@
+// Package gohcl allows decoding HCL configurations into Go data structures.
+//
+// It provides a convenient and concise way of describing the schema for
+// configuration and then accessing the resulting data via native Go
+// types.
+//
+// A struct field tag scheme is used, similar to other decoding and
+// unmarshalling libraries. The tags are formatted as in the following example:
+//
+//    ThingType string `hcl:"thing_type,attr"`
+//
+// Within each tag there are two comma-separated tokens. The first is the
+// name of the corresponding construct in configuration, while the second
+// is a keyword giving the kind of construct expected. The following
+// kind keywords are supported:
+//
+//    attr (the default) indicates that the value is to be populated from an attribute
+//    block indicates that the value is to populated from a block
+//    label indicates that the value is to populated from a block label
+//    remain indicates that the value is to be populated from the remaining body after populating other fields
+//
+// "attr" fields may either be of type *hcl.Expression, in which case the raw
+// expression is assigned, or of any type accepted by gocty, in which case
+// gocty will be used to assign the value to a native Go type.
+//
+// "block" fields may be of type *hcl.Block or hcl.Body, in which case the
+// corresponding raw value is assigned, or may be a struct that recursively
+// uses the same tags. Block fields may also be slices of any of these types,
+// in which case multiple blocks of the corresponding type are decoded into
+// the slice.
+//
+// "label" fields are considered only in a struct used as the type of a field
+// marked as "block", and are used sequentially to capture the labels of
+// the blocks being decoded. In this case, the name token is used only as
+// an identifier for the label in diagnostic messages.
+//
+// "remain" can be placed on a single field that may be either of type
+// hcl.Body or hcl.Attributes, in which case any remaining body content is
+// placed into this field for delayed processing. If no "remain" field is
+// present then any attributes or blocks not matched by another valid tag
+// will cause an error diagnostic.
+//
+// Broadly-speaking this package deals with two types of error. The first is
+// errors in the configuration itself, which are returned as diagnostics
+// written with the configuration author as the target audience. The second
+// is bugs in the calling program, such as invalid struct tags, which are
+// surfaced via panics since there can be no useful runtime handling of such
+// errors and they should certainly not be returned to the user as diagnostics.
+package gohcl
diff --git a/vendor/github.com/hashicorp/hcl2/gohcl/schema.go b/vendor/github.com/hashicorp/hcl2/gohcl/schema.go
new file mode 100644
index 0000000..88164cb
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/gohcl/schema.go
@@ -0,0 +1,174 @@
+package gohcl
+
+import (
+        "fmt"
+        "reflect"
+        "sort"
+        "strings"
+
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+// ImpliedBodySchema produces a hcl.BodySchema derived from the type of the
+// given value, which must be a struct value or a pointer to one. If an
+// inappropriate value is passed, this function will panic.
+//
+// The second return argument indicates whether the given struct includes
+// a "remain" field, and thus the returned schema is non-exhaustive.
+//
+// This uses the tags on the fields of the struct to discover how each
+// field's value should be expressed within configuration. If an invalid
+// mapping is attempted, this function will panic.
+func ImpliedBodySchema(val interface{}) (schema *hcl.BodySchema, partial bool) {
+        ty := reflect.TypeOf(val)
+
+        if ty.Kind() == reflect.Ptr {
+                ty = ty.Elem()
+        }
+
+        if ty.Kind() != reflect.Struct {
+                panic(fmt.Sprintf("given value must be struct, not %T", val))
+        }
+
+        var attrSchemas []hcl.AttributeSchema
+        var blockSchemas []hcl.BlockHeaderSchema
+
+        tags := getFieldTags(ty)
+
+        attrNames := make([]string, 0, len(tags.Attributes))
+        for n := range tags.Attributes {
+                attrNames = append(attrNames, n)
+        }
+        sort.Strings(attrNames)
+        for _, n := range attrNames {
+                idx := tags.Attributes[n]
+                optional := tags.Optional[n]
+                field := ty.Field(idx)
+
+                var required bool
+
+                switch {
+                case field.Type.AssignableTo(exprType):
+                        // If we're decoding to hcl.Expression then absense can be
+                        // indicated via a null value, so we don't specify that
+                        // the field is required during decoding.
+                        required = false
+                case field.Type.Kind() != reflect.Ptr && !optional:
+                        required = true
+                default:
+                        required = false
+                }
+
+                attrSchemas = append(attrSchemas, hcl.AttributeSchema{
+                        Name:     n,
+                        Required: required,
+                })
+        }
+
+        blockNames := make([]string, 0, len(tags.Blocks))
+        for n := range tags.Blocks {
+                blockNames = append(blockNames, n)
+        }
+        sort.Strings(blockNames)
+        for _, n := range blockNames {
+                idx := tags.Blocks[n]
+                field := ty.Field(idx)
+                fty := field.Type
+                if fty.Kind() == reflect.Slice {
+                        fty = fty.Elem()
+                }
+                if fty.Kind() == reflect.Ptr {
+                        fty = fty.Elem()
+                }
+                if fty.Kind() != reflect.Struct {
+                        panic(fmt.Sprintf(
+                                "hcl 'block' tag kind cannot be applied to %s field %s: struct required", field.Type.String(), field.Name,
+                        ))
+                }
+                ftags := getFieldTags(fty)
+                var labelNames []string
+                if len(ftags.Labels) > 0 {
+                        labelNames = make([]string, len(ftags.Labels))
+                        for i, l := range ftags.Labels {
+                                labelNames[i] = l.Name
+                        }
+                }
+
+                blockSchemas = append(blockSchemas, hcl.BlockHeaderSchema{
+                        Type:       n,
+                        LabelNames: labelNames,
+                })
+        }
+
+        partial = tags.Remain != nil
+        schema = &hcl.BodySchema{
+                Attributes: attrSchemas,
+                Blocks:     blockSchemas,
+        }
+        return schema, partial
+}
+
+type fieldTags struct {
+        Attributes map[string]int
+        Blocks     map[string]int
+        Labels     []labelField
+        Remain     *int
+        Optional   map[string]bool
+}
+
+type labelField struct {
+        FieldIndex int
+        Name       string
+}
+
+func getFieldTags(ty reflect.Type) *fieldTags {
+        ret := &fieldTags{
+                Attributes: map[string]int{},
+                Blocks:     map[string]int{},
+                Optional:   map[string]bool{},
+        }
+
+        ct := ty.NumField()
+        for i := 0; i < ct; i++ {
+                field := ty.Field(i)
+                tag := field.Tag.Get("hcl")
+                if tag == "" {
+                        continue
+                }
+
+                comma := strings.Index(tag, ",")
+                var name, kind string
+                if comma != -1 {
+                        name = tag[:comma]
+                        kind = tag[comma+1:]
+                } else {
+                        name = tag
+                        kind = "attr"
+                }
+
+                switch kind {
+                case "attr":
+                        ret.Attributes[name] = i
+                case "block":
+                        ret.Blocks[name] = i
+                case "label":
+                        ret.Labels = append(ret.Labels, labelField{
+                                FieldIndex: i,
+                                Name:       name,
+                        })
+                case "remain":
+                        if ret.Remain != nil {
+                                panic("only one 'remain' tag is permitted")
+                        }
+                        idx := i // copy, because this loop will continue assigning to i
+                        ret.Remain = &idx
+                case "optional":
+                        ret.Attributes[name] = i
+                        ret.Optional[name] = true
+                default:
+                        panic(fmt.Sprintf("invalid hcl field tag kind %q on %s %q", kind, field.Type.String(), field.Name))
+                }
+        }
+
+        return ret
+}
diff --git a/vendor/github.com/hashicorp/hcl2/gohcl/types.go b/vendor/github.com/hashicorp/hcl2/gohcl/types.go
new file mode 100644
index 0000000..a94f275
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/gohcl/types.go
@@ -0,0 +1,16 @@
+package gohcl
+
+import (
+        "reflect"
+
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+var victimExpr hcl.Expression
+var victimBody hcl.Body
+
+var exprType = reflect.TypeOf(&victimExpr).Elem()
+var bodyType = reflect.TypeOf(&victimBody).Elem()
+var blockType = reflect.TypeOf((*hcl.Block)(nil))
+var attrType = reflect.TypeOf((*hcl.Attribute)(nil))
+var attrsType = reflect.TypeOf(hcl.Attributes(nil))
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/diagnostic.go b/vendor/github.com/hashicorp/hcl2/hcl/diagnostic.go
new file mode 100644
index 0000000..6ecf744
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/diagnostic.go
@@ -0,0 +1,103 @@
+package hcl
+
+import (
+        "fmt"
+)
+
+// DiagnosticSeverity represents the severity of a diagnostic.
+type DiagnosticSeverity int
+
+const (
+        // DiagInvalid is the invalid zero value of DiagnosticSeverity
+        DiagInvalid DiagnosticSeverity = iota
+
+        // DiagError indicates that the problem reported by a diagnostic prevents
+        // further progress in parsing and/or evaluating the subject.
+        DiagError
+
+        // DiagWarning indicates that the problem reported by a diagnostic warrants
+        // user attention but does not prevent further progress. It is most
+        // commonly used for showing deprecation notices.
+        DiagWarning
+)
+
+// Diagnostic represents information to be presented to a user about an
+// error or anomoly in parsing or evaluating configuration.
+type Diagnostic struct {
+        Severity DiagnosticSeverity
+
+        // Summary and detail contain the English-language description of the
+        // problem. Summary is a terse description of the general problem and
+        // detail is a more elaborate, often-multi-sentence description of
+        // the probem and what might be done to solve it.
+        Summary string
+        Detail  string
+        Subject *Range
+        Context *Range
+}
+
+// Diagnostics is a list of Diagnostic instances.
+type Diagnostics []*Diagnostic
+
+// error implementation, so that diagnostics can be returned via APIs
+// that normally deal in vanilla Go errors.
+//
+// This presents only minimal context about the error, for compatibility
+// with usual expectations about how errors will present as strings.
+func (d *Diagnostic) Error() string {
+        return fmt.Sprintf("%s: %s; %s", d.Subject, d.Summary, d.Detail)
+}
+
+// error implementation, so that sets of diagnostics can be returned via
+// APIs that normally deal in vanilla Go errors.
+func (d Diagnostics) Error() string {
+        count := len(d)
+        switch {
+        case count == 0:
+                return "no diagnostics"
+        case count == 1:
+                return d[0].Error()
+        default:
+                return fmt.Sprintf("%s, and %d other diagnostic(s)", d[0].Error(), count-1)
+        }
+}
+
+// Append appends a new error to a Diagnostics and return the whole Diagnostics.
+//
+// This is provided as a convenience for returning from a function that
+// collects and then returns a set of diagnostics:
+//
+//     return nil, diags.Append(&hcl.Diagnostic{ ... })
+//
+// Note that this modifies the array underlying the diagnostics slice, so
+// must be used carefully within a single codepath. It is incorrect (and rude)
+// to extend a diagnostics created by a different subsystem.
+func (d Diagnostics) Append(diag *Diagnostic) Diagnostics {
+        return append(d, diag)
+}
+
+// Extend concatenates the given Diagnostics with the receiver and returns
+// the whole new Diagnostics.
+//
+// This is similar to Append but accepts multiple diagnostics to add. It has
+// all the same caveats and constraints.
+func (d Diagnostics) Extend(diags Diagnostics) Diagnostics {
+        return append(d, diags...)
+}
+
+// HasErrors returns true if the receiver contains any diagnostics of
+// severity DiagError.
+func (d Diagnostics) HasErrors() bool {
+        for _, diag := range d {
+                if diag.Severity == DiagError {
+                        return true
+                }
+        }
+        return false
+}
+
+// A DiagnosticWriter emits diagnostics somehow.
+type DiagnosticWriter interface {
+        WriteDiagnostic(*Diagnostic) error
+        WriteDiagnostics(Diagnostics) error
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/diagnostic_text.go b/vendor/github.com/hashicorp/hcl2/hcl/diagnostic_text.go
new file mode 100644
index 0000000..dfa473a
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/diagnostic_text.go
@@ -0,0 +1,168 @@
+package hcl
+
+import (
+        "bufio"
+        "errors"
+        "fmt"
+        "io"
+
+        wordwrap "github.com/mitchellh/go-wordwrap"
+)
+
+type diagnosticTextWriter struct {
+        files map[string]*File
+        wr    io.Writer
+        width uint
+        color bool
+}
+
+// NewDiagnosticTextWriter creates a DiagnosticWriter that writes diagnostics
+// to the given writer as formatted text.
+//
+// It is designed to produce text appropriate to print in a monospaced font
+// in a terminal of a particular width, or optionally with no width limit.
+//
+// The given width may be zero to disable word-wrapping of the detail text
+// and truncation of source code snippets.
+//
+// If color is set to true, the output will include VT100 escape sequences to
+// color-code the severity indicators. It is suggested to turn this off if
+// the target writer is not a terminal.
+func NewDiagnosticTextWriter(wr io.Writer, files map[string]*File, width uint, color bool) DiagnosticWriter {
+        return &diagnosticTextWriter{
+                files: files,
+                wr:    wr,
+                width: width,
+                color: color,
+        }
+}
+
+func (w *diagnosticTextWriter) WriteDiagnostic(diag *Diagnostic) error {
+        if diag == nil {
+                return errors.New("nil diagnostic")
+        }
+
+        var colorCode, highlightCode, resetCode string
+        if w.color {
+                switch diag.Severity {
+                case DiagError:
+                        colorCode = "\x1b[31m"
+                case DiagWarning:
+                        colorCode = "\x1b[33m"
+                }
+                resetCode = "\x1b[0m"
+                highlightCode = "\x1b[1;4m"
+        }
+
+        var severityStr string
+        switch diag.Severity {
+        case DiagError:
+                severityStr = "Error"
+        case DiagWarning:
+                severityStr = "Warning"
+        default:
+                // should never happen
+                severityStr = "???????"
+        }
+
+        fmt.Fprintf(w.wr, "%s%s%s: %s\n\n", colorCode, severityStr, resetCode, diag.Summary)
+
+        if diag.Subject != nil {
+                snipRange := *diag.Subject
+                highlightRange := snipRange
+                if diag.Context != nil {
+                        // Show enough of the source code to include both the subject
+                        // and context ranges, which overlap in all reasonable
+                        // situations.
+                        snipRange = RangeOver(snipRange, *diag.Context)
+                }
+                // We can't illustrate an empty range, so we'll turn such ranges into
+                // single-character ranges, which might not be totally valid (may point
+                // off the end of a line, or off the end of the file) but are good
+                // enough for the bounds checks we do below.
+                if snipRange.Empty() {
+                        snipRange.End.Byte++
+                        snipRange.End.Column++
+                }
+                if highlightRange.Empty() {
+                        highlightRange.End.Byte++
+                        highlightRange.End.Column++
+                }
+
+                file := w.files[diag.Subject.Filename]
+                if file == nil || file.Bytes == nil {
+                        fmt.Fprintf(w.wr, "  on %s line %d:\n  (source code not available)\n\n", diag.Subject.Filename, diag.Subject.Start.Line)
+                } else {
+
+                        var contextLine string
+                        if diag.Subject != nil {
+                                contextLine = contextString(file, diag.Subject.Start.Byte)
+                                if contextLine != "" {
+                                        contextLine = ", in " + contextLine
+                                }
+                        }
+
+                        fmt.Fprintf(w.wr, "  on %s line %d%s:\n", diag.Subject.Filename, diag.Subject.Start.Line, contextLine)
+
+                        src := file.Bytes
+                        sc := NewRangeScanner(src, diag.Subject.Filename, bufio.ScanLines)
+
+                        for sc.Scan() {
+                                lineRange := sc.Range()
+                                if !lineRange.Overlaps(snipRange) {
+                                        continue
+                                }
+
+                                beforeRange, highlightedRange, afterRange := lineRange.PartitionAround(highlightRange)
+                                if highlightedRange.Empty() {
+                                        fmt.Fprintf(w.wr, "%4d: %s\n", lineRange.Start.Line, sc.Bytes())
+                                } else {
+                                        before := beforeRange.SliceBytes(src)
+                                        highlighted := highlightedRange.SliceBytes(src)
+                                        after := afterRange.SliceBytes(src)
+                                        fmt.Fprintf(
+                                                w.wr, "%4d: %s%s%s%s%s\n",
+                                                lineRange.Start.Line,
+                                                before,
+                                                highlightCode, highlighted, resetCode,
+                                                after,
+                                        )
+                                }
+
+                        }
+
+                        w.wr.Write([]byte{'\n'})
+                }
+        }
+
+        if diag.Detail != "" {
+                detail := diag.Detail
+                if w.width != 0 {
+                        detail = wordwrap.WrapString(detail, w.width)
+                }
+                fmt.Fprintf(w.wr, "%s\n\n", detail)
+        }
+
+        return nil
+}
+
+func (w *diagnosticTextWriter) WriteDiagnostics(diags Diagnostics) error {
+        for _, diag := range diags {
+                err := w.WriteDiagnostic(diag)
+                if err != nil {
+                        return err
+                }
+        }
+        return nil
+}
+
+func contextString(file *File, offset int) string {
+        type contextStringer interface {
+                ContextString(offset int) string
+        }
+
+        if cser, ok := file.Nav.(contextStringer); ok {
+                return cser.ContextString(offset)
+        }
+        return ""
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/didyoumean.go b/vendor/github.com/hashicorp/hcl2/hcl/didyoumean.go
new file mode 100644
index 0000000..c128334
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/didyoumean.go
@@ -0,0 +1,24 @@
+package hcl
+
+import (
+        "github.com/agext/levenshtein"
+)
+
+// nameSuggestion tries to find a name from the given slice of suggested names
+// that is close to the given name and returns it if found. If no suggestion
+// is close enough, returns the empty string.
+//
+// The suggestions are tried in order, so earlier suggestions take precedence
+// if the given string is similar to two or more suggestions.
+//
+// This function is intended to be used with a relatively-small number of
+// suggestions. It's not optimized for hundreds or thousands of them.
+func nameSuggestion(given string, suggestions []string) string {
+        for _, suggestion := range suggestions {
+                dist := levenshtein.Distance(given, suggestion, nil)
+                if dist < 3 { // threshold determined experimentally
+                        return suggestion
+                }
+        }
+        return ""
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/doc.go b/vendor/github.com/hashicorp/hcl2/hcl/doc.go
new file mode 100644
index 0000000..01318c9
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/doc.go
@@ -0,0 +1 @@
+package hcl
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/eval_context.go b/vendor/github.com/hashicorp/hcl2/hcl/eval_context.go
new file mode 100644
index 0000000..915910a
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/eval_context.go
@@ -0,0 +1,25 @@
+package hcl
+
+import (
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/function"
+)
+
+// An EvalContext provides the variables and functions that should be used
+// to evaluate an expression.
+type EvalContext struct {
+        Variables map[string]cty.Value
+        Functions map[string]function.Function
+        parent    *EvalContext
+}
+
+// NewChild returns a new EvalContext that is a child of the receiver.
+func (ctx *EvalContext) NewChild() *EvalContext {
+        return &EvalContext{parent: ctx}
+}
+
+// Parent returns the parent of the receiver, or nil if the receiver has
+// no parent.
+func (ctx *EvalContext) Parent() *EvalContext {
+        return ctx.parent
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/expr_call.go b/vendor/github.com/hashicorp/hcl2/hcl/expr_call.go
new file mode 100644
index 0000000..6963fba
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/expr_call.go
@@ -0,0 +1,46 @@
+package hcl
+
+// ExprCall tests if the given expression is a function call and,
+// if so, extracts the function name and the expressions that represent
+// the arguments. If the given expression is not statically a function call,
+// error diagnostics are returned.
+//
+// A particular Expression implementation can support this function by
+// offering a method called ExprCall that takes no arguments and returns
+// *StaticCall. This method should return nil if a static call cannot
+// be extracted.  Alternatively, an implementation can support
+// UnwrapExpression to delegate handling of this function to a wrapped
+// Expression object.
+func ExprCall(expr Expression) (*StaticCall, Diagnostics) {
+        type exprCall interface {
+                ExprCall() *StaticCall
+        }
+
+        physExpr := UnwrapExpressionUntil(expr, func(expr Expression) bool {
+                _, supported := expr.(exprCall)
+                return supported
+        })
+
+        if exC, supported := physExpr.(exprCall); supported {
+                if call := exC.ExprCall(); call != nil {
+                        return call, nil
+                }
+        }
+        return nil, Diagnostics{
+                &Diagnostic{
+                        Severity: DiagError,
+                        Summary:  "Invalid expression",
+                        Detail:   "A static function call is required.",
+                        Subject:  expr.StartRange().Ptr(),
+                },
+        }
+}
+
+// StaticCall represents a function call that was extracted statically from
+// an expression using ExprCall.
+type StaticCall struct {
+        Name      string
+        NameRange Range
+        Arguments []Expression
+        ArgsRange Range
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/expr_list.go b/vendor/github.com/hashicorp/hcl2/hcl/expr_list.go
new file mode 100644
index 0000000..d05cca0
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/expr_list.go
@@ -0,0 +1,37 @@
+package hcl
+
+// ExprList tests if the given expression is a static list construct and,
+// if so, extracts the expressions that represent the list elements.
+// If the given expression is not a static list, error diagnostics are
+// returned.
+//
+// A particular Expression implementation can support this function by
+// offering a method called ExprList that takes no arguments and returns
+// []Expression. This method should return nil if a static list cannot
+// be extracted.  Alternatively, an implementation can support
+// UnwrapExpression to delegate handling of this function to a wrapped
+// Expression object.
+func ExprList(expr Expression) ([]Expression, Diagnostics) {
+        type exprList interface {
+                ExprList() []Expression
+        }
+
+        physExpr := UnwrapExpressionUntil(expr, func(expr Expression) bool {
+                _, supported := expr.(exprList)
+                return supported
+        })
+
+        if exL, supported := physExpr.(exprList); supported {
+                if list := exL.ExprList(); list != nil {
+                        return list, nil
+                }
+        }
+        return nil, Diagnostics{
+                &Diagnostic{
+                        Severity: DiagError,
+                        Summary:  "Invalid expression",
+                        Detail:   "A static list expression is required.",
+                        Subject:  expr.StartRange().Ptr(),
+                },
+        }
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/expr_map.go b/vendor/github.com/hashicorp/hcl2/hcl/expr_map.go
new file mode 100644
index 0000000..96d1ce4
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/expr_map.go
@@ -0,0 +1,44 @@
+package hcl
+
+// ExprMap tests if the given expression is a static map construct and,
+// if so, extracts the expressions that represent the map elements.
+// If the given expression is not a static map, error diagnostics are
+// returned.
+//
+// A particular Expression implementation can support this function by
+// offering a method called ExprMap that takes no arguments and returns
+// []KeyValuePair. This method should return nil if a static map cannot
+// be extracted.  Alternatively, an implementation can support
+// UnwrapExpression to delegate handling of this function to a wrapped
+// Expression object.
+func ExprMap(expr Expression) ([]KeyValuePair, Diagnostics) {
+        type exprMap interface {
+                ExprMap() []KeyValuePair
+        }
+
+        physExpr := UnwrapExpressionUntil(expr, func(expr Expression) bool {
+                _, supported := expr.(exprMap)
+                return supported
+        })
+
+        if exM, supported := physExpr.(exprMap); supported {
+                if pairs := exM.ExprMap(); pairs != nil {
+                        return pairs, nil
+                }
+        }
+        return nil, Diagnostics{
+                &Diagnostic{
+                        Severity: DiagError,
+                        Summary:  "Invalid expression",
+                        Detail:   "A static map expression is required.",
+                        Subject:  expr.StartRange().Ptr(),
+                },
+        }
+}
+
+// KeyValuePair represents a pair of expressions that serve as a single item
+// within a map or object definition construct.
+type KeyValuePair struct {
+        Key   Expression
+        Value Expression
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/expr_unwrap.go b/vendor/github.com/hashicorp/hcl2/hcl/expr_unwrap.go
new file mode 100644
index 0000000..6d5d205
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/expr_unwrap.go
@@ -0,0 +1,68 @@
+package hcl
+
+type unwrapExpression interface {
+        UnwrapExpression() Expression
+}
+
+// UnwrapExpression removes any "wrapper" expressions from the given expression,
+// to recover the representation of the physical expression given in source
+// code.
+//
+// Sometimes wrapping expressions are used to modify expression behavior, e.g.
+// in extensions that need to make some local variables available to certain
+// sub-trees of the configuration. This can make it difficult to reliably
+// type-assert on the physical AST types used by the underlying syntax.
+//
+// Unwrapping an expression may modify its behavior by stripping away any
+// additional constraints or capabilities being applied to the Value and
+// Variables methods, so this function should generally only be used prior
+// to operations that concern themselves with the static syntax of the input
+// configuration, and not with the effective value of the expression.
+//
+// Wrapper expression types must support unwrapping by implementing a method
+// called UnwrapExpression that takes no arguments and returns the embedded
+// Expression. Implementations of this method should peel away only one level
+// of wrapping, if multiple are present. This method may return nil to
+// indicate _dynamically_ that no wrapped expression is available, for
+// expression types that might only behave as wrappers in certain cases.
+func UnwrapExpression(expr Expression) Expression {
+        for {
+                unwrap, wrapped := expr.(unwrapExpression)
+                if !wrapped {
+                        return expr
+                }
+                innerExpr := unwrap.UnwrapExpression()
+                if innerExpr == nil {
+                        return expr
+                }
+                expr = innerExpr
+        }
+}
+
+// UnwrapExpressionUntil is similar to UnwrapExpression except it gives the
+// caller an opportunity to test each level of unwrapping to see each a
+// particular expression is accepted.
+//
+// This could be used, for example, to unwrap until a particular other
+// interface is satisfied, regardless of wrap wrapping level it is satisfied
+// at.
+//
+// The given callback function must return false to continue wrapping, or
+// true to accept and return the proposed expression given. If the callback
+// function rejects even the final, physical expression then the result of
+// this function is nil.
+func UnwrapExpressionUntil(expr Expression, until func(Expression) bool) Expression {
+        for {
+                if until(expr) {
+                        return expr
+                }
+                unwrap, wrapped := expr.(unwrapExpression)
+                if !wrapped {
+                        return nil
+                }
+                expr = unwrap.UnwrapExpression()
+                if expr == nil {
+                        return nil
+                }
+        }
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/didyoumean.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/didyoumean.go
new file mode 100644
index 0000000..ccc1c0a
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/didyoumean.go
@@ -0,0 +1,24 @@
+package hclsyntax
+
+import (
+        "github.com/agext/levenshtein"
+)
+
+// nameSuggestion tries to find a name from the given slice of suggested names
+// that is close to the given name and returns it if found. If no suggestion
+// is close enough, returns the empty string.
+//
+// The suggestions are tried in order, so earlier suggestions take precedence
+// if the given string is similar to two or more suggestions.
+//
+// This function is intended to be used with a relatively-small number of
+// suggestions. It's not optimized for hundreds or thousands of them.
+func nameSuggestion(given string, suggestions []string) string {
+        for _, suggestion := range suggestions {
+                dist := levenshtein.Distance(given, suggestion, nil)
+                if dist < 3 { // threshold determined experimentally
+                        return suggestion
+                }
+        }
+        return ""
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/doc.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/doc.go
new file mode 100644
index 0000000..617bc29
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/doc.go
@@ -0,0 +1,7 @@
+// Package hclsyntax contains the parser, AST, etc for HCL's native language,
+// as opposed to the JSON variant.
+//
+// In normal use applications should rarely depend on this package directly,
+// instead preferring the higher-level interface of the main hcl package and
+// its companion package hclparse.
+package hclsyntax
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/expression.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/expression.go
new file mode 100644
index 0000000..cfc7cd9
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/expression.go
@@ -0,0 +1,1275 @@
+package hclsyntax
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+        "github.com/zclconf/go-cty/cty/function"
+)
+
+// Expression is the abstract type for nodes that behave as HCL expressions.
+type Expression interface {
+        Node
+
+        // The hcl.Expression methods are duplicated here, rather than simply
+        // embedded, because both Node and hcl.Expression have a Range method
+        // and so they conflict.
+
+        Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics)
+        Variables() []hcl.Traversal
+        StartRange() hcl.Range
+}
+
+// Assert that Expression implements hcl.Expression
+var assertExprImplExpr hcl.Expression = Expression(nil)
+
+// LiteralValueExpr is an expression that just always returns a given value.
+type LiteralValueExpr struct {
+        Val      cty.Value
+        SrcRange hcl.Range
+}
+
+func (e *LiteralValueExpr) walkChildNodes(w internalWalkFunc) {
+        // Literal values have no child nodes
+}
+
+func (e *LiteralValueExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        return e.Val, nil
+}
+
+func (e *LiteralValueExpr) Range() hcl.Range {
+        return e.SrcRange
+}
+
+func (e *LiteralValueExpr) StartRange() hcl.Range {
+        return e.SrcRange
+}
+
+// Implementation for hcl.AbsTraversalForExpr.
+func (e *LiteralValueExpr) AsTraversal() hcl.Traversal {
+        // This one's a little weird: the contract for AsTraversal is to interpret
+        // an expression as if it were traversal syntax, and traversal syntax
+        // doesn't have the special keywords "null", "true", and "false" so these
+        // are expected to be treated like variables in that case.
+        // Since our parser already turned them into LiteralValueExpr by the time
+        // we get here, we need to undo this and infer the name that would've
+        // originally led to our value.
+        // We don't do anything for any other values, since they don't overlap
+        // with traversal roots.
+
+        if e.Val.IsNull() {
+                // In practice the parser only generates null values of the dynamic
+                // pseudo-type for literals, so we can safely assume that any null
+                // was orignally the keyword "null".
+                return hcl.Traversal{
+                        hcl.TraverseRoot{
+                                Name:     "null",
+                                SrcRange: e.SrcRange,
+                        },
+                }
+        }
+
+        switch e.Val {
+        case cty.True:
+                return hcl.Traversal{
+                        hcl.TraverseRoot{
+                                Name:     "true",
+                                SrcRange: e.SrcRange,
+                        },
+                }
+        case cty.False:
+                return hcl.Traversal{
+                        hcl.TraverseRoot{
+                                Name:     "false",
+                                SrcRange: e.SrcRange,
+                        },
+                }
+        default:
+                // No traversal is possible for any other value.
+                return nil
+        }
+}
+
+// ScopeTraversalExpr is an Expression that retrieves a value from the scope
+// using a traversal.
+type ScopeTraversalExpr struct {
+        Traversal hcl.Traversal
+        SrcRange  hcl.Range
+}
+
+func (e *ScopeTraversalExpr) walkChildNodes(w internalWalkFunc) {
+        // Scope traversals have no child nodes
+}
+
+func (e *ScopeTraversalExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        return e.Traversal.TraverseAbs(ctx)
+}
+
+func (e *ScopeTraversalExpr) Range() hcl.Range {
+        return e.SrcRange
+}
+
+func (e *ScopeTraversalExpr) StartRange() hcl.Range {
+        return e.SrcRange
+}
+
+// Implementation for hcl.AbsTraversalForExpr.
+func (e *ScopeTraversalExpr) AsTraversal() hcl.Traversal {
+        return e.Traversal
+}
+
+// RelativeTraversalExpr is an Expression that retrieves a value from another
+// value using a _relative_ traversal.
+type RelativeTraversalExpr struct {
+        Source    Expression
+        Traversal hcl.Traversal
+        SrcRange  hcl.Range
+}
+
+func (e *RelativeTraversalExpr) walkChildNodes(w internalWalkFunc) {
+        // Scope traversals have no child nodes
+}
+
+func (e *RelativeTraversalExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        src, diags := e.Source.Value(ctx)
+        ret, travDiags := e.Traversal.TraverseRel(src)
+        diags = append(diags, travDiags...)
+        return ret, diags
+}
+
+func (e *RelativeTraversalExpr) Range() hcl.Range {
+        return e.SrcRange
+}
+
+func (e *RelativeTraversalExpr) StartRange() hcl.Range {
+        return e.SrcRange
+}
+
+// Implementation for hcl.AbsTraversalForExpr.
+func (e *RelativeTraversalExpr) AsTraversal() hcl.Traversal {
+        // We can produce a traversal only if our source can.
+        st, diags := hcl.AbsTraversalForExpr(e.Source)
+        if diags.HasErrors() {
+                return nil
+        }
+
+        ret := make(hcl.Traversal, len(st)+len(e.Traversal))
+        copy(ret, st)
+        copy(ret[len(st):], e.Traversal)
+        return ret
+}
+
+// FunctionCallExpr is an Expression that calls a function from the EvalContext
+// and returns its result.
+type FunctionCallExpr struct {
+        Name string
+        Args []Expression
+
+        // If true, the final argument should be a tuple, list or set which will
+        // expand to be one argument per element.
+        ExpandFinal bool
+
+        NameRange       hcl.Range
+        OpenParenRange  hcl.Range
+        CloseParenRange hcl.Range
+}
+
+func (e *FunctionCallExpr) walkChildNodes(w internalWalkFunc) {
+        for i, arg := range e.Args {
+                e.Args[i] = w(arg).(Expression)
+        }
+}
+
+func (e *FunctionCallExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+
+        var f function.Function
+        exists := false
+        hasNonNilMap := false
+        thisCtx := ctx
+        for thisCtx != nil {
+                if thisCtx.Functions == nil {
+                        thisCtx = thisCtx.Parent()
+                        continue
+                }
+                hasNonNilMap = true
+                f, exists = thisCtx.Functions[e.Name]
+                if exists {
+                        break
+                }
+                thisCtx = thisCtx.Parent()
+        }
+
+        if !exists {
+                if !hasNonNilMap {
+                        return cty.DynamicVal, hcl.Diagnostics{
+                                {
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Function calls not allowed",
+                                        Detail:   "Functions may not be called here.",
+                                        Subject:  e.Range().Ptr(),
+                                },
+                        }
+                }
+
+                avail := make([]string, 0, len(ctx.Functions))
+                for name := range ctx.Functions {
+                        avail = append(avail, name)
+                }
+                suggestion := nameSuggestion(e.Name, avail)
+                if suggestion != "" {
+                        suggestion = fmt.Sprintf(" Did you mean %q?", suggestion)
+                }
+
+                return cty.DynamicVal, hcl.Diagnostics{
+                        {
+                                Severity: hcl.DiagError,
+                                Summary:  "Call to unknown function",
+                                Detail:   fmt.Sprintf("There is no function named %q.%s", e.Name, suggestion),
+                                Subject:  &e.NameRange,
+                                Context:  e.Range().Ptr(),
+                        },
+                }
+        }
+
+        params := f.Params()
+        varParam := f.VarParam()
+
+        args := e.Args
+        if e.ExpandFinal {
+                if len(args) < 1 {
+                        // should never happen if the parser is behaving
+                        panic("ExpandFinal set on function call with no arguments")
+                }
+                expandExpr := args[len(args)-1]
+                expandVal, expandDiags := expandExpr.Value(ctx)
+                diags = append(diags, expandDiags...)
+                if expandDiags.HasErrors() {
+                        return cty.DynamicVal, diags
+                }
+
+                switch {
+                case expandVal.Type().IsTupleType() || expandVal.Type().IsListType() || expandVal.Type().IsSetType():
+                        if expandVal.IsNull() {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Invalid expanding argument value",
+                                        Detail:   "The expanding argument (indicated by ...) must not be null.",
+                                        Context:  expandExpr.Range().Ptr(),
+                                        Subject:  e.Range().Ptr(),
+                                })
+                                return cty.DynamicVal, diags
+                        }
+                        if !expandVal.IsKnown() {
+                                return cty.DynamicVal, diags
+                        }
+
+                        newArgs := make([]Expression, 0, (len(args)-1)+expandVal.LengthInt())
+                        newArgs = append(newArgs, args[:len(args)-1]...)
+                        it := expandVal.ElementIterator()
+                        for it.Next() {
+                                _, val := it.Element()
+                                newArgs = append(newArgs, &LiteralValueExpr{
+                                        Val:      val,
+                                        SrcRange: expandExpr.Range(),
+                                })
+                        }
+                        args = newArgs
+                default:
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid expanding argument value",
+                                Detail:   "The expanding argument (indicated by ...) must be of a tuple, list, or set type.",
+                                Context:  expandExpr.Range().Ptr(),
+                                Subject:  e.Range().Ptr(),
+                        })
+                        return cty.DynamicVal, diags
+                }
+        }
+
+        if len(args) < len(params) {
+                missing := params[len(args)]
+                qual := ""
+                if varParam != nil {
+                        qual = " at least"
+                }
+                return cty.DynamicVal, hcl.Diagnostics{
+                        {
+                                Severity: hcl.DiagError,
+                                Summary:  "Not enough function arguments",
+                                Detail: fmt.Sprintf(
+                                        "Function %q expects%s %d argument(s). Missing value for %q.",
+                                        e.Name, qual, len(params), missing.Name,
+                                ),
+                                Subject: &e.CloseParenRange,
+                                Context: e.Range().Ptr(),
+                        },
+                }
+        }
+
+        if varParam == nil && len(args) > len(params) {
+                return cty.DynamicVal, hcl.Diagnostics{
+                        {
+                                Severity: hcl.DiagError,
+                                Summary:  "Too many function arguments",
+                                Detail: fmt.Sprintf(
+                                        "Function %q expects only %d argument(s).",
+                                        e.Name, len(params),
+                                ),
+                                Subject: args[len(params)].StartRange().Ptr(),
+                                Context: e.Range().Ptr(),
+                        },
+                }
+        }
+
+        argVals := make([]cty.Value, len(args))
+
+        for i, argExpr := range args {
+                var param *function.Parameter
+                if i < len(params) {
+                        param = &params[i]
+                } else {
+                        param = varParam
+                }
+
+                val, argDiags := argExpr.Value(ctx)
+                if len(argDiags) > 0 {
+                        diags = append(diags, argDiags...)
+                }
+
+                // Try to convert our value to the parameter type
+                val, err := convert.Convert(val, param.Type)
+                if err != nil {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid function argument",
+                                Detail: fmt.Sprintf(
+                                        "Invalid value for %q parameter: %s.",
+                                        param.Name, err,
+                                ),
+                                Subject: argExpr.StartRange().Ptr(),
+                                Context: e.Range().Ptr(),
+                        })
+                }
+
+                argVals[i] = val
+        }
+
+        if diags.HasErrors() {
+                // Don't try to execute the function if we already have errors with
+                // the arguments, because the result will probably be a confusing
+                // error message.
+                return cty.DynamicVal, diags
+        }
+
+        resultVal, err := f.Call(argVals)
+        if err != nil {
+                switch terr := err.(type) {
+                case function.ArgError:
+                        i := terr.Index
+                        var param *function.Parameter
+                        if i < len(params) {
+                                param = &params[i]
+                        } else {
+                                param = varParam
+                        }
+                        argExpr := e.Args[i]
+
+                        // TODO: we should also unpick a PathError here and show the
+                        // path to the deep value where the error was detected.
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid function argument",
+                                Detail: fmt.Sprintf(
+                                        "Invalid value for %q parameter: %s.",
+                                        param.Name, err,
+                                ),
+                                Subject: argExpr.StartRange().Ptr(),
+                                Context: e.Range().Ptr(),
+                        })
+
+                default:
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Error in function call",
+                                Detail: fmt.Sprintf(
+                                        "Call to function %q failed: %s.",
+                                        e.Name, err,
+                                ),
+                                Subject: e.StartRange().Ptr(),
+                                Context: e.Range().Ptr(),
+                        })
+                }
+
+                return cty.DynamicVal, diags
+        }
+
+        return resultVal, diags
+}
+
+func (e *FunctionCallExpr) Range() hcl.Range {
+        return hcl.RangeBetween(e.NameRange, e.CloseParenRange)
+}
+
+func (e *FunctionCallExpr) StartRange() hcl.Range {
+        return hcl.RangeBetween(e.NameRange, e.OpenParenRange)
+}
+
+// Implementation for hcl.ExprCall.
+func (e *FunctionCallExpr) ExprCall() *hcl.StaticCall {
+        ret := &hcl.StaticCall{
+                Name:      e.Name,
+                NameRange: e.NameRange,
+                Arguments: make([]hcl.Expression, len(e.Args)),
+                ArgsRange: hcl.RangeBetween(e.OpenParenRange, e.CloseParenRange),
+        }
+        // Need to convert our own Expression objects into hcl.Expression.
+        for i, arg := range e.Args {
+                ret.Arguments[i] = arg
+        }
+        return ret
+}
+
+type ConditionalExpr struct {
+        Condition   Expression
+        TrueResult  Expression
+        FalseResult Expression
+
+        SrcRange hcl.Range
+}
+
+func (e *ConditionalExpr) walkChildNodes(w internalWalkFunc) {
+        e.Condition = w(e.Condition).(Expression)
+        e.TrueResult = w(e.TrueResult).(Expression)
+        e.FalseResult = w(e.FalseResult).(Expression)
+}
+
+func (e *ConditionalExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        trueResult, trueDiags := e.TrueResult.Value(ctx)
+        falseResult, falseDiags := e.FalseResult.Value(ctx)
+        var diags hcl.Diagnostics
+
+        // Try to find a type that both results can be converted to.
+        resultType, convs := convert.UnifyUnsafe([]cty.Type{trueResult.Type(), falseResult.Type()})
+        if resultType == cty.NilType {
+                return cty.DynamicVal, hcl.Diagnostics{
+                        {
+                                Severity: hcl.DiagError,
+                                Summary:  "Inconsistent conditional result types",
+                                Detail: fmt.Sprintf(
+                                        // FIXME: Need a helper function for showing natural-language type diffs,
+                                        // since this will generate some useless messages in some cases, like
+                                        // "These expressions are object and object respectively" if the
+                                        // object types don't exactly match.
+                                        "The true and false result expressions must have consistent types. The given expressions are %s and %s, respectively.",
+                                        trueResult.Type(), falseResult.Type(),
+                                ),
+                                Subject: hcl.RangeBetween(e.TrueResult.Range(), e.FalseResult.Range()).Ptr(),
+                                Context: &e.SrcRange,
+                        },
+                }
+        }
+
+        condResult, condDiags := e.Condition.Value(ctx)
+        diags = append(diags, condDiags...)
+        if condResult.IsNull() {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Null condition",
+                        Detail:   "The condition value is null. Conditions must either be true or false.",
+                        Subject:  e.Condition.Range().Ptr(),
+                        Context:  &e.SrcRange,
+                })
+                return cty.UnknownVal(resultType), diags
+        }
+        if !condResult.IsKnown() {
+                return cty.UnknownVal(resultType), diags
+        }
+        condResult, err := convert.Convert(condResult, cty.Bool)
+        if err != nil {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Incorrect condition type",
+                        Detail:   fmt.Sprintf("The condition expression must be of type bool."),
+                        Subject:  e.Condition.Range().Ptr(),
+                        Context:  &e.SrcRange,
+                })
+                return cty.UnknownVal(resultType), diags
+        }
+
+        if condResult.True() {
+                diags = append(diags, trueDiags...)
+                if convs[0] != nil {
+                        var err error
+                        trueResult, err = convs[0](trueResult)
+                        if err != nil {
+                                // Unsafe conversion failed with the concrete result value
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Inconsistent conditional result types",
+                                        Detail: fmt.Sprintf(
+                                                "The true result value has the wrong type: %s.",
+                                                err.Error(),
+                                        ),
+                                        Subject: e.TrueResult.Range().Ptr(),
+                                        Context: &e.SrcRange,
+                                })
+                                trueResult = cty.UnknownVal(resultType)
+                        }
+                }
+                return trueResult, diags
+        } else {
+                diags = append(diags, falseDiags...)
+                if convs[1] != nil {
+                        var err error
+                        falseResult, err = convs[1](falseResult)
+                        if err != nil {
+                                // Unsafe conversion failed with the concrete result value
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Inconsistent conditional result types",
+                                        Detail: fmt.Sprintf(
+                                                "The false result value has the wrong type: %s.",
+                                                err.Error(),
+                                        ),
+                                        Subject: e.TrueResult.Range().Ptr(),
+                                        Context: &e.SrcRange,
+                                })
+                                falseResult = cty.UnknownVal(resultType)
+                        }
+                }
+                return falseResult, diags
+        }
+}
+
+func (e *ConditionalExpr) Range() hcl.Range {
+        return e.SrcRange
+}
+
+func (e *ConditionalExpr) StartRange() hcl.Range {
+        return e.Condition.StartRange()
+}
+
+type IndexExpr struct {
+        Collection Expression
+        Key        Expression
+
+        SrcRange  hcl.Range
+        OpenRange hcl.Range
+}
+
+func (e *IndexExpr) walkChildNodes(w internalWalkFunc) {
+        e.Collection = w(e.Collection).(Expression)
+        e.Key = w(e.Key).(Expression)
+}
+
+func (e *IndexExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+        coll, collDiags := e.Collection.Value(ctx)
+        key, keyDiags := e.Key.Value(ctx)
+        diags = append(diags, collDiags...)
+        diags = append(diags, keyDiags...)
+
+        return hcl.Index(coll, key, &e.SrcRange)
+}
+
+func (e *IndexExpr) Range() hcl.Range {
+        return e.SrcRange
+}
+
+func (e *IndexExpr) StartRange() hcl.Range {
+        return e.OpenRange
+}
+
+type TupleConsExpr struct {
+        Exprs []Expression
+
+        SrcRange  hcl.Range
+        OpenRange hcl.Range
+}
+
+func (e *TupleConsExpr) walkChildNodes(w internalWalkFunc) {
+        for i, expr := range e.Exprs {
+                e.Exprs[i] = w(expr).(Expression)
+        }
+}
+
+func (e *TupleConsExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        var vals []cty.Value
+        var diags hcl.Diagnostics
+
+        vals = make([]cty.Value, len(e.Exprs))
+        for i, expr := range e.Exprs {
+                val, valDiags := expr.Value(ctx)
+                vals[i] = val
+                diags = append(diags, valDiags...)
+        }
+
+        return cty.TupleVal(vals), diags
+}
+
+func (e *TupleConsExpr) Range() hcl.Range {
+        return e.SrcRange
+}
+
+func (e *TupleConsExpr) StartRange() hcl.Range {
+        return e.OpenRange
+}
+
+// Implementation for hcl.ExprList
+func (e *TupleConsExpr) ExprList() []hcl.Expression {
+        ret := make([]hcl.Expression, len(e.Exprs))
+        for i, expr := range e.Exprs {
+                ret[i] = expr
+        }
+        return ret
+}
+
+type ObjectConsExpr struct {
+        Items []ObjectConsItem
+
+        SrcRange  hcl.Range
+        OpenRange hcl.Range
+}
+
+type ObjectConsItem struct {
+        KeyExpr   Expression
+        ValueExpr Expression
+}
+
+func (e *ObjectConsExpr) walkChildNodes(w internalWalkFunc) {
+        for i, item := range e.Items {
+                e.Items[i].KeyExpr = w(item.KeyExpr).(Expression)
+                e.Items[i].ValueExpr = w(item.ValueExpr).(Expression)
+        }
+}
+
+func (e *ObjectConsExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        var vals map[string]cty.Value
+        var diags hcl.Diagnostics
+
+        // This will get set to true if we fail to produce any of our keys,
+        // either because they are actually unknown or if the evaluation produces
+        // errors. In all of these case we must return DynamicPseudoType because
+        // we're unable to know the full set of keys our object has, and thus
+        // we can't produce a complete value of the intended type.
+        //
+        // We still evaluate all of the item keys and values to make sure that we
+        // get as complete as possible a set of diagnostics.
+        known := true
+
+        vals = make(map[string]cty.Value, len(e.Items))
+        for _, item := range e.Items {
+                key, keyDiags := item.KeyExpr.Value(ctx)
+                diags = append(diags, keyDiags...)
+
+                val, valDiags := item.ValueExpr.Value(ctx)
+                diags = append(diags, valDiags...)
+
+                if keyDiags.HasErrors() {
+                        known = false
+                        continue
+                }
+
+                if key.IsNull() {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Null value as key",
+                                Detail:   "Can't use a null value as a key.",
+                                Subject:  item.ValueExpr.Range().Ptr(),
+                        })
+                        known = false
+                        continue
+                }
+
+                var err error
+                key, err = convert.Convert(key, cty.String)
+                if err != nil {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Incorrect key type",
+                                Detail:   fmt.Sprintf("Can't use this value as a key: %s.", err.Error()),
+                                Subject:  item.ValueExpr.Range().Ptr(),
+                        })
+                        known = false
+                        continue
+                }
+
+                if !key.IsKnown() {
+                        known = false
+                        continue
+                }
+
+                keyStr := key.AsString()
+
+                vals[keyStr] = val
+        }
+
+        if !known {
+                return cty.DynamicVal, diags
+        }
+
+        return cty.ObjectVal(vals), diags
+}
+
+func (e *ObjectConsExpr) Range() hcl.Range {
+        return e.SrcRange
+}
+
+func (e *ObjectConsExpr) StartRange() hcl.Range {
+        return e.OpenRange
+}
+
+// Implementation for hcl.ExprMap
+func (e *ObjectConsExpr) ExprMap() []hcl.KeyValuePair {
+        ret := make([]hcl.KeyValuePair, len(e.Items))
+        for i, item := range e.Items {
+                ret[i] = hcl.KeyValuePair{
+                        Key:   item.KeyExpr,
+                        Value: item.ValueExpr,
+                }
+        }
+        return ret
+}
+
+// ObjectConsKeyExpr is a special wrapper used only for ObjectConsExpr keys,
+// which deals with the special case that a naked identifier in that position
+// must be interpreted as a literal string rather than evaluated directly.
+type ObjectConsKeyExpr struct {
+        Wrapped Expression
+}
+
+func (e *ObjectConsKeyExpr) literalName() string {
+        // This is our logic for deciding whether to behave like a literal string.
+        // We lean on our AbsTraversalForExpr implementation here, which already
+        // deals with some awkward cases like the expression being the result
+        // of the keywords "null", "true" and "false" which we'd want to interpret
+        // as keys here too.
+        return hcl.ExprAsKeyword(e.Wrapped)
+}
+
+func (e *ObjectConsKeyExpr) walkChildNodes(w internalWalkFunc) {
+        // We only treat our wrapped expression as a real expression if we're
+        // not going to interpret it as a literal.
+        if e.literalName() == "" {
+                e.Wrapped = w(e.Wrapped).(Expression)
+        }
+}
+
+func (e *ObjectConsKeyExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        if ln := e.literalName(); ln != "" {
+                return cty.StringVal(ln), nil
+        }
+        return e.Wrapped.Value(ctx)
+}
+
+func (e *ObjectConsKeyExpr) Range() hcl.Range {
+        return e.Wrapped.Range()
+}
+
+func (e *ObjectConsKeyExpr) StartRange() hcl.Range {
+        return e.Wrapped.StartRange()
+}
+
+// Implementation for hcl.AbsTraversalForExpr.
+func (e *ObjectConsKeyExpr) AsTraversal() hcl.Traversal {
+        // We can produce a traversal only if our wrappee can.
+        st, diags := hcl.AbsTraversalForExpr(e.Wrapped)
+        if diags.HasErrors() {
+                return nil
+        }
+
+        return st
+}
+
+func (e *ObjectConsKeyExpr) UnwrapExpression() Expression {
+        return e.Wrapped
+}
+
+// ForExpr represents iteration constructs:
+//
+//     tuple = [for i, v in list: upper(v) if i > 2]
+//     object = {for k, v in map: k => upper(v)}
+//     object_of_tuples = {for v in list: v.key: v...}
+type ForExpr struct {
+        KeyVar string // empty if ignoring the key
+        ValVar string
+
+        CollExpr Expression
+
+        KeyExpr  Expression // nil when producing a tuple
+        ValExpr  Expression
+        CondExpr Expression // null if no "if" clause is present
+
+        Group bool // set if the ellipsis is used on the value in an object for
+
+        SrcRange   hcl.Range
+        OpenRange  hcl.Range
+        CloseRange hcl.Range
+}
+
+func (e *ForExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+
+        collVal, collDiags := e.CollExpr.Value(ctx)
+        diags = append(diags, collDiags...)
+
+        if collVal.IsNull() {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Iteration over null value",
+                        Detail:   "A null value cannot be used as the collection in a 'for' expression.",
+                        Subject:  e.CollExpr.Range().Ptr(),
+                        Context:  &e.SrcRange,
+                })
+                return cty.DynamicVal, diags
+        }
+        if collVal.Type() == cty.DynamicPseudoType {
+                return cty.DynamicVal, diags
+        }
+        if !collVal.CanIterateElements() {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Iteration over non-iterable value",
+                        Detail: fmt.Sprintf(
+                                "A value of type %s cannot be used as the collection in a 'for' expression.",
+                                collVal.Type().FriendlyName(),
+                        ),
+                        Subject: e.CollExpr.Range().Ptr(),
+                        Context: &e.SrcRange,
+                })
+                return cty.DynamicVal, diags
+        }
+        if !collVal.IsKnown() {
+                return cty.DynamicVal, diags
+        }
+
+        childCtx := ctx.NewChild()
+        childCtx.Variables = map[string]cty.Value{}
+
+        // Before we start we'll do an early check to see if any CondExpr we've
+        // been given is of the wrong type. This isn't 100% reliable (it may
+        // be DynamicVal until real values are given) but it should catch some
+        // straightforward cases and prevent a barrage of repeated errors.
+        if e.CondExpr != nil {
+                if e.KeyVar != "" {
+                        childCtx.Variables[e.KeyVar] = cty.DynamicVal
+                }
+                childCtx.Variables[e.ValVar] = cty.DynamicVal
+
+                result, condDiags := e.CondExpr.Value(childCtx)
+                diags = append(diags, condDiags...)
+                if result.IsNull() {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Condition is null",
+                                Detail:   "The value of the 'if' clause must not be null.",
+                                Subject:  e.CondExpr.Range().Ptr(),
+                                Context:  &e.SrcRange,
+                        })
+                        return cty.DynamicVal, diags
+                }
+                _, err := convert.Convert(result, cty.Bool)
+                if err != nil {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid 'for' condition",
+                                Detail:   fmt.Sprintf("The 'if' clause value is invalid: %s.", err.Error()),
+                                Subject:  e.CondExpr.Range().Ptr(),
+                                Context:  &e.SrcRange,
+                        })
+                        return cty.DynamicVal, diags
+                }
+                if condDiags.HasErrors() {
+                        return cty.DynamicVal, diags
+                }
+        }
+
+        if e.KeyExpr != nil {
+                // Producing an object
+                var vals map[string]cty.Value
+                var groupVals map[string][]cty.Value
+                if e.Group {
+                        groupVals = map[string][]cty.Value{}
+                } else {
+                        vals = map[string]cty.Value{}
+                }
+
+                it := collVal.ElementIterator()
+
+                known := true
+                for it.Next() {
+                        k, v := it.Element()
+                        if e.KeyVar != "" {
+                                childCtx.Variables[e.KeyVar] = k
+                        }
+                        childCtx.Variables[e.ValVar] = v
+
+                        if e.CondExpr != nil {
+                                includeRaw, condDiags := e.CondExpr.Value(childCtx)
+                                diags = append(diags, condDiags...)
+                                if includeRaw.IsNull() {
+                                        if known {
+                                                diags = append(diags, &hcl.Diagnostic{
+                                                        Severity: hcl.DiagError,
+                                                        Summary:  "Condition is null",
+                                                        Detail:   "The value of the 'if' clause must not be null.",
+                                                        Subject:  e.CondExpr.Range().Ptr(),
+                                                        Context:  &e.SrcRange,
+                                                })
+                                        }
+                                        known = false
+                                        continue
+                                }
+                                include, err := convert.Convert(includeRaw, cty.Bool)
+                                if err != nil {
+                                        if known {
+                                                diags = append(diags, &hcl.Diagnostic{
+                                                        Severity: hcl.DiagError,
+                                                        Summary:  "Invalid 'for' condition",
+                                                        Detail:   fmt.Sprintf("The 'if' clause value is invalid: %s.", err.Error()),
+                                                        Subject:  e.CondExpr.Range().Ptr(),
+                                                        Context:  &e.SrcRange,
+                                                })
+                                        }
+                                        known = false
+                                        continue
+                                }
+                                if !include.IsKnown() {
+                                        known = false
+                                        continue
+                                }
+
+                                if include.False() {
+                                        // Skip this element
+                                        continue
+                                }
+                        }
+
+                        keyRaw, keyDiags := e.KeyExpr.Value(childCtx)
+                        diags = append(diags, keyDiags...)
+                        if keyRaw.IsNull() {
+                                if known {
+                                        diags = append(diags, &hcl.Diagnostic{
+                                                Severity: hcl.DiagError,
+                                                Summary:  "Invalid object key",
+                                                Detail:   "Key expression in 'for' expression must not produce a null value.",
+                                                Subject:  e.KeyExpr.Range().Ptr(),
+                                                Context:  &e.SrcRange,
+                                        })
+                                }
+                                known = false
+                                continue
+                        }
+                        if !keyRaw.IsKnown() {
+                                known = false
+                                continue
+                        }
+
+                        key, err := convert.Convert(keyRaw, cty.String)
+                        if err != nil {
+                                if known {
+                                        diags = append(diags, &hcl.Diagnostic{
+                                                Severity: hcl.DiagError,
+                                                Summary:  "Invalid object key",
+                                                Detail:   fmt.Sprintf("The key expression produced an invalid result: %s.", err.Error()),
+                                                Subject:  e.KeyExpr.Range().Ptr(),
+                                                Context:  &e.SrcRange,
+                                        })
+                                }
+                                known = false
+                                continue
+                        }
+
+                        val, valDiags := e.ValExpr.Value(childCtx)
+                        diags = append(diags, valDiags...)
+
+                        if e.Group {
+                                k := key.AsString()
+                                groupVals[k] = append(groupVals[k], val)
+                        } else {
+                                k := key.AsString()
+                                if _, exists := vals[k]; exists {
+                                        diags = append(diags, &hcl.Diagnostic{
+                                                Severity: hcl.DiagError,
+                                                Summary:  "Duplicate object key",
+                                                Detail: fmt.Sprintf(
+                                                        "Two different items produced the key %q in this for expression. If duplicates are expected, use the ellipsis (...) after the value expression to enable grouping by key.",
+                                                        k,
+                                                ),
+                                                Subject: e.KeyExpr.Range().Ptr(),
+                                                Context: &e.SrcRange,
+                                        })
+                                } else {
+                                        vals[key.AsString()] = val
+                                }
+                        }
+                }
+
+                if !known {
+                        return cty.DynamicVal, diags
+                }
+
+                if e.Group {
+                        vals = map[string]cty.Value{}
+                        for k, gvs := range groupVals {
+                                vals[k] = cty.TupleVal(gvs)
+                        }
+                }
+
+                return cty.ObjectVal(vals), diags
+
+        } else {
+                // Producing a tuple
+                vals := []cty.Value{}
+
+                it := collVal.ElementIterator()
+
+                known := true
+                for it.Next() {
+                        k, v := it.Element()
+                        if e.KeyVar != "" {
+                                childCtx.Variables[e.KeyVar] = k
+                        }
+                        childCtx.Variables[e.ValVar] = v
+
+                        if e.CondExpr != nil {
+                                includeRaw, condDiags := e.CondExpr.Value(childCtx)
+                                diags = append(diags, condDiags...)
+                                if includeRaw.IsNull() {
+                                        if known {
+                                                diags = append(diags, &hcl.Diagnostic{
+                                                        Severity: hcl.DiagError,
+                                                        Summary:  "Condition is null",
+                                                        Detail:   "The value of the 'if' clause must not be null.",
+                                                        Subject:  e.CondExpr.Range().Ptr(),
+                                                        Context:  &e.SrcRange,
+                                                })
+                                        }
+                                        known = false
+                                        continue
+                                }
+                                if !includeRaw.IsKnown() {
+                                        // We will eventually return DynamicVal, but we'll continue
+                                        // iterating in case there are other diagnostics to gather
+                                        // for later elements.
+                                        known = false
+                                        continue
+                                }
+
+                                include, err := convert.Convert(includeRaw, cty.Bool)
+                                if err != nil {
+                                        if known {
+                                                diags = append(diags, &hcl.Diagnostic{
+                                                        Severity: hcl.DiagError,
+                                                        Summary:  "Invalid 'for' condition",
+                                                        Detail:   fmt.Sprintf("The 'if' clause value is invalid: %s.", err.Error()),
+                                                        Subject:  e.CondExpr.Range().Ptr(),
+                                                        Context:  &e.SrcRange,
+                                                })
+                                        }
+                                        known = false
+                                        continue
+                                }
+
+                                if include.False() {
+                                        // Skip this element
+                                        continue
+                                }
+                        }
+
+                        val, valDiags := e.ValExpr.Value(childCtx)
+                        diags = append(diags, valDiags...)
+                        vals = append(vals, val)
+                }
+
+                if !known {
+                        return cty.DynamicVal, diags
+                }
+
+                return cty.TupleVal(vals), diags
+        }
+}
+
+func (e *ForExpr) walkChildNodes(w internalWalkFunc) {
+        e.CollExpr = w(e.CollExpr).(Expression)
+
+        scopeNames := map[string]struct{}{}
+        if e.KeyVar != "" {
+                scopeNames[e.KeyVar] = struct{}{}
+        }
+        if e.ValVar != "" {
+                scopeNames[e.ValVar] = struct{}{}
+        }
+
+        if e.KeyExpr != nil {
+                w(ChildScope{
+                        LocalNames: scopeNames,
+                        Expr:       &e.KeyExpr,
+                })
+        }
+        w(ChildScope{
+                LocalNames: scopeNames,
+                Expr:       &e.ValExpr,
+        })
+        if e.CondExpr != nil {
+                w(ChildScope{
+                        LocalNames: scopeNames,
+                        Expr:       &e.CondExpr,
+                })
+        }
+}
+
+func (e *ForExpr) Range() hcl.Range {
+        return e.SrcRange
+}
+
+func (e *ForExpr) StartRange() hcl.Range {
+        return e.OpenRange
+}
+
+type SplatExpr struct {
+        Source Expression
+        Each   Expression
+        Item   *AnonSymbolExpr
+
+        SrcRange    hcl.Range
+        MarkerRange hcl.Range
+}
+
+func (e *SplatExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        sourceVal, diags := e.Source.Value(ctx)
+        if diags.HasErrors() {
+                // We'll evaluate our "Each" expression here just to see if it
+                // produces any more diagnostics we can report. Since we're not
+                // assigning a value to our AnonSymbolExpr here it will return
+                // DynamicVal, which should short-circuit any use of it.
+                _, itemDiags := e.Item.Value(ctx)
+                diags = append(diags, itemDiags...)
+                return cty.DynamicVal, diags
+        }
+
+        if sourceVal.IsNull() {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Splat of null value",
+                        Detail:   "Splat expressions (with the * symbol) cannot be applied to null values.",
+                        Subject:  e.Source.Range().Ptr(),
+                        Context:  hcl.RangeBetween(e.Source.Range(), e.MarkerRange).Ptr(),
+                })
+                return cty.DynamicVal, diags
+        }
+        if !sourceVal.IsKnown() {
+                return cty.DynamicVal, diags
+        }
+
+        // A "special power" of splat expressions is that they can be applied
+        // both to tuples/lists and to other values, and in the latter case
+        // the value will be treated as an implicit single-value list. We'll
+        // deal with that here first.
+        if !(sourceVal.Type().IsTupleType() || sourceVal.Type().IsListType()) {
+                sourceVal = cty.ListVal([]cty.Value{sourceVal})
+        }
+
+        vals := make([]cty.Value, 0, sourceVal.LengthInt())
+        it := sourceVal.ElementIterator()
+        if ctx == nil {
+                // we need a context to use our AnonSymbolExpr, so we'll just
+                // make an empty one here to use as a placeholder.
+                ctx = ctx.NewChild()
+        }
+        isKnown := true
+        for it.Next() {
+                _, sourceItem := it.Element()
+                e.Item.setValue(ctx, sourceItem)
+                newItem, itemDiags := e.Each.Value(ctx)
+                diags = append(diags, itemDiags...)
+                if itemDiags.HasErrors() {
+                        isKnown = false
+                }
+                vals = append(vals, newItem)
+        }
+        e.Item.clearValue(ctx) // clean up our temporary value
+
+        if !isKnown {
+                return cty.DynamicVal, diags
+        }
+
+        return cty.TupleVal(vals), diags
+}
+
+func (e *SplatExpr) walkChildNodes(w internalWalkFunc) {
+        e.Source = w(e.Source).(Expression)
+        e.Each = w(e.Each).(Expression)
+}
+
+func (e *SplatExpr) Range() hcl.Range {
+        return e.SrcRange
+}
+
+func (e *SplatExpr) StartRange() hcl.Range {
+        return e.MarkerRange
+}
+
+// AnonSymbolExpr is used as a placeholder for a value in an expression that
+// can be applied dynamically to any value at runtime.
+//
+// This is a rather odd, synthetic expression. It is used as part of the
+// representation of splat expressions as a placeholder for the current item
+// being visited in the splat evaluation.
+//
+// AnonSymbolExpr cannot be evaluated in isolation. If its Value is called
+// directly then cty.DynamicVal will be returned. Instead, it is evaluated
+// in terms of another node (i.e. a splat expression) which temporarily
+// assigns it a value.
+type AnonSymbolExpr struct {
+        SrcRange hcl.Range
+        values   map[*hcl.EvalContext]cty.Value
+}
+
+func (e *AnonSymbolExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        if ctx == nil {
+                return cty.DynamicVal, nil
+        }
+        val, exists := e.values[ctx]
+        if !exists {
+                return cty.DynamicVal, nil
+        }
+        return val, nil
+}
+
+// setValue sets a temporary local value for the expression when evaluated
+// in the given context, which must be non-nil.
+func (e *AnonSymbolExpr) setValue(ctx *hcl.EvalContext, val cty.Value) {
+        if e.values == nil {
+                e.values = make(map[*hcl.EvalContext]cty.Value)
+        }
+        if ctx == nil {
+                panic("can't setValue for a nil EvalContext")
+        }
+        e.values[ctx] = val
+}
+
+func (e *AnonSymbolExpr) clearValue(ctx *hcl.EvalContext) {
+        if e.values == nil {
+                return
+        }
+        if ctx == nil {
+                panic("can't clearValue for a nil EvalContext")
+        }
+        delete(e.values, ctx)
+}
+
+func (e *AnonSymbolExpr) walkChildNodes(w internalWalkFunc) {
+        // AnonSymbolExpr is a leaf node in the tree
+}
+
+func (e *AnonSymbolExpr) Range() hcl.Range {
+        return e.SrcRange
+}
+
+func (e *AnonSymbolExpr) StartRange() hcl.Range {
+        return e.SrcRange
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/expression_ops.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/expression_ops.go
new file mode 100644
index 0000000..9a5da04
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/expression_ops.go
@@ -0,0 +1,258 @@
+package hclsyntax
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+        "github.com/zclconf/go-cty/cty/function"
+        "github.com/zclconf/go-cty/cty/function/stdlib"
+)
+
+type Operation struct {
+        Impl function.Function
+        Type cty.Type
+}
+
+var (
+        OpLogicalOr = &Operation{
+                Impl: stdlib.OrFunc,
+                Type: cty.Bool,
+        }
+        OpLogicalAnd = &Operation{
+                Impl: stdlib.AndFunc,
+                Type: cty.Bool,
+        }
+        OpLogicalNot = &Operation{
+                Impl: stdlib.NotFunc,
+                Type: cty.Bool,
+        }
+
+        OpEqual = &Operation{
+                Impl: stdlib.EqualFunc,
+                Type: cty.Bool,
+        }
+        OpNotEqual = &Operation{
+                Impl: stdlib.NotEqualFunc,
+                Type: cty.Bool,
+        }
+
+        OpGreaterThan = &Operation{
+                Impl: stdlib.GreaterThanFunc,
+                Type: cty.Bool,
+        }
+        OpGreaterThanOrEqual = &Operation{
+                Impl: stdlib.GreaterThanOrEqualToFunc,
+                Type: cty.Bool,
+        }
+        OpLessThan = &Operation{
+                Impl: stdlib.LessThanFunc,
+                Type: cty.Bool,
+        }
+        OpLessThanOrEqual = &Operation{
+                Impl: stdlib.LessThanOrEqualToFunc,
+                Type: cty.Bool,
+        }
+
+        OpAdd = &Operation{
+                Impl: stdlib.AddFunc,
+                Type: cty.Number,
+        }
+        OpSubtract = &Operation{
+                Impl: stdlib.SubtractFunc,
+                Type: cty.Number,
+        }
+        OpMultiply = &Operation{
+                Impl: stdlib.MultiplyFunc,
+                Type: cty.Number,
+        }
+        OpDivide = &Operation{
+                Impl: stdlib.DivideFunc,
+                Type: cty.Number,
+        }
+        OpModulo = &Operation{
+                Impl: stdlib.ModuloFunc,
+                Type: cty.Number,
+        }
+        OpNegate = &Operation{
+                Impl: stdlib.NegateFunc,
+                Type: cty.Number,
+        }
+)
+
+var binaryOps []map[TokenType]*Operation
+
+func init() {
+        // This operation table maps from the operator's token type
+        // to the AST operation type. All expressions produced from
+        // binary operators are BinaryOp nodes.
+        //
+        // Binary operator groups are listed in order of precedence, with
+        // the *lowest* precedence first. Operators within the same group
+        // have left-to-right associativity.
+        binaryOps = []map[TokenType]*Operation{
+                {
+                        TokenOr: OpLogicalOr,
+                },
+                {
+                        TokenAnd: OpLogicalAnd,
+                },
+                {
+                        TokenEqualOp:  OpEqual,
+                        TokenNotEqual: OpNotEqual,
+                },
+                {
+                        TokenGreaterThan:   OpGreaterThan,
+                        TokenGreaterThanEq: OpGreaterThanOrEqual,
+                        TokenLessThan:      OpLessThan,
+                        TokenLessThanEq:    OpLessThanOrEqual,
+                },
+                {
+                        TokenPlus:  OpAdd,
+                        TokenMinus: OpSubtract,
+                },
+                {
+                        TokenStar:    OpMultiply,
+                        TokenSlash:   OpDivide,
+                        TokenPercent: OpModulo,
+                },
+        }
+}
+
+type BinaryOpExpr struct {
+        LHS Expression
+        Op  *Operation
+        RHS Expression
+
+        SrcRange hcl.Range
+}
+
+func (e *BinaryOpExpr) walkChildNodes(w internalWalkFunc) {
+        e.LHS = w(e.LHS).(Expression)
+        e.RHS = w(e.RHS).(Expression)
+}
+
+func (e *BinaryOpExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        impl := e.Op.Impl // assumed to be a function taking exactly two arguments
+        params := impl.Params()
+        lhsParam := params[0]
+        rhsParam := params[1]
+
+        var diags hcl.Diagnostics
+
+        givenLHSVal, lhsDiags := e.LHS.Value(ctx)
+        givenRHSVal, rhsDiags := e.RHS.Value(ctx)
+        diags = append(diags, lhsDiags...)
+        diags = append(diags, rhsDiags...)
+
+        lhsVal, err := convert.Convert(givenLHSVal, lhsParam.Type)
+        if err != nil {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid operand",
+                        Detail:   fmt.Sprintf("Unsuitable value for left operand: %s.", err),
+                        Subject:  e.LHS.Range().Ptr(),
+                        Context:  &e.SrcRange,
+                })
+        }
+        rhsVal, err := convert.Convert(givenRHSVal, rhsParam.Type)
+        if err != nil {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid operand",
+                        Detail:   fmt.Sprintf("Unsuitable value for right operand: %s.", err),
+                        Subject:  e.RHS.Range().Ptr(),
+                        Context:  &e.SrcRange,
+                })
+        }
+
+        if diags.HasErrors() {
+                // Don't actually try the call if we have errors already, since the
+                // this will probably just produce a confusing duplicative diagnostic.
+                return cty.UnknownVal(e.Op.Type), diags
+        }
+
+        args := []cty.Value{lhsVal, rhsVal}
+        result, err := impl.Call(args)
+        if err != nil {
+                diags = append(diags, &hcl.Diagnostic{
+                        // FIXME: This diagnostic is useless.
+                        Severity: hcl.DiagError,
+                        Summary:  "Operation failed",
+                        Detail:   fmt.Sprintf("Error during operation: %s.", err),
+                        Subject:  &e.SrcRange,
+                })
+                return cty.UnknownVal(e.Op.Type), diags
+        }
+
+        return result, diags
+}
+
+func (e *BinaryOpExpr) Range() hcl.Range {
+        return e.SrcRange
+}
+
+func (e *BinaryOpExpr) StartRange() hcl.Range {
+        return e.LHS.StartRange()
+}
+
+type UnaryOpExpr struct {
+        Op  *Operation
+        Val Expression
+
+        SrcRange    hcl.Range
+        SymbolRange hcl.Range
+}
+
+func (e *UnaryOpExpr) walkChildNodes(w internalWalkFunc) {
+        e.Val = w(e.Val).(Expression)
+}
+
+func (e *UnaryOpExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        impl := e.Op.Impl // assumed to be a function taking exactly one argument
+        params := impl.Params()
+        param := params[0]
+
+        givenVal, diags := e.Val.Value(ctx)
+
+        val, err := convert.Convert(givenVal, param.Type)
+        if err != nil {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Invalid operand",
+                        Detail:   fmt.Sprintf("Unsuitable value for unary operand: %s.", err),
+                        Subject:  e.Val.Range().Ptr(),
+                        Context:  &e.SrcRange,
+                })
+        }
+
+        if diags.HasErrors() {
+                // Don't actually try the call if we have errors already, since the
+                // this will probably just produce a confusing duplicative diagnostic.
+                return cty.UnknownVal(e.Op.Type), diags
+        }
+
+        args := []cty.Value{val}
+        result, err := impl.Call(args)
+        if err != nil {
+                diags = append(diags, &hcl.Diagnostic{
+                        // FIXME: This diagnostic is useless.
+                        Severity: hcl.DiagError,
+                        Summary:  "Operation failed",
+                        Detail:   fmt.Sprintf("Error during operation: %s.", err),
+                        Subject:  &e.SrcRange,
+                })
+                return cty.UnknownVal(e.Op.Type), diags
+        }
+
+        return result, diags
+}
+
+func (e *UnaryOpExpr) Range() hcl.Range {
+        return e.SrcRange
+}
+
+func (e *UnaryOpExpr) StartRange() hcl.Range {
+        return e.SymbolRange
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/expression_template.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/expression_template.go
new file mode 100644
index 0000000..a1c4727
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/expression_template.go
@@ -0,0 +1,192 @@
+package hclsyntax
+
+import (
+        "bytes"
+        "fmt"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+)
+
+type TemplateExpr struct {
+        Parts []Expression
+
+        SrcRange hcl.Range
+}
+
+func (e *TemplateExpr) walkChildNodes(w internalWalkFunc) {
+        for i, part := range e.Parts {
+                e.Parts[i] = w(part).(Expression)
+        }
+}
+
+func (e *TemplateExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        buf := &bytes.Buffer{}
+        var diags hcl.Diagnostics
+        isKnown := true
+
+        for _, part := range e.Parts {
+                partVal, partDiags := part.Value(ctx)
+                diags = append(diags, partDiags...)
+
+                if partVal.IsNull() {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid template interpolation value",
+                                Detail: fmt.Sprintf(
+                                        "The expression result is null. Cannot include a null value in a string template.",
+                                ),
+                                Subject: part.Range().Ptr(),
+                                Context: &e.SrcRange,
+                        })
+                        continue
+                }
+
+                if !partVal.IsKnown() {
+                        // If any part is unknown then the result as a whole must be
+                        // unknown too. We'll keep on processing the rest of the parts
+                        // anyway, because we want to still emit any diagnostics resulting
+                        // from evaluating those.
+                        isKnown = false
+                        continue
+                }
+
+                strVal, err := convert.Convert(partVal, cty.String)
+                if err != nil {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid template interpolation value",
+                                Detail: fmt.Sprintf(
+                                        "Cannot include the given value in a string template: %s.",
+                                        err.Error(),
+                                ),
+                                Subject: part.Range().Ptr(),
+                                Context: &e.SrcRange,
+                        })
+                        continue
+                }
+
+                buf.WriteString(strVal.AsString())
+        }
+
+        if !isKnown {
+                return cty.UnknownVal(cty.String), diags
+        }
+
+        return cty.StringVal(buf.String()), diags
+}
+
+func (e *TemplateExpr) Range() hcl.Range {
+        return e.SrcRange
+}
+
+func (e *TemplateExpr) StartRange() hcl.Range {
+        return e.Parts[0].StartRange()
+}
+
+// TemplateJoinExpr is used to convert tuples of strings produced by template
+// constructs (i.e. for loops) into flat strings, by converting the values
+// tos strings and joining them. This AST node is not used directly; it's
+// produced as part of the AST of a "for" loop in a template.
+type TemplateJoinExpr struct {
+        Tuple Expression
+}
+
+func (e *TemplateJoinExpr) walkChildNodes(w internalWalkFunc) {
+        e.Tuple = w(e.Tuple).(Expression)
+}
+
+func (e *TemplateJoinExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        tuple, diags := e.Tuple.Value(ctx)
+
+        if tuple.IsNull() {
+                // This indicates a bug in the code that constructed the AST.
+                panic("TemplateJoinExpr got null tuple")
+        }
+        if tuple.Type() == cty.DynamicPseudoType {
+                return cty.UnknownVal(cty.String), diags
+        }
+        if !tuple.Type().IsTupleType() {
+                // This indicates a bug in the code that constructed the AST.
+                panic("TemplateJoinExpr got non-tuple tuple")
+        }
+        if !tuple.IsKnown() {
+                return cty.UnknownVal(cty.String), diags
+        }
+
+        buf := &bytes.Buffer{}
+        it := tuple.ElementIterator()
+        for it.Next() {
+                _, val := it.Element()
+
+                if val.IsNull() {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid template interpolation value",
+                                Detail: fmt.Sprintf(
+                                        "An iteration result is null. Cannot include a null value in a string template.",
+                                ),
+                                Subject: e.Range().Ptr(),
+                        })
+                        continue
+                }
+                if val.Type() == cty.DynamicPseudoType {
+                        return cty.UnknownVal(cty.String), diags
+                }
+                strVal, err := convert.Convert(val, cty.String)
+                if err != nil {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid template interpolation value",
+                                Detail: fmt.Sprintf(
+                                        "Cannot include one of the interpolation results into the string template: %s.",
+                                        err.Error(),
+                                ),
+                                Subject: e.Range().Ptr(),
+                        })
+                        continue
+                }
+                if !val.IsKnown() {
+                        return cty.UnknownVal(cty.String), diags
+                }
+
+                buf.WriteString(strVal.AsString())
+        }
+
+        return cty.StringVal(buf.String()), diags
+}
+
+func (e *TemplateJoinExpr) Range() hcl.Range {
+        return e.Tuple.Range()
+}
+
+func (e *TemplateJoinExpr) StartRange() hcl.Range {
+        return e.Tuple.StartRange()
+}
+
+// TemplateWrapExpr is used instead of a TemplateExpr when a template
+// consists _only_ of a single interpolation sequence. In that case, the
+// template's result is the single interpolation's result, verbatim with
+// no type conversions.
+type TemplateWrapExpr struct {
+        Wrapped Expression
+
+        SrcRange hcl.Range
+}
+
+func (e *TemplateWrapExpr) walkChildNodes(w internalWalkFunc) {
+        e.Wrapped = w(e.Wrapped).(Expression)
+}
+
+func (e *TemplateWrapExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        return e.Wrapped.Value(ctx)
+}
+
+func (e *TemplateWrapExpr) Range() hcl.Range {
+        return e.SrcRange
+}
+
+func (e *TemplateWrapExpr) StartRange() hcl.Range {
+        return e.SrcRange
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/expression_vars.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/expression_vars.go
new file mode 100644
index 0000000..9177092
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/expression_vars.go
@@ -0,0 +1,76 @@
+package hclsyntax
+
+// Generated by expression_vars_get.go. DO NOT EDIT.
+// Run 'go generate' on this package to update the set of functions here.
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+func (e *AnonSymbolExpr) Variables() []hcl.Traversal {
+        return Variables(e)
+}
+
+func (e *BinaryOpExpr) Variables() []hcl.Traversal {
+        return Variables(e)
+}
+
+func (e *ConditionalExpr) Variables() []hcl.Traversal {
+        return Variables(e)
+}
+
+func (e *ForExpr) Variables() []hcl.Traversal {
+        return Variables(e)
+}
+
+func (e *FunctionCallExpr) Variables() []hcl.Traversal {
+        return Variables(e)
+}
+
+func (e *IndexExpr) Variables() []hcl.Traversal {
+        return Variables(e)
+}
+
+func (e *LiteralValueExpr) Variables() []hcl.Traversal {
+        return Variables(e)
+}
+
+func (e *ObjectConsExpr) Variables() []hcl.Traversal {
+        return Variables(e)
+}
+
+func (e *ObjectConsKeyExpr) Variables() []hcl.Traversal {
+        return Variables(e)
+}
+
+func (e *RelativeTraversalExpr) Variables() []hcl.Traversal {
+        return Variables(e)
+}
+
+func (e *ScopeTraversalExpr) Variables() []hcl.Traversal {
+        return Variables(e)
+}
+
+func (e *SplatExpr) Variables() []hcl.Traversal {
+        return Variables(e)
+}
+
+func (e *TemplateExpr) Variables() []hcl.Traversal {
+        return Variables(e)
+}
+
+func (e *TemplateJoinExpr) Variables() []hcl.Traversal {
+        return Variables(e)
+}
+
+func (e *TemplateWrapExpr) Variables() []hcl.Traversal {
+        return Variables(e)
+}
+
+func (e *TupleConsExpr) Variables() []hcl.Traversal {
+        return Variables(e)
+}
+
+func (e *UnaryOpExpr) Variables() []hcl.Traversal {
+        return Variables(e)
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/expression_vars_gen.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/expression_vars_gen.go
new file mode 100644
index 0000000..88f1980
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/expression_vars_gen.go
@@ -0,0 +1,99 @@
+// This is a 'go generate'-oriented program for producing the "Variables"
+// method on every Expression implementation found within this package.
+// All expressions share the same implementation for this method, which
+// just wraps the package-level function "Variables" and uses an AST walk
+// to do its work.
+
+// +build ignore
+
+package main
+
+import (
+        "fmt"
+        "go/ast"
+        "go/parser"
+        "go/token"
+        "os"
+        "sort"
+)
+
+func main() {
+        fs := token.NewFileSet()
+        pkgs, err := parser.ParseDir(fs, ".", nil, 0)
+        if err != nil {
+                fmt.Fprintf(os.Stderr, "error while parsing: %s\n", err)
+                os.Exit(1)
+        }
+        pkg := pkgs["hclsyntax"]
+
+        // Walk all the files and collect the receivers of any "Value" methods
+        // that look like they are trying to implement Expression.
+        var recvs []string
+        for _, f := range pkg.Files {
+                for _, decl := range f.Decls {
+                        fd, ok := decl.(*ast.FuncDecl)
+                        if !ok {
+                                continue
+                        }
+                        if fd.Name.Name != "Value" {
+                                continue
+                        }
+                        results := fd.Type.Results.List
+                        if len(results) != 2 {
+                                continue
+                        }
+                        valResult := fd.Type.Results.List[0].Type.(*ast.SelectorExpr).X.(*ast.Ident)
+                        diagsResult := fd.Type.Results.List[1].Type.(*ast.SelectorExpr).X.(*ast.Ident)
+
+                        if valResult.Name != "cty" && diagsResult.Name != "hcl" {
+                                continue
+                        }
+
+                        // If we have a method called Value and it returns something in
+                        // "cty" followed by something in "hcl" then that's specific enough
+                        // for now, even though this is not 100% exact as a correct
+                        // implementation of Value.
+
+                        recvTy := fd.Recv.List[0].Type
+
+                        switch rtt := recvTy.(type) {
+                        case *ast.StarExpr:
+                                name := rtt.X.(*ast.Ident).Name
+                                recvs = append(recvs, fmt.Sprintf("*%s", name))
+                        default:
+                                fmt.Fprintf(os.Stderr, "don't know what to do with a %T receiver\n", recvTy)
+                        }
+
+                }
+        }
+
+        sort.Strings(recvs)
+
+        of, err := os.OpenFile("expression_vars.go", os.O_WRONLY|os.O_CREATE|os.O_TRUNC, os.ModePerm)
+        if err != nil {
+                fmt.Fprintf(os.Stderr, "failed to open output file: %s\n", err)
+                os.Exit(1)
+        }
+
+        fmt.Fprint(of, outputPreamble)
+        for _, recv := range recvs {
+                fmt.Fprintf(of, outputMethodFmt, recv)
+        }
+        fmt.Fprint(of, "\n")
+
+}
+
+const outputPreamble = `package hclsyntax
+
+// Generated by expression_vars_get.go. DO NOT EDIT.
+// Run 'go generate' on this package to update the set of functions here.
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+)`
+
+const outputMethodFmt = `
+
+func (e %s) Variables() []hcl.Traversal {
+        return Variables(e)
+}`
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/file.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/file.go
new file mode 100644
index 0000000..490c025
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/file.go
@@ -0,0 +1,20 @@
+package hclsyntax
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+// File is the top-level object resulting from parsing a configuration file.
+type File struct {
+        Body  *Body
+        Bytes []byte
+}
+
+func (f *File) AsHCLFile() *hcl.File {
+        return &hcl.File{
+                Body:  f.Body,
+                Bytes: f.Bytes,
+
+                // TODO: The Nav object, once we have an implementation of it
+        }
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/generate.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/generate.go
new file mode 100644
index 0000000..841656a
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/generate.go
@@ -0,0 +1,9 @@
+package hclsyntax
+
+//go:generate go run expression_vars_gen.go
+//go:generate ruby unicode2ragel.rb --url=http://www.unicode.org/Public/9.0.0/ucd/DerivedCoreProperties.txt -m UnicodeDerived -p ID_Start,ID_Continue -o unicode_derived.rl
+//go:generate ragel -Z scan_tokens.rl
+//go:generate gofmt -w scan_tokens.go
+//go:generate ragel -Z scan_string_lit.rl
+//go:generate gofmt -w scan_string_lit.go
+//go:generate stringer -type TokenType -output token_type_string.go
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/keywords.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/keywords.go
new file mode 100644
index 0000000..eef8b96
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/keywords.go
@@ -0,0 +1,21 @@
+package hclsyntax
+
+import (
+        "bytes"
+)
+
+type Keyword []byte
+
+var forKeyword = Keyword([]byte{'f', 'o', 'r'})
+var inKeyword = Keyword([]byte{'i', 'n'})
+var ifKeyword = Keyword([]byte{'i', 'f'})
+var elseKeyword = Keyword([]byte{'e', 'l', 's', 'e'})
+var endifKeyword = Keyword([]byte{'e', 'n', 'd', 'i', 'f'})
+var endforKeyword = Keyword([]byte{'e', 'n', 'd', 'f', 'o', 'r'})
+
+func (kw Keyword) TokenMatches(token Token) bool {
+        if token.Type != TokenIdent {
+                return false
+        }
+        return bytes.Equal([]byte(kw), token.Bytes)
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/navigation.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/navigation.go
new file mode 100644
index 0000000..4d41b6b
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/navigation.go
@@ -0,0 +1,41 @@
+package hclsyntax
+
+import (
+        "bytes"
+        "fmt"
+)
+
+type navigation struct {
+        root *Body
+}
+
+// Implementation of hcled.ContextString
+func (n navigation) ContextString(offset int) string {
+        // We will walk our top-level blocks until we find one that contains
+        // the given offset, and then construct a representation of the header
+        // of the block.
+
+        var block *Block
+        for _, candidate := range n.root.Blocks {
+                if candidate.Range().ContainsOffset(offset) {
+                        block = candidate
+                        break
+                }
+        }
+
+        if block == nil {
+                return ""
+        }
+
+        if len(block.Labels) == 0 {
+                // Easy case!
+                return block.Type
+        }
+
+        buf := &bytes.Buffer{}
+        buf.WriteString(block.Type)
+        for _, label := range block.Labels {
+                fmt.Fprintf(buf, " %q", label)
+        }
+        return buf.String()
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/node.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/node.go
new file mode 100644
index 0000000..fd426d4
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/node.go
@@ -0,0 +1,22 @@
+package hclsyntax
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+// Node is the abstract type that every AST node implements.
+//
+// This is a closed interface, so it cannot be implemented from outside of
+// this package.
+type Node interface {
+        // This is the mechanism by which the public-facing walk functions
+        // are implemented. Implementations should call the given function
+        // for each child node and then replace that node with its return value.
+        // The return value might just be the same node, for non-transforming
+        // walks.
+        walkChildNodes(w internalWalkFunc)
+
+        Range() hcl.Range
+}
+
+type internalWalkFunc func(Node) Node
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/parser.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/parser.go
new file mode 100644
index 0000000..002858f
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/parser.go
@@ -0,0 +1,1836 @@
+package hclsyntax
+
+import (
+        "bytes"
+        "fmt"
+        "strconv"
+        "unicode/utf8"
+
+        "github.com/apparentlymart/go-textseg/textseg"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+)
+
+type parser struct {
+        *peeker
+
+        // set to true if any recovery is attempted. The parser can use this
+        // to attempt to reduce error noise by suppressing "bad token" errors
+        // in recovery mode, assuming that the recovery heuristics have failed
+        // in this case and left the peeker in a wrong place.
+        recovery bool
+}
+
+func (p *parser) ParseBody(end TokenType) (*Body, hcl.Diagnostics) {
+        attrs := Attributes{}
+        blocks := Blocks{}
+        var diags hcl.Diagnostics
+
+        startRange := p.PrevRange()
+        var endRange hcl.Range
+
+Token:
+        for {
+                next := p.Peek()
+                if next.Type == end {
+                        endRange = p.NextRange()
+                        p.Read()
+                        break Token
+                }
+
+                switch next.Type {
+                case TokenNewline:
+                        p.Read()
+                        continue
+                case TokenIdent:
+                        item, itemDiags := p.ParseBodyItem()
+                        diags = append(diags, itemDiags...)
+                        switch titem := item.(type) {
+                        case *Block:
+                                blocks = append(blocks, titem)
+                        case *Attribute:
+                                if existing, exists := attrs[titem.Name]; exists {
+                                        diags = append(diags, &hcl.Diagnostic{
+                                                Severity: hcl.DiagError,
+                                                Summary:  "Attribute redefined",
+                                                Detail: fmt.Sprintf(
+                                                        "The attribute %q was already defined at %s. Each attribute may be defined only once.",
+                                                        titem.Name, existing.NameRange.String(),
+                                                ),
+                                                Subject: &titem.NameRange,
+                                        })
+                                } else {
+                                        attrs[titem.Name] = titem
+                                }
+                        default:
+                                // This should never happen for valid input, but may if a
+                                // syntax error was detected in ParseBodyItem that prevented
+                                // it from even producing a partially-broken item. In that
+                                // case, it would've left at least one error in the diagnostics
+                                // slice we already dealt with above.
+                                //
+                                // We'll assume ParseBodyItem attempted recovery to leave
+                                // us in a reasonable position to try parsing the next item.
+                                continue
+                        }
+                default:
+                        bad := p.Read()
+                        if !p.recovery {
+                                if bad.Type == TokenOQuote {
+                                        diags = append(diags, &hcl.Diagnostic{
+                                                Severity: hcl.DiagError,
+                                                Summary:  "Invalid attribute name",
+                                                Detail:   "Attribute names must not be quoted.",
+                                                Subject:  &bad.Range,
+                                        })
+                                } else {
+                                        diags = append(diags, &hcl.Diagnostic{
+                                                Severity: hcl.DiagError,
+                                                Summary:  "Attribute or block definition required",
+                                                Detail:   "An attribute or block definition is required here.",
+                                                Subject:  &bad.Range,
+                                        })
+                                }
+                        }
+                        endRange = p.PrevRange() // arbitrary, but somewhere inside the body means better diagnostics
+
+                        p.recover(end) // attempt to recover to the token after the end of this body
+                        break Token
+                }
+        }
+
+        return &Body{
+                Attributes: attrs,
+                Blocks:     blocks,
+
+                SrcRange: hcl.RangeBetween(startRange, endRange),
+                EndRange: hcl.Range{
+                        Filename: endRange.Filename,
+                        Start:    endRange.End,
+                        End:      endRange.End,
+                },
+        }, diags
+}
+
+func (p *parser) ParseBodyItem() (Node, hcl.Diagnostics) {
+        ident := p.Read()
+        if ident.Type != TokenIdent {
+                p.recoverAfterBodyItem()
+                return nil, hcl.Diagnostics{
+                        {
+                                Severity: hcl.DiagError,
+                                Summary:  "Attribute or block definition required",
+                                Detail:   "An attribute or block definition is required here.",
+                                Subject:  &ident.Range,
+                        },
+                }
+        }
+
+        next := p.Peek()
+
+        switch next.Type {
+        case TokenEqual:
+                return p.finishParsingBodyAttribute(ident)
+        case TokenOQuote, TokenOBrace, TokenIdent:
+                return p.finishParsingBodyBlock(ident)
+        default:
+                p.recoverAfterBodyItem()
+                return nil, hcl.Diagnostics{
+                        {
+                                Severity: hcl.DiagError,
+                                Summary:  "Attribute or block definition required",
+                                Detail:   "An attribute or block definition is required here. To define an attribute, use the equals sign \"=\" to introduce the attribute value.",
+                                Subject:  &ident.Range,
+                        },
+                }
+        }
+
+        return nil, nil
+}
+
+func (p *parser) finishParsingBodyAttribute(ident Token) (Node, hcl.Diagnostics) {
+        eqTok := p.Read() // eat equals token
+        if eqTok.Type != TokenEqual {
+                // should never happen if caller behaves
+                panic("finishParsingBodyAttribute called with next not equals")
+        }
+
+        var endRange hcl.Range
+
+        expr, diags := p.ParseExpression()
+        if p.recovery && diags.HasErrors() {
+                // recovery within expressions tends to be tricky, so we've probably
+                // landed somewhere weird. We'll try to reset to the start of a body
+                // item so parsing can continue.
+                endRange = p.PrevRange()
+                p.recoverAfterBodyItem()
+        } else {
+                end := p.Peek()
+                if end.Type != TokenNewline && end.Type != TokenEOF {
+                        if !p.recovery {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Missing newline after attribute definition",
+                                        Detail:   "An attribute definition must end with a newline.",
+                                        Subject:  &end.Range,
+                                        Context:  hcl.RangeBetween(ident.Range, end.Range).Ptr(),
+                                })
+                        }
+                        endRange = p.PrevRange()
+                        p.recoverAfterBodyItem()
+                } else {
+                        endRange = p.PrevRange()
+                        p.Read() // eat newline
+                }
+        }
+
+        return &Attribute{
+                Name: string(ident.Bytes),
+                Expr: expr,
+
+                SrcRange:    hcl.RangeBetween(ident.Range, endRange),
+                NameRange:   ident.Range,
+                EqualsRange: eqTok.Range,
+        }, diags
+}
+
+func (p *parser) finishParsingBodyBlock(ident Token) (Node, hcl.Diagnostics) {
+        var blockType = string(ident.Bytes)
+        var diags hcl.Diagnostics
+        var labels []string
+        var labelRanges []hcl.Range
+
+        var oBrace Token
+
+Token:
+        for {
+                tok := p.Peek()
+
+                switch tok.Type {
+
+                case TokenOBrace:
+                        oBrace = p.Read()
+                        break Token
+
+                case TokenOQuote:
+                        label, labelRange, labelDiags := p.parseQuotedStringLiteral()
+                        diags = append(diags, labelDiags...)
+                        labels = append(labels, label)
+                        labelRanges = append(labelRanges, labelRange)
+                        if labelDiags.HasErrors() {
+                                p.recoverAfterBodyItem()
+                                return &Block{
+                                        Type:   blockType,
+                                        Labels: labels,
+                                        Body:   nil,
+
+                                        TypeRange:       ident.Range,
+                                        LabelRanges:     labelRanges,
+                                        OpenBraceRange:  ident.Range, // placeholder
+                                        CloseBraceRange: ident.Range, // placeholder
+                                }, diags
+                        }
+
+                case TokenIdent:
+                        tok = p.Read() // eat token
+                        label, labelRange := string(tok.Bytes), tok.Range
+                        labels = append(labels, label)
+                        labelRanges = append(labelRanges, labelRange)
+
+                default:
+                        switch tok.Type {
+                        case TokenEqual:
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Invalid block definition",
+                                        Detail:   "The equals sign \"=\" indicates an attribute definition, and must not be used when defining a block.",
+                                        Subject:  &tok.Range,
+                                        Context:  hcl.RangeBetween(ident.Range, tok.Range).Ptr(),
+                                })
+                        case TokenNewline:
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Invalid block definition",
+                                        Detail:   "A block definition must have block content delimited by \"{\" and \"}\", starting on the same line as the block header.",
+                                        Subject:  &tok.Range,
+                                        Context:  hcl.RangeBetween(ident.Range, tok.Range).Ptr(),
+                                })
+                        default:
+                                if !p.recovery {
+                                        diags = append(diags, &hcl.Diagnostic{
+                                                Severity: hcl.DiagError,
+                                                Summary:  "Invalid block definition",
+                                                Detail:   "Either a quoted string block label or an opening brace (\"{\") is expected here.",
+                                                Subject:  &tok.Range,
+                                                Context:  hcl.RangeBetween(ident.Range, tok.Range).Ptr(),
+                                        })
+                                }
+                        }
+
+                        p.recoverAfterBodyItem()
+
+                        return &Block{
+                                Type:   blockType,
+                                Labels: labels,
+                                Body:   nil,
+
+                                TypeRange:       ident.Range,
+                                LabelRanges:     labelRanges,
+                                OpenBraceRange:  ident.Range, // placeholder
+                                CloseBraceRange: ident.Range, // placeholder
+                        }, diags
+                }
+        }
+
+        // Once we fall out here, the peeker is pointed just after our opening
+        // brace, so we can begin our nested body parsing.
+        body, bodyDiags := p.ParseBody(TokenCBrace)
+        diags = append(diags, bodyDiags...)
+        cBraceRange := p.PrevRange()
+
+        eol := p.Peek()
+        if eol.Type == TokenNewline || eol.Type == TokenEOF {
+                p.Read() // eat newline
+        } else {
+                if !p.recovery {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Missing newline after block definition",
+                                Detail:   "A block definition must end with a newline.",
+                                Subject:  &eol.Range,
+                                Context:  hcl.RangeBetween(ident.Range, eol.Range).Ptr(),
+                        })
+                }
+                p.recoverAfterBodyItem()
+        }
+
+        return &Block{
+                Type:   blockType,
+                Labels: labels,
+                Body:   body,
+
+                TypeRange:       ident.Range,
+                LabelRanges:     labelRanges,
+                OpenBraceRange:  oBrace.Range,
+                CloseBraceRange: cBraceRange,
+        }, diags
+}
+
+func (p *parser) ParseExpression() (Expression, hcl.Diagnostics) {
+        return p.parseTernaryConditional()
+}
+
+func (p *parser) parseTernaryConditional() (Expression, hcl.Diagnostics) {
+        // The ternary conditional operator (.. ? .. : ..) behaves somewhat
+        // like a binary operator except that the "symbol" is itself
+        // an expression enclosed in two punctuation characters.
+        // The middle expression is parsed as if the ? and : symbols
+        // were parentheses. The "rhs" (the "false expression") is then
+        // treated right-associatively so it behaves similarly to the
+        // middle in terms of precedence.
+
+        startRange := p.NextRange()
+        var condExpr, trueExpr, falseExpr Expression
+        var diags hcl.Diagnostics
+
+        condExpr, condDiags := p.parseBinaryOps(binaryOps)
+        diags = append(diags, condDiags...)
+        if p.recovery && condDiags.HasErrors() {
+                return condExpr, diags
+        }
+
+        questionMark := p.Peek()
+        if questionMark.Type != TokenQuestion {
+                return condExpr, diags
+        }
+
+        p.Read() // eat question mark
+
+        trueExpr, trueDiags := p.ParseExpression()
+        diags = append(diags, trueDiags...)
+        if p.recovery && trueDiags.HasErrors() {
+                return condExpr, diags
+        }
+
+        colon := p.Peek()
+        if colon.Type != TokenColon {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Missing false expression in conditional",
+                        Detail:   "The conditional operator (...?...:...) requires a false expression, delimited by a colon.",
+                        Subject:  &colon.Range,
+                        Context:  hcl.RangeBetween(startRange, colon.Range).Ptr(),
+                })
+                return condExpr, diags
+        }
+
+        p.Read() // eat colon
+
+        falseExpr, falseDiags := p.ParseExpression()
+        diags = append(diags, falseDiags...)
+        if p.recovery && falseDiags.HasErrors() {
+                return condExpr, diags
+        }
+
+        return &ConditionalExpr{
+                Condition:   condExpr,
+                TrueResult:  trueExpr,
+                FalseResult: falseExpr,
+
+                SrcRange: hcl.RangeBetween(startRange, falseExpr.Range()),
+        }, diags
+}
+
+// parseBinaryOps calls itself recursively to work through all of the
+// operator precedence groups, and then eventually calls parseExpressionTerm
+// for each operand.
+func (p *parser) parseBinaryOps(ops []map[TokenType]*Operation) (Expression, hcl.Diagnostics) {
+        if len(ops) == 0 {
+                // We've run out of operators, so now we'll just try to parse a term.
+                return p.parseExpressionWithTraversals()
+        }
+
+        thisLevel := ops[0]
+        remaining := ops[1:]
+
+        var lhs, rhs Expression
+        var operation *Operation
+        var diags hcl.Diagnostics
+
+        // Parse a term that might be the first operand of a binary
+        // operation or it might just be a standalone term.
+        // We won't know until we've parsed it and can look ahead
+        // to see if there's an operator token for this level.
+        lhs, lhsDiags := p.parseBinaryOps(remaining)
+        diags = append(diags, lhsDiags...)
+        if p.recovery && lhsDiags.HasErrors() {
+                return lhs, diags
+        }
+
+        // We'll keep eating up operators until we run out, so that operators
+        // with the same precedence will combine in a left-associative manner:
+        // a+b+c => (a+b)+c, not a+(b+c)
+        //
+        // Should we later want to have right-associative operators, a way
+        // to achieve that would be to call back up to ParseExpression here
+        // instead of iteratively parsing only the remaining operators.
+        for {
+                next := p.Peek()
+                var newOp *Operation
+                var ok bool
+                if newOp, ok = thisLevel[next.Type]; !ok {
+                        break
+                }
+
+                // Are we extending an expression started on the previous iteration?
+                if operation != nil {
+                        lhs = &BinaryOpExpr{
+                                LHS: lhs,
+                                Op:  operation,
+                                RHS: rhs,
+
+                                SrcRange: hcl.RangeBetween(lhs.Range(), rhs.Range()),
+                        }
+                }
+
+                operation = newOp
+                p.Read() // eat operator token
+                var rhsDiags hcl.Diagnostics
+                rhs, rhsDiags = p.parseBinaryOps(remaining)
+                diags = append(diags, rhsDiags...)
+                if p.recovery && rhsDiags.HasErrors() {
+                        return lhs, diags
+                }
+        }
+
+        if operation == nil {
+                return lhs, diags
+        }
+
+        return &BinaryOpExpr{
+                LHS: lhs,
+                Op:  operation,
+                RHS: rhs,
+
+                SrcRange: hcl.RangeBetween(lhs.Range(), rhs.Range()),
+        }, diags
+}
+
+func (p *parser) parseExpressionWithTraversals() (Expression, hcl.Diagnostics) {
+        term, diags := p.parseExpressionTerm()
+        ret := term
+
+Traversal:
+        for {
+                next := p.Peek()
+
+                switch next.Type {
+                case TokenDot:
+                        // Attribute access or splat
+                        dot := p.Read()
+                        attrTok := p.Peek()
+
+                        switch attrTok.Type {
+                        case TokenIdent:
+                                attrTok = p.Read() // eat token
+                                name := string(attrTok.Bytes)
+                                rng := hcl.RangeBetween(dot.Range, attrTok.Range)
+                                step := hcl.TraverseAttr{
+                                        Name:     name,
+                                        SrcRange: rng,
+                                }
+
+                                ret = makeRelativeTraversal(ret, step, rng)
+
+                        case TokenNumberLit:
+                                // This is a weird form we inherited from HIL, allowing numbers
+                                // to be used as attributes as a weird way of writing [n].
+                                // This was never actually a first-class thing in HIL, but
+                                // HIL tolerated sequences like .0. in its variable names and
+                                // calling applications like Terraform exploited that to
+                                // introduce indexing syntax where none existed.
+                                numTok := p.Read() // eat token
+                                attrTok = numTok
+
+                                // This syntax is ambiguous if multiple indices are used in
+                                // succession, like foo.0.1.baz: that actually parses as
+                                // a fractional number 0.1. Since we're only supporting this
+                                // syntax for compatibility with legacy Terraform
+                                // configurations, and Terraform does not tend to have lists
+                                // of lists, we'll choose to reject that here with a helpful
+                                // error message, rather than failing later because the index
+                                // isn't a whole number.
+                                if dotIdx := bytes.IndexByte(numTok.Bytes, '.'); dotIdx >= 0 {
+                                        first := numTok.Bytes[:dotIdx]
+                                        second := numTok.Bytes[dotIdx+1:]
+                                        diags = append(diags, &hcl.Diagnostic{
+                                                Severity: hcl.DiagError,
+                                                Summary:  "Invalid legacy index syntax",
+                                                Detail:   fmt.Sprintf("When using the legacy index syntax, chaining two indexes together is not permitted. Use the proper index syntax instead, like [%s][%s].", first, second),
+                                                Subject:  &attrTok.Range,
+                                        })
+                                        rng := hcl.RangeBetween(dot.Range, numTok.Range)
+                                        step := hcl.TraverseIndex{
+                                                Key:      cty.DynamicVal,
+                                                SrcRange: rng,
+                                        }
+                                        ret = makeRelativeTraversal(ret, step, rng)
+                                        break
+                                }
+
+                                numVal, numDiags := p.numberLitValue(numTok)
+                                diags = append(diags, numDiags...)
+
+                                rng := hcl.RangeBetween(dot.Range, numTok.Range)
+                                step := hcl.TraverseIndex{
+                                        Key:      numVal,
+                                        SrcRange: rng,
+                                }
+
+                                ret = makeRelativeTraversal(ret, step, rng)
+
+                        case TokenStar:
+                                // "Attribute-only" splat expression.
+                                // (This is a kinda weird construct inherited from HIL, which
+                                // behaves a bit like a [*] splat except that it is only able
+                                // to do attribute traversals into each of its elements,
+                                // whereas foo[*] can support _any_ traversal.
+                                marker := p.Read() // eat star
+                                trav := make(hcl.Traversal, 0, 1)
+                                var firstRange, lastRange hcl.Range
+                                firstRange = p.NextRange()
+                                for p.Peek().Type == TokenDot {
+                                        dot := p.Read()
+
+                                        if p.Peek().Type == TokenNumberLit {
+                                                // Continuing the "weird stuff inherited from HIL"
+                                                // theme, we also allow numbers as attribute names
+                                                // inside splats and interpret them as indexing
+                                                // into a list, for expressions like:
+                                                // foo.bar.*.baz.0.foo
+                                                numTok := p.Read()
+
+                                                // Weird special case if the user writes something
+                                                // like foo.bar.*.baz.0.0.foo, where 0.0 parses
+                                                // as a number.
+                                                if dotIdx := bytes.IndexByte(numTok.Bytes, '.'); dotIdx >= 0 {
+                                                        first := numTok.Bytes[:dotIdx]
+                                                        second := numTok.Bytes[dotIdx+1:]
+                                                        diags = append(diags, &hcl.Diagnostic{
+                                                                Severity: hcl.DiagError,
+                                                                Summary:  "Invalid legacy index syntax",
+                                                                Detail:   fmt.Sprintf("When using the legacy index syntax, chaining two indexes together is not permitted. Use the proper index syntax with a full splat expression [*] instead, like [%s][%s].", first, second),
+                                                                Subject:  &attrTok.Range,
+                                                        })
+                                                        trav = append(trav, hcl.TraverseIndex{
+                                                                Key:      cty.DynamicVal,
+                                                                SrcRange: hcl.RangeBetween(dot.Range, numTok.Range),
+                                                        })
+                                                        lastRange = numTok.Range
+                                                        continue
+                                                }
+
+                                                numVal, numDiags := p.numberLitValue(numTok)
+                                                diags = append(diags, numDiags...)
+                                                trav = append(trav, hcl.TraverseIndex{
+                                                        Key:      numVal,
+                                                        SrcRange: hcl.RangeBetween(dot.Range, numTok.Range),
+                                                })
+                                                lastRange = numTok.Range
+                                                continue
+                                        }
+
+                                        if p.Peek().Type != TokenIdent {
+                                                if !p.recovery {
+                                                        if p.Peek().Type == TokenStar {
+                                                                diags = append(diags, &hcl.Diagnostic{
+                                                                        Severity: hcl.DiagError,
+                                                                        Summary:  "Nested splat expression not allowed",
+                                                                        Detail:   "A splat expression (*) cannot be used inside another attribute-only splat expression.",
+                                                                        Subject:  p.Peek().Range.Ptr(),
+                                                                })
+                                                        } else {
+                                                                diags = append(diags, &hcl.Diagnostic{
+                                                                        Severity: hcl.DiagError,
+                                                                        Summary:  "Invalid attribute name",
+                                                                        Detail:   "An attribute name is required after a dot.",
+                                                                        Subject:  &attrTok.Range,
+                                                                })
+                                                        }
+                                                }
+                                                p.setRecovery()
+                                                continue Traversal
+                                        }
+
+                                        attrTok := p.Read()
+                                        trav = append(trav, hcl.TraverseAttr{
+                                                Name:     string(attrTok.Bytes),
+                                                SrcRange: hcl.RangeBetween(dot.Range, attrTok.Range),
+                                        })
+                                        lastRange = attrTok.Range
+                                }
+
+                                itemExpr := &AnonSymbolExpr{
+                                        SrcRange: hcl.RangeBetween(dot.Range, marker.Range),
+                                }
+                                var travExpr Expression
+                                if len(trav) == 0 {
+                                        travExpr = itemExpr
+                                } else {
+                                        travExpr = &RelativeTraversalExpr{
+                                                Source:    itemExpr,
+                                                Traversal: trav,
+                                                SrcRange:  hcl.RangeBetween(firstRange, lastRange),
+                                        }
+                                }
+
+                                ret = &SplatExpr{
+                                        Source: ret,
+                                        Each:   travExpr,
+                                        Item:   itemExpr,
+
+                                        SrcRange:    hcl.RangeBetween(dot.Range, lastRange),
+                                        MarkerRange: hcl.RangeBetween(dot.Range, marker.Range),
+                                }
+
+                        default:
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Invalid attribute name",
+                                        Detail:   "An attribute name is required after a dot.",
+                                        Subject:  &attrTok.Range,
+                                })
+                                // This leaves the peeker in a bad place, so following items
+                                // will probably be misparsed until we hit something that
+                                // allows us to re-sync.
+                                //
+                                // We will probably need to do something better here eventually
+                                // in order to support autocomplete triggered by typing a
+                                // period.
+                                p.setRecovery()
+                        }
+
+                case TokenOBrack:
+                        // Indexing of a collection.
+                        // This may or may not be a hcl.Traverser, depending on whether
+                        // the key value is something constant.
+
+                        open := p.Read()
+                        // TODO: If we have a TokenStar inside our brackets, parse as
+                        // a Splat expression: foo[*].baz[0].
+                        var close Token
+                        p.PushIncludeNewlines(false) // arbitrary newlines allowed in brackets
+                        keyExpr, keyDiags := p.ParseExpression()
+                        diags = append(diags, keyDiags...)
+                        if p.recovery && keyDiags.HasErrors() {
+                                close = p.recover(TokenCBrack)
+                        } else {
+                                close = p.Read()
+                                if close.Type != TokenCBrack && !p.recovery {
+                                        diags = append(diags, &hcl.Diagnostic{
+                                                Severity: hcl.DiagError,
+                                                Summary:  "Missing close bracket on index",
+                                                Detail:   "The index operator must end with a closing bracket (\"]\").",
+                                                Subject:  &close.Range,
+                                        })
+                                        close = p.recover(TokenCBrack)
+                                }
+                        }
+                        p.PopIncludeNewlines()
+
+                        if lit, isLit := keyExpr.(*LiteralValueExpr); isLit {
+                                litKey, _ := lit.Value(nil)
+                                rng := hcl.RangeBetween(open.Range, close.Range)
+                                step := hcl.TraverseIndex{
+                                        Key:      litKey,
+                                        SrcRange: rng,
+                                }
+                                ret = makeRelativeTraversal(ret, step, rng)
+                        } else {
+                                rng := hcl.RangeBetween(open.Range, close.Range)
+                                ret = &IndexExpr{
+                                        Collection: ret,
+                                        Key:        keyExpr,
+
+                                        SrcRange:  rng,
+                                        OpenRange: open.Range,
+                                }
+                        }
+
+                default:
+                        break Traversal
+                }
+        }
+
+        return ret, diags
+}
+
+// makeRelativeTraversal takes an expression and a traverser and returns
+// a traversal expression that combines the two. If the given expression
+// is already a traversal, it is extended in place (mutating it) and
+// returned. If it isn't, a new RelativeTraversalExpr is created and returned.
+func makeRelativeTraversal(expr Expression, next hcl.Traverser, rng hcl.Range) Expression {
+        switch texpr := expr.(type) {
+        case *ScopeTraversalExpr:
+                texpr.Traversal = append(texpr.Traversal, next)
+                texpr.SrcRange = hcl.RangeBetween(texpr.SrcRange, rng)
+                return texpr
+        case *RelativeTraversalExpr:
+                texpr.Traversal = append(texpr.Traversal, next)
+                texpr.SrcRange = hcl.RangeBetween(texpr.SrcRange, rng)
+                return texpr
+        default:
+                return &RelativeTraversalExpr{
+                        Source:    expr,
+                        Traversal: hcl.Traversal{next},
+                        SrcRange:  rng,
+                }
+        }
+}
+
+func (p *parser) parseExpressionTerm() (Expression, hcl.Diagnostics) {
+        start := p.Peek()
+
+        switch start.Type {
+        case TokenOParen:
+                p.Read() // eat open paren
+
+                p.PushIncludeNewlines(false)
+
+                expr, diags := p.ParseExpression()
+                if diags.HasErrors() {
+                        // attempt to place the peeker after our closing paren
+                        // before we return, so that the next parser has some
+                        // chance of finding a valid expression.
+                        p.recover(TokenCParen)
+                        p.PopIncludeNewlines()
+                        return expr, diags
+                }
+
+                close := p.Peek()
+                if close.Type != TokenCParen {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Unbalanced parentheses",
+                                Detail:   "Expected a closing parenthesis to terminate the expression.",
+                                Subject:  &close.Range,
+                                Context:  hcl.RangeBetween(start.Range, close.Range).Ptr(),
+                        })
+                        p.setRecovery()
+                }
+
+                p.Read() // eat closing paren
+                p.PopIncludeNewlines()
+
+                return expr, diags
+
+        case TokenNumberLit:
+                tok := p.Read() // eat number token
+
+                numVal, diags := p.numberLitValue(tok)
+                return &LiteralValueExpr{
+                        Val:      numVal,
+                        SrcRange: tok.Range,
+                }, diags
+
+        case TokenIdent:
+                tok := p.Read() // eat identifier token
+
+                if p.Peek().Type == TokenOParen {
+                        return p.finishParsingFunctionCall(tok)
+                }
+
+                name := string(tok.Bytes)
+                switch name {
+                case "true":
+                        return &LiteralValueExpr{
+                                Val:      cty.True,
+                                SrcRange: tok.Range,
+                        }, nil
+                case "false":
+                        return &LiteralValueExpr{
+                                Val:      cty.False,
+                                SrcRange: tok.Range,
+                        }, nil
+                case "null":
+                        return &LiteralValueExpr{
+                                Val:      cty.NullVal(cty.DynamicPseudoType),
+                                SrcRange: tok.Range,
+                        }, nil
+                default:
+                        return &ScopeTraversalExpr{
+                                Traversal: hcl.Traversal{
+                                        hcl.TraverseRoot{
+                                                Name:     name,
+                                                SrcRange: tok.Range,
+                                        },
+                                },
+                                SrcRange: tok.Range,
+                        }, nil
+                }
+
+        case TokenOQuote, TokenOHeredoc:
+                open := p.Read() // eat opening marker
+                closer := p.oppositeBracket(open.Type)
+                exprs, passthru, _, diags := p.parseTemplateInner(closer)
+
+                closeRange := p.PrevRange()
+
+                if passthru {
+                        if len(exprs) != 1 {
+                                panic("passthru set with len(exprs) != 1")
+                        }
+                        return &TemplateWrapExpr{
+                                Wrapped:  exprs[0],
+                                SrcRange: hcl.RangeBetween(open.Range, closeRange),
+                        }, diags
+                }
+
+                return &TemplateExpr{
+                        Parts:    exprs,
+                        SrcRange: hcl.RangeBetween(open.Range, closeRange),
+                }, diags
+
+        case TokenMinus:
+                tok := p.Read() // eat minus token
+
+                // Important to use parseExpressionWithTraversals rather than parseExpression
+                // here, otherwise we can capture a following binary expression into
+                // our negation.
+                // e.g. -46+5 should parse as (-46)+5, not -(46+5)
+                operand, diags := p.parseExpressionWithTraversals()
+                return &UnaryOpExpr{
+                        Op:  OpNegate,
+                        Val: operand,
+
+                        SrcRange:    hcl.RangeBetween(tok.Range, operand.Range()),
+                        SymbolRange: tok.Range,
+                }, diags
+
+        case TokenBang:
+                tok := p.Read() // eat bang token
+
+                // Important to use parseExpressionWithTraversals rather than parseExpression
+                // here, otherwise we can capture a following binary expression into
+                // our negation.
+                operand, diags := p.parseExpressionWithTraversals()
+                return &UnaryOpExpr{
+                        Op:  OpLogicalNot,
+                        Val: operand,
+
+                        SrcRange:    hcl.RangeBetween(tok.Range, operand.Range()),
+                        SymbolRange: tok.Range,
+                }, diags
+
+        case TokenOBrack:
+                return p.parseTupleCons()
+
+        case TokenOBrace:
+                return p.parseObjectCons()
+
+        default:
+                var diags hcl.Diagnostics
+                if !p.recovery {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid expression",
+                                Detail:   "Expected the start of an expression, but found an invalid expression token.",
+                                Subject:  &start.Range,
+                        })
+                }
+                p.setRecovery()
+
+                // Return a placeholder so that the AST is still structurally sound
+                // even in the presence of parse errors.
+                return &LiteralValueExpr{
+                        Val:      cty.DynamicVal,
+                        SrcRange: start.Range,
+                }, diags
+        }
+}
+
+func (p *parser) numberLitValue(tok Token) (cty.Value, hcl.Diagnostics) {
+        // We'll lean on the cty converter to do the conversion, to ensure that
+        // the behavior is the same as what would happen if converting a
+        // non-literal string to a number.
+        numStrVal := cty.StringVal(string(tok.Bytes))
+        numVal, err := convert.Convert(numStrVal, cty.Number)
+        if err != nil {
+                ret := cty.UnknownVal(cty.Number)
+                return ret, hcl.Diagnostics{
+                        {
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid number literal",
+                                // FIXME: not a very good error message, but convert only
+                                // gives us "a number is required", so not much help either.
+                                Detail:  "Failed to recognize the value of this number literal.",
+                                Subject: &tok.Range,
+                        },
+                }
+        }
+        return numVal, nil
+}
+
+// finishParsingFunctionCall parses a function call assuming that the function
+// name was already read, and so the peeker should be pointing at the opening
+// parenthesis after the name.
+func (p *parser) finishParsingFunctionCall(name Token) (Expression, hcl.Diagnostics) {
+        openTok := p.Read()
+        if openTok.Type != TokenOParen {
+                // should never happen if callers behave
+                panic("finishParsingFunctionCall called with non-parenthesis as next token")
+        }
+
+        var args []Expression
+        var diags hcl.Diagnostics
+        var expandFinal bool
+        var closeTok Token
+
+        // Arbitrary newlines are allowed inside the function call parentheses.
+        p.PushIncludeNewlines(false)
+
+Token:
+        for {
+                tok := p.Peek()
+
+                if tok.Type == TokenCParen {
+                        closeTok = p.Read() // eat closing paren
+                        break Token
+                }
+
+                arg, argDiags := p.ParseExpression()
+                args = append(args, arg)
+                diags = append(diags, argDiags...)
+                if p.recovery && argDiags.HasErrors() {
+                        // if there was a parse error in the argument then we've
+                        // probably been left in a weird place in the token stream,
+                        // so we'll bail out with a partial argument list.
+                        p.recover(TokenCParen)
+                        break Token
+                }
+
+                sep := p.Read()
+                if sep.Type == TokenCParen {
+                        closeTok = sep
+                        break Token
+                }
+
+                if sep.Type == TokenEllipsis {
+                        expandFinal = true
+
+                        if p.Peek().Type != TokenCParen {
+                                if !p.recovery {
+                                        diags = append(diags, &hcl.Diagnostic{
+                                                Severity: hcl.DiagError,
+                                                Summary:  "Missing closing parenthesis",
+                                                Detail:   "An expanded function argument (with ...) must be immediately followed by closing parentheses.",
+                                                Subject:  &sep.Range,
+                                                Context:  hcl.RangeBetween(name.Range, sep.Range).Ptr(),
+                                        })
+                                }
+                                closeTok = p.recover(TokenCParen)
+                        } else {
+                                closeTok = p.Read() // eat closing paren
+                        }
+                        break Token
+                }
+
+                if sep.Type != TokenComma {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Missing argument separator",
+                                Detail:   "A comma is required to separate each function argument from the next.",
+                                Subject:  &sep.Range,
+                                Context:  hcl.RangeBetween(name.Range, sep.Range).Ptr(),
+                        })
+                        closeTok = p.recover(TokenCParen)
+                        break Token
+                }
+
+                if p.Peek().Type == TokenCParen {
+                        // A trailing comma after the last argument gets us in here.
+                        closeTok = p.Read() // eat closing paren
+                        break Token
+                }
+
+        }
+
+        p.PopIncludeNewlines()
+
+        return &FunctionCallExpr{
+                Name: string(name.Bytes),
+                Args: args,
+
+                ExpandFinal: expandFinal,
+
+                NameRange:       name.Range,
+                OpenParenRange:  openTok.Range,
+                CloseParenRange: closeTok.Range,
+        }, diags
+}
+
+func (p *parser) parseTupleCons() (Expression, hcl.Diagnostics) {
+        open := p.Read()
+        if open.Type != TokenOBrack {
+                // Should never happen if callers are behaving
+                panic("parseTupleCons called without peeker pointing to open bracket")
+        }
+
+        p.PushIncludeNewlines(false)
+        defer p.PopIncludeNewlines()
+
+        if forKeyword.TokenMatches(p.Peek()) {
+                return p.finishParsingForExpr(open)
+        }
+
+        var close Token
+
+        var diags hcl.Diagnostics
+        var exprs []Expression
+
+        for {
+                next := p.Peek()
+                if next.Type == TokenCBrack {
+                        close = p.Read() // eat closer
+                        break
+                }
+
+                expr, exprDiags := p.ParseExpression()
+                exprs = append(exprs, expr)
+                diags = append(diags, exprDiags...)
+
+                if p.recovery && exprDiags.HasErrors() {
+                        // If expression parsing failed then we are probably in a strange
+                        // place in the token stream, so we'll bail out and try to reset
+                        // to after our closing bracket to allow parsing to continue.
+                        close = p.recover(TokenCBrack)
+                        break
+                }
+
+                next = p.Peek()
+                if next.Type == TokenCBrack {
+                        close = p.Read() // eat closer
+                        break
+                }
+
+                if next.Type != TokenComma {
+                        if !p.recovery {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Missing item separator",
+                                        Detail:   "Expected a comma to mark the beginning of the next item.",
+                                        Subject:  &next.Range,
+                                        Context:  hcl.RangeBetween(open.Range, next.Range).Ptr(),
+                                })
+                        }
+                        close = p.recover(TokenCBrack)
+                        break
+                }
+
+                p.Read() // eat comma
+
+        }
+
+        return &TupleConsExpr{
+                Exprs: exprs,
+
+                SrcRange:  hcl.RangeBetween(open.Range, close.Range),
+                OpenRange: open.Range,
+        }, diags
+}
+
+func (p *parser) parseObjectCons() (Expression, hcl.Diagnostics) {
+        open := p.Read()
+        if open.Type != TokenOBrace {
+                // Should never happen if callers are behaving
+                panic("parseObjectCons called without peeker pointing to open brace")
+        }
+
+        p.PushIncludeNewlines(true)
+        defer p.PopIncludeNewlines()
+
+        if forKeyword.TokenMatches(p.Peek()) {
+                return p.finishParsingForExpr(open)
+        }
+
+        var close Token
+
+        var diags hcl.Diagnostics
+        var items []ObjectConsItem
+
+        for {
+                next := p.Peek()
+                if next.Type == TokenNewline {
+                        p.Read() // eat newline
+                        continue
+                }
+
+                if next.Type == TokenCBrace {
+                        close = p.Read() // eat closer
+                        break
+                }
+
+                var key Expression
+                var keyDiags hcl.Diagnostics
+                key, keyDiags = p.ParseExpression()
+                diags = append(diags, keyDiags...)
+
+                if p.recovery && keyDiags.HasErrors() {
+                        // If expression parsing failed then we are probably in a strange
+                        // place in the token stream, so we'll bail out and try to reset
+                        // to after our closing brace to allow parsing to continue.
+                        close = p.recover(TokenCBrace)
+                        break
+                }
+
+                // We wrap up the key expression in a special wrapper that deals
+                // with our special case that naked identifiers as object keys
+                // are interpreted as literal strings.
+                key = &ObjectConsKeyExpr{Wrapped: key}
+
+                next = p.Peek()
+                if next.Type != TokenEqual && next.Type != TokenColon {
+                        if !p.recovery {
+                                if next.Type == TokenNewline || next.Type == TokenComma {
+                                        diags = append(diags, &hcl.Diagnostic{
+                                                Severity: hcl.DiagError,
+                                                Summary:  "Missing item value",
+                                                Detail:   "Expected an item value, introduced by an equals sign (\"=\").",
+                                                Subject:  &next.Range,
+                                                Context:  hcl.RangeBetween(open.Range, next.Range).Ptr(),
+                                        })
+                                } else {
+                                        diags = append(diags, &hcl.Diagnostic{
+                                                Severity: hcl.DiagError,
+                                                Summary:  "Missing key/value separator",
+                                                Detail:   "Expected an equals sign (\"=\") to mark the beginning of the item value.",
+                                                Subject:  &next.Range,
+                                                Context:  hcl.RangeBetween(open.Range, next.Range).Ptr(),
+                                        })
+                                }
+                        }
+                        close = p.recover(TokenCBrace)
+                        break
+                }
+
+                p.Read() // eat equals sign or colon
+
+                value, valueDiags := p.ParseExpression()
+                diags = append(diags, valueDiags...)
+
+                if p.recovery && valueDiags.HasErrors() {
+                        // If expression parsing failed then we are probably in a strange
+                        // place in the token stream, so we'll bail out and try to reset
+                        // to after our closing brace to allow parsing to continue.
+                        close = p.recover(TokenCBrace)
+                        break
+                }
+
+                items = append(items, ObjectConsItem{
+                        KeyExpr:   key,
+                        ValueExpr: value,
+                })
+
+                next = p.Peek()
+                if next.Type == TokenCBrace {
+                        close = p.Read() // eat closer
+                        break
+                }
+
+                if next.Type != TokenComma && next.Type != TokenNewline {
+                        if !p.recovery {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Missing item separator",
+                                        Detail:   "Expected a newline or comma to mark the beginning of the next item.",
+                                        Subject:  &next.Range,
+                                        Context:  hcl.RangeBetween(open.Range, next.Range).Ptr(),
+                                })
+                        }
+                        close = p.recover(TokenCBrace)
+                        break
+                }
+
+                p.Read() // eat comma or newline
+
+        }
+
+        return &ObjectConsExpr{
+                Items: items,
+
+                SrcRange:  hcl.RangeBetween(open.Range, close.Range),
+                OpenRange: open.Range,
+        }, diags
+}
+
+func (p *parser) finishParsingForExpr(open Token) (Expression, hcl.Diagnostics) {
+        introducer := p.Read()
+        if !forKeyword.TokenMatches(introducer) {
+                // Should never happen if callers are behaving
+                panic("finishParsingForExpr called without peeker pointing to 'for' identifier")
+        }
+
+        var makeObj bool
+        var closeType TokenType
+        switch open.Type {
+        case TokenOBrace:
+                makeObj = true
+                closeType = TokenCBrace
+        case TokenOBrack:
+                makeObj = false // making a tuple
+                closeType = TokenCBrack
+        default:
+                // Should never happen if callers are behaving
+                panic("finishParsingForExpr called with invalid open token")
+        }
+
+        var diags hcl.Diagnostics
+        var keyName, valName string
+
+        if p.Peek().Type != TokenIdent {
+                if !p.recovery {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid 'for' expression",
+                                Detail:   "For expression requires variable name after 'for'.",
+                                Subject:  p.Peek().Range.Ptr(),
+                                Context:  hcl.RangeBetween(open.Range, p.Peek().Range).Ptr(),
+                        })
+                }
+                close := p.recover(closeType)
+                return &LiteralValueExpr{
+                        Val:      cty.DynamicVal,
+                        SrcRange: hcl.RangeBetween(open.Range, close.Range),
+                }, diags
+        }
+
+        valName = string(p.Read().Bytes)
+
+        if p.Peek().Type == TokenComma {
+                // What we just read was actually the key, then.
+                keyName = valName
+                p.Read() // eat comma
+
+                if p.Peek().Type != TokenIdent {
+                        if !p.recovery {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Invalid 'for' expression",
+                                        Detail:   "For expression requires value variable name after comma.",
+                                        Subject:  p.Peek().Range.Ptr(),
+                                        Context:  hcl.RangeBetween(open.Range, p.Peek().Range).Ptr(),
+                                })
+                        }
+                        close := p.recover(closeType)
+                        return &LiteralValueExpr{
+                                Val:      cty.DynamicVal,
+                                SrcRange: hcl.RangeBetween(open.Range, close.Range),
+                        }, diags
+                }
+
+                valName = string(p.Read().Bytes)
+        }
+
+        if !inKeyword.TokenMatches(p.Peek()) {
+                if !p.recovery {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid 'for' expression",
+                                Detail:   "For expression requires 'in' keyword after names.",
+                                Subject:  p.Peek().Range.Ptr(),
+                                Context:  hcl.RangeBetween(open.Range, p.Peek().Range).Ptr(),
+                        })
+                }
+                close := p.recover(closeType)
+                return &LiteralValueExpr{
+                        Val:      cty.DynamicVal,
+                        SrcRange: hcl.RangeBetween(open.Range, close.Range),
+                }, diags
+        }
+        p.Read() // eat 'in' keyword
+
+        collExpr, collDiags := p.ParseExpression()
+        diags = append(diags, collDiags...)
+        if p.recovery && collDiags.HasErrors() {
+                close := p.recover(closeType)
+                return &LiteralValueExpr{
+                        Val:      cty.DynamicVal,
+                        SrcRange: hcl.RangeBetween(open.Range, close.Range),
+                }, diags
+        }
+
+        if p.Peek().Type != TokenColon {
+                if !p.recovery {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid 'for' expression",
+                                Detail:   "For expression requires colon after collection expression.",
+                                Subject:  p.Peek().Range.Ptr(),
+                                Context:  hcl.RangeBetween(open.Range, p.Peek().Range).Ptr(),
+                        })
+                }
+                close := p.recover(closeType)
+                return &LiteralValueExpr{
+                        Val:      cty.DynamicVal,
+                        SrcRange: hcl.RangeBetween(open.Range, close.Range),
+                }, diags
+        }
+        p.Read() // eat colon
+
+        var keyExpr, valExpr Expression
+        var keyDiags, valDiags hcl.Diagnostics
+        valExpr, valDiags = p.ParseExpression()
+        if p.Peek().Type == TokenFatArrow {
+                // What we just parsed was actually keyExpr
+                p.Read() // eat the fat arrow
+                keyExpr, keyDiags = valExpr, valDiags
+
+                valExpr, valDiags = p.ParseExpression()
+        }
+        diags = append(diags, keyDiags...)
+        diags = append(diags, valDiags...)
+        if p.recovery && (keyDiags.HasErrors() || valDiags.HasErrors()) {
+                close := p.recover(closeType)
+                return &LiteralValueExpr{
+                        Val:      cty.DynamicVal,
+                        SrcRange: hcl.RangeBetween(open.Range, close.Range),
+                }, diags
+        }
+
+        group := false
+        var ellipsis Token
+        if p.Peek().Type == TokenEllipsis {
+                ellipsis = p.Read()
+                group = true
+        }
+
+        var condExpr Expression
+        var condDiags hcl.Diagnostics
+        if ifKeyword.TokenMatches(p.Peek()) {
+                p.Read() // eat "if"
+                condExpr, condDiags = p.ParseExpression()
+                diags = append(diags, condDiags...)
+                if p.recovery && condDiags.HasErrors() {
+                        close := p.recover(p.oppositeBracket(open.Type))
+                        return &LiteralValueExpr{
+                                Val:      cty.DynamicVal,
+                                SrcRange: hcl.RangeBetween(open.Range, close.Range),
+                        }, diags
+                }
+        }
+
+        var close Token
+        if p.Peek().Type == closeType {
+                close = p.Read()
+        } else {
+                if !p.recovery {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid 'for' expression",
+                                Detail:   "Extra characters after the end of the 'for' expression.",
+                                Subject:  p.Peek().Range.Ptr(),
+                                Context:  hcl.RangeBetween(open.Range, p.Peek().Range).Ptr(),
+                        })
+                }
+                close = p.recover(closeType)
+        }
+
+        if !makeObj {
+                if keyExpr != nil {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid 'for' expression",
+                                Detail:   "Key expression is not valid when building a tuple.",
+                                Subject:  keyExpr.Range().Ptr(),
+                                Context:  hcl.RangeBetween(open.Range, close.Range).Ptr(),
+                        })
+                }
+
+                if group {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid 'for' expression",
+                                Detail:   "Grouping ellipsis (...) cannot be used when building a tuple.",
+                                Subject:  &ellipsis.Range,
+                                Context:  hcl.RangeBetween(open.Range, close.Range).Ptr(),
+                        })
+                }
+        } else {
+                if keyExpr == nil {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid 'for' expression",
+                                Detail:   "Key expression is required when building an object.",
+                                Subject:  valExpr.Range().Ptr(),
+                                Context:  hcl.RangeBetween(open.Range, close.Range).Ptr(),
+                        })
+                }
+        }
+
+        return &ForExpr{
+                KeyVar:   keyName,
+                ValVar:   valName,
+                CollExpr: collExpr,
+                KeyExpr:  keyExpr,
+                ValExpr:  valExpr,
+                CondExpr: condExpr,
+                Group:    group,
+
+                SrcRange:   hcl.RangeBetween(open.Range, close.Range),
+                OpenRange:  open.Range,
+                CloseRange: close.Range,
+        }, diags
+}
+
+// parseQuotedStringLiteral is a helper for parsing quoted strings that
+// aren't allowed to contain any interpolations, such as block labels.
+func (p *parser) parseQuotedStringLiteral() (string, hcl.Range, hcl.Diagnostics) {
+        oQuote := p.Read()
+        if oQuote.Type != TokenOQuote {
+                return "", oQuote.Range, hcl.Diagnostics{
+                        {
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid string literal",
+                                Detail:   "A quoted string is required here.",
+                                Subject:  &oQuote.Range,
+                        },
+                }
+        }
+
+        var diags hcl.Diagnostics
+        ret := &bytes.Buffer{}
+        var cQuote Token
+
+Token:
+        for {
+                tok := p.Read()
+                switch tok.Type {
+
+                case TokenCQuote:
+                        cQuote = tok
+                        break Token
+
+                case TokenQuotedLit:
+                        s, sDiags := p.decodeStringLit(tok)
+                        diags = append(diags, sDiags...)
+                        ret.WriteString(s)
+
+                case TokenTemplateControl, TokenTemplateInterp:
+                        which := "$"
+                        if tok.Type == TokenTemplateControl {
+                                which = "!"
+                        }
+
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid string literal",
+                                Detail: fmt.Sprintf(
+                                        "Template sequences are not allowed in this string. To include a literal %q, double it (as \"%s%s\") to escape it.",
+                                        which, which, which,
+                                ),
+                                Subject: &tok.Range,
+                                Context: hcl.RangeBetween(oQuote.Range, tok.Range).Ptr(),
+                        })
+                        p.recover(TokenTemplateSeqEnd)
+
+                case TokenEOF:
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Unterminated string literal",
+                                Detail:   "Unable to find the closing quote mark before the end of the file.",
+                                Subject:  &tok.Range,
+                                Context:  hcl.RangeBetween(oQuote.Range, tok.Range).Ptr(),
+                        })
+                        break Token
+
+                default:
+                        // Should never happen, as long as the scanner is behaving itself
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid string literal",
+                                Detail:   "This item is not valid in a string literal.",
+                                Subject:  &tok.Range,
+                                Context:  hcl.RangeBetween(oQuote.Range, tok.Range).Ptr(),
+                        })
+                        p.recover(TokenOQuote)
+                        break Token
+
+                }
+
+        }
+
+        return ret.String(), hcl.RangeBetween(oQuote.Range, cQuote.Range), diags
+}
+
+// decodeStringLit processes the given token, which must be either a
+// TokenQuotedLit or a TokenStringLit, returning the string resulting from
+// resolving any escape sequences.
+//
+// If any error diagnostics are returned, the returned string may be incomplete
+// or otherwise invalid.
+func (p *parser) decodeStringLit(tok Token) (string, hcl.Diagnostics) {
+        var quoted bool
+        switch tok.Type {
+        case TokenQuotedLit:
+                quoted = true
+        case TokenStringLit:
+                quoted = false
+        default:
+                panic("decodeQuotedLit can only be used with TokenStringLit and TokenQuotedLit tokens")
+        }
+        var diags hcl.Diagnostics
+
+        ret := make([]byte, 0, len(tok.Bytes))
+        slices := scanStringLit(tok.Bytes, quoted)
+
+        // We will mutate rng constantly as we walk through our token slices below.
+        // Any diagnostics must take a copy of this rng rather than simply pointing
+        // to it, e.g. by using rng.Ptr() rather than &rng.
+        rng := tok.Range
+        rng.End = rng.Start
+
+Slices:
+        for _, slice := range slices {
+                if len(slice) == 0 {
+                        continue
+                }
+
+                // Advance the start of our range to where the previous token ended
+                rng.Start = rng.End
+
+                // Advance the end of our range to after our token.
+                b := slice
+                for len(b) > 0 {
+                        adv, ch, _ := textseg.ScanGraphemeClusters(b, true)
+                        rng.End.Byte += adv
+                        switch ch[0] {
+                        case '\r', '\n':
+                                rng.End.Line++
+                                rng.End.Column = 1
+                        default:
+                                rng.End.Column++
+                        }
+                        b = b[adv:]
+                }
+
+        TokenType:
+                switch slice[0] {
+                case '\\':
+                        if !quoted {
+                                // If we're not in quoted mode then just treat this token as
+                                // normal. (Slices can still start with backslash even if we're
+                                // not specifically looking for backslash sequences.)
+                                break TokenType
+                        }
+                        if len(slice) < 2 {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Invalid escape sequence",
+                                        Detail:   "Backslash must be followed by an escape sequence selector character.",
+                                        Subject:  rng.Ptr(),
+                                })
+                                break TokenType
+                        }
+
+                        switch slice[1] {
+
+                        case 'n':
+                                ret = append(ret, '\n')
+                                continue Slices
+                        case 'r':
+                                ret = append(ret, '\r')
+                                continue Slices
+                        case 't':
+                                ret = append(ret, '\t')
+                                continue Slices
+                        case '"':
+                                ret = append(ret, '"')
+                                continue Slices
+                        case '\\':
+                                ret = append(ret, '\\')
+                                continue Slices
+                        case 'u', 'U':
+                                if slice[1] == 'u' && len(slice) != 6 {
+                                        diags = append(diags, &hcl.Diagnostic{
+                                                Severity: hcl.DiagError,
+                                                Summary:  "Invalid escape sequence",
+                                                Detail:   "The \\u escape sequence must be followed by four hexadecimal digits.",
+                                                Subject:  rng.Ptr(),
+                                        })
+                                        break TokenType
+                                } else if slice[1] == 'U' && len(slice) != 10 {
+                                        diags = append(diags, &hcl.Diagnostic{
+                                                Severity: hcl.DiagError,
+                                                Summary:  "Invalid escape sequence",
+                                                Detail:   "The \\U escape sequence must be followed by eight hexadecimal digits.",
+                                                Subject:  rng.Ptr(),
+                                        })
+                                        break TokenType
+                                }
+
+                                numHex := string(slice[2:])
+                                num, err := strconv.ParseUint(numHex, 16, 32)
+                                if err != nil {
+                                        // Should never happen because the scanner won't match
+                                        // a sequence of digits that isn't valid.
+                                        panic(err)
+                                }
+
+                                r := rune(num)
+                                l := utf8.RuneLen(r)
+                                if l == -1 {
+                                        diags = append(diags, &hcl.Diagnostic{
+                                                Severity: hcl.DiagError,
+                                                Summary:  "Invalid escape sequence",
+                                                Detail:   fmt.Sprintf("Cannot encode character U+%04x in UTF-8.", num),
+                                                Subject:  rng.Ptr(),
+                                        })
+                                        break TokenType
+                                }
+                                for i := 0; i < l; i++ {
+                                        ret = append(ret, 0)
+                                }
+                                rb := ret[len(ret)-l:]
+                                utf8.EncodeRune(rb, r)
+
+                                continue Slices
+
+                        default:
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Invalid escape sequence",
+                                        Detail:   fmt.Sprintf("The symbol %q is not a valid escape sequence selector.", slice[1:]),
+                                        Subject:  rng.Ptr(),
+                                })
+                                ret = append(ret, slice[1:]...)
+                                continue Slices
+                        }
+
+                case '$', '%':
+                        if len(slice) != 3 {
+                                // Not long enough to be our escape sequence, so it's literal.
+                                break TokenType
+                        }
+
+                        if slice[1] == slice[0] && slice[2] == '{' {
+                                ret = append(ret, slice[0])
+                                ret = append(ret, '{')
+                                continue Slices
+                        }
+
+                        break TokenType
+                }
+
+                // If we fall out here or break out of here from the switch above
+                // then this slice is just a literal.
+                ret = append(ret, slice...)
+        }
+
+        return string(ret), diags
+}
+
+// setRecovery turns on recovery mode without actually doing any recovery.
+// This can be used when a parser knowingly leaves the peeker in a useless
+// place and wants to suppress errors that might result from that decision.
+func (p *parser) setRecovery() {
+        p.recovery = true
+}
+
+// recover seeks forward in the token stream until it finds TokenType "end",
+// then returns with the peeker pointed at the following token.
+//
+// If the given token type is a bracketer, this function will additionally
+// count nested instances of the brackets to try to leave the peeker at
+// the end of the _current_ instance of that bracketer, skipping over any
+// nested instances. This is a best-effort operation and may have
+// unpredictable results on input with bad bracketer nesting.
+func (p *parser) recover(end TokenType) Token {
+        start := p.oppositeBracket(end)
+        p.recovery = true
+
+        nest := 0
+        for {
+                tok := p.Read()
+                ty := tok.Type
+                if end == TokenTemplateSeqEnd && ty == TokenTemplateControl {
+                        // normalize so that our matching behavior can work, since
+                        // TokenTemplateControl/TokenTemplateInterp are asymmetrical
+                        // with TokenTemplateSeqEnd and thus we need to count both
+                        // openers if that's the closer we're looking for.
+                        ty = TokenTemplateInterp
+                }
+
+                switch ty {
+                case start:
+                        nest++
+                case end:
+                        if nest < 1 {
+                                return tok
+                        }
+
+                        nest--
+                case TokenEOF:
+                        return tok
+                }
+        }
+}
+
+// recoverOver seeks forward in the token stream until it finds a block
+// starting with TokenType "start", then finds the corresponding end token,
+// leaving the peeker pointed at the token after that end token.
+//
+// The given token type _must_ be a bracketer. For example, if the given
+// start token is TokenOBrace then the parser will be left at the _end_ of
+// the next brace-delimited block encountered, or at EOF if no such block
+// is found or it is unclosed.
+func (p *parser) recoverOver(start TokenType) {
+        end := p.oppositeBracket(start)
+
+        // find the opening bracket first
+Token:
+        for {
+                tok := p.Read()
+                switch tok.Type {
+                case start, TokenEOF:
+                        break Token
+                }
+        }
+
+        // Now use our existing recover function to locate the _end_ of the
+        // container we've found.
+        p.recover(end)
+}
+
+func (p *parser) recoverAfterBodyItem() {
+        p.recovery = true
+        var open []TokenType
+
+Token:
+        for {
+                tok := p.Read()
+
+                switch tok.Type {
+
+                case TokenNewline:
+                        if len(open) == 0 {
+                                break Token
+                        }
+
+                case TokenEOF:
+                        break Token
+
+                case TokenOBrace, TokenOBrack, TokenOParen, TokenOQuote, TokenOHeredoc, TokenTemplateInterp, TokenTemplateControl:
+                        open = append(open, tok.Type)
+
+                case TokenCBrace, TokenCBrack, TokenCParen, TokenCQuote, TokenCHeredoc:
+                        opener := p.oppositeBracket(tok.Type)
+                        for len(open) > 0 && open[len(open)-1] != opener {
+                                open = open[:len(open)-1]
+                        }
+                        if len(open) > 0 {
+                                open = open[:len(open)-1]
+                        }
+
+                case TokenTemplateSeqEnd:
+                        for len(open) > 0 && open[len(open)-1] != TokenTemplateInterp && open[len(open)-1] != TokenTemplateControl {
+                                open = open[:len(open)-1]
+                        }
+                        if len(open) > 0 {
+                                open = open[:len(open)-1]
+                        }
+
+                }
+        }
+}
+
+// oppositeBracket finds the bracket that opposes the given bracketer, or
+// NilToken if the given token isn't a bracketer.
+//
+// "Bracketer", for the sake of this function, is one end of a matching
+// open/close set of tokens that establish a bracketing context.
+func (p *parser) oppositeBracket(ty TokenType) TokenType {
+        switch ty {
+
+        case TokenOBrace:
+                return TokenCBrace
+        case TokenOBrack:
+                return TokenCBrack
+        case TokenOParen:
+                return TokenCParen
+        case TokenOQuote:
+                return TokenCQuote
+        case TokenOHeredoc:
+                return TokenCHeredoc
+
+        case TokenCBrace:
+                return TokenOBrace
+        case TokenCBrack:
+                return TokenOBrack
+        case TokenCParen:
+                return TokenOParen
+        case TokenCQuote:
+                return TokenOQuote
+        case TokenCHeredoc:
+                return TokenOHeredoc
+
+        case TokenTemplateControl:
+                return TokenTemplateSeqEnd
+        case TokenTemplateInterp:
+                return TokenTemplateSeqEnd
+        case TokenTemplateSeqEnd:
+                // This is ambigous, but we return Interp here because that's
+                // what's assumed by the "recover" method.
+                return TokenTemplateInterp
+
+        default:
+                return TokenNil
+        }
+}
+
+func errPlaceholderExpr(rng hcl.Range) Expression {
+        return &LiteralValueExpr{
+                Val:      cty.DynamicVal,
+                SrcRange: rng,
+        }
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/parser_template.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/parser_template.go
new file mode 100644
index 0000000..3711067
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/parser_template.go
@@ -0,0 +1,728 @@
+package hclsyntax
+
+import (
+        "fmt"
+        "strings"
+        "unicode"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+)
+
+func (p *parser) ParseTemplate() (Expression, hcl.Diagnostics) {
+        return p.parseTemplate(TokenEOF)
+}
+
+func (p *parser) parseTemplate(end TokenType) (Expression, hcl.Diagnostics) {
+        exprs, passthru, rng, diags := p.parseTemplateInner(end)
+
+        if passthru {
+                if len(exprs) != 1 {
+                        panic("passthru set with len(exprs) != 1")
+                }
+                return &TemplateWrapExpr{
+                        Wrapped:  exprs[0],
+                        SrcRange: rng,
+                }, diags
+        }
+
+        return &TemplateExpr{
+                Parts:    exprs,
+                SrcRange: rng,
+        }, diags
+}
+
+func (p *parser) parseTemplateInner(end TokenType) ([]Expression, bool, hcl.Range, hcl.Diagnostics) {
+        parts, diags := p.parseTemplateParts(end)
+        tp := templateParser{
+                Tokens:   parts.Tokens,
+                SrcRange: parts.SrcRange,
+        }
+        exprs, exprsDiags := tp.parseRoot()
+        diags = append(diags, exprsDiags...)
+
+        passthru := false
+        if len(parts.Tokens) == 2 { // one real token and one synthetic "end" token
+                if _, isInterp := parts.Tokens[0].(*templateInterpToken); isInterp {
+                        passthru = true
+                }
+        }
+
+        return exprs, passthru, parts.SrcRange, diags
+}
+
+type templateParser struct {
+        Tokens   []templateToken
+        SrcRange hcl.Range
+
+        pos int
+}
+
+func (p *templateParser) parseRoot() ([]Expression, hcl.Diagnostics) {
+        var exprs []Expression
+        var diags hcl.Diagnostics
+
+        for {
+                next := p.Peek()
+                if _, isEnd := next.(*templateEndToken); isEnd {
+                        break
+                }
+
+                expr, exprDiags := p.parseExpr()
+                diags = append(diags, exprDiags...)
+                exprs = append(exprs, expr)
+        }
+
+        return exprs, diags
+}
+
+func (p *templateParser) parseExpr() (Expression, hcl.Diagnostics) {
+        next := p.Peek()
+        switch tok := next.(type) {
+
+        case *templateLiteralToken:
+                p.Read() // eat literal
+                return &LiteralValueExpr{
+                        Val:      cty.StringVal(tok.Val),
+                        SrcRange: tok.SrcRange,
+                }, nil
+
+        case *templateInterpToken:
+                p.Read() // eat interp
+                return tok.Expr, nil
+
+        case *templateIfToken:
+                return p.parseIf()
+
+        case *templateForToken:
+                return p.parseFor()
+
+        case *templateEndToken:
+                p.Read() // eat erroneous token
+                return errPlaceholderExpr(tok.SrcRange), hcl.Diagnostics{
+                        {
+                                // This is a particularly unhelpful diagnostic, so callers
+                                // should attempt to pre-empt it and produce a more helpful
+                                // diagnostic that is context-aware.
+                                Severity: hcl.DiagError,
+                                Summary:  "Unexpected end of template",
+                                Detail:   "The control directives within this template are unbalanced.",
+                                Subject:  &tok.SrcRange,
+                        },
+                }
+
+        case *templateEndCtrlToken:
+                p.Read() // eat erroneous token
+                return errPlaceholderExpr(tok.SrcRange), hcl.Diagnostics{
+                        {
+                                Severity: hcl.DiagError,
+                                Summary:  fmt.Sprintf("Unexpected %s directive", tok.Name()),
+                                Detail:   "The control directives within this template are unbalanced.",
+                                Subject:  &tok.SrcRange,
+                        },
+                }
+
+        default:
+                // should never happen, because above should be exhaustive
+                panic(fmt.Sprintf("unhandled template token type %T", next))
+        }
+}
+
+func (p *templateParser) parseIf() (Expression, hcl.Diagnostics) {
+        open := p.Read()
+        openIf, isIf := open.(*templateIfToken)
+        if !isIf {
+                // should never happen if caller is behaving
+                panic("parseIf called with peeker not pointing at if token")
+        }
+
+        var ifExprs, elseExprs []Expression
+        var diags hcl.Diagnostics
+        var endifRange hcl.Range
+
+        currentExprs := &ifExprs
+Token:
+        for {
+                next := p.Peek()
+                if end, isEnd := next.(*templateEndToken); isEnd {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Unexpected end of template",
+                                Detail: fmt.Sprintf(
+                                        "The if directive at %s is missing its corresponding endif directive.",
+                                        openIf.SrcRange,
+                                ),
+                                Subject: &end.SrcRange,
+                        })
+                        return errPlaceholderExpr(end.SrcRange), diags
+                }
+                if end, isCtrlEnd := next.(*templateEndCtrlToken); isCtrlEnd {
+                        p.Read() // eat end directive
+
+                        switch end.Type {
+
+                        case templateElse:
+                                if currentExprs == &ifExprs {
+                                        currentExprs = &elseExprs
+                                        continue Token
+                                }
+
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Unexpected else directive",
+                                        Detail: fmt.Sprintf(
+                                                "Already in the else clause for the if started at %s.",
+                                                openIf.SrcRange,
+                                        ),
+                                        Subject: &end.SrcRange,
+                                })
+
+                        case templateEndIf:
+                                endifRange = end.SrcRange
+                                break Token
+
+                        default:
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  fmt.Sprintf("Unexpected %s directive", end.Name()),
+                                        Detail: fmt.Sprintf(
+                                                "Expecting an endif directive for the if started at %s.",
+                                                openIf.SrcRange,
+                                        ),
+                                        Subject: &end.SrcRange,
+                                })
+                        }
+
+                        return errPlaceholderExpr(end.SrcRange), diags
+                }
+
+                expr, exprDiags := p.parseExpr()
+                diags = append(diags, exprDiags...)
+                *currentExprs = append(*currentExprs, expr)
+        }
+
+        if len(ifExprs) == 0 {
+                ifExprs = append(ifExprs, &LiteralValueExpr{
+                        Val: cty.StringVal(""),
+                        SrcRange: hcl.Range{
+                                Filename: openIf.SrcRange.Filename,
+                                Start:    openIf.SrcRange.End,
+                                End:      openIf.SrcRange.End,
+                        },
+                })
+        }
+        if len(elseExprs) == 0 {
+                elseExprs = append(elseExprs, &LiteralValueExpr{
+                        Val: cty.StringVal(""),
+                        SrcRange: hcl.Range{
+                                Filename: endifRange.Filename,
+                                Start:    endifRange.Start,
+                                End:      endifRange.Start,
+                        },
+                })
+        }
+
+        trueExpr := &TemplateExpr{
+                Parts:    ifExprs,
+                SrcRange: hcl.RangeBetween(ifExprs[0].Range(), ifExprs[len(ifExprs)-1].Range()),
+        }
+        falseExpr := &TemplateExpr{
+                Parts:    elseExprs,
+                SrcRange: hcl.RangeBetween(elseExprs[0].Range(), elseExprs[len(elseExprs)-1].Range()),
+        }
+
+        return &ConditionalExpr{
+                Condition:   openIf.CondExpr,
+                TrueResult:  trueExpr,
+                FalseResult: falseExpr,
+
+                SrcRange: hcl.RangeBetween(openIf.SrcRange, endifRange),
+        }, diags
+}
+
+func (p *templateParser) parseFor() (Expression, hcl.Diagnostics) {
+        open := p.Read()
+        openFor, isFor := open.(*templateForToken)
+        if !isFor {
+                // should never happen if caller is behaving
+                panic("parseFor called with peeker not pointing at for token")
+        }
+
+        var contentExprs []Expression
+        var diags hcl.Diagnostics
+        var endforRange hcl.Range
+
+Token:
+        for {
+                next := p.Peek()
+                if end, isEnd := next.(*templateEndToken); isEnd {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Unexpected end of template",
+                                Detail: fmt.Sprintf(
+                                        "The for directive at %s is missing its corresponding endfor directive.",
+                                        openFor.SrcRange,
+                                ),
+                                Subject: &end.SrcRange,
+                        })
+                        return errPlaceholderExpr(end.SrcRange), diags
+                }
+                if end, isCtrlEnd := next.(*templateEndCtrlToken); isCtrlEnd {
+                        p.Read() // eat end directive
+
+                        switch end.Type {
+
+                        case templateElse:
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Unexpected else directive",
+                                        Detail:   "An else clause is not expected for a for directive.",
+                                        Subject:  &end.SrcRange,
+                                })
+
+                        case templateEndFor:
+                                endforRange = end.SrcRange
+                                break Token
+
+                        default:
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  fmt.Sprintf("Unexpected %s directive", end.Name()),
+                                        Detail: fmt.Sprintf(
+                                                "Expecting an endfor directive corresponding to the for directive at %s.",
+                                                openFor.SrcRange,
+                                        ),
+                                        Subject: &end.SrcRange,
+                                })
+                        }
+
+                        return errPlaceholderExpr(end.SrcRange), diags
+                }
+
+                expr, exprDiags := p.parseExpr()
+                diags = append(diags, exprDiags...)
+                contentExprs = append(contentExprs, expr)
+        }
+
+        if len(contentExprs) == 0 {
+                contentExprs = append(contentExprs, &LiteralValueExpr{
+                        Val: cty.StringVal(""),
+                        SrcRange: hcl.Range{
+                                Filename: openFor.SrcRange.Filename,
+                                Start:    openFor.SrcRange.End,
+                                End:      openFor.SrcRange.End,
+                        },
+                })
+        }
+
+        contentExpr := &TemplateExpr{
+                Parts:    contentExprs,
+                SrcRange: hcl.RangeBetween(contentExprs[0].Range(), contentExprs[len(contentExprs)-1].Range()),
+        }
+
+        forExpr := &ForExpr{
+                KeyVar: openFor.KeyVar,
+                ValVar: openFor.ValVar,
+
+                CollExpr: openFor.CollExpr,
+                ValExpr:  contentExpr,
+
+                SrcRange:   hcl.RangeBetween(openFor.SrcRange, endforRange),
+                OpenRange:  openFor.SrcRange,
+                CloseRange: endforRange,
+        }
+
+        return &TemplateJoinExpr{
+                Tuple: forExpr,
+        }, diags
+}
+
+func (p *templateParser) Peek() templateToken {
+        return p.Tokens[p.pos]
+}
+
+func (p *templateParser) Read() templateToken {
+        ret := p.Peek()
+        if _, end := ret.(*templateEndToken); !end {
+                p.pos++
+        }
+        return ret
+}
+
+// parseTemplateParts produces a flat sequence of "template tokens", which are
+// either literal values (with any "trimming" already applied), interpolation
+// sequences, or control flow markers.
+//
+// A further pass is required on the result to turn it into an AST.
+func (p *parser) parseTemplateParts(end TokenType) (*templateParts, hcl.Diagnostics) {
+        var parts []templateToken
+        var diags hcl.Diagnostics
+
+        startRange := p.NextRange()
+        ltrimNext := false
+        nextCanTrimPrev := false
+        var endRange hcl.Range
+
+Token:
+        for {
+                next := p.Read()
+                if next.Type == end {
+                        // all done!
+                        endRange = next.Range
+                        break
+                }
+
+                ltrim := ltrimNext
+                ltrimNext = false
+                canTrimPrev := nextCanTrimPrev
+                nextCanTrimPrev = false
+
+                switch next.Type {
+                case TokenStringLit, TokenQuotedLit:
+                        str, strDiags := p.decodeStringLit(next)
+                        diags = append(diags, strDiags...)
+
+                        if ltrim {
+                                str = strings.TrimLeftFunc(str, unicode.IsSpace)
+                        }
+
+                        parts = append(parts, &templateLiteralToken{
+                                Val:      str,
+                                SrcRange: next.Range,
+                        })
+                        nextCanTrimPrev = true
+
+                case TokenTemplateInterp:
+                        // if the opener is ${~ then we want to eat any trailing whitespace
+                        // in the preceding literal token, assuming it is indeed a literal
+                        // token.
+                        if canTrimPrev && len(next.Bytes) == 3 && next.Bytes[2] == '~' && len(parts) > 0 {
+                                prevExpr := parts[len(parts)-1]
+                                if lexpr, ok := prevExpr.(*templateLiteralToken); ok {
+                                        lexpr.Val = strings.TrimRightFunc(lexpr.Val, unicode.IsSpace)
+                                }
+                        }
+
+                        p.PushIncludeNewlines(false)
+                        expr, exprDiags := p.ParseExpression()
+                        diags = append(diags, exprDiags...)
+                        close := p.Peek()
+                        if close.Type != TokenTemplateSeqEnd {
+                                if !p.recovery {
+                                        diags = append(diags, &hcl.Diagnostic{
+                                                Severity: hcl.DiagError,
+                                                Summary:  "Extra characters after interpolation expression",
+                                                Detail:   "Expected a closing brace to end the interpolation expression, but found extra characters.",
+                                                Subject:  &close.Range,
+                                                Context:  hcl.RangeBetween(startRange, close.Range).Ptr(),
+                                        })
+                                }
+                                p.recover(TokenTemplateSeqEnd)
+                        } else {
+                                p.Read() // eat closing brace
+
+                                // If the closer is ~} then we want to eat any leading
+                                // whitespace on the next token, if it turns out to be a
+                                // literal token.
+                                if len(close.Bytes) == 2 && close.Bytes[0] == '~' {
+                                        ltrimNext = true
+                                }
+                        }
+                        p.PopIncludeNewlines()
+                        parts = append(parts, &templateInterpToken{
+                                Expr:     expr,
+                                SrcRange: hcl.RangeBetween(next.Range, close.Range),
+                        })
+
+                case TokenTemplateControl:
+                        // if the opener is %{~ then we want to eat any trailing whitespace
+                        // in the preceding literal token, assuming it is indeed a literal
+                        // token.
+                        if canTrimPrev && len(next.Bytes) == 3 && next.Bytes[2] == '~' && len(parts) > 0 {
+                                prevExpr := parts[len(parts)-1]
+                                if lexpr, ok := prevExpr.(*templateLiteralToken); ok {
+                                        lexpr.Val = strings.TrimRightFunc(lexpr.Val, unicode.IsSpace)
+                                }
+                        }
+                        p.PushIncludeNewlines(false)
+
+                        kw := p.Peek()
+                        if kw.Type != TokenIdent {
+                                if !p.recovery {
+                                        diags = append(diags, &hcl.Diagnostic{
+                                                Severity: hcl.DiagError,
+                                                Summary:  "Invalid template directive",
+                                                Detail:   "A template directive keyword (\"if\", \"for\", etc) is expected at the beginning of a %{ sequence.",
+                                                Subject:  &kw.Range,
+                                                Context:  hcl.RangeBetween(next.Range, kw.Range).Ptr(),
+                                        })
+                                }
+                                p.recover(TokenTemplateSeqEnd)
+                                p.PopIncludeNewlines()
+                                continue Token
+                        }
+                        p.Read() // eat keyword token
+
+                        switch {
+
+                        case ifKeyword.TokenMatches(kw):
+                                condExpr, exprDiags := p.ParseExpression()
+                                diags = append(diags, exprDiags...)
+                                parts = append(parts, &templateIfToken{
+                                        CondExpr: condExpr,
+                                        SrcRange: hcl.RangeBetween(next.Range, p.NextRange()),
+                                })
+
+                        case elseKeyword.TokenMatches(kw):
+                                parts = append(parts, &templateEndCtrlToken{
+                                        Type:     templateElse,
+                                        SrcRange: hcl.RangeBetween(next.Range, p.NextRange()),
+                                })
+
+                        case endifKeyword.TokenMatches(kw):
+                                parts = append(parts, &templateEndCtrlToken{
+                                        Type:     templateEndIf,
+                                        SrcRange: hcl.RangeBetween(next.Range, p.NextRange()),
+                                })
+
+                        case forKeyword.TokenMatches(kw):
+                                var keyName, valName string
+                                if p.Peek().Type != TokenIdent {
+                                        if !p.recovery {
+                                                diags = append(diags, &hcl.Diagnostic{
+                                                        Severity: hcl.DiagError,
+                                                        Summary:  "Invalid 'for' directive",
+                                                        Detail:   "For directive requires variable name after 'for'.",
+                                                        Subject:  p.Peek().Range.Ptr(),
+                                                })
+                                        }
+                                        p.recover(TokenTemplateSeqEnd)
+                                        p.PopIncludeNewlines()
+                                        continue Token
+                                }
+
+                                valName = string(p.Read().Bytes)
+
+                                if p.Peek().Type == TokenComma {
+                                        // What we just read was actually the key, then.
+                                        keyName = valName
+                                        p.Read() // eat comma
+
+                                        if p.Peek().Type != TokenIdent {
+                                                if !p.recovery {
+                                                        diags = append(diags, &hcl.Diagnostic{
+                                                                Severity: hcl.DiagError,
+                                                                Summary:  "Invalid 'for' directive",
+                                                                Detail:   "For directive requires value variable name after comma.",
+                                                                Subject:  p.Peek().Range.Ptr(),
+                                                        })
+                                                }
+                                                p.recover(TokenTemplateSeqEnd)
+                                                p.PopIncludeNewlines()
+                                                continue Token
+                                        }
+
+                                        valName = string(p.Read().Bytes)
+                                }
+
+                                if !inKeyword.TokenMatches(p.Peek()) {
+                                        if !p.recovery {
+                                                diags = append(diags, &hcl.Diagnostic{
+                                                        Severity: hcl.DiagError,
+                                                        Summary:  "Invalid 'for' directive",
+                                                        Detail:   "For directive requires 'in' keyword after names.",
+                                                        Subject:  p.Peek().Range.Ptr(),
+                                                })
+                                        }
+                                        p.recover(TokenTemplateSeqEnd)
+                                        p.PopIncludeNewlines()
+                                        continue Token
+                                }
+                                p.Read() // eat 'in' keyword
+
+                                collExpr, collDiags := p.ParseExpression()
+                                diags = append(diags, collDiags...)
+                                parts = append(parts, &templateForToken{
+                                        KeyVar:   keyName,
+                                        ValVar:   valName,
+                                        CollExpr: collExpr,
+
+                                        SrcRange: hcl.RangeBetween(next.Range, p.NextRange()),
+                                })
+
+                        case endforKeyword.TokenMatches(kw):
+                                parts = append(parts, &templateEndCtrlToken{
+                                        Type:     templateEndFor,
+                                        SrcRange: hcl.RangeBetween(next.Range, p.NextRange()),
+                                })
+
+                        default:
+                                if !p.recovery {
+                                        suggestions := []string{"if", "for", "else", "endif", "endfor"}
+                                        given := string(kw.Bytes)
+                                        suggestion := nameSuggestion(given, suggestions)
+                                        if suggestion != "" {
+                                                suggestion = fmt.Sprintf(" Did you mean %q?", suggestion)
+                                        }
+
+                                        diags = append(diags, &hcl.Diagnostic{
+                                                Severity: hcl.DiagError,
+                                                Summary:  "Invalid template control keyword",
+                                                Detail:   fmt.Sprintf("%q is not a valid template control keyword.%s", given, suggestion),
+                                                Subject:  &kw.Range,
+                                                Context:  hcl.RangeBetween(next.Range, kw.Range).Ptr(),
+                                        })
+                                }
+                                p.recover(TokenTemplateSeqEnd)
+                                p.PopIncludeNewlines()
+                                continue Token
+
+                        }
+
+                        close := p.Peek()
+                        if close.Type != TokenTemplateSeqEnd {
+                                if !p.recovery {
+                                        diags = append(diags, &hcl.Diagnostic{
+                                                Severity: hcl.DiagError,
+                                                Summary:  fmt.Sprintf("Extra characters in %s marker", kw.Bytes),
+                                                Detail:   "Expected a closing brace to end the sequence, but found extra characters.",
+                                                Subject:  &close.Range,
+                                                Context:  hcl.RangeBetween(startRange, close.Range).Ptr(),
+                                        })
+                                }
+                                p.recover(TokenTemplateSeqEnd)
+                        } else {
+                                p.Read() // eat closing brace
+
+                                // If the closer is ~} then we want to eat any leading
+                                // whitespace on the next token, if it turns out to be a
+                                // literal token.
+                                if len(close.Bytes) == 2 && close.Bytes[0] == '~' {
+                                        ltrimNext = true
+                                }
+                        }
+                        p.PopIncludeNewlines()
+
+                default:
+                        if !p.recovery {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Unterminated template string",
+                                        Detail:   "No closing marker was found for the string.",
+                                        Subject:  &next.Range,
+                                        Context:  hcl.RangeBetween(startRange, next.Range).Ptr(),
+                                })
+                        }
+                        final := p.recover(end)
+                        endRange = final.Range
+                        break Token
+                }
+        }
+
+        if len(parts) == 0 {
+                // If a sequence has no content, we'll treat it as if it had an
+                // empty string in it because that's what the user probably means
+                // if they write "" in configuration.
+                parts = append(parts, &templateLiteralToken{
+                        Val: "",
+                        SrcRange: hcl.Range{
+                                // Range is the zero-character span immediately after the
+                                // opening quote.
+                                Filename: startRange.Filename,
+                                Start:    startRange.End,
+                                End:      startRange.End,
+                        },
+                })
+        }
+
+        // Always end with an end token, so the parser can produce diagnostics
+        // about unclosed items with proper position information.
+        parts = append(parts, &templateEndToken{
+                SrcRange: endRange,
+        })
+
+        ret := &templateParts{
+                Tokens:   parts,
+                SrcRange: hcl.RangeBetween(startRange, endRange),
+        }
+
+        return ret, diags
+}
+
+type templateParts struct {
+        Tokens   []templateToken
+        SrcRange hcl.Range
+}
+
+// templateToken is a higher-level token that represents a single atom within
+// the template language. Our template parsing first raises the raw token
+// stream to a sequence of templateToken, and then transforms the result into
+// an expression tree.
+type templateToken interface {
+        templateToken() templateToken
+}
+
+type templateLiteralToken struct {
+        Val      string
+        SrcRange hcl.Range
+        isTemplateToken
+}
+
+type templateInterpToken struct {
+        Expr     Expression
+        SrcRange hcl.Range
+        isTemplateToken
+}
+
+type templateIfToken struct {
+        CondExpr Expression
+        SrcRange hcl.Range
+        isTemplateToken
+}
+
+type templateForToken struct {
+        KeyVar   string // empty if ignoring key
+        ValVar   string
+        CollExpr Expression
+        SrcRange hcl.Range
+        isTemplateToken
+}
+
+type templateEndCtrlType int
+
+const (
+        templateEndIf templateEndCtrlType = iota
+        templateElse
+        templateEndFor
+)
+
+type templateEndCtrlToken struct {
+        Type     templateEndCtrlType
+        SrcRange hcl.Range
+        isTemplateToken
+}
+
+func (t *templateEndCtrlToken) Name() string {
+        switch t.Type {
+        case templateEndIf:
+                return "endif"
+        case templateElse:
+                return "else"
+        case templateEndFor:
+                return "endfor"
+        default:
+                // should never happen
+                panic("invalid templateEndCtrlType")
+        }
+}
+
+type templateEndToken struct {
+        SrcRange hcl.Range
+        isTemplateToken
+}
+
+type isTemplateToken [0]int
+
+func (t isTemplateToken) templateToken() templateToken {
+        return t
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/parser_traversal.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/parser_traversal.go
new file mode 100644
index 0000000..2ff3ed6
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/parser_traversal.go
@@ -0,0 +1,159 @@
+package hclsyntax
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// ParseTraversalAbs parses an absolute traversal that is assumed to consume
+// all of the remaining tokens in the peeker. The usual parser recovery
+// behavior is not supported here because traversals are not expected to
+// be parsed as part of a larger program.
+func (p *parser) ParseTraversalAbs() (hcl.Traversal, hcl.Diagnostics) {
+        var ret hcl.Traversal
+        var diags hcl.Diagnostics
+
+        // Absolute traversal must always begin with a variable name
+        varTok := p.Read()
+        if varTok.Type != TokenIdent {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Variable name required",
+                        Detail:   "Must begin with a variable name.",
+                        Subject:  &varTok.Range,
+                })
+                return ret, diags
+        }
+
+        varName := string(varTok.Bytes)
+        ret = append(ret, hcl.TraverseRoot{
+                Name:     varName,
+                SrcRange: varTok.Range,
+        })
+
+        for {
+                next := p.Peek()
+
+                if next.Type == TokenEOF {
+                        return ret, diags
+                }
+
+                switch next.Type {
+                case TokenDot:
+                        // Attribute access
+                        dot := p.Read() // eat dot
+                        nameTok := p.Read()
+                        if nameTok.Type != TokenIdent {
+                                if nameTok.Type == TokenStar {
+                                        diags = append(diags, &hcl.Diagnostic{
+                                                Severity: hcl.DiagError,
+                                                Summary:  "Attribute name required",
+                                                Detail:   "Splat expressions (.*) may not be used here.",
+                                                Subject:  &nameTok.Range,
+                                                Context:  hcl.RangeBetween(varTok.Range, nameTok.Range).Ptr(),
+                                        })
+                                } else {
+                                        diags = append(diags, &hcl.Diagnostic{
+                                                Severity: hcl.DiagError,
+                                                Summary:  "Attribute name required",
+                                                Detail:   "Dot must be followed by attribute name.",
+                                                Subject:  &nameTok.Range,
+                                                Context:  hcl.RangeBetween(varTok.Range, nameTok.Range).Ptr(),
+                                        })
+                                }
+                                return ret, diags
+                        }
+
+                        attrName := string(nameTok.Bytes)
+                        ret = append(ret, hcl.TraverseAttr{
+                                Name:     attrName,
+                                SrcRange: hcl.RangeBetween(dot.Range, nameTok.Range),
+                        })
+                case TokenOBrack:
+                        // Index
+                        open := p.Read() // eat open bracket
+                        next := p.Peek()
+
+                        switch next.Type {
+                        case TokenNumberLit:
+                                tok := p.Read() // eat number
+                                numVal, numDiags := p.numberLitValue(tok)
+                                diags = append(diags, numDiags...)
+
+                                close := p.Read()
+                                if close.Type != TokenCBrack {
+                                        diags = append(diags, &hcl.Diagnostic{
+                                                Severity: hcl.DiagError,
+                                                Summary:  "Unclosed index brackets",
+                                                Detail:   "Index key must be followed by a closing bracket.",
+                                                Subject:  &close.Range,
+                                                Context:  hcl.RangeBetween(open.Range, close.Range).Ptr(),
+                                        })
+                                }
+
+                                ret = append(ret, hcl.TraverseIndex{
+                                        Key:      numVal,
+                                        SrcRange: hcl.RangeBetween(open.Range, close.Range),
+                                })
+
+                                if diags.HasErrors() {
+                                        return ret, diags
+                                }
+
+                        case TokenOQuote:
+                                str, _, strDiags := p.parseQuotedStringLiteral()
+                                diags = append(diags, strDiags...)
+
+                                close := p.Read()
+                                if close.Type != TokenCBrack {
+                                        diags = append(diags, &hcl.Diagnostic{
+                                                Severity: hcl.DiagError,
+                                                Summary:  "Unclosed index brackets",
+                                                Detail:   "Index key must be followed by a closing bracket.",
+                                                Subject:  &close.Range,
+                                                Context:  hcl.RangeBetween(open.Range, close.Range).Ptr(),
+                                        })
+                                }
+
+                                ret = append(ret, hcl.TraverseIndex{
+                                        Key:      cty.StringVal(str),
+                                        SrcRange: hcl.RangeBetween(open.Range, close.Range),
+                                })
+
+                                if diags.HasErrors() {
+                                        return ret, diags
+                                }
+
+                        default:
+                                if next.Type == TokenStar {
+                                        diags = append(diags, &hcl.Diagnostic{
+                                                Severity: hcl.DiagError,
+                                                Summary:  "Attribute name required",
+                                                Detail:   "Splat expressions ([*]) may not be used here.",
+                                                Subject:  &next.Range,
+                                                Context:  hcl.RangeBetween(varTok.Range, next.Range).Ptr(),
+                                        })
+                                } else {
+                                        diags = append(diags, &hcl.Diagnostic{
+                                                Severity: hcl.DiagError,
+                                                Summary:  "Index value required",
+                                                Detail:   "Index brackets must contain either a literal number or a literal string.",
+                                                Subject:  &next.Range,
+                                                Context:  hcl.RangeBetween(varTok.Range, next.Range).Ptr(),
+                                        })
+                                }
+                                return ret, diags
+                        }
+
+                default:
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid character",
+                                Detail:   "Expected an attribute access or an index operator.",
+                                Subject:  &next.Range,
+                                Context:  hcl.RangeBetween(varTok.Range, next.Range).Ptr(),
+                        })
+                        return ret, diags
+                }
+        }
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/peeker.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/peeker.go
new file mode 100644
index 0000000..5a4b50e
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/peeker.go
@@ -0,0 +1,212 @@
+package hclsyntax
+
+import (
+        "bytes"
+        "fmt"
+        "path/filepath"
+        "runtime"
+        "strings"
+
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+// This is set to true at init() time in tests, to enable more useful output
+// if a stack discipline error is detected. It should not be enabled in
+// normal mode since there is a performance penalty from accessing the
+// runtime stack to produce the traces, but could be temporarily set to
+// true for debugging if desired.
+var tracePeekerNewlinesStack = false
+
+type peeker struct {
+        Tokens    Tokens
+        NextIndex int
+
+        IncludeComments      bool
+        IncludeNewlinesStack []bool
+
+        // used only when tracePeekerNewlinesStack is set
+        newlineStackChanges []peekerNewlineStackChange
+}
+
+// for use in debugging the stack usage only
+type peekerNewlineStackChange struct {
+        Pushing bool // if false, then popping
+        Frame   runtime.Frame
+        Include bool
+}
+
+func newPeeker(tokens Tokens, includeComments bool) *peeker {
+        return &peeker{
+                Tokens:          tokens,
+                IncludeComments: includeComments,
+
+                IncludeNewlinesStack: []bool{true},
+        }
+}
+
+func (p *peeker) Peek() Token {
+        ret, _ := p.nextToken()
+        return ret
+}
+
+func (p *peeker) Read() Token {
+        ret, nextIdx := p.nextToken()
+        p.NextIndex = nextIdx
+        return ret
+}
+
+func (p *peeker) NextRange() hcl.Range {
+        return p.Peek().Range
+}
+
+func (p *peeker) PrevRange() hcl.Range {
+        if p.NextIndex == 0 {
+                return p.NextRange()
+        }
+
+        return p.Tokens[p.NextIndex-1].Range
+}
+
+func (p *peeker) nextToken() (Token, int) {
+        for i := p.NextIndex; i < len(p.Tokens); i++ {
+                tok := p.Tokens[i]
+                switch tok.Type {
+                case TokenComment:
+                        if !p.IncludeComments {
+                                // Single-line comment tokens, starting with # or //, absorb
+                                // the trailing newline that terminates them as part of their
+                                // bytes. When we're filtering out comments, we must as a
+                                // special case transform these to newline tokens in order
+                                // to properly parse newline-terminated block items.
+
+                                if p.includingNewlines() {
+                                        if len(tok.Bytes) > 0 && tok.Bytes[len(tok.Bytes)-1] == '\n' {
+                                                fakeNewline := Token{
+                                                        Type:  TokenNewline,
+                                                        Bytes: tok.Bytes[len(tok.Bytes)-1 : len(tok.Bytes)],
+
+                                                        // We use the whole token range as the newline
+                                                        // range, even though that's a little... weird,
+                                                        // because otherwise we'd need to go count
+                                                        // characters again in order to figure out the
+                                                        // column of the newline, and that complexity
+                                                        // isn't justified when ranges of newlines are
+                                                        // so rarely printed anyway.
+                                                        Range: tok.Range,
+                                                }
+                                                return fakeNewline, i + 1
+                                        }
+                                }
+
+                                continue
+                        }
+                case TokenNewline:
+                        if !p.includingNewlines() {
+                                continue
+                        }
+                }
+
+                return tok, i + 1
+        }
+
+        // if we fall out here then we'll return the EOF token, and leave
+        // our index pointed off the end of the array so we'll keep
+        // returning EOF in future too.
+        return p.Tokens[len(p.Tokens)-1], len(p.Tokens)
+}
+
+func (p *peeker) includingNewlines() bool {
+        return p.IncludeNewlinesStack[len(p.IncludeNewlinesStack)-1]
+}
+
+func (p *peeker) PushIncludeNewlines(include bool) {
+        if tracePeekerNewlinesStack {
+                // Record who called us so that we can more easily track down any
+                // mismanagement of the stack in the parser.
+                callers := []uintptr{0}
+                runtime.Callers(2, callers)
+                frames := runtime.CallersFrames(callers)
+                frame, _ := frames.Next()
+                p.newlineStackChanges = append(p.newlineStackChanges, peekerNewlineStackChange{
+                        true, frame, include,
+                })
+        }
+
+        p.IncludeNewlinesStack = append(p.IncludeNewlinesStack, include)
+}
+
+func (p *peeker) PopIncludeNewlines() bool {
+        stack := p.IncludeNewlinesStack
+        remain, ret := stack[:len(stack)-1], stack[len(stack)-1]
+        p.IncludeNewlinesStack = remain
+
+        if tracePeekerNewlinesStack {
+                // Record who called us so that we can more easily track down any
+                // mismanagement of the stack in the parser.
+                callers := []uintptr{0}
+                runtime.Callers(2, callers)
+                frames := runtime.CallersFrames(callers)
+                frame, _ := frames.Next()
+                p.newlineStackChanges = append(p.newlineStackChanges, peekerNewlineStackChange{
+                        false, frame, ret,
+                })
+        }
+
+        return ret
+}
+
+// AssertEmptyNewlinesStack checks if the IncludeNewlinesStack is empty, doing
+// panicking if it is not. This can be used to catch stack mismanagement that
+// might otherwise just cause confusing downstream errors.
+//
+// This function is a no-op if the stack is empty when called.
+//
+// If newlines stack tracing is enabled by setting the global variable
+// tracePeekerNewlinesStack at init time, a full log of all of the push/pop
+// calls will be produced to help identify which caller in the parser is
+// misbehaving.
+func (p *peeker) AssertEmptyIncludeNewlinesStack() {
+        if len(p.IncludeNewlinesStack) != 1 {
+                // Should never happen; indicates mismanagement of the stack inside
+                // the parser.
+                if p.newlineStackChanges != nil { // only if traceNewlinesStack is enabled above
+                        panic(fmt.Errorf(
+                                "non-empty IncludeNewlinesStack after parse with %d calls unaccounted for:\n%s",
+                                len(p.IncludeNewlinesStack)-1,
+                                formatPeekerNewlineStackChanges(p.newlineStackChanges),
+                        ))
+                } else {
+                        panic(fmt.Errorf("non-empty IncludeNewlinesStack after parse: %#v", p.IncludeNewlinesStack))
+                }
+        }
+}
+
+func formatPeekerNewlineStackChanges(changes []peekerNewlineStackChange) string {
+        indent := 0
+        var buf bytes.Buffer
+        for _, change := range changes {
+                funcName := change.Frame.Function
+                if idx := strings.LastIndexByte(funcName, '.'); idx != -1 {
+                        funcName = funcName[idx+1:]
+                }
+                filename := change.Frame.File
+                if idx := strings.LastIndexByte(filename, filepath.Separator); idx != -1 {
+                        filename = filename[idx+1:]
+                }
+
+                switch change.Pushing {
+
+                case true:
+                        buf.WriteString(strings.Repeat("    ", indent))
+                        fmt.Fprintf(&buf, "PUSH %#v (%s at %s:%d)\n", change.Include, funcName, filename, change.Frame.Line)
+                        indent++
+
+                case false:
+                        indent--
+                        buf.WriteString(strings.Repeat("    ", indent))
+                        fmt.Fprintf(&buf, "POP %#v (%s at %s:%d)\n", change.Include, funcName, filename, change.Frame.Line)
+
+                }
+        }
+        return buf.String()
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/public.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/public.go
new file mode 100644
index 0000000..cf0ee29
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/public.go
@@ -0,0 +1,171 @@
+package hclsyntax
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+// ParseConfig parses the given buffer as a whole HCL config file, returning
+// a *hcl.File representing its contents. If HasErrors called on the returned
+// diagnostics returns true, the returned body is likely to be incomplete
+// and should therefore be used with care.
+//
+// The body in the returned file has dynamic type *hclsyntax.Body, so callers
+// may freely type-assert this to get access to the full hclsyntax API in
+// situations where detailed access is required. However, most common use-cases
+// should be served using the hcl.Body interface to ensure compatibility with
+// other configurationg syntaxes, such as JSON.
+func ParseConfig(src []byte, filename string, start hcl.Pos) (*hcl.File, hcl.Diagnostics) {
+        tokens, diags := LexConfig(src, filename, start)
+        peeker := newPeeker(tokens, false)
+        parser := &parser{peeker: peeker}
+        body, parseDiags := parser.ParseBody(TokenEOF)
+        diags = append(diags, parseDiags...)
+
+        // Panic if the parser uses incorrect stack discipline with the peeker's
+        // newlines stack, since otherwise it will produce confusing downstream
+        // errors.
+        peeker.AssertEmptyIncludeNewlinesStack()
+
+        return &hcl.File{
+                Body:  body,
+                Bytes: src,
+
+                Nav: navigation{
+                        root: body,
+                },
+        }, diags
+}
+
+// ParseExpression parses the given buffer as a standalone HCL expression,
+// returning it as an instance of Expression.
+func ParseExpression(src []byte, filename string, start hcl.Pos) (Expression, hcl.Diagnostics) {
+        tokens, diags := LexExpression(src, filename, start)
+        peeker := newPeeker(tokens, false)
+        parser := &parser{peeker: peeker}
+
+        // Bare expressions are always parsed in  "ignore newlines" mode, as if
+        // they were wrapped in parentheses.
+        parser.PushIncludeNewlines(false)
+
+        expr, parseDiags := parser.ParseExpression()
+        diags = append(diags, parseDiags...)
+
+        next := parser.Peek()
+        if next.Type != TokenEOF && !parser.recovery {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Extra characters after expression",
+                        Detail:   "An expression was successfully parsed, but extra characters were found after it.",
+                        Subject:  &next.Range,
+                })
+        }
+
+        parser.PopIncludeNewlines()
+
+        // Panic if the parser uses incorrect stack discipline with the peeker's
+        // newlines stack, since otherwise it will produce confusing downstream
+        // errors.
+        peeker.AssertEmptyIncludeNewlinesStack()
+
+        return expr, diags
+}
+
+// ParseTemplate parses the given buffer as a standalone HCL template,
+// returning it as an instance of Expression.
+func ParseTemplate(src []byte, filename string, start hcl.Pos) (Expression, hcl.Diagnostics) {
+        tokens, diags := LexTemplate(src, filename, start)
+        peeker := newPeeker(tokens, false)
+        parser := &parser{peeker: peeker}
+        expr, parseDiags := parser.ParseTemplate()
+        diags = append(diags, parseDiags...)
+
+        // Panic if the parser uses incorrect stack discipline with the peeker's
+        // newlines stack, since otherwise it will produce confusing downstream
+        // errors.
+        peeker.AssertEmptyIncludeNewlinesStack()
+
+        return expr, diags
+}
+
+// ParseTraversalAbs parses the given buffer as a standalone absolute traversal.
+//
+// Parsing as a traversal is more limited than parsing as an expession since
+// it allows only attribute and indexing operations on variables. Traverals
+// are useful as a syntax for referring to objects without necessarily
+// evaluating them.
+func ParseTraversalAbs(src []byte, filename string, start hcl.Pos) (hcl.Traversal, hcl.Diagnostics) {
+        tokens, diags := LexExpression(src, filename, start)
+        peeker := newPeeker(tokens, false)
+        parser := &parser{peeker: peeker}
+
+        // Bare traverals are always parsed in  "ignore newlines" mode, as if
+        // they were wrapped in parentheses.
+        parser.PushIncludeNewlines(false)
+
+        expr, parseDiags := parser.ParseTraversalAbs()
+        diags = append(diags, parseDiags...)
+
+        parser.PopIncludeNewlines()
+
+        // Panic if the parser uses incorrect stack discipline with the peeker's
+        // newlines stack, since otherwise it will produce confusing downstream
+        // errors.
+        peeker.AssertEmptyIncludeNewlinesStack()
+
+        return expr, diags
+}
+
+// LexConfig performs lexical analysis on the given buffer, treating it as a
+// whole HCL config file, and returns the resulting tokens.
+//
+// Only minimal validation is done during lexical analysis, so the returned
+// diagnostics may include errors about lexical issues such as bad character
+// encodings or unrecognized characters, but full parsing is required to
+// detect _all_ syntax errors.
+func LexConfig(src []byte, filename string, start hcl.Pos) (Tokens, hcl.Diagnostics) {
+        tokens := scanTokens(src, filename, start, scanNormal)
+        diags := checkInvalidTokens(tokens)
+        return tokens, diags
+}
+
+// LexExpression performs lexical analysis on the given buffer, treating it as
+// a standalone HCL expression, and returns the resulting tokens.
+//
+// Only minimal validation is done during lexical analysis, so the returned
+// diagnostics may include errors about lexical issues such as bad character
+// encodings or unrecognized characters, but full parsing is required to
+// detect _all_ syntax errors.
+func LexExpression(src []byte, filename string, start hcl.Pos) (Tokens, hcl.Diagnostics) {
+        // This is actually just the same thing as LexConfig, since configs
+        // and expressions lex in the same way.
+        tokens := scanTokens(src, filename, start, scanNormal)
+        diags := checkInvalidTokens(tokens)
+        return tokens, diags
+}
+
+// LexTemplate performs lexical analysis on the given buffer, treating it as a
+// standalone HCL template, and returns the resulting tokens.
+//
+// Only minimal validation is done during lexical analysis, so the returned
+// diagnostics may include errors about lexical issues such as bad character
+// encodings or unrecognized characters, but full parsing is required to
+// detect _all_ syntax errors.
+func LexTemplate(src []byte, filename string, start hcl.Pos) (Tokens, hcl.Diagnostics) {
+        tokens := scanTokens(src, filename, start, scanTemplate)
+        diags := checkInvalidTokens(tokens)
+        return tokens, diags
+}
+
+// ValidIdentifier tests if the given string could be a valid identifier in
+// a native syntax expression.
+//
+// This is useful when accepting names from the user that will be used as
+// variable or attribute names in the scope, to ensure that any name chosen
+// will be traversable using the variable or attribute traversal syntax.
+func ValidIdentifier(s string) bool {
+        // This is a kinda-expensive way to do something pretty simple, but it
+        // is easiest to do with our existing scanner-related infrastructure here
+        // and nobody should be validating identifiers in a tight loop.
+        tokens := scanTokens([]byte(s), "", hcl.Pos{}, scanIdentOnly)
+        return len(tokens) == 2 && tokens[0].Type == TokenIdent && tokens[1].Type == TokenEOF
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/scan_string_lit.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/scan_string_lit.go
new file mode 100644
index 0000000..de1f524
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/scan_string_lit.go
@@ -0,0 +1,301 @@
+// line 1 "scan_string_lit.rl"
+
+package hclsyntax
+
+// This file is generated from scan_string_lit.rl. DO NOT EDIT.
+
+// line 9 "scan_string_lit.go"
+var _hclstrtok_actions []byte = []byte{
+        0, 1, 0, 1, 1, 2, 1, 0,
+}
+
+var _hclstrtok_key_offsets []byte = []byte{
+        0, 0, 2, 4, 6, 10, 14, 18,
+        22, 27, 31, 36, 41, 46, 51, 57,
+        62, 74, 85, 96, 107, 118, 129, 140,
+        151,
+}
+
+var _hclstrtok_trans_keys []byte = []byte{
+        128, 191, 128, 191, 128, 191, 10, 13,
+        36, 37, 10, 13, 36, 37, 10, 13,
+        36, 37, 10, 13, 36, 37, 10, 13,
+        36, 37, 123, 10, 13, 36, 37, 10,
+        13, 36, 37, 92, 10, 13, 36, 37,
+        92, 10, 13, 36, 37, 92, 10, 13,
+        36, 37, 92, 10, 13, 36, 37, 92,
+        123, 10, 13, 36, 37, 92, 85, 117,
+        128, 191, 192, 223, 224, 239, 240, 247,
+        248, 255, 10, 13, 36, 37, 92, 48,
+        57, 65, 70, 97, 102, 10, 13, 36,
+        37, 92, 48, 57, 65, 70, 97, 102,
+        10, 13, 36, 37, 92, 48, 57, 65,
+        70, 97, 102, 10, 13, 36, 37, 92,
+        48, 57, 65, 70, 97, 102, 10, 13,
+        36, 37, 92, 48, 57, 65, 70, 97,
+        102, 10, 13, 36, 37, 92, 48, 57,
+        65, 70, 97, 102, 10, 13, 36, 37,
+        92, 48, 57, 65, 70, 97, 102, 10,
+        13, 36, 37, 92, 48, 57, 65, 70,
+        97, 102,
+}
+
+var _hclstrtok_single_lengths []byte = []byte{
+        0, 0, 0, 0, 4, 4, 4, 4,
+        5, 4, 5, 5, 5, 5, 6, 5,
+        2, 5, 5, 5, 5, 5, 5, 5,
+        5,
+}
+
+var _hclstrtok_range_lengths []byte = []byte{
+        0, 1, 1, 1, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        5, 3, 3, 3, 3, 3, 3, 3,
+        3,
+}
+
+var _hclstrtok_index_offsets []byte = []byte{
+        0, 0, 2, 4, 6, 11, 16, 21,
+        26, 32, 37, 43, 49, 55, 61, 68,
+        74, 82, 91, 100, 109, 118, 127, 136,
+        145,
+}
+
+var _hclstrtok_indicies []byte = []byte{
+        0, 1, 2, 1, 3, 1, 5, 6,
+        7, 8, 4, 10, 11, 12, 13, 9,
+        14, 11, 12, 13, 9, 10, 11, 15,
+        13, 9, 10, 11, 12, 13, 14, 9,
+        10, 11, 12, 15, 9, 17, 18, 19,
+        20, 21, 16, 23, 24, 25, 26, 27,
+        22, 0, 24, 25, 26, 27, 22, 23,
+        24, 28, 26, 27, 22, 23, 24, 25,
+        26, 27, 0, 22, 23, 24, 25, 28,
+        27, 22, 29, 30, 22, 2, 3, 31,
+        22, 0, 23, 24, 25, 26, 27, 32,
+        32, 32, 22, 23, 24, 25, 26, 27,
+        33, 33, 33, 22, 23, 24, 25, 26,
+        27, 34, 34, 34, 22, 23, 24, 25,
+        26, 27, 30, 30, 30, 22, 23, 24,
+        25, 26, 27, 35, 35, 35, 22, 23,
+        24, 25, 26, 27, 36, 36, 36, 22,
+        23, 24, 25, 26, 27, 37, 37, 37,
+        22, 23, 24, 25, 26, 27, 0, 0,
+        0, 22,
+}
+
+var _hclstrtok_trans_targs []byte = []byte{
+        11, 0, 1, 2, 4, 5, 6, 7,
+        9, 4, 5, 6, 7, 9, 5, 8,
+        10, 11, 12, 13, 15, 16, 10, 11,
+        12, 13, 15, 16, 14, 17, 21, 3,
+        18, 19, 20, 22, 23, 24,
+}
+
+var _hclstrtok_trans_actions []byte = []byte{
+        0, 0, 0, 0, 0, 1, 1, 1,
+        1, 3, 5, 5, 5, 5, 0, 0,
+        0, 1, 1, 1, 1, 1, 3, 5,
+        5, 5, 5, 5, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0,
+}
+
+var _hclstrtok_eof_actions []byte = []byte{
+        0, 0, 0, 0, 0, 3, 3, 3,
+        3, 3, 0, 3, 3, 3, 3, 3,
+        3, 3, 3, 3, 3, 3, 3, 3,
+        3,
+}
+
+const hclstrtok_start int = 4
+const hclstrtok_first_final int = 4
+const hclstrtok_error int = 0
+
+const hclstrtok_en_quoted int = 10
+const hclstrtok_en_unquoted int = 4
+
+// line 10 "scan_string_lit.rl"
+
+func scanStringLit(data []byte, quoted bool) [][]byte {
+        var ret [][]byte
+
+        // line 61 "scan_string_lit.rl"
+
+        // Ragel state
+        p := 0          // "Pointer" into data
+        pe := len(data) // End-of-data "pointer"
+        ts := 0
+        te := 0
+        eof := pe
+
+        var cs int // current state
+        switch {
+        case quoted:
+                cs = hclstrtok_en_quoted
+        default:
+                cs = hclstrtok_en_unquoted
+        }
+
+        // Make Go compiler happy
+        _ = ts
+        _ = eof
+
+        /*token := func () {
+            ret = append(ret, data[ts:te])
+        }*/
+
+        // line 154 "scan_string_lit.go"
+        {
+        }
+
+        // line 158 "scan_string_lit.go"
+        {
+                var _klen int
+                var _trans int
+                var _acts int
+                var _nacts uint
+                var _keys int
+                if p == pe {
+                        goto _test_eof
+                }
+                if cs == 0 {
+                        goto _out
+                }
+        _resume:
+                _keys = int(_hclstrtok_key_offsets[cs])
+                _trans = int(_hclstrtok_index_offsets[cs])
+
+                _klen = int(_hclstrtok_single_lengths[cs])
+                if _klen > 0 {
+                        _lower := int(_keys)
+                        var _mid int
+                        _upper := int(_keys + _klen - 1)
+                        for {
+                                if _upper < _lower {
+                                        break
+                                }
+
+                                _mid = _lower + ((_upper - _lower) >> 1)
+                                switch {
+                                case data[p] < _hclstrtok_trans_keys[_mid]:
+                                        _upper = _mid - 1
+                                case data[p] > _hclstrtok_trans_keys[_mid]:
+                                        _lower = _mid + 1
+                                default:
+                                        _trans += int(_mid - int(_keys))
+                                        goto _match
+                                }
+                        }
+                        _keys += _klen
+                        _trans += _klen
+                }
+
+                _klen = int(_hclstrtok_range_lengths[cs])
+                if _klen > 0 {
+                        _lower := int(_keys)
+                        var _mid int
+                        _upper := int(_keys + (_klen << 1) - 2)
+                        for {
+                                if _upper < _lower {
+                                        break
+                                }
+
+                                _mid = _lower + (((_upper - _lower) >> 1) & ^1)
+                                switch {
+                                case data[p] < _hclstrtok_trans_keys[_mid]:
+                                        _upper = _mid - 2
+                                case data[p] > _hclstrtok_trans_keys[_mid+1]:
+                                        _lower = _mid + 2
+                                default:
+                                        _trans += int((_mid - int(_keys)) >> 1)
+                                        goto _match
+                                }
+                        }
+                        _trans += _klen
+                }
+
+        _match:
+                _trans = int(_hclstrtok_indicies[_trans])
+                cs = int(_hclstrtok_trans_targs[_trans])
+
+                if _hclstrtok_trans_actions[_trans] == 0 {
+                        goto _again
+                }
+
+                _acts = int(_hclstrtok_trans_actions[_trans])
+                _nacts = uint(_hclstrtok_actions[_acts])
+                _acts++
+                for ; _nacts > 0; _nacts-- {
+                        _acts++
+                        switch _hclstrtok_actions[_acts-1] {
+                        case 0:
+                                // line 40 "scan_string_lit.rl"
+
+                                // If te is behind p then we've skipped over some literal
+                                // characters which we must now return.
+                                if te < p {
+                                        ret = append(ret, data[te:p])
+                                }
+                                ts = p
+
+                        case 1:
+                                // line 48 "scan_string_lit.rl"
+
+                                te = p
+                                ret = append(ret, data[ts:te])
+
+                                // line 255 "scan_string_lit.go"
+                        }
+                }
+
+        _again:
+                if cs == 0 {
+                        goto _out
+                }
+                p++
+                if p != pe {
+                        goto _resume
+                }
+        _test_eof:
+                {
+                }
+                if p == eof {
+                        __acts := _hclstrtok_eof_actions[cs]
+                        __nacts := uint(_hclstrtok_actions[__acts])
+                        __acts++
+                        for ; __nacts > 0; __nacts-- {
+                                __acts++
+                                switch _hclstrtok_actions[__acts-1] {
+                                case 1:
+                                        // line 48 "scan_string_lit.rl"
+
+                                        te = p
+                                        ret = append(ret, data[ts:te])
+
+                                        // line 281 "scan_string_lit.go"
+                                }
+                        }
+                }
+
+        _out:
+                {
+                }
+        }
+
+        // line 89 "scan_string_lit.rl"
+
+        if te < p {
+                // Collect any leftover literal characters at the end of the input
+                ret = append(ret, data[te:p])
+        }
+
+        // If we fall out here without being in a final state then we've
+        // encountered something that the scanner can't match, which should
+        // be impossible (the scanner matches all bytes _somehow_) but we'll
+        // tolerate it and let the caller deal with it.
+        if cs < hclstrtok_first_final {
+                ret = append(ret, data[p:len(data)])
+        }
+
+        return ret
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/scan_string_lit.rl b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/scan_string_lit.rl
new file mode 100644
index 0000000..f8ac117
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/scan_string_lit.rl
@@ -0,0 +1,105 @@
+
+package hclsyntax
+
+// This file is generated from scan_string_lit.rl. DO NOT EDIT.
+%%{
+  # (except you are actually in scan_string_lit.rl here, so edit away!)
+
+  machine hclstrtok;
+  write data;
+}%%
+
+func scanStringLit(data []byte, quoted bool) [][]byte {
+    var ret [][]byte
+
+    %%{
+        include UnicodeDerived "unicode_derived.rl";
+
+        UTF8Cont = 0x80 .. 0xBF;
+        AnyUTF8 = (
+            0x00..0x7F |
+            0xC0..0xDF . UTF8Cont |
+            0xE0..0xEF . UTF8Cont . UTF8Cont |
+            0xF0..0xF7 . UTF8Cont . UTF8Cont . UTF8Cont
+        );
+        BadUTF8 = any - AnyUTF8;
+
+        Hex = ('0'..'9' | 'a'..'f' | 'A'..'F');
+
+        # Our goal with this patterns is to capture user intent as best as
+        # possible, even if the input is invalid. The caller will then verify
+        # whether each token is valid and generate suitable error messages
+        # if not.
+        UnicodeEscapeShort = "\\u" . Hex{0,4};
+        UnicodeEscapeLong = "\\U" . Hex{0,8};
+        UnicodeEscape = (UnicodeEscapeShort | UnicodeEscapeLong);
+        SimpleEscape = "\\" . (AnyUTF8 - ('U'|'u'))?;
+        TemplateEscape = ("$" . ("$" . ("{"?))?) | ("%" . ("%" . ("{"?))?);
+        Newline = ("\r\n" | "\r" | "\n");
+
+        action Begin {
+            // If te is behind p then we've skipped over some literal
+            // characters which we must now return.
+            if te < p {
+                ret = append(ret, data[te:p])
+            }
+            ts = p;
+        }
+        action End {
+            te = p;
+            ret = append(ret, data[ts:te]);
+        }
+
+        QuotedToken = (UnicodeEscape | SimpleEscape | TemplateEscape | Newline) >Begin %End;
+        UnquotedToken = (TemplateEscape | Newline) >Begin %End;
+        QuotedLiteral = (any - ("\\" | "$" | "%" | "\r" | "\n"));
+        UnquotedLiteral = (any - ("$" | "%" | "\r" | "\n"));
+
+        quoted := (QuotedToken | QuotedLiteral)**;
+        unquoted := (UnquotedToken | UnquotedLiteral)**;
+
+    }%%
+
+    // Ragel state
+        p := 0  // "Pointer" into data
+        pe := len(data) // End-of-data "pointer"
+    ts := 0
+    te := 0
+    eof := pe
+
+    var cs int // current state
+    switch {
+    case quoted:
+        cs = hclstrtok_en_quoted
+    default:
+        cs = hclstrtok_en_unquoted
+    }
+
+    // Make Go compiler happy
+    _ = ts
+    _ = eof
+
+    /*token := func () {
+        ret = append(ret, data[ts:te])
+    }*/
+
+    %%{
+        write init nocs;
+        write exec;
+    }%%
+
+    if te < p {
+        // Collect any leftover literal characters at the end of the input
+        ret = append(ret, data[te:p])
+    }
+
+    // If we fall out here without being in a final state then we've
+    // encountered something that the scanner can't match, which should
+    // be impossible (the scanner matches all bytes _somehow_) but we'll
+    // tolerate it and let the caller deal with it.
+    if cs < hclstrtok_first_final {
+        ret = append(ret, data[p:len(data)])
+    }
+
+    return ret
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/scan_tokens.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/scan_tokens.go
new file mode 100644
index 0000000..395e9c1
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/scan_tokens.go
@@ -0,0 +1,5443 @@
+// line 1 "scan_tokens.rl"
+
+package hclsyntax
+
+import (
+        "bytes"
+
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+// This file is generated from scan_tokens.rl. DO NOT EDIT.
+
+// line 15 "scan_tokens.go"
+var _hcltok_actions []byte = []byte{
+        0, 1, 0, 1, 1, 1, 2, 1, 3,
+        1, 4, 1, 6, 1, 7, 1, 8,
+        1, 9, 1, 10, 1, 11, 1, 12,
+        1, 13, 1, 14, 1, 15, 1, 16,
+        1, 17, 1, 18, 1, 19, 1, 22,
+        1, 23, 1, 24, 1, 25, 1, 26,
+        1, 27, 1, 28, 1, 29, 1, 30,
+        1, 31, 1, 34, 1, 35, 1, 36,
+        1, 37, 1, 38, 1, 39, 1, 40,
+        1, 41, 1, 42, 1, 43, 1, 46,
+        1, 47, 1, 48, 1, 49, 1, 50,
+        1, 51, 1, 52, 1, 58, 1, 59,
+        1, 60, 1, 61, 1, 62, 1, 63,
+        1, 64, 1, 65, 1, 66, 1, 67,
+        1, 68, 1, 69, 1, 70, 1, 71,
+        1, 72, 1, 73, 1, 74, 1, 75,
+        1, 76, 1, 77, 1, 78, 1, 79,
+        1, 80, 1, 81, 1, 82, 1, 83,
+        1, 84, 1, 85, 1, 86, 1, 87,
+        2, 0, 15, 2, 1, 15, 2, 2,
+        24, 2, 2, 28, 2, 3, 24, 2,
+        3, 28, 2, 4, 5, 2, 7, 0,
+        2, 7, 1, 2, 7, 20, 2, 7,
+        21, 2, 7, 32, 2, 7, 33, 2,
+        7, 44, 2, 7, 45, 2, 7, 53,
+        2, 7, 54, 2, 7, 55, 2, 7,
+        56, 2, 7, 57, 3, 7, 2, 20,
+        3, 7, 3, 20,
+}
+
+var _hcltok_key_offsets []int16 = []int16{
+        0, 0, 1, 2, 3, 5, 10, 14,
+        16, 58, 99, 145, 146, 150, 156, 156,
+        158, 160, 169, 175, 182, 183, 186, 187,
+        191, 196, 205, 209, 213, 221, 223, 225,
+        227, 230, 262, 264, 266, 270, 274, 277,
+        288, 301, 320, 333, 349, 361, 377, 392,
+        413, 423, 435, 446, 460, 475, 485, 497,
+        506, 518, 520, 524, 545, 554, 564, 570,
+        576, 577, 626, 628, 632, 634, 640, 647,
+        655, 662, 665, 671, 675, 679, 681, 685,
+        689, 693, 699, 707, 715, 721, 723, 727,
+        729, 735, 739, 743, 747, 751, 756, 763,
+        769, 771, 773, 777, 779, 785, 789, 793,
+        803, 808, 822, 837, 839, 847, 849, 854,
+        868, 873, 875, 879, 880, 884, 890, 896,
+        906, 916, 927, 935, 938, 941, 945, 949,
+        951, 954, 954, 957, 959, 989, 991, 993,
+        997, 1002, 1006, 1011, 1013, 1015, 1017, 1026,
+        1030, 1034, 1040, 1042, 1050, 1058, 1070, 1073,
+        1079, 1083, 1085, 1089, 1109, 1111, 1113, 1124,
+        1130, 1132, 1134, 1136, 1140, 1146, 1152, 1154,
+        1159, 1163, 1165, 1173, 1191, 1231, 1241, 1245,
+        1247, 1249, 1250, 1254, 1258, 1262, 1266, 1270,
+        1275, 1279, 1283, 1287, 1289, 1291, 1295, 1305,
+        1309, 1311, 1315, 1319, 1323, 1336, 1338, 1340,
+        1344, 1346, 1350, 1352, 1354, 1384, 1388, 1392,
+        1396, 1399, 1406, 1411, 1422, 1426, 1442, 1456,
+        1460, 1465, 1469, 1473, 1479, 1481, 1487, 1489,
+        1493, 1495, 1501, 1506, 1511, 1521, 1523, 1525,
+        1529, 1533, 1535, 1548, 1550, 1554, 1558, 1566,
+        1568, 1572, 1574, 1575, 1578, 1583, 1585, 1587,
+        1591, 1593, 1597, 1603, 1623, 1629, 1635, 1637,
+        1638, 1648, 1649, 1657, 1664, 1666, 1669, 1671,
+        1673, 1675, 1680, 1684, 1688, 1693, 1703, 1713,
+        1717, 1721, 1735, 1761, 1771, 1773, 1775, 1778,
+        1780, 1783, 1785, 1789, 1791, 1792, 1796, 1798,
+        1801, 1808, 1816, 1818, 1820, 1824, 1826, 1832,
+        1843, 1846, 1848, 1852, 1857, 1887, 1892, 1894,
+        1897, 1902, 1916, 1923, 1937, 1942, 1955, 1959,
+        1972, 1977, 1995, 1996, 2005, 2009, 2021, 2026,
+        2033, 2040, 2047, 2049, 2053, 2075, 2080, 2081,
+        2085, 2087, 2137, 2140, 2151, 2155, 2157, 2163,
+        2169, 2171, 2176, 2178, 2182, 2184, 2185, 2187,
+        2189, 2195, 2197, 2199, 2203, 2209, 2222, 2224,
+        2230, 2234, 2242, 2253, 2261, 2264, 2294, 2300,
+        2303, 2308, 2310, 2314, 2318, 2322, 2324, 2331,
+        2333, 2342, 2349, 2357, 2359, 2379, 2391, 2395,
+        2397, 2415, 2454, 2456, 2460, 2462, 2469, 2473,
+        2501, 2503, 2505, 2507, 2509, 2512, 2514, 2518,
+        2522, 2524, 2527, 2529, 2531, 2534, 2536, 2538,
+        2539, 2541, 2543, 2547, 2551, 2554, 2567, 2569,
+        2575, 2579, 2581, 2585, 2589, 2603, 2606, 2615,
+        2617, 2621, 2627, 2627, 2629, 2631, 2640, 2646,
+        2653, 2654, 2657, 2658, 2662, 2667, 2676, 2680,
+        2684, 2692, 2694, 2696, 2698, 2701, 2733, 2735,
+        2737, 2741, 2745, 2748, 2759, 2772, 2791, 2804,
+        2820, 2832, 2848, 2863, 2884, 2894, 2906, 2917,
+        2931, 2946, 2956, 2968, 2977, 2989, 2991, 2995,
+        3016, 3025, 3035, 3041, 3047, 3048, 3097, 3099,
+        3103, 3105, 3111, 3118, 3126, 3133, 3136, 3142,
+        3146, 3150, 3152, 3156, 3160, 3164, 3170, 3178,
+        3186, 3192, 3194, 3198, 3200, 3206, 3210, 3214,
+        3218, 3222, 3227, 3234, 3240, 3242, 3244, 3248,
+        3250, 3256, 3260, 3264, 3274, 3279, 3293, 3308,
+        3310, 3318, 3320, 3325, 3339, 3344, 3346, 3350,
+        3351, 3355, 3361, 3367, 3377, 3387, 3398, 3406,
+        3409, 3412, 3416, 3420, 3422, 3425, 3425, 3428,
+        3430, 3460, 3462, 3464, 3468, 3473, 3477, 3482,
+        3484, 3486, 3488, 3497, 3501, 3505, 3511, 3513,
+        3521, 3529, 3541, 3544, 3550, 3554, 3556, 3560,
+        3580, 3582, 3584, 3595, 3601, 3603, 3605, 3607,
+        3611, 3617, 3623, 3625, 3630, 3634, 3636, 3644,
+        3662, 3702, 3712, 3716, 3718, 3720, 3721, 3725,
+        3729, 3733, 3737, 3741, 3746, 3750, 3754, 3758,
+        3760, 3762, 3766, 3776, 3780, 3782, 3786, 3790,
+        3794, 3807, 3809, 3811, 3815, 3817, 3821, 3823,
+        3825, 3855, 3859, 3863, 3867, 3870, 3877, 3882,
+        3893, 3897, 3913, 3927, 3931, 3936, 3940, 3944,
+        3950, 3952, 3958, 3960, 3964, 3966, 3972, 3977,
+        3982, 3992, 3994, 3996, 4000, 4004, 4006, 4019,
+        4021, 4025, 4029, 4037, 4039, 4043, 4045, 4046,
+        4049, 4054, 4056, 4058, 4062, 4064, 4068, 4074,
+        4094, 4100, 4106, 4108, 4109, 4119, 4120, 4128,
+        4135, 4137, 4140, 4142, 4144, 4146, 4151, 4155,
+        4159, 4164, 4174, 4184, 4188, 4192, 4206, 4232,
+        4242, 4244, 4246, 4249, 4251, 4254, 4256, 4260,
+        4262, 4263, 4267, 4269, 4271, 4278, 4282, 4289,
+        4296, 4305, 4321, 4333, 4351, 4362, 4374, 4382,
+        4400, 4408, 4438, 4441, 4451, 4461, 4473, 4484,
+        4493, 4506, 4518, 4522, 4528, 4555, 4564, 4567,
+        4572, 4578, 4583, 4604, 4608, 4614, 4614, 4621,
+        4630, 4638, 4641, 4645, 4651, 4657, 4660, 4664,
+        4671, 4677, 4686, 4695, 4699, 4703, 4707, 4711,
+        4718, 4722, 4726, 4736, 4742, 4746, 4752, 4756,
+        4759, 4765, 4771, 4783, 4787, 4791, 4801, 4805,
+        4816, 4818, 4820, 4824, 4836, 4841, 4865, 4869,
+        4875, 4897, 4906, 4910, 4913, 4914, 4922, 4930,
+        4936, 4946, 4953, 4971, 4974, 4977, 4985, 4991,
+        4995, 4999, 5003, 5009, 5017, 5022, 5028, 5032,
+        5040, 5047, 5051, 5058, 5064, 5072, 5080, 5086,
+        5092, 5103, 5107, 5119, 5128, 5145, 5162, 5165,
+        5169, 5171, 5177, 5179, 5183, 5198, 5202, 5206,
+        5210, 5214, 5218, 5220, 5226, 5231, 5235, 5241,
+        5248, 5251, 5269, 5271, 5316, 5322, 5328, 5332,
+        5336, 5342, 5346, 5352, 5358, 5365, 5367, 5373,
+        5379, 5383, 5387, 5395, 5408, 5414, 5421, 5429,
+        5435, 5444, 5450, 5454, 5459, 5463, 5471, 5475,
+        5479, 5509, 5515, 5521, 5527, 5533, 5540, 5546,
+        5553, 5558, 5568, 5572, 5579, 5585, 5589, 5596,
+        5600, 5606, 5609, 5613, 5617, 5621, 5625, 5630,
+        5635, 5639, 5650, 5654, 5658, 5664, 5672, 5676,
+        5693, 5697, 5703, 5713, 5719, 5725, 5728, 5733,
+        5742, 5746, 5750, 5756, 5760, 5766, 5774, 5792,
+        5793, 5803, 5804, 5813, 5821, 5823, 5826, 5828,
+        5830, 5832, 5837, 5850, 5854, 5869, 5898, 5909,
+        5911, 5915, 5919, 5924, 5928, 5930, 5937, 5941,
+        5949, 5953, 5954, 5955, 5957, 5959, 5961, 5963,
+        5965, 5966, 5967, 5968, 5970, 5972, 5974, 5975,
+        5976, 5977, 5978, 5980, 5982, 5984, 5985, 5986,
+        5990, 5996, 5996, 5998, 6000, 6009, 6015, 6022,
+        6023, 6026, 6027, 6031, 6036, 6045, 6049, 6053,
+        6061, 6063, 6065, 6067, 6070, 6102, 6104, 6106,
+        6110, 6114, 6117, 6128, 6141, 6160, 6173, 6189,
+        6201, 6217, 6232, 6253, 6263, 6275, 6286, 6300,
+        6315, 6325, 6337, 6346, 6358, 6360, 6364, 6385,
+        6394, 6404, 6410, 6416, 6417, 6466, 6468, 6472,
+        6474, 6480, 6487, 6495, 6502, 6505, 6511, 6515,
+        6519, 6521, 6525, 6529, 6533, 6539, 6547, 6555,
+        6561, 6563, 6567, 6569, 6575, 6579, 6583, 6587,
+        6591, 6596, 6603, 6609, 6611, 6613, 6617, 6619,
+        6625, 6629, 6633, 6643, 6648, 6662, 6677, 6679,
+        6687, 6689, 6694, 6708, 6713, 6715, 6719, 6720,
+        6724, 6730, 6736, 6746, 6756, 6767, 6775, 6778,
+        6781, 6785, 6789, 6791, 6794, 6794, 6797, 6799,
+        6829, 6831, 6833, 6837, 6842, 6846, 6851, 6853,
+        6855, 6857, 6866, 6870, 6874, 6880, 6882, 6890,
+        6898, 6910, 6913, 6919, 6923, 6925, 6929, 6949,
+        6951, 6953, 6964, 6970, 6972, 6974, 6976, 6980,
+        6986, 6992, 6994, 6999, 7003, 7005, 7013, 7031,
+        7071, 7081, 7085, 7087, 7089, 7090, 7094, 7098,
+        7102, 7106, 7110, 7115, 7119, 7123, 7127, 7129,
+        7131, 7135, 7145, 7149, 7151, 7155, 7159, 7163,
+        7176, 7178, 7180, 7184, 7186, 7190, 7192, 7194,
+        7224, 7228, 7232, 7236, 7239, 7246, 7251, 7262,
+        7266, 7282, 7296, 7300, 7305, 7309, 7313, 7319,
+        7321, 7327, 7329, 7333, 7335, 7341, 7346, 7351,
+        7361, 7363, 7365, 7369, 7373, 7375, 7388, 7390,
+        7394, 7398, 7406, 7408, 7412, 7414, 7415, 7418,
+        7423, 7425, 7427, 7431, 7433, 7437, 7443, 7463,
+        7469, 7475, 7477, 7478, 7488, 7489, 7497, 7504,
+        7506, 7509, 7511, 7513, 7515, 7520, 7524, 7528,
+        7533, 7543, 7553, 7557, 7561, 7575, 7601, 7611,
+        7613, 7615, 7618, 7620, 7623, 7625, 7629, 7631,
+        7632, 7636, 7638, 7640, 7647, 7651, 7658, 7665,
+        7674, 7690, 7702, 7720, 7731, 7743, 7751, 7769,
+        7777, 7807, 7810, 7820, 7830, 7842, 7853, 7862,
+        7875, 7887, 7891, 7897, 7924, 7933, 7936, 7941,
+        7947, 7952, 7973, 7977, 7983, 7983, 7990, 7999,
+        8007, 8010, 8014, 8020, 8026, 8029, 8033, 8040,
+        8046, 8055, 8064, 8068, 8072, 8076, 8080, 8087,
+        8091, 8095, 8105, 8111, 8115, 8121, 8125, 8128,
+        8134, 8140, 8152, 8156, 8160, 8170, 8174, 8185,
+        8187, 8189, 8193, 8205, 8210, 8234, 8238, 8244,
+        8266, 8275, 8279, 8282, 8283, 8291, 8299, 8305,
+        8315, 8322, 8340, 8343, 8346, 8354, 8360, 8364,
+        8368, 8372, 8378, 8386, 8391, 8397, 8401, 8409,
+        8416, 8420, 8427, 8433, 8441, 8449, 8455, 8461,
+        8472, 8476, 8488, 8497, 8514, 8531, 8534, 8538,
+        8540, 8546, 8548, 8552, 8567, 8571, 8575, 8579,
+        8583, 8587, 8589, 8595, 8600, 8604, 8610, 8617,
+        8620, 8638, 8640, 8685, 8691, 8697, 8701, 8705,
+        8711, 8715, 8721, 8727, 8734, 8736, 8742, 8748,
+        8752, 8756, 8764, 8777, 8783, 8790, 8798, 8804,
+        8813, 8819, 8823, 8828, 8832, 8840, 8844, 8848,
+        8878, 8884, 8890, 8896, 8902, 8909, 8915, 8922,
+        8927, 8937, 8941, 8948, 8954, 8958, 8965, 8969,
+        8975, 8978, 8982, 8986, 8990, 8994, 8999, 9004,
+        9008, 9019, 9023, 9027, 9033, 9041, 9045, 9062,
+        9066, 9072, 9082, 9088, 9094, 9097, 9102, 9111,
+        9115, 9119, 9125, 9129, 9135, 9143, 9161, 9162,
+        9172, 9173, 9182, 9190, 9192, 9195, 9197, 9199,
+        9201, 9206, 9219, 9223, 9238, 9267, 9278, 9280,
+        9284, 9288, 9293, 9297, 9299, 9306, 9310, 9318,
+        9322, 9398, 9400, 9401, 9402, 9403, 9404, 9405,
+        9407, 9408, 9413, 9415, 9417, 9418, 9462, 9463,
+        9464, 9466, 9471, 9475, 9475, 9477, 9479, 9490,
+        9500, 9508, 9509, 9511, 9512, 9516, 9520, 9530,
+        9534, 9541, 9552, 9559, 9563, 9569, 9580, 9612,
+        9661, 9676, 9691, 9696, 9698, 9703, 9735, 9743,
+        9745, 9767, 9789, 9791, 9807, 9823, 9839, 9855,
+        9870, 9880, 9897, 9914, 9931, 9947, 9957, 9974,
+        9990, 10006, 10022, 10038, 10054, 10070, 10086, 10087,
+        10088, 10089, 10090, 10092, 10094, 10096, 10110, 10124,
+        10138, 10152, 10153, 10154, 10156, 10158, 10160, 10174,
+        10188, 10189, 10190, 10192, 10194, 10196, 10245, 10289,
+        10291, 10296, 10300, 10300, 10302, 10304, 10315, 10325,
+        10333, 10334, 10336, 10337, 10341, 10345, 10355, 10359,
+        10366, 10377, 10384, 10388, 10394, 10405, 10437, 10486,
+        10501, 10516, 10521, 10523, 10528, 10560, 10568, 10570,
+        10592, 10614,
+}
+
+var _hcltok_trans_keys []byte = []byte{
+        10, 46, 42, 42, 47, 46, 69, 101,
+        48, 57, 43, 45, 48, 57, 48, 57,
+        45, 95, 194, 195, 198, 199, 203, 205,
+        206, 207, 210, 212, 213, 214, 215, 216,
+        217, 219, 220, 221, 222, 223, 224, 225,
+        226, 227, 228, 233, 234, 237, 239, 240,
+        65, 90, 97, 122, 196, 202, 208, 218,
+        229, 236, 95, 194, 195, 198, 199, 203,
+        205, 206, 207, 210, 212, 213, 214, 215,
+        216, 217, 219, 220, 221, 222, 223, 224,
+        225, 226, 227, 228, 233, 234, 237, 239,
+        240, 65, 90, 97, 122, 196, 202, 208,
+        218, 229, 236, 10, 13, 45, 95, 194,
+        195, 198, 199, 203, 204, 205, 206, 207,
+        210, 212, 213, 214, 215, 216, 217, 219,
+        220, 221, 222, 223, 224, 225, 226, 227,
+        228, 233, 234, 237, 239, 240, 243, 48,
+        57, 65, 90, 97, 122, 196, 218, 229,
+        236, 10, 170, 181, 183, 186, 128, 150,
+        152, 182, 184, 255, 192, 255, 0, 127,
+        173, 130, 133, 146, 159, 165, 171, 175,
+        255, 181, 190, 184, 185, 192, 255, 140,
+        134, 138, 142, 161, 163, 255, 182, 130,
+        136, 137, 176, 151, 152, 154, 160, 190,
+        136, 144, 192, 255, 135, 129, 130, 132,
+        133, 144, 170, 176, 178, 144, 154, 160,
+        191, 128, 169, 174, 255, 148, 169, 157,
+        158, 189, 190, 192, 255, 144, 255, 139,
+        140, 178, 255, 186, 128, 181, 160, 161,
+        162, 163, 164, 165, 166, 167, 168, 169,
+        170, 171, 172, 173, 174, 175, 176, 177,
+        178, 179, 180, 181, 182, 183, 184, 185,
+        186, 187, 188, 189, 190, 191, 128, 173,
+        128, 155, 160, 180, 182, 189, 148, 161,
+        163, 255, 176, 164, 165, 132, 169, 177,
+        141, 142, 145, 146, 179, 181, 186, 187,
+        158, 133, 134, 137, 138, 143, 150, 152,
+        155, 164, 165, 178, 255, 188, 129, 131,
+        133, 138, 143, 144, 147, 168, 170, 176,
+        178, 179, 181, 182, 184, 185, 190, 255,
+        157, 131, 134, 137, 138, 142, 144, 146,
+        152, 159, 165, 182, 255, 129, 131, 133,
+        141, 143, 145, 147, 168, 170, 176, 178,
+        179, 181, 185, 188, 255, 134, 138, 142,
+        143, 145, 159, 164, 165, 176, 184, 186,
+        255, 129, 131, 133, 140, 143, 144, 147,
+        168, 170, 176, 178, 179, 181, 185, 188,
+        191, 177, 128, 132, 135, 136, 139, 141,
+        150, 151, 156, 157, 159, 163, 166, 175,
+        156, 130, 131, 133, 138, 142, 144, 146,
+        149, 153, 154, 158, 159, 163, 164, 168,
+        170, 174, 185, 190, 191, 144, 151, 128,
+        130, 134, 136, 138, 141, 166, 175, 128,
+        131, 133, 140, 142, 144, 146, 168, 170,
+        185, 189, 255, 133, 137, 151, 142, 148,
+        155, 159, 164, 165, 176, 255, 128, 131,
+        133, 140, 142, 144, 146, 168, 170, 179,
+        181, 185, 188, 191, 158, 128, 132, 134,
+        136, 138, 141, 149, 150, 160, 163, 166,
+        175, 177, 178, 129, 131, 133, 140, 142,
+        144, 146, 186, 189, 255, 133, 137, 143,
+        147, 152, 158, 164, 165, 176, 185, 192,
+        255, 189, 130, 131, 133, 150, 154, 177,
+        179, 187, 138, 150, 128, 134, 143, 148,
+        152, 159, 166, 175, 178, 179, 129, 186,
+        128, 142, 144, 153, 132, 138, 141, 165,
+        167, 129, 130, 135, 136, 148, 151, 153,
+        159, 161, 163, 170, 171, 173, 185, 187,
+        189, 134, 128, 132, 136, 141, 144, 153,
+        156, 159, 128, 181, 183, 185, 152, 153,
+        160, 169, 190, 191, 128, 135, 137, 172,
+        177, 191, 128, 132, 134, 151, 153, 188,
+        134, 128, 129, 130, 131, 137, 138, 139,
+        140, 141, 142, 143, 144, 153, 154, 155,
+        156, 157, 158, 159, 160, 161, 162, 163,
+        164, 165, 166, 167, 168, 169, 170, 173,
+        175, 176, 177, 178, 179, 181, 182, 183,
+        188, 189, 190, 191, 132, 152, 172, 184,
+        185, 187, 128, 191, 128, 137, 144, 255,
+        158, 159, 134, 187, 136, 140, 142, 143,
+        137, 151, 153, 142, 143, 158, 159, 137,
+        177, 142, 143, 182, 183, 191, 255, 128,
+        130, 133, 136, 150, 152, 255, 145, 150,
+        151, 155, 156, 160, 168, 178, 255, 128,
+        143, 160, 255, 182, 183, 190, 255, 129,
+        255, 173, 174, 192, 255, 129, 154, 160,
+        255, 171, 173, 185, 255, 128, 140, 142,
+        148, 160, 180, 128, 147, 160, 172, 174,
+        176, 178, 179, 148, 150, 152, 155, 158,
+        159, 170, 255, 139, 141, 144, 153, 160,
+        255, 184, 255, 128, 170, 176, 255, 182,
+        255, 128, 158, 160, 171, 176, 187, 134,
+        173, 176, 180, 128, 171, 176, 255, 138,
+        143, 155, 255, 128, 155, 160, 255, 159,
+        189, 190, 192, 255, 167, 128, 137, 144,
+        153, 176, 189, 140, 143, 154, 170, 180,
+        255, 180, 255, 128, 183, 128, 137, 141,
+        189, 128, 136, 144, 146, 148, 182, 184,
+        185, 128, 181, 187, 191, 150, 151, 158,
+        159, 152, 154, 156, 158, 134, 135, 142,
+        143, 190, 255, 190, 128, 180, 182, 188,
+        130, 132, 134, 140, 144, 147, 150, 155,
+        160, 172, 178, 180, 182, 188, 128, 129,
+        130, 131, 132, 133, 134, 176, 177, 178,
+        179, 180, 181, 182, 183, 191, 255, 129,
+        147, 149, 176, 178, 190, 192, 255, 144,
+        156, 161, 144, 156, 165, 176, 130, 135,
+        149, 164, 166, 168, 138, 147, 152, 157,
+        170, 185, 188, 191, 142, 133, 137, 160,
+        255, 137, 255, 128, 174, 176, 255, 159,
+        165, 170, 180, 255, 167, 173, 128, 165,
+        176, 255, 168, 174, 176, 190, 192, 255,
+        128, 150, 160, 166, 168, 174, 176, 182,
+        184, 190, 128, 134, 136, 142, 144, 150,
+        152, 158, 160, 191, 128, 129, 130, 131,
+        132, 133, 134, 135, 144, 145, 255, 133,
+        135, 161, 175, 177, 181, 184, 188, 160,
+        151, 152, 187, 192, 255, 133, 173, 177,
+        255, 143, 159, 187, 255, 176, 191, 182,
+        183, 184, 191, 192, 255, 150, 255, 128,
+        146, 147, 148, 152, 153, 154, 155, 156,
+        158, 159, 160, 161, 162, 163, 164, 165,
+        166, 167, 168, 169, 170, 171, 172, 173,
+        174, 175, 176, 129, 255, 141, 255, 144,
+        189, 141, 143, 172, 255, 191, 128, 175,
+        180, 189, 151, 159, 162, 255, 175, 137,
+        138, 184, 255, 183, 255, 168, 255, 128,
+        179, 188, 134, 143, 154, 159, 184, 186,
+        190, 255, 128, 173, 176, 255, 148, 159,
+        189, 255, 129, 142, 154, 159, 191, 255,
+        128, 182, 128, 141, 144, 153, 160, 182,
+        186, 255, 128, 130, 155, 157, 160, 175,
+        178, 182, 129, 134, 137, 142, 145, 150,
+        160, 166, 168, 174, 176, 255, 155, 166,
+        175, 128, 170, 172, 173, 176, 185, 158,
+        159, 160, 255, 164, 175, 135, 138, 188,
+        255, 164, 169, 171, 172, 173, 174, 175,
+        180, 181, 182, 183, 184, 185, 187, 188,
+        189, 190, 191, 165, 186, 174, 175, 154,
+        255, 190, 128, 134, 147, 151, 157, 168,
+        170, 182, 184, 188, 128, 129, 131, 132,
+        134, 255, 147, 255, 190, 255, 144, 145,
+        136, 175, 188, 255, 128, 143, 160, 175,
+        179, 180, 141, 143, 176, 180, 182, 255,
+        189, 255, 191, 144, 153, 161, 186, 129,
+        154, 166, 255, 191, 255, 130, 135, 138,
+        143, 146, 151, 154, 156, 144, 145, 146,
+        147, 148, 150, 151, 152, 155, 157, 158,
+        160, 170, 171, 172, 175, 161, 169, 128,
+        129, 130, 131, 133, 135, 138, 139, 140,
+        141, 142, 143, 144, 145, 146, 147, 148,
+        149, 152, 156, 157, 160, 161, 162, 163,
+        164, 166, 168, 169, 170, 171, 172, 173,
+        174, 176, 177, 153, 155, 178, 179, 128,
+        139, 141, 166, 168, 186, 188, 189, 191,
+        255, 142, 143, 158, 255, 187, 255, 128,
+        180, 189, 128, 156, 160, 255, 145, 159,
+        161, 255, 128, 159, 176, 255, 139, 143,
+        187, 255, 128, 157, 160, 255, 144, 132,
+        135, 150, 255, 158, 159, 170, 175, 148,
+        151, 188, 255, 128, 167, 176, 255, 164,
+        255, 183, 255, 128, 149, 160, 167, 136,
+        188, 128, 133, 138, 181, 183, 184, 191,
+        255, 150, 159, 183, 255, 128, 158, 160,
+        178, 180, 181, 128, 149, 160, 185, 128,
+        183, 190, 191, 191, 128, 131, 133, 134,
+        140, 147, 149, 151, 153, 179, 184, 186,
+        160, 188, 128, 156, 128, 135, 137, 166,
+        128, 181, 128, 149, 160, 178, 128, 145,
+        128, 178, 129, 130, 131, 132, 133, 135,
+        136, 138, 139, 140, 141, 144, 145, 146,
+        147, 150, 151, 152, 153, 154, 155, 156,
+        162, 163, 171, 176, 177, 178, 128, 134,
+        135, 165, 176, 190, 144, 168, 176, 185,
+        128, 180, 182, 191, 182, 144, 179, 155,
+        133, 137, 141, 143, 157, 255, 190, 128,
+        145, 147, 183, 136, 128, 134, 138, 141,
+        143, 157, 159, 168, 176, 255, 171, 175,
+        186, 255, 128, 131, 133, 140, 143, 144,
+        147, 168, 170, 176, 178, 179, 181, 185,
+        188, 191, 144, 151, 128, 132, 135, 136,
+        139, 141, 157, 163, 166, 172, 176, 180,
+        128, 138, 144, 153, 134, 136, 143, 154,
+        255, 128, 181, 184, 255, 129, 151, 158,
+        255, 129, 131, 133, 143, 154, 255, 128,
+        137, 128, 153, 157, 171, 176, 185, 160,
+        255, 170, 190, 192, 255, 128, 184, 128,
+        136, 138, 182, 184, 191, 128, 144, 153,
+        178, 255, 168, 144, 145, 183, 255, 128,
+        142, 145, 149, 129, 141, 144, 146, 147,
+        148, 175, 255, 132, 255, 128, 144, 129,
+        143, 144, 153, 145, 152, 135, 255, 160,
+        168, 169, 171, 172, 173, 174, 188, 189,
+        190, 191, 161, 167, 185, 255, 128, 158,
+        160, 169, 144, 173, 176, 180, 128, 131,
+        144, 153, 163, 183, 189, 255, 144, 255,
+        133, 143, 191, 255, 143, 159, 160, 128,
+        129, 255, 159, 160, 171, 172, 255, 173,
+        255, 179, 255, 128, 176, 177, 178, 128,
+        129, 171, 175, 189, 255, 128, 136, 144,
+        153, 157, 158, 133, 134, 137, 144, 145,
+        146, 147, 148, 149, 154, 155, 156, 157,
+        158, 159, 168, 169, 170, 150, 153, 165,
+        169, 173, 178, 187, 255, 131, 132, 140,
+        169, 174, 255, 130, 132, 149, 157, 173,
+        186, 188, 160, 161, 163, 164, 167, 168,
+        132, 134, 149, 157, 186, 139, 140, 191,
+        255, 134, 128, 132, 138, 144, 146, 255,
+        166, 167, 129, 155, 187, 149, 181, 143,
+        175, 137, 169, 131, 140, 141, 192, 255,
+        128, 182, 187, 255, 173, 180, 182, 255,
+        132, 155, 159, 161, 175, 128, 160, 163,
+        164, 165, 184, 185, 186, 161, 162, 128,
+        134, 136, 152, 155, 161, 163, 164, 166,
+        170, 133, 143, 151, 255, 139, 143, 154,
+        255, 164, 167, 185, 187, 128, 131, 133,
+        159, 161, 162, 169, 178, 180, 183, 130,
+        135, 137, 139, 148, 151, 153, 155, 157,
+        159, 164, 190, 141, 143, 145, 146, 161,
+        162, 167, 170, 172, 178, 180, 183, 185,
+        188, 128, 137, 139, 155, 161, 163, 165,
+        169, 171, 187, 155, 156, 151, 255, 156,
+        157, 160, 181, 255, 186, 187, 255, 162,
+        255, 160, 168, 161, 167, 158, 255, 160,
+        132, 135, 133, 134, 176, 255, 170, 181,
+        186, 191, 176, 180, 182, 183, 186, 189,
+        134, 140, 136, 138, 142, 161, 163, 255,
+        130, 137, 136, 255, 144, 170, 176, 178,
+        160, 191, 128, 138, 174, 175, 177, 255,
+        148, 150, 164, 167, 173, 176, 185, 189,
+        190, 192, 255, 144, 146, 175, 141, 255,
+        166, 176, 178, 255, 186, 138, 170, 180,
+        181, 160, 161, 162, 164, 165, 166, 167,
+        168, 169, 170, 171, 172, 173, 174, 175,
+        176, 177, 178, 179, 180, 181, 182, 184,
+        186, 187, 188, 189, 190, 183, 185, 154,
+        164, 168, 128, 149, 128, 152, 189, 132,
+        185, 144, 152, 161, 177, 255, 169, 177,
+        129, 132, 141, 142, 145, 146, 179, 181,
+        186, 188, 190, 255, 142, 156, 157, 159,
+        161, 176, 177, 133, 138, 143, 144, 147,
+        168, 170, 176, 178, 179, 181, 182, 184,
+        185, 158, 153, 156, 178, 180, 189, 133,
+        141, 143, 145, 147, 168, 170, 176, 178,
+        179, 181, 185, 144, 185, 160, 161, 189,
+        133, 140, 143, 144, 147, 168, 170, 176,
+        178, 179, 181, 185, 177, 156, 157, 159,
+        161, 131, 156, 133, 138, 142, 144, 146,
+        149, 153, 154, 158, 159, 163, 164, 168,
+        170, 174, 185, 144, 189, 133, 140, 142,
+        144, 146, 168, 170, 185, 152, 154, 160,
+        161, 128, 189, 133, 140, 142, 144, 146,
+        168, 170, 179, 181, 185, 158, 160, 161,
+        177, 178, 189, 133, 140, 142, 144, 146,
+        186, 142, 148, 150, 159, 161, 186, 191,
+        189, 133, 150, 154, 177, 179, 187, 128,
+        134, 129, 176, 178, 179, 132, 138, 141,
+        165, 167, 189, 129, 130, 135, 136, 148,
+        151, 153, 159, 161, 163, 170, 171, 173,
+        176, 178, 179, 134, 128, 132, 156, 159,
+        128, 128, 135, 137, 172, 136, 140, 128,
+        129, 130, 131, 137, 138, 139, 140, 141,
+        142, 143, 144, 153, 154, 155, 156, 157,
+        158, 159, 160, 161, 162, 163, 164, 165,
+        166, 167, 168, 169, 170, 172, 173, 174,
+        175, 176, 177, 178, 179, 180, 181, 182,
+        184, 188, 189, 190, 191, 132, 152, 185,
+        187, 191, 128, 170, 161, 144, 149, 154,
+        157, 165, 166, 174, 176, 181, 255, 130,
+        141, 143, 159, 155, 255, 128, 140, 142,
+        145, 160, 177, 128, 145, 160, 172, 174,
+        176, 151, 156, 170, 128, 168, 176, 255,
+        138, 255, 128, 150, 160, 255, 149, 255,
+        167, 133, 179, 133, 139, 131, 160, 174,
+        175, 186, 255, 166, 255, 128, 163, 141,
+        143, 154, 189, 169, 172, 174, 177, 181,
+        182, 129, 130, 132, 133, 134, 176, 177,
+        178, 179, 180, 181, 182, 183, 177, 191,
+        165, 170, 175, 177, 180, 255, 168, 174,
+        176, 255, 128, 134, 136, 142, 144, 150,
+        152, 158, 128, 129, 130, 131, 132, 133,
+        134, 135, 144, 145, 255, 133, 135, 161,
+        169, 177, 181, 184, 188, 160, 151, 154,
+        128, 146, 147, 148, 152, 153, 154, 155,
+        156, 158, 159, 160, 161, 162, 163, 164,
+        165, 166, 167, 168, 169, 170, 171, 172,
+        173, 174, 175, 176, 129, 255, 141, 143,
+        160, 169, 172, 255, 191, 128, 174, 130,
+        134, 139, 163, 255, 130, 179, 187, 189,
+        178, 183, 138, 165, 176, 255, 135, 159,
+        189, 255, 132, 178, 143, 160, 164, 166,
+        175, 186, 190, 128, 168, 186, 128, 130,
+        132, 139, 160, 182, 190, 255, 176, 178,
+        180, 183, 184, 190, 255, 128, 130, 155,
+        157, 160, 170, 178, 180, 128, 162, 164,
+        169, 171, 172, 173, 174, 175, 180, 181,
+        182, 183, 185, 186, 187, 188, 189, 190,
+        191, 165, 179, 157, 190, 128, 134, 147,
+        151, 159, 168, 170, 182, 184, 188, 176,
+        180, 182, 255, 161, 186, 144, 145, 146,
+        147, 148, 150, 151, 152, 155, 157, 158,
+        160, 170, 171, 172, 175, 161, 169, 128,
+        129, 130, 131, 133, 138, 139, 140, 141,
+        142, 143, 144, 145, 146, 147, 148, 149,
+        152, 156, 157, 160, 161, 162, 163, 164,
+        166, 168, 169, 170, 171, 172, 173, 174,
+        176, 177, 153, 155, 178, 179, 145, 255,
+        139, 143, 182, 255, 158, 175, 128, 144,
+        147, 149, 151, 153, 179, 128, 135, 137,
+        164, 128, 130, 131, 132, 133, 134, 135,
+        136, 138, 139, 140, 141, 144, 145, 146,
+        147, 150, 151, 152, 153, 154, 156, 162,
+        163, 171, 176, 177, 178, 131, 183, 131,
+        175, 144, 168, 131, 166, 182, 144, 178,
+        131, 178, 154, 156, 129, 132, 128, 145,
+        147, 171, 159, 255, 144, 157, 161, 135,
+        138, 128, 175, 135, 132, 133, 128, 174,
+        152, 155, 132, 128, 170, 128, 153, 160,
+        190, 192, 255, 128, 136, 138, 174, 128,
+        178, 255, 160, 168, 169, 171, 172, 173,
+        174, 188, 189, 190, 191, 161, 167, 144,
+        173, 128, 131, 163, 183, 189, 255, 133,
+        143, 145, 255, 147, 159, 128, 176, 177,
+        178, 128, 136, 144, 153, 144, 145, 146,
+        147, 148, 149, 154, 155, 156, 157, 158,
+        159, 150, 153, 131, 140, 255, 160, 163,
+        164, 165, 184, 185, 186, 161, 162, 133,
+        255, 170, 181, 183, 186, 128, 150, 152,
+        182, 184, 255, 192, 255, 128, 255, 173,
+        130, 133, 146, 159, 165, 171, 175, 255,
+        181, 190, 184, 185, 192, 255, 140, 134,
+        138, 142, 161, 163, 255, 182, 130, 136,
+        137, 176, 151, 152, 154, 160, 190, 136,
+        144, 192, 255, 135, 129, 130, 132, 133,
+        144, 170, 176, 178, 144, 154, 160, 191,
+        128, 169, 174, 255, 148, 169, 157, 158,
+        189, 190, 192, 255, 144, 255, 139, 140,
+        178, 255, 186, 128, 181, 160, 161, 162,
+        163, 164, 165, 166, 167, 168, 169, 170,
+        171, 172, 173, 174, 175, 176, 177, 178,
+        179, 180, 181, 182, 183, 184, 185, 186,
+        187, 188, 189, 190, 191, 128, 173, 128,
+        155, 160, 180, 182, 189, 148, 161, 163,
+        255, 176, 164, 165, 132, 169, 177, 141,
+        142, 145, 146, 179, 181, 186, 187, 158,
+        133, 134, 137, 138, 143, 150, 152, 155,
+        164, 165, 178, 255, 188, 129, 131, 133,
+        138, 143, 144, 147, 168, 170, 176, 178,
+        179, 181, 182, 184, 185, 190, 255, 157,
+        131, 134, 137, 138, 142, 144, 146, 152,
+        159, 165, 182, 255, 129, 131, 133, 141,
+        143, 145, 147, 168, 170, 176, 178, 179,
+        181, 185, 188, 255, 134, 138, 142, 143,
+        145, 159, 164, 165, 176, 184, 186, 255,
+        129, 131, 133, 140, 143, 144, 147, 168,
+        170, 176, 178, 179, 181, 185, 188, 191,
+        177, 128, 132, 135, 136, 139, 141, 150,
+        151, 156, 157, 159, 163, 166, 175, 156,
+        130, 131, 133, 138, 142, 144, 146, 149,
+        153, 154, 158, 159, 163, 164, 168, 170,
+        174, 185, 190, 191, 144, 151, 128, 130,
+        134, 136, 138, 141, 166, 175, 128, 131,
+        133, 140, 142, 144, 146, 168, 170, 185,
+        189, 255, 133, 137, 151, 142, 148, 155,
+        159, 164, 165, 176, 255, 128, 131, 133,
+        140, 142, 144, 146, 168, 170, 179, 181,
+        185, 188, 191, 158, 128, 132, 134, 136,
+        138, 141, 149, 150, 160, 163, 166, 175,
+        177, 178, 129, 131, 133, 140, 142, 144,
+        146, 186, 189, 255, 133, 137, 143, 147,
+        152, 158, 164, 165, 176, 185, 192, 255,
+        189, 130, 131, 133, 150, 154, 177, 179,
+        187, 138, 150, 128, 134, 143, 148, 152,
+        159, 166, 175, 178, 179, 129, 186, 128,
+        142, 144, 153, 132, 138, 141, 165, 167,
+        129, 130, 135, 136, 148, 151, 153, 159,
+        161, 163, 170, 171, 173, 185, 187, 189,
+        134, 128, 132, 136, 141, 144, 153, 156,
+        159, 128, 181, 183, 185, 152, 153, 160,
+        169, 190, 191, 128, 135, 137, 172, 177,
+        191, 128, 132, 134, 151, 153, 188, 134,
+        128, 129, 130, 131, 137, 138, 139, 140,
+        141, 142, 143, 144, 153, 154, 155, 156,
+        157, 158, 159, 160, 161, 162, 163, 164,
+        165, 166, 167, 168, 169, 170, 173, 175,
+        176, 177, 178, 179, 181, 182, 183, 188,
+        189, 190, 191, 132, 152, 172, 184, 185,
+        187, 128, 191, 128, 137, 144, 255, 158,
+        159, 134, 187, 136, 140, 142, 143, 137,
+        151, 153, 142, 143, 158, 159, 137, 177,
+        142, 143, 182, 183, 191, 255, 128, 130,
+        133, 136, 150, 152, 255, 145, 150, 151,
+        155, 156, 160, 168, 178, 255, 128, 143,
+        160, 255, 182, 183, 190, 255, 129, 255,
+        173, 174, 192, 255, 129, 154, 160, 255,
+        171, 173, 185, 255, 128, 140, 142, 148,
+        160, 180, 128, 147, 160, 172, 174, 176,
+        178, 179, 148, 150, 152, 155, 158, 159,
+        170, 255, 139, 141, 144, 153, 160, 255,
+        184, 255, 128, 170, 176, 255, 182, 255,
+        128, 158, 160, 171, 176, 187, 134, 173,
+        176, 180, 128, 171, 176, 255, 138, 143,
+        155, 255, 128, 155, 160, 255, 159, 189,
+        190, 192, 255, 167, 128, 137, 144, 153,
+        176, 189, 140, 143, 154, 170, 180, 255,
+        180, 255, 128, 183, 128, 137, 141, 189,
+        128, 136, 144, 146, 148, 182, 184, 185,
+        128, 181, 187, 191, 150, 151, 158, 159,
+        152, 154, 156, 158, 134, 135, 142, 143,
+        190, 255, 190, 128, 180, 182, 188, 130,
+        132, 134, 140, 144, 147, 150, 155, 160,
+        172, 178, 180, 182, 188, 128, 129, 130,
+        131, 132, 133, 134, 176, 177, 178, 179,
+        180, 181, 182, 183, 191, 255, 129, 147,
+        149, 176, 178, 190, 192, 255, 144, 156,
+        161, 144, 156, 165, 176, 130, 135, 149,
+        164, 166, 168, 138, 147, 152, 157, 170,
+        185, 188, 191, 142, 133, 137, 160, 255,
+        137, 255, 128, 174, 176, 255, 159, 165,
+        170, 180, 255, 167, 173, 128, 165, 176,
+        255, 168, 174, 176, 190, 192, 255, 128,
+        150, 160, 166, 168, 174, 176, 182, 184,
+        190, 128, 134, 136, 142, 144, 150, 152,
+        158, 160, 191, 128, 129, 130, 131, 132,
+        133, 134, 135, 144, 145, 255, 133, 135,
+        161, 175, 177, 181, 184, 188, 160, 151,
+        152, 187, 192, 255, 133, 173, 177, 255,
+        143, 159, 187, 255, 176, 191, 182, 183,
+        184, 191, 192, 255, 150, 255, 128, 146,
+        147, 148, 152, 153, 154, 155, 156, 158,
+        159, 160, 161, 162, 163, 164, 165, 166,
+        167, 168, 169, 170, 171, 172, 173, 174,
+        175, 176, 129, 255, 141, 255, 144, 189,
+        141, 143, 172, 255, 191, 128, 175, 180,
+        189, 151, 159, 162, 255, 175, 137, 138,
+        184, 255, 183, 255, 168, 255, 128, 179,
+        188, 134, 143, 154, 159, 184, 186, 190,
+        255, 128, 173, 176, 255, 148, 159, 189,
+        255, 129, 142, 154, 159, 191, 255, 128,
+        182, 128, 141, 144, 153, 160, 182, 186,
+        255, 128, 130, 155, 157, 160, 175, 178,
+        182, 129, 134, 137, 142, 145, 150, 160,
+        166, 168, 174, 176, 255, 155, 166, 175,
+        128, 170, 172, 173, 176, 185, 158, 159,
+        160, 255, 164, 175, 135, 138, 188, 255,
+        164, 169, 171, 172, 173, 174, 175, 180,
+        181, 182, 183, 184, 185, 187, 188, 189,
+        190, 191, 165, 186, 174, 175, 154, 255,
+        190, 128, 134, 147, 151, 157, 168, 170,
+        182, 184, 188, 128, 129, 131, 132, 134,
+        255, 147, 255, 190, 255, 144, 145, 136,
+        175, 188, 255, 128, 143, 160, 175, 179,
+        180, 141, 143, 176, 180, 182, 255, 189,
+        255, 191, 144, 153, 161, 186, 129, 154,
+        166, 255, 191, 255, 130, 135, 138, 143,
+        146, 151, 154, 156, 144, 145, 146, 147,
+        148, 150, 151, 152, 155, 157, 158, 160,
+        170, 171, 172, 175, 161, 169, 128, 129,
+        130, 131, 133, 135, 138, 139, 140, 141,
+        142, 143, 144, 145, 146, 147, 148, 149,
+        152, 156, 157, 160, 161, 162, 163, 164,
+        166, 168, 169, 170, 171, 172, 173, 174,
+        176, 177, 153, 155, 178, 179, 128, 139,
+        141, 166, 168, 186, 188, 189, 191, 255,
+        142, 143, 158, 255, 187, 255, 128, 180,
+        189, 128, 156, 160, 255, 145, 159, 161,
+        255, 128, 159, 176, 255, 139, 143, 187,
+        255, 128, 157, 160, 255, 144, 132, 135,
+        150, 255, 158, 159, 170, 175, 148, 151,
+        188, 255, 128, 167, 176, 255, 164, 255,
+        183, 255, 128, 149, 160, 167, 136, 188,
+        128, 133, 138, 181, 183, 184, 191, 255,
+        150, 159, 183, 255, 128, 158, 160, 178,
+        180, 181, 128, 149, 160, 185, 128, 183,
+        190, 191, 191, 128, 131, 133, 134, 140,
+        147, 149, 151, 153, 179, 184, 186, 160,
+        188, 128, 156, 128, 135, 137, 166, 128,
+        181, 128, 149, 160, 178, 128, 145, 128,
+        178, 129, 130, 131, 132, 133, 135, 136,
+        138, 139, 140, 141, 144, 145, 146, 147,
+        150, 151, 152, 153, 154, 155, 156, 162,
+        163, 171, 176, 177, 178, 128, 134, 135,
+        165, 176, 190, 144, 168, 176, 185, 128,
+        180, 182, 191, 182, 144, 179, 155, 133,
+        137, 141, 143, 157, 255, 190, 128, 145,
+        147, 183, 136, 128, 134, 138, 141, 143,
+        157, 159, 168, 176, 255, 171, 175, 186,
+        255, 128, 131, 133, 140, 143, 144, 147,
+        168, 170, 176, 178, 179, 181, 185, 188,
+        191, 144, 151, 128, 132, 135, 136, 139,
+        141, 157, 163, 166, 172, 176, 180, 128,
+        138, 144, 153, 134, 136, 143, 154, 255,
+        128, 181, 184, 255, 129, 151, 158, 255,
+        129, 131, 133, 143, 154, 255, 128, 137,
+        128, 153, 157, 171, 176, 185, 160, 255,
+        170, 190, 192, 255, 128, 184, 128, 136,
+        138, 182, 184, 191, 128, 144, 153, 178,
+        255, 168, 144, 145, 183, 255, 128, 142,
+        145, 149, 129, 141, 144, 146, 147, 148,
+        175, 255, 132, 255, 128, 144, 129, 143,
+        144, 153, 145, 152, 135, 255, 160, 168,
+        169, 171, 172, 173, 174, 188, 189, 190,
+        191, 161, 167, 185, 255, 128, 158, 160,
+        169, 144, 173, 176, 180, 128, 131, 144,
+        153, 163, 183, 189, 255, 144, 255, 133,
+        143, 191, 255, 143, 159, 160, 128, 129,
+        255, 159, 160, 171, 172, 255, 173, 255,
+        179, 255, 128, 176, 177, 178, 128, 129,
+        171, 175, 189, 255, 128, 136, 144, 153,
+        157, 158, 133, 134, 137, 144, 145, 146,
+        147, 148, 149, 154, 155, 156, 157, 158,
+        159, 168, 169, 170, 150, 153, 165, 169,
+        173, 178, 187, 255, 131, 132, 140, 169,
+        174, 255, 130, 132, 149, 157, 173, 186,
+        188, 160, 161, 163, 164, 167, 168, 132,
+        134, 149, 157, 186, 139, 140, 191, 255,
+        134, 128, 132, 138, 144, 146, 255, 166,
+        167, 129, 155, 187, 149, 181, 143, 175,
+        137, 169, 131, 140, 141, 192, 255, 128,
+        182, 187, 255, 173, 180, 182, 255, 132,
+        155, 159, 161, 175, 128, 160, 163, 164,
+        165, 184, 185, 186, 161, 162, 128, 134,
+        136, 152, 155, 161, 163, 164, 166, 170,
+        133, 143, 151, 255, 139, 143, 154, 255,
+        164, 167, 185, 187, 128, 131, 133, 159,
+        161, 162, 169, 178, 180, 183, 130, 135,
+        137, 139, 148, 151, 153, 155, 157, 159,
+        164, 190, 141, 143, 145, 146, 161, 162,
+        167, 170, 172, 178, 180, 183, 185, 188,
+        128, 137, 139, 155, 161, 163, 165, 169,
+        171, 187, 155, 156, 151, 255, 156, 157,
+        160, 181, 255, 186, 187, 255, 162, 255,
+        160, 168, 161, 167, 158, 255, 160, 132,
+        135, 133, 134, 176, 255, 128, 191, 154,
+        164, 168, 128, 149, 150, 191, 128, 152,
+        153, 191, 181, 128, 159, 160, 189, 190,
+        191, 189, 128, 131, 132, 185, 186, 191,
+        144, 128, 151, 152, 161, 162, 176, 177,
+        255, 169, 177, 129, 132, 141, 142, 145,
+        146, 179, 181, 186, 188, 190, 191, 192,
+        255, 142, 158, 128, 155, 156, 161, 162,
+        175, 176, 177, 178, 191, 169, 177, 180,
+        183, 128, 132, 133, 138, 139, 142, 143,
+        144, 145, 146, 147, 185, 186, 191, 157,
+        128, 152, 153, 158, 159, 177, 178, 180,
+        181, 191, 142, 146, 169, 177, 180, 189,
+        128, 132, 133, 185, 186, 191, 144, 185,
+        128, 159, 160, 161, 162, 191, 169, 177,
+        180, 189, 128, 132, 133, 140, 141, 142,
+        143, 144, 145, 146, 147, 185, 186, 191,
+        158, 177, 128, 155, 156, 161, 162, 191,
+        131, 145, 155, 157, 128, 132, 133, 138,
+        139, 141, 142, 149, 150, 152, 153, 159,
+        160, 162, 163, 164, 165, 167, 168, 170,
+        171, 173, 174, 185, 186, 191, 144, 128,
+        191, 141, 145, 169, 189, 128, 132, 133,
+        185, 186, 191, 128, 151, 152, 154, 155,
+        159, 160, 161, 162, 191, 128, 141, 145,
+        169, 180, 189, 129, 132, 133, 185, 186,
+        191, 158, 128, 159, 160, 161, 162, 176,
+        177, 178, 179, 191, 141, 145, 189, 128,
+        132, 133, 186, 187, 191, 142, 128, 147,
+        148, 150, 151, 158, 159, 161, 162, 185,
+        186, 191, 178, 188, 128, 132, 133, 150,
+        151, 153, 154, 189, 190, 191, 128, 134,
+        135, 191, 128, 177, 129, 179, 180, 191,
+        128, 131, 137, 141, 152, 160, 164, 166,
+        172, 177, 189, 129, 132, 133, 134, 135,
+        138, 139, 147, 148, 167, 168, 169, 170,
+        179, 180, 191, 133, 128, 134, 135, 155,
+        156, 159, 160, 191, 128, 129, 191, 136,
+        128, 172, 173, 191, 128, 135, 136, 140,
+        141, 191, 191, 128, 170, 171, 190, 161,
+        128, 143, 144, 149, 150, 153, 154, 157,
+        158, 164, 165, 166, 167, 173, 174, 176,
+        177, 180, 181, 255, 130, 141, 143, 159,
+        134, 187, 136, 140, 142, 143, 137, 151,
+        153, 142, 143, 158, 159, 137, 177, 191,
+        142, 143, 182, 183, 192, 255, 129, 151,
+        128, 133, 134, 135, 136, 255, 145, 150,
+        151, 155, 191, 192, 255, 128, 143, 144,
+        159, 160, 255, 182, 183, 190, 191, 192,
+        255, 128, 129, 255, 173, 174, 192, 255,
+        128, 129, 154, 155, 159, 160, 255, 171,
+        173, 185, 191, 192, 255, 141, 128, 145,
+        146, 159, 160, 177, 178, 191, 173, 128,
+        145, 146, 159, 160, 176, 177, 191, 128,
+        179, 180, 191, 151, 156, 128, 191, 128,
+        159, 160, 255, 184, 191, 192, 255, 169,
+        128, 170, 171, 175, 176, 255, 182, 191,
+        192, 255, 128, 158, 159, 191, 128, 143,
+        144, 173, 174, 175, 176, 180, 181, 191,
+        128, 171, 172, 175, 176, 255, 138, 191,
+        192, 255, 128, 150, 151, 159, 160, 255,
+        149, 191, 192, 255, 167, 128, 191, 128,
+        132, 133, 179, 180, 191, 128, 132, 133,
+        139, 140, 191, 128, 130, 131, 160, 161,
+        173, 174, 175, 176, 185, 186, 255, 166,
+        191, 192, 255, 128, 163, 164, 191, 128,
+        140, 141, 143, 144, 153, 154, 189, 190,
+        191, 128, 136, 137, 191, 173, 128, 168,
+        169, 177, 178, 180, 181, 182, 183, 191,
+        0, 127, 192, 255, 150, 151, 158, 159,
+        152, 154, 156, 158, 134, 135, 142, 143,
+        190, 191, 192, 255, 181, 189, 191, 128,
+        190, 133, 181, 128, 129, 130, 140, 141,
+        143, 144, 147, 148, 149, 150, 155, 156,
+        159, 160, 172, 173, 177, 178, 188, 189,
+        191, 177, 191, 128, 190, 128, 143, 144,
+        156, 157, 191, 130, 135, 148, 164, 166,
+        168, 128, 137, 138, 149, 150, 151, 152,
+        157, 158, 169, 170, 185, 186, 187, 188,
+        191, 142, 128, 132, 133, 137, 138, 159,
+        160, 255, 137, 191, 192, 255, 175, 128,
+        255, 159, 165, 170, 175, 177, 180, 191,
+        192, 255, 166, 173, 128, 167, 168, 175,
+        176, 255, 168, 174, 176, 191, 192, 255,
+        167, 175, 183, 191, 128, 150, 151, 159,
+        160, 190, 135, 143, 151, 128, 158, 159,
+        191, 128, 132, 133, 135, 136, 160, 161,
+        169, 170, 176, 177, 181, 182, 183, 184,
+        188, 189, 191, 160, 151, 154, 187, 192,
+        255, 128, 132, 133, 173, 174, 176, 177,
+        255, 143, 159, 187, 191, 192, 255, 128,
+        175, 176, 191, 150, 191, 192, 255, 141,
+        191, 192, 255, 128, 143, 144, 189, 190,
+        191, 141, 143, 160, 169, 172, 191, 192,
+        255, 191, 128, 174, 175, 190, 128, 157,
+        158, 159, 160, 255, 176, 191, 192, 255,
+        128, 150, 151, 159, 160, 161, 162, 255,
+        175, 137, 138, 184, 191, 192, 255, 128,
+        182, 183, 255, 130, 134, 139, 163, 191,
+        192, 255, 128, 129, 130, 179, 180, 191,
+        187, 189, 128, 177, 178, 183, 184, 191,
+        128, 137, 138, 165, 166, 175, 176, 255,
+        135, 159, 189, 191, 192, 255, 128, 131,
+        132, 178, 179, 191, 143, 165, 191, 128,
+        159, 160, 175, 176, 185, 186, 190, 128,
+        168, 169, 191, 131, 186, 128, 139, 140,
+        159, 160, 182, 183, 189, 190, 255, 176,
+        178, 180, 183, 184, 190, 191, 192, 255,
+        129, 128, 130, 131, 154, 155, 157, 158,
+        159, 160, 170, 171, 177, 178, 180, 181,
+        191, 128, 167, 175, 129, 134, 135, 136,
+        137, 142, 143, 144, 145, 150, 151, 159,
+        160, 255, 155, 166, 175, 128, 162, 163,
+        191, 164, 175, 135, 138, 188, 191, 192,
+        255, 174, 175, 154, 191, 192, 255, 157,
+        169, 183, 189, 191, 128, 134, 135, 146,
+        147, 151, 152, 158, 159, 190, 130, 133,
+        128, 255, 178, 191, 192, 255, 128, 146,
+        147, 255, 190, 191, 192, 255, 128, 143,
+        144, 255, 144, 145, 136, 175, 188, 191,
+        192, 255, 181, 128, 175, 176, 255, 189,
+        191, 192, 255, 128, 160, 161, 186, 187,
+        191, 128, 129, 154, 155, 165, 166, 255,
+        191, 192, 255, 128, 129, 130, 135, 136,
+        137, 138, 143, 144, 145, 146, 151, 152,
+        153, 154, 156, 157, 191, 128, 191, 128,
+        129, 130, 131, 133, 138, 139, 140, 141,
+        142, 143, 144, 145, 146, 147, 148, 149,
+        152, 156, 157, 160, 161, 162, 163, 164,
+        166, 168, 169, 170, 171, 172, 173, 174,
+        176, 177, 132, 151, 153, 155, 158, 175,
+        178, 179, 180, 191, 140, 167, 187, 190,
+        128, 255, 142, 143, 158, 191, 192, 255,
+        187, 191, 192, 255, 128, 180, 181, 191,
+        128, 156, 157, 159, 160, 255, 145, 191,
+        192, 255, 128, 159, 160, 175, 176, 255,
+        139, 143, 182, 191, 192, 255, 144, 132,
+        135, 150, 191, 192, 255, 158, 175, 148,
+        151, 188, 191, 192, 255, 128, 167, 168,
+        175, 176, 255, 164, 191, 192, 255, 183,
+        191, 192, 255, 128, 149, 150, 159, 160,
+        167, 168, 191, 136, 182, 188, 128, 133,
+        134, 137, 138, 184, 185, 190, 191, 255,
+        150, 159, 183, 191, 192, 255, 179, 128,
+        159, 160, 181, 182, 191, 128, 149, 150,
+        159, 160, 185, 186, 191, 128, 183, 184,
+        189, 190, 191, 128, 148, 152, 129, 143,
+        144, 179, 180, 191, 128, 159, 160, 188,
+        189, 191, 128, 156, 157, 191, 136, 128,
+        164, 165, 191, 128, 181, 182, 191, 128,
+        149, 150, 159, 160, 178, 179, 191, 128,
+        145, 146, 191, 128, 178, 179, 191, 128,
+        130, 131, 132, 133, 134, 135, 136, 138,
+        139, 140, 141, 144, 145, 146, 147, 150,
+        151, 152, 153, 154, 156, 162, 163, 171,
+        176, 177, 178, 129, 191, 128, 130, 131,
+        183, 184, 191, 128, 130, 131, 175, 176,
+        191, 128, 143, 144, 168, 169, 191, 128,
+        130, 131, 166, 167, 191, 182, 128, 143,
+        144, 178, 179, 191, 128, 130, 131, 178,
+        179, 191, 128, 154, 156, 129, 132, 133,
+        191, 146, 128, 171, 172, 191, 135, 137,
+        142, 158, 128, 168, 169, 175, 176, 255,
+        159, 191, 192, 255, 144, 128, 156, 157,
+        161, 162, 191, 128, 134, 135, 138, 139,
+        191, 128, 175, 176, 191, 134, 128, 131,
+        132, 135, 136, 191, 128, 174, 175, 191,
+        128, 151, 152, 155, 156, 191, 132, 128,
+        191, 128, 170, 171, 191, 128, 153, 154,
+        191, 160, 190, 192, 255, 128, 184, 185,
+        191, 137, 128, 174, 175, 191, 128, 129,
+        177, 178, 255, 144, 191, 192, 255, 128,
+        142, 143, 144, 145, 146, 149, 129, 148,
+        150, 191, 175, 191, 192, 255, 132, 191,
+        192, 255, 128, 144, 129, 143, 145, 191,
+        144, 153, 128, 143, 145, 152, 154, 191,
+        135, 191, 192, 255, 160, 168, 169, 171,
+        172, 173, 174, 188, 189, 190, 191, 128,
+        159, 161, 167, 170, 187, 185, 191, 192,
+        255, 128, 143, 144, 173, 174, 191, 128,
+        131, 132, 162, 163, 183, 184, 188, 189,
+        255, 133, 143, 145, 191, 192, 255, 128,
+        146, 147, 159, 160, 191, 160, 128, 191,
+        128, 129, 191, 192, 255, 159, 160, 171,
+        128, 170, 172, 191, 192, 255, 173, 191,
+        192, 255, 179, 191, 192, 255, 128, 176,
+        177, 178, 129, 191, 128, 129, 130, 191,
+        171, 175, 189, 191, 192, 255, 128, 136,
+        137, 143, 144, 153, 154, 191, 144, 145,
+        146, 147, 148, 149, 154, 155, 156, 157,
+        158, 159, 128, 143, 150, 153, 160, 191,
+        149, 157, 173, 186, 188, 160, 161, 163,
+        164, 167, 168, 132, 134, 149, 157, 186,
+        191, 139, 140, 192, 255, 133, 145, 128,
+        134, 135, 137, 138, 255, 166, 167, 129,
+        155, 187, 149, 181, 143, 175, 137, 169,
+        131, 140, 191, 192, 255, 160, 163, 164,
+        165, 184, 185, 186, 128, 159, 161, 162,
+        166, 191, 133, 191, 192, 255, 132, 160,
+        163, 167, 179, 184, 186, 128, 164, 165,
+        168, 169, 187, 188, 191, 130, 135, 137,
+        139, 144, 147, 151, 153, 155, 157, 159,
+        163, 171, 179, 184, 189, 191, 128, 140,
+        141, 148, 149, 160, 161, 164, 165, 166,
+        167, 190, 138, 164, 170, 128, 155, 156,
+        160, 161, 187, 188, 191, 128, 191, 155,
+        156, 128, 191, 151, 191, 192, 255, 156,
+        157, 160, 128, 191, 181, 191, 192, 255,
+        158, 159, 186, 128, 185, 187, 191, 192,
+        255, 162, 191, 192, 255, 160, 168, 128,
+        159, 161, 167, 169, 191, 158, 191, 192,
+        255, 123, 123, 128, 191, 128, 191, 128,
+        191, 128, 191, 128, 191, 10, 123, 123,
+        128, 191, 128, 191, 128, 191, 123, 123,
+        10, 123, 128, 191, 128, 191, 128, 191,
+        123, 123, 170, 181, 183, 186, 128, 150,
+        152, 182, 184, 255, 192, 255, 128, 255,
+        173, 130, 133, 146, 159, 165, 171, 175,
+        255, 181, 190, 184, 185, 192, 255, 140,
+        134, 138, 142, 161, 163, 255, 182, 130,
+        136, 137, 176, 151, 152, 154, 160, 190,
+        136, 144, 192, 255, 135, 129, 130, 132,
+        133, 144, 170, 176, 178, 144, 154, 160,
+        191, 128, 169, 174, 255, 148, 169, 157,
+        158, 189, 190, 192, 255, 144, 255, 139,
+        140, 178, 255, 186, 128, 181, 160, 161,
+        162, 163, 164, 165, 166, 167, 168, 169,
+        170, 171, 172, 173, 174, 175, 176, 177,
+        178, 179, 180, 181, 182, 183, 184, 185,
+        186, 187, 188, 189, 190, 191, 128, 173,
+        128, 155, 160, 180, 182, 189, 148, 161,
+        163, 255, 176, 164, 165, 132, 169, 177,
+        141, 142, 145, 146, 179, 181, 186, 187,
+        158, 133, 134, 137, 138, 143, 150, 152,
+        155, 164, 165, 178, 255, 188, 129, 131,
+        133, 138, 143, 144, 147, 168, 170, 176,
+        178, 179, 181, 182, 184, 185, 190, 255,
+        157, 131, 134, 137, 138, 142, 144, 146,
+        152, 159, 165, 182, 255, 129, 131, 133,
+        141, 143, 145, 147, 168, 170, 176, 178,
+        179, 181, 185, 188, 255, 134, 138, 142,
+        143, 145, 159, 164, 165, 176, 184, 186,
+        255, 129, 131, 133, 140, 143, 144, 147,
+        168, 170, 176, 178, 179, 181, 185, 188,
+        191, 177, 128, 132, 135, 136, 139, 141,
+        150, 151, 156, 157, 159, 163, 166, 175,
+        156, 130, 131, 133, 138, 142, 144, 146,
+        149, 153, 154, 158, 159, 163, 164, 168,
+        170, 174, 185, 190, 191, 144, 151, 128,
+        130, 134, 136, 138, 141, 166, 175, 128,
+        131, 133, 140, 142, 144, 146, 168, 170,
+        185, 189, 255, 133, 137, 151, 142, 148,
+        155, 159, 164, 165, 176, 255, 128, 131,
+        133, 140, 142, 144, 146, 168, 170, 179,
+        181, 185, 188, 191, 158, 128, 132, 134,
+        136, 138, 141, 149, 150, 160, 163, 166,
+        175, 177, 178, 129, 131, 133, 140, 142,
+        144, 146, 186, 189, 255, 133, 137, 143,
+        147, 152, 158, 164, 165, 176, 185, 192,
+        255, 189, 130, 131, 133, 150, 154, 177,
+        179, 187, 138, 150, 128, 134, 143, 148,
+        152, 159, 166, 175, 178, 179, 129, 186,
+        128, 142, 144, 153, 132, 138, 141, 165,
+        167, 129, 130, 135, 136, 148, 151, 153,
+        159, 161, 163, 170, 171, 173, 185, 187,
+        189, 134, 128, 132, 136, 141, 144, 153,
+        156, 159, 128, 181, 183, 185, 152, 153,
+        160, 169, 190, 191, 128, 135, 137, 172,
+        177, 191, 128, 132, 134, 151, 153, 188,
+        134, 128, 129, 130, 131, 137, 138, 139,
+        140, 141, 142, 143, 144, 153, 154, 155,
+        156, 157, 158, 159, 160, 161, 162, 163,
+        164, 165, 166, 167, 168, 169, 170, 173,
+        175, 176, 177, 178, 179, 181, 182, 183,
+        188, 189, 190, 191, 132, 152, 172, 184,
+        185, 187, 128, 191, 128, 137, 144, 255,
+        158, 159, 134, 187, 136, 140, 142, 143,
+        137, 151, 153, 142, 143, 158, 159, 137,
+        177, 142, 143, 182, 183, 191, 255, 128,
+        130, 133, 136, 150, 152, 255, 145, 150,
+        151, 155, 156, 160, 168, 178, 255, 128,
+        143, 160, 255, 182, 183, 190, 255, 129,
+        255, 173, 174, 192, 255, 129, 154, 160,
+        255, 171, 173, 185, 255, 128, 140, 142,
+        148, 160, 180, 128, 147, 160, 172, 174,
+        176, 178, 179, 148, 150, 152, 155, 158,
+        159, 170, 255, 139, 141, 144, 153, 160,
+        255, 184, 255, 128, 170, 176, 255, 182,
+        255, 128, 158, 160, 171, 176, 187, 134,
+        173, 176, 180, 128, 171, 176, 255, 138,
+        143, 155, 255, 128, 155, 160, 255, 159,
+        189, 190, 192, 255, 167, 128, 137, 144,
+        153, 176, 189, 140, 143, 154, 170, 180,
+        255, 180, 255, 128, 183, 128, 137, 141,
+        189, 128, 136, 144, 146, 148, 182, 184,
+        185, 128, 181, 187, 191, 150, 151, 158,
+        159, 152, 154, 156, 158, 134, 135, 142,
+        143, 190, 255, 190, 128, 180, 182, 188,
+        130, 132, 134, 140, 144, 147, 150, 155,
+        160, 172, 178, 180, 182, 188, 128, 129,
+        130, 131, 132, 133, 134, 176, 177, 178,
+        179, 180, 181, 182, 183, 191, 255, 129,
+        147, 149, 176, 178, 190, 192, 255, 144,
+        156, 161, 144, 156, 165, 176, 130, 135,
+        149, 164, 166, 168, 138, 147, 152, 157,
+        170, 185, 188, 191, 142, 133, 137, 160,
+        255, 137, 255, 128, 174, 176, 255, 159,
+        165, 170, 180, 255, 167, 173, 128, 165,
+        176, 255, 168, 174, 176, 190, 192, 255,
+        128, 150, 160, 166, 168, 174, 176, 182,
+        184, 190, 128, 134, 136, 142, 144, 150,
+        152, 158, 160, 191, 128, 129, 130, 131,
+        132, 133, 134, 135, 144, 145, 255, 133,
+        135, 161, 175, 177, 181, 184, 188, 160,
+        151, 152, 187, 192, 255, 133, 173, 177,
+        255, 143, 159, 187, 255, 176, 191, 182,
+        183, 184, 191, 192, 255, 150, 255, 128,
+        146, 147, 148, 152, 153, 154, 155, 156,
+        158, 159, 160, 161, 162, 163, 164, 165,
+        166, 167, 168, 169, 170, 171, 172, 173,
+        174, 175, 176, 129, 255, 141, 255, 144,
+        189, 141, 143, 172, 255, 191, 128, 175,
+        180, 189, 151, 159, 162, 255, 175, 137,
+        138, 184, 255, 183, 255, 168, 255, 128,
+        179, 188, 134, 143, 154, 159, 184, 186,
+        190, 255, 128, 173, 176, 255, 148, 159,
+        189, 255, 129, 142, 154, 159, 191, 255,
+        128, 182, 128, 141, 144, 153, 160, 182,
+        186, 255, 128, 130, 155, 157, 160, 175,
+        178, 182, 129, 134, 137, 142, 145, 150,
+        160, 166, 168, 174, 176, 255, 155, 166,
+        175, 128, 170, 172, 173, 176, 185, 158,
+        159, 160, 255, 164, 175, 135, 138, 188,
+        255, 164, 169, 171, 172, 173, 174, 175,
+        180, 181, 182, 183, 184, 185, 187, 188,
+        189, 190, 191, 165, 186, 174, 175, 154,
+        255, 190, 128, 134, 147, 151, 157, 168,
+        170, 182, 184, 188, 128, 129, 131, 132,
+        134, 255, 147, 255, 190, 255, 144, 145,
+        136, 175, 188, 255, 128, 143, 160, 175,
+        179, 180, 141, 143, 176, 180, 182, 255,
+        189, 255, 191, 144, 153, 161, 186, 129,
+        154, 166, 255, 191, 255, 130, 135, 138,
+        143, 146, 151, 154, 156, 144, 145, 146,
+        147, 148, 150, 151, 152, 155, 157, 158,
+        160, 170, 171, 172, 175, 161, 169, 128,
+        129, 130, 131, 133, 135, 138, 139, 140,
+        141, 142, 143, 144, 145, 146, 147, 148,
+        149, 152, 156, 157, 160, 161, 162, 163,
+        164, 166, 168, 169, 170, 171, 172, 173,
+        174, 176, 177, 153, 155, 178, 179, 128,
+        139, 141, 166, 168, 186, 188, 189, 191,
+        255, 142, 143, 158, 255, 187, 255, 128,
+        180, 189, 128, 156, 160, 255, 145, 159,
+        161, 255, 128, 159, 176, 255, 139, 143,
+        187, 255, 128, 157, 160, 255, 144, 132,
+        135, 150, 255, 158, 159, 170, 175, 148,
+        151, 188, 255, 128, 167, 176, 255, 164,
+        255, 183, 255, 128, 149, 160, 167, 136,
+        188, 128, 133, 138, 181, 183, 184, 191,
+        255, 150, 159, 183, 255, 128, 158, 160,
+        178, 180, 181, 128, 149, 160, 185, 128,
+        183, 190, 191, 191, 128, 131, 133, 134,
+        140, 147, 149, 151, 153, 179, 184, 186,
+        160, 188, 128, 156, 128, 135, 137, 166,
+        128, 181, 128, 149, 160, 178, 128, 145,
+        128, 178, 129, 130, 131, 132, 133, 135,
+        136, 138, 139, 140, 141, 144, 145, 146,
+        147, 150, 151, 152, 153, 154, 155, 156,
+        162, 163, 171, 176, 177, 178, 128, 134,
+        135, 165, 176, 190, 144, 168, 176, 185,
+        128, 180, 182, 191, 182, 144, 179, 155,
+        133, 137, 141, 143, 157, 255, 190, 128,
+        145, 147, 183, 136, 128, 134, 138, 141,
+        143, 157, 159, 168, 176, 255, 171, 175,
+        186, 255, 128, 131, 133, 140, 143, 144,
+        147, 168, 170, 176, 178, 179, 181, 185,
+        188, 191, 144, 151, 128, 132, 135, 136,
+        139, 141, 157, 163, 166, 172, 176, 180,
+        128, 138, 144, 153, 134, 136, 143, 154,
+        255, 128, 181, 184, 255, 129, 151, 158,
+        255, 129, 131, 133, 143, 154, 255, 128,
+        137, 128, 153, 157, 171, 176, 185, 160,
+        255, 170, 190, 192, 255, 128, 184, 128,
+        136, 138, 182, 184, 191, 128, 144, 153,
+        178, 255, 168, 144, 145, 183, 255, 128,
+        142, 145, 149, 129, 141, 144, 146, 147,
+        148, 175, 255, 132, 255, 128, 144, 129,
+        143, 144, 153, 145, 152, 135, 255, 160,
+        168, 169, 171, 172, 173, 174, 188, 189,
+        190, 191, 161, 167, 185, 255, 128, 158,
+        160, 169, 144, 173, 176, 180, 128, 131,
+        144, 153, 163, 183, 189, 255, 144, 255,
+        133, 143, 191, 255, 143, 159, 160, 128,
+        129, 255, 159, 160, 171, 172, 255, 173,
+        255, 179, 255, 128, 176, 177, 178, 128,
+        129, 171, 175, 189, 255, 128, 136, 144,
+        153, 157, 158, 133, 134, 137, 144, 145,
+        146, 147, 148, 149, 154, 155, 156, 157,
+        158, 159, 168, 169, 170, 150, 153, 165,
+        169, 173, 178, 187, 255, 131, 132, 140,
+        169, 174, 255, 130, 132, 149, 157, 173,
+        186, 188, 160, 161, 163, 164, 167, 168,
+        132, 134, 149, 157, 186, 139, 140, 191,
+        255, 134, 128, 132, 138, 144, 146, 255,
+        166, 167, 129, 155, 187, 149, 181, 143,
+        175, 137, 169, 131, 140, 141, 192, 255,
+        128, 182, 187, 255, 173, 180, 182, 255,
+        132, 155, 159, 161, 175, 128, 160, 163,
+        164, 165, 184, 185, 186, 161, 162, 128,
+        134, 136, 152, 155, 161, 163, 164, 166,
+        170, 133, 143, 151, 255, 139, 143, 154,
+        255, 164, 167, 185, 187, 128, 131, 133,
+        159, 161, 162, 169, 178, 180, 183, 130,
+        135, 137, 139, 148, 151, 153, 155, 157,
+        159, 164, 190, 141, 143, 145, 146, 161,
+        162, 167, 170, 172, 178, 180, 183, 185,
+        188, 128, 137, 139, 155, 161, 163, 165,
+        169, 171, 187, 155, 156, 151, 255, 156,
+        157, 160, 181, 255, 186, 187, 255, 162,
+        255, 160, 168, 161, 167, 158, 255, 160,
+        132, 135, 133, 134, 176, 255, 128, 191,
+        154, 164, 168, 128, 149, 150, 191, 128,
+        152, 153, 191, 181, 128, 159, 160, 189,
+        190, 191, 189, 128, 131, 132, 185, 186,
+        191, 144, 128, 151, 152, 161, 162, 176,
+        177, 255, 169, 177, 129, 132, 141, 142,
+        145, 146, 179, 181, 186, 188, 190, 191,
+        192, 255, 142, 158, 128, 155, 156, 161,
+        162, 175, 176, 177, 178, 191, 169, 177,
+        180, 183, 128, 132, 133, 138, 139, 142,
+        143, 144, 145, 146, 147, 185, 186, 191,
+        157, 128, 152, 153, 158, 159, 177, 178,
+        180, 181, 191, 142, 146, 169, 177, 180,
+        189, 128, 132, 133, 185, 186, 191, 144,
+        185, 128, 159, 160, 161, 162, 191, 169,
+        177, 180, 189, 128, 132, 133, 140, 141,
+        142, 143, 144, 145, 146, 147, 185, 186,
+        191, 158, 177, 128, 155, 156, 161, 162,
+        191, 131, 145, 155, 157, 128, 132, 133,
+        138, 139, 141, 142, 149, 150, 152, 153,
+        159, 160, 162, 163, 164, 165, 167, 168,
+        170, 171, 173, 174, 185, 186, 191, 144,
+        128, 191, 141, 145, 169, 189, 128, 132,
+        133, 185, 186, 191, 128, 151, 152, 154,
+        155, 159, 160, 161, 162, 191, 128, 141,
+        145, 169, 180, 189, 129, 132, 133, 185,
+        186, 191, 158, 128, 159, 160, 161, 162,
+        176, 177, 178, 179, 191, 141, 145, 189,
+        128, 132, 133, 186, 187, 191, 142, 128,
+        147, 148, 150, 151, 158, 159, 161, 162,
+        185, 186, 191, 178, 188, 128, 132, 133,
+        150, 151, 153, 154, 189, 190, 191, 128,
+        134, 135, 191, 128, 177, 129, 179, 180,
+        191, 128, 131, 137, 141, 152, 160, 164,
+        166, 172, 177, 189, 129, 132, 133, 134,
+        135, 138, 139, 147, 148, 167, 168, 169,
+        170, 179, 180, 191, 133, 128, 134, 135,
+        155, 156, 159, 160, 191, 128, 129, 191,
+        136, 128, 172, 173, 191, 128, 135, 136,
+        140, 141, 191, 191, 128, 170, 171, 190,
+        161, 128, 143, 144, 149, 150, 153, 154,
+        157, 158, 164, 165, 166, 167, 173, 174,
+        176, 177, 180, 181, 255, 130, 141, 143,
+        159, 134, 187, 136, 140, 142, 143, 137,
+        151, 153, 142, 143, 158, 159, 137, 177,
+        191, 142, 143, 182, 183, 192, 255, 129,
+        151, 128, 133, 134, 135, 136, 255, 145,
+        150, 151, 155, 191, 192, 255, 128, 143,
+        144, 159, 160, 255, 182, 183, 190, 191,
+        192, 255, 128, 129, 255, 173, 174, 192,
+        255, 128, 129, 154, 155, 159, 160, 255,
+        171, 173, 185, 191, 192, 255, 141, 128,
+        145, 146, 159, 160, 177, 178, 191, 173,
+        128, 145, 146, 159, 160, 176, 177, 191,
+        128, 179, 180, 191, 151, 156, 128, 191,
+        128, 159, 160, 255, 184, 191, 192, 255,
+        169, 128, 170, 171, 175, 176, 255, 182,
+        191, 192, 255, 128, 158, 159, 191, 128,
+        143, 144, 173, 174, 175, 176, 180, 181,
+        191, 128, 171, 172, 175, 176, 255, 138,
+        191, 192, 255, 128, 150, 151, 159, 160,
+        255, 149, 191, 192, 255, 167, 128, 191,
+        128, 132, 133, 179, 180, 191, 128, 132,
+        133, 139, 140, 191, 128, 130, 131, 160,
+        161, 173, 174, 175, 176, 185, 186, 255,
+        166, 191, 192, 255, 128, 163, 164, 191,
+        128, 140, 141, 143, 144, 153, 154, 189,
+        190, 191, 128, 136, 137, 191, 173, 128,
+        168, 169, 177, 178, 180, 181, 182, 183,
+        191, 0, 127, 192, 255, 150, 151, 158,
+        159, 152, 154, 156, 158, 134, 135, 142,
+        143, 190, 191, 192, 255, 181, 189, 191,
+        128, 190, 133, 181, 128, 129, 130, 140,
+        141, 143, 144, 147, 148, 149, 150, 155,
+        156, 159, 160, 172, 173, 177, 178, 188,
+        189, 191, 177, 191, 128, 190, 128, 143,
+        144, 156, 157, 191, 130, 135, 148, 164,
+        166, 168, 128, 137, 138, 149, 150, 151,
+        152, 157, 158, 169, 170, 185, 186, 187,
+        188, 191, 142, 128, 132, 133, 137, 138,
+        159, 160, 255, 137, 191, 192, 255, 175,
+        128, 255, 159, 165, 170, 175, 177, 180,
+        191, 192, 255, 166, 173, 128, 167, 168,
+        175, 176, 255, 168, 174, 176, 191, 192,
+        255, 167, 175, 183, 191, 128, 150, 151,
+        159, 160, 190, 135, 143, 151, 128, 158,
+        159, 191, 128, 132, 133, 135, 136, 160,
+        161, 169, 170, 176, 177, 181, 182, 183,
+        184, 188, 189, 191, 160, 151, 154, 187,
+        192, 255, 128, 132, 133, 173, 174, 176,
+        177, 255, 143, 159, 187, 191, 192, 255,
+        128, 175, 176, 191, 150, 191, 192, 255,
+        141, 191, 192, 255, 128, 143, 144, 189,
+        190, 191, 141, 143, 160, 169, 172, 191,
+        192, 255, 191, 128, 174, 175, 190, 128,
+        157, 158, 159, 160, 255, 176, 191, 192,
+        255, 128, 150, 151, 159, 160, 161, 162,
+        255, 175, 137, 138, 184, 191, 192, 255,
+        128, 182, 183, 255, 130, 134, 139, 163,
+        191, 192, 255, 128, 129, 130, 179, 180,
+        191, 187, 189, 128, 177, 178, 183, 184,
+        191, 128, 137, 138, 165, 166, 175, 176,
+        255, 135, 159, 189, 191, 192, 255, 128,
+        131, 132, 178, 179, 191, 143, 165, 191,
+        128, 159, 160, 175, 176, 185, 186, 190,
+        128, 168, 169, 191, 131, 186, 128, 139,
+        140, 159, 160, 182, 183, 189, 190, 255,
+        176, 178, 180, 183, 184, 190, 191, 192,
+        255, 129, 128, 130, 131, 154, 155, 157,
+        158, 159, 160, 170, 171, 177, 178, 180,
+        181, 191, 128, 167, 175, 129, 134, 135,
+        136, 137, 142, 143, 144, 145, 150, 151,
+        159, 160, 255, 155, 166, 175, 128, 162,
+        163, 191, 164, 175, 135, 138, 188, 191,
+        192, 255, 174, 175, 154, 191, 192, 255,
+        157, 169, 183, 189, 191, 128, 134, 135,
+        146, 147, 151, 152, 158, 159, 190, 130,
+        133, 128, 255, 178, 191, 192, 255, 128,
+        146, 147, 255, 190, 191, 192, 255, 128,
+        143, 144, 255, 144, 145, 136, 175, 188,
+        191, 192, 255, 181, 128, 175, 176, 255,
+        189, 191, 192, 255, 128, 160, 161, 186,
+        187, 191, 128, 129, 154, 155, 165, 166,
+        255, 191, 192, 255, 128, 129, 130, 135,
+        136, 137, 138, 143, 144, 145, 146, 151,
+        152, 153, 154, 156, 157, 191, 128, 191,
+        128, 129, 130, 131, 133, 138, 139, 140,
+        141, 142, 143, 144, 145, 146, 147, 148,
+        149, 152, 156, 157, 160, 161, 162, 163,
+        164, 166, 168, 169, 170, 171, 172, 173,
+        174, 176, 177, 132, 151, 153, 155, 158,
+        175, 178, 179, 180, 191, 140, 167, 187,
+        190, 128, 255, 142, 143, 158, 191, 192,
+        255, 187, 191, 192, 255, 128, 180, 181,
+        191, 128, 156, 157, 159, 160, 255, 145,
+        191, 192, 255, 128, 159, 160, 175, 176,
+        255, 139, 143, 182, 191, 192, 255, 144,
+        132, 135, 150, 191, 192, 255, 158, 175,
+        148, 151, 188, 191, 192, 255, 128, 167,
+        168, 175, 176, 255, 164, 191, 192, 255,
+        183, 191, 192, 255, 128, 149, 150, 159,
+        160, 167, 168, 191, 136, 182, 188, 128,
+        133, 134, 137, 138, 184, 185, 190, 191,
+        255, 150, 159, 183, 191, 192, 255, 179,
+        128, 159, 160, 181, 182, 191, 128, 149,
+        150, 159, 160, 185, 186, 191, 128, 183,
+        184, 189, 190, 191, 128, 148, 152, 129,
+        143, 144, 179, 180, 191, 128, 159, 160,
+        188, 189, 191, 128, 156, 157, 191, 136,
+        128, 164, 165, 191, 128, 181, 182, 191,
+        128, 149, 150, 159, 160, 178, 179, 191,
+        128, 145, 146, 191, 128, 178, 179, 191,
+        128, 130, 131, 132, 133, 134, 135, 136,
+        138, 139, 140, 141, 144, 145, 146, 147,
+        150, 151, 152, 153, 154, 156, 162, 163,
+        171, 176, 177, 178, 129, 191, 128, 130,
+        131, 183, 184, 191, 128, 130, 131, 175,
+        176, 191, 128, 143, 144, 168, 169, 191,
+        128, 130, 131, 166, 167, 191, 182, 128,
+        143, 144, 178, 179, 191, 128, 130, 131,
+        178, 179, 191, 128, 154, 156, 129, 132,
+        133, 191, 146, 128, 171, 172, 191, 135,
+        137, 142, 158, 128, 168, 169, 175, 176,
+        255, 159, 191, 192, 255, 144, 128, 156,
+        157, 161, 162, 191, 128, 134, 135, 138,
+        139, 191, 128, 175, 176, 191, 134, 128,
+        131, 132, 135, 136, 191, 128, 174, 175,
+        191, 128, 151, 152, 155, 156, 191, 132,
+        128, 191, 128, 170, 171, 191, 128, 153,
+        154, 191, 160, 190, 192, 255, 128, 184,
+        185, 191, 137, 128, 174, 175, 191, 128,
+        129, 177, 178, 255, 144, 191, 192, 255,
+        128, 142, 143, 144, 145, 146, 149, 129,
+        148, 150, 191, 175, 191, 192, 255, 132,
+        191, 192, 255, 128, 144, 129, 143, 145,
+        191, 144, 153, 128, 143, 145, 152, 154,
+        191, 135, 191, 192, 255, 160, 168, 169,
+        171, 172, 173, 174, 188, 189, 190, 191,
+        128, 159, 161, 167, 170, 187, 185, 191,
+        192, 255, 128, 143, 144, 173, 174, 191,
+        128, 131, 132, 162, 163, 183, 184, 188,
+        189, 255, 133, 143, 145, 191, 192, 255,
+        128, 146, 147, 159, 160, 191, 160, 128,
+        191, 128, 129, 191, 192, 255, 159, 160,
+        171, 128, 170, 172, 191, 192, 255, 173,
+        191, 192, 255, 179, 191, 192, 255, 128,
+        176, 177, 178, 129, 191, 128, 129, 130,
+        191, 171, 175, 189, 191, 192, 255, 128,
+        136, 137, 143, 144, 153, 154, 191, 144,
+        145, 146, 147, 148, 149, 154, 155, 156,
+        157, 158, 159, 128, 143, 150, 153, 160,
+        191, 149, 157, 173, 186, 188, 160, 161,
+        163, 164, 167, 168, 132, 134, 149, 157,
+        186, 191, 139, 140, 192, 255, 133, 145,
+        128, 134, 135, 137, 138, 255, 166, 167,
+        129, 155, 187, 149, 181, 143, 175, 137,
+        169, 131, 140, 191, 192, 255, 160, 163,
+        164, 165, 184, 185, 186, 128, 159, 161,
+        162, 166, 191, 133, 191, 192, 255, 132,
+        160, 163, 167, 179, 184, 186, 128, 164,
+        165, 168, 169, 187, 188, 191, 130, 135,
+        137, 139, 144, 147, 151, 153, 155, 157,
+        159, 163, 171, 179, 184, 189, 191, 128,
+        140, 141, 148, 149, 160, 161, 164, 165,
+        166, 167, 190, 138, 164, 170, 128, 155,
+        156, 160, 161, 187, 188, 191, 128, 191,
+        155, 156, 128, 191, 151, 191, 192, 255,
+        156, 157, 160, 128, 191, 181, 191, 192,
+        255, 158, 159, 186, 128, 185, 187, 191,
+        192, 255, 162, 191, 192, 255, 160, 168,
+        128, 159, 161, 167, 169, 191, 158, 191,
+        192, 255, 9, 10, 13, 32, 33, 34,
+        35, 37, 38, 46, 47, 60, 61, 62,
+        64, 92, 95, 123, 124, 125, 126, 127,
+        194, 195, 198, 199, 203, 204, 205, 206,
+        207, 210, 212, 213, 214, 215, 216, 217,
+        219, 220, 221, 222, 223, 224, 225, 226,
+        227, 228, 233, 234, 237, 238, 239, 240,
+        0, 39, 40, 45, 48, 57, 58, 63,
+        65, 90, 91, 96, 97, 122, 192, 193,
+        196, 218, 229, 236, 241, 247, 9, 32,
+        10, 61, 10, 38, 46, 42, 47, 42,
+        46, 69, 101, 48, 57, 60, 61, 61,
+        62, 61, 45, 95, 194, 195, 198, 199,
+        203, 204, 205, 206, 207, 210, 212, 213,
+        214, 215, 216, 217, 219, 220, 221, 222,
+        223, 224, 225, 226, 227, 228, 233, 234,
+        237, 239, 240, 243, 48, 57, 65, 90,
+        97, 122, 196, 218, 229, 236, 124, 125,
+        128, 191, 170, 181, 186, 128, 191, 151,
+        183, 128, 255, 192, 255, 0, 127, 173,
+        130, 133, 146, 159, 165, 171, 175, 191,
+        192, 255, 181, 190, 128, 175, 176, 183,
+        184, 185, 186, 191, 134, 139, 141, 162,
+        128, 135, 136, 255, 182, 130, 137, 176,
+        151, 152, 154, 160, 136, 191, 192, 255,
+        128, 143, 144, 170, 171, 175, 176, 178,
+        179, 191, 128, 159, 160, 191, 176, 128,
+        138, 139, 173, 174, 255, 148, 150, 164,
+        167, 173, 176, 185, 189, 190, 192, 255,
+        144, 128, 145, 146, 175, 176, 191, 128,
+        140, 141, 255, 166, 176, 178, 191, 192,
+        255, 186, 128, 137, 138, 170, 171, 179,
+        180, 181, 182, 191, 160, 161, 162, 164,
+        165, 166, 167, 168, 169, 170, 171, 172,
+        173, 174, 175, 176, 177, 178, 179, 180,
+        181, 182, 183, 184, 185, 186, 187, 188,
+        189, 190, 128, 191, 128, 129, 130, 131,
+        137, 138, 139, 140, 141, 142, 143, 144,
+        153, 154, 155, 156, 157, 158, 159, 160,
+        161, 162, 163, 164, 165, 166, 167, 168,
+        169, 170, 171, 172, 173, 174, 175, 176,
+        177, 178, 179, 180, 182, 183, 184, 188,
+        189, 190, 191, 132, 187, 129, 130, 132,
+        133, 134, 176, 177, 178, 179, 180, 181,
+        182, 183, 128, 191, 128, 129, 130, 131,
+        132, 133, 134, 135, 144, 136, 143, 145,
+        191, 192, 255, 182, 183, 184, 128, 191,
+        128, 191, 191, 128, 190, 192, 255, 128,
+        146, 147, 148, 152, 153, 154, 155, 156,
+        158, 159, 160, 161, 162, 163, 164, 165,
+        166, 167, 168, 169, 170, 171, 172, 173,
+        174, 175, 176, 129, 191, 192, 255, 158,
+        159, 128, 157, 160, 191, 192, 255, 128,
+        191, 164, 169, 171, 172, 173, 174, 175,
+        180, 181, 182, 183, 184, 185, 187, 188,
+        189, 190, 191, 128, 163, 165, 186, 144,
+        145, 146, 147, 148, 150, 151, 152, 155,
+        157, 158, 160, 170, 171, 172, 175, 128,
+        159, 161, 169, 173, 191, 128, 191, 10,
+        13, 34, 36, 37, 92, 128, 191, 192,
+        223, 224, 239, 240, 247, 248, 255, 10,
+        13, 34, 36, 37, 92, 128, 191, 192,
+        223, 224, 239, 240, 247, 248, 255, 10,
+        13, 34, 36, 37, 92, 128, 191, 192,
+        223, 224, 239, 240, 247, 248, 255, 10,
+        13, 34, 36, 37, 92, 128, 191, 192,
+        223, 224, 239, 240, 247, 248, 255, 10,
+        13, 36, 37, 92, 128, 191, 192, 223,
+        224, 239, 240, 247, 248, 255, 36, 37,
+        92, 123, 192, 223, 224, 239, 240, 247,
+        10, 13, 34, 36, 37, 92, 123, 128,
+        191, 192, 223, 224, 239, 240, 247, 248,
+        255, 10, 13, 34, 36, 37, 92, 123,
+        128, 191, 192, 223, 224, 239, 240, 247,
+        248, 255, 10, 13, 34, 36, 37, 92,
+        123, 128, 191, 192, 223, 224, 239, 240,
+        247, 248, 255, 10, 13, 34, 36, 37,
+        92, 128, 191, 192, 223, 224, 239, 240,
+        247, 248, 255, 36, 37, 92, 123, 192,
+        223, 224, 239, 240, 247, 10, 13, 34,
+        36, 37, 92, 123, 128, 191, 192, 223,
+        224, 239, 240, 247, 248, 255, 10, 13,
+        34, 36, 37, 92, 128, 191, 192, 223,
+        224, 239, 240, 247, 248, 255, 10, 13,
+        34, 36, 37, 92, 128, 191, 192, 223,
+        224, 239, 240, 247, 248, 255, 10, 13,
+        34, 36, 37, 92, 128, 191, 192, 223,
+        224, 239, 240, 247, 248, 255, 10, 13,
+        34, 36, 37, 92, 128, 191, 192, 223,
+        224, 239, 240, 247, 248, 255, 10, 13,
+        34, 36, 37, 92, 128, 191, 192, 223,
+        224, 239, 240, 247, 248, 255, 10, 13,
+        34, 36, 37, 92, 128, 191, 192, 223,
+        224, 239, 240, 247, 248, 255, 10, 13,
+        34, 36, 37, 92, 128, 191, 192, 223,
+        224, 239, 240, 247, 248, 255, 123, 126,
+        123, 126, 128, 191, 128, 191, 128, 191,
+        10, 13, 36, 37, 128, 191, 192, 223,
+        224, 239, 240, 247, 248, 255, 10, 13,
+        36, 37, 128, 191, 192, 223, 224, 239,
+        240, 247, 248, 255, 10, 13, 36, 37,
+        128, 191, 192, 223, 224, 239, 240, 247,
+        248, 255, 10, 13, 36, 37, 128, 191,
+        192, 223, 224, 239, 240, 247, 248, 255,
+        126, 126, 128, 191, 128, 191, 128, 191,
+        10, 13, 36, 37, 128, 191, 192, 223,
+        224, 239, 240, 247, 248, 255, 10, 13,
+        36, 37, 128, 191, 192, 223, 224, 239,
+        240, 247, 248, 255, 126, 126, 128, 191,
+        128, 191, 128, 191, 95, 194, 195, 198,
+        199, 203, 204, 205, 206, 207, 210, 212,
+        213, 214, 215, 216, 217, 219, 220, 221,
+        222, 223, 224, 225, 226, 227, 228, 233,
+        234, 237, 238, 239, 240, 65, 90, 97,
+        122, 128, 191, 192, 193, 196, 218, 229,
+        236, 241, 247, 248, 255, 45, 95, 194,
+        195, 198, 199, 203, 204, 205, 206, 207,
+        210, 212, 213, 214, 215, 216, 217, 219,
+        220, 221, 222, 223, 224, 225, 226, 227,
+        228, 233, 234, 237, 239, 240, 243, 48,
+        57, 65, 90, 97, 122, 196, 218, 229,
+        236, 128, 191, 170, 181, 186, 128, 191,
+        151, 183, 128, 255, 192, 255, 0, 127,
+        173, 130, 133, 146, 159, 165, 171, 175,
+        191, 192, 255, 181, 190, 128, 175, 176,
+        183, 184, 185, 186, 191, 134, 139, 141,
+        162, 128, 135, 136, 255, 182, 130, 137,
+        176, 151, 152, 154, 160, 136, 191, 192,
+        255, 128, 143, 144, 170, 171, 175, 176,
+        178, 179, 191, 128, 159, 160, 191, 176,
+        128, 138, 139, 173, 174, 255, 148, 150,
+        164, 167, 173, 176, 185, 189, 190, 192,
+        255, 144, 128, 145, 146, 175, 176, 191,
+        128, 140, 141, 255, 166, 176, 178, 191,
+        192, 255, 186, 128, 137, 138, 170, 171,
+        179, 180, 181, 182, 191, 160, 161, 162,
+        164, 165, 166, 167, 168, 169, 170, 171,
+        172, 173, 174, 175, 176, 177, 178, 179,
+        180, 181, 182, 183, 184, 185, 186, 187,
+        188, 189, 190, 128, 191, 128, 129, 130,
+        131, 137, 138, 139, 140, 141, 142, 143,
+        144, 153, 154, 155, 156, 157, 158, 159,
+        160, 161, 162, 163, 164, 165, 166, 167,
+        168, 169, 170, 171, 172, 173, 174, 175,
+        176, 177, 178, 179, 180, 182, 183, 184,
+        188, 189, 190, 191, 132, 187, 129, 130,
+        132, 133, 134, 176, 177, 178, 179, 180,
+        181, 182, 183, 128, 191, 128, 129, 130,
+        131, 132, 133, 134, 135, 144, 136, 143,
+        145, 191, 192, 255, 182, 183, 184, 128,
+        191, 128, 191, 191, 128, 190, 192, 255,
+        128, 146, 147, 148, 152, 153, 154, 155,
+        156, 158, 159, 160, 161, 162, 163, 164,
+        165, 166, 167, 168, 169, 170, 171, 172,
+        173, 174, 175, 176, 129, 191, 192, 255,
+        158, 159, 128, 157, 160, 191, 192, 255,
+        128, 191, 164, 169, 171, 172, 173, 174,
+        175, 180, 181, 182, 183, 184, 185, 187,
+        188, 189, 190, 191, 128, 163, 165, 186,
+        144, 145, 146, 147, 148, 150, 151, 152,
+        155, 157, 158, 160, 170, 171, 172, 175,
+        128, 159, 161, 169, 173, 191, 128, 191,
+}
+
+var _hcltok_single_lengths []byte = []byte{
+        0, 1, 1, 1, 2, 3, 2, 0,
+        32, 31, 36, 1, 4, 0, 0, 0,
+        0, 1, 2, 1, 1, 1, 1, 0,
+        1, 1, 0, 0, 2, 0, 0, 0,
+        1, 32, 0, 0, 0, 0, 1, 3,
+        1, 1, 1, 0, 2, 0, 1, 1,
+        2, 0, 3, 0, 1, 0, 2, 1,
+        2, 0, 0, 5, 1, 4, 0, 0,
+        1, 43, 0, 0, 0, 2, 3, 2,
+        1, 1, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 1, 1, 0,
+        0, 0, 0, 0, 0, 0, 0, 4,
+        1, 0, 15, 0, 0, 0, 1, 6,
+        1, 0, 0, 1, 0, 2, 0, 0,
+        0, 9, 0, 1, 1, 0, 0, 0,
+        3, 0, 1, 0, 28, 0, 0, 0,
+        1, 0, 1, 0, 0, 0, 1, 0,
+        0, 0, 0, 0, 0, 0, 1, 0,
+        2, 0, 0, 18, 0, 0, 1, 0,
+        0, 0, 0, 0, 0, 0, 0, 1,
+        0, 0, 0, 16, 36, 0, 0, 0,
+        0, 1, 0, 0, 0, 0, 0, 1,
+        0, 0, 0, 0, 0, 0, 2, 0,
+        0, 0, 0, 0, 1, 0, 0, 0,
+        0, 0, 0, 0, 28, 0, 0, 0,
+        1, 1, 1, 1, 0, 0, 2, 0,
+        1, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 1, 1, 4, 0, 0, 2,
+        2, 0, 11, 0, 0, 0, 0, 0,
+        0, 0, 1, 1, 3, 0, 0, 4,
+        0, 0, 0, 18, 0, 0, 0, 1,
+        4, 1, 4, 1, 0, 3, 2, 2,
+        2, 1, 0, 0, 1, 8, 0, 0,
+        0, 4, 12, 0, 2, 0, 3, 0,
+        1, 0, 2, 0, 1, 2, 0, 3,
+        1, 2, 0, 0, 0, 0, 0, 1,
+        1, 0, 0, 1, 28, 3, 0, 1,
+        1, 2, 1, 0, 1, 1, 2, 1,
+        1, 2, 1, 1, 0, 2, 1, 1,
+        1, 1, 0, 0, 6, 1, 1, 0,
+        0, 46, 1, 1, 0, 0, 0, 0,
+        2, 1, 0, 0, 0, 1, 0, 0,
+        0, 0, 0, 0, 0, 13, 2, 0,
+        0, 0, 9, 0, 1, 28, 0, 1,
+        3, 0, 2, 0, 0, 0, 1, 0,
+        1, 1, 2, 0, 18, 2, 0, 0,
+        16, 35, 0, 0, 0, 1, 0, 28,
+        0, 0, 0, 0, 1, 0, 2, 0,
+        0, 1, 0, 0, 1, 0, 0, 1,
+        0, 0, 0, 0, 1, 11, 0, 0,
+        0, 0, 4, 0, 12, 1, 7, 0,
+        4, 0, 0, 0, 0, 1, 2, 1,
+        1, 1, 1, 0, 1, 1, 0, 0,
+        2, 0, 0, 0, 1, 32, 0, 0,
+        0, 0, 1, 3, 1, 1, 1, 0,
+        2, 0, 1, 1, 2, 0, 3, 0,
+        1, 0, 2, 1, 2, 0, 0, 5,
+        1, 4, 0, 0, 1, 43, 0, 0,
+        0, 2, 3, 2, 1, 1, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 1, 1, 0, 0, 0, 0, 0,
+        0, 0, 0, 4, 1, 0, 15, 0,
+        0, 0, 1, 6, 1, 0, 0, 1,
+        0, 2, 0, 0, 0, 9, 0, 1,
+        1, 0, 0, 0, 3, 0, 1, 0,
+        28, 0, 0, 0, 1, 0, 1, 0,
+        0, 0, 1, 0, 0, 0, 0, 0,
+        0, 0, 1, 0, 2, 0, 0, 18,
+        0, 0, 1, 0, 0, 0, 0, 0,
+        0, 0, 0, 1, 0, 0, 0, 16,
+        36, 0, 0, 0, 0, 1, 0, 0,
+        0, 0, 0, 1, 0, 0, 0, 0,
+        0, 0, 2, 0, 0, 0, 0, 0,
+        1, 0, 0, 0, 0, 0, 0, 0,
+        28, 0, 0, 0, 1, 1, 1, 1,
+        0, 0, 2, 0, 1, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 1, 1,
+        4, 0, 0, 2, 2, 0, 11, 0,
+        0, 0, 0, 0, 0, 0, 1, 1,
+        3, 0, 0, 4, 0, 0, 0, 18,
+        0, 0, 0, 1, 4, 1, 4, 1,
+        0, 3, 2, 2, 2, 1, 0, 0,
+        1, 8, 0, 0, 0, 4, 12, 0,
+        2, 0, 3, 0, 1, 0, 2, 0,
+        1, 2, 0, 0, 3, 0, 1, 1,
+        1, 2, 2, 4, 1, 6, 2, 4,
+        2, 4, 1, 4, 0, 6, 1, 3,
+        1, 2, 0, 2, 11, 1, 1, 1,
+        0, 1, 1, 0, 2, 0, 3, 3,
+        2, 1, 0, 0, 0, 1, 0, 1,
+        0, 1, 1, 0, 2, 0, 0, 1,
+        0, 0, 0, 0, 0, 0, 0, 1,
+        0, 0, 0, 0, 0, 0, 0, 1,
+        0, 0, 0, 4, 3, 2, 2, 0,
+        6, 1, 0, 1, 1, 0, 2, 0,
+        4, 3, 0, 1, 1, 0, 0, 0,
+        0, 0, 0, 0, 1, 0, 0, 0,
+        1, 0, 3, 0, 2, 0, 0, 0,
+        3, 0, 2, 1, 1, 3, 1, 0,
+        0, 0, 0, 0, 5, 2, 0, 0,
+        0, 0, 0, 0, 1, 0, 0, 1,
+        1, 0, 0, 35, 4, 0, 0, 0,
+        0, 0, 0, 0, 1, 0, 0, 0,
+        0, 0, 0, 3, 0, 1, 0, 0,
+        3, 0, 0, 1, 0, 0, 0, 0,
+        28, 0, 0, 0, 0, 1, 0, 3,
+        1, 4, 0, 1, 0, 0, 1, 0,
+        0, 1, 0, 0, 0, 0, 1, 1,
+        0, 7, 0, 0, 2, 2, 0, 11,
+        0, 0, 0, 0, 0, 1, 1, 3,
+        0, 0, 4, 0, 0, 0, 12, 1,
+        4, 1, 5, 2, 0, 3, 2, 2,
+        2, 1, 7, 0, 7, 17, 3, 0,
+        2, 0, 3, 0, 0, 1, 0, 2,
+        0, 1, 1, 0, 0, 0, 0, 0,
+        1, 1, 1, 0, 0, 0, 1, 1,
+        1, 1, 0, 0, 0, 1, 1, 4,
+        0, 0, 0, 0, 1, 2, 1, 1,
+        1, 1, 0, 1, 1, 0, 0, 2,
+        0, 0, 0, 1, 32, 0, 0, 0,
+        0, 1, 3, 1, 1, 1, 0, 2,
+        0, 1, 1, 2, 0, 3, 0, 1,
+        0, 2, 1, 2, 0, 0, 5, 1,
+        4, 0, 0, 1, 43, 0, 0, 0,
+        2, 3, 2, 1, 1, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        1, 1, 0, 0, 0, 0, 0, 0,
+        0, 0, 4, 1, 0, 15, 0, 0,
+        0, 1, 6, 1, 0, 0, 1, 0,
+        2, 0, 0, 0, 9, 0, 1, 1,
+        0, 0, 0, 3, 0, 1, 0, 28,
+        0, 0, 0, 1, 0, 1, 0, 0,
+        0, 1, 0, 0, 0, 0, 0, 0,
+        0, 1, 0, 2, 0, 0, 18, 0,
+        0, 1, 0, 0, 0, 0, 0, 0,
+        0, 0, 1, 0, 0, 0, 16, 36,
+        0, 0, 0, 0, 1, 0, 0, 0,
+        0, 0, 1, 0, 0, 0, 0, 0,
+        0, 2, 0, 0, 0, 0, 0, 1,
+        0, 0, 0, 0, 0, 0, 0, 28,
+        0, 0, 0, 1, 1, 1, 1, 0,
+        0, 2, 0, 1, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 1, 1, 4,
+        0, 0, 2, 2, 0, 11, 0, 0,
+        0, 0, 0, 0, 0, 1, 1, 3,
+        0, 0, 4, 0, 0, 0, 18, 0,
+        0, 0, 1, 4, 1, 4, 1, 0,
+        3, 2, 2, 2, 1, 0, 0, 1,
+        8, 0, 0, 0, 4, 12, 0, 2,
+        0, 3, 0, 1, 0, 2, 0, 1,
+        2, 0, 0, 3, 0, 1, 1, 1,
+        2, 2, 4, 1, 6, 2, 4, 2,
+        4, 1, 4, 0, 6, 1, 3, 1,
+        2, 0, 2, 11, 1, 1, 1, 0,
+        1, 1, 0, 2, 0, 3, 3, 2,
+        1, 0, 0, 0, 1, 0, 1, 0,
+        1, 1, 0, 2, 0, 0, 1, 0,
+        0, 0, 0, 0, 0, 0, 1, 0,
+        0, 0, 0, 0, 0, 0, 1, 0,
+        0, 0, 4, 3, 2, 2, 0, 6,
+        1, 0, 1, 1, 0, 2, 0, 4,
+        3, 0, 1, 1, 0, 0, 0, 0,
+        0, 0, 0, 1, 0, 0, 0, 1,
+        0, 3, 0, 2, 0, 0, 0, 3,
+        0, 2, 1, 1, 3, 1, 0, 0,
+        0, 0, 0, 5, 2, 0, 0, 0,
+        0, 0, 0, 1, 0, 0, 1, 1,
+        0, 0, 35, 4, 0, 0, 0, 0,
+        0, 0, 0, 1, 0, 0, 0, 0,
+        0, 0, 3, 0, 1, 0, 0, 3,
+        0, 0, 1, 0, 0, 0, 0, 28,
+        0, 0, 0, 0, 1, 0, 3, 1,
+        4, 0, 1, 0, 0, 1, 0, 0,
+        1, 0, 0, 0, 0, 1, 1, 0,
+        7, 0, 0, 2, 2, 0, 11, 0,
+        0, 0, 0, 0, 1, 1, 3, 0,
+        0, 4, 0, 0, 0, 12, 1, 4,
+        1, 5, 2, 0, 3, 2, 2, 2,
+        1, 7, 0, 7, 17, 3, 0, 2,
+        0, 3, 0, 0, 1, 0, 2, 0,
+        54, 2, 1, 1, 1, 1, 1, 2,
+        1, 3, 2, 2, 1, 34, 1, 1,
+        0, 3, 2, 0, 0, 0, 1, 2,
+        4, 1, 0, 1, 0, 0, 0, 0,
+        1, 1, 1, 0, 0, 1, 30, 47,
+        13, 9, 3, 0, 1, 28, 2, 0,
+        18, 16, 0, 6, 6, 6, 6, 5,
+        4, 7, 7, 7, 6, 4, 7, 6,
+        6, 6, 6, 6, 6, 6, 1, 1,
+        1, 1, 0, 0, 0, 4, 4, 4,
+        4, 1, 1, 0, 0, 0, 4, 2,
+        1, 1, 0, 0, 0, 33, 34, 0,
+        3, 2, 0, 0, 0, 1, 2, 4,
+        1, 0, 1, 0, 0, 0, 0, 1,
+        1, 1, 0, 0, 1, 30, 47, 13,
+        9, 3, 0, 1, 28, 2, 0, 18,
+        16, 0,
+}
+
+var _hcltok_range_lengths []byte = []byte{
+        0, 0, 0, 0, 0, 1, 1, 1,
+        5, 5, 5, 0, 0, 3, 0, 1,
+        1, 4, 2, 3, 0, 1, 0, 2,
+        2, 4, 2, 2, 3, 1, 1, 1,
+        1, 0, 1, 1, 2, 2, 1, 4,
+        6, 9, 6, 8, 5, 8, 7, 10,
+        4, 6, 4, 7, 7, 5, 5, 4,
+        5, 1, 2, 8, 4, 3, 3, 3,
+        0, 3, 1, 2, 1, 2, 2, 3,
+        3, 1, 3, 2, 2, 1, 2, 2,
+        2, 3, 4, 4, 3, 1, 2, 1,
+        3, 2, 2, 2, 2, 2, 3, 3,
+        1, 1, 2, 1, 3, 2, 2, 3,
+        2, 7, 0, 1, 4, 1, 2, 4,
+        2, 1, 2, 0, 2, 2, 3, 5,
+        5, 1, 4, 1, 1, 2, 2, 1,
+        0, 0, 1, 1, 1, 1, 1, 2,
+        2, 2, 2, 1, 1, 1, 4, 2,
+        2, 3, 1, 4, 4, 6, 1, 3,
+        1, 1, 2, 1, 1, 1, 5, 3,
+        1, 1, 1, 2, 3, 3, 1, 2,
+        2, 1, 4, 1, 2, 5, 2, 1,
+        1, 0, 2, 2, 2, 2, 2, 2,
+        2, 2, 2, 1, 1, 2, 4, 2,
+        1, 2, 2, 2, 6, 1, 1, 2,
+        1, 2, 1, 1, 1, 2, 2, 2,
+        1, 3, 2, 5, 2, 8, 6, 2,
+        2, 2, 2, 3, 1, 3, 1, 2,
+        1, 3, 2, 2, 3, 1, 1, 1,
+        1, 1, 1, 1, 2, 2, 4, 1,
+        2, 1, 0, 1, 1, 1, 1, 0,
+        1, 2, 3, 1, 3, 3, 1, 0,
+        3, 0, 2, 3, 1, 0, 0, 0,
+        0, 2, 2, 2, 2, 1, 5, 2,
+        2, 5, 7, 5, 0, 1, 0, 1,
+        1, 1, 1, 1, 0, 1, 1, 0,
+        3, 3, 1, 1, 2, 1, 3, 5,
+        1, 1, 2, 2, 1, 1, 1, 1,
+        2, 6, 3, 7, 2, 6, 1, 6,
+        2, 8, 0, 4, 2, 5, 2, 3,
+        3, 3, 1, 2, 8, 2, 0, 2,
+        1, 2, 1, 5, 2, 1, 3, 3,
+        0, 2, 1, 2, 1, 0, 1, 1,
+        3, 1, 1, 2, 3, 0, 0, 3,
+        2, 4, 1, 4, 1, 1, 3, 1,
+        1, 1, 1, 2, 2, 1, 3, 1,
+        4, 3, 3, 1, 1, 5, 2, 1,
+        1, 2, 1, 2, 1, 3, 2, 0,
+        1, 1, 1, 1, 1, 1, 1, 2,
+        1, 1, 1, 1, 1, 1, 1, 0,
+        1, 1, 2, 2, 1, 1, 1, 3,
+        2, 1, 0, 2, 1, 1, 1, 1,
+        0, 3, 0, 1, 1, 4, 2, 3,
+        0, 1, 0, 2, 2, 4, 2, 2,
+        3, 1, 1, 1, 1, 0, 1, 1,
+        2, 2, 1, 4, 6, 9, 6, 8,
+        5, 8, 7, 10, 4, 6, 4, 7,
+        7, 5, 5, 4, 5, 1, 2, 8,
+        4, 3, 3, 3, 0, 3, 1, 2,
+        1, 2, 2, 3, 3, 1, 3, 2,
+        2, 1, 2, 2, 2, 3, 4, 4,
+        3, 1, 2, 1, 3, 2, 2, 2,
+        2, 2, 3, 3, 1, 1, 2, 1,
+        3, 2, 2, 3, 2, 7, 0, 1,
+        4, 1, 2, 4, 2, 1, 2, 0,
+        2, 2, 3, 5, 5, 1, 4, 1,
+        1, 2, 2, 1, 0, 0, 1, 1,
+        1, 1, 1, 2, 2, 2, 2, 1,
+        1, 1, 4, 2, 2, 3, 1, 4,
+        4, 6, 1, 3, 1, 1, 2, 1,
+        1, 1, 5, 3, 1, 1, 1, 2,
+        3, 3, 1, 2, 2, 1, 4, 1,
+        2, 5, 2, 1, 1, 0, 2, 2,
+        2, 2, 2, 2, 2, 2, 2, 1,
+        1, 2, 4, 2, 1, 2, 2, 2,
+        6, 1, 1, 2, 1, 2, 1, 1,
+        1, 2, 2, 2, 1, 3, 2, 5,
+        2, 8, 6, 2, 2, 2, 2, 3,
+        1, 3, 1, 2, 1, 3, 2, 2,
+        3, 1, 1, 1, 1, 1, 1, 1,
+        2, 2, 4, 1, 2, 1, 0, 1,
+        1, 1, 1, 0, 1, 2, 3, 1,
+        3, 3, 1, 0, 3, 0, 2, 3,
+        1, 0, 0, 0, 0, 2, 2, 2,
+        2, 1, 5, 2, 2, 5, 7, 5,
+        0, 1, 0, 1, 1, 1, 1, 1,
+        0, 1, 1, 1, 2, 2, 3, 3,
+        4, 7, 5, 7, 5, 3, 3, 7,
+        3, 13, 1, 3, 5, 3, 5, 3,
+        6, 5, 2, 2, 8, 4, 1, 2,
+        3, 2, 10, 2, 2, 0, 2, 3,
+        3, 1, 2, 3, 3, 1, 2, 3,
+        3, 4, 4, 2, 1, 2, 2, 3,
+        2, 2, 5, 3, 2, 3, 2, 1,
+        3, 3, 6, 2, 2, 5, 2, 5,
+        1, 1, 2, 4, 1, 11, 1, 3,
+        8, 4, 2, 1, 0, 4, 3, 3,
+        3, 2, 9, 1, 1, 4, 3, 2,
+        2, 2, 3, 4, 2, 3, 2, 4,
+        3, 2, 2, 3, 3, 4, 3, 3,
+        4, 2, 5, 4, 8, 7, 1, 2,
+        1, 3, 1, 2, 5, 1, 2, 2,
+        2, 2, 1, 3, 2, 2, 3, 3,
+        1, 9, 1, 5, 1, 3, 2, 2,
+        3, 2, 3, 3, 3, 1, 3, 3,
+        2, 2, 4, 5, 3, 3, 4, 3,
+        3, 3, 2, 2, 2, 4, 2, 2,
+        1, 3, 3, 3, 3, 3, 3, 2,
+        2, 3, 2, 3, 3, 2, 3, 2,
+        3, 1, 2, 2, 2, 2, 2, 2,
+        2, 2, 2, 2, 2, 3, 2, 3,
+        2, 3, 5, 3, 3, 1, 2, 3,
+        2, 2, 1, 2, 3, 4, 3, 0,
+        3, 0, 2, 3, 1, 0, 0, 0,
+        0, 2, 3, 2, 4, 6, 4, 1,
+        1, 2, 1, 2, 1, 3, 2, 3,
+        2, 0, 0, 1, 1, 1, 1, 1,
+        0, 0, 0, 1, 1, 1, 0, 0,
+        0, 0, 1, 1, 1, 0, 0, 0,
+        3, 0, 1, 1, 4, 2, 3, 0,
+        1, 0, 2, 2, 4, 2, 2, 3,
+        1, 1, 1, 1, 0, 1, 1, 2,
+        2, 1, 4, 6, 9, 6, 8, 5,
+        8, 7, 10, 4, 6, 4, 7, 7,
+        5, 5, 4, 5, 1, 2, 8, 4,
+        3, 3, 3, 0, 3, 1, 2, 1,
+        2, 2, 3, 3, 1, 3, 2, 2,
+        1, 2, 2, 2, 3, 4, 4, 3,
+        1, 2, 1, 3, 2, 2, 2, 2,
+        2, 3, 3, 1, 1, 2, 1, 3,
+        2, 2, 3, 2, 7, 0, 1, 4,
+        1, 2, 4, 2, 1, 2, 0, 2,
+        2, 3, 5, 5, 1, 4, 1, 1,
+        2, 2, 1, 0, 0, 1, 1, 1,
+        1, 1, 2, 2, 2, 2, 1, 1,
+        1, 4, 2, 2, 3, 1, 4, 4,
+        6, 1, 3, 1, 1, 2, 1, 1,
+        1, 5, 3, 1, 1, 1, 2, 3,
+        3, 1, 2, 2, 1, 4, 1, 2,
+        5, 2, 1, 1, 0, 2, 2, 2,
+        2, 2, 2, 2, 2, 2, 1, 1,
+        2, 4, 2, 1, 2, 2, 2, 6,
+        1, 1, 2, 1, 2, 1, 1, 1,
+        2, 2, 2, 1, 3, 2, 5, 2,
+        8, 6, 2, 2, 2, 2, 3, 1,
+        3, 1, 2, 1, 3, 2, 2, 3,
+        1, 1, 1, 1, 1, 1, 1, 2,
+        2, 4, 1, 2, 1, 0, 1, 1,
+        1, 1, 0, 1, 2, 3, 1, 3,
+        3, 1, 0, 3, 0, 2, 3, 1,
+        0, 0, 0, 0, 2, 2, 2, 2,
+        1, 5, 2, 2, 5, 7, 5, 0,
+        1, 0, 1, 1, 1, 1, 1, 0,
+        1, 1, 1, 2, 2, 3, 3, 4,
+        7, 5, 7, 5, 3, 3, 7, 3,
+        13, 1, 3, 5, 3, 5, 3, 6,
+        5, 2, 2, 8, 4, 1, 2, 3,
+        2, 10, 2, 2, 0, 2, 3, 3,
+        1, 2, 3, 3, 1, 2, 3, 3,
+        4, 4, 2, 1, 2, 2, 3, 2,
+        2, 5, 3, 2, 3, 2, 1, 3,
+        3, 6, 2, 2, 5, 2, 5, 1,
+        1, 2, 4, 1, 11, 1, 3, 8,
+        4, 2, 1, 0, 4, 3, 3, 3,
+        2, 9, 1, 1, 4, 3, 2, 2,
+        2, 3, 4, 2, 3, 2, 4, 3,
+        2, 2, 3, 3, 4, 3, 3, 4,
+        2, 5, 4, 8, 7, 1, 2, 1,
+        3, 1, 2, 5, 1, 2, 2, 2,
+        2, 1, 3, 2, 2, 3, 3, 1,
+        9, 1, 5, 1, 3, 2, 2, 3,
+        2, 3, 3, 3, 1, 3, 3, 2,
+        2, 4, 5, 3, 3, 4, 3, 3,
+        3, 2, 2, 2, 4, 2, 2, 1,
+        3, 3, 3, 3, 3, 3, 2, 2,
+        3, 2, 3, 3, 2, 3, 2, 3,
+        1, 2, 2, 2, 2, 2, 2, 2,
+        2, 2, 2, 2, 3, 2, 3, 2,
+        3, 5, 3, 3, 1, 2, 3, 2,
+        2, 1, 2, 3, 4, 3, 0, 3,
+        0, 2, 3, 1, 0, 0, 0, 0,
+        2, 3, 2, 4, 6, 4, 1, 1,
+        2, 1, 2, 1, 3, 2, 3, 2,
+        11, 0, 0, 0, 0, 0, 0, 0,
+        0, 1, 0, 0, 0, 5, 0, 0,
+        1, 1, 1, 0, 1, 1, 5, 4,
+        2, 0, 1, 0, 2, 2, 5, 2,
+        3, 5, 3, 2, 3, 5, 1, 1,
+        1, 3, 1, 1, 2, 2, 3, 1,
+        2, 3, 1, 5, 5, 5, 5, 5,
+        3, 5, 5, 5, 5, 3, 5, 5,
+        5, 5, 5, 5, 5, 5, 0, 0,
+        0, 0, 1, 1, 1, 5, 5, 5,
+        5, 0, 0, 1, 1, 1, 5, 6,
+        0, 0, 1, 1, 1, 8, 5, 1,
+        1, 1, 0, 1, 1, 5, 4, 2,
+        0, 1, 0, 2, 2, 5, 2, 3,
+        5, 3, 2, 3, 5, 1, 1, 1,
+        3, 1, 1, 2, 2, 3, 1, 2,
+        3, 1,
+}
+
+var _hcltok_index_offsets []int16 = []int16{
+        0, 0, 2, 4, 6, 9, 14, 18,
+        20, 58, 95, 137, 139, 144, 148, 149,
+        151, 153, 159, 164, 169, 171, 174, 176,
+        179, 183, 189, 192, 195, 201, 203, 205,
+        207, 210, 243, 245, 247, 250, 253, 256,
+        264, 272, 283, 291, 300, 308, 317, 326,
+        338, 345, 352, 360, 368, 377, 383, 391,
+        397, 405, 407, 410, 424, 430, 438, 442,
+        446, 448, 495, 497, 500, 502, 507, 513,
+        519, 524, 527, 531, 534, 537, 539, 542,
+        545, 548, 552, 557, 562, 566, 568, 571,
+        573, 577, 580, 583, 586, 589, 593, 598,
+        602, 604, 606, 609, 611, 615, 618, 621,
+        629, 633, 641, 657, 659, 664, 666, 670,
+        681, 685, 687, 690, 692, 695, 700, 704,
+        710, 716, 727, 732, 735, 738, 741, 744,
+        746, 750, 751, 754, 756, 786, 788, 790,
+        793, 797, 800, 804, 806, 808, 810, 816,
+        819, 822, 826, 828, 833, 838, 845, 848,
+        852, 856, 858, 861, 881, 883, 885, 892,
+        896, 898, 900, 902, 905, 909, 913, 915,
+        919, 922, 924, 929, 947, 986, 992, 995,
+        997, 999, 1001, 1004, 1007, 1010, 1013, 1016,
+        1020, 1023, 1026, 1029, 1031, 1033, 1036, 1043,
+        1046, 1048, 1051, 1054, 1057, 1065, 1067, 1069,
+        1072, 1074, 1077, 1079, 1081, 1111, 1114, 1117,
+        1120, 1123, 1128, 1132, 1139, 1142, 1151, 1160,
+        1163, 1167, 1170, 1173, 1177, 1179, 1183, 1185,
+        1188, 1190, 1194, 1198, 1202, 1210, 1212, 1214,
+        1218, 1222, 1224, 1237, 1239, 1242, 1245, 1250,
+        1252, 1255, 1257, 1259, 1262, 1267, 1269, 1271,
+        1276, 1278, 1281, 1285, 1305, 1309, 1313, 1315,
+        1317, 1325, 1327, 1334, 1339, 1341, 1345, 1348,
+        1351, 1354, 1358, 1361, 1364, 1368, 1378, 1384,
+        1387, 1390, 1400, 1420, 1426, 1429, 1431, 1435,
+        1437, 1440, 1442, 1446, 1448, 1450, 1454, 1456,
+        1460, 1465, 1471, 1473, 1475, 1478, 1480, 1484,
+        1491, 1494, 1496, 1499, 1503, 1533, 1538, 1540,
+        1543, 1547, 1556, 1561, 1569, 1573, 1581, 1585,
+        1593, 1597, 1608, 1610, 1616, 1619, 1627, 1631,
+        1636, 1641, 1646, 1648, 1651, 1666, 1670, 1672,
+        1675, 1677, 1726, 1729, 1736, 1739, 1741, 1745,
+        1749, 1752, 1756, 1758, 1761, 1763, 1765, 1767,
+        1769, 1773, 1775, 1777, 1780, 1784, 1798, 1801,
+        1805, 1808, 1813, 1824, 1829, 1832, 1862, 1866,
+        1869, 1874, 1876, 1880, 1883, 1886, 1888, 1893,
+        1895, 1901, 1906, 1912, 1914, 1934, 1942, 1945,
+        1947, 1965, 2003, 2005, 2008, 2010, 2015, 2018,
+        2047, 2049, 2051, 2053, 2055, 2058, 2060, 2064,
+        2067, 2069, 2072, 2074, 2076, 2079, 2081, 2083,
+        2085, 2087, 2089, 2092, 2095, 2098, 2111, 2113,
+        2117, 2120, 2122, 2127, 2130, 2144, 2147, 2156,
+        2158, 2163, 2167, 2168, 2170, 2172, 2178, 2183,
+        2188, 2190, 2193, 2195, 2198, 2202, 2208, 2211,
+        2214, 2220, 2222, 2224, 2226, 2229, 2262, 2264,
+        2266, 2269, 2272, 2275, 2283, 2291, 2302, 2310,
+        2319, 2327, 2336, 2345, 2357, 2364, 2371, 2379,
+        2387, 2396, 2402, 2410, 2416, 2424, 2426, 2429,
+        2443, 2449, 2457, 2461, 2465, 2467, 2514, 2516,
+        2519, 2521, 2526, 2532, 2538, 2543, 2546, 2550,
+        2553, 2556, 2558, 2561, 2564, 2567, 2571, 2576,
+        2581, 2585, 2587, 2590, 2592, 2596, 2599, 2602,
+        2605, 2608, 2612, 2617, 2621, 2623, 2625, 2628,
+        2630, 2634, 2637, 2640, 2648, 2652, 2660, 2676,
+        2678, 2683, 2685, 2689, 2700, 2704, 2706, 2709,
+        2711, 2714, 2719, 2723, 2729, 2735, 2746, 2751,
+        2754, 2757, 2760, 2763, 2765, 2769, 2770, 2773,
+        2775, 2805, 2807, 2809, 2812, 2816, 2819, 2823,
+        2825, 2827, 2829, 2835, 2838, 2841, 2845, 2847,
+        2852, 2857, 2864, 2867, 2871, 2875, 2877, 2880,
+        2900, 2902, 2904, 2911, 2915, 2917, 2919, 2921,
+        2924, 2928, 2932, 2934, 2938, 2941, 2943, 2948,
+        2966, 3005, 3011, 3014, 3016, 3018, 3020, 3023,
+        3026, 3029, 3032, 3035, 3039, 3042, 3045, 3048,
+        3050, 3052, 3055, 3062, 3065, 3067, 3070, 3073,
+        3076, 3084, 3086, 3088, 3091, 3093, 3096, 3098,
+        3100, 3130, 3133, 3136, 3139, 3142, 3147, 3151,
+        3158, 3161, 3170, 3179, 3182, 3186, 3189, 3192,
+        3196, 3198, 3202, 3204, 3207, 3209, 3213, 3217,
+        3221, 3229, 3231, 3233, 3237, 3241, 3243, 3256,
+        3258, 3261, 3264, 3269, 3271, 3274, 3276, 3278,
+        3281, 3286, 3288, 3290, 3295, 3297, 3300, 3304,
+        3324, 3328, 3332, 3334, 3336, 3344, 3346, 3353,
+        3358, 3360, 3364, 3367, 3370, 3373, 3377, 3380,
+        3383, 3387, 3397, 3403, 3406, 3409, 3419, 3439,
+        3445, 3448, 3450, 3454, 3456, 3459, 3461, 3465,
+        3467, 3469, 3473, 3475, 3477, 3483, 3486, 3491,
+        3496, 3502, 3512, 3520, 3532, 3539, 3549, 3555,
+        3567, 3573, 3591, 3594, 3602, 3608, 3618, 3625,
+        3632, 3640, 3648, 3651, 3656, 3676, 3682, 3685,
+        3689, 3693, 3697, 3709, 3712, 3717, 3718, 3724,
+        3731, 3737, 3740, 3743, 3747, 3751, 3754, 3757,
+        3762, 3766, 3772, 3778, 3781, 3785, 3788, 3791,
+        3796, 3799, 3802, 3808, 3812, 3815, 3819, 3822,
+        3825, 3829, 3833, 3840, 3843, 3846, 3852, 3855,
+        3862, 3864, 3866, 3869, 3878, 3883, 3897, 3901,
+        3905, 3920, 3926, 3929, 3932, 3934, 3939, 3945,
+        3949, 3957, 3963, 3973, 3976, 3979, 3984, 3988,
+        3991, 3994, 3997, 4001, 4006, 4010, 4014, 4017,
+        4022, 4027, 4030, 4036, 4040, 4046, 4051, 4055,
+        4059, 4067, 4070, 4078, 4084, 4094, 4105, 4108,
+        4111, 4113, 4117, 4119, 4122, 4133, 4137, 4140,
+        4143, 4146, 4149, 4151, 4155, 4159, 4162, 4166,
+        4171, 4174, 4184, 4186, 4227, 4233, 4237, 4240,
+        4243, 4247, 4250, 4254, 4258, 4263, 4265, 4269,
+        4273, 4276, 4279, 4284, 4293, 4297, 4302, 4307,
+        4311, 4318, 4322, 4325, 4329, 4332, 4337, 4340,
+        4343, 4373, 4377, 4381, 4385, 4389, 4394, 4398,
+        4404, 4408, 4416, 4419, 4424, 4428, 4431, 4436,
+        4439, 4443, 4446, 4449, 4452, 4455, 4458, 4462,
+        4466, 4469, 4479, 4482, 4485, 4490, 4496, 4499,
+        4514, 4517, 4521, 4527, 4531, 4535, 4538, 4542,
+        4549, 4552, 4555, 4561, 4564, 4568, 4573, 4589,
+        4591, 4599, 4601, 4609, 4615, 4617, 4621, 4624,
+        4627, 4630, 4634, 4645, 4648, 4660, 4684, 4692,
+        4694, 4698, 4701, 4706, 4709, 4711, 4716, 4719,
+        4725, 4728, 4730, 4732, 4734, 4736, 4738, 4740,
+        4742, 4744, 4746, 4748, 4750, 4752, 4754, 4756,
+        4758, 4760, 4762, 4764, 4766, 4768, 4770, 4772,
+        4777, 4781, 4782, 4784, 4786, 4792, 4797, 4802,
+        4804, 4807, 4809, 4812, 4816, 4822, 4825, 4828,
+        4834, 4836, 4838, 4840, 4843, 4876, 4878, 4880,
+        4883, 4886, 4889, 4897, 4905, 4916, 4924, 4933,
+        4941, 4950, 4959, 4971, 4978, 4985, 4993, 5001,
+        5010, 5016, 5024, 5030, 5038, 5040, 5043, 5057,
+        5063, 5071, 5075, 5079, 5081, 5128, 5130, 5133,
+        5135, 5140, 5146, 5152, 5157, 5160, 5164, 5167,
+        5170, 5172, 5175, 5178, 5181, 5185, 5190, 5195,
+        5199, 5201, 5204, 5206, 5210, 5213, 5216, 5219,
+        5222, 5226, 5231, 5235, 5237, 5239, 5242, 5244,
+        5248, 5251, 5254, 5262, 5266, 5274, 5290, 5292,
+        5297, 5299, 5303, 5314, 5318, 5320, 5323, 5325,
+        5328, 5333, 5337, 5343, 5349, 5360, 5365, 5368,
+        5371, 5374, 5377, 5379, 5383, 5384, 5387, 5389,
+        5419, 5421, 5423, 5426, 5430, 5433, 5437, 5439,
+        5441, 5443, 5449, 5452, 5455, 5459, 5461, 5466,
+        5471, 5478, 5481, 5485, 5489, 5491, 5494, 5514,
+        5516, 5518, 5525, 5529, 5531, 5533, 5535, 5538,
+        5542, 5546, 5548, 5552, 5555, 5557, 5562, 5580,
+        5619, 5625, 5628, 5630, 5632, 5634, 5637, 5640,
+        5643, 5646, 5649, 5653, 5656, 5659, 5662, 5664,
+        5666, 5669, 5676, 5679, 5681, 5684, 5687, 5690,
+        5698, 5700, 5702, 5705, 5707, 5710, 5712, 5714,
+        5744, 5747, 5750, 5753, 5756, 5761, 5765, 5772,
+        5775, 5784, 5793, 5796, 5800, 5803, 5806, 5810,
+        5812, 5816, 5818, 5821, 5823, 5827, 5831, 5835,
+        5843, 5845, 5847, 5851, 5855, 5857, 5870, 5872,
+        5875, 5878, 5883, 5885, 5888, 5890, 5892, 5895,
+        5900, 5902, 5904, 5909, 5911, 5914, 5918, 5938,
+        5942, 5946, 5948, 5950, 5958, 5960, 5967, 5972,
+        5974, 5978, 5981, 5984, 5987, 5991, 5994, 5997,
+        6001, 6011, 6017, 6020, 6023, 6033, 6053, 6059,
+        6062, 6064, 6068, 6070, 6073, 6075, 6079, 6081,
+        6083, 6087, 6089, 6091, 6097, 6100, 6105, 6110,
+        6116, 6126, 6134, 6146, 6153, 6163, 6169, 6181,
+        6187, 6205, 6208, 6216, 6222, 6232, 6239, 6246,
+        6254, 6262, 6265, 6270, 6290, 6296, 6299, 6303,
+        6307, 6311, 6323, 6326, 6331, 6332, 6338, 6345,
+        6351, 6354, 6357, 6361, 6365, 6368, 6371, 6376,
+        6380, 6386, 6392, 6395, 6399, 6402, 6405, 6410,
+        6413, 6416, 6422, 6426, 6429, 6433, 6436, 6439,
+        6443, 6447, 6454, 6457, 6460, 6466, 6469, 6476,
+        6478, 6480, 6483, 6492, 6497, 6511, 6515, 6519,
+        6534, 6540, 6543, 6546, 6548, 6553, 6559, 6563,
+        6571, 6577, 6587, 6590, 6593, 6598, 6602, 6605,
+        6608, 6611, 6615, 6620, 6624, 6628, 6631, 6636,
+        6641, 6644, 6650, 6654, 6660, 6665, 6669, 6673,
+        6681, 6684, 6692, 6698, 6708, 6719, 6722, 6725,
+        6727, 6731, 6733, 6736, 6747, 6751, 6754, 6757,
+        6760, 6763, 6765, 6769, 6773, 6776, 6780, 6785,
+        6788, 6798, 6800, 6841, 6847, 6851, 6854, 6857,
+        6861, 6864, 6868, 6872, 6877, 6879, 6883, 6887,
+        6890, 6893, 6898, 6907, 6911, 6916, 6921, 6925,
+        6932, 6936, 6939, 6943, 6946, 6951, 6954, 6957,
+        6987, 6991, 6995, 6999, 7003, 7008, 7012, 7018,
+        7022, 7030, 7033, 7038, 7042, 7045, 7050, 7053,
+        7057, 7060, 7063, 7066, 7069, 7072, 7076, 7080,
+        7083, 7093, 7096, 7099, 7104, 7110, 7113, 7128,
+        7131, 7135, 7141, 7145, 7149, 7152, 7156, 7163,
+        7166, 7169, 7175, 7178, 7182, 7187, 7203, 7205,
+        7213, 7215, 7223, 7229, 7231, 7235, 7238, 7241,
+        7244, 7248, 7259, 7262, 7274, 7298, 7306, 7308,
+        7312, 7315, 7320, 7323, 7325, 7330, 7333, 7339,
+        7342, 7408, 7411, 7413, 7415, 7417, 7419, 7421,
+        7424, 7426, 7431, 7434, 7437, 7439, 7479, 7481,
+        7483, 7485, 7490, 7494, 7495, 7497, 7499, 7506,
+        7513, 7520, 7522, 7524, 7526, 7529, 7532, 7538,
+        7541, 7546, 7553, 7558, 7561, 7565, 7572, 7604,
+        7653, 7668, 7681, 7686, 7688, 7692, 7723, 7729,
+        7731, 7752, 7772, 7774, 7786, 7798, 7810, 7822,
+        7833, 7841, 7854, 7867, 7880, 7892, 7900, 7913,
+        7925, 7937, 7949, 7961, 7973, 7985, 7997, 7999,
+        8001, 8003, 8005, 8007, 8009, 8011, 8021, 8031,
+        8041, 8051, 8053, 8055, 8057, 8059, 8061, 8071,
+        8080, 8082, 8084, 8086, 8088, 8090, 8132, 8172,
+        8174, 8179, 8183, 8184, 8186, 8188, 8195, 8202,
+        8209, 8211, 8213, 8215, 8218, 8221, 8227, 8230,
+        8235, 8242, 8247, 8250, 8254, 8261, 8293, 8342,
+        8357, 8370, 8375, 8377, 8381, 8412, 8418, 8420,
+        8441, 8461,
+}
+
+var _hcltok_indicies []int16 = []int16{
+        2, 1, 4, 3, 6, 5, 6, 7,
+        5, 9, 11, 11, 10, 8, 12, 12,
+        10, 8, 10, 8, 13, 14, 15, 16,
+        18, 19, 20, 21, 22, 23, 24, 25,
+        26, 27, 28, 29, 30, 31, 32, 33,
+        34, 35, 36, 37, 38, 39, 40, 42,
+        43, 44, 45, 46, 14, 14, 17, 17,
+        41, 3, 14, 15, 16, 18, 19, 20,
+        21, 22, 23, 24, 25, 26, 27, 28,
+        29, 30, 31, 32, 33, 34, 35, 36,
+        37, 38, 39, 40, 42, 43, 44, 45,
+        46, 14, 14, 17, 17, 41, 3, 47,
+        48, 14, 14, 49, 16, 18, 19, 20,
+        19, 50, 51, 23, 52, 25, 26, 53,
+        54, 55, 56, 57, 58, 59, 60, 61,
+        62, 63, 64, 65, 40, 42, 66, 44,
+        67, 68, 69, 14, 14, 14, 17, 41,
+        3, 47, 3, 14, 14, 14, 14, 3,
+        14, 14, 14, 3, 14, 3, 14, 3,
+        14, 3, 3, 3, 3, 3, 14, 3,
+        3, 3, 3, 14, 14, 14, 14, 14,
+        3, 3, 14, 3, 3, 14, 3, 14,
+        3, 3, 14, 3, 3, 3, 14, 14,
+        14, 14, 14, 14, 3, 14, 14, 3,
+        14, 14, 3, 3, 3, 3, 3, 3,
+        14, 14, 3, 3, 14, 3, 14, 14,
+        14, 3, 70, 71, 72, 73, 17, 74,
+        75, 76, 77, 78, 79, 80, 81, 82,
+        83, 84, 85, 86, 87, 88, 89, 90,
+        91, 92, 93, 94, 95, 96, 97, 98,
+        99, 100, 3, 14, 3, 14, 3, 14,
+        14, 3, 14, 14, 3, 3, 3, 14,
+        3, 3, 3, 3, 3, 3, 3, 14,
+        3, 3, 3, 3, 3, 3, 3, 14,
+        14, 14, 14, 14, 14, 14, 14, 14,
+        14, 14, 3, 3, 3, 3, 3, 3,
+        3, 3, 14, 14, 14, 14, 14, 14,
+        14, 14, 14, 3, 3, 3, 3, 3,
+        3, 3, 3, 14, 14, 14, 14, 14,
+        14, 14, 14, 14, 3, 14, 14, 14,
+        14, 14, 14, 14, 14, 3, 14, 14,
+        14, 14, 14, 14, 14, 14, 14, 14,
+        14, 3, 14, 14, 14, 14, 14, 14,
+        3, 14, 14, 14, 14, 14, 14, 3,
+        3, 3, 3, 3, 3, 3, 3, 14,
+        14, 14, 14, 14, 14, 14, 14, 3,
+        14, 14, 14, 14, 14, 14, 14, 14,
+        3, 14, 14, 14, 14, 14, 3, 3,
+        3, 3, 3, 3, 3, 3, 14, 14,
+        14, 14, 14, 14, 3, 14, 14, 14,
+        14, 14, 14, 14, 3, 14, 3, 14,
+        14, 3, 14, 14, 14, 14, 14, 14,
+        14, 14, 14, 14, 14, 14, 14, 3,
+        14, 14, 14, 14, 14, 3, 14, 14,
+        14, 14, 14, 14, 14, 3, 14, 14,
+        14, 3, 14, 14, 14, 3, 14, 3,
+        101, 102, 103, 104, 105, 106, 107, 108,
+        109, 110, 111, 112, 113, 114, 115, 116,
+        117, 19, 118, 119, 120, 121, 122, 123,
+        124, 125, 126, 127, 128, 129, 130, 131,
+        132, 133, 134, 135, 17, 18, 136, 137,
+        138, 139, 140, 17, 19, 17, 3, 14,
+        3, 14, 14, 3, 3, 14, 3, 3,
+        3, 3, 14, 3, 3, 3, 3, 3,
+        14, 3, 3, 3, 3, 3, 14, 14,
+        14, 14, 14, 3, 3, 3, 14, 3,
+        3, 3, 14, 14, 14, 3, 3, 3,
+        14, 14, 3, 3, 3, 14, 14, 14,
+        3, 3, 3, 14, 14, 14, 14, 3,
+        14, 14, 14, 14, 3, 3, 3, 3,
+        3, 14, 14, 14, 14, 3, 3, 14,
+        14, 14, 3, 3, 14, 14, 14, 14,
+        3, 14, 14, 3, 14, 14, 3, 3,
+        3, 14, 14, 14, 3, 3, 3, 3,
+        14, 14, 14, 14, 14, 3, 3, 3,
+        3, 14, 3, 14, 14, 3, 14, 14,
+        3, 14, 3, 14, 14, 14, 3, 14,
+        14, 3, 3, 3, 14, 3, 3, 3,
+        3, 3, 3, 3, 14, 14, 14, 14,
+        3, 14, 14, 14, 14, 14, 14, 14,
+        3, 141, 142, 143, 144, 145, 146, 147,
+        148, 149, 17, 150, 151, 152, 153, 154,
+        3, 14, 3, 3, 3, 3, 3, 14,
+        14, 3, 14, 14, 14, 3, 14, 14,
+        14, 14, 14, 14, 14, 14, 14, 14,
+        3, 14, 14, 14, 3, 3, 14, 14,
+        14, 3, 3, 14, 3, 3, 14, 14,
+        14, 14, 14, 3, 3, 3, 3, 14,
+        14, 14, 14, 14, 14, 3, 14, 14,
+        14, 14, 14, 3, 155, 112, 156, 157,
+        158, 17, 159, 160, 19, 17, 3, 14,
+        14, 14, 14, 3, 3, 3, 14, 3,
+        3, 14, 14, 14, 3, 3, 3, 14,
+        14, 3, 122, 3, 19, 17, 17, 161,
+        3, 17, 3, 14, 19, 162, 163, 19,
+        164, 165, 19, 60, 166, 167, 168, 169,
+        170, 19, 171, 172, 173, 19, 174, 175,
+        176, 18, 177, 178, 179, 18, 180, 19,
+        17, 3, 3, 14, 14, 3, 3, 3,
+        14, 14, 14, 14, 3, 14, 14, 3,
+        3, 3, 3, 14, 14, 3, 3, 14,
+        14, 3, 3, 3, 3, 3, 3, 14,
+        14, 14, 3, 3, 3, 14, 3, 3,
+        3, 14, 14, 3, 14, 14, 14, 14,
+        3, 14, 14, 14, 14, 3, 14, 14,
+        14, 14, 14, 14, 3, 3, 3, 14,
+        14, 14, 14, 3, 181, 182, 3, 17,
+        3, 14, 3, 3, 14, 19, 183, 184,
+        185, 186, 60, 187, 188, 58, 189, 190,
+        191, 192, 193, 194, 195, 196, 197, 17,
+        3, 3, 14, 3, 14, 14, 14, 14,
+        14, 14, 14, 3, 14, 14, 14, 3,
+        14, 3, 3, 14, 3, 14, 3, 3,
+        14, 14, 14, 14, 3, 14, 14, 14,
+        3, 3, 14, 14, 14, 14, 3, 14,
+        14, 3, 3, 14, 14, 14, 14, 14,
+        3, 198, 199, 200, 201, 202, 203, 204,
+        205, 206, 207, 208, 204, 209, 210, 211,
+        212, 41, 3, 213, 214, 19, 215, 216,
+        217, 218, 219, 220, 221, 222, 223, 19,
+        17, 224, 225, 226, 227, 19, 228, 229,
+        230, 231, 232, 233, 234, 235, 236, 237,
+        238, 239, 240, 241, 242, 19, 147, 17,
+        243, 3, 14, 14, 14, 14, 14, 3,
+        3, 3, 14, 3, 14, 14, 3, 14,
+        3, 14, 14, 3, 3, 3, 14, 14,
+        14, 3, 3, 3, 14, 14, 14, 3,
+        3, 3, 3, 14, 3, 3, 14, 3,
+        3, 14, 14, 14, 3, 3, 14, 3,
+        14, 14, 14, 3, 14, 14, 14, 14,
+        14, 14, 3, 3, 3, 14, 14, 3,
+        14, 14, 3, 14, 14, 3, 14, 14,
+        3, 14, 14, 14, 14, 14, 14, 14,
+        3, 14, 3, 14, 3, 14, 14, 3,
+        14, 3, 14, 14, 3, 14, 3, 14,
+        3, 244, 215, 245, 246, 247, 248, 249,
+        250, 251, 252, 253, 101, 254, 19, 255,
+        256, 257, 19, 258, 132, 259, 260, 261,
+        262, 263, 264, 265, 266, 19, 3, 3,
+        3, 14, 14, 14, 3, 14, 14, 3,
+        14, 14, 3, 3, 3, 3, 3, 14,
+        14, 14, 14, 3, 14, 14, 14, 14,
+        14, 14, 3, 3, 3, 14, 14, 14,
+        14, 14, 14, 14, 14, 14, 3, 14,
+        14, 14, 14, 14, 14, 14, 14, 3,
+        14, 14, 3, 3, 3, 3, 14, 14,
+        14, 3, 3, 3, 14, 3, 3, 3,
+        14, 14, 3, 14, 14, 14, 3, 14,
+        3, 3, 3, 14, 14, 3, 14, 14,
+        14, 3, 14, 14, 14, 3, 3, 3,
+        3, 14, 19, 184, 267, 268, 17, 19,
+        17, 3, 3, 14, 3, 14, 19, 267,
+        17, 3, 19, 269, 17, 3, 3, 14,
+        19, 270, 271, 272, 175, 273, 274, 19,
+        275, 276, 277, 17, 3, 3, 14, 14,
+        14, 3, 14, 14, 3, 14, 14, 14,
+        14, 3, 3, 14, 3, 3, 14, 14,
+        3, 14, 3, 19, 17, 3, 278, 19,
+        279, 3, 17, 3, 14, 3, 14, 280,
+        19, 281, 282, 3, 14, 3, 3, 3,
+        14, 14, 14, 14, 3, 283, 284, 285,
+        19, 286, 287, 288, 289, 290, 291, 292,
+        293, 294, 295, 296, 297, 298, 299, 17,
+        3, 14, 14, 14, 3, 3, 3, 3,
+        14, 14, 3, 3, 14, 3, 3, 3,
+        3, 3, 3, 3, 14, 3, 14, 3,
+        3, 3, 3, 3, 3, 14, 14, 14,
+        14, 14, 3, 3, 14, 3, 3, 3,
+        14, 3, 3, 14, 3, 3, 14, 3,
+        3, 14, 3, 3, 3, 14, 14, 14,
+        3, 3, 3, 14, 14, 14, 14, 3,
+        300, 19, 301, 19, 302, 303, 304, 305,
+        17, 3, 14, 14, 14, 14, 14, 3,
+        3, 3, 14, 3, 3, 14, 14, 14,
+        14, 14, 14, 14, 14, 14, 14, 3,
+        14, 14, 14, 14, 14, 14, 14, 14,
+        14, 14, 14, 14, 14, 14, 14, 14,
+        14, 14, 14, 3, 14, 14, 14, 14,
+        14, 3, 306, 19, 17, 3, 14, 307,
+        19, 103, 17, 3, 14, 308, 3, 17,
+        3, 14, 19, 309, 17, 3, 3, 14,
+        310, 3, 19, 311, 17, 3, 3, 14,
+        14, 14, 14, 3, 14, 14, 14, 14,
+        3, 14, 14, 14, 14, 14, 3, 3,
+        14, 3, 14, 14, 14, 3, 14, 3,
+        14, 14, 14, 3, 3, 3, 3, 3,
+        3, 3, 14, 14, 14, 3, 14, 3,
+        3, 3, 14, 14, 14, 14, 3, 312,
+        313, 72, 314, 315, 316, 317, 318, 319,
+        320, 321, 322, 323, 324, 325, 326, 327,
+        328, 329, 330, 331, 332, 334, 335, 336,
+        337, 338, 339, 333, 3, 14, 14, 14,
+        14, 3, 14, 3, 14, 14, 3, 14,
+        14, 14, 3, 3, 3, 3, 3, 3,
+        3, 3, 3, 14, 14, 14, 14, 14,
+        3, 14, 14, 14, 14, 14, 14, 14,
+        3, 14, 14, 14, 3, 14, 14, 14,
+        14, 14, 14, 14, 3, 14, 14, 14,
+        3, 14, 14, 14, 14, 14, 14, 14,
+        3, 14, 14, 14, 3, 14, 14, 14,
+        14, 14, 14, 14, 14, 14, 14, 3,
+        14, 3, 14, 14, 14, 14, 14, 3,
+        14, 14, 3, 14, 14, 14, 14, 14,
+        14, 14, 3, 14, 14, 14, 3, 14,
+        14, 14, 14, 3, 14, 14, 14, 14,
+        3, 14, 14, 14, 14, 3, 14, 3,
+        14, 14, 3, 14, 14, 14, 14, 14,
+        14, 14, 14, 14, 14, 14, 14, 14,
+        14, 3, 14, 14, 14, 3, 14, 3,
+        14, 14, 3, 14, 3, 340, 341, 342,
+        104, 105, 106, 107, 108, 343, 110, 111,
+        112, 113, 114, 115, 344, 345, 170, 346,
+        261, 120, 347, 122, 232, 272, 125, 348,
+        349, 350, 351, 352, 353, 354, 355, 356,
+        357, 134, 358, 19, 17, 18, 19, 137,
+        138, 139, 140, 17, 17, 3, 14, 14,
+        3, 14, 14, 14, 14, 14, 14, 3,
+        3, 3, 14, 3, 14, 14, 14, 14,
+        3, 14, 14, 14, 3, 14, 14, 3,
+        14, 14, 14, 3, 3, 14, 14, 14,
+        3, 3, 14, 14, 3, 14, 3, 14,
+        3, 14, 14, 14, 3, 3, 14, 14,
+        3, 14, 14, 3, 14, 14, 14, 3,
+        359, 143, 145, 146, 147, 148, 149, 17,
+        360, 151, 361, 153, 362, 3, 14, 14,
+        3, 3, 3, 3, 14, 3, 3, 14,
+        14, 14, 14, 14, 3, 363, 112, 364,
+        157, 158, 17, 159, 160, 19, 17, 3,
+        14, 14, 14, 14, 3, 3, 3, 14,
+        19, 162, 163, 19, 365, 366, 222, 311,
+        166, 167, 168, 367, 170, 368, 369, 370,
+        371, 372, 373, 374, 375, 376, 377, 178,
+        179, 18, 378, 19, 17, 3, 3, 3,
+        3, 14, 14, 14, 3, 3, 3, 3,
+        3, 14, 14, 3, 14, 14, 14, 3,
+        14, 14, 3, 3, 3, 14, 14, 3,
+        14, 14, 14, 14, 3, 14, 3, 14,
+        14, 14, 14, 14, 3, 3, 3, 3,
+        3, 14, 14, 14, 14, 14, 14, 3,
+        14, 3, 19, 183, 184, 379, 186, 60,
+        187, 188, 58, 189, 190, 380, 17, 193,
+        381, 195, 196, 197, 17, 3, 14, 14,
+        14, 14, 14, 14, 14, 3, 14, 14,
+        3, 14, 3, 382, 383, 200, 201, 202,
+        384, 204, 205, 385, 386, 387, 204, 209,
+        210, 211, 212, 41, 3, 213, 214, 19,
+        215, 216, 218, 388, 220, 389, 222, 223,
+        19, 17, 390, 225, 226, 227, 19, 228,
+        229, 230, 231, 232, 233, 234, 235, 391,
+        237, 238, 392, 240, 241, 242, 19, 147,
+        17, 243, 3, 3, 14, 3, 3, 14,
+        3, 14, 14, 14, 14, 14, 3, 14,
+        14, 3, 393, 394, 395, 396, 397, 398,
+        399, 400, 250, 401, 322, 402, 216, 403,
+        404, 405, 406, 407, 404, 408, 409, 410,
+        261, 411, 263, 412, 413, 274, 3, 14,
+        3, 14, 3, 14, 3, 14, 3, 14,
+        14, 3, 14, 3, 14, 14, 14, 3,
+        14, 14, 3, 3, 14, 14, 14, 3,
+        14, 3, 14, 3, 14, 14, 3, 14,
+        3, 14, 3, 14, 3, 14, 3, 14,
+        3, 3, 3, 14, 14, 14, 3, 14,
+        14, 3, 19, 270, 232, 414, 404, 415,
+        274, 19, 416, 417, 277, 17, 3, 14,
+        3, 14, 14, 14, 3, 3, 3, 14,
+        14, 3, 280, 19, 281, 418, 3, 14,
+        14, 3, 19, 286, 287, 288, 289, 290,
+        291, 292, 293, 294, 295, 419, 17, 3,
+        3, 3, 14, 19, 420, 19, 268, 303,
+        304, 305, 17, 3, 3, 14, 422, 422,
+        422, 422, 421, 422, 422, 422, 421, 422,
+        421, 422, 422, 421, 421, 421, 421, 421,
+        421, 422, 421, 421, 421, 421, 422, 422,
+        422, 422, 422, 421, 421, 422, 421, 421,
+        422, 421, 422, 421, 421, 422, 421, 421,
+        421, 422, 422, 422, 422, 422, 422, 421,
+        422, 422, 421, 422, 422, 421, 421, 421,
+        421, 421, 421, 422, 422, 421, 421, 422,
+        421, 422, 422, 422, 421, 423, 424, 425,
+        426, 427, 428, 429, 430, 431, 432, 433,
+        434, 435, 436, 437, 438, 439, 440, 441,
+        442, 443, 444, 445, 446, 447, 448, 449,
+        450, 451, 452, 453, 454, 421, 422, 421,
+        422, 421, 422, 422, 421, 422, 422, 421,
+        421, 421, 422, 421, 421, 421, 421, 421,
+        421, 421, 422, 421, 421, 421, 421, 421,
+        421, 421, 422, 422, 422, 422, 422, 422,
+        422, 422, 422, 422, 422, 421, 421, 421,
+        421, 421, 421, 421, 421, 422, 422, 422,
+        422, 422, 422, 422, 422, 422, 421, 421,
+        421, 421, 421, 421, 421, 421, 422, 422,
+        422, 422, 422, 422, 422, 422, 422, 421,
+        422, 422, 422, 422, 422, 422, 422, 422,
+        421, 422, 422, 422, 422, 422, 422, 422,
+        422, 422, 422, 422, 421, 422, 422, 422,
+        422, 422, 422, 421, 422, 422, 422, 422,
+        422, 422, 421, 421, 421, 421, 421, 421,
+        421, 421, 422, 422, 422, 422, 422, 422,
+        422, 422, 421, 422, 422, 422, 422, 422,
+        422, 422, 422, 421, 422, 422, 422, 422,
+        422, 421, 421, 421, 421, 421, 421, 421,
+        421, 422, 422, 422, 422, 422, 422, 421,
+        422, 422, 422, 422, 422, 422, 422, 421,
+        422, 421, 422, 422, 421, 422, 422, 422,
+        422, 422, 422, 422, 422, 422, 422, 422,
+        422, 422, 421, 422, 422, 422, 422, 422,
+        421, 422, 422, 422, 422, 422, 422, 422,
+        421, 422, 422, 422, 421, 422, 422, 422,
+        421, 422, 421, 455, 456, 457, 458, 459,
+        460, 461, 462, 463, 464, 465, 466, 467,
+        468, 469, 470, 471, 472, 473, 474, 475,
+        476, 477, 478, 479, 480, 481, 482, 483,
+        484, 485, 486, 487, 488, 489, 490, 427,
+        491, 492, 493, 494, 495, 496, 427, 472,
+        427, 421, 422, 421, 422, 422, 421, 421,
+        422, 421, 421, 421, 421, 422, 421, 421,
+        421, 421, 421, 422, 421, 421, 421, 421,
+        421, 422, 422, 422, 422, 422, 421, 421,
+        421, 422, 421, 421, 421, 422, 422, 422,
+        421, 421, 421, 422, 422, 421, 421, 421,
+        422, 422, 422, 421, 421, 421, 422, 422,
+        422, 422, 421, 422, 422, 422, 422, 421,
+        421, 421, 421, 421, 422, 422, 422, 422,
+        421, 421, 422, 422, 422, 421, 421, 422,
+        422, 422, 422, 421, 422, 422, 421, 422,
+        422, 421, 421, 421, 422, 422, 422, 421,
+        421, 421, 421, 422, 422, 422, 422, 422,
+        421, 421, 421, 421, 422, 421, 422, 422,
+        421, 422, 422, 421, 422, 421, 422, 422,
+        422, 421, 422, 422, 421, 421, 421, 422,
+        421, 421, 421, 421, 421, 421, 421, 422,
+        422, 422, 422, 421, 422, 422, 422, 422,
+        422, 422, 422, 421, 497, 498, 499, 500,
+        501, 502, 503, 504, 505, 427, 506, 507,
+        508, 509, 510, 421, 422, 421, 421, 421,
+        421, 421, 422, 422, 421, 422, 422, 422,
+        421, 422, 422, 422, 422, 422, 422, 422,
+        422, 422, 422, 421, 422, 422, 422, 421,
+        421, 422, 422, 422, 421, 421, 422, 421,
+        421, 422, 422, 422, 422, 422, 421, 421,
+        421, 421, 422, 422, 422, 422, 422, 422,
+        421, 422, 422, 422, 422, 422, 421, 511,
+        466, 512, 513, 514, 427, 515, 516, 472,
+        427, 421, 422, 422, 422, 422, 421, 421,
+        421, 422, 421, 421, 422, 422, 422, 421,
+        421, 421, 422, 422, 421, 477, 421, 472,
+        427, 427, 517, 421, 427, 421, 422, 472,
+        518, 519, 472, 520, 521, 472, 522, 523,
+        524, 525, 526, 527, 472, 528, 529, 530,
+        472, 531, 532, 533, 491, 534, 535, 536,
+        491, 537, 472, 427, 421, 421, 422, 422,
+        421, 421, 421, 422, 422, 422, 422, 421,
+        422, 422, 421, 421, 421, 421, 422, 422,
+        421, 421, 422, 422, 421, 421, 421, 421,
+        421, 421, 422, 422, 422, 421, 421, 421,
+        422, 421, 421, 421, 422, 422, 421, 422,
+        422, 422, 422, 421, 422, 422, 422, 422,
+        421, 422, 422, 422, 422, 422, 422, 421,
+        421, 421, 422, 422, 422, 422, 421, 538,
+        539, 421, 427, 421, 422, 421, 421, 422,
+        472, 540, 541, 542, 543, 522, 544, 545,
+        546, 547, 548, 549, 550, 551, 552, 553,
+        554, 555, 427, 421, 421, 422, 421, 422,
+        422, 422, 422, 422, 422, 422, 421, 422,
+        422, 422, 421, 422, 421, 421, 422, 421,
+        422, 421, 421, 422, 422, 422, 422, 421,
+        422, 422, 422, 421, 421, 422, 422, 422,
+        422, 421, 422, 422, 421, 421, 422, 422,
+        422, 422, 422, 421, 556, 557, 558, 559,
+        560, 561, 562, 563, 564, 565, 566, 562,
+        568, 569, 570, 571, 567, 421, 572, 573,
+        472, 574, 575, 576, 577, 578, 579, 580,
+        581, 582, 472, 427, 583, 584, 585, 586,
+        472, 587, 588, 589, 590, 591, 592, 593,
+        594, 595, 596, 597, 598, 599, 600, 601,
+        472, 503, 427, 602, 421, 422, 422, 422,
+        422, 422, 421, 421, 421, 422, 421, 422,
+        422, 421, 422, 421, 422, 422, 421, 421,
+        421, 422, 422, 422, 421, 421, 421, 422,
+        422, 422, 421, 421, 421, 421, 422, 421,
+        421, 422, 421, 421, 422, 422, 422, 421,
+        421, 422, 421, 422, 422, 422, 421, 422,
+        422, 422, 422, 422, 422, 421, 421, 421,
+        422, 422, 421, 422, 422, 421, 422, 422,
+        421, 422, 422, 421, 422, 422, 422, 422,
+        422, 422, 422, 421, 422, 421, 422, 421,
+        422, 422, 421, 422, 421, 422, 422, 421,
+        422, 421, 422, 421, 603, 574, 604, 605,
+        606, 607, 608, 609, 610, 611, 612, 455,
+        613, 472, 614, 615, 616, 472, 617, 487,
+        618, 619, 620, 621, 622, 623, 624, 625,
+        472, 421, 421, 421, 422, 422, 422, 421,
+        422, 422, 421, 422, 422, 421, 421, 421,
+        421, 421, 422, 422, 422, 422, 421, 422,
+        422, 422, 422, 422, 422, 421, 421, 421,
+        422, 422, 422, 422, 422, 422, 422, 422,
+        422, 421, 422, 422, 422, 422, 422, 422,
+        422, 422, 421, 422, 422, 421, 421, 421,
+        421, 422, 422, 422, 421, 421, 421, 422,
+        421, 421, 421, 422, 422, 421, 422, 422,
+        422, 421, 422, 421, 421, 421, 422, 422,
+        421, 422, 422, 422, 421, 422, 422, 422,
+        421, 421, 421, 421, 422, 472, 541, 626,
+        627, 427, 472, 427, 421, 421, 422, 421,
+        422, 472, 626, 427, 421, 472, 628, 427,
+        421, 421, 422, 472, 629, 630, 631, 532,
+        632, 633, 472, 634, 635, 636, 427, 421,
+        421, 422, 422, 422, 421, 422, 422, 421,
+        422, 422, 422, 422, 421, 421, 422, 421,
+        421, 422, 422, 421, 422, 421, 472, 427,
+        421, 637, 472, 638, 421, 427, 421, 422,
+        421, 422, 639, 472, 640, 641, 421, 422,
+        421, 421, 421, 422, 422, 422, 422, 421,
+        642, 643, 644, 472, 645, 646, 647, 648,
+        649, 650, 651, 652, 653, 654, 655, 656,
+        657, 658, 427, 421, 422, 422, 422, 421,
+        421, 421, 421, 422, 422, 421, 421, 422,
+        421, 421, 421, 421, 421, 421, 421, 422,
+        421, 422, 421, 421, 421, 421, 421, 421,
+        422, 422, 422, 422, 422, 421, 421, 422,
+        421, 421, 421, 422, 421, 421, 422, 421,
+        421, 422, 421, 421, 422, 421, 421, 421,
+        422, 422, 422, 421, 421, 421, 422, 422,
+        422, 422, 421, 659, 472, 660, 472, 661,
+        662, 663, 664, 427, 421, 422, 422, 422,
+        422, 422, 421, 421, 421, 422, 421, 421,
+        422, 422, 422, 422, 422, 422, 422, 422,
+        422, 422, 421, 422, 422, 422, 422, 422,
+        422, 422, 422, 422, 422, 422, 422, 422,
+        422, 422, 422, 422, 422, 422, 421, 422,
+        422, 422, 422, 422, 421, 665, 472, 427,
+        421, 422, 666, 472, 457, 427, 421, 422,
+        667, 421, 427, 421, 422, 472, 668, 427,
+        421, 421, 422, 669, 421, 472, 670, 427,
+        421, 421, 422, 672, 671, 422, 422, 422,
+        422, 672, 671, 422, 672, 671, 672, 672,
+        422, 672, 671, 422, 672, 422, 672, 671,
+        422, 672, 422, 672, 422, 671, 672, 672,
+        672, 672, 672, 672, 672, 672, 671, 422,
+        422, 672, 672, 422, 672, 422, 672, 671,
+        672, 672, 672, 672, 672, 422, 672, 422,
+        672, 422, 672, 671, 672, 672, 422, 672,
+        422, 672, 671, 672, 672, 672, 672, 672,
+        422, 672, 422, 672, 671, 422, 422, 672,
+        422, 672, 671, 672, 672, 672, 422, 672,
+        422, 672, 422, 672, 422, 672, 671, 672,
+        422, 672, 422, 672, 671, 422, 672, 672,
+        672, 672, 422, 672, 422, 672, 422, 672,
+        422, 672, 422, 672, 422, 672, 671, 422,
+        672, 671, 672, 672, 672, 422, 672, 422,
+        672, 671, 672, 422, 672, 422, 672, 671,
+        422, 672, 672, 672, 672, 422, 672, 422,
+        672, 671, 422, 672, 422, 672, 422, 672,
+        671, 672, 672, 422, 672, 422, 672, 671,
+        422, 672, 422, 672, 422, 672, 422, 671,
+        672, 672, 672, 422, 672, 422, 672, 671,
+        422, 672, 671, 672, 672, 422, 672, 671,
+        672, 672, 672, 422, 672, 672, 672, 672,
+        672, 672, 422, 422, 672, 422, 672, 422,
+        672, 422, 672, 671, 672, 422, 672, 422,
+        672, 671, 422, 672, 671, 672, 422, 672,
+        671, 672, 422, 672, 671, 422, 422, 672,
+        671, 422, 672, 422, 672, 422, 672, 422,
+        672, 422, 672, 422, 671, 672, 672, 422,
+        672, 672, 672, 672, 422, 422, 672, 672,
+        672, 672, 672, 422, 672, 672, 672, 672,
+        672, 671, 422, 672, 672, 422, 672, 422,
+        671, 672, 672, 422, 672, 671, 422, 422,
+        672, 422, 671, 672, 672, 671, 422, 672,
+        422, 671, 672, 671, 422, 672, 422, 672,
+        422, 671, 672, 672, 671, 422, 672, 422,
+        672, 422, 672, 671, 672, 422, 672, 422,
+        672, 671, 422, 672, 671, 422, 422, 672,
+        671, 672, 422, 671, 672, 671, 422, 672,
+        422, 672, 422, 671, 672, 671, 422, 422,
+        672, 671, 672, 422, 672, 422, 672, 671,
+        422, 672, 422, 671, 672, 671, 422, 422,
+        672, 422, 671, 672, 671, 422, 422, 672,
+        671, 672, 422, 672, 671, 672, 422, 672,
+        671, 672, 422, 672, 422, 672, 422, 671,
+        672, 671, 422, 422, 672, 671, 672, 422,
+        672, 422, 672, 671, 422, 672, 671, 672,
+        672, 422, 672, 422, 672, 671, 671, 422,
+        671, 422, 672, 672, 422, 672, 672, 672,
+        672, 672, 672, 672, 671, 422, 672, 672,
+        672, 422, 671, 672, 672, 672, 422, 672,
+        422, 672, 422, 672, 422, 672, 422, 672,
+        671, 422, 422, 672, 671, 672, 422, 672,
+        671, 422, 422, 672, 422, 422, 422, 672,
+        422, 672, 422, 672, 422, 672, 422, 671,
+        422, 672, 422, 672, 422, 671, 672, 671,
+        422, 672, 422, 671, 672, 422, 672, 672,
+        672, 671, 422, 672, 422, 422, 672, 422,
+        671, 672, 672, 671, 422, 672, 672, 672,
+        672, 422, 672, 422, 671, 672, 672, 672,
+        422, 672, 671, 672, 422, 672, 422, 672,
+        422, 672, 422, 672, 671, 672, 672, 422,
+        672, 671, 422, 672, 422, 672, 422, 671,
+        672, 672, 671, 422, 672, 422, 671, 672,
+        671, 422, 672, 671, 422, 672, 422, 672,
+        671, 672, 672, 672, 671, 422, 422, 422,
+        672, 671, 422, 672, 422, 671, 672, 671,
+        422, 672, 422, 672, 422, 671, 672, 672,
+        672, 671, 422, 672, 422, 671, 672, 672,
+        672, 672, 671, 422, 672, 422, 672, 671,
+        422, 422, 672, 422, 672, 671, 672, 422,
+        672, 422, 671, 672, 672, 671, 422, 672,
+        422, 672, 671, 422, 672, 672, 672, 422,
+        672, 422, 671, 422, 672, 671, 672, 422,
+        422, 672, 422, 672, 422, 671, 672, 672,
+        672, 672, 671, 422, 672, 422, 672, 422,
+        672, 422, 672, 422, 672, 671, 672, 672,
+        672, 422, 672, 422, 672, 422, 672, 422,
+        671, 672, 672, 422, 422, 672, 671, 672,
+        422, 672, 672, 671, 422, 672, 422, 672,
+        671, 422, 422, 672, 672, 672, 672, 422,
+        672, 422, 672, 422, 671, 672, 672, 422,
+        671, 672, 671, 422, 672, 422, 671, 672,
+        671, 422, 672, 422, 671, 672, 422, 672,
+        672, 671, 422, 672, 672, 422, 671, 672,
+        671, 422, 672, 422, 672, 671, 672, 422,
+        672, 422, 671, 672, 671, 422, 672, 422,
+        672, 422, 672, 422, 672, 422, 672, 671,
+        673, 671, 674, 675, 676, 677, 678, 679,
+        680, 681, 682, 683, 684, 676, 685, 686,
+        687, 688, 689, 676, 690, 691, 692, 693,
+        694, 695, 696, 697, 698, 699, 700, 701,
+        702, 703, 704, 676, 705, 673, 685, 673,
+        706, 673, 671, 672, 672, 672, 672, 422,
+        671, 672, 672, 671, 422, 672, 671, 422,
+        422, 672, 671, 422, 672, 422, 671, 672,
+        671, 422, 422, 672, 422, 671, 672, 672,
+        671, 422, 672, 672, 672, 671, 422, 672,
+        422, 672, 672, 671, 422, 422, 672, 422,
+        671, 672, 671, 422, 672, 671, 422, 422,
+        672, 422, 672, 671, 422, 672, 422, 422,
+        672, 422, 672, 422, 671, 672, 672, 671,
+        422, 672, 672, 422, 672, 671, 422, 672,
+        422, 672, 671, 422, 672, 422, 671, 422,
+        672, 672, 672, 422, 672, 671, 672, 422,
+        672, 671, 422, 672, 671, 672, 422, 672,
+        671, 422, 672, 671, 422, 672, 422, 672,
+        671, 422, 672, 671, 422, 672, 671, 707,
+        708, 709, 710, 711, 712, 713, 714, 715,
+        716, 717, 718, 678, 719, 720, 721, 722,
+        723, 720, 724, 725, 726, 727, 728, 729,
+        730, 731, 732, 673, 671, 672, 422, 672,
+        671, 672, 422, 672, 671, 672, 422, 672,
+        671, 672, 422, 672, 671, 422, 672, 422,
+        672, 671, 672, 422, 672, 671, 672, 422,
+        422, 422, 672, 671, 672, 422, 672, 671,
+        672, 672, 672, 672, 422, 672, 422, 671,
+        672, 671, 422, 422, 672, 422, 672, 671,
+        672, 422, 672, 671, 422, 672, 671, 672,
+        672, 422, 672, 671, 422, 672, 671, 672,
+        422, 672, 671, 422, 672, 671, 422, 672,
+        671, 422, 672, 671, 672, 671, 422, 422,
+        672, 671, 672, 422, 672, 671, 422, 672,
+        422, 671, 672, 671, 422, 676, 733, 673,
+        676, 734, 676, 735, 685, 673, 671, 672,
+        671, 422, 672, 671, 422, 676, 734, 685,
+        673, 671, 676, 736, 673, 685, 673, 671,
+        672, 671, 422, 676, 737, 694, 738, 720,
+        739, 732, 676, 740, 741, 742, 673, 685,
+        673, 671, 672, 671, 422, 672, 422, 672,
+        671, 422, 672, 422, 672, 422, 671, 672,
+        672, 671, 422, 672, 422, 672, 671, 422,
+        672, 671, 676, 685, 427, 671, 743, 676,
+        744, 685, 673, 671, 427, 672, 671, 422,
+        672, 671, 422, 745, 676, 746, 747, 673,
+        671, 422, 672, 671, 672, 672, 671, 422,
+        422, 672, 422, 672, 671, 676, 748, 749,
+        750, 751, 752, 753, 754, 755, 756, 757,
+        758, 673, 685, 673, 671, 672, 422, 672,
+        672, 672, 672, 672, 672, 672, 422, 672,
+        422, 672, 672, 672, 672, 672, 672, 671,
+        422, 672, 672, 422, 672, 422, 671, 672,
+        422, 672, 672, 672, 422, 672, 672, 422,
+        672, 672, 422, 672, 672, 422, 672, 672,
+        671, 422, 676, 759, 676, 735, 760, 761,
+        762, 673, 685, 673, 671, 672, 671, 422,
+        672, 672, 672, 422, 672, 672, 672, 422,
+        672, 422, 672, 671, 422, 422, 422, 422,
+        672, 672, 422, 422, 422, 422, 422, 672,
+        672, 672, 672, 672, 672, 672, 422, 672,
+        422, 672, 422, 671, 672, 672, 672, 422,
+        672, 422, 672, 671, 685, 427, 763, 676,
+        685, 427, 672, 671, 422, 764, 676, 765,
+        685, 427, 672, 671, 422, 672, 422, 766,
+        685, 673, 671, 427, 672, 671, 422, 676,
+        767, 673, 685, 673, 671, 672, 671, 422,
+        768, 769, 768, 770, 771, 768, 772, 768,
+        773, 768, 771, 774, 775, 774, 777, 776,
+        778, 779, 778, 780, 781, 776, 782, 776,
+        783, 778, 784, 779, 785, 780, 787, 786,
+        788, 789, 789, 786, 790, 786, 791, 788,
+        792, 789, 793, 789, 795, 795, 795, 795,
+        794, 795, 795, 795, 794, 795, 794, 795,
+        795, 794, 794, 794, 794, 794, 794, 795,
+        794, 794, 794, 794, 795, 795, 795, 795,
+        795, 794, 794, 795, 794, 794, 795, 794,
+        795, 794, 794, 795, 794, 794, 794, 795,
+        795, 795, 795, 795, 795, 794, 795, 795,
+        794, 795, 795, 794, 794, 794, 794, 794,
+        794, 795, 795, 794, 794, 795, 794, 795,
+        795, 795, 794, 797, 798, 799, 800, 801,
+        802, 803, 804, 805, 806, 807, 808, 809,
+        810, 811, 812, 813, 814, 815, 816, 817,
+        818, 819, 820, 821, 822, 823, 824, 825,
+        826, 827, 828, 794, 795, 794, 795, 794,
+        795, 795, 794, 795, 795, 794, 794, 794,
+        795, 794, 794, 794, 794, 794, 794, 794,
+        795, 794, 794, 794, 794, 794, 794, 794,
+        795, 795, 795, 795, 795, 795, 795, 795,
+        795, 795, 795, 794, 794, 794, 794, 794,
+        794, 794, 794, 795, 795, 795, 795, 795,
+        795, 795, 795, 795, 794, 794, 794, 794,
+        794, 794, 794, 794, 795, 795, 795, 795,
+        795, 795, 795, 795, 795, 794, 795, 795,
+        795, 795, 795, 795, 795, 795, 794, 795,
+        795, 795, 795, 795, 795, 795, 795, 795,
+        795, 795, 794, 795, 795, 795, 795, 795,
+        795, 794, 795, 795, 795, 795, 795, 795,
+        794, 794, 794, 794, 794, 794, 794, 794,
+        795, 795, 795, 795, 795, 795, 795, 795,
+        794, 795, 795, 795, 795, 795, 795, 795,
+        795, 794, 795, 795, 795, 795, 795, 794,
+        794, 794, 794, 794, 794, 794, 794, 795,
+        795, 795, 795, 795, 795, 794, 795, 795,
+        795, 795, 795, 795, 795, 794, 795, 794,
+        795, 795, 794, 795, 795, 795, 795, 795,
+        795, 795, 795, 795, 795, 795, 795, 795,
+        794, 795, 795, 795, 795, 795, 794, 795,
+        795, 795, 795, 795, 795, 795, 794, 795,
+        795, 795, 794, 795, 795, 795, 794, 795,
+        794, 829, 830, 831, 832, 833, 834, 835,
+        836, 837, 838, 839, 840, 841, 842, 843,
+        844, 845, 846, 847, 848, 849, 850, 851,
+        852, 853, 854, 855, 856, 857, 858, 859,
+        860, 861, 862, 863, 864, 801, 865, 866,
+        867, 868, 869, 870, 801, 846, 801, 794,
+        795, 794, 795, 795, 794, 794, 795, 794,
+        794, 794, 794, 795, 794, 794, 794, 794,
+        794, 795, 794, 794, 794, 794, 794, 795,
+        795, 795, 795, 795, 794, 794, 794, 795,
+        794, 794, 794, 795, 795, 795, 794, 794,
+        794, 795, 795, 794, 794, 794, 795, 795,
+        795, 794, 794, 794, 795, 795, 795, 795,
+        794, 795, 795, 795, 795, 794, 794, 794,
+        794, 794, 795, 795, 795, 795, 794, 794,
+        795, 795, 795, 794, 794, 795, 795, 795,
+        795, 794, 795, 795, 794, 795, 795, 794,
+        794, 794, 795, 795, 795, 794, 794, 794,
+        794, 795, 795, 795, 795, 795, 794, 794,
+        794, 794, 795, 794, 795, 795, 794, 795,
+        795, 794, 795, 794, 795, 795, 795, 794,
+        795, 795, 794, 794, 794, 795, 794, 794,
+        794, 794, 794, 794, 794, 795, 795, 795,
+        795, 794, 795, 795, 795, 795, 795, 795,
+        795, 794, 871, 872, 873, 874, 875, 876,
+        877, 878, 879, 801, 880, 881, 882, 883,
+        884, 794, 795, 794, 794, 794, 794, 794,
+        795, 795, 794, 795, 795, 795, 794, 795,
+        795, 795, 795, 795, 795, 795, 795, 795,
+        795, 794, 795, 795, 795, 794, 794, 795,
+        795, 795, 794, 794, 795, 794, 794, 795,
+        795, 795, 795, 795, 794, 794, 794, 794,
+        795, 795, 795, 795, 795, 795, 794, 795,
+        795, 795, 795, 795, 794, 885, 840, 886,
+        887, 888, 801, 889, 890, 846, 801, 794,
+        795, 795, 795, 795, 794, 794, 794, 795,
+        794, 794, 795, 795, 795, 794, 794, 794,
+        795, 795, 794, 851, 794, 846, 801, 801,
+        891, 794, 801, 794, 795, 846, 892, 893,
+        846, 894, 895, 846, 896, 897, 898, 899,
+        900, 901, 846, 902, 903, 904, 846, 905,
+        906, 907, 865, 908, 909, 910, 865, 911,
+        846, 801, 794, 794, 795, 795, 794, 794,
+        794, 795, 795, 795, 795, 794, 795, 795,
+        794, 794, 794, 794, 795, 795, 794, 794,
+        795, 795, 794, 794, 794, 794, 794, 794,
+        795, 795, 795, 794, 794, 794, 795, 794,
+        794, 794, 795, 795, 794, 795, 795, 795,
+        795, 794, 795, 795, 795, 795, 794, 795,
+        795, 795, 795, 795, 795, 794, 794, 794,
+        795, 795, 795, 795, 794, 912, 913, 794,
+        801, 794, 795, 794, 794, 795, 846, 914,
+        915, 916, 917, 896, 918, 919, 920, 921,
+        922, 923, 924, 925, 926, 927, 928, 929,
+        801, 794, 794, 795, 794, 795, 795, 795,
+        795, 795, 795, 795, 794, 795, 795, 795,
+        794, 795, 794, 794, 795, 794, 795, 794,
+        794, 795, 795, 795, 795, 794, 795, 795,
+        795, 794, 794, 795, 795, 795, 795, 794,
+        795, 795, 794, 794, 795, 795, 795, 795,
+        795, 794, 930, 931, 932, 933, 934, 935,
+        936, 937, 938, 939, 940, 936, 942, 943,
+        944, 945, 941, 794, 946, 947, 846, 948,
+        949, 950, 951, 952, 953, 954, 955, 956,
+        846, 801, 957, 958, 959, 960, 846, 961,
+        962, 963, 964, 965, 966, 967, 968, 969,
+        970, 971, 972, 973, 974, 975, 846, 877,
+        801, 976, 794, 795, 795, 795, 795, 795,
+        794, 794, 794, 795, 794, 795, 795, 794,
+        795, 794, 795, 795, 794, 794, 794, 795,
+        795, 795, 794, 794, 794, 795, 795, 795,
+        794, 794, 794, 794, 795, 794, 794, 795,
+        794, 794, 795, 795, 795, 794, 794, 795,
+        794, 795, 795, 795, 794, 795, 795, 795,
+        795, 795, 795, 794, 794, 794, 795, 795,
+        794, 795, 795, 794, 795, 795, 794, 795,
+        795, 794, 795, 795, 795, 795, 795, 795,
+        795, 794, 795, 794, 795, 794, 795, 795,
+        794, 795, 794, 795, 795, 794, 795, 794,
+        795, 794, 977, 948, 978, 979, 980, 981,
+        982, 983, 984, 985, 986, 829, 987, 846,
+        988, 989, 990, 846, 991, 861, 992, 993,
+        994, 995, 996, 997, 998, 999, 846, 794,
+        794, 794, 795, 795, 795, 794, 795, 795,
+        794, 795, 795, 794, 794, 794, 794, 794,
+        795, 795, 795, 795, 794, 795, 795, 795,
+        795, 795, 795, 794, 794, 794, 795, 795,
+        795, 795, 795, 795, 795, 795, 795, 794,
+        795, 795, 795, 795, 795, 795, 795, 795,
+        794, 795, 795, 794, 794, 794, 794, 795,
+        795, 795, 794, 794, 794, 795, 794, 794,
+        794, 795, 795, 794, 795, 795, 795, 794,
+        795, 794, 794, 794, 795, 795, 794, 795,
+        795, 795, 794, 795, 795, 795, 794, 794,
+        794, 794, 795, 846, 915, 1000, 1001, 801,
+        846, 801, 794, 794, 795, 794, 795, 846,
+        1000, 801, 794, 846, 1002, 801, 794, 794,
+        795, 846, 1003, 1004, 1005, 906, 1006, 1007,
+        846, 1008, 1009, 1010, 801, 794, 794, 795,
+        795, 795, 794, 795, 795, 794, 795, 795,
+        795, 795, 794, 794, 795, 794, 794, 795,
+        795, 794, 795, 794, 846, 801, 794, 1011,
+        846, 1012, 794, 801, 794, 795, 794, 795,
+        1013, 846, 1014, 1015, 794, 795, 794, 794,
+        794, 795, 795, 795, 795, 794, 1016, 1017,
+        1018, 846, 1019, 1020, 1021, 1022, 1023, 1024,
+        1025, 1026, 1027, 1028, 1029, 1030, 1031, 1032,
+        801, 794, 795, 795, 795, 794, 794, 794,
+        794, 795, 795, 794, 794, 795, 794, 794,
+        794, 794, 794, 794, 794, 795, 794, 795,
+        794, 794, 794, 794, 794, 794, 795, 795,
+        795, 795, 795, 794, 794, 795, 794, 794,
+        794, 795, 794, 794, 795, 794, 794, 795,
+        794, 794, 795, 794, 794, 794, 795, 795,
+        795, 794, 794, 794, 795, 795, 795, 795,
+        794, 1033, 846, 1034, 846, 1035, 1036, 1037,
+        1038, 801, 794, 795, 795, 795, 795, 795,
+        794, 794, 794, 795, 794, 794, 795, 795,
+        795, 795, 795, 795, 795, 795, 795, 795,
+        794, 795, 795, 795, 795, 795, 795, 795,
+        795, 795, 795, 795, 795, 795, 795, 795,
+        795, 795, 795, 795, 794, 795, 795, 795,
+        795, 795, 794, 1039, 846, 801, 794, 795,
+        1040, 846, 831, 801, 794, 795, 1041, 794,
+        801, 794, 795, 846, 1042, 801, 794, 794,
+        795, 1043, 794, 846, 1044, 801, 794, 794,
+        795, 1046, 1045, 795, 795, 795, 795, 1046,
+        1045, 795, 1046, 1045, 1046, 1046, 795, 1046,
+        1045, 795, 1046, 795, 1046, 1045, 795, 1046,
+        795, 1046, 795, 1045, 1046, 1046, 1046, 1046,
+        1046, 1046, 1046, 1046, 1045, 795, 795, 1046,
+        1046, 795, 1046, 795, 1046, 1045, 1046, 1046,
+        1046, 1046, 1046, 795, 1046, 795, 1046, 795,
+        1046, 1045, 1046, 1046, 795, 1046, 795, 1046,
+        1045, 1046, 1046, 1046, 1046, 1046, 795, 1046,
+        795, 1046, 1045, 795, 795, 1046, 795, 1046,
+        1045, 1046, 1046, 1046, 795, 1046, 795, 1046,
+        795, 1046, 795, 1046, 1045, 1046, 795, 1046,
+        795, 1046, 1045, 795, 1046, 1046, 1046, 1046,
+        795, 1046, 795, 1046, 795, 1046, 795, 1046,
+        795, 1046, 795, 1046, 1045, 795, 1046, 1045,
+        1046, 1046, 1046, 795, 1046, 795, 1046, 1045,
+        1046, 795, 1046, 795, 1046, 1045, 795, 1046,
+        1046, 1046, 1046, 795, 1046, 795, 1046, 1045,
+        795, 1046, 795, 1046, 795, 1046, 1045, 1046,
+        1046, 795, 1046, 795, 1046, 1045, 795, 1046,
+        795, 1046, 795, 1046, 795, 1045, 1046, 1046,
+        1046, 795, 1046, 795, 1046, 1045, 795, 1046,
+        1045, 1046, 1046, 795, 1046, 1045, 1046, 1046,
+        1046, 795, 1046, 1046, 1046, 1046, 1046, 1046,
+        795, 795, 1046, 795, 1046, 795, 1046, 795,
+        1046, 1045, 1046, 795, 1046, 795, 1046, 1045,
+        795, 1046, 1045, 1046, 795, 1046, 1045, 1046,
+        795, 1046, 1045, 795, 795, 1046, 1045, 795,
+        1046, 795, 1046, 795, 1046, 795, 1046, 795,
+        1046, 795, 1045, 1046, 1046, 795, 1046, 1046,
+        1046, 1046, 795, 795, 1046, 1046, 1046, 1046,
+        1046, 795, 1046, 1046, 1046, 1046, 1046, 1045,
+        795, 1046, 1046, 795, 1046, 795, 1045, 1046,
+        1046, 795, 1046, 1045, 795, 795, 1046, 795,
+        1045, 1046, 1046, 1045, 795, 1046, 795, 1045,
+        1046, 1045, 795, 1046, 795, 1046, 795, 1045,
+        1046, 1046, 1045, 795, 1046, 795, 1046, 795,
+        1046, 1045, 1046, 795, 1046, 795, 1046, 1045,
+        795, 1046, 1045, 795, 795, 1046, 1045, 1046,
+        795, 1045, 1046, 1045, 795, 1046, 795, 1046,
+        795, 1045, 1046, 1045, 795, 795, 1046, 1045,
+        1046, 795, 1046, 795, 1046, 1045, 795, 1046,
+        795, 1045, 1046, 1045, 795, 795, 1046, 795,
+        1045, 1046, 1045, 795, 795, 1046, 1045, 1046,
+        795, 1046, 1045, 1046, 795, 1046, 1045, 1046,
+        795, 1046, 795, 1046, 795, 1045, 1046, 1045,
+        795, 795, 1046, 1045, 1046, 795, 1046, 795,
+        1046, 1045, 795, 1046, 1045, 1046, 1046, 795,
+        1046, 795, 1046, 1045, 1045, 795, 1045, 795,
+        1046, 1046, 795, 1046, 1046, 1046, 1046, 1046,
+        1046, 1046, 1045, 795, 1046, 1046, 1046, 795,
+        1045, 1046, 1046, 1046, 795, 1046, 795, 1046,
+        795, 1046, 795, 1046, 795, 1046, 1045, 795,
+        795, 1046, 1045, 1046, 795, 1046, 1045, 795,
+        795, 1046, 795, 795, 795, 1046, 795, 1046,
+        795, 1046, 795, 1046, 795, 1045, 795, 1046,
+        795, 1046, 795, 1045, 1046, 1045, 795, 1046,
+        795, 1045, 1046, 795, 1046, 1046, 1046, 1045,
+        795, 1046, 795, 795, 1046, 795, 1045, 1046,
+        1046, 1045, 795, 1046, 1046, 1046, 1046, 795,
+        1046, 795, 1045, 1046, 1046, 1046, 795, 1046,
+        1045, 1046, 795, 1046, 795, 1046, 795, 1046,
+        795, 1046, 1045, 1046, 1046, 795, 1046, 1045,
+        795, 1046, 795, 1046, 795, 1045, 1046, 1046,
+        1045, 795, 1046, 795, 1045, 1046, 1045, 795,
+        1046, 1045, 795, 1046, 795, 1046, 1045, 1046,
+        1046, 1046, 1045, 795, 795, 795, 1046, 1045,
+        795, 1046, 795, 1045, 1046, 1045, 795, 1046,
+        795, 1046, 795, 1045, 1046, 1046, 1046, 1045,
+        795, 1046, 795, 1045, 1046, 1046, 1046, 1046,
+        1045, 795, 1046, 795, 1046, 1045, 795, 795,
+        1046, 795, 1046, 1045, 1046, 795, 1046, 795,
+        1045, 1046, 1046, 1045, 795, 1046, 795, 1046,
+        1045, 795, 1046, 1046, 1046, 795, 1046, 795,
+        1045, 795, 1046, 1045, 1046, 795, 795, 1046,
+        795, 1046, 795, 1045, 1046, 1046, 1046, 1046,
+        1045, 795, 1046, 795, 1046, 795, 1046, 795,
+        1046, 795, 1046, 1045, 1046, 1046, 1046, 795,
+        1046, 795, 1046, 795, 1046, 795, 1045, 1046,
+        1046, 795, 795, 1046, 1045, 1046, 795, 1046,
+        1046, 1045, 795, 1046, 795, 1046, 1045, 795,
+        795, 1046, 1046, 1046, 1046, 795, 1046, 795,
+        1046, 795, 1045, 1046, 1046, 795, 1045, 1046,
+        1045, 795, 1046, 795, 1045, 1046, 1045, 795,
+        1046, 795, 1045, 1046, 795, 1046, 1046, 1045,
+        795, 1046, 1046, 795, 1045, 1046, 1045, 795,
+        1046, 795, 1046, 1045, 1046, 795, 1046, 795,
+        1045, 1046, 1045, 795, 1046, 795, 1046, 795,
+        1046, 795, 1046, 795, 1046, 1045, 1047, 1045,
+        1048, 1049, 1050, 1051, 1052, 1053, 1054, 1055,
+        1056, 1057, 1058, 1050, 1059, 1060, 1061, 1062,
+        1063, 1050, 1064, 1065, 1066, 1067, 1068, 1069,
+        1070, 1071, 1072, 1073, 1074, 1075, 1076, 1077,
+        1078, 1050, 1079, 1047, 1059, 1047, 1080, 1047,
+        1045, 1046, 1046, 1046, 1046, 795, 1045, 1046,
+        1046, 1045, 795, 1046, 1045, 795, 795, 1046,
+        1045, 795, 1046, 795, 1045, 1046, 1045, 795,
+        795, 1046, 795, 1045, 1046, 1046, 1045, 795,
+        1046, 1046, 1046, 1045, 795, 1046, 795, 1046,
+        1046, 1045, 795, 795, 1046, 795, 1045, 1046,
+        1045, 795, 1046, 1045, 795, 795, 1046, 795,
+        1046, 1045, 795, 1046, 795, 795, 1046, 795,
+        1046, 795, 1045, 1046, 1046, 1045, 795, 1046,
+        1046, 795, 1046, 1045, 795, 1046, 795, 1046,
+        1045, 795, 1046, 795, 1045, 795, 1046, 1046,
+        1046, 795, 1046, 1045, 1046, 795, 1046, 1045,
+        795, 1046, 1045, 1046, 795, 1046, 1045, 795,
+        1046, 1045, 795, 1046, 795, 1046, 1045, 795,
+        1046, 1045, 795, 1046, 1045, 1081, 1082, 1083,
+        1084, 1085, 1086, 1087, 1088, 1089, 1090, 1091,
+        1092, 1052, 1093, 1094, 1095, 1096, 1097, 1094,
+        1098, 1099, 1100, 1101, 1102, 1103, 1104, 1105,
+        1106, 1047, 1045, 1046, 795, 1046, 1045, 1046,
+        795, 1046, 1045, 1046, 795, 1046, 1045, 1046,
+        795, 1046, 1045, 795, 1046, 795, 1046, 1045,
+        1046, 795, 1046, 1045, 1046, 795, 795, 795,
+        1046, 1045, 1046, 795, 1046, 1045, 1046, 1046,
+        1046, 1046, 795, 1046, 795, 1045, 1046, 1045,
+        795, 795, 1046, 795, 1046, 1045, 1046, 795,
+        1046, 1045, 795, 1046, 1045, 1046, 1046, 795,
+        1046, 1045, 795, 1046, 1045, 1046, 795, 1046,
+        1045, 795, 1046, 1045, 795, 1046, 1045, 795,
+        1046, 1045, 1046, 1045, 795, 795, 1046, 1045,
+        1046, 795, 1046, 1045, 795, 1046, 795, 1045,
+        1046, 1045, 795, 1050, 1107, 1047, 1050, 1108,
+        1050, 1109, 1059, 1047, 1045, 1046, 1045, 795,
+        1046, 1045, 795, 1050, 1108, 1059, 1047, 1045,
+        1050, 1110, 1047, 1059, 1047, 1045, 1046, 1045,
+        795, 1050, 1111, 1068, 1112, 1094, 1113, 1106,
+        1050, 1114, 1115, 1116, 1047, 1059, 1047, 1045,
+        1046, 1045, 795, 1046, 795, 1046, 1045, 795,
+        1046, 795, 1046, 795, 1045, 1046, 1046, 1045,
+        795, 1046, 795, 1046, 1045, 795, 1046, 1045,
+        1050, 1059, 801, 1045, 1117, 1050, 1118, 1059,
+        1047, 1045, 801, 1046, 1045, 795, 1046, 1045,
+        795, 1119, 1050, 1120, 1121, 1047, 1045, 795,
+        1046, 1045, 1046, 1046, 1045, 795, 795, 1046,
+        795, 1046, 1045, 1050, 1122, 1123, 1124, 1125,
+        1126, 1127, 1128, 1129, 1130, 1131, 1132, 1047,
+        1059, 1047, 1045, 1046, 795, 1046, 1046, 1046,
+        1046, 1046, 1046, 1046, 795, 1046, 795, 1046,
+        1046, 1046, 1046, 1046, 1046, 1045, 795, 1046,
+        1046, 795, 1046, 795, 1045, 1046, 795, 1046,
+        1046, 1046, 795, 1046, 1046, 795, 1046, 1046,
+        795, 1046, 1046, 795, 1046, 1046, 1045, 795,
+        1050, 1133, 1050, 1109, 1134, 1135, 1136, 1047,
+        1059, 1047, 1045, 1046, 1045, 795, 1046, 1046,
+        1046, 795, 1046, 1046, 1046, 795, 1046, 795,
+        1046, 1045, 795, 795, 795, 795, 1046, 1046,
+        795, 795, 795, 795, 795, 1046, 1046, 1046,
+        1046, 1046, 1046, 1046, 795, 1046, 795, 1046,
+        795, 1045, 1046, 1046, 1046, 795, 1046, 795,
+        1046, 1045, 1059, 801, 1137, 1050, 1059, 801,
+        1046, 1045, 795, 1138, 1050, 1139, 1059, 801,
+        1046, 1045, 795, 1046, 795, 1140, 1059, 1047,
+        1045, 801, 1046, 1045, 795, 1050, 1141, 1047,
+        1059, 1047, 1045, 1046, 1045, 795, 1142, 1143,
+        1144, 1142, 1145, 1146, 1147, 1148, 1149, 1150,
+        1151, 1152, 1153, 1154, 672, 672, 422, 1155,
+        1156, 1157, 1158, 672, 1161, 1162, 1164, 1165,
+        1166, 1160, 1167, 1168, 1169, 1170, 1171, 1172,
+        1173, 1174, 1175, 1176, 1177, 1178, 1179, 1180,
+        1181, 1182, 1183, 1184, 1185, 1186, 1188, 1189,
+        1190, 1191, 1192, 1193, 672, 1148, 10, 1148,
+        422, 1148, 422, 1160, 1163, 1187, 1194, 1159,
+        1142, 1142, 1195, 1143, 1196, 1198, 1197, 2,
+        1, 1199, 1197, 1200, 1197, 5, 1, 1197,
+        6, 5, 9, 11, 11, 10, 1202, 1203,
+        1204, 1197, 1205, 1206, 1197, 1207, 1197, 422,
+        422, 1209, 1210, 491, 472, 1211, 472, 1212,
+        1213, 1214, 1215, 1216, 1217, 1218, 1219, 1220,
+        1221, 1222, 546, 1223, 522, 1224, 1225, 1226,
+        1227, 1228, 1229, 1230, 1231, 1232, 1233, 1234,
+        1235, 422, 422, 422, 427, 567, 1208, 1236,
+        1197, 1237, 1197, 672, 1238, 422, 422, 422,
+        672, 1238, 672, 672, 422, 1238, 422, 1238,
+        422, 1238, 422, 672, 672, 672, 672, 672,
+        1238, 422, 672, 672, 672, 422, 672, 422,
+        1238, 422, 672, 672, 672, 672, 422, 1238,
+        672, 422, 672, 422, 672, 422, 672, 672,
+        422, 672, 1238, 422, 672, 422, 672, 422,
+        672, 1238, 672, 422, 1238, 672, 422, 672,
+        422, 1238, 672, 672, 672, 672, 672, 1238,
+        422, 422, 672, 422, 672, 1238, 672, 422,
+        1238, 672, 672, 1238, 422, 422, 672, 422,
+        672, 422, 672, 1238, 1239, 1240, 1241, 1242,
+        1243, 1244, 1245, 1246, 1247, 1248, 1249, 717,
+        1250, 1251, 1252, 1253, 1254, 1255, 1256, 1257,
+        1258, 1259, 1260, 1261, 1260, 1262, 1263, 1264,
+        1265, 1266, 673, 1238, 1267, 1268, 1269, 1270,
+        1271, 1272, 1273, 1274, 1275, 1276, 1277, 1278,
+        1279, 1280, 1281, 1282, 1283, 1284, 1285, 727,
+        1286, 1287, 1288, 694, 1289, 1290, 1291, 1292,
+        1293, 1294, 673, 1295, 1296, 1297, 1298, 1299,
+        1300, 1301, 1302, 676, 1303, 673, 676, 1304,
+        1305, 1306, 1307, 685, 1238, 1308, 1309, 1310,
+        1311, 705, 1312, 1313, 685, 1314, 1315, 1316,
+        1317, 1318, 673, 1238, 1319, 1278, 1320, 1321,
+        1322, 685, 1323, 1324, 676, 673, 685, 427,
+        1238, 1288, 673, 676, 685, 427, 685, 427,
+        1325, 685, 1238, 427, 676, 1326, 1327, 676,
+        1328, 1329, 683, 1330, 1331, 1332, 1333, 1334,
+        1284, 1335, 1336, 1337, 1338, 1339, 1340, 1341,
+        1342, 1343, 1344, 1345, 1346, 1303, 1347, 676,
+        685, 427, 1238, 1348, 1349, 685, 673, 1238,
+        427, 673, 1238, 676, 1350, 733, 1351, 1352,
+        1353, 1354, 1355, 1356, 1357, 1358, 673, 1359,
+        1360, 1361, 1362, 1363, 1364, 673, 685, 1238,
+        1366, 1367, 1368, 1369, 1370, 1371, 1372, 1373,
+        1374, 1375, 1376, 1372, 1378, 1379, 1380, 1381,
+        1365, 1377, 1365, 1238, 1365, 1238, 1382, 1382,
+        1383, 1384, 1385, 1386, 1387, 1388, 1389, 1390,
+        1387, 771, 1391, 1391, 1391, 1392, 1393, 1386,
+        1391, 772, 773, 1394, 1391, 771, 1395, 1395,
+        1395, 1397, 1398, 1399, 1395, 1400, 1401, 1402,
+        1395, 1396, 1403, 1403, 1403, 1405, 1406, 1407,
+        1403, 1408, 1409, 1410, 1403, 1404, 1391, 1391,
+        1411, 1412, 1386, 1391, 772, 773, 1394, 1391,
+        771, 1413, 1414, 1415, 771, 1416, 1417, 1418,
+        769, 769, 769, 769, 1420, 1421, 1422, 1396,
+        769, 1423, 1424, 1425, 769, 1419, 770, 770,
+        770, 1427, 1428, 1429, 1396, 770, 1430, 1431,
+        1432, 770, 1426, 769, 769, 769, 1434, 1435,
+        1436, 1404, 769, 1437, 1438, 1439, 769, 1433,
+        1395, 1395, 771, 1440, 1441, 1399, 1395, 1400,
+        1401, 1402, 1395, 1396, 1442, 1443, 1444, 771,
+        1445, 1446, 1447, 770, 770, 770, 770, 1449,
+        1450, 1451, 1404, 770, 1452, 1453, 1454, 770,
+        1448, 1403, 1403, 771, 1455, 1456, 1407, 1403,
+        1408, 1409, 1410, 1403, 1404, 1403, 1403, 1403,
+        1405, 1406, 1407, 771, 1408, 1409, 1410, 1403,
+        1404, 1403, 1403, 1403, 1405, 1406, 1407, 772,
+        1408, 1409, 1410, 1403, 1404, 1403, 1403, 1403,
+        1405, 1406, 1407, 773, 1408, 1409, 1410, 1403,
+        1404, 1395, 1395, 1395, 1397, 1398, 1399, 771,
+        1400, 1401, 1402, 1395, 1396, 1395, 1395, 1395,
+        1397, 1398, 1399, 772, 1400, 1401, 1402, 1395,
+        1396, 1395, 1395, 1395, 1397, 1398, 1399, 773,
+        1400, 1401, 1402, 1395, 1396, 1458, 769, 1460,
+        1459, 1461, 770, 1463, 1462, 771, 1464, 775,
+        1464, 1465, 1464, 777, 1466, 1467, 1468, 1469,
+        1470, 1471, 1472, 1469, 781, 777, 1466, 1474,
+        1475, 1473, 782, 783, 1476, 1473, 781, 1479,
+        1480, 1481, 1482, 1477, 1483, 1484, 1485, 1477,
+        1478, 1488, 1489, 1490, 1491, 1486, 1492, 1493,
+        1494, 1486, 1487, 1496, 1495, 1498, 1497, 781,
+        1499, 782, 1499, 783, 1499, 787, 1500, 1501,
+        1502, 1503, 1504, 1505, 1506, 1503, 789, 787,
+        1500, 1508, 1507, 790, 791, 1509, 1507, 789,
+        1511, 1510, 1513, 1512, 789, 1514, 790, 1514,
+        791, 1514, 795, 1517, 1518, 1520, 1521, 1522,
+        1516, 1523, 1524, 1525, 1526, 1527, 1528, 1529,
+        1530, 1531, 1532, 1533, 1534, 1535, 1536, 1537,
+        1538, 1539, 1540, 1541, 1542, 1544, 1545, 1546,
+        1547, 1548, 1549, 795, 795, 1515, 1516, 1519,
+        1543, 1550, 1515, 1046, 795, 795, 1552, 1553,
+        865, 846, 1554, 846, 1555, 1556, 1557, 1558,
+        1559, 1560, 1561, 1562, 1563, 1564, 1565, 920,
+        1566, 896, 1567, 1568, 1569, 1570, 1571, 1572,
+        1573, 1574, 1575, 1576, 1577, 1578, 795, 795,
+        795, 801, 941, 1551, 1046, 1579, 795, 795,
+        795, 1046, 1579, 1046, 1046, 795, 1579, 795,
+        1579, 795, 1579, 795, 1046, 1046, 1046, 1046,
+        1046, 1579, 795, 1046, 1046, 1046, 795, 1046,
+        795, 1579, 795, 1046, 1046, 1046, 1046, 795,
+        1579, 1046, 795, 1046, 795, 1046, 795, 1046,
+        1046, 795, 1046, 1579, 795, 1046, 795, 1046,
+        795, 1046, 1579, 1046, 795, 1579, 1046, 795,
+        1046, 795, 1579, 1046, 1046, 1046, 1046, 1046,
+        1579, 795, 795, 1046, 795, 1046, 1579, 1046,
+        795, 1579, 1046, 1046, 1579, 795, 795, 1046,
+        795, 1046, 795, 1046, 1579, 1580, 1581, 1582,
+        1583, 1584, 1585, 1586, 1587, 1588, 1589, 1590,
+        1091, 1591, 1592, 1593, 1594, 1595, 1596, 1597,
+        1598, 1599, 1600, 1601, 1602, 1601, 1603, 1604,
+        1605, 1606, 1607, 1047, 1579, 1608, 1609, 1610,
+        1611, 1612, 1613, 1614, 1615, 1616, 1617, 1618,
+        1619, 1620, 1621, 1622, 1623, 1624, 1625, 1626,
+        1101, 1627, 1628, 1629, 1068, 1630, 1631, 1632,
+        1633, 1634, 1635, 1047, 1636, 1637, 1638, 1639,
+        1640, 1641, 1642, 1643, 1050, 1644, 1047, 1050,
+        1645, 1646, 1647, 1648, 1059, 1579, 1649, 1650,
+        1651, 1652, 1079, 1653, 1654, 1059, 1655, 1656,
+        1657, 1658, 1659, 1047, 1579, 1660, 1619, 1661,
+        1662, 1663, 1059, 1664, 1665, 1050, 1047, 1059,
+        801, 1579, 1629, 1047, 1050, 1059, 801, 1059,
+        801, 1666, 1059, 1579, 801, 1050, 1667, 1668,
+        1050, 1669, 1670, 1057, 1671, 1672, 1673, 1674,
+        1675, 1625, 1676, 1677, 1678, 1679, 1680, 1681,
+        1682, 1683, 1684, 1685, 1686, 1687, 1644, 1688,
+        1050, 1059, 801, 1579, 1689, 1690, 1059, 1047,
+        1579, 801, 1047, 1579, 1050, 1691, 1107, 1692,
+        1693, 1694, 1695, 1696, 1697, 1698, 1699, 1047,
+        1700, 1701, 1702, 1703, 1704, 1705, 1047, 1059,
+        1579, 1707, 1708, 1709, 1710, 1711, 1712, 1713,
+        1714, 1715, 1716, 1717, 1713, 1719, 1720, 1721,
+        1722, 1706, 1718, 1706, 1579, 1706, 1579,
+}
+
+var _hcltok_trans_targs []int16 = []int16{
+        1464, 1, 1464, 1464, 1464, 3, 4, 1472,
+        1464, 5, 1473, 6, 7, 9, 10, 287,
+        13, 14, 15, 16, 17, 288, 289, 20,
+        290, 22, 23, 291, 292, 293, 294, 295,
+        296, 297, 298, 299, 300, 329, 349, 354,
+        128, 129, 130, 357, 152, 372, 376, 1464,
+        11, 12, 18, 19, 21, 24, 25, 26,
+        27, 28, 29, 30, 31, 32, 33, 65,
+        106, 121, 132, 155, 171, 284, 34, 35,
+        36, 37, 38, 39, 40, 41, 42, 43,
+        44, 45, 46, 47, 48, 49, 50, 51,
+        52, 53, 54, 55, 56, 57, 58, 59,
+        60, 61, 62, 63, 64, 66, 67, 68,
+        69, 70, 71, 72, 73, 74, 75, 76,
+        77, 78, 79, 80, 81, 82, 83, 84,
+        85, 86, 87, 88, 89, 90, 91, 92,
+        93, 94, 95, 96, 97, 98, 99, 100,
+        101, 102, 103, 104, 105, 107, 108, 109,
+        110, 111, 112, 113, 114, 115, 116, 117,
+        118, 119, 120, 122, 123, 124, 125, 126,
+        127, 131, 133, 134, 135, 136, 137, 138,
+        139, 140, 141, 142, 143, 144, 145, 146,
+        147, 148, 149, 150, 151, 153, 154, 156,
+        157, 158, 159, 160, 161, 162, 163, 164,
+        165, 166, 167, 168, 169, 170, 172, 204,
+        228, 231, 232, 234, 243, 244, 247, 251,
+        269, 276, 278, 280, 282, 173, 174, 175,
+        176, 177, 178, 179, 180, 181, 182, 183,
+        184, 185, 186, 187, 188, 189, 190, 191,
+        192, 193, 194, 195, 196, 197, 198, 199,
+        200, 201, 202, 203, 205, 206, 207, 208,
+        209, 210, 211, 212, 213, 214, 215, 216,
+        217, 218, 219, 220, 221, 222, 223, 224,
+        225, 226, 227, 229, 230, 233, 235, 236,
+        237, 238, 239, 240, 241, 242, 245, 246,
+        248, 249, 250, 252, 253, 254, 255, 256,
+        257, 258, 259, 260, 261, 262, 263, 264,
+        265, 266, 267, 268, 270, 271, 272, 273,
+        274, 275, 277, 279, 281, 283, 285, 286,
+        301, 302, 303, 304, 305, 306, 307, 308,
+        309, 310, 311, 312, 313, 314, 315, 316,
+        317, 318, 319, 320, 321, 322, 323, 324,
+        325, 326, 327, 328, 330, 331, 332, 333,
+        334, 335, 336, 337, 338, 339, 340, 341,
+        342, 343, 344, 345, 346, 347, 348, 350,
+        351, 352, 353, 355, 356, 358, 359, 360,
+        361, 362, 363, 364, 365, 366, 367, 368,
+        369, 370, 371, 373, 374, 375, 377, 383,
+        405, 410, 412, 414, 378, 379, 380, 381,
+        382, 384, 385, 386, 387, 388, 389, 390,
+        391, 392, 393, 394, 395, 396, 397, 398,
+        399, 400, 401, 402, 403, 404, 406, 407,
+        408, 409, 411, 413, 415, 1464, 1477, 438,
+        439, 440, 441, 418, 442, 443, 444, 445,
+        446, 447, 448, 449, 450, 451, 452, 453,
+        454, 455, 456, 457, 458, 459, 460, 461,
+        462, 463, 464, 465, 466, 467, 468, 470,
+        471, 472, 473, 474, 475, 476, 477, 478,
+        479, 480, 481, 482, 483, 484, 485, 486,
+        420, 487, 488, 489, 490, 491, 492, 493,
+        494, 495, 496, 497, 498, 499, 500, 501,
+        502, 503, 504, 419, 505, 506, 507, 508,
+        509, 511, 512, 513, 514, 515, 516, 517,
+        518, 519, 520, 521, 522, 523, 524, 526,
+        527, 528, 529, 530, 531, 535, 537, 538,
+        539, 540, 435, 541, 542, 543, 544, 545,
+        546, 547, 548, 549, 550, 551, 552, 553,
+        554, 555, 557, 558, 560, 561, 562, 563,
+        564, 565, 433, 566, 567, 568, 569, 570,
+        571, 572, 573, 574, 576, 608, 632, 635,
+        636, 638, 647, 648, 651, 655, 673, 533,
+        680, 682, 684, 686, 577, 578, 579, 580,
+        581, 582, 583, 584, 585, 586, 587, 588,
+        589, 590, 591, 592, 593, 594, 595, 596,
+        597, 598, 599, 600, 601, 602, 603, 604,
+        605, 606, 607, 609, 610, 611, 612, 613,
+        614, 615, 616, 617, 618, 619, 620, 621,
+        622, 623, 624, 625, 626, 627, 628, 629,
+        630, 631, 633, 634, 637, 639, 640, 641,
+        642, 643, 644, 645, 646, 649, 650, 652,
+        653, 654, 656, 657, 658, 659, 660, 661,
+        662, 663, 664, 665, 666, 667, 668, 669,
+        670, 671, 672, 674, 675, 676, 677, 678,
+        679, 681, 683, 685, 687, 689, 690, 1464,
+        1464, 691, 828, 829, 760, 830, 831, 832,
+        833, 834, 835, 789, 836, 725, 837, 838,
+        839, 840, 841, 842, 843, 844, 745, 845,
+        846, 847, 848, 849, 850, 851, 852, 853,
+        854, 770, 855, 857, 858, 859, 860, 861,
+        862, 863, 864, 865, 866, 703, 867, 868,
+        869, 870, 871, 872, 873, 874, 875, 741,
+        876, 877, 878, 879, 880, 811, 882, 883,
+        886, 888, 889, 890, 891, 892, 893, 896,
+        897, 899, 900, 901, 903, 904, 905, 906,
+        907, 908, 909, 910, 911, 912, 913, 915,
+        916, 917, 918, 921, 923, 924, 926, 928,
+        1515, 1517, 1518, 1516, 931, 932, 1515, 934,
+        1541, 1541, 1541, 1543, 1544, 1542, 939, 940,
+        1545, 1546, 1550, 1550, 1550, 1551, 946, 947,
+        1552, 1553, 1557, 1558, 1557, 973, 974, 975,
+        976, 953, 977, 978, 979, 980, 981, 982,
+        983, 984, 985, 986, 987, 988, 989, 990,
+        991, 992, 993, 994, 995, 996, 997, 998,
+        999, 1000, 1001, 1002, 1003, 1005, 1006, 1007,
+        1008, 1009, 1010, 1011, 1012, 1013, 1014, 1015,
+        1016, 1017, 1018, 1019, 1020, 1021, 955, 1022,
+        1023, 1024, 1025, 1026, 1027, 1028, 1029, 1030,
+        1031, 1032, 1033, 1034, 1035, 1036, 1037, 1038,
+        1039, 954, 1040, 1041, 1042, 1043, 1044, 1046,
+        1047, 1048, 1049, 1050, 1051, 1052, 1053, 1054,
+        1055, 1056, 1057, 1058, 1059, 1061, 1062, 1063,
+        1064, 1065, 1066, 1070, 1072, 1073, 1074, 1075,
+        970, 1076, 1077, 1078, 1079, 1080, 1081, 1082,
+        1083, 1084, 1085, 1086, 1087, 1088, 1089, 1090,
+        1092, 1093, 1095, 1096, 1097, 1098, 1099, 1100,
+        968, 1101, 1102, 1103, 1104, 1105, 1106, 1107,
+        1108, 1109, 1111, 1143, 1167, 1170, 1171, 1173,
+        1182, 1183, 1186, 1190, 1208, 1068, 1215, 1217,
+        1219, 1221, 1112, 1113, 1114, 1115, 1116, 1117,
+        1118, 1119, 1120, 1121, 1122, 1123, 1124, 1125,
+        1126, 1127, 1128, 1129, 1130, 1131, 1132, 1133,
+        1134, 1135, 1136, 1137, 1138, 1139, 1140, 1141,
+        1142, 1144, 1145, 1146, 1147, 1148, 1149, 1150,
+        1151, 1152, 1153, 1154, 1155, 1156, 1157, 1158,
+        1159, 1160, 1161, 1162, 1163, 1164, 1165, 1166,
+        1168, 1169, 1172, 1174, 1175, 1176, 1177, 1178,
+        1179, 1180, 1181, 1184, 1185, 1187, 1188, 1189,
+        1191, 1192, 1193, 1194, 1195, 1196, 1197, 1198,
+        1199, 1200, 1201, 1202, 1203, 1204, 1205, 1206,
+        1207, 1209, 1210, 1211, 1212, 1213, 1214, 1216,
+        1218, 1220, 1222, 1224, 1225, 1557, 1557, 1226,
+        1363, 1364, 1295, 1365, 1366, 1367, 1368, 1369,
+        1370, 1324, 1371, 1260, 1372, 1373, 1374, 1375,
+        1376, 1377, 1378, 1379, 1280, 1380, 1381, 1382,
+        1383, 1384, 1385, 1386, 1387, 1388, 1389, 1305,
+        1390, 1392, 1393, 1394, 1395, 1396, 1397, 1398,
+        1399, 1400, 1401, 1238, 1402, 1403, 1404, 1405,
+        1406, 1407, 1408, 1409, 1410, 1276, 1411, 1412,
+        1413, 1414, 1415, 1346, 1417, 1418, 1421, 1423,
+        1424, 1425, 1426, 1427, 1428, 1431, 1432, 1434,
+        1435, 1436, 1438, 1439, 1440, 1441, 1442, 1443,
+        1444, 1445, 1446, 1447, 1448, 1450, 1451, 1452,
+        1453, 1456, 1458, 1459, 1461, 1463, 1465, 1464,
+        1466, 1467, 1464, 1468, 1464, 1469, 1470, 1471,
+        1474, 1475, 1476, 1464, 1478, 1464, 1479, 1464,
+        1480, 1481, 1482, 1483, 1484, 1485, 1486, 1487,
+        1488, 1489, 1490, 1491, 1492, 1493, 1494, 1495,
+        1496, 1497, 1498, 1499, 1500, 1501, 1502, 1503,
+        1504, 1505, 1506, 1507, 1508, 1509, 1510, 1511,
+        1512, 1513, 1514, 1464, 1464, 1464, 1464, 1464,
+        2, 1464, 1464, 8, 1464, 1464, 1464, 1464,
+        1464, 416, 417, 421, 422, 423, 424, 425,
+        426, 427, 428, 429, 430, 431, 432, 434,
+        436, 437, 469, 510, 525, 532, 534, 536,
+        556, 559, 575, 688, 1464, 1464, 1464, 692,
+        693, 694, 695, 696, 697, 698, 699, 700,
+        701, 702, 704, 705, 706, 707, 708, 709,
+        710, 711, 712, 713, 714, 715, 716, 717,
+        718, 719, 720, 721, 722, 723, 724, 726,
+        727, 728, 729, 730, 731, 732, 733, 734,
+        735, 736, 737, 738, 739, 740, 742, 743,
+        744, 746, 747, 748, 749, 750, 751, 752,
+        753, 754, 755, 756, 757, 758, 759, 761,
+        762, 763, 764, 765, 766, 767, 768, 769,
+        771, 772, 773, 774, 775, 776, 777, 778,
+        779, 780, 781, 782, 783, 784, 785, 786,
+        787, 788, 790, 791, 792, 793, 794, 795,
+        796, 797, 798, 799, 800, 801, 802, 803,
+        804, 805, 806, 807, 808, 809, 810, 812,
+        813, 814, 815, 816, 817, 818, 819, 820,
+        821, 822, 823, 824, 825, 826, 827, 856,
+        881, 884, 885, 887, 894, 895, 898, 902,
+        914, 919, 920, 922, 925, 927, 1515, 1515,
+        1534, 1536, 1519, 1515, 1538, 1539, 1540, 1515,
+        929, 930, 933, 1515, 1516, 929, 930, 1519,
+        931, 932, 933, 1515, 1516, 929, 930, 1519,
+        931, 932, 933, 1520, 1525, 1521, 1522, 1524,
+        1531, 1532, 1533, 1517, 1521, 1522, 1524, 1531,
+        1532, 1533, 1518, 1523, 1526, 1527, 1528, 1529,
+        1530, 1517, 1521, 1522, 1524, 1531, 1532, 1533,
+        1520, 1525, 1523, 1526, 1527, 1528, 1529, 1530,
+        1518, 1523, 1526, 1527, 1528, 1529, 1530, 1520,
+        1525, 1515, 1535, 1515, 1515, 1537, 1515, 1515,
+        1515, 935, 936, 942, 943, 1541, 1547, 1548,
+        1549, 1541, 937, 938, 941, 1541, 1542, 1541,
+        936, 937, 938, 939, 940, 941, 1541, 1542,
+        1541, 936, 937, 938, 939, 940, 941, 1541,
+        1541, 1541, 1541, 1541, 944, 949, 950, 1550,
+        1554, 1555, 1556, 1550, 945, 948, 1550, 1550,
+        1550, 1550, 1550, 1557, 1559, 1560, 1561, 1562,
+        1563, 1564, 1565, 1566, 1567, 1568, 1569, 1570,
+        1571, 1572, 1573, 1574, 1575, 1576, 1577, 1578,
+        1579, 1580, 1581, 1582, 1583, 1584, 1585, 1586,
+        1587, 1588, 1589, 1590, 1591, 1592, 1593, 1557,
+        951, 952, 956, 957, 958, 959, 960, 961,
+        962, 963, 964, 965, 966, 967, 969, 971,
+        972, 1004, 1045, 1060, 1067, 1069, 1071, 1091,
+        1094, 1110, 1223, 1557, 1227, 1228, 1229, 1230,
+        1231, 1232, 1233, 1234, 1235, 1236, 1237, 1239,
+        1240, 1241, 1242, 1243, 1244, 1245, 1246, 1247,
+        1248, 1249, 1250, 1251, 1252, 1253, 1254, 1255,
+        1256, 1257, 1258, 1259, 1261, 1262, 1263, 1264,
+        1265, 1266, 1267, 1268, 1269, 1270, 1271, 1272,
+        1273, 1274, 1275, 1277, 1278, 1279, 1281, 1282,
+        1283, 1284, 1285, 1286, 1287, 1288, 1289, 1290,
+        1291, 1292, 1293, 1294, 1296, 1297, 1298, 1299,
+        1300, 1301, 1302, 1303, 1304, 1306, 1307, 1308,
+        1309, 1310, 1311, 1312, 1313, 1314, 1315, 1316,
+        1317, 1318, 1319, 1320, 1321, 1322, 1323, 1325,
+        1326, 1327, 1328, 1329, 1330, 1331, 1332, 1333,
+        1334, 1335, 1336, 1337, 1338, 1339, 1340, 1341,
+        1342, 1343, 1344, 1345, 1347, 1348, 1349, 1350,
+        1351, 1352, 1353, 1354, 1355, 1356, 1357, 1358,
+        1359, 1360, 1361, 1362, 1391, 1416, 1419, 1420,
+        1422, 1429, 1430, 1433, 1437, 1449, 1454, 1455,
+        1457, 1460, 1462,
+}
+
+var _hcltok_trans_actions []byte = []byte{
+        151, 0, 93, 147, 109, 0, 0, 201,
+        143, 0, 13, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 123,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 145, 198, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 149,
+        127, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        35, 13, 13, 13, 0, 0, 37, 0,
+        57, 43, 55, 180, 180, 180, 0, 0,
+        0, 0, 77, 63, 75, 186, 0, 0,
+        0, 0, 87, 192, 91, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 89, 81, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 95,
+        0, 0, 121, 210, 113, 0, 13, 204,
+        13, 0, 0, 115, 0, 117, 0, 125,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 13, 13,
+        13, 207, 207, 207, 207, 207, 207, 13,
+        13, 207, 13, 129, 141, 137, 99, 105,
+        0, 135, 131, 0, 103, 97, 111, 101,
+        133, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 107, 119, 139, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 21, 19,
+        0, 0, 13, 23, 0, 13, 13, 29,
+        0, 0, 0, 153, 174, 1, 1, 174,
+        1, 1, 1, 156, 177, 3, 3, 177,
+        3, 3, 3, 0, 0, 0, 0, 13,
+        13, 13, 13, 174, 1, 1, 174, 174,
+        174, 174, 174, 1, 1, 174, 174, 174,
+        174, 177, 3, 3, 177, 177, 177, 177,
+        1, 1, 0, 0, 13, 13, 13, 13,
+        177, 3, 3, 177, 177, 177, 177, 3,
+        3, 31, 0, 25, 15, 0, 27, 17,
+        33, 0, 0, 0, 0, 45, 0, 183,
+        183, 51, 0, 0, 0, 162, 213, 159,
+        5, 5, 5, 5, 5, 5, 168, 217,
+        165, 7, 7, 7, 7, 7, 7, 47,
+        39, 49, 41, 53, 0, 0, 0, 65,
+        0, 189, 189, 71, 0, 0, 67, 59,
+        69, 61, 73, 79, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 13, 13, 13, 195, 195, 195,
+        195, 195, 195, 13, 13, 195, 13, 83,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 85, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0,
+}
+
+var _hcltok_to_state_actions []byte = []byte{
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        9, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 9, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 171, 0, 0,
+        0, 0, 0, 0, 0, 0, 171, 0,
+        0, 0, 0, 0, 0, 9, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0,
+}
+
+var _hcltok_from_state_actions []byte = []byte{
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        11, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 11, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 11, 0, 0,
+        0, 0, 0, 0, 0, 0, 11, 0,
+        0, 0, 0, 0, 0, 11, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0,
+}
+
+var _hcltok_eof_trans []int16 = []int16{
+        0, 1, 4, 1, 1, 9, 9, 9,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        4, 4, 4, 4, 4, 4, 4, 4,
+        422, 422, 1, 422, 422, 422, 422, 422,
+        422, 422, 422, 422, 422, 422, 422, 422,
+        422, 422, 422, 422, 422, 422, 422, 422,
+        422, 422, 422, 422, 422, 422, 422, 422,
+        422, 422, 422, 422, 422, 422, 422, 422,
+        422, 422, 422, 422, 422, 422, 422, 422,
+        422, 422, 422, 422, 422, 422, 422, 422,
+        422, 422, 422, 422, 422, 422, 422, 422,
+        422, 422, 422, 422, 422, 422, 422, 422,
+        422, 422, 422, 422, 422, 422, 422, 422,
+        422, 422, 422, 422, 422, 422, 422, 422,
+        422, 422, 422, 422, 422, 422, 422, 422,
+        422, 422, 422, 422, 422, 422, 422, 422,
+        422, 422, 422, 422, 422, 422, 422, 422,
+        422, 422, 422, 422, 422, 422, 422, 422,
+        422, 422, 422, 422, 422, 422, 422, 422,
+        422, 422, 422, 422, 422, 422, 422, 422,
+        422, 422, 422, 422, 422, 422, 422, 422,
+        422, 422, 422, 422, 422, 422, 422, 422,
+        422, 422, 422, 422, 422, 422, 422, 422,
+        422, 422, 422, 422, 422, 422, 422, 422,
+        422, 422, 422, 422, 422, 422, 422, 422,
+        422, 422, 422, 422, 422, 422, 422, 422,
+        422, 422, 422, 422, 422, 422, 422, 422,
+        422, 422, 422, 422, 422, 422, 422, 422,
+        422, 422, 422, 422, 422, 422, 422, 422,
+        422, 422, 422, 422, 422, 422, 422, 422,
+        422, 422, 422, 422, 422, 422, 422, 422,
+        422, 422, 422, 422, 422, 422, 422, 422,
+        422, 422, 422, 422, 422, 422, 422, 422,
+        422, 422, 422, 422, 422, 422, 422, 422,
+        422, 422, 422, 422, 422, 422, 422, 422,
+        422, 422, 422, 422, 422, 422, 422, 422,
+        422, 422, 422, 422, 422, 422, 422, 422,
+        422, 422, 422, 672, 672, 672, 672, 672,
+        672, 672, 672, 672, 672, 672, 672, 672,
+        672, 672, 672, 672, 672, 672, 672, 672,
+        672, 672, 672, 672, 672, 672, 672, 672,
+        672, 672, 672, 672, 672, 672, 672, 672,
+        672, 672, 672, 672, 672, 672, 672, 672,
+        672, 672, 672, 672, 672, 672, 672, 672,
+        672, 672, 672, 672, 672, 672, 672, 672,
+        672, 672, 672, 672, 672, 672, 672, 672,
+        672, 672, 672, 672, 672, 672, 672, 672,
+        672, 672, 672, 672, 672, 672, 672, 672,
+        672, 672, 672, 672, 672, 672, 672, 672,
+        672, 672, 672, 672, 672, 672, 672, 672,
+        672, 672, 672, 672, 672, 672, 672, 672,
+        672, 672, 672, 672, 672, 672, 672, 672,
+        672, 672, 672, 672, 672, 672, 672, 672,
+        672, 672, 672, 672, 672, 672, 672, 672,
+        672, 672, 672, 672, 672, 672, 672, 672,
+        672, 672, 672, 672, 672, 672, 672, 672,
+        672, 672, 672, 672, 672, 672, 672, 672,
+        672, 672, 672, 672, 672, 672, 672, 672,
+        672, 672, 672, 672, 672, 672, 672, 672,
+        672, 672, 672, 672, 672, 672, 672, 672,
+        672, 672, 672, 672, 672, 672, 672, 672,
+        672, 672, 672, 672, 672, 672, 672, 672,
+        672, 672, 672, 672, 672, 672, 672, 672,
+        672, 672, 672, 672, 672, 672, 672, 672,
+        672, 672, 672, 672, 672, 672, 672, 672,
+        672, 672, 672, 672, 672, 672, 672, 672,
+        672, 672, 672, 672, 672, 672, 672, 672,
+        672, 769, 769, 769, 769, 769, 775, 775,
+        777, 779, 779, 777, 777, 779, 0, 0,
+        787, 789, 787, 787, 789, 0, 0, 795,
+        795, 797, 795, 795, 795, 795, 795, 795,
+        795, 795, 795, 795, 795, 795, 795, 795,
+        795, 795, 795, 795, 795, 795, 795, 795,
+        795, 795, 795, 795, 795, 795, 795, 795,
+        795, 795, 795, 795, 795, 795, 795, 795,
+        795, 795, 795, 795, 795, 795, 795, 795,
+        795, 795, 795, 795, 795, 795, 795, 795,
+        795, 795, 795, 795, 795, 795, 795, 795,
+        795, 795, 795, 795, 795, 795, 795, 795,
+        795, 795, 795, 795, 795, 795, 795, 795,
+        795, 795, 795, 795, 795, 795, 795, 795,
+        795, 795, 795, 795, 795, 795, 795, 795,
+        795, 795, 795, 795, 795, 795, 795, 795,
+        795, 795, 795, 795, 795, 795, 795, 795,
+        795, 795, 795, 795, 795, 795, 795, 795,
+        795, 795, 795, 795, 795, 795, 795, 795,
+        795, 795, 795, 795, 795, 795, 795, 795,
+        795, 795, 795, 795, 795, 795, 795, 795,
+        795, 795, 795, 795, 795, 795, 795, 795,
+        795, 795, 795, 795, 795, 795, 795, 795,
+        795, 795, 795, 795, 795, 795, 795, 795,
+        795, 795, 795, 795, 795, 795, 795, 795,
+        795, 795, 795, 795, 795, 795, 795, 795,
+        795, 795, 795, 795, 795, 795, 795, 795,
+        795, 795, 795, 795, 795, 795, 795, 795,
+        795, 795, 795, 795, 795, 795, 795, 795,
+        795, 795, 795, 795, 795, 795, 795, 795,
+        795, 795, 795, 795, 795, 795, 795, 795,
+        795, 795, 795, 795, 795, 795, 795, 795,
+        795, 795, 795, 795, 795, 795, 795, 795,
+        795, 795, 795, 795, 795, 795, 795, 795,
+        795, 795, 795, 795, 795, 795, 795, 795,
+        795, 795, 795, 795, 795, 795, 795, 795,
+        795, 795, 795, 795, 795, 795, 795, 795,
+        795, 795, 1046, 1046, 1046, 1046, 1046, 1046,
+        1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046,
+        1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046,
+        1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046,
+        1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046,
+        1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046,
+        1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046,
+        1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046,
+        1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046,
+        1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046,
+        1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046,
+        1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046,
+        1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046,
+        1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046,
+        1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046,
+        1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046,
+        1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046,
+        1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046,
+        1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046,
+        1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046,
+        1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046,
+        1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046,
+        1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046,
+        1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046,
+        1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046,
+        1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046,
+        1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046,
+        1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046,
+        1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046,
+        1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046,
+        0, 1196, 1197, 1198, 1197, 1198, 1198, 1198,
+        1202, 1203, 1198, 1198, 1198, 1209, 1198, 1198,
+        1239, 1239, 1239, 1239, 1239, 1239, 1239, 1239,
+        1239, 1239, 1239, 1239, 1239, 1239, 1239, 1239,
+        1239, 1239, 1239, 1239, 1239, 1239, 1239, 1239,
+        1239, 1239, 1239, 1239, 1239, 1239, 1239, 1239,
+        1239, 1239, 1239, 0, 1392, 1396, 1404, 1392,
+        1392, 1396, 1396, 1404, 1396, 1392, 1404, 1404,
+        1404, 1404, 1404, 1396, 1396, 1396, 1458, 1460,
+        1458, 1463, 1465, 1465, 1465, 0, 1474, 1478,
+        1487, 1496, 1498, 1500, 1500, 1500, 0, 1508,
+        1511, 1513, 1515, 1515, 1515, 0, 1552, 1580,
+        1580, 1580, 1580, 1580, 1580, 1580, 1580, 1580,
+        1580, 1580, 1580, 1580, 1580, 1580, 1580, 1580,
+        1580, 1580, 1580, 1580, 1580, 1580, 1580, 1580,
+        1580, 1580, 1580, 1580, 1580, 1580, 1580, 1580,
+        1580, 1580,
+}
+
+const hcltok_start int = 1464
+const hcltok_first_final int = 1464
+const hcltok_error int = 0
+
+const hcltok_en_stringTemplate int = 1515
+const hcltok_en_heredocTemplate int = 1541
+const hcltok_en_bareTemplate int = 1550
+const hcltok_en_identOnly int = 1557
+const hcltok_en_main int = 1464
+
+// line 16 "scan_tokens.rl"
+
+func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []Token {
+        f := &tokenAccum{
+                Filename: filename,
+                Bytes:    data,
+                Pos:      start,
+        }
+
+        // line 294 "scan_tokens.rl"
+
+        // Ragel state
+        p := 0          // "Pointer" into data
+        pe := len(data) // End-of-data "pointer"
+        ts := 0
+        te := 0
+        act := 0
+        eof := pe
+        var stack []int
+        var top int
+
+        var cs int // current state
+        switch mode {
+        case scanNormal:
+                cs = hcltok_en_main
+        case scanTemplate:
+                cs = hcltok_en_bareTemplate
+        case scanIdentOnly:
+                cs = hcltok_en_identOnly
+        default:
+                panic("invalid scanMode")
+        }
+
+        braces := 0
+        var retBraces []int              // stack of brace levels that cause us to use fret
+        var heredocs []heredocInProgress // stack of heredocs we're currently processing
+
+        // line 329 "scan_tokens.rl"
+
+        // Make Go compiler happy
+        _ = ts
+        _ = te
+        _ = act
+        _ = eof
+
+        token := func(ty TokenType) {
+                f.emitToken(ty, ts, te)
+        }
+        selfToken := func() {
+                b := data[ts:te]
+                if len(b) != 1 {
+                        // should never happen
+                        panic("selfToken only works for single-character tokens")
+                }
+                f.emitToken(TokenType(b[0]), ts, te)
+        }
+
+        // line 4372 "scan_tokens.go"
+        {
+                top = 0
+                ts = 0
+                te = 0
+                act = 0
+        }
+
+        // line 4380 "scan_tokens.go"
+        {
+                var _klen int
+                var _trans int
+                var _acts int
+                var _nacts uint
+                var _keys int
+                if p == pe {
+                        goto _test_eof
+                }
+                if cs == 0 {
+                        goto _out
+                }
+        _resume:
+                _acts = int(_hcltok_from_state_actions[cs])
+                _nacts = uint(_hcltok_actions[_acts])
+                _acts++
+                for ; _nacts > 0; _nacts-- {
+                        _acts++
+                        switch _hcltok_actions[_acts-1] {
+                        case 6:
+                                // line 1 "NONE"
+
+                                ts = p
+
+                                // line 4404 "scan_tokens.go"
+                        }
+                }
+
+                _keys = int(_hcltok_key_offsets[cs])
+                _trans = int(_hcltok_index_offsets[cs])
+
+                _klen = int(_hcltok_single_lengths[cs])
+                if _klen > 0 {
+                        _lower := int(_keys)
+                        var _mid int
+                        _upper := int(_keys + _klen - 1)
+                        for {
+                                if _upper < _lower {
+                                        break
+                                }
+
+                                _mid = _lower + ((_upper - _lower) >> 1)
+                                switch {
+                                case data[p] < _hcltok_trans_keys[_mid]:
+                                        _upper = _mid - 1
+                                case data[p] > _hcltok_trans_keys[_mid]:
+                                        _lower = _mid + 1
+                                default:
+                                        _trans += int(_mid - int(_keys))
+                                        goto _match
+                                }
+                        }
+                        _keys += _klen
+                        _trans += _klen
+                }
+
+                _klen = int(_hcltok_range_lengths[cs])
+                if _klen > 0 {
+                        _lower := int(_keys)
+                        var _mid int
+                        _upper := int(_keys + (_klen << 1) - 2)
+                        for {
+                                if _upper < _lower {
+                                        break
+                                }
+
+                                _mid = _lower + (((_upper - _lower) >> 1) & ^1)
+                                switch {
+                                case data[p] < _hcltok_trans_keys[_mid]:
+                                        _upper = _mid - 2
+                                case data[p] > _hcltok_trans_keys[_mid+1]:
+                                        _lower = _mid + 2
+                                default:
+                                        _trans += int((_mid - int(_keys)) >> 1)
+                                        goto _match
+                                }
+                        }
+                        _trans += _klen
+                }
+
+        _match:
+                _trans = int(_hcltok_indicies[_trans])
+        _eof_trans:
+                cs = int(_hcltok_trans_targs[_trans])
+
+                if _hcltok_trans_actions[_trans] == 0 {
+                        goto _again
+                }
+
+                _acts = int(_hcltok_trans_actions[_trans])
+                _nacts = uint(_hcltok_actions[_acts])
+                _acts++
+                for ; _nacts > 0; _nacts-- {
+                        _acts++
+                        switch _hcltok_actions[_acts-1] {
+                        case 0:
+                                // line 218 "scan_tokens.rl"
+
+                                p--
+
+                        case 1:
+                                // line 219 "scan_tokens.rl"
+
+                                p--
+
+                        case 2:
+                                // line 224 "scan_tokens.rl"
+
+                                p--
+
+                        case 3:
+                                // line 225 "scan_tokens.rl"
+
+                                p--
+
+                        case 7:
+                                // line 1 "NONE"
+
+                                te = p + 1
+
+                        case 8:
+                                // line 155 "scan_tokens.rl"
+
+                                te = p + 1
+                                {
+                                        token(TokenTemplateInterp)
+                                        braces++
+                                        retBraces = append(retBraces, braces)
+                                        if len(heredocs) > 0 {
+                                                heredocs[len(heredocs)-1].StartOfLine = false
+                                        }
+                                        {
+                                                stack = append(stack, 0)
+                                                stack[top] = cs
+                                                top++
+                                                cs = 1464
+                                                goto _again
+                                        }
+                                }
+                        case 9:
+                                // line 165 "scan_tokens.rl"
+
+                                te = p + 1
+                                {
+                                        token(TokenTemplateControl)
+                                        braces++
+                                        retBraces = append(retBraces, braces)
+                                        if len(heredocs) > 0 {
+                                                heredocs[len(heredocs)-1].StartOfLine = false
+                                        }
+                                        {
+                                                stack = append(stack, 0)
+                                                stack[top] = cs
+                                                top++
+                                                cs = 1464
+                                                goto _again
+                                        }
+                                }
+                        case 10:
+                                // line 79 "scan_tokens.rl"
+
+                                te = p + 1
+                                {
+                                        token(TokenCQuote)
+                                        top--
+                                        cs = stack[top]
+                                        {
+                                                stack = stack[:len(stack)-1]
+                                        }
+                                        goto _again
+
+                                }
+                        case 11:
+                                // line 239 "scan_tokens.rl"
+
+                                te = p + 1
+                                {
+                                        token(TokenInvalid)
+                                }
+                        case 12:
+                                // line 240 "scan_tokens.rl"
+
+                                te = p + 1
+                                {
+                                        token(TokenBadUTF8)
+                                }
+                        case 13:
+                                // line 155 "scan_tokens.rl"
+
+                                te = p
+                                p--
+                                {
+                                        token(TokenTemplateInterp)
+                                        braces++
+                                        retBraces = append(retBraces, braces)
+                                        if len(heredocs) > 0 {
+                                                heredocs[len(heredocs)-1].StartOfLine = false
+                                        }
+                                        {
+                                                stack = append(stack, 0)
+                                                stack[top] = cs
+                                                top++
+                                                cs = 1464
+                                                goto _again
+                                        }
+                                }
+                        case 14:
+                                // line 165 "scan_tokens.rl"
+
+                                te = p
+                                p--
+                                {
+                                        token(TokenTemplateControl)
+                                        braces++
+                                        retBraces = append(retBraces, braces)
+                                        if len(heredocs) > 0 {
+                                                heredocs[len(heredocs)-1].StartOfLine = false
+                                        }
+                                        {
+                                                stack = append(stack, 0)
+                                                stack[top] = cs
+                                                top++
+                                                cs = 1464
+                                                goto _again
+                                        }
+                                }
+                        case 15:
+                                // line 238 "scan_tokens.rl"
+
+                                te = p
+                                p--
+                                {
+                                        token(TokenQuotedLit)
+                                }
+                        case 16:
+                                // line 239 "scan_tokens.rl"
+
+                                te = p
+                                p--
+                                {
+                                        token(TokenInvalid)
+                                }
+                        case 17:
+                                // line 240 "scan_tokens.rl"
+
+                                te = p
+                                p--
+                                {
+                                        token(TokenBadUTF8)
+                                }
+                        case 18:
+                                // line 238 "scan_tokens.rl"
+
+                                p = (te) - 1
+                                {
+                                        token(TokenQuotedLit)
+                                }
+                        case 19:
+                                // line 240 "scan_tokens.rl"
+
+                                p = (te) - 1
+                                {
+                                        token(TokenBadUTF8)
+                                }
+                        case 20:
+                                // line 143 "scan_tokens.rl"
+
+                                act = 10
+                        case 21:
+                                // line 248 "scan_tokens.rl"
+
+                                act = 11
+                        case 22:
+                                // line 155 "scan_tokens.rl"
+
+                                te = p + 1
+                                {
+                                        token(TokenTemplateInterp)
+                                        braces++
+                                        retBraces = append(retBraces, braces)
+                                        if len(heredocs) > 0 {
+                                                heredocs[len(heredocs)-1].StartOfLine = false
+                                        }
+                                        {
+                                                stack = append(stack, 0)
+                                                stack[top] = cs
+                                                top++
+                                                cs = 1464
+                                                goto _again
+                                        }
+                                }
+                        case 23:
+                                // line 165 "scan_tokens.rl"
+
+                                te = p + 1
+                                {
+                                        token(TokenTemplateControl)
+                                        braces++
+                                        retBraces = append(retBraces, braces)
+                                        if len(heredocs) > 0 {
+                                                heredocs[len(heredocs)-1].StartOfLine = false
+                                        }
+                                        {
+                                                stack = append(stack, 0)
+                                                stack[top] = cs
+                                                top++
+                                                cs = 1464
+                                                goto _again
+                                        }
+                                }
+                        case 24:
+                                // line 106 "scan_tokens.rl"
+
+                                te = p + 1
+                                {
+                                        // This action is called specificially when a heredoc literal
+                                        // ends with a newline character.
+
+                                        // This might actually be our end marker.
+                                        topdoc := &heredocs[len(heredocs)-1]
+                                        if topdoc.StartOfLine {
+                                                maybeMarker := bytes.TrimSpace(data[ts:te])
+                                                if bytes.Equal(maybeMarker, topdoc.Marker) {
+                                                        // We actually emit two tokens here: the end-of-heredoc
+                                                        // marker first, and then separately the newline that
+                                                        // follows it. This then avoids issues with the closing
+                                                        // marker consuming a newline that would normally be used
+                                                        // to mark the end of an attribute definition.
+                                                        // We might have either a \n sequence or an \r\n sequence
+                                                        // here, so we must handle both.
+                                                        nls := te - 1
+                                                        nle := te
+                                                        te--
+                                                        if data[te-1] == '\r' {
+                                                                // back up one more byte
+                                                                nls--
+                                                                te--
+                                                        }
+                                                        token(TokenCHeredoc)
+                                                        ts = nls
+                                                        te = nle
+                                                        token(TokenNewline)
+                                                        heredocs = heredocs[:len(heredocs)-1]
+                                                        top--
+                                                        cs = stack[top]
+                                                        {
+                                                                stack = stack[:len(stack)-1]
+                                                        }
+                                                        goto _again
+
+                                                }
+                                        }
+
+                                        topdoc.StartOfLine = true
+                                        token(TokenStringLit)
+                                }
+                        case 25:
+                                // line 248 "scan_tokens.rl"
+
+                                te = p + 1
+                                {
+                                        token(TokenBadUTF8)
+                                }
+                        case 26:
+                                // line 155 "scan_tokens.rl"
+
+                                te = p
+                                p--
+                                {
+                                        token(TokenTemplateInterp)
+                                        braces++
+                                        retBraces = append(retBraces, braces)
+                                        if len(heredocs) > 0 {
+                                                heredocs[len(heredocs)-1].StartOfLine = false
+                                        }
+                                        {
+                                                stack = append(stack, 0)
+                                                stack[top] = cs
+                                                top++
+                                                cs = 1464
+                                                goto _again
+                                        }
+                                }
+                        case 27:
+                                // line 165 "scan_tokens.rl"
+
+                                te = p
+                                p--
+                                {
+                                        token(TokenTemplateControl)
+                                        braces++
+                                        retBraces = append(retBraces, braces)
+                                        if len(heredocs) > 0 {
+                                                heredocs[len(heredocs)-1].StartOfLine = false
+                                        }
+                                        {
+                                                stack = append(stack, 0)
+                                                stack[top] = cs
+                                                top++
+                                                cs = 1464
+                                                goto _again
+                                        }
+                                }
+                        case 28:
+                                // line 143 "scan_tokens.rl"
+
+                                te = p
+                                p--
+                                {
+                                        // This action is called when a heredoc literal _doesn't_ end
+                                        // with a newline character, e.g. because we're about to enter
+                                        // an interpolation sequence.
+                                        heredocs[len(heredocs)-1].StartOfLine = false
+                                        token(TokenStringLit)
+                                }
+                        case 29:
+                                // line 248 "scan_tokens.rl"
+
+                                te = p
+                                p--
+                                {
+                                        token(TokenBadUTF8)
+                                }
+                        case 30:
+                                // line 143 "scan_tokens.rl"
+
+                                p = (te) - 1
+                                {
+                                        // This action is called when a heredoc literal _doesn't_ end
+                                        // with a newline character, e.g. because we're about to enter
+                                        // an interpolation sequence.
+                                        heredocs[len(heredocs)-1].StartOfLine = false
+                                        token(TokenStringLit)
+                                }
+                        case 31:
+                                // line 1 "NONE"
+
+                                switch act {
+                                case 0:
+                                        {
+                                                cs = 0
+                                                goto _again
+                                        }
+                                case 10:
+                                        {
+                                                p = (te) - 1
+
+                                                // This action is called when a heredoc literal _doesn't_ end
+                                                // with a newline character, e.g. because we're about to enter
+                                                // an interpolation sequence.
+                                                heredocs[len(heredocs)-1].StartOfLine = false
+                                                token(TokenStringLit)
+                                        }
+                                case 11:
+                                        {
+                                                p = (te) - 1
+                                                token(TokenBadUTF8)
+                                        }
+                                }
+
+                        case 32:
+                                // line 151 "scan_tokens.rl"
+
+                                act = 14
+                        case 33:
+                                // line 255 "scan_tokens.rl"
+
+                                act = 15
+                        case 34:
+                                // line 155 "scan_tokens.rl"
+
+                                te = p + 1
+                                {
+                                        token(TokenTemplateInterp)
+                                        braces++
+                                        retBraces = append(retBraces, braces)
+                                        if len(heredocs) > 0 {
+                                                heredocs[len(heredocs)-1].StartOfLine = false
+                                        }
+                                        {
+                                                stack = append(stack, 0)
+                                                stack[top] = cs
+                                                top++
+                                                cs = 1464
+                                                goto _again
+                                        }
+                                }
+                        case 35:
+                                // line 165 "scan_tokens.rl"
+
+                                te = p + 1
+                                {
+                                        token(TokenTemplateControl)
+                                        braces++
+                                        retBraces = append(retBraces, braces)
+                                        if len(heredocs) > 0 {
+                                                heredocs[len(heredocs)-1].StartOfLine = false
+                                        }
+                                        {
+                                                stack = append(stack, 0)
+                                                stack[top] = cs
+                                                top++
+                                                cs = 1464
+                                                goto _again
+                                        }
+                                }
+                        case 36:
+                                // line 151 "scan_tokens.rl"
+
+                                te = p + 1
+                                {
+                                        token(TokenStringLit)
+                                }
+                        case 37:
+                                // line 255 "scan_tokens.rl"
+
+                                te = p + 1
+                                {
+                                        token(TokenBadUTF8)
+                                }
+                        case 38:
+                                // line 155 "scan_tokens.rl"
+
+                                te = p
+                                p--
+                                {
+                                        token(TokenTemplateInterp)
+                                        braces++
+                                        retBraces = append(retBraces, braces)
+                                        if len(heredocs) > 0 {
+                                                heredocs[len(heredocs)-1].StartOfLine = false
+                                        }
+                                        {
+                                                stack = append(stack, 0)
+                                                stack[top] = cs
+                                                top++
+                                                cs = 1464
+                                                goto _again
+                                        }
+                                }
+                        case 39:
+                                // line 165 "scan_tokens.rl"
+
+                                te = p
+                                p--
+                                {
+                                        token(TokenTemplateControl)
+                                        braces++
+                                        retBraces = append(retBraces, braces)
+                                        if len(heredocs) > 0 {
+                                                heredocs[len(heredocs)-1].StartOfLine = false
+                                        }
+                                        {
+                                                stack = append(stack, 0)
+                                                stack[top] = cs
+                                                top++
+                                                cs = 1464
+                                                goto _again
+                                        }
+                                }
+                        case 40:
+                                // line 151 "scan_tokens.rl"
+
+                                te = p
+                                p--
+                                {
+                                        token(TokenStringLit)
+                                }
+                        case 41:
+                                // line 255 "scan_tokens.rl"
+
+                                te = p
+                                p--
+                                {
+                                        token(TokenBadUTF8)
+                                }
+                        case 42:
+                                // line 151 "scan_tokens.rl"
+
+                                p = (te) - 1
+                                {
+                                        token(TokenStringLit)
+                                }
+                        case 43:
+                                // line 1 "NONE"
+
+                                switch act {
+                                case 0:
+                                        {
+                                                cs = 0
+                                                goto _again
+                                        }
+                                case 14:
+                                        {
+                                                p = (te) - 1
+
+                                                token(TokenStringLit)
+                                        }
+                                case 15:
+                                        {
+                                                p = (te) - 1
+                                                token(TokenBadUTF8)
+                                        }
+                                }
+
+                        case 44:
+                                // line 259 "scan_tokens.rl"
+
+                                act = 16
+                        case 45:
+                                // line 260 "scan_tokens.rl"
+
+                                act = 17
+                        case 46:
+                                // line 260 "scan_tokens.rl"
+
+                                te = p + 1
+                                {
+                                        token(TokenBadUTF8)
+                                }
+                        case 47:
+                                // line 261 "scan_tokens.rl"
+
+                                te = p + 1
+                                {
+                                        token(TokenInvalid)
+                                }
+                        case 48:
+                                // line 259 "scan_tokens.rl"
+
+                                te = p
+                                p--
+                                {
+                                        token(TokenIdent)
+                                }
+                        case 49:
+                                // line 260 "scan_tokens.rl"
+
+                                te = p
+                                p--
+                                {
+                                        token(TokenBadUTF8)
+                                }
+                        case 50:
+                                // line 259 "scan_tokens.rl"
+
+                                p = (te) - 1
+                                {
+                                        token(TokenIdent)
+                                }
+                        case 51:
+                                // line 260 "scan_tokens.rl"
+
+                                p = (te) - 1
+                                {
+                                        token(TokenBadUTF8)
+                                }
+                        case 52:
+                                // line 1 "NONE"
+
+                                switch act {
+                                case 16:
+                                        {
+                                                p = (te) - 1
+                                                token(TokenIdent)
+                                        }
+                                case 17:
+                                        {
+                                                p = (te) - 1
+                                                token(TokenBadUTF8)
+                                        }
+                                }
+
+                        case 53:
+                                // line 267 "scan_tokens.rl"
+
+                                act = 21
+                        case 54:
+                                // line 269 "scan_tokens.rl"
+
+                                act = 22
+                        case 55:
+                                // line 280 "scan_tokens.rl"
+
+                                act = 32
+                        case 56:
+                                // line 290 "scan_tokens.rl"
+
+                                act = 38
+                        case 57:
+                                // line 291 "scan_tokens.rl"
+
+                                act = 39
+                        case 58:
+                                // line 269 "scan_tokens.rl"
+
+                                te = p + 1
+                                {
+                                        token(TokenComment)
+                                }
+                        case 59:
+                                // line 270 "scan_tokens.rl"
+
+                                te = p + 1
+                                {
+                                        token(TokenNewline)
+                                }
+                        case 60:
+                                // line 272 "scan_tokens.rl"
+
+                                te = p + 1
+                                {
+                                        token(TokenEqualOp)
+                                }
+                        case 61:
+                                // line 273 "scan_tokens.rl"
+
+                                te = p + 1
+                                {
+                                        token(TokenNotEqual)
+                                }
+                        case 62:
+                                // line 274 "scan_tokens.rl"
+
+                                te = p + 1
+                                {
+                                        token(TokenGreaterThanEq)
+                                }
+                        case 63:
+                                // line 275 "scan_tokens.rl"
+
+                                te = p + 1
+                                {
+                                        token(TokenLessThanEq)
+                                }
+                        case 64:
+                                // line 276 "scan_tokens.rl"
+
+                                te = p + 1
+                                {
+                                        token(TokenAnd)
+                                }
+                        case 65:
+                                // line 277 "scan_tokens.rl"
+
+                                te = p + 1
+                                {
+                                        token(TokenOr)
+                                }
+                        case 66:
+                                // line 278 "scan_tokens.rl"
+
+                                te = p + 1
+                                {
+                                        token(TokenEllipsis)
+                                }
+                        case 67:
+                                // line 279 "scan_tokens.rl"
+
+                                te = p + 1
+                                {
+                                        token(TokenFatArrow)
+                                }
+                        case 68:
+                                // line 280 "scan_tokens.rl"
+
+                                te = p + 1
+                                {
+                                        selfToken()
+                                }
+                        case 69:
+                                // line 175 "scan_tokens.rl"
+
+                                te = p + 1
+                                {
+                                        token(TokenOBrace)
+                                        braces++
+                                }
+                        case 70:
+                                // line 180 "scan_tokens.rl"
+
+                                te = p + 1
+                                {
+                                        if len(retBraces) > 0 && retBraces[len(retBraces)-1] == braces {
+                                                token(TokenTemplateSeqEnd)
+                                                braces--
+                                                retBraces = retBraces[0 : len(retBraces)-1]
+                                                top--
+                                                cs = stack[top]
+                                                {
+                                                        stack = stack[:len(stack)-1]
+                                                }
+                                                goto _again
+
+                                        } else {
+                                                token(TokenCBrace)
+                                                braces--
+                                        }
+                                }
+                        case 71:
+                                // line 192 "scan_tokens.rl"
+
+                                te = p + 1
+                                {
+                                        // Only consume from the retBraces stack and return if we are at
+                                        // a suitable brace nesting level, otherwise things will get
+                                        // confused. (Not entering this branch indicates a syntax error,
+                                        // which we will catch in the parser.)
+                                        if len(retBraces) > 0 && retBraces[len(retBraces)-1] == braces {
+                                                token(TokenTemplateSeqEnd)
+                                                braces--
+                                                retBraces = retBraces[0 : len(retBraces)-1]
+                                                top--
+                                                cs = stack[top]
+                                                {
+                                                        stack = stack[:len(stack)-1]
+                                                }
+                                                goto _again
+
+                                        } else {
+                                                // We intentionally generate a TokenTemplateSeqEnd here,
+                                                // even though the user apparently wanted a brace, because
+                                                // we want to allow the parser to catch the incorrect use
+                                                // of a ~} to balance a generic opening brace, rather than
+                                                // a template sequence.
+                                                token(TokenTemplateSeqEnd)
+                                                braces--
+                                        }
+                                }
+                        case 72:
+                                // line 74 "scan_tokens.rl"
+
+                                te = p + 1
+                                {
+                                        token(TokenOQuote)
+                                        {
+                                                stack = append(stack, 0)
+                                                stack[top] = cs
+                                                top++
+                                                cs = 1515
+                                                goto _again
+                                        }
+                                }
+                        case 73:
+                                // line 84 "scan_tokens.rl"
+
+                                te = p + 1
+                                {
+                                        token(TokenOHeredoc)
+                                        // the token is currently the whole heredoc introducer, like
+                                        // <<EOT or <<-EOT, followed by a newline. We want to extract
+                                        // just the "EOT" portion that we'll use as the closing marker.
+
+                                        marker := data[ts+2 : te-1]
+                                        if marker[0] == '-' {
+                                                marker = marker[1:]
+                                        }
+                                        if marker[len(marker)-1] == '\r' {
+                                                marker = marker[:len(marker)-1]
+                                        }
+
+                                        heredocs = append(heredocs, heredocInProgress{
+                                                Marker:      marker,
+                                                StartOfLine: true,
+                                        })
+
+                                        {
+                                                stack = append(stack, 0)
+                                                stack[top] = cs
+                                                top++
+                                                cs = 1541
+                                                goto _again
+                                        }
+                                }
+                        case 74:
+                                // line 290 "scan_tokens.rl"
+
+                                te = p + 1
+                                {
+                                        token(TokenBadUTF8)
+                                }
+                        case 75:
+                                // line 291 "scan_tokens.rl"
+
+                                te = p + 1
+                                {
+                                        token(TokenInvalid)
+                                }
+                        case 76:
+                                // line 265 "scan_tokens.rl"
+
+                                te = p
+                                p--
+
+                        case 77:
+                                // line 266 "scan_tokens.rl"
+
+                                te = p
+                                p--
+                                {
+                                        token(TokenNumberLit)
+                                }
+                        case 78:
+                                // line 267 "scan_tokens.rl"
+
+                                te = p
+                                p--
+                                {
+                                        token(TokenIdent)
+                                }
+                        case 79:
+                                // line 269 "scan_tokens.rl"
+
+                                te = p
+                                p--
+                                {
+                                        token(TokenComment)
+                                }
+                        case 80:
+                                // line 280 "scan_tokens.rl"
+
+                                te = p
+                                p--
+                                {
+                                        selfToken()
+                                }
+                        case 81:
+                                // line 290 "scan_tokens.rl"
+
+                                te = p
+                                p--
+                                {
+                                        token(TokenBadUTF8)
+                                }
+                        case 82:
+                                // line 291 "scan_tokens.rl"
+
+                                te = p
+                                p--
+                                {
+                                        token(TokenInvalid)
+                                }
+                        case 83:
+                                // line 266 "scan_tokens.rl"
+
+                                p = (te) - 1
+                                {
+                                        token(TokenNumberLit)
+                                }
+                        case 84:
+                                // line 267 "scan_tokens.rl"
+
+                                p = (te) - 1
+                                {
+                                        token(TokenIdent)
+                                }
+                        case 85:
+                                // line 280 "scan_tokens.rl"
+
+                                p = (te) - 1
+                                {
+                                        selfToken()
+                                }
+                        case 86:
+                                // line 290 "scan_tokens.rl"
+
+                                p = (te) - 1
+                                {
+                                        token(TokenBadUTF8)
+                                }
+                        case 87:
+                                // line 1 "NONE"
+
+                                switch act {
+                                case 21:
+                                        {
+                                                p = (te) - 1
+                                                token(TokenIdent)
+                                        }
+                                case 22:
+                                        {
+                                                p = (te) - 1
+                                                token(TokenComment)
+                                        }
+                                case 32:
+                                        {
+                                                p = (te) - 1
+                                                selfToken()
+                                        }
+                                case 38:
+                                        {
+                                                p = (te) - 1
+                                                token(TokenBadUTF8)
+                                        }
+                                case 39:
+                                        {
+                                                p = (te) - 1
+                                                token(TokenInvalid)
+                                        }
+                                }
+
+                                // line 5232 "scan_tokens.go"
+                        }
+                }
+
+        _again:
+                _acts = int(_hcltok_to_state_actions[cs])
+                _nacts = uint(_hcltok_actions[_acts])
+                _acts++
+                for ; _nacts > 0; _nacts-- {
+                        _acts++
+                        switch _hcltok_actions[_acts-1] {
+                        case 4:
+                                // line 1 "NONE"
+
+                                ts = 0
+
+                        case 5:
+                                // line 1 "NONE"
+
+                                act = 0
+
+                                // line 5252 "scan_tokens.go"
+                        }
+                }
+
+                if cs == 0 {
+                        goto _out
+                }
+                p++
+                if p != pe {
+                        goto _resume
+                }
+        _test_eof:
+                {
+                }
+                if p == eof {
+                        if _hcltok_eof_trans[cs] > 0 {
+                                _trans = int(_hcltok_eof_trans[cs] - 1)
+                                goto _eof_trans
+                        }
+                }
+
+        _out:
+                {
+                }
+        }
+
+        // line 352 "scan_tokens.rl"
+
+        // If we fall out here without being in a final state then we've
+        // encountered something that the scanner can't match, which we'll
+        // deal with as an invalid.
+        if cs < hcltok_first_final {
+                if mode == scanTemplate && len(stack) == 0 {
+                        // If we're scanning a bare template then any straggling
+                        // top-level stuff is actually literal string, rather than
+                        // invalid. This handles the case where the template ends
+                        // with a single "$" or "%", which trips us up because we
+                        // want to see another character to decide if it's a sequence
+                        // or an escape.
+                        f.emitToken(TokenStringLit, ts, len(data))
+                } else {
+                        f.emitToken(TokenInvalid, ts, len(data))
+                }
+        }
+
+        // We always emit a synthetic EOF token at the end, since it gives the
+        // parser position information for an "unexpected EOF" diagnostic.
+        f.emitToken(TokenEOF, len(data), len(data))
+
+        return f.Tokens
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/scan_tokens.rl b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/scan_tokens.rl
new file mode 100644
index 0000000..83ef65b
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/scan_tokens.rl
@@ -0,0 +1,376 @@
+
+package hclsyntax
+
+import (
+    "bytes"
+
+    "github.com/hashicorp/hcl2/hcl"
+)
+
+// This file is generated from scan_tokens.rl. DO NOT EDIT.
+%%{
+  # (except you are actually in scan_tokens.rl here, so edit away!)
+
+  machine hcltok;
+  write data;
+}%%
+
+func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []Token {
+    f := &tokenAccum{
+        Filename: filename,
+        Bytes:    data,
+        Pos:      start,
+    }
+
+    %%{
+        include UnicodeDerived "unicode_derived.rl";
+
+        UTF8Cont = 0x80 .. 0xBF;
+        AnyUTF8 = (
+            0x00..0x7F |
+            0xC0..0xDF . UTF8Cont |
+            0xE0..0xEF . UTF8Cont . UTF8Cont |
+            0xF0..0xF7 . UTF8Cont . UTF8Cont . UTF8Cont
+        );
+        BrokenUTF8 = any - AnyUTF8;
+
+        NumberLitContinue = (digit|'.'|('e'|'E') ('+'|'-')? digit);
+        NumberLit = digit ("" | (NumberLitContinue - '.') | (NumberLitContinue* (NumberLitContinue - '.')));
+        Ident = (ID_Start | '_') (ID_Continue | '-')*;
+
+        # Symbols that just represent themselves are handled as a single rule.
+        SelfToken = "[" | "]" | "(" | ")" | "." | "," | "*" | "/" | "%" | "+" | "-" | "=" | "<" | ">" | "!" | "?" | ":" | "\n" | "&" | "|" | "~" | "^" | ";" | "`";
+
+        EqualOp = "==";
+        NotEqual = "!=";
+        GreaterThanEqual = ">=";
+        LessThanEqual = "<=";
+        LogicalAnd = "&&";
+        LogicalOr = "||";
+
+        Ellipsis = "...";
+        FatArrow = "=>";
+
+        Newline = '\r' ? '\n';
+        EndOfLine = Newline;
+
+        BeginStringTmpl = '"';
+        BeginHeredocTmpl = '<<' ('-')? Ident Newline;
+
+        Comment = (
+            ("#" (any - EndOfLine)* EndOfLine) |
+            ("//" (any - EndOfLine)* EndOfLine) |
+            ("/*" any* "*/")
+        );
+
+        # Note: hclwrite assumes that only ASCII spaces appear between tokens,
+        # and uses this assumption to recreate the spaces between tokens by
+        # looking at byte offset differences. This means it will produce
+        # incorrect results in the presence of tabs, but that's acceptable
+        # because the canonical style (which hclwrite itself can impose
+        # automatically is to never use tabs).
+        Spaces = (' ' | 0x09)+;
+
+        action beginStringTemplate {
+            token(TokenOQuote);
+            fcall stringTemplate;
+        }
+
+        action endStringTemplate {
+            token(TokenCQuote);
+            fret;
+        }
+
+        action beginHeredocTemplate {
+            token(TokenOHeredoc);
+            // the token is currently the whole heredoc introducer, like
+            // <<EOT or <<-EOT, followed by a newline. We want to extract
+            // just the "EOT" portion that we'll use as the closing marker.
+
+            marker := data[ts+2:te-1]
+            if marker[0] == '-' {
+                marker = marker[1:]
+            }
+            if marker[len(marker)-1] == '\r' {
+                marker = marker[:len(marker)-1]
+            }
+
+            heredocs = append(heredocs, heredocInProgress{
+                Marker:      marker,
+                StartOfLine: true,
+            })
+
+            fcall heredocTemplate;
+        }
+
+        action heredocLiteralEOL {
+            // This action is called specificially when a heredoc literal
+            // ends with a newline character.
+
+            // This might actually be our end marker.
+            topdoc := &heredocs[len(heredocs)-1]
+            if topdoc.StartOfLine {
+                maybeMarker := bytes.TrimSpace(data[ts:te])
+                if bytes.Equal(maybeMarker, topdoc.Marker) {
+                    // We actually emit two tokens here: the end-of-heredoc
+                    // marker first, and then separately the newline that
+                    // follows it. This then avoids issues with the closing
+                    // marker consuming a newline that would normally be used
+                    // to mark the end of an attribute definition.
+                    // We might have either a \n sequence or an \r\n sequence
+                    // here, so we must handle both.
+                    nls := te-1
+                    nle := te
+                    te--
+                    if data[te-1] == '\r' {
+                        // back up one more byte
+                        nls--
+                        te--
+                    }
+                    token(TokenCHeredoc);
+                    ts = nls
+                    te = nle
+                    token(TokenNewline);
+                    heredocs = heredocs[:len(heredocs)-1]
+                    fret;
+                }
+            }
+
+            topdoc.StartOfLine = true;
+            token(TokenStringLit);
+        }
+
+        action heredocLiteralMidline {
+            // This action is called when a heredoc literal _doesn't_ end
+            // with a newline character, e.g. because we're about to enter
+            // an interpolation sequence.
+            heredocs[len(heredocs)-1].StartOfLine = false;
+            token(TokenStringLit);
+        }
+
+        action bareTemplateLiteral {
+            token(TokenStringLit);
+        }
+
+        action beginTemplateInterp {
+            token(TokenTemplateInterp);
+            braces++;
+            retBraces = append(retBraces, braces);
+            if len(heredocs) > 0 {
+                heredocs[len(heredocs)-1].StartOfLine = false;
+            }
+            fcall main;
+        }
+
+        action beginTemplateControl {
+            token(TokenTemplateControl);
+            braces++;
+            retBraces = append(retBraces, braces);
+            if len(heredocs) > 0 {
+                heredocs[len(heredocs)-1].StartOfLine = false;
+            }
+            fcall main;
+        }
+
+        action openBrace {
+            token(TokenOBrace);
+            braces++;
+        }
+
+        action closeBrace {
+            if len(retBraces) > 0 && retBraces[len(retBraces)-1] == braces {
+                token(TokenTemplateSeqEnd);
+                braces--;
+                retBraces = retBraces[0:len(retBraces)-1]
+                fret;
+            } else {
+                token(TokenCBrace);
+                braces--;
+            }
+        }
+
+        action closeTemplateSeqEatWhitespace {
+            // Only consume from the retBraces stack and return if we are at
+            // a suitable brace nesting level, otherwise things will get
+            // confused. (Not entering this branch indicates a syntax error,
+            // which we will catch in the parser.)
+            if len(retBraces) > 0 && retBraces[len(retBraces)-1] == braces {
+                token(TokenTemplateSeqEnd);
+                braces--;
+                retBraces = retBraces[0:len(retBraces)-1]
+                fret;
+            } else {
+                // We intentionally generate a TokenTemplateSeqEnd here,
+                // even though the user apparently wanted a brace, because
+                // we want to allow the parser to catch the incorrect use
+                // of a ~} to balance a generic opening brace, rather than
+                // a template sequence.
+                token(TokenTemplateSeqEnd);
+                braces--;
+            }
+        }
+
+        TemplateInterp = "${" ("~")?;
+        TemplateControl = "%{" ("~")?;
+        EndStringTmpl = '"';
+        StringLiteralChars = (AnyUTF8 - ("\r"|"\n"));
+        TemplateStringLiteral = (
+            ('$' ^'{' %{ fhold; }) |
+            ('%' ^'{' %{ fhold; }) |
+            ('\\' StringLiteralChars) |
+            (StringLiteralChars - ("$" | '%' | '"'))
+        )+;
+        HeredocStringLiteral = (
+            ('$' ^'{' %{ fhold; }) |
+            ('%' ^'{' %{ fhold; }) |
+            (StringLiteralChars - ("$" | '%'))
+        )*;
+        BareStringLiteral = (
+            ('$' ^'{') |
+            ('%' ^'{') |
+            (StringLiteralChars - ("$" | '%'))
+        )* Newline?;
+
+        stringTemplate := |*
+            TemplateInterp        => beginTemplateInterp;
+            TemplateControl       => beginTemplateControl;
+            EndStringTmpl         => endStringTemplate;
+            TemplateStringLiteral => { token(TokenQuotedLit); };
+            AnyUTF8               => { token(TokenInvalid); };
+            BrokenUTF8            => { token(TokenBadUTF8); };
+        *|;
+
+        heredocTemplate := |*
+            TemplateInterp        => beginTemplateInterp;
+            TemplateControl       => beginTemplateControl;
+            HeredocStringLiteral EndOfLine => heredocLiteralEOL;
+            HeredocStringLiteral  => heredocLiteralMidline;
+            BrokenUTF8            => { token(TokenBadUTF8); };
+        *|;
+
+        bareTemplate := |*
+            TemplateInterp        => beginTemplateInterp;
+            TemplateControl       => beginTemplateControl;
+            BareStringLiteral     => bareTemplateLiteral;
+            BrokenUTF8            => { token(TokenBadUTF8); };
+        *|;
+
+        identOnly := |*
+            Ident            => { token(TokenIdent) };
+            BrokenUTF8       => { token(TokenBadUTF8) };
+            AnyUTF8          => { token(TokenInvalid) };
+        *|;
+
+        main := |*
+            Spaces           => {};
+            NumberLit        => { token(TokenNumberLit) };
+            Ident            => { token(TokenIdent) };
+
+            Comment          => { token(TokenComment) };
+            Newline          => { token(TokenNewline) };
+
+            EqualOp          => { token(TokenEqualOp); };
+            NotEqual         => { token(TokenNotEqual); };
+            GreaterThanEqual => { token(TokenGreaterThanEq); };
+            LessThanEqual    => { token(TokenLessThanEq); };
+            LogicalAnd       => { token(TokenAnd); };
+            LogicalOr        => { token(TokenOr); };
+            Ellipsis         => { token(TokenEllipsis); };
+            FatArrow         => { token(TokenFatArrow); };
+            SelfToken        => { selfToken() };
+
+            "{"              => openBrace;
+            "}"              => closeBrace;
+
+            "~}"             => closeTemplateSeqEatWhitespace;
+
+            BeginStringTmpl  => beginStringTemplate;
+            BeginHeredocTmpl => beginHeredocTemplate;
+
+            BrokenUTF8       => { token(TokenBadUTF8) };
+            AnyUTF8          => { token(TokenInvalid) };
+        *|;
+
+    }%%
+
+    // Ragel state
+        p := 0  // "Pointer" into data
+        pe := len(data) // End-of-data "pointer"
+    ts := 0
+    te := 0
+    act := 0
+    eof := pe
+    var stack []int
+    var top int
+
+    var cs int // current state
+    switch mode {
+    case scanNormal:
+        cs = hcltok_en_main
+    case scanTemplate:
+        cs = hcltok_en_bareTemplate
+    case scanIdentOnly:
+        cs = hcltok_en_identOnly
+    default:
+        panic("invalid scanMode")
+    }
+
+    braces := 0
+    var retBraces []int // stack of brace levels that cause us to use fret
+    var heredocs []heredocInProgress // stack of heredocs we're currently processing
+
+    %%{
+        prepush {
+            stack = append(stack, 0);
+        }
+        postpop {
+            stack = stack[:len(stack)-1];
+        }
+    }%%
+
+    // Make Go compiler happy
+    _ = ts
+    _ = te
+    _ = act
+    _ = eof
+
+    token := func (ty TokenType) {
+        f.emitToken(ty, ts, te)
+    }
+    selfToken := func () {
+        b := data[ts:te]
+        if len(b) != 1 {
+            // should never happen
+            panic("selfToken only works for single-character tokens")
+        }
+        f.emitToken(TokenType(b[0]), ts, te)
+    }
+
+    %%{
+        write init nocs;
+        write exec;
+    }%%
+
+    // If we fall out here without being in a final state then we've
+    // encountered something that the scanner can't match, which we'll
+    // deal with as an invalid.
+    if cs < hcltok_first_final {
+        if mode == scanTemplate && len(stack) == 0 {
+            // If we're scanning a bare template then any straggling
+            // top-level stuff is actually literal string, rather than
+            // invalid. This handles the case where the template ends
+            // with a single "$" or "%", which trips us up because we
+            // want to see another character to decide if it's a sequence
+            // or an escape.
+            f.emitToken(TokenStringLit, ts, len(data))
+        } else {
+            f.emitToken(TokenInvalid, ts, len(data))
+        }
+    }
+
+    // We always emit a synthetic EOF token at the end, since it gives the
+    // parser position information for an "unexpected EOF" diagnostic.
+    f.emitToken(TokenEOF, len(data), len(data))
+
+    return f.Tokens
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/spec.md b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/spec.md
new file mode 100644
index 0000000..49b9a3e
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/spec.md
@@ -0,0 +1,923 @@
+# HCL Native Syntax Specification
+
+This is the specification of the syntax and semantics of the native syntax
+for HCL. HCL is a system for defining configuration languages for applications.
+The HCL information model is designed to support multiple concrete syntaxes
+for configuration, but this native syntax is considered the primary format
+and is optimized for human authoring and maintenence, as opposed to machine
+generation of configuration.
+
+The language consists of three integrated sub-languages:
+
+* The _structural_ language defines the overall heirarchical configuration
+  structure, and is a serialization of HCL bodies, blocks and attributes.
+
+* The _expression_ language is used to express attribute values, either as
+  literals or as derivations of other values.
+
+* The _template_ language is used to compose values together into strings,
+  as one of several types of expression in the expression language.
+
+In normal use these three sub-languages are used together within configuration
+files to describe an overall configuration, with the structural language
+being used at the top level. The expression and template languages can also
+be used in isolation, to implement features such as REPLs, debuggers, and
+integration into more limited HCL syntaxes such as the JSON profile.
+
+## Syntax Notation
+
+Within this specification a semi-formal notation is used to illustrate the
+details of syntax. This notation is intended for human consumption rather
+than machine consumption, with the following conventions:
+
+* A naked name starting with an uppercase letter is a global production,
+  common to all of the syntax specifications in this document.
+* A naked name starting with a lowercase letter is a local production,
+  meaningful only within the specification where it is defined.
+* Double and single quotes (`"` and `'`) are used to mark literal character
+  sequences, which may be either punctuation markers or keywords.
+* The default operator for combining items, which has no punctuation,
+  is concatenation.
+* The symbol `|` indicates that any one of its left and right operands may
+  be present.
+* The `*` symbol indicates zero or more repetitions of the item to its left.
+* The `?` symbol indicates zero or one of the item to its left.
+* Parentheses (`(` and `)`) are used to group items together to apply
+  the `|`, `*` and `?` operators to them collectively.
+
+The grammar notation does not fully describe the language. The prose may
+augment or conflict with the illustrated grammar. In case of conflict, prose
+has priority.
+
+## Source Code Representation
+
+Source code is unicode text expressed in the UTF-8 encoding. The language
+itself does not perform unicode normalization, so syntax features such as
+identifiers are sequences of unicode code points and so e.g. a precombined
+accented character is distinct from a letter associated with a combining
+accent. (String literals have some special handling with regard to Unicode
+normalization which will be covered later in the relevant section.)
+
+UTF-8 encoded Unicode byte order marks are not permitted. Invalid or
+non-normalized UTF-8 encoding is always a parse error.
+
+## Lexical Elements
+
+### Comments and Whitespace
+
+Comments and Whitespace are recognized as lexical elements but are ignored
+except as described below.
+
+Whitespace is defined as a sequence of zero or more space characters
+(U+0020). Newline sequences (either U+000A or U+000D followed by U+000A)
+are _not_ considered whitespace but are ignored as such in certain contexts.
+
+Horizontal tab characters (U+0009) are not considered to be whitespace and
+are not valid within HCL native syntax.
+
+Comments serve as program documentation and come in two forms:
+
+* _Line comments_ start with either the `//` or `#` sequences and end with
+  the next newline sequence. A line comments is considered equivalent to a
+  newline sequence.
+
+* _Inline comments_ start with the `/*` sequence and end with the `*/`
+  sequence, and may have any characters within except the ending sequence.
+  An inline comments is considered equivalent to a whitespace sequence.
+
+Comments and whitespace cannot begin within within other comments, or within
+template literals except inside an interpolation sequence or template directive.
+
+### Identifiers
+
+Identifiers name entities such as blocks, attributes and expression variables.
+Identifiers are interpreted as per [UAX #31][UAX31] Section 2. Specifically,
+their syntax is defined in terms of the `ID_Start` and `ID_Continue`
+character properties as follows:
+
+```ebnf
+Identifier = ID_Start (ID_Continue | '-')*;
+```
+
+The Unicode specification provides the normative requirements for identifier
+parsing. Non-normatively, the spirit of this specification is that `ID_Start`
+consists of Unicode letter and certain unambiguous punctuation tokens, while
+`ID_Continue` augments that set with Unicode digits, combining marks, etc.
+
+The dash character `-` is additionally allowed in identifiers, even though
+that is not part of the unicode `ID_Continue` definition. This is to allow
+attribute names and block type names to contain dashes, although underscores
+as word separators are considered the idiomatic usage.
+
+[UAX31]: http://unicode.org/reports/tr31/ "Unicode Identifier and Pattern Syntax"
+
+### Keywords
+
+There are no globally-reserved words, but in some contexts certain identifiers
+are reserved to function as keywords. These are discussed further in the
+relevant documentation sections that follow. In such situations, the
+identifier's role as a keyword supersedes any other valid interpretation that
+may be possible. Outside of these specific situations, the keywords have no
+special meaning and are interpreted as regular identifiers.
+
+### Operators and Delimiters
+
+The following character sequences represent operators, delimiters, and other
+special tokens:
+
+```
++    &&   ==   <    :    {    [    (    ${
+-    ||   !=   >    ?    }    ]    )    %{
+*    !         <=        =         .
+/              >=        =>        ,
+%                                  ...
+```
+
+### Numeric Literals
+
+A numeric literal is a decimal representation of a
+real number. It has an integer part, a fractional part,
+and an exponent part.
+
+```ebnf
+NumericLit = decimal+ ("." decimal+)? (expmark decimal+)?;
+decimal    = '0' .. '9';
+expmark    = ('e' | 'E') ("+" | "-")?;
+```
+
+## Structural Elements
+
+The structural language consists of syntax representing the following
+constructs:
+
+* _Attributes_, which assign a value to a specified name.
+* _Blocks_, which create a child body annotated by a type and optional labels.
+* _Body Content_, which consists of a collection of attributes and blocks.
+
+These constructs correspond to the similarly-named concepts in the
+language-agnostic HCL information model.
+
+```ebnf
+ConfigFile = Body;
+Body       = (Attribute | Block)*;
+Attribute  = Identifier "=" Expression Newline;
+Block      = Identifier (StringLit|Identifier)* "{" Newline Body "}" Newline;
+```
+
+### Configuration Files
+
+A _configuration file_ is a sequence of characters whose top-level is
+interpreted as a Body.
+
+### Bodies
+
+A _body_ is a collection of associated attributes and blocks. The meaning of
+this association is defined by the calling application.
+
+### Attribute Definitions
+
+An _attribute definition_ assigns a value to a particular attribute name within
+a body. Each distinct attribute name may be defined no more than once within a
+single body.
+
+The attribute value is given as an expression, which is retained literally
+for later evaluation by the calling application.
+
+### Blocks
+
+A _block_ creates a child body that is annotated with a block _type_ and
+zero or more block _labels_. Blocks create a structural heirachy which can be
+interpreted by the calling application.
+
+Block labels can either be quoted literal strings or naked identifiers.
+
+## Expressions
+
+The expression sub-language is used within attribute definitions to specify
+values.
+
+```ebnf
+Expression = (
+    ExprTerm |
+    Operation |
+    Conditional
+);
+```
+
+### Types
+
+The value types used within the expression language are those defined by the
+syntax-agnostic HCL information model. An expression may return any valid
+type, but only a subset of the available types have first-class syntax.
+A calling application may make other types available via _variables_ and
+_functions_.
+
+### Expression Terms
+
+Expression _terms_ are the operands for unary and binary expressions, as well
+as acting as expressions in their own right.
+
+```ebnf
+ExprTerm = (
+    LiteralValue |
+    CollectionValue |
+    TemplateExpr |
+    VariableExpr |
+    FunctionCall |
+    ForExpr |
+    ExprTerm Index |
+    ExprTerm GetAttr |
+    ExprTerm Splat |
+    "(" Expression ")"
+);
+```
+
+The productions for these different term types are given in their corresponding
+sections.
+
+Between the `(` and `)` characters denoting a sub-expression, newline
+characters are ignored as whitespace.
+
+### Literal Values
+
+A _literal value_ immediately represents a particular value of a primitive
+type.
+
+```ebnf
+LiteralValue = (
+  NumericLit |
+  "true" |
+  "false" |
+  "null"
+);
+```
+
+* Numeric literals represent values of type _number_.
+* The `true` and `false` keywords represent values of type _bool_.
+* The `null` keyword represents a null value of the dynamic pseudo-type.
+
+String literals are not directly available in the expression sub-language, but
+are available via the template sub-language, which can in turn be incorporated
+via _template expressions_.
+
+### Collection Values
+
+A _collection value_ combines zero or more other expressions to produce a
+collection value.
+
+```ebnf
+CollectionValue = tuple | object;
+tuple = "[" (
+    (Expression ("," Expression)* ","?)?
+) "]";
+object = "{" (
+    (objectelem ("," objectelem)* ","?)?
+) "}";
+objectelem = (Identifier | Expression) "=" Expression;
+```
+
+Only tuple and object values can be directly constructed via native syntax.
+Tuple and object values can in turn be converted to list, set and map values
+with other operations, which behaves as defined by the syntax-agnostic HCL
+information model.
+
+When specifying an object element, an identifier is interpreted as a literal
+attribute name as opposed to a variable reference. To populate an item key
+from a variable, use parentheses to disambiguate:
+
+* `{foo = "baz"}` is interpreted as an attribute literally named `foo`.
+* `{(foo) = "baz"}` is interpreted as an attribute whose name is taken
+  from the variable named `foo`.
+
+Between the open and closing delimiters of these sequences, newline sequences
+are ignored as whitespace.
+
+There is a syntax ambiguity between _for expressions_ and collection values
+whose first element is a reference to a variable named `for`. The
+_for expression_ interpretation has priority, so to produce a tuple whose
+first element is the value of a variable named `for`, or an object with a
+key named `for`, use paretheses to disambiguate:
+
+* `[for, foo, baz]` is a syntax error.
+* `[(for), foo, baz]` is a tuple whose first element is the value of variable
+  `for`.
+* `{for: 1, baz: 2}` is a syntax error.
+* `{(for): 1, baz: 2}` is an object with an attribute literally named `for`.
+* `{baz: 2, for: 1}` is equivalent to the previous example, and resolves the
+  ambiguity by reordering.
+
+### Template Expressions
+
+A _template expression_ embeds a program written in the template sub-language
+as an expression. Template expressions come in two forms:
+
+* A _quoted_ template expression is delimited by quote characters (`"`) and
+  defines a template as a single-line expression with escape characters.
+* A _heredoc_ template expression is introduced by a `<<` sequence and
+  defines a template via a multi-line sequence terminated by a user-chosen
+  delimiter.
+
+In both cases the template interpolation and directive syntax is available for
+use within the delimiters, and any text outside of these special sequences is
+interpreted as a literal string.
+
+In _quoted_ template expressions any literal string sequences within the 
+template behave in a special way: literal newline sequences are not permitted
+and instead _escape sequences_ can be included, starting with the
+backslash `\`:
+
+```
+    \n         Unicode newline control character
+    \r         Unicode carriage return control character
+    \t         Unicode tab control character
+    \"         Literal quote mark, used to prevent interpretation as end of string
+    \\         Literal backslash, used to prevent interpretation as escape sequence
+    \uNNNN     Unicode character from Basic Multilingual Plane (NNNN is four hexadecimal digits)
+    \UNNNNNNNN Unicode character from supplementary planes (NNNNNNNN is eight hexadecimal digits)
+```
+
+The _heredoc_ template expression type is introduced by either `<<` or `<<-`,
+followed by an identifier. The template expression ends when the given
+identifier subsequently appears again on a line of its own.
+
+If a heredoc template is introduced with the `<<-` symbol, any literal string
+at the start of each line is analyzed to find the minimum number of leading
+spaces, and then that number of prefix spaces is removed from all line-leading
+literal strings. The final closing marker may also have an arbitrary number
+of spaces preceding it on its line.
+
+```ebnf
+TemplateExpr = quotedTemplate | heredocTemplate;
+quotedTemplate = (as defined in prose above);
+heredocTemplate = (
+    ("<<" | "<<-") Identifier Newline
+    (content as defined in prose above)
+    Identifier Newline
+);
+```
+
+A quoted template expression containing only a single literal string serves
+as a syntax for defining literal string _expressions_. In certain contexts
+the template syntax is restricted in this manner:
+
+```ebnf
+StringLit = '"' (quoted literals as defined in prose above) '"';
+```
+
+The `StringLit` production permits the escape sequences discussed for quoted
+template expressions as above, but does _not_ permit template interpolation
+or directive sequences.
+
+### Variables and Variable Expressions
+
+A _variable_ is a value that has been assigned a symbolic name. Variables are
+made available for use in expressions by the calling application, by populating
+the _global scope_ used for expression evaluation.
+
+Variables can also be created by expressions themselves, which always creates
+a _child scope_ that incorporates the variables from its parent scope but
+(re-)defines zero or more names with new values.
+
+The value of a variable is accessed using a _variable expression_, which is
+a standalone `Identifier` whose name corresponds to a defined variable:
+
+```ebnf
+VariableExpr = Identifier;
+```
+
+Variables in a particular scope are immutable, but child scopes may _hide_
+a variable from an ancestor scope by defining a new variable of the same name.
+When looking up variables, the most locally-defined variable of the given name
+is used, and ancestor-scoped variables of the same name cannot be accessed.
+
+No direct syntax is provided for declaring or assigning variables, but other
+expression constructs implicitly create child scopes and define variables as
+part of their evaluation.
+
+### Functions and Function Calls
+
+A _function_ is an operation that has been assigned a symbolic name. Functions
+are made available for use in expressions by the calling application, by
+populating the _function table_ used for expression evaluation.
+
+The namespace of functions is distinct from the namespace of variables. A
+function and a variable may share the same name with no implication that they
+are in any way related.
+
+A function can be executed via a _function call_ expression:
+
+```ebnf
+FunctionCall = Identifier "(" arguments ")";
+Arguments = (
+    () ||
+    (Expression ("," Expression)* ("," | "...")?)
+);
+```
+
+The definition of functions and the semantics of calling them are defined by
+the language-agnostic HCL information model. The given arguments are mapped
+onto the function's _parameters_ and the result of a function call expression
+is the return value of the named function when given those arguments.
+
+If the final argument expression is followed by the ellipsis symbol (`...`),
+the final argument expression must evaluate to either a list or tuple value.
+The elements of the value are each mapped to a single parameter of the
+named function, beginning at the first parameter remaining after all other
+argument expressions have been mapped.
+
+Within the parentheses that delimit the function arguments, newline sequences
+are ignored as whitespace.
+
+### For Expressions
+
+A _for expression_ is a construct for constructing a collection by projecting
+the items from another collection.
+
+```ebnf
+ForExpr = forTupleExpr | forObjectExpr;
+forTupleExpr = "[" forIntro Expression forCond? "]";
+forObjectExpr = "{" forIntro Expression "=>" Expression "..."? forCond? "}";
+forIntro = "for" Identifier ("," Identifier)? "in" Expression ":";
+forCond = "if" Expression;
+```
+
+The punctuation used to delimit a for expression decide whether it will produce
+a tuple value (`[` and `]`) or an object value (`{` and `}`).
+
+The "introduction" is equivalent in both cases: the keyword `for` followed by
+either one or two identifiers separated by a comma which define the temporary
+variable names used for iteration, followed by the keyword `in` and then
+an expression that must evaluate to a value that can be iterated. The
+introduction is then terminated by the colon (`:`) symbol.
+
+If only one identifier is provided, it is the name of a variable that will
+be temporarily assigned the value of each element during iteration. If both
+are provided, the first is the key and the second is the value.
+
+Tuple, object, list, map, and set types are iterable. The type of collection
+used defines how the key and value variables are populated:
+
+* For tuple and list types, the _key_ is the zero-based index into the
+  sequence for each element, and the _value_ is the element value. The
+  elements are visited in index order.
+* For object and map types, the _key_ is the string attribute name or element
+  key, and the _value_ is the attribute or element value. The elements are
+  visited in the order defined by a lexicographic sort of the attribute names
+  or keys.
+* For set types, the _key_ and _value_ are both the element value. The elements
+  are visited in an undefined but consistent order.
+
+The expression after the colon and (in the case of object `for`) the expression
+after the `=>` are both evaluated once for each element of the source
+collection, in a local scope that defines the key and value variable names
+specified.
+
+The results of evaluating these expressions for each input element are used
+to populate an element in the new collection. In the case of tuple `for`, the
+single expression becomes an element, appending values to the tuple in visit
+order. In the case of object `for`, the pair of expressions is used as an
+attribute name and value respectively, creating an element in the resulting
+object.
+
+In the case of object `for`, it is an error if two input elements produce
+the same result from the attribute name expression, since duplicate
+attributes are not possible. If the ellipsis symbol (`...`) appears
+immediately after the value experssion, this activates the grouping mode in
+which each value in the resulting object is a _tuple_ of all of the values
+that were produced against each distinct key.
+
+* `[for v in ["a", "b"]: v]` returns `["a", "b"]`.
+* `[for i, v in ["a", "b"]: i]` returns `[0, 1]`.
+* `{for i, v in ["a", "b"]: v => i}` returns `{a = 0, b = 1}`.
+* `{for i, v in ["a", "a", "b"]: k => v}` produces an error, because attribute
+  `a` is defined twice.
+* `{for i, v in ["a", "a", "b"]: v => i...}` returns `{a = [0, 1], b = [2]}`.
+
+If the `if` keyword is used after the element expression(s), it applies an
+additional predicate that can be used to conditionally filter elements from
+the source collection from consideration. The expression following `if` is
+evaluated once for each source element, in the same scope used for the
+element expression(s). It must evaluate to a boolean value; if `true`, the
+element will be evaluated as normal, while if `false` the element will be
+skipped.
+
+* `[for i, v in ["a", "b", "c"]: v if i < 2]` returns `["a", "b"]`.
+
+If the collection value, element expression(s) or condition expression return
+unknown values that are otherwise type-valid, the result is a value of the
+dynamic pseudo-type.
+
+### Index Operator
+
+The _index_ operator returns the value of a single element of a collection
+value. It is a postfix operator and can be applied to any value that has
+a tuple, object, map, or list type.
+
+```ebnf
+Index = "[" Expression "]";
+```
+
+The expression delimited by the brackets is the _key_ by which an element
+will be looked up.
+
+If the index operator is applied to a value of tuple or list type, the
+key expression must be an non-negative integer number representing the
+zero-based element index to access. If applied to a value of object or map
+type, the key expression must be a string representing the attribute name
+or element key. If the given key value is not of the appropriate type, a
+conversion is attempted using the conversion rules from the HCL
+syntax-agnostic information model.
+
+An error is produced if the given key expression does not correspond to
+an element in the collection, either because it is of an unconvertable type,
+because it is outside the range of elements for a tuple or list, or because
+the given attribute or key does not exist.
+
+If either the collection or the key are an unknown value of an
+otherwise-suitable type, the return value is an unknown value whose type
+matches what type would be returned given known values, or a value of the
+dynamic pseudo-type if type information alone cannot determine a suitable
+return type.
+
+Within the brackets that delimit the index key, newline sequences are ignored
+as whitespace.
+
+### Attribute Access Operator
+
+The _attribute access_ operator returns the value of a single attribute in
+an object value. It is a postfix operator and can be applied to any value
+that has an object type.
+
+```ebnf
+GetAttr = "." Identifier;
+```
+
+The given identifier is interpreted as the name of the attribute to access.
+An error is produced if the object to which the operator is applied does not
+have an attribute with the given name.
+
+If the object is an unknown value of a type that has the attribute named, the
+result is an unknown value of the attribute's type.
+
+### Splat Operators
+
+The _splat operators_ allow convenient access to attributes or elements of
+elements in a tuple, list, or set value.
+
+There are two kinds of "splat" operator:
+
+* The _attribute-only_ splat operator supports only attribute lookups into
+  the elements from a list, but supports an arbitrary number of them.
+
+* The _full_ splat operator additionally supports indexing into the elements
+  from a list, and allows any combination of attribute access and index
+  operations.
+
+```ebnf
+Splat = attrSplat | fullSplat;
+attrSplat = "." "*" GetAttr*;
+fullSplat = "[" "*" "]" (GetAttr | Index)*;
+```
+
+The splat operators can be thought of as shorthands for common operations that
+could otherwise be performed using _for expressions_:
+
+* `tuple.*.foo.bar[0]` is approximately equivalent to
+  `[for v in tuple: v.foo.bar][0]`.
+* `tuple[*].foo.bar[0]` is approximately equivalent to
+  `[for v in tuple: v.foo.bar[0]]`
+
+Note the difference in how the trailing index operator is interpreted in
+each case. This different interpretation is the key difference between the
+_attribute-only_ and _full_ splat operators.
+
+Splat operators have one additional behavior compared to the equivalent
+_for expressions_ shown above: if a splat operator is applied to a value that
+is _not_ of tuple, list, or set type, the value is coerced automatically into
+a single-value list of the value type:
+
+* `any_object.*.id` is equivalent to `[any_object.id]`, assuming that `any_object`
+  is a single object.
+* `any_number.*` is equivalent to `[any_number]`, assuming that `any_number`
+  is a single number.
+
+If the left operand of a splat operator is an unknown value of any type, the
+result is a value of the dynamic pseudo-type.
+
+### Operations
+
+Operations apply a particular operator to either one or two expression terms.
+
+```ebnf
+Operation = unaryOp | binaryOp;
+unaryOp = ("-" | "!") ExprTerm;
+binaryOp = ExprTerm binaryOperator ExprTerm;
+binaryOperator = compareOperator | arithmeticOperator | logicOperator;
+compareOperator = "==" | "!=" | "<" | ">" | "<=" | ">=";
+arithmeticOperator = "+" | "-" | "*" | "/" | "%";
+logicOperator = "&&" | "||" | "!";
+```
+
+The unary operators have the highest precedence.
+
+The binary operators are grouped into the following precedence levels:
+
+```
+Level    Operators
+  6      * / %
+  5      + -
+  4      > >= < <=
+  3      == !=
+  2      &&
+  1      ||
+```
+
+Higher values of "level" bind tighter. Operators within the same precedence
+level have left-to-right associativity. For example, `x / y * z` is equivalent
+to `(x / y) * z`.
+
+### Comparison Operators
+
+Comparison operators always produce boolean values, as a result of testing
+the relationship between two values.
+
+The two equality operators apply to values of any type:
+
+```
+a == b  equal
+a != b  not equal
+```
+
+Two values are equal if the are of identical types and their values are
+equal as defined in the HCL syntax-agnostic information model. The equality
+operators are commutative and opposite, such that `(a == b) == !(a != b)`
+and `(a == b) == (b == a)` for all values `a` and `b`.
+
+The four numeric comparison operators apply only to numbers:
+
+```
+a < b   less than
+a <= b  less than or equal to
+a > b   greater than
+a >= b  greater than or equal to
+```
+
+If either operand of a comparison operator is a correctly-typed unknown value
+or a value of the dynamic pseudo-type, the result is an unknown boolean.
+
+### Arithmetic Operators
+
+Arithmetic operators apply only to number values and always produce number
+values as results.
+
+```
+a + b   sum        (addition)
+a - b   difference (subtraction)
+a * b   product    (multiplication)
+a / b   quotient   (division)
+a % b   remainder  (modulo)
+-a      negation
+```
+
+Arithmetic operations are considered to be performed in an arbitrary-precision
+number space.
+
+If either operand of an arithmetic operator is an unknown number or a value
+of the dynamic pseudo-type, the result is an unknown number. 
+
+### Logic Operators
+
+Logic operators apply only to boolean values and always produce boolean values
+as results.
+
+```
+a && b   logical AND
+a || b   logical OR
+!a       logical NOT
+```
+
+If either operand of a logic operator is an unknown bool value or a value
+of the dynamic pseudo-type, the result is an unknown bool value.
+
+### Conditional Operator
+
+The conditional operator allows selecting from one of two expressions based on
+the outcome of a boolean expression.
+
+```ebnf
+Conditional = Expression "?" Expression ":" Expression;
+```
+
+The first expression is the _predicate_, which is  evaluated and must produce
+a boolean result. If the predicate value is `true`, the result of the second
+expression is the result of the conditional. If the predicate value is
+`false`, the result of the third expression is the result of the conditional.
+
+The second and third expressions must be of the same type or must be able to
+unify into a common type using the type unification rules defined in the
+HCL syntax-agnostic information model. This unified type is the result type
+of the conditional, with both expressions converted as necessary to the
+unified type.
+
+If the predicate is an unknown boolean value or a value of the dynamic
+pseudo-type then the result is an unknown value of the unified type of the
+other two expressions.
+
+If either the second or third expressions produce errors when evaluated,
+these errors are passed through only if the erroneous expression is selected.
+This allows for expressions such as
+`length(some_list) > 0 ? some_list[0] : default` (given some suitable `length`
+function) without producing an error when the predicate is `false`.
+
+## Templates
+
+The template sub-language is used within template expressions to concisely
+combine strings and other values to produce other strings. It can also be
+used in isolation as a standalone template language.
+
+```ebnf
+Template = (
+    TemplateLiteral |
+    TemplateInterpolation |
+    TemplateDirective
+)*
+TemplateDirective = TemplateIf | TemplateFor;
+```
+
+A template behaves like an expression that always returns a string value.
+The different elements of the template are evaluated and combined into a
+single string to return. If any of the elements produce an unknown string
+or a value of the dynamic pseudo-type, the result is an unknown string.
+
+An important use-case for standalone templates is to enable the use of
+expressions in alternative HCL syntaxes where a native expression grammar is
+not available. For example, the HCL JSON profile treats the values of JSON
+strings as standalone templates when attributes are evaluated in expression
+mode.
+
+### Template Literals
+
+A template literal is a literal sequence of characters to include in the
+resulting string. When the template sub-language is used standalone, a
+template literal can contain any unicode character, with the exception
+of the sequences that introduce interpolations and directives, and for the
+sequences that escape those introductions.
+
+The interpolation and directive introductions are escaped by doubling their
+leading characters. The `${` sequence is escaped as `$${` and the `%{`
+sequence is escaped as `%%{`.
+
+When the template sub-language is embedded in the expression language via
+_template expressions_, additional constraints and transforms are applied to
+template literalsas described in the definition of template expressions.
+
+The value of a template literal can be modified by _strip markers_ in any
+interpolations or directives that are adjacent to it. A strip marker is
+a tilde (`~`) placed immediately after the opening `{` or before the closing
+`}` of a template sequence:
+
+* `hello ${~ "world" }` produces `"helloworld"`.
+* `%{ if true ~} hello %{~ endif }` produces `"hello"`.
+
+When a strip marker is present, any spaces adjacent to it in the corresponding
+string literal (if any) are removed before producing the final value. Space
+characters are interpreted as per Unicode's definition.
+
+Stripping is done at syntax level rather than value level. Values returned
+by interpolations or directives are not subject to stripping:
+
+* `${"hello" ~}${" world"}` produces `"hello world"`, and not `"helloworld"`,
+  because the space is not in a template literal directly adjacent to the
+  strip marker.
+
+### Template Interpolations
+
+An _interpolation sequence_ evaluates an expression (written in the
+expression sub-language), converts the result to a string value, and
+replaces itself with the resulting string.
+
+```ebnf
+TemplateInterpolation = ("${" | "${~") Expression ("}" | "~}";
+```
+
+If the expression result cannot be converted to a string, an error is
+produced.
+
+### Template If Directive
+
+The template `if` directive is the template equivalent of the
+_conditional expression_, allowing selection of one of two sub-templates based
+on the value of a predicate expression.
+
+```ebnf
+TemplateIf = (
+    ("%{" | "%{~") "if" Expression ("}" | "~}")
+    Template
+    (
+        ("%{" | "%{~") "else" ("}" | "~}")
+        Template
+    )?
+    ("%{" | "%{~") "endif" ("}" | "~}")
+);
+```
+
+The evaluation of the `if` directive is equivalent to the conditional
+expression, with the following exceptions:
+
+* The two sub-templates always produce strings, and thus the result value is
+  also always a string.
+* The `else` clause may be omitted, in which case the conditional's third
+  expression result is implied to be the empty string.
+
+### Template For Directive
+
+The template `for` directive is the template equivalent of the _for expression_,
+producing zero or more copies of its sub-template based on the elements of
+a collection.
+
+```ebnf
+TemplateFor = (
+    ("%{" | "%{~") "for" Identifier ("," Identifier) "in" Expression ("}" | "~}")
+    Template
+    ("%{" | "%{~") "endfor" ("}" | "~}")
+);
+```
+
+The evaluation of the `for` directive is equivalent to the _for expression_
+when producing a tuple, with the following exceptions:
+
+* The sub-template always produces a string.
+* There is no equivalent of the "if" clause on the for expression.
+* The elements of the resulting tuple are all converted to strings and
+  concatenated to produce a flat string result.
+
+### Template Interpolation Unwrapping
+
+As a special case, a template that consists only of a single interpolation,
+with no surrounding literals, directives or other interpolations, is
+"unwrapped". In this case, the result of the interpolation expression is
+returned verbatim, without conversion to string.
+
+This special case exists primarily to enable the native template language
+to be used inside strings in alternative HCL syntaxes that lack a first-class
+template or expression syntax. Unwrapping allows arbitrary expressions to be
+used to populate attributes when strings in such languages are interpreted
+as templates.
+
+* `${true}` produces the boolean value `true`
+* `${"${true}"}` produces the boolean value `true`, because both the inner
+  and outer interpolations are subject to unwrapping.
+* `hello ${true}` produces the string `"hello true"`
+* `${""}${true}` produces the string `"true"` because there are two
+  interpolation sequences, even though one produces an empty result.
+* `%{ for v in [true] }${v}%{ endif }` produces the string `true` because
+  the presence of the `for` directive circumvents the unwrapping even though
+  the final result is a single value.
+
+In some contexts this unwrapping behavior may be circumvented by the calling
+application, by converting the final template result to string. This is
+necessary, for example, if a standalone template is being used to produce
+the direct contents of a file, since the result in that case must always be a
+string.
+
+## Static Analysis
+
+The HCL static analysis operations are implemented for some expression types
+in the native syntax, as described in the following sections.
+
+A goal for static analysis of the native syntax is for the interpretation to
+be as consistent as possible with the dynamic evaluation interpretation of
+the given expression, though some deviations are intentionally made in order
+to maximize the potential for analysis.
+
+### Static List
+
+The tuple construction syntax can be interpreted as a static list. All of
+the expression elements given are returned as the static list elements,
+with no further interpretation.
+
+### Static Map
+
+The object construction syntax can be interpreted as a static map. All of the
+key/value pairs given are returned as the static pairs, with no further
+interpretation.
+
+The usual requirement that an attribute name be interpretable as a string
+does not apply to this static analyis, allowing callers to provide map-like
+constructs with different key types by building on the map syntax.
+
+### Static Call
+
+The function call syntax can be interpreted as a static call. The called
+function name is returned verbatim and the given argument expressions are
+returned as the static arguments, with no further interpretation.
+
+### Static Traversal
+
+A variable expression and any attached attribute access operations and
+constant index operations can be interpreted as a static traversal.
+
+The keywords `true`, `false` and `null` can also be interpreted as
+static traversals, behaving as if they were references to variables of those
+names, to allow callers to redefine the meaning of those keywords in certain
+contexts.
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/structure.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/structure.go
new file mode 100644
index 0000000..d69f65b
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/structure.go
@@ -0,0 +1,379 @@
+package hclsyntax
+
+import (
+        "fmt"
+        "strings"
+
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+// AsHCLBlock returns the block data expressed as a *hcl.Block.
+func (b *Block) AsHCLBlock() *hcl.Block {
+        lastHeaderRange := b.TypeRange
+        if len(b.LabelRanges) > 0 {
+                lastHeaderRange = b.LabelRanges[len(b.LabelRanges)-1]
+        }
+
+        return &hcl.Block{
+                Type:   b.Type,
+                Labels: b.Labels,
+                Body:   b.Body,
+
+                DefRange:    hcl.RangeBetween(b.TypeRange, lastHeaderRange),
+                TypeRange:   b.TypeRange,
+                LabelRanges: b.LabelRanges,
+        }
+}
+
+// Body is the implementation of hcl.Body for the HCL native syntax.
+type Body struct {
+        Attributes Attributes
+        Blocks     Blocks
+
+        // These are used with PartialContent to produce a "remaining items"
+        // body to return. They are nil on all bodies fresh out of the parser.
+        hiddenAttrs  map[string]struct{}
+        hiddenBlocks map[string]struct{}
+
+        SrcRange hcl.Range
+        EndRange hcl.Range // Final token of the body, for reporting missing items
+}
+
+// Assert that *Body implements hcl.Body
+var assertBodyImplBody hcl.Body = &Body{}
+
+func (b *Body) walkChildNodes(w internalWalkFunc) {
+        b.Attributes = w(b.Attributes).(Attributes)
+        b.Blocks = w(b.Blocks).(Blocks)
+}
+
+func (b *Body) Range() hcl.Range {
+        return b.SrcRange
+}
+
+func (b *Body) Content(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Diagnostics) {
+        content, remainHCL, diags := b.PartialContent(schema)
+
+        // No we'll see if anything actually remains, to produce errors about
+        // extraneous items.
+        remain := remainHCL.(*Body)
+
+        for name, attr := range b.Attributes {
+                if _, hidden := remain.hiddenAttrs[name]; !hidden {
+                        var suggestions []string
+                        for _, attrS := range schema.Attributes {
+                                if _, defined := content.Attributes[attrS.Name]; defined {
+                                        continue
+                                }
+                                suggestions = append(suggestions, attrS.Name)
+                        }
+                        suggestion := nameSuggestion(name, suggestions)
+                        if suggestion != "" {
+                                suggestion = fmt.Sprintf(" Did you mean %q?", suggestion)
+                        } else {
+                                // Is there a block of the same name?
+                                for _, blockS := range schema.Blocks {
+                                        if blockS.Type == name {
+                                                suggestion = fmt.Sprintf(" Did you mean to define a block of type %q?", name)
+                                                break
+                                        }
+                                }
+                        }
+
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Unsupported attribute",
+                                Detail:   fmt.Sprintf("An attribute named %q is not expected here.%s", name, suggestion),
+                                Subject:  &attr.NameRange,
+                        })
+                }
+        }
+
+        for _, block := range b.Blocks {
+                blockTy := block.Type
+                if _, hidden := remain.hiddenBlocks[blockTy]; !hidden {
+                        var suggestions []string
+                        for _, blockS := range schema.Blocks {
+                                suggestions = append(suggestions, blockS.Type)
+                        }
+                        suggestion := nameSuggestion(blockTy, suggestions)
+                        if suggestion != "" {
+                                suggestion = fmt.Sprintf(" Did you mean %q?", suggestion)
+                        } else {
+                                // Is there an attribute of the same name?
+                                for _, attrS := range schema.Attributes {
+                                        if attrS.Name == blockTy {
+                                                suggestion = fmt.Sprintf(" Did you mean to define attribute %q?", blockTy)
+                                                break
+                                        }
+                                }
+                        }
+
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Unsupported block type",
+                                Detail:   fmt.Sprintf("Blocks of type %q are not expected here.%s", blockTy, suggestion),
+                                Subject:  &block.TypeRange,
+                        })
+                }
+        }
+
+        return content, diags
+}
+
+func (b *Body) PartialContent(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Body, hcl.Diagnostics) {
+        attrs := make(hcl.Attributes)
+        var blocks hcl.Blocks
+        var diags hcl.Diagnostics
+        hiddenAttrs := make(map[string]struct{})
+        hiddenBlocks := make(map[string]struct{})
+
+        if b.hiddenAttrs != nil {
+                for k, v := range b.hiddenAttrs {
+                        hiddenAttrs[k] = v
+                }
+        }
+        if b.hiddenBlocks != nil {
+                for k, v := range b.hiddenBlocks {
+                        hiddenBlocks[k] = v
+                }
+        }
+
+        for _, attrS := range schema.Attributes {
+                name := attrS.Name
+                attr, exists := b.Attributes[name]
+                _, hidden := hiddenAttrs[name]
+                if hidden || !exists {
+                        if attrS.Required {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Missing required attribute",
+                                        Detail:   fmt.Sprintf("The attribute %q is required, but no definition was found.", attrS.Name),
+                                        Subject:  b.MissingItemRange().Ptr(),
+                                })
+                        }
+                        continue
+                }
+
+                hiddenAttrs[name] = struct{}{}
+                attrs[name] = attr.AsHCLAttribute()
+        }
+
+        blocksWanted := make(map[string]hcl.BlockHeaderSchema)
+        for _, blockS := range schema.Blocks {
+                blocksWanted[blockS.Type] = blockS
+        }
+
+        for _, block := range b.Blocks {
+                if _, hidden := hiddenBlocks[block.Type]; hidden {
+                        continue
+                }
+                blockS, wanted := blocksWanted[block.Type]
+                if !wanted {
+                        continue
+                }
+
+                if len(block.Labels) > len(blockS.LabelNames) {
+                        name := block.Type
+                        if len(blockS.LabelNames) == 0 {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  fmt.Sprintf("Extraneous label for %s", name),
+                                        Detail: fmt.Sprintf(
+                                                "No labels are expected for %s blocks.", name,
+                                        ),
+                                        Subject: block.LabelRanges[0].Ptr(),
+                                        Context: hcl.RangeBetween(block.TypeRange, block.OpenBraceRange).Ptr(),
+                                })
+                        } else {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  fmt.Sprintf("Extraneous label for %s", name),
+                                        Detail: fmt.Sprintf(
+                                                "Only %d labels (%s) are expected for %s blocks.",
+                                                len(blockS.LabelNames), strings.Join(blockS.LabelNames, ", "), name,
+                                        ),
+                                        Subject: block.LabelRanges[len(blockS.LabelNames)].Ptr(),
+                                        Context: hcl.RangeBetween(block.TypeRange, block.OpenBraceRange).Ptr(),
+                                })
+                        }
+                        continue
+                }
+
+                if len(block.Labels) < len(blockS.LabelNames) {
+                        name := block.Type
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  fmt.Sprintf("Missing %s for %s", blockS.LabelNames[len(block.Labels)], name),
+                                Detail: fmt.Sprintf(
+                                        "All %s blocks must have %d labels (%s).",
+                                        name, len(blockS.LabelNames), strings.Join(blockS.LabelNames, ", "),
+                                ),
+                                Subject: &block.OpenBraceRange,
+                                Context: hcl.RangeBetween(block.TypeRange, block.OpenBraceRange).Ptr(),
+                        })
+                        continue
+                }
+
+                blocks = append(blocks, block.AsHCLBlock())
+        }
+
+        // We hide blocks only after we've processed all of them, since otherwise
+        // we can't process more than one of the same type.
+        for _, blockS := range schema.Blocks {
+                hiddenBlocks[blockS.Type] = struct{}{}
+        }
+
+        remain := &Body{
+                Attributes: b.Attributes,
+                Blocks:     b.Blocks,
+
+                hiddenAttrs:  hiddenAttrs,
+                hiddenBlocks: hiddenBlocks,
+
+                SrcRange: b.SrcRange,
+                EndRange: b.EndRange,
+        }
+
+        return &hcl.BodyContent{
+                Attributes: attrs,
+                Blocks:     blocks,
+
+                MissingItemRange: b.MissingItemRange(),
+        }, remain, diags
+}
+
+func (b *Body) JustAttributes() (hcl.Attributes, hcl.Diagnostics) {
+        attrs := make(hcl.Attributes)
+        var diags hcl.Diagnostics
+
+        if len(b.Blocks) > 0 {
+                example := b.Blocks[0]
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  fmt.Sprintf("Unexpected %s block", example.Type),
+                        Detail:   "Blocks are not allowed here.",
+                        Context:  &example.TypeRange,
+                })
+                // we will continue processing anyway, and return the attributes
+                // we are able to find so that certain analyses can still be done
+                // in the face of errors.
+        }
+
+        if b.Attributes == nil {
+                return attrs, diags
+        }
+
+        for name, attr := range b.Attributes {
+                if _, hidden := b.hiddenAttrs[name]; hidden {
+                        continue
+                }
+                attrs[name] = attr.AsHCLAttribute()
+        }
+
+        return attrs, diags
+}
+
+func (b *Body) MissingItemRange() hcl.Range {
+        return b.EndRange
+}
+
+// Attributes is the collection of attribute definitions within a body.
+type Attributes map[string]*Attribute
+
+func (a Attributes) walkChildNodes(w internalWalkFunc) {
+        for k, attr := range a {
+                a[k] = w(attr).(*Attribute)
+        }
+}
+
+// Range returns the range of some arbitrary point within the set of
+// attributes, or an invalid range if there are no attributes.
+//
+// This is provided only to complete the Node interface, but has no practical
+// use.
+func (a Attributes) Range() hcl.Range {
+        // An attributes doesn't really have a useful range to report, since
+        // it's just a grouping construct. So we'll arbitrarily take the
+        // range of one of the attributes, or produce an invalid range if we have
+        // none. In practice, there's little reason to ask for the range of
+        // an Attributes.
+        for _, attr := range a {
+                return attr.Range()
+        }
+        return hcl.Range{
+                Filename: "<unknown>",
+        }
+}
+
+// Attribute represents a single attribute definition within a body.
+type Attribute struct {
+        Name string
+        Expr Expression
+
+        SrcRange    hcl.Range
+        NameRange   hcl.Range
+        EqualsRange hcl.Range
+}
+
+func (a *Attribute) walkChildNodes(w internalWalkFunc) {
+        a.Expr = w(a.Expr).(Expression)
+}
+
+func (a *Attribute) Range() hcl.Range {
+        return a.SrcRange
+}
+
+// AsHCLAttribute returns the block data expressed as a *hcl.Attribute.
+func (a *Attribute) AsHCLAttribute() *hcl.Attribute {
+        return &hcl.Attribute{
+                Name: a.Name,
+                Expr: a.Expr,
+
+                Range:     a.SrcRange,
+                NameRange: a.NameRange,
+        }
+}
+
+// Blocks is the list of nested blocks within a body.
+type Blocks []*Block
+
+func (bs Blocks) walkChildNodes(w internalWalkFunc) {
+        for i, block := range bs {
+                bs[i] = w(block).(*Block)
+        }
+}
+
+// Range returns the range of some arbitrary point within the list of
+// blocks, or an invalid range if there are no blocks.
+//
+// This is provided only to complete the Node interface, but has no practical
+// use.
+func (bs Blocks) Range() hcl.Range {
+        if len(bs) > 0 {
+                return bs[0].Range()
+        }
+        return hcl.Range{
+                Filename: "<unknown>",
+        }
+}
+
+// Block represents a nested block structure
+type Block struct {
+        Type   string
+        Labels []string
+        Body   *Body
+
+        TypeRange       hcl.Range
+        LabelRanges     []hcl.Range
+        OpenBraceRange  hcl.Range
+        CloseBraceRange hcl.Range
+}
+
+func (b *Block) walkChildNodes(w internalWalkFunc) {
+        b.Body = w(b.Body).(*Body)
+}
+
+func (b *Block) Range() hcl.Range {
+        return hcl.RangeBetween(b.TypeRange, b.CloseBraceRange)
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/token.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/token.go
new file mode 100644
index 0000000..bcaa15f
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/token.go
@@ -0,0 +1,272 @@
+package hclsyntax
+
+import (
+        "fmt"
+
+        "github.com/apparentlymart/go-textseg/textseg"
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+// Token represents a sequence of bytes from some HCL code that has been
+// tagged with a type and its range within the source file.
+type Token struct {
+        Type  TokenType
+        Bytes []byte
+        Range hcl.Range
+}
+
+// Tokens is a slice of Token.
+type Tokens []Token
+
+// TokenType is an enumeration used for the Type field on Token.
+type TokenType rune
+
+const (
+        // Single-character tokens are represented by their own character, for
+        // convenience in producing these within the scanner. However, the values
+        // are otherwise arbitrary and just intended to be mnemonic for humans
+        // who might see them in debug output.
+
+        TokenOBrace   TokenType = '{'
+        TokenCBrace   TokenType = '}'
+        TokenOBrack   TokenType = '['
+        TokenCBrack   TokenType = ']'
+        TokenOParen   TokenType = '('
+        TokenCParen   TokenType = ')'
+        TokenOQuote   TokenType = '«'
+        TokenCQuote   TokenType = '»'
+        TokenOHeredoc TokenType = 'H'
+        TokenCHeredoc TokenType = 'h'
+
+        TokenStar    TokenType = '*'
+        TokenSlash   TokenType = '/'
+        TokenPlus    TokenType = '+'
+        TokenMinus   TokenType = '-'
+        TokenPercent TokenType = '%'
+
+        TokenEqual         TokenType = '='
+        TokenEqualOp       TokenType = '≔'
+        TokenNotEqual      TokenType = '≠'
+        TokenLessThan      TokenType = '<'
+        TokenLessThanEq    TokenType = '≤'
+        TokenGreaterThan   TokenType = '>'
+        TokenGreaterThanEq TokenType = '≥'
+
+        TokenAnd  TokenType = '∧'
+        TokenOr   TokenType = '∨'
+        TokenBang TokenType = '!'
+
+        TokenDot   TokenType = '.'
+        TokenComma TokenType = ','
+
+        TokenEllipsis TokenType = '…'
+        TokenFatArrow TokenType = '⇒'
+
+        TokenQuestion TokenType = '?'
+        TokenColon    TokenType = ':'
+
+        TokenTemplateInterp  TokenType = '∫'
+        TokenTemplateControl TokenType = 'λ'
+        TokenTemplateSeqEnd  TokenType = '∎'
+
+        TokenQuotedLit TokenType = 'Q' // might contain backslash escapes
+        TokenStringLit TokenType = 'S' // cannot contain backslash escapes
+        TokenNumberLit TokenType = 'N'
+        TokenIdent     TokenType = 'I'
+
+        TokenComment TokenType = 'C'
+
+        TokenNewline TokenType = '\n'
+        TokenEOF     TokenType = '␄'
+
+        // The rest are not used in the language but recognized by the scanner so
+        // we can generate good diagnostics in the parser when users try to write
+        // things that might work in other languages they are familiar with, or
+        // simply make incorrect assumptions about the HCL language.
+
+        TokenBitwiseAnd TokenType = '&'
+        TokenBitwiseOr  TokenType = '|'
+        TokenBitwiseNot TokenType = '~'
+        TokenBitwiseXor TokenType = '^'
+        TokenStarStar   TokenType = '➚'
+        TokenBacktick   TokenType = '`'
+        TokenSemicolon  TokenType = ';'
+        TokenTabs       TokenType = '␉'
+        TokenInvalid    TokenType = '�'
+        TokenBadUTF8    TokenType = '💩'
+
+        // TokenNil is a placeholder for when a token is required but none is
+        // available, e.g. when reporting errors. The scanner will never produce
+        // this as part of a token stream.
+        TokenNil TokenType = '\x00'
+)
+
+func (t TokenType) GoString() string {
+        return fmt.Sprintf("hclsyntax.%s", t.String())
+}
+
+type scanMode int
+
+const (
+        scanNormal scanMode = iota
+        scanTemplate
+        scanIdentOnly
+)
+
+type tokenAccum struct {
+        Filename string
+        Bytes    []byte
+        Pos      hcl.Pos
+        Tokens   []Token
+}
+
+func (f *tokenAccum) emitToken(ty TokenType, startOfs, endOfs int) {
+        // Walk through our buffer to figure out how much we need to adjust
+        // the start pos to get our end pos.
+
+        start := f.Pos
+        start.Column += startOfs - f.Pos.Byte // Safe because only ASCII spaces can be in the offset
+        start.Byte = startOfs
+
+        end := start
+        end.Byte = endOfs
+        b := f.Bytes[startOfs:endOfs]
+        for len(b) > 0 {
+                advance, seq, _ := textseg.ScanGraphemeClusters(b, true)
+                if (len(seq) == 1 && seq[0] == '\n') || (len(seq) == 2 && seq[0] == '\r' && seq[1] == '\n') {
+                        end.Line++
+                        end.Column = 1
+                } else {
+                        end.Column++
+                }
+                b = b[advance:]
+        }
+
+        f.Pos = end
+
+        f.Tokens = append(f.Tokens, Token{
+                Type:  ty,
+                Bytes: f.Bytes[startOfs:endOfs],
+                Range: hcl.Range{
+                        Filename: f.Filename,
+                        Start:    start,
+                        End:      end,
+                },
+        })
+}
+
+type heredocInProgress struct {
+        Marker      []byte
+        StartOfLine bool
+}
+
+// checkInvalidTokens does a simple pass across the given tokens and generates
+// diagnostics for tokens that should _never_ appear in HCL source. This
+// is intended to avoid the need for the parser to have special support
+// for them all over.
+//
+// Returns a diagnostics with no errors if everything seems acceptable.
+// Otherwise, returns zero or more error diagnostics, though tries to limit
+// repetition of the same information.
+func checkInvalidTokens(tokens Tokens) hcl.Diagnostics {
+        var diags hcl.Diagnostics
+
+        toldBitwise := 0
+        toldExponent := 0
+        toldBacktick := 0
+        toldSemicolon := 0
+        toldTabs := 0
+        toldBadUTF8 := 0
+
+        for _, tok := range tokens {
+                switch tok.Type {
+                case TokenBitwiseAnd, TokenBitwiseOr, TokenBitwiseXor, TokenBitwiseNot:
+                        if toldBitwise < 4 {
+                                var suggestion string
+                                switch tok.Type {
+                                case TokenBitwiseAnd:
+                                        suggestion = " Did you mean boolean AND (\"&&\")?"
+                                case TokenBitwiseOr:
+                                        suggestion = " Did you mean boolean OR (\"&&\")?"
+                                case TokenBitwiseNot:
+                                        suggestion = " Did you mean boolean NOT (\"!\")?"
+                                }
+
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Unsupported operator",
+                                        Detail:   fmt.Sprintf("Bitwise operators are not supported.%s", suggestion),
+                                        Subject:  &tok.Range,
+                                })
+                                toldBitwise++
+                        }
+                case TokenStarStar:
+                        if toldExponent < 1 {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Unsupported operator",
+                                        Detail:   "\"**\" is not a supported operator. Exponentiation is not supported as an operator.",
+                                        Subject:  &tok.Range,
+                                })
+
+                                toldExponent++
+                        }
+                case TokenBacktick:
+                        // Only report for alternating (even) backticks, so we won't report both start and ends of the same
+                        // backtick-quoted string.
+                        if toldExponent < 4 && (toldExponent%2) == 0 {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Invalid character",
+                                        Detail:   "The \"`\" character is not valid. To create a multi-line string, use the \"heredoc\" syntax, like \"<<EOT\".",
+                                        Subject:  &tok.Range,
+                                })
+
+                                toldBacktick++
+                        }
+                case TokenSemicolon:
+                        if toldSemicolon < 1 {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Invalid character",
+                                        Detail:   "The \";\" character is not valid. Use newlines to separate attributes and blocks, and commas to separate items in collection values.",
+                                        Subject:  &tok.Range,
+                                })
+
+                                toldSemicolon++
+                        }
+                case TokenTabs:
+                        if toldTabs < 1 {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Invalid character",
+                                        Detail:   "Tab characters may not be used. The recommended indentation style is two spaces per indent.",
+                                        Subject:  &tok.Range,
+                                })
+
+                                toldTabs++
+                        }
+                case TokenBadUTF8:
+                        if toldBadUTF8 < 1 {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Invalid character encoding",
+                                        Detail:   "All input files must be UTF-8 encoded. Ensure that UTF-8 encoding is selected in your editor.",
+                                        Subject:  &tok.Range,
+                                })
+
+                                toldBadUTF8++
+                        }
+                case TokenInvalid:
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid character",
+                                Detail:   "This character is not used within the language.",
+                                Subject:  &tok.Range,
+                        })
+
+                        toldTabs++
+                }
+        }
+        return diags
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/token_type_string.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/token_type_string.go
new file mode 100644
index 0000000..93de7ee
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/token_type_string.go
@@ -0,0 +1,69 @@
+// Code generated by "stringer -type TokenType -output token_type_string.go"; DO NOT EDIT.
+
+package hclsyntax
+
+import "strconv"
+
+const _TokenType_name = "TokenNilTokenNewlineTokenBangTokenPercentTokenBitwiseAndTokenOParenTokenCParenTokenStarTokenPlusTokenCommaTokenMinusTokenDotTokenSlashTokenColonTokenSemicolonTokenLessThanTokenEqualTokenGreaterThanTokenQuestionTokenCommentTokenOHeredocTokenIdentTokenNumberLitTokenQuotedLitTokenStringLitTokenOBrackTokenCBrackTokenBitwiseXorTokenBacktickTokenCHeredocTokenOBraceTokenBitwiseOrTokenCBraceTokenBitwiseNotTokenOQuoteTokenCQuoteTokenTemplateControlTokenEllipsisTokenFatArrowTokenTemplateSeqEndTokenAndTokenOrTokenTemplateInterpTokenEqualOpTokenNotEqualTokenLessThanEqTokenGreaterThanEqTokenEOFTokenTabsTokenStarStarTokenInvalidTokenBadUTF8"
+
+var _TokenType_map = map[TokenType]string{
+        0:      _TokenType_name[0:8],
+        10:     _TokenType_name[8:20],
+        33:     _TokenType_name[20:29],
+        37:     _TokenType_name[29:41],
+        38:     _TokenType_name[41:56],
+        40:     _TokenType_name[56:67],
+        41:     _TokenType_name[67:78],
+        42:     _TokenType_name[78:87],
+        43:     _TokenType_name[87:96],
+        44:     _TokenType_name[96:106],
+        45:     _TokenType_name[106:116],
+        46:     _TokenType_name[116:124],
+        47:     _TokenType_name[124:134],
+        58:     _TokenType_name[134:144],
+        59:     _TokenType_name[144:158],
+        60:     _TokenType_name[158:171],
+        61:     _TokenType_name[171:181],
+        62:     _TokenType_name[181:197],
+        63:     _TokenType_name[197:210],
+        67:     _TokenType_name[210:222],
+        72:     _TokenType_name[222:235],
+        73:     _TokenType_name[235:245],
+        78:     _TokenType_name[245:259],
+        81:     _TokenType_name[259:273],
+        83:     _TokenType_name[273:287],
+        91:     _TokenType_name[287:298],
+        93:     _TokenType_name[298:309],
+        94:     _TokenType_name[309:324],
+        96:     _TokenType_name[324:337],
+        104:    _TokenType_name[337:350],
+        123:    _TokenType_name[350:361],
+        124:    _TokenType_name[361:375],
+        125:    _TokenType_name[375:386],
+        126:    _TokenType_name[386:401],
+        171:    _TokenType_name[401:412],
+        187:    _TokenType_name[412:423],
+        955:    _TokenType_name[423:443],
+        8230:   _TokenType_name[443:456],
+        8658:   _TokenType_name[456:469],
+        8718:   _TokenType_name[469:488],
+        8743:   _TokenType_name[488:496],
+        8744:   _TokenType_name[496:503],
+        8747:   _TokenType_name[503:522],
+        8788:   _TokenType_name[522:534],
+        8800:   _TokenType_name[534:547],
+        8804:   _TokenType_name[547:562],
+        8805:   _TokenType_name[562:580],
+        9220:   _TokenType_name[580:588],
+        9225:   _TokenType_name[588:597],
+        10138:  _TokenType_name[597:610],
+        65533:  _TokenType_name[610:622],
+        128169: _TokenType_name[622:634],
+}
+
+func (i TokenType) String() string {
+        if str, ok := _TokenType_map[i]; ok {
+                return str
+        }
+        return "TokenType(" + strconv.FormatInt(int64(i), 10) + ")"
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/unicode2ragel.rb b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/unicode2ragel.rb
new file mode 100644
index 0000000..422e4e5
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/unicode2ragel.rb
@@ -0,0 +1,335 @@
+#!/usr/bin/env ruby
+#
+# This scripted has been updated to accept more command-line arguments:
+#
+#    -u, --url                        URL to process
+#    -m, --machine                    Machine name
+#    -p, --properties                 Properties to add to the machine
+#    -o, --output                     Write output to file
+#
+# Updated by: Marty Schoch <marty.schoch@gmail.com>
+# 
+# This script uses the unicode spec to generate a Ragel state machine
+# that recognizes unicode alphanumeric characters.  It generates 5
+# character classes: uupper, ulower, ualpha, udigit, and ualnum.
+# Currently supported encodings are UTF-8 [default] and UCS-4.
+#
+# Usage: unicode2ragel.rb [options]
+#    -e, --encoding [ucs4 | utf8]     Data encoding
+#    -h, --help                       Show this message
+#
+# This script was originally written as part of the Ferret search
+# engine library.
+#
+# Author: Rakan El-Khalil <rakan@well.com>
+
+require 'optparse'
+require 'open-uri'
+
+ENCODINGS = [ :utf8, :ucs4 ]
+ALPHTYPES = { :utf8 => "byte", :ucs4 => "rune" }
+DEFAULT_CHART_URL = "http://www.unicode.org/Public/5.1.0/ucd/DerivedCoreProperties.txt"
+DEFAULT_MACHINE_NAME= "WChar"
+
+###
+# Display vars & default option
+
+TOTAL_WIDTH = 80
+RANGE_WIDTH = 23
+@encoding = :utf8
+@chart_url = DEFAULT_CHART_URL
+machine_name = DEFAULT_MACHINE_NAME
+properties = []
+@output = $stdout
+
+###
+# Option parsing
+
+cli_opts = OptionParser.new do |opts|
+  opts.on("-e", "--encoding [ucs4 | utf8]", "Data encoding") do |o|
+    @encoding = o.downcase.to_sym
+  end
+  opts.on("-h", "--help", "Show this message") do
+    puts opts
+    exit
+  end
+  opts.on("-u", "--url URL", "URL to process") do |o|
+    @chart_url = o 
+  end
+  opts.on("-m", "--machine MACHINE_NAME", "Machine name") do |o|
+    machine_name = o
+  end
+  opts.on("-p", "--properties x,y,z", Array, "Properties to add to machine") do |o|
+    properties = o
+  end
+  opts.on("-o", "--output FILE", "output file") do |o|
+    @output = File.new(o, "w+")
+  end
+end
+
+cli_opts.parse(ARGV)
+unless ENCODINGS.member? @encoding
+  puts "Invalid encoding: #{@encoding}"
+  puts cli_opts
+  exit
+end
+
+##
+# Downloads the document at url and yields every alpha line's hex
+# range and description.
+
+def each_alpha( url, property ) 
+  open( url ) do |file|
+    file.each_line do |line|
+      next if line =~ /^#/;
+      next if line !~ /; #{property} #/;
+
+      range, description = line.split(/;/)
+      range.strip!
+      description.gsub!(/.*#/, '').strip!
+
+      if range =~ /\.\./
+           start, stop = range.split '..'
+      else start = stop = range
+      end
+
+      yield start.hex .. stop.hex, description
+    end
+  end
+end
+
+###
+# Formats to hex at minimum width
+
+def to_hex( n )
+  r = "%0X" % n
+  r = "0#{r}" unless (r.length % 2).zero?
+  r
+end
+
+###
+# UCS4 is just a straight hex conversion of the unicode codepoint.
+
+def to_ucs4( range )
+  rangestr  =   "0x" + to_hex(range.begin)
+  rangestr << "..0x" + to_hex(range.end) if range.begin != range.end
+  [ rangestr ]
+end
+
+##
+# 0x00     - 0x7f     -> 0zzzzzzz[7]
+# 0x80     - 0x7ff    -> 110yyyyy[5] 10zzzzzz[6]
+# 0x800    - 0xffff   -> 1110xxxx[4] 10yyyyyy[6] 10zzzzzz[6]
+# 0x010000 - 0x10ffff -> 11110www[3] 10xxxxxx[6] 10yyyyyy[6] 10zzzzzz[6] 
+
+UTF8_BOUNDARIES = [0x7f, 0x7ff, 0xffff, 0x10ffff]
+
+def to_utf8_enc( n )
+  r = 0
+  if n <= 0x7f
+    r = n
+  elsif n <= 0x7ff
+    y = 0xc0 | (n >> 6)
+    z = 0x80 | (n & 0x3f)
+    r = y << 8 | z
+  elsif n <= 0xffff
+    x = 0xe0 | (n >> 12)
+    y = 0x80 | (n >>  6) & 0x3f
+    z = 0x80 |  n        & 0x3f
+    r = x << 16 | y << 8 | z
+  elsif n <= 0x10ffff
+    w = 0xf0 | (n >> 18)
+    x = 0x80 | (n >> 12) & 0x3f
+    y = 0x80 | (n >>  6) & 0x3f
+    z = 0x80 |  n        & 0x3f
+    r = w << 24 | x << 16 | y << 8 | z
+  end
+
+  to_hex(r)
+end
+
+def from_utf8_enc( n )
+  n = n.hex
+  r = 0
+  if n <= 0x7f
+    r = n
+  elsif n <= 0xdfff
+    y = (n >> 8) & 0x1f
+    z =  n       & 0x3f
+    r = y << 6 | z
+  elsif n <= 0xefffff
+    x = (n >> 16) & 0x0f
+    y = (n >>  8) & 0x3f
+    z =  n        & 0x3f
+    r = x << 10 | y << 6 | z
+  elsif n <= 0xf7ffffff
+    w = (n >> 24) & 0x07
+    x = (n >> 16) & 0x3f
+    y = (n >>  8) & 0x3f
+    z =  n        & 0x3f
+    r = w << 18 | x << 12 | y << 6 | z
+  end
+  r
+end
+
+###
+# Given a range, splits it up into ranges that can be continuously
+# encoded into utf8.  Eg: 0x00 .. 0xff => [0x00..0x7f, 0x80..0xff]
+# This is not strictly needed since the current [5.1] unicode standard
+# doesn't have ranges that straddle utf8 boundaries.  This is included
+# for completeness as there is no telling if that will ever change.
+
+def utf8_ranges( range )
+  ranges = []
+  UTF8_BOUNDARIES.each do |max|
+    if range.begin <= max
+      if range.end <= max
+        ranges << range
+        return ranges
+      end
+
+      ranges << (range.begin .. max)
+      range = (max + 1) .. range.end
+    end
+  end
+  ranges
+end
+
+def build_range( start, stop )
+  size = start.size/2
+  left = size - 1
+  return [""] if size < 1
+
+  a = start[0..1]
+  b = stop[0..1]
+
+  ###
+  # Shared prefix
+
+  if a == b
+    return build_range(start[2..-1], stop[2..-1]).map do |elt|
+      "0x#{a} " + elt
+    end
+  end
+
+  ###
+  # Unshared prefix, end of run
+
+  return ["0x#{a}..0x#{b} "] if left.zero?
+  
+  ###
+  # Unshared prefix, not end of run
+  # Range can be 0x123456..0x56789A
+  # Which is equivalent to:
+  #     0x123456 .. 0x12FFFF
+  #     0x130000 .. 0x55FFFF
+  #     0x560000 .. 0x56789A
+
+  ret = []
+  ret << build_range(start, a + "FF" * left)
+
+  ###
+  # Only generate middle range if need be.
+
+  if a.hex+1 != b.hex
+    max = to_hex(b.hex - 1)
+    max = "FF" if b == "FF"
+    ret << "0x#{to_hex(a.hex+1)}..0x#{max} " + "0x00..0xFF " * left
+  end
+
+  ###
+  # Don't generate last range if it is covered by first range
+  
+  ret << build_range(b + "00" * left, stop) unless b == "FF"
+  ret.flatten!
+end
+
+def to_utf8( range )
+  utf8_ranges( range ).map do |r|   
+    begin_enc = to_utf8_enc(r.begin)
+    end_enc = to_utf8_enc(r.end)
+    build_range begin_enc, end_enc
+  end.flatten!
+end
+
+##
+# Perform a 3-way comparison of the number of codepoints advertised by
+# the unicode spec for the given range, the originally parsed range,
+# and the resulting utf8 encoded range.
+
+def count_codepoints( code )
+  code.split(' ').inject(1) do |acc, elt|
+    if elt =~ /0x(.+)\.\.0x(.+)/
+      if @encoding == :utf8
+        acc * (from_utf8_enc($2) - from_utf8_enc($1) + 1)
+      else
+        acc * ($2.hex - $1.hex + 1)
+      end
+    else
+      acc
+    end
+  end
+end
+
+def is_valid?( range, desc, codes )
+  spec_count  = 1
+  spec_count  = $1.to_i if desc =~ /\[(\d+)\]/
+  range_count = range.end - range.begin + 1
+
+  sum = codes.inject(0) { |acc, elt| acc + count_codepoints(elt) }
+  sum == spec_count and sum == range_count
+end
+
+##
+# Generate the state maching to stdout
+
+def generate_machine( name, property )
+  pipe = " "
+  @output.puts "    #{name} = "
+  each_alpha( @chart_url, property ) do |range, desc|
+
+    codes = (@encoding == :ucs4) ? to_ucs4(range) : to_utf8(range)
+
+    #raise "Invalid encoding of range #{range}: #{codes.inspect}" unless 
+    #  is_valid? range, desc, codes
+
+    range_width = codes.map { |a| a.size }.max
+    range_width = RANGE_WIDTH if range_width < RANGE_WIDTH
+
+    desc_width  = TOTAL_WIDTH - RANGE_WIDTH - 11
+    desc_width -= (range_width - RANGE_WIDTH) if range_width > RANGE_WIDTH
+
+    if desc.size > desc_width
+      desc = desc[0..desc_width - 4] + "..."
+    end
+
+    codes.each_with_index do |r, idx|
+      desc = "" unless idx.zero?
+      code = "%-#{range_width}s" % r
+      @output.puts "      #{pipe} #{code} ##{desc}"
+      pipe = "|"
+    end
+  end
+  @output.puts "      ;"
+  @output.puts ""
+end
+
+@output.puts <<EOF
+# The following Ragel file was autogenerated with #{$0} 
+# from: #{@chart_url}
+#
+# It defines #{properties}.
+#
+# To use this, make sure that your alphtype is set to #{ALPHTYPES[@encoding]},
+# and that your input is in #{@encoding}.
+
+%%{
+    machine #{machine_name};
+    
+EOF
+
+properties.each { |x| generate_machine( x, x ) }
+
+@output.puts <<EOF
+}%%
+EOF
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/unicode_derived.rl b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/unicode_derived.rl
new file mode 100644
index 0000000..612ad62
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/unicode_derived.rl
@@ -0,0 +1,2135 @@
+# The following Ragel file was autogenerated with unicode2ragel.rb 
+# from: http://www.unicode.org/Public/9.0.0/ucd/DerivedCoreProperties.txt
+#
+# It defines ["ID_Start", "ID_Continue"].
+#
+# To use this, make sure that your alphtype is set to byte,
+# and that your input is in utf8.
+
+%%{
+    machine UnicodeDerived;
+    
+    ID_Start = 
+        0x41..0x5A              #L&  [26] LATIN CAPITAL LETTER A..LATIN CAPI...
+      | 0x61..0x7A              #L&  [26] LATIN SMALL LETTER A..LATIN SMALL ...
+      | 0xC2 0xAA               #Lo       FEMININE ORDINAL INDICATOR
+      | 0xC2 0xB5               #L&       MICRO SIGN
+      | 0xC2 0xBA               #Lo       MASCULINE ORDINAL INDICATOR
+      | 0xC3 0x80..0x96         #L&  [23] LATIN CAPITAL LETTER A WITH GRAVE....
+      | 0xC3 0x98..0xB6         #L&  [31] LATIN CAPITAL LETTER O WITH STROKE...
+      | 0xC3 0xB8..0xFF         #L& [195] LATIN SMALL LETTER O WITH STROKE.....
+      | 0xC4..0xC5 0x00..0xFF   #
+      | 0xC6 0x00..0xBA         #
+      | 0xC6 0xBB               #Lo       LATIN LETTER TWO WITH STROKE
+      | 0xC6 0xBC..0xBF         #L&   [4] LATIN CAPITAL LETTER TONE FIVE..LA...
+      | 0xC7 0x80..0x83         #Lo   [4] LATIN LETTER DENTAL CLICK..LATIN L...
+      | 0xC7 0x84..0xFF         #L& [208] LATIN CAPITAL LETTER DZ WITH CARON...
+      | 0xC8..0xC9 0x00..0xFF   #
+      | 0xCA 0x00..0x93         #
+      | 0xCA 0x94               #Lo       LATIN LETTER GLOTTAL STOP
+      | 0xCA 0x95..0xAF         #L&  [27] LATIN LETTER PHARYNGEAL VOICED FRI...
+      | 0xCA 0xB0..0xFF         #Lm  [18] MODIFIER LETTER SMALL H..MODIFIER ...
+      | 0xCB 0x00..0x81         #
+      | 0xCB 0x86..0x91         #Lm  [12] MODIFIER LETTER CIRCUMFLEX ACCENT....
+      | 0xCB 0xA0..0xA4         #Lm   [5] MODIFIER LETTER SMALL GAMMA..MODIF...
+      | 0xCB 0xAC               #Lm       MODIFIER LETTER VOICING
+      | 0xCB 0xAE               #Lm       MODIFIER LETTER DOUBLE APOSTROPHE
+      | 0xCD 0xB0..0xB3         #L&   [4] GREEK CAPITAL LETTER HETA..GREEK S...
+      | 0xCD 0xB4               #Lm       GREEK NUMERAL SIGN
+      | 0xCD 0xB6..0xB7         #L&   [2] GREEK CAPITAL LETTER PAMPHYLIAN DI...
+      | 0xCD 0xBA               #Lm       GREEK YPOGEGRAMMENI
+      | 0xCD 0xBB..0xBD         #L&   [3] GREEK SMALL REVERSED LUNATE SIGMA ...
+      | 0xCD 0xBF               #L&       GREEK CAPITAL LETTER YOT
+      | 0xCE 0x86               #L&       GREEK CAPITAL LETTER ALPHA WITH TONOS
+      | 0xCE 0x88..0x8A         #L&   [3] GREEK CAPITAL LETTER EPSILON WITH ...
+      | 0xCE 0x8C               #L&       GREEK CAPITAL LETTER OMICRON WITH ...
+      | 0xCE 0x8E..0xA1         #L&  [20] GREEK CAPITAL LETTER UPSILON WITH ...
+      | 0xCE 0xA3..0xFF         #L&  [83] GREEK CAPITAL LETTER SIGMA..GREEK ...
+      | 0xCF 0x00..0xB5         #
+      | 0xCF 0xB7..0xFF         #L& [139] GREEK CAPITAL LETTER SHO..CYRILLIC...
+      | 0xD0..0xD1 0x00..0xFF   #
+      | 0xD2 0x00..0x81         #
+      | 0xD2 0x8A..0xFF         #L& [166] CYRILLIC CAPITAL LETTER SHORT I WI...
+      | 0xD3..0xD3 0x00..0xFF   #
+      | 0xD4 0x00..0xAF         #
+      | 0xD4 0xB1..0xFF         #L&  [38] ARMENIAN CAPITAL LETTER AYB..ARMEN...
+      | 0xD5 0x00..0x96         #
+      | 0xD5 0x99               #Lm       ARMENIAN MODIFIER LETTER LEFT HALF...
+      | 0xD5 0xA1..0xFF         #L&  [39] ARMENIAN SMALL LETTER AYB..ARMENIA...
+      | 0xD6 0x00..0x87         #
+      | 0xD7 0x90..0xAA         #Lo  [27] HEBREW LETTER ALEF..HEBREW LETTER TAV
+      | 0xD7 0xB0..0xB2         #Lo   [3] HEBREW LIGATURE YIDDISH DOUBLE VAV...
+      | 0xD8 0xA0..0xBF         #Lo  [32] ARABIC LETTER KASHMIRI YEH..ARABIC...
+      | 0xD9 0x80               #Lm       ARABIC TATWEEL
+      | 0xD9 0x81..0x8A         #Lo  [10] ARABIC LETTER FEH..ARABIC LETTER YEH
+      | 0xD9 0xAE..0xAF         #Lo   [2] ARABIC LETTER DOTLESS BEH..ARABIC ...
+      | 0xD9 0xB1..0xFF         #Lo  [99] ARABIC LETTER ALEF WASLA..ARABIC L...
+      | 0xDA..0xDA 0x00..0xFF   #
+      | 0xDB 0x00..0x93         #
+      | 0xDB 0x95               #Lo       ARABIC LETTER AE
+      | 0xDB 0xA5..0xA6         #Lm   [2] ARABIC SMALL WAW..ARABIC SMALL YEH
+      | 0xDB 0xAE..0xAF         #Lo   [2] ARABIC LETTER DAL WITH INVERTED V....
+      | 0xDB 0xBA..0xBC         #Lo   [3] ARABIC LETTER SHEEN WITH DOT BELOW...
+      | 0xDB 0xBF               #Lo       ARABIC LETTER HEH WITH INVERTED V
+      | 0xDC 0x90               #Lo       SYRIAC LETTER ALAPH
+      | 0xDC 0x92..0xAF         #Lo  [30] SYRIAC LETTER BETH..SYRIAC LETTER ...
+      | 0xDD 0x8D..0xFF         #Lo  [89] SYRIAC LETTER SOGDIAN ZHAIN..THAAN...
+      | 0xDE 0x00..0xA5         #
+      | 0xDE 0xB1               #Lo       THAANA LETTER NAA
+      | 0xDF 0x8A..0xAA         #Lo  [33] NKO LETTER A..NKO LETTER JONA RA
+      | 0xDF 0xB4..0xB5         #Lm   [2] NKO HIGH TONE APOSTROPHE..NKO LOW ...
+      | 0xDF 0xBA               #Lm       NKO LAJANYALAN
+      | 0xE0 0xA0 0x80..0x95    #Lo  [22] SAMARITAN LETTER ALAF..SAMARITAN L...
+      | 0xE0 0xA0 0x9A          #Lm       SAMARITAN MODIFIER LETTER EPENTHET...
+      | 0xE0 0xA0 0xA4          #Lm       SAMARITAN MODIFIER LETTER SHORT A
+      | 0xE0 0xA0 0xA8          #Lm       SAMARITAN MODIFIER LETTER I
+      | 0xE0 0xA1 0x80..0x98    #Lo  [25] MANDAIC LETTER HALQA..MANDAIC LETT...
+      | 0xE0 0xA2 0xA0..0xB4    #Lo  [21] ARABIC LETTER BEH WITH SMALL V BEL...
+      | 0xE0 0xA2 0xB6..0xBD    #Lo   [8] ARABIC LETTER BEH WITH SMALL MEEM ...
+      | 0xE0 0xA4 0x84..0xB9    #Lo  [54] DEVANAGARI LETTER SHORT A..DEVANAG...
+      | 0xE0 0xA4 0xBD          #Lo       DEVANAGARI SIGN AVAGRAHA
+      | 0xE0 0xA5 0x90          #Lo       DEVANAGARI OM
+      | 0xE0 0xA5 0x98..0xA1    #Lo  [10] DEVANAGARI LETTER QA..DEVANAGARI L...
+      | 0xE0 0xA5 0xB1          #Lm       DEVANAGARI SIGN HIGH SPACING DOT
+      | 0xE0 0xA5 0xB2..0xFF    #Lo  [15] DEVANAGARI LETTER CANDRA A..BENGAL...
+      | 0xE0 0xA6 0x00..0x80    #
+      | 0xE0 0xA6 0x85..0x8C    #Lo   [8] BENGALI LETTER A..BENGALI LETTER V...
+      | 0xE0 0xA6 0x8F..0x90    #Lo   [2] BENGALI LETTER E..BENGALI LETTER AI
+      | 0xE0 0xA6 0x93..0xA8    #Lo  [22] BENGALI LETTER O..BENGALI LETTER NA
+      | 0xE0 0xA6 0xAA..0xB0    #Lo   [7] BENGALI LETTER PA..BENGALI LETTER RA
+      | 0xE0 0xA6 0xB2          #Lo       BENGALI LETTER LA
+      | 0xE0 0xA6 0xB6..0xB9    #Lo   [4] BENGALI LETTER SHA..BENGALI LETTER HA
+      | 0xE0 0xA6 0xBD          #Lo       BENGALI SIGN AVAGRAHA
+      | 0xE0 0xA7 0x8E          #Lo       BENGALI LETTER KHANDA TA
+      | 0xE0 0xA7 0x9C..0x9D    #Lo   [2] BENGALI LETTER RRA..BENGALI LETTER...
+      | 0xE0 0xA7 0x9F..0xA1    #Lo   [3] BENGALI LETTER YYA..BENGALI LETTER...
+      | 0xE0 0xA7 0xB0..0xB1    #Lo   [2] BENGALI LETTER RA WITH MIDDLE DIAG...
+      | 0xE0 0xA8 0x85..0x8A    #Lo   [6] GURMUKHI LETTER A..GURMUKHI LETTER UU
+      | 0xE0 0xA8 0x8F..0x90    #Lo   [2] GURMUKHI LETTER EE..GURMUKHI LETTE...
+      | 0xE0 0xA8 0x93..0xA8    #Lo  [22] GURMUKHI LETTER OO..GURMUKHI LETTE...
+      | 0xE0 0xA8 0xAA..0xB0    #Lo   [7] GURMUKHI LETTER PA..GURMUKHI LETTE...
+      | 0xE0 0xA8 0xB2..0xB3    #Lo   [2] GURMUKHI LETTER LA..GURMUKHI LETTE...
+      | 0xE0 0xA8 0xB5..0xB6    #Lo   [2] GURMUKHI LETTER VA..GURMUKHI LETTE...
+      | 0xE0 0xA8 0xB8..0xB9    #Lo   [2] GURMUKHI LETTER SA..GURMUKHI LETTE...
+      | 0xE0 0xA9 0x99..0x9C    #Lo   [4] GURMUKHI LETTER KHHA..GURMUKHI LET...
+      | 0xE0 0xA9 0x9E          #Lo       GURMUKHI LETTER FA
+      | 0xE0 0xA9 0xB2..0xB4    #Lo   [3] GURMUKHI IRI..GURMUKHI EK ONKAR
+      | 0xE0 0xAA 0x85..0x8D    #Lo   [9] GUJARATI LETTER A..GUJARATI VOWEL ...
+      | 0xE0 0xAA 0x8F..0x91    #Lo   [3] GUJARATI LETTER E..GUJARATI VOWEL ...
+      | 0xE0 0xAA 0x93..0xA8    #Lo  [22] GUJARATI LETTER O..GUJARATI LETTER NA
+      | 0xE0 0xAA 0xAA..0xB0    #Lo   [7] GUJARATI LETTER PA..GUJARATI LETTE...
+      | 0xE0 0xAA 0xB2..0xB3    #Lo   [2] GUJARATI LETTER LA..GUJARATI LETTE...
+      | 0xE0 0xAA 0xB5..0xB9    #Lo   [5] GUJARATI LETTER VA..GUJARATI LETTE...
+      | 0xE0 0xAA 0xBD          #Lo       GUJARATI SIGN AVAGRAHA
+      | 0xE0 0xAB 0x90          #Lo       GUJARATI OM
+      | 0xE0 0xAB 0xA0..0xA1    #Lo   [2] GUJARATI LETTER VOCALIC RR..GUJARA...
+      | 0xE0 0xAB 0xB9          #Lo       GUJARATI LETTER ZHA
+      | 0xE0 0xAC 0x85..0x8C    #Lo   [8] ORIYA LETTER A..ORIYA LETTER VOCAL...
+      | 0xE0 0xAC 0x8F..0x90    #Lo   [2] ORIYA LETTER E..ORIYA LETTER AI
+      | 0xE0 0xAC 0x93..0xA8    #Lo  [22] ORIYA LETTER O..ORIYA LETTER NA
+      | 0xE0 0xAC 0xAA..0xB0    #Lo   [7] ORIYA LETTER PA..ORIYA LETTER RA
+      | 0xE0 0xAC 0xB2..0xB3    #Lo   [2] ORIYA LETTER LA..ORIYA LETTER LLA
+      | 0xE0 0xAC 0xB5..0xB9    #Lo   [5] ORIYA LETTER VA..ORIYA LETTER HA
+      | 0xE0 0xAC 0xBD          #Lo       ORIYA SIGN AVAGRAHA
+      | 0xE0 0xAD 0x9C..0x9D    #Lo   [2] ORIYA LETTER RRA..ORIYA LETTER RHA
+      | 0xE0 0xAD 0x9F..0xA1    #Lo   [3] ORIYA LETTER YYA..ORIYA LETTER VOC...
+      | 0xE0 0xAD 0xB1          #Lo       ORIYA LETTER WA
+      | 0xE0 0xAE 0x83          #Lo       TAMIL SIGN VISARGA
+      | 0xE0 0xAE 0x85..0x8A    #Lo   [6] TAMIL LETTER A..TAMIL LETTER UU
+      | 0xE0 0xAE 0x8E..0x90    #Lo   [3] TAMIL LETTER E..TAMIL LETTER AI
+      | 0xE0 0xAE 0x92..0x95    #Lo   [4] TAMIL LETTER O..TAMIL LETTER KA
+      | 0xE0 0xAE 0x99..0x9A    #Lo   [2] TAMIL LETTER NGA..TAMIL LETTER CA
+      | 0xE0 0xAE 0x9C          #Lo       TAMIL LETTER JA
+      | 0xE0 0xAE 0x9E..0x9F    #Lo   [2] TAMIL LETTER NYA..TAMIL LETTER TTA
+      | 0xE0 0xAE 0xA3..0xA4    #Lo   [2] TAMIL LETTER NNA..TAMIL LETTER TA
+      | 0xE0 0xAE 0xA8..0xAA    #Lo   [3] TAMIL LETTER NA..TAMIL LETTER PA
+      | 0xE0 0xAE 0xAE..0xB9    #Lo  [12] TAMIL LETTER MA..TAMIL LETTER HA
+      | 0xE0 0xAF 0x90          #Lo       TAMIL OM
+      | 0xE0 0xB0 0x85..0x8C    #Lo   [8] TELUGU LETTER A..TELUGU LETTER VOC...
+      | 0xE0 0xB0 0x8E..0x90    #Lo   [3] TELUGU LETTER E..TELUGU LETTER AI
+      | 0xE0 0xB0 0x92..0xA8    #Lo  [23] TELUGU LETTER O..TELUGU LETTER NA
+      | 0xE0 0xB0 0xAA..0xB9    #Lo  [16] TELUGU LETTER PA..TELUGU LETTER HA
+      | 0xE0 0xB0 0xBD          #Lo       TELUGU SIGN AVAGRAHA
+      | 0xE0 0xB1 0x98..0x9A    #Lo   [3] TELUGU LETTER TSA..TELUGU LETTER RRRA
+      | 0xE0 0xB1 0xA0..0xA1    #Lo   [2] TELUGU LETTER VOCALIC RR..TELUGU L...
+      | 0xE0 0xB2 0x80          #Lo       KANNADA SIGN SPACING CANDRABINDU
+      | 0xE0 0xB2 0x85..0x8C    #Lo   [8] KANNADA LETTER A..KANNADA LETTER V...
+      | 0xE0 0xB2 0x8E..0x90    #Lo   [3] KANNADA LETTER E..KANNADA LETTER AI
+      | 0xE0 0xB2 0x92..0xA8    #Lo  [23] KANNADA LETTER O..KANNADA LETTER NA
+      | 0xE0 0xB2 0xAA..0xB3    #Lo  [10] KANNADA LETTER PA..KANNADA LETTER LLA
+      | 0xE0 0xB2 0xB5..0xB9    #Lo   [5] KANNADA LETTER VA..KANNADA LETTER HA
+      | 0xE0 0xB2 0xBD          #Lo       KANNADA SIGN AVAGRAHA
+      | 0xE0 0xB3 0x9E          #Lo       KANNADA LETTER FA
+      | 0xE0 0xB3 0xA0..0xA1    #Lo   [2] KANNADA LETTER VOCALIC RR..KANNADA...
+      | 0xE0 0xB3 0xB1..0xB2    #Lo   [2] KANNADA SIGN JIHVAMULIYA..KANNADA ...
+      | 0xE0 0xB4 0x85..0x8C    #Lo   [8] MALAYALAM LETTER A..MALAYALAM LETT...
+      | 0xE0 0xB4 0x8E..0x90    #Lo   [3] MALAYALAM LETTER E..MALAYALAM LETT...
+      | 0xE0 0xB4 0x92..0xBA    #Lo  [41] MALAYALAM LETTER O..MALAYALAM LETT...
+      | 0xE0 0xB4 0xBD          #Lo       MALAYALAM SIGN AVAGRAHA
+      | 0xE0 0xB5 0x8E          #Lo       MALAYALAM LETTER DOT REPH
+      | 0xE0 0xB5 0x94..0x96    #Lo   [3] MALAYALAM LETTER CHILLU M..MALAYAL...
+      | 0xE0 0xB5 0x9F..0xA1    #Lo   [3] MALAYALAM LETTER ARCHAIC II..MALAY...
+      | 0xE0 0xB5 0xBA..0xBF    #Lo   [6] MALAYALAM LETTER CHILLU NN..MALAYA...
+      | 0xE0 0xB6 0x85..0x96    #Lo  [18] SINHALA LETTER AYANNA..SINHALA LET...
+      | 0xE0 0xB6 0x9A..0xB1    #Lo  [24] SINHALA LETTER ALPAPRAANA KAYANNA....
+      | 0xE0 0xB6 0xB3..0xBB    #Lo   [9] SINHALA LETTER SANYAKA DAYANNA..SI...
+      | 0xE0 0xB6 0xBD          #Lo       SINHALA LETTER DANTAJA LAYANNA
+      | 0xE0 0xB7 0x80..0x86    #Lo   [7] SINHALA LETTER VAYANNA..SINHALA LE...
+      | 0xE0 0xB8 0x81..0xB0    #Lo  [48] THAI CHARACTER KO KAI..THAI CHARAC...
+      | 0xE0 0xB8 0xB2..0xB3    #Lo   [2] THAI CHARACTER SARA AA..THAI CHARA...
+      | 0xE0 0xB9 0x80..0x85    #Lo   [6] THAI CHARACTER SARA E..THAI CHARAC...
+      | 0xE0 0xB9 0x86          #Lm       THAI CHARACTER MAIYAMOK
+      | 0xE0 0xBA 0x81..0x82    #Lo   [2] LAO LETTER KO..LAO LETTER KHO SUNG
+      | 0xE0 0xBA 0x84          #Lo       LAO LETTER KHO TAM
+      | 0xE0 0xBA 0x87..0x88    #Lo   [2] LAO LETTER NGO..LAO LETTER CO
+      | 0xE0 0xBA 0x8A          #Lo       LAO LETTER SO TAM
+      | 0xE0 0xBA 0x8D          #Lo       LAO LETTER NYO
+      | 0xE0 0xBA 0x94..0x97    #Lo   [4] LAO LETTER DO..LAO LETTER THO TAM
+      | 0xE0 0xBA 0x99..0x9F    #Lo   [7] LAO LETTER NO..LAO LETTER FO SUNG
+      | 0xE0 0xBA 0xA1..0xA3    #Lo   [3] LAO LETTER MO..LAO LETTER LO LING
+      | 0xE0 0xBA 0xA5          #Lo       LAO LETTER LO LOOT
+      | 0xE0 0xBA 0xA7          #Lo       LAO LETTER WO
+      | 0xE0 0xBA 0xAA..0xAB    #Lo   [2] LAO LETTER SO SUNG..LAO LETTER HO ...
+      | 0xE0 0xBA 0xAD..0xB0    #Lo   [4] LAO LETTER O..LAO VOWEL SIGN A
+      | 0xE0 0xBA 0xB2..0xB3    #Lo   [2] LAO VOWEL SIGN AA..LAO VOWEL SIGN AM
+      | 0xE0 0xBA 0xBD          #Lo       LAO SEMIVOWEL SIGN NYO
+      | 0xE0 0xBB 0x80..0x84    #Lo   [5] LAO VOWEL SIGN E..LAO VOWEL SIGN AI
+      | 0xE0 0xBB 0x86          #Lm       LAO KO LA
+      | 0xE0 0xBB 0x9C..0x9F    #Lo   [4] LAO HO NO..LAO LETTER KHMU NYO
+      | 0xE0 0xBC 0x80          #Lo       TIBETAN SYLLABLE OM
+      | 0xE0 0xBD 0x80..0x87    #Lo   [8] TIBETAN LETTER KA..TIBETAN LETTER JA
+      | 0xE0 0xBD 0x89..0xAC    #Lo  [36] TIBETAN LETTER NYA..TIBETAN LETTER...
+      | 0xE0 0xBE 0x88..0x8C    #Lo   [5] TIBETAN SIGN LCE TSA CAN..TIBETAN ...
+      | 0xE1 0x80 0x80..0xAA    #Lo  [43] MYANMAR LETTER KA..MYANMAR LETTER AU
+      | 0xE1 0x80 0xBF          #Lo       MYANMAR LETTER GREAT SA
+      | 0xE1 0x81 0x90..0x95    #Lo   [6] MYANMAR LETTER SHA..MYANMAR LETTER...
+      | 0xE1 0x81 0x9A..0x9D    #Lo   [4] MYANMAR LETTER MON NGA..MYANMAR LE...
+      | 0xE1 0x81 0xA1          #Lo       MYANMAR LETTER SGAW KAREN SHA
+      | 0xE1 0x81 0xA5..0xA6    #Lo   [2] MYANMAR LETTER WESTERN PWO KAREN T...
+      | 0xE1 0x81 0xAE..0xB0    #Lo   [3] MYANMAR LETTER EASTERN PWO KAREN N...
+      | 0xE1 0x81 0xB5..0xFF    #Lo  [13] MYANMAR LETTER SHAN KA..MYANMAR LE...
+      | 0xE1 0x82 0x00..0x81    #
+      | 0xE1 0x82 0x8E          #Lo       MYANMAR LETTER RUMAI PALAUNG FA
+      | 0xE1 0x82 0xA0..0xFF    #L&  [38] GEORGIAN CAPITAL LETTER AN..GEORGI...
+      | 0xE1 0x83 0x00..0x85    #
+      | 0xE1 0x83 0x87          #L&       GEORGIAN CAPITAL LETTER YN
+      | 0xE1 0x83 0x8D          #L&       GEORGIAN CAPITAL LETTER AEN
+      | 0xE1 0x83 0x90..0xBA    #Lo  [43] GEORGIAN LETTER AN..GEORGIAN LETTE...
+      | 0xE1 0x83 0xBC          #Lm       MODIFIER LETTER GEORGIAN NAR
+      | 0xE1 0x83 0xBD..0xFF        #Lo [332] GEORGIAN LETTER AEN..ETHIOPIC ...
+      | 0xE1 0x84..0x88 0x00..0xFF  #
+      | 0xE1 0x89 0x00..0x88        #
+      | 0xE1 0x89 0x8A..0x8D    #Lo   [4] ETHIOPIC SYLLABLE QWI..ETHIOPIC SY...
+      | 0xE1 0x89 0x90..0x96    #Lo   [7] ETHIOPIC SYLLABLE QHA..ETHIOPIC SY...
+      | 0xE1 0x89 0x98          #Lo       ETHIOPIC SYLLABLE QHWA
+      | 0xE1 0x89 0x9A..0x9D    #Lo   [4] ETHIOPIC SYLLABLE QHWI..ETHIOPIC S...
+      | 0xE1 0x89 0xA0..0xFF    #Lo  [41] ETHIOPIC SYLLABLE BA..ETHIOPIC SYL...
+      | 0xE1 0x8A 0x00..0x88    #
+      | 0xE1 0x8A 0x8A..0x8D    #Lo   [4] ETHIOPIC SYLLABLE XWI..ETHIOPIC SY...
+      | 0xE1 0x8A 0x90..0xB0    #Lo  [33] ETHIOPIC SYLLABLE NA..ETHIOPIC SYL...
+      | 0xE1 0x8A 0xB2..0xB5    #Lo   [4] ETHIOPIC SYLLABLE KWI..ETHIOPIC SY...
+      | 0xE1 0x8A 0xB8..0xBE    #Lo   [7] ETHIOPIC SYLLABLE KXA..ETHIOPIC SY...
+      | 0xE1 0x8B 0x80          #Lo       ETHIOPIC SYLLABLE KXWA
+      | 0xE1 0x8B 0x82..0x85    #Lo   [4] ETHIOPIC SYLLABLE KXWI..ETHIOPIC S...
+      | 0xE1 0x8B 0x88..0x96    #Lo  [15] ETHIOPIC SYLLABLE WA..ETHIOPIC SYL...
+      | 0xE1 0x8B 0x98..0xFF    #Lo  [57] ETHIOPIC SYLLABLE ZA..ETHIOPIC SYL...
+      | 0xE1 0x8C 0x00..0x90    #
+      | 0xE1 0x8C 0x92..0x95    #Lo   [4] ETHIOPIC SYLLABLE GWI..ETHIOPIC SY...
+      | 0xE1 0x8C 0x98..0xFF    #Lo  [67] ETHIOPIC SYLLABLE GGA..ETHIOPIC SY...
+      | 0xE1 0x8D 0x00..0x9A    #
+      | 0xE1 0x8E 0x80..0x8F    #Lo  [16] ETHIOPIC SYLLABLE SEBATBEIT MWA..E...
+      | 0xE1 0x8E 0xA0..0xFF    #L&  [86] CHEROKEE LETTER A..CHEROKEE LETTER MV
+      | 0xE1 0x8F 0x00..0xB5    #
+      | 0xE1 0x8F 0xB8..0xBD    #L&   [6] CHEROKEE SMALL LETTER YE..CHEROKEE...
+      | 0xE1 0x90 0x81..0xFF        #Lo [620] CANADIAN SYLLABICS E..CANADIAN...
+      | 0xE1 0x91..0x98 0x00..0xFF  #
+      | 0xE1 0x99 0x00..0xAC        #
+      | 0xE1 0x99 0xAF..0xBF    #Lo  [17] CANADIAN SYLLABICS QAI..CANADIAN S...
+      | 0xE1 0x9A 0x81..0x9A    #Lo  [26] OGHAM LETTER BEITH..OGHAM LETTER P...
+      | 0xE1 0x9A 0xA0..0xFF    #Lo  [75] RUNIC LETTER FEHU FEOH FE F..RUNIC...
+      | 0xE1 0x9B 0x00..0xAA    #
+      | 0xE1 0x9B 0xAE..0xB0    #Nl   [3] RUNIC ARLAUG SYMBOL..RUNIC BELGTHO...
+      | 0xE1 0x9B 0xB1..0xB8    #Lo   [8] RUNIC LETTER K..RUNIC LETTER FRANK...
+      | 0xE1 0x9C 0x80..0x8C    #Lo  [13] TAGALOG LETTER A..TAGALOG LETTER YA
+      | 0xE1 0x9C 0x8E..0x91    #Lo   [4] TAGALOG LETTER LA..TAGALOG LETTER HA
+      | 0xE1 0x9C 0xA0..0xB1    #Lo  [18] HANUNOO LETTER A..HANUNOO LETTER HA
+      | 0xE1 0x9D 0x80..0x91    #Lo  [18] BUHID LETTER A..BUHID LETTER HA
+      | 0xE1 0x9D 0xA0..0xAC    #Lo  [13] TAGBANWA LETTER A..TAGBANWA LETTER YA
+      | 0xE1 0x9D 0xAE..0xB0    #Lo   [3] TAGBANWA LETTER LA..TAGBANWA LETTE...
+      | 0xE1 0x9E 0x80..0xB3    #Lo  [52] KHMER LETTER KA..KHMER INDEPENDENT...
+      | 0xE1 0x9F 0x97          #Lm       KHMER SIGN LEK TOO
+      | 0xE1 0x9F 0x9C          #Lo       KHMER SIGN AVAKRAHASANYA
+      | 0xE1 0xA0 0xA0..0xFF    #Lo  [35] MONGOLIAN LETTER A..MONGOLIAN LETT...
+      | 0xE1 0xA1 0x00..0x82    #
+      | 0xE1 0xA1 0x83          #Lm       MONGOLIAN LETTER TODO LONG VOWEL SIGN
+      | 0xE1 0xA1 0x84..0xB7    #Lo  [52] MONGOLIAN LETTER TODO E..MONGOLIAN...
+      | 0xE1 0xA2 0x80..0x84    #Lo   [5] MONGOLIAN LETTER ALI GALI ANUSVARA...
+      | 0xE1 0xA2 0x85..0x86    #Mn   [2] MONGOLIAN LETTER ALI GALI BALUDA.....
+      | 0xE1 0xA2 0x87..0xA8    #Lo  [34] MONGOLIAN LETTER ALI GALI A..MONGO...
+      | 0xE1 0xA2 0xAA          #Lo       MONGOLIAN LETTER MANCHU ALI GALI LHA
+      | 0xE1 0xA2 0xB0..0xFF    #Lo  [70] CANADIAN SYLLABICS OY..CANADIAN SY...
+      | 0xE1 0xA3 0x00..0xB5    #
+      | 0xE1 0xA4 0x80..0x9E    #Lo  [31] LIMBU VOWEL-CARRIER LETTER..LIMBU ...
+      | 0xE1 0xA5 0x90..0xAD    #Lo  [30] TAI LE LETTER KA..TAI LE LETTER AI
+      | 0xE1 0xA5 0xB0..0xB4    #Lo   [5] TAI LE LETTER TONE-2..TAI LE LETTE...
+      | 0xE1 0xA6 0x80..0xAB    #Lo  [44] NEW TAI LUE LETTER HIGH QA..NEW TA...
+      | 0xE1 0xA6 0xB0..0xFF    #Lo  [26] NEW TAI LUE VOWEL SIGN VOWEL SHORT...
+      | 0xE1 0xA7 0x00..0x89    #
+      | 0xE1 0xA8 0x80..0x96    #Lo  [23] BUGINESE LETTER KA..BUGINESE LETTE...
+      | 0xE1 0xA8 0xA0..0xFF    #Lo  [53] TAI THAM LETTER HIGH KA..TAI THAM ...
+      | 0xE1 0xA9 0x00..0x94    #
+      | 0xE1 0xAA 0xA7          #Lm       TAI THAM SIGN MAI YAMOK
+      | 0xE1 0xAC 0x85..0xB3    #Lo  [47] BALINESE LETTER AKARA..BALINESE LE...
+      | 0xE1 0xAD 0x85..0x8B    #Lo   [7] BALINESE LETTER KAF SASAK..BALINES...
+      | 0xE1 0xAE 0x83..0xA0    #Lo  [30] SUNDANESE LETTER A..SUNDANESE LETT...
+      | 0xE1 0xAE 0xAE..0xAF    #Lo   [2] SUNDANESE LETTER KHA..SUNDANESE LE...
+      | 0xE1 0xAE 0xBA..0xFF    #Lo  [44] SUNDANESE AVAGRAHA..BATAK LETTER U
+      | 0xE1 0xAF 0x00..0xA5    #
+      | 0xE1 0xB0 0x80..0xA3    #Lo  [36] LEPCHA LETTER KA..LEPCHA LETTER A
+      | 0xE1 0xB1 0x8D..0x8F    #Lo   [3] LEPCHA LETTER TTA..LEPCHA LETTER DDA
+      | 0xE1 0xB1 0x9A..0xB7    #Lo  [30] OL CHIKI LETTER LA..OL CHIKI LETTE...
+      | 0xE1 0xB1 0xB8..0xBD    #Lm   [6] OL CHIKI MU TTUDDAG..OL CHIKI AHAD
+      | 0xE1 0xB2 0x80..0x88    #L&   [9] CYRILLIC SMALL LETTER ROUNDED VE.....
+      | 0xE1 0xB3 0xA9..0xAC    #Lo   [4] VEDIC SIGN ANUSVARA ANTARGOMUKHA.....
+      | 0xE1 0xB3 0xAE..0xB1    #Lo   [4] VEDIC SIGN HEXIFORM LONG ANUSVARA....
+      | 0xE1 0xB3 0xB5..0xB6    #Lo   [2] VEDIC SIGN JIHVAMULIYA..VEDIC SIGN...
+      | 0xE1 0xB4 0x80..0xAB    #L&  [44] LATIN LETTER SMALL CAPITAL A..CYRI...
+      | 0xE1 0xB4 0xAC..0xFF    #Lm  [63] MODIFIER LETTER CAPITAL A..GREEK S...
+      | 0xE1 0xB5 0x00..0xAA    #
+      | 0xE1 0xB5 0xAB..0xB7    #L&  [13] LATIN SMALL LETTER UE..LATIN SMALL...
+      | 0xE1 0xB5 0xB8          #Lm       MODIFIER LETTER CYRILLIC EN
+      | 0xE1 0xB5 0xB9..0xFF    #L&  [34] LATIN SMALL LETTER INSULAR G..LATI...
+      | 0xE1 0xB6 0x00..0x9A    #
+      | 0xE1 0xB6 0x9B..0xBF    #Lm  [37] MODIFIER LETTER SMALL TURNED ALPHA...
+      | 0xE1 0xB8 0x80..0xFF        #L& [278] LATIN CAPITAL LETTER A WITH RI...
+      | 0xE1 0xB9..0xBB 0x00..0xFF  #
+      | 0xE1 0xBC 0x00..0x95        #
+      | 0xE1 0xBC 0x98..0x9D    #L&   [6] GREEK CAPITAL LETTER EPSILON WITH ...
+      | 0xE1 0xBC 0xA0..0xFF    #L&  [38] GREEK SMALL LETTER ETA WITH PSILI....
+      | 0xE1 0xBD 0x00..0x85    #
+      | 0xE1 0xBD 0x88..0x8D    #L&   [6] GREEK CAPITAL LETTER OMICRON WITH ...
+      | 0xE1 0xBD 0x90..0x97    #L&   [8] GREEK SMALL LETTER UPSILON WITH PS...
+      | 0xE1 0xBD 0x99          #L&       GREEK CAPITAL LETTER UPSILON WITH ...
+      | 0xE1 0xBD 0x9B          #L&       GREEK CAPITAL LETTER UPSILON WITH ...
+      | 0xE1 0xBD 0x9D          #L&       GREEK CAPITAL LETTER UPSILON WITH ...
+      | 0xE1 0xBD 0x9F..0xBD    #L&  [31] GREEK CAPITAL LETTER UPSILON WITH ...
+      | 0xE1 0xBE 0x80..0xB4    #L&  [53] GREEK SMALL LETTER ALPHA WITH PSIL...
+      | 0xE1 0xBE 0xB6..0xBC    #L&   [7] GREEK SMALL LETTER ALPHA WITH PERI...
+      | 0xE1 0xBE 0xBE          #L&       GREEK PROSGEGRAMMENI
+      | 0xE1 0xBF 0x82..0x84    #L&   [3] GREEK SMALL LETTER ETA WITH VARIA ...
+      | 0xE1 0xBF 0x86..0x8C    #L&   [7] GREEK SMALL LETTER ETA WITH PERISP...
+      | 0xE1 0xBF 0x90..0x93    #L&   [4] GREEK SMALL LETTER IOTA WITH VRACH...
+      | 0xE1 0xBF 0x96..0x9B    #L&   [6] GREEK SMALL LETTER IOTA WITH PERIS...
+      | 0xE1 0xBF 0xA0..0xAC    #L&  [13] GREEK SMALL LETTER UPSILON WITH VR...
+      | 0xE1 0xBF 0xB2..0xB4    #L&   [3] GREEK SMALL LETTER OMEGA WITH VARI...
+      | 0xE1 0xBF 0xB6..0xBC    #L&   [7] GREEK SMALL LETTER OMEGA WITH PERI...
+      | 0xE2 0x81 0xB1          #Lm       SUPERSCRIPT LATIN SMALL LETTER I
+      | 0xE2 0x81 0xBF          #Lm       SUPERSCRIPT LATIN SMALL LETTER N
+      | 0xE2 0x82 0x90..0x9C    #Lm  [13] LATIN SUBSCRIPT SMALL LETTER A..LA...
+      | 0xE2 0x84 0x82          #L&       DOUBLE-STRUCK CAPITAL C
+      | 0xE2 0x84 0x87          #L&       EULER CONSTANT
+      | 0xE2 0x84 0x8A..0x93    #L&  [10] SCRIPT SMALL G..SCRIPT SMALL L
+      | 0xE2 0x84 0x95          #L&       DOUBLE-STRUCK CAPITAL N
+      | 0xE2 0x84 0x98          #Sm       SCRIPT CAPITAL P
+      | 0xE2 0x84 0x99..0x9D    #L&   [5] DOUBLE-STRUCK CAPITAL P..DOUBLE-ST...
+      | 0xE2 0x84 0xA4          #L&       DOUBLE-STRUCK CAPITAL Z
+      | 0xE2 0x84 0xA6          #L&       OHM SIGN
+      | 0xE2 0x84 0xA8          #L&       BLACK-LETTER CAPITAL Z
+      | 0xE2 0x84 0xAA..0xAD    #L&   [4] KELVIN SIGN..BLACK-LETTER CAPITAL C
+      | 0xE2 0x84 0xAE          #So       ESTIMATED SYMBOL
+      | 0xE2 0x84 0xAF..0xB4    #L&   [6] SCRIPT SMALL E..SCRIPT SMALL O
+      | 0xE2 0x84 0xB5..0xB8    #Lo   [4] ALEF SYMBOL..DALET SYMBOL
+      | 0xE2 0x84 0xB9          #L&       INFORMATION SOURCE
+      | 0xE2 0x84 0xBC..0xBF    #L&   [4] DOUBLE-STRUCK SMALL PI..DOUBLE-STR...
+      | 0xE2 0x85 0x85..0x89    #L&   [5] DOUBLE-STRUCK ITALIC CAPITAL D..DO...
+      | 0xE2 0x85 0x8E          #L&       TURNED SMALL F
+      | 0xE2 0x85 0xA0..0xFF    #Nl  [35] ROMAN NUMERAL ONE..ROMAN NUMERAL T...
+      | 0xE2 0x86 0x00..0x82    #
+      | 0xE2 0x86 0x83..0x84    #L&   [2] ROMAN NUMERAL REVERSED ONE HUNDRED...
+      | 0xE2 0x86 0x85..0x88    #Nl   [4] ROMAN NUMERAL SIX LATE FORM..ROMAN...
+      | 0xE2 0xB0 0x80..0xAE    #L&  [47] GLAGOLITIC CAPITAL LETTER AZU..GLA...
+      | 0xE2 0xB0 0xB0..0xFF    #L&  [47] GLAGOLITIC SMALL LETTER AZU..GLAGO...
+      | 0xE2 0xB1 0x00..0x9E    #
+      | 0xE2 0xB1 0xA0..0xBB    #L&  [28] LATIN CAPITAL LETTER L WITH DOUBLE...
+      | 0xE2 0xB1 0xBC..0xBD    #Lm   [2] LATIN SUBSCRIPT SMALL LETTER J..MO...
+      | 0xE2 0xB1 0xBE..0xFF        #L& [103] LATIN CAPITAL LETTER S WITH SW...
+      | 0xE2 0xB2..0xB2 0x00..0xFF  #
+      | 0xE2 0xB3 0x00..0xA4        #
+      | 0xE2 0xB3 0xAB..0xAE    #L&   [4] COPTIC CAPITAL LETTER CRYPTOGRAMMI...
+      | 0xE2 0xB3 0xB2..0xB3    #L&   [2] COPTIC CAPITAL LETTER BOHAIRIC KHE...
+      | 0xE2 0xB4 0x80..0xA5    #L&  [38] GEORGIAN SMALL LETTER AN..GEORGIAN...
+      | 0xE2 0xB4 0xA7          #L&       GEORGIAN SMALL LETTER YN
+      | 0xE2 0xB4 0xAD          #L&       GEORGIAN SMALL LETTER AEN
+      | 0xE2 0xB4 0xB0..0xFF    #Lo  [56] TIFINAGH LETTER YA..TIFINAGH LETTE...
+      | 0xE2 0xB5 0x00..0xA7    #
+      | 0xE2 0xB5 0xAF          #Lm       TIFINAGH MODIFIER LETTER LABIALIZA...
+      | 0xE2 0xB6 0x80..0x96    #Lo  [23] ETHIOPIC SYLLABLE LOA..ETHIOPIC SY...
+      | 0xE2 0xB6 0xA0..0xA6    #Lo   [7] ETHIOPIC SYLLABLE SSA..ETHIOPIC SY...
+      | 0xE2 0xB6 0xA8..0xAE    #Lo   [7] ETHIOPIC SYLLABLE CCA..ETHIOPIC SY...
+      | 0xE2 0xB6 0xB0..0xB6    #Lo   [7] ETHIOPIC SYLLABLE ZZA..ETHIOPIC SY...
+      | 0xE2 0xB6 0xB8..0xBE    #Lo   [7] ETHIOPIC SYLLABLE CCHA..ETHIOPIC S...
+      | 0xE2 0xB7 0x80..0x86    #Lo   [7] ETHIOPIC SYLLABLE QYA..ETHIOPIC SY...
+      | 0xE2 0xB7 0x88..0x8E    #Lo   [7] ETHIOPIC SYLLABLE KYA..ETHIOPIC SY...
+      | 0xE2 0xB7 0x90..0x96    #Lo   [7] ETHIOPIC SYLLABLE XYA..ETHIOPIC SY...
+      | 0xE2 0xB7 0x98..0x9E    #Lo   [7] ETHIOPIC SYLLABLE GYA..ETHIOPIC SY...
+      | 0xE3 0x80 0x85          #Lm       IDEOGRAPHIC ITERATION MARK
+      | 0xE3 0x80 0x86          #Lo       IDEOGRAPHIC CLOSING MARK
+      | 0xE3 0x80 0x87          #Nl       IDEOGRAPHIC NUMBER ZERO
+      | 0xE3 0x80 0xA1..0xA9    #Nl   [9] HANGZHOU NUMERAL ONE..HANGZHOU NUM...
+      | 0xE3 0x80 0xB1..0xB5    #Lm   [5] VERTICAL KANA REPEAT MARK..VERTICA...
+      | 0xE3 0x80 0xB8..0xBA    #Nl   [3] HANGZHOU NUMERAL TEN..HANGZHOU NUM...
+      | 0xE3 0x80 0xBB          #Lm       VERTICAL IDEOGRAPHIC ITERATION MARK
+      | 0xE3 0x80 0xBC          #Lo       MASU MARK
+      | 0xE3 0x81 0x81..0xFF    #Lo  [86] HIRAGANA LETTER SMALL A..HIRAGANA ...
+      | 0xE3 0x82 0x00..0x96    #
+      | 0xE3 0x82 0x9B..0x9C    #Sk   [2] KATAKANA-HIRAGANA VOICED SOUND MAR...
+      | 0xE3 0x82 0x9D..0x9E    #Lm   [2] HIRAGANA ITERATION MARK..HIRAGANA ...
+      | 0xE3 0x82 0x9F          #Lo       HIRAGANA DIGRAPH YORI
+      | 0xE3 0x82 0xA1..0xFF    #Lo  [90] KATAKANA LETTER SMALL A..KATAKANA ...
+      | 0xE3 0x83 0x00..0xBA    #
+      | 0xE3 0x83 0xBC..0xBE    #Lm   [3] KATAKANA-HIRAGANA PROLONGED SOUND ...
+      | 0xE3 0x83 0xBF          #Lo       KATAKANA DIGRAPH KOTO
+      | 0xE3 0x84 0x85..0xAD    #Lo  [41] BOPOMOFO LETTER B..BOPOMOFO LETTER IH
+      | 0xE3 0x84 0xB1..0xFF        #Lo  [94] HANGUL LETTER KIYEOK..HANGUL L...
+      | 0xE3 0x85..0x85 0x00..0xFF  #
+      | 0xE3 0x86 0x00..0x8E        #
+      | 0xE3 0x86 0xA0..0xBA    #Lo  [27] BOPOMOFO LETTER BU..BOPOMOFO LETTE...
+      | 0xE3 0x87 0xB0..0xBF    #Lo  [16] KATAKANA LETTER SMALL KU..KATAKANA...
+      | 0xE3 0x90 0x80..0xFF        #Lo [6582] CJK UNIFIED IDEOGRAPH-3400..C...
+      | 0xE3 0x91..0xFF 0x00..0xFF  #
+      | 0xE4 0x00 0x00..0xFF        #
+      | 0xE4 0x01..0xB5 0x00..0xFF  #
+      | 0xE4 0xB6 0x00..0xB5        #
+      | 0xE4 0xB8 0x80..0xFF              #Lo [20950] CJK UNIFIED IDEOGRAPH-...
+      | 0xE4 0xB9..0xFF 0x00..0xFF        #
+      | 0xE5..0xE8 0x00..0xFF 0x00..0xFF  #
+      | 0xE9 0x00 0x00..0xFF              #
+      | 0xE9 0x01..0xBE 0x00..0xFF        #
+      | 0xE9 0xBF 0x00..0x95              #
+      | 0xEA 0x80 0x80..0x94    #Lo  [21] YI SYLLABLE IT..YI SYLLABLE E
+      | 0xEA 0x80 0x95          #Lm       YI SYLLABLE WU
+      | 0xEA 0x80 0x96..0xFF        #Lo [1143] YI SYLLABLE BIT..YI SYLLABLE YYR
+      | 0xEA 0x81..0x91 0x00..0xFF  #
+      | 0xEA 0x92 0x00..0x8C        #
+      | 0xEA 0x93 0x90..0xB7    #Lo  [40] LISU LETTER BA..LISU LETTER OE
+      | 0xEA 0x93 0xB8..0xBD    #Lm   [6] LISU LETTER TONE MYA TI..LISU LETT...
+      | 0xEA 0x94 0x80..0xFF        #Lo [268] VAI SYLLABLE EE..VAI SYLLABLE NG
+      | 0xEA 0x95..0x97 0x00..0xFF  #
+      | 0xEA 0x98 0x00..0x8B        #
+      | 0xEA 0x98 0x8C          #Lm       VAI SYLLABLE LENGTHENER
+      | 0xEA 0x98 0x90..0x9F    #Lo  [16] VAI SYLLABLE NDOLE FA..VAI SYMBOL ...
+      | 0xEA 0x98 0xAA..0xAB    #Lo   [2] VAI SYLLABLE NDOLE MA..VAI SYLLABL...
+      | 0xEA 0x99 0x80..0xAD    #L&  [46] CYRILLIC CAPITAL LETTER ZEMLYA..CY...
+      | 0xEA 0x99 0xAE          #Lo       CYRILLIC LETTER MULTIOCULAR O
+      | 0xEA 0x99 0xBF          #Lm       CYRILLIC PAYEROK
+      | 0xEA 0x9A 0x80..0x9B    #L&  [28] CYRILLIC CAPITAL LETTER DWE..CYRIL...
+      | 0xEA 0x9A 0x9C..0x9D    #Lm   [2] MODIFIER LETTER CYRILLIC HARD SIGN...
+      | 0xEA 0x9A 0xA0..0xFF    #Lo  [70] BAMUM LETTER A..BAMUM LETTER KI
+      | 0xEA 0x9B 0x00..0xA5    #
+      | 0xEA 0x9B 0xA6..0xAF    #Nl  [10] BAMUM LETTER MO..BAMUM LETTER KOGHOM
+      | 0xEA 0x9C 0x97..0x9F    #Lm   [9] MODIFIER LETTER DOT VERTICAL BAR.....
+      | 0xEA 0x9C 0xA2..0xFF    #L&  [78] LATIN CAPITAL LETTER EGYPTOLOGICAL...
+      | 0xEA 0x9D 0x00..0xAF    #
+      | 0xEA 0x9D 0xB0          #Lm       MODIFIER LETTER US
+      | 0xEA 0x9D 0xB1..0xFF    #L&  [23] LATIN SMALL LETTER DUM..LATIN SMAL...
+      | 0xEA 0x9E 0x00..0x87    #
+      | 0xEA 0x9E 0x88          #Lm       MODIFIER LETTER LOW CIRCUMFLEX ACCENT
+      | 0xEA 0x9E 0x8B..0x8E    #L&   [4] LATIN CAPITAL LETTER SALTILLO..LAT...
+      | 0xEA 0x9E 0x8F          #Lo       LATIN LETTER SINOLOGICAL DOT
+      | 0xEA 0x9E 0x90..0xAE    #L&  [31] LATIN CAPITAL LETTER N WITH DESCEN...
+      | 0xEA 0x9E 0xB0..0xB7    #L&   [8] LATIN CAPITAL LETTER TURNED K..LAT...
+      | 0xEA 0x9F 0xB7          #Lo       LATIN EPIGRAPHIC LETTER SIDEWAYS I
+      | 0xEA 0x9F 0xB8..0xB9    #Lm   [2] MODIFIER LETTER CAPITAL H WITH STR...
+      | 0xEA 0x9F 0xBA          #L&       LATIN LETTER SMALL CAPITAL TURNED M
+      | 0xEA 0x9F 0xBB..0xFF    #Lo   [7] LATIN EPIGRAPHIC LETTER REVERSED F...
+      | 0xEA 0xA0 0x00..0x81    #
+      | 0xEA 0xA0 0x83..0x85    #Lo   [3] SYLOTI NAGRI LETTER U..SYLOTI NAGR...
+      | 0xEA 0xA0 0x87..0x8A    #Lo   [4] SYLOTI NAGRI LETTER KO..SYLOTI NAG...
+      | 0xEA 0xA0 0x8C..0xA2    #Lo  [23] SYLOTI NAGRI LETTER CO..SYLOTI NAG...
+      | 0xEA 0xA1 0x80..0xB3    #Lo  [52] PHAGS-PA LETTER KA..PHAGS-PA LETTE...
+      | 0xEA 0xA2 0x82..0xB3    #Lo  [50] SAURASHTRA LETTER A..SAURASHTRA LE...
+      | 0xEA 0xA3 0xB2..0xB7    #Lo   [6] DEVANAGARI SIGN SPACING CANDRABIND...
+      | 0xEA 0xA3 0xBB          #Lo       DEVANAGARI HEADSTROKE
+      | 0xEA 0xA3 0xBD          #Lo       DEVANAGARI JAIN OM
+      | 0xEA 0xA4 0x8A..0xA5    #Lo  [28] KAYAH LI LETTER KA..KAYAH LI LETTE...
+      | 0xEA 0xA4 0xB0..0xFF    #Lo  [23] REJANG LETTER KA..REJANG LETTER A
+      | 0xEA 0xA5 0x00..0x86    #
+      | 0xEA 0xA5 0xA0..0xBC    #Lo  [29] HANGUL CHOSEONG TIKEUT-MIEUM..HANG...
+      | 0xEA 0xA6 0x84..0xB2    #Lo  [47] JAVANESE LETTER A..JAVANESE LETTER HA
+      | 0xEA 0xA7 0x8F          #Lm       JAVANESE PANGRANGKEP
+      | 0xEA 0xA7 0xA0..0xA4    #Lo   [5] MYANMAR LETTER SHAN GHA..MYANMAR L...
+      | 0xEA 0xA7 0xA6          #Lm       MYANMAR MODIFIER LETTER SHAN REDUP...
+      | 0xEA 0xA7 0xA7..0xAF    #Lo   [9] MYANMAR LETTER TAI LAING NYA..MYAN...
+      | 0xEA 0xA7 0xBA..0xBE    #Lo   [5] MYANMAR LETTER TAI LAING LLA..MYAN...
+      | 0xEA 0xA8 0x80..0xA8    #Lo  [41] CHAM LETTER A..CHAM LETTER HA
+      | 0xEA 0xA9 0x80..0x82    #Lo   [3] CHAM LETTER FINAL K..CHAM LETTER F...
+      | 0xEA 0xA9 0x84..0x8B    #Lo   [8] CHAM LETTER FINAL CH..CHAM LETTER ...
+      | 0xEA 0xA9 0xA0..0xAF    #Lo  [16] MYANMAR LETTER KHAMTI GA..MYANMAR ...
+      | 0xEA 0xA9 0xB0          #Lm       MYANMAR MODIFIER LETTER KHAMTI RED...
+      | 0xEA 0xA9 0xB1..0xB6    #Lo   [6] MYANMAR LETTER KHAMTI XA..MYANMAR ...
+      | 0xEA 0xA9 0xBA          #Lo       MYANMAR LETTER AITON RA
+      | 0xEA 0xA9 0xBE..0xFF    #Lo  [50] MYANMAR LETTER SHWE PALAUNG CHA..T...
+      | 0xEA 0xAA 0x00..0xAF    #
+      | 0xEA 0xAA 0xB1          #Lo       TAI VIET VOWEL AA
+      | 0xEA 0xAA 0xB5..0xB6    #Lo   [2] TAI VIET VOWEL E..TAI VIET VOWEL O
+      | 0xEA 0xAA 0xB9..0xBD    #Lo   [5] TAI VIET VOWEL UEA..TAI VIET VOWEL AN
+      | 0xEA 0xAB 0x80          #Lo       TAI VIET TONE MAI NUENG
+      | 0xEA 0xAB 0x82          #Lo       TAI VIET TONE MAI SONG
+      | 0xEA 0xAB 0x9B..0x9C    #Lo   [2] TAI VIET SYMBOL KON..TAI VIET SYMB...
+      | 0xEA 0xAB 0x9D          #Lm       TAI VIET SYMBOL SAM
+      | 0xEA 0xAB 0xA0..0xAA    #Lo  [11] MEETEI MAYEK LETTER E..MEETEI MAYE...
+      | 0xEA 0xAB 0xB2          #Lo       MEETEI MAYEK ANJI
+      | 0xEA 0xAB 0xB3..0xB4    #Lm   [2] MEETEI MAYEK SYLLABLE REPETITION M...
+      | 0xEA 0xAC 0x81..0x86    #Lo   [6] ETHIOPIC SYLLABLE TTHU..ETHIOPIC S...
+      | 0xEA 0xAC 0x89..0x8E    #Lo   [6] ETHIOPIC SYLLABLE DDHU..ETHIOPIC S...
+      | 0xEA 0xAC 0x91..0x96    #Lo   [6] ETHIOPIC SYLLABLE DZU..ETHIOPIC SY...
+      | 0xEA 0xAC 0xA0..0xA6    #Lo   [7] ETHIOPIC SYLLABLE CCHHA..ETHIOPIC ...
+      | 0xEA 0xAC 0xA8..0xAE    #Lo   [7] ETHIOPIC SYLLABLE BBA..ETHIOPIC SY...
+      | 0xEA 0xAC 0xB0..0xFF    #L&  [43] LATIN SMALL LETTER BARRED ALPHA..L...
+      | 0xEA 0xAD 0x00..0x9A    #
+      | 0xEA 0xAD 0x9C..0x9F    #Lm   [4] MODIFIER LETTER SMALL HENG..MODIFI...
+      | 0xEA 0xAD 0xA0..0xA5    #L&   [6] LATIN SMALL LETTER SAKHA YAT..GREE...
+      | 0xEA 0xAD 0xB0..0xFF    #L&  [80] CHEROKEE SMALL LETTER A..CHEROKEE ...
+      | 0xEA 0xAE 0x00..0xBF    #
+      | 0xEA 0xAF 0x80..0xA2    #Lo  [35] MEETEI MAYEK LETTER KOK..MEETEI MA...
+      | 0xEA 0xB0 0x80..0xFF              #Lo [11172] HANGUL SYLLABLE GA..HA...
+      | 0xEA 0xB1..0xFF 0x00..0xFF        #
+      | 0xEB..0xEC 0x00..0xFF 0x00..0xFF  #
+      | 0xED 0x00 0x00..0xFF              #
+      | 0xED 0x01..0x9D 0x00..0xFF        #
+      | 0xED 0x9E 0x00..0xA3              #
+      | 0xED 0x9E 0xB0..0xFF    #Lo  [23] HANGUL JUNGSEONG O-YEO..HANGUL JUN...
+      | 0xED 0x9F 0x00..0x86    #
+      | 0xED 0x9F 0x8B..0xBB    #Lo  [49] HANGUL JONGSEONG NIEUN-RIEUL..HANG...
+      | 0xEF 0xA4 0x80..0xFF        #Lo [366] CJK COMPATIBILITY IDEOGRAPH-F9...
+      | 0xEF 0xA5..0xA8 0x00..0xFF  #
+      | 0xEF 0xA9 0x00..0xAD        #
+      | 0xEF 0xA9 0xB0..0xFF        #Lo [106] CJK COMPATIBILITY IDEOGRAPH-FA...
+      | 0xEF 0xAA..0xAA 0x00..0xFF  #
+      | 0xEF 0xAB 0x00..0x99        #
+      | 0xEF 0xAC 0x80..0x86    #L&   [7] LATIN SMALL LIGATURE FF..LATIN SMA...
+      | 0xEF 0xAC 0x93..0x97    #L&   [5] ARMENIAN SMALL LIGATURE MEN NOW..A...
+      | 0xEF 0xAC 0x9D          #Lo       HEBREW LETTER YOD WITH HIRIQ
+      | 0xEF 0xAC 0x9F..0xA8    #Lo  [10] HEBREW LIGATURE YIDDISH YOD YOD PA...
+      | 0xEF 0xAC 0xAA..0xB6    #Lo  [13] HEBREW LETTER SHIN WITH SHIN DOT.....
+      | 0xEF 0xAC 0xB8..0xBC    #Lo   [5] HEBREW LETTER TET WITH DAGESH..HEB...
+      | 0xEF 0xAC 0xBE          #Lo       HEBREW LETTER MEM WITH DAGESH
+      | 0xEF 0xAD 0x80..0x81    #Lo   [2] HEBREW LETTER NUN WITH DAGESH..HEB...
+      | 0xEF 0xAD 0x83..0x84    #Lo   [2] HEBREW LETTER FINAL PE WITH DAGESH...
+      | 0xEF 0xAD 0x86..0xFF    #Lo [108] HEBREW LETTER TSADI WITH DAGESH..A...
+      | 0xEF 0xAE 0x00..0xB1    #
+      | 0xEF 0xAF 0x93..0xFF        #Lo [363] ARABIC LETTER NG ISOLATED FORM...
+      | 0xEF 0xB0..0xB3 0x00..0xFF  #
+      | 0xEF 0xB4 0x00..0xBD        #
+      | 0xEF 0xB5 0x90..0xFF    #Lo  [64] ARABIC LIGATURE TEH WITH JEEM WITH...
+      | 0xEF 0xB6 0x00..0x8F    #
+      | 0xEF 0xB6 0x92..0xFF    #Lo  [54] ARABIC LIGATURE MEEM WITH JEEM WIT...
+      | 0xEF 0xB7 0x00..0x87    #
+      | 0xEF 0xB7 0xB0..0xBB    #Lo  [12] ARABIC LIGATURE SALLA USED AS KORA...
+      | 0xEF 0xB9 0xB0..0xB4    #Lo   [5] ARABIC FATHATAN ISOLATED FORM..ARA...
+      | 0xEF 0xB9 0xB6..0xFF        #Lo [135] ARABIC FATHA ISOLATED FORM..AR...
+      | 0xEF 0xBA..0xBA 0x00..0xFF  #
+      | 0xEF 0xBB 0x00..0xBC        #
+      | 0xEF 0xBC 0xA1..0xBA    #L&  [26] FULLWIDTH LATIN CAPITAL LETTER A.....
+      | 0xEF 0xBD 0x81..0x9A    #L&  [26] FULLWIDTH LATIN SMALL LETTER A..FU...
+      | 0xEF 0xBD 0xA6..0xAF    #Lo  [10] HALFWIDTH KATAKANA LETTER WO..HALF...
+      | 0xEF 0xBD 0xB0          #Lm       HALFWIDTH KATAKANA-HIRAGANA PROLON...
+      | 0xEF 0xBD 0xB1..0xFF    #Lo  [45] HALFWIDTH KATAKANA LETTER A..HALFW...
+      | 0xEF 0xBE 0x00..0x9D    #
+      | 0xEF 0xBE 0x9E..0x9F    #Lm   [2] HALFWIDTH KATAKANA VOICED SOUND MA...
+      | 0xEF 0xBE 0xA0..0xBE    #Lo  [31] HALFWIDTH HANGUL FILLER..HALFWIDTH...
+      | 0xEF 0xBF 0x82..0x87    #Lo   [6] HALFWIDTH HANGUL LETTER A..HALFWID...
+      | 0xEF 0xBF 0x8A..0x8F    #Lo   [6] HALFWIDTH HANGUL LETTER YEO..HALFW...
+      | 0xEF 0xBF 0x92..0x97    #Lo   [6] HALFWIDTH HANGUL LETTER YO..HALFWI...
+      | 0xEF 0xBF 0x9A..0x9C    #Lo   [3] HALFWIDTH HANGUL LETTER EU..HALFWI...
+      | 0xF0 0x90 0x80 0x80..0x8B  #Lo  [12] LINEAR B SYLLABLE B008 A..LINEA...
+      | 0xF0 0x90 0x80 0x8D..0xA6  #Lo  [26] LINEAR B SYLLABLE B036 JO..LINE...
+      | 0xF0 0x90 0x80 0xA8..0xBA  #Lo  [19] LINEAR B SYLLABLE B060 RA..LINE...
+      | 0xF0 0x90 0x80 0xBC..0xBD  #Lo   [2] LINEAR B SYLLABLE B017 ZA..LINE...
+      | 0xF0 0x90 0x80 0xBF..0xFF  #Lo  [15] LINEAR B SYLLABLE B020 ZO..LINE...
+      | 0xF0 0x90 0x81 0x00..0x8D  #
+      | 0xF0 0x90 0x81 0x90..0x9D  #Lo  [14] LINEAR B SYMBOL B018..LINEAR B ...
+      | 0xF0 0x90 0x82 0x80..0xFF  #Lo [123] LINEAR B IDEOGRAM B100 MAN..LIN...
+      | 0xF0 0x90 0x83 0x00..0xBA  #
+      | 0xF0 0x90 0x85 0x80..0xB4  #Nl  [53] GREEK ACROPHONIC ATTIC ONE QUAR...
+      | 0xF0 0x90 0x8A 0x80..0x9C  #Lo  [29] LYCIAN LETTER A..LYCIAN LETTER X
+      | 0xF0 0x90 0x8A 0xA0..0xFF  #Lo  [49] CARIAN LETTER A..CARIAN LETTER ...
+      | 0xF0 0x90 0x8B 0x00..0x90  #
+      | 0xF0 0x90 0x8C 0x80..0x9F  #Lo  [32] OLD ITALIC LETTER A..OLD ITALIC...
+      | 0xF0 0x90 0x8C 0xB0..0xFF  #Lo  [17] GOTHIC LETTER AHSA..GOTHIC LETT...
+      | 0xF0 0x90 0x8D 0x00..0x80  #
+      | 0xF0 0x90 0x8D 0x81     #Nl       GOTHIC LETTER NINETY
+      | 0xF0 0x90 0x8D 0x82..0x89  #Lo   [8] GOTHIC LETTER RAIDA..GOTHIC LET...
+      | 0xF0 0x90 0x8D 0x8A     #Nl       GOTHIC LETTER NINE HUNDRED
+      | 0xF0 0x90 0x8D 0x90..0xB5  #Lo  [38] OLD PERMIC LETTER AN..OLD PERMI...
+      | 0xF0 0x90 0x8E 0x80..0x9D  #Lo  [30] UGARITIC LETTER ALPA..UGARITIC ...
+      | 0xF0 0x90 0x8E 0xA0..0xFF  #Lo  [36] OLD PERSIAN SIGN A..OLD PERSIAN...
+      | 0xF0 0x90 0x8F 0x00..0x83  #
+      | 0xF0 0x90 0x8F 0x88..0x8F  #Lo   [8] OLD PERSIAN SIGN AURAMAZDAA..OL...
+      | 0xF0 0x90 0x8F 0x91..0x95  #Nl   [5] OLD PERSIAN NUMBER ONE..OLD PER...
+      | 0xF0 0x90 0x90 0x80..0xFF  #L&  [80] DESERET CAPITAL LETTER LONG I.....
+      | 0xF0 0x90 0x91 0x00..0x8F  #
+      | 0xF0 0x90 0x91 0x90..0xFF  #Lo  [78] SHAVIAN LETTER PEEP..OSMANYA LE...
+      | 0xF0 0x90 0x92 0x00..0x9D  #
+      | 0xF0 0x90 0x92 0xB0..0xFF  #L&  [36] OSAGE CAPITAL LETTER A..OSAGE C...
+      | 0xF0 0x90 0x93 0x00..0x93  #
+      | 0xF0 0x90 0x93 0x98..0xBB  #L&  [36] OSAGE SMALL LETTER A..OSAGE SMA...
+      | 0xF0 0x90 0x94 0x80..0xA7  #Lo  [40] ELBASAN LETTER A..ELBASAN LETTE...
+      | 0xF0 0x90 0x94 0xB0..0xFF  #Lo  [52] CAUCASIAN ALBANIAN LETTER ALT.....
+      | 0xF0 0x90 0x95 0x00..0xA3  #
+      | 0xF0 0x90 0x98 0x80..0xFF        #Lo [311] LINEAR A SIGN AB001..LINE...
+      | 0xF0 0x90 0x99..0x9B 0x00..0xFF  #
+      | 0xF0 0x90 0x9C 0x00..0xB6        #
+      | 0xF0 0x90 0x9D 0x80..0x95  #Lo  [22] LINEAR A SIGN A701 A..LINEAR A ...
+      | 0xF0 0x90 0x9D 0xA0..0xA7  #Lo   [8] LINEAR A SIGN A800..LINEAR A SI...
+      | 0xF0 0x90 0xA0 0x80..0x85  #Lo   [6] CYPRIOT SYLLABLE A..CYPRIOT SYL...
+      | 0xF0 0x90 0xA0 0x88     #Lo       CYPRIOT SYLLABLE JO
+      | 0xF0 0x90 0xA0 0x8A..0xB5  #Lo  [44] CYPRIOT SYLLABLE KA..CYPRIOT SY...
+      | 0xF0 0x90 0xA0 0xB7..0xB8  #Lo   [2] CYPRIOT SYLLABLE XA..CYPRIOT SY...
+      | 0xF0 0x90 0xA0 0xBC     #Lo       CYPRIOT SYLLABLE ZA
+      | 0xF0 0x90 0xA0 0xBF..0xFF  #Lo  [23] CYPRIOT SYLLABLE ZO..IMPERIAL A...
+      | 0xF0 0x90 0xA1 0x00..0x95  #
+      | 0xF0 0x90 0xA1 0xA0..0xB6  #Lo  [23] PALMYRENE LETTER ALEPH..PALMYRE...
+      | 0xF0 0x90 0xA2 0x80..0x9E  #Lo  [31] NABATAEAN LETTER FINAL ALEPH..N...
+      | 0xF0 0x90 0xA3 0xA0..0xB2  #Lo  [19] HATRAN LETTER ALEPH..HATRAN LET...
+      | 0xF0 0x90 0xA3 0xB4..0xB5  #Lo   [2] HATRAN LETTER SHIN..HATRAN LETT...
+      | 0xF0 0x90 0xA4 0x80..0x95  #Lo  [22] PHOENICIAN LETTER ALF..PHOENICI...
+      | 0xF0 0x90 0xA4 0xA0..0xB9  #Lo  [26] LYDIAN LETTER A..LYDIAN LETTER C
+      | 0xF0 0x90 0xA6 0x80..0xB7  #Lo  [56] MEROITIC HIEROGLYPHIC LETTER A....
+      | 0xF0 0x90 0xA6 0xBE..0xBF  #Lo   [2] MEROITIC CURSIVE LOGOGRAM RMT.....
+      | 0xF0 0x90 0xA8 0x80     #Lo       KHAROSHTHI LETTER A
+      | 0xF0 0x90 0xA8 0x90..0x93  #Lo   [4] KHAROSHTHI LETTER KA..KHAROSHTH...
+      | 0xF0 0x90 0xA8 0x95..0x97  #Lo   [3] KHAROSHTHI LETTER CA..KHAROSHTH...
+      | 0xF0 0x90 0xA8 0x99..0xB3  #Lo  [27] KHAROSHTHI LETTER NYA..KHAROSHT...
+      | 0xF0 0x90 0xA9 0xA0..0xBC  #Lo  [29] OLD SOUTH ARABIAN LETTER HE..OL...
+      | 0xF0 0x90 0xAA 0x80..0x9C  #Lo  [29] OLD NORTH ARABIAN LETTER HEH..O...
+      | 0xF0 0x90 0xAB 0x80..0x87  #Lo   [8] MANICHAEAN LETTER ALEPH..MANICH...
+      | 0xF0 0x90 0xAB 0x89..0xA4  #Lo  [28] MANICHAEAN LETTER ZAYIN..MANICH...
+      | 0xF0 0x90 0xAC 0x80..0xB5  #Lo  [54] AVESTAN LETTER A..AVESTAN LETTE...
+      | 0xF0 0x90 0xAD 0x80..0x95  #Lo  [22] INSCRIPTIONAL PARTHIAN LETTER A...
+      | 0xF0 0x90 0xAD 0xA0..0xB2  #Lo  [19] INSCRIPTIONAL PAHLAVI LETTER AL...
+      | 0xF0 0x90 0xAE 0x80..0x91  #Lo  [18] PSALTER PAHLAVI LETTER ALEPH..P...
+      | 0xF0 0x90 0xB0 0x80..0xFF  #Lo  [73] OLD TURKIC LETTER ORKHON A..OLD...
+      | 0xF0 0x90 0xB1 0x00..0x88  #
+      | 0xF0 0x90 0xB2 0x80..0xB2  #L&  [51] OLD HUNGARIAN CAPITAL LETTER A....
+      | 0xF0 0x90 0xB3 0x80..0xB2  #L&  [51] OLD HUNGARIAN SMALL LETTER A..O...
+      | 0xF0 0x91 0x80 0x83..0xB7  #Lo  [53] BRAHMI SIGN JIHVAMULIYA..BRAHMI...
+      | 0xF0 0x91 0x82 0x83..0xAF  #Lo  [45] KAITHI LETTER A..KAITHI LETTER HA
+      | 0xF0 0x91 0x83 0x90..0xA8  #Lo  [25] SORA SOMPENG LETTER SAH..SORA S...
+      | 0xF0 0x91 0x84 0x83..0xA6  #Lo  [36] CHAKMA LETTER AA..CHAKMA LETTER...
+      | 0xF0 0x91 0x85 0x90..0xB2  #Lo  [35] MAHAJANI LETTER A..MAHAJANI LET...
+      | 0xF0 0x91 0x85 0xB6     #Lo       MAHAJANI LIGATURE SHRI
+      | 0xF0 0x91 0x86 0x83..0xB2  #Lo  [48] SHARADA LETTER A..SHARADA LETTE...
+      | 0xF0 0x91 0x87 0x81..0x84  #Lo   [4] SHARADA SIGN AVAGRAHA..SHARADA OM
+      | 0xF0 0x91 0x87 0x9A     #Lo       SHARADA EKAM
+      | 0xF0 0x91 0x87 0x9C     #Lo       SHARADA HEADSTROKE
+      | 0xF0 0x91 0x88 0x80..0x91  #Lo  [18] KHOJKI LETTER A..KHOJKI LETTER JJA
+      | 0xF0 0x91 0x88 0x93..0xAB  #Lo  [25] KHOJKI LETTER NYA..KHOJKI LETTE...
+      | 0xF0 0x91 0x8A 0x80..0x86  #Lo   [7] MULTANI LETTER A..MULTANI LETTE...
+      | 0xF0 0x91 0x8A 0x88     #Lo       MULTANI LETTER GHA
+      | 0xF0 0x91 0x8A 0x8A..0x8D  #Lo   [4] MULTANI LETTER CA..MULTANI LETT...
+      | 0xF0 0x91 0x8A 0x8F..0x9D  #Lo  [15] MULTANI LETTER NYA..MULTANI LET...
+      | 0xF0 0x91 0x8A 0x9F..0xA8  #Lo  [10] MULTANI LETTER BHA..MULTANI LET...
+      | 0xF0 0x91 0x8A 0xB0..0xFF  #Lo  [47] KHUDAWADI LETTER A..KHUDAWADI L...
+      | 0xF0 0x91 0x8B 0x00..0x9E  #
+      | 0xF0 0x91 0x8C 0x85..0x8C  #Lo   [8] GRANTHA LETTER A..GRANTHA LETTE...
+      | 0xF0 0x91 0x8C 0x8F..0x90  #Lo   [2] GRANTHA LETTER EE..GRANTHA LETT...
+      | 0xF0 0x91 0x8C 0x93..0xA8  #Lo  [22] GRANTHA LETTER OO..GRANTHA LETT...
+      | 0xF0 0x91 0x8C 0xAA..0xB0  #Lo   [7] GRANTHA LETTER PA..GRANTHA LETT...
+      | 0xF0 0x91 0x8C 0xB2..0xB3  #Lo   [2] GRANTHA LETTER LA..GRANTHA LETT...
+      | 0xF0 0x91 0x8C 0xB5..0xB9  #Lo   [5] GRANTHA LETTER VA..GRANTHA LETT...
+      | 0xF0 0x91 0x8C 0xBD     #Lo       GRANTHA SIGN AVAGRAHA
+      | 0xF0 0x91 0x8D 0x90     #Lo       GRANTHA OM
+      | 0xF0 0x91 0x8D 0x9D..0xA1  #Lo   [5] GRANTHA SIGN PLUTA..GRANTHA LET...
+      | 0xF0 0x91 0x90 0x80..0xB4  #Lo  [53] NEWA LETTER A..NEWA LETTER HA
+      | 0xF0 0x91 0x91 0x87..0x8A  #Lo   [4] NEWA SIGN AVAGRAHA..NEWA SIDDHI
+      | 0xF0 0x91 0x92 0x80..0xAF  #Lo  [48] TIRHUTA ANJI..TIRHUTA LETTER HA
+      | 0xF0 0x91 0x93 0x84..0x85  #Lo   [2] TIRHUTA SIGN AVAGRAHA..TIRHUTA ...
+      | 0xF0 0x91 0x93 0x87     #Lo       TIRHUTA OM
+      | 0xF0 0x91 0x96 0x80..0xAE  #Lo  [47] SIDDHAM LETTER A..SIDDHAM LETTE...
+      | 0xF0 0x91 0x97 0x98..0x9B  #Lo   [4] SIDDHAM LETTER THREE-CIRCLE ALT...
+      | 0xF0 0x91 0x98 0x80..0xAF  #Lo  [48] MODI LETTER A..MODI LETTER LLA
+      | 0xF0 0x91 0x99 0x84     #Lo       MODI SIGN HUVA
+      | 0xF0 0x91 0x9A 0x80..0xAA  #Lo  [43] TAKRI LETTER A..TAKRI LETTER RRA
+      | 0xF0 0x91 0x9C 0x80..0x99  #Lo  [26] AHOM LETTER KA..AHOM LETTER JHA
+      | 0xF0 0x91 0xA2 0xA0..0xFF  #L&  [64] WARANG CITI CAPITAL LETTER NGAA...
+      | 0xF0 0x91 0xA3 0x00..0x9F  #
+      | 0xF0 0x91 0xA3 0xBF     #Lo       WARANG CITI OM
+      | 0xF0 0x91 0xAB 0x80..0xB8  #Lo  [57] PAU CIN HAU LETTER PA..PAU CIN ...
+      | 0xF0 0x91 0xB0 0x80..0x88  #Lo   [9] BHAIKSUKI LETTER A..BHAIKSUKI L...
+      | 0xF0 0x91 0xB0 0x8A..0xAE  #Lo  [37] BHAIKSUKI LETTER E..BHAIKSUKI L...
+      | 0xF0 0x91 0xB1 0x80     #Lo       BHAIKSUKI SIGN AVAGRAHA
+      | 0xF0 0x91 0xB1 0xB2..0xFF  #Lo  [30] MARCHEN LETTER KA..MARCHEN LETT...
+      | 0xF0 0x91 0xB2 0x00..0x8F  #
+      | 0xF0 0x92 0x80 0x80..0xFF        #Lo [922] CUNEIFORM SIGN A..CUNEIFO...
+      | 0xF0 0x92 0x81..0x8D 0x00..0xFF  #
+      | 0xF0 0x92 0x8E 0x00..0x99        #
+      | 0xF0 0x92 0x90 0x80..0xFF  #Nl [111] CUNEIFORM NUMERIC SIGN TWO ASH....
+      | 0xF0 0x92 0x91 0x00..0xAE  #
+      | 0xF0 0x92 0x92 0x80..0xFF        #Lo [196] CUNEIFORM SIGN AB TIMES N...
+      | 0xF0 0x92 0x93..0x94 0x00..0xFF  #
+      | 0xF0 0x92 0x95 0x00..0x83        #
+      | 0xF0 0x93 0x80 0x80..0xFF        #Lo [1071] EGYPTIAN HIEROGLYPH A001...
+      | 0xF0 0x93 0x81..0x8F 0x00..0xFF  #
+      | 0xF0 0x93 0x90 0x00..0xAE        #
+      | 0xF0 0x94 0x90 0x80..0xFF        #Lo [583] ANATOLIAN HIEROGLYPH A001...
+      | 0xF0 0x94 0x91..0x98 0x00..0xFF  #
+      | 0xF0 0x94 0x99 0x00..0x86        #
+      | 0xF0 0x96 0xA0 0x80..0xFF        #Lo [569] BAMUM LETTER PHASE-A NGKU...
+      | 0xF0 0x96 0xA1..0xA7 0x00..0xFF  #
+      | 0xF0 0x96 0xA8 0x00..0xB8        #
+      | 0xF0 0x96 0xA9 0x80..0x9E  #Lo  [31] MRO LETTER TA..MRO LETTER TEK
+      | 0xF0 0x96 0xAB 0x90..0xAD  #Lo  [30] BASSA VAH LETTER ENNI..BASSA VA...
+      | 0xF0 0x96 0xAC 0x80..0xAF  #Lo  [48] PAHAWH HMONG VOWEL KEEB..PAHAWH...
+      | 0xF0 0x96 0xAD 0x80..0x83  #Lm   [4] PAHAWH HMONG SIGN VOS SEEV..PAH...
+      | 0xF0 0x96 0xAD 0xA3..0xB7  #Lo  [21] PAHAWH HMONG SIGN VOS LUB..PAHA...
+      | 0xF0 0x96 0xAD 0xBD..0xFF  #Lo  [19] PAHAWH HMONG CLAN SIGN TSHEEJ.....
+      | 0xF0 0x96 0xAE 0x00..0x8F  #
+      | 0xF0 0x96 0xBC 0x80..0xFF  #Lo  [69] MIAO LETTER PA..MIAO LETTER HHA
+      | 0xF0 0x96 0xBD 0x00..0x84  #
+      | 0xF0 0x96 0xBD 0x90     #Lo       MIAO LETTER NASALIZATION
+      | 0xF0 0x96 0xBE 0x93..0x9F  #Lm  [13] MIAO LETTER TONE-2..MIAO LETTER...
+      | 0xF0 0x96 0xBF 0xA0     #Lm       TANGUT ITERATION MARK
+      | 0xF0 0x97 0x80 0x80..0xFF        #Lo [6125] TANGUT IDEOGRAPH-17000.....
+      | 0xF0 0x97 0x81..0xFF 0x00..0xFF  #
+      | 0xF0 0x98 0x00 0x00..0xFF        #
+      | 0xF0 0x98 0x01..0x9E 0x00..0xFF  #
+      | 0xF0 0x98 0x9F 0x00..0xAC        #
+      | 0xF0 0x98 0xA0 0x80..0xFF        #Lo [755] TANGUT COMPONENT-001..TAN...
+      | 0xF0 0x98 0xA1..0xAA 0x00..0xFF  #
+      | 0xF0 0x98 0xAB 0x00..0xB2        #
+      | 0xF0 0x9B 0x80 0x80..0x81  #Lo   [2] KATAKANA LETTER ARCHAIC E..HIRA...
+      | 0xF0 0x9B 0xB0 0x80..0xFF  #Lo [107] DUPLOYAN LETTER H..DUPLOYAN LET...
+      | 0xF0 0x9B 0xB1 0x00..0xAA  #
+      | 0xF0 0x9B 0xB1 0xB0..0xBC  #Lo  [13] DUPLOYAN AFFIX LEFT HORIZONTAL ...
+      | 0xF0 0x9B 0xB2 0x80..0x88  #Lo   [9] DUPLOYAN AFFIX HIGH ACUTE..DUPL...
+      | 0xF0 0x9B 0xB2 0x90..0x99  #Lo  [10] DUPLOYAN AFFIX LOW ACUTE..DUPLO...
+      | 0xF0 0x9D 0x90 0x80..0xFF  #L&  [85] MATHEMATICAL BOLD CAPITAL A..MA...
+      | 0xF0 0x9D 0x91 0x00..0x94  #
+      | 0xF0 0x9D 0x91 0x96..0xFF  #L&  [71] MATHEMATICAL ITALIC SMALL I..MA...
+      | 0xF0 0x9D 0x92 0x00..0x9C  #
+      | 0xF0 0x9D 0x92 0x9E..0x9F  #L&   [2] MATHEMATICAL SCRIPT CAPITAL C.....
+      | 0xF0 0x9D 0x92 0xA2     #L&       MATHEMATICAL SCRIPT CAPITAL G
+      | 0xF0 0x9D 0x92 0xA5..0xA6  #L&   [2] MATHEMATICAL SCRIPT CAPITAL J.....
+      | 0xF0 0x9D 0x92 0xA9..0xAC  #L&   [4] MATHEMATICAL SCRIPT CAPITAL N.....
+      | 0xF0 0x9D 0x92 0xAE..0xB9  #L&  [12] MATHEMATICAL SCRIPT CAPITAL S.....
+      | 0xF0 0x9D 0x92 0xBB     #L&       MATHEMATICAL SCRIPT SMALL F
+      | 0xF0 0x9D 0x92 0xBD..0xFF  #L&   [7] MATHEMATICAL SCRIPT SMALL H..MA...
+      | 0xF0 0x9D 0x93 0x00..0x83  #
+      | 0xF0 0x9D 0x93 0x85..0xFF  #L&  [65] MATHEMATICAL SCRIPT SMALL P..MA...
+      | 0xF0 0x9D 0x94 0x00..0x85  #
+      | 0xF0 0x9D 0x94 0x87..0x8A  #L&   [4] MATHEMATICAL FRAKTUR CAPITAL D....
+      | 0xF0 0x9D 0x94 0x8D..0x94  #L&   [8] MATHEMATICAL FRAKTUR CAPITAL J....
+      | 0xF0 0x9D 0x94 0x96..0x9C  #L&   [7] MATHEMATICAL FRAKTUR CAPITAL S....
+      | 0xF0 0x9D 0x94 0x9E..0xB9  #L&  [28] MATHEMATICAL FRAKTUR SMALL A..M...
+      | 0xF0 0x9D 0x94 0xBB..0xBE  #L&   [4] MATHEMATICAL DOUBLE-STRUCK CAPI...
+      | 0xF0 0x9D 0x95 0x80..0x84  #L&   [5] MATHEMATICAL DOUBLE-STRUCK CAPI...
+      | 0xF0 0x9D 0x95 0x86     #L&       MATHEMATICAL DOUBLE-STRUCK CAPITAL O
+      | 0xF0 0x9D 0x95 0x8A..0x90  #L&   [7] MATHEMATICAL DOUBLE-STRUCK CAPI...
+      | 0xF0 0x9D 0x95 0x92..0xFF        #L& [340] MATHEMATICAL DOUBLE-STRUC...
+      | 0xF0 0x9D 0x96..0x99 0x00..0xFF  #
+      | 0xF0 0x9D 0x9A 0x00..0xA5        #
+      | 0xF0 0x9D 0x9A 0xA8..0xFF  #L&  [25] MATHEMATICAL BOLD CAPITAL ALPHA...
+      | 0xF0 0x9D 0x9B 0x00..0x80  #
+      | 0xF0 0x9D 0x9B 0x82..0x9A  #L&  [25] MATHEMATICAL BOLD SMALL ALPHA.....
+      | 0xF0 0x9D 0x9B 0x9C..0xBA  #L&  [31] MATHEMATICAL BOLD EPSILON SYMBO...
+      | 0xF0 0x9D 0x9B 0xBC..0xFF  #L&  [25] MATHEMATICAL ITALIC SMALL ALPHA...
+      | 0xF0 0x9D 0x9C 0x00..0x94  #
+      | 0xF0 0x9D 0x9C 0x96..0xB4  #L&  [31] MATHEMATICAL ITALIC EPSILON SYM...
+      | 0xF0 0x9D 0x9C 0xB6..0xFF  #L&  [25] MATHEMATICAL BOLD ITALIC SMALL ...
+      | 0xF0 0x9D 0x9D 0x00..0x8E  #
+      | 0xF0 0x9D 0x9D 0x90..0xAE  #L&  [31] MATHEMATICAL BOLD ITALIC EPSILO...
+      | 0xF0 0x9D 0x9D 0xB0..0xFF  #L&  [25] MATHEMATICAL SANS-SERIF BOLD SM...
+      | 0xF0 0x9D 0x9E 0x00..0x88  #
+      | 0xF0 0x9D 0x9E 0x8A..0xA8  #L&  [31] MATHEMATICAL SANS-SERIF BOLD EP...
+      | 0xF0 0x9D 0x9E 0xAA..0xFF  #L&  [25] MATHEMATICAL SANS-SERIF BOLD IT...
+      | 0xF0 0x9D 0x9F 0x00..0x82  #
+      | 0xF0 0x9D 0x9F 0x84..0x8B  #L&   [8] MATHEMATICAL SANS-SERIF BOLD IT...
+      | 0xF0 0x9E 0xA0 0x80..0xFF        #Lo [197] MENDE KIKAKUI SYLLABLE M0...
+      | 0xF0 0x9E 0xA1..0xA2 0x00..0xFF  #
+      | 0xF0 0x9E 0xA3 0x00..0x84        #
+      | 0xF0 0x9E 0xA4 0x80..0xFF  #L&  [68] ADLAM CAPITAL LETTER ALIF..ADLA...
+      | 0xF0 0x9E 0xA5 0x00..0x83  #
+      | 0xF0 0x9E 0xB8 0x80..0x83  #Lo   [4] ARABIC MATHEMATICAL ALEF..ARABI...
+      | 0xF0 0x9E 0xB8 0x85..0x9F  #Lo  [27] ARABIC MATHEMATICAL WAW..ARABIC...
+      | 0xF0 0x9E 0xB8 0xA1..0xA2  #Lo   [2] ARABIC MATHEMATICAL INITIAL BEH...
+      | 0xF0 0x9E 0xB8 0xA4     #Lo       ARABIC MATHEMATICAL INITIAL HEH
+      | 0xF0 0x9E 0xB8 0xA7     #Lo       ARABIC MATHEMATICAL INITIAL HAH
+      | 0xF0 0x9E 0xB8 0xA9..0xB2  #Lo  [10] ARABIC MATHEMATICAL INITIAL YEH...
+      | 0xF0 0x9E 0xB8 0xB4..0xB7  #Lo   [4] ARABIC MATHEMATICAL INITIAL SHE...
+      | 0xF0 0x9E 0xB8 0xB9     #Lo       ARABIC MATHEMATICAL INITIAL DAD
+      | 0xF0 0x9E 0xB8 0xBB     #Lo       ARABIC MATHEMATICAL INITIAL GHAIN
+      | 0xF0 0x9E 0xB9 0x82     #Lo       ARABIC MATHEMATICAL TAILED JEEM
+      | 0xF0 0x9E 0xB9 0x87     #Lo       ARABIC MATHEMATICAL TAILED HAH
+      | 0xF0 0x9E 0xB9 0x89     #Lo       ARABIC MATHEMATICAL TAILED YEH
+      | 0xF0 0x9E 0xB9 0x8B     #Lo       ARABIC MATHEMATICAL TAILED LAM
+      | 0xF0 0x9E 0xB9 0x8D..0x8F  #Lo   [3] ARABIC MATHEMATICAL TAILED NOON...
+      | 0xF0 0x9E 0xB9 0x91..0x92  #Lo   [2] ARABIC MATHEMATICAL TAILED SAD....
+      | 0xF0 0x9E 0xB9 0x94     #Lo       ARABIC MATHEMATICAL TAILED SHEEN
+      | 0xF0 0x9E 0xB9 0x97     #Lo       ARABIC MATHEMATICAL TAILED KHAH
+      | 0xF0 0x9E 0xB9 0x99     #Lo       ARABIC MATHEMATICAL TAILED DAD
+      | 0xF0 0x9E 0xB9 0x9B     #Lo       ARABIC MATHEMATICAL TAILED GHAIN
+      | 0xF0 0x9E 0xB9 0x9D     #Lo       ARABIC MATHEMATICAL TAILED DOTLESS...
+      | 0xF0 0x9E 0xB9 0x9F     #Lo       ARABIC MATHEMATICAL TAILED DOTLESS...
+      | 0xF0 0x9E 0xB9 0xA1..0xA2  #Lo   [2] ARABIC MATHEMATICAL STRETCHED B...
+      | 0xF0 0x9E 0xB9 0xA4     #Lo       ARABIC MATHEMATICAL STRETCHED HEH
+      | 0xF0 0x9E 0xB9 0xA7..0xAA  #Lo   [4] ARABIC MATHEMATICAL STRETCHED H...
+      | 0xF0 0x9E 0xB9 0xAC..0xB2  #Lo   [7] ARABIC MATHEMATICAL STRETCHED M...
+      | 0xF0 0x9E 0xB9 0xB4..0xB7  #Lo   [4] ARABIC MATHEMATICAL STRETCHED S...
+      | 0xF0 0x9E 0xB9 0xB9..0xBC  #Lo   [4] ARABIC MATHEMATICAL STRETCHED D...
+      | 0xF0 0x9E 0xB9 0xBE     #Lo       ARABIC MATHEMATICAL STRETCHED DOTL...
+      | 0xF0 0x9E 0xBA 0x80..0x89  #Lo  [10] ARABIC MATHEMATICAL LOOPED ALEF...
+      | 0xF0 0x9E 0xBA 0x8B..0x9B  #Lo  [17] ARABIC MATHEMATICAL LOOPED LAM....
+      | 0xF0 0x9E 0xBA 0xA1..0xA3  #Lo   [3] ARABIC MATHEMATICAL DOUBLE-STRU...
+      | 0xF0 0x9E 0xBA 0xA5..0xA9  #Lo   [5] ARABIC MATHEMATICAL DOUBLE-STRU...
+      | 0xF0 0x9E 0xBA 0xAB..0xBB  #Lo  [17] ARABIC MATHEMATICAL DOUBLE-STRU...
+      | 0xF0 0xA0 0x80 0x80..0xFF              #Lo [42711] CJK UNIFIED IDEOG...
+      | 0xF0 0xA0 0x81..0xFF 0x00..0xFF        #
+      | 0xF0 0xA1..0xA9 0x00..0xFF 0x00..0xFF  #
+      | 0xF0 0xAA 0x00 0x00..0xFF              #
+      | 0xF0 0xAA 0x01..0x9A 0x00..0xFF        #
+      | 0xF0 0xAA 0x9B 0x00..0x96              #
+      | 0xF0 0xAA 0x9C 0x80..0xFF        #Lo [4149] CJK UNIFIED IDEOGRAPH-2A...
+      | 0xF0 0xAA 0x9D..0xFF 0x00..0xFF  #
+      | 0xF0 0xAB 0x00 0x00..0xFF        #
+      | 0xF0 0xAB 0x01..0x9B 0x00..0xFF  #
+      | 0xF0 0xAB 0x9C 0x00..0xB4        #
+      | 0xF0 0xAB 0x9D 0x80..0xFF        #Lo [222] CJK UNIFIED IDEOGRAPH-2B7...
+      | 0xF0 0xAB 0x9E..0x9F 0x00..0xFF  #
+      | 0xF0 0xAB 0xA0 0x00..0x9D        #
+      | 0xF0 0xAB 0xA0 0xA0..0xFF        #Lo [5762] CJK UNIFIED IDEOGRAPH-2B...
+      | 0xF0 0xAB 0xA1..0xFF 0x00..0xFF  #
+      | 0xF0 0xAC 0x00 0x00..0xFF        #
+      | 0xF0 0xAC 0x01..0xB9 0x00..0xFF  #
+      | 0xF0 0xAC 0xBA 0x00..0xA1        #
+      | 0xF0 0xAF 0xA0 0x80..0xFF        #Lo [542] CJK COMPATIBILITY IDEOGRA...
+      | 0xF0 0xAF 0xA1..0xA7 0x00..0xFF  #
+      | 0xF0 0xAF 0xA8 0x00..0x9D        #
+      ;
+
+    ID_Continue = 
+        0x30..0x39              #Nd  [10] DIGIT ZERO..DIGIT NINE
+      | 0x41..0x5A              #L&  [26] LATIN CAPITAL LETTER A..LATIN CAPI...
+      | 0x5F                    #Pc       LOW LINE
+      | 0x61..0x7A              #L&  [26] LATIN SMALL LETTER A..LATIN SMALL ...
+      | 0xC2 0xAA               #Lo       FEMININE ORDINAL INDICATOR
+      | 0xC2 0xB5               #L&       MICRO SIGN
+      | 0xC2 0xB7               #Po       MIDDLE DOT
+      | 0xC2 0xBA               #Lo       MASCULINE ORDINAL INDICATOR
+      | 0xC3 0x80..0x96         #L&  [23] LATIN CAPITAL LETTER A WITH GRAVE....
+      | 0xC3 0x98..0xB6         #L&  [31] LATIN CAPITAL LETTER O WITH STROKE...
+      | 0xC3 0xB8..0xFF         #L& [195] LATIN SMALL LETTER O WITH STROKE.....
+      | 0xC4..0xC5 0x00..0xFF   #
+      | 0xC6 0x00..0xBA         #
+      | 0xC6 0xBB               #Lo       LATIN LETTER TWO WITH STROKE
+      | 0xC6 0xBC..0xBF         #L&   [4] LATIN CAPITAL LETTER TONE FIVE..LA...
+      | 0xC7 0x80..0x83         #Lo   [4] LATIN LETTER DENTAL CLICK..LATIN L...
+      | 0xC7 0x84..0xFF         #L& [208] LATIN CAPITAL LETTER DZ WITH CARON...
+      | 0xC8..0xC9 0x00..0xFF   #
+      | 0xCA 0x00..0x93         #
+      | 0xCA 0x94               #Lo       LATIN LETTER GLOTTAL STOP
+      | 0xCA 0x95..0xAF         #L&  [27] LATIN LETTER PHARYNGEAL VOICED FRI...
+      | 0xCA 0xB0..0xFF         #Lm  [18] MODIFIER LETTER SMALL H..MODIFIER ...
+      | 0xCB 0x00..0x81         #
+      | 0xCB 0x86..0x91         #Lm  [12] MODIFIER LETTER CIRCUMFLEX ACCENT....
+      | 0xCB 0xA0..0xA4         #Lm   [5] MODIFIER LETTER SMALL GAMMA..MODIF...
+      | 0xCB 0xAC               #Lm       MODIFIER LETTER VOICING
+      | 0xCB 0xAE               #Lm       MODIFIER LETTER DOUBLE APOSTROPHE
+      | 0xCC 0x80..0xFF         #Mn [112] COMBINING GRAVE ACCENT..COMBINING ...
+      | 0xCD 0x00..0xAF         #
+      | 0xCD 0xB0..0xB3         #L&   [4] GREEK CAPITAL LETTER HETA..GREEK S...
+      | 0xCD 0xB4               #Lm       GREEK NUMERAL SIGN
+      | 0xCD 0xB6..0xB7         #L&   [2] GREEK CAPITAL LETTER PAMPHYLIAN DI...
+      | 0xCD 0xBA               #Lm       GREEK YPOGEGRAMMENI
+      | 0xCD 0xBB..0xBD         #L&   [3] GREEK SMALL REVERSED LUNATE SIGMA ...
+      | 0xCD 0xBF               #L&       GREEK CAPITAL LETTER YOT
+      | 0xCE 0x86               #L&       GREEK CAPITAL LETTER ALPHA WITH TONOS
+      | 0xCE 0x87               #Po       GREEK ANO TELEIA
+      | 0xCE 0x88..0x8A         #L&   [3] GREEK CAPITAL LETTER EPSILON WITH ...
+      | 0xCE 0x8C               #L&       GREEK CAPITAL LETTER OMICRON WITH ...
+      | 0xCE 0x8E..0xA1         #L&  [20] GREEK CAPITAL LETTER UPSILON WITH ...
+      | 0xCE 0xA3..0xFF         #L&  [83] GREEK CAPITAL LETTER SIGMA..GREEK ...
+      | 0xCF 0x00..0xB5         #
+      | 0xCF 0xB7..0xFF         #L& [139] GREEK CAPITAL LETTER SHO..CYRILLIC...
+      | 0xD0..0xD1 0x00..0xFF   #
+      | 0xD2 0x00..0x81         #
+      | 0xD2 0x83..0x87         #Mn   [5] COMBINING CYRILLIC TITLO..COMBININ...
+      | 0xD2 0x8A..0xFF         #L& [166] CYRILLIC CAPITAL LETTER SHORT I WI...
+      | 0xD3..0xD3 0x00..0xFF   #
+      | 0xD4 0x00..0xAF         #
+      | 0xD4 0xB1..0xFF         #L&  [38] ARMENIAN CAPITAL LETTER AYB..ARMEN...
+      | 0xD5 0x00..0x96         #
+      | 0xD5 0x99               #Lm       ARMENIAN MODIFIER LETTER LEFT HALF...
+      | 0xD5 0xA1..0xFF         #L&  [39] ARMENIAN SMALL LETTER AYB..ARMENIA...
+      | 0xD6 0x00..0x87         #
+      | 0xD6 0x91..0xBD         #Mn  [45] HEBREW ACCENT ETNAHTA..HEBREW POIN...
+      | 0xD6 0xBF               #Mn       HEBREW POINT RAFE
+      | 0xD7 0x81..0x82         #Mn   [2] HEBREW POINT SHIN DOT..HEBREW POIN...
+      | 0xD7 0x84..0x85         #Mn   [2] HEBREW MARK UPPER DOT..HEBREW MARK...
+      | 0xD7 0x87               #Mn       HEBREW POINT QAMATS QATAN
+      | 0xD7 0x90..0xAA         #Lo  [27] HEBREW LETTER ALEF..HEBREW LETTER TAV
+      | 0xD7 0xB0..0xB2         #Lo   [3] HEBREW LIGATURE YIDDISH DOUBLE VAV...
+      | 0xD8 0x90..0x9A         #Mn  [11] ARABIC SIGN SALLALLAHOU ALAYHE WAS...
+      | 0xD8 0xA0..0xBF         #Lo  [32] ARABIC LETTER KASHMIRI YEH..ARABIC...
+      | 0xD9 0x80               #Lm       ARABIC TATWEEL
+      | 0xD9 0x81..0x8A         #Lo  [10] ARABIC LETTER FEH..ARABIC LETTER YEH
+      | 0xD9 0x8B..0x9F         #Mn  [21] ARABIC FATHATAN..ARABIC WAVY HAMZA...
+      | 0xD9 0xA0..0xA9         #Nd  [10] ARABIC-INDIC DIGIT ZERO..ARABIC-IN...
+      | 0xD9 0xAE..0xAF         #Lo   [2] ARABIC LETTER DOTLESS BEH..ARABIC ...
+      | 0xD9 0xB0               #Mn       ARABIC LETTER SUPERSCRIPT ALEF
+      | 0xD9 0xB1..0xFF         #Lo  [99] ARABIC LETTER ALEF WASLA..ARABIC L...
+      | 0xDA..0xDA 0x00..0xFF   #
+      | 0xDB 0x00..0x93         #
+      | 0xDB 0x95               #Lo       ARABIC LETTER AE
+      | 0xDB 0x96..0x9C         #Mn   [7] ARABIC SMALL HIGH LIGATURE SAD WIT...
+      | 0xDB 0x9F..0xA4         #Mn   [6] ARABIC SMALL HIGH ROUNDED ZERO..AR...
+      | 0xDB 0xA5..0xA6         #Lm   [2] ARABIC SMALL WAW..ARABIC SMALL YEH
+      | 0xDB 0xA7..0xA8         #Mn   [2] ARABIC SMALL HIGH YEH..ARABIC SMAL...
+      | 0xDB 0xAA..0xAD         #Mn   [4] ARABIC EMPTY CENTRE LOW STOP..ARAB...
+      | 0xDB 0xAE..0xAF         #Lo   [2] ARABIC LETTER DAL WITH INVERTED V....
+      | 0xDB 0xB0..0xB9         #Nd  [10] EXTENDED ARABIC-INDIC DIGIT ZERO.....
+      | 0xDB 0xBA..0xBC         #Lo   [3] ARABIC LETTER SHEEN WITH DOT BELOW...
+      | 0xDB 0xBF               #Lo       ARABIC LETTER HEH WITH INVERTED V
+      | 0xDC 0x90               #Lo       SYRIAC LETTER ALAPH
+      | 0xDC 0x91               #Mn       SYRIAC LETTER SUPERSCRIPT ALAPH
+      | 0xDC 0x92..0xAF         #Lo  [30] SYRIAC LETTER BETH..SYRIAC LETTER ...
+      | 0xDC 0xB0..0xFF         #Mn  [27] SYRIAC PTHAHA ABOVE..SYRIAC BARREKH
+      | 0xDD 0x00..0x8A         #
+      | 0xDD 0x8D..0xFF         #Lo  [89] SYRIAC LETTER SOGDIAN ZHAIN..THAAN...
+      | 0xDE 0x00..0xA5         #
+      | 0xDE 0xA6..0xB0         #Mn  [11] THAANA ABAFILI..THAANA SUKUN
+      | 0xDE 0xB1               #Lo       THAANA LETTER NAA
+      | 0xDF 0x80..0x89         #Nd  [10] NKO DIGIT ZERO..NKO DIGIT NINE
+      | 0xDF 0x8A..0xAA         #Lo  [33] NKO LETTER A..NKO LETTER JONA RA
+      | 0xDF 0xAB..0xB3         #Mn   [9] NKO COMBINING SHORT HIGH TONE..NKO...
+      | 0xDF 0xB4..0xB5         #Lm   [2] NKO HIGH TONE APOSTROPHE..NKO LOW ...
+      | 0xDF 0xBA               #Lm       NKO LAJANYALAN
+      | 0xE0 0xA0 0x80..0x95    #Lo  [22] SAMARITAN LETTER ALAF..SAMARITAN L...
+      | 0xE0 0xA0 0x96..0x99    #Mn   [4] SAMARITAN MARK IN..SAMARITAN MARK ...
+      | 0xE0 0xA0 0x9A          #Lm       SAMARITAN MODIFIER LETTER EPENTHET...
+      | 0xE0 0xA0 0x9B..0xA3    #Mn   [9] SAMARITAN MARK EPENTHETIC YUT..SAM...
+      | 0xE0 0xA0 0xA4          #Lm       SAMARITAN MODIFIER LETTER SHORT A
+      | 0xE0 0xA0 0xA5..0xA7    #Mn   [3] SAMARITAN VOWEL SIGN SHORT A..SAMA...
+      | 0xE0 0xA0 0xA8          #Lm       SAMARITAN MODIFIER LETTER I
+      | 0xE0 0xA0 0xA9..0xAD    #Mn   [5] SAMARITAN VOWEL SIGN LONG I..SAMAR...
+      | 0xE0 0xA1 0x80..0x98    #Lo  [25] MANDAIC LETTER HALQA..MANDAIC LETT...
+      | 0xE0 0xA1 0x99..0x9B    #Mn   [3] MANDAIC AFFRICATION MARK..MANDAIC ...
+      | 0xE0 0xA2 0xA0..0xB4    #Lo  [21] ARABIC LETTER BEH WITH SMALL V BEL...
+      | 0xE0 0xA2 0xB6..0xBD    #Lo   [8] ARABIC LETTER BEH WITH SMALL MEEM ...
+      | 0xE0 0xA3 0x94..0xA1    #Mn  [14] ARABIC SMALL HIGH WORD AR-RUB..ARA...
+      | 0xE0 0xA3 0xA3..0xFF    #Mn  [32] ARABIC TURNED DAMMA BELOW..DEVANAG...
+      | 0xE0 0xA4 0x00..0x82    #
+      | 0xE0 0xA4 0x83          #Mc       DEVANAGARI SIGN VISARGA
+      | 0xE0 0xA4 0x84..0xB9    #Lo  [54] DEVANAGARI LETTER SHORT A..DEVANAG...
+      | 0xE0 0xA4 0xBA          #Mn       DEVANAGARI VOWEL SIGN OE
+      | 0xE0 0xA4 0xBB          #Mc       DEVANAGARI VOWEL SIGN OOE
+      | 0xE0 0xA4 0xBC          #Mn       DEVANAGARI SIGN NUKTA
+      | 0xE0 0xA4 0xBD          #Lo       DEVANAGARI SIGN AVAGRAHA
+      | 0xE0 0xA4 0xBE..0xFF    #Mc   [3] DEVANAGARI VOWEL SIGN AA..DEVANAGA...
+      | 0xE0 0xA5 0x00..0x80    #
+      | 0xE0 0xA5 0x81..0x88    #Mn   [8] DEVANAGARI VOWEL SIGN U..DEVANAGAR...
+      | 0xE0 0xA5 0x89..0x8C    #Mc   [4] DEVANAGARI VOWEL SIGN CANDRA O..DE...
+      | 0xE0 0xA5 0x8D          #Mn       DEVANAGARI SIGN VIRAMA
+      | 0xE0 0xA5 0x8E..0x8F    #Mc   [2] DEVANAGARI VOWEL SIGN PRISHTHAMATR...
+      | 0xE0 0xA5 0x90          #Lo       DEVANAGARI OM
+      | 0xE0 0xA5 0x91..0x97    #Mn   [7] DEVANAGARI STRESS SIGN UDATTA..DEV...
+      | 0xE0 0xA5 0x98..0xA1    #Lo  [10] DEVANAGARI LETTER QA..DEVANAGARI L...
+      | 0xE0 0xA5 0xA2..0xA3    #Mn   [2] DEVANAGARI VOWEL SIGN VOCALIC L..D...
+      | 0xE0 0xA5 0xA6..0xAF    #Nd  [10] DEVANAGARI DIGIT ZERO..DEVANAGARI ...
+      | 0xE0 0xA5 0xB1          #Lm       DEVANAGARI SIGN HIGH SPACING DOT
+      | 0xE0 0xA5 0xB2..0xFF    #Lo  [15] DEVANAGARI LETTER CANDRA A..BENGAL...
+      | 0xE0 0xA6 0x00..0x80    #
+      | 0xE0 0xA6 0x81          #Mn       BENGALI SIGN CANDRABINDU
+      | 0xE0 0xA6 0x82..0x83    #Mc   [2] BENGALI SIGN ANUSVARA..BENGALI SIG...
+      | 0xE0 0xA6 0x85..0x8C    #Lo   [8] BENGALI LETTER A..BENGALI LETTER V...
+      | 0xE0 0xA6 0x8F..0x90    #Lo   [2] BENGALI LETTER E..BENGALI LETTER AI
+      | 0xE0 0xA6 0x93..0xA8    #Lo  [22] BENGALI LETTER O..BENGALI LETTER NA
+      | 0xE0 0xA6 0xAA..0xB0    #Lo   [7] BENGALI LETTER PA..BENGALI LETTER RA
+      | 0xE0 0xA6 0xB2          #Lo       BENGALI LETTER LA
+      | 0xE0 0xA6 0xB6..0xB9    #Lo   [4] BENGALI LETTER SHA..BENGALI LETTER HA
+      | 0xE0 0xA6 0xBC          #Mn       BENGALI SIGN NUKTA
+      | 0xE0 0xA6 0xBD          #Lo       BENGALI SIGN AVAGRAHA
+      | 0xE0 0xA6 0xBE..0xFF    #Mc   [3] BENGALI VOWEL SIGN AA..BENGALI VOW...
+      | 0xE0 0xA7 0x00..0x80    #
+      | 0xE0 0xA7 0x81..0x84    #Mn   [4] BENGALI VOWEL SIGN U..BENGALI VOWE...
+      | 0xE0 0xA7 0x87..0x88    #Mc   [2] BENGALI VOWEL SIGN E..BENGALI VOWE...
+      | 0xE0 0xA7 0x8B..0x8C    #Mc   [2] BENGALI VOWEL SIGN O..BENGALI VOWE...
+      | 0xE0 0xA7 0x8D          #Mn       BENGALI SIGN VIRAMA
+      | 0xE0 0xA7 0x8E          #Lo       BENGALI LETTER KHANDA TA
+      | 0xE0 0xA7 0x97          #Mc       BENGALI AU LENGTH MARK
+      | 0xE0 0xA7 0x9C..0x9D    #Lo   [2] BENGALI LETTER RRA..BENGALI LETTER...
+      | 0xE0 0xA7 0x9F..0xA1    #Lo   [3] BENGALI LETTER YYA..BENGALI LETTER...
+      | 0xE0 0xA7 0xA2..0xA3    #Mn   [2] BENGALI VOWEL SIGN VOCALIC L..BENG...
+      | 0xE0 0xA7 0xA6..0xAF    #Nd  [10] BENGALI DIGIT ZERO..BENGALI DIGIT ...
+      | 0xE0 0xA7 0xB0..0xB1    #Lo   [2] BENGALI LETTER RA WITH MIDDLE DIAG...
+      | 0xE0 0xA8 0x81..0x82    #Mn   [2] GURMUKHI SIGN ADAK BINDI..GURMUKHI...
+      | 0xE0 0xA8 0x83          #Mc       GURMUKHI SIGN VISARGA
+      | 0xE0 0xA8 0x85..0x8A    #Lo   [6] GURMUKHI LETTER A..GURMUKHI LETTER UU
+      | 0xE0 0xA8 0x8F..0x90    #Lo   [2] GURMUKHI LETTER EE..GURMUKHI LETTE...
+      | 0xE0 0xA8 0x93..0xA8    #Lo  [22] GURMUKHI LETTER OO..GURMUKHI LETTE...
+      | 0xE0 0xA8 0xAA..0xB0    #Lo   [7] GURMUKHI LETTER PA..GURMUKHI LETTE...
+      | 0xE0 0xA8 0xB2..0xB3    #Lo   [2] GURMUKHI LETTER LA..GURMUKHI LETTE...
+      | 0xE0 0xA8 0xB5..0xB6    #Lo   [2] GURMUKHI LETTER VA..GURMUKHI LETTE...
+      | 0xE0 0xA8 0xB8..0xB9    #Lo   [2] GURMUKHI LETTER SA..GURMUKHI LETTE...
+      | 0xE0 0xA8 0xBC          #Mn       GURMUKHI SIGN NUKTA
+      | 0xE0 0xA8 0xBE..0xFF    #Mc   [3] GURMUKHI VOWEL SIGN AA..GURMUKHI V...
+      | 0xE0 0xA9 0x00..0x80    #
+      | 0xE0 0xA9 0x81..0x82    #Mn   [2] GURMUKHI VOWEL SIGN U..GURMUKHI VO...
+      | 0xE0 0xA9 0x87..0x88    #Mn   [2] GURMUKHI VOWEL SIGN EE..GURMUKHI V...
+      | 0xE0 0xA9 0x8B..0x8D    #Mn   [3] GURMUKHI VOWEL SIGN OO..GURMUKHI S...
+      | 0xE0 0xA9 0x91          #Mn       GURMUKHI SIGN UDAAT
+      | 0xE0 0xA9 0x99..0x9C    #Lo   [4] GURMUKHI LETTER KHHA..GURMUKHI LET...
+      | 0xE0 0xA9 0x9E          #Lo       GURMUKHI LETTER FA
+      | 0xE0 0xA9 0xA6..0xAF    #Nd  [10] GURMUKHI DIGIT ZERO..GURMUKHI DIGI...
+      | 0xE0 0xA9 0xB0..0xB1    #Mn   [2] GURMUKHI TIPPI..GURMUKHI ADDAK
+      | 0xE0 0xA9 0xB2..0xB4    #Lo   [3] GURMUKHI IRI..GURMUKHI EK ONKAR
+      | 0xE0 0xA9 0xB5          #Mn       GURMUKHI SIGN YAKASH
+      | 0xE0 0xAA 0x81..0x82    #Mn   [2] GUJARATI SIGN CANDRABINDU..GUJARAT...
+      | 0xE0 0xAA 0x83          #Mc       GUJARATI SIGN VISARGA
+      | 0xE0 0xAA 0x85..0x8D    #Lo   [9] GUJARATI LETTER A..GUJARATI VOWEL ...
+      | 0xE0 0xAA 0x8F..0x91    #Lo   [3] GUJARATI LETTER E..GUJARATI VOWEL ...
+      | 0xE0 0xAA 0x93..0xA8    #Lo  [22] GUJARATI LETTER O..GUJARATI LETTER NA
+      | 0xE0 0xAA 0xAA..0xB0    #Lo   [7] GUJARATI LETTER PA..GUJARATI LETTE...
+      | 0xE0 0xAA 0xB2..0xB3    #Lo   [2] GUJARATI LETTER LA..GUJARATI LETTE...
+      | 0xE0 0xAA 0xB5..0xB9    #Lo   [5] GUJARATI LETTER VA..GUJARATI LETTE...
+      | 0xE0 0xAA 0xBC          #Mn       GUJARATI SIGN NUKTA
+      | 0xE0 0xAA 0xBD          #Lo       GUJARATI SIGN AVAGRAHA
+      | 0xE0 0xAA 0xBE..0xFF    #Mc   [3] GUJARATI VOWEL SIGN AA..GUJARATI V...
+      | 0xE0 0xAB 0x00..0x80    #
+      | 0xE0 0xAB 0x81..0x85    #Mn   [5] GUJARATI VOWEL SIGN U..GUJARATI VO...
+      | 0xE0 0xAB 0x87..0x88    #Mn   [2] GUJARATI VOWEL SIGN E..GUJARATI VO...
+      | 0xE0 0xAB 0x89          #Mc       GUJARATI VOWEL SIGN CANDRA O
+      | 0xE0 0xAB 0x8B..0x8C    #Mc   [2] GUJARATI VOWEL SIGN O..GUJARATI VO...
+      | 0xE0 0xAB 0x8D          #Mn       GUJARATI SIGN VIRAMA
+      | 0xE0 0xAB 0x90          #Lo       GUJARATI OM
+      | 0xE0 0xAB 0xA0..0xA1    #Lo   [2] GUJARATI LETTER VOCALIC RR..GUJARA...
+      | 0xE0 0xAB 0xA2..0xA3    #Mn   [2] GUJARATI VOWEL SIGN VOCALIC L..GUJ...
+      | 0xE0 0xAB 0xA6..0xAF    #Nd  [10] GUJARATI DIGIT ZERO..GUJARATI DIGI...
+      | 0xE0 0xAB 0xB9          #Lo       GUJARATI LETTER ZHA
+      | 0xE0 0xAC 0x81          #Mn       ORIYA SIGN CANDRABINDU
+      | 0xE0 0xAC 0x82..0x83    #Mc   [2] ORIYA SIGN ANUSVARA..ORIYA SIGN VI...
+      | 0xE0 0xAC 0x85..0x8C    #Lo   [8] ORIYA LETTER A..ORIYA LETTER VOCAL...
+      | 0xE0 0xAC 0x8F..0x90    #Lo   [2] ORIYA LETTER E..ORIYA LETTER AI
+      | 0xE0 0xAC 0x93..0xA8    #Lo  [22] ORIYA LETTER O..ORIYA LETTER NA
+      | 0xE0 0xAC 0xAA..0xB0    #Lo   [7] ORIYA LETTER PA..ORIYA LETTER RA
+      | 0xE0 0xAC 0xB2..0xB3    #Lo   [2] ORIYA LETTER LA..ORIYA LETTER LLA
+      | 0xE0 0xAC 0xB5..0xB9    #Lo   [5] ORIYA LETTER VA..ORIYA LETTER HA
+      | 0xE0 0xAC 0xBC          #Mn       ORIYA SIGN NUKTA
+      | 0xE0 0xAC 0xBD          #Lo       ORIYA SIGN AVAGRAHA
+      | 0xE0 0xAC 0xBE          #Mc       ORIYA VOWEL SIGN AA
+      | 0xE0 0xAC 0xBF          #Mn       ORIYA VOWEL SIGN I
+      | 0xE0 0xAD 0x80          #Mc       ORIYA VOWEL SIGN II
+      | 0xE0 0xAD 0x81..0x84    #Mn   [4] ORIYA VOWEL SIGN U..ORIYA VOWEL SI...
+      | 0xE0 0xAD 0x87..0x88    #Mc   [2] ORIYA VOWEL SIGN E..ORIYA VOWEL SI...
+      | 0xE0 0xAD 0x8B..0x8C    #Mc   [2] ORIYA VOWEL SIGN O..ORIYA VOWEL SI...
+      | 0xE0 0xAD 0x8D          #Mn       ORIYA SIGN VIRAMA
+      | 0xE0 0xAD 0x96          #Mn       ORIYA AI LENGTH MARK
+      | 0xE0 0xAD 0x97          #Mc       ORIYA AU LENGTH MARK
+      | 0xE0 0xAD 0x9C..0x9D    #Lo   [2] ORIYA LETTER RRA..ORIYA LETTER RHA
+      | 0xE0 0xAD 0x9F..0xA1    #Lo   [3] ORIYA LETTER YYA..ORIYA LETTER VOC...
+      | 0xE0 0xAD 0xA2..0xA3    #Mn   [2] ORIYA VOWEL SIGN VOCALIC L..ORIYA ...
+      | 0xE0 0xAD 0xA6..0xAF    #Nd  [10] ORIYA DIGIT ZERO..ORIYA DIGIT NINE
+      | 0xE0 0xAD 0xB1          #Lo       ORIYA LETTER WA
+      | 0xE0 0xAE 0x82          #Mn       TAMIL SIGN ANUSVARA
+      | 0xE0 0xAE 0x83          #Lo       TAMIL SIGN VISARGA
+      | 0xE0 0xAE 0x85..0x8A    #Lo   [6] TAMIL LETTER A..TAMIL LETTER UU
+      | 0xE0 0xAE 0x8E..0x90    #Lo   [3] TAMIL LETTER E..TAMIL LETTER AI
+      | 0xE0 0xAE 0x92..0x95    #Lo   [4] TAMIL LETTER O..TAMIL LETTER KA
+      | 0xE0 0xAE 0x99..0x9A    #Lo   [2] TAMIL LETTER NGA..TAMIL LETTER CA
+      | 0xE0 0xAE 0x9C          #Lo       TAMIL LETTER JA
+      | 0xE0 0xAE 0x9E..0x9F    #Lo   [2] TAMIL LETTER NYA..TAMIL LETTER TTA
+      | 0xE0 0xAE 0xA3..0xA4    #Lo   [2] TAMIL LETTER NNA..TAMIL LETTER TA
+      | 0xE0 0xAE 0xA8..0xAA    #Lo   [3] TAMIL LETTER NA..TAMIL LETTER PA
+      | 0xE0 0xAE 0xAE..0xB9    #Lo  [12] TAMIL LETTER MA..TAMIL LETTER HA
+      | 0xE0 0xAE 0xBE..0xBF    #Mc   [2] TAMIL VOWEL SIGN AA..TAMIL VOWEL S...
+      | 0xE0 0xAF 0x80          #Mn       TAMIL VOWEL SIGN II
+      | 0xE0 0xAF 0x81..0x82    #Mc   [2] TAMIL VOWEL SIGN U..TAMIL VOWEL SI...
+      | 0xE0 0xAF 0x86..0x88    #Mc   [3] TAMIL VOWEL SIGN E..TAMIL VOWEL SI...
+      | 0xE0 0xAF 0x8A..0x8C    #Mc   [3] TAMIL VOWEL SIGN O..TAMIL VOWEL SI...
+      | 0xE0 0xAF 0x8D          #Mn       TAMIL SIGN VIRAMA
+      | 0xE0 0xAF 0x90          #Lo       TAMIL OM
+      | 0xE0 0xAF 0x97          #Mc       TAMIL AU LENGTH MARK
+      | 0xE0 0xAF 0xA6..0xAF    #Nd  [10] TAMIL DIGIT ZERO..TAMIL DIGIT NINE
+      | 0xE0 0xB0 0x80          #Mn       TELUGU SIGN COMBINING CANDRABINDU ...
+      | 0xE0 0xB0 0x81..0x83    #Mc   [3] TELUGU SIGN CANDRABINDU..TELUGU SI...
+      | 0xE0 0xB0 0x85..0x8C    #Lo   [8] TELUGU LETTER A..TELUGU LETTER VOC...
+      | 0xE0 0xB0 0x8E..0x90    #Lo   [3] TELUGU LETTER E..TELUGU LETTER AI
+      | 0xE0 0xB0 0x92..0xA8    #Lo  [23] TELUGU LETTER O..TELUGU LETTER NA
+      | 0xE0 0xB0 0xAA..0xB9    #Lo  [16] TELUGU LETTER PA..TELUGU LETTER HA
+      | 0xE0 0xB0 0xBD          #Lo       TELUGU SIGN AVAGRAHA
+      | 0xE0 0xB0 0xBE..0xFF    #Mn   [3] TELUGU VOWEL SIGN AA..TELUGU VOWEL...
+      | 0xE0 0xB1 0x00..0x80    #
+      | 0xE0 0xB1 0x81..0x84    #Mc   [4] TELUGU VOWEL SIGN U..TELUGU VOWEL ...
+      | 0xE0 0xB1 0x86..0x88    #Mn   [3] TELUGU VOWEL SIGN E..TELUGU VOWEL ...
+      | 0xE0 0xB1 0x8A..0x8D    #Mn   [4] TELUGU VOWEL SIGN O..TELUGU SIGN V...
+      | 0xE0 0xB1 0x95..0x96    #Mn   [2] TELUGU LENGTH MARK..TELUGU AI LENG...
+      | 0xE0 0xB1 0x98..0x9A    #Lo   [3] TELUGU LETTER TSA..TELUGU LETTER RRRA
+      | 0xE0 0xB1 0xA0..0xA1    #Lo   [2] TELUGU LETTER VOCALIC RR..TELUGU L...
+      | 0xE0 0xB1 0xA2..0xA3    #Mn   [2] TELUGU VOWEL SIGN VOCALIC L..TELUG...
+      | 0xE0 0xB1 0xA6..0xAF    #Nd  [10] TELUGU DIGIT ZERO..TELUGU DIGIT NINE
+      | 0xE0 0xB2 0x80          #Lo       KANNADA SIGN SPACING CANDRABINDU
+      | 0xE0 0xB2 0x81          #Mn       KANNADA SIGN CANDRABINDU
+      | 0xE0 0xB2 0x82..0x83    #Mc   [2] KANNADA SIGN ANUSVARA..KANNADA SIG...
+      | 0xE0 0xB2 0x85..0x8C    #Lo   [8] KANNADA LETTER A..KANNADA LETTER V...
+      | 0xE0 0xB2 0x8E..0x90    #Lo   [3] KANNADA LETTER E..KANNADA LETTER AI
+      | 0xE0 0xB2 0x92..0xA8    #Lo  [23] KANNADA LETTER O..KANNADA LETTER NA
+      | 0xE0 0xB2 0xAA..0xB3    #Lo  [10] KANNADA LETTER PA..KANNADA LETTER LLA
+      | 0xE0 0xB2 0xB5..0xB9    #Lo   [5] KANNADA LETTER VA..KANNADA LETTER HA
+      | 0xE0 0xB2 0xBC          #Mn       KANNADA SIGN NUKTA
+      | 0xE0 0xB2 0xBD          #Lo       KANNADA SIGN AVAGRAHA
+      | 0xE0 0xB2 0xBE          #Mc       KANNADA VOWEL SIGN AA
+      | 0xE0 0xB2 0xBF          #Mn       KANNADA VOWEL SIGN I
+      | 0xE0 0xB3 0x80..0x84    #Mc   [5] KANNADA VOWEL SIGN II..KANNADA VOW...
+      | 0xE0 0xB3 0x86          #Mn       KANNADA VOWEL SIGN E
+      | 0xE0 0xB3 0x87..0x88    #Mc   [2] KANNADA VOWEL SIGN EE..KANNADA VOW...
+      | 0xE0 0xB3 0x8A..0x8B    #Mc   [2] KANNADA VOWEL SIGN O..KANNADA VOWE...
+      | 0xE0 0xB3 0x8C..0x8D    #Mn   [2] KANNADA VOWEL SIGN AU..KANNADA SIG...
+      | 0xE0 0xB3 0x95..0x96    #Mc   [2] KANNADA LENGTH MARK..KANNADA AI LE...
+      | 0xE0 0xB3 0x9E          #Lo       KANNADA LETTER FA
+      | 0xE0 0xB3 0xA0..0xA1    #Lo   [2] KANNADA LETTER VOCALIC RR..KANNADA...
+      | 0xE0 0xB3 0xA2..0xA3    #Mn   [2] KANNADA VOWEL SIGN VOCALIC L..KANN...
+      | 0xE0 0xB3 0xA6..0xAF    #Nd  [10] KANNADA DIGIT ZERO..KANNADA DIGIT ...
+      | 0xE0 0xB3 0xB1..0xB2    #Lo   [2] KANNADA SIGN JIHVAMULIYA..KANNADA ...
+      | 0xE0 0xB4 0x81          #Mn       MALAYALAM SIGN CANDRABINDU
+      | 0xE0 0xB4 0x82..0x83    #Mc   [2] MALAYALAM SIGN ANUSVARA..MALAYALAM...
+      | 0xE0 0xB4 0x85..0x8C    #Lo   [8] MALAYALAM LETTER A..MALAYALAM LETT...
+      | 0xE0 0xB4 0x8E..0x90    #Lo   [3] MALAYALAM LETTER E..MALAYALAM LETT...
+      | 0xE0 0xB4 0x92..0xBA    #Lo  [41] MALAYALAM LETTER O..MALAYALAM LETT...
+      | 0xE0 0xB4 0xBD          #Lo       MALAYALAM SIGN AVAGRAHA
+      | 0xE0 0xB4 0xBE..0xFF    #Mc   [3] MALAYALAM VOWEL SIGN AA..MALAYALAM...
+      | 0xE0 0xB5 0x00..0x80    #
+      | 0xE0 0xB5 0x81..0x84    #Mn   [4] MALAYALAM VOWEL SIGN U..MALAYALAM ...
+      | 0xE0 0xB5 0x86..0x88    #Mc   [3] MALAYALAM VOWEL SIGN E..MALAYALAM ...
+      | 0xE0 0xB5 0x8A..0x8C    #Mc   [3] MALAYALAM VOWEL SIGN O..MALAYALAM ...
+      | 0xE0 0xB5 0x8D          #Mn       MALAYALAM SIGN VIRAMA
+      | 0xE0 0xB5 0x8E          #Lo       MALAYALAM LETTER DOT REPH
+      | 0xE0 0xB5 0x94..0x96    #Lo   [3] MALAYALAM LETTER CHILLU M..MALAYAL...
+      | 0xE0 0xB5 0x97          #Mc       MALAYALAM AU LENGTH MARK
+      | 0xE0 0xB5 0x9F..0xA1    #Lo   [3] MALAYALAM LETTER ARCHAIC II..MALAY...
+      | 0xE0 0xB5 0xA2..0xA3    #Mn   [2] MALAYALAM VOWEL SIGN VOCALIC L..MA...
+      | 0xE0 0xB5 0xA6..0xAF    #Nd  [10] MALAYALAM DIGIT ZERO..MALAYALAM DI...
+      | 0xE0 0xB5 0xBA..0xBF    #Lo   [6] MALAYALAM LETTER CHILLU NN..MALAYA...
+      | 0xE0 0xB6 0x82..0x83    #Mc   [2] SINHALA SIGN ANUSVARAYA..SINHALA S...
+      | 0xE0 0xB6 0x85..0x96    #Lo  [18] SINHALA LETTER AYANNA..SINHALA LET...
+      | 0xE0 0xB6 0x9A..0xB1    #Lo  [24] SINHALA LETTER ALPAPRAANA KAYANNA....
+      | 0xE0 0xB6 0xB3..0xBB    #Lo   [9] SINHALA LETTER SANYAKA DAYANNA..SI...
+      | 0xE0 0xB6 0xBD          #Lo       SINHALA LETTER DANTAJA LAYANNA
+      | 0xE0 0xB7 0x80..0x86    #Lo   [7] SINHALA LETTER VAYANNA..SINHALA LE...
+      | 0xE0 0xB7 0x8A          #Mn       SINHALA SIGN AL-LAKUNA
+      | 0xE0 0xB7 0x8F..0x91    #Mc   [3] SINHALA VOWEL SIGN AELA-PILLA..SIN...
+      | 0xE0 0xB7 0x92..0x94    #Mn   [3] SINHALA VOWEL SIGN KETTI IS-PILLA....
+      | 0xE0 0xB7 0x96          #Mn       SINHALA VOWEL SIGN DIGA PAA-PILLA
+      | 0xE0 0xB7 0x98..0x9F    #Mc   [8] SINHALA VOWEL SIGN GAETTA-PILLA..S...
+      | 0xE0 0xB7 0xA6..0xAF    #Nd  [10] SINHALA LITH DIGIT ZERO..SINHALA L...
+      | 0xE0 0xB7 0xB2..0xB3    #Mc   [2] SINHALA VOWEL SIGN DIGA GAETTA-PIL...
+      | 0xE0 0xB8 0x81..0xB0    #Lo  [48] THAI CHARACTER KO KAI..THAI CHARAC...
+      | 0xE0 0xB8 0xB1          #Mn       THAI CHARACTER MAI HAN-AKAT
+      | 0xE0 0xB8 0xB2..0xB3    #Lo   [2] THAI CHARACTER SARA AA..THAI CHARA...
+      | 0xE0 0xB8 0xB4..0xBA    #Mn   [7] THAI CHARACTER SARA I..THAI CHARAC...
+      | 0xE0 0xB9 0x80..0x85    #Lo   [6] THAI CHARACTER SARA E..THAI CHARAC...
+      | 0xE0 0xB9 0x86          #Lm       THAI CHARACTER MAIYAMOK
+      | 0xE0 0xB9 0x87..0x8E    #Mn   [8] THAI CHARACTER MAITAIKHU..THAI CHA...
+      | 0xE0 0xB9 0x90..0x99    #Nd  [10] THAI DIGIT ZERO..THAI DIGIT NINE
+      | 0xE0 0xBA 0x81..0x82    #Lo   [2] LAO LETTER KO..LAO LETTER KHO SUNG
+      | 0xE0 0xBA 0x84          #Lo       LAO LETTER KHO TAM
+      | 0xE0 0xBA 0x87..0x88    #Lo   [2] LAO LETTER NGO..LAO LETTER CO
+      | 0xE0 0xBA 0x8A          #Lo       LAO LETTER SO TAM
+      | 0xE0 0xBA 0x8D          #Lo       LAO LETTER NYO
+      | 0xE0 0xBA 0x94..0x97    #Lo   [4] LAO LETTER DO..LAO LETTER THO TAM
+      | 0xE0 0xBA 0x99..0x9F    #Lo   [7] LAO LETTER NO..LAO LETTER FO SUNG
+      | 0xE0 0xBA 0xA1..0xA3    #Lo   [3] LAO LETTER MO..LAO LETTER LO LING
+      | 0xE0 0xBA 0xA5          #Lo       LAO LETTER LO LOOT
+      | 0xE0 0xBA 0xA7          #Lo       LAO LETTER WO
+      | 0xE0 0xBA 0xAA..0xAB    #Lo   [2] LAO LETTER SO SUNG..LAO LETTER HO ...
+      | 0xE0 0xBA 0xAD..0xB0    #Lo   [4] LAO LETTER O..LAO VOWEL SIGN A
+      | 0xE0 0xBA 0xB1          #Mn       LAO VOWEL SIGN MAI KAN
+      | 0xE0 0xBA 0xB2..0xB3    #Lo   [2] LAO VOWEL SIGN AA..LAO VOWEL SIGN AM
+      | 0xE0 0xBA 0xB4..0xB9    #Mn   [6] LAO VOWEL SIGN I..LAO VOWEL SIGN UU
+      | 0xE0 0xBA 0xBB..0xBC    #Mn   [2] LAO VOWEL SIGN MAI KON..LAO SEMIVO...
+      | 0xE0 0xBA 0xBD          #Lo       LAO SEMIVOWEL SIGN NYO
+      | 0xE0 0xBB 0x80..0x84    #Lo   [5] LAO VOWEL SIGN E..LAO VOWEL SIGN AI
+      | 0xE0 0xBB 0x86          #Lm       LAO KO LA
+      | 0xE0 0xBB 0x88..0x8D    #Mn   [6] LAO TONE MAI EK..LAO NIGGAHITA
+      | 0xE0 0xBB 0x90..0x99    #Nd  [10] LAO DIGIT ZERO..LAO DIGIT NINE
+      | 0xE0 0xBB 0x9C..0x9F    #Lo   [4] LAO HO NO..LAO LETTER KHMU NYO
+      | 0xE0 0xBC 0x80          #Lo       TIBETAN SYLLABLE OM
+      | 0xE0 0xBC 0x98..0x99    #Mn   [2] TIBETAN ASTROLOGICAL SIGN -KHYUD P...
+      | 0xE0 0xBC 0xA0..0xA9    #Nd  [10] TIBETAN DIGIT ZERO..TIBETAN DIGIT ...
+      | 0xE0 0xBC 0xB5          #Mn       TIBETAN MARK NGAS BZUNG NYI ZLA
+      | 0xE0 0xBC 0xB7          #Mn       TIBETAN MARK NGAS BZUNG SGOR RTAGS
+      | 0xE0 0xBC 0xB9          #Mn       TIBETAN MARK TSA -PHRU
+      | 0xE0 0xBC 0xBE..0xBF    #Mc   [2] TIBETAN SIGN YAR TSHES..TIBETAN SI...
+      | 0xE0 0xBD 0x80..0x87    #Lo   [8] TIBETAN LETTER KA..TIBETAN LETTER JA
+      | 0xE0 0xBD 0x89..0xAC    #Lo  [36] TIBETAN LETTER NYA..TIBETAN LETTER...
+      | 0xE0 0xBD 0xB1..0xBE    #Mn  [14] TIBETAN VOWEL SIGN AA..TIBETAN SIG...
+      | 0xE0 0xBD 0xBF          #Mc       TIBETAN SIGN RNAM BCAD
+      | 0xE0 0xBE 0x80..0x84    #Mn   [5] TIBETAN VOWEL SIGN REVERSED I..TIB...
+      | 0xE0 0xBE 0x86..0x87    #Mn   [2] TIBETAN SIGN LCI RTAGS..TIBETAN SI...
+      | 0xE0 0xBE 0x88..0x8C    #Lo   [5] TIBETAN SIGN LCE TSA CAN..TIBETAN ...
+      | 0xE0 0xBE 0x8D..0x97    #Mn  [11] TIBETAN SUBJOINED SIGN LCE TSA CAN...
+      | 0xE0 0xBE 0x99..0xBC    #Mn  [36] TIBETAN SUBJOINED LETTER NYA..TIBE...
+      | 0xE0 0xBF 0x86          #Mn       TIBETAN SYMBOL PADMA GDAN
+      | 0xE1 0x80 0x80..0xAA    #Lo  [43] MYANMAR LETTER KA..MYANMAR LETTER AU
+      | 0xE1 0x80 0xAB..0xAC    #Mc   [2] MYANMAR VOWEL SIGN TALL AA..MYANMA...
+      | 0xE1 0x80 0xAD..0xB0    #Mn   [4] MYANMAR VOWEL SIGN I..MYANMAR VOWE...
+      | 0xE1 0x80 0xB1          #Mc       MYANMAR VOWEL SIGN E
+      | 0xE1 0x80 0xB2..0xB7    #Mn   [6] MYANMAR VOWEL SIGN AI..MYANMAR SIG...
+      | 0xE1 0x80 0xB8          #Mc       MYANMAR SIGN VISARGA
+      | 0xE1 0x80 0xB9..0xBA    #Mn   [2] MYANMAR SIGN VIRAMA..MYANMAR SIGN ...
+      | 0xE1 0x80 0xBB..0xBC    #Mc   [2] MYANMAR CONSONANT SIGN MEDIAL YA.....
+      | 0xE1 0x80 0xBD..0xBE    #Mn   [2] MYANMAR CONSONANT SIGN MEDIAL WA.....
+      | 0xE1 0x80 0xBF          #Lo       MYANMAR LETTER GREAT SA
+      | 0xE1 0x81 0x80..0x89    #Nd  [10] MYANMAR DIGIT ZERO..MYANMAR DIGIT ...
+      | 0xE1 0x81 0x90..0x95    #Lo   [6] MYANMAR LETTER SHA..MYANMAR LETTER...
+      | 0xE1 0x81 0x96..0x97    #Mc   [2] MYANMAR VOWEL SIGN VOCALIC R..MYAN...
+      | 0xE1 0x81 0x98..0x99    #Mn   [2] MYANMAR VOWEL SIGN VOCALIC L..MYAN...
+      | 0xE1 0x81 0x9A..0x9D    #Lo   [4] MYANMAR LETTER MON NGA..MYANMAR LE...
+      | 0xE1 0x81 0x9E..0xA0    #Mn   [3] MYANMAR CONSONANT SIGN MON MEDIAL ...
+      | 0xE1 0x81 0xA1          #Lo       MYANMAR LETTER SGAW KAREN SHA
+      | 0xE1 0x81 0xA2..0xA4    #Mc   [3] MYANMAR VOWEL SIGN SGAW KAREN EU.....
+      | 0xE1 0x81 0xA5..0xA6    #Lo   [2] MYANMAR LETTER WESTERN PWO KAREN T...
+      | 0xE1 0x81 0xA7..0xAD    #Mc   [7] MYANMAR VOWEL SIGN WESTERN PWO KAR...
+      | 0xE1 0x81 0xAE..0xB0    #Lo   [3] MYANMAR LETTER EASTERN PWO KAREN N...
+      | 0xE1 0x81 0xB1..0xB4    #Mn   [4] MYANMAR VOWEL SIGN GEBA KAREN I..M...
+      | 0xE1 0x81 0xB5..0xFF    #Lo  [13] MYANMAR LETTER SHAN KA..MYANMAR LE...
+      | 0xE1 0x82 0x00..0x81    #
+      | 0xE1 0x82 0x82          #Mn       MYANMAR CONSONANT SIGN SHAN MEDIAL WA
+      | 0xE1 0x82 0x83..0x84    #Mc   [2] MYANMAR VOWEL SIGN SHAN AA..MYANMA...
+      | 0xE1 0x82 0x85..0x86    #Mn   [2] MYANMAR VOWEL SIGN SHAN E ABOVE..M...
+      | 0xE1 0x82 0x87..0x8C    #Mc   [6] MYANMAR SIGN SHAN TONE-2..MYANMAR ...
+      | 0xE1 0x82 0x8D          #Mn       MYANMAR SIGN SHAN COUNCIL EMPHATIC...
+      | 0xE1 0x82 0x8E          #Lo       MYANMAR LETTER RUMAI PALAUNG FA
+      | 0xE1 0x82 0x8F          #Mc       MYANMAR SIGN RUMAI PALAUNG TONE-5
+      | 0xE1 0x82 0x90..0x99    #Nd  [10] MYANMAR SHAN DIGIT ZERO..MYANMAR S...
+      | 0xE1 0x82 0x9A..0x9C    #Mc   [3] MYANMAR SIGN KHAMTI TONE-1..MYANMA...
+      | 0xE1 0x82 0x9D          #Mn       MYANMAR VOWEL SIGN AITON AI
+      | 0xE1 0x82 0xA0..0xFF    #L&  [38] GEORGIAN CAPITAL LETTER AN..GEORGI...
+      | 0xE1 0x83 0x00..0x85    #
+      | 0xE1 0x83 0x87          #L&       GEORGIAN CAPITAL LETTER YN
+      | 0xE1 0x83 0x8D          #L&       GEORGIAN CAPITAL LETTER AEN
+      | 0xE1 0x83 0x90..0xBA    #Lo  [43] GEORGIAN LETTER AN..GEORGIAN LETTE...
+      | 0xE1 0x83 0xBC          #Lm       MODIFIER LETTER GEORGIAN NAR
+      | 0xE1 0x83 0xBD..0xFF        #Lo [332] GEORGIAN LETTER AEN..ETHIOPIC ...
+      | 0xE1 0x84..0x88 0x00..0xFF  #
+      | 0xE1 0x89 0x00..0x88        #
+      | 0xE1 0x89 0x8A..0x8D    #Lo   [4] ETHIOPIC SYLLABLE QWI..ETHIOPIC SY...
+      | 0xE1 0x89 0x90..0x96    #Lo   [7] ETHIOPIC SYLLABLE QHA..ETHIOPIC SY...
+      | 0xE1 0x89 0x98          #Lo       ETHIOPIC SYLLABLE QHWA
+      | 0xE1 0x89 0x9A..0x9D    #Lo   [4] ETHIOPIC SYLLABLE QHWI..ETHIOPIC S...
+      | 0xE1 0x89 0xA0..0xFF    #Lo  [41] ETHIOPIC SYLLABLE BA..ETHIOPIC SYL...
+      | 0xE1 0x8A 0x00..0x88    #
+      | 0xE1 0x8A 0x8A..0x8D    #Lo   [4] ETHIOPIC SYLLABLE XWI..ETHIOPIC SY...
+      | 0xE1 0x8A 0x90..0xB0    #Lo  [33] ETHIOPIC SYLLABLE NA..ETHIOPIC SYL...
+      | 0xE1 0x8A 0xB2..0xB5    #Lo   [4] ETHIOPIC SYLLABLE KWI..ETHIOPIC SY...
+      | 0xE1 0x8A 0xB8..0xBE    #Lo   [7] ETHIOPIC SYLLABLE KXA..ETHIOPIC SY...
+      | 0xE1 0x8B 0x80          #Lo       ETHIOPIC SYLLABLE KXWA
+      | 0xE1 0x8B 0x82..0x85    #Lo   [4] ETHIOPIC SYLLABLE KXWI..ETHIOPIC S...
+      | 0xE1 0x8B 0x88..0x96    #Lo  [15] ETHIOPIC SYLLABLE WA..ETHIOPIC SYL...
+      | 0xE1 0x8B 0x98..0xFF    #Lo  [57] ETHIOPIC SYLLABLE ZA..ETHIOPIC SYL...
+      | 0xE1 0x8C 0x00..0x90    #
+      | 0xE1 0x8C 0x92..0x95    #Lo   [4] ETHIOPIC SYLLABLE GWI..ETHIOPIC SY...
+      | 0xE1 0x8C 0x98..0xFF    #Lo  [67] ETHIOPIC SYLLABLE GGA..ETHIOPIC SY...
+      | 0xE1 0x8D 0x00..0x9A    #
+      | 0xE1 0x8D 0x9D..0x9F    #Mn   [3] ETHIOPIC COMBINING GEMINATION AND ...
+      | 0xE1 0x8D 0xA9..0xB1    #No   [9] ETHIOPIC DIGIT ONE..ETHIOPIC DIGIT...
+      | 0xE1 0x8E 0x80..0x8F    #Lo  [16] ETHIOPIC SYLLABLE SEBATBEIT MWA..E...
+      | 0xE1 0x8E 0xA0..0xFF    #L&  [86] CHEROKEE LETTER A..CHEROKEE LETTER MV
+      | 0xE1 0x8F 0x00..0xB5    #
+      | 0xE1 0x8F 0xB8..0xBD    #L&   [6] CHEROKEE SMALL LETTER YE..CHEROKEE...
+      | 0xE1 0x90 0x81..0xFF        #Lo [620] CANADIAN SYLLABICS E..CANADIAN...
+      | 0xE1 0x91..0x98 0x00..0xFF  #
+      | 0xE1 0x99 0x00..0xAC        #
+      | 0xE1 0x99 0xAF..0xBF    #Lo  [17] CANADIAN SYLLABICS QAI..CANADIAN S...
+      | 0xE1 0x9A 0x81..0x9A    #Lo  [26] OGHAM LETTER BEITH..OGHAM LETTER P...
+      | 0xE1 0x9A 0xA0..0xFF    #Lo  [75] RUNIC LETTER FEHU FEOH FE F..RUNIC...
+      | 0xE1 0x9B 0x00..0xAA    #
+      | 0xE1 0x9B 0xAE..0xB0    #Nl   [3] RUNIC ARLAUG SYMBOL..RUNIC BELGTHO...
+      | 0xE1 0x9B 0xB1..0xB8    #Lo   [8] RUNIC LETTER K..RUNIC LETTER FRANK...
+      | 0xE1 0x9C 0x80..0x8C    #Lo  [13] TAGALOG LETTER A..TAGALOG LETTER YA
+      | 0xE1 0x9C 0x8E..0x91    #Lo   [4] TAGALOG LETTER LA..TAGALOG LETTER HA
+      | 0xE1 0x9C 0x92..0x94    #Mn   [3] TAGALOG VOWEL SIGN I..TAGALOG SIGN...
+      | 0xE1 0x9C 0xA0..0xB1    #Lo  [18] HANUNOO LETTER A..HANUNOO LETTER HA
+      | 0xE1 0x9C 0xB2..0xB4    #Mn   [3] HANUNOO VOWEL SIGN I..HANUNOO SIGN...
+      | 0xE1 0x9D 0x80..0x91    #Lo  [18] BUHID LETTER A..BUHID LETTER HA
+      | 0xE1 0x9D 0x92..0x93    #Mn   [2] BUHID VOWEL SIGN I..BUHID VOWEL SI...
+      | 0xE1 0x9D 0xA0..0xAC    #Lo  [13] TAGBANWA LETTER A..TAGBANWA LETTER YA
+      | 0xE1 0x9D 0xAE..0xB0    #Lo   [3] TAGBANWA LETTER LA..TAGBANWA LETTE...
+      | 0xE1 0x9D 0xB2..0xB3    #Mn   [2] TAGBANWA VOWEL SIGN I..TAGBANWA VO...
+      | 0xE1 0x9E 0x80..0xB3    #Lo  [52] KHMER LETTER KA..KHMER INDEPENDENT...
+      | 0xE1 0x9E 0xB4..0xB5    #Mn   [2] KHMER VOWEL INHERENT AQ..KHMER VOW...
+      | 0xE1 0x9E 0xB6          #Mc       KHMER VOWEL SIGN AA
+      | 0xE1 0x9E 0xB7..0xBD    #Mn   [7] KHMER VOWEL SIGN I..KHMER VOWEL SI...
+      | 0xE1 0x9E 0xBE..0xFF    #Mc   [8] KHMER VOWEL SIGN OE..KHMER VOWEL S...
+      | 0xE1 0x9F 0x00..0x85    #
+      | 0xE1 0x9F 0x86          #Mn       KHMER SIGN NIKAHIT
+      | 0xE1 0x9F 0x87..0x88    #Mc   [2] KHMER SIGN REAHMUK..KHMER SIGN YUU...
+      | 0xE1 0x9F 0x89..0x93    #Mn  [11] KHMER SIGN MUUSIKATOAN..KHMER SIGN...
+      | 0xE1 0x9F 0x97          #Lm       KHMER SIGN LEK TOO
+      | 0xE1 0x9F 0x9C          #Lo       KHMER SIGN AVAKRAHASANYA
+      | 0xE1 0x9F 0x9D          #Mn       KHMER SIGN ATTHACAN
+      | 0xE1 0x9F 0xA0..0xA9    #Nd  [10] KHMER DIGIT ZERO..KHMER DIGIT NINE
+      | 0xE1 0xA0 0x8B..0x8D    #Mn   [3] MONGOLIAN FREE VARIATION SELECTOR ...
+      | 0xE1 0xA0 0x90..0x99    #Nd  [10] MONGOLIAN DIGIT ZERO..MONGOLIAN DI...
+      | 0xE1 0xA0 0xA0..0xFF    #Lo  [35] MONGOLIAN LETTER A..MONGOLIAN LETT...
+      | 0xE1 0xA1 0x00..0x82    #
+      | 0xE1 0xA1 0x83          #Lm       MONGOLIAN LETTER TODO LONG VOWEL SIGN
+      | 0xE1 0xA1 0x84..0xB7    #Lo  [52] MONGOLIAN LETTER TODO E..MONGOLIAN...
+      | 0xE1 0xA2 0x80..0x84    #Lo   [5] MONGOLIAN LETTER ALI GALI ANUSVARA...
+      | 0xE1 0xA2 0x85..0x86    #Mn   [2] MONGOLIAN LETTER ALI GALI BALUDA.....
+      | 0xE1 0xA2 0x87..0xA8    #Lo  [34] MONGOLIAN LETTER ALI GALI A..MONGO...
+      | 0xE1 0xA2 0xA9          #Mn       MONGOLIAN LETTER ALI GALI DAGALGA
+      | 0xE1 0xA2 0xAA          #Lo       MONGOLIAN LETTER MANCHU ALI GALI LHA
+      | 0xE1 0xA2 0xB0..0xFF    #Lo  [70] CANADIAN SYLLABICS OY..CANADIAN SY...
+      | 0xE1 0xA3 0x00..0xB5    #
+      | 0xE1 0xA4 0x80..0x9E    #Lo  [31] LIMBU VOWEL-CARRIER LETTER..LIMBU ...
+      | 0xE1 0xA4 0xA0..0xA2    #Mn   [3] LIMBU VOWEL SIGN A..LIMBU VOWEL SI...
+      | 0xE1 0xA4 0xA3..0xA6    #Mc   [4] LIMBU VOWEL SIGN EE..LIMBU VOWEL S...
+      | 0xE1 0xA4 0xA7..0xA8    #Mn   [2] LIMBU VOWEL SIGN E..LIMBU VOWEL SI...
+      | 0xE1 0xA4 0xA9..0xAB    #Mc   [3] LIMBU SUBJOINED LETTER YA..LIMBU S...
+      | 0xE1 0xA4 0xB0..0xB1    #Mc   [2] LIMBU SMALL LETTER KA..LIMBU SMALL...
+      | 0xE1 0xA4 0xB2          #Mn       LIMBU SMALL LETTER ANUSVARA
+      | 0xE1 0xA4 0xB3..0xB8    #Mc   [6] LIMBU SMALL LETTER TA..LIMBU SMALL...
+      | 0xE1 0xA4 0xB9..0xBB    #Mn   [3] LIMBU SIGN MUKPHRENG..LIMBU SIGN SA-I
+      | 0xE1 0xA5 0x86..0x8F    #Nd  [10] LIMBU DIGIT ZERO..LIMBU DIGIT NINE
+      | 0xE1 0xA5 0x90..0xAD    #Lo  [30] TAI LE LETTER KA..TAI LE LETTER AI
+      | 0xE1 0xA5 0xB0..0xB4    #Lo   [5] TAI LE LETTER TONE-2..TAI LE LETTE...
+      | 0xE1 0xA6 0x80..0xAB    #Lo  [44] NEW TAI LUE LETTER HIGH QA..NEW TA...
+      | 0xE1 0xA6 0xB0..0xFF    #Lo  [26] NEW TAI LUE VOWEL SIGN VOWEL SHORT...
+      | 0xE1 0xA7 0x00..0x89    #
+      | 0xE1 0xA7 0x90..0x99    #Nd  [10] NEW TAI LUE DIGIT ZERO..NEW TAI LU...
+      | 0xE1 0xA7 0x9A          #No       NEW TAI LUE THAM DIGIT ONE
+      | 0xE1 0xA8 0x80..0x96    #Lo  [23] BUGINESE LETTER KA..BUGINESE LETTE...
+      | 0xE1 0xA8 0x97..0x98    #Mn   [2] BUGINESE VOWEL SIGN I..BUGINESE VO...
+      | 0xE1 0xA8 0x99..0x9A    #Mc   [2] BUGINESE VOWEL SIGN E..BUGINESE VO...
+      | 0xE1 0xA8 0x9B          #Mn       BUGINESE VOWEL SIGN AE
+      | 0xE1 0xA8 0xA0..0xFF    #Lo  [53] TAI THAM LETTER HIGH KA..TAI THAM ...
+      | 0xE1 0xA9 0x00..0x94    #
+      | 0xE1 0xA9 0x95          #Mc       TAI THAM CONSONANT SIGN MEDIAL RA
+      | 0xE1 0xA9 0x96          #Mn       TAI THAM CONSONANT SIGN MEDIAL LA
+      | 0xE1 0xA9 0x97          #Mc       TAI THAM CONSONANT SIGN LA TANG LAI
+      | 0xE1 0xA9 0x98..0x9E    #Mn   [7] TAI THAM SIGN MAI KANG LAI..TAI TH...
+      | 0xE1 0xA9 0xA0          #Mn       TAI THAM SIGN SAKOT
+      | 0xE1 0xA9 0xA1          #Mc       TAI THAM VOWEL SIGN A
+      | 0xE1 0xA9 0xA2          #Mn       TAI THAM VOWEL SIGN MAI SAT
+      | 0xE1 0xA9 0xA3..0xA4    #Mc   [2] TAI THAM VOWEL SIGN AA..TAI THAM V...
+      | 0xE1 0xA9 0xA5..0xAC    #Mn   [8] TAI THAM VOWEL SIGN I..TAI THAM VO...
+      | 0xE1 0xA9 0xAD..0xB2    #Mc   [6] TAI THAM VOWEL SIGN OY..TAI THAM V...
+      | 0xE1 0xA9 0xB3..0xBC    #Mn  [10] TAI THAM VOWEL SIGN OA ABOVE..TAI ...
+      | 0xE1 0xA9 0xBF          #Mn       TAI THAM COMBINING CRYPTOGRAMMIC DOT
+      | 0xE1 0xAA 0x80..0x89    #Nd  [10] TAI THAM HORA DIGIT ZERO..TAI THAM...
+      | 0xE1 0xAA 0x90..0x99    #Nd  [10] TAI THAM THAM DIGIT ZERO..TAI THAM...
+      | 0xE1 0xAA 0xA7          #Lm       TAI THAM SIGN MAI YAMOK
+      | 0xE1 0xAA 0xB0..0xBD    #Mn  [14] COMBINING DOUBLED CIRCUMFLEX ACCEN...
+      | 0xE1 0xAC 0x80..0x83    #Mn   [4] BALINESE SIGN ULU RICEM..BALINESE ...
+      | 0xE1 0xAC 0x84          #Mc       BALINESE SIGN BISAH
+      | 0xE1 0xAC 0x85..0xB3    #Lo  [47] BALINESE LETTER AKARA..BALINESE LE...
+      | 0xE1 0xAC 0xB4          #Mn       BALINESE SIGN REREKAN
+      | 0xE1 0xAC 0xB5          #Mc       BALINESE VOWEL SIGN TEDUNG
+      | 0xE1 0xAC 0xB6..0xBA    #Mn   [5] BALINESE VOWEL SIGN ULU..BALINESE ...
+      | 0xE1 0xAC 0xBB          #Mc       BALINESE VOWEL SIGN RA REPA TEDUNG
+      | 0xE1 0xAC 0xBC          #Mn       BALINESE VOWEL SIGN LA LENGA
+      | 0xE1 0xAC 0xBD..0xFF    #Mc   [5] BALINESE VOWEL SIGN LA LENGA TEDUN...
+      | 0xE1 0xAD 0x00..0x81    #
+      | 0xE1 0xAD 0x82          #Mn       BALINESE VOWEL SIGN PEPET
+      | 0xE1 0xAD 0x83..0x84    #Mc   [2] BALINESE VOWEL SIGN PEPET TEDUNG.....
+      | 0xE1 0xAD 0x85..0x8B    #Lo   [7] BALINESE LETTER KAF SASAK..BALINES...
+      | 0xE1 0xAD 0x90..0x99    #Nd  [10] BALINESE DIGIT ZERO..BALINESE DIGI...
+      | 0xE1 0xAD 0xAB..0xB3    #Mn   [9] BALINESE MUSICAL SYMBOL COMBINING ...
+      | 0xE1 0xAE 0x80..0x81    #Mn   [2] SUNDANESE SIGN PANYECEK..SUNDANESE...
+      | 0xE1 0xAE 0x82          #Mc       SUNDANESE SIGN PANGWISAD
+      | 0xE1 0xAE 0x83..0xA0    #Lo  [30] SUNDANESE LETTER A..SUNDANESE LETT...
+      | 0xE1 0xAE 0xA1          #Mc       SUNDANESE CONSONANT SIGN PAMINGKAL
+      | 0xE1 0xAE 0xA2..0xA5    #Mn   [4] SUNDANESE CONSONANT SIGN PANYAKRA....
+      | 0xE1 0xAE 0xA6..0xA7    #Mc   [2] SUNDANESE VOWEL SIGN PANAELAENG..S...
+      | 0xE1 0xAE 0xA8..0xA9    #Mn   [2] SUNDANESE VOWEL SIGN PAMEPET..SUND...
+      | 0xE1 0xAE 0xAA          #Mc       SUNDANESE SIGN PAMAAEH
+      | 0xE1 0xAE 0xAB..0xAD    #Mn   [3] SUNDANESE SIGN VIRAMA..SUNDANESE C...
+      | 0xE1 0xAE 0xAE..0xAF    #Lo   [2] SUNDANESE LETTER KHA..SUNDANESE LE...
+      | 0xE1 0xAE 0xB0..0xB9    #Nd  [10] SUNDANESE DIGIT ZERO..SUNDANESE DI...
+      | 0xE1 0xAE 0xBA..0xFF    #Lo  [44] SUNDANESE AVAGRAHA..BATAK LETTER U
+      | 0xE1 0xAF 0x00..0xA5    #
+      | 0xE1 0xAF 0xA6          #Mn       BATAK SIGN TOMPI
+      | 0xE1 0xAF 0xA7          #Mc       BATAK VOWEL SIGN E
+      | 0xE1 0xAF 0xA8..0xA9    #Mn   [2] BATAK VOWEL SIGN PAKPAK E..BATAK V...
+      | 0xE1 0xAF 0xAA..0xAC    #Mc   [3] BATAK VOWEL SIGN I..BATAK VOWEL SI...
+      | 0xE1 0xAF 0xAD          #Mn       BATAK VOWEL SIGN KARO O
+      | 0xE1 0xAF 0xAE          #Mc       BATAK VOWEL SIGN U
+      | 0xE1 0xAF 0xAF..0xB1    #Mn   [3] BATAK VOWEL SIGN U FOR SIMALUNGUN ...
+      | 0xE1 0xAF 0xB2..0xB3    #Mc   [2] BATAK PANGOLAT..BATAK PANONGONAN
+      | 0xE1 0xB0 0x80..0xA3    #Lo  [36] LEPCHA LETTER KA..LEPCHA LETTER A
+      | 0xE1 0xB0 0xA4..0xAB    #Mc   [8] LEPCHA SUBJOINED LETTER YA..LEPCHA...
+      | 0xE1 0xB0 0xAC..0xB3    #Mn   [8] LEPCHA VOWEL SIGN E..LEPCHA CONSON...
+      | 0xE1 0xB0 0xB4..0xB5    #Mc   [2] LEPCHA CONSONANT SIGN NYIN-DO..LEP...
+      | 0xE1 0xB0 0xB6..0xB7    #Mn   [2] LEPCHA SIGN RAN..LEPCHA SIGN NUKTA
+      | 0xE1 0xB1 0x80..0x89    #Nd  [10] LEPCHA DIGIT ZERO..LEPCHA DIGIT NINE
+      | 0xE1 0xB1 0x8D..0x8F    #Lo   [3] LEPCHA LETTER TTA..LEPCHA LETTER DDA
+      | 0xE1 0xB1 0x90..0x99    #Nd  [10] OL CHIKI DIGIT ZERO..OL CHIKI DIGI...
+      | 0xE1 0xB1 0x9A..0xB7    #Lo  [30] OL CHIKI LETTER LA..OL CHIKI LETTE...
+      | 0xE1 0xB1 0xB8..0xBD    #Lm   [6] OL CHIKI MU TTUDDAG..OL CHIKI AHAD
+      | 0xE1 0xB2 0x80..0x88    #L&   [9] CYRILLIC SMALL LETTER ROUNDED VE.....
+      | 0xE1 0xB3 0x90..0x92    #Mn   [3] VEDIC TONE KARSHANA..VEDIC TONE PR...
+      | 0xE1 0xB3 0x94..0xA0    #Mn  [13] VEDIC SIGN YAJURVEDIC MIDLINE SVAR...
+      | 0xE1 0xB3 0xA1          #Mc       VEDIC TONE ATHARVAVEDIC INDEPENDEN...
+      | 0xE1 0xB3 0xA2..0xA8    #Mn   [7] VEDIC SIGN VISARGA SVARITA..VEDIC ...
+      | 0xE1 0xB3 0xA9..0xAC    #Lo   [4] VEDIC SIGN ANUSVARA ANTARGOMUKHA.....
+      | 0xE1 0xB3 0xAD          #Mn       VEDIC SIGN TIRYAK
+      | 0xE1 0xB3 0xAE..0xB1    #Lo   [4] VEDIC SIGN HEXIFORM LONG ANUSVARA....
+      | 0xE1 0xB3 0xB2..0xB3    #Mc   [2] VEDIC SIGN ARDHAVISARGA..VEDIC SIG...
+      | 0xE1 0xB3 0xB4          #Mn       VEDIC TONE CANDRA ABOVE
+      | 0xE1 0xB3 0xB5..0xB6    #Lo   [2] VEDIC SIGN JIHVAMULIYA..VEDIC SIGN...
+      | 0xE1 0xB3 0xB8..0xB9    #Mn   [2] VEDIC TONE RING ABOVE..VEDIC TONE ...
+      | 0xE1 0xB4 0x80..0xAB    #L&  [44] LATIN LETTER SMALL CAPITAL A..CYRI...
+      | 0xE1 0xB4 0xAC..0xFF    #Lm  [63] MODIFIER LETTER CAPITAL A..GREEK S...
+      | 0xE1 0xB5 0x00..0xAA    #
+      | 0xE1 0xB5 0xAB..0xB7    #L&  [13] LATIN SMALL LETTER UE..LATIN SMALL...
+      | 0xE1 0xB5 0xB8          #Lm       MODIFIER LETTER CYRILLIC EN
+      | 0xE1 0xB5 0xB9..0xFF    #L&  [34] LATIN SMALL LETTER INSULAR G..LATI...
+      | 0xE1 0xB6 0x00..0x9A    #
+      | 0xE1 0xB6 0x9B..0xBF    #Lm  [37] MODIFIER LETTER SMALL TURNED ALPHA...
+      | 0xE1 0xB7 0x80..0xB5    #Mn  [54] COMBINING DOTTED GRAVE ACCENT..COM...
+      | 0xE1 0xB7 0xBB..0xBF    #Mn   [5] COMBINING DELETION MARK..COMBINING...
+      | 0xE1 0xB8 0x80..0xFF        #L& [278] LATIN CAPITAL LETTER A WITH RI...
+      | 0xE1 0xB9..0xBB 0x00..0xFF  #
+      | 0xE1 0xBC 0x00..0x95        #
+      | 0xE1 0xBC 0x98..0x9D    #L&   [6] GREEK CAPITAL LETTER EPSILON WITH ...
+      | 0xE1 0xBC 0xA0..0xFF    #L&  [38] GREEK SMALL LETTER ETA WITH PSILI....
+      | 0xE1 0xBD 0x00..0x85    #
+      | 0xE1 0xBD 0x88..0x8D    #L&   [6] GREEK CAPITAL LETTER OMICRON WITH ...
+      | 0xE1 0xBD 0x90..0x97    #L&   [8] GREEK SMALL LETTER UPSILON WITH PS...
+      | 0xE1 0xBD 0x99          #L&       GREEK CAPITAL LETTER UPSILON WITH ...
+      | 0xE1 0xBD 0x9B          #L&       GREEK CAPITAL LETTER UPSILON WITH ...
+      | 0xE1 0xBD 0x9D          #L&       GREEK CAPITAL LETTER UPSILON WITH ...
+      | 0xE1 0xBD 0x9F..0xBD    #L&  [31] GREEK CAPITAL LETTER UPSILON WITH ...
+      | 0xE1 0xBE 0x80..0xB4    #L&  [53] GREEK SMALL LETTER ALPHA WITH PSIL...
+      | 0xE1 0xBE 0xB6..0xBC    #L&   [7] GREEK SMALL LETTER ALPHA WITH PERI...
+      | 0xE1 0xBE 0xBE          #L&       GREEK PROSGEGRAMMENI
+      | 0xE1 0xBF 0x82..0x84    #L&   [3] GREEK SMALL LETTER ETA WITH VARIA ...
+      | 0xE1 0xBF 0x86..0x8C    #L&   [7] GREEK SMALL LETTER ETA WITH PERISP...
+      | 0xE1 0xBF 0x90..0x93    #L&   [4] GREEK SMALL LETTER IOTA WITH VRACH...
+      | 0xE1 0xBF 0x96..0x9B    #L&   [6] GREEK SMALL LETTER IOTA WITH PERIS...
+      | 0xE1 0xBF 0xA0..0xAC    #L&  [13] GREEK SMALL LETTER UPSILON WITH VR...
+      | 0xE1 0xBF 0xB2..0xB4    #L&   [3] GREEK SMALL LETTER OMEGA WITH VARI...
+      | 0xE1 0xBF 0xB6..0xBC    #L&   [7] GREEK SMALL LETTER OMEGA WITH PERI...
+      | 0xE2 0x80 0xBF..0xFF    #Pc   [2] UNDERTIE..CHARACTER TIE
+      | 0xE2 0x81 0x00..0x80    #
+      | 0xE2 0x81 0x94          #Pc       INVERTED UNDERTIE
+      | 0xE2 0x81 0xB1          #Lm       SUPERSCRIPT LATIN SMALL LETTER I
+      | 0xE2 0x81 0xBF          #Lm       SUPERSCRIPT LATIN SMALL LETTER N
+      | 0xE2 0x82 0x90..0x9C    #Lm  [13] LATIN SUBSCRIPT SMALL LETTER A..LA...
+      | 0xE2 0x83 0x90..0x9C    #Mn  [13] COMBINING LEFT HARPOON ABOVE..COMB...
+      | 0xE2 0x83 0xA1          #Mn       COMBINING LEFT RIGHT ARROW ABOVE
+      | 0xE2 0x83 0xA5..0xB0    #Mn  [12] COMBINING REVERSE SOLIDUS OVERLAY....
+      | 0xE2 0x84 0x82          #L&       DOUBLE-STRUCK CAPITAL C
+      | 0xE2 0x84 0x87          #L&       EULER CONSTANT
+      | 0xE2 0x84 0x8A..0x93    #L&  [10] SCRIPT SMALL G..SCRIPT SMALL L
+      | 0xE2 0x84 0x95          #L&       DOUBLE-STRUCK CAPITAL N
+      | 0xE2 0x84 0x98          #Sm       SCRIPT CAPITAL P
+      | 0xE2 0x84 0x99..0x9D    #L&   [5] DOUBLE-STRUCK CAPITAL P..DOUBLE-ST...
+      | 0xE2 0x84 0xA4          #L&       DOUBLE-STRUCK CAPITAL Z
+      | 0xE2 0x84 0xA6          #L&       OHM SIGN
+      | 0xE2 0x84 0xA8          #L&       BLACK-LETTER CAPITAL Z
+      | 0xE2 0x84 0xAA..0xAD    #L&   [4] KELVIN SIGN..BLACK-LETTER CAPITAL C
+      | 0xE2 0x84 0xAE          #So       ESTIMATED SYMBOL
+      | 0xE2 0x84 0xAF..0xB4    #L&   [6] SCRIPT SMALL E..SCRIPT SMALL O
+      | 0xE2 0x84 0xB5..0xB8    #Lo   [4] ALEF SYMBOL..DALET SYMBOL
+      | 0xE2 0x84 0xB9          #L&       INFORMATION SOURCE
+      | 0xE2 0x84 0xBC..0xBF    #L&   [4] DOUBLE-STRUCK SMALL PI..DOUBLE-STR...
+      | 0xE2 0x85 0x85..0x89    #L&   [5] DOUBLE-STRUCK ITALIC CAPITAL D..DO...
+      | 0xE2 0x85 0x8E          #L&       TURNED SMALL F
+      | 0xE2 0x85 0xA0..0xFF    #Nl  [35] ROMAN NUMERAL ONE..ROMAN NUMERAL T...
+      | 0xE2 0x86 0x00..0x82    #
+      | 0xE2 0x86 0x83..0x84    #L&   [2] ROMAN NUMERAL REVERSED ONE HUNDRED...
+      | 0xE2 0x86 0x85..0x88    #Nl   [4] ROMAN NUMERAL SIX LATE FORM..ROMAN...
+      | 0xE2 0xB0 0x80..0xAE    #L&  [47] GLAGOLITIC CAPITAL LETTER AZU..GLA...
+      | 0xE2 0xB0 0xB0..0xFF    #L&  [47] GLAGOLITIC SMALL LETTER AZU..GLAGO...
+      | 0xE2 0xB1 0x00..0x9E    #
+      | 0xE2 0xB1 0xA0..0xBB    #L&  [28] LATIN CAPITAL LETTER L WITH DOUBLE...
+      | 0xE2 0xB1 0xBC..0xBD    #Lm   [2] LATIN SUBSCRIPT SMALL LETTER J..MO...
+      | 0xE2 0xB1 0xBE..0xFF        #L& [103] LATIN CAPITAL LETTER S WITH SW...
+      | 0xE2 0xB2..0xB2 0x00..0xFF  #
+      | 0xE2 0xB3 0x00..0xA4        #
+      | 0xE2 0xB3 0xAB..0xAE    #L&   [4] COPTIC CAPITAL LETTER CRYPTOGRAMMI...
+      | 0xE2 0xB3 0xAF..0xB1    #Mn   [3] COPTIC COMBINING NI ABOVE..COPTIC ...
+      | 0xE2 0xB3 0xB2..0xB3    #L&   [2] COPTIC CAPITAL LETTER BOHAIRIC KHE...
+      | 0xE2 0xB4 0x80..0xA5    #L&  [38] GEORGIAN SMALL LETTER AN..GEORGIAN...
+      | 0xE2 0xB4 0xA7          #L&       GEORGIAN SMALL LETTER YN
+      | 0xE2 0xB4 0xAD          #L&       GEORGIAN SMALL LETTER AEN
+      | 0xE2 0xB4 0xB0..0xFF    #Lo  [56] TIFINAGH LETTER YA..TIFINAGH LETTE...
+      | 0xE2 0xB5 0x00..0xA7    #
+      | 0xE2 0xB5 0xAF          #Lm       TIFINAGH MODIFIER LETTER LABIALIZA...
+      | 0xE2 0xB5 0xBF          #Mn       TIFINAGH CONSONANT JOINER
+      | 0xE2 0xB6 0x80..0x96    #Lo  [23] ETHIOPIC SYLLABLE LOA..ETHIOPIC SY...
+      | 0xE2 0xB6 0xA0..0xA6    #Lo   [7] ETHIOPIC SYLLABLE SSA..ETHIOPIC SY...
+      | 0xE2 0xB6 0xA8..0xAE    #Lo   [7] ETHIOPIC SYLLABLE CCA..ETHIOPIC SY...
+      | 0xE2 0xB6 0xB0..0xB6    #Lo   [7] ETHIOPIC SYLLABLE ZZA..ETHIOPIC SY...
+      | 0xE2 0xB6 0xB8..0xBE    #Lo   [7] ETHIOPIC SYLLABLE CCHA..ETHIOPIC S...
+      | 0xE2 0xB7 0x80..0x86    #Lo   [7] ETHIOPIC SYLLABLE QYA..ETHIOPIC SY...
+      | 0xE2 0xB7 0x88..0x8E    #Lo   [7] ETHIOPIC SYLLABLE KYA..ETHIOPIC SY...
+      | 0xE2 0xB7 0x90..0x96    #Lo   [7] ETHIOPIC SYLLABLE XYA..ETHIOPIC SY...
+      | 0xE2 0xB7 0x98..0x9E    #Lo   [7] ETHIOPIC SYLLABLE GYA..ETHIOPIC SY...
+      | 0xE2 0xB7 0xA0..0xBF    #Mn  [32] COMBINING CYRILLIC LETTER BE..COMB...
+      | 0xE3 0x80 0x85          #Lm       IDEOGRAPHIC ITERATION MARK
+      | 0xE3 0x80 0x86          #Lo       IDEOGRAPHIC CLOSING MARK
+      | 0xE3 0x80 0x87          #Nl       IDEOGRAPHIC NUMBER ZERO
+      | 0xE3 0x80 0xA1..0xA9    #Nl   [9] HANGZHOU NUMERAL ONE..HANGZHOU NUM...
+      | 0xE3 0x80 0xAA..0xAD    #Mn   [4] IDEOGRAPHIC LEVEL TONE MARK..IDEOG...
+      | 0xE3 0x80 0xAE..0xAF    #Mc   [2] HANGUL SINGLE DOT TONE MARK..HANGU...
+      | 0xE3 0x80 0xB1..0xB5    #Lm   [5] VERTICAL KANA REPEAT MARK..VERTICA...
+      | 0xE3 0x80 0xB8..0xBA    #Nl   [3] HANGZHOU NUMERAL TEN..HANGZHOU NUM...
+      | 0xE3 0x80 0xBB          #Lm       VERTICAL IDEOGRAPHIC ITERATION MARK
+      | 0xE3 0x80 0xBC          #Lo       MASU MARK
+      | 0xE3 0x81 0x81..0xFF    #Lo  [86] HIRAGANA LETTER SMALL A..HIRAGANA ...
+      | 0xE3 0x82 0x00..0x96    #
+      | 0xE3 0x82 0x99..0x9A    #Mn   [2] COMBINING KATAKANA-HIRAGANA VOICED...
+      | 0xE3 0x82 0x9B..0x9C    #Sk   [2] KATAKANA-HIRAGANA VOICED SOUND MAR...
+      | 0xE3 0x82 0x9D..0x9E    #Lm   [2] HIRAGANA ITERATION MARK..HIRAGANA ...
+      | 0xE3 0x82 0x9F          #Lo       HIRAGANA DIGRAPH YORI
+      | 0xE3 0x82 0xA1..0xFF    #Lo  [90] KATAKANA LETTER SMALL A..KATAKANA ...
+      | 0xE3 0x83 0x00..0xBA    #
+      | 0xE3 0x83 0xBC..0xBE    #Lm   [3] KATAKANA-HIRAGANA PROLONGED SOUND ...
+      | 0xE3 0x83 0xBF          #Lo       KATAKANA DIGRAPH KOTO
+      | 0xE3 0x84 0x85..0xAD    #Lo  [41] BOPOMOFO LETTER B..BOPOMOFO LETTER IH
+      | 0xE3 0x84 0xB1..0xFF        #Lo  [94] HANGUL LETTER KIYEOK..HANGUL L...
+      | 0xE3 0x85..0x85 0x00..0xFF  #
+      | 0xE3 0x86 0x00..0x8E        #
+      | 0xE3 0x86 0xA0..0xBA    #Lo  [27] BOPOMOFO LETTER BU..BOPOMOFO LETTE...
+      | 0xE3 0x87 0xB0..0xBF    #Lo  [16] KATAKANA LETTER SMALL KU..KATAKANA...
+      | 0xE3 0x90 0x80..0xFF        #Lo [6582] CJK UNIFIED IDEOGRAPH-3400..C...
+      | 0xE3 0x91..0xFF 0x00..0xFF  #
+      | 0xE4 0x00 0x00..0xFF        #
+      | 0xE4 0x01..0xB5 0x00..0xFF  #
+      | 0xE4 0xB6 0x00..0xB5        #
+      | 0xE4 0xB8 0x80..0xFF              #Lo [20950] CJK UNIFIED IDEOGRAPH-...
+      | 0xE4 0xB9..0xFF 0x00..0xFF        #
+      | 0xE5..0xE8 0x00..0xFF 0x00..0xFF  #
+      | 0xE9 0x00 0x00..0xFF              #
+      | 0xE9 0x01..0xBE 0x00..0xFF        #
+      | 0xE9 0xBF 0x00..0x95              #
+      | 0xEA 0x80 0x80..0x94    #Lo  [21] YI SYLLABLE IT..YI SYLLABLE E
+      | 0xEA 0x80 0x95          #Lm       YI SYLLABLE WU
+      | 0xEA 0x80 0x96..0xFF        #Lo [1143] YI SYLLABLE BIT..YI SYLLABLE YYR
+      | 0xEA 0x81..0x91 0x00..0xFF  #
+      | 0xEA 0x92 0x00..0x8C        #
+      | 0xEA 0x93 0x90..0xB7    #Lo  [40] LISU LETTER BA..LISU LETTER OE
+      | 0xEA 0x93 0xB8..0xBD    #Lm   [6] LISU LETTER TONE MYA TI..LISU LETT...
+      | 0xEA 0x94 0x80..0xFF        #Lo [268] VAI SYLLABLE EE..VAI SYLLABLE NG
+      | 0xEA 0x95..0x97 0x00..0xFF  #
+      | 0xEA 0x98 0x00..0x8B        #
+      | 0xEA 0x98 0x8C          #Lm       VAI SYLLABLE LENGTHENER
+      | 0xEA 0x98 0x90..0x9F    #Lo  [16] VAI SYLLABLE NDOLE FA..VAI SYMBOL ...
+      | 0xEA 0x98 0xA0..0xA9    #Nd  [10] VAI DIGIT ZERO..VAI DIGIT NINE
+      | 0xEA 0x98 0xAA..0xAB    #Lo   [2] VAI SYLLABLE NDOLE MA..VAI SYLLABL...
+      | 0xEA 0x99 0x80..0xAD    #L&  [46] CYRILLIC CAPITAL LETTER ZEMLYA..CY...
+      | 0xEA 0x99 0xAE          #Lo       CYRILLIC LETTER MULTIOCULAR O
+      | 0xEA 0x99 0xAF          #Mn       COMBINING CYRILLIC VZMET
+      | 0xEA 0x99 0xB4..0xBD    #Mn  [10] COMBINING CYRILLIC LETTER UKRAINIA...
+      | 0xEA 0x99 0xBF          #Lm       CYRILLIC PAYEROK
+      | 0xEA 0x9A 0x80..0x9B    #L&  [28] CYRILLIC CAPITAL LETTER DWE..CYRIL...
+      | 0xEA 0x9A 0x9C..0x9D    #Lm   [2] MODIFIER LETTER CYRILLIC HARD SIGN...
+      | 0xEA 0x9A 0x9E..0x9F    #Mn   [2] COMBINING CYRILLIC LETTER EF..COMB...
+      | 0xEA 0x9A 0xA0..0xFF    #Lo  [70] BAMUM LETTER A..BAMUM LETTER KI
+      | 0xEA 0x9B 0x00..0xA5    #
+      | 0xEA 0x9B 0xA6..0xAF    #Nl  [10] BAMUM LETTER MO..BAMUM LETTER KOGHOM
+      | 0xEA 0x9B 0xB0..0xB1    #Mn   [2] BAMUM COMBINING MARK KOQNDON..BAMU...
+      | 0xEA 0x9C 0x97..0x9F    #Lm   [9] MODIFIER LETTER DOT VERTICAL BAR.....
+      | 0xEA 0x9C 0xA2..0xFF    #L&  [78] LATIN CAPITAL LETTER EGYPTOLOGICAL...
+      | 0xEA 0x9D 0x00..0xAF    #
+      | 0xEA 0x9D 0xB0          #Lm       MODIFIER LETTER US
+      | 0xEA 0x9D 0xB1..0xFF    #L&  [23] LATIN SMALL LETTER DUM..LATIN SMAL...
+      | 0xEA 0x9E 0x00..0x87    #
+      | 0xEA 0x9E 0x88          #Lm       MODIFIER LETTER LOW CIRCUMFLEX ACCENT
+      | 0xEA 0x9E 0x8B..0x8E    #L&   [4] LATIN CAPITAL LETTER SALTILLO..LAT...
+      | 0xEA 0x9E 0x8F          #Lo       LATIN LETTER SINOLOGICAL DOT
+      | 0xEA 0x9E 0x90..0xAE    #L&  [31] LATIN CAPITAL LETTER N WITH DESCEN...
+      | 0xEA 0x9E 0xB0..0xB7    #L&   [8] LATIN CAPITAL LETTER TURNED K..LAT...
+      | 0xEA 0x9F 0xB7          #Lo       LATIN EPIGRAPHIC LETTER SIDEWAYS I
+      | 0xEA 0x9F 0xB8..0xB9    #Lm   [2] MODIFIER LETTER CAPITAL H WITH STR...
+      | 0xEA 0x9F 0xBA          #L&       LATIN LETTER SMALL CAPITAL TURNED M
+      | 0xEA 0x9F 0xBB..0xFF    #Lo   [7] LATIN EPIGRAPHIC LETTER REVERSED F...
+      | 0xEA 0xA0 0x00..0x81    #
+      | 0xEA 0xA0 0x82          #Mn       SYLOTI NAGRI SIGN DVISVARA
+      | 0xEA 0xA0 0x83..0x85    #Lo   [3] SYLOTI NAGRI LETTER U..SYLOTI NAGR...
+      | 0xEA 0xA0 0x86          #Mn       SYLOTI NAGRI SIGN HASANTA
+      | 0xEA 0xA0 0x87..0x8A    #Lo   [4] SYLOTI NAGRI LETTER KO..SYLOTI NAG...
+      | 0xEA 0xA0 0x8B          #Mn       SYLOTI NAGRI SIGN ANUSVARA
+      | 0xEA 0xA0 0x8C..0xA2    #Lo  [23] SYLOTI NAGRI LETTER CO..SYLOTI NAG...
+      | 0xEA 0xA0 0xA3..0xA4    #Mc   [2] SYLOTI NAGRI VOWEL SIGN A..SYLOTI ...
+      | 0xEA 0xA0 0xA5..0xA6    #Mn   [2] SYLOTI NAGRI VOWEL SIGN U..SYLOTI ...
+      | 0xEA 0xA0 0xA7          #Mc       SYLOTI NAGRI VOWEL SIGN OO
+      | 0xEA 0xA1 0x80..0xB3    #Lo  [52] PHAGS-PA LETTER KA..PHAGS-PA LETTE...
+      | 0xEA 0xA2 0x80..0x81    #Mc   [2] SAURASHTRA SIGN ANUSVARA..SAURASHT...
+      | 0xEA 0xA2 0x82..0xB3    #Lo  [50] SAURASHTRA LETTER A..SAURASHTRA LE...
+      | 0xEA 0xA2 0xB4..0xFF    #Mc  [16] SAURASHTRA CONSONANT SIGN HAARU..S...
+      | 0xEA 0xA3 0x00..0x83    #
+      | 0xEA 0xA3 0x84..0x85    #Mn   [2] SAURASHTRA SIGN VIRAMA..SAURASHTRA...
+      | 0xEA 0xA3 0x90..0x99    #Nd  [10] SAURASHTRA DIGIT ZERO..SAURASHTRA ...
+      | 0xEA 0xA3 0xA0..0xB1    #Mn  [18] COMBINING DEVANAGARI DIGIT ZERO..C...
+      | 0xEA 0xA3 0xB2..0xB7    #Lo   [6] DEVANAGARI SIGN SPACING CANDRABIND...
+      | 0xEA 0xA3 0xBB          #Lo       DEVANAGARI HEADSTROKE
+      | 0xEA 0xA3 0xBD          #Lo       DEVANAGARI JAIN OM
+      | 0xEA 0xA4 0x80..0x89    #Nd  [10] KAYAH LI DIGIT ZERO..KAYAH LI DIGI...
+      | 0xEA 0xA4 0x8A..0xA5    #Lo  [28] KAYAH LI LETTER KA..KAYAH LI LETTE...
+      | 0xEA 0xA4 0xA6..0xAD    #Mn   [8] KAYAH LI VOWEL UE..KAYAH LI TONE C...
+      | 0xEA 0xA4 0xB0..0xFF    #Lo  [23] REJANG LETTER KA..REJANG LETTER A
+      | 0xEA 0xA5 0x00..0x86    #
+      | 0xEA 0xA5 0x87..0x91    #Mn  [11] REJANG VOWEL SIGN I..REJANG CONSON...
+      | 0xEA 0xA5 0x92..0x93    #Mc   [2] REJANG CONSONANT SIGN H..REJANG VI...
+      | 0xEA 0xA5 0xA0..0xBC    #Lo  [29] HANGUL CHOSEONG TIKEUT-MIEUM..HANG...
+      | 0xEA 0xA6 0x80..0x82    #Mn   [3] JAVANESE SIGN PANYANGGA..JAVANESE ...
+      | 0xEA 0xA6 0x83          #Mc       JAVANESE SIGN WIGNYAN
+      | 0xEA 0xA6 0x84..0xB2    #Lo  [47] JAVANESE LETTER A..JAVANESE LETTER HA
+      | 0xEA 0xA6 0xB3          #Mn       JAVANESE SIGN CECAK TELU
+      | 0xEA 0xA6 0xB4..0xB5    #Mc   [2] JAVANESE VOWEL SIGN TARUNG..JAVANE...
+      | 0xEA 0xA6 0xB6..0xB9    #Mn   [4] JAVANESE VOWEL SIGN WULU..JAVANESE...
+      | 0xEA 0xA6 0xBA..0xBB    #Mc   [2] JAVANESE VOWEL SIGN TALING..JAVANE...
+      | 0xEA 0xA6 0xBC          #Mn       JAVANESE VOWEL SIGN PEPET
+      | 0xEA 0xA6 0xBD..0xFF    #Mc   [4] JAVANESE CONSONANT SIGN KERET..JAV...
+      | 0xEA 0xA7 0x00..0x80    #
+      | 0xEA 0xA7 0x8F          #Lm       JAVANESE PANGRANGKEP
+      | 0xEA 0xA7 0x90..0x99    #Nd  [10] JAVANESE DIGIT ZERO..JAVANESE DIGI...
+      | 0xEA 0xA7 0xA0..0xA4    #Lo   [5] MYANMAR LETTER SHAN GHA..MYANMAR L...
+      | 0xEA 0xA7 0xA5          #Mn       MYANMAR SIGN SHAN SAW
+      | 0xEA 0xA7 0xA6          #Lm       MYANMAR MODIFIER LETTER SHAN REDUP...
+      | 0xEA 0xA7 0xA7..0xAF    #Lo   [9] MYANMAR LETTER TAI LAING NYA..MYAN...
+      | 0xEA 0xA7 0xB0..0xB9    #Nd  [10] MYANMAR TAI LAING DIGIT ZERO..MYAN...
+      | 0xEA 0xA7 0xBA..0xBE    #Lo   [5] MYANMAR LETTER TAI LAING LLA..MYAN...
+      | 0xEA 0xA8 0x80..0xA8    #Lo  [41] CHAM LETTER A..CHAM LETTER HA
+      | 0xEA 0xA8 0xA9..0xAE    #Mn   [6] CHAM VOWEL SIGN AA..CHAM VOWEL SIG...
+      | 0xEA 0xA8 0xAF..0xB0    #Mc   [2] CHAM VOWEL SIGN O..CHAM VOWEL SIGN AI
+      | 0xEA 0xA8 0xB1..0xB2    #Mn   [2] CHAM VOWEL SIGN AU..CHAM VOWEL SIG...
+      | 0xEA 0xA8 0xB3..0xB4    #Mc   [2] CHAM CONSONANT SIGN YA..CHAM CONSO...
+      | 0xEA 0xA8 0xB5..0xB6    #Mn   [2] CHAM CONSONANT SIGN LA..CHAM CONSO...
+      | 0xEA 0xA9 0x80..0x82    #Lo   [3] CHAM LETTER FINAL K..CHAM LETTER F...
+      | 0xEA 0xA9 0x83          #Mn       CHAM CONSONANT SIGN FINAL NG
+      | 0xEA 0xA9 0x84..0x8B    #Lo   [8] CHAM LETTER FINAL CH..CHAM LETTER ...
+      | 0xEA 0xA9 0x8C          #Mn       CHAM CONSONANT SIGN FINAL M
+      | 0xEA 0xA9 0x8D          #Mc       CHAM CONSONANT SIGN FINAL H
+      | 0xEA 0xA9 0x90..0x99    #Nd  [10] CHAM DIGIT ZERO..CHAM DIGIT NINE
+      | 0xEA 0xA9 0xA0..0xAF    #Lo  [16] MYANMAR LETTER KHAMTI GA..MYANMAR ...
+      | 0xEA 0xA9 0xB0          #Lm       MYANMAR MODIFIER LETTER KHAMTI RED...
+      | 0xEA 0xA9 0xB1..0xB6    #Lo   [6] MYANMAR LETTER KHAMTI XA..MYANMAR ...
+      | 0xEA 0xA9 0xBA          #Lo       MYANMAR LETTER AITON RA
+      | 0xEA 0xA9 0xBB          #Mc       MYANMAR SIGN PAO KAREN TONE
+      | 0xEA 0xA9 0xBC          #Mn       MYANMAR SIGN TAI LAING TONE-2
+      | 0xEA 0xA9 0xBD          #Mc       MYANMAR SIGN TAI LAING TONE-5
+      | 0xEA 0xA9 0xBE..0xFF    #Lo  [50] MYANMAR LETTER SHWE PALAUNG CHA..T...
+      | 0xEA 0xAA 0x00..0xAF    #
+      | 0xEA 0xAA 0xB0          #Mn       TAI VIET MAI KANG
+      | 0xEA 0xAA 0xB1          #Lo       TAI VIET VOWEL AA
+      | 0xEA 0xAA 0xB2..0xB4    #Mn   [3] TAI VIET VOWEL I..TAI VIET VOWEL U
+      | 0xEA 0xAA 0xB5..0xB6    #Lo   [2] TAI VIET VOWEL E..TAI VIET VOWEL O
+      | 0xEA 0xAA 0xB7..0xB8    #Mn   [2] TAI VIET MAI KHIT..TAI VIET VOWEL IA
+      | 0xEA 0xAA 0xB9..0xBD    #Lo   [5] TAI VIET VOWEL UEA..TAI VIET VOWEL AN
+      | 0xEA 0xAA 0xBE..0xBF    #Mn   [2] TAI VIET VOWEL AM..TAI VIET TONE M...
+      | 0xEA 0xAB 0x80          #Lo       TAI VIET TONE MAI NUENG
+      | 0xEA 0xAB 0x81          #Mn       TAI VIET TONE MAI THO
+      | 0xEA 0xAB 0x82          #Lo       TAI VIET TONE MAI SONG
+      | 0xEA 0xAB 0x9B..0x9C    #Lo   [2] TAI VIET SYMBOL KON..TAI VIET SYMB...
+      | 0xEA 0xAB 0x9D          #Lm       TAI VIET SYMBOL SAM
+      | 0xEA 0xAB 0xA0..0xAA    #Lo  [11] MEETEI MAYEK LETTER E..MEETEI MAYE...
+      | 0xEA 0xAB 0xAB          #Mc       MEETEI MAYEK VOWEL SIGN II
+      | 0xEA 0xAB 0xAC..0xAD    #Mn   [2] MEETEI MAYEK VOWEL SIGN UU..MEETEI...
+      | 0xEA 0xAB 0xAE..0xAF    #Mc   [2] MEETEI MAYEK VOWEL SIGN AU..MEETEI...
+      | 0xEA 0xAB 0xB2          #Lo       MEETEI MAYEK ANJI
+      | 0xEA 0xAB 0xB3..0xB4    #Lm   [2] MEETEI MAYEK SYLLABLE REPETITION M...
+      | 0xEA 0xAB 0xB5          #Mc       MEETEI MAYEK VOWEL SIGN VISARGA
+      | 0xEA 0xAB 0xB6          #Mn       MEETEI MAYEK VIRAMA
+      | 0xEA 0xAC 0x81..0x86    #Lo   [6] ETHIOPIC SYLLABLE TTHU..ETHIOPIC S...
+      | 0xEA 0xAC 0x89..0x8E    #Lo   [6] ETHIOPIC SYLLABLE DDHU..ETHIOPIC S...
+      | 0xEA 0xAC 0x91..0x96    #Lo   [6] ETHIOPIC SYLLABLE DZU..ETHIOPIC SY...
+      | 0xEA 0xAC 0xA0..0xA6    #Lo   [7] ETHIOPIC SYLLABLE CCHHA..ETHIOPIC ...
+      | 0xEA 0xAC 0xA8..0xAE    #Lo   [7] ETHIOPIC SYLLABLE BBA..ETHIOPIC SY...
+      | 0xEA 0xAC 0xB0..0xFF    #L&  [43] LATIN SMALL LETTER BARRED ALPHA..L...
+      | 0xEA 0xAD 0x00..0x9A    #
+      | 0xEA 0xAD 0x9C..0x9F    #Lm   [4] MODIFIER LETTER SMALL HENG..MODIFI...
+      | 0xEA 0xAD 0xA0..0xA5    #L&   [6] LATIN SMALL LETTER SAKHA YAT..GREE...
+      | 0xEA 0xAD 0xB0..0xFF    #L&  [80] CHEROKEE SMALL LETTER A..CHEROKEE ...
+      | 0xEA 0xAE 0x00..0xBF    #
+      | 0xEA 0xAF 0x80..0xA2    #Lo  [35] MEETEI MAYEK LETTER KOK..MEETEI MA...
+      | 0xEA 0xAF 0xA3..0xA4    #Mc   [2] MEETEI MAYEK VOWEL SIGN ONAP..MEET...
+      | 0xEA 0xAF 0xA5          #Mn       MEETEI MAYEK VOWEL SIGN ANAP
+      | 0xEA 0xAF 0xA6..0xA7    #Mc   [2] MEETEI MAYEK VOWEL SIGN YENAP..MEE...
+      | 0xEA 0xAF 0xA8          #Mn       MEETEI MAYEK VOWEL SIGN UNAP
+      | 0xEA 0xAF 0xA9..0xAA    #Mc   [2] MEETEI MAYEK VOWEL SIGN CHEINAP..M...
+      | 0xEA 0xAF 0xAC          #Mc       MEETEI MAYEK LUM IYEK
+      | 0xEA 0xAF 0xAD          #Mn       MEETEI MAYEK APUN IYEK
+      | 0xEA 0xAF 0xB0..0xB9    #Nd  [10] MEETEI MAYEK DIGIT ZERO..MEETEI MA...
+      | 0xEA 0xB0 0x80..0xFF              #Lo [11172] HANGUL SYLLABLE GA..HA...
+      | 0xEA 0xB1..0xFF 0x00..0xFF        #
+      | 0xEB..0xEC 0x00..0xFF 0x00..0xFF  #
+      | 0xED 0x00 0x00..0xFF              #
+      | 0xED 0x01..0x9D 0x00..0xFF        #
+      | 0xED 0x9E 0x00..0xA3              #
+      | 0xED 0x9E 0xB0..0xFF    #Lo  [23] HANGUL JUNGSEONG O-YEO..HANGUL JUN...
+      | 0xED 0x9F 0x00..0x86    #
+      | 0xED 0x9F 0x8B..0xBB    #Lo  [49] HANGUL JONGSEONG NIEUN-RIEUL..HANG...
+      | 0xEF 0xA4 0x80..0xFF        #Lo [366] CJK COMPATIBILITY IDEOGRAPH-F9...
+      | 0xEF 0xA5..0xA8 0x00..0xFF  #
+      | 0xEF 0xA9 0x00..0xAD        #
+      | 0xEF 0xA9 0xB0..0xFF        #Lo [106] CJK COMPATIBILITY IDEOGRAPH-FA...
+      | 0xEF 0xAA..0xAA 0x00..0xFF  #
+      | 0xEF 0xAB 0x00..0x99        #
+      | 0xEF 0xAC 0x80..0x86    #L&   [7] LATIN SMALL LIGATURE FF..LATIN SMA...
+      | 0xEF 0xAC 0x93..0x97    #L&   [5] ARMENIAN SMALL LIGATURE MEN NOW..A...
+      | 0xEF 0xAC 0x9D          #Lo       HEBREW LETTER YOD WITH HIRIQ
+      | 0xEF 0xAC 0x9E          #Mn       HEBREW POINT JUDEO-SPANISH VARIKA
+      | 0xEF 0xAC 0x9F..0xA8    #Lo  [10] HEBREW LIGATURE YIDDISH YOD YOD PA...
+      | 0xEF 0xAC 0xAA..0xB6    #Lo  [13] HEBREW LETTER SHIN WITH SHIN DOT.....
+      | 0xEF 0xAC 0xB8..0xBC    #Lo   [5] HEBREW LETTER TET WITH DAGESH..HEB...
+      | 0xEF 0xAC 0xBE          #Lo       HEBREW LETTER MEM WITH DAGESH
+      | 0xEF 0xAD 0x80..0x81    #Lo   [2] HEBREW LETTER NUN WITH DAGESH..HEB...
+      | 0xEF 0xAD 0x83..0x84    #Lo   [2] HEBREW LETTER FINAL PE WITH DAGESH...
+      | 0xEF 0xAD 0x86..0xFF    #Lo [108] HEBREW LETTER TSADI WITH DAGESH..A...
+      | 0xEF 0xAE 0x00..0xB1    #
+      | 0xEF 0xAF 0x93..0xFF        #Lo [363] ARABIC LETTER NG ISOLATED FORM...
+      | 0xEF 0xB0..0xB3 0x00..0xFF  #
+      | 0xEF 0xB4 0x00..0xBD        #
+      | 0xEF 0xB5 0x90..0xFF    #Lo  [64] ARABIC LIGATURE TEH WITH JEEM WITH...
+      | 0xEF 0xB6 0x00..0x8F    #
+      | 0xEF 0xB6 0x92..0xFF    #Lo  [54] ARABIC LIGATURE MEEM WITH JEEM WIT...
+      | 0xEF 0xB7 0x00..0x87    #
+      | 0xEF 0xB7 0xB0..0xBB    #Lo  [12] ARABIC LIGATURE SALLA USED AS KORA...
+      | 0xEF 0xB8 0x80..0x8F    #Mn  [16] VARIATION SELECTOR-1..VARIATION SE...
+      | 0xEF 0xB8 0xA0..0xAF    #Mn  [16] COMBINING LIGATURE LEFT HALF..COMB...
+      | 0xEF 0xB8 0xB3..0xB4    #Pc   [2] PRESENTATION FORM FOR VERTICAL LOW...
+      | 0xEF 0xB9 0x8D..0x8F    #Pc   [3] DASHED LOW LINE..WAVY LOW LINE
+      | 0xEF 0xB9 0xB0..0xB4    #Lo   [5] ARABIC FATHATAN ISOLATED FORM..ARA...
+      | 0xEF 0xB9 0xB6..0xFF        #Lo [135] ARABIC FATHA ISOLATED FORM..AR...
+      | 0xEF 0xBA..0xBA 0x00..0xFF  #
+      | 0xEF 0xBB 0x00..0xBC        #
+      | 0xEF 0xBC 0x90..0x99    #Nd  [10] FULLWIDTH DIGIT ZERO..FULLWIDTH DI...
+      | 0xEF 0xBC 0xA1..0xBA    #L&  [26] FULLWIDTH LATIN CAPITAL LETTER A.....
+      | 0xEF 0xBC 0xBF          #Pc       FULLWIDTH LOW LINE
+      | 0xEF 0xBD 0x81..0x9A    #L&  [26] FULLWIDTH LATIN SMALL LETTER A..FU...
+      | 0xEF 0xBD 0xA6..0xAF    #Lo  [10] HALFWIDTH KATAKANA LETTER WO..HALF...
+      | 0xEF 0xBD 0xB0          #Lm       HALFWIDTH KATAKANA-HIRAGANA PROLON...
+      | 0xEF 0xBD 0xB1..0xFF    #Lo  [45] HALFWIDTH KATAKANA LETTER A..HALFW...
+      | 0xEF 0xBE 0x00..0x9D    #
+      | 0xEF 0xBE 0x9E..0x9F    #Lm   [2] HALFWIDTH KATAKANA VOICED SOUND MA...
+      | 0xEF 0xBE 0xA0..0xBE    #Lo  [31] HALFWIDTH HANGUL FILLER..HALFWIDTH...
+      | 0xEF 0xBF 0x82..0x87    #Lo   [6] HALFWIDTH HANGUL LETTER A..HALFWID...
+      | 0xEF 0xBF 0x8A..0x8F    #Lo   [6] HALFWIDTH HANGUL LETTER YEO..HALFW...
+      | 0xEF 0xBF 0x92..0x97    #Lo   [6] HALFWIDTH HANGUL LETTER YO..HALFWI...
+      | 0xEF 0xBF 0x9A..0x9C    #Lo   [3] HALFWIDTH HANGUL LETTER EU..HALFWI...
+      | 0xF0 0x90 0x80 0x80..0x8B  #Lo  [12] LINEAR B SYLLABLE B008 A..LINEA...
+      | 0xF0 0x90 0x80 0x8D..0xA6  #Lo  [26] LINEAR B SYLLABLE B036 JO..LINE...
+      | 0xF0 0x90 0x80 0xA8..0xBA  #Lo  [19] LINEAR B SYLLABLE B060 RA..LINE...
+      | 0xF0 0x90 0x80 0xBC..0xBD  #Lo   [2] LINEAR B SYLLABLE B017 ZA..LINE...
+      | 0xF0 0x90 0x80 0xBF..0xFF  #Lo  [15] LINEAR B SYLLABLE B020 ZO..LINE...
+      | 0xF0 0x90 0x81 0x00..0x8D  #
+      | 0xF0 0x90 0x81 0x90..0x9D  #Lo  [14] LINEAR B SYMBOL B018..LINEAR B ...
+      | 0xF0 0x90 0x82 0x80..0xFF  #Lo [123] LINEAR B IDEOGRAM B100 MAN..LIN...
+      | 0xF0 0x90 0x83 0x00..0xBA  #
+      | 0xF0 0x90 0x85 0x80..0xB4  #Nl  [53] GREEK ACROPHONIC ATTIC ONE QUAR...
+      | 0xF0 0x90 0x87 0xBD     #Mn       PHAISTOS DISC SIGN COMBINING OBLIQ...
+      | 0xF0 0x90 0x8A 0x80..0x9C  #Lo  [29] LYCIAN LETTER A..LYCIAN LETTER X
+      | 0xF0 0x90 0x8A 0xA0..0xFF  #Lo  [49] CARIAN LETTER A..CARIAN LETTER ...
+      | 0xF0 0x90 0x8B 0x00..0x90  #
+      | 0xF0 0x90 0x8B 0xA0     #Mn       COPTIC EPACT THOUSANDS MARK
+      | 0xF0 0x90 0x8C 0x80..0x9F  #Lo  [32] OLD ITALIC LETTER A..OLD ITALIC...
+      | 0xF0 0x90 0x8C 0xB0..0xFF  #Lo  [17] GOTHIC LETTER AHSA..GOTHIC LETT...
+      | 0xF0 0x90 0x8D 0x00..0x80  #
+      | 0xF0 0x90 0x8D 0x81     #Nl       GOTHIC LETTER NINETY
+      | 0xF0 0x90 0x8D 0x82..0x89  #Lo   [8] GOTHIC LETTER RAIDA..GOTHIC LET...
+      | 0xF0 0x90 0x8D 0x8A     #Nl       GOTHIC LETTER NINE HUNDRED
+      | 0xF0 0x90 0x8D 0x90..0xB5  #Lo  [38] OLD PERMIC LETTER AN..OLD PERMI...
+      | 0xF0 0x90 0x8D 0xB6..0xBA  #Mn   [5] COMBINING OLD PERMIC LETTER AN....
+      | 0xF0 0x90 0x8E 0x80..0x9D  #Lo  [30] UGARITIC LETTER ALPA..UGARITIC ...
+      | 0xF0 0x90 0x8E 0xA0..0xFF  #Lo  [36] OLD PERSIAN SIGN A..OLD PERSIAN...
+      | 0xF0 0x90 0x8F 0x00..0x83  #
+      | 0xF0 0x90 0x8F 0x88..0x8F  #Lo   [8] OLD PERSIAN SIGN AURAMAZDAA..OL...
+      | 0xF0 0x90 0x8F 0x91..0x95  #Nl   [5] OLD PERSIAN NUMBER ONE..OLD PER...
+      | 0xF0 0x90 0x90 0x80..0xFF  #L&  [80] DESERET CAPITAL LETTER LONG I.....
+      | 0xF0 0x90 0x91 0x00..0x8F  #
+      | 0xF0 0x90 0x91 0x90..0xFF  #Lo  [78] SHAVIAN LETTER PEEP..OSMANYA LE...
+      | 0xF0 0x90 0x92 0x00..0x9D  #
+      | 0xF0 0x90 0x92 0xA0..0xA9  #Nd  [10] OSMANYA DIGIT ZERO..OSMANYA DIG...
+      | 0xF0 0x90 0x92 0xB0..0xFF  #L&  [36] OSAGE CAPITAL LETTER A..OSAGE C...
+      | 0xF0 0x90 0x93 0x00..0x93  #
+      | 0xF0 0x90 0x93 0x98..0xBB  #L&  [36] OSAGE SMALL LETTER A..OSAGE SMA...
+      | 0xF0 0x90 0x94 0x80..0xA7  #Lo  [40] ELBASAN LETTER A..ELBASAN LETTE...
+      | 0xF0 0x90 0x94 0xB0..0xFF  #Lo  [52] CAUCASIAN ALBANIAN LETTER ALT.....
+      | 0xF0 0x90 0x95 0x00..0xA3  #
+      | 0xF0 0x90 0x98 0x80..0xFF        #Lo [311] LINEAR A SIGN AB001..LINE...
+      | 0xF0 0x90 0x99..0x9B 0x00..0xFF  #
+      | 0xF0 0x90 0x9C 0x00..0xB6        #
+      | 0xF0 0x90 0x9D 0x80..0x95  #Lo  [22] LINEAR A SIGN A701 A..LINEAR A ...
+      | 0xF0 0x90 0x9D 0xA0..0xA7  #Lo   [8] LINEAR A SIGN A800..LINEAR A SI...
+      | 0xF0 0x90 0xA0 0x80..0x85  #Lo   [6] CYPRIOT SYLLABLE A..CYPRIOT SYL...
+      | 0xF0 0x90 0xA0 0x88     #Lo       CYPRIOT SYLLABLE JO
+      | 0xF0 0x90 0xA0 0x8A..0xB5  #Lo  [44] CYPRIOT SYLLABLE KA..CYPRIOT SY...
+      | 0xF0 0x90 0xA0 0xB7..0xB8  #Lo   [2] CYPRIOT SYLLABLE XA..CYPRIOT SY...
+      | 0xF0 0x90 0xA0 0xBC     #Lo       CYPRIOT SYLLABLE ZA
+      | 0xF0 0x90 0xA0 0xBF..0xFF  #Lo  [23] CYPRIOT SYLLABLE ZO..IMPERIAL A...
+      | 0xF0 0x90 0xA1 0x00..0x95  #
+      | 0xF0 0x90 0xA1 0xA0..0xB6  #Lo  [23] PALMYRENE LETTER ALEPH..PALMYRE...
+      | 0xF0 0x90 0xA2 0x80..0x9E  #Lo  [31] NABATAEAN LETTER FINAL ALEPH..N...
+      | 0xF0 0x90 0xA3 0xA0..0xB2  #Lo  [19] HATRAN LETTER ALEPH..HATRAN LET...
+      | 0xF0 0x90 0xA3 0xB4..0xB5  #Lo   [2] HATRAN LETTER SHIN..HATRAN LETT...
+      | 0xF0 0x90 0xA4 0x80..0x95  #Lo  [22] PHOENICIAN LETTER ALF..PHOENICI...
+      | 0xF0 0x90 0xA4 0xA0..0xB9  #Lo  [26] LYDIAN LETTER A..LYDIAN LETTER C
+      | 0xF0 0x90 0xA6 0x80..0xB7  #Lo  [56] MEROITIC HIEROGLYPHIC LETTER A....
+      | 0xF0 0x90 0xA6 0xBE..0xBF  #Lo   [2] MEROITIC CURSIVE LOGOGRAM RMT.....
+      | 0xF0 0x90 0xA8 0x80     #Lo       KHAROSHTHI LETTER A
+      | 0xF0 0x90 0xA8 0x81..0x83  #Mn   [3] KHAROSHTHI VOWEL SIGN I..KHAROS...
+      | 0xF0 0x90 0xA8 0x85..0x86  #Mn   [2] KHAROSHTHI VOWEL SIGN E..KHAROS...
+      | 0xF0 0x90 0xA8 0x8C..0x8F  #Mn   [4] KHAROSHTHI VOWEL LENGTH MARK..K...
+      | 0xF0 0x90 0xA8 0x90..0x93  #Lo   [4] KHAROSHTHI LETTER KA..KHAROSHTH...
+      | 0xF0 0x90 0xA8 0x95..0x97  #Lo   [3] KHAROSHTHI LETTER CA..KHAROSHTH...
+      | 0xF0 0x90 0xA8 0x99..0xB3  #Lo  [27] KHAROSHTHI LETTER NYA..KHAROSHT...
+      | 0xF0 0x90 0xA8 0xB8..0xBA  #Mn   [3] KHAROSHTHI SIGN BAR ABOVE..KHAR...
+      | 0xF0 0x90 0xA8 0xBF     #Mn       KHAROSHTHI VIRAMA
+      | 0xF0 0x90 0xA9 0xA0..0xBC  #Lo  [29] OLD SOUTH ARABIAN LETTER HE..OL...
+      | 0xF0 0x90 0xAA 0x80..0x9C  #Lo  [29] OLD NORTH ARABIAN LETTER HEH..O...
+      | 0xF0 0x90 0xAB 0x80..0x87  #Lo   [8] MANICHAEAN LETTER ALEPH..MANICH...
+      | 0xF0 0x90 0xAB 0x89..0xA4  #Lo  [28] MANICHAEAN LETTER ZAYIN..MANICH...
+      | 0xF0 0x90 0xAB 0xA5..0xA6  #Mn   [2] MANICHAEAN ABBREVIATION MARK AB...
+      | 0xF0 0x90 0xAC 0x80..0xB5  #Lo  [54] AVESTAN LETTER A..AVESTAN LETTE...
+      | 0xF0 0x90 0xAD 0x80..0x95  #Lo  [22] INSCRIPTIONAL PARTHIAN LETTER A...
+      | 0xF0 0x90 0xAD 0xA0..0xB2  #Lo  [19] INSCRIPTIONAL PAHLAVI LETTER AL...
+      | 0xF0 0x90 0xAE 0x80..0x91  #Lo  [18] PSALTER PAHLAVI LETTER ALEPH..P...
+      | 0xF0 0x90 0xB0 0x80..0xFF  #Lo  [73] OLD TURKIC LETTER ORKHON A..OLD...
+      | 0xF0 0x90 0xB1 0x00..0x88  #
+      | 0xF0 0x90 0xB2 0x80..0xB2  #L&  [51] OLD HUNGARIAN CAPITAL LETTER A....
+      | 0xF0 0x90 0xB3 0x80..0xB2  #L&  [51] OLD HUNGARIAN SMALL LETTER A..O...
+      | 0xF0 0x91 0x80 0x80     #Mc       BRAHMI SIGN CANDRABINDU
+      | 0xF0 0x91 0x80 0x81     #Mn       BRAHMI SIGN ANUSVARA
+      | 0xF0 0x91 0x80 0x82     #Mc       BRAHMI SIGN VISARGA
+      | 0xF0 0x91 0x80 0x83..0xB7  #Lo  [53] BRAHMI SIGN JIHVAMULIYA..BRAHMI...
+      | 0xF0 0x91 0x80 0xB8..0xFF  #Mn  [15] BRAHMI VOWEL SIGN AA..BRAHMI VI...
+      | 0xF0 0x91 0x81 0x00..0x86  #
+      | 0xF0 0x91 0x81 0xA6..0xAF  #Nd  [10] BRAHMI DIGIT ZERO..BRAHMI DIGIT...
+      | 0xF0 0x91 0x81 0xBF..0xFF  #Mn   [3] BRAHMI NUMBER JOINER..KAITHI SI...
+      | 0xF0 0x91 0x82 0x00..0x81  #
+      | 0xF0 0x91 0x82 0x82     #Mc       KAITHI SIGN VISARGA
+      | 0xF0 0x91 0x82 0x83..0xAF  #Lo  [45] KAITHI LETTER A..KAITHI LETTER HA
+      | 0xF0 0x91 0x82 0xB0..0xB2  #Mc   [3] KAITHI VOWEL SIGN AA..KAITHI VO...
+      | 0xF0 0x91 0x82 0xB3..0xB6  #Mn   [4] KAITHI VOWEL SIGN U..KAITHI VOW...
+      | 0xF0 0x91 0x82 0xB7..0xB8  #Mc   [2] KAITHI VOWEL SIGN O..KAITHI VOW...
+      | 0xF0 0x91 0x82 0xB9..0xBA  #Mn   [2] KAITHI SIGN VIRAMA..KAITHI SIGN...
+      | 0xF0 0x91 0x83 0x90..0xA8  #Lo  [25] SORA SOMPENG LETTER SAH..SORA S...
+      | 0xF0 0x91 0x83 0xB0..0xB9  #Nd  [10] SORA SOMPENG DIGIT ZERO..SORA S...
+      | 0xF0 0x91 0x84 0x80..0x82  #Mn   [3] CHAKMA SIGN CANDRABINDU..CHAKMA...
+      | 0xF0 0x91 0x84 0x83..0xA6  #Lo  [36] CHAKMA LETTER AA..CHAKMA LETTER...
+      | 0xF0 0x91 0x84 0xA7..0xAB  #Mn   [5] CHAKMA VOWEL SIGN A..CHAKMA VOW...
+      | 0xF0 0x91 0x84 0xAC     #Mc       CHAKMA VOWEL SIGN E
+      | 0xF0 0x91 0x84 0xAD..0xB4  #Mn   [8] CHAKMA VOWEL SIGN AI..CHAKMA MA...
+      | 0xF0 0x91 0x84 0xB6..0xBF  #Nd  [10] CHAKMA DIGIT ZERO..CHAKMA DIGIT...
+      | 0xF0 0x91 0x85 0x90..0xB2  #Lo  [35] MAHAJANI LETTER A..MAHAJANI LET...
+      | 0xF0 0x91 0x85 0xB3     #Mn       MAHAJANI SIGN NUKTA
+      | 0xF0 0x91 0x85 0xB6     #Lo       MAHAJANI LIGATURE SHRI
+      | 0xF0 0x91 0x86 0x80..0x81  #Mn   [2] SHARADA SIGN CANDRABINDU..SHARA...
+      | 0xF0 0x91 0x86 0x82     #Mc       SHARADA SIGN VISARGA
+      | 0xF0 0x91 0x86 0x83..0xB2  #Lo  [48] SHARADA LETTER A..SHARADA LETTE...
+      | 0xF0 0x91 0x86 0xB3..0xB5  #Mc   [3] SHARADA VOWEL SIGN AA..SHARADA ...
+      | 0xF0 0x91 0x86 0xB6..0xBE  #Mn   [9] SHARADA VOWEL SIGN U..SHARADA V...
+      | 0xF0 0x91 0x86 0xBF..0xFF  #Mc   [2] SHARADA VOWEL SIGN AU..SHARADA ...
+      | 0xF0 0x91 0x87 0x00..0x80  #
+      | 0xF0 0x91 0x87 0x81..0x84  #Lo   [4] SHARADA SIGN AVAGRAHA..SHARADA OM
+      | 0xF0 0x91 0x87 0x8A..0x8C  #Mn   [3] SHARADA SIGN NUKTA..SHARADA EXT...
+      | 0xF0 0x91 0x87 0x90..0x99  #Nd  [10] SHARADA DIGIT ZERO..SHARADA DIG...
+      | 0xF0 0x91 0x87 0x9A     #Lo       SHARADA EKAM
+      | 0xF0 0x91 0x87 0x9C     #Lo       SHARADA HEADSTROKE
+      | 0xF0 0x91 0x88 0x80..0x91  #Lo  [18] KHOJKI LETTER A..KHOJKI LETTER JJA
+      | 0xF0 0x91 0x88 0x93..0xAB  #Lo  [25] KHOJKI LETTER NYA..KHOJKI LETTE...
+      | 0xF0 0x91 0x88 0xAC..0xAE  #Mc   [3] KHOJKI VOWEL SIGN AA..KHOJKI VO...
+      | 0xF0 0x91 0x88 0xAF..0xB1  #Mn   [3] KHOJKI VOWEL SIGN U..KHOJKI VOW...
+      | 0xF0 0x91 0x88 0xB2..0xB3  #Mc   [2] KHOJKI VOWEL SIGN O..KHOJKI VOW...
+      | 0xF0 0x91 0x88 0xB4     #Mn       KHOJKI SIGN ANUSVARA
+      | 0xF0 0x91 0x88 0xB5     #Mc       KHOJKI SIGN VIRAMA
+      | 0xF0 0x91 0x88 0xB6..0xB7  #Mn   [2] KHOJKI SIGN NUKTA..KHOJKI SIGN ...
+      | 0xF0 0x91 0x88 0xBE     #Mn       KHOJKI SIGN SUKUN
+      | 0xF0 0x91 0x8A 0x80..0x86  #Lo   [7] MULTANI LETTER A..MULTANI LETTE...
+      | 0xF0 0x91 0x8A 0x88     #Lo       MULTANI LETTER GHA
+      | 0xF0 0x91 0x8A 0x8A..0x8D  #Lo   [4] MULTANI LETTER CA..MULTANI LETT...
+      | 0xF0 0x91 0x8A 0x8F..0x9D  #Lo  [15] MULTANI LETTER NYA..MULTANI LET...
+      | 0xF0 0x91 0x8A 0x9F..0xA8  #Lo  [10] MULTANI LETTER BHA..MULTANI LET...
+      | 0xF0 0x91 0x8A 0xB0..0xFF  #Lo  [47] KHUDAWADI LETTER A..KHUDAWADI L...
+      | 0xF0 0x91 0x8B 0x00..0x9E  #
+      | 0xF0 0x91 0x8B 0x9F     #Mn       KHUDAWADI SIGN ANUSVARA
+      | 0xF0 0x91 0x8B 0xA0..0xA2  #Mc   [3] KHUDAWADI VOWEL SIGN AA..KHUDAW...
+      | 0xF0 0x91 0x8B 0xA3..0xAA  #Mn   [8] KHUDAWADI VOWEL SIGN U..KHUDAWA...
+      | 0xF0 0x91 0x8B 0xB0..0xB9  #Nd  [10] KHUDAWADI DIGIT ZERO..KHUDAWADI...
+      | 0xF0 0x91 0x8C 0x80..0x81  #Mn   [2] GRANTHA SIGN COMBINING ANUSVARA...
+      | 0xF0 0x91 0x8C 0x82..0x83  #Mc   [2] GRANTHA SIGN ANUSVARA..GRANTHA ...
+      | 0xF0 0x91 0x8C 0x85..0x8C  #Lo   [8] GRANTHA LETTER A..GRANTHA LETTE...
+      | 0xF0 0x91 0x8C 0x8F..0x90  #Lo   [2] GRANTHA LETTER EE..GRANTHA LETT...
+      | 0xF0 0x91 0x8C 0x93..0xA8  #Lo  [22] GRANTHA LETTER OO..GRANTHA LETT...
+      | 0xF0 0x91 0x8C 0xAA..0xB0  #Lo   [7] GRANTHA LETTER PA..GRANTHA LETT...
+      | 0xF0 0x91 0x8C 0xB2..0xB3  #Lo   [2] GRANTHA LETTER LA..GRANTHA LETT...
+      | 0xF0 0x91 0x8C 0xB5..0xB9  #Lo   [5] GRANTHA LETTER VA..GRANTHA LETT...
+      | 0xF0 0x91 0x8C 0xBC     #Mn       GRANTHA SIGN NUKTA
+      | 0xF0 0x91 0x8C 0xBD     #Lo       GRANTHA SIGN AVAGRAHA
+      | 0xF0 0x91 0x8C 0xBE..0xBF  #Mc   [2] GRANTHA VOWEL SIGN AA..GRANTHA ...
+      | 0xF0 0x91 0x8D 0x80     #Mn       GRANTHA VOWEL SIGN II
+      | 0xF0 0x91 0x8D 0x81..0x84  #Mc   [4] GRANTHA VOWEL SIGN U..GRANTHA V...
+      | 0xF0 0x91 0x8D 0x87..0x88  #Mc   [2] GRANTHA VOWEL SIGN EE..GRANTHA ...
+      | 0xF0 0x91 0x8D 0x8B..0x8D  #Mc   [3] GRANTHA VOWEL SIGN OO..GRANTHA ...
+      | 0xF0 0x91 0x8D 0x90     #Lo       GRANTHA OM
+      | 0xF0 0x91 0x8D 0x97     #Mc       GRANTHA AU LENGTH MARK
+      | 0xF0 0x91 0x8D 0x9D..0xA1  #Lo   [5] GRANTHA SIGN PLUTA..GRANTHA LET...
+      | 0xF0 0x91 0x8D 0xA2..0xA3  #Mc   [2] GRANTHA VOWEL SIGN VOCALIC L..G...
+      | 0xF0 0x91 0x8D 0xA6..0xAC  #Mn   [7] COMBINING GRANTHA DIGIT ZERO..C...
+      | 0xF0 0x91 0x8D 0xB0..0xB4  #Mn   [5] COMBINING GRANTHA LETTER A..COM...
+      | 0xF0 0x91 0x90 0x80..0xB4  #Lo  [53] NEWA LETTER A..NEWA LETTER HA
+      | 0xF0 0x91 0x90 0xB5..0xB7  #Mc   [3] NEWA VOWEL SIGN AA..NEWA VOWEL ...
+      | 0xF0 0x91 0x90 0xB8..0xBF  #Mn   [8] NEWA VOWEL SIGN U..NEWA VOWEL S...
+      | 0xF0 0x91 0x91 0x80..0x81  #Mc   [2] NEWA VOWEL SIGN O..NEWA VOWEL S...
+      | 0xF0 0x91 0x91 0x82..0x84  #Mn   [3] NEWA SIGN VIRAMA..NEWA SIGN ANU...
+      | 0xF0 0x91 0x91 0x85     #Mc       NEWA SIGN VISARGA
+      | 0xF0 0x91 0x91 0x86     #Mn       NEWA SIGN NUKTA
+      | 0xF0 0x91 0x91 0x87..0x8A  #Lo   [4] NEWA SIGN AVAGRAHA..NEWA SIDDHI
+      | 0xF0 0x91 0x91 0x90..0x99  #Nd  [10] NEWA DIGIT ZERO..NEWA DIGIT NINE
+      | 0xF0 0x91 0x92 0x80..0xAF  #Lo  [48] TIRHUTA ANJI..TIRHUTA LETTER HA
+      | 0xF0 0x91 0x92 0xB0..0xB2  #Mc   [3] TIRHUTA VOWEL SIGN AA..TIRHUTA ...
+      | 0xF0 0x91 0x92 0xB3..0xB8  #Mn   [6] TIRHUTA VOWEL SIGN U..TIRHUTA V...
+      | 0xF0 0x91 0x92 0xB9     #Mc       TIRHUTA VOWEL SIGN E
+      | 0xF0 0x91 0x92 0xBA     #Mn       TIRHUTA VOWEL SIGN SHORT E
+      | 0xF0 0x91 0x92 0xBB..0xBE  #Mc   [4] TIRHUTA VOWEL SIGN AI..TIRHUTA ...
+      | 0xF0 0x91 0x92 0xBF..0xFF  #Mn   [2] TIRHUTA SIGN CANDRABINDU..TIRHU...
+      | 0xF0 0x91 0x93 0x00..0x80  #
+      | 0xF0 0x91 0x93 0x81     #Mc       TIRHUTA SIGN VISARGA
+      | 0xF0 0x91 0x93 0x82..0x83  #Mn   [2] TIRHUTA SIGN VIRAMA..TIRHUTA SI...
+      | 0xF0 0x91 0x93 0x84..0x85  #Lo   [2] TIRHUTA SIGN AVAGRAHA..TIRHUTA ...
+      | 0xF0 0x91 0x93 0x87     #Lo       TIRHUTA OM
+      | 0xF0 0x91 0x93 0x90..0x99  #Nd  [10] TIRHUTA DIGIT ZERO..TIRHUTA DIG...
+      | 0xF0 0x91 0x96 0x80..0xAE  #Lo  [47] SIDDHAM LETTER A..SIDDHAM LETTE...
+      | 0xF0 0x91 0x96 0xAF..0xB1  #Mc   [3] SIDDHAM VOWEL SIGN AA..SIDDHAM ...
+      | 0xF0 0x91 0x96 0xB2..0xB5  #Mn   [4] SIDDHAM VOWEL SIGN U..SIDDHAM V...
+      | 0xF0 0x91 0x96 0xB8..0xBB  #Mc   [4] SIDDHAM VOWEL SIGN E..SIDDHAM V...
+      | 0xF0 0x91 0x96 0xBC..0xBD  #Mn   [2] SIDDHAM SIGN CANDRABINDU..SIDDH...
+      | 0xF0 0x91 0x96 0xBE     #Mc       SIDDHAM SIGN VISARGA
+      | 0xF0 0x91 0x96 0xBF..0xFF  #Mn   [2] SIDDHAM SIGN VIRAMA..SIDDHAM SI...
+      | 0xF0 0x91 0x97 0x00..0x80  #
+      | 0xF0 0x91 0x97 0x98..0x9B  #Lo   [4] SIDDHAM LETTER THREE-CIRCLE ALT...
+      | 0xF0 0x91 0x97 0x9C..0x9D  #Mn   [2] SIDDHAM VOWEL SIGN ALTERNATE U....
+      | 0xF0 0x91 0x98 0x80..0xAF  #Lo  [48] MODI LETTER A..MODI LETTER LLA
+      | 0xF0 0x91 0x98 0xB0..0xB2  #Mc   [3] MODI VOWEL SIGN AA..MODI VOWEL ...
+      | 0xF0 0x91 0x98 0xB3..0xBA  #Mn   [8] MODI VOWEL SIGN U..MODI VOWEL S...
+      | 0xF0 0x91 0x98 0xBB..0xBC  #Mc   [2] MODI VOWEL SIGN O..MODI VOWEL S...
+      | 0xF0 0x91 0x98 0xBD     #Mn       MODI SIGN ANUSVARA
+      | 0xF0 0x91 0x98 0xBE     #Mc       MODI SIGN VISARGA
+      | 0xF0 0x91 0x98 0xBF..0xFF  #Mn   [2] MODI SIGN VIRAMA..MODI SIGN ARD...
+      | 0xF0 0x91 0x99 0x00..0x80  #
+      | 0xF0 0x91 0x99 0x84     #Lo       MODI SIGN HUVA
+      | 0xF0 0x91 0x99 0x90..0x99  #Nd  [10] MODI DIGIT ZERO..MODI DIGIT NINE
+      | 0xF0 0x91 0x9A 0x80..0xAA  #Lo  [43] TAKRI LETTER A..TAKRI LETTER RRA
+      | 0xF0 0x91 0x9A 0xAB     #Mn       TAKRI SIGN ANUSVARA
+      | 0xF0 0x91 0x9A 0xAC     #Mc       TAKRI SIGN VISARGA
+      | 0xF0 0x91 0x9A 0xAD     #Mn       TAKRI VOWEL SIGN AA
+      | 0xF0 0x91 0x9A 0xAE..0xAF  #Mc   [2] TAKRI VOWEL SIGN I..TAKRI VOWEL...
+      | 0xF0 0x91 0x9A 0xB0..0xB5  #Mn   [6] TAKRI VOWEL SIGN U..TAKRI VOWEL...
+      | 0xF0 0x91 0x9A 0xB6     #Mc       TAKRI SIGN VIRAMA
+      | 0xF0 0x91 0x9A 0xB7     #Mn       TAKRI SIGN NUKTA
+      | 0xF0 0x91 0x9B 0x80..0x89  #Nd  [10] TAKRI DIGIT ZERO..TAKRI DIGIT NINE
+      | 0xF0 0x91 0x9C 0x80..0x99  #Lo  [26] AHOM LETTER KA..AHOM LETTER JHA
+      | 0xF0 0x91 0x9C 0x9D..0x9F  #Mn   [3] AHOM CONSONANT SIGN MEDIAL LA.....
+      | 0xF0 0x91 0x9C 0xA0..0xA1  #Mc   [2] AHOM VOWEL SIGN A..AHOM VOWEL S...
+      | 0xF0 0x91 0x9C 0xA2..0xA5  #Mn   [4] AHOM VOWEL SIGN I..AHOM VOWEL S...
+      | 0xF0 0x91 0x9C 0xA6     #Mc       AHOM VOWEL SIGN E
+      | 0xF0 0x91 0x9C 0xA7..0xAB  #Mn   [5] AHOM VOWEL SIGN AW..AHOM SIGN K...
+      | 0xF0 0x91 0x9C 0xB0..0xB9  #Nd  [10] AHOM DIGIT ZERO..AHOM DIGIT NINE
+      | 0xF0 0x91 0xA2 0xA0..0xFF  #L&  [64] WARANG CITI CAPITAL LETTER NGAA...
+      | 0xF0 0x91 0xA3 0x00..0x9F  #
+      | 0xF0 0x91 0xA3 0xA0..0xA9  #Nd  [10] WARANG CITI DIGIT ZERO..WARANG ...
+      | 0xF0 0x91 0xA3 0xBF     #Lo       WARANG CITI OM
+      | 0xF0 0x91 0xAB 0x80..0xB8  #Lo  [57] PAU CIN HAU LETTER PA..PAU CIN ...
+      | 0xF0 0x91 0xB0 0x80..0x88  #Lo   [9] BHAIKSUKI LETTER A..BHAIKSUKI L...
+      | 0xF0 0x91 0xB0 0x8A..0xAE  #Lo  [37] BHAIKSUKI LETTER E..BHAIKSUKI L...
+      | 0xF0 0x91 0xB0 0xAF     #Mc       BHAIKSUKI VOWEL SIGN AA
+      | 0xF0 0x91 0xB0 0xB0..0xB6  #Mn   [7] BHAIKSUKI VOWEL SIGN I..BHAIKSU...
+      | 0xF0 0x91 0xB0 0xB8..0xBD  #Mn   [6] BHAIKSUKI VOWEL SIGN E..BHAIKSU...
+      | 0xF0 0x91 0xB0 0xBE     #Mc       BHAIKSUKI SIGN VISARGA
+      | 0xF0 0x91 0xB0 0xBF     #Mn       BHAIKSUKI SIGN VIRAMA
+      | 0xF0 0x91 0xB1 0x80     #Lo       BHAIKSUKI SIGN AVAGRAHA
+      | 0xF0 0x91 0xB1 0x90..0x99  #Nd  [10] BHAIKSUKI DIGIT ZERO..BHAIKSUKI...
+      | 0xF0 0x91 0xB1 0xB2..0xFF  #Lo  [30] MARCHEN LETTER KA..MARCHEN LETT...
+      | 0xF0 0x91 0xB2 0x00..0x8F  #
+      | 0xF0 0x91 0xB2 0x92..0xA7  #Mn  [22] MARCHEN SUBJOINED LETTER KA..MA...
+      | 0xF0 0x91 0xB2 0xA9     #Mc       MARCHEN SUBJOINED LETTER YA
+      | 0xF0 0x91 0xB2 0xAA..0xB0  #Mn   [7] MARCHEN SUBJOINED LETTER RA..MA...
+      | 0xF0 0x91 0xB2 0xB1     #Mc       MARCHEN VOWEL SIGN I
+      | 0xF0 0x91 0xB2 0xB2..0xB3  #Mn   [2] MARCHEN VOWEL SIGN U..MARCHEN V...
+      | 0xF0 0x91 0xB2 0xB4     #Mc       MARCHEN VOWEL SIGN O
+      | 0xF0 0x91 0xB2 0xB5..0xB6  #Mn   [2] MARCHEN SIGN ANUSVARA..MARCHEN ...
+      | 0xF0 0x92 0x80 0x80..0xFF        #Lo [922] CUNEIFORM SIGN A..CUNEIFO...
+      | 0xF0 0x92 0x81..0x8D 0x00..0xFF  #
+      | 0xF0 0x92 0x8E 0x00..0x99        #
+      | 0xF0 0x92 0x90 0x80..0xFF  #Nl [111] CUNEIFORM NUMERIC SIGN TWO ASH....
+      | 0xF0 0x92 0x91 0x00..0xAE  #
+      | 0xF0 0x92 0x92 0x80..0xFF        #Lo [196] CUNEIFORM SIGN AB TIMES N...
+      | 0xF0 0x92 0x93..0x94 0x00..0xFF  #
+      | 0xF0 0x92 0x95 0x00..0x83        #
+      | 0xF0 0x93 0x80 0x80..0xFF        #Lo [1071] EGYPTIAN HIEROGLYPH A001...
+      | 0xF0 0x93 0x81..0x8F 0x00..0xFF  #
+      | 0xF0 0x93 0x90 0x00..0xAE        #
+      | 0xF0 0x94 0x90 0x80..0xFF        #Lo [583] ANATOLIAN HIEROGLYPH A001...
+      | 0xF0 0x94 0x91..0x98 0x00..0xFF  #
+      | 0xF0 0x94 0x99 0x00..0x86        #
+      | 0xF0 0x96 0xA0 0x80..0xFF        #Lo [569] BAMUM LETTER PHASE-A NGKU...
+      | 0xF0 0x96 0xA1..0xA7 0x00..0xFF  #
+      | 0xF0 0x96 0xA8 0x00..0xB8        #
+      | 0xF0 0x96 0xA9 0x80..0x9E  #Lo  [31] MRO LETTER TA..MRO LETTER TEK
+      | 0xF0 0x96 0xA9 0xA0..0xA9  #Nd  [10] MRO DIGIT ZERO..MRO DIGIT NINE
+      | 0xF0 0x96 0xAB 0x90..0xAD  #Lo  [30] BASSA VAH LETTER ENNI..BASSA VA...
+      | 0xF0 0x96 0xAB 0xB0..0xB4  #Mn   [5] BASSA VAH COMBINING HIGH TONE.....
+      | 0xF0 0x96 0xAC 0x80..0xAF  #Lo  [48] PAHAWH HMONG VOWEL KEEB..PAHAWH...
+      | 0xF0 0x96 0xAC 0xB0..0xB6  #Mn   [7] PAHAWH HMONG MARK CIM TUB..PAHA...
+      | 0xF0 0x96 0xAD 0x80..0x83  #Lm   [4] PAHAWH HMONG SIGN VOS SEEV..PAH...
+      | 0xF0 0x96 0xAD 0x90..0x99  #Nd  [10] PAHAWH HMONG DIGIT ZERO..PAHAWH...
+      | 0xF0 0x96 0xAD 0xA3..0xB7  #Lo  [21] PAHAWH HMONG SIGN VOS LUB..PAHA...
+      | 0xF0 0x96 0xAD 0xBD..0xFF  #Lo  [19] PAHAWH HMONG CLAN SIGN TSHEEJ.....
+      | 0xF0 0x96 0xAE 0x00..0x8F  #
+      | 0xF0 0x96 0xBC 0x80..0xFF  #Lo  [69] MIAO LETTER PA..MIAO LETTER HHA
+      | 0xF0 0x96 0xBD 0x00..0x84  #
+      | 0xF0 0x96 0xBD 0x90     #Lo       MIAO LETTER NASALIZATION
+      | 0xF0 0x96 0xBD 0x91..0xBE  #Mc  [46] MIAO SIGN ASPIRATION..MIAO VOWE...
+      | 0xF0 0x96 0xBE 0x8F..0x92  #Mn   [4] MIAO TONE RIGHT..MIAO TONE BELOW
+      | 0xF0 0x96 0xBE 0x93..0x9F  #Lm  [13] MIAO LETTER TONE-2..MIAO LETTER...
+      | 0xF0 0x96 0xBF 0xA0     #Lm       TANGUT ITERATION MARK
+      | 0xF0 0x97 0x80 0x80..0xFF        #Lo [6125] TANGUT IDEOGRAPH-17000.....
+      | 0xF0 0x97 0x81..0xFF 0x00..0xFF  #
+      | 0xF0 0x98 0x00 0x00..0xFF        #
+      | 0xF0 0x98 0x01..0x9E 0x00..0xFF  #
+      | 0xF0 0x98 0x9F 0x00..0xAC        #
+      | 0xF0 0x98 0xA0 0x80..0xFF        #Lo [755] TANGUT COMPONENT-001..TAN...
+      | 0xF0 0x98 0xA1..0xAA 0x00..0xFF  #
+      | 0xF0 0x98 0xAB 0x00..0xB2        #
+      | 0xF0 0x9B 0x80 0x80..0x81  #Lo   [2] KATAKANA LETTER ARCHAIC E..HIRA...
+      | 0xF0 0x9B 0xB0 0x80..0xFF  #Lo [107] DUPLOYAN LETTER H..DUPLOYAN LET...
+      | 0xF0 0x9B 0xB1 0x00..0xAA  #
+      | 0xF0 0x9B 0xB1 0xB0..0xBC  #Lo  [13] DUPLOYAN AFFIX LEFT HORIZONTAL ...
+      | 0xF0 0x9B 0xB2 0x80..0x88  #Lo   [9] DUPLOYAN AFFIX HIGH ACUTE..DUPL...
+      | 0xF0 0x9B 0xB2 0x90..0x99  #Lo  [10] DUPLOYAN AFFIX LOW ACUTE..DUPLO...
+      | 0xF0 0x9B 0xB2 0x9D..0x9E  #Mn   [2] DUPLOYAN THICK LETTER SELECTOR....
+      | 0xF0 0x9D 0x85 0xA5..0xA6  #Mc   [2] MUSICAL SYMBOL COMBINING STEM.....
+      | 0xF0 0x9D 0x85 0xA7..0xA9  #Mn   [3] MUSICAL SYMBOL COMBINING TREMOL...
+      | 0xF0 0x9D 0x85 0xAD..0xB2  #Mc   [6] MUSICAL SYMBOL COMBINING AUGMEN...
+      | 0xF0 0x9D 0x85 0xBB..0xFF  #Mn   [8] MUSICAL SYMBOL COMBINING ACCENT...
+      | 0xF0 0x9D 0x86 0x00..0x82  #
+      | 0xF0 0x9D 0x86 0x85..0x8B  #Mn   [7] MUSICAL SYMBOL COMBINING DOIT.....
+      | 0xF0 0x9D 0x86 0xAA..0xAD  #Mn   [4] MUSICAL SYMBOL COMBINING DOWN B...
+      | 0xF0 0x9D 0x89 0x82..0x84  #Mn   [3] COMBINING GREEK MUSICAL TRISEME...
+      | 0xF0 0x9D 0x90 0x80..0xFF  #L&  [85] MATHEMATICAL BOLD CAPITAL A..MA...
+      | 0xF0 0x9D 0x91 0x00..0x94  #
+      | 0xF0 0x9D 0x91 0x96..0xFF  #L&  [71] MATHEMATICAL ITALIC SMALL I..MA...
+      | 0xF0 0x9D 0x92 0x00..0x9C  #
+      | 0xF0 0x9D 0x92 0x9E..0x9F  #L&   [2] MATHEMATICAL SCRIPT CAPITAL C.....
+      | 0xF0 0x9D 0x92 0xA2     #L&       MATHEMATICAL SCRIPT CAPITAL G
+      | 0xF0 0x9D 0x92 0xA5..0xA6  #L&   [2] MATHEMATICAL SCRIPT CAPITAL J.....
+      | 0xF0 0x9D 0x92 0xA9..0xAC  #L&   [4] MATHEMATICAL SCRIPT CAPITAL N.....
+      | 0xF0 0x9D 0x92 0xAE..0xB9  #L&  [12] MATHEMATICAL SCRIPT CAPITAL S.....
+      | 0xF0 0x9D 0x92 0xBB     #L&       MATHEMATICAL SCRIPT SMALL F
+      | 0xF0 0x9D 0x92 0xBD..0xFF  #L&   [7] MATHEMATICAL SCRIPT SMALL H..MA...
+      | 0xF0 0x9D 0x93 0x00..0x83  #
+      | 0xF0 0x9D 0x93 0x85..0xFF  #L&  [65] MATHEMATICAL SCRIPT SMALL P..MA...
+      | 0xF0 0x9D 0x94 0x00..0x85  #
+      | 0xF0 0x9D 0x94 0x87..0x8A  #L&   [4] MATHEMATICAL FRAKTUR CAPITAL D....
+      | 0xF0 0x9D 0x94 0x8D..0x94  #L&   [8] MATHEMATICAL FRAKTUR CAPITAL J....
+      | 0xF0 0x9D 0x94 0x96..0x9C  #L&   [7] MATHEMATICAL FRAKTUR CAPITAL S....
+      | 0xF0 0x9D 0x94 0x9E..0xB9  #L&  [28] MATHEMATICAL FRAKTUR SMALL A..M...
+      | 0xF0 0x9D 0x94 0xBB..0xBE  #L&   [4] MATHEMATICAL DOUBLE-STRUCK CAPI...
+      | 0xF0 0x9D 0x95 0x80..0x84  #L&   [5] MATHEMATICAL DOUBLE-STRUCK CAPI...
+      | 0xF0 0x9D 0x95 0x86     #L&       MATHEMATICAL DOUBLE-STRUCK CAPITAL O
+      | 0xF0 0x9D 0x95 0x8A..0x90  #L&   [7] MATHEMATICAL DOUBLE-STRUCK CAPI...
+      | 0xF0 0x9D 0x95 0x92..0xFF        #L& [340] MATHEMATICAL DOUBLE-STRUC...
+      | 0xF0 0x9D 0x96..0x99 0x00..0xFF  #
+      | 0xF0 0x9D 0x9A 0x00..0xA5        #
+      | 0xF0 0x9D 0x9A 0xA8..0xFF  #L&  [25] MATHEMATICAL BOLD CAPITAL ALPHA...
+      | 0xF0 0x9D 0x9B 0x00..0x80  #
+      | 0xF0 0x9D 0x9B 0x82..0x9A  #L&  [25] MATHEMATICAL BOLD SMALL ALPHA.....
+      | 0xF0 0x9D 0x9B 0x9C..0xBA  #L&  [31] MATHEMATICAL BOLD EPSILON SYMBO...
+      | 0xF0 0x9D 0x9B 0xBC..0xFF  #L&  [25] MATHEMATICAL ITALIC SMALL ALPHA...
+      | 0xF0 0x9D 0x9C 0x00..0x94  #
+      | 0xF0 0x9D 0x9C 0x96..0xB4  #L&  [31] MATHEMATICAL ITALIC EPSILON SYM...
+      | 0xF0 0x9D 0x9C 0xB6..0xFF  #L&  [25] MATHEMATICAL BOLD ITALIC SMALL ...
+      | 0xF0 0x9D 0x9D 0x00..0x8E  #
+      | 0xF0 0x9D 0x9D 0x90..0xAE  #L&  [31] MATHEMATICAL BOLD ITALIC EPSILO...
+      | 0xF0 0x9D 0x9D 0xB0..0xFF  #L&  [25] MATHEMATICAL SANS-SERIF BOLD SM...
+      | 0xF0 0x9D 0x9E 0x00..0x88  #
+      | 0xF0 0x9D 0x9E 0x8A..0xA8  #L&  [31] MATHEMATICAL SANS-SERIF BOLD EP...
+      | 0xF0 0x9D 0x9E 0xAA..0xFF  #L&  [25] MATHEMATICAL SANS-SERIF BOLD IT...
+      | 0xF0 0x9D 0x9F 0x00..0x82  #
+      | 0xF0 0x9D 0x9F 0x84..0x8B  #L&   [8] MATHEMATICAL SANS-SERIF BOLD IT...
+      | 0xF0 0x9D 0x9F 0x8E..0xBF  #Nd  [50] MATHEMATICAL BOLD DIGIT ZERO..M...
+      | 0xF0 0x9D 0xA8 0x80..0xB6  #Mn  [55] SIGNWRITING HEAD RIM..SIGNWRITI...
+      | 0xF0 0x9D 0xA8 0xBB..0xFF  #Mn  [50] SIGNWRITING MOUTH CLOSED NEUTRA...
+      | 0xF0 0x9D 0xA9 0x00..0xAC  #
+      | 0xF0 0x9D 0xA9 0xB5     #Mn       SIGNWRITING UPPER BODY TILTING FRO...
+      | 0xF0 0x9D 0xAA 0x84     #Mn       SIGNWRITING LOCATION HEAD NECK
+      | 0xF0 0x9D 0xAA 0x9B..0x9F  #Mn   [5] SIGNWRITING FILL MODIFIER-2..SI...
+      | 0xF0 0x9D 0xAA 0xA1..0xAF  #Mn  [15] SIGNWRITING ROTATION MODIFIER-2...
+      | 0xF0 0x9E 0x80 0x80..0x86  #Mn   [7] COMBINING GLAGOLITIC LETTER AZU...
+      | 0xF0 0x9E 0x80 0x88..0x98  #Mn  [17] COMBINING GLAGOLITIC LETTER ZEM...
+      | 0xF0 0x9E 0x80 0x9B..0xA1  #Mn   [7] COMBINING GLAGOLITIC LETTER SHT...
+      | 0xF0 0x9E 0x80 0xA3..0xA4  #Mn   [2] COMBINING GLAGOLITIC LETTER YU....
+      | 0xF0 0x9E 0x80 0xA6..0xAA  #Mn   [5] COMBINING GLAGOLITIC LETTER YO....
+      | 0xF0 0x9E 0xA0 0x80..0xFF        #Lo [197] MENDE KIKAKUI SYLLABLE M0...
+      | 0xF0 0x9E 0xA1..0xA2 0x00..0xFF  #
+      | 0xF0 0x9E 0xA3 0x00..0x84        #
+      | 0xF0 0x9E 0xA3 0x90..0x96  #Mn   [7] MENDE KIKAKUI COMBINING NUMBER ...
+      | 0xF0 0x9E 0xA4 0x80..0xFF  #L&  [68] ADLAM CAPITAL LETTER ALIF..ADLA...
+      | 0xF0 0x9E 0xA5 0x00..0x83  #
+      | 0xF0 0x9E 0xA5 0x84..0x8A  #Mn   [7] ADLAM ALIF LENGTHENER..ADLAM NUKTA
+      | 0xF0 0x9E 0xA5 0x90..0x99  #Nd  [10] ADLAM DIGIT ZERO..ADLAM DIGIT NINE
+      | 0xF0 0x9E 0xB8 0x80..0x83  #Lo   [4] ARABIC MATHEMATICAL ALEF..ARABI...
+      | 0xF0 0x9E 0xB8 0x85..0x9F  #Lo  [27] ARABIC MATHEMATICAL WAW..ARABIC...
+      | 0xF0 0x9E 0xB8 0xA1..0xA2  #Lo   [2] ARABIC MATHEMATICAL INITIAL BEH...
+      | 0xF0 0x9E 0xB8 0xA4     #Lo       ARABIC MATHEMATICAL INITIAL HEH
+      | 0xF0 0x9E 0xB8 0xA7     #Lo       ARABIC MATHEMATICAL INITIAL HAH
+      | 0xF0 0x9E 0xB8 0xA9..0xB2  #Lo  [10] ARABIC MATHEMATICAL INITIAL YEH...
+      | 0xF0 0x9E 0xB8 0xB4..0xB7  #Lo   [4] ARABIC MATHEMATICAL INITIAL SHE...
+      | 0xF0 0x9E 0xB8 0xB9     #Lo       ARABIC MATHEMATICAL INITIAL DAD
+      | 0xF0 0x9E 0xB8 0xBB     #Lo       ARABIC MATHEMATICAL INITIAL GHAIN
+      | 0xF0 0x9E 0xB9 0x82     #Lo       ARABIC MATHEMATICAL TAILED JEEM
+      | 0xF0 0x9E 0xB9 0x87     #Lo       ARABIC MATHEMATICAL TAILED HAH
+      | 0xF0 0x9E 0xB9 0x89     #Lo       ARABIC MATHEMATICAL TAILED YEH
+      | 0xF0 0x9E 0xB9 0x8B     #Lo       ARABIC MATHEMATICAL TAILED LAM
+      | 0xF0 0x9E 0xB9 0x8D..0x8F  #Lo   [3] ARABIC MATHEMATICAL TAILED NOON...
+      | 0xF0 0x9E 0xB9 0x91..0x92  #Lo   [2] ARABIC MATHEMATICAL TAILED SAD....
+      | 0xF0 0x9E 0xB9 0x94     #Lo       ARABIC MATHEMATICAL TAILED SHEEN
+      | 0xF0 0x9E 0xB9 0x97     #Lo       ARABIC MATHEMATICAL TAILED KHAH
+      | 0xF0 0x9E 0xB9 0x99     #Lo       ARABIC MATHEMATICAL TAILED DAD
+      | 0xF0 0x9E 0xB9 0x9B     #Lo       ARABIC MATHEMATICAL TAILED GHAIN
+      | 0xF0 0x9E 0xB9 0x9D     #Lo       ARABIC MATHEMATICAL TAILED DOTLESS...
+      | 0xF0 0x9E 0xB9 0x9F     #Lo       ARABIC MATHEMATICAL TAILED DOTLESS...
+      | 0xF0 0x9E 0xB9 0xA1..0xA2  #Lo   [2] ARABIC MATHEMATICAL STRETCHED B...
+      | 0xF0 0x9E 0xB9 0xA4     #Lo       ARABIC MATHEMATICAL STRETCHED HEH
+      | 0xF0 0x9E 0xB9 0xA7..0xAA  #Lo   [4] ARABIC MATHEMATICAL STRETCHED H...
+      | 0xF0 0x9E 0xB9 0xAC..0xB2  #Lo   [7] ARABIC MATHEMATICAL STRETCHED M...
+      | 0xF0 0x9E 0xB9 0xB4..0xB7  #Lo   [4] ARABIC MATHEMATICAL STRETCHED S...
+      | 0xF0 0x9E 0xB9 0xB9..0xBC  #Lo   [4] ARABIC MATHEMATICAL STRETCHED D...
+      | 0xF0 0x9E 0xB9 0xBE     #Lo       ARABIC MATHEMATICAL STRETCHED DOTL...
+      | 0xF0 0x9E 0xBA 0x80..0x89  #Lo  [10] ARABIC MATHEMATICAL LOOPED ALEF...
+      | 0xF0 0x9E 0xBA 0x8B..0x9B  #Lo  [17] ARABIC MATHEMATICAL LOOPED LAM....
+      | 0xF0 0x9E 0xBA 0xA1..0xA3  #Lo   [3] ARABIC MATHEMATICAL DOUBLE-STRU...
+      | 0xF0 0x9E 0xBA 0xA5..0xA9  #Lo   [5] ARABIC MATHEMATICAL DOUBLE-STRU...
+      | 0xF0 0x9E 0xBA 0xAB..0xBB  #Lo  [17] ARABIC MATHEMATICAL DOUBLE-STRU...
+      | 0xF0 0xA0 0x80 0x80..0xFF              #Lo [42711] CJK UNIFIED IDEOG...
+      | 0xF0 0xA0 0x81..0xFF 0x00..0xFF        #
+      | 0xF0 0xA1..0xA9 0x00..0xFF 0x00..0xFF  #
+      | 0xF0 0xAA 0x00 0x00..0xFF              #
+      | 0xF0 0xAA 0x01..0x9A 0x00..0xFF        #
+      | 0xF0 0xAA 0x9B 0x00..0x96              #
+      | 0xF0 0xAA 0x9C 0x80..0xFF        #Lo [4149] CJK UNIFIED IDEOGRAPH-2A...
+      | 0xF0 0xAA 0x9D..0xFF 0x00..0xFF  #
+      | 0xF0 0xAB 0x00 0x00..0xFF        #
+      | 0xF0 0xAB 0x01..0x9B 0x00..0xFF  #
+      | 0xF0 0xAB 0x9C 0x00..0xB4        #
+      | 0xF0 0xAB 0x9D 0x80..0xFF        #Lo [222] CJK UNIFIED IDEOGRAPH-2B7...
+      | 0xF0 0xAB 0x9E..0x9F 0x00..0xFF  #
+      | 0xF0 0xAB 0xA0 0x00..0x9D        #
+      | 0xF0 0xAB 0xA0 0xA0..0xFF        #Lo [5762] CJK UNIFIED IDEOGRAPH-2B...
+      | 0xF0 0xAB 0xA1..0xFF 0x00..0xFF  #
+      | 0xF0 0xAC 0x00 0x00..0xFF        #
+      | 0xF0 0xAC 0x01..0xB9 0x00..0xFF  #
+      | 0xF0 0xAC 0xBA 0x00..0xA1        #
+      | 0xF0 0xAF 0xA0 0x80..0xFF        #Lo [542] CJK COMPATIBILITY IDEOGRA...
+      | 0xF0 0xAF 0xA1..0xA7 0x00..0xFF  #
+      | 0xF0 0xAF 0xA8 0x00..0x9D        #
+      | 0xF3 0xA0 0x84 0x80..0xFF        #Mn [240] VARIATION SELECTOR-17..VA...
+      | 0xF3 0xA0 0x85..0x86 0x00..0xFF  #
+      | 0xF3 0xA0 0x87 0x00..0xAF        #
+      ;
+
+}%%
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/variables.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/variables.go
new file mode 100644
index 0000000..eeee1a5
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/variables.go
@@ -0,0 +1,86 @@
+package hclsyntax
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+// Variables returns all of the variables referenced within a given experssion.
+//
+// This is the implementation of the "Variables" method on every native
+// expression.
+func Variables(expr Expression) []hcl.Traversal {
+        var vars []hcl.Traversal
+
+        walker := &variablesWalker{
+                Callback: func(t hcl.Traversal) {
+                        vars = append(vars, t)
+                },
+        }
+
+        Walk(expr, walker)
+
+        return vars
+}
+
+// variablesWalker is a Walker implementation that calls its callback for any
+// root scope traversal found while walking.
+type variablesWalker struct {
+        Callback    func(hcl.Traversal)
+        localScopes []map[string]struct{}
+}
+
+func (w *variablesWalker) Enter(n Node) hcl.Diagnostics {
+        switch tn := n.(type) {
+        case *ScopeTraversalExpr:
+                t := tn.Traversal
+
+                // Check if the given root name appears in any of the active
+                // local scopes. We don't want to return local variables here, since
+                // the goal of walking variables is to tell the calling application
+                // which names it needs to populate in the _root_ scope.
+                name := t.RootName()
+                for _, names := range w.localScopes {
+                        if _, localized := names[name]; localized {
+                                return nil
+                        }
+                }
+
+                w.Callback(t)
+        case ChildScope:
+                w.localScopes = append(w.localScopes, tn.LocalNames)
+        }
+        return nil
+}
+
+func (w *variablesWalker) Exit(n Node) hcl.Diagnostics {
+        switch n.(type) {
+        case ChildScope:
+                // pop the latest local scope, assuming that the walker will
+                // behave symmetrically as promised.
+                w.localScopes = w.localScopes[:len(w.localScopes)-1]
+        }
+        return nil
+}
+
+// ChildScope is a synthetic AST node that is visited during a walk to
+// indicate that its descendent will be evaluated in a child scope, which
+// may mask certain variables from the parent scope as locals.
+//
+// ChildScope nodes don't really exist in the AST, but are rather synthesized
+// on the fly during walk. Therefore it doesn't do any good to transform them;
+// instead, transform either parent node that created a scope or the expression
+// that the child scope struct wraps.
+type ChildScope struct {
+        LocalNames map[string]struct{}
+        Expr       *Expression // pointer because it can be replaced on walk
+}
+
+func (e ChildScope) walkChildNodes(w internalWalkFunc) {
+        *(e.Expr) = w(*(e.Expr)).(Expression)
+}
+
+// Range returns the range of the expression that the ChildScope is
+// encapsulating. It isn't really very useful to call Range on a ChildScope.
+func (e ChildScope) Range() hcl.Range {
+        return (*e.Expr).Range()
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/walk.go b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/walk.go
new file mode 100644
index 0000000..3405d26
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/hclsyntax/walk.go
@@ -0,0 +1,77 @@
+package hclsyntax
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+// VisitFunc is the callback signature for VisitAll.
+type VisitFunc func(node Node) hcl.Diagnostics
+
+// VisitAll is a basic way to traverse the AST beginning with a particular
+// node. The given function will be called once for each AST node in
+// depth-first order, but no context is provided about the shape of the tree.
+//
+// The VisitFunc may return diagnostics, in which case they will be accumulated
+// and returned as a single set.
+func VisitAll(node Node, f VisitFunc) hcl.Diagnostics {
+        diags := f(node)
+        node.walkChildNodes(func(node Node) Node {
+                diags = append(diags, VisitAll(node, f)...)
+                return node
+        })
+        return diags
+}
+
+// Walker is an interface used with Walk.
+type Walker interface {
+        Enter(node Node) hcl.Diagnostics
+        Exit(node Node) hcl.Diagnostics
+}
+
+// Walk is a more complex way to traverse the AST starting with a particular
+// node, which provides information about the tree structure via separate
+// Enter and Exit functions.
+func Walk(node Node, w Walker) hcl.Diagnostics {
+        diags := w.Enter(node)
+        node.walkChildNodes(func(node Node) Node {
+                diags = append(diags, Walk(node, w)...)
+                return node
+        })
+        return diags
+}
+
+// Transformer is an interface used with Transform
+type Transformer interface {
+        // Transform accepts a node and returns a replacement node along with
+        // a flag for whether to also visit child nodes. If the flag is false,
+        // none of the child nodes will be visited and the TransformExit method
+        // will not be called for the node.
+        //
+        // It is acceptable and appropriate for Transform to return the same node
+        // it was given, for situations where no transform is needed.
+        Transform(node Node) (Node, bool, hcl.Diagnostics)
+
+        // TransformExit signals the end of transformations of child nodes of the
+        // given node. If Transform returned a new node, the given node is the
+        // node that was returned, rather than the node that was originally
+        // encountered.
+        TransformExit(node Node) hcl.Diagnostics
+}
+
+// Transform allows for in-place transformations of an AST starting with a
+// particular node. The provider Transformer implementation drives the
+// transformation process. The return value is the node that replaced the
+// given top-level node.
+func Transform(node Node, t Transformer) (Node, hcl.Diagnostics) {
+        newNode, descend, diags := t.Transform(node)
+        if !descend {
+                return newNode, diags
+        }
+        node.walkChildNodes(func(node Node) Node {
+                newNode, newDiags := Transform(node, t)
+                diags = append(diags, newDiags...)
+                return newNode
+        })
+        diags = append(diags, t.TransformExit(newNode)...)
+        return newNode, diags
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/json/ast.go b/vendor/github.com/hashicorp/hcl2/hcl/json/ast.go
new file mode 100644
index 0000000..753bfa0
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/json/ast.go
@@ -0,0 +1,121 @@
+package json
+
+import (
+        "math/big"
+
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+type node interface {
+        Range() hcl.Range
+        StartRange() hcl.Range
+}
+
+type objectVal struct {
+        Attrs      []*objectAttr
+        SrcRange   hcl.Range // range of the entire object, brace-to-brace
+        OpenRange  hcl.Range // range of the opening brace
+        CloseRange hcl.Range // range of the closing brace
+}
+
+func (n *objectVal) Range() hcl.Range {
+        return n.SrcRange
+}
+
+func (n *objectVal) StartRange() hcl.Range {
+        return n.OpenRange
+}
+
+type objectAttr struct {
+        Name      string
+        Value     node
+        NameRange hcl.Range // range of the name string
+}
+
+func (n *objectAttr) Range() hcl.Range {
+        return n.NameRange
+}
+
+func (n *objectAttr) StartRange() hcl.Range {
+        return n.NameRange
+}
+
+type arrayVal struct {
+        Values    []node
+        SrcRange  hcl.Range // range of the entire object, bracket-to-bracket
+        OpenRange hcl.Range // range of the opening bracket
+}
+
+func (n *arrayVal) Range() hcl.Range {
+        return n.SrcRange
+}
+
+func (n *arrayVal) StartRange() hcl.Range {
+        return n.OpenRange
+}
+
+type booleanVal struct {
+        Value    bool
+        SrcRange hcl.Range
+}
+
+func (n *booleanVal) Range() hcl.Range {
+        return n.SrcRange
+}
+
+func (n *booleanVal) StartRange() hcl.Range {
+        return n.SrcRange
+}
+
+type numberVal struct {
+        Value    *big.Float
+        SrcRange hcl.Range
+}
+
+func (n *numberVal) Range() hcl.Range {
+        return n.SrcRange
+}
+
+func (n *numberVal) StartRange() hcl.Range {
+        return n.SrcRange
+}
+
+type stringVal struct {
+        Value    string
+        SrcRange hcl.Range
+}
+
+func (n *stringVal) Range() hcl.Range {
+        return n.SrcRange
+}
+
+func (n *stringVal) StartRange() hcl.Range {
+        return n.SrcRange
+}
+
+type nullVal struct {
+        SrcRange hcl.Range
+}
+
+func (n *nullVal) Range() hcl.Range {
+        return n.SrcRange
+}
+
+func (n *nullVal) StartRange() hcl.Range {
+        return n.SrcRange
+}
+
+// invalidVal is used as a placeholder where a value is needed for a valid
+// parse tree but the input was invalid enough to prevent one from being
+// created.
+type invalidVal struct {
+        SrcRange hcl.Range
+}
+
+func (n invalidVal) Range() hcl.Range {
+        return n.SrcRange
+}
+
+func (n invalidVal) StartRange() hcl.Range {
+        return n.SrcRange
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/json/didyoumean.go b/vendor/github.com/hashicorp/hcl2/hcl/json/didyoumean.go
new file mode 100644
index 0000000..fbdd8bf
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/json/didyoumean.go
@@ -0,0 +1,33 @@
+package json
+
+import (
+        "github.com/agext/levenshtein"
+)
+
+var keywords = []string{"false", "true", "null"}
+
+// keywordSuggestion tries to find a valid JSON keyword that is close to the
+// given string and returns it if found. If no keyword is close enough, returns
+// the empty string.
+func keywordSuggestion(given string) string {
+        return nameSuggestion(given, keywords)
+}
+
+// nameSuggestion tries to find a name from the given slice of suggested names
+// that is close to the given name and returns it if found. If no suggestion
+// is close enough, returns the empty string.
+//
+// The suggestions are tried in order, so earlier suggestions take precedence
+// if the given string is similar to two or more suggestions.
+//
+// This function is intended to be used with a relatively-small number of
+// suggestions. It's not optimized for hundreds or thousands of them.
+func nameSuggestion(given string, suggestions []string) string {
+        for _, suggestion := range suggestions {
+                dist := levenshtein.Distance(given, suggestion, nil)
+                if dist < 3 { // threshold determined experimentally
+                        return suggestion
+                }
+        }
+        return ""
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/json/doc.go b/vendor/github.com/hashicorp/hcl2/hcl/json/doc.go
new file mode 100644
index 0000000..4943f9b
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/json/doc.go
@@ -0,0 +1,8 @@
+// Package json is the JSON parser for HCL. It parses JSON files and returns
+// implementations of the core HCL structural interfaces in terms of the
+// JSON data inside.
+//
+// This is not a generic JSON parser. Instead, it deals with the mapping from
+// the JSON information model to the HCL information model, using a number
+// of hard-coded structural conventions.
+package json
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/json/navigation.go b/vendor/github.com/hashicorp/hcl2/hcl/json/navigation.go
new file mode 100644
index 0000000..bc8a97f
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/json/navigation.go
@@ -0,0 +1,70 @@
+package json
+
+import (
+        "fmt"
+        "strings"
+)
+
+type navigation struct {
+        root node
+}
+
+// Implementation of hcled.ContextString
+func (n navigation) ContextString(offset int) string {
+        steps := navigationStepsRev(n.root, offset)
+        if steps == nil {
+                return ""
+        }
+
+        // We built our slice backwards, so we'll reverse it in-place now.
+        half := len(steps) / 2 // integer division
+        for i := 0; i < half; i++ {
+                steps[i], steps[len(steps)-1-i] = steps[len(steps)-1-i], steps[i]
+        }
+
+        ret := strings.Join(steps, "")
+        if len(ret) > 0 && ret[0] == '.' {
+                ret = ret[1:]
+        }
+        return ret
+}
+
+func navigationStepsRev(v node, offset int) []string {
+        switch tv := v.(type) {
+        case *objectVal:
+                // Do any of our properties have an object that contains the target
+                // offset?
+                for _, attr := range tv.Attrs {
+                        k := attr.Name
+                        av := attr.Value
+
+                        switch av.(type) {
+                        case *objectVal, *arrayVal:
+                                // okay
+                        default:
+                                continue
+                        }
+
+                        if av.Range().ContainsOffset(offset) {
+                                return append(navigationStepsRev(av, offset), "."+k)
+                        }
+                }
+        case *arrayVal:
+                // Do any of our elements contain the target offset?
+                for i, elem := range tv.Values {
+
+                        switch elem.(type) {
+                        case *objectVal, *arrayVal:
+                                // okay
+                        default:
+                                continue
+                        }
+
+                        if elem.Range().ContainsOffset(offset) {
+                                return append(navigationStepsRev(elem, offset), fmt.Sprintf("[%d]", i))
+                        }
+                }
+        }
+
+        return nil
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/json/parser.go b/vendor/github.com/hashicorp/hcl2/hcl/json/parser.go
new file mode 100644
index 0000000..246fd1c
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/json/parser.go
@@ -0,0 +1,491 @@
+package json
+
+import (
+        "encoding/json"
+        "fmt"
+        "math/big"
+
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+func parseFileContent(buf []byte, filename string) (node, hcl.Diagnostics) {
+        tokens := scan(buf, pos{
+                Filename: filename,
+                Pos: hcl.Pos{
+                        Byte:   0,
+                        Line:   1,
+                        Column: 1,
+                },
+        })
+        p := newPeeker(tokens)
+        node, diags := parseValue(p)
+        if len(diags) == 0 && p.Peek().Type != tokenEOF {
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Extraneous data after value",
+                        Detail:   "Extra characters appear after the JSON value.",
+                        Subject:  p.Peek().Range.Ptr(),
+                })
+        }
+        return node, diags
+}
+
+func parseValue(p *peeker) (node, hcl.Diagnostics) {
+        tok := p.Peek()
+
+        wrapInvalid := func(n node, diags hcl.Diagnostics) (node, hcl.Diagnostics) {
+                if n != nil {
+                        return n, diags
+                }
+                return invalidVal{tok.Range}, diags
+        }
+
+        switch tok.Type {
+        case tokenBraceO:
+                return wrapInvalid(parseObject(p))
+        case tokenBrackO:
+                return wrapInvalid(parseArray(p))
+        case tokenNumber:
+                return wrapInvalid(parseNumber(p))
+        case tokenString:
+                return wrapInvalid(parseString(p))
+        case tokenKeyword:
+                return wrapInvalid(parseKeyword(p))
+        case tokenBraceC:
+                return wrapInvalid(nil, hcl.Diagnostics{
+                        {
+                                Severity: hcl.DiagError,
+                                Summary:  "Missing attribute value",
+                                Detail:   "A JSON value must start with a brace, a bracket, a number, a string, or a keyword.",
+                                Subject:  &tok.Range,
+                        },
+                })
+        case tokenBrackC:
+                return wrapInvalid(nil, hcl.Diagnostics{
+                        {
+                                Severity: hcl.DiagError,
+                                Summary:  "Missing array element value",
+                                Detail:   "A JSON value must start with a brace, a bracket, a number, a string, or a keyword.",
+                                Subject:  &tok.Range,
+                        },
+                })
+        case tokenEOF:
+                return wrapInvalid(nil, hcl.Diagnostics{
+                        {
+                                Severity: hcl.DiagError,
+                                Summary:  "Missing value",
+                                Detail:   "The JSON data ends prematurely.",
+                                Subject:  &tok.Range,
+                        },
+                })
+        default:
+                return wrapInvalid(nil, hcl.Diagnostics{
+                        {
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid start of value",
+                                Detail:   "A JSON value must start with a brace, a bracket, a number, a string, or a keyword.",
+                                Subject:  &tok.Range,
+                        },
+                })
+        }
+}
+
+func tokenCanStartValue(tok token) bool {
+        switch tok.Type {
+        case tokenBraceO, tokenBrackO, tokenNumber, tokenString, tokenKeyword:
+                return true
+        default:
+                return false
+        }
+}
+
+func parseObject(p *peeker) (node, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+
+        open := p.Read()
+        attrs := []*objectAttr{}
+
+        // recover is used to shift the peeker to what seems to be the end of
+        // our object, so that when we encounter an error we leave the peeker
+        // at a reasonable point in the token stream to continue parsing.
+        recover := func(tok token) {
+                open := 1
+                for {
+                        switch tok.Type {
+                        case tokenBraceO:
+                                open++
+                        case tokenBraceC:
+                                open--
+                                if open <= 1 {
+                                        return
+                                }
+                        case tokenEOF:
+                                // Ran out of source before we were able to recover,
+                                // so we'll bail here and let the caller deal with it.
+                                return
+                        }
+                        tok = p.Read()
+                }
+        }
+
+Token:
+        for {
+                if p.Peek().Type == tokenBraceC {
+                        break Token
+                }
+
+                keyNode, keyDiags := parseValue(p)
+                diags = diags.Extend(keyDiags)
+                if keyNode == nil {
+                        return nil, diags
+                }
+
+                keyStrNode, ok := keyNode.(*stringVal)
+                if !ok {
+                        return nil, diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid object attribute name",
+                                Detail:   "A JSON object attribute name must be a string",
+                                Subject:  keyNode.StartRange().Ptr(),
+                        })
+                }
+
+                key := keyStrNode.Value
+
+                colon := p.Read()
+                if colon.Type != tokenColon {
+                        recover(colon)
+
+                        if colon.Type == tokenBraceC || colon.Type == tokenComma {
+                                // Catch common mistake of using braces instead of brackets
+                                // for an object.
+                                return nil, diags.Append(&hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Missing object value",
+                                        Detail:   "A JSON object attribute must have a value, introduced by a colon.",
+                                        Subject:  &colon.Range,
+                                })
+                        }
+
+                        if colon.Type == tokenEquals {
+                                // Possible confusion with native HCL syntax.
+                                return nil, diags.Append(&hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Missing attribute value colon",
+                                        Detail:   "JSON uses a colon as its name/value delimiter, not an equals sign.",
+                                        Subject:  &colon.Range,
+                                })
+                        }
+
+                        return nil, diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Missing attribute value colon",
+                                Detail:   "A colon must appear between an object attribute's name and its value.",
+                                Subject:  &colon.Range,
+                        })
+                }
+
+                valNode, valDiags := parseValue(p)
+                diags = diags.Extend(valDiags)
+                if valNode == nil {
+                        return nil, diags
+                }
+
+                attrs = append(attrs, &objectAttr{
+                        Name:      key,
+                        Value:     valNode,
+                        NameRange: keyStrNode.SrcRange,
+                })
+
+                switch p.Peek().Type {
+                case tokenComma:
+                        comma := p.Read()
+                        if p.Peek().Type == tokenBraceC {
+                                // Special error message for this common mistake
+                                return nil, diags.Append(&hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Trailing comma in object",
+                                        Detail:   "JSON does not permit a trailing comma after the final attribute in an object.",
+                                        Subject:  &comma.Range,
+                                })
+                        }
+                        continue Token
+                case tokenEOF:
+                        return nil, diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Unclosed object",
+                                Detail:   "No closing brace was found for this JSON object.",
+                                Subject:  &open.Range,
+                        })
+                case tokenBrackC:
+                        // Consume the bracket anyway, so that we don't return with the peeker
+                        // at a strange place.
+                        p.Read()
+                        return nil, diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Mismatched braces",
+                                Detail:   "A JSON object must be closed with a brace, not a bracket.",
+                                Subject:  p.Peek().Range.Ptr(),
+                        })
+                case tokenBraceC:
+                        break Token
+                default:
+                        recover(p.Read())
+                        return nil, diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Missing attribute seperator comma",
+                                Detail:   "A comma must appear between each attribute declaration in an object.",
+                                Subject:  p.Peek().Range.Ptr(),
+                        })
+                }
+
+        }
+
+        close := p.Read()
+        return &objectVal{
+                Attrs:      attrs,
+                SrcRange:   hcl.RangeBetween(open.Range, close.Range),
+                OpenRange:  open.Range,
+                CloseRange: close.Range,
+        }, diags
+}
+
+func parseArray(p *peeker) (node, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+
+        open := p.Read()
+        vals := []node{}
+
+        // recover is used to shift the peeker to what seems to be the end of
+        // our array, so that when we encounter an error we leave the peeker
+        // at a reasonable point in the token stream to continue parsing.
+        recover := func(tok token) {
+                open := 1
+                for {
+                        switch tok.Type {
+                        case tokenBrackO:
+                                open++
+                        case tokenBrackC:
+                                open--
+                                if open <= 1 {
+                                        return
+                                }
+                        case tokenEOF:
+                                // Ran out of source before we were able to recover,
+                                // so we'll bail here and let the caller deal with it.
+                                return
+                        }
+                        tok = p.Read()
+                }
+        }
+
+Token:
+        for {
+                if p.Peek().Type == tokenBrackC {
+                        break Token
+                }
+
+                valNode, valDiags := parseValue(p)
+                diags = diags.Extend(valDiags)
+                if valNode == nil {
+                        return nil, diags
+                }
+
+                vals = append(vals, valNode)
+
+                switch p.Peek().Type {
+                case tokenComma:
+                        comma := p.Read()
+                        if p.Peek().Type == tokenBrackC {
+                                // Special error message for this common mistake
+                                return nil, diags.Append(&hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Trailing comma in array",
+                                        Detail:   "JSON does not permit a trailing comma after the final attribute in an array.",
+                                        Subject:  &comma.Range,
+                                })
+                        }
+                        continue Token
+                case tokenColon:
+                        recover(p.Read())
+                        return nil, diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid array value",
+                                Detail:   "A colon is not used to introduce values in a JSON array.",
+                                Subject:  p.Peek().Range.Ptr(),
+                        })
+                case tokenEOF:
+                        recover(p.Read())
+                        return nil, diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Unclosed object",
+                                Detail:   "No closing bracket was found for this JSON array.",
+                                Subject:  &open.Range,
+                        })
+                case tokenBraceC:
+                        recover(p.Read())
+                        return nil, diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Mismatched brackets",
+                                Detail:   "A JSON array must be closed with a bracket, not a brace.",
+                                Subject:  p.Peek().Range.Ptr(),
+                        })
+                case tokenBrackC:
+                        break Token
+                default:
+                        recover(p.Read())
+                        return nil, diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Missing attribute seperator comma",
+                                Detail:   "A comma must appear between each value in an array.",
+                                Subject:  p.Peek().Range.Ptr(),
+                        })
+                }
+
+        }
+
+        close := p.Read()
+        return &arrayVal{
+                Values:    vals,
+                SrcRange:  hcl.RangeBetween(open.Range, close.Range),
+                OpenRange: open.Range,
+        }, diags
+}
+
+func parseNumber(p *peeker) (node, hcl.Diagnostics) {
+        tok := p.Read()
+
+        // Use encoding/json to validate the number syntax.
+        // TODO: Do this more directly to produce better diagnostics.
+        var num json.Number
+        err := json.Unmarshal(tok.Bytes, &num)
+        if err != nil {
+                return nil, hcl.Diagnostics{
+                        {
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid JSON number",
+                                Detail:   fmt.Sprintf("There is a syntax error in the given JSON number."),
+                                Subject:  &tok.Range,
+                        },
+                }
+        }
+
+        f, _, err := big.ParseFloat(string(num), 10, 512, big.ToNearestEven)
+        if err != nil {
+                // Should never happen if above passed, since JSON numbers are a subset
+                // of what big.Float can parse...
+                return nil, hcl.Diagnostics{
+                        {
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid JSON number",
+                                Detail:   fmt.Sprintf("There is a syntax error in the given JSON number."),
+                                Subject:  &tok.Range,
+                        },
+                }
+        }
+
+        return &numberVal{
+                Value:    f,
+                SrcRange: tok.Range,
+        }, nil
+}
+
+func parseString(p *peeker) (node, hcl.Diagnostics) {
+        tok := p.Read()
+        var str string
+        err := json.Unmarshal(tok.Bytes, &str)
+
+        if err != nil {
+                var errRange hcl.Range
+                if serr, ok := err.(*json.SyntaxError); ok {
+                        errOfs := serr.Offset
+                        errPos := tok.Range.Start
+                        errPos.Byte += int(errOfs)
+
+                        // TODO: Use the byte offset to properly count unicode
+                        // characters for the column, and mark the whole of the
+                        // character that was wrong as part of our range.
+                        errPos.Column += int(errOfs)
+
+                        errEndPos := errPos
+                        errEndPos.Byte++
+                        errEndPos.Column++
+
+                        errRange = hcl.Range{
+                                Filename: tok.Range.Filename,
+                                Start:    errPos,
+                                End:      errEndPos,
+                        }
+                } else {
+                        errRange = tok.Range
+                }
+
+                var contextRange *hcl.Range
+                if errRange != tok.Range {
+                        contextRange = &tok.Range
+                }
+
+                // FIXME: Eventually we should parse strings directly here so
+                // we can produce a more useful error message in the face fo things
+                // such as invalid escapes, etc.
+                return nil, hcl.Diagnostics{
+                        {
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid JSON string",
+                                Detail:   fmt.Sprintf("There is a syntax error in the given JSON string."),
+                                Subject:  &errRange,
+                                Context:  contextRange,
+                        },
+                }
+        }
+
+        return &stringVal{
+                Value:    str,
+                SrcRange: tok.Range,
+        }, nil
+}
+
+func parseKeyword(p *peeker) (node, hcl.Diagnostics) {
+        tok := p.Read()
+        s := string(tok.Bytes)
+
+        switch s {
+        case "true":
+                return &booleanVal{
+                        Value:    true,
+                        SrcRange: tok.Range,
+                }, nil
+        case "false":
+                return &booleanVal{
+                        Value:    false,
+                        SrcRange: tok.Range,
+                }, nil
+        case "null":
+                return &nullVal{
+                        SrcRange: tok.Range,
+                }, nil
+        case "undefined", "NaN", "Infinity":
+                return nil, hcl.Diagnostics{
+                        {
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid JSON keyword",
+                                Detail:   fmt.Sprintf("The JavaScript identifier %q cannot be used in JSON.", s),
+                                Subject:  &tok.Range,
+                        },
+                }
+        default:
+                var dym string
+                if suggest := keywordSuggestion(s); suggest != "" {
+                        dym = fmt.Sprintf(" Did you mean %q?", suggest)
+                }
+
+                return nil, hcl.Diagnostics{
+                        {
+                                Severity: hcl.DiagError,
+                                Summary:  "Invalid JSON keyword",
+                                Detail:   fmt.Sprintf("%q is not a valid JSON keyword.%s", s, dym),
+                                Subject:  &tok.Range,
+                        },
+                }
+        }
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/json/peeker.go b/vendor/github.com/hashicorp/hcl2/hcl/json/peeker.go
new file mode 100644
index 0000000..fc7bbf5
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/json/peeker.go
@@ -0,0 +1,25 @@
+package json
+
+type peeker struct {
+        tokens []token
+        pos    int
+}
+
+func newPeeker(tokens []token) *peeker {
+        return &peeker{
+                tokens: tokens,
+                pos:    0,
+        }
+}
+
+func (p *peeker) Peek() token {
+        return p.tokens[p.pos]
+}
+
+func (p *peeker) Read() token {
+        ret := p.tokens[p.pos]
+        if ret.Type != tokenEOF {
+                p.pos++
+        }
+        return ret
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/json/public.go b/vendor/github.com/hashicorp/hcl2/hcl/json/public.go
new file mode 100644
index 0000000..2728aa1
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/json/public.go
@@ -0,0 +1,94 @@
+package json
+
+import (
+        "fmt"
+        "io/ioutil"
+        "os"
+
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+// Parse attempts to parse the given buffer as JSON and, if successful, returns
+// a hcl.File for the HCL configuration represented by it.
+//
+// This is not a generic JSON parser. Instead, it deals only with the profile
+// of JSON used to express HCL configuration.
+//
+// The returned file is valid only if the returned diagnostics returns false
+// from its HasErrors method. If HasErrors returns true, the file represents
+// the subset of data that was able to be parsed, which may be none.
+func Parse(src []byte, filename string) (*hcl.File, hcl.Diagnostics) {
+        rootNode, diags := parseFileContent(src, filename)
+
+        switch rootNode.(type) {
+        case *objectVal, *arrayVal:
+                // okay
+        default:
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Root value must be object",
+                        Detail:   "The root value in a JSON-based configuration must be either a JSON object or a JSON array of objects.",
+                        Subject:  rootNode.StartRange().Ptr(),
+                })
+
+                // Since we've already produced an error message for this being
+                // invalid, we'll return an empty placeholder here so that trying to
+                // extract content from our root body won't produce a redundant
+                // error saying the same thing again in more general terms.
+                fakePos := hcl.Pos{
+                        Byte:   0,
+                        Line:   1,
+                        Column: 1,
+                }
+                fakeRange := hcl.Range{
+                        Filename: filename,
+                        Start:    fakePos,
+                        End:      fakePos,
+                }
+                rootNode = &objectVal{
+                        Attrs:     []*objectAttr{},
+                        SrcRange:  fakeRange,
+                        OpenRange: fakeRange,
+                }
+        }
+
+        file := &hcl.File{
+                Body: &body{
+                        val: rootNode,
+                },
+                Bytes: src,
+                Nav:   navigation{rootNode},
+        }
+        return file, diags
+}
+
+// ParseFile is a convenience wrapper around Parse that first attempts to load
+// data from the given filename, passing the result to Parse if successful.
+//
+// If the file cannot be read, an error diagnostic with nil context is returned.
+func ParseFile(filename string) (*hcl.File, hcl.Diagnostics) {
+        f, err := os.Open(filename)
+        if err != nil {
+                return nil, hcl.Diagnostics{
+                        {
+                                Severity: hcl.DiagError,
+                                Summary:  "Failed to open file",
+                                Detail:   fmt.Sprintf("The file %q could not be opened.", filename),
+                        },
+                }
+        }
+        defer f.Close()
+
+        src, err := ioutil.ReadAll(f)
+        if err != nil {
+                return nil, hcl.Diagnostics{
+                        {
+                                Severity: hcl.DiagError,
+                                Summary:  "Failed to read file",
+                                Detail:   fmt.Sprintf("The file %q was opened, but an error occured while reading it.", filename),
+                        },
+                }
+        }
+
+        return Parse(src, filename)
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/json/scanner.go b/vendor/github.com/hashicorp/hcl2/hcl/json/scanner.go
new file mode 100644
index 0000000..0a8378b
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/json/scanner.go
@@ -0,0 +1,293 @@
+package json
+
+import (
+        "fmt"
+
+        "github.com/apparentlymart/go-textseg/textseg"
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+//go:generate stringer -type tokenType scanner.go
+type tokenType rune
+
+const (
+        tokenBraceO  tokenType = '{'
+        tokenBraceC  tokenType = '}'
+        tokenBrackO  tokenType = '['
+        tokenBrackC  tokenType = ']'
+        tokenComma   tokenType = ','
+        tokenColon   tokenType = ':'
+        tokenKeyword tokenType = 'K'
+        tokenString  tokenType = 'S'
+        tokenNumber  tokenType = 'N'
+        tokenEOF     tokenType = '␄'
+        tokenInvalid tokenType = 0
+        tokenEquals  tokenType = '=' // used only for reminding the user of JSON syntax
+)
+
+type token struct {
+        Type  tokenType
+        Bytes []byte
+        Range hcl.Range
+}
+
+// scan returns the primary tokens for the given JSON buffer in sequence.
+//
+// The responsibility of this pass is to just mark the slices of the buffer
+// as being of various types. It is lax in how it interprets the multi-byte
+// token types keyword, string and number, preferring to capture erroneous
+// extra bytes that we presume the user intended to be part of the token
+// so that we can generate more helpful diagnostics in the parser.
+func scan(buf []byte, start pos) []token {
+        var tokens []token
+        p := start
+        for {
+                if len(buf) == 0 {
+                        tokens = append(tokens, token{
+                                Type:  tokenEOF,
+                                Bytes: nil,
+                                Range: posRange(p, p),
+                        })
+                        return tokens
+                }
+
+                buf, p = skipWhitespace(buf, p)
+
+                if len(buf) == 0 {
+                        tokens = append(tokens, token{
+                                Type:  tokenEOF,
+                                Bytes: nil,
+                                Range: posRange(p, p),
+                        })
+                        return tokens
+                }
+
+                start = p
+
+                first := buf[0]
+                switch {
+                case first == '{' || first == '}' || first == '[' || first == ']' || first == ',' || first == ':' || first == '=':
+                        p.Pos.Column++
+                        p.Pos.Byte++
+                        tokens = append(tokens, token{
+                                Type:  tokenType(first),
+                                Bytes: buf[0:1],
+                                Range: posRange(start, p),
+                        })
+                        buf = buf[1:]
+                case first == '"':
+                        var tokBuf []byte
+                        tokBuf, buf, p = scanString(buf, p)
+                        tokens = append(tokens, token{
+                                Type:  tokenString,
+                                Bytes: tokBuf,
+                                Range: posRange(start, p),
+                        })
+                case byteCanStartNumber(first):
+                        var tokBuf []byte
+                        tokBuf, buf, p = scanNumber(buf, p)
+                        tokens = append(tokens, token{
+                                Type:  tokenNumber,
+                                Bytes: tokBuf,
+                                Range: posRange(start, p),
+                        })
+                case byteCanStartKeyword(first):
+                        var tokBuf []byte
+                        tokBuf, buf, p = scanKeyword(buf, p)
+                        tokens = append(tokens, token{
+                                Type:  tokenKeyword,
+                                Bytes: tokBuf,
+                                Range: posRange(start, p),
+                        })
+                default:
+                        tokens = append(tokens, token{
+                                Type:  tokenInvalid,
+                                Bytes: buf[:1],
+                                Range: start.Range(1, 1),
+                        })
+                        // If we've encountered an invalid then we might as well stop
+                        // scanning since the parser won't proceed beyond this point.
+                        return tokens
+                }
+        }
+}
+
+func byteCanStartNumber(b byte) bool {
+        switch b {
+        // We are slightly more tolerant than JSON requires here since we
+        // expect the parser will make a stricter interpretation of the
+        // number bytes, but we specifically don't allow 'e' or 'E' here
+        // since we want the scanner to treat that as the start of an
+        // invalid keyword instead, to produce more intelligible error messages.
+        case '-', '+', '.', '0', '1', '2', '3', '4', '5', '6', '7', '8', '9':
+                return true
+        default:
+                return false
+        }
+}
+
+func scanNumber(buf []byte, start pos) ([]byte, []byte, pos) {
+        // The scanner doesn't check that the sequence of digit-ish bytes is
+        // in a valid order. The parser must do this when decoding a number
+        // token.
+        var i int
+        p := start
+Byte:
+        for i = 0; i < len(buf); i++ {
+                switch buf[i] {
+                case '-', '+', '.', 'e', 'E', '0', '1', '2', '3', '4', '5', '6', '7', '8', '9':
+                        p.Pos.Byte++
+                        p.Pos.Column++
+                default:
+                        break Byte
+                }
+        }
+        return buf[:i], buf[i:], p
+}
+
+func byteCanStartKeyword(b byte) bool {
+        switch {
+        // We allow any sequence of alphabetical characters here, even though
+        // JSON is more constrained, so that we can collect what we presume
+        // the user intended to be a single keyword and then check its validity
+        // in the parser, where we can generate better diagnostics.
+        // So e.g. we want to be able to say:
+        //   unrecognized keyword "True". Did you mean "true"?
+        case b >= 'a' || b <= 'z' || b >= 'A' || b <= 'Z':
+                return true
+        default:
+                return false
+        }
+}
+
+func scanKeyword(buf []byte, start pos) ([]byte, []byte, pos) {
+        var i int
+        p := start
+Byte:
+        for i = 0; i < len(buf); i++ {
+                b := buf[i]
+                switch {
+                case (b >= 'a' && b <= 'z') || (b >= 'A' && b <= 'Z') || b == '_':
+                        p.Pos.Byte++
+                        p.Pos.Column++
+                default:
+                        break Byte
+                }
+        }
+        return buf[:i], buf[i:], p
+}
+
+func scanString(buf []byte, start pos) ([]byte, []byte, pos) {
+        // The scanner doesn't validate correct use of escapes, etc. It pays
+        // attention to escapes only for the purpose of identifying the closing
+        // quote character. It's the parser's responsibility to do proper
+        // validation.
+        //
+        // The scanner also doesn't specifically detect unterminated string
+        // literals, though they can be identified in the parser by checking if
+        // the final byte in a string token is the double-quote character.
+
+        // Skip the opening quote symbol
+        i := 1
+        p := start
+        p.Pos.Byte++
+        p.Pos.Column++
+        escaping := false
+Byte:
+        for i < len(buf) {
+                b := buf[i]
+
+                switch {
+                case b == '\\':
+                        escaping = !escaping
+                        p.Pos.Byte++
+                        p.Pos.Column++
+                        i++
+                case b == '"':
+                        p.Pos.Byte++
+                        p.Pos.Column++
+                        i++
+                        if !escaping {
+                                break Byte
+                        }
+                        escaping = false
+                case b < 32:
+                        break Byte
+                default:
+                        // Advance by one grapheme cluster, so that we consider each
+                        // grapheme to be a "column".
+                        // Ignoring error because this scanner cannot produce errors.
+                        advance, _, _ := textseg.ScanGraphemeClusters(buf[i:], true)
+
+                        p.Pos.Byte += advance
+                        p.Pos.Column++
+                        i += advance
+
+                        escaping = false
+                }
+        }
+        return buf[:i], buf[i:], p
+}
+
+func skipWhitespace(buf []byte, start pos) ([]byte, pos) {
+        var i int
+        p := start
+Byte:
+        for i = 0; i < len(buf); i++ {
+                switch buf[i] {
+                case ' ':
+                        p.Pos.Byte++
+                        p.Pos.Column++
+                case '\n':
+                        p.Pos.Byte++
+                        p.Pos.Column = 1
+                        p.Pos.Line++
+                case '\r':
+                        // For the purpose of line/column counting we consider a
+                        // carriage return to take up no space, assuming that it will
+                        // be paired up with a newline (on Windows, for example) that
+                        // will account for both of them.
+                        p.Pos.Byte++
+                case '\t':
+                        // We arbitrarily count a tab as if it were two spaces, because
+                        // we need to choose _some_ number here. This means any system
+                        // that renders code on-screen with markers must itself treat
+                        // tabs as a pair of spaces for rendering purposes, or instead
+                        // use the byte offset and back into its own column position.
+                        p.Pos.Byte++
+                        p.Pos.Column += 2
+                default:
+                        break Byte
+                }
+        }
+        return buf[i:], p
+}
+
+type pos struct {
+        Filename string
+        Pos      hcl.Pos
+}
+
+func (p *pos) Range(byteLen, charLen int) hcl.Range {
+        start := p.Pos
+        end := p.Pos
+        end.Byte += byteLen
+        end.Column += charLen
+        return hcl.Range{
+                Filename: p.Filename,
+                Start:    start,
+                End:      end,
+        }
+}
+
+func posRange(start, end pos) hcl.Range {
+        return hcl.Range{
+                Filename: start.Filename,
+                Start:    start.Pos,
+                End:      end.Pos,
+        }
+}
+
+func (t token) GoString() string {
+        return fmt.Sprintf("json.token{json.%s, []byte(%q), %#v}", t.Type, t.Bytes, t.Range)
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/json/spec.md b/vendor/github.com/hashicorp/hcl2/hcl/json/spec.md
new file mode 100644
index 0000000..9b33c7f
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/json/spec.md
@@ -0,0 +1,405 @@
+# HCL JSON Syntax Specification
+
+This is the specification for the JSON serialization for hcl. HCL is a system
+for defining configuration languages for applications. The HCL information
+model is designed to support multiple concrete syntaxes for configuration,
+and this JSON-based format complements [the native syntax](../hclsyntax/spec.md)
+by being easy to machine-generate, whereas the native syntax is oriented
+towards human authoring and maintenence.
+
+This syntax is defined in terms of JSON as defined in
+[RFC7159](https://tools.ietf.org/html/rfc7159). As such it inherits the JSON
+grammar as-is, and merely defines a specific methodology for interpreting
+JSON constructs into HCL structural elements and expressions.
+
+This mapping is defined such that valid JSON-serialized HCL input can be
+_produced_ using standard JSON implementations in various programming languages.
+_Parsing_ such JSON has some additional constraints not beyond what is normally
+supported by JSON parsers, so a specialized parser may be required that
+is able to:
+
+* Preserve the relative ordering of properties defined in an object.
+* Preserve multiple definitions of the same property name.
+* Preserve numeric values to the precision required by the number type
+  in [the HCL syntax-agnostic information model](../spec.md).
+* Retain source location information for parsed tokens/constructs in order
+  to produce good error messages.
+
+## Structural Elements
+
+[The HCL syntax-agnostic information model](../spec.md) defines a _body_ as an
+abstract container for attribute definitions and child blocks. A body is
+represented in JSON as either a single JSON object or a JSON array of objects.
+
+Body processing is in terms of JSON object properties, visited in the order
+they appear in the input. Where a body is represented by a single JSON object,
+the properties of that object are visited in order. Where a body is
+represented by a JSON array, each of its elements are visited in order and
+each element has its properties visited in order. If any element of the array
+is not a JSON object then the input is erroneous.
+
+When a body is being processed in the _dynamic attributes_ mode, the allowance
+of a JSON array in the previous paragraph does not apply and instead a single
+JSON object is always required.
+
+As defined in the language-agnostic model, body processing is in terms
+of a schema which provides context for interpreting the body's content. For
+JSON bodies, the schema is crucial to allow differentiation of attribute
+definitions and block definitions, both of which are represented via object
+properties.
+
+The special property name `"//"`, when used in an object representing a HCL
+body, is parsed and ignored. A property with this name can be used to
+include human-readable comments. (This special property name is _not_
+processed in this way for any _other_ HCL constructs that are represented as
+JSON objects.)
+
+### Attributes
+
+Where the given schema describes an attribute with a given name, the object
+property with the matching name — if present — serves as the attribute's
+definition.
+
+When a body is being processed in the _dynamic attributes_ mode, each object
+property serves as an attribute definition for the attribute whose name
+matches the property name.
+
+The value of an attribute definition property is interpreted as an _expression_,
+as described in a later section.
+
+Given a schema that calls for an attribute named "foo", a JSON object like
+the following provides a definition for that attribute:
+
+```json
+{
+  "foo": "bar baz"
+}
+```
+
+### Blocks
+
+Where the given schema describes a block with a given type name, each object
+property with the matching name serves as a definition of zero or more blocks
+of that type.
+
+Processing of child blocks is in terms of nested JSON objects and arrays.
+If the schema defines one or more _labels_ for the block type, a nested JSON
+object or JSON array of objects is required for each labelling level. These
+are flattened to a single ordered sequence of object properties using the
+same algorithm as for body content as defined above. Each object property
+serves as a label value at the corresponding level.
+
+After any labelling levels, the next nested value is either a JSON object
+representing a single block body, or a JSON array of JSON objects that each
+represent a single block body. Use of an array accommodates the definition
+of multiple blocks that have identical type and labels.
+
+Given a schema that calls for a block type named "foo" with no labels, the
+following JSON objects are all valid definitions of zero or more blocks of this
+type:
+
+```json
+{
+  "foo": {
+    "child_attr": "baz"
+  }
+}
+```
+
+```json
+{
+  "foo": [
+    {
+      "child_attr": "baz"
+    },
+    {
+      "child_attr": "boz"
+    }
+  ]
+}
+```
+```json
+{
+  "foo": []
+}
+```
+
+The first of these defines a single child block of type "foo". The second
+defines _two_ such blocks. The final example shows a degenerate definition
+of zero blocks, though generators should prefer to omit the property entirely
+in this scenario.
+
+Given a schema that calls for a block type named "foo" with _two_ labels, the
+extra label levels must be represented as objects or arrays of objects as in
+the following examples:
+
+```json
+{
+  "foo": {
+    "bar": {
+      "baz": {
+        "child_attr": "baz"
+      },
+      "boz": {
+        "child_attr": "baz"
+      }
+    },
+    "boz": {
+      "baz": {
+        "child_attr": "baz"
+      },
+    }
+  }
+}
+```
+
+```json
+{
+  "foo": {
+    "bar": {
+      "baz": {
+        "child_attr": "baz"
+      },
+      "boz": {
+        "child_attr": "baz"
+      }
+    },
+    "boz": {
+      "baz": [
+        {
+          "child_attr": "baz"
+        },
+        {
+          "child_attr": "boz"
+        }
+      ]
+    }
+  }
+}
+```
+
+```json
+{
+  "foo": [
+    {
+      "bar": {
+        "baz": {
+          "child_attr": "baz"
+        },
+        "boz": {
+          "child_attr": "baz"
+        }
+      },
+    },
+    {
+      "bar": {
+        "baz": [
+          {
+            "child_attr": "baz"
+          },
+          {
+            "child_attr": "boz"
+          }
+        ]
+      }
+    }
+  ]
+}
+```
+
+```json
+{
+  "foo": {
+    "bar": {
+      "baz": {
+        "child_attr": "baz"
+      },
+      "boz": {
+        "child_attr": "baz"
+      }
+    },
+    "bar": {
+      "baz": [
+        {
+          "child_attr": "baz"
+        },
+        {
+          "child_attr": "boz"
+        }
+      ]
+    }
+  }
+}
+```
+
+Arrays can be introduced at either the label definition or block body
+definition levels to define multiple definitions of the same block type
+or labels while preserving order.
+
+A JSON HCL parser _must_ support duplicate definitions of the same property
+name within a single object, preserving all of them and the relative ordering
+between them. The array-based forms are also required so that JSON HCL
+configurations can be produced with JSON producing libraries that are not
+able to preserve property definition order and multiple definitions of
+the same property.
+
+## Expressions
+
+JSON lacks a native expression syntax, so the HCL JSON syntax instead defines
+a mapping for each of the JSON value types, including a special mapping for
+strings that allows optional use of arbitrary expressions.
+
+### Objects
+
+When interpreted as an expression, a JSON object represents a value of a HCL
+object type.
+
+Each property of the JSON object represents an attribute of the HCL object type.
+The property name string given in the JSON input is interpreted as a string
+expression as described below, and its result is converted to string as defined
+by the syntax-agnostic information model. If such a conversion is not possible,
+an error is produced and evaluation fails.
+
+An instance of the constructed object type is then created, whose values
+are interpreted by again recursively applying the mapping rules defined in
+this section to each of the property values.
+
+If any evaluated property name strings produce null values, an error is
+produced and evaluation fails. If any produce _unknown_ values, the _entire
+object's_ result is an unknown value of the dynamic pseudo-type, signalling
+that the type of the object cannot be determined.
+
+It is an error to define the same property name multiple times within a single
+JSON object interpreted as an expression. In full expression mode, this
+constraint applies to the name expression results after conversion to string,
+rather than the raw string that may contain interpolation expressions.
+
+### Arrays
+
+When interpreted as an expression, a JSON array represents a value of a HCL
+tuple type.
+
+Each element of the JSON array represents an element of the HCL tuple type.
+The tuple type is constructed by enumerationg the JSON array elements, creating
+for each an element whose type is the result of recursively applying the
+expression mapping rules. Correspondance is preserved between the array element
+indices and the tuple element indices.
+
+An instance of the constructed tuple type is then created, whose values are
+interpreted by again recursively applying the mapping rules defined in this
+section.
+
+### Numbers
+
+When interpreted as an expression, a JSON number represents a HCL number value.
+
+HCL numbers are arbitrary-precision decimal values, so a JSON HCL parser must
+be able to translate exactly the value given to a number of corresponding
+precision, within the constraints set by the HCL syntax-agnostic information
+model.
+
+In practice, off-the-shelf JSON serializers often do not support customizing the
+processing of numbers, and instead force processing as 32-bit or 64-bit
+floating point values.
+
+A _producer_ of JSON HCL that uses such a serializer can provide numeric values
+as JSON strings where they have precision too great for representation in the
+serializer's chosen numeric type in situations where the result will be
+converted to number (using the standard conversion rules) by a calling
+application.
+
+Alternatively, for expressions that are evaluated in full expression mode an
+embedded template interpolation can be used to faithfully represent a number,
+such as `"${1e150}"`, which will then be evaluated by the underlying HCL native
+syntax expression evaluator.
+
+### Boolean Values
+
+The JSON boolean values `true` and `false`, when interpreted as expressions,
+represent the corresponding HCL boolean values.
+
+### The Null Value
+
+The JSON value `null`, when interpreted as an expression, represents a
+HCL null value of the dynamic pseudo-type.
+
+### Strings
+
+When intepreted as an expression, a JSON string may be interpreted in one of
+two ways depending on the evaluation mode.
+
+If evaluating in literal-only mode (as defined by the syntax-agnostic
+information model) the literal string is intepreted directly as a HCL string
+value, by directly using the exact sequence of unicode characters represented.
+Template interpolations and directives MUST NOT be processed in this mode,
+allowing any characters that appear as introduction sequences to pass through
+literally:
+
+```json
+"Hello world! Template sequences like ${ are not intepreted here."
+```
+
+When evaluating in full expression mode (again, as defined by the syntax-
+agnostic information model) the literal string is instead interpreted as a
+_standalone template_ in the HCL Native Syntax. The expression evaluation
+result is then the direct result of evaluating that template with the current
+variable scope and function table.
+
+```json
+"Hello, ${name}! Template sequences are interpreted in full expression mode."
+```
+
+In particular the _Template Interpolation Unwrapping_ requirement from the
+HCL native syntax specification must be implemented, allowing the use of
+single-interpolation templates to represent expressions that would not
+otherwise be representable in JSON, such as the following example where
+the result must be a number, rather than a string representation of a number:
+
+```json
+"${ a + b }"
+```
+
+## Static Analysis
+
+The HCL static analysis operations are implemented for JSON values that
+represent expressions, as described in the following sections.
+
+Due to the limited expressive power of the JSON syntax alone, use of these
+static analyses functions rather than normal expression evaluation is used
+as additional context for how a JSON value is to be interpreted, which means
+that static analyses can result in a different interpretation of a given
+expression than normal evaluation.
+
+### Static List
+
+An expression interpreted as a static list must be a JSON array. Each of the
+values in the array is interpreted as an expression and returned.
+
+### Static Map
+
+An expression interpreted as a static map must be a JSON object. Each of the
+key/value pairs in the object is presented as a pair of expressions. Since
+object property names are always strings, evaluating the key expression with
+a non-`nil` evaluation context will evaluate any template sequences given
+in the property name.
+
+### Static Call
+
+An expression interpreted as a static call must be a string. The content of
+the string is interpreted as a native syntax expression (not a _template_,
+unlike normal evaluation) and then the static call analysis is delegated to
+that expression.
+
+If the original expression is not a string or its contents cannot be parsed
+as a native syntax expression then static call analysis is not supported.
+
+### Static Traversal
+
+An expression interpreted as a static traversal must be a string. The content
+of the string is interpreted as a native syntax expression (not a _template_,
+unlike normal evaluation) and then static traversal analysis is delegated
+to that expression.
+
+If the original expression is not a string or its contents cannot be parsed
+as a native syntax expression then static call analysis is not supported.
+
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/json/structure.go b/vendor/github.com/hashicorp/hcl2/hcl/json/structure.go
new file mode 100644
index 0000000..28dcf52
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/json/structure.go
@@ -0,0 +1,616 @@
+package json
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+)
+
+// body is the implementation of "Body" used for files processed with the JSON
+// parser.
+type body struct {
+        val node
+
+        // If non-nil, the keys of this map cause the corresponding attributes to
+        // be treated as non-existing. This is used when Body.PartialContent is
+        // called, to produce the "remaining content" Body.
+        hiddenAttrs map[string]struct{}
+}
+
+// expression is the implementation of "Expression" used for files processed
+// with the JSON parser.
+type expression struct {
+        src node
+}
+
+func (b *body) Content(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Diagnostics) {
+        content, newBody, diags := b.PartialContent(schema)
+
+        hiddenAttrs := newBody.(*body).hiddenAttrs
+
+        var nameSuggestions []string
+        for _, attrS := range schema.Attributes {
+                if _, ok := hiddenAttrs[attrS.Name]; !ok {
+                        // Only suggest an attribute name if we didn't use it already.
+                        nameSuggestions = append(nameSuggestions, attrS.Name)
+                }
+        }
+        for _, blockS := range schema.Blocks {
+                // Blocks can appear multiple times, so we'll suggest their type
+                // names regardless of whether they've already been used.
+                nameSuggestions = append(nameSuggestions, blockS.Type)
+        }
+
+        jsonAttrs, attrDiags := b.collectDeepAttrs(b.val, nil)
+        diags = append(diags, attrDiags...)
+
+        for _, attr := range jsonAttrs {
+                k := attr.Name
+                if k == "//" {
+                        // Ignore "//" keys in objects representing bodies, to allow
+                        // their use as comments.
+                        continue
+                }
+
+                if _, ok := hiddenAttrs[k]; !ok {
+                        suggestion := nameSuggestion(k, nameSuggestions)
+                        if suggestion != "" {
+                                suggestion = fmt.Sprintf(" Did you mean %q?", suggestion)
+                        }
+
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Extraneous JSON object property",
+                                Detail:   fmt.Sprintf("No attribute or block type is named %q.%s", k, suggestion),
+                                Subject:  &attr.NameRange,
+                                Context:  attr.Range().Ptr(),
+                        })
+                }
+        }
+
+        return content, diags
+}
+
+func (b *body) PartialContent(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Body, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+
+        jsonAttrs, attrDiags := b.collectDeepAttrs(b.val, nil)
+        diags = append(diags, attrDiags...)
+
+        usedNames := map[string]struct{}{}
+        if b.hiddenAttrs != nil {
+                for k := range b.hiddenAttrs {
+                        usedNames[k] = struct{}{}
+                }
+        }
+
+        content := &hcl.BodyContent{
+                Attributes: map[string]*hcl.Attribute{},
+                Blocks:     nil,
+
+                MissingItemRange: b.MissingItemRange(),
+        }
+
+        // Create some more convenient data structures for our work below.
+        attrSchemas := map[string]hcl.AttributeSchema{}
+        blockSchemas := map[string]hcl.BlockHeaderSchema{}
+        for _, attrS := range schema.Attributes {
+                attrSchemas[attrS.Name] = attrS
+        }
+        for _, blockS := range schema.Blocks {
+                blockSchemas[blockS.Type] = blockS
+        }
+
+        for _, jsonAttr := range jsonAttrs {
+                attrName := jsonAttr.Name
+                if _, used := b.hiddenAttrs[attrName]; used {
+                        continue
+                }
+
+                if attrS, defined := attrSchemas[attrName]; defined {
+                        if existing, exists := content.Attributes[attrName]; exists {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Duplicate attribute definition",
+                                        Detail:   fmt.Sprintf("The attribute %q was already defined at %s.", attrName, existing.Range),
+                                        Subject:  &jsonAttr.NameRange,
+                                        Context:  jsonAttr.Range().Ptr(),
+                                })
+                                continue
+                        }
+
+                        content.Attributes[attrS.Name] = &hcl.Attribute{
+                                Name:      attrS.Name,
+                                Expr:      &expression{src: jsonAttr.Value},
+                                Range:     hcl.RangeBetween(jsonAttr.NameRange, jsonAttr.Value.Range()),
+                                NameRange: jsonAttr.NameRange,
+                        }
+                        usedNames[attrName] = struct{}{}
+
+                } else if blockS, defined := blockSchemas[attrName]; defined {
+                        bv := jsonAttr.Value
+                        blockDiags := b.unpackBlock(bv, blockS.Type, &jsonAttr.NameRange, blockS.LabelNames, nil, nil, &content.Blocks)
+                        diags = append(diags, blockDiags...)
+                        usedNames[attrName] = struct{}{}
+                }
+
+                // We ignore anything that isn't defined because that's the
+                // PartialContent contract. The Content method will catch leftovers.
+        }
+
+        // Make sure we got all the required attributes.
+        for _, attrS := range schema.Attributes {
+                if !attrS.Required {
+                        continue
+                }
+                if _, defined := content.Attributes[attrS.Name]; !defined {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Missing required attribute",
+                                Detail:   fmt.Sprintf("The attribute %q is required, but no definition was found.", attrS.Name),
+                                Subject:  b.MissingItemRange().Ptr(),
+                        })
+                }
+        }
+
+        unusedBody := &body{
+                val:         b.val,
+                hiddenAttrs: usedNames,
+        }
+
+        return content, unusedBody, diags
+}
+
+// JustAttributes for JSON bodies interprets all properties of the wrapped
+// JSON object as attributes and returns them.
+func (b *body) JustAttributes() (hcl.Attributes, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+        attrs := make(map[string]*hcl.Attribute)
+
+        obj, ok := b.val.(*objectVal)
+        if !ok {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Incorrect JSON value type",
+                        Detail:   "A JSON object is required here, defining the attributes for this block.",
+                        Subject:  b.val.StartRange().Ptr(),
+                })
+                return attrs, diags
+        }
+
+        for _, jsonAttr := range obj.Attrs {
+                name := jsonAttr.Name
+                if name == "//" {
+                        // Ignore "//" keys in objects representing bodies, to allow
+                        // their use as comments.
+                        continue
+                }
+
+                if _, hidden := b.hiddenAttrs[name]; hidden {
+                        continue
+                }
+
+                if existing, exists := attrs[name]; exists {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Duplicate attribute definition",
+                                Detail:   fmt.Sprintf("The attribute %q was already defined at %s.", name, existing.Range),
+                                Subject:  &jsonAttr.NameRange,
+                        })
+                        continue
+                }
+
+                attrs[name] = &hcl.Attribute{
+                        Name:      name,
+                        Expr:      &expression{src: jsonAttr.Value},
+                        Range:     hcl.RangeBetween(jsonAttr.NameRange, jsonAttr.Value.Range()),
+                        NameRange: jsonAttr.NameRange,
+                }
+        }
+
+        // No diagnostics possible here, since the parser already took care of
+        // finding duplicates and every JSON value can be a valid attribute value.
+        return attrs, diags
+}
+
+func (b *body) MissingItemRange() hcl.Range {
+        switch tv := b.val.(type) {
+        case *objectVal:
+                return tv.CloseRange
+        case *arrayVal:
+                return tv.OpenRange
+        default:
+                // Should not happen in correct operation, but might show up if the
+                // input is invalid and we are producing partial results.
+                return tv.StartRange()
+        }
+}
+
+func (b *body) unpackBlock(v node, typeName string, typeRange *hcl.Range, labelsLeft []string, labelsUsed []string, labelRanges []hcl.Range, blocks *hcl.Blocks) (diags hcl.Diagnostics) {
+        if len(labelsLeft) > 0 {
+                labelName := labelsLeft[0]
+                jsonAttrs, attrDiags := b.collectDeepAttrs(v, &labelName)
+                diags = append(diags, attrDiags...)
+
+                if len(jsonAttrs) == 0 {
+                        diags = diags.Append(&hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Missing block label",
+                                Detail:   fmt.Sprintf("At least one object property is required, whose name represents the %s block's %s.", typeName, labelName),
+                                Subject:  v.StartRange().Ptr(),
+                        })
+                        return
+                }
+                labelsUsed := append(labelsUsed, "")
+                labelRanges := append(labelRanges, hcl.Range{})
+                for _, p := range jsonAttrs {
+                        pk := p.Name
+                        labelsUsed[len(labelsUsed)-1] = pk
+                        labelRanges[len(labelRanges)-1] = p.NameRange
+                        diags = append(diags, b.unpackBlock(p.Value, typeName, typeRange, labelsLeft[1:], labelsUsed, labelRanges, blocks)...)
+                }
+                return
+        }
+
+        // By the time we get here, we've peeled off all the labels and we're ready
+        // to deal with the block's actual content.
+
+        // need to copy the label slices because their underlying arrays will
+        // continue to be mutated after we return.
+        labels := make([]string, len(labelsUsed))
+        copy(labels, labelsUsed)
+        labelR := make([]hcl.Range, len(labelRanges))
+        copy(labelR, labelRanges)
+
+        switch tv := v.(type) {
+        case *objectVal:
+                // Single instance of the block
+                *blocks = append(*blocks, &hcl.Block{
+                        Type:   typeName,
+                        Labels: labels,
+                        Body: &body{
+                                val: tv,
+                        },
+
+                        DefRange:    tv.OpenRange,
+                        TypeRange:   *typeRange,
+                        LabelRanges: labelR,
+                })
+        case *arrayVal:
+                // Multiple instances of the block
+                for _, av := range tv.Values {
+                        *blocks = append(*blocks, &hcl.Block{
+                                Type:   typeName,
+                                Labels: labels,
+                                Body: &body{
+                                        val: av, // might be mistyped; we'll find out when content is requested for this body
+                                },
+
+                                DefRange:    tv.OpenRange,
+                                TypeRange:   *typeRange,
+                                LabelRanges: labelR,
+                        })
+                }
+        default:
+                diags = diags.Append(&hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Incorrect JSON value type",
+                        Detail:   fmt.Sprintf("Either a JSON object or a JSON array is required, representing the contents of one or more %q blocks.", typeName),
+                        Subject:  v.StartRange().Ptr(),
+                })
+        }
+        return
+}
+
+// collectDeepAttrs takes either a single object or an array of objects and
+// flattens it into a list of object attributes, collecting attributes from
+// all of the objects in a given array.
+//
+// Ordering is preserved, so a list of objects that each have one property
+// will result in those properties being returned in the same order as the
+// objects appeared in the array.
+//
+// This is appropriate for use only for objects representing bodies or labels
+// within a block.
+//
+// The labelName argument, if non-null, is used to tailor returned error
+// messages to refer to block labels rather than attributes and child blocks.
+// It has no other effect.
+func (b *body) collectDeepAttrs(v node, labelName *string) ([]*objectAttr, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+        var attrs []*objectAttr
+
+        switch tv := v.(type) {
+
+        case *objectVal:
+                attrs = append(attrs, tv.Attrs...)
+
+        case *arrayVal:
+                for _, ev := range tv.Values {
+                        switch tev := ev.(type) {
+                        case *objectVal:
+                                attrs = append(attrs, tev.Attrs...)
+                        default:
+                                if labelName != nil {
+                                        diags = append(diags, &hcl.Diagnostic{
+                                                Severity: hcl.DiagError,
+                                                Summary:  "Incorrect JSON value type",
+                                                Detail:   fmt.Sprintf("A JSON object is required here, to specify %s labels for this block.", *labelName),
+                                                Subject:  ev.StartRange().Ptr(),
+                                        })
+                                } else {
+                                        diags = append(diags, &hcl.Diagnostic{
+                                                Severity: hcl.DiagError,
+                                                Summary:  "Incorrect JSON value type",
+                                                Detail:   "A JSON object is required here, to define attributes and child blocks.",
+                                                Subject:  ev.StartRange().Ptr(),
+                                        })
+                                }
+                        }
+                }
+
+        default:
+                if labelName != nil {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Incorrect JSON value type",
+                                Detail:   fmt.Sprintf("Either a JSON object or JSON array of objects is required here, to specify %s labels for this block.", *labelName),
+                                Subject:  v.StartRange().Ptr(),
+                        })
+                } else {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  "Incorrect JSON value type",
+                                Detail:   "Either a JSON object or JSON array of objects is required here, to define attributes and child blocks.",
+                                Subject:  v.StartRange().Ptr(),
+                        })
+                }
+        }
+
+        return attrs, diags
+}
+
+func (e *expression) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        switch v := e.src.(type) {
+        case *stringVal:
+                if ctx != nil {
+                        // Parse string contents as a HCL native language expression.
+                        // We only do this if we have a context, so passing a nil context
+                        // is how the caller specifies that interpolations are not allowed
+                        // and that the string should just be returned verbatim.
+                        templateSrc := v.Value
+                        expr, diags := hclsyntax.ParseTemplate(
+                                []byte(templateSrc),
+                                v.SrcRange.Filename,
+
+                                // This won't produce _exactly_ the right result, since
+                                // the hclsyntax parser can't "see" any escapes we removed
+                                // while parsing JSON, but it's better than nothing.
+                                hcl.Pos{
+                                        Line: v.SrcRange.Start.Line,
+
+                                        // skip over the opening quote mark
+                                        Byte:   v.SrcRange.Start.Byte + 1,
+                                        Column: v.SrcRange.Start.Column + 1,
+                                },
+                        )
+                        if diags.HasErrors() {
+                                return cty.DynamicVal, diags
+                        }
+                        val, evalDiags := expr.Value(ctx)
+                        diags = append(diags, evalDiags...)
+                        return val, diags
+                }
+
+                return cty.StringVal(v.Value), nil
+        case *numberVal:
+                return cty.NumberVal(v.Value), nil
+        case *booleanVal:
+                return cty.BoolVal(v.Value), nil
+        case *arrayVal:
+                vals := []cty.Value{}
+                for _, jsonVal := range v.Values {
+                        val, _ := (&expression{src: jsonVal}).Value(ctx)
+                        vals = append(vals, val)
+                }
+                return cty.TupleVal(vals), nil
+        case *objectVal:
+                var diags hcl.Diagnostics
+                attrs := map[string]cty.Value{}
+                attrRanges := map[string]hcl.Range{}
+                known := true
+                for _, jsonAttr := range v.Attrs {
+                        // In this one context we allow keys to contain interpolation
+                        // experessions too, assuming we're evaluating in interpolation
+                        // mode. This achieves parity with the native syntax where
+                        // object expressions can have dynamic keys, while block contents
+                        // may not.
+                        name, nameDiags := (&expression{src: &stringVal{
+                                Value:    jsonAttr.Name,
+                                SrcRange: jsonAttr.NameRange,
+                        }}).Value(ctx)
+                        val, valDiags := (&expression{src: jsonAttr.Value}).Value(ctx)
+                        diags = append(diags, nameDiags...)
+                        diags = append(diags, valDiags...)
+
+                        var err error
+                        name, err = convert.Convert(name, cty.String)
+                        if err != nil {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Invalid object key expression",
+                                        Detail:   fmt.Sprintf("Cannot use this expression as an object key: %s.", err),
+                                        Subject:  &jsonAttr.NameRange,
+                                })
+                                continue
+                        }
+                        if name.IsNull() {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Invalid object key expression",
+                                        Detail:   "Cannot use null value as an object key.",
+                                        Subject:  &jsonAttr.NameRange,
+                                })
+                                continue
+                        }
+                        if !name.IsKnown() {
+                                // This is a bit of a weird case, since our usual rules require
+                                // us to tolerate unknowns and just represent the result as
+                                // best we can but if we don't know the key then we can't
+                                // know the type of our object at all, and thus we must turn
+                                // the whole thing into cty.DynamicVal. This is consistent with
+                                // how this situation is handled in the native syntax.
+                                // We'll keep iterating so we can collect other errors in
+                                // subsequent attributes.
+                                known = false
+                                continue
+                        }
+                        nameStr := name.AsString()
+                        if _, defined := attrs[nameStr]; defined {
+                                diags = append(diags, &hcl.Diagnostic{
+                                        Severity: hcl.DiagError,
+                                        Summary:  "Duplicate object attribute",
+                                        Detail:   fmt.Sprintf("An attribute named %q was already defined at %s.", nameStr, attrRanges[nameStr]),
+                                        Subject:  &jsonAttr.NameRange,
+                                })
+                                continue
+                        }
+                        attrs[nameStr] = val
+                        attrRanges[nameStr] = jsonAttr.NameRange
+                }
+                if !known {
+                        // We encountered an unknown key somewhere along the way, so
+                        // we can't know what our type will eventually be.
+                        return cty.DynamicVal, diags
+                }
+                return cty.ObjectVal(attrs), diags
+        default:
+                // Default to DynamicVal so that ASTs containing invalid nodes can
+                // still be partially-evaluated.
+                return cty.DynamicVal, nil
+        }
+}
+
+func (e *expression) Variables() []hcl.Traversal {
+        var vars []hcl.Traversal
+
+        switch v := e.src.(type) {
+        case *stringVal:
+                templateSrc := v.Value
+                expr, diags := hclsyntax.ParseTemplate(
+                        []byte(templateSrc),
+                        v.SrcRange.Filename,
+
+                        // This won't produce _exactly_ the right result, since
+                        // the hclsyntax parser can't "see" any escapes we removed
+                        // while parsing JSON, but it's better than nothing.
+                        hcl.Pos{
+                                Line: v.SrcRange.Start.Line,
+
+                                // skip over the opening quote mark
+                                Byte:   v.SrcRange.Start.Byte + 1,
+                                Column: v.SrcRange.Start.Column + 1,
+                        },
+                )
+                if diags.HasErrors() {
+                        return vars
+                }
+                return expr.Variables()
+
+        case *arrayVal:
+                for _, jsonVal := range v.Values {
+                        vars = append(vars, (&expression{src: jsonVal}).Variables()...)
+                }
+        case *objectVal:
+                for _, jsonAttr := range v.Attrs {
+                        vars = append(vars, (&expression{src: jsonAttr.Value}).Variables()...)
+                }
+        }
+
+        return vars
+}
+
+func (e *expression) Range() hcl.Range {
+        return e.src.Range()
+}
+
+func (e *expression) StartRange() hcl.Range {
+        return e.src.StartRange()
+}
+
+// Implementation for hcl.AbsTraversalForExpr.
+func (e *expression) AsTraversal() hcl.Traversal {
+        // In JSON-based syntax a traversal is given as a string containing
+        // traversal syntax as defined by hclsyntax.ParseTraversalAbs.
+
+        switch v := e.src.(type) {
+        case *stringVal:
+                traversal, diags := hclsyntax.ParseTraversalAbs([]byte(v.Value), v.SrcRange.Filename, v.SrcRange.Start)
+                if diags.HasErrors() {
+                        return nil
+                }
+                return traversal
+        default:
+                return nil
+        }
+}
+
+// Implementation for hcl.ExprCall.
+func (e *expression) ExprCall() *hcl.StaticCall {
+        // In JSON-based syntax a static call is given as a string containing
+        // an expression in the native syntax that also supports ExprCall.
+
+        switch v := e.src.(type) {
+        case *stringVal:
+                expr, diags := hclsyntax.ParseExpression([]byte(v.Value), v.SrcRange.Filename, v.SrcRange.Start)
+                if diags.HasErrors() {
+                        return nil
+                }
+
+                call, diags := hcl.ExprCall(expr)
+                if diags.HasErrors() {
+                        return nil
+                }
+
+                return call
+        default:
+                return nil
+        }
+}
+
+// Implementation for hcl.ExprList.
+func (e *expression) ExprList() []hcl.Expression {
+        switch v := e.src.(type) {
+        case *arrayVal:
+                ret := make([]hcl.Expression, len(v.Values))
+                for i, node := range v.Values {
+                        ret[i] = &expression{src: node}
+                }
+                return ret
+        default:
+                return nil
+        }
+}
+
+// Implementation for hcl.ExprMap.
+func (e *expression) ExprMap() []hcl.KeyValuePair {
+        switch v := e.src.(type) {
+        case *objectVal:
+                ret := make([]hcl.KeyValuePair, len(v.Attrs))
+                for i, jsonAttr := range v.Attrs {
+                        ret[i] = hcl.KeyValuePair{
+                                Key: &expression{src: &stringVal{
+                                        Value:    jsonAttr.Name,
+                                        SrcRange: jsonAttr.NameRange,
+                                }},
+                                Value: &expression{src: jsonAttr.Value},
+                        }
+                }
+                return ret
+        default:
+                return nil
+        }
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/json/tokentype_string.go b/vendor/github.com/hashicorp/hcl2/hcl/json/tokentype_string.go
new file mode 100644
index 0000000..bbcce5b
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/json/tokentype_string.go
@@ -0,0 +1,29 @@
+// Code generated by "stringer -type tokenType scanner.go"; DO NOT EDIT.
+
+package json
+
+import "strconv"
+
+const _tokenType_name = "tokenInvalidtokenCommatokenColontokenEqualstokenKeywordtokenNumbertokenStringtokenBrackOtokenBrackCtokenBraceOtokenBraceCtokenEOF"
+
+var _tokenType_map = map[tokenType]string{
+        0:    _tokenType_name[0:12],
+        44:   _tokenType_name[12:22],
+        58:   _tokenType_name[22:32],
+        61:   _tokenType_name[32:43],
+        75:   _tokenType_name[43:55],
+        78:   _tokenType_name[55:66],
+        83:   _tokenType_name[66:77],
+        91:   _tokenType_name[77:88],
+        93:   _tokenType_name[88:99],
+        123:  _tokenType_name[99:110],
+        125:  _tokenType_name[110:121],
+        9220: _tokenType_name[121:129],
+}
+
+func (i tokenType) String() string {
+        if str, ok := _tokenType_map[i]; ok {
+                return str
+        }
+        return "tokenType(" + strconv.FormatInt(int64(i), 10) + ")"
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/merged.go b/vendor/github.com/hashicorp/hcl2/hcl/merged.go
new file mode 100644
index 0000000..ca2b728
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/merged.go
@@ -0,0 +1,226 @@
+package hcl
+
+import (
+        "fmt"
+)
+
+// MergeFiles combines the given files to produce a single body that contains
+// configuration from all of the given files.
+//
+// The ordering of the given files decides the order in which contained
+// elements will be returned. If any top-level attributes are defined with
+// the same name across multiple files, a diagnostic will be produced from
+// the Content and PartialContent methods describing this error in a
+// user-friendly way.
+func MergeFiles(files []*File) Body {
+        var bodies []Body
+        for _, file := range files {
+                bodies = append(bodies, file.Body)
+        }
+        return MergeBodies(bodies)
+}
+
+// MergeBodies is like MergeFiles except it deals directly with bodies, rather
+// than with entire files.
+func MergeBodies(bodies []Body) Body {
+        if len(bodies) == 0 {
+                // Swap out for our singleton empty body, to reduce the number of
+                // empty slices we have hanging around.
+                return emptyBody
+        }
+
+        // If any of the given bodies are already merged bodies, we'll unpack
+        // to flatten to a single mergedBodies, since that's conceptually simpler.
+        // This also, as a side-effect, eliminates any empty bodies, since
+        // empties are merged bodies with no inner bodies.
+        var newLen int
+        var flatten bool
+        for _, body := range bodies {
+                if children, merged := body.(mergedBodies); merged {
+                        newLen += len(children)
+                        flatten = true
+                } else {
+                        newLen++
+                }
+        }
+
+        if !flatten { // not just newLen == len, because we might have mergedBodies with single bodies inside
+                return mergedBodies(bodies)
+        }
+
+        if newLen == 0 {
+                // Don't allocate a new empty when we already have one
+                return emptyBody
+        }
+
+        new := make([]Body, 0, newLen)
+        for _, body := range bodies {
+                if children, merged := body.(mergedBodies); merged {
+                        new = append(new, children...)
+                } else {
+                        new = append(new, body)
+                }
+        }
+        return mergedBodies(new)
+}
+
+var emptyBody = mergedBodies([]Body{})
+
+// EmptyBody returns a body with no content. This body can be used as a
+// placeholder when a body is required but no body content is available.
+func EmptyBody() Body {
+        return emptyBody
+}
+
+type mergedBodies []Body
+
+// Content returns the content produced by applying the given schema to all
+// of the merged bodies and merging the result.
+//
+// Although required attributes _are_ supported, they should be used sparingly
+// with merged bodies since in this case there is no contextual information
+// with which to return good diagnostics. Applications working with merged
+// bodies may wish to mark all attributes as optional and then check for
+// required attributes afterwards, to produce better diagnostics.
+func (mb mergedBodies) Content(schema *BodySchema) (*BodyContent, Diagnostics) {
+        // the returned body will always be empty in this case, because mergedContent
+        // will only ever call Content on the child bodies.
+        content, _, diags := mb.mergedContent(schema, false)
+        return content, diags
+}
+
+func (mb mergedBodies) PartialContent(schema *BodySchema) (*BodyContent, Body, Diagnostics) {
+        return mb.mergedContent(schema, true)
+}
+
+func (mb mergedBodies) JustAttributes() (Attributes, Diagnostics) {
+        attrs := make(map[string]*Attribute)
+        var diags Diagnostics
+
+        for _, body := range mb {
+                thisAttrs, thisDiags := body.JustAttributes()
+
+                if len(thisDiags) != 0 {
+                        diags = append(diags, thisDiags...)
+                }
+
+                if thisAttrs != nil {
+                        for name, attr := range thisAttrs {
+                                if existing := attrs[name]; existing != nil {
+                                        diags = diags.Append(&Diagnostic{
+                                                Severity: DiagError,
+                                                Summary:  "Duplicate attribute",
+                                                Detail: fmt.Sprintf(
+                                                        "Attribute %q was already assigned at %s",
+                                                        name, existing.NameRange.String(),
+                                                ),
+                                                Subject: &attr.NameRange,
+                                        })
+                                        continue
+                                }
+
+                                attrs[name] = attr
+                        }
+                }
+        }
+
+        return attrs, diags
+}
+
+func (mb mergedBodies) MissingItemRange() Range {
+        if len(mb) == 0 {
+                // Nothing useful to return here, so we'll return some garbage.
+                return Range{
+                        Filename: "<empty>",
+                }
+        }
+
+        // arbitrarily use the first body's missing item range
+        return mb[0].MissingItemRange()
+}
+
+func (mb mergedBodies) mergedContent(schema *BodySchema, partial bool) (*BodyContent, Body, Diagnostics) {
+        // We need to produce a new schema with none of the attributes marked as
+        // required, since _any one_ of our bodies can contribute an attribute value.
+        // We'll separately check that all required attributes are present at
+        // the end.
+        mergedSchema := &BodySchema{
+                Blocks: schema.Blocks,
+        }
+        for _, attrS := range schema.Attributes {
+                mergedAttrS := attrS
+                mergedAttrS.Required = false
+                mergedSchema.Attributes = append(mergedSchema.Attributes, mergedAttrS)
+        }
+
+        var mergedLeftovers []Body
+        content := &BodyContent{
+                Attributes: map[string]*Attribute{},
+        }
+
+        var diags Diagnostics
+        for _, body := range mb {
+                var thisContent *BodyContent
+                var thisLeftovers Body
+                var thisDiags Diagnostics
+
+                if partial {
+                        thisContent, thisLeftovers, thisDiags = body.PartialContent(mergedSchema)
+                } else {
+                        thisContent, thisDiags = body.Content(mergedSchema)
+                }
+
+                if thisLeftovers != nil {
+                        mergedLeftovers = append(mergedLeftovers)
+                }
+                if len(thisDiags) != 0 {
+                        diags = append(diags, thisDiags...)
+                }
+
+                if thisContent.Attributes != nil {
+                        for name, attr := range thisContent.Attributes {
+                                if existing := content.Attributes[name]; existing != nil {
+                                        diags = diags.Append(&Diagnostic{
+                                                Severity: DiagError,
+                                                Summary:  "Duplicate attribute",
+                                                Detail: fmt.Sprintf(
+                                                        "Attribute %q was already assigned at %s",
+                                                        name, existing.NameRange.String(),
+                                                ),
+                                                Subject: &attr.NameRange,
+                                        })
+                                        continue
+                                }
+                                content.Attributes[name] = attr
+                        }
+                }
+
+                if len(thisContent.Blocks) != 0 {
+                        content.Blocks = append(content.Blocks, thisContent.Blocks...)
+                }
+        }
+
+        // Finally, we check for required attributes.
+        for _, attrS := range schema.Attributes {
+                if !attrS.Required {
+                        continue
+                }
+
+                if content.Attributes[attrS.Name] == nil {
+                        // We don't have any context here to produce a good diagnostic,
+                        // which is why we warn in the Content docstring to minimize the
+                        // use of required attributes on merged bodies.
+                        diags = diags.Append(&Diagnostic{
+                                Severity: DiagError,
+                                Summary:  "Missing required attribute",
+                                Detail: fmt.Sprintf(
+                                        "The attribute %q is required, but was not assigned.",
+                                        attrS.Name,
+                                ),
+                        })
+                }
+        }
+
+        leftoverBody := MergeBodies(mergedLeftovers)
+        return content, leftoverBody, diags
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/ops.go b/vendor/github.com/hashicorp/hcl2/hcl/ops.go
new file mode 100644
index 0000000..f4e30b0
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/ops.go
@@ -0,0 +1,147 @@
+package hcl
+
+import (
+        "fmt"
+
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+)
+
+// Index is a helper function that performs the same operation as the index
+// operator in the HCL expression language. That is, the result is the
+// same as it would be for collection[key] in a configuration expression.
+//
+// This is exported so that applications can perform indexing in a manner
+// consistent with how the language does it, including handling of null and
+// unknown values, etc.
+//
+// Diagnostics are produced if the given combination of values is not valid.
+// Therefore a pointer to a source range must be provided to use in diagnostics,
+// though nil can be provided if the calling application is going to
+// ignore the subject of the returned diagnostics anyway.
+func Index(collection, key cty.Value, srcRange *Range) (cty.Value, Diagnostics) {
+        if collection.IsNull() {
+                return cty.DynamicVal, Diagnostics{
+                        {
+                                Severity: DiagError,
+                                Summary:  "Attempt to index null value",
+                                Detail:   "This value is null, so it does not have any indices.",
+                                Subject:  srcRange,
+                        },
+                }
+        }
+        if key.IsNull() {
+                return cty.DynamicVal, Diagnostics{
+                        {
+                                Severity: DiagError,
+                                Summary:  "Invalid index",
+                                Detail:   "Can't use a null value as an indexing key.",
+                                Subject:  srcRange,
+                        },
+                }
+        }
+        ty := collection.Type()
+        kty := key.Type()
+        if kty == cty.DynamicPseudoType || ty == cty.DynamicPseudoType {
+                return cty.DynamicVal, nil
+        }
+
+        switch {
+
+        case ty.IsListType() || ty.IsTupleType() || ty.IsMapType():
+                var wantType cty.Type
+                switch {
+                case ty.IsListType() || ty.IsTupleType():
+                        wantType = cty.Number
+                case ty.IsMapType():
+                        wantType = cty.String
+                default:
+                        // should never happen
+                        panic("don't know what key type we want")
+                }
+
+                key, keyErr := convert.Convert(key, wantType)
+                if keyErr != nil {
+                        return cty.DynamicVal, Diagnostics{
+                                {
+                                        Severity: DiagError,
+                                        Summary:  "Invalid index",
+                                        Detail: fmt.Sprintf(
+                                                "The given key does not identify an element in this collection value: %s.",
+                                                keyErr.Error(),
+                                        ),
+                                        Subject: srcRange,
+                                },
+                        }
+                }
+
+                has := collection.HasIndex(key)
+                if !has.IsKnown() {
+                        if ty.IsTupleType() {
+                                return cty.DynamicVal, nil
+                        } else {
+                                return cty.UnknownVal(ty.ElementType()), nil
+                        }
+                }
+                if has.False() {
+                        return cty.DynamicVal, Diagnostics{
+                                {
+                                        Severity: DiagError,
+                                        Summary:  "Invalid index",
+                                        Detail:   "The given key does not identify an element in this collection value.",
+                                        Subject:  srcRange,
+                                },
+                        }
+                }
+
+                return collection.Index(key), nil
+
+        case ty.IsObjectType():
+                key, keyErr := convert.Convert(key, cty.String)
+                if keyErr != nil {
+                        return cty.DynamicVal, Diagnostics{
+                                {
+                                        Severity: DiagError,
+                                        Summary:  "Invalid index",
+                                        Detail: fmt.Sprintf(
+                                                "The given key does not identify an element in this collection value: %s.",
+                                                keyErr.Error(),
+                                        ),
+                                        Subject: srcRange,
+                                },
+                        }
+                }
+                if !collection.IsKnown() {
+                        return cty.DynamicVal, nil
+                }
+                if !key.IsKnown() {
+                        return cty.DynamicVal, nil
+                }
+
+                attrName := key.AsString()
+
+                if !ty.HasAttribute(attrName) {
+                        return cty.DynamicVal, Diagnostics{
+                                {
+                                        Severity: DiagError,
+                                        Summary:  "Invalid index",
+                                        Detail:   "The given key does not identify an element in this collection value.",
+                                        Subject:  srcRange,
+                                },
+                        }
+                }
+
+                return collection.GetAttr(attrName), nil
+
+        default:
+                return cty.DynamicVal, Diagnostics{
+                        {
+                                Severity: DiagError,
+                                Summary:  "Invalid index",
+                                Detail:   "This value does not have any indices.",
+                                Subject:  srcRange,
+                        },
+                }
+        }
+
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/pos.go b/vendor/github.com/hashicorp/hcl2/hcl/pos.go
new file mode 100644
index 0000000..1a4b329
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/pos.go
@@ -0,0 +1,262 @@
+package hcl
+
+import "fmt"
+
+// Pos represents a single position in a source file, by addressing the
+// start byte of a unicode character encoded in UTF-8.
+//
+// Pos is generally used only in the context of a Range, which then defines
+// which source file the position is within.
+type Pos struct {
+        // Line is the source code line where this position points. Lines are
+        // counted starting at 1 and incremented for each newline character
+        // encountered.
+        Line int
+
+        // Column is the source code column where this position points, in
+        // unicode characters, with counting starting at 1.
+        //
+        // Column counts characters as they appear visually, so for example a
+        // latin letter with a combining diacritic mark counts as one character.
+        // This is intended for rendering visual markers against source code in
+        // contexts where these diacritics would be rendered in a single character
+        // cell. Technically speaking, Column is counting grapheme clusters as
+        // used in unicode normalization.
+        Column int
+
+        // Byte is the byte offset into the file where the indicated character
+        // begins. This is a zero-based offset to the first byte of the first
+        // UTF-8 codepoint sequence in the character, and thus gives a position
+        // that can be resolved _without_ awareness of Unicode characters.
+        Byte int
+}
+
+// Range represents a span of characters between two positions in a source
+// file.
+//
+// This struct is usually used by value in types that represent AST nodes,
+// but by pointer in types that refer to the positions of other objects,
+// such as in diagnostics.
+type Range struct {
+        // Filename is the name of the file into which this range's positions
+        // point.
+        Filename string
+
+        // Start and End represent the bounds of this range. Start is inclusive
+        // and End is exclusive.
+        Start, End Pos
+}
+
+// RangeBetween returns a new range that spans from the beginning of the
+// start range to the end of the end range.
+//
+// The result is meaningless if the two ranges do not belong to the same
+// source file or if the end range appears before the start range.
+func RangeBetween(start, end Range) Range {
+        return Range{
+                Filename: start.Filename,
+                Start:    start.Start,
+                End:      end.End,
+        }
+}
+
+// RangeOver returns a new range that covers both of the given ranges and
+// possibly additional content between them if the two ranges do not overlap.
+//
+// If either range is empty then it is ignored. The result is empty if both
+// given ranges are empty.
+//
+// The result is meaningless if the two ranges to not belong to the same
+// source file.
+func RangeOver(a, b Range) Range {
+        if a.Empty() {
+                return b
+        }
+        if b.Empty() {
+                return a
+        }
+
+        var start, end Pos
+        if a.Start.Byte < b.Start.Byte {
+                start = a.Start
+        } else {
+                start = b.Start
+        }
+        if a.End.Byte > b.End.Byte {
+                end = a.End
+        } else {
+                end = b.End
+        }
+        return Range{
+                Filename: a.Filename,
+                Start:    start,
+                End:      end,
+        }
+}
+
+// ContainsOffset returns true if and only if the given byte offset is within
+// the receiving Range.
+func (r Range) ContainsOffset(offset int) bool {
+        return offset >= r.Start.Byte && offset < r.End.Byte
+}
+
+// Ptr returns a pointer to a copy of the receiver. This is a convenience when
+// ranges in places where pointers are required, such as in Diagnostic, but
+// the range in question is returned from a method. Go would otherwise not
+// allow one to take the address of a function call.
+func (r Range) Ptr() *Range {
+        return &r
+}
+
+// String returns a compact string representation of the receiver.
+// Callers should generally prefer to present a range more visually,
+// e.g. via markers directly on the relevant portion of source code.
+func (r Range) String() string {
+        if r.Start.Line == r.End.Line {
+                return fmt.Sprintf(
+                        "%s:%d,%d-%d",
+                        r.Filename,
+                        r.Start.Line, r.Start.Column,
+                        r.End.Column,
+                )
+        } else {
+                return fmt.Sprintf(
+                        "%s:%d,%d-%d,%d",
+                        r.Filename,
+                        r.Start.Line, r.Start.Column,
+                        r.End.Line, r.End.Column,
+                )
+        }
+}
+
+func (r Range) Empty() bool {
+        return r.Start.Byte == r.End.Byte
+}
+
+// CanSliceBytes returns true if SliceBytes could return an accurate
+// sub-slice of the given slice.
+//
+// This effectively tests whether the start and end offsets of the range
+// are within the bounds of the slice, and thus whether SliceBytes can be
+// trusted to produce an accurate start and end position within that slice.
+func (r Range) CanSliceBytes(b []byte) bool {
+        switch {
+        case r.Start.Byte < 0 || r.Start.Byte > len(b):
+                return false
+        case r.End.Byte < 0 || r.End.Byte > len(b):
+                return false
+        case r.End.Byte < r.Start.Byte:
+                return false
+        default:
+                return true
+        }
+}
+
+// SliceBytes returns a sub-slice of the given slice that is covered by the
+// receiving range, assuming that the given slice is the source code of the
+// file indicated by r.Filename.
+//
+// If the receiver refers to any byte offsets that are outside of the slice
+// then the result is constrained to the overlapping portion only, to avoid
+// a panic. Use CanSliceBytes to determine if the result is guaranteed to
+// be an accurate span of the requested range.
+func (r Range) SliceBytes(b []byte) []byte {
+        start := r.Start.Byte
+        end := r.End.Byte
+        if start < 0 {
+                start = 0
+        } else if start > len(b) {
+                start = len(b)
+        }
+        if end < 0 {
+                end = 0
+        } else if end > len(b) {
+                end = len(b)
+        }
+        if end < start {
+                end = start
+        }
+        return b[start:end]
+}
+
+// Overlaps returns true if the receiver and the other given range share any
+// characters in common.
+func (r Range) Overlaps(other Range) bool {
+        switch {
+        case r.Filename != other.Filename:
+                // If the ranges are in different files then they can't possibly overlap
+                return false
+        case r.Empty() || other.Empty():
+                // Empty ranges can never overlap
+                return false
+        case r.ContainsOffset(other.Start.Byte) || r.ContainsOffset(other.End.Byte):
+                return true
+        case other.ContainsOffset(r.Start.Byte) || other.ContainsOffset(r.End.Byte):
+                return true
+        default:
+                return false
+        }
+}
+
+// Overlap finds a range that is either identical to or a sub-range of both
+// the receiver and the other given range. It returns an empty range
+// within the receiver if there is no overlap between the two ranges.
+//
+// A non-empty result is either identical to or a subset of the receiver.
+func (r Range) Overlap(other Range) Range {
+        if !r.Overlaps(other) {
+                // Start == End indicates an empty range
+                return Range{
+                        Filename: r.Filename,
+                        Start:    r.Start,
+                        End:      r.Start,
+                }
+        }
+
+        var start, end Pos
+        if r.Start.Byte > other.Start.Byte {
+                start = r.Start
+        } else {
+                start = other.Start
+        }
+        if r.End.Byte < other.End.Byte {
+                end = r.End
+        } else {
+                end = other.End
+        }
+
+        return Range{
+                Filename: r.Filename,
+                Start:    start,
+                End:      end,
+        }
+}
+
+// PartitionAround finds the portion of the given range that overlaps with
+// the reciever and returns three ranges: the portion of the reciever that
+// precedes the overlap, the overlap itself, and then the portion of the
+// reciever that comes after the overlap.
+//
+// If the two ranges do not overlap then all three returned ranges are empty.
+//
+// If the given range aligns with or extends beyond either extent of the
+// reciever then the corresponding outer range will be empty.
+func (r Range) PartitionAround(other Range) (before, overlap, after Range) {
+        overlap = r.Overlap(other)
+        if overlap.Empty() {
+                return overlap, overlap, overlap
+        }
+
+        before = Range{
+                Filename: r.Filename,
+                Start:    r.Start,
+                End:      overlap.Start,
+        }
+        after = Range{
+                Filename: r.Filename,
+                Start:    overlap.End,
+                End:      r.End,
+        }
+
+        return before, overlap, after
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/pos_scanner.go b/vendor/github.com/hashicorp/hcl2/hcl/pos_scanner.go
new file mode 100644
index 0000000..7c8f2df
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/pos_scanner.go
@@ -0,0 +1,148 @@
+package hcl
+
+import (
+        "bufio"
+        "bytes"
+
+        "github.com/apparentlymart/go-textseg/textseg"
+)
+
+// RangeScanner is a helper that will scan over a buffer using a bufio.SplitFunc
+// and visit a source range for each token matched.
+//
+// For example, this can be used with bufio.ScanLines to find the source range
+// for each line in the file, skipping over the actual newline characters, which
+// may be useful when printing source code snippets as part of diagnostic
+// messages.
+//
+// The line and column information in the returned ranges is produced by
+// counting newline characters and grapheme clusters respectively, which
+// mimics the behavior we expect from a parser when producing ranges.
+type RangeScanner struct {
+        filename string
+        b        []byte
+        cb       bufio.SplitFunc
+
+        pos Pos    // position of next byte to process in b
+        cur Range  // latest range
+        tok []byte // slice of b that is covered by cur
+        err error  // error from last scan, if any
+}
+
+// Create a new RangeScanner for the given buffer, producing ranges for the
+// given filename.
+//
+// Since ranges have grapheme-cluster granularity rather than byte granularity,
+// the scanner will produce incorrect results if the given SplitFunc creates
+// tokens between grapheme cluster boundaries. In particular, it is incorrect
+// to use RangeScanner with bufio.ScanRunes because it will produce tokens
+// around individual UTF-8 sequences, which will split any multi-sequence
+// grapheme clusters.
+func NewRangeScanner(b []byte, filename string, cb bufio.SplitFunc) *RangeScanner {
+        return &RangeScanner{
+                filename: filename,
+                b:        b,
+                cb:       cb,
+                pos: Pos{
+                        Byte:   0,
+                        Line:   1,
+                        Column: 1,
+                },
+        }
+}
+
+func (sc *RangeScanner) Scan() bool {
+        if sc.pos.Byte >= len(sc.b) || sc.err != nil {
+                // All done
+                return false
+        }
+
+        // Since we're operating on an in-memory buffer, we always pass the whole
+        // remainder of the buffer to our SplitFunc and set isEOF to let it know
+        // that it has the whole thing.
+        advance, token, err := sc.cb(sc.b[sc.pos.Byte:], true)
+
+        // Since we are setting isEOF to true this should never happen, but
+        // if it does we will just abort and assume the SplitFunc is misbehaving.
+        if advance == 0 && token == nil && err == nil {
+                return false
+        }
+
+        if err != nil {
+                sc.err = err
+                sc.cur = Range{
+                        Filename: sc.filename,
+                        Start:    sc.pos,
+                        End:      sc.pos,
+                }
+                sc.tok = nil
+                return false
+        }
+
+        sc.tok = token
+        start := sc.pos
+        end := sc.pos
+        new := sc.pos
+
+        // adv is similar to token but it also includes any subsequent characters
+        // we're being asked to skip over by the SplitFunc.
+        // adv is a slice covering any additional bytes we are skipping over, based
+        // on what the SplitFunc told us to do with advance.
+        adv := sc.b[sc.pos.Byte : sc.pos.Byte+advance]
+
+        // We now need to scan over our token to count the grapheme clusters
+        // so we can correctly advance Column, and count the newlines so we
+        // can correctly advance Line.
+        advR := bytes.NewReader(adv)
+        gsc := bufio.NewScanner(advR)
+        advanced := 0
+        gsc.Split(textseg.ScanGraphemeClusters)
+        for gsc.Scan() {
+                gr := gsc.Bytes()
+                new.Byte += len(gr)
+                new.Column++
+
+                // We rely here on the fact that \r\n is considered a grapheme cluster
+                // and so we don't need to worry about miscounting additional lines
+                // on files with Windows-style line endings.
+                if len(gr) != 0 && (gr[0] == '\r' || gr[0] == '\n') {
+                        new.Column = 1
+                        new.Line++
+                }
+
+                if advanced < len(token) {
+                        // If we've not yet found the end of our token then we'll
+                        // also push our "end" marker along.
+                        // (if advance > len(token) then we'll stop moving "end" early
+                        // so that the caller only sees the range covered by token.)
+                        end = new
+                }
+                advanced += len(gr)
+        }
+
+        sc.cur = Range{
+                Filename: sc.filename,
+                Start:    start,
+                End:      end,
+        }
+        sc.pos = new
+        return true
+}
+
+// Range returns a range that covers the latest token obtained after a call
+// to Scan returns true.
+func (sc *RangeScanner) Range() Range {
+        return sc.cur
+}
+
+// Bytes returns the slice of the input buffer that is covered by the range
+// that would be returned by Range.
+func (sc *RangeScanner) Bytes() []byte {
+        return sc.tok
+}
+
+// Err can be called after Scan returns false to determine if the latest read
+// resulted in an error, and obtain that error if so.
+func (sc *RangeScanner) Err() error {
+        return sc.err
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/schema.go b/vendor/github.com/hashicorp/hcl2/hcl/schema.go
new file mode 100644
index 0000000..891257a
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/schema.go
@@ -0,0 +1,21 @@
+package hcl
+
+// BlockHeaderSchema represents the shape of a block header, and is
+// used for matching blocks within bodies.
+type BlockHeaderSchema struct {
+        Type       string
+        LabelNames []string
+}
+
+// AttributeSchema represents the requirements for an attribute, and is used
+// for matching attributes within bodies.
+type AttributeSchema struct {
+        Name     string
+        Required bool
+}
+
+// BodySchema represents the desired shallow structure of a body.
+type BodySchema struct {
+        Attributes []AttributeSchema
+        Blocks     []BlockHeaderSchema
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/spec.md b/vendor/github.com/hashicorp/hcl2/hcl/spec.md
new file mode 100644
index 0000000..58257bf
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/spec.md
@@ -0,0 +1,691 @@
+# HCL Syntax-Agnostic Information Model
+
+This is the specification for the general information model (abstract types and
+semantics) for hcl. HCL is a system for defining configuration languages for
+applications. The HCL information model is designed to support multiple
+concrete syntaxes for configuration, each with a mapping to the model defined
+in this specification.
+
+The two primary syntaxes intended for use in conjunction with this model are
+[the HCL native syntax](./hclsyntax/spec.md) and [the JSON syntax](./json/spec.md).
+In principle other syntaxes are possible as long as either their language model
+is sufficiently rich to express the concepts described in this specification
+or the language targets a well-defined subset of the specification.
+
+## Structural Elements
+
+The primary structural element is the _body_, which is a container representing
+a set of zero or more _attributes_ and a set of zero or more _blocks_.
+
+A _configuration file_ is the top-level object, and will usually be produced
+by reading a file from disk and parsing it as a particular syntax. A
+configuration file has its own _body_, representing the top-level attributes
+and blocks.
+
+An _attribute_ is a name and value pair associated with a body. Attribute names
+are unique within a given body. Attribute values are provided as _expressions_,
+which are discussed in detail in a later section.
+
+A _block_ is a nested structure that has a _type name_, zero or more string
+_labels_ (e.g. identifiers), and a nested body.
+
+Together the structural elements create a heirarchical data structure, with
+attributes intended to represent the direct properties of a particular object
+in the calling application, and blocks intended to represent child objects
+of a particular object.
+
+## Body Content
+
+To support the expression of the HCL concepts in languages whose information
+model is a subset of HCL's, such as JSON, a _body_ is an opaque container
+whose content can only be accessed by providing information on the expected
+structure of the content.
+
+The specification for each syntax must describe how its physical constructs
+are mapped on to body content given a schema. For syntaxes that have
+first-class syntax distinguishing attributes and bodies this can be relatively
+straightforward, while more detailed mapping rules may be required in syntaxes
+where the representation of attributes vs. blocks is ambiguous.
+
+### Schema-driven Processing
+
+Schema-driven processing is the primary way to access body content.
+A _body schema_ is a description of what is expected within a particular body,
+which can then be used to extract the _body content_, which then provides
+access to the specific attributes and blocks requested.
+
+A _body schema_ consists of a list of _attribute schemata_ and
+_block header schemata_:
+
+* An _attribute schema_ provides the name of an attribute and whether its
+  presence is required.
+
+* A _block header schema_ provides a block type name and the semantic names
+  assigned to each of the labels of that block type, if any.
+
+Within a schema, it is an error to request the same attribute name twice or
+to request a block type whose name is also an attribute name. While this can
+in principle be supported in some syntaxes, in other syntaxes the attribute
+and block namespaces are combined and so an an attribute cannot coexist with
+a block whose type name is identical to the attribute name.
+
+The result of applying a body schema to a body is _body content_, which
+consists of an _attribute map_ and a _block sequence_:
+
+* The _attribute map_ is a map data structure whose keys are attribute names
+  and whose values are _expressions_ that represent the corresponding attribute
+  values.
+
+* The _block sequence_ is an ordered sequence of blocks, with each specifying
+  a block _type name_, the sequence of _labels_ specified for the block,
+  and the body object (not body _content_) representing the block's own body.
+
+After obtaining _body content_, the calling application may continue processing
+by evaluating attribute expressions and/or recursively applying further
+schema-driven processing to the child block bodies.
+
+**Note:** The _body schema_ is intentionally minimal, to reduce the set of
+mapping rules that must be defined for each syntax. Higher-level utility
+libraries may be provided to assist in the construction of a schema and
+perform additional processing, such as automatically evaluating attribute
+expressions and assigning their result values into a data structure, or
+recursively applying a schema to child blocks. Such utilities are not part of
+this core specification and will vary depending on the capabilities and idiom
+of the implementation language.
+
+### _Dynamic Attributes_ Processing
+
+The _schema-driven_ processing model is useful when the expected structure
+of a body is known a priori by the calling application. Some blocks are
+instead more free-form, such as a user-provided set of arbitrary key/value
+pairs.
+
+The alternative _dynamic attributes_ processing mode allows for this more
+ad-hoc approach. Processing in this mode behaves as if a schema had been
+constructed without any _block header schemata_ and with an attribute
+schema for each distinct key provided within the physical representation
+of the body.
+
+The means by which _distinct keys_ are identified is dependent on the
+physical syntax; this processing mode assumes that the syntax has a way
+to enumerate keys provided by the author and identify expressions that
+correspond with those keys, but does not define the means by which this is
+done.
+
+The result of _dynamic attributes_ processing is an _attribute map_ as
+defined in the previous section. No _block sequence_ is produced in this
+processing mode.
+
+### Partial Processing of Body Content
+
+Under _schema-driven processing_, by default the given schema is assumed
+to be exhaustive, such that any attribute or block not matched by schema
+elements is considered an error. This allows feedback about unsupported
+attributes and blocks (such as typos) to be provided.
+
+An alternative is _partial processing_, where any additional elements within
+the body are not considered an error.
+
+Under partial processing, the result is both body content as described
+above _and_ a new body that represents any body elements that remain after
+the schema has been processed.
+
+Specifically:
+
+* Any attribute whose name is specified in the schema is returned in body
+  content and elided from the new body.
+
+* Any block whose type is specified in the schema is returned in body content
+  and elided from the new body.
+
+* Any attribute or block _not_ meeting the above conditions is placed into
+  the new body, unmodified.
+
+The new body can then be recursively processed using any of the body
+processing models. This facility allows different subsets of body content
+to be processed by different parts of the calling application.
+
+Processing a body in two steps — first partial processing of a source body,
+then exhaustive processing of the returned body — is equivalent to single-step
+processing with a schema that is the union of the schemata used
+across the two steps.
+
+## Expressions
+
+Attribute values are represented by _expressions_. Depending on the concrete
+syntax in use, an expression may just be a literal value or it may describe
+a computation in terms of literal values, variables, and functions.
+
+Each syntax defines its own representation of expressions. For syntaxes based
+in languages that do not have any non-literal expression syntax, it is
+recommended to embed the template language from
+[the native syntax](./hclsyntax/spec.md) e.g. as a post-processing step on
+string literals.
+
+### Expression Evaluation
+
+In order to obtain a concrete value, each expression must be _evaluated_.
+Evaluation is performed in terms of an evaluation context, which
+consists of the following:
+
+* An _evaluation mode_, which is defined below.
+* A _variable scope_, which provides a set of named variables for use in
+  expressions.
+* A _function table_, which provides a set of named functions for use in
+  expressions.
+
+The _evaluation mode_ allows for two different interpretations of an
+expression:
+
+* In _literal-only mode_, variables and functions are not available and it
+  is assumed that the calling application's intent is to treat the attribute
+  value as a literal.
+
+* In _full expression mode_, variables and functions are defined and it is
+  assumed that the calling application wishes to provide a full expression
+  language for definition of the attribute value.
+
+The actual behavior of these two modes depends on the syntax in use. For
+languages with first-class expression syntax, these two modes may be considered
+equivalent, with _literal-only mode_ simply not defining any variables or
+functions. For languages that embed arbitrary expressions via string templates,
+_literal-only mode_ may disable such processing, allowing literal strings to
+pass through without interpretation as templates.
+
+Since literal-only mode does not support variables and functions, it is an
+error for the calling application to enable this mode and yet provide a
+variable scope and/or function table.
+
+## Values and Value Types
+
+The result of expression evaluation is a _value_. Each value has a _type_,
+which is dynamically determined during evaluation. The _variable scope_ in
+the evaluation context is a map from variable name to value, using the same
+definition of value.
+
+The type system for HCL values is intended to be of a level abstraction
+suitable for configuration of various applications. A well-defined,
+implementation-language-agnostic type system is defined to allow for
+consistent processing of configuration across many implementation languages.
+Concrete implementations may provide additional functionality to lower
+HCL values and types to corresponding native language types, which may then
+impose additional constraints on the values outside of the scope of this
+specification.
+
+Two values are _equal_ if and only if they have identical types and their
+values are equal according to the rules of their shared type.
+
+### Primitive Types
+
+The primitive types are _string_, _bool_, and _number_.
+
+A _string_ is a sequence of unicode characters. Two strings are equal if
+NFC normalization ([UAX#15](http://unicode.org/reports/tr15/)
+of each string produces two identical sequences of characters.
+NFC normalization ensures that, for example, a precomposed combination of a
+latin letter and a diacritic compares equal with the letter followed by
+a combining diacritic.
+
+The _bool_ type has only two non-null values: _true_ and _false_. Two bool
+values are equal if and only if they are either both true or both false.
+
+A _number_ is an arbitrary-precision floating point value. An implementation
+_must_ make the full-precision values available to the calling application
+for interpretation into any suitable number representation. An implementation
+may in practice implement numbers with limited precision so long as the
+following constraints are met:
+
+* Integers are represented with at least 256 bits.
+* Non-integer numbers are represented as floating point values with a
+  mantissa of at least 256 bits and a signed binary exponent of at least
+  16 bits.
+* An error is produced if an integer value given in source cannot be
+  represented precisely.
+* An error is produced if a non-integer value cannot be represented due to
+  overflow.
+* A non-integer number is rounded to the nearest possible value when a
+  value is of too high a precision to be represented.
+
+The _number_ type also requires representation of both positive and negative
+infinity. A "not a number" (NaN) value is _not_ provided nor used.
+
+Two number values are equal if they are numerically equal to the precision
+associated with the number. Positive infinity and negative infinity are
+equal to themselves but not to each other. Positive infinity is greater than
+any other number value, and negative infinity is less than any other number
+value.
+
+Some syntaxes may be unable to represent numeric literals of arbitrary
+precision. This must be defined in the syntax specification as part of its
+description of mapping numeric literals to HCL values.
+
+### Structural Types
+
+_Structural types_ are types that are constructed by combining other types.
+Each distinct combination of other types is itself a distinct type. There
+are two structural type _kinds_:
+
+* _Object types_ are constructed of a set of named attributes, each of which
+  has a type. Attribute names are always strings. (_Object_ attributes are a
+  distinct idea from _body_ attributes, though calling applications
+  may choose to blur the distinction by use of common naming schemes.)
+* _Tuple tupes_ are constructed of a sequence of elements, each of which
+  has a type.
+
+Values of structural types are compared for equality in terms of their
+attributes or elements. A structural type value is equal to another if and
+only if all of the corresponding attributes or elements are equal.
+
+Two structural types are identical if they are of the same kind and
+have attributes or elements with identical types.
+
+### Collection Types
+
+_Collection types_ are types that combine together an arbitrary number of
+values of some other single type. There are three collection type _kinds_:
+
+* _List types_ represent ordered sequences of values of their element type.
+* _Map types_ represent values of their element type accessed via string keys.
+* _Set types_ represent unordered sets of distinct values of their element type.
+
+For each of these kinds and each distinct element type there is a distinct
+collection type. For example, "list of string" is a distinct type from
+"set of string", and "list of number" is a distinct type from "list of string".
+
+Values of collection types are compared for equality in terms of their
+elements. A collection type value is equal to another if and only if both
+have the same number of elements and their corresponding elements are equal.
+
+Two collection types are identical if they are of the same kind and have
+the same element type.
+
+### Null values
+
+Each type has a null value. The null value of a type represents the absense
+of a value, but with type information retained to allow for type checking.
+
+Null values are used primarily to represent the conditional absense of a
+body attribute. In a syntax with a conditional operator, one of the result
+values of that conditional may be null to indicate that the attribute should be
+considered not present in that case.
+
+Calling applications _should_ consider an attribute with a null value as
+equivalent to the value not being present at all.
+
+A null value of a particular type is equal to itself.
+
+### Unknown Values and the Dynamic Pseudo-type
+
+An _unknown value_ is a placeholder for a value that is not yet known.
+Operations on unknown values themselves return unknown values that have a
+type appropriate to the operation. For example, adding together two unknown
+numbers yields an unknown number, while comparing two unknown values of any
+type for equality yields an unknown bool.
+
+Each type has a distinct unknown value. For example, an unknown _number_ is
+a distinct value from an unknown _string_.
+
+_The dynamic pseudo-type_ is a placeholder for a type that is not yet known.
+The only values of this type are its null value and its unknown value. It is
+referred to as a _pseudo-type_ because it should not be considered a type in
+its own right, but rather as a placeholder for a type yet to be established.
+The unknown value of the dynamic pseudo-type is referred to as _the dynamic
+value_.
+
+Operations on values of the dynamic pseudo-type behave as if it is a value
+of the expected type, optimistically assuming that once the value and type
+are known they will be valid for the operation. For example, adding together
+a number and the dynamic value produces an unknown number.
+
+Unknown values and the dynamic pseudo-type can be used as a mechanism for
+partial type checking and semantic checking: by evaluating an expression with
+all variables set to an unknown value, the expression can be evaluated to
+produce an unknown value of a given type, or produce an error if any operation
+is provably invalid with only type information.
+
+Unknown values and the dynamic pseudo-type must never be returned from
+operations unless at least one operand is unknown or dynamic. Calling
+applications are guaranteed that unless the global scope includes unknown
+values, or the function table includes functions that return unknown values,
+no expression will evaluate to an unknown value. The calling application is
+thus in total control over the use and meaning of unknown values.
+
+The dynamic pseudo-type is identical only to itself.
+
+### Capsule Types
+
+A _capsule type_ is a custom type defined by the calling application. A value
+of a capsule type is considered opaque to HCL, but may be accepted
+by functions provided by the calling application.
+
+A particular capsule type is identical only to itself. The equality of two
+values of the same capsule type is defined by the calling application. No
+other operations are supported for values of capsule types.
+
+Support for capsule types in a HCL implementation is optional. Capsule types
+are intended to allow calling applications to pass through values that are
+not part of the standard type system. For example, an application that
+deals with raw binary data may define a capsule type representing a byte
+array, and provide functions that produce or operate on byte arrays.
+
+### Type Specifications
+
+In certain situations it is necessary to define expectations about the expected
+type of a value. Whereas two _types_ have a commutative _identity_ relationship,
+a type has a non-commutative _matches_ relationship with a _type specification_.
+A type specification is, in practice, just a different interpretation of a
+type such that:
+
+* Any type _matches_ any type that it is identical to.
+
+* Any type _matches_ the dynamic pseudo-type.
+
+For example, given a type specification "list of dynamic pseudo-type", the
+concrete types "list of string" and "list of map" match, but the
+type "set of string" does not.
+
+## Functions and Function Calls
+
+The evaluation context used to evaluate an expression includes a function
+table, which represents an application-defined set of named functions
+available for use in expressions.
+
+Each syntax defines whether function calls are supported and how they are
+physically represented in source code, but the semantics of function calls are
+defined here to ensure consistent results across syntaxes and to allow
+applications to provide functions that are interoperable with all syntaxes.
+
+A _function_ is defined from the following elements:
+
+* Zero or more _positional parameters_, each with a name used for documentation,
+  a type specification for expected argument values, and a flag for whether
+  each of null values, unknown values, and values of the dynamic pseudo-type
+  are accepted.
+
+* Zero or one _variadic parameters_, with the same structure as the _positional_
+  parameters, which if present collects any additional arguments provided at
+  the function call site.
+
+* A _result type definition_, which specifies the value type returned for each
+  valid sequence of argument values.
+
+* A _result value definition_, which specifies the value returned for each
+  valid sequence of argument values.
+
+A _function call_, regardless of source syntax, consists of a sequence of
+argument values. The argument values are each mapped to a corresponding
+parameter as follows:
+
+* For each of the function's positional parameters in sequence, take the next
+  argument. If there are no more arguments, the call is erroneous.
+
+* If the function has a variadic parameter, take all remaining arguments that
+  where not yet assigned to a positional parameter and collect them into
+  a sequence of variadic arguments that each correspond to the variadic
+  parameter.
+
+* If the function has _no_ variadic parameter, it is an error if any arguments
+  remain after taking one argument for each positional parameter.
+
+After mapping each argument to a parameter, semantic checking proceeds
+for each argument:
+
+* If the argument value corresponding to a parameter does not match the
+  parameter's type specification, the call is erroneous.
+
+* If the argument value corresponding to a parameter is null and the parameter
+  is not specified as accepting nulls, the call is erroneous.
+
+* If the argument value corresponding to a parameter is the dynamic value
+  and the parameter is not specified as accepting values of the dynamic
+  pseudo-type, the call is valid but its _result type_ is forced to be the
+  dynamic pseudo type.
+
+* If neither of the above conditions holds for any argument, the call is
+  valid and the function's value type definition is used to determine the
+  call's _result type_. A function _may_ vary its result type depending on
+  the argument _values_ as well as the argument _types_; for example, a
+  function that decodes a JSON value will return a different result type
+  depending on the data structure described by the given JSON source code.
+
+If semantic checking succeeds without error, the call is _executed_:
+
+* For each argument, if its value is unknown and its corresponding parameter
+  is not specified as accepting unknowns, the _result value_ is forced to be an
+  unknown value of the result type.
+
+* If the previous condition does not apply, the function's result value
+  definition is used to determine the call's _result value_.
+
+The result of a function call expression is either an error, if one of the
+erroenous conditions above applies, or the _result value_.
+
+## Type Conversions and Unification
+
+Values given in configuration may not always match the expectations of the
+operations applied to them or to the calling application. In such situations,
+automatic type conversion is attempted as a convenience to the user.
+
+Along with conversions to a _specified_ type, it is sometimes necessary to
+ensure that a selection of values are all of the _same_ type, without any
+constraint on which type that is. This is the process of _type unification_,
+which attempts to find the most general type that all of the given types can
+be converted to.
+
+Both type conversions and unification are defined in the syntax-agnostic
+model to ensure consistency of behavior between syntaxes.
+
+Type conversions are broadly characterized into two categories: _safe_ and
+_unsafe_. A conversion is "safe" if any distinct value of the source type
+has a corresponding distinct value in the target type. A conversion is
+"unsafe" if either the target type values are _not_ distinct (information
+may be lost in conversion) or if some values of the source type do not have
+any corresponding value in the target type. An unsafe conversion may result
+in an error.
+
+A given type can always be converted to itself, which is a no-op.
+
+### Conversion of Null Values
+
+All null values are safely convertable to a null value of any other type,
+regardless of other type-specific rules specified in the sections below.
+
+### Conversion to and from the Dynamic Pseudo-type
+
+Conversion _from_ the dynamic pseudo-type _to_ any other type always succeeds,
+producing an unknown value of the target type.
+
+Conversion of any value _to_ the dynamic pseudo-type is a no-op. The result
+is the input value, verbatim. This is the only situation where the conversion
+result value is not of the the given target type.
+
+### Primitive Type Conversions
+
+Bidirectional conversions are available between the string and number types,
+and between the string and boolean types.
+
+The bool value true corresponds to the string containing the characters "true",
+while the bool value false corresponds to teh string containing the characters
+"false". Conversion from bool to string is safe, while the converse is
+unsafe. The strings "1" and "0" are alternative string representations
+of true and false respectively. It is an error to convert a string other than
+the four in this paragraph to type bool.
+
+A number value is converted to string by translating its integer portion
+into a sequence of decimal digits (`0` through `9`), and then if it has a
+non-zero fractional part, a period `.` followed by a sequence of decimal
+digits representing its fractional part. No exponent portion is included.
+The number is converted at its full precision. Conversion from number to
+string is safe.
+
+A string is converted to a number value by reversing the above mapping.
+No exponent portion is allowed. Conversion from string to number is unsafe.
+It is an error to convert a string that does not comply with the expected
+syntax to type number.
+
+No direct conversion is available between the bool and number types.
+
+### Collection and Structural Type Conversions
+
+Conversion from set types to list types is _safe_, as long as their
+element types are safely convertable. If the element types are _unsafely_
+convertable, then the collection conversion is also unsafe. Each set element
+becomes a corresponding list element, in an undefined order. Although no
+particular ordering is required, implementations _should_ produce list
+elements in a consistent order for a given input set, as a convenience
+to calling applications.
+
+Conversion from list types to set types is _unsafe_, as long as their element
+types are convertable. Each distinct list item becomes a distinct set item.
+If two list items are equal, one of the two is lost in the conversion.
+
+Conversion from tuple types to list types permitted if all of the
+tuple element types are convertable to the target list element type.
+The safety of the conversion depends on the safety of each of the element
+conversions. Each element in turn is converted to the list element type,
+producing a list of identical length.
+
+Conversion from tuple types to set types is permitted, behaving as if the
+tuple type was first converted to a list of the same element type and then
+that list converted to the target set type.
+
+Conversion from object types to map types is permitted if all of the object
+attribute types are convertable to the target map element type. The safety
+of the conversion depends on the safety of each of the attribute conversions.
+Each attribute in turn is converted to the map element type, and map element
+keys are set to the name of each corresponding object attribute.
+
+Conversion from list and set types to tuple types is permitted, following
+the opposite steps as the converse conversions. Such conversions are _unsafe_.
+It is an error to convert a list or set to a tuple type whose number of
+elements does not match the list or set length.
+
+Conversion from map types to object types is permitted if each map key
+corresponds to an attribute in the target object type. It is an error to
+convert from a map value whose set of keys does not exactly match the target
+type's attributes. The conversion takes the opposite steps of the converse
+conversion.
+
+Conversion from one object type to another is permitted as long as the
+common attribute names have convertable types. Any attribute present in the
+target type but not in the source type is populated with a null value of
+the appropriate type.
+
+Conversion from one tuple type to another is permitted as long as the
+tuples have the same length and the elements have convertable types.
+
+### Type Unification
+
+Type unification is an operation that takes a list of types and attempts
+to find a single type to which they can all be converted. Since some
+type pairs have bidirectional conversions, preference is given to _safe_
+conversions. In technical terms, all possible types are arranged into
+a lattice, from which a most general supertype is selected where possible.
+
+The type resulting from type unification may be one of the input types, or
+it may be an entirely new type produced by combination of two or more
+input types.
+
+The following rules do not guarantee a valid result. In addition to these
+rules, unification fails if any of the given types are not convertable
+(per the above rules) to the selected result type.
+
+The following unification rules apply transitively. That is, if a rule is
+defined from A to B, and one from B to C, then A can unify to C.
+
+Number and bool types both unify with string by preferring string.
+
+Two collection types of the same kind unify according to the unification
+of their element types.
+
+List and set types unify by preferring the list type.
+
+Map and object types unify by preferring the object type.
+
+List, set and tuple types unify by preferring the tuple type.
+
+The dynamic pseudo-type unifies with any other type by selecting that other
+type. The dynamic pseudo-type is the result type only if _all_ input types
+are the dynamic pseudo-type.
+
+Two object types unify by constructing a new type whose attributes are
+the union of those of the two input types. Any common attributes themselves
+have their types unified.
+
+Two tuple types of the same length unify constructing a new type of the
+same length whose elements are the unification of the corresponding elements
+in the two input types.
+
+## Static Analysis
+
+In most applications, full expression evaluation is sufficient for understanding
+the provided configuration. However, some specialized applications require more
+direct access to the physical structures in the expressions, which can for
+example allow the construction of new language constructs in terms of the
+existing syntax elements.
+
+Since static analysis analyses the physical structure of configuration, the
+details will vary depending on syntax. Each syntax must decide which of its
+physical structures corresponds to the following analyses, producing error
+diagnostics if they are applied to inappropriate expressions.
+
+The following are the required static analysis functions:
+
+* **Static List**: Require list/tuple construction syntax to be used and
+  return a list of expressions for each of the elements given.
+
+* **Static Map**: Require map/object construction syntax to be used and
+  return a list of key/value pairs -- both expressions -- for each of
+  the elements given. The usual constraint that a map key must be a string
+  must not apply to this analysis, thus allowing applications to interpret
+  arbitrary keys as they see fit.
+
+* **Static Call**: Require function call syntax to be used and return an
+  object describing the called function name and a list of expressions
+  representing each of the call arguments.
+
+* **Static Traversal**: Require a reference to a symbol in the variable
+  scope and return a description of the path from the root scope to the
+  accessed attribute or index.
+
+The intent of a calling application using these features is to require a more
+rigid interpretation of the configuration than in expression evaluation.
+Syntax implementations should make use of the extra contextual information
+provided in order to make an intuitive mapping onto the constructs of the
+underlying syntax, possibly interpreting the expression slightly differently
+than it would be interpreted in normal evaluation.
+
+Each syntax must define which of its expression elements each of the analyses
+above applies to, and how those analyses behave given those expression elements.
+
+## Implementation Considerations
+
+Implementations of this specification are free to adopt any strategy that
+produces behavior consistent with the specification. This non-normative
+section describes some possible implementation strategies that are consistent
+with the goals of this specification.
+
+### Language-agnosticism
+
+The language-agnosticism of this specification assumes that certain behaviors
+are implemented separately for each syntax:
+
+* Matching of a body schema with the physical elements of a body in the
+  source language, to determine correspondance between physical constructs
+  and schema elements.
+
+* Implementing the _dynamic attributes_ body processing mode by either
+  interpreting all physical constructs as attributes or producing an error
+  if non-attribute constructs are present.
+
+* Providing an evaluation function for all possible expressions that produces
+  a value given an evaluation context.
+
+* Providing the static analysis functionality described above in a manner that
+  makes sense within the convention of the syntax.
+
+The suggested implementation strategy is to use an implementation language's
+closest concept to an _abstract type_, _virtual type_ or _interface type_
+to represent both Body and Expression. Each language-specific implementation
+can then provide an implementation of each of these types wrapping AST nodes
+or other physical constructs from the language parser.
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/static_expr.go b/vendor/github.com/hashicorp/hcl2/hcl/static_expr.go
new file mode 100644
index 0000000..98ada87
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/static_expr.go
@@ -0,0 +1,40 @@
+package hcl
+
+import (
+        "github.com/zclconf/go-cty/cty"
+)
+
+type staticExpr struct {
+        val cty.Value
+        rng Range
+}
+
+// StaticExpr returns an Expression that always evaluates to the given value.
+//
+// This is useful to substitute default values for expressions that are
+// not explicitly given in configuration and thus would otherwise have no
+// Expression to return.
+//
+// Since expressions are expected to have a source range, the caller must
+// provide one. Ideally this should be a real source range, but it can
+// be a synthetic one (with an empty-string filename) if no suitable range
+// is available.
+func StaticExpr(val cty.Value, rng Range) Expression {
+        return staticExpr{val, rng}
+}
+
+func (e staticExpr) Value(ctx *EvalContext) (cty.Value, Diagnostics) {
+        return e.val, nil
+}
+
+func (e staticExpr) Variables() []Traversal {
+        return nil
+}
+
+func (e staticExpr) Range() Range {
+        return e.rng
+}
+
+func (e staticExpr) StartRange() Range {
+        return e.rng
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/structure.go b/vendor/github.com/hashicorp/hcl2/hcl/structure.go
new file mode 100644
index 0000000..b336f30
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/structure.go
@@ -0,0 +1,151 @@
+package hcl
+
+import (
+        "github.com/zclconf/go-cty/cty"
+)
+
+// File is the top-level node that results from parsing a HCL file.
+type File struct {
+        Body  Body
+        Bytes []byte
+
+        // Nav is used to integrate with the "hcled" editor integration package,
+        // and with diagnostic information formatters. It is not for direct use
+        // by a calling application.
+        Nav interface{}
+}
+
+// Block represents a nested block within a Body.
+type Block struct {
+        Type   string
+        Labels []string
+        Body   Body
+
+        DefRange    Range   // Range that can be considered the "definition" for seeking in an editor
+        TypeRange   Range   // Range for the block type declaration specifically.
+        LabelRanges []Range // Ranges for the label values specifically.
+}
+
+// Blocks is a sequence of Block.
+type Blocks []*Block
+
+// Attributes is a set of attributes keyed by their names.
+type Attributes map[string]*Attribute
+
+// Body is a container for attributes and blocks. It serves as the primary
+// unit of heirarchical structure within configuration.
+//
+// The content of a body cannot be meaningfully intepreted without a schema,
+// so Body represents the raw body content and has methods that allow the
+// content to be extracted in terms of a given schema.
+type Body interface {
+        // Content verifies that the entire body content conforms to the given
+        // schema and then returns it, and/or returns diagnostics. The returned
+        // body content is valid if non-nil, regardless of whether Diagnostics
+        // are provided, but diagnostics should still be eventually shown to
+        // the user.
+        Content(schema *BodySchema) (*BodyContent, Diagnostics)
+
+        // PartialContent is like Content except that it permits the configuration
+        // to contain additional blocks or attributes not specified in the
+        // schema. If any are present, the returned Body is non-nil and contains
+        // the remaining items from the body that were not selected by the schema.
+        PartialContent(schema *BodySchema) (*BodyContent, Body, Diagnostics)
+
+        // JustAttributes attempts to interpret all of the contents of the body
+        // as attributes, allowing for the contents to be accessed without a priori
+        // knowledge of the structure.
+        //
+        // The behavior of this method depends on the body's source language.
+        // Some languages, like JSON, can't distinguish between attributes and
+        // blocks without schema hints, but for languages that _can_ error
+        // diagnostics will be generated if any blocks are present in the body.
+        //
+        // Diagnostics may be produced for other reasons too, such as duplicate
+        // declarations of the same attribute.
+        JustAttributes() (Attributes, Diagnostics)
+
+        // MissingItemRange returns a range that represents where a missing item
+        // might hypothetically be inserted. This is used when producing
+        // diagnostics about missing required attributes or blocks. Not all bodies
+        // will have an obvious single insertion point, so the result here may
+        // be rather arbitrary.
+        MissingItemRange() Range
+}
+
+// BodyContent is the result of applying a BodySchema to a Body.
+type BodyContent struct {
+        Attributes Attributes
+        Blocks     Blocks
+
+        MissingItemRange Range
+}
+
+// Attribute represents an attribute from within a body.
+type Attribute struct {
+        Name string
+        Expr Expression
+
+        Range     Range
+        NameRange Range
+}
+
+// Expression is a literal value or an expression provided in the
+// configuration, which can be evaluated within a scope to produce a value.
+type Expression interface {
+        // Value returns the value resulting from evaluating the expression
+        // in the given evaluation context.
+        //
+        // The context may be nil, in which case the expression may contain
+        // only constants and diagnostics will be produced for any non-constant
+        // sub-expressions. (The exact definition of this depends on the source
+        // language.)
+        //
+        // The context may instead be set but have either its Variables or
+        // Functions maps set to nil, in which case only use of these features
+        // will return diagnostics.
+        //
+        // Different diagnostics are provided depending on whether the given
+        // context maps are nil or empty. In the former case, the message
+        // tells the user that variables/functions are not permitted at all,
+        // while in the latter case usage will produce a "not found" error for
+        // the specific symbol in question.
+        Value(ctx *EvalContext) (cty.Value, Diagnostics)
+
+        // Variables returns a list of variables referenced in the receiving
+        // expression. These are expressed as absolute Traversals, so may include
+        // additional information about how the variable is used, such as
+        // attribute lookups, which the calling application can potentially use
+        // to only selectively populate the scope.
+        Variables() []Traversal
+
+        Range() Range
+        StartRange() Range
+}
+
+// OfType filters the receiving block sequence by block type name,
+// returning a new block sequence including only the blocks of the
+// requested type.
+func (els Blocks) OfType(typeName string) Blocks {
+        ret := make(Blocks, 0)
+        for _, el := range els {
+                if el.Type == typeName {
+                        ret = append(ret, el)
+                }
+        }
+        return ret
+}
+
+// ByType transforms the receiving block sequence into a map from type
+// name to block sequences of only that type.
+func (els Blocks) ByType() map[string]Blocks {
+        ret := make(map[string]Blocks)
+        for _, el := range els {
+                ty := el.Type
+                if ret[ty] == nil {
+                        ret[ty] = make(Blocks, 0, 1)
+                }
+                ret[ty] = append(ret[ty], el)
+        }
+        return ret
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/traversal.go b/vendor/github.com/hashicorp/hcl2/hcl/traversal.go
new file mode 100644
index 0000000..24f4c91
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/traversal.go
@@ -0,0 +1,352 @@
+package hcl
+
+import (
+        "fmt"
+
+        "github.com/zclconf/go-cty/cty"
+)
+
+// A Traversal is a description of traversing through a value through a
+// series of operations such as attribute lookup, index lookup, etc.
+//
+// It is used to look up values in scopes, for example.
+//
+// The traversal operations are implementations of interface Traverser.
+// This is a closed set of implementations, so the interface cannot be
+// implemented from outside this package.
+//
+// A traversal can be absolute (its first value is a symbol name) or relative
+// (starts from an existing value).
+type Traversal []Traverser
+
+// TraversalJoin appends a relative traversal to an absolute traversal to
+// produce a new absolute traversal.
+func TraversalJoin(abs Traversal, rel Traversal) Traversal {
+        if abs.IsRelative() {
+                panic("first argument to TraversalJoin must be absolute")
+        }
+        if !rel.IsRelative() {
+                panic("second argument to TraversalJoin must be relative")
+        }
+
+        ret := make(Traversal, len(abs)+len(rel))
+        copy(ret, abs)
+        copy(ret[len(abs):], rel)
+        return ret
+}
+
+// TraverseRel applies the receiving traversal to the given value, returning
+// the resulting value. This is supported only for relative traversals,
+// and will panic if applied to an absolute traversal.
+func (t Traversal) TraverseRel(val cty.Value) (cty.Value, Diagnostics) {
+        if !t.IsRelative() {
+                panic("can't use TraverseRel on an absolute traversal")
+        }
+
+        current := val
+        var diags Diagnostics
+        for _, tr := range t {
+                var newDiags Diagnostics
+                current, newDiags = tr.TraversalStep(current)
+                diags = append(diags, newDiags...)
+                if newDiags.HasErrors() {
+                        return cty.DynamicVal, diags
+                }
+        }
+        return current, diags
+}
+
+// TraverseAbs applies the receiving traversal to the given eval context,
+// returning the resulting value. This is supported only for absolute
+// traversals, and will panic if applied to a relative traversal.
+func (t Traversal) TraverseAbs(ctx *EvalContext) (cty.Value, Diagnostics) {
+        if t.IsRelative() {
+                panic("can't use TraverseAbs on a relative traversal")
+        }
+
+        split := t.SimpleSplit()
+        root := split.Abs[0].(TraverseRoot)
+        name := root.Name
+
+        thisCtx := ctx
+        hasNonNil := false
+        for thisCtx != nil {
+                if thisCtx.Variables == nil {
+                        thisCtx = thisCtx.parent
+                        continue
+                }
+                hasNonNil = true
+                val, exists := thisCtx.Variables[name]
+                if exists {
+                        return split.Rel.TraverseRel(val)
+                }
+                thisCtx = thisCtx.parent
+        }
+
+        if !hasNonNil {
+                return cty.DynamicVal, Diagnostics{
+                        {
+                                Severity: DiagError,
+                                Summary:  "Variables not allowed",
+                                Detail:   "Variables may not be used here.",
+                                Subject:  &root.SrcRange,
+                        },
+                }
+        }
+
+        suggestions := make([]string, 0, len(ctx.Variables))
+        thisCtx = ctx
+        for thisCtx != nil {
+                for k := range thisCtx.Variables {
+                        suggestions = append(suggestions, k)
+                }
+                thisCtx = thisCtx.parent
+        }
+        suggestion := nameSuggestion(name, suggestions)
+        if suggestion != "" {
+                suggestion = fmt.Sprintf(" Did you mean %q?", suggestion)
+        }
+
+        return cty.DynamicVal, Diagnostics{
+                {
+                        Severity: DiagError,
+                        Summary:  "Unknown variable",
+                        Detail:   fmt.Sprintf("There is no variable named %q.%s", name, suggestion),
+                        Subject:  &root.SrcRange,
+                },
+        }
+}
+
+// IsRelative returns true if the receiver is a relative traversal, or false
+// otherwise.
+func (t Traversal) IsRelative() bool {
+        if len(t) == 0 {
+                return true
+        }
+        if _, firstIsRoot := t[0].(TraverseRoot); firstIsRoot {
+                return false
+        }
+        return true
+}
+
+// SimpleSplit returns a TraversalSplit where the name lookup is the absolute
+// part and the remainder is the relative part. Supported only for
+// absolute traversals, and will panic if applied to a relative traversal.
+//
+// This can be used by applications that have a relatively-simple variable
+// namespace where only the top-level is directly populated in the scope, with
+// everything else handled by relative lookups from those initial values.
+func (t Traversal) SimpleSplit() TraversalSplit {
+        if t.IsRelative() {
+                panic("can't use SimpleSplit on a relative traversal")
+        }
+        return TraversalSplit{
+                Abs: t[0:1],
+                Rel: t[1:],
+        }
+}
+
+// RootName returns the root name for a absolute traversal. Will panic if
+// called on a relative traversal.
+func (t Traversal) RootName() string {
+        if t.IsRelative() {
+                panic("can't use RootName on a relative traversal")
+
+        }
+        return t[0].(TraverseRoot).Name
+}
+
+// SourceRange returns the source range for the traversal.
+func (t Traversal) SourceRange() Range {
+        if len(t) == 0 {
+                // Nothing useful to return here, but we'll return something
+                // that's correctly-typed at least.
+                return Range{}
+        }
+
+        return RangeBetween(t[0].SourceRange(), t[len(t)-1].SourceRange())
+}
+
+// TraversalSplit represents a pair of traversals, the first of which is
+// an absolute traversal and the second of which is relative to the first.
+//
+// This is used by calling applications that only populate prefixes of the
+// traversals in the scope, with Abs representing the part coming from the
+// scope and Rel representing the remaining steps once that part is
+// retrieved.
+type TraversalSplit struct {
+        Abs Traversal
+        Rel Traversal
+}
+
+// TraverseAbs traverses from a scope to the value resulting from the
+// absolute traversal.
+func (t TraversalSplit) TraverseAbs(ctx *EvalContext) (cty.Value, Diagnostics) {
+        return t.Abs.TraverseAbs(ctx)
+}
+
+// TraverseRel traverses from a given value, assumed to be the result of
+// TraverseAbs on some scope, to a final result for the entire split traversal.
+func (t TraversalSplit) TraverseRel(val cty.Value) (cty.Value, Diagnostics) {
+        return t.Rel.TraverseRel(val)
+}
+
+// Traverse is a convenience function to apply TraverseAbs followed by
+// TraverseRel.
+func (t TraversalSplit) Traverse(ctx *EvalContext) (cty.Value, Diagnostics) {
+        v1, diags := t.TraverseAbs(ctx)
+        if diags.HasErrors() {
+                return cty.DynamicVal, diags
+        }
+        v2, newDiags := t.TraverseRel(v1)
+        diags = append(diags, newDiags...)
+        return v2, diags
+}
+
+// Join concatenates together the Abs and Rel parts to produce a single
+// absolute traversal.
+func (t TraversalSplit) Join() Traversal {
+        return TraversalJoin(t.Abs, t.Rel)
+}
+
+// RootName returns the root name for the absolute part of the split.
+func (t TraversalSplit) RootName() string {
+        return t.Abs.RootName()
+}
+
+// A Traverser is a step within a Traversal.
+type Traverser interface {
+        TraversalStep(cty.Value) (cty.Value, Diagnostics)
+        SourceRange() Range
+        isTraverserSigil() isTraverser
+}
+
+// Embed this in a struct to declare it as a Traverser
+type isTraverser struct {
+}
+
+func (tr isTraverser) isTraverserSigil() isTraverser {
+        return isTraverser{}
+}
+
+// TraverseRoot looks up a root name in a scope. It is used as the first step
+// of an absolute Traversal, and cannot itself be traversed directly.
+type TraverseRoot struct {
+        isTraverser
+        Name     string
+        SrcRange Range
+}
+
+// TraversalStep on a TraverseName immediately panics, because absolute
+// traversals cannot be directly traversed.
+func (tn TraverseRoot) TraversalStep(cty.Value) (cty.Value, Diagnostics) {
+        panic("Cannot traverse an absolute traversal")
+}
+
+func (tn TraverseRoot) SourceRange() Range {
+        return tn.SrcRange
+}
+
+// TraverseAttr looks up an attribute in its initial value.
+type TraverseAttr struct {
+        isTraverser
+        Name     string
+        SrcRange Range
+}
+
+func (tn TraverseAttr) TraversalStep(val cty.Value) (cty.Value, Diagnostics) {
+        if val.IsNull() {
+                return cty.DynamicVal, Diagnostics{
+                        {
+                                Severity: DiagError,
+                                Summary:  "Attempt to get attribute from null value",
+                                Detail:   "This value is null, so it does not have any attributes.",
+                                Subject:  &tn.SrcRange,
+                        },
+                }
+        }
+
+        ty := val.Type()
+        switch {
+        case ty.IsObjectType():
+                if !ty.HasAttribute(tn.Name) {
+                        return cty.DynamicVal, Diagnostics{
+                                {
+                                        Severity: DiagError,
+                                        Summary:  "Unsupported attribute",
+                                        Detail:   fmt.Sprintf("This object does not have an attribute named %q.", tn.Name),
+                                        Subject:  &tn.SrcRange,
+                                },
+                        }
+                }
+
+                if !val.IsKnown() {
+                        return cty.UnknownVal(ty.AttributeType(tn.Name)), nil
+                }
+
+                return val.GetAttr(tn.Name), nil
+        case ty.IsMapType():
+                if !val.IsKnown() {
+                        return cty.UnknownVal(ty.ElementType()), nil
+                }
+
+                idx := cty.StringVal(tn.Name)
+                if val.HasIndex(idx).False() {
+                        return cty.DynamicVal, Diagnostics{
+                                {
+                                        Severity: DiagError,
+                                        Summary:  "Missing map element",
+                                        Detail:   fmt.Sprintf("This map does not have an element with the key %q.", tn.Name),
+                                        Subject:  &tn.SrcRange,
+                                },
+                        }
+                }
+
+                return val.Index(idx), nil
+        case ty == cty.DynamicPseudoType:
+                return cty.DynamicVal, nil
+        default:
+                return cty.DynamicVal, Diagnostics{
+                        {
+                                Severity: DiagError,
+                                Summary:  "Unsupported attribute",
+                                Detail:   "This value does not have any attributes.",
+                                Subject:  &tn.SrcRange,
+                        },
+                }
+        }
+}
+
+func (tn TraverseAttr) SourceRange() Range {
+        return tn.SrcRange
+}
+
+// TraverseIndex applies the index operation to its initial value.
+type TraverseIndex struct {
+        isTraverser
+        Key      cty.Value
+        SrcRange Range
+}
+
+func (tn TraverseIndex) TraversalStep(val cty.Value) (cty.Value, Diagnostics) {
+        return Index(val, tn.Key, &tn.SrcRange)
+}
+
+func (tn TraverseIndex) SourceRange() Range {
+        return tn.SrcRange
+}
+
+// TraverseSplat applies the splat operation to its initial value.
+type TraverseSplat struct {
+        isTraverser
+        Each     Traversal
+        SrcRange Range
+}
+
+func (tn TraverseSplat) TraversalStep(val cty.Value) (cty.Value, Diagnostics) {
+        panic("TraverseSplat not yet implemented")
+}
+
+func (tn TraverseSplat) SourceRange() Range {
+        return tn.SrcRange
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcl/traversal_for_expr.go b/vendor/github.com/hashicorp/hcl2/hcl/traversal_for_expr.go
new file mode 100644
index 0000000..5f52946
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcl/traversal_for_expr.go
@@ -0,0 +1,121 @@
+package hcl
+
+// AbsTraversalForExpr attempts to interpret the given expression as
+// an absolute traversal, or returns error diagnostic(s) if that is
+// not possible for the given expression.
+//
+// A particular Expression implementation can support this function by
+// offering a method called AsTraversal that takes no arguments and
+// returns either a valid absolute traversal or nil to indicate that
+// no traversal is possible. Alternatively, an implementation can support
+// UnwrapExpression to delegate handling of this function to a wrapped
+// Expression object.
+//
+// In most cases the calling application is interested in the value
+// that results from an expression, but in rarer cases the application
+// needs to see the the name of the variable and subsequent
+// attributes/indexes itself, for example to allow users to give references
+// to the variables themselves rather than to their values. An implementer
+// of this function should at least support attribute and index steps.
+func AbsTraversalForExpr(expr Expression) (Traversal, Diagnostics) {
+        type asTraversal interface {
+                AsTraversal() Traversal
+        }
+
+        physExpr := UnwrapExpressionUntil(expr, func(expr Expression) bool {
+                _, supported := expr.(asTraversal)
+                return supported
+        })
+
+        if asT, supported := physExpr.(asTraversal); supported {
+                if traversal := asT.AsTraversal(); traversal != nil {
+                        return traversal, nil
+                }
+        }
+        return nil, Diagnostics{
+                &Diagnostic{
+                        Severity: DiagError,
+                        Summary:  "Invalid expression",
+                        Detail:   "A static variable reference is required.",
+                        Subject:  expr.Range().Ptr(),
+                },
+        }
+}
+
+// RelTraversalForExpr is similar to AbsTraversalForExpr but it returns
+// a relative traversal instead. Due to the nature of HCL expressions, the
+// first element of the returned traversal is always a TraverseAttr, and
+// then it will be followed by zero or more other expressions.
+//
+// Any expression accepted by AbsTraversalForExpr is also accepted by
+// RelTraversalForExpr.
+func RelTraversalForExpr(expr Expression) (Traversal, Diagnostics) {
+        traversal, diags := AbsTraversalForExpr(expr)
+        if len(traversal) > 0 {
+                root := traversal[0].(TraverseRoot)
+                traversal[0] = TraverseAttr{
+                        Name:     root.Name,
+                        SrcRange: root.SrcRange,
+                }
+        }
+        return traversal, diags
+}
+
+// ExprAsKeyword attempts to interpret the given expression as a static keyword,
+// returning the keyword string if possible, and the empty string if not.
+//
+// A static keyword, for the sake of this function, is a single identifier.
+// For example, the following attribute has an expression that would produce
+// the keyword "foo":
+//
+//     example = foo
+//
+// This function is a variant of AbsTraversalForExpr, which uses the same
+// interface on the given expression. This helper constrains the result
+// further by requiring only a single root identifier.
+//
+// This function is intended to be used with the following idiom, to recognize
+// situations where one of a fixed set of keywords is required and arbitrary
+// expressions are not allowed:
+//
+//     switch hcl.ExprAsKeyword(expr) {
+//     case "allow":
+//         // (take suitable action for keyword "allow")
+//     case "deny":
+//         // (take suitable action for keyword "deny")
+//     default:
+//         diags = append(diags, &hcl.Diagnostic{
+//             // ... "invalid keyword" diagnostic message ...
+//         })
+//     }
+//
+// The above approach will generate the same message for both the use of an
+// unrecognized keyword and for not using a keyword at all, which is usually
+// reasonable if the message specifies that the given value must be a keyword
+// from that fixed list.
+//
+// Note that in the native syntax the keywords "true", "false", and "null" are
+// recognized as literal values during parsing and so these reserved words
+// cannot not be accepted as keywords by this function.
+//
+// Since interpreting an expression as a keyword bypasses usual expression
+// evaluation, it should be used sparingly for situations where e.g. one of
+// a fixed set of keywords is used in a structural way in a special attribute
+// to affect the further processing of a block.
+func ExprAsKeyword(expr Expression) string {
+        type asTraversal interface {
+                AsTraversal() Traversal
+        }
+
+        physExpr := UnwrapExpressionUntil(expr, func(expr Expression) bool {
+                _, supported := expr.(asTraversal)
+                return supported
+        })
+
+        if asT, supported := physExpr.(asTraversal); supported {
+                if traversal := asT.AsTraversal(); len(traversal) == 1 {
+                        return traversal.RootName()
+                }
+        }
+        return ""
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcldec/block_labels.go b/vendor/github.com/hashicorp/hcl2/hcldec/block_labels.go
new file mode 100644
index 0000000..7e652e9
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcldec/block_labels.go
@@ -0,0 +1,21 @@
+package hcldec
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+type blockLabel struct {
+        Value string
+        Range hcl.Range
+}
+
+func labelsForBlock(block *hcl.Block) []blockLabel {
+        ret := make([]blockLabel, len(block.Labels))
+        for i := range block.Labels {
+                ret[i] = blockLabel{
+                        Value: block.Labels[i],
+                        Range: block.LabelRanges[i],
+                }
+        }
+        return ret
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcldec/decode.go b/vendor/github.com/hashicorp/hcl2/hcldec/decode.go
new file mode 100644
index 0000000..6cf93fe
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcldec/decode.go
@@ -0,0 +1,36 @@
+package hcldec
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+)
+
+func decode(body hcl.Body, blockLabels []blockLabel, ctx *hcl.EvalContext, spec Spec, partial bool) (cty.Value, hcl.Body, hcl.Diagnostics) {
+        schema := ImpliedSchema(spec)
+
+        var content *hcl.BodyContent
+        var diags hcl.Diagnostics
+        var leftovers hcl.Body
+
+        if partial {
+                content, leftovers, diags = body.PartialContent(schema)
+        } else {
+                content, diags = body.Content(schema)
+        }
+
+        val, valDiags := spec.decode(content, blockLabels, ctx)
+        diags = append(diags, valDiags...)
+
+        return val, leftovers, diags
+}
+
+func impliedType(spec Spec) cty.Type {
+        return spec.impliedType()
+}
+
+func sourceRange(body hcl.Body, blockLabels []blockLabel, spec Spec) hcl.Range {
+        schema := ImpliedSchema(spec)
+        content, _, _ := body.PartialContent(schema)
+
+        return spec.sourceRange(content, blockLabels)
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcldec/doc.go b/vendor/github.com/hashicorp/hcl2/hcldec/doc.go
new file mode 100644
index 0000000..23bfe54
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcldec/doc.go
@@ -0,0 +1,12 @@
+// Package hcldec provides a higher-level API for unpacking the content of
+// HCL bodies, implemented in terms of the low-level "Content" API exposed
+// by the bodies themselves.
+//
+// It allows decoding an entire nested configuration in a single operation
+// by providing a description of the intended structure.
+//
+// For some applications it may be more convenient to use the "gohcl"
+// package, which has a similar purpose but decodes directly into native
+// Go data types. hcldec instead targets the cty type system, and thus allows
+// a cty-driven application to remain within that type system.
+package hcldec
diff --git a/vendor/github.com/hashicorp/hcl2/hcldec/gob.go b/vendor/github.com/hashicorp/hcl2/hcldec/gob.go
new file mode 100644
index 0000000..e2027cf
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcldec/gob.go
@@ -0,0 +1,23 @@
+package hcldec
+
+import (
+        "encoding/gob"
+)
+
+func init() {
+        // Every Spec implementation should be registered with gob, so that
+        // specs can be sent over gob channels, such as using
+        // github.com/hashicorp/go-plugin with plugins that need to describe
+        // what shape of configuration they are expecting.
+        gob.Register(ObjectSpec(nil))
+        gob.Register(TupleSpec(nil))
+        gob.Register((*AttrSpec)(nil))
+        gob.Register((*LiteralSpec)(nil))
+        gob.Register((*ExprSpec)(nil))
+        gob.Register((*BlockSpec)(nil))
+        gob.Register((*BlockListSpec)(nil))
+        gob.Register((*BlockSetSpec)(nil))
+        gob.Register((*BlockMapSpec)(nil))
+        gob.Register((*BlockLabelSpec)(nil))
+        gob.Register((*DefaultSpec)(nil))
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcldec/public.go b/vendor/github.com/hashicorp/hcl2/hcldec/public.go
new file mode 100644
index 0000000..5d1f10a
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcldec/public.go
@@ -0,0 +1,78 @@
+package hcldec
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// Decode interprets the given body using the given specification and returns
+// the resulting value. If the given body is not valid per the spec, error
+// diagnostics are returned and the returned value is likely to be incomplete.
+//
+// The ctx argument may be nil, in which case any references to variables or
+// functions will produce error diagnostics.
+func Decode(body hcl.Body, spec Spec, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        val, _, diags := decode(body, nil, ctx, spec, false)
+        return val, diags
+}
+
+// PartialDecode is like Decode except that it permits "leftover" items in
+// the top-level body, which are returned as a new body to allow for
+// further processing.
+//
+// Any descendent block bodies are _not_ decoded partially and thus must
+// be fully described by the given specification.
+func PartialDecode(body hcl.Body, spec Spec, ctx *hcl.EvalContext) (cty.Value, hcl.Body, hcl.Diagnostics) {
+        return decode(body, nil, ctx, spec, true)
+}
+
+// ImpliedType returns the value type that should result from decoding the
+// given spec.
+func ImpliedType(spec Spec) cty.Type {
+        return impliedType(spec)
+}
+
+// SourceRange interprets the given body using the given specification and
+// then returns the source range of the value that would be used to
+// fulfill the spec.
+//
+// This can be used if application-level validation detects value errors, to
+// obtain a reasonable SourceRange to use for generated diagnostics. It works
+// best when applied to specific body items (e.g. using AttrSpec, BlockSpec, ...)
+// as opposed to entire bodies using ObjectSpec, TupleSpec. The result will
+// be less useful the broader the specification, so e.g. a spec that returns
+// the entirety of all of the blocks of a given type is likely to be
+// _particularly_ arbitrary and useless.
+//
+// If the given body is not valid per the given spec, the result is best-effort
+// and may not actually be something ideal. It's expected that an application
+// will already have used Decode or PartialDecode earlier and thus had an
+// opportunity to detect and report spec violations.
+func SourceRange(body hcl.Body, spec Spec) hcl.Range {
+        return sourceRange(body, nil, spec)
+}
+
+// ChildBlockTypes returns a map of all of the child block types declared
+// by the given spec, with block type names as keys and the associated
+// nested body specs as values.
+func ChildBlockTypes(spec Spec) map[string]Spec {
+        ret := map[string]Spec{}
+
+        // visitSameBodyChildren walks through the spec structure, calling
+        // the given callback for each descendent spec encountered. We are
+        // interested in the specs that reference attributes and blocks.
+        var visit visitFunc
+        visit = func(s Spec) {
+                if bs, ok := s.(blockSpec); ok {
+                        for _, blockS := range bs.blockHeaderSchemata() {
+                                ret[blockS.Type] = bs.nestedSpec()
+                        }
+                }
+
+                s.visitSameBodyChildren(visit)
+        }
+
+        visit(spec)
+
+        return ret
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcldec/schema.go b/vendor/github.com/hashicorp/hcl2/hcldec/schema.go
new file mode 100644
index 0000000..b57bd96
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcldec/schema.go
@@ -0,0 +1,36 @@
+package hcldec
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+// ImpliedSchema returns the *hcl.BodySchema implied by the given specification.
+// This is the schema that the Decode function will use internally to
+// access the content of a given body.
+func ImpliedSchema(spec Spec) *hcl.BodySchema {
+        var attrs []hcl.AttributeSchema
+        var blocks []hcl.BlockHeaderSchema
+
+        // visitSameBodyChildren walks through the spec structure, calling
+        // the given callback for each descendent spec encountered. We are
+        // interested in the specs that reference attributes and blocks.
+        var visit visitFunc
+        visit = func(s Spec) {
+                if as, ok := s.(attrSpec); ok {
+                        attrs = append(attrs, as.attrSchemata()...)
+                }
+
+                if bs, ok := s.(blockSpec); ok {
+                        blocks = append(blocks, bs.blockHeaderSchemata()...)
+                }
+
+                s.visitSameBodyChildren(visit)
+        }
+
+        visit(spec)
+
+        return &hcl.BodySchema{
+                Attributes: attrs,
+                Blocks:     blocks,
+        }
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcldec/spec.go b/vendor/github.com/hashicorp/hcl2/hcldec/spec.go
new file mode 100644
index 0000000..25cafcd
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcldec/spec.go
@@ -0,0 +1,998 @@
+package hcldec
+
+import (
+        "bytes"
+        "fmt"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+        "github.com/zclconf/go-cty/cty/function"
+)
+
+// A Spec is a description of how to decode a hcl.Body to a cty.Value.
+//
+// The various other types in this package whose names end in "Spec" are
+// the spec implementations. The most common top-level spec is ObjectSpec,
+// which decodes body content into a cty.Value of an object type.
+type Spec interface {
+        // Perform the decode operation on the given body, in the context of
+        // the given block (which might be null), using the given eval context.
+        //
+        // "block" is provided only by the nested calls performed by the spec
+        // types that work on block bodies.
+        decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics)
+
+        // Return the cty.Type that should be returned when decoding a body with
+        // this spec.
+        impliedType() cty.Type
+
+        // Call the given callback once for each of the nested specs that would
+        // get decoded with the same body and block as the receiver. This should
+        // not descend into the nested specs used when decoding blocks.
+        visitSameBodyChildren(cb visitFunc)
+
+        // Determine the source range of the value that would be returned for the
+        // spec in the given content, in the context of the given block
+        // (which might be null). If the corresponding item is missing, return
+        // a place where it might be inserted.
+        sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range
+}
+
+type visitFunc func(spec Spec)
+
+// An ObjectSpec is a Spec that produces a cty.Value of an object type whose
+// attributes correspond to the keys of the spec map.
+type ObjectSpec map[string]Spec
+
+// attrSpec is implemented by specs that require attributes from the body.
+type attrSpec interface {
+        attrSchemata() []hcl.AttributeSchema
+}
+
+// blockSpec is implemented by specs that require blocks from the body.
+type blockSpec interface {
+        blockHeaderSchemata() []hcl.BlockHeaderSchema
+        nestedSpec() Spec
+}
+
+// specNeedingVariables is implemented by specs that can use variables
+// from the EvalContext, to declare which variables they need.
+type specNeedingVariables interface {
+        variablesNeeded(content *hcl.BodyContent) []hcl.Traversal
+}
+
+func (s ObjectSpec) visitSameBodyChildren(cb visitFunc) {
+        for _, c := range s {
+                cb(c)
+        }
+}
+
+func (s ObjectSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        vals := make(map[string]cty.Value, len(s))
+        var diags hcl.Diagnostics
+
+        for k, spec := range s {
+                var kd hcl.Diagnostics
+                vals[k], kd = spec.decode(content, blockLabels, ctx)
+                diags = append(diags, kd...)
+        }
+
+        return cty.ObjectVal(vals), diags
+}
+
+func (s ObjectSpec) impliedType() cty.Type {
+        if len(s) == 0 {
+                return cty.EmptyObject
+        }
+
+        attrTypes := make(map[string]cty.Type)
+        for k, childSpec := range s {
+                attrTypes[k] = childSpec.impliedType()
+        }
+        return cty.Object(attrTypes)
+}
+
+func (s ObjectSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range {
+        // This is not great, but the best we can do. In practice, it's rather
+        // strange to ask for the source range of an entire top-level body, since
+        // that's already readily available to the caller.
+        return content.MissingItemRange
+}
+
+// A TupleSpec is a Spec that produces a cty.Value of a tuple type whose
+// elements correspond to the elements of the spec slice.
+type TupleSpec []Spec
+
+func (s TupleSpec) visitSameBodyChildren(cb visitFunc) {
+        for _, c := range s {
+                cb(c)
+        }
+}
+
+func (s TupleSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        vals := make([]cty.Value, len(s))
+        var diags hcl.Diagnostics
+
+        for i, spec := range s {
+                var ed hcl.Diagnostics
+                vals[i], ed = spec.decode(content, blockLabels, ctx)
+                diags = append(diags, ed...)
+        }
+
+        return cty.TupleVal(vals), diags
+}
+
+func (s TupleSpec) impliedType() cty.Type {
+        if len(s) == 0 {
+                return cty.EmptyTuple
+        }
+
+        attrTypes := make([]cty.Type, len(s))
+        for i, childSpec := range s {
+                attrTypes[i] = childSpec.impliedType()
+        }
+        return cty.Tuple(attrTypes)
+}
+
+func (s TupleSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range {
+        // This is not great, but the best we can do. In practice, it's rather
+        // strange to ask for the source range of an entire top-level body, since
+        // that's already readily available to the caller.
+        return content.MissingItemRange
+}
+
+// An AttrSpec is a Spec that evaluates a particular attribute expression in
+// the body and returns its resulting value converted to the requested type,
+// or produces a diagnostic if the type is incorrect.
+type AttrSpec struct {
+        Name     string
+        Type     cty.Type
+        Required bool
+}
+
+func (s *AttrSpec) visitSameBodyChildren(cb visitFunc) {
+        // leaf node
+}
+
+// specNeedingVariables implementation
+func (s *AttrSpec) variablesNeeded(content *hcl.BodyContent) []hcl.Traversal {
+        attr, exists := content.Attributes[s.Name]
+        if !exists {
+                return nil
+        }
+
+        return attr.Expr.Variables()
+}
+
+// attrSpec implementation
+func (s *AttrSpec) attrSchemata() []hcl.AttributeSchema {
+        return []hcl.AttributeSchema{
+                {
+                        Name:     s.Name,
+                        Required: s.Required,
+                },
+        }
+}
+
+func (s *AttrSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range {
+        attr, exists := content.Attributes[s.Name]
+        if !exists {
+                return content.MissingItemRange
+        }
+
+        return attr.Expr.Range()
+}
+
+func (s *AttrSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        attr, exists := content.Attributes[s.Name]
+        if !exists {
+                // We don't need to check required and emit a diagnostic here, because
+                // that would already have happened when building "content".
+                return cty.NullVal(s.Type), nil
+        }
+
+        val, diags := attr.Expr.Value(ctx)
+
+        convVal, err := convert.Convert(val, s.Type)
+        if err != nil {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Incorrect attribute value type",
+                        Detail: fmt.Sprintf(
+                                "Inappropriate value for attribute %q: %s.",
+                                s.Name, err.Error(),
+                        ),
+                        Subject: attr.Expr.StartRange().Ptr(),
+                        Context: hcl.RangeBetween(attr.NameRange, attr.Expr.StartRange()).Ptr(),
+                })
+                // We'll return an unknown value of the _correct_ type so that the
+                // incomplete result can still be used for some analysis use-cases.
+                val = cty.UnknownVal(s.Type)
+        } else {
+                val = convVal
+        }
+
+        return val, diags
+}
+
+func (s *AttrSpec) impliedType() cty.Type {
+        return s.Type
+}
+
+// A LiteralSpec is a Spec that produces the given literal value, ignoring
+// the given body.
+type LiteralSpec struct {
+        Value cty.Value
+}
+
+func (s *LiteralSpec) visitSameBodyChildren(cb visitFunc) {
+        // leaf node
+}
+
+func (s *LiteralSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        return s.Value, nil
+}
+
+func (s *LiteralSpec) impliedType() cty.Type {
+        return s.Value.Type()
+}
+
+func (s *LiteralSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range {
+        // No sensible range to return for a literal, so the caller had better
+        // ensure it doesn't cause any diagnostics.
+        return hcl.Range{
+                Filename: "<unknown>",
+        }
+}
+
+// An ExprSpec is a Spec that evaluates the given expression, ignoring the
+// given body.
+type ExprSpec struct {
+        Expr hcl.Expression
+}
+
+func (s *ExprSpec) visitSameBodyChildren(cb visitFunc) {
+        // leaf node
+}
+
+// specNeedingVariables implementation
+func (s *ExprSpec) variablesNeeded(content *hcl.BodyContent) []hcl.Traversal {
+        return s.Expr.Variables()
+}
+
+func (s *ExprSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        return s.Expr.Value(ctx)
+}
+
+func (s *ExprSpec) impliedType() cty.Type {
+        // We can't know the type of our expression until we evaluate it
+        return cty.DynamicPseudoType
+}
+
+func (s *ExprSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range {
+        return s.Expr.Range()
+}
+
+// A BlockSpec is a Spec that produces a cty.Value by decoding the contents
+// of a single nested block of a given type, using a nested spec.
+//
+// If the Required flag is not set, the nested block may be omitted, in which
+// case a null value is produced. If it _is_ set, an error diagnostic is
+// produced if there are no nested blocks of the given type.
+type BlockSpec struct {
+        TypeName string
+        Nested   Spec
+        Required bool
+}
+
+func (s *BlockSpec) visitSameBodyChildren(cb visitFunc) {
+        // leaf node ("Nested" does not use the same body)
+}
+
+// blockSpec implementation
+func (s *BlockSpec) blockHeaderSchemata() []hcl.BlockHeaderSchema {
+        return []hcl.BlockHeaderSchema{
+                {
+                        Type:       s.TypeName,
+                        LabelNames: findLabelSpecs(s.Nested),
+                },
+        }
+}
+
+// blockSpec implementation
+func (s *BlockSpec) nestedSpec() Spec {
+        return s.Nested
+}
+
+// specNeedingVariables implementation
+func (s *BlockSpec) variablesNeeded(content *hcl.BodyContent) []hcl.Traversal {
+        var childBlock *hcl.Block
+        for _, candidate := range content.Blocks {
+                if candidate.Type != s.TypeName {
+                        continue
+                }
+
+                childBlock = candidate
+                break
+        }
+
+        if childBlock == nil {
+                return nil
+        }
+
+        return Variables(childBlock.Body, s.Nested)
+}
+
+func (s *BlockSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+
+        var childBlock *hcl.Block
+        for _, candidate := range content.Blocks {
+                if candidate.Type != s.TypeName {
+                        continue
+                }
+
+                if childBlock != nil {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  fmt.Sprintf("Duplicate %s block", s.TypeName),
+                                Detail: fmt.Sprintf(
+                                        "Only one block of type %q is allowed. Previous definition was at %s.",
+                                        s.TypeName, childBlock.DefRange.String(),
+                                ),
+                                Subject: &candidate.DefRange,
+                        })
+                        break
+                }
+
+                childBlock = candidate
+        }
+
+        if childBlock == nil {
+                if s.Required {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  fmt.Sprintf("Missing %s block", s.TypeName),
+                                Detail: fmt.Sprintf(
+                                        "A block of type %q is required here.", s.TypeName,
+                                ),
+                                Subject: &content.MissingItemRange,
+                        })
+                }
+                return cty.NullVal(s.Nested.impliedType()), diags
+        }
+
+        if s.Nested == nil {
+                panic("BlockSpec with no Nested Spec")
+        }
+        val, _, childDiags := decode(childBlock.Body, labelsForBlock(childBlock), ctx, s.Nested, false)
+        diags = append(diags, childDiags...)
+        return val, diags
+}
+
+func (s *BlockSpec) impliedType() cty.Type {
+        return s.Nested.impliedType()
+}
+
+func (s *BlockSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range {
+        var childBlock *hcl.Block
+        for _, candidate := range content.Blocks {
+                if candidate.Type != s.TypeName {
+                        continue
+                }
+
+                childBlock = candidate
+                break
+        }
+
+        if childBlock == nil {
+                return content.MissingItemRange
+        }
+
+        return sourceRange(childBlock.Body, labelsForBlock(childBlock), s.Nested)
+}
+
+// A BlockListSpec is a Spec that produces a cty list of the results of
+// decoding all of the nested blocks of a given type, using a nested spec.
+type BlockListSpec struct {
+        TypeName string
+        Nested   Spec
+        MinItems int
+        MaxItems int
+}
+
+func (s *BlockListSpec) visitSameBodyChildren(cb visitFunc) {
+        // leaf node ("Nested" does not use the same body)
+}
+
+// blockSpec implementation
+func (s *BlockListSpec) blockHeaderSchemata() []hcl.BlockHeaderSchema {
+        return []hcl.BlockHeaderSchema{
+                {
+                        Type:       s.TypeName,
+                        LabelNames: findLabelSpecs(s.Nested),
+                },
+        }
+}
+
+// blockSpec implementation
+func (s *BlockListSpec) nestedSpec() Spec {
+        return s.Nested
+}
+
+// specNeedingVariables implementation
+func (s *BlockListSpec) variablesNeeded(content *hcl.BodyContent) []hcl.Traversal {
+        var ret []hcl.Traversal
+
+        for _, childBlock := range content.Blocks {
+                if childBlock.Type != s.TypeName {
+                        continue
+                }
+
+                ret = append(ret, Variables(childBlock.Body, s.Nested)...)
+        }
+
+        return ret
+}
+
+func (s *BlockListSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+
+        if s.Nested == nil {
+                panic("BlockListSpec with no Nested Spec")
+        }
+
+        var elems []cty.Value
+        var sourceRanges []hcl.Range
+        for _, childBlock := range content.Blocks {
+                if childBlock.Type != s.TypeName {
+                        continue
+                }
+
+                val, _, childDiags := decode(childBlock.Body, labelsForBlock(childBlock), ctx, s.Nested, false)
+                diags = append(diags, childDiags...)
+                elems = append(elems, val)
+                sourceRanges = append(sourceRanges, sourceRange(childBlock.Body, labelsForBlock(childBlock), s.Nested))
+        }
+
+        if len(elems) < s.MinItems {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  fmt.Sprintf("Insufficient %s blocks", s.TypeName),
+                        Detail:   fmt.Sprintf("At least %d %q blocks are required.", s.MinItems, s.TypeName),
+                        Subject:  &content.MissingItemRange,
+                })
+        } else if s.MaxItems > 0 && len(elems) > s.MaxItems {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  fmt.Sprintf("Too many %s blocks", s.TypeName),
+                        Detail:   fmt.Sprintf("No more than %d %q blocks are allowed", s.MaxItems, s.TypeName),
+                        Subject:  &sourceRanges[s.MaxItems],
+                })
+        }
+
+        var ret cty.Value
+
+        if len(elems) == 0 {
+                ret = cty.ListValEmpty(s.Nested.impliedType())
+        } else {
+                ret = cty.ListVal(elems)
+        }
+
+        return ret, diags
+}
+
+func (s *BlockListSpec) impliedType() cty.Type {
+        return cty.List(s.Nested.impliedType())
+}
+
+func (s *BlockListSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range {
+        // We return the source range of the _first_ block of the given type,
+        // since they are not guaranteed to form a contiguous range.
+
+        var childBlock *hcl.Block
+        for _, candidate := range content.Blocks {
+                if candidate.Type != s.TypeName {
+                        continue
+                }
+
+                childBlock = candidate
+                break
+        }
+
+        if childBlock == nil {
+                return content.MissingItemRange
+        }
+
+        return sourceRange(childBlock.Body, labelsForBlock(childBlock), s.Nested)
+}
+
+// A BlockSetSpec is a Spec that produces a cty set of the results of
+// decoding all of the nested blocks of a given type, using a nested spec.
+type BlockSetSpec struct {
+        TypeName string
+        Nested   Spec
+        MinItems int
+        MaxItems int
+}
+
+func (s *BlockSetSpec) visitSameBodyChildren(cb visitFunc) {
+        // leaf node ("Nested" does not use the same body)
+}
+
+// blockSpec implementation
+func (s *BlockSetSpec) blockHeaderSchemata() []hcl.BlockHeaderSchema {
+        return []hcl.BlockHeaderSchema{
+                {
+                        Type:       s.TypeName,
+                        LabelNames: findLabelSpecs(s.Nested),
+                },
+        }
+}
+
+// blockSpec implementation
+func (s *BlockSetSpec) nestedSpec() Spec {
+        return s.Nested
+}
+
+// specNeedingVariables implementation
+func (s *BlockSetSpec) variablesNeeded(content *hcl.BodyContent) []hcl.Traversal {
+        var ret []hcl.Traversal
+
+        for _, childBlock := range content.Blocks {
+                if childBlock.Type != s.TypeName {
+                        continue
+                }
+
+                ret = append(ret, Variables(childBlock.Body, s.Nested)...)
+        }
+
+        return ret
+}
+
+func (s *BlockSetSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+
+        if s.Nested == nil {
+                panic("BlockSetSpec with no Nested Spec")
+        }
+
+        var elems []cty.Value
+        var sourceRanges []hcl.Range
+        for _, childBlock := range content.Blocks {
+                if childBlock.Type != s.TypeName {
+                        continue
+                }
+
+                val, _, childDiags := decode(childBlock.Body, labelsForBlock(childBlock), ctx, s.Nested, false)
+                diags = append(diags, childDiags...)
+                elems = append(elems, val)
+                sourceRanges = append(sourceRanges, sourceRange(childBlock.Body, labelsForBlock(childBlock), s.Nested))
+        }
+
+        if len(elems) < s.MinItems {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  fmt.Sprintf("Insufficient %s blocks", s.TypeName),
+                        Detail:   fmt.Sprintf("At least %d %q blocks are required.", s.MinItems, s.TypeName),
+                        Subject:  &content.MissingItemRange,
+                })
+        } else if s.MaxItems > 0 && len(elems) > s.MaxItems {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  fmt.Sprintf("Too many %s blocks", s.TypeName),
+                        Detail:   fmt.Sprintf("No more than %d %q blocks are allowed", s.MaxItems, s.TypeName),
+                        Subject:  &sourceRanges[s.MaxItems],
+                })
+        }
+
+        var ret cty.Value
+
+        if len(elems) == 0 {
+                ret = cty.SetValEmpty(s.Nested.impliedType())
+        } else {
+                ret = cty.SetVal(elems)
+        }
+
+        return ret, diags
+}
+
+func (s *BlockSetSpec) impliedType() cty.Type {
+        return cty.Set(s.Nested.impliedType())
+}
+
+func (s *BlockSetSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range {
+        // We return the source range of the _first_ block of the given type,
+        // since they are not guaranteed to form a contiguous range.
+
+        var childBlock *hcl.Block
+        for _, candidate := range content.Blocks {
+                if candidate.Type != s.TypeName {
+                        continue
+                }
+
+                childBlock = candidate
+                break
+        }
+
+        if childBlock == nil {
+                return content.MissingItemRange
+        }
+
+        return sourceRange(childBlock.Body, labelsForBlock(childBlock), s.Nested)
+}
+
+// A BlockMapSpec is a Spec that produces a cty map of the results of
+// decoding all of the nested blocks of a given type, using a nested spec.
+//
+// One level of map structure is created for each of the given label names.
+// There must be at least one given label name.
+type BlockMapSpec struct {
+        TypeName   string
+        LabelNames []string
+        Nested     Spec
+}
+
+func (s *BlockMapSpec) visitSameBodyChildren(cb visitFunc) {
+        // leaf node ("Nested" does not use the same body)
+}
+
+// blockSpec implementation
+func (s *BlockMapSpec) blockHeaderSchemata() []hcl.BlockHeaderSchema {
+        return []hcl.BlockHeaderSchema{
+                {
+                        Type:       s.TypeName,
+                        LabelNames: append(s.LabelNames, findLabelSpecs(s.Nested)...),
+                },
+        }
+}
+
+// blockSpec implementation
+func (s *BlockMapSpec) nestedSpec() Spec {
+        return s.Nested
+}
+
+// specNeedingVariables implementation
+func (s *BlockMapSpec) variablesNeeded(content *hcl.BodyContent) []hcl.Traversal {
+        var ret []hcl.Traversal
+
+        for _, childBlock := range content.Blocks {
+                if childBlock.Type != s.TypeName {
+                        continue
+                }
+
+                ret = append(ret, Variables(childBlock.Body, s.Nested)...)
+        }
+
+        return ret
+}
+
+func (s *BlockMapSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+
+        if s.Nested == nil {
+                panic("BlockSetSpec with no Nested Spec")
+        }
+
+        elems := map[string]interface{}{}
+        for _, childBlock := range content.Blocks {
+                if childBlock.Type != s.TypeName {
+                        continue
+                }
+
+                childLabels := labelsForBlock(childBlock)
+                val, _, childDiags := decode(childBlock.Body, childLabels[len(s.LabelNames):], ctx, s.Nested, false)
+                targetMap := elems
+                for _, key := range childBlock.Labels[:len(s.LabelNames)-1] {
+                        if _, exists := targetMap[key]; !exists {
+                                targetMap[key] = make(map[string]interface{})
+                        }
+                        targetMap = targetMap[key].(map[string]interface{})
+                }
+
+                diags = append(diags, childDiags...)
+
+                key := childBlock.Labels[len(s.LabelNames)-1]
+                if _, exists := targetMap[key]; exists {
+                        labelsBuf := bytes.Buffer{}
+                        for _, label := range childBlock.Labels {
+                                fmt.Fprintf(&labelsBuf, " %q", label)
+                        }
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  fmt.Sprintf("Duplicate %s block", s.TypeName),
+                                Detail: fmt.Sprintf(
+                                        "A block for %s%s was already defined. The %s labels must be unique.",
+                                        s.TypeName, labelsBuf.String(), s.TypeName,
+                                ),
+                                Subject: &childBlock.DefRange,
+                        })
+                        continue
+                }
+
+                targetMap[key] = val
+        }
+
+        if len(elems) == 0 {
+                return cty.MapValEmpty(s.Nested.impliedType()), diags
+        }
+
+        var ctyMap func(map[string]interface{}, int) cty.Value
+        ctyMap = func(raw map[string]interface{}, depth int) cty.Value {
+                vals := make(map[string]cty.Value, len(raw))
+                if depth == 1 {
+                        for k, v := range raw {
+                                vals[k] = v.(cty.Value)
+                        }
+                } else {
+                        for k, v := range raw {
+                                vals[k] = ctyMap(v.(map[string]interface{}), depth-1)
+                        }
+                }
+                return cty.MapVal(vals)
+        }
+
+        return ctyMap(elems, len(s.LabelNames)), diags
+}
+
+func (s *BlockMapSpec) impliedType() cty.Type {
+        ret := s.Nested.impliedType()
+        for _ = range s.LabelNames {
+                ret = cty.Map(ret)
+        }
+        return ret
+}
+
+func (s *BlockMapSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range {
+        // We return the source range of the _first_ block of the given type,
+        // since they are not guaranteed to form a contiguous range.
+
+        var childBlock *hcl.Block
+        for _, candidate := range content.Blocks {
+                if candidate.Type != s.TypeName {
+                        continue
+                }
+
+                childBlock = candidate
+                break
+        }
+
+        if childBlock == nil {
+                return content.MissingItemRange
+        }
+
+        return sourceRange(childBlock.Body, labelsForBlock(childBlock), s.Nested)
+}
+
+// A BlockLabelSpec is a Spec that returns a cty.String representing the
+// label of the block its given body belongs to, if indeed its given body
+// belongs to a block. It is a programming error to use this in a non-block
+// context, so this spec will panic in that case.
+//
+// This spec only works in the nested spec within a BlockSpec, BlockListSpec,
+// BlockSetSpec or BlockMapSpec.
+//
+// The full set of label specs used against a particular block must have a
+// consecutive set of indices starting at zero. The maximum index found
+// defines how many labels the corresponding blocks must have in cty source.
+type BlockLabelSpec struct {
+        Index int
+        Name  string
+}
+
+func (s *BlockLabelSpec) visitSameBodyChildren(cb visitFunc) {
+        // leaf node
+}
+
+func (s *BlockLabelSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        if s.Index >= len(blockLabels) {
+                panic("BlockListSpec used in non-block context")
+        }
+
+        return cty.StringVal(blockLabels[s.Index].Value), nil
+}
+
+func (s *BlockLabelSpec) impliedType() cty.Type {
+        return cty.String // labels are always strings
+}
+
+func (s *BlockLabelSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range {
+        if s.Index >= len(blockLabels) {
+                panic("BlockListSpec used in non-block context")
+        }
+
+        return blockLabels[s.Index].Range
+}
+
+func findLabelSpecs(spec Spec) []string {
+        maxIdx := -1
+        var names map[int]string
+
+        var visit visitFunc
+        visit = func(s Spec) {
+                if ls, ok := s.(*BlockLabelSpec); ok {
+                        if maxIdx < ls.Index {
+                                maxIdx = ls.Index
+                        }
+                        if names == nil {
+                                names = make(map[int]string)
+                        }
+                        names[ls.Index] = ls.Name
+                }
+                s.visitSameBodyChildren(visit)
+        }
+
+        visit(spec)
+
+        if maxIdx < 0 {
+                return nil // no labels at all
+        }
+
+        ret := make([]string, maxIdx+1)
+        for i := range ret {
+                name := names[i]
+                if name == "" {
+                        // Should never happen if the spec is conformant, since we require
+                        // consecutive indices starting at zero.
+                        name = fmt.Sprintf("missing%02d", i)
+                }
+                ret[i] = name
+        }
+
+        return ret
+}
+
+// DefaultSpec is a spec that wraps two specs, evaluating the primary first
+// and then evaluating the default if the primary returns a null value.
+//
+// The two specifications must have the same implied result type for correct
+// operation. If not, the result is undefined.
+type DefaultSpec struct {
+        Primary Spec
+        Default Spec
+}
+
+func (s *DefaultSpec) visitSameBodyChildren(cb visitFunc) {
+        cb(s.Primary)
+        cb(s.Default)
+}
+
+func (s *DefaultSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        val, diags := s.Primary.decode(content, blockLabels, ctx)
+        if val.IsNull() {
+                var moreDiags hcl.Diagnostics
+                val, moreDiags = s.Default.decode(content, blockLabels, ctx)
+                diags = append(diags, moreDiags...)
+        }
+        return val, diags
+}
+
+func (s *DefaultSpec) impliedType() cty.Type {
+        return s.Primary.impliedType()
+}
+
+func (s *DefaultSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range {
+        // We can't tell from here which of the two specs will ultimately be used
+        // in our result, so we'll just assume the first. This is usually the right
+        // choice because the default is often a literal spec that doesn't have a
+        // reasonable source range to return anyway.
+        return s.Primary.sourceRange(content, blockLabels)
+}
+
+// TransformExprSpec is a spec that wraps another and then evaluates a given
+// hcl.Expression on the result.
+//
+// The implied type of this spec is determined by evaluating the expression
+// with an unknown value of the nested spec's implied type, which may cause
+// the result to be imprecise. This spec should not be used in situations where
+// precise result type information is needed.
+type TransformExprSpec struct {
+        Wrapped      Spec
+        Expr         hcl.Expression
+        TransformCtx *hcl.EvalContext
+        VarName      string
+}
+
+func (s *TransformExprSpec) visitSameBodyChildren(cb visitFunc) {
+        cb(s.Wrapped)
+}
+
+func (s *TransformExprSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        wrappedVal, diags := s.Wrapped.decode(content, blockLabels, ctx)
+        if diags.HasErrors() {
+                // We won't try to run our function in this case, because it'll probably
+                // generate confusing additional errors that will distract from the
+                // root cause.
+                return cty.UnknownVal(s.impliedType()), diags
+        }
+
+        chiCtx := s.TransformCtx.NewChild()
+        chiCtx.Variables = map[string]cty.Value{
+                s.VarName: wrappedVal,
+        }
+        resultVal, resultDiags := s.Expr.Value(chiCtx)
+        diags = append(diags, resultDiags...)
+        return resultVal, diags
+}
+
+func (s *TransformExprSpec) impliedType() cty.Type {
+        wrappedTy := s.Wrapped.impliedType()
+        chiCtx := s.TransformCtx.NewChild()
+        chiCtx.Variables = map[string]cty.Value{
+                s.VarName: cty.UnknownVal(wrappedTy),
+        }
+        resultVal, _ := s.Expr.Value(chiCtx)
+        return resultVal.Type()
+}
+
+func (s *TransformExprSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range {
+        // We'll just pass through our wrapped range here, even though that's
+        // not super-accurate, because there's nothing better to return.
+        return s.Wrapped.sourceRange(content, blockLabels)
+}
+
+// TransformFuncSpec is a spec that wraps another and then evaluates a given
+// cty function with the result. The given function must expect exactly one
+// argument, where the result of the wrapped spec will be passed.
+//
+// The implied type of this spec is determined by type-checking the function
+// with an unknown value of the nested spec's implied type, which may cause
+// the result to be imprecise. This spec should not be used in situations where
+// precise result type information is needed.
+//
+// If the given function produces an error when run, this spec will produce
+// a non-user-actionable diagnostic message. It's the caller's responsibility
+// to ensure that the given function cannot fail for any non-error result
+// of the wrapped spec.
+type TransformFuncSpec struct {
+        Wrapped Spec
+        Func    function.Function
+}
+
+func (s *TransformFuncSpec) visitSameBodyChildren(cb visitFunc) {
+        cb(s.Wrapped)
+}
+
+func (s *TransformFuncSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        wrappedVal, diags := s.Wrapped.decode(content, blockLabels, ctx)
+        if diags.HasErrors() {
+                // We won't try to run our function in this case, because it'll probably
+                // generate confusing additional errors that will distract from the
+                // root cause.
+                return cty.UnknownVal(s.impliedType()), diags
+        }
+
+        resultVal, err := s.Func.Call([]cty.Value{wrappedVal})
+        if err != nil {
+                // This is not a good example of a diagnostic because it is reporting
+                // a programming error in the calling application, rather than something
+                // an end-user could act on.
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Transform function failed",
+                        Detail:   fmt.Sprintf("Decoder transform returned an error: %s", err),
+                        Subject:  s.sourceRange(content, blockLabels).Ptr(),
+                })
+                return cty.UnknownVal(s.impliedType()), diags
+        }
+
+        return resultVal, diags
+}
+
+func (s *TransformFuncSpec) impliedType() cty.Type {
+        wrappedTy := s.Wrapped.impliedType()
+        resultTy, err := s.Func.ReturnType([]cty.Type{wrappedTy})
+        if err != nil {
+                // Should never happen with a correctly-configured spec
+                return cty.DynamicPseudoType
+        }
+
+        return resultTy
+}
+
+func (s *TransformFuncSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range {
+        // We'll just pass through our wrapped range here, even though that's
+        // not super-accurate, because there's nothing better to return.
+        return s.Wrapped.sourceRange(content, blockLabels)
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcldec/variables.go b/vendor/github.com/hashicorp/hcl2/hcldec/variables.go
new file mode 100644
index 0000000..427b0d0
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcldec/variables.go
@@ -0,0 +1,34 @@
+package hcldec
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+// Variables processes the given body with the given spec and returns a
+// list of the variable traversals that would be required to decode
+// the same pairing of body and spec.
+//
+// This can be used to conditionally populate the variables in the EvalContext
+// passed to Decode, for applications where a static scope is insufficient.
+//
+// If the given body is not compliant with the given schema, the result may
+// be incomplete, but that's assumed to be okay because the eventual call
+// to Decode will produce error diagnostics anyway.
+func Variables(body hcl.Body, spec Spec) []hcl.Traversal {
+        schema := ImpliedSchema(spec)
+
+        content, _, _ := body.PartialContent(schema)
+
+        var vars []hcl.Traversal
+
+        if vs, ok := spec.(specNeedingVariables); ok {
+                vars = append(vars, vs.variablesNeeded(content)...)
+        }
+        spec.visitSameBodyChildren(func(s Spec) {
+                if vs, ok := s.(specNeedingVariables); ok {
+                        vars = append(vars, vs.variablesNeeded(content)...)
+                }
+        })
+
+        return vars
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hclparse/parser.go b/vendor/github.com/hashicorp/hcl2/hclparse/parser.go
new file mode 100644
index 0000000..6d47f12
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hclparse/parser.go
@@ -0,0 +1,123 @@
+package hclparse
+
+import (
+        "fmt"
+        "io/ioutil"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+        "github.com/hashicorp/hcl2/hcl/json"
+)
+
+// NOTE: This is the public interface for parsing. The actual parsers are
+// in other packages alongside this one, with this package just wrapping them
+// to provide a unified interface for the caller across all supported formats.
+
+// Parser is the main interface for parsing configuration files. As well as
+// parsing files, a parser also retains a registry of all of the files it
+// has parsed so that multiple attempts to parse the same file will return
+// the same object and so the collected files can be used when printing
+// diagnostics.
+//
+// Any diagnostics for parsing a file are only returned once on the first
+// call to parse that file. Callers are expected to collect up diagnostics
+// and present them together, so returning diagnostics for the same file
+// multiple times would create a confusing result.
+type Parser struct {
+        files map[string]*hcl.File
+}
+
+// NewParser creates a new parser, ready to parse configuration files.
+func NewParser() *Parser {
+        return &Parser{
+                files: map[string]*hcl.File{},
+        }
+}
+
+// ParseHCL parses the given buffer (which is assumed to have been loaded from
+// the given filename) as a native-syntax configuration file and returns the
+// hcl.File object representing it.
+func (p *Parser) ParseHCL(src []byte, filename string) (*hcl.File, hcl.Diagnostics) {
+        if existing := p.files[filename]; existing != nil {
+                return existing, nil
+        }
+
+        file, diags := hclsyntax.ParseConfig(src, filename, hcl.Pos{Byte: 0, Line: 1, Column: 1})
+        p.files[filename] = file
+        return file, diags
+}
+
+// ParseHCLFile reads the given filename and parses it as a native-syntax HCL
+// configuration file. An error diagnostic is returned if the given file
+// cannot be read.
+func (p *Parser) ParseHCLFile(filename string) (*hcl.File, hcl.Diagnostics) {
+        if existing := p.files[filename]; existing != nil {
+                return existing, nil
+        }
+
+        src, err := ioutil.ReadFile(filename)
+        if err != nil {
+                return nil, hcl.Diagnostics{
+                        {
+                                Severity: hcl.DiagError,
+                                Summary:  "Failed to read file",
+                                Detail:   fmt.Sprintf("The configuration file %q could not be read.", filename),
+                        },
+                }
+        }
+
+        return p.ParseHCL(src, filename)
+}
+
+// ParseJSON parses the given JSON buffer (which is assumed to have been loaded
+// from the given filename) and returns the hcl.File object representing it.
+func (p *Parser) ParseJSON(src []byte, filename string) (*hcl.File, hcl.Diagnostics) {
+        if existing := p.files[filename]; existing != nil {
+                return existing, nil
+        }
+
+        file, diags := json.Parse(src, filename)
+        p.files[filename] = file
+        return file, diags
+}
+
+// ParseJSONFile reads the given filename and parses it as JSON, similarly to
+// ParseJSON. An error diagnostic is returned if the given file cannot be read.
+func (p *Parser) ParseJSONFile(filename string) (*hcl.File, hcl.Diagnostics) {
+        if existing := p.files[filename]; existing != nil {
+                return existing, nil
+        }
+
+        file, diags := json.ParseFile(filename)
+        p.files[filename] = file
+        return file, diags
+}
+
+// AddFile allows a caller to record in a parser a file that was parsed some
+// other way, thus allowing it to be included in the registry of sources.
+func (p *Parser) AddFile(filename string, file *hcl.File) {
+        p.files[filename] = file
+}
+
+// Sources returns a map from filenames to the raw source code that was
+// read from them. This is intended to be used, for example, to print
+// diagnostics with contextual information.
+//
+// The arrays underlying the returned slices should not be modified.
+func (p *Parser) Sources() map[string][]byte {
+        ret := make(map[string][]byte)
+        for fn, f := range p.files {
+                ret[fn] = f.Bytes
+        }
+        return ret
+}
+
+// Files returns a map from filenames to the File objects produced from them.
+// This is intended to be used, for example, to print diagnostics with
+// contextual information.
+//
+// The returned map and all of the objects it refers to directly or indirectly
+// must not be modified.
+func (p *Parser) Files() map[string]*hcl.File {
+        return p.files
+}
diff --git a/vendor/github.com/hashicorp/hil/scanner/scanner.go b/vendor/github.com/hashicorp/hil/scanner/scanner.go
index bab86c6..86085de 100644
--- a/vendor/github.com/hashicorp/hil/scanner/scanner.go
+++ b/vendor/github.com/hashicorp/hil/scanner/scanner.go
@@ -395,6 +395,12 @@ func scanLiteral(s string, startPos ast.Pos, nested bool) (string, *Token) {
                                         pos.Column = pos.Column + 2
                                         litLen = litLen + 2
                                         continue
+                                } else if follow == '\\' {
+                                        // \\ escapes \
+                                        // so we will consume both characters here.
+                                        pos.Column = pos.Column + 2
+                                        litLen = litLen + 2
+                                        continue
                                 }
                         }
                 }
diff --git a/vendor/github.com/hashicorp/terraform/config/append.go b/vendor/github.com/hashicorp/terraform/config/append.go
index 5f4e89e..9d80c42 100644
--- a/vendor/github.com/hashicorp/terraform/config/append.go
+++ b/vendor/github.com/hashicorp/terraform/config/append.go
@@ -82,5 +82,11 @@ func Append(c1, c2 *Config) (*Config, error) {
                 c.Variables = append(c.Variables, c2.Variables...)
         }
 
+        if len(c1.Locals) > 0 || len(c2.Locals) > 0 {
+                c.Locals = make([]*Local, 0, len(c1.Locals)+len(c2.Locals))
+                c.Locals = append(c.Locals, c1.Locals...)
+                c.Locals = append(c.Locals, c2.Locals...)
+        }
+
         return c, nil
 }
diff --git a/vendor/github.com/hashicorp/terraform/config/config.go b/vendor/github.com/hashicorp/terraform/config/config.go
index 3f756dc..1772fd7 100644
--- a/vendor/github.com/hashicorp/terraform/config/config.go
+++ b/vendor/github.com/hashicorp/terraform/config/config.go
@@ -8,11 +8,11 @@ import (
         "strconv"
         "strings"
 
-        "github.com/hashicorp/go-multierror"
-        "github.com/hashicorp/hil"
+        hcl2 "github.com/hashicorp/hcl2/hcl"
         "github.com/hashicorp/hil/ast"
         "github.com/hashicorp/terraform/helper/hilmapstructure"
         "github.com/hashicorp/terraform/plugin/discovery"
+        "github.com/hashicorp/terraform/tfdiags"
         "github.com/mitchellh/reflectwalk"
 )
 
@@ -34,6 +34,7 @@ type Config struct {
         ProviderConfigs []*ProviderConfig
         Resources       []*Resource
         Variables       []*Variable
+        Locals          []*Local
         Outputs         []*Output
 
         // The fields below can be filled in by loaders for validation
@@ -55,6 +56,8 @@ type AtlasConfig struct {
 type Module struct {
         Name      string
         Source    string
+        Version   string
+        Providers map[string]string
         RawConfig *RawConfig
 }
 
@@ -147,7 +150,7 @@ func (p *Provisioner) Copy() *Provisioner {
         }
 }
 
-// Variable is a variable defined within the configuration.
+// Variable is a module argument defined within the configuration.
 type Variable struct {
         Name         string
         DeclaredType string `mapstructure:"type"`
@@ -155,6 +158,12 @@ type Variable struct {
         Description  string
 }
 
+// Local is a local value defined within the configuration.
+type Local struct {
+        Name      string
+        RawConfig *RawConfig
+}
+
 // Output is an output defined within the configuration. An output is
 // resulting data that is highlighted by Terraform when finished. An
 // output marked Sensitive will be output in a masked form following
@@ -222,7 +231,10 @@ func (r *Resource) Count() (int, error) {
 
         v, err := strconv.ParseInt(count, 0, 0)
         if err != nil {
-                return 0, err
+                return 0, fmt.Errorf(
+                        "cannot parse %q as an integer",
+                        count,
+                )
         }
 
         return int(v), nil
@@ -253,7 +265,9 @@ func (r *Resource) ProviderFullName() string {
 // the provider name is inferred from the resource type name.
 func ResourceProviderFullName(resourceType, explicitProvider string) string {
         if explicitProvider != "" {
-                return explicitProvider
+                // check for an explicit provider name, or return the original
+                parts := strings.SplitAfter(explicitProvider, "provider.")
+                return parts[len(parts)-1]
         }
 
         idx := strings.IndexRune(resourceType, '_')
@@ -268,30 +282,35 @@ func ResourceProviderFullName(resourceType, explicitProvider string) string {
 }
 
 // Validate does some basic semantic checking of the configuration.
-func (c *Config) Validate() error {
+func (c *Config) Validate() tfdiags.Diagnostics {
         if c == nil {
                 return nil
         }
 
-        var errs []error
+        var diags tfdiags.Diagnostics
 
         for _, k := range c.unknownKeys {
-                errs = append(errs, fmt.Errorf(
-                        "Unknown root level key: %s", k))
+                diags = diags.Append(
+                        fmt.Errorf("Unknown root level key: %s", k),
+                )
         }
 
         // Validate the Terraform config
         if tf := c.Terraform; tf != nil {
-                errs = append(errs, c.Terraform.Validate()...)
+                errs := c.Terraform.Validate()
+                for _, err := range errs {
+                        diags = diags.Append(err)
+                }
         }
 
         vars := c.InterpolatedVariables()
         varMap := make(map[string]*Variable)
         for _, v := range c.Variables {
                 if _, ok := varMap[v.Name]; ok {
-                        errs = append(errs, fmt.Errorf(
+                        diags = diags.Append(fmt.Errorf(
                                 "Variable '%s': duplicate found. Variable names must be unique.",
-                                v.Name))
+                                v.Name,
+                        ))
                 }
 
                 varMap[v.Name] = v
@@ -299,17 +318,19 @@ func (c *Config) Validate() error {
 
         for k, _ := range varMap {
                 if !NameRegexp.MatchString(k) {
-                        errs = append(errs, fmt.Errorf(
-                                "variable %q: variable name must match regular expresion %s",
-                                k, NameRegexp))
+                        diags = diags.Append(fmt.Errorf(
+                                "variable %q: variable name must match regular expression %s",
+                                k, NameRegexp,
+                        ))
                 }
         }
 
         for _, v := range c.Variables {
                 if v.Type() == VariableTypeUnknown {
-                        errs = append(errs, fmt.Errorf(
+                        diags = diags.Append(fmt.Errorf(
                                 "Variable '%s': must be a string or a map",
-                                v.Name))
+                                v.Name,
+                        ))
                         continue
                 }
 
@@ -330,9 +351,10 @@ func (c *Config) Validate() error {
                 if v.Default != nil {
                         if err := reflectwalk.Walk(v.Default, w); err == nil {
                                 if interp {
-                                        errs = append(errs, fmt.Errorf(
-                                                "Variable '%s': cannot contain interpolations",
-                                                v.Name))
+                                        diags = diags.Append(fmt.Errorf(
+                                                "variable %q: default may not contain interpolations",
+                                                v.Name,
+                                        ))
                                 }
                         }
                 }
@@ -348,10 +370,11 @@ func (c *Config) Validate() error {
                         }
 
                         if _, ok := varMap[uv.Name]; !ok {
-                                errs = append(errs, fmt.Errorf(
-                                        "%s: unknown variable referenced: '%s'. define it with 'variable' blocks",
+                                diags = diags.Append(fmt.Errorf(
+                                        "%s: unknown variable referenced: '%s'; define it with a 'variable' block",
                                         source,
-                                        uv.Name))
+                                        uv.Name,
+                                ))
                         }
                 }
         }
@@ -362,17 +385,19 @@ func (c *Config) Validate() error {
                         switch v := rawV.(type) {
                         case *CountVariable:
                                 if v.Type == CountValueInvalid {
-                                        errs = append(errs, fmt.Errorf(
+                                        diags = diags.Append(fmt.Errorf(
                                                 "%s: invalid count variable: %s",
                                                 source,
-                                                v.FullKey()))
+                                                v.FullKey(),
+                                        ))
                                 }
                         case *PathVariable:
                                 if v.Type == PathValueInvalid {
-                                        errs = append(errs, fmt.Errorf(
+                                        diags = diags.Append(fmt.Errorf(
                                                 "%s: invalid path variable: %s",
                                                 source,
-                                                v.FullKey()))
+                                                v.FullKey(),
+                                        ))
                                 }
                         }
                 }
@@ -380,27 +405,35 @@ func (c *Config) Validate() error {
 
         // Check that providers aren't declared multiple times and that their
         // version constraints, where present, are syntactically valid.
-        providerSet := make(map[string]struct{})
+        providerSet := make(map[string]bool)
         for _, p := range c.ProviderConfigs {
                 name := p.FullName()
                 if _, ok := providerSet[name]; ok {
-                        errs = append(errs, fmt.Errorf(
-                                "provider.%s: declared multiple times, you can only declare a provider once",
-                                name))
+                        diags = diags.Append(fmt.Errorf(
+                                "provider.%s: multiple configurations present; only one configuration is allowed per provider",
+                                name,
+                        ))
                         continue
                 }
 
                 if p.Version != "" {
                         _, err := discovery.ConstraintStr(p.Version).Parse()
                         if err != nil {
-                                errs = append(errs, fmt.Errorf(
-                                        "provider.%s: invalid version constraint %q: %s",
-                                        name, p.Version, err,
-                                ))
+                                diags = diags.Append(&hcl2.Diagnostic{
+                                        Severity: hcl2.DiagError,
+                                        Summary:  "Invalid provider version constraint",
+                                        Detail: fmt.Sprintf(
+                                                "The value %q given for provider.%s is not a valid version constraint.",
+                                                p.Version, name,
+                                        ),
+                                        // TODO: include a "Subject" source reference in here,
+                                        // once the config loader is able to retain source
+                                        // location information.
+                                })
                         }
                 }
 
-                providerSet[name] = struct{}{}
+                providerSet[name] = true
         }
 
         // Check that all references to modules are valid
@@ -412,9 +445,10 @@ func (c *Config) Validate() error {
                         if _, ok := dupped[m.Id()]; !ok {
                                 dupped[m.Id()] = struct{}{}
 
-                                errs = append(errs, fmt.Errorf(
-                                        "%s: module repeated multiple times",
-                                        m.Id()))
+                                diags = diags.Append(fmt.Errorf(
+                                        "module %q: module repeated multiple times",
+                                        m.Id(),
+                                ))
                         }
 
                         // Already seen this module, just skip it
@@ -428,21 +462,23 @@ func (c *Config) Validate() error {
                         "root": m.Source,
                 })
                 if err != nil {
-                        errs = append(errs, fmt.Errorf(
-                                "%s: module source error: %s",
-                                m.Id(), err))
+                        diags = diags.Append(fmt.Errorf(
+                                "module %q: module source error: %s",
+                                m.Id(), err,
+                        ))
                 } else if len(rc.Interpolations) > 0 {
-                        errs = append(errs, fmt.Errorf(
-                                "%s: module source cannot contain interpolations",
-                                m.Id()))
+                        diags = diags.Append(fmt.Errorf(
+                                "module %q: module source cannot contain interpolations",
+                                m.Id(),
+                        ))
                 }
 
                 // Check that the name matches our regexp
                 if !NameRegexp.Match([]byte(m.Name)) {
-                        errs = append(errs, fmt.Errorf(
-                                "%s: module name can only contain letters, numbers, "+
-                                        "dashes, and underscores",
-                                m.Id()))
+                        diags = diags.Append(fmt.Errorf(
+                                "module %q: module name must be a letter or underscore followed by only letters, numbers, dashes, and underscores",
+                                m.Id(),
+                        ))
                 }
 
                 // Check that the configuration can all be strings, lists or maps
@@ -466,30 +502,47 @@ func (c *Config) Validate() error {
                                 continue
                         }
 
-                        errs = append(errs, fmt.Errorf(
-                                "%s: variable %s must be a string, list or map value",
-                                m.Id(), k))
+                        diags = diags.Append(fmt.Errorf(
+                                "module %q: argument %s must have a string, list, or map value",
+                                m.Id(), k,
+                        ))
                 }
 
                 // Check for invalid count variables
                 for _, v := range m.RawConfig.Variables {
                         switch v.(type) {
                         case *CountVariable:
-                                errs = append(errs, fmt.Errorf(
-                                        "%s: count variables are only valid within resources", m.Name))
+                                diags = diags.Append(fmt.Errorf(
+                                        "module %q: count variables are only valid within resources",
+                                        m.Name,
+                                ))
                         case *SelfVariable:
-                                errs = append(errs, fmt.Errorf(
-                                        "%s: self variables are only valid within resources", m.Name))
+                                diags = diags.Append(fmt.Errorf(
+                                        "module %q: self variables are only valid within resources",
+                                        m.Name,
+                                ))
                         }
                 }
 
                 // Update the raw configuration to only contain the string values
                 m.RawConfig, err = NewRawConfig(raw)
                 if err != nil {
-                        errs = append(errs, fmt.Errorf(
+                        diags = diags.Append(fmt.Errorf(
                                 "%s: can't initialize configuration: %s",
-                                m.Id(), err))
+                                m.Id(), err,
+                        ))
                 }
+
+                // check that all named providers actually exist
+                for _, p := range m.Providers {
+                        if !providerSet[p] {
+                                diags = diags.Append(fmt.Errorf(
+                                        "module %q: cannot pass non-existent provider %q",
+                                        m.Name, p,
+                                ))
+                        }
+                }
+
         }
         dupped = nil
 
@@ -503,10 +556,10 @@ func (c *Config) Validate() error {
                         }
 
                         if _, ok := modules[mv.Name]; !ok {
-                                errs = append(errs, fmt.Errorf(
+                                diags = diags.Append(fmt.Errorf(
                                         "%s: unknown module referenced: %s",
-                                        source,
-                                        mv.Name))
+                                        source, mv.Name,
+                                ))
                         }
                 }
         }
@@ -519,9 +572,10 @@ func (c *Config) Validate() error {
                         if _, ok := dupped[r.Id()]; !ok {
                                 dupped[r.Id()] = struct{}{}
 
-                                errs = append(errs, fmt.Errorf(
+                                diags = diags.Append(fmt.Errorf(
                                         "%s: resource repeated multiple times",
-                                        r.Id()))
+                                        r.Id(),
+                                ))
                         }
                 }
 
@@ -535,53 +589,42 @@ func (c *Config) Validate() error {
                 for _, v := range r.RawCount.Variables {
                         switch v.(type) {
                         case *CountVariable:
-                                errs = append(errs, fmt.Errorf(
+                                diags = diags.Append(fmt.Errorf(
                                         "%s: resource count can't reference count variable: %s",
-                                        n,
-                                        v.FullKey()))
+                                        n, v.FullKey(),
+                                ))
                         case *SimpleVariable:
-                                errs = append(errs, fmt.Errorf(
+                                diags = diags.Append(fmt.Errorf(
                                         "%s: resource count can't reference variable: %s",
-                                        n,
-                                        v.FullKey()))
+                                        n, v.FullKey(),
+                                ))
 
                         // Good
                         case *ModuleVariable:
                         case *ResourceVariable:
                         case *TerraformVariable:
                         case *UserVariable:
+                        case *LocalVariable:
 
                         default:
-                                errs = append(errs, fmt.Errorf(
+                                diags = diags.Append(fmt.Errorf(
                                         "Internal error. Unknown type in count var in %s: %T",
-                                        n, v))
+                                        n, v,
+                                ))
                         }
                 }
 
-                // Interpolate with a fixed number to verify that its a number.
-                r.RawCount.interpolate(func(root ast.Node) (interface{}, error) {
-                        // Execute the node but transform the AST so that it returns
-                        // a fixed value of "5" for all interpolations.
-                        result, err := hil.Eval(
-                                hil.FixedValueTransform(
-                                        root, &ast.LiteralNode{Value: "5", Typex: ast.TypeString}),
-                                nil)
-                        if err != nil {
-                                return "", err
-                        }
-
-                        return result.Value, nil
-                })
-                _, err := strconv.ParseInt(r.RawCount.Value().(string), 0, 0)
-                if err != nil {
-                        errs = append(errs, fmt.Errorf(
-                                "%s: resource count must be an integer",
-                                n))
+                if !r.RawCount.couldBeInteger() {
+                        diags = diags.Append(fmt.Errorf(
+                                "%s: resource count must be an integer", n,
+                        ))
                 }
                 r.RawCount.init()
 
                 // Validate DependsOn
-                errs = append(errs, c.validateDependsOn(n, r.DependsOn, resources, modules)...)
+                for _, err := range c.validateDependsOn(n, r.DependsOn, resources, modules) {
+                        diags = diags.Append(err)
+                }
 
                 // Verify provisioners
                 for _, p := range r.Provisioners {
@@ -595,9 +638,10 @@ func (c *Config) Validate() error {
                                 }
 
                                 if rv.Multi && rv.Index == -1 && rv.Type == r.Type && rv.Name == r.Name {
-                                        errs = append(errs, fmt.Errorf(
-                                                "%s: connection info cannot contain splat variable "+
-                                                        "referencing itself", n))
+                                        diags = diags.Append(fmt.Errorf(
+                                                "%s: connection info cannot contain splat variable referencing itself",
+                                                n,
+                                        ))
                                         break
                                 }
                         }
@@ -609,9 +653,10 @@ func (c *Config) Validate() error {
                                 }
 
                                 if rv.Multi && rv.Index == -1 && rv.Type == r.Type && rv.Name == r.Name {
-                                        errs = append(errs, fmt.Errorf(
-                                                "%s: connection info cannot contain splat variable "+
-                                                        "referencing itself", n))
+                                        diags = diags.Append(fmt.Errorf(
+                                                "%s: connection info cannot contain splat variable referencing itself",
+                                                n,
+                                        ))
                                         break
                                 }
                         }
@@ -619,21 +664,24 @@ func (c *Config) Validate() error {
                         // Check for invalid when/onFailure values, though this should be
                         // picked up by the loader we check here just in case.
                         if p.When == ProvisionerWhenInvalid {
-                                errs = append(errs, fmt.Errorf(
-                                        "%s: provisioner 'when' value is invalid", n))
+                                diags = diags.Append(fmt.Errorf(
+                                        "%s: provisioner 'when' value is invalid", n,
+                                ))
                         }
                         if p.OnFailure == ProvisionerOnFailureInvalid {
-                                errs = append(errs, fmt.Errorf(
-                                        "%s: provisioner 'on_failure' value is invalid", n))
+                                diags = diags.Append(fmt.Errorf(
+                                        "%s: provisioner 'on_failure' value is invalid", n,
+                                ))
                         }
                 }
 
                 // Verify ignore_changes contains valid entries
                 for _, v := range r.Lifecycle.IgnoreChanges {
                         if strings.Contains(v, "*") && v != "*" {
-                                errs = append(errs, fmt.Errorf(
-                                        "%s: ignore_changes does not support using a partial string "+
-                                                "together with a wildcard: %s", n, v))
+                                diags = diags.Append(fmt.Errorf(
+                                        "%s: ignore_changes does not support using a partial string together with a wildcard: %s",
+                                        n, v,
+                                ))
                         }
                 }
 
@@ -642,21 +690,24 @@ func (c *Config) Validate() error {
                         "root": r.Lifecycle.IgnoreChanges,
                 })
                 if err != nil {
-                        errs = append(errs, fmt.Errorf(
+                        diags = diags.Append(fmt.Errorf(
                                 "%s: lifecycle ignore_changes error: %s",
-                                n, err))
+                                n, err,
+                        ))
                 } else if len(rc.Interpolations) > 0 {
-                        errs = append(errs, fmt.Errorf(
+                        diags = diags.Append(fmt.Errorf(
                                 "%s: lifecycle ignore_changes cannot contain interpolations",
-                                n))
+                                n,
+                        ))
                 }
 
                 // If it is a data source then it can't have provisioners
                 if r.Mode == DataResourceMode {
                         if _, ok := r.RawConfig.Raw["provisioner"]; ok {
-                                errs = append(errs, fmt.Errorf(
+                                diags = diags.Append(fmt.Errorf(
                                         "%s: data sources cannot have provisioners",
-                                        n))
+                                        n,
+                                ))
                         }
                 }
         }
@@ -670,25 +721,50 @@ func (c *Config) Validate() error {
 
                         id := rv.ResourceId()
                         if _, ok := resources[id]; !ok {
-                                errs = append(errs, fmt.Errorf(
+                                diags = diags.Append(fmt.Errorf(
                                         "%s: unknown resource '%s' referenced in variable %s",
                                         source,
                                         id,
-                                        rv.FullKey()))
+                                        rv.FullKey(),
+                                ))
                                 continue
                         }
                 }
         }
 
+        // Check that all locals are valid
+        {
+                found := make(map[string]struct{})
+                for _, l := range c.Locals {
+                        if _, ok := found[l.Name]; ok {
+                                diags = diags.Append(fmt.Errorf(
+                                        "%s: duplicate local. local value names must be unique",
+                                        l.Name,
+                                ))
+                                continue
+                        }
+                        found[l.Name] = struct{}{}
+
+                        for _, v := range l.RawConfig.Variables {
+                                if _, ok := v.(*CountVariable); ok {
+                                        diags = diags.Append(fmt.Errorf(
+                                                "local %s: count variables are only valid within resources", l.Name,
+                                        ))
+                                }
+                        }
+                }
+        }
+
         // Check that all outputs are valid
         {
                 found := make(map[string]struct{})
                 for _, o := range c.Outputs {
                         // Verify the output is new
                         if _, ok := found[o.Name]; ok {
-                                errs = append(errs, fmt.Errorf(
-                                        "%s: duplicate output. output names must be unique.",
-                                        o.Name))
+                                diags = diags.Append(fmt.Errorf(
+                                        "output %q: an output of this name was already defined",
+                                        o.Name,
+                                ))
                                 continue
                         }
                         found[o.Name] = struct{}{}
@@ -708,9 +784,10 @@ func (c *Config) Validate() error {
                                                 continue
                                         }
 
-                                        errs = append(errs, fmt.Errorf(
-                                                "%s: value for 'sensitive' must be boolean",
-                                                o.Name))
+                                        diags = diags.Append(fmt.Errorf(
+                                                "output %q: value for 'sensitive' must be boolean",
+                                                o.Name,
+                                        ))
                                         continue
                                 }
                                 if k == "description" {
@@ -719,27 +796,78 @@ func (c *Config) Validate() error {
                                                 continue
                                         }
 
-                                        errs = append(errs, fmt.Errorf(
-                                                "%s: value for 'description' must be string",
-                                                o.Name))
+                                        diags = diags.Append(fmt.Errorf(
+                                                "output %q: value for 'description' must be string",
+                                                o.Name,
+                                        ))
                                         continue
                                 }
                                 invalidKeys = append(invalidKeys, k)
                         }
                         if len(invalidKeys) > 0 {
-                                errs = append(errs, fmt.Errorf(
-                                        "%s: output has invalid keys: %s",
-                                        o.Name, strings.Join(invalidKeys, ", ")))
+                                diags = diags.Append(fmt.Errorf(
+                                        "output %q: invalid keys: %s",
+                                        o.Name, strings.Join(invalidKeys, ", "),
+                                ))
                         }
                         if !valueKeyFound {
-                                errs = append(errs, fmt.Errorf(
-                                        "%s: output is missing required 'value' key", o.Name))
+                                diags = diags.Append(fmt.Errorf(
+                                        "output %q: missing required 'value' argument", o.Name,
+                                ))
                         }
 
                         for _, v := range o.RawConfig.Variables {
                                 if _, ok := v.(*CountVariable); ok {
-                                        errs = append(errs, fmt.Errorf(
-                                                "%s: count variables are only valid within resources", o.Name))
+                                        diags = diags.Append(fmt.Errorf(
+                                                "output %q: count variables are only valid within resources",
+                                                o.Name,
+                                        ))
+                                }
+                        }
+
+                        // Detect a common mistake of using a "count"ed resource in
+                        // an output value without using the splat or index form.
+                        // Prior to 0.11 this error was silently ignored, but outputs
+                        // now have their errors checked like all other contexts.
+                        //
+                        // TODO: Remove this in 0.12.
+                        for _, v := range o.RawConfig.Variables {
+                                rv, ok := v.(*ResourceVariable)
+                                if !ok {
+                                        continue
+                                }
+
+                                // If the variable seems to be treating the referenced
+                                // resource as a singleton (no count specified) then
+                                // we'll check to make sure it is indeed a singleton.
+                                // It's a warning if not.
+
+                                if rv.Multi || rv.Index != 0 {
+                                        // This reference is treating the resource as a
+                                        // multi-resource, so the warning doesn't apply.
+                                        continue
+                                }
+
+                                for _, r := range c.Resources {
+                                        if r.Id() != rv.ResourceId() {
+                                                continue
+                                        }
+
+                                        // We test specifically for the raw string "1" here
+                                        // because we _do_ want to generate this warning if
+                                        // the user has provided an expression that happens
+                                        // to return 1 right now, to catch situations where
+                                        // a count might dynamically be set to something
+                                        // other than 1 and thus splat syntax is still needed
+                                        // to be safe.
+                                        if r.RawCount != nil && r.RawCount.Raw != nil && r.RawCount.Raw["count"] != "1" && rv.Field != "count" {
+                                                diags = diags.Append(tfdiags.SimpleWarning(fmt.Sprintf(
+                                                        "output %q: must use splat syntax to access %s attribute %q, because it has \"count\" set; use %s.*.%s to obtain a list of the attributes across all instances",
+                                                        o.Name,
+                                                        r.Id(), rv.Field,
+                                                        r.Id(), rv.Field,
+                                                )))
+                                        }
                                 }
                         }
                 }
@@ -755,17 +883,15 @@ func (c *Config) Validate() error {
 
                 for _, v := range rc.Variables {
                         if _, ok := v.(*SelfVariable); ok {
-                                errs = append(errs, fmt.Errorf(
-                                        "%s: cannot contain self-reference %s", source, v.FullKey()))
+                                diags = diags.Append(fmt.Errorf(
+                                        "%s: cannot contain self-reference %s",
+                                        source, v.FullKey(),
+                                ))
                         }
                 }
         }
 
-        if len(errs) > 0 {
-                return &multierror.Error{Errors: errs}
-        }
-
-        return nil
+        return diags
 }
 
 // InterpolatedVariables is a helper that returns a mapping of all the interpolated
diff --git a/vendor/github.com/hashicorp/terraform/config/config_string.go b/vendor/github.com/hashicorp/terraform/config/config_string.go
index 0b3abbc..a6933c2 100644
--- a/vendor/github.com/hashicorp/terraform/config/config_string.go
+++ b/vendor/github.com/hashicorp/terraform/config/config_string.go
@@ -143,6 +143,46 @@ func outputsStr(os []*Output) string {
                                 result += fmt.Sprintf("    %s: %s\n", kind, str)
                         }
                 }
+
+                if o.Description != "" {
+                        result += fmt.Sprintf("  description\n    %s\n", o.Description)
+                }
+        }
+
+        return strings.TrimSpace(result)
+}
+
+func localsStr(ls []*Local) string {
+        ns := make([]string, 0, len(ls))
+        m := make(map[string]*Local)
+        for _, l := range ls {
+                ns = append(ns, l.Name)
+                m[l.Name] = l
+        }
+        sort.Strings(ns)
+
+        result := ""
+        for _, n := range ns {
+                l := m[n]
+
+                result += fmt.Sprintf("%s\n", n)
+
+                if len(l.RawConfig.Variables) > 0 {
+                        result += fmt.Sprintf("  vars\n")
+                        for _, rawV := range l.RawConfig.Variables {
+                                kind := "unknown"
+                                str := rawV.FullKey()
+
+                                switch rawV.(type) {
+                                case *ResourceVariable:
+                                        kind = "resource"
+                                case *UserVariable:
+                                        kind = "user"
+                                }
+
+                                result += fmt.Sprintf("    %s: %s\n", kind, str)
+                        }
+                }
         }
 
         return strings.TrimSpace(result)
diff --git a/vendor/github.com/hashicorp/terraform/config/configschema/decoder_spec.go b/vendor/github.com/hashicorp/terraform/config/configschema/decoder_spec.go
new file mode 100644
index 0000000..2b1b0ca
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/config/configschema/decoder_spec.go
@@ -0,0 +1,97 @@
+package configschema
+
+import (
+        "github.com/hashicorp/hcl2/hcldec"
+        "github.com/zclconf/go-cty/cty"
+)
+
+var mapLabelNames = []string{"key"}
+
+// DecoderSpec returns a hcldec.Spec that can be used to decode a HCL Body
+// using the facilities in the hcldec package.
+//
+// The returned specification is guaranteed to return a value of the same type
+// returned by method ImpliedType, but it may contain null or unknown values if
+// any of the block attributes are defined as optional and/or computed
+// respectively.
+func (b *Block) DecoderSpec() hcldec.Spec {
+        ret := hcldec.ObjectSpec{}
+        if b == nil {
+                return ret
+        }
+
+        for name, attrS := range b.Attributes {
+                switch {
+                case attrS.Computed && attrS.Optional:
+                        // In this special case we use an unknown value as a default
+                        // to get the intended behavior that the result is computed
+                        // unless it has been explicitly set in config.
+                        ret[name] = &hcldec.DefaultSpec{
+                                Primary: &hcldec.AttrSpec{
+                                        Name: name,
+                                        Type: attrS.Type,
+                                },
+                                Default: &hcldec.LiteralSpec{
+                                        Value: cty.UnknownVal(attrS.Type),
+                                },
+                        }
+                case attrS.Computed:
+                        ret[name] = &hcldec.LiteralSpec{
+                                Value: cty.UnknownVal(attrS.Type),
+                        }
+                default:
+                        ret[name] = &hcldec.AttrSpec{
+                                Name:     name,
+                                Type:     attrS.Type,
+                                Required: attrS.Required,
+                        }
+                }
+        }
+
+        for name, blockS := range b.BlockTypes {
+                if _, exists := ret[name]; exists {
+                        // This indicates an invalid schema, since it's not valid to
+                        // define both an attribute and a block type of the same name.
+                        // However, we don't raise this here since it's checked by
+                        // InternalValidate.
+                        continue
+                }
+
+                childSpec := blockS.Block.DecoderSpec()
+
+                switch blockS.Nesting {
+                case NestingSingle:
+                        ret[name] = &hcldec.BlockSpec{
+                                TypeName: name,
+                                Nested:   childSpec,
+                                Required: blockS.MinItems == 1 && blockS.MaxItems >= 1,
+                        }
+                case NestingList:
+                        ret[name] = &hcldec.BlockListSpec{
+                                TypeName: name,
+                                Nested:   childSpec,
+                                MinItems: blockS.MinItems,
+                                MaxItems: blockS.MaxItems,
+                        }
+                case NestingSet:
+                        ret[name] = &hcldec.BlockSetSpec{
+                                TypeName: name,
+                                Nested:   childSpec,
+                                MinItems: blockS.MinItems,
+                                MaxItems: blockS.MaxItems,
+                        }
+                case NestingMap:
+                        ret[name] = &hcldec.BlockMapSpec{
+                                TypeName:   name,
+                                Nested:     childSpec,
+                                LabelNames: mapLabelNames,
+                        }
+                default:
+                        // Invalid nesting type is just ignored. It's checked by
+                        // InternalValidate.
+                        continue
+                }
+        }
+
+        return ret
+}
diff --git a/vendor/github.com/hashicorp/terraform/config/configschema/doc.go b/vendor/github.com/hashicorp/terraform/config/configschema/doc.go
new file mode 100644
index 0000000..caf8d73
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/config/configschema/doc.go
@@ -0,0 +1,14 @@
+// Package configschema contains types for describing the expected structure
+// of a configuration block whose shape is not known until runtime.
+//
+// For example, this is used to describe the expected contents of a resource
+// configuration block, which is defined by the corresponding provider plugin
+// and thus not compiled into Terraform core.
+//
+// A configschema primarily describes the shape of configuration, but it is
+// also suitable for use with other structures derived from the configuration,
+// such as the cached state of a resource or a resource diff.
+//
+// This package should not be confused with the package helper/schema, which
+// is the higher-level helper library used to implement providers themselves.
+package configschema
diff --git a/vendor/github.com/hashicorp/terraform/config/configschema/implied_type.go b/vendor/github.com/hashicorp/terraform/config/configschema/implied_type.go
new file mode 100644
index 0000000..67324eb
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/config/configschema/implied_type.go
@@ -0,0 +1,21 @@
+package configschema
+
+import (
+        "github.com/hashicorp/hcl2/hcldec"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// ImpliedType returns the cty.Type that would result from decoding a
+// configuration block using the receiving block schema.
+//
+// ImpliedType always returns a result, even if the given schema is
+// inconsistent. Code that creates configschema.Block objects should be
+// tested using the InternalValidate method to detect any inconsistencies
+// that would cause this method to fall back on defaults and assumptions.
+func (b *Block) ImpliedType() cty.Type {
+        if b == nil {
+                return cty.EmptyObject
+        }
+
+        return hcldec.ImpliedType(b.DecoderSpec())
+}
diff --git a/vendor/github.com/hashicorp/terraform/config/configschema/internal_validate.go b/vendor/github.com/hashicorp/terraform/config/configschema/internal_validate.go
new file mode 100644
index 0000000..33cbe88
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/config/configschema/internal_validate.go
@@ -0,0 +1,92 @@
+package configschema
+
+import (
+        "fmt"
+        "regexp"
+
+        "github.com/zclconf/go-cty/cty"
+
+        multierror "github.com/hashicorp/go-multierror"
+)
+
+var validName = regexp.MustCompile(`^[a-z0-9_]+$`)
+
+// InternalValidate returns an error if the receiving block and its child
+// schema definitions have any consistencies with the documented rules for
+// valid schema.
+//
+// This is intended to be used within unit tests to detect when a given
+// schema is invalid.
+func (b *Block) InternalValidate() error {
+        if b == nil {
+                return fmt.Errorf("top-level block schema is nil")
+        }
+        return b.internalValidate("", nil)
+
+}
+
+func (b *Block) internalValidate(prefix string, err error) error {
+        for name, attrS := range b.Attributes {
+                if attrS == nil {
+                        err = multierror.Append(err, fmt.Errorf("%s%s: attribute schema is nil", prefix, name))
+                        continue
+                }
+                if !validName.MatchString(name) {
+                        err = multierror.Append(err, fmt.Errorf("%s%s: name may contain only lowercase letters, digits and underscores", prefix, name))
+                }
+                if attrS.Optional == false && attrS.Required == false && attrS.Computed == false {
+                        err = multierror.Append(err, fmt.Errorf("%s%s: must set Optional, Required or Computed", prefix, name))
+                }
+                if attrS.Optional && attrS.Required {
+                        err = multierror.Append(err, fmt.Errorf("%s%s: cannot set both Optional and Required", prefix, name))
+                }
+                if attrS.Computed && attrS.Required {
+                        err = multierror.Append(err, fmt.Errorf("%s%s: cannot set both Computed and Required", prefix, name))
+                }
+                if attrS.Type == cty.NilType {
+                        err = multierror.Append(err, fmt.Errorf("%s%s: Type must be set to something other than cty.NilType", prefix, name))
+                }
+        }
+
+        for name, blockS := range b.BlockTypes {
+                if blockS == nil {
+                        err = multierror.Append(err, fmt.Errorf("%s%s: block schema is nil", prefix, name))
+                        continue
+                }
+
+                if _, isAttr := b.Attributes[name]; isAttr {
+                        err = multierror.Append(err, fmt.Errorf("%s%s: name defined as both attribute and child block type", prefix, name))
+                } else if !validName.MatchString(name) {
+                        err = multierror.Append(err, fmt.Errorf("%s%s: name may contain only lowercase letters, digits and underscores", prefix, name))
+                }
+
+                if blockS.MinItems < 0 || blockS.MaxItems < 0 {
+                        err = multierror.Append(err, fmt.Errorf("%s%s: MinItems and MaxItems must both be greater than zero", prefix, name))
+                }
+
+                switch blockS.Nesting {
+                case NestingSingle:
+                        switch {
+                        case blockS.MinItems != blockS.MaxItems:
+                                err = multierror.Append(err, fmt.Errorf("%s%s: MinItems and MaxItems must match in NestingSingle mode", prefix, name))
+                        case blockS.MinItems < 0 || blockS.MinItems > 1:
+                                err = multierror.Append(err, fmt.Errorf("%s%s: MinItems and MaxItems must be set to either 0 or 1 in NestingSingle mode", prefix, name))
+                        }
+                case NestingList, NestingSet:
+                        if blockS.MinItems > blockS.MaxItems && blockS.MaxItems != 0 {
+                                err = multierror.Append(err, fmt.Errorf("%s%s: MinItems must be less than or equal to MaxItems in %s mode", prefix, name, blockS.Nesting))
+                        }
+                case NestingMap:
+                        if blockS.MinItems != 0 || blockS.MaxItems != 0 {
+                                err = multierror.Append(err, fmt.Errorf("%s%s: MinItems and MaxItems must both be 0 in NestingMap mode", prefix, name))
+                        }
+                default:
+                        err = multierror.Append(err, fmt.Errorf("%s%s: invalid nesting mode %s", prefix, name, blockS.Nesting))
+                }
+
+                subPrefix := prefix + name + "."
+                err = blockS.Block.internalValidate(subPrefix, err)
+        }
+
+        return err
+}
diff --git a/vendor/github.com/hashicorp/terraform/config/configschema/nestingmode_string.go b/vendor/github.com/hashicorp/terraform/config/configschema/nestingmode_string.go
new file mode 100644
index 0000000..6cb9313
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/config/configschema/nestingmode_string.go
@@ -0,0 +1,16 @@
+// Code generated by "stringer -type=NestingMode"; DO NOT EDIT.
+
+package configschema
+
+import "strconv"
+
+const _NestingMode_name = "nestingModeInvalidNestingSingleNestingListNestingSetNestingMap"
+
+var _NestingMode_index = [...]uint8{0, 18, 31, 42, 52, 62}
+
+func (i NestingMode) String() string {
+        if i < 0 || i >= NestingMode(len(_NestingMode_index)-1) {
+                return "NestingMode(" + strconv.FormatInt(int64(i), 10) + ")"
+        }
+        return _NestingMode_name[_NestingMode_index[i]:_NestingMode_index[i+1]]
+}
diff --git a/vendor/github.com/hashicorp/terraform/config/configschema/schema.go b/vendor/github.com/hashicorp/terraform/config/configschema/schema.go
new file mode 100644
index 0000000..9a8ee55
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/config/configschema/schema.go
@@ -0,0 +1,107 @@
+package configschema
+
+import (
+        "github.com/zclconf/go-cty/cty"
+)
+
+// Block represents a configuration block.
+//
+// "Block" here is a logical grouping construct, though it happens to map
+// directly onto the physical block syntax of Terraform's native configuration
+// syntax. It may be a more a matter of convention in other syntaxes, such as
+// JSON.
+//
+// When converted to a value, a Block always becomes an instance of an object
+// type derived from its defined attributes and nested blocks
+type Block struct {
+        // Attributes describes any attributes that may appear directly inside
+        // the block.
+        Attributes map[string]*Attribute
+
+        // BlockTypes describes any nested block types that may appear directly
+        // inside the block.
+        BlockTypes map[string]*NestedBlock
+}
+
+// Attribute represents a configuration attribute, within a block.
+type Attribute struct {
+        // Type is a type specification that the attribute's value must conform to.
+        Type cty.Type
+
+        // Required, if set to true, specifies that an omitted or null value is
+        // not permitted.
+        Required bool
+
+        // Optional, if set to true, specifies that an omitted or null value is
+        // permitted. This field conflicts with Required.
+        Optional bool
+
+        // Computed, if set to true, specifies that the value comes from the
+        // provider rather than from configuration. If combined with Optional,
+        // then the config may optionally provide an overridden value.
+        Computed bool
+
+        // Sensitive, if set to true, indicates that an attribute may contain
+        // sensitive information.
+        //
+        // At present nothing is done with this information, but callers are
+        // encouraged to set it where appropriate so that it may be used in the
+        // future to help Terraform mask sensitive information. (Terraform
+        // currently achieves this in a limited sense via other mechanisms.)
+        Sensitive bool
+}
+
+// NestedBlock represents the embedding of one block within another.
+type NestedBlock struct {
+        // Block is the description of the block that's nested.
+        Block
+
+        // Nesting provides the nesting mode for the child block, which determines
+        // how many instances of the block are allowed, how many labels it expects,
+        // and how the resulting data will be converted into a data structure.
+        Nesting NestingMode
+
+        // MinItems and MaxItems set, for the NestingList and NestingSet nesting
+        // modes, lower and upper limits on the number of child blocks allowed
+        // of the given type. If both are left at zero, no limit is applied.
+        //
+        // As a special case, both values can be set to 1 for NestingSingle in
+        // order to indicate that a particular single block is required.
+        //
+        // These fields are ignored for other nesting modes and must both be left
+        // at zero.
+        MinItems, MaxItems int
+}
+
+// NestingMode is an enumeration of modes for nesting blocks inside other
+// blocks.
+type NestingMode int
+
+//go:generate stringer -type=NestingMode
+
+const (
+        nestingModeInvalid NestingMode = iota
+
+        // NestingSingle indicates that only a single instance of a given
+        // block type is permitted, with no labels, and its content should be
+        // provided directly as an object value.
+        NestingSingle
+
+        // NestingList indicates that multiple blocks of the given type are
+        // permitted, with no labels, and that their corresponding objects should
+        // be provided in a list.
+        NestingList
+
+        // NestingSet indicates that multiple blocks of the given type are
+        // permitted, with no labels, and that their corresponding objects should
+        // be provided in a set.
+        NestingSet
+
+        // NestingMap indicates that multiple blocks of the given type are
+        // permitted, each with a single label, and that their corresponding
+        // objects should be provided in a map whose keys are the labels.
+        //
+        // It's an error, therefore, to use the same label value on multiple
+        // blocks.
+        NestingMap
+)
diff --git a/vendor/github.com/hashicorp/terraform/config/hcl2_shim_util.go b/vendor/github.com/hashicorp/terraform/config/hcl2_shim_util.go
new file mode 100644
index 0000000..207d105
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/config/hcl2_shim_util.go
@@ -0,0 +1,134 @@
+package config
+
+import (
+        "fmt"
+
+        "github.com/zclconf/go-cty/cty/function/stdlib"
+
+        "github.com/hashicorp/hil/ast"
+        "github.com/hashicorp/terraform/config/hcl2shim"
+
+        hcl2 "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+        "github.com/zclconf/go-cty/cty/function"
+)
+
+// ---------------------------------------------------------------------------
+// This file contains some helper functions that are used to shim between
+// HCL2 concepts and HCL/HIL concepts, to help us mostly preserve the existing
+// public API that was built around HCL/HIL-oriented approaches.
+// ---------------------------------------------------------------------------
+
+func hcl2InterpolationFuncs() map[string]function.Function {
+        hcl2Funcs := map[string]function.Function{}
+
+        for name, hilFunc := range Funcs() {
+                hcl2Funcs[name] = hcl2InterpolationFuncShim(hilFunc)
+        }
+
+        // Some functions in the old world are dealt with inside langEvalConfig
+        // due to their legacy reliance on direct access to the symbol table.
+        // Since 0.7 they don't actually need it anymore and just ignore it,
+        // so we're cheating a bit here and exploiting that detail by passing nil.
+        hcl2Funcs["lookup"] = hcl2InterpolationFuncShim(interpolationFuncLookup(nil))
+        hcl2Funcs["keys"] = hcl2InterpolationFuncShim(interpolationFuncKeys(nil))
+        hcl2Funcs["values"] = hcl2InterpolationFuncShim(interpolationFuncValues(nil))
+
+        // As a bonus, we'll provide the JSON-handling functions from the cty
+        // function library since its "jsonencode" is more complete (doesn't force
+        // weird type conversions) and HIL's type system can't represent
+        // "jsondecode" at all. The result of jsondecode will eventually be forced
+        // to conform to the HIL type system on exit into the rest of Terraform due
+        // to our shimming right now, but it should be usable for decoding _within_
+        // an expression.
+        hcl2Funcs["jsonencode"] = stdlib.JSONEncodeFunc
+        hcl2Funcs["jsondecode"] = stdlib.JSONDecodeFunc
+
+        return hcl2Funcs
+}
+
+func hcl2InterpolationFuncShim(hilFunc ast.Function) function.Function {
+        spec := &function.Spec{}
+
+        for i, hilArgType := range hilFunc.ArgTypes {
+                spec.Params = append(spec.Params, function.Parameter{
+                        Type: hcl2shim.HCL2TypeForHILType(hilArgType),
+                        Name: fmt.Sprintf("arg%d", i+1), // HIL args don't have names, so we'll fudge it
+                })
+        }
+
+        if hilFunc.Variadic {
+                spec.VarParam = &function.Parameter{
+                        Type: hcl2shim.HCL2TypeForHILType(hilFunc.VariadicType),
+                        Name: "varargs", // HIL args don't have names, so we'll fudge it
+                }
+        }
+
+        spec.Type = func(args []cty.Value) (cty.Type, error) {
+                return hcl2shim.HCL2TypeForHILType(hilFunc.ReturnType), nil
+        }
+        spec.Impl = func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                hilArgs := make([]interface{}, len(args))
+                for i, arg := range args {
+                        hilV := hcl2shim.HILVariableFromHCL2Value(arg)
+
+                        // Although the cty function system does automatic type conversions
+                        // to match the argument types, cty doesn't distinguish int and
+                        // float and so we may need to adjust here to ensure that the
+                        // wrapped function gets exactly the Go type it was expecting.
+                        var wantType ast.Type
+                        if i < len(hilFunc.ArgTypes) {
+                                wantType = hilFunc.ArgTypes[i]
+                        } else {
+                                wantType = hilFunc.VariadicType
+                        }
+                        switch {
+                        case hilV.Type == ast.TypeInt && wantType == ast.TypeFloat:
+                                hilV.Type = wantType
+                                hilV.Value = float64(hilV.Value.(int))
+                        case hilV.Type == ast.TypeFloat && wantType == ast.TypeInt:
+                                hilV.Type = wantType
+                                hilV.Value = int(hilV.Value.(float64))
+                        }
+
+                        // HIL functions actually expect to have the outermost variable
+                        // "peeled" but any nested values (in lists or maps) will
+                        // still have their ast.Variable wrapping.
+                        hilArgs[i] = hilV.Value
+                }
+
+                hilResult, err := hilFunc.Callback(hilArgs)
+                if err != nil {
+                        return cty.DynamicVal, err
+                }
+
+                // Just as on the way in, we get back a partially-peeled ast.Variable
+                // which we need to re-wrap in order to convert it back into what
+                // we're calling a "config value".
+                rv := hcl2shim.HCL2ValueFromHILVariable(ast.Variable{
+                        Type:  hilFunc.ReturnType,
+                        Value: hilResult,
+                })
+
+                return convert.Convert(rv, retType) // if result is unknown we'll force the correct type here
+        }
+        return function.New(spec)
+}
+
+func hcl2EvalWithUnknownVars(expr hcl2.Expression) (cty.Value, hcl2.Diagnostics) {
+        trs := expr.Variables()
+        vars := map[string]cty.Value{}
+        val := cty.DynamicVal
+
+        for _, tr := range trs {
+                name := tr.RootName()
+                vars[name] = val
+        }
+
+        ctx := &hcl2.EvalContext{
+                Variables: vars,
+                Functions: hcl2InterpolationFuncs(),
+        }
+        return expr.Value(ctx)
+}
diff --git a/vendor/github.com/hashicorp/terraform/config/hcl2shim/single_attr_body.go b/vendor/github.com/hashicorp/terraform/config/hcl2shim/single_attr_body.go
new file mode 100644
index 0000000..19651c8
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/config/hcl2shim/single_attr_body.go
@@ -0,0 +1,85 @@
+package hcl2shim
+
+import (
+        "fmt"
+
+        hcl2 "github.com/hashicorp/hcl2/hcl"
+)
+
+// SingleAttrBody is a weird implementation of hcl2.Body that acts as if
+// it has a single attribute whose value is the given expression.
+//
+// This is used to shim Resource.RawCount and Output.RawConfig to behave
+// more like they do in the old HCL loader.
+type SingleAttrBody struct {
+        Name string
+        Expr hcl2.Expression
+}
+
+var _ hcl2.Body = SingleAttrBody{}
+
+func (b SingleAttrBody) Content(schema *hcl2.BodySchema) (*hcl2.BodyContent, hcl2.Diagnostics) {
+        content, all, diags := b.content(schema)
+        if !all {
+                // This should never happen because this body implementation should only
+                // be used by code that is aware that it's using a single-attr body.
+                diags = append(diags, &hcl2.Diagnostic{
+                        Severity: hcl2.DiagError,
+                        Summary:  "Invalid attribute",
+                        Detail:   fmt.Sprintf("The correct attribute name is %q.", b.Name),
+                        Subject:  b.Expr.Range().Ptr(),
+                })
+        }
+        return content, diags
+}
+
+func (b SingleAttrBody) PartialContent(schema *hcl2.BodySchema) (*hcl2.BodyContent, hcl2.Body, hcl2.Diagnostics) {
+        content, all, diags := b.content(schema)
+        var remain hcl2.Body
+        if all {
+                // If the request matched the one attribute we represent, then the
+                // remaining body is empty.
+                remain = hcl2.EmptyBody()
+        } else {
+                remain = b
+        }
+        return content, remain, diags
+}
+
+func (b SingleAttrBody) content(schema *hcl2.BodySchema) (*hcl2.BodyContent, bool, hcl2.Diagnostics) {
+        ret := &hcl2.BodyContent{}
+        all := false
+        var diags hcl2.Diagnostics
+
+        for _, attrS := range schema.Attributes {
+                if attrS.Name == b.Name {
+                        attrs, _ := b.JustAttributes()
+                        ret.Attributes = attrs
+                        all = true
+                } else if attrS.Required {
+                        diags = append(diags, &hcl2.Diagnostic{
+                                Severity: hcl2.DiagError,
+                                Summary:  "Missing attribute",
+                                Detail:   fmt.Sprintf("The attribute %q is required.", attrS.Name),
+                                Subject:  b.Expr.Range().Ptr(),
+                        })
+                }
+        }
+
+        return ret, all, diags
+}
+
+func (b SingleAttrBody) JustAttributes() (hcl2.Attributes, hcl2.Diagnostics) {
+        return hcl2.Attributes{
+                b.Name: {
+                        Expr:      b.Expr,
+                        Name:      b.Name,
+                        NameRange: b.Expr.Range(),
+                        Range:     b.Expr.Range(),
+                },
+        }, nil
+}
+
+func (b SingleAttrBody) MissingItemRange() hcl2.Range {
+        return b.Expr.Range()
+}
diff --git a/vendor/github.com/hashicorp/terraform/config/hcl2shim/values.go b/vendor/github.com/hashicorp/terraform/config/hcl2shim/values.go
new file mode 100644
index 0000000..0b697a5
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/config/hcl2shim/values.go
@@ -0,0 +1,246 @@
+package hcl2shim
+
+import (
+        "fmt"
+        "math/big"
+
+        "github.com/hashicorp/hil/ast"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// UnknownVariableValue is a sentinel value that can be used
+// to denote that the value of a variable is unknown at this time.
+// RawConfig uses this information to build up data about
+// unknown keys.
+const UnknownVariableValue = "74D93920-ED26-11E3-AC10-0800200C9A66"
+
+// ConfigValueFromHCL2 converts a value from HCL2 (really, from the cty dynamic
+// types library that HCL2 uses) to a value type that matches what would've
+// been produced from the HCL-based interpolator for an equivalent structure.
+//
+// This function will transform a cty null value into a Go nil value, which
+// isn't a possible outcome of the HCL/HIL-based decoder and so callers may
+// need to detect and reject any null values.
+func ConfigValueFromHCL2(v cty.Value) interface{} {
+        if !v.IsKnown() {
+                return UnknownVariableValue
+        }
+        if v.IsNull() {
+                return nil
+        }
+
+        switch v.Type() {
+        case cty.Bool:
+                return v.True() // like HCL.BOOL
+        case cty.String:
+                return v.AsString() // like HCL token.STRING or token.HEREDOC
+        case cty.Number:
+                // We can't match HCL _exactly_ here because it distinguishes between
+                // int and float values, but we'll get as close as we can by using
+                // an int if the number is exactly representable, and a float if not.
+                // The conversion to float will force precision to that of a float64,
+                // which is potentially losing information from the specific number
+                // given, but no worse than what HCL would've done in its own conversion
+                // to float.
+
+                f := v.AsBigFloat()
+                if i, acc := f.Int64(); acc == big.Exact {
+                        // if we're on a 32-bit system and the number is too big for 32-bit
+                        // int then we'll fall through here and use a float64.
+                        const MaxInt = int(^uint(0) >> 1)
+                        const MinInt = -MaxInt - 1
+                        if i <= int64(MaxInt) && i >= int64(MinInt) {
+                                return int(i) // Like HCL token.NUMBER
+                        }
+                }
+
+                f64, _ := f.Float64()
+                return f64 // like HCL token.FLOAT
+        }
+
+        if v.Type().IsListType() || v.Type().IsSetType() || v.Type().IsTupleType() {
+                l := make([]interface{}, 0, v.LengthInt())
+                it := v.ElementIterator()
+                for it.Next() {
+                        _, ev := it.Element()
+                        l = append(l, ConfigValueFromHCL2(ev))
+                }
+                return l
+        }
+
+        if v.Type().IsMapType() || v.Type().IsObjectType() {
+                l := make(map[string]interface{})
+                it := v.ElementIterator()
+                for it.Next() {
+                        ek, ev := it.Element()
+                        l[ek.AsString()] = ConfigValueFromHCL2(ev)
+                }
+                return l
+        }
+
+        // If we fall out here then we have some weird type that we haven't
+        // accounted for. This should never happen unless the caller is using
+        // capsule types, and we don't currently have any such types defined.
+        panic(fmt.Errorf("can't convert %#v to config value", v))
+}
+
+// HCL2ValueFromConfigValue is the opposite of configValueFromHCL2: it takes
+// a value as would be returned from the old interpolator and turns it into
+// a cty.Value so it can be used within, for example, an HCL2 EvalContext.
+func HCL2ValueFromConfigValue(v interface{}) cty.Value {
+        if v == nil {
+                return cty.NullVal(cty.DynamicPseudoType)
+        }
+        if v == UnknownVariableValue {
+                return cty.DynamicVal
+        }
+
+        switch tv := v.(type) {
+        case bool:
+                return cty.BoolVal(tv)
+        case string:
+                return cty.StringVal(tv)
+        case int:
+                return cty.NumberIntVal(int64(tv))
+        case float64:
+                return cty.NumberFloatVal(tv)
+        case []interface{}:
+                vals := make([]cty.Value, len(tv))
+                for i, ev := range tv {
+                        vals[i] = HCL2ValueFromConfigValue(ev)
+                }
+                return cty.TupleVal(vals)
+        case map[string]interface{}:
+                vals := map[string]cty.Value{}
+                for k, ev := range tv {
+                        vals[k] = HCL2ValueFromConfigValue(ev)
+                }
+                return cty.ObjectVal(vals)
+        default:
+                // HCL/HIL should never generate anything that isn't caught by
+                // the above, so if we get here something has gone very wrong.
+                panic(fmt.Errorf("can't convert %#v to cty.Value", v))
+        }
+}
+
+func HILVariableFromHCL2Value(v cty.Value) ast.Variable {
+        if v.IsNull() {
+                // Caller should guarantee/check this before calling
+                panic("Null values cannot be represented in HIL")
+        }
+        if !v.IsKnown() {
+                return ast.Variable{
+                        Type:  ast.TypeUnknown,
+                        Value: UnknownVariableValue,
+                }
+        }
+
+        switch v.Type() {
+        case cty.Bool:
+                return ast.Variable{
+                        Type:  ast.TypeBool,
+                        Value: v.True(),
+                }
+        case cty.Number:
+                v := ConfigValueFromHCL2(v)
+                switch tv := v.(type) {
+                case int:
+                        return ast.Variable{
+                                Type:  ast.TypeInt,
+                                Value: tv,
+                        }
+                case float64:
+                        return ast.Variable{
+                                Type:  ast.TypeFloat,
+                                Value: tv,
+                        }
+                default:
+                        // should never happen
+                        panic("invalid return value for configValueFromHCL2")
+                }
+        case cty.String:
+                return ast.Variable{
+                        Type:  ast.TypeString,
+                        Value: v.AsString(),
+                }
+        }
+
+        if v.Type().IsListType() || v.Type().IsSetType() || v.Type().IsTupleType() {
+                l := make([]ast.Variable, 0, v.LengthInt())
+                it := v.ElementIterator()
+                for it.Next() {
+                        _, ev := it.Element()
+                        l = append(l, HILVariableFromHCL2Value(ev))
+                }
+                // If we were given a tuple then this could actually produce an invalid
+                // list with non-homogenous types, which we expect to be caught inside
+                // HIL just like a user-supplied non-homogenous list would be.
+                return ast.Variable{
+                        Type:  ast.TypeList,
+                        Value: l,
+                }
+        }
+
+        if v.Type().IsMapType() || v.Type().IsObjectType() {
+                l := make(map[string]ast.Variable)
+                it := v.ElementIterator()
+                for it.Next() {
+                        ek, ev := it.Element()
+                        l[ek.AsString()] = HILVariableFromHCL2Value(ev)
+                }
+                // If we were given an object then this could actually produce an invalid
+                // map with non-homogenous types, which we expect to be caught inside
+                // HIL just like a user-supplied non-homogenous map would be.
+                return ast.Variable{
+                        Type:  ast.TypeMap,
+                        Value: l,
+                }
+        }
+
+        // If we fall out here then we have some weird type that we haven't
+        // accounted for. This should never happen unless the caller is using
+        // capsule types, and we don't currently have any such types defined.
+        panic(fmt.Errorf("can't convert %#v to HIL variable", v))
+}
+
+func HCL2ValueFromHILVariable(v ast.Variable) cty.Value {
+        switch v.Type {
+        case ast.TypeList:
+                vals := make([]cty.Value, len(v.Value.([]ast.Variable)))
+                for i, ev := range v.Value.([]ast.Variable) {
+                        vals[i] = HCL2ValueFromHILVariable(ev)
+                }
+                return cty.TupleVal(vals)
+        case ast.TypeMap:
+                vals := make(map[string]cty.Value, len(v.Value.(map[string]ast.Variable)))
+                for k, ev := range v.Value.(map[string]ast.Variable) {
+                        vals[k] = HCL2ValueFromHILVariable(ev)
+                }
+                return cty.ObjectVal(vals)
+        default:
+                return HCL2ValueFromConfigValue(v.Value)
+        }
+}
+
+func HCL2TypeForHILType(hilType ast.Type) cty.Type {
+        switch hilType {
+        case ast.TypeAny:
+                return cty.DynamicPseudoType
+        case ast.TypeUnknown:
+                return cty.DynamicPseudoType
+        case ast.TypeBool:
+                return cty.Bool
+        case ast.TypeInt:
+                return cty.Number
+        case ast.TypeFloat:
+                return cty.Number
+        case ast.TypeString:
+                return cty.String
+        case ast.TypeList:
+                return cty.List(cty.DynamicPseudoType)
+        case ast.TypeMap:
+                return cty.Map(cty.DynamicPseudoType)
+        default:
+                return cty.NilType // equilvalent to ast.TypeInvalid
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/config/import_tree.go b/vendor/github.com/hashicorp/terraform/config/import_tree.go
index 37ec11a..08cbc77 100644
--- a/vendor/github.com/hashicorp/terraform/config/import_tree.go
+++ b/vendor/github.com/hashicorp/terraform/config/import_tree.go
@@ -1,8 +1,12 @@
 package config
 
 import (
+        "bufio"
         "fmt"
         "io"
+        "os"
+
+        "github.com/hashicorp/errwrap"
 )
 
 // configurable is an interface that must be implemented by any configuration
@@ -27,15 +31,52 @@ type importTree struct {
 // imports.
 type fileLoaderFunc func(path string) (configurable, []string, error)
 
+// Set this to a non-empty value at link time to enable the HCL2 experiment.
+// This is not currently enabled for release builds.
+//
+// For example:
+//    go install -ldflags="-X github.com/hashicorp/terraform/config.enableHCL2Experiment=true" github.com/hashicorp/terraform
+var enableHCL2Experiment = ""
+
 // loadTree takes a single file and loads the entire importTree for that
 // file. This function detects what kind of configuration file it is an
 // executes the proper fileLoaderFunc.
 func loadTree(root string) (*importTree, error) {
         var f fileLoaderFunc
-        switch ext(root) {
-        case ".tf", ".tf.json":
-                f = loadFileHcl
-        default:
+
+        // HCL2 experiment is currently activated at build time via the linker.
+        // See the comment on this variable for more information.
+        if enableHCL2Experiment == "" {
+                // Main-line behavior: always use the original HCL parser
+                switch ext(root) {
+                case ".tf", ".tf.json":
+                        f = loadFileHcl
+                default:
+                }
+        } else {
+                // Experimental behavior: use the HCL2 parser if the opt-in comment
+                // is present.
+                switch ext(root) {
+                case ".tf":
+                        // We need to sniff the file for the opt-in comment line to decide
+                        // if the file is participating in the HCL2 experiment.
+                        cf, err := os.Open(root)
+                        if err != nil {
+                                return nil, err
+                        }
+                        sc := bufio.NewScanner(cf)
+                        for sc.Scan() {
+                                if sc.Text() == "#terraform:hcl2" {
+                                        f = globalHCL2Loader.loadFile
+                                }
+                        }
+                        if f == nil {
+                                f = loadFileHcl
+                        }
+                case ".tf.json":
+                        f = loadFileHcl
+                default:
+                }
         }
 
         if f == nil {
@@ -86,10 +127,7 @@ func (t *importTree) Close() error {
 func (t *importTree) ConfigTree() (*configTree, error) {
         config, err := t.Raw.Config()
         if err != nil {
-                return nil, fmt.Errorf(
-                        "Error loading %s: %s",
-                        t.Path,
-                        err)
+                return nil, errwrap.Wrapf(fmt.Sprintf("Error loading %s: {{err}}", t.Path), err)
         }
 
         // Build our result
diff --git a/vendor/github.com/hashicorp/terraform/config/interpolate.go b/vendor/github.com/hashicorp/terraform/config/interpolate.go
index bbb3555..599e5ec 100644
--- a/vendor/github.com/hashicorp/terraform/config/interpolate.go
+++ b/vendor/github.com/hashicorp/terraform/config/interpolate.go
@@ -5,6 +5,8 @@ import (
         "strconv"
         "strings"
 
+        "github.com/hashicorp/terraform/tfdiags"
+
         "github.com/hashicorp/hil/ast"
 )
 
@@ -14,6 +16,21 @@ import (
 // variables can come from: user variables, resources, etc.
 type InterpolatedVariable interface {
         FullKey() string
+        SourceRange() tfdiags.SourceRange
+}
+
+// varRange can be embedded into an InterpolatedVariable implementation to
+// implement the SourceRange method.
+type varRange struct {
+        rng tfdiags.SourceRange
+}
+
+func (r varRange) SourceRange() tfdiags.SourceRange {
+        return r.rng
+}
+
+func makeVarRange(rng tfdiags.SourceRange) varRange {
+        return varRange{rng}
 }
 
 // CountVariable is a variable for referencing information about
@@ -21,6 +38,7 @@ type InterpolatedVariable interface {
 type CountVariable struct {
         Type CountValueType
         key  string
+        varRange
 }
 
 // CountValueType is the type of the count variable that is referenced.
@@ -37,6 +55,7 @@ type ModuleVariable struct {
         Name  string
         Field string
         key   string
+        varRange
 }
 
 // A PathVariable is a variable that references path information about the
@@ -44,6 +63,7 @@ type ModuleVariable struct {
 type PathVariable struct {
         Type PathValueType
         key  string
+        varRange
 }
 
 type PathValueType byte
@@ -67,6 +87,7 @@ type ResourceVariable struct {
         Index int  // Index for multi-variable: aws_instance.foo.1.id == 1
 
         key string
+        varRange
 }
 
 // SelfVariable is a variable that is referencing the same resource
@@ -75,6 +96,7 @@ type SelfVariable struct {
         Field string
 
         key string
+        varRange
 }
 
 // SimpleVariable is an unprefixed variable, which can show up when users have
@@ -82,6 +104,7 @@ type SelfVariable struct {
 // internally. The template_file resource is an example of this.
 type SimpleVariable struct {
         Key string
+        varRange
 }
 
 // TerraformVariable is a "terraform."-prefixed variable used to access
@@ -89,6 +112,7 @@ type SimpleVariable struct {
 type TerraformVariable struct {
         Field string
         key   string
+        varRange
 }
 
 // A UserVariable is a variable that is referencing a user variable
@@ -99,6 +123,14 @@ type UserVariable struct {
         Elem string
 
         key string
+        varRange
+}
+
+// A LocalVariable is a variable that references a local value defined within
+// the current module, via a "locals" block. This looks like "${local.foo}".
+type LocalVariable struct {
+        Name string
+        varRange
 }
 
 func NewInterpolatedVariable(v string) (InterpolatedVariable, error) {
@@ -112,6 +144,8 @@ func NewInterpolatedVariable(v string) (InterpolatedVariable, error) {
                 return NewTerraformVariable(v)
         } else if strings.HasPrefix(v, "var.") {
                 return NewUserVariable(v)
+        } else if strings.HasPrefix(v, "local.") {
+                return NewLocalVariable(v)
         } else if strings.HasPrefix(v, "module.") {
                 return NewModuleVariable(v)
         } else if !strings.ContainsRune(v, '.') {
@@ -276,7 +310,7 @@ func (v *SelfVariable) GoString() string {
 }
 
 func NewSimpleVariable(key string) (*SimpleVariable, error) {
-        return &SimpleVariable{key}, nil
+        return &SimpleVariable{Key: key}, nil
 }
 
 func (v *SimpleVariable) FullKey() string {
@@ -331,6 +365,25 @@ func (v *UserVariable) GoString() string {
         return fmt.Sprintf("*%#v", *v)
 }
 
+func NewLocalVariable(key string) (*LocalVariable, error) {
+        name := key[len("local."):]
+        if idx := strings.Index(name, "."); idx > -1 {
+                return nil, fmt.Errorf("Can't use dot (.) attribute access in local.%s; use square bracket indexing", name)
+        }
+
+        return &LocalVariable{
+                Name: name,
+        }, nil
+}
+
+func (v *LocalVariable) FullKey() string {
+        return fmt.Sprintf("local.%s", v.Name)
+}
+
+func (v *LocalVariable) GoString() string {
+        return fmt.Sprintf("*%#v", *v)
+}
+
 // DetectVariables takes an AST root and returns all the interpolated
 // variables that are detected in the AST tree.
 func DetectVariables(root ast.Node) ([]InterpolatedVariable, error) {
diff --git a/vendor/github.com/hashicorp/terraform/config/interpolate_funcs.go b/vendor/github.com/hashicorp/terraform/config/interpolate_funcs.go
index a298cf2..421edb0 100644
--- a/vendor/github.com/hashicorp/terraform/config/interpolate_funcs.go
+++ b/vendor/github.com/hashicorp/terraform/config/interpolate_funcs.go
@@ -1,17 +1,23 @@
 package config
 
 import (
+        "bytes"
+        "compress/gzip"
         "crypto/md5"
+        "crypto/rsa"
         "crypto/sha1"
         "crypto/sha256"
         "crypto/sha512"
+        "crypto/x509"
         "encoding/base64"
         "encoding/hex"
         "encoding/json"
+        "encoding/pem"
         "fmt"
         "io/ioutil"
         "math"
         "net"
+        "net/url"
         "path/filepath"
         "regexp"
         "sort"
@@ -55,59 +61,74 @@ func listVariableValueToStringSlice(values []ast.Variable) ([]string, error) {
 // Funcs is the mapping of built-in functions for configuration.
 func Funcs() map[string]ast.Function {
         return map[string]ast.Function{
-                "basename":     interpolationFuncBasename(),
-                "base64decode": interpolationFuncBase64Decode(),
-                "base64encode": interpolationFuncBase64Encode(),
-                "base64sha256": interpolationFuncBase64Sha256(),
-                "base64sha512": interpolationFuncBase64Sha512(),
-                "bcrypt":       interpolationFuncBcrypt(),
-                "ceil":         interpolationFuncCeil(),
-                "chomp":        interpolationFuncChomp(),
-                "cidrhost":     interpolationFuncCidrHost(),
-                "cidrnetmask":  interpolationFuncCidrNetmask(),
-                "cidrsubnet":   interpolationFuncCidrSubnet(),
-                "coalesce":     interpolationFuncCoalesce(),
-                "coalescelist": interpolationFuncCoalesceList(),
-                "compact":      interpolationFuncCompact(),
-                "concat":       interpolationFuncConcat(),
-                "contains":     interpolationFuncContains(),
-                "dirname":      interpolationFuncDirname(),
-                "distinct":     interpolationFuncDistinct(),
-                "element":      interpolationFuncElement(),
-                "file":         interpolationFuncFile(),
-                "matchkeys":    interpolationFuncMatchKeys(),
-                "floor":        interpolationFuncFloor(),
-                "format":       interpolationFuncFormat(),
-                "formatlist":   interpolationFuncFormatList(),
-                "index":        interpolationFuncIndex(),
-                "join":         interpolationFuncJoin(),
-                "jsonencode":   interpolationFuncJSONEncode(),
-                "length":       interpolationFuncLength(),
-                "list":         interpolationFuncList(),
-                "log":          interpolationFuncLog(),
-                "lower":        interpolationFuncLower(),
-                "map":          interpolationFuncMap(),
-                "max":          interpolationFuncMax(),
-                "md5":          interpolationFuncMd5(),
-                "merge":        interpolationFuncMerge(),
-                "min":          interpolationFuncMin(),
-                "pathexpand":   interpolationFuncPathExpand(),
-                "pow":          interpolationFuncPow(),
-                "uuid":         interpolationFuncUUID(),
-                "replace":      interpolationFuncReplace(),
-                "sha1":         interpolationFuncSha1(),
-                "sha256":       interpolationFuncSha256(),
-                "sha512":       interpolationFuncSha512(),
-                "signum":       interpolationFuncSignum(),
-                "slice":        interpolationFuncSlice(),
-                "sort":         interpolationFuncSort(),
-                "split":        interpolationFuncSplit(),
-                "substr":       interpolationFuncSubstr(),
-                "timestamp":    interpolationFuncTimestamp(),
-                "title":        interpolationFuncTitle(),
-                "trimspace":    interpolationFuncTrimSpace(),
-                "upper":        interpolationFuncUpper(),
-                "zipmap":       interpolationFuncZipMap(),
+                "abs":              interpolationFuncAbs(),
+                "basename":         interpolationFuncBasename(),
+                "base64decode":     interpolationFuncBase64Decode(),
+                "base64encode":     interpolationFuncBase64Encode(),
+                "base64gzip":       interpolationFuncBase64Gzip(),
+                "base64sha256":     interpolationFuncBase64Sha256(),
+                "base64sha512":     interpolationFuncBase64Sha512(),
+                "bcrypt":           interpolationFuncBcrypt(),
+                "ceil":             interpolationFuncCeil(),
+                "chomp":            interpolationFuncChomp(),
+                "cidrhost":         interpolationFuncCidrHost(),
+                "cidrnetmask":      interpolationFuncCidrNetmask(),
+                "cidrsubnet":       interpolationFuncCidrSubnet(),
+                "coalesce":         interpolationFuncCoalesce(),
+                "coalescelist":     interpolationFuncCoalesceList(),
+                "compact":          interpolationFuncCompact(),
+                "concat":           interpolationFuncConcat(),
+                "contains":         interpolationFuncContains(),
+                "dirname":          interpolationFuncDirname(),
+                "distinct":         interpolationFuncDistinct(),
+                "element":          interpolationFuncElement(),
+                "chunklist":        interpolationFuncChunklist(),
+                "file":             interpolationFuncFile(),
+                "filebase64sha256": interpolationFuncMakeFileHash(interpolationFuncBase64Sha256()),
+                "filebase64sha512": interpolationFuncMakeFileHash(interpolationFuncBase64Sha512()),
+                "filemd5":          interpolationFuncMakeFileHash(interpolationFuncMd5()),
+                "filesha1":         interpolationFuncMakeFileHash(interpolationFuncSha1()),
+                "filesha256":       interpolationFuncMakeFileHash(interpolationFuncSha256()),
+                "filesha512":       interpolationFuncMakeFileHash(interpolationFuncSha512()),
+                "matchkeys":        interpolationFuncMatchKeys(),
+                "flatten":          interpolationFuncFlatten(),
+                "floor":            interpolationFuncFloor(),
+                "format":           interpolationFuncFormat(),
+                "formatlist":       interpolationFuncFormatList(),
+                "indent":           interpolationFuncIndent(),
+                "index":            interpolationFuncIndex(),
+                "join":             interpolationFuncJoin(),
+                "jsonencode":       interpolationFuncJSONEncode(),
+                "length":           interpolationFuncLength(),
+                "list":             interpolationFuncList(),
+                "log":              interpolationFuncLog(),
+                "lower":            interpolationFuncLower(),
+                "map":              interpolationFuncMap(),
+                "max":              interpolationFuncMax(),
+                "md5":              interpolationFuncMd5(),
+                "merge":            interpolationFuncMerge(),
+                "min":              interpolationFuncMin(),
+                "pathexpand":       interpolationFuncPathExpand(),
+                "pow":              interpolationFuncPow(),
+                "uuid":             interpolationFuncUUID(),
+                "replace":          interpolationFuncReplace(),
+                "rsadecrypt":       interpolationFuncRsaDecrypt(),
+                "sha1":             interpolationFuncSha1(),
+                "sha256":           interpolationFuncSha256(),
+                "sha512":           interpolationFuncSha512(),
+                "signum":           interpolationFuncSignum(),
+                "slice":            interpolationFuncSlice(),
+                "sort":             interpolationFuncSort(),
+                "split":            interpolationFuncSplit(),
+                "substr":           interpolationFuncSubstr(),
+                "timestamp":        interpolationFuncTimestamp(),
+                "timeadd":          interpolationFuncTimeAdd(),
+                "title":            interpolationFuncTitle(),
+                "transpose":        interpolationFuncTranspose(),
+                "trimspace":        interpolationFuncTrimSpace(),
+                "upper":            interpolationFuncUpper(),
+                "urlencode":        interpolationFuncURLEncode(),
+                "zipmap":           interpolationFuncZipMap(),
         }
 }
 
@@ -669,6 +690,21 @@ func interpolationFuncFormatList() ast.Function {
         }
 }
 
+// interpolationFuncIndent indents a multi-line string with the
+// specified number of spaces
+func interpolationFuncIndent() ast.Function {
+        return ast.Function{
+                ArgTypes:   []ast.Type{ast.TypeInt, ast.TypeString},
+                ReturnType: ast.TypeString,
+                Callback: func(args []interface{}) (interface{}, error) {
+                        spaces := args[0].(int)
+                        data := args[1].(string)
+                        pad := strings.Repeat(" ", spaces)
+                        return strings.Replace(data, "\n", "\n"+pad, -1), nil
+                },
+        }
+}
+
 // interpolationFuncIndex implements the "index" function that allows one to
 // find the index of a specific element in a list
 func interpolationFuncIndex() ast.Function {
@@ -823,8 +859,7 @@ func interpolationFuncJoin() ast.Function {
 }
 
 // interpolationFuncJSONEncode implements the "jsonencode" function that encodes
-// a string, list, or map as its JSON representation. For now, values in the
-// list or map may only be strings.
+// a string, list, or map as its JSON representation.
 func interpolationFuncJSONEncode() ast.Function {
         return ast.Function{
                 ArgTypes:   []ast.Type{ast.TypeAny},
@@ -837,28 +872,36 @@ func interpolationFuncJSONEncode() ast.Function {
                                 toEncode = typedArg
 
                         case []ast.Variable:
-                                // We preallocate the list here. Note that it's important that in
-                                // the length 0 case, we have an empty list rather than nil, as
-                                // they encode differently.
-                                // XXX It would be nice to support arbitrarily nested data here. Is
-                                // there an inverse of hil.InterfaceToVariable?
                                 strings := make([]string, len(typedArg))
 
                                 for i, v := range typedArg {
                                         if v.Type != ast.TypeString {
-                                                return "", fmt.Errorf("list elements must be strings")
+                                                variable, _ := hil.InterfaceToVariable(typedArg)
+                                                toEncode, _ = hil.VariableToInterface(variable)
+
+                                                jEnc, err := json.Marshal(toEncode)
+                                                if err != nil {
+                                                        return "", fmt.Errorf("failed to encode JSON data '%s'", toEncode)
+                                                }
+                                                return string(jEnc), nil
+
                                         }
                                         strings[i] = v.Value.(string)
                                 }
                                 toEncode = strings
 
                         case map[string]ast.Variable:
-                                // XXX It would be nice to support arbitrarily nested data here. Is
-                                // there an inverse of hil.InterfaceToVariable?
                                 stringMap := make(map[string]string)
                                 for k, v := range typedArg {
                                         if v.Type != ast.TypeString {
-                                                return "", fmt.Errorf("map values must be strings")
+                                                variable, _ := hil.InterfaceToVariable(typedArg)
+                                                toEncode, _ = hil.VariableToInterface(variable)
+
+                                                jEnc, err := json.Marshal(toEncode)
+                                                if err != nil {
+                                                        return "", fmt.Errorf("failed to encode JSON data '%s'", toEncode)
+                                                }
+                                                return string(jEnc), nil
                                         }
                                         stringMap[k] = v.Value.(string)
                                 }
@@ -1098,6 +1141,56 @@ func interpolationFuncElement() ast.Function {
         }
 }
 
+// returns the `list` items chunked by `size`.
+func interpolationFuncChunklist() ast.Function {
+        return ast.Function{
+                ArgTypes: []ast.Type{
+                        ast.TypeList, // inputList
+                        ast.TypeInt,  // size
+                },
+                ReturnType: ast.TypeList,
+                Callback: func(args []interface{}) (interface{}, error) {
+                        output := make([]ast.Variable, 0)
+
+                        values, _ := args[0].([]ast.Variable)
+                        size, _ := args[1].(int)
+
+                        // errors if size is negative
+                        if size < 0 {
+                                return nil, fmt.Errorf("The size argument must be positive")
+                        }
+
+                        // if size is 0, returns a list made of the initial list
+                        if size == 0 {
+                                output = append(output, ast.Variable{
+                                        Type:  ast.TypeList,
+                                        Value: values,
+                                })
+                                return output, nil
+                        }
+
+                        variables := make([]ast.Variable, 0)
+                        chunk := ast.Variable{
+                                Type:  ast.TypeList,
+                                Value: variables,
+                        }
+                        l := len(values)
+                        for i, v := range values {
+                                variables = append(variables, v)
+
+                                // Chunk when index isn't 0, or when reaching the values's length
+                                if (i+1)%size == 0 || (i+1) == l {
+                                        chunk.Value = variables
+                                        output = append(output, chunk)
+                                        variables = make([]ast.Variable, 0)
+                                }
+                        }
+
+                        return output, nil
+                },
+        }
+}
+
 // interpolationFuncKeys implements the "keys" function that yields a list of
 // keys of map types within a Terraform configuration.
 func interpolationFuncKeys(vs map[string]ast.Variable) ast.Function {
@@ -1197,6 +1290,32 @@ func interpolationFuncBase64Decode() ast.Function {
         }
 }
 
+// interpolationFuncBase64Gzip implements the "gzip" function that allows gzip
+// compression encoding the result using base64
+func interpolationFuncBase64Gzip() ast.Function {
+        return ast.Function{
+                ArgTypes:   []ast.Type{ast.TypeString},
+                ReturnType: ast.TypeString,
+                Callback: func(args []interface{}) (interface{}, error) {
+                        s := args[0].(string)
+
+                        var b bytes.Buffer
+                        gz := gzip.NewWriter(&b)
+                        if _, err := gz.Write([]byte(s)); err != nil {
+                                return "", fmt.Errorf("failed to write gzip raw data: '%s'", s)
+                        }
+                        if err := gz.Flush(); err != nil {
+                                return "", fmt.Errorf("failed to flush gzip writer: '%s'", s)
+                        }
+                        if err := gz.Close(); err != nil {
+                                return "", fmt.Errorf("failed to close gzip writer: '%s'", s)
+                        }
+
+                        return base64.StdEncoding.EncodeToString(b.Bytes()), nil
+                },
+        }
+}
+
 // interpolationFuncLower implements the "lower" function that does
 // string lower casing.
 func interpolationFuncLower() ast.Function {
@@ -1396,6 +1515,29 @@ func interpolationFuncTimestamp() ast.Function {
         }
 }
 
+func interpolationFuncTimeAdd() ast.Function {
+        return ast.Function{
+                ArgTypes: []ast.Type{
+                        ast.TypeString, // input timestamp string in RFC3339 format
+                        ast.TypeString, // duration to add to input timestamp that should be parsable by time.ParseDuration
+                },
+                ReturnType: ast.TypeString,
+                Callback: func(args []interface{}) (interface{}, error) {
+
+                        ts, err := time.Parse(time.RFC3339, args[0].(string))
+                        if err != nil {
+                                return nil, err
+                        }
+                        duration, err := time.ParseDuration(args[1].(string))
+                        if err != nil {
+                                return nil, err
+                        }
+
+                        return ts.Add(duration).Format(time.RFC3339), nil
+                },
+        }
+}
+
 // interpolationFuncTitle implements the "title" function that returns a copy of the
 // string in which first characters of all the words are capitalized.
 func interpolationFuncTitle() ast.Function {
@@ -1441,7 +1583,7 @@ func interpolationFuncSubstr() ast.Function {
                                 return nil, fmt.Errorf("length should be a non-negative integer")
                         }
 
-                        if offset > len(str) {
+                        if offset > len(str) || offset < 0 {
                                 return nil, fmt.Errorf("offset cannot be larger than the length of the string")
                         }
 
@@ -1453,3 +1595,160 @@ func interpolationFuncSubstr() ast.Function {
                 },
         }
 }
+
+// Flatten until it's not ast.TypeList
+func flattener(finalList []ast.Variable, flattenList []ast.Variable) []ast.Variable {
+        for _, val := range flattenList {
+                if val.Type == ast.TypeList {
+                        finalList = flattener(finalList, val.Value.([]ast.Variable))
+                } else {
+                        finalList = append(finalList, val)
+                }
+        }
+        return finalList
+}
+
+// Flatten to single list
+func interpolationFuncFlatten() ast.Function {
+        return ast.Function{
+                ArgTypes:   []ast.Type{ast.TypeList},
+                ReturnType: ast.TypeList,
+                Variadic:   false,
+                Callback: func(args []interface{}) (interface{}, error) {
+                        inputList := args[0].([]ast.Variable)
+
+                        var outputList []ast.Variable
+                        return flattener(outputList, inputList), nil
+                },
+        }
+}
+
+func interpolationFuncURLEncode() ast.Function {
+        return ast.Function{
+                ArgTypes:   []ast.Type{ast.TypeString},
+                ReturnType: ast.TypeString,
+                Callback: func(args []interface{}) (interface{}, error) {
+                        s := args[0].(string)
+                        return url.QueryEscape(s), nil
+                },
+        }
+}
+
+// interpolationFuncTranspose implements the "transpose" function
+// that converts a map (string,list) to a map (string,list) where
+// the unique values of the original lists become the keys of the
+// new map and the keys of the original map become values for the
+// corresponding new keys.
+func interpolationFuncTranspose() ast.Function {
+        return ast.Function{
+                ArgTypes:   []ast.Type{ast.TypeMap},
+                ReturnType: ast.TypeMap,
+                Callback: func(args []interface{}) (interface{}, error) {
+
+                        inputMap := args[0].(map[string]ast.Variable)
+                        outputMap := make(map[string]ast.Variable)
+                        tmpMap := make(map[string][]string)
+
+                        for inKey, inVal := range inputMap {
+                                if inVal.Type != ast.TypeList {
+                                        return nil, fmt.Errorf("transpose requires a map of lists of strings")
+                                }
+                                values := inVal.Value.([]ast.Variable)
+                                for _, listVal := range values {
+                                        if listVal.Type != ast.TypeString {
+                                                return nil, fmt.Errorf("transpose requires the given map values to be lists of strings")
+                                        }
+                                        outKey := listVal.Value.(string)
+                                        if _, ok := tmpMap[outKey]; !ok {
+                                                tmpMap[outKey] = make([]string, 0)
+                                        }
+                                        outVal := tmpMap[outKey]
+                                        outVal = append(outVal, inKey)
+                                        sort.Strings(outVal)
+                                        tmpMap[outKey] = outVal
+                                }
+                        }
+
+                        for outKey, outVal := range tmpMap {
+                                values := make([]ast.Variable, 0)
+                                for _, v := range outVal {
+                                        values = append(values, ast.Variable{Type: ast.TypeString, Value: v})
+                                }
+                                outputMap[outKey] = ast.Variable{Type: ast.TypeList, Value: values}
+                        }
+                        return outputMap, nil
+                },
+        }
+}
+
+// interpolationFuncAbs returns the absolute value of a given float.
+func interpolationFuncAbs() ast.Function {
+        return ast.Function{
+                ArgTypes:   []ast.Type{ast.TypeFloat},
+                ReturnType: ast.TypeFloat,
+                Callback: func(args []interface{}) (interface{}, error) {
+                        return math.Abs(args[0].(float64)), nil
+                },
+        }
+}
+
+// interpolationFuncRsaDecrypt implements the "rsadecrypt" function that does
+// RSA decryption.
+func interpolationFuncRsaDecrypt() ast.Function {
+        return ast.Function{
+                ArgTypes:   []ast.Type{ast.TypeString, ast.TypeString},
+                ReturnType: ast.TypeString,
+                Callback: func(args []interface{}) (interface{}, error) {
+                        s := args[0].(string)
+                        key := args[1].(string)
+
+                        b, err := base64.StdEncoding.DecodeString(s)
+                        if err != nil {
+                                return "", fmt.Errorf("Failed to decode input %q: cipher text must be base64-encoded", s)
+                        }
+
+                        block, _ := pem.Decode([]byte(key))
+                        if block == nil {
+                                return "", fmt.Errorf("Failed to read key %q: no key found", key)
+                        }
+                        if block.Headers["Proc-Type"] == "4,ENCRYPTED" {
+                                return "", fmt.Errorf(
+                                        "Failed to read key %q: password protected keys are\n"+
+                                                "not supported. Please decrypt the key prior to use.", key)
+                        }
+
+                        x509Key, err := x509.ParsePKCS1PrivateKey(block.Bytes)
+                        if err != nil {
+                                return "", err
+                        }
+
+                        out, err := rsa.DecryptPKCS1v15(nil, x509Key, b)
+                        if err != nil {
+                                return "", err
+                        }
+
+                        return string(out), nil
+                },
+        }
+}
+
+// interpolationFuncMakeFileHash constructs a function that hashes the contents
+// of a file by combining the implementations of the file(...) function and
+// a given other function that is assumed to take a single string argument and
+// return a hash value.
+func interpolationFuncMakeFileHash(hashFunc ast.Function) ast.Function {
+        fileFunc := interpolationFuncFile()
+
+        return ast.Function{
+                ArgTypes:   []ast.Type{ast.TypeString},
+                ReturnType: ast.TypeString,
+                Callback: func(args []interface{}) (interface{}, error) {
+                        filename := args[0].(string)
+                        contents, err := fileFunc.Callback([]interface{}{filename})
+                        if err != nil {
+                                return nil, err
+                        }
+                        return hashFunc.Callback([]interface{}{contents})
+                },
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/config/interpolate_walk.go b/vendor/github.com/hashicorp/terraform/config/interpolate_walk.go
index ead3d10..66a677d 100644
--- a/vendor/github.com/hashicorp/terraform/config/interpolate_walk.go
+++ b/vendor/github.com/hashicorp/terraform/config/interpolate_walk.go
@@ -271,9 +271,7 @@ func (w *interpolationWalker) splitSlice() {
                                 result = append(result, val.Value)
                         }
                 case []interface{}:
-                        for _, element := range val {
-                                result = append(result, element)
-                        }
+                        result = append(result, val...)
                 default:
                         result = append(result, v)
                 }
diff --git a/vendor/github.com/hashicorp/terraform/config/loader.go b/vendor/github.com/hashicorp/terraform/config/loader.go
index 5dd7d46..6e34781 100644
--- a/vendor/github.com/hashicorp/terraform/config/loader.go
+++ b/vendor/github.com/hashicorp/terraform/config/loader.go
@@ -80,7 +80,7 @@ func LoadDir(root string) (*Config, error) {
         if err != nil {
                 return nil, err
         }
-        if len(files) == 0 {
+        if len(files) == 0 && len(overrides) == 0 {
                 return nil, &ErrNoConfigsFound{Dir: root}
         }
 
@@ -112,6 +112,9 @@ func LoadDir(root string) (*Config, error) {
                         result = c
                 }
         }
+        if len(files) == 0 {
+                result = &Config{}
+        }
 
         // Load all the overrides, and merge them into the config
         for _, f := range overrides {
diff --git a/vendor/github.com/hashicorp/terraform/config/loader_hcl.go b/vendor/github.com/hashicorp/terraform/config/loader_hcl.go
index e85e493..68cffe2 100644
--- a/vendor/github.com/hashicorp/terraform/config/loader_hcl.go
+++ b/vendor/github.com/hashicorp/terraform/config/loader_hcl.go
@@ -17,10 +17,20 @@ type hclConfigurable struct {
         Root *ast.File
 }
 
+var ReservedDataSourceFields = []string{
+        "connection",
+        "count",
+        "depends_on",
+        "lifecycle",
+        "provider",
+        "provisioner",
+}
+
 var ReservedResourceFields = []string{
         "connection",
         "count",
         "depends_on",
+        "id",
         "lifecycle",
         "provider",
         "provisioner",
@@ -35,6 +45,7 @@ func (t *hclConfigurable) Config() (*Config, error) {
         validKeys := map[string]struct{}{
                 "atlas":     struct{}{},
                 "data":      struct{}{},
+                "locals":    struct{}{},
                 "module":    struct{}{},
                 "output":    struct{}{},
                 "provider":  struct{}{},
@@ -70,6 +81,15 @@ func (t *hclConfigurable) Config() (*Config, error) {
                 }
         }
 
+        // Build local values
+        if locals := list.Filter("locals"); len(locals.Items) > 0 {
+                var err error
+                config.Locals, err = loadLocalsHcl(locals)
+                if err != nil {
+                        return nil, err
+                }
+        }
+
         // Get Atlas configuration
         if atlas := list.Filter("atlas"); len(atlas.Items) > 0 {
                 var err error
@@ -373,9 +393,6 @@ func loadModulesHcl(list *ast.ObjectList) ([]*Module, error) {
                                 err)
                 }
 
-                // Remove the fields we handle specially
-                delete(config, "source")
-
                 rawConfig, err := NewRawConfig(config)
                 if err != nil {
                         return nil, fmt.Errorf(
@@ -384,7 +401,11 @@ func loadModulesHcl(list *ast.ObjectList) ([]*Module, error) {
                                 err)
                 }
 
-                // If we have a count, then figure it out
+                // Remove the fields we handle specially
+                delete(config, "source")
+                delete(config, "version")
+                delete(config, "providers")
+
                 var source string
                 if o := listVal.Filter("source"); len(o.Items) > 0 {
                         err = hcl.DecodeObject(&source, o.Items[0].Val)
@@ -396,9 +417,33 @@ func loadModulesHcl(list *ast.ObjectList) ([]*Module, error) {
                         }
                 }
 
+                var version string
+                if o := listVal.Filter("version"); len(o.Items) > 0 {
+                        err = hcl.DecodeObject(&version, o.Items[0].Val)
+                        if err != nil {
+                                return nil, fmt.Errorf(
+                                        "Error parsing version for %s: %s",
+                                        k,
+                                        err)
+                        }
+                }
+
+                var providers map[string]string
+                if o := listVal.Filter("providers"); len(o.Items) > 0 {
+                        err = hcl.DecodeObject(&providers, o.Items[0].Val)
+                        if err != nil {
+                                return nil, fmt.Errorf(
+                                        "Error parsing providers for %s: %s",
+                                        k,
+                                        err)
+                        }
+                }
+
                 result = append(result, &Module{
                         Name:      k,
                         Source:    source,
+                        Version:   version,
+                        Providers: providers,
                         RawConfig: rawConfig,
                 })
         }
@@ -406,6 +451,59 @@ func loadModulesHcl(list *ast.ObjectList) ([]*Module, error) {
         return result, nil
 }
 
+// loadLocalsHcl recurses into the given HCL object turns it into
+// a list of locals.
+func loadLocalsHcl(list *ast.ObjectList) ([]*Local, error) {
+
+        result := make([]*Local, 0, len(list.Items))
+
+        for _, block := range list.Items {
+                if len(block.Keys) > 0 {
+                        return nil, fmt.Errorf(
+                                "locals block at %s should not have label %q",
+                                block.Pos(), block.Keys[0].Token.Value(),
+                        )
+                }
+
+                blockObj, ok := block.Val.(*ast.ObjectType)
+                if !ok {
+                        return nil, fmt.Errorf("locals value at %s should be a block", block.Val.Pos())
+                }
+
+                // blockObj now contains directly our local decls
+                for _, item := range blockObj.List.Items {
+                        if len(item.Keys) != 1 {
+                                return nil, fmt.Errorf("local declaration at %s may not be a block", item.Val.Pos())
+                        }
+
+                        // By the time we get here there can only be one item left, but
+                        // we'll decode into a map anyway because it's a convenient way
+                        // to extract both the key and the value robustly.
+                        kv := map[string]interface{}{}
+                        hcl.DecodeObject(&kv, item)
+                        for k, v := range kv {
+                                rawConfig, err := NewRawConfig(map[string]interface{}{
+                                        "value": v,
+                                })
+
+                                if err != nil {
+                                        return nil, fmt.Errorf(
+                                                "error parsing local value %q at %s: %s",
+                                                k, item.Val.Pos(), err,
+                                        )
+                                }
+
+                                result = append(result, &Local{
+                                        Name:      k,
+                                        RawConfig: rawConfig,
+                                })
+                        }
+                }
+        }
+
+        return result, nil
+}
+
 // LoadOutputsHcl recurses into the given HCL object and turns
 // it into a mapping of outputs.
 func loadOutputsHcl(list *ast.ObjectList) ([]*Output, error) {
@@ -434,6 +532,7 @@ func loadOutputsHcl(list *ast.ObjectList) ([]*Output, error) {
 
                 // Delete special keys
                 delete(config, "depends_on")
+                delete(config, "description")
 
                 rawConfig, err := NewRawConfig(config)
                 if err != nil {
@@ -455,10 +554,23 @@ func loadOutputsHcl(list *ast.ObjectList) ([]*Output, error) {
                         }
                 }
 
+                // If we have a description field, then filter that
+                var description string
+                if o := listVal.Filter("description"); len(o.Items) > 0 {
+                        err := hcl.DecodeObject(&description, o.Items[0].Val)
+                        if err != nil {
+                                return nil, fmt.Errorf(
+                                        "Error reading description for output %q: %s",
+                                        n,
+                                        err)
+                        }
+                }
+
                 result = append(result, &Output{
-                        Name:      n,
-                        RawConfig: rawConfig,
-                        DependsOn: dependsOn,
+                        Name:        n,
+                        RawConfig:   rawConfig,
+                        DependsOn:   dependsOn,
+                        Description: description,
                 })
         }
 
diff --git a/vendor/github.com/hashicorp/terraform/config/loader_hcl2.go b/vendor/github.com/hashicorp/terraform/config/loader_hcl2.go
new file mode 100644
index 0000000..4f9f129
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/config/loader_hcl2.go
@@ -0,0 +1,473 @@
+package config
+
+import (
+        "fmt"
+        "sort"
+        "strings"
+
+        gohcl2 "github.com/hashicorp/hcl2/gohcl"
+        hcl2 "github.com/hashicorp/hcl2/hcl"
+        hcl2parse "github.com/hashicorp/hcl2/hclparse"
+        "github.com/hashicorp/terraform/config/hcl2shim"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// hcl2Configurable is an implementation of configurable that knows
+// how to turn a HCL Body into a *Config object.
+type hcl2Configurable struct {
+        SourceFilename string
+        Body           hcl2.Body
+}
+
+// hcl2Loader is a wrapper around a HCL parser that provides a fileLoaderFunc.
+type hcl2Loader struct {
+        Parser *hcl2parse.Parser
+}
+
+// For the moment we'll just have a global loader since we don't have anywhere
+// better to stash this.
+// TODO: refactor the loader API so that it uses some sort of object we can
+// stash the parser inside.
+var globalHCL2Loader = newHCL2Loader()
+
+// newHCL2Loader creates a new hcl2Loader containing a new HCL Parser.
+//
+// HCL parsers retain information about files that are loaded to aid in
+// producing diagnostic messages, so all files within a single configuration
+// should be loaded with the same parser to ensure the availability of
+// full diagnostic information.
+func newHCL2Loader() hcl2Loader {
+        return hcl2Loader{
+                Parser: hcl2parse.NewParser(),
+        }
+}
+
+// loadFile is a fileLoaderFunc that knows how to read a HCL2 file and turn it
+// into a hcl2Configurable.
+func (l hcl2Loader) loadFile(filename string) (configurable, []string, error) {
+        var f *hcl2.File
+        var diags hcl2.Diagnostics
+        if strings.HasSuffix(filename, ".json") {
+                f, diags = l.Parser.ParseJSONFile(filename)
+        } else {
+                f, diags = l.Parser.ParseHCLFile(filename)
+        }
+        if diags.HasErrors() {
+                // Return diagnostics as an error; callers may type-assert this to
+                // recover the original diagnostics, if it doesn't end up wrapped
+                // in another error.
+                return nil, nil, diags
+        }
+
+        return &hcl2Configurable{
+                SourceFilename: filename,
+                Body:           f.Body,
+        }, nil, nil
+}
+
+func (t *hcl2Configurable) Config() (*Config, error) {
+        config := &Config{}
+
+        // these structs are used only for the initial shallow decoding; we'll
+        // expand this into the main, public-facing config structs afterwards.
+        type atlas struct {
+                Name    string    `hcl:"name"`
+                Include *[]string `hcl:"include"`
+                Exclude *[]string `hcl:"exclude"`
+        }
+        type provider struct {
+                Name    string    `hcl:"name,label"`
+                Alias   *string   `hcl:"alias,attr"`
+                Version *string   `hcl:"version,attr"`
+                Config  hcl2.Body `hcl:",remain"`
+        }
+        type module struct {
+                Name      string             `hcl:"name,label"`
+                Source    string             `hcl:"source,attr"`
+                Version   *string            `hcl:"version,attr"`
+                Providers *map[string]string `hcl:"providers,attr"`
+                Config    hcl2.Body          `hcl:",remain"`
+        }
+        type resourceLifecycle struct {
+                CreateBeforeDestroy *bool     `hcl:"create_before_destroy,attr"`
+                PreventDestroy      *bool     `hcl:"prevent_destroy,attr"`
+                IgnoreChanges       *[]string `hcl:"ignore_changes,attr"`
+        }
+        type connection struct {
+                Config hcl2.Body `hcl:",remain"`
+        }
+        type provisioner struct {
+                Type string `hcl:"type,label"`
+
+                When      *string `hcl:"when,attr"`
+                OnFailure *string `hcl:"on_failure,attr"`
+
+                Connection *connection `hcl:"connection,block"`
+                Config     hcl2.Body   `hcl:",remain"`
+        }
+        type managedResource struct {
+                Type string `hcl:"type,label"`
+                Name string `hcl:"name,label"`
+
+                CountExpr hcl2.Expression `hcl:"count,attr"`
+                Provider  *string         `hcl:"provider,attr"`
+                DependsOn *[]string       `hcl:"depends_on,attr"`
+
+                Lifecycle    *resourceLifecycle `hcl:"lifecycle,block"`
+                Provisioners []provisioner      `hcl:"provisioner,block"`
+                Connection   *connection        `hcl:"connection,block"`
+
+                Config hcl2.Body `hcl:",remain"`
+        }
+        type dataResource struct {
+                Type string `hcl:"type,label"`
+                Name string `hcl:"name,label"`
+
+                CountExpr hcl2.Expression `hcl:"count,attr"`
+                Provider  *string         `hcl:"provider,attr"`
+                DependsOn *[]string       `hcl:"depends_on,attr"`
+
+                Config hcl2.Body `hcl:",remain"`
+        }
+        type variable struct {
+                Name string `hcl:"name,label"`
+
+                DeclaredType *string    `hcl:"type,attr"`
+                Default      *cty.Value `hcl:"default,attr"`
+                Description  *string    `hcl:"description,attr"`
+                Sensitive    *bool      `hcl:"sensitive,attr"`
+        }
+        type output struct {
+                Name string `hcl:"name,label"`
+
+                ValueExpr   hcl2.Expression `hcl:"value,attr"`
+                DependsOn   *[]string       `hcl:"depends_on,attr"`
+                Description *string         `hcl:"description,attr"`
+                Sensitive   *bool           `hcl:"sensitive,attr"`
+        }
+        type locals struct {
+                Definitions hcl2.Attributes `hcl:",remain"`
+        }
+        type backend struct {
+                Type   string    `hcl:"type,label"`
+                Config hcl2.Body `hcl:",remain"`
+        }
+        type terraform struct {
+                RequiredVersion *string  `hcl:"required_version,attr"`
+                Backend         *backend `hcl:"backend,block"`
+        }
+        type topLevel struct {
+                Atlas     *atlas            `hcl:"atlas,block"`
+                Datas     []dataResource    `hcl:"data,block"`
+                Modules   []module          `hcl:"module,block"`
+                Outputs   []output          `hcl:"output,block"`
+                Providers []provider        `hcl:"provider,block"`
+                Resources []managedResource `hcl:"resource,block"`
+                Terraform *terraform        `hcl:"terraform,block"`
+                Variables []variable        `hcl:"variable,block"`
+                Locals    []*locals         `hcl:"locals,block"`
+        }
+
+        var raw topLevel
+        diags := gohcl2.DecodeBody(t.Body, nil, &raw)
+        if diags.HasErrors() {
+                // Do some minimal decoding to see if we can at least get the
+                // required Terraform version, which might help explain why we
+                // couldn't parse the rest.
+                if raw.Terraform != nil && raw.Terraform.RequiredVersion != nil {
+                        config.Terraform = &Terraform{
+                                RequiredVersion: *raw.Terraform.RequiredVersion,
+                        }
+                }
+
+                // We return the diags as an implementation of error, which the
+                // caller than then type-assert if desired to recover the individual
+                // diagnostics.
+                // FIXME: The current API gives us no way to return warnings in the
+                // absense of any errors.
+                return config, diags
+        }
+
+        if raw.Terraform != nil {
+                var reqdVersion string
+                var backend *Backend
+
+                if raw.Terraform.RequiredVersion != nil {
+                        reqdVersion = *raw.Terraform.RequiredVersion
+                }
+                if raw.Terraform.Backend != nil {
+                        backend = new(Backend)
+                        backend.Type = raw.Terraform.Backend.Type
+
+                        // We don't permit interpolations or nested blocks inside the
+                        // backend config, so we can decode the config early here and
+                        // get direct access to the values, which is important for the
+                        // config hashing to work as expected.
+                        var config map[string]string
+                        configDiags := gohcl2.DecodeBody(raw.Terraform.Backend.Config, nil, &config)
+                        diags = append(diags, configDiags...)
+
+                        raw := make(map[string]interface{}, len(config))
+                        for k, v := range config {
+                                raw[k] = v
+                        }
+
+                        var err error
+                        backend.RawConfig, err = NewRawConfig(raw)
+                        if err != nil {
+                                diags = append(diags, &hcl2.Diagnostic{
+                                        Severity: hcl2.DiagError,
+                                        Summary:  "Invalid backend configuration",
+                                        Detail:   fmt.Sprintf("Error in backend configuration: %s", err),
+                                })
+                        }
+                }
+
+                config.Terraform = &Terraform{
+                        RequiredVersion: reqdVersion,
+                        Backend:         backend,
+                }
+        }
+
+        if raw.Atlas != nil {
+                var include, exclude []string
+                if raw.Atlas.Include != nil {
+                        include = *raw.Atlas.Include
+                }
+                if raw.Atlas.Exclude != nil {
+                        exclude = *raw.Atlas.Exclude
+                }
+                config.Atlas = &AtlasConfig{
+                        Name:    raw.Atlas.Name,
+                        Include: include,
+                        Exclude: exclude,
+                }
+        }
+
+        for _, rawM := range raw.Modules {
+                m := &Module{
+                        Name:      rawM.Name,
+                        Source:    rawM.Source,
+                        RawConfig: NewRawConfigHCL2(rawM.Config),
+                }
+
+                if rawM.Version != nil {
+                        m.Version = *rawM.Version
+                }
+
+                if rawM.Providers != nil {
+                        m.Providers = *rawM.Providers
+                }
+
+                config.Modules = append(config.Modules, m)
+        }
+
+        for _, rawV := range raw.Variables {
+                v := &Variable{
+                        Name: rawV.Name,
+                }
+                if rawV.DeclaredType != nil {
+                        v.DeclaredType = *rawV.DeclaredType
+                }
+                if rawV.Default != nil {
+                        v.Default = hcl2shim.ConfigValueFromHCL2(*rawV.Default)
+                }
+                if rawV.Description != nil {
+                        v.Description = *rawV.Description
+                }
+
+                config.Variables = append(config.Variables, v)
+        }
+
+        for _, rawO := range raw.Outputs {
+                o := &Output{
+                        Name: rawO.Name,
+                }
+
+                if rawO.Description != nil {
+                        o.Description = *rawO.Description
+                }
+                if rawO.DependsOn != nil {
+                        o.DependsOn = *rawO.DependsOn
+                }
+                if rawO.Sensitive != nil {
+                        o.Sensitive = *rawO.Sensitive
+                }
+
+                // The result is expected to be a map like map[string]interface{}{"value": something},
+                // so we'll fake that with our hcl2shim.SingleAttrBody shim.
+                o.RawConfig = NewRawConfigHCL2(hcl2shim.SingleAttrBody{
+                        Name: "value",
+                        Expr: rawO.ValueExpr,
+                })
+
+                config.Outputs = append(config.Outputs, o)
+        }
+
+        for _, rawR := range raw.Resources {
+                r := &Resource{
+                        Mode: ManagedResourceMode,
+                        Type: rawR.Type,
+                        Name: rawR.Name,
+                }
+                if rawR.Lifecycle != nil {
+                        var l ResourceLifecycle
+                        if rawR.Lifecycle.CreateBeforeDestroy != nil {
+                                l.CreateBeforeDestroy = *rawR.Lifecycle.CreateBeforeDestroy
+                        }
+                        if rawR.Lifecycle.PreventDestroy != nil {
+                                l.PreventDestroy = *rawR.Lifecycle.PreventDestroy
+                        }
+                        if rawR.Lifecycle.IgnoreChanges != nil {
+                                l.IgnoreChanges = *rawR.Lifecycle.IgnoreChanges
+                        }
+                        r.Lifecycle = l
+                }
+                if rawR.Provider != nil {
+                        r.Provider = *rawR.Provider
+                }
+                if rawR.DependsOn != nil {
+                        r.DependsOn = *rawR.DependsOn
+                }
+
+                var defaultConnInfo *RawConfig
+                if rawR.Connection != nil {
+                        defaultConnInfo = NewRawConfigHCL2(rawR.Connection.Config)
+                }
+
+                for _, rawP := range rawR.Provisioners {
+                        p := &Provisioner{
+                                Type: rawP.Type,
+                        }
+
+                        switch {
+                        case rawP.When == nil:
+                                p.When = ProvisionerWhenCreate
+                        case *rawP.When == "create":
+                                p.When = ProvisionerWhenCreate
+                        case *rawP.When == "destroy":
+                                p.When = ProvisionerWhenDestroy
+                        default:
+                                p.When = ProvisionerWhenInvalid
+                        }
+
+                        switch {
+                        case rawP.OnFailure == nil:
+                                p.OnFailure = ProvisionerOnFailureFail
+                        case *rawP.When == "fail":
+                                p.OnFailure = ProvisionerOnFailureFail
+                        case *rawP.When == "continue":
+                                p.OnFailure = ProvisionerOnFailureContinue
+                        default:
+                                p.OnFailure = ProvisionerOnFailureInvalid
+                        }
+
+                        if rawP.Connection != nil {
+                                p.ConnInfo = NewRawConfigHCL2(rawP.Connection.Config)
+                        } else {
+                                p.ConnInfo = defaultConnInfo
+                        }
+
+                        p.RawConfig = NewRawConfigHCL2(rawP.Config)
+
+                        r.Provisioners = append(r.Provisioners, p)
+                }
+
+                // The old loader records the count expression as a weird RawConfig with
+                // a single-element map inside. Since the rest of the world is assuming
+                // that, we'll mimic it here.
+                {
+                        countBody := hcl2shim.SingleAttrBody{
+                                Name: "count",
+                                Expr: rawR.CountExpr,
+                        }
+
+                        r.RawCount = NewRawConfigHCL2(countBody)
+                        r.RawCount.Key = "count"
+                }
+
+                r.RawConfig = NewRawConfigHCL2(rawR.Config)
+
+                config.Resources = append(config.Resources, r)
+
+        }
+
+        for _, rawR := range raw.Datas {
+                r := &Resource{
+                        Mode: DataResourceMode,
+                        Type: rawR.Type,
+                        Name: rawR.Name,
+                }
+
+                if rawR.Provider != nil {
+                        r.Provider = *rawR.Provider
+                }
+                if rawR.DependsOn != nil {
+                        r.DependsOn = *rawR.DependsOn
+                }
+
+                // The old loader records the count expression as a weird RawConfig with
+                // a single-element map inside. Since the rest of the world is assuming
+                // that, we'll mimic it here.
+                {
+                        countBody := hcl2shim.SingleAttrBody{
+                                Name: "count",
+                                Expr: rawR.CountExpr,
+                        }
+
+                        r.RawCount = NewRawConfigHCL2(countBody)
+                        r.RawCount.Key = "count"
+                }
+
+                r.RawConfig = NewRawConfigHCL2(rawR.Config)
+
+                config.Resources = append(config.Resources, r)
+        }
+
+        for _, rawP := range raw.Providers {
+                p := &ProviderConfig{
+                        Name: rawP.Name,
+                }
+
+                if rawP.Alias != nil {
+                        p.Alias = *rawP.Alias
+                }
+                if rawP.Version != nil {
+                        p.Version = *rawP.Version
+                }
+
+                // The result is expected to be a map like map[string]interface{}{"value": something},
+                // so we'll fake that with our hcl2shim.SingleAttrBody shim.
+                p.RawConfig = NewRawConfigHCL2(rawP.Config)
+
+                config.ProviderConfigs = append(config.ProviderConfigs, p)
+        }
+
+        for _, rawL := range raw.Locals {
+                names := make([]string, 0, len(rawL.Definitions))
+                for n := range rawL.Definitions {
+                        names = append(names, n)
+                }
+                sort.Strings(names)
+                for _, n := range names {
+                        attr := rawL.Definitions[n]
+                        l := &Local{
+                                Name: n,
+                                RawConfig: NewRawConfigHCL2(hcl2shim.SingleAttrBody{
+                                        Name: "value",
+                                        Expr: attr.Expr,
+                                }),
+                        }
+                        config.Locals = append(config.Locals, l)
+                }
+        }
+
+        // FIXME: The current API gives us no way to return warnings in the
+        // absense of any errors.
+        var err error
+        if diags.HasErrors() {
+                err = diags
+        }
+
+        return config, err
+}
diff --git a/vendor/github.com/hashicorp/terraform/config/merge.go b/vendor/github.com/hashicorp/terraform/config/merge.go
index db214be..55fc864 100644
--- a/vendor/github.com/hashicorp/terraform/config/merge.go
+++ b/vendor/github.com/hashicorp/terraform/config/merge.go
@@ -137,6 +137,17 @@ func Merge(c1, c2 *Config) (*Config, error) {
                 }
         }
 
+        // Local Values
+        // These are simpler than the other config elements because they are just
+        // flat values and so no deep merging is required.
+        if localsCount := len(c1.Locals) + len(c2.Locals); localsCount != 0 {
+                // Explicit length check above because we want c.Locals to remain
+                // nil if the result would be empty.
+                c.Locals = make([]*Local, 0, len(c1.Locals)+len(c2.Locals))
+                c.Locals = append(c.Locals, c1.Locals...)
+                c.Locals = append(c.Locals, c2.Locals...)
+        }
+
         return c, nil
 }
 
diff --git a/vendor/github.com/hashicorp/terraform/config/module/get.go b/vendor/github.com/hashicorp/terraform/config/module/get.go
index 96b4a63..5073d0d 100644
--- a/vendor/github.com/hashicorp/terraform/config/module/get.go
+++ b/vendor/github.com/hashicorp/terraform/config/module/get.go
@@ -3,6 +3,7 @@ package module
 import (
         "io/ioutil"
         "os"
+        "path/filepath"
 
         "github.com/hashicorp/go-getter"
 )
@@ -37,13 +38,10 @@ func GetCopy(dst, src string) error {
         if err != nil {
                 return err
         }
-        // FIXME: This isn't completely safe. Creating and removing our temp path
-        //        exposes where to race to inject files.
-        if err := os.RemoveAll(tmpDir); err != nil {
-                return err
-        }
         defer os.RemoveAll(tmpDir)
 
+        tmpDir = filepath.Join(tmpDir, "module")
+
         // Get to that temporary dir
         if err := getter.Get(tmpDir, src); err != nil {
                 return err
@@ -57,15 +55,3 @@ func GetCopy(dst, src string) error {
         // Copy to the final location
         return copyDir(dst, tmpDir)
 }
-
-func getStorage(s getter.Storage, key string, src string, mode GetMode) (string, bool, error) {
-        // Get the module with the level specified if we were told to.
-        if mode > GetModeNone {
-                if err := s.Get(key, src, mode == GetModeUpdate); err != nil {
-                        return "", false, err
-                }
-        }
-
-        // Get the directory where the module is.
-        return s.Dir(key)
-}
diff --git a/vendor/github.com/hashicorp/terraform/config/module/inode.go b/vendor/github.com/hashicorp/terraform/config/module/inode.go
index 8603ee2..da520ab 100644
--- a/vendor/github.com/hashicorp/terraform/config/module/inode.go
+++ b/vendor/github.com/hashicorp/terraform/config/module/inode.go
@@ -1,4 +1,4 @@
-// +build linux darwin openbsd netbsd solaris
+// +build linux darwin openbsd netbsd solaris dragonfly
 
 package module
 
diff --git a/vendor/github.com/hashicorp/terraform/config/module/module.go b/vendor/github.com/hashicorp/terraform/config/module/module.go
index f8649f6..7dc8fcc 100644
--- a/vendor/github.com/hashicorp/terraform/config/module/module.go
+++ b/vendor/github.com/hashicorp/terraform/config/module/module.go
@@ -2,6 +2,8 @@ package module
 
 // Module represents the metadata for a single module.
 type Module struct {
-        Name   string
-        Source string
+        Name      string
+        Source    string
+        Version   string
+        Providers map[string]string
 }
diff --git a/vendor/github.com/hashicorp/terraform/config/module/storage.go b/vendor/github.com/hashicorp/terraform/config/module/storage.go
new file mode 100644
index 0000000..58e3a10
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/config/module/storage.go
@@ -0,0 +1,365 @@
+package module
+
+import (
+        "encoding/json"
+        "fmt"
+        "io/ioutil"
+        "log"
+        "os"
+        "path/filepath"
+        "strings"
+
+        getter "github.com/hashicorp/go-getter"
+        "github.com/hashicorp/terraform/registry"
+        "github.com/hashicorp/terraform/registry/regsrc"
+        "github.com/hashicorp/terraform/svchost/disco"
+        "github.com/mitchellh/cli"
+)
+
+const manifestName = "modules.json"
+
+// moduleManifest is the serialization structure used to record the stored
+// module's metadata.
+type moduleManifest struct {
+        Modules []moduleRecord
+}
+
+// moduleRecords represents the stored module's metadata.
+// This is compared for equality using '==', so all fields needs to remain
+// comparable.
+type moduleRecord struct {
+        // Source is the module source string from the config, minus any
+        // subdirectory.
+        Source string
+
+        // Key is the locally unique identifier for this module.
+        Key string
+
+        // Version is the exact version string for the stored module.
+        Version string
+
+        // Dir is the directory name returned by the FileStorage. This is what
+        // allows us to correlate a particular module version with the location on
+        // disk.
+        Dir string
+
+        // Root is the root directory containing the module. If the module is
+        // unpacked from an archive, and not located in the root directory, this is
+        // used to direct the loader to the correct subdirectory. This is
+        // independent from any subdirectory in the original source string, which
+        // may traverse further into the module tree.
+        Root string
+
+        // url is the location of the module source
+        url string
+
+        // Registry is true if this module is sourced from a registry
+        registry bool
+}
+
+// Storage implements methods to manage the storage of modules.
+// This is used by Tree.Load to query registries, authenticate requests, and
+// store modules locally.
+type Storage struct {
+        // StorageDir is the full path to the directory where all modules will be
+        // stored.
+        StorageDir string
+
+        // Ui is an optional cli.Ui for user output
+        Ui cli.Ui
+
+        // Mode is the GetMode that will be used for various operations.
+        Mode GetMode
+
+        registry *registry.Client
+}
+
+// NewStorage returns a new initialized Storage object.
+func NewStorage(dir string, services *disco.Disco) *Storage {
+        regClient := registry.NewClient(services, nil)
+
+        return &Storage{
+                StorageDir: dir,
+                registry:   regClient,
+        }
+}
+
+// loadManifest returns the moduleManifest file from the parent directory.
+func (s Storage) loadManifest() (moduleManifest, error) {
+        manifest := moduleManifest{}
+
+        manifestPath := filepath.Join(s.StorageDir, manifestName)
+        data, err := ioutil.ReadFile(manifestPath)
+        if err != nil && !os.IsNotExist(err) {
+                return manifest, err
+        }
+
+        if len(data) == 0 {
+                return manifest, nil
+        }
+
+        if err := json.Unmarshal(data, &manifest); err != nil {
+                return manifest, err
+        }
+
+        for i, rec := range manifest.Modules {
+                // If the path was recorded before we changed to always using a
+                // slash as separator, we delete the record from the manifest so
+                // it can be discovered again and will be recorded using a slash.
+                if strings.Contains(rec.Dir, "\\") {
+                        manifest.Modules[i] = manifest.Modules[len(manifest.Modules)-1]
+                        manifest.Modules = manifest.Modules[:len(manifest.Modules)-1]
+                        continue
+                }
+
+                // Make sure we use the correct path separator.
+                rec.Dir = filepath.FromSlash(rec.Dir)
+        }
+
+        return manifest, nil
+}
+
+// Store the location of the module, along with the version used and the module
+// root directory. The storage method loads the entire file and rewrites it
+// each time. This is only done a few times during init, so efficiency is
+// not a concern.
+func (s Storage) recordModule(rec moduleRecord) error {
+        manifest, err := s.loadManifest()
+        if err != nil {
+                // if there was a problem with the file, we will attempt to write a new
+                // one. Any non-data related error should surface there.
+                log.Printf("[WARN] error reading module manifest: %s", err)
+        }
+
+        // do nothing if we already have the exact module
+        for i, stored := range manifest.Modules {
+                if rec == stored {
+                        return nil
+                }
+
+                // they are not equal, but if the storage path is the same we need to
+                // remove this rec to be replaced.
+                if rec.Dir == stored.Dir {
+                        manifest.Modules[i] = manifest.Modules[len(manifest.Modules)-1]
+                        manifest.Modules = manifest.Modules[:len(manifest.Modules)-1]
+                        break
+                }
+        }
+
+        // Make sure we always use a slash separator.
+        rec.Dir = filepath.ToSlash(rec.Dir)
+
+        manifest.Modules = append(manifest.Modules, rec)
+
+        js, err := json.Marshal(manifest)
+        if err != nil {
+                panic(err)
+        }
+
+        manifestPath := filepath.Join(s.StorageDir, manifestName)
+        return ioutil.WriteFile(manifestPath, js, 0644)
+}
+
+// load the manifest from dir, and return all module versions matching the
+// provided source. Records with no version info will be skipped, as they need
+// to be uniquely identified by other means.
+func (s Storage) moduleVersions(source string) ([]moduleRecord, error) {
+        manifest, err := s.loadManifest()
+        if err != nil {
+                return manifest.Modules, err
+        }
+
+        var matching []moduleRecord
+
+        for _, m := range manifest.Modules {
+                if m.Source == source && m.Version != "" {
+                        log.Printf("[DEBUG] found local version %q for module %s", m.Version, m.Source)
+                        matching = append(matching, m)
+                }
+        }
+
+        return matching, nil
+}
+
+func (s Storage) moduleDir(key string) (string, error) {
+        manifest, err := s.loadManifest()
+        if err != nil {
+                return "", err
+        }
+
+        for _, m := range manifest.Modules {
+                if m.Key == key {
+                        return m.Dir, nil
+                }
+        }
+
+        return "", nil
+}
+
+// return only the root directory of the module stored in dir.
+func (s Storage) getModuleRoot(dir string) (string, error) {
+        manifest, err := s.loadManifest()
+        if err != nil {
+                return "", err
+        }
+
+        for _, mod := range manifest.Modules {
+                if mod.Dir == dir {
+                        return mod.Root, nil
+                }
+        }
+        return "", nil
+}
+
+// record only the Root directory for the module stored at dir.
+func (s Storage) recordModuleRoot(dir, root string) error {
+        rec := moduleRecord{
+                Dir:  dir,
+                Root: root,
+        }
+
+        return s.recordModule(rec)
+}
+
+func (s Storage) output(msg string) {
+        if s.Ui == nil || s.Mode == GetModeNone {
+                return
+        }
+        s.Ui.Output(msg)
+}
+
+func (s Storage) getStorage(key string, src string) (string, bool, error) {
+        storage := &getter.FolderStorage{
+                StorageDir: s.StorageDir,
+        }
+
+        log.Printf("[DEBUG] fetching module from %s", src)
+
+        // Get the module with the level specified if we were told to.
+        if s.Mode > GetModeNone {
+                log.Printf("[DEBUG] fetching %q with key %q", src, key)
+                if err := storage.Get(key, src, s.Mode == GetModeUpdate); err != nil {
+                        return "", false, err
+                }
+        }
+
+        // Get the directory where the module is.
+        dir, found, err := storage.Dir(key)
+        log.Printf("[DEBUG] found %q in %q: %t", src, dir, found)
+        return dir, found, err
+}
+
+// find a stored module that's not from a registry
+func (s Storage) findModule(key string) (string, error) {
+        if s.Mode == GetModeUpdate {
+                return "", nil
+        }
+
+        return s.moduleDir(key)
+}
+
+// GetModule fetches a module source into the specified directory. This is used
+// as a convenience function by the CLI to initialize a configuration.
+func (s Storage) GetModule(dst, src string) error {
+        // reset this in case the caller was going to re-use it
+        mode := s.Mode
+        s.Mode = GetModeUpdate
+        defer func() {
+                s.Mode = mode
+        }()
+
+        rec, err := s.findRegistryModule(src, anyVersion)
+        if err != nil {
+                return err
+        }
+
+        pwd, err := os.Getwd()
+        if err != nil {
+                return err
+        }
+
+        source := rec.url
+        if source == "" {
+                source, err = getter.Detect(src, pwd, getter.Detectors)
+                if err != nil {
+                        return fmt.Errorf("module %s: %s", src, err)
+                }
+        }
+
+        if source == "" {
+                return fmt.Errorf("module %q not found", src)
+        }
+
+        return GetCopy(dst, source)
+}
+
+// find a registry module
+func (s Storage) findRegistryModule(mSource, constraint string) (moduleRecord, error) {
+        rec := moduleRecord{
+                Source: mSource,
+        }
+        // detect if we have a registry source
+        mod, err := regsrc.ParseModuleSource(mSource)
+        switch err {
+        case nil:
+                //ok
+        case regsrc.ErrInvalidModuleSource:
+                return rec, nil
+        default:
+                return rec, err
+        }
+        rec.registry = true
+
+        log.Printf("[TRACE] %q is a registry module", mod.Display())
+
+        versions, err := s.moduleVersions(mod.String())
+        if err != nil {
+                log.Printf("[ERROR] error looking up versions for %q: %s", mod.Display(), err)
+                return rec, err
+        }
+
+        match, err := newestRecord(versions, constraint)
+        if err != nil {
+                log.Printf("[INFO] no matching version for %q<%s>, %s", mod.Display(), constraint, err)
+        }
+        log.Printf("[DEBUG] matched %q version %s for %s", mod, match.Version, constraint)
+
+        rec.Dir = match.Dir
+        rec.Version = match.Version
+        found := rec.Dir != ""
+
+        // we need to lookup available versions
+        // Only on Get if it's not found, on unconditionally on Update
+        if (s.Mode == GetModeGet && !found) || (s.Mode == GetModeUpdate) {
+                resp, err := s.registry.Versions(mod)
+                if err != nil {
+                        return rec, err
+                }
+
+                if len(resp.Modules) == 0 {
+                        return rec, fmt.Errorf("module %q not found in registry", mod.Display())
+                }
+
+                match, err := newestVersion(resp.Modules[0].Versions, constraint)
+                if err != nil {
+                        return rec, err
+                }
+
+                if match == nil {
+                        return rec, fmt.Errorf("no versions for %q found matching %q", mod.Display(), constraint)
+                }
+
+                rec.Version = match.Version
+
+                rec.url, err = s.registry.Location(mod, rec.Version)
+                if err != nil {
+                        return rec, err
+                }
+
+                // we've already validated this by now
+                host, _ := mod.SvcHost()
+                s.output(fmt.Sprintf("  Found version %s of %s on %s", rec.Version, mod.Module(), host.ForDisplay()))
+
+        }
+        return rec, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/config/module/testing.go b/vendor/github.com/hashicorp/terraform/config/module/testing.go
index fc9e733..6f1ff05 100644
--- a/vendor/github.com/hashicorp/terraform/config/module/testing.go
+++ b/vendor/github.com/hashicorp/terraform/config/module/testing.go
@@ -4,8 +4,6 @@ import (
         "io/ioutil"
         "os"
         "testing"
-
-        "github.com/hashicorp/go-getter"
 )
 
 // TestTree loads a module at the given path and returns the tree as well
@@ -26,8 +24,8 @@ func TestTree(t *testing.T, path string) (*Tree, func()) {
         }
 
         // Get the child modules
-        s := &getter.FolderStorage{StorageDir: dir}
-        if err := mod.Load(s, GetModeGet); err != nil {
+        s := &Storage{StorageDir: dir, Mode: GetModeGet}
+        if err := mod.Load(s); err != nil {
                 t.Fatalf("err: %s", err)
                 return nil, nil
         }
diff --git a/vendor/github.com/hashicorp/terraform/config/module/tree.go b/vendor/github.com/hashicorp/terraform/config/module/tree.go
index 4b0b153..f56d69b 100644
--- a/vendor/github.com/hashicorp/terraform/config/module/tree.go
+++ b/vendor/github.com/hashicorp/terraform/config/module/tree.go
@@ -4,11 +4,14 @@ import (
         "bufio"
         "bytes"
         "fmt"
+        "log"
         "path/filepath"
         "strings"
         "sync"
 
-        "github.com/hashicorp/go-getter"
+        "github.com/hashicorp/terraform/tfdiags"
+
+        getter "github.com/hashicorp/go-getter"
         "github.com/hashicorp/terraform/config"
 )
 
@@ -26,6 +29,17 @@ type Tree struct {
         children map[string]*Tree
         path     []string
         lock     sync.RWMutex
+
+        // version is the final version of the config loaded for the Tree's module
+        version string
+        // source is the "source" string used to load this module. It's possible
+        // for a module source to change, but the path remains the same, preventing
+        // it from being reloaded.
+        source string
+        // parent allows us to walk back up the tree and determine if there are any
+        // versioned ancestor modules which may effect the stored location of
+        // submodules
+        parent *Tree
 }
 
 // NewTree returns a new Tree for the given config structure.
@@ -40,7 +54,7 @@ func NewEmptyTree() *Tree {
         // We do this dummy load so that the tree is marked as "loaded". It
         // should never fail because this is just about a no-op. If it does fail
         // we panic so we can know its a bug.
-        if err := t.Load(nil, GetModeGet); err != nil {
+        if err := t.Load(&Storage{Mode: GetModeGet}); err != nil {
                 panic(err)
         }
 
@@ -126,8 +140,10 @@ func (t *Tree) Modules() []*Module {
         result := make([]*Module, len(t.config.Modules))
         for i, m := range t.config.Modules {
                 result[i] = &Module{
-                        Name:   m.Name,
-                        Source: m.Source,
+                        Name:      m.Name,
+                        Version:   m.Version,
+                        Source:    m.Source,
+                        Providers: m.Providers,
                 }
         }
 
@@ -155,81 +171,178 @@ func (t *Tree) Name() string {
 // module trees inherently require the configuration to be in a reasonably
 // sane state: no circular dependencies, proper module sources, etc. A full
 // suite of validations can be done by running Validate (after loading).
-func (t *Tree) Load(s getter.Storage, mode GetMode) error {
+func (t *Tree) Load(s *Storage) error {
         t.lock.Lock()
         defer t.lock.Unlock()
 
-        // Reset the children if we have any
-        t.children = nil
+        children, err := t.getChildren(s)
+        if err != nil {
+                return err
+        }
+
+        // Go through all the children and load them.
+        for _, c := range children {
+                if err := c.Load(s); err != nil {
+                        return err
+                }
+        }
+
+        // Set our tree up
+        t.children = children
 
-        modules := t.Modules()
+        return nil
+}
+
+func (t *Tree) getChildren(s *Storage) (map[string]*Tree, error) {
         children := make(map[string]*Tree)
 
         // Go through all the modules and get the directory for them.
-        for _, m := range modules {
+        for _, m := range t.Modules() {
                 if _, ok := children[m.Name]; ok {
-                        return fmt.Errorf(
+                        return nil, fmt.Errorf(
                                 "module %s: duplicated. module names must be unique", m.Name)
                 }
 
                 // Determine the path to this child
-                path := make([]string, len(t.path), len(t.path)+1)
-                copy(path, t.path)
-                path = append(path, m.Name)
+                modPath := make([]string, len(t.path), len(t.path)+1)
+                copy(modPath, t.path)
+                modPath = append(modPath, m.Name)
 
-                // Split out the subdir if we have one
-                source, subDir := getter.SourceDirSubdir(m.Source)
+                log.Printf("[TRACE] module source: %q", m.Source)
 
-                source, err := getter.Detect(source, t.config.Dir, getter.Detectors)
+                // add the module path to help indicate where modules with relative
+                // paths are being loaded from
+                s.output(fmt.Sprintf("- module.%s", strings.Join(modPath, ".")))
+
+                // Lookup the local location of the module.
+                // dir is the local directory where the module is stored
+                mod, err := s.findRegistryModule(m.Source, m.Version)
                 if err != nil {
-                        return fmt.Errorf("module %s: %s", m.Name, err)
+                        return nil, err
                 }
 
+                // The key is the string that will be used to uniquely id the Source in
+                // the local storage.  The prefix digit can be incremented to
+                // invalidate the local module storage.
+                key := "1." + t.versionedPathKey(m)
+                if mod.Version != "" {
+                        key += "." + mod.Version
+                }
+
+                // Check for the exact key if it's not a registry module
+                if !mod.registry {
+                        mod.Dir, err = s.findModule(key)
+                        if err != nil {
+                                return nil, err
+                        }
+                }
+
+                if mod.Dir != "" && s.Mode != GetModeUpdate {
+                        // We found it locally, but in order to load the Tree we need to
+                        // find out if there was another subDir stored from detection.
+                        subDir, err := s.getModuleRoot(mod.Dir)
+                        if err != nil {
+                                // If there's a problem with the subdir record, we'll let the
+                                // recordSubdir method fix it up.  Any other filesystem errors
+                                // will turn up again below.
+                                log.Println("[WARN] error reading subdir record:", err)
+                        }
+
+                        fullDir := filepath.Join(mod.Dir, subDir)
+
+                        child, err := NewTreeModule(m.Name, fullDir)
+                        if err != nil {
+                                return nil, fmt.Errorf("module %s: %s", m.Name, err)
+                        }
+                        child.path = modPath
+                        child.parent = t
+                        child.version = mod.Version
+                        child.source = m.Source
+                        children[m.Name] = child
+                        continue
+                }
+
+                // Split out the subdir if we have one.
+                // Terraform keeps the entire requested tree, so that modules can
+                // reference sibling modules from the same archive or repo.
+                rawSource, subDir := getter.SourceDirSubdir(m.Source)
+
+                // we haven't found a source, so fallback to the go-getter detectors
+                source := mod.url
+                if source == "" {
+                        source, err = getter.Detect(rawSource, t.config.Dir, getter.Detectors)
+                        if err != nil {
+                                return nil, fmt.Errorf("module %s: %s", m.Name, err)
+                        }
+                }
+
+                log.Printf("[TRACE] detected module source %q", source)
+
                 // Check if the detector introduced something new.
-                source, subDir2 := getter.SourceDirSubdir(source)
-                if subDir2 != "" {
-                        subDir = filepath.Join(subDir2, subDir)
+                // For example, the registry always adds a subdir of `//*`,
+                // indicating that we need to strip off the first component from the
+                // tar archive, though we may not yet know what it is called.
+                source, detectedSubDir := getter.SourceDirSubdir(source)
+                if detectedSubDir != "" {
+                        subDir = filepath.Join(detectedSubDir, subDir)
+                }
+
+                output := ""
+                switch s.Mode {
+                case GetModeUpdate:
+                        output = fmt.Sprintf("  Updating source %q", m.Source)
+                default:
+                        output = fmt.Sprintf("  Getting source %q", m.Source)
                 }
+                s.output(output)
 
-                // Get the directory where this module is so we can load it
-                key := strings.Join(path, ".")
-                key = fmt.Sprintf("root.%s-%s", key, m.Source)
-                dir, ok, err := getStorage(s, key, source, mode)
+                dir, ok, err := s.getStorage(key, source)
                 if err != nil {
-                        return err
+                        return nil, err
                 }
                 if !ok {
-                        return fmt.Errorf(
-                                "module %s: not found, may need to be downloaded using 'terraform get'", m.Name)
+                        return nil, fmt.Errorf("module %s: not found, may need to run 'terraform init'", m.Name)
                 }
 
-                // If we have a subdirectory, then merge that in
+                log.Printf("[TRACE] %q stored in %q", source, dir)
+
+                // expand and record the subDir for later
+                fullDir := dir
                 if subDir != "" {
-                        dir = filepath.Join(dir, subDir)
-                }
+                        fullDir, err = getter.SubdirGlob(dir, subDir)
+                        if err != nil {
+                                return nil, err
+                        }
 
-                // Load the configurations.Dir(source)
-                children[m.Name], err = NewTreeModule(m.Name, dir)
-                if err != nil {
-                        return fmt.Errorf(
-                                "module %s: %s", m.Name, err)
+                        // +1 to account for the pathsep
+                        if len(dir)+1 > len(fullDir) {
+                                return nil, fmt.Errorf("invalid module storage path %q", fullDir)
+                        }
+                        subDir = fullDir[len(dir)+1:]
                 }
 
-                // Set the path of this child
-                children[m.Name].path = path
-        }
+                // add new info to the module record
+                mod.Key = key
+                mod.Dir = dir
+                mod.Root = subDir
 
-        // Go through all the children and load them.
-        for _, c := range children {
-                if err := c.Load(s, mode); err != nil {
-                        return err
+                // record the module in our manifest
+                if err := s.recordModule(mod); err != nil {
+                        return nil, err
                 }
-        }
 
-        // Set our tree up
-        t.children = children
+                child, err := NewTreeModule(m.Name, fullDir)
+                if err != nil {
+                        return nil, fmt.Errorf("module %s: %s", m.Name, err)
+                }
+                child.path = modPath
+                child.parent = t
+                child.version = mod.Version
+                child.source = m.Source
+                children[m.Name] = child
+        }
 
-        return nil
+        return children, nil
 }
 
 // Path is the full path to this tree.
@@ -272,32 +385,35 @@ func (t *Tree) String() string {
 // as verifying things such as parameters/outputs between the various modules.
 //
 // Load must be called prior to calling Validate or an error will be returned.
-func (t *Tree) Validate() error {
+func (t *Tree) Validate() tfdiags.Diagnostics {
+        var diags tfdiags.Diagnostics
+
         if !t.Loaded() {
-                return fmt.Errorf("tree must be loaded before calling Validate")
+                diags = diags.Append(fmt.Errorf(
+                        "tree must be loaded before calling Validate",
+                ))
+                return diags
         }
 
-        // If something goes wrong, here is our error template
-        newErr := &treeError{Name: []string{t.Name()}}
-
         // Terraform core does not handle root module children named "root".
         // We plan to fix this in the future but this bug was brought up in
         // the middle of a release and we don't want to introduce wide-sweeping
         // changes at that time.
         if len(t.path) == 1 && t.name == "root" {
-                return fmt.Errorf("root module cannot contain module named 'root'")
+                diags = diags.Append(fmt.Errorf(
+                        "root module cannot contain module named 'root'",
+                ))
+                return diags
         }
 
         // Validate our configuration first.
-        if err := t.config.Validate(); err != nil {
-                newErr.Add(err)
-        }
+        diags = diags.Append(t.config.Validate())
 
         // If we're the root, we do extra validation. This validation usually
         // requires the entire tree (since children don't have parent pointers).
         if len(t.path) == 0 {
                 if err := t.validateProviderAlias(); err != nil {
-                        newErr.Add(err)
+                        diags = diags.Append(err)
                 }
         }
 
@@ -306,20 +422,11 @@ func (t *Tree) Validate() error {
 
         // Validate all our children
         for _, c := range children {
-                err := c.Validate()
-                if err == nil {
+                childDiags := c.Validate()
+                diags = diags.Append(childDiags)
+                if diags.HasErrors() {
                         continue
                 }
-
-                verr, ok := err.(*treeError)
-                if !ok {
-                        // Unknown error, just return...
-                        return err
-                }
-
-                // Append ourselves to the error and then return
-                verr.Name = append(verr.Name, t.Name())
-                newErr.AddChild(verr)
         }
 
         // Go over all the modules and verify that any parameters are valid
@@ -345,9 +452,10 @@ func (t *Tree) Validate() error {
                 // Compare to the keys in our raw config for the module
                 for k, _ := range m.RawConfig.Raw {
                         if _, ok := varMap[k]; !ok {
-                                newErr.Add(fmt.Errorf(
-                                        "module %s: %s is not a valid parameter",
-                                        m.Name, k))
+                                diags = diags.Append(fmt.Errorf(
+                                        "module %q: %q is not a valid argument",
+                                        m.Name, k,
+                                ))
                         }
 
                         // Remove the required
@@ -356,9 +464,10 @@ func (t *Tree) Validate() error {
 
                 // If we have any required left over, they aren't set.
                 for k, _ := range requiredMap {
-                        newErr.Add(fmt.Errorf(
-                                "module %s: required variable %q not set",
-                                m.Name, k))
+                        diags = diags.Append(fmt.Errorf(
+                                "module %q: missing required argument %q",
+                                m.Name, k,
+                        ))
                 }
         }
 
@@ -373,9 +482,10 @@ func (t *Tree) Validate() error {
 
                         tree, ok := children[mv.Name]
                         if !ok {
-                                newErr.Add(fmt.Errorf(
-                                        "%s: undefined module referenced %s",
-                                        source, mv.Name))
+                                diags = diags.Append(fmt.Errorf(
+                                        "%s: reference to undefined module %q",
+                                        source, mv.Name,
+                                ))
                                 continue
                         }
 
@@ -387,14 +497,56 @@ func (t *Tree) Validate() error {
                                 }
                         }
                         if !found {
-                                newErr.Add(fmt.Errorf(
-                                        "%s: %s is not a valid output for module %s",
-                                        source, mv.Field, mv.Name))
+                                diags = diags.Append(fmt.Errorf(
+                                        "%s: %q is not a valid output for module %q",
+                                        source, mv.Field, mv.Name,
+                                ))
                         }
                 }
         }
 
-        return newErr.ErrOrNil()
+        return diags
+}
+
+// versionedPathKey returns a path string with every levels full name, version
+// and source encoded. This is to provide a unique key for our module storage,
+// since submodules need to know which versions of their ancestor modules they
+// are loaded from.
+// For example, if module A has a subdirectory B, if module A's source or
+// version is updated B's storage key must reflect this change in order for the
+// correct version of B's source to be loaded.
+func (t *Tree) versionedPathKey(m *Module) string {
+        path := make([]string, len(t.path)+1)
+        path[len(path)-1] = m.Name + ";" + m.Source
+        // We're going to load these in order for easier reading and debugging, but
+        // in practice they only need to be unique and consistent.
+
+        p := t
+        i := len(path) - 2
+        for ; i >= 0; i-- {
+                if p == nil {
+                        break
+                }
+                // we may have been loaded under a blank Tree, so always check for a name
+                // too.
+                if p.name == "" {
+                        break
+                }
+                seg := p.name
+                if p.version != "" {
+                        seg += "#" + p.version
+                }
+
+                if p.source != "" {
+                        seg += ";" + p.source
+                }
+
+                path[i] = seg
+                p = p.parent
+        }
+
+        key := strings.Join(path, "|")
+        return key
 }
 
 // treeError is an error use by Tree.Validate to accumulates all
diff --git a/vendor/github.com/hashicorp/terraform/config/module/validate_provider_alias.go b/vendor/github.com/hashicorp/terraform/config/module/validate_provider_alias.go
index 090d4f7..f203556 100644
--- a/vendor/github.com/hashicorp/terraform/config/module/validate_provider_alias.go
+++ b/vendor/github.com/hashicorp/terraform/config/module/validate_provider_alias.go
@@ -67,7 +67,7 @@ func (t *Tree) validateProviderAlias() error {
 
                         // We didn't find the alias, error!
                         err = multierror.Append(err, fmt.Errorf(
-                                "module %s: provider alias must be defined by the module or a parent: %s",
+                                "module %s: provider alias must be defined by the module: %s",
                                 strings.Join(pv.Path, "."), k))
                 }
         }
diff --git a/vendor/github.com/hashicorp/terraform/config/module/versions.go b/vendor/github.com/hashicorp/terraform/config/module/versions.go
new file mode 100644
index 0000000..8348d4b
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/config/module/versions.go
@@ -0,0 +1,95 @@
+package module
+
+import (
+        "errors"
+        "fmt"
+        "sort"
+
+        version "github.com/hashicorp/go-version"
+        "github.com/hashicorp/terraform/registry/response"
+)
+
+const anyVersion = ">=0.0.0"
+
+// return the newest version that satisfies the provided constraint
+func newest(versions []string, constraint string) (string, error) {
+        if constraint == "" {
+                constraint = anyVersion
+        }
+        cs, err := version.NewConstraint(constraint)
+        if err != nil {
+                return "", err
+        }
+
+        switch len(versions) {
+        case 0:
+                return "", errors.New("no versions found")
+        case 1:
+                v, err := version.NewVersion(versions[0])
+                if err != nil {
+                        return "", err
+                }
+
+                if !cs.Check(v) {
+                        return "", fmt.Errorf("no version found matching constraint %q", constraint)
+                }
+                return versions[0], nil
+        }
+
+        sort.Slice(versions, func(i, j int) bool {
+                // versions should have already been validated
+                // sort invalid version strings to the end
+                iv, err := version.NewVersion(versions[i])
+                if err != nil {
+                        return true
+                }
+                jv, err := version.NewVersion(versions[j])
+                if err != nil {
+                        return true
+                }
+                return iv.GreaterThan(jv)
+        })
+
+        // versions are now in order, so just find the first which satisfies the
+        // constraint
+        for i := range versions {
+                v, err := version.NewVersion(versions[i])
+                if err != nil {
+                        continue
+                }
+                if cs.Check(v) {
+                        return versions[i], nil
+                }
+        }
+
+        return "", nil
+}
+
+// return the newest *moduleVersion that matches the given constraint
+// TODO: reconcile these two types and newest* functions
+func newestVersion(moduleVersions []*response.ModuleVersion, constraint string) (*response.ModuleVersion, error) {
+        var versions []string
+        modules := make(map[string]*response.ModuleVersion)
+
+        for _, m := range moduleVersions {
+                versions = append(versions, m.Version)
+                modules[m.Version] = m
+        }
+
+        match, err := newest(versions, constraint)
+        return modules[match], err
+}
+
+// return the newest moduleRecord that matches the given constraint
+func newestRecord(moduleVersions []moduleRecord, constraint string) (moduleRecord, error) {
+        var versions []string
+        modules := make(map[string]moduleRecord)
+
+        for _, m := range moduleVersions {
+                versions = append(versions, m.Version)
+                modules[m.Version] = m
+        }
+
+        match, err := newest(versions, constraint)
+        return modules[match], err
+}
diff --git a/vendor/github.com/hashicorp/terraform/config/raw_config.go b/vendor/github.com/hashicorp/terraform/config/raw_config.go
index f8498d8..1854a8b 100644
--- a/vendor/github.com/hashicorp/terraform/config/raw_config.go
+++ b/vendor/github.com/hashicorp/terraform/config/raw_config.go
@@ -3,8 +3,14 @@ package config
 import (
         "bytes"
         "encoding/gob"
+        "errors"
+        "strconv"
         "sync"
 
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+
+        hcl2 "github.com/hashicorp/hcl2/hcl"
         "github.com/hashicorp/hil"
         "github.com/hashicorp/hil/ast"
         "github.com/mitchellh/copystructure"
@@ -27,8 +33,24 @@ const UnknownVariableValue = "74D93920-ED26-11E3-AC10-0800200C9A66"
 // RawConfig supports a query-like interface to request
 // information from deep within the structure.
 type RawConfig struct {
-        Key            string
-        Raw            map[string]interface{}
+        Key string
+
+        // Only _one_ of Raw and Body may be populated at a time.
+        //
+        // In the normal case, Raw is populated and Body is nil.
+        //
+        // When the experimental HCL2 parsing mode is enabled, "Body"
+        // is populated and RawConfig serves only to transport the hcl2.Body
+        // through the rest of Terraform core so we can ultimately decode it
+        // once its schema is known.
+        //
+        // Once we transition to HCL2 as the primary representation, RawConfig
+        // should be removed altogether and the hcl2.Body should be passed
+        // around directly.
+
+        Raw  map[string]interface{}
+        Body hcl2.Body
+
         Interpolations []ast.Node
         Variables      map[string]InterpolatedVariable
 
@@ -48,6 +70,26 @@ func NewRawConfig(raw map[string]interface{}) (*RawConfig, error) {
         return result, nil
 }
 
+// NewRawConfigHCL2 creates a new RawConfig that is serving as a capsule
+// to transport a hcl2.Body. In this mode, the publicly-readable struct
+// fields are not populated since all operations should instead be diverted
+// to the HCL2 body.
+//
+// For a RawConfig object constructed with this function, the only valid use
+// is to later retrieve the Body value and call its own methods. Callers
+// may choose to set and then later handle the Key field, in a manner
+// consistent with how it is handled by the Value method, but the Value
+// method itself must not be used.
+//
+// This is an experimental codepath to be used only by the HCL2 config loader.
+// Non-experimental parsing should _always_ use NewRawConfig to produce a
+// fully-functional RawConfig object.
+func NewRawConfigHCL2(body hcl2.Body) *RawConfig {
+        return &RawConfig{
+                Body: body,
+        }
+}
+
 // RawMap returns a copy of the RawConfig.Raw map.
 func (r *RawConfig) RawMap() map[string]interface{} {
         r.lock.Lock()
@@ -69,6 +111,10 @@ func (r *RawConfig) Copy() *RawConfig {
         r.lock.Lock()
         defer r.lock.Unlock()
 
+        if r.Body != nil {
+                return NewRawConfigHCL2(r.Body)
+        }
+
         newRaw := make(map[string]interface{})
         for k, v := range r.Raw {
                 newRaw[k] = v
@@ -223,6 +269,13 @@ func (r *RawConfig) init() error {
 }
 
 func (r *RawConfig) interpolate(fn interpolationWalkerFunc) error {
+        if r.Body != nil {
+                // For RawConfigs created for the HCL2 experiement, callers must
+                // use the HCL2 Body API directly rather than interpolating via
+                // the RawConfig.
+                return errors.New("this feature is not yet supported under the HCL2 experiment")
+        }
+
         config, err := copystructure.Copy(r.Raw)
         if err != nil {
                 return err
@@ -268,6 +321,74 @@ func (r *RawConfig) merge(r2 *RawConfig) *RawConfig {
         return result
 }
 
+// couldBeInteger is a helper that determines if the represented value could
+// result in an integer.
+//
+// This function only works for RawConfigs that have "Key" set, meaning that
+// a single result can be produced. Calling this function will overwrite
+// the Config and Value results to be a test value.
+//
+// This function is conservative. If there is some doubt about whether the
+// result could be an integer -- for example, if it depends on a variable
+// whose type we don't know yet -- it will still return true.
+func (r *RawConfig) couldBeInteger() bool {
+        if r.Key == "" {
+                // un-keyed RawConfigs can never produce numbers
+                return false
+        }
+        if r.Body == nil {
+                // Normal path: using the interpolator in this package
+                // Interpolate with a fixed number to verify that its a number.
+                r.interpolate(func(root ast.Node) (interface{}, error) {
+                        // Execute the node but transform the AST so that it returns
+                        // a fixed value of "5" for all interpolations.
+                        result, err := hil.Eval(
+                                hil.FixedValueTransform(
+                                        root, &ast.LiteralNode{Value: "5", Typex: ast.TypeString}),
+                                nil)
+                        if err != nil {
+                                return "", err
+                        }
+
+                        return result.Value, nil
+                })
+                _, err := strconv.ParseInt(r.Value().(string), 0, 0)
+                return err == nil
+        } else {
+                // HCL2 experiment path: using the HCL2 API via shims
+                //
+                // This path catches fewer situations because we have to assume all
+                // variables are entirely unknown in HCL2, rather than the assumption
+                // above that all variables can be numbers because names like "var.foo"
+                // are considered a single variable rather than an attribute access.
+                // This is fine in practice, because we get a definitive answer
+                // during the graph walk when we have real values to work with.
+                attrs, diags := r.Body.JustAttributes()
+                if diags.HasErrors() {
+                        // This body is not just a single attribute with a value, so
+                        // this can't be a number.
+                        return false
+                }
+                attr, hasAttr := attrs[r.Key]
+                if !hasAttr {
+                        return false
+                }
+                result, diags := hcl2EvalWithUnknownVars(attr.Expr)
+                if diags.HasErrors() {
+                        // We'll conservatively assume that this error is a result of
+                        // us not being ready to fully-populate the scope, and catch
+                        // any further problems during the main graph walk.
+                        return true
+                }
+
+                // If the result is convertable to number then we'll allow it.
+                // We do this because an unknown string is optimistically convertable
+                // to number (might be "5") but a _known_ string "hello" is not.
+                _, err := convert.Convert(result, cty.Number)
+                return err == nil
+        }
+}
+
 // UnknownKeys returns the keys of the configuration that are unknown
 // because they had interpolated variables that must be computed.
 func (r *RawConfig) UnknownKeys() []string {
diff --git a/vendor/github.com/hashicorp/terraform/config/resource_mode_string.go b/vendor/github.com/hashicorp/terraform/config/resource_mode_string.go
index ea68b4f..8a55e06 100644
--- a/vendor/github.com/hashicorp/terraform/config/resource_mode_string.go
+++ b/vendor/github.com/hashicorp/terraform/config/resource_mode_string.go
@@ -2,7 +2,7 @@
 
 package config
 
-import "fmt"
+import "strconv"
 
 const _ResourceMode_name = "ManagedResourceModeDataResourceMode"
 
@@ -10,7 +10,7 @@ var _ResourceMode_index = [...]uint8{0, 19, 35}
 
 func (i ResourceMode) String() string {
         if i < 0 || i >= ResourceMode(len(_ResourceMode_index)-1) {
-                return fmt.Sprintf("ResourceMode(%d)", i)
+                return "ResourceMode(" + strconv.FormatInt(int64(i), 10) + ")"
         }
         return _ResourceMode_name[_ResourceMode_index[i]:_ResourceMode_index[i+1]]
 }
diff --git a/vendor/github.com/hashicorp/terraform/config/testing.go b/vendor/github.com/hashicorp/terraform/config/testing.go
index f7bfadd..831fc77 100644
--- a/vendor/github.com/hashicorp/terraform/config/testing.go
+++ b/vendor/github.com/hashicorp/terraform/config/testing.go
@@ -6,6 +6,8 @@ import (
 
 // TestRawConfig is used to create a RawConfig for testing.
 func TestRawConfig(t *testing.T, c map[string]interface{}) *RawConfig {
+        t.Helper()
+
         cfg, err := NewRawConfig(c)
         if err != nil {
                 t.Fatalf("err: %s", err)
diff --git a/vendor/github.com/hashicorp/terraform/dag/dag.go b/vendor/github.com/hashicorp/terraform/dag/dag.go
index f8776bc..b7eb10c 100644
--- a/vendor/github.com/hashicorp/terraform/dag/dag.go
+++ b/vendor/github.com/hashicorp/terraform/dag/dag.go
@@ -106,7 +106,7 @@ func (g *AcyclicGraph) TransitiveReduction() {
                 uTargets := g.DownEdges(u)
                 vs := AsVertexList(g.DownEdges(u))
 
-                g.DepthFirstWalk(vs, func(v Vertex, d int) error {
+                g.depthFirstWalk(vs, false, func(v Vertex, d int) error {
                         shared := uTargets.Intersection(g.DownEdges(v))
                         for _, vPrime := range AsVertexList(shared) {
                                 g.RemoveEdge(BasicEdge(u, vPrime))
@@ -187,9 +187,18 @@ type vertexAtDepth struct {
 }
 
 // depthFirstWalk does a depth-first walk of the graph starting from
-// the vertices in start. This is not exported now but it would make sense
-// to export this publicly at some point.
+// the vertices in start.
 func (g *AcyclicGraph) DepthFirstWalk(start []Vertex, f DepthWalkFunc) error {
+        return g.depthFirstWalk(start, true, f)
+}
+
+// This internal method provides the option of not sorting the vertices during
+// the walk, which we use for the Transitive reduction.
+// Some configurations can lead to fully-connected subgraphs, which makes our
+// transitive reduction algorithm O(n^3). This is still passable for the size
+// of our graphs, but the additional n^2 sort operations would make this
+// uncomputable in a reasonable amount of time.
+func (g *AcyclicGraph) depthFirstWalk(start []Vertex, sorted bool, f DepthWalkFunc) error {
         defer g.debug.BeginOperation(typeDepthFirstWalk, "").End("")
 
         seen := make(map[Vertex]struct{})
@@ -219,7 +228,11 @@ func (g *AcyclicGraph) DepthFirstWalk(start []Vertex, f DepthWalkFunc) error {
 
                 // Visit targets of this in a consistent order.
                 targets := AsVertexList(g.DownEdges(current.Vertex))
-                sort.Sort(byVertexName(targets))
+
+                if sorted {
+                        sort.Sort(byVertexName(targets))
+                }
+
                 for _, t := range targets {
                         frontier = append(frontier, &vertexAtDepth{
                                 Vertex: t,
diff --git a/vendor/github.com/hashicorp/terraform/dag/marshal.go b/vendor/github.com/hashicorp/terraform/dag/marshal.go
index 16d5dd6..c567d27 100644
--- a/vendor/github.com/hashicorp/terraform/dag/marshal.go
+++ b/vendor/github.com/hashicorp/terraform/dag/marshal.go
@@ -273,6 +273,9 @@ func (e *encoder) Encode(i interface{}) {
 }
 
 func (e *encoder) Add(v Vertex) {
+        if e == nil {
+                return
+        }
         e.Encode(marshalTransform{
                 Type:      typeTransform,
                 AddVertex: newMarshalVertex(v),
@@ -281,6 +284,9 @@ func (e *encoder) Add(v Vertex) {
 
 // Remove records the removal of Vertex v.
 func (e *encoder) Remove(v Vertex) {
+        if e == nil {
+                return
+        }
         e.Encode(marshalTransform{
                 Type:         typeTransform,
                 RemoveVertex: newMarshalVertex(v),
@@ -288,6 +294,9 @@ func (e *encoder) Remove(v Vertex) {
 }
 
 func (e *encoder) Connect(edge Edge) {
+        if e == nil {
+                return
+        }
         e.Encode(marshalTransform{
                 Type:    typeTransform,
                 AddEdge: newMarshalEdge(edge),
@@ -295,6 +304,9 @@ func (e *encoder) Connect(edge Edge) {
 }
 
 func (e *encoder) RemoveEdge(edge Edge) {
+        if e == nil {
+                return
+        }
         e.Encode(marshalTransform{
                 Type:       typeTransform,
                 RemoveEdge: newMarshalEdge(edge),
diff --git a/vendor/github.com/hashicorp/terraform/dag/walk.go b/vendor/github.com/hashicorp/terraform/dag/walk.go
index 23c87ad..f03b100 100644
--- a/vendor/github.com/hashicorp/terraform/dag/walk.go
+++ b/vendor/github.com/hashicorp/terraform/dag/walk.go
@@ -166,7 +166,7 @@ func (w *Walker) Update(g *AcyclicGraph) {
                 w.wait.Add(1)
 
                 // Add to our own set so we know about it already
-                log.Printf("[DEBUG] dag/walk: added new vertex: %q", VertexName(v))
+                log.Printf("[TRACE] dag/walk: added new vertex: %q", VertexName(v))
                 w.vertices.Add(raw)
 
                 // Initialize the vertex info
@@ -198,7 +198,7 @@ func (w *Walker) Update(g *AcyclicGraph) {
                 // Delete it out of the map
                 delete(w.vertexMap, v)
 
-                log.Printf("[DEBUG] dag/walk: removed vertex: %q", VertexName(v))
+                log.Printf("[TRACE] dag/walk: removed vertex: %q", VertexName(v))
                 w.vertices.Delete(raw)
         }
 
@@ -229,7 +229,7 @@ func (w *Walker) Update(g *AcyclicGraph) {
                 changedDeps.Add(waiter)
 
                 log.Printf(
-                        "[DEBUG] dag/walk: added edge: %q waiting on %q",
+                        "[TRACE] dag/walk: added edge: %q waiting on %q",
                         VertexName(waiter), VertexName(dep))
                 w.edges.Add(raw)
         }
@@ -253,7 +253,7 @@ func (w *Walker) Update(g *AcyclicGraph) {
                 changedDeps.Add(waiter)
 
                 log.Printf(
-                        "[DEBUG] dag/walk: removed edge: %q waiting on %q",
+                        "[TRACE] dag/walk: removed edge: %q waiting on %q",
                         VertexName(waiter), VertexName(dep))
                 w.edges.Delete(raw)
         }
@@ -296,7 +296,7 @@ func (w *Walker) Update(g *AcyclicGraph) {
                 info.depsCancelCh = cancelCh
 
                 log.Printf(
-                        "[DEBUG] dag/walk: dependencies changed for %q, sending new deps",
+                        "[TRACE] dag/walk: dependencies changed for %q, sending new deps",
                         VertexName(v))
 
                 // Start the waiter
@@ -383,10 +383,10 @@ func (w *Walker) walkVertex(v Vertex, info *walkerVertex) {
         // Run our callback or note that our upstream failed
         var err error
         if depsSuccess {
-                log.Printf("[DEBUG] dag/walk: walking %q", VertexName(v))
+                log.Printf("[TRACE] dag/walk: walking %q", VertexName(v))
                 err = w.Callback(v)
         } else {
-                log.Printf("[DEBUG] dag/walk: upstream errored, not walking %q", VertexName(v))
+                log.Printf("[TRACE] dag/walk: upstream errored, not walking %q", VertexName(v))
                 err = errWalkUpstream
         }
 
@@ -423,7 +423,7 @@ func (w *Walker) waitDeps(
                                 return
 
                         case <-time.After(time.Second * 5):
-                                log.Printf("[DEBUG] dag/walk: vertex %q, waiting for: %q",
+                                log.Printf("[TRACE] dag/walk: vertex %q, waiting for: %q",
                                         VertexName(v), VertexName(dep))
                         }
                 }
diff --git a/vendor/github.com/hashicorp/terraform/helper/experiment/experiment.go b/vendor/github.com/hashicorp/terraform/helper/experiment/experiment.go
deleted file mode 100644
index 18b8837..0000000
--- a/vendor/github.com/hashicorp/terraform/helper/experiment/experiment.go
+++ /dev/null
@@ -1,154 +0,0 @@
-// experiment package contains helper functions for tracking experimental
-// features throughout Terraform.
-//
-// This package should be used for creating, enabling, querying, and deleting
-// experimental features. By unifying all of that onto a single interface,
-// we can have the Go compiler help us by enforcing every place we touch
-// an experimental feature.
-//
-// To create a new experiment:
-//
-//   1. Add the experiment to the global vars list below, prefixed with X_
-//
-//   2. Add the experiment variable to the All listin the init() function
-//
-//   3. Use it!
-//
-// To remove an experiment:
-//
-//   1. Delete the experiment global var.
-//
-//   2. Try to compile and fix all the places where the var was referenced.
-//
-// To use an experiment:
-//
-//   1. Use Flag() if you want the experiment to be available from the CLI.
-//
-//   2. Use Enabled() to check whether it is enabled.
-//
-// As a general user:
-//
-//   1. The `-Xexperiment-name` flag
-//   2. The `TF_X_<experiment-name>` env var.
-//   3. The `TF_X_FORCE` env var can be set to force an experimental feature
-//      without human verifications.
-//
-package experiment
-
-import (
-        "flag"
-        "fmt"
-        "os"
-        "strconv"
-        "strings"
-        "sync"
-)
-
-// The experiments that are available are listed below. Any package in
-// Terraform defining an experiment should define the experiments below.
-// By keeping them all within the experiment package we force a single point
-// of definition and use. This allows the compiler to enforce references
-// so it becomes easy to remove the features.
-var (
-        // Shadow graph. This is already on by default. Disabling it will be
-        // allowed for awhile in order for it to not block operations.
-        X_shadow = newBasicID("shadow", "SHADOW", false)
-)
-
-// Global variables this package uses because we are a package
-// with global state.
-var (
-        // all is the list of all experiements. Do not modify this.
-        All []ID
-
-        // enabled keeps track of what flags have been enabled
-        enabled     map[string]bool
-        enabledLock sync.Mutex
-
-        // Hidden "experiment" that forces all others to be on without verification
-        x_force = newBasicID("force", "FORCE", false)
-)
-
-func init() {
-        // The list of all experiments, update this when an experiment is added.
-        All = []ID{
-                X_shadow,
-                x_force,
-        }
-
-        // Load
-        reload()
-}
-
-// reload is used by tests to reload the global state. This is called by
-// init publicly.
-func reload() {
-        // Initialize
-        enabledLock.Lock()
-        enabled = make(map[string]bool)
-        enabledLock.Unlock()
-
-        // Set defaults and check env vars
-        for _, id := range All {
-                // Get the default value
-                def := id.Default()
-
-                // If we set it in the env var, default it to true
-                key := fmt.Sprintf("TF_X_%s", strings.ToUpper(id.Env()))
-                if v := os.Getenv(key); v != "" {
-                        def = v != "0"
-                }
-
-                // Set the default
-                SetEnabled(id, def)
-        }
-}
-
-// Enabled returns whether an experiment has been enabled or not.
-func Enabled(id ID) bool {
-        enabledLock.Lock()
-        defer enabledLock.Unlock()
-        return enabled[id.Flag()]
-}
-
-// SetEnabled sets an experiment to enabled/disabled. Please check with
-// the experiment docs for when calling this actually affects the experiment.
-func SetEnabled(id ID, v bool) {
-        enabledLock.Lock()
-        defer enabledLock.Unlock()
-        enabled[id.Flag()] = v
-}
-
-// Force returns true if the -Xforce of TF_X_FORCE flag is present, which
-// advises users of this package to not verify with the user that they want
-// experimental behavior and to just continue with it.
-func Force() bool {
-        return Enabled(x_force)
-}
-
-// Flag configures the given FlagSet with the flags to configure
-// all active experiments.
-func Flag(fs *flag.FlagSet) {
-        for _, id := range All {
-                desc := id.Flag()
-                key := fmt.Sprintf("X%s", id.Flag())
-                fs.Var(&idValue{X: id}, key, desc)
-        }
-}
-
-// idValue implements flag.Value for setting the enabled/disabled state
-// of an experiment from the CLI.
-type idValue struct {
-        X ID
-}
-
-func (v *idValue) IsBoolFlag() bool { return true }
-func (v *idValue) String() string   { return strconv.FormatBool(Enabled(v.X)) }
-func (v *idValue) Set(raw string) error {
-        b, err := strconv.ParseBool(raw)
-        if err == nil {
-                SetEnabled(v.X, b)
-        }
-
-        return err
-}
diff --git a/vendor/github.com/hashicorp/terraform/helper/experiment/id.go b/vendor/github.com/hashicorp/terraform/helper/experiment/id.go
deleted file mode 100644
index 8e2f707..0000000
--- a/vendor/github.com/hashicorp/terraform/helper/experiment/id.go
+++ /dev/null
@@ -1,34 +0,0 @@
-package experiment
-
-// ID represents an experimental feature.
-//
-// The global vars defined on this package should be used as ID values.
-// This interface is purposely not implement-able outside of this package
-// so that we can rely on the Go compiler to enforce all experiment references.
-type ID interface {
-        Env() string
-        Flag() string
-        Default() bool
-
-        unexported() // So the ID can't be implemented externally.
-}
-
-// basicID implements ID.
-type basicID struct {
-        EnvValue     string
-        FlagValue    string
-        DefaultValue bool
-}
-
-func newBasicID(flag, env string, def bool) ID {
-        return &basicID{
-                EnvValue:     env,
-                FlagValue:    flag,
-                DefaultValue: def,
-        }
-}
-
-func (id *basicID) Env() string   { return id.EnvValue }
-func (id *basicID) Flag() string  { return id.FlagValue }
-func (id *basicID) Default() bool { return id.DefaultValue }
-func (id *basicID) unexported()   {}
diff --git a/vendor/github.com/hashicorp/terraform/helper/hashcode/hashcode.go b/vendor/github.com/hashicorp/terraform/helper/hashcode/hashcode.go
index 64d8263..6ccc523 100644
--- a/vendor/github.com/hashicorp/terraform/helper/hashcode/hashcode.go
+++ b/vendor/github.com/hashicorp/terraform/helper/hashcode/hashcode.go
@@ -1,6 +1,8 @@
 package hashcode
 
 import (
+        "bytes"
+        "fmt"
         "hash/crc32"
 )
 
@@ -20,3 +22,14 @@ func String(s string) int {
         // v == MinInt
         return 0
 }
+
+// Strings hashes a list of strings to a unique hashcode.
+func Strings(strings []string) string {
+        var buf bytes.Buffer
+
+        for _, s := range strings {
+                buf.WriteString(fmt.Sprintf("%s-", s))
+        }
+
+        return fmt.Sprintf("%d", String(buf.String()))
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/logging/logging.go b/vendor/github.com/hashicorp/terraform/helper/logging/logging.go
index 433cd77..6bd92f7 100644
--- a/vendor/github.com/hashicorp/terraform/helper/logging/logging.go
+++ b/vendor/github.com/hashicorp/terraform/helper/logging/logging.go
@@ -18,7 +18,7 @@ const (
         EnvLogFile = "TF_LOG_PATH" // Set to a file
 )
 
-var validLevels = []logutils.LogLevel{"TRACE", "DEBUG", "INFO", "WARN", "ERROR"}
+var ValidLevels = []logutils.LogLevel{"TRACE", "DEBUG", "INFO", "WARN", "ERROR"}
 
 // LogOutput determines where we should send logs (if anywhere) and the log level.
 func LogOutput() (logOutput io.Writer, err error) {
@@ -40,7 +40,7 @@ func LogOutput() (logOutput io.Writer, err error) {
 
         // This was the default since the beginning
         logOutput = &logutils.LevelFilter{
-                Levels:   validLevels,
+                Levels:   ValidLevels,
                 MinLevel: logutils.LogLevel(logLevel),
                 Writer:   logOutput,
         }
@@ -77,7 +77,7 @@ func LogLevel() string {
                 logLevel = strings.ToUpper(envLevel)
         } else {
                 log.Printf("[WARN] Invalid log level: %q. Defaulting to level: TRACE. Valid levels are: %+v",
-                        envLevel, validLevels)
+                        envLevel, ValidLevels)
         }
 
         return logLevel
@@ -90,7 +90,7 @@ func IsDebugOrHigher() bool {
 }
 
 func isValidLogLevel(level string) bool {
-        for _, l := range validLevels {
+        for _, l := range ValidLevels {
                 if strings.ToUpper(level) == string(l) {
                         return true
                 }
diff --git a/vendor/github.com/hashicorp/terraform/helper/logging/transport.go b/vendor/github.com/hashicorp/terraform/helper/logging/transport.go
index 4477924..bddabe6 100644
--- a/vendor/github.com/hashicorp/terraform/helper/logging/transport.go
+++ b/vendor/github.com/hashicorp/terraform/helper/logging/transport.go
@@ -1,9 +1,12 @@
 package logging
 
 import (
+        "bytes"
+        "encoding/json"
         "log"
         "net/http"
         "net/http/httputil"
+        "strings"
 )
 
 type transport struct {
@@ -15,7 +18,7 @@ func (t *transport) RoundTrip(req *http.Request) (*http.Response, error) {
         if IsDebugOrHigher() {
                 reqData, err := httputil.DumpRequestOut(req, true)
                 if err == nil {
-                        log.Printf("[DEBUG] "+logReqMsg, t.name, string(reqData))
+                        log.Printf("[DEBUG] "+logReqMsg, t.name, prettyPrintJsonLines(reqData))
                 } else {
                         log.Printf("[ERROR] %s API Request error: %#v", t.name, err)
                 }
@@ -29,7 +32,7 @@ func (t *transport) RoundTrip(req *http.Request) (*http.Response, error) {
         if IsDebugOrHigher() {
                 respData, err := httputil.DumpResponse(resp, true)
                 if err == nil {
-                        log.Printf("[DEBUG] "+logRespMsg, t.name, string(respData))
+                        log.Printf("[DEBUG] "+logRespMsg, t.name, prettyPrintJsonLines(respData))
                 } else {
                         log.Printf("[ERROR] %s API Response error: %#v", t.name, err)
                 }
@@ -42,6 +45,20 @@ func NewTransport(name string, t http.RoundTripper) *transport {
         return &transport{name, t}
 }
 
+// prettyPrintJsonLines iterates through a []byte line-by-line,
+// transforming any lines that are complete json into pretty-printed json.
+func prettyPrintJsonLines(b []byte) string {
+        parts := strings.Split(string(b), "\n")
+        for i, p := range parts {
+                if b := []byte(p); json.Valid(b) {
+                        var out bytes.Buffer
+                        json.Indent(&out, b, "", " ")
+                        parts[i] = out.String()
+                }
+        }
+        return strings.Join(parts, "\n")
+}
+
 const logReqMsg = `%s API Request Details:
 ---[ REQUEST ]---------------------------------------
 %s
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/id.go b/vendor/github.com/hashicorp/terraform/helper/resource/id.go
index 1cde67c..4494955 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/id.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/id.go
@@ -18,6 +18,11 @@ func UniqueId() string {
         return PrefixedUniqueId(UniqueIdPrefix)
 }
 
+// UniqueIDSuffixLength is the string length of the suffix generated by
+// PrefixedUniqueId. This can be used by length validation functions to
+// ensure prefixes are the correct length for the target field.
+const UniqueIDSuffixLength = 26
+
 // Helper for a resource to generate a unique identifier w/ given prefix
 //
 // After the prefix, the ID consists of an incrementing 26 digit value (to match
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/state.go b/vendor/github.com/hashicorp/terraform/helper/resource/state.go
index 37c586a..c34e21b 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/state.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/state.go
@@ -46,7 +46,7 @@ type StateChangeConf struct {
 // If the Timeout is exceeded before reaching the Target state, return an
 // error.
 //
-// Otherwise, result the result of the first call to the Refresh function to
+// Otherwise, the result is the result of the first call to the Refresh function to
 // reach the target state.
 func (conf *StateChangeConf) WaitForState() (interface{}, error) {
         log.Printf("[DEBUG] Waiting for state to become: %s", conf.Target)
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/testing.go b/vendor/github.com/hashicorp/terraform/helper/resource/testing.go
index d7de1a0..b97673f 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/testing.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/testing.go
@@ -11,11 +11,13 @@ import (
         "reflect"
         "regexp"
         "strings"
+        "syscall"
         "testing"
 
         "github.com/davecgh/go-spew/spew"
-        "github.com/hashicorp/go-getter"
+        "github.com/hashicorp/errwrap"
         "github.com/hashicorp/go-multierror"
+        "github.com/hashicorp/logutils"
         "github.com/hashicorp/terraform/config/module"
         "github.com/hashicorp/terraform/helper/logging"
         "github.com/hashicorp/terraform/terraform"
@@ -186,6 +188,10 @@ type TestCheckFunc func(*terraform.State) error
 // ImportStateCheckFunc is the check function for ImportState tests
 type ImportStateCheckFunc func([]*terraform.InstanceState) error
 
+// ImportStateIdFunc is an ID generation function to help with complex ID
+// generation for ImportState tests.
+type ImportStateIdFunc func(*terraform.State) (string, error)
+
 // TestCase is a single acceptance test case used to test the apply/destroy
 // lifecycle of a resource in a specific configuration.
 //
@@ -260,6 +266,15 @@ type TestStep struct {
         // below.
         PreConfig func()
 
+        // Taint is a list of resource addresses to taint prior to the execution of
+        // the step. Be sure to only include this at a step where the referenced
+        // address will be present in state, as it will fail the test if the resource
+        // is missing.
+        //
+        // This option is ignored on ImportState tests, and currently only works for
+        // resources in the root module path.
+        Taint []string
+
         //---------------------------------------------------------------
         // Test modes. One of the following groups of settings must be
         // set to determine what the test step will do. Ideally we would've
@@ -304,10 +319,19 @@ type TestStep struct {
         // no-op plans
         PlanOnly bool
 
+        // PreventDiskCleanup can be set to true for testing terraform modules which
+        // require access to disk at runtime. Note that this will leave files in the
+        // temp folder
+        PreventDiskCleanup bool
+
         // PreventPostDestroyRefresh can be set to true for cases where data sources
         // are tested alongside real resources
         PreventPostDestroyRefresh bool
 
+        // SkipFunc is called before applying config, but after PreConfig
+        // This is useful for defining test steps with platform-dependent checks
+        SkipFunc func() (bool, error)
+
         //---------------------------------------------------------------
         // ImportState testing
         //---------------------------------------------------------------
@@ -329,6 +353,12 @@ type TestStep struct {
         // the unset ImportStateId field.
         ImportStateIdPrefix string
 
+        // ImportStateIdFunc is a function that can be used to dynamically generate
+        // the ID for the ImportState tests. It is sent the state, which can be
+        // checked to derive the attributes necessary and generate the string in the
+        // desired format.
+        ImportStateIdFunc ImportStateIdFunc
+
         // ImportStateCheck checks the results of ImportState. It should be
         // used to verify that the resulting value of ImportState has the
         // proper resources, IDs, and attributes.
@@ -345,6 +375,60 @@ type TestStep struct {
         ImportStateVerifyIgnore []string
 }
 
+// Set to a file mask in sprintf format where %s is test name
+const EnvLogPathMask = "TF_LOG_PATH_MASK"
+
+func LogOutput(t TestT) (logOutput io.Writer, err error) {
+        logOutput = ioutil.Discard
+
+        logLevel := logging.LogLevel()
+        if logLevel == "" {
+                return
+        }
+
+        logOutput = os.Stderr
+
+        if logPath := os.Getenv(logging.EnvLogFile); logPath != "" {
+                var err error
+                logOutput, err = os.OpenFile(logPath, syscall.O_CREAT|syscall.O_RDWR|syscall.O_APPEND, 0666)
+                if err != nil {
+                        return nil, err
+                }
+        }
+
+        if logPathMask := os.Getenv(EnvLogPathMask); logPathMask != "" {
+                // Escape special characters which may appear if we have subtests
+                testName := strings.Replace(t.Name(), "/", "__", -1)
+
+                logPath := fmt.Sprintf(logPathMask, testName)
+                var err error
+                logOutput, err = os.OpenFile(logPath, syscall.O_CREAT|syscall.O_RDWR|syscall.O_APPEND, 0666)
+                if err != nil {
+                        return nil, err
+                }
+        }
+
+        // This was the default since the beginning
+        logOutput = &logutils.LevelFilter{
+                Levels:   logging.ValidLevels,
+                MinLevel: logutils.LogLevel(logLevel),
+                Writer:   logOutput,
+        }
+
+        return
+}
+
+// ParallelTest performs an acceptance test on a resource, allowing concurrency
+// with other ParallelTest.
+//
+// Tests will fail if they do not properly handle conditions to allow multiple
+// tests to occur against the same resource or service (e.g. random naming).
+// All other requirements of the Test function also apply to this function.
+func ParallelTest(t TestT, c TestCase) {
+        t.Parallel()
+        Test(t, c)
+}
+
 // Test performs an acceptance test on a resource.
 //
 // Tests are not run unless an environmental variable "TF_ACC" is
@@ -366,7 +450,7 @@ func Test(t TestT, c TestCase) {
                 return
         }
 
-        logWriter, err := logging.LogOutput()
+        logWriter, err := LogOutput(t)
         if err != nil {
                 t.Error(fmt.Errorf("error setting up logging: %s", err))
         }
@@ -398,7 +482,18 @@ func Test(t TestT, c TestCase) {
         errored := false
         for i, step := range c.Steps {
                 var err error
-                log.Printf("[WARN] Test: Executing step %d", i)
+                log.Printf("[DEBUG] Test: Executing step %d", i)
+
+                if step.SkipFunc != nil {
+                        skip, err := step.SkipFunc()
+                        if err != nil {
+                                t.Fatal(err)
+                        }
+                        if skip {
+                                log.Printf("[WARN] Skipping step %d", i)
+                                continue
+                        }
+                }
 
                 if step.Config == "" && !step.ImportState {
                         err = fmt.Errorf(
@@ -418,6 +513,15 @@ func Test(t TestT, c TestCase) {
                         }
                 }
 
+                // If we expected an error, but did not get one, fail
+                if err == nil && step.ExpectError != nil {
+                        errored = true
+                        t.Error(fmt.Sprintf(
+                                "Step %d, no error received, but expected a match to:\n\n%s\n\n",
+                                i, step.ExpectError))
+                        break
+                }
+
                 // If there was an error, exit
                 if err != nil {
                         // Perhaps we expected an error? Check if it matches
@@ -485,6 +589,7 @@ func Test(t TestT, c TestCase) {
                         Config:                    lastStep.Config,
                         Check:                     c.CheckDestroy,
                         Destroy:                   true,
+                        PreventDiskCleanup:        lastStep.PreventDiskCleanup,
                         PreventPostDestroyRefresh: c.PreventPostDestroyRefresh,
                 }
 
@@ -593,18 +698,12 @@ func testIDOnlyRefresh(c TestCase, opts terraform.ContextOpts, step TestStep, r
         if err != nil {
                 return err
         }
-        if ws, es := ctx.Validate(); len(ws) > 0 || len(es) > 0 {
-                if len(es) > 0 {
-                        estrs := make([]string, len(es))
-                        for i, e := range es {
-                                estrs[i] = e.Error()
-                        }
-                        return fmt.Errorf(
-                                "Configuration is invalid.\n\nWarnings: %#v\n\nErrors: %#v",
-                                ws, estrs)
+        if diags := ctx.Validate(); len(diags) > 0 {
+                if diags.HasErrors() {
+                        return errwrap.Wrapf("config is invalid: {{err}}", diags.Err())
                 }
 
-                log.Printf("[WARN] Config warnings: %#v", ws)
+                log.Printf("[WARN] Config warnings:\n%s", diags.Err().Error())
         }
 
         // Refresh!
@@ -657,9 +756,7 @@ func testIDOnlyRefresh(c TestCase, opts terraform.ContextOpts, step TestStep, r
         return nil
 }
 
-func testModule(
-        opts terraform.ContextOpts,
-        step TestStep) (*module.Tree, error) {
+func testModule(opts terraform.ContextOpts, step TestStep) (*module.Tree, error) {
         if step.PreConfig != nil {
                 step.PreConfig()
         }
@@ -669,7 +766,12 @@ func testModule(
                 return nil, fmt.Errorf(
                         "Error creating temporary directory for config: %s", err)
         }
-        defer os.RemoveAll(cfgPath)
+
+        if step.PreventDiskCleanup {
+                log.Printf("[INFO] Skipping defer os.RemoveAll call")
+        } else {
+                defer os.RemoveAll(cfgPath)
+        }
 
         // Write the configuration
         cfgF, err := os.Create(filepath.Join(cfgPath, "main.tf"))
@@ -693,10 +795,11 @@ func testModule(
         }
 
         // Load the modules
-        modStorage := &getter.FolderStorage{
+        modStorage := &module.Storage{
                 StorageDir: filepath.Join(cfgPath, ".tfmodules"),
+                Mode:       module.GetModeGet,
         }
-        err = mod.Load(modStorage, module.GetModeGet)
+        err = mod.Load(modStorage)
         if err != nil {
                 return nil, fmt.Errorf("Error downloading modules: %s", err)
         }
@@ -771,12 +874,29 @@ func TestCheckResourceAttrSet(name, key string) TestCheckFunc {
                         return err
                 }
 
-                if val, ok := is.Attributes[key]; ok && val != "" {
-                        return nil
+                return testCheckResourceAttrSet(is, name, key)
+        }
+}
+
+// TestCheckModuleResourceAttrSet - as per TestCheckResourceAttrSet but with
+// support for non-root modules
+func TestCheckModuleResourceAttrSet(mp []string, name string, key string) TestCheckFunc {
+        return func(s *terraform.State) error {
+                is, err := modulePathPrimaryInstanceState(s, mp, name)
+                if err != nil {
+                        return err
                 }
 
+                return testCheckResourceAttrSet(is, name, key)
+        }
+}
+
+func testCheckResourceAttrSet(is *terraform.InstanceState, name string, key string) error {
+        if val, ok := is.Attributes[key]; !ok || val == "" {
                 return fmt.Errorf("%s: Attribute '%s' expected to be set", name, key)
         }
+
+        return nil
 }
 
 // TestCheckResourceAttr is a TestCheckFunc which validates
@@ -788,21 +908,37 @@ func TestCheckResourceAttr(name, key, value string) TestCheckFunc {
                         return err
                 }
 
-                if v, ok := is.Attributes[key]; !ok || v != value {
-                        if !ok {
-                                return fmt.Errorf("%s: Attribute '%s' not found", name, key)
-                        }
+                return testCheckResourceAttr(is, name, key, value)
+        }
+}
 
-                        return fmt.Errorf(
-                                "%s: Attribute '%s' expected %#v, got %#v",
-                                name,
-                                key,
-                                value,
-                                v)
+// TestCheckModuleResourceAttr - as per TestCheckResourceAttr but with
+// support for non-root modules
+func TestCheckModuleResourceAttr(mp []string, name string, key string, value string) TestCheckFunc {
+        return func(s *terraform.State) error {
+                is, err := modulePathPrimaryInstanceState(s, mp, name)
+                if err != nil {
+                        return err
                 }
 
-                return nil
+                return testCheckResourceAttr(is, name, key, value)
+        }
+}
+
+func testCheckResourceAttr(is *terraform.InstanceState, name string, key string, value string) error {
+        if v, ok := is.Attributes[key]; !ok || v != value {
+                if !ok {
+                        return fmt.Errorf("%s: Attribute '%s' not found", name, key)
+                }
+
+                return fmt.Errorf(
+                        "%s: Attribute '%s' expected %#v, got %#v",
+                        name,
+                        key,
+                        value,
+                        v)
         }
+        return nil
 }
 
 // TestCheckNoResourceAttr is a TestCheckFunc which ensures that
@@ -814,14 +950,31 @@ func TestCheckNoResourceAttr(name, key string) TestCheckFunc {
                         return err
                 }
 
-                if _, ok := is.Attributes[key]; ok {
-                        return fmt.Errorf("%s: Attribute '%s' found when not expected", name, key)
+                return testCheckNoResourceAttr(is, name, key)
+        }
+}
+
+// TestCheckModuleNoResourceAttr - as per TestCheckNoResourceAttr but with
+// support for non-root modules
+func TestCheckModuleNoResourceAttr(mp []string, name string, key string) TestCheckFunc {
+        return func(s *terraform.State) error {
+                is, err := modulePathPrimaryInstanceState(s, mp, name)
+                if err != nil {
+                        return err
                 }
 
-                return nil
+                return testCheckNoResourceAttr(is, name, key)
         }
 }
 
+func testCheckNoResourceAttr(is *terraform.InstanceState, name string, key string) error {
+        if _, ok := is.Attributes[key]; ok {
+                return fmt.Errorf("%s: Attribute '%s' found when not expected", name, key)
+        }
+
+        return nil
+}
+
 // TestMatchResourceAttr is a TestCheckFunc which checks that the value
 // in state for the given name/key combination matches the given regex.
 func TestMatchResourceAttr(name, key string, r *regexp.Regexp) TestCheckFunc {
@@ -831,17 +984,34 @@ func TestMatchResourceAttr(name, key string, r *regexp.Regexp) TestCheckFunc {
                         return err
                 }
 
-                if !r.MatchString(is.Attributes[key]) {
-                        return fmt.Errorf(
-                                "%s: Attribute '%s' didn't match %q, got %#v",
-                                name,
-                                key,
-                                r.String(),
-                                is.Attributes[key])
+                return testMatchResourceAttr(is, name, key, r)
+        }
+}
+
+// TestModuleMatchResourceAttr - as per TestMatchResourceAttr but with
+// support for non-root modules
+func TestModuleMatchResourceAttr(mp []string, name string, key string, r *regexp.Regexp) TestCheckFunc {
+        return func(s *terraform.State) error {
+                is, err := modulePathPrimaryInstanceState(s, mp, name)
+                if err != nil {
+                        return err
                 }
 
-                return nil
+                return testMatchResourceAttr(is, name, key, r)
+        }
+}
+
+func testMatchResourceAttr(is *terraform.InstanceState, name string, key string, r *regexp.Regexp) error {
+        if !r.MatchString(is.Attributes[key]) {
+                return fmt.Errorf(
+                        "%s: Attribute '%s' didn't match %q, got %#v",
+                        name,
+                        key,
+                        r.String(),
+                        is.Attributes[key])
         }
+
+        return nil
 }
 
 // TestCheckResourceAttrPtr is like TestCheckResourceAttr except the
@@ -853,6 +1023,14 @@ func TestCheckResourceAttrPtr(name string, key string, value *string) TestCheckF
         }
 }
 
+// TestCheckModuleResourceAttrPtr - as per TestCheckResourceAttrPtr but with
+// support for non-root modules
+func TestCheckModuleResourceAttrPtr(mp []string, name string, key string, value *string) TestCheckFunc {
+        return func(s *terraform.State) error {
+                return TestCheckModuleResourceAttr(mp, name, key, *value)(s)
+        }
+}
+
 // TestCheckResourceAttrPair is a TestCheckFunc which validates that the values
 // in state for a pair of name/key combinations are equal.
 func TestCheckResourceAttrPair(nameFirst, keyFirst, nameSecond, keySecond string) TestCheckFunc {
@@ -861,33 +1039,57 @@ func TestCheckResourceAttrPair(nameFirst, keyFirst, nameSecond, keySecond string
                 if err != nil {
                         return err
                 }
-                vFirst, ok := isFirst.Attributes[keyFirst]
-                if !ok {
-                        return fmt.Errorf("%s: Attribute '%s' not found", nameFirst, keyFirst)
-                }
 
                 isSecond, err := primaryInstanceState(s, nameSecond)
                 if err != nil {
                         return err
                 }
-                vSecond, ok := isSecond.Attributes[keySecond]
-                if !ok {
-                        return fmt.Errorf("%s: Attribute '%s' not found", nameSecond, keySecond)
+
+                return testCheckResourceAttrPair(isFirst, nameFirst, keyFirst, isSecond, nameSecond, keySecond)
+        }
+}
+
+// TestCheckModuleResourceAttrPair - as per TestCheckResourceAttrPair but with
+// support for non-root modules
+func TestCheckModuleResourceAttrPair(mpFirst []string, nameFirst string, keyFirst string, mpSecond []string, nameSecond string, keySecond string) TestCheckFunc {
+        return func(s *terraform.State) error {
+                isFirst, err := modulePathPrimaryInstanceState(s, mpFirst, nameFirst)
+                if err != nil {
+                        return err
                 }
 
-                if vFirst != vSecond {
-                        return fmt.Errorf(
-                                "%s: Attribute '%s' expected %#v, got %#v",
-                                nameFirst,
-                                keyFirst,
-                                vSecond,
-                                vFirst)
+                isSecond, err := modulePathPrimaryInstanceState(s, mpSecond, nameSecond)
+                if err != nil {
+                        return err
                 }
 
-                return nil
+                return testCheckResourceAttrPair(isFirst, nameFirst, keyFirst, isSecond, nameSecond, keySecond)
         }
 }
 
+func testCheckResourceAttrPair(isFirst *terraform.InstanceState, nameFirst string, keyFirst string, isSecond *terraform.InstanceState, nameSecond string, keySecond string) error {
+        vFirst, ok := isFirst.Attributes[keyFirst]
+        if !ok {
+                return fmt.Errorf("%s: Attribute '%s' not found", nameFirst, keyFirst)
+        }
+
+        vSecond, ok := isSecond.Attributes[keySecond]
+        if !ok {
+                return fmt.Errorf("%s: Attribute '%s' not found", nameSecond, keySecond)
+        }
+
+        if vFirst != vSecond {
+                return fmt.Errorf(
+                        "%s: Attribute '%s' expected %#v, got %#v",
+                        nameFirst,
+                        keyFirst,
+                        vSecond,
+                        vFirst)
+        }
+
+        return nil
+}
+
 // TestCheckOutput checks an output in the Terraform configuration
 func TestCheckOutput(name, value string) TestCheckFunc {
         return func(s *terraform.State) error {
@@ -936,23 +1138,43 @@ type TestT interface {
         Error(args ...interface{})
         Fatal(args ...interface{})
         Skip(args ...interface{})
+        Name() string
+        Parallel()
 }
 
 // This is set to true by unit tests to alter some behavior
 var testTesting = false
 
-// primaryInstanceState returns the primary instance state for the given resource name.
-func primaryInstanceState(s *terraform.State, name string) (*terraform.InstanceState, error) {
-        ms := s.RootModule()
+// modulePrimaryInstanceState returns the instance state for the given resource
+// name in a ModuleState
+func modulePrimaryInstanceState(s *terraform.State, ms *terraform.ModuleState, name string) (*terraform.InstanceState, error) {
         rs, ok := ms.Resources[name]
         if !ok {
-                return nil, fmt.Errorf("Not found: %s", name)
+                return nil, fmt.Errorf("Not found: %s in %s", name, ms.Path)
         }
 
         is := rs.Primary
         if is == nil {
-                return nil, fmt.Errorf("No primary instance: %s", name)
+                return nil, fmt.Errorf("No primary instance: %s in %s", name, ms.Path)
         }
 
         return is, nil
 }
+
+// modulePathPrimaryInstanceState returns the primary instance state for the
+// given resource name in a given module path.
+func modulePathPrimaryInstanceState(s *terraform.State, mp []string, name string) (*terraform.InstanceState, error) {
+        ms := s.ModuleByPath(mp)
+        if ms == nil {
+                return nil, fmt.Errorf("No module found at: %s", mp)
+        }
+
+        return modulePrimaryInstanceState(s, ms, name)
+}
+
+// primaryInstanceState returns the primary instance state for the given
+// resource name in the root module.
+func primaryInstanceState(s *terraform.State, name string) (*terraform.InstanceState, error) {
+        ms := s.RootModule()
+        return modulePrimaryInstanceState(s, ms, name)
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/testing_config.go b/vendor/github.com/hashicorp/terraform/helper/resource/testing_config.go
index 537a11c..033f126 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/testing_config.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/testing_config.go
@@ -1,10 +1,12 @@
 package resource
 
 import (
+        "errors"
         "fmt"
         "log"
         "strings"
 
+        "github.com/hashicorp/errwrap"
         "github.com/hashicorp/terraform/terraform"
 )
 
@@ -20,6 +22,14 @@ func testStep(
         opts terraform.ContextOpts,
         state *terraform.State,
         step TestStep) (*terraform.State, error) {
+        // Pre-taint any resources that have been defined in Taint, as long as this
+        // is not a destroy step.
+        if !step.Destroy {
+                if err := testStepTaint(state, step); err != nil {
+                        return state, err
+                }
+        }
+
         mod, err := testModule(opts, step)
         if err != nil {
                 return state, err
@@ -33,17 +43,12 @@ func testStep(
         if err != nil {
                 return state, fmt.Errorf("Error initializing context: %s", err)
         }
-        if ws, es := ctx.Validate(); len(ws) > 0 || len(es) > 0 {
-                if len(es) > 0 {
-                        estrs := make([]string, len(es))
-                        for i, e := range es {
-                                estrs[i] = e.Error()
-                        }
-                        return state, fmt.Errorf(
-                                "Configuration is invalid.\n\nWarnings: %#v\n\nErrors: %#v",
-                                ws, estrs)
+        if diags := ctx.Validate(); len(diags) > 0 {
+                if diags.HasErrors() {
+                        return nil, errwrap.Wrapf("config is invalid: {{err}}", diags.Err())
                 }
-                log.Printf("[WARN] Config warnings: %#v", ws)
+
+                log.Printf("[WARN] Config warnings:\n%s", diags)
         }
 
         // Refresh!
@@ -158,3 +163,19 @@ func testStep(
         // Made it here? Good job test step!
         return state, nil
 }
+
+func testStepTaint(state *terraform.State, step TestStep) error {
+        for _, p := range step.Taint {
+                m := state.RootModule()
+                if m == nil {
+                        return errors.New("no state")
+                }
+                rs, ok := m.Resources[p]
+                if !ok {
+                        return fmt.Errorf("resource %q not found in state", p)
+                }
+                log.Printf("[WARN] Test: Explicitly tainting resource %q", p)
+                rs.Taint()
+        }
+        return nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/testing_import_state.go b/vendor/github.com/hashicorp/terraform/helper/resource/testing_import_state.go
index 28ad105..94fef3c 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/testing_import_state.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/testing_import_state.go
@@ -16,15 +16,24 @@ func testStepImportState(
         state *terraform.State,
         step TestStep) (*terraform.State, error) {
         // Determine the ID to import
-        importId := step.ImportStateId
-        if importId == "" {
+        var importId string
+        switch {
+        case step.ImportStateIdFunc != nil:
+                var err error
+                importId, err = step.ImportStateIdFunc(state)
+                if err != nil {
+                        return state, err
+                }
+        case step.ImportStateId != "":
+                importId = step.ImportStateId
+        default:
                 resource, err := testResource(step, state)
                 if err != nil {
                         return state, err
                 }
-
                 importId = resource.Primary.ID
         }
+
         importPrefix := step.ImportStateIdPrefix
         if importPrefix != "" {
                 importId = fmt.Sprintf("%s%s", importPrefix, importId)
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/wait.go b/vendor/github.com/hashicorp/terraform/helper/resource/wait.go
index ca50e29..e56a515 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/wait.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/wait.go
@@ -74,7 +74,7 @@ func RetryableError(err error) *RetryError {
         return &RetryError{Err: err, Retryable: true}
 }
 
-// NonRetryableError is a helper to create a RetryError that's _not)_ retryable
+// NonRetryableError is a helper to create a RetryError that's _not_ retryable
 // from a given error.
 func NonRetryableError(err error) *RetryError {
         if err == nil {
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/backend.go b/vendor/github.com/hashicorp/terraform/helper/schema/backend.go
index a0729c0..57fbba7 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/backend.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/backend.go
@@ -65,7 +65,7 @@ func (b *Backend) Configure(c *terraform.ResourceConfig) error {
 
         // Get a ResourceData for this configuration. To do this, we actually
         // generate an intermediary "diff" although that is never exposed.
-        diff, err := sm.Diff(nil, c)
+        diff, err := sm.Diff(nil, c, nil, nil)
         if err != nil {
                 return err
         }
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/core_schema.go b/vendor/github.com/hashicorp/terraform/helper/schema/core_schema.go
new file mode 100644
index 0000000..bf952f6
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/core_schema.go
@@ -0,0 +1,155 @@
+package schema
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/terraform/config/configschema"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// The functions and methods in this file are concerned with the conversion
+// of this package's schema model into the slightly-lower-level schema model
+// used by Terraform core for configuration parsing.
+
+// CoreConfigSchema lowers the receiver to the schema model expected by
+// Terraform core.
+//
+// This lower-level model has fewer features than the schema in this package,
+// describing only the basic structure of configuration and state values we
+// expect. The full schemaMap from this package is still required for full
+// validation, handling of default values, etc.
+//
+// This method presumes a schema that passes InternalValidate, and so may
+// panic or produce an invalid result if given an invalid schemaMap.
+func (m schemaMap) CoreConfigSchema() *configschema.Block {
+        if len(m) == 0 {
+                // We return an actual (empty) object here, rather than a nil,
+                // because a nil result would mean that we don't have a schema at
+                // all, rather than that we have an empty one.
+                return &configschema.Block{}
+        }
+
+        ret := &configschema.Block{
+                Attributes: map[string]*configschema.Attribute{},
+                BlockTypes: map[string]*configschema.NestedBlock{},
+        }
+
+        for name, schema := range m {
+                if schema.Elem == nil {
+                        ret.Attributes[name] = schema.coreConfigSchemaAttribute()
+                        continue
+                }
+                switch schema.Elem.(type) {
+                case *Schema:
+                        ret.Attributes[name] = schema.coreConfigSchemaAttribute()
+                case *Resource:
+                        ret.BlockTypes[name] = schema.coreConfigSchemaBlock()
+                default:
+                        // Should never happen for a valid schema
+                        panic(fmt.Errorf("invalid Schema.Elem %#v; need *Schema or *Resource", schema.Elem))
+                }
+        }
+
+        return ret
+}
+
+// coreConfigSchemaAttribute prepares a configschema.Attribute representation
+// of a schema. This is appropriate only for primitives or collections whose
+// Elem is an instance of Schema. Use coreConfigSchemaBlock for collections
+// whose elem is a whole resource.
+func (s *Schema) coreConfigSchemaAttribute() *configschema.Attribute {
+        return &configschema.Attribute{
+                Type:      s.coreConfigSchemaType(),
+                Optional:  s.Optional,
+                Required:  s.Required,
+                Computed:  s.Computed,
+                Sensitive: s.Sensitive,
+        }
+}
+
+// coreConfigSchemaBlock prepares a configschema.NestedBlock representation of
+// a schema. This is appropriate only for collections whose Elem is an instance
+// of Resource, and will panic otherwise.
+func (s *Schema) coreConfigSchemaBlock() *configschema.NestedBlock {
+        ret := &configschema.NestedBlock{}
+        if nested := s.Elem.(*Resource).CoreConfigSchema(); nested != nil {
+                ret.Block = *nested
+        }
+        switch s.Type {
+        case TypeList:
+                ret.Nesting = configschema.NestingList
+        case TypeSet:
+                ret.Nesting = configschema.NestingSet
+        case TypeMap:
+                ret.Nesting = configschema.NestingMap
+        default:
+                // Should never happen for a valid schema
+                panic(fmt.Errorf("invalid s.Type %s for s.Elem being resource", s.Type))
+        }
+
+        ret.MinItems = s.MinItems
+        ret.MaxItems = s.MaxItems
+
+        if s.Required && s.MinItems == 0 {
+                // configschema doesn't have a "required" representation for nested
+                // blocks, but we can fake it by requiring at least one item.
+                ret.MinItems = 1
+        }
+
+        return ret
+}
+
+// coreConfigSchemaType determines the core config schema type that corresponds
+// to a particular schema's type.
+func (s *Schema) coreConfigSchemaType() cty.Type {
+        switch s.Type {
+        case TypeString:
+                return cty.String
+        case TypeBool:
+                return cty.Bool
+        case TypeInt, TypeFloat:
+                // configschema doesn't distinguish int and float, so helper/schema
+                // will deal with this as an additional validation step after
+                // configuration has been parsed and decoded.
+                return cty.Number
+        case TypeList, TypeSet, TypeMap:
+                var elemType cty.Type
+                switch set := s.Elem.(type) {
+                case *Schema:
+                        elemType = set.coreConfigSchemaType()
+                case *Resource:
+                        // In practice we don't actually use this for normal schema
+                        // construction because we construct a NestedBlock in that
+                        // case instead. See schemaMap.CoreConfigSchema.
+                        elemType = set.CoreConfigSchema().ImpliedType()
+                default:
+                        if set != nil {
+                                // Should never happen for a valid schema
+                                panic(fmt.Errorf("invalid Schema.Elem %#v; need *Schema or *Resource", s.Elem))
+                        }
+                        // Some pre-existing schemas assume string as default, so we need
+                        // to be compatible with them.
+                        elemType = cty.String
+                }
+                switch s.Type {
+                case TypeList:
+                        return cty.List(elemType)
+                case TypeSet:
+                        return cty.Set(elemType)
+                case TypeMap:
+                        return cty.Map(elemType)
+                default:
+                        // can never get here in practice, due to the case we're inside
+                        panic("invalid collection type")
+                }
+        default:
+                // should never happen for a valid schema
+                panic(fmt.Errorf("invalid Schema.Type %s", s.Type))
+        }
+}
+
+// CoreConfigSchema is a convenient shortcut for calling CoreConfigSchema
+// on the resource's schema.
+func (r *Resource) CoreConfigSchema() *configschema.Block {
+        return schemaMap(r.Schema).CoreConfigSchema()
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/data_source_resource_shim.go b/vendor/github.com/hashicorp/terraform/helper/schema/data_source_resource_shim.go
index 5a03d2d..8d93750 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/data_source_resource_shim.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/data_source_resource_shim.go
@@ -32,7 +32,7 @@ func DataSourceResourceShim(name string, dataSource *Resource) *Resource {
 
         // FIXME: Link to some further docs either on the website or in the
         // changelog, once such a thing exists.
-        dataSource.deprecationMessage = fmt.Sprintf(
+        dataSource.DeprecationMessage = fmt.Sprintf(
                 "using %s as a resource is deprecated; consider using the data source instead",
                 name,
         )
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader.go
index 1660a67..b80b223 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader.go
@@ -126,6 +126,8 @@ func addrToSchema(addr []string, schemaMap map[string]*Schema) []*Schema {
                                 switch v := current.Elem.(type) {
                                 case ValueType:
                                         current = &Schema{Type: v}
+                                case *Schema:
+                                        current, _ = current.Elem.(*Schema)
                                 default:
                                         // maps default to string values. This is all we can have
                                         // if this is nested in another list or map.
@@ -249,11 +251,10 @@ func readObjectField(
 }
 
 // convert map values to the proper primitive type based on schema.Elem
-func mapValuesToPrimitive(m map[string]interface{}, schema *Schema) error {
-
-        elemType := TypeString
-        if et, ok := schema.Elem.(ValueType); ok {
-                elemType = et
+func mapValuesToPrimitive(k string, m map[string]interface{}, schema *Schema) error {
+        elemType, err := getValueType(k, schema)
+        if err != nil {
+                return err
         }
 
         switch elemType {
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_config.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_config.go
index f958bbc..55a301d 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_config.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_config.go
@@ -206,7 +206,7 @@ func (r *ConfigFieldReader) readMap(k string, schema *Schema) (FieldReadResult,
                 panic(fmt.Sprintf("unknown type: %#v", mraw))
         }
 
-        err := mapValuesToPrimitive(result, schema)
+        err := mapValuesToPrimitive(k, result, schema)
         if err != nil {
                 return FieldReadResult{}, nil
         }
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_diff.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_diff.go
index 16bbae2..d558a5b 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_diff.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_diff.go
@@ -29,29 +29,59 @@ type DiffFieldReader struct {
         Diff   *terraform.InstanceDiff
         Source FieldReader
         Schema map[string]*Schema
+
+        // cache for memoizing ReadField calls.
+        cache map[string]cachedFieldReadResult
+}
+
+type cachedFieldReadResult struct {
+        val FieldReadResult
+        err error
 }
 
 func (r *DiffFieldReader) ReadField(address []string) (FieldReadResult, error) {
+        if r.cache == nil {
+                r.cache = make(map[string]cachedFieldReadResult)
+        }
+
+        // Create the cache key by joining around a value that isn't a valid part
+        // of an address. This assumes that the Source and Schema are not changed
+        // for the life of this DiffFieldReader.
+        cacheKey := strings.Join(address, "|")
+        if cached, ok := r.cache[cacheKey]; ok {
+                return cached.val, cached.err
+        }
+
         schemaList := addrToSchema(address, r.Schema)
         if len(schemaList) == 0 {
+                r.cache[cacheKey] = cachedFieldReadResult{}
                 return FieldReadResult{}, nil
         }
 
+        var res FieldReadResult
+        var err error
+
         schema := schemaList[len(schemaList)-1]
         switch schema.Type {
         case TypeBool, TypeInt, TypeFloat, TypeString:
-                return r.readPrimitive(address, schema)
+                res, err = r.readPrimitive(address, schema)
         case TypeList:
-                return readListField(r, address, schema)
+                res, err = readListField(r, address, schema)
         case TypeMap:
-                return r.readMap(address, schema)
+                res, err = r.readMap(address, schema)
         case TypeSet:
-                return r.readSet(address, schema)
+                res, err = r.readSet(address, schema)
         case typeObject:
-                return readObjectField(r, address, schema.Elem.(map[string]*Schema))
+                res, err = readObjectField(r, address, schema.Elem.(map[string]*Schema))
         default:
                 panic(fmt.Sprintf("Unknown type: %#v", schema.Type))
         }
+
+        r.cache[cacheKey] = cachedFieldReadResult{
+                val: res,
+                err: err,
+        }
+        return res, err
 }
 
 func (r *DiffFieldReader) readMap(
@@ -92,7 +122,8 @@ func (r *DiffFieldReader) readMap(
                 result[k] = v.New
         }
 
-        err = mapValuesToPrimitive(result, schema)
+        key := address[len(address)-1]
+        err = mapValuesToPrimitive(key, result, schema)
         if err != nil {
                 return FieldReadResult{}, nil
         }
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_map.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_map.go
index 9533981..054efe0 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_map.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_map.go
@@ -61,7 +61,7 @@ func (r *MapFieldReader) readMap(k string, schema *Schema) (FieldReadResult, err
                 return true
         })
 
-        err := mapValuesToPrimitive(result, schema)
+        err := mapValuesToPrimitive(k, result, schema)
         if err != nil {
                 return FieldReadResult{}, nil
         }
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_writer_map.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_writer_map.go
index 689ed8d..814c7ba 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_writer_map.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_writer_map.go
@@ -39,6 +39,19 @@ func (w *MapFieldWriter) unsafeWriteField(addr string, value string) {
         w.result[addr] = value
 }
 
+// clearTree clears a field and any sub-fields of the given address out of the
+// map. This should be used to reset some kind of complex structures (namely
+// sets) before writing to make sure that any conflicting data is removed (for
+// example, if the set was previously written to the writer's layer).
+func (w *MapFieldWriter) clearTree(addr []string) {
+        prefix := strings.Join(addr, ".") + "."
+        for k := range w.result {
+                if strings.HasPrefix(k, prefix) {
+                        delete(w.result, k)
+                }
+        }
+}
+
 func (w *MapFieldWriter) WriteField(addr []string, value interface{}) error {
         w.lock.Lock()
         defer w.lock.Unlock()
@@ -115,6 +128,14 @@ func (w *MapFieldWriter) setList(
                 return fmt.Errorf("%s: %s", k, err)
         }
 
+        // Wipe the set from the current writer prior to writing if it exists.
+        // Multiple writes to the same layer is a lot safer for lists than sets due
+        // to the fact that indexes are always deterministic and the length will
+        // always be updated with the current length on the last write, but making
+        // sure we have a clean namespace removes any chance for edge cases to pop up
+        // and ensures that the last write to the set is the correct value.
+        w.clearTree(addr)
+
         // Set the entire list.
         var err error
         for i, elem := range vs {
@@ -162,6 +183,10 @@ func (w *MapFieldWriter) setMap(
                 vs[mk.String()] = mv.Interface()
         }
 
+        // Wipe this address tree. The contents of the map should always reflect the
+        // last write made to it.
+        w.clearTree(addr)
+
         // Remove the pure key since we're setting the full map value
         delete(w.result, k)
 
@@ -308,6 +333,13 @@ func (w *MapFieldWriter) setSet(
                 value = s
         }
 
+        // Clear any keys that match the set address first. This is necessary because
+        // it's always possible and sometimes may be necessary to write to a certain
+        // writer layer more than once with different set data each time, which will
+        // lead to different keys being inserted, which can lead to determinism
+        // problems when the old data isn't wiped first.
+        w.clearTree(addr)
+
         for code, elem := range value.(*Set).m {
                 if err := w.set(append(addrCopy, code), elem); err != nil {
                         return err
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/getsource_string.go b/vendor/github.com/hashicorp/terraform/helper/schema/getsource_string.go
index 3a97629..38cd8c7 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/getsource_string.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/getsource_string.go
@@ -2,7 +2,7 @@
 
 package schema
 
-import "fmt"
+import "strconv"
 
 const (
         _getSource_name_0 = "getSourceStategetSourceConfig"
@@ -13,8 +13,6 @@ const (
 
 var (
         _getSource_index_0 = [...]uint8{0, 14, 29}
-        _getSource_index_1 = [...]uint8{0, 13}
-        _getSource_index_2 = [...]uint8{0, 12}
         _getSource_index_3 = [...]uint8{0, 18, 32}
 )
 
@@ -31,6 +29,6 @@ func (i getSource) String() string {
                 i -= 15
                 return _getSource_name_3[_getSource_index_3[i]:_getSource_index_3[i+1]]
         default:
-                return fmt.Sprintf("getSource(%d)", i)
+                return "getSource(" + strconv.FormatInt(int64(i), 10) + ")"
         }
 }
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/provider.go b/vendor/github.com/hashicorp/terraform/helper/schema/provider.go
index fb28b41..6cd325d 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/provider.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/provider.go
@@ -9,6 +9,7 @@ import (
 
         "github.com/hashicorp/go-multierror"
         "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/config/configschema"
         "github.com/hashicorp/terraform/terraform"
 )
 
@@ -58,7 +59,7 @@ type Provider struct {
 
         meta interface{}
 
-        // a mutex is required because TestReset can directly repalce the stopCtx
+        // a mutex is required because TestReset can directly replace the stopCtx
         stopMu        sync.Mutex
         stopCtx       context.Context
         stopCtxCancel context.CancelFunc
@@ -185,6 +186,29 @@ func (p *Provider) TestReset() error {
         return nil
 }
 
+// GetSchema implementation of terraform.ResourceProvider interface
+func (p *Provider) GetSchema(req *terraform.ProviderSchemaRequest) (*terraform.ProviderSchema, error) {
+        resourceTypes := map[string]*configschema.Block{}
+        dataSources := map[string]*configschema.Block{}
+
+        for _, name := range req.ResourceTypes {
+                if r, exists := p.ResourcesMap[name]; exists {
+                        resourceTypes[name] = r.CoreConfigSchema()
+                }
+        }
+        for _, name := range req.DataSources {
+                if r, exists := p.DataSourcesMap[name]; exists {
+                        dataSources[name] = r.CoreConfigSchema()
+                }
+        }
+
+        return &terraform.ProviderSchema{
+                Provider:      schemaMap(p.Schema).CoreConfigSchema(),
+                ResourceTypes: resourceTypes,
+                DataSources:   dataSources,
+        }, nil
+}
+
 // Input implementation of terraform.ResourceProvider interface.
 func (p *Provider) Input(
         input terraform.UIInput,
@@ -227,7 +251,7 @@ func (p *Provider) Configure(c *terraform.ResourceConfig) error {
 
         // Get a ResourceData for this configuration. To do this, we actually
         // generate an intermediary "diff" although that is never exposed.
-        diff, err := sm.Diff(nil, c)
+        diff, err := sm.Diff(nil, c, nil, p.meta)
         if err != nil {
                 return err
         }
@@ -269,7 +293,7 @@ func (p *Provider) Diff(
                 return nil, fmt.Errorf("unknown resource type: %s", info.Type)
         }
 
-        return r.Diff(s, c)
+        return r.Diff(s, c, p.meta)
 }
 
 // Refresh implementation of terraform.ResourceProvider interface.
@@ -305,6 +329,10 @@ func (p *Provider) Resources() []terraform.ResourceType {
                 result = append(result, terraform.ResourceType{
                         Name:       k,
                         Importable: resource.Importer != nil,
+
+                        // Indicates that a provider is compiled against a new enough
+                        // version of core to support the GetSchema method.
+                        SchemaAvailable: true,
                 })
         }
 
@@ -382,7 +410,7 @@ func (p *Provider) ReadDataDiff(
                 return nil, fmt.Errorf("unknown data source: %s", info.Type)
         }
 
-        return r.Diff(nil, c)
+        return r.Diff(nil, c, p.meta)
 }
 
 // RefreshData implementation of terraform.ResourceProvider interface.
@@ -410,6 +438,10 @@ func (p *Provider) DataSources() []terraform.DataSource {
         for _, k := range keys {
                 result = append(result, terraform.DataSource{
                         Name: k,
+
+                        // Indicates that a provider is compiled against a new enough
+                        // version of core to support the GetSchema method.
+                        SchemaAvailable: true,
                 })
         }
 
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/provisioner.go b/vendor/github.com/hashicorp/terraform/helper/schema/provisioner.go
index 476192e..a8d42db 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/provisioner.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/provisioner.go
@@ -146,7 +146,7 @@ func (p *Provisioner) Apply(
                 }
 
                 sm := schemaMap(p.ConnSchema)
-                diff, err := sm.Diff(nil, terraform.NewResourceConfig(c))
+                diff, err := sm.Diff(nil, terraform.NewResourceConfig(c), nil, nil)
                 if err != nil {
                         return err
                 }
@@ -160,7 +160,7 @@ func (p *Provisioner) Apply(
                 // Build the configuration data. Doing this requires making a "diff"
                 // even though that's never used. We use that just to get the correct types.
                 configMap := schemaMap(p.Schema)
-                diff, err := configMap.Diff(nil, c)
+                diff, err := configMap.Diff(nil, c, nil, nil)
                 if err != nil {
                         return err
                 }
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/resource.go b/vendor/github.com/hashicorp/terraform/helper/schema/resource.go
index ddba109..d3be2d6 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/resource.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/resource.go
@@ -85,6 +85,37 @@ type Resource struct {
         Delete DeleteFunc
         Exists ExistsFunc
 
+        // CustomizeDiff is a custom function for working with the diff that
+        // Terraform has created for this resource - it can be used to customize the
+        // diff that has been created, diff values not controlled by configuration,
+        // or even veto the diff altogether and abort the plan. It is passed a
+        // *ResourceDiff, a structure similar to ResourceData but lacking most write
+        // functions like Set, while introducing new functions that work with the
+        // diff such as SetNew, SetNewComputed, and ForceNew.
+        //
+        // The phases Terraform runs this in, and the state available via functions
+        // like Get and GetChange, are as follows:
+        //
+        //  * New resource: One run with no state
+        //  * Existing resource: One run with state
+        //   * Existing resource, forced new: One run with state (before ForceNew),
+        //     then one run without state (as if new resource)
+        //  * Tainted resource: No runs (custom diff logic is skipped)
+        //  * Destroy: No runs (standard diff logic is skipped on destroy diffs)
+        //
+        // This function needs to be resilient to support all scenarios.
+        //
+        // If this function needs to access external API resources, remember to flag
+        // the RequiresRefresh attribute mentioned below to ensure that
+        // -refresh=false is blocked when running plan or apply, as this means that
+        // this resource requires refresh-like behaviour to work effectively.
+        //
+        // For the most part, only computed fields can be customized by this
+        // function.
+        //
+        // This function is only allowed on regular resources (not data sources).
+        CustomizeDiff CustomizeDiffFunc
+
         // Importer is the ResourceImporter implementation for this resource.
         // If this is nil, then this resource does not support importing. If
         // this is non-nil, then it supports importing and ResourceImporter
@@ -93,9 +124,7 @@ type Resource struct {
         Importer *ResourceImporter
 
         // If non-empty, this string is emitted as a warning during Validate.
-        // This is a private interface for now, for use by DataSourceResourceShim,
-        // and not for general use. (But maybe later...)
-        deprecationMessage string
+        DeprecationMessage string
 
         // Timeouts allow users to specify specific time durations in which an
         // operation should time out, to allow them to extend an action to suit their
@@ -126,6 +155,9 @@ type ExistsFunc func(*ResourceData, interface{}) (bool, error)
 type StateMigrateFunc func(
         int, *terraform.InstanceState, interface{}) (*terraform.InstanceState, error)
 
+// See Resource documentation.
+type CustomizeDiffFunc func(*ResourceDiff, interface{}) error
+
 // Apply creates, updates, and/or deletes a resource.
 func (r *Resource) Apply(
         s *terraform.InstanceState,
@@ -202,11 +234,11 @@ func (r *Resource) Apply(
         return r.recordCurrentSchemaVersion(data.State()), err
 }
 
-// Diff returns a diff of this resource and is API compatible with the
-// ResourceProvider interface.
+// Diff returns a diff of this resource.
 func (r *Resource) Diff(
         s *terraform.InstanceState,
-        c *terraform.ResourceConfig) (*terraform.InstanceDiff, error) {
+        c *terraform.ResourceConfig,
+        meta interface{}) (*terraform.InstanceDiff, error) {
 
         t := &ResourceTimeout{}
         err := t.ConfigDecode(r, c)
@@ -215,7 +247,7 @@ func (r *Resource) Diff(
                 return nil, fmt.Errorf("[ERR] Error decoding timeout: %s", err)
         }
 
-        instanceDiff, err := schemaMap(r.Schema).Diff(s, c)
+        instanceDiff, err := schemaMap(r.Schema).Diff(s, c, r.CustomizeDiff, meta)
         if err != nil {
                 return instanceDiff, err
         }
@@ -235,8 +267,8 @@ func (r *Resource) Diff(
 func (r *Resource) Validate(c *terraform.ResourceConfig) ([]string, []error) {
         warns, errs := schemaMap(r.Schema).Validate(c)
 
-        if r.deprecationMessage != "" {
-                warns = append(warns, r.deprecationMessage)
+        if r.DeprecationMessage != "" {
+                warns = append(warns, r.DeprecationMessage)
         }
 
         return warns, errs
@@ -248,7 +280,6 @@ func (r *Resource) ReadDataApply(
         d *terraform.InstanceDiff,
         meta interface{},
 ) (*terraform.InstanceState, error) {
-
         // Data sources are always built completely from scratch
         // on each read, so the source state is always nil.
         data, err := schemaMap(r.Schema).Data(nil, d)
@@ -346,6 +377,11 @@ func (r *Resource) InternalValidate(topSchemaMap schemaMap, writable bool) error
                 if r.Create != nil || r.Update != nil || r.Delete != nil {
                         return fmt.Errorf("must not implement Create, Update or Delete")
                 }
+
+                // CustomizeDiff cannot be defined for read-only resources
+                if r.CustomizeDiff != nil {
+                        return fmt.Errorf("cannot implement CustomizeDiff")
+                }
         }
 
         tsm := topSchemaMap
@@ -393,19 +429,43 @@ func (r *Resource) InternalValidate(topSchemaMap schemaMap, writable bool) error
                                 return err
                         }
                 }
+
+                for k, f := range tsm {
+                        if isReservedResourceFieldName(k, f) {
+                                return fmt.Errorf("%s is a reserved field name", k)
+                        }
+                }
         }
 
-        // Resource-specific checks
-        for k, _ := range tsm {
-                if isReservedResourceFieldName(k) {
-                        return fmt.Errorf("%s is a reserved field name for a resource", k)
+        // Data source
+        if r.isTopLevel() && !writable {
+                tsm = schemaMap(r.Schema)
+                for k, _ := range tsm {
+                        if isReservedDataSourceFieldName(k) {
+                                return fmt.Errorf("%s is a reserved field name", k)
+                        }
                 }
         }
 
         return schemaMap(r.Schema).InternalValidate(tsm)
 }
 
-func isReservedResourceFieldName(name string) bool {
+func isReservedDataSourceFieldName(name string) bool {
+        for _, reservedName := range config.ReservedDataSourceFields {
+                if name == reservedName {
+                        return true
+                }
+        }
+        return false
+}
+
+func isReservedResourceFieldName(name string, s *Schema) bool {
+        // Allow phasing out "id"
+        // See https://github.com/terraform-providers/terraform-provider-aws/pull/1626#issuecomment-328881415
+        if name == "id" && (s.Deprecated != "" || s.Removed != "") {
+                return false
+        }
+
         for _, reservedName := range config.ReservedResourceFields {
                 if name == reservedName {
                         return true
@@ -430,6 +490,12 @@ func (r *Resource) Data(s *terraform.InstanceState) *ResourceData {
                 panic(err)
         }
 
+        // load the Resource timeouts
+        result.timeouts = r.Timeouts
+        if result.timeouts == nil {
+                result.timeouts = &ResourceTimeout{}
+        }
+
         // Set the schema version to latest by default
         result.meta = map[string]interface{}{
                 "schema_version": strconv.Itoa(r.SchemaVersion),
@@ -450,7 +516,7 @@ func (r *Resource) TestResourceData() *ResourceData {
 // Returns true if the resource is "top level" i.e. not a sub-resource.
 func (r *Resource) isTopLevel() bool {
         // TODO: This is a heuristic; replace with a definitive attribute?
-        return r.Create != nil
+        return (r.Create != nil || r.Read != nil)
 }
 
 // Determines if a given InstanceState needs to be migrated by checking the
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/resource_data.go b/vendor/github.com/hashicorp/terraform/helper/schema/resource_data.go
index b2bc8f6..6cc01ee 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/resource_data.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/resource_data.go
@@ -35,6 +35,8 @@ type ResourceData struct {
         partialMap  map[string]struct{}
         once        sync.Once
         isNew       bool
+
+        panicOnError bool
 }
 
 // getResult is the internal structure that is generated when a Get
@@ -104,6 +106,22 @@ func (d *ResourceData) GetOk(key string) (interface{}, bool) {
         return r.Value, exists
 }
 
+// GetOkExists returns the data for a given key and whether or not the key
+// has been set to a non-zero value. This is only useful for determining
+// if boolean attributes have been set, if they are Optional but do not
+// have a Default value.
+//
+// This is nearly the same function as GetOk, yet it does not check
+// for the zero value of the attribute's type. This allows for attributes
+// without a default, to fully check for a literal assignment, regardless
+// of the zero-value for that type.
+// This should only be used if absolutely required/needed.
+func (d *ResourceData) GetOkExists(key string) (interface{}, bool) {
+        r := d.getRaw(key, getSourceSet)
+        exists := r.Exists && !r.Computed
+        return r.Value, exists
+}
+
 func (d *ResourceData) getRaw(key string, level getSource) getResult {
         var parts []string
         if key != "" {
@@ -168,7 +186,11 @@ func (d *ResourceData) Set(key string, value interface{}) error {
                 }
         }
 
-        return d.setWriter.WriteField(strings.Split(key, "."), value)
+        err := d.setWriter.WriteField(strings.Split(key, "."), value)
+        if err != nil && d.panicOnError {
+                panic(err)
+        }
+        return err
 }
 
 // SetPartial adds the key to the final state output while
@@ -293,6 +315,7 @@ func (d *ResourceData) State() *terraform.InstanceState {
 
         mapW := &MapFieldWriter{Schema: d.schema}
         if err := mapW.WriteField(nil, rawMap); err != nil {
+                log.Printf("[ERR] Error writing fields: %s", err)
                 return nil
         }
 
@@ -344,6 +367,13 @@ func (d *ResourceData) State() *terraform.InstanceState {
 func (d *ResourceData) Timeout(key string) time.Duration {
         key = strings.ToLower(key)
 
+        // System default of 20 minutes
+        defaultTimeout := 20 * time.Minute
+
+        if d.timeouts == nil {
+                return defaultTimeout
+        }
+
         var timeout *time.Duration
         switch key {
         case TimeoutCreate:
@@ -364,8 +394,7 @@ func (d *ResourceData) Timeout(key string) time.Duration {
                 return *d.timeouts.Default
         }
 
-        // Return system default of 20 minutes
-        return 20 * time.Minute
+        return defaultTimeout
 }
 
 func (d *ResourceData) init() {
@@ -423,7 +452,7 @@ func (d *ResourceData) init() {
 }
 
 func (d *ResourceData) diffChange(
-        k string) (interface{}, interface{}, bool, bool) {
+        k string) (interface{}, interface{}, bool, bool, bool) {
         // Get the change between the state and the config.
         o, n := d.getChange(k, getSourceState, getSourceConfig|getSourceExact)
         if !o.Exists {
@@ -434,7 +463,7 @@ func (d *ResourceData) diffChange(
         }
 
         // Return the old, new, and whether there is a change
-        return o.Value, n.Value, !reflect.DeepEqual(o.Value, n.Value), n.Computed
+        return o.Value, n.Value, !reflect.DeepEqual(o.Value, n.Value), n.Computed, false
 }
 
 func (d *ResourceData) getChange(
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/resource_diff.go b/vendor/github.com/hashicorp/terraform/helper/schema/resource_diff.go
new file mode 100644
index 0000000..7db3dec
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/resource_diff.go
@@ -0,0 +1,559 @@
+package schema
+
+import (
+        "errors"
+        "fmt"
+        "reflect"
+        "strings"
+        "sync"
+
+        "github.com/hashicorp/terraform/terraform"
+)
+
+// newValueWriter is a minor re-implementation of MapFieldWriter to include
+// keys that should be marked as computed, to represent the new part of a
+// pseudo-diff.
+type newValueWriter struct {
+        *MapFieldWriter
+
+        // A list of keys that should be marked as computed.
+        computedKeys map[string]bool
+
+        // A lock to prevent races on writes. The underlying writer will have one as
+        // well - this is for computed keys.
+        lock sync.Mutex
+
+        // To be used with init.
+        once sync.Once
+}
+
+// init performs any initialization tasks for the newValueWriter.
+func (w *newValueWriter) init() {
+        if w.computedKeys == nil {
+                w.computedKeys = make(map[string]bool)
+        }
+}
+
+// WriteField overrides MapValueWriter's WriteField, adding the ability to flag
+// the address as computed.
+func (w *newValueWriter) WriteField(address []string, value interface{}, computed bool) error {
+        // Fail the write if we have a non-nil value and computed is true.
+        // NewComputed values should not have a value when written.
+        if value != nil && computed {
+                return errors.New("Non-nil value with computed set")
+        }
+
+        if err := w.MapFieldWriter.WriteField(address, value); err != nil {
+                return err
+        }
+
+        w.once.Do(w.init)
+
+        w.lock.Lock()
+        defer w.lock.Unlock()
+        if computed {
+                w.computedKeys[strings.Join(address, ".")] = true
+        }
+        return nil
+}
+
+// ComputedKeysMap returns the underlying computed keys map.
+func (w *newValueWriter) ComputedKeysMap() map[string]bool {
+        w.once.Do(w.init)
+        return w.computedKeys
+}
+
+// newValueReader is a minor re-implementation of MapFieldReader and is the
+// read counterpart to MapValueWriter, allowing the read of keys flagged as
+// computed to accommodate the diff override logic in ResourceDiff.
+type newValueReader struct {
+        *MapFieldReader
+
+        // The list of computed keys from a newValueWriter.
+        computedKeys map[string]bool
+}
+
+// ReadField reads the values from the underlying writer, returning the
+// computed value if it is found as well.
+func (r *newValueReader) ReadField(address []string) (FieldReadResult, error) {
+        addrKey := strings.Join(address, ".")
+        v, err := r.MapFieldReader.ReadField(address)
+        if err != nil {
+                return FieldReadResult{}, err
+        }
+        for computedKey := range r.computedKeys {
+                if childAddrOf(addrKey, computedKey) {
+                        if strings.HasSuffix(addrKey, ".#") {
+                                // This is a count value for a list or set that has been marked as
+                                // computed, or a sub-list/sub-set of a complex resource that has
+                                // been marked as computed.  We need to pass through to other readers
+                                // so that an accurate previous count can be fetched for the diff.
+                                v.Exists = false
+                        }
+                        v.Computed = true
+                }
+        }
+
+        return v, nil
+}
+
+// ResourceDiff is used to query and make custom changes to an in-flight diff.
+// It can be used to veto particular changes in the diff, customize the diff
+// that has been created, or diff values not controlled by config.
+//
+// The object functions similar to ResourceData, however most notably lacks
+// Set, SetPartial, and Partial, as it should be used to change diff values
+// only.  Most other first-class ResourceData functions exist, namely Get,
+// GetOk, HasChange, and GetChange exist.
+//
+// All functions in ResourceDiff, save for ForceNew, can only be used on
+// computed fields.
+type ResourceDiff struct {
+        // The schema for the resource being worked on.
+        schema map[string]*Schema
+
+        // The current config for this resource.
+        config *terraform.ResourceConfig
+
+        // The state for this resource as it exists post-refresh, after the initial
+        // diff.
+        state *terraform.InstanceState
+
+        // The diff created by Terraform. This diff is used, along with state,
+        // config, and custom-set diff data, to provide a multi-level reader
+        // experience similar to ResourceData.
+        diff *terraform.InstanceDiff
+
+        // The internal reader structure that contains the state, config, the default
+        // diff, and the new diff.
+        multiReader *MultiLevelFieldReader
+
+        // A writer that writes overridden new fields.
+        newWriter *newValueWriter
+
+        // Tracks which keys have been updated by ResourceDiff to ensure that the
+        // diff does not get re-run on keys that were not touched, or diffs that were
+        // just removed (re-running on the latter would just roll back the removal).
+        updatedKeys map[string]bool
+
+        // Tracks which keys were flagged as forceNew. These keys are not saved in
+        // newWriter, but we need to track them so that they can be re-diffed later.
+        forcedNewKeys map[string]bool
+}
+
+// newResourceDiff creates a new ResourceDiff instance.
+func newResourceDiff(schema map[string]*Schema, config *terraform.ResourceConfig, state *terraform.InstanceState, diff *terraform.InstanceDiff) *ResourceDiff {
+        d := &ResourceDiff{
+                config: config,
+                state:  state,
+                diff:   diff,
+                schema: schema,
+        }
+
+        d.newWriter = &newValueWriter{
+                MapFieldWriter: &MapFieldWriter{Schema: d.schema},
+        }
+        readers := make(map[string]FieldReader)
+        var stateAttributes map[string]string
+        if d.state != nil {
+                stateAttributes = d.state.Attributes
+                readers["state"] = &MapFieldReader{
+                        Schema: d.schema,
+                        Map:    BasicMapReader(stateAttributes),
+                }
+        }
+        if d.config != nil {
+                readers["config"] = &ConfigFieldReader{
+                        Schema: d.schema,
+                        Config: d.config,
+                }
+        }
+        if d.diff != nil {
+                readers["diff"] = &DiffFieldReader{
+                        Schema: d.schema,
+                        Diff:   d.diff,
+                        Source: &MultiLevelFieldReader{
+                                Levels:  []string{"state", "config"},
+                                Readers: readers,
+                        },
+                }
+        }
+        readers["newDiff"] = &newValueReader{
+                MapFieldReader: &MapFieldReader{
+                        Schema: d.schema,
+                        Map:    BasicMapReader(d.newWriter.Map()),
+                },
+                computedKeys: d.newWriter.ComputedKeysMap(),
+        }
+        d.multiReader = &MultiLevelFieldReader{
+                Levels: []string{
+                        "state",
+                        "config",
+                        "diff",
+                        "newDiff",
+                },
+
+                Readers: readers,
+        }
+
+        d.updatedKeys = make(map[string]bool)
+        d.forcedNewKeys = make(map[string]bool)
+
+        return d
+}
+
+// UpdatedKeys returns the keys that were updated by this ResourceDiff run.
+// These are the only keys that a diff should be re-calculated for.
+//
+// This is the combined result of both keys for which diff values were updated
+// for or cleared, and also keys that were flagged to be re-diffed as a result
+// of ForceNew.
+func (d *ResourceDiff) UpdatedKeys() []string {
+        var s []string
+        for k := range d.updatedKeys {
+                s = append(s, k)
+        }
+        for k := range d.forcedNewKeys {
+                for _, l := range s {
+                        if k == l {
+                                break
+                        }
+                }
+                s = append(s, k)
+        }
+        return s
+}
+
+// Clear wipes the diff for a particular key. It is called by ResourceDiff's
+// functionality to remove any possibility of conflicts, but can be called on
+// its own to just remove a specific key from the diff completely.
+//
+// Note that this does not wipe an override. This function is only allowed on
+// computed keys.
+func (d *ResourceDiff) Clear(key string) error {
+        if err := d.checkKey(key, "Clear", true); err != nil {
+                return err
+        }
+
+        return d.clear(key)
+}
+
+func (d *ResourceDiff) clear(key string) error {
+        // Check the schema to make sure that this key exists first.
+        schemaL := addrToSchema(strings.Split(key, "."), d.schema)
+        if len(schemaL) == 0 {
+                return fmt.Errorf("%s is not a valid key", key)
+        }
+
+        for k := range d.diff.Attributes {
+                if strings.HasPrefix(k, key) {
+                        delete(d.diff.Attributes, k)
+                }
+        }
+        return nil
+}
+
+// GetChangedKeysPrefix helps to implement Resource.CustomizeDiff
+// where we need to act on all nested fields
+// without calling out each one separately
+func (d *ResourceDiff) GetChangedKeysPrefix(prefix string) []string {
+        keys := make([]string, 0)
+        for k := range d.diff.Attributes {
+                if strings.HasPrefix(k, prefix) {
+                        keys = append(keys, k)
+                }
+        }
+        return keys
+}
+
+// diffChange helps to implement resourceDiffer and derives its change values
+// from ResourceDiff's own change data, in addition to existing diff, config, and state.
+func (d *ResourceDiff) diffChange(key string) (interface{}, interface{}, bool, bool, bool) {
+        old, new, customized := d.getChange(key)
+
+        if !old.Exists {
+                old.Value = nil
+        }
+        if !new.Exists || d.removed(key) {
+                new.Value = nil
+        }
+
+        return old.Value, new.Value, !reflect.DeepEqual(old.Value, new.Value), new.Computed, customized
+}
+
+// SetNew is used to set a new diff value for the mentioned key. The value must
+// be correct for the attribute's schema (mostly relevant for maps, lists, and
+// sets). The original value from the state is used as the old value.
+//
+// This function is only allowed on computed attributes.
+func (d *ResourceDiff) SetNew(key string, value interface{}) error {
+        if err := d.checkKey(key, "SetNew", false); err != nil {
+                return err
+        }
+
+        return d.setDiff(key, value, false)
+}
+
+// SetNewComputed functions like SetNew, except that it blanks out a new value
+// and marks it as computed.
+//
+// This function is only allowed on computed attributes.
+func (d *ResourceDiff) SetNewComputed(key string) error {
+        if err := d.checkKey(key, "SetNewComputed", false); err != nil {
+                return err
+        }
+
+        return d.setDiff(key, nil, true)
+}
+
+// setDiff performs common diff setting behaviour.
+func (d *ResourceDiff) setDiff(key string, new interface{}, computed bool) error {
+        if err := d.clear(key); err != nil {
+                return err
+        }
+
+        if err := d.newWriter.WriteField(strings.Split(key, "."), new, computed); err != nil {
+                return fmt.Errorf("Cannot set new diff value for key %s: %s", key, err)
+        }
+
+        d.updatedKeys[key] = true
+
+        return nil
+}
+
+// ForceNew force-flags ForceNew in the schema for a specific key, and
+// re-calculates its diff, effectively causing this attribute to force a new
+// resource.
+//
+// Keep in mind that forcing a new resource will force a second run of the
+// resource's CustomizeDiff function (with a new ResourceDiff) once the current
+// one has completed. This second run is performed without state. This behavior
+// will be the same as if a new resource is being created and is performed to
+// ensure that the diff looks like the diff for a new resource as much as
+// possible. CustomizeDiff should expect such a scenario and act correctly.
+//
+// This function is a no-op/error if there is no diff.
+//
+// Note that the change to schema is permanent for the lifecycle of this
+// specific ResourceDiff instance.
+func (d *ResourceDiff) ForceNew(key string) error {
+        if !d.HasChange(key) {
+                return fmt.Errorf("ForceNew: No changes for %s", key)
+        }
+
+        keyParts := strings.Split(key, ".")
+        var schema *Schema
+        schemaL := addrToSchema(keyParts, d.schema)
+        if len(schemaL) > 0 {
+                schema = schemaL[len(schemaL)-1]
+        } else {
+                return fmt.Errorf("ForceNew: %s is not a valid key", key)
+        }
+
+        schema.ForceNew = true
+
+        // Flag this for a re-diff. Don't save any values to guarantee that existing
+        // diffs aren't messed with, as this gets messy when dealing with complex
+        // structures, zero values, etc.
+        d.forcedNewKeys[keyParts[0]] = true
+
+        return nil
+}
+
+// Get hands off to ResourceData.Get.
+func (d *ResourceDiff) Get(key string) interface{} {
+        r, _ := d.GetOk(key)
+        return r
+}
+
+// GetChange gets the change between the state and diff, checking first to see
+// if a overridden diff exists.
+//
+// This implementation differs from ResourceData's in the way that we first get
+// results from the exact levels for the new diff, then from state and diff as
+// per normal.
+func (d *ResourceDiff) GetChange(key string) (interface{}, interface{}) {
+        old, new, _ := d.getChange(key)
+        return old.Value, new.Value
+}
+
+// GetOk functions the same way as ResourceData.GetOk, but it also checks the
+// new diff levels to provide data consistent with the current state of the
+// customized diff.
+func (d *ResourceDiff) GetOk(key string) (interface{}, bool) {
+        r := d.get(strings.Split(key, "."), "newDiff")
+        exists := r.Exists && !r.Computed
+        if exists {
+                // If it exists, we also want to verify it is not the zero-value.
+                value := r.Value
+                zero := r.Schema.Type.Zero()
+
+                if eq, ok := value.(Equal); ok {
+                        exists = !eq.Equal(zero)
+                } else {
+                        exists = !reflect.DeepEqual(value, zero)
+                }
+        }
+
+        return r.Value, exists
+}
+
+// GetOkExists functions the same way as GetOkExists within ResourceData, but
+// it also checks the new diff levels to provide data consistent with the
+// current state of the customized diff.
+//
+// This is nearly the same function as GetOk, yet it does not check
+// for the zero value of the attribute's type. This allows for attributes
+// without a default, to fully check for a literal assignment, regardless
+// of the zero-value for that type.
+func (d *ResourceDiff) GetOkExists(key string) (interface{}, bool) {
+        r := d.get(strings.Split(key, "."), "newDiff")
+        exists := r.Exists && !r.Computed
+        return r.Value, exists
+}
+
+// NewValueKnown returns true if the new value for the given key is available
+// as its final value at diff time. If the return value is false, this means
+// either the value is based of interpolation that was unavailable at diff
+// time, or that the value was explicitly marked as computed by SetNewComputed.
+func (d *ResourceDiff) NewValueKnown(key string) bool {
+        r := d.get(strings.Split(key, "."), "newDiff")
+        return !r.Computed
+}
+
+// HasChange checks to see if there is a change between state and the diff, or
+// in the overridden diff.
+func (d *ResourceDiff) HasChange(key string) bool {
+        old, new := d.GetChange(key)
+
+        // If the type implements the Equal interface, then call that
+        // instead of just doing a reflect.DeepEqual. An example where this is
+        // needed is *Set
+        if eq, ok := old.(Equal); ok {
+                return !eq.Equal(new)
+        }
+
+        return !reflect.DeepEqual(old, new)
+}
+
+// Id returns the ID of this resource.
+//
+// Note that technically, ID does not change during diffs (it either has
+// already changed in the refresh, or will change on update), hence we do not
+// support updating the ID or fetching it from anything else other than state.
+func (d *ResourceDiff) Id() string {
+        var result string
+
+        if d.state != nil {
+                result = d.state.ID
+        }
+        return result
+}
+
+// getChange gets values from two different levels, designed for use in
+// diffChange, HasChange, and GetChange.
+//
+// This implementation differs from ResourceData's in the way that we first get
+// results from the exact levels for the new diff, then from state and diff as
+// per normal.
+func (d *ResourceDiff) getChange(key string) (getResult, getResult, bool) {
+        old := d.get(strings.Split(key, "."), "state")
+        var new getResult
+        for p := range d.updatedKeys {
+                if childAddrOf(key, p) {
+                        new = d.getExact(strings.Split(key, "."), "newDiff")
+                        return old, new, true
+                }
+        }
+        new = d.get(strings.Split(key, "."), "newDiff")
+        return old, new, false
+}
+
+// removed checks to see if the key is present in the existing, pre-customized
+// diff and if it was marked as NewRemoved.
+func (d *ResourceDiff) removed(k string) bool {
+        diff, ok := d.diff.Attributes[k]
+        if !ok {
+                return false
+        }
+        return diff.NewRemoved
+}
+
+// get performs the appropriate multi-level reader logic for ResourceDiff,
+// starting at source. Refer to newResourceDiff for the level order.
+func (d *ResourceDiff) get(addr []string, source string) getResult {
+        result, err := d.multiReader.ReadFieldMerge(addr, source)
+        if err != nil {
+                panic(err)
+        }
+
+        return d.finalizeResult(addr, result)
+}
+
+// getExact gets an attribute from the exact level referenced by source.
+func (d *ResourceDiff) getExact(addr []string, source string) getResult {
+        result, err := d.multiReader.ReadFieldExact(addr, source)
+        if err != nil {
+                panic(err)
+        }
+
+        return d.finalizeResult(addr, result)
+}
+
+// finalizeResult does some post-processing of the result produced by get and getExact.
+func (d *ResourceDiff) finalizeResult(addr []string, result FieldReadResult) getResult {
+        // If the result doesn't exist, then we set the value to the zero value
+        var schema *Schema
+        if schemaL := addrToSchema(addr, d.schema); len(schemaL) > 0 {
+                schema = schemaL[len(schemaL)-1]
+        }
+
+        if result.Value == nil && schema != nil {
+                result.Value = result.ValueOrZero(schema)
+        }
+
+        // Transform the FieldReadResult into a getResult. It might be worth
+        // merging these two structures one day.
+        return getResult{
+                Value:          result.Value,
+                ValueProcessed: result.ValueProcessed,
+                Computed:       result.Computed,
+                Exists:         result.Exists,
+                Schema:         schema,
+        }
+}
+
+// childAddrOf does a comparison of two addresses to see if one is the child of
+// the other.
+func childAddrOf(child, parent string) bool {
+        cs := strings.Split(child, ".")
+        ps := strings.Split(parent, ".")
+        if len(ps) > len(cs) {
+                return false
+        }
+        return reflect.DeepEqual(ps, cs[:len(ps)])
+}
+
+// checkKey checks the key to make sure it exists and is computed.
+func (d *ResourceDiff) checkKey(key, caller string, nested bool) error {
+        var schema *Schema
+        if nested {
+                keyParts := strings.Split(key, ".")
+                schemaL := addrToSchema(keyParts, d.schema)
+                if len(schemaL) > 0 {
+                        schema = schemaL[len(schemaL)-1]
+                }
+        } else {
+                s, ok := d.schema[key]
+                if ok {
+                        schema = s
+                }
+        }
+        if schema == nil {
+                return fmt.Errorf("%s: invalid key: %s", caller, key)
+        }
+        if !schema.Computed {
+                return fmt.Errorf("%s only operates on computed keys - %s is not one", caller, key)
+        }
+        return nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/schema.go b/vendor/github.com/hashicorp/terraform/helper/schema/schema.go
index acb5618..0ea5aad 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/schema.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/schema.go
@@ -21,9 +21,13 @@ import (
         "strings"
 
         "github.com/hashicorp/terraform/terraform"
+        "github.com/mitchellh/copystructure"
         "github.com/mitchellh/mapstructure"
 )
 
+// Name of ENV variable which (if not empty) prefers panic over error
+const PanicOnErr = "TF_SCHEMA_PANIC_ON_ERROR"
+
 // type used for schema package context keys
 type contextKey string
 
@@ -116,12 +120,16 @@ type Schema struct {
         ForceNew  bool
         StateFunc SchemaStateFunc
 
-        // The following fields are only set for a TypeList or TypeSet Type.
+        // The following fields are only set for a TypeList, TypeSet, or TypeMap.
         //
-        // Elem must be either a *Schema or a *Resource only if the Type is
-        // TypeList, and represents what the element type is. If it is *Schema,
-        // the element type is just a simple value. If it is *Resource, the
-        // element type is a complex structure, potentially with its own lifecycle.
+        // Elem represents the element type. For a TypeMap, it must be a *Schema
+        // with a Type of TypeString, otherwise it may be either a *Schema or a
+        // *Resource. If it is *Schema, the element type is just a simple value.
+        // If it is *Resource, the element type is a complex structure,
+        // potentially with its own lifecycle.
+        Elem interface{}
+
+        // The following fields are only set for a TypeList or TypeSet.
         //
         // MaxItems defines a maximum amount of items that can exist within a
         // TypeSet or TypeList. Specific use cases would be if a TypeSet is being
@@ -138,7 +146,6 @@ type Schema struct {
         // ["foo"] automatically. This is primarily for legacy reasons and the
         // ambiguity is not recommended for new usage. Promotion is only allowed
         // for primitive element types.
-        Elem          interface{}
         MaxItems      int
         MinItems      int
         PromoteSingle bool
@@ -192,7 +199,7 @@ type Schema struct {
         Sensitive bool
 }
 
-// SchemaDiffSuppresFunc is a function which can be used to determine
+// SchemaDiffSuppressFunc is a function which can be used to determine
 // whether a detected diff on a schema element is "valid" or not, and
 // suppress it from the plan if necessary.
 //
@@ -289,8 +296,7 @@ func (s *Schema) ZeroValue() interface{} {
         }
 }
 
-func (s *Schema) finalizeDiff(
-        d *terraform.ResourceAttrDiff) *terraform.ResourceAttrDiff {
+func (s *Schema) finalizeDiff(d *terraform.ResourceAttrDiff, customized bool) *terraform.ResourceAttrDiff {
         if d == nil {
                 return d
         }
@@ -331,13 +337,20 @@ func (s *Schema) finalizeDiff(
         }
 
         if s.Computed {
-                if d.Old != "" && d.New == "" {
-                        // This is a computed value with an old value set already,
-                        // just let it go.
-                        return nil
+                // FIXME: This is where the customized bool from getChange finally
+                //        comes into play.  It allows the previously incorrect behavior
+                //        of an empty string being used as "unset" when the value is
+                //        computed. This should be removed once we can properly
+                //        represent an unset/nil value from the configuration.
+                if !customized {
+                        if d.Old != "" && d.New == "" {
+                                // This is a computed value with an old value set already,
+                                // just let it go.
+                                return nil
+                        }
                 }
 
-                if d.New == "" {
+                if d.New == "" && !d.NewComputed {
                         // Computed attribute without a new value set
                         d.NewComputed = true
                 }
@@ -354,6 +367,13 @@ func (s *Schema) finalizeDiff(
 // schemaMap is a wrapper that adds nice functions on top of schemas.
 type schemaMap map[string]*Schema
 
+func (m schemaMap) panicOnError() bool {
+        if os.Getenv(PanicOnErr) != "" {
+                return true
+        }
+        return false
+}
+
 // Data returns a ResourceData for the given schema, state, and diff.
 //
 // The diff is optional.
@@ -361,17 +381,30 @@ func (m schemaMap) Data(
         s *terraform.InstanceState,
         d *terraform.InstanceDiff) (*ResourceData, error) {
         return &ResourceData{
-                schema: m,
-                state:  s,
-                diff:   d,
+                schema:       m,
+                state:        s,
+                diff:         d,
+                panicOnError: m.panicOnError(),
         }, nil
 }
 
+// DeepCopy returns a copy of this schemaMap. The copy can be safely modified
+// without affecting the original.
+func (m *schemaMap) DeepCopy() schemaMap {
+        copy, err := copystructure.Config{Lock: true}.Copy(m)
+        if err != nil {
+                panic(err)
+        }
+        return *copy.(*schemaMap)
+}
+
 // Diff returns the diff for a resource given the schema map,
 // state, and configuration.
 func (m schemaMap) Diff(
         s *terraform.InstanceState,
-        c *terraform.ResourceConfig) (*terraform.InstanceDiff, error) {
+        c *terraform.ResourceConfig,
+        customizeDiff CustomizeDiffFunc,
+        meta interface{}) (*terraform.InstanceDiff, error) {
         result := new(terraform.InstanceDiff)
         result.Attributes = make(map[string]*terraform.ResourceAttrDiff)
 
@@ -381,9 +414,10 @@ func (m schemaMap) Diff(
         }
 
         d := &ResourceData{
-                schema: m,
-                state:  s,
-                config: c,
+                schema:       m,
+                state:        s,
+                config:       c,
+                panicOnError: m.panicOnError(),
         }
 
         for k, schema := range m {
@@ -393,6 +427,29 @@ func (m schemaMap) Diff(
                 }
         }
 
+        // Remove any nil diffs just to keep things clean
+        for k, v := range result.Attributes {
+                if v == nil {
+                        delete(result.Attributes, k)
+                }
+        }
+
+        // If this is a non-destroy diff, call any custom diff logic that has been
+        // defined.
+        if !result.DestroyTainted && customizeDiff != nil {
+                mc := m.DeepCopy()
+                rd := newResourceDiff(mc, c, s, result)
+                if err := customizeDiff(rd, meta); err != nil {
+                        return nil, err
+                }
+                for _, k := range rd.UpdatedKeys() {
+                        err := m.diff(k, mc[k], result, rd, false)
+                        if err != nil {
+                                return nil, err
+                        }
+                }
+        }
+
         // If the diff requires a new resource, then we recompute the diff
         // so we have the complete new resource diff, and preserve the
         // RequiresNew fields where necessary so the user knows exactly what
@@ -418,6 +475,21 @@ func (m schemaMap) Diff(
                         }
                 }
 
+                // Re-run customization
+                if !result2.DestroyTainted && customizeDiff != nil {
+                        mc := m.DeepCopy()
+                        rd := newResourceDiff(mc, c, d.state, result2)
+                        if err := customizeDiff(rd, meta); err != nil {
+                                return nil, err
+                        }
+                        for _, k := range rd.UpdatedKeys() {
+                                err := m.diff(k, mc[k], result2, rd, false)
+                                if err != nil {
+                                        return nil, err
+                                }
+                        }
+                }
+
                 // Force all the fields to not force a new since we know what we
                 // want to force new.
                 for k, attr := range result2.Attributes {
@@ -456,13 +528,6 @@ func (m schemaMap) Diff(
                 result = result2
         }
 
-        // Remove any nil diffs just to keep things clean
-        for k, v := range result.Attributes {
-                if v == nil {
-                        delete(result.Attributes, k)
-                }
-        }
-
         // Go through and detect all of the ComputedWhens now that we've
         // finished the diff.
         // TODO
@@ -681,11 +746,23 @@ func isValidFieldName(name string) bool {
         return re.MatchString(name)
 }
 
+// resourceDiffer is an interface that is used by the private diff functions.
+// This helps facilitate diff logic for both ResourceData and ResoureDiff with
+// minimal divergence in code.
+type resourceDiffer interface {
+        diffChange(string) (interface{}, interface{}, bool, bool, bool)
+        Get(string) interface{}
+        GetChange(string) (interface{}, interface{})
+        GetOk(string) (interface{}, bool)
+        HasChange(string) bool
+        Id() string
+}
+
 func (m schemaMap) diff(
         k string,
         schema *Schema,
         diff *terraform.InstanceDiff,
-        d *ResourceData,
+        d resourceDiffer,
         all bool) error {
 
         unsupressedDiff := new(terraform.InstanceDiff)
@@ -706,12 +783,14 @@ func (m schemaMap) diff(
         }
 
         for attrK, attrV := range unsupressedDiff.Attributes {
-                if schema.DiffSuppressFunc != nil &&
-                        attrV != nil &&
-                        schema.DiffSuppressFunc(attrK, attrV.Old, attrV.New, d) {
-                        continue
+                switch rd := d.(type) {
+                case *ResourceData:
+                        if schema.DiffSuppressFunc != nil &&
+                                attrV != nil &&
+                                schema.DiffSuppressFunc(attrK, attrV.Old, attrV.New, rd) {
+                                continue
+                        }
                 }
-
                 diff.Attributes[attrK] = attrV
         }
 
@@ -722,9 +801,9 @@ func (m schemaMap) diffList(
         k string,
         schema *Schema,
         diff *terraform.InstanceDiff,
-        d *ResourceData,
+        d resourceDiffer,
         all bool) error {
-        o, n, _, computedList := d.diffChange(k)
+        o, n, _, computedList, customized := d.diffChange(k)
         if computedList {
                 n = nil
         }
@@ -791,10 +870,13 @@ func (m schemaMap) diffList(
                         oldStr = ""
                 }
 
-                diff.Attributes[k+".#"] = countSchema.finalizeDiff(&terraform.ResourceAttrDiff{
-                        Old: oldStr,
-                        New: newStr,
-                })
+                diff.Attributes[k+".#"] = countSchema.finalizeDiff(
+                        &terraform.ResourceAttrDiff{
+                                Old: oldStr,
+                                New: newStr,
+                        },
+                        customized,
+                )
         }
 
         // Figure out the maximum
@@ -841,13 +923,13 @@ func (m schemaMap) diffMap(
         k string,
         schema *Schema,
         diff *terraform.InstanceDiff,
-        d *ResourceData,
+        d resourceDiffer,
         all bool) error {
         prefix := k + "."
 
         // First get all the values from the state
         var stateMap, configMap map[string]string
-        o, n, _, nComputed := d.diffChange(k)
+        o, n, _, nComputed, customized := d.diffChange(k)
         if err := mapstructure.WeakDecode(o, &stateMap); err != nil {
                 return fmt.Errorf("%s: %s", k, err)
         }
@@ -899,6 +981,7 @@ func (m schemaMap) diffMap(
                                 Old: oldStr,
                                 New: newStr,
                         },
+                        customized,
                 )
         }
 
@@ -916,16 +999,22 @@ func (m schemaMap) diffMap(
                         continue
                 }
 
-                diff.Attributes[prefix+k] = schema.finalizeDiff(&terraform.ResourceAttrDiff{
-                        Old: old,
-                        New: v,
-                })
+                diff.Attributes[prefix+k] = schema.finalizeDiff(
+                        &terraform.ResourceAttrDiff{
+                                Old: old,
+                                New: v,
+                        },
+                        customized,
+                )
         }
         for k, v := range stateMap {
-                diff.Attributes[prefix+k] = schema.finalizeDiff(&terraform.ResourceAttrDiff{
-                        Old:        v,
-                        NewRemoved: true,
-                })
+                diff.Attributes[prefix+k] = schema.finalizeDiff(
+                        &terraform.ResourceAttrDiff{
+                                Old:        v,
+                                NewRemoved: true,
+                        },
+                        customized,
+                )
         }
 
         return nil
@@ -935,10 +1024,10 @@ func (m schemaMap) diffSet(
         k string,
         schema *Schema,
         diff *terraform.InstanceDiff,
-        d *ResourceData,
+        d resourceDiffer,
         all bool) error {
 
-        o, n, _, computedSet := d.diffChange(k)
+        o, n, _, computedSet, customized := d.diffChange(k)
         if computedSet {
                 n = nil
         }
@@ -997,20 +1086,26 @@ func (m schemaMap) diffSet(
                         countStr = ""
                 }
 
-                diff.Attributes[k+".#"] = countSchema.finalizeDiff(&terraform.ResourceAttrDiff{
-                        Old:         countStr,
-                        NewComputed: true,
-                })
+                diff.Attributes[k+".#"] = countSchema.finalizeDiff(
+                        &terraform.ResourceAttrDiff{
+                                Old:         countStr,
+                                NewComputed: true,
+                        },
+                        customized,
+                )
                 return nil
         }
 
         // If the counts are not the same, then record that diff
         changed := oldLen != newLen
         if changed || all {
-                diff.Attributes[k+".#"] = countSchema.finalizeDiff(&terraform.ResourceAttrDiff{
-                        Old: oldStr,
-                        New: newStr,
-                })
+                diff.Attributes[k+".#"] = countSchema.finalizeDiff(
+                        &terraform.ResourceAttrDiff{
+                                Old: oldStr,
+                                New: newStr,
+                        },
+                        customized,
+                )
         }
 
         // Build the list of codes that will make up our set. This is the
@@ -1056,11 +1151,11 @@ func (m schemaMap) diffString(
         k string,
         schema *Schema,
         diff *terraform.InstanceDiff,
-        d *ResourceData,
+        d resourceDiffer,
         all bool) error {
         var originalN interface{}
         var os, ns string
-        o, n, _, computed := d.diffChange(k)
+        o, n, _, computed, customized := d.diffChange(k)
         if schema.StateFunc != nil && n != nil {
                 originalN = n
                 n = schema.StateFunc(n)
@@ -1090,20 +1185,23 @@ func (m schemaMap) diffString(
         }
 
         removed := false
-        if o != nil && n == nil {
+        if o != nil && n == nil && !computed {
                 removed = true
         }
         if removed && schema.Computed {
                 return nil
         }
 
-        diff.Attributes[k] = schema.finalizeDiff(&terraform.ResourceAttrDiff{
-                Old:         os,
-                New:         ns,
-                NewExtra:    originalN,
-                NewRemoved:  removed,
-                NewComputed: computed,
-        })
+        diff.Attributes[k] = schema.finalizeDiff(
+                &terraform.ResourceAttrDiff{
+                        Old:         os,
+                        New:         ns,
+                        NewExtra:    originalN,
+                        NewRemoved:  removed,
+                        NewComputed: computed,
+                },
+                customized,
+        )
 
         return nil
 }
@@ -1172,9 +1270,9 @@ func (m schemaMap) validateConflictingAttributes(
         }
 
         for _, conflicting_key := range schema.ConflictsWith {
-                if value, ok := c.Get(conflicting_key); ok {
+                if _, ok := c.Get(conflicting_key); ok {
                         return fmt.Errorf(
-                                "%q: conflicts with %s (%#v)", k, conflicting_key, value)
+                                "%q: conflicts with %s", k, conflicting_key)
                 }
         }
 
@@ -1363,13 +1461,10 @@ func getValueType(k string, schema *Schema) (ValueType, error) {
                 return vt, nil
         }
 
+        // If a Schema is provided to a Map, we use the Type of that schema
+        // as the type for each element in the Map.
         if s, ok := schema.Elem.(*Schema); ok {
-                if s.Elem == nil {
-                        return TypeString, nil
-                }
-                if vt, ok := s.Elem.(ValueType); ok {
-                        return vt, nil
-                }
+                return s.Type, nil
         }
 
         if _, ok := schema.Elem.(*Resource); ok {
@@ -1430,7 +1525,6 @@ func (m schemaMap) validatePrimitive(
         raw interface{},
         schema *Schema,
         c *terraform.ResourceConfig) ([]string, []error) {
-
         // Catch if the user gave a complex type where a primitive was
         // expected, so we can return a friendly error message that
         // doesn't contain Go type system terminology.
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/set.go b/vendor/github.com/hashicorp/terraform/helper/schema/set.go
index de05f40..cba2890 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/set.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/set.go
@@ -17,6 +17,12 @@ func HashString(v interface{}) int {
         return hashcode.String(v.(string))
 }
 
+// HashInt hashes integers. If you want a Set of integers, this is the
+// SchemaSetFunc you want.
+func HashInt(v interface{}) int {
+        return hashcode.String(strconv.Itoa(v.(int)))
+}
+
 // HashResource hashes complex structures that are described using
 // a *Resource. This is the default set implementation used when a set's
 // element type is a full resource.
@@ -153,6 +159,31 @@ func (s *Set) Equal(raw interface{}) bool {
         return reflect.DeepEqual(s.m, other.m)
 }
 
+// HashEqual simply checks to the keys the top-level map to the keys in the
+// other set's top-level map to see if they are equal. This obviously assumes
+// you have a properly working hash function - use HashResource if in doubt.
+func (s *Set) HashEqual(raw interface{}) bool {
+        other, ok := raw.(*Set)
+        if !ok {
+                return false
+        }
+
+        ks1 := make([]string, 0)
+        ks2 := make([]string, 0)
+
+        for k := range s.m {
+                ks1 = append(ks1, k)
+        }
+        for k := range other.m {
+                ks2 = append(ks2, k)
+        }
+
+        sort.Strings(ks1)
+        sort.Strings(ks2)
+
+        return reflect.DeepEqual(ks1, ks2)
+}
+
 func (s *Set) GoString() string {
         return fmt.Sprintf("*Set(%#v)", s.m)
 }
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/testing.go b/vendor/github.com/hashicorp/terraform/helper/schema/testing.go
index 9765bdb..da754ac 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/testing.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/testing.go
@@ -10,13 +10,15 @@ import (
 // TestResourceDataRaw creates a ResourceData from a raw configuration map.
 func TestResourceDataRaw(
         t *testing.T, schema map[string]*Schema, raw map[string]interface{}) *ResourceData {
+        t.Helper()
+
         c, err := config.NewRawConfig(raw)
         if err != nil {
                 t.Fatalf("err: %s", err)
         }
 
         sm := schemaMap(schema)
-        diff, err := sm.Diff(nil, terraform.NewResourceConfig(c))
+        diff, err := sm.Diff(nil, terraform.NewResourceConfig(c), nil, nil)
         if err != nil {
                 t.Fatalf("err: %s", err)
         }
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/valuetype_string.go b/vendor/github.com/hashicorp/terraform/helper/schema/valuetype_string.go
index 1610cec..3bc3ac4 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/valuetype_string.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/valuetype_string.go
@@ -2,7 +2,7 @@
 
 package schema
 
-import "fmt"
+import "strconv"
 
 const _ValueType_name = "TypeInvalidTypeBoolTypeIntTypeFloatTypeStringTypeListTypeMapTypeSettypeObject"
 
@@ -10,7 +10,7 @@ var _ValueType_index = [...]uint8{0, 11, 19, 26, 35, 45, 53, 60, 67, 77}
 
 func (i ValueType) String() string {
         if i < 0 || i >= ValueType(len(_ValueType_index)-1) {
-                return fmt.Sprintf("ValueType(%d)", i)
+                return "ValueType(" + strconv.FormatInt(int64(i), 10) + ")"
         }
         return _ValueType_name[_ValueType_index[i]:_ValueType_index[i+1]]
 }
diff --git a/vendor/github.com/hashicorp/terraform/helper/shadow/closer.go b/vendor/github.com/hashicorp/terraform/helper/shadow/closer.go
deleted file mode 100644
index edc1e2a..0000000
--- a/vendor/github.com/hashicorp/terraform/helper/shadow/closer.go
+++ /dev/null
@@ -1,83 +0,0 @@
-package shadow
-
-import (
-        "fmt"
-        "io"
-        "reflect"
-
-        "github.com/hashicorp/go-multierror"
-        "github.com/mitchellh/reflectwalk"
-)
-
-// Close will close all shadow values within the given structure.
-//
-// This uses reflection to walk the structure, find all shadow elements,
-// and close them. Currently this will only find struct fields that are
-// shadow values, and not slice elements, etc.
-func Close(v interface{}) error {
-        // We require a pointer so we can address the internal fields
-        val := reflect.ValueOf(v)
-        if val.Kind() != reflect.Ptr {
-                return fmt.Errorf("value must be a pointer")
-        }
-
-        // Walk and close
-        var w closeWalker
-        if err := reflectwalk.Walk(v, &w); err != nil {
-                return err
-        }
-
-        return w.Err
-}
-
-type closeWalker struct {
-        Err error
-}
-
-func (w *closeWalker) Struct(reflect.Value) error {
-        // Do nothing. We implement this for reflectwalk.StructWalker
-        return nil
-}
-
-var closerType = reflect.TypeOf((*io.Closer)(nil)).Elem()
-
-func (w *closeWalker) StructField(f reflect.StructField, v reflect.Value) error {
-        // Not sure why this would be but lets avoid some panics
-        if !v.IsValid() {
-                return nil
-        }
-
-        // Empty for exported, so don't check unexported fields
-        if f.PkgPath != "" {
-                return nil
-        }
-
-        // Verify the io.Closer is in this package
-        typ := v.Type()
-        if typ.PkgPath() != "github.com/hashicorp/terraform/helper/shadow" {
-                return nil
-        }
-
-        var closer io.Closer
-        if v.Type().Implements(closerType) {
-                closer = v.Interface().(io.Closer)
-        } else if v.CanAddr() {
-                // The Close method may require a pointer receiver, but we only have a value.
-                v := v.Addr()
-                if v.Type().Implements(closerType) {
-                        closer = v.Interface().(io.Closer)
-                }
-        }
-
-        if closer == nil {
-                return reflectwalk.SkipEntry
-        }
-
-        // Close it
-        if err := closer.Close(); err != nil {
-                w.Err = multierror.Append(w.Err, err)
-        }
-
-        // Don't go into the struct field
-        return reflectwalk.SkipEntry
-}
diff --git a/vendor/github.com/hashicorp/terraform/helper/shadow/compared_value.go b/vendor/github.com/hashicorp/terraform/helper/shadow/compared_value.go
deleted file mode 100644
index 4223e92..0000000
--- a/vendor/github.com/hashicorp/terraform/helper/shadow/compared_value.go
+++ /dev/null
@@ -1,128 +0,0 @@
-package shadow
-
-import (
-        "sync"
-)
-
-// ComparedValue is a struct that finds a value by comparing some key
-// to the list of stored values. This is useful when there is no easy
-// uniquely identifying key that works in a map (for that, use KeyedValue).
-//
-// ComparedValue is very expensive, relative to other Value types. Try to
-// limit the number of values stored in a ComparedValue by potentially
-// nesting it within a KeyedValue (a keyed value points to a compared value,
-// for example).
-type ComparedValue struct {
-        // Func is a function that is given the lookup key and a single
-        // stored value. If it matches, it returns true.
-        Func func(k, v interface{}) bool
-
-        lock    sync.Mutex
-        once    sync.Once
-        closed  bool
-        values  []interface{}
-        waiters map[interface{}]*Value
-}
-
-// Close closes the value. This can never fail. For a definition of
-// "close" see the ErrClosed docs.
-func (w *ComparedValue) Close() error {
-        w.lock.Lock()
-        defer w.lock.Unlock()
-
-        // Set closed to true always
-        w.closed = true
-
-        // For all waiters, complete with ErrClosed
-        for k, val := range w.waiters {
-                val.SetValue(ErrClosed)
-                delete(w.waiters, k)
-        }
-
-        return nil
-}
-
-// Value returns the value that was set for the given key, or blocks
-// until one is available.
-func (w *ComparedValue) Value(k interface{}) interface{} {
-        v, val := w.valueWaiter(k)
-        if val == nil {
-                return v
-        }
-
-        return val.Value()
-}
-
-// ValueOk gets the value for the given key, returning immediately if the
-// value doesn't exist. The second return argument is true if the value exists.
-func (w *ComparedValue) ValueOk(k interface{}) (interface{}, bool) {
-        v, val := w.valueWaiter(k)
-        return v, val == nil
-}
-
-func (w *ComparedValue) SetValue(v interface{}) {
-        w.lock.Lock()
-        defer w.lock.Unlock()
-        w.once.Do(w.init)
-
-        // Check if we already have this exact value (by simply comparing
-        // with == directly). If we do, then we don't insert it again.
-        found := false
-        for _, v2 := range w.values {
-                if v == v2 {
-                        found = true
-                        break
-                }
-        }
-
-        if !found {
-                // Set the value, always
-                w.values = append(w.values, v)
-        }
-
-        // Go through the waiters
-        for k, val := range w.waiters {
-                if w.Func(k, v) {
-                        val.SetValue(v)
-                        delete(w.waiters, k)
-                }
-        }
-}
-
-func (w *ComparedValue) valueWaiter(k interface{}) (interface{}, *Value) {
-        w.lock.Lock()
-        w.once.Do(w.init)
-
-        // Look for a pre-existing value
-        for _, v := range w.values {
-                if w.Func(k, v) {
-                        w.lock.Unlock()
-                        return v, nil
-                }
-        }
-
-        // If we're closed, return that
-        if w.closed {
-                w.lock.Unlock()
-                return ErrClosed, nil
-        }
-
-        // Pre-existing value doesn't exist, create a waiter
-        val := w.waiters[k]
-        if val == nil {
-                val = new(Value)
-                w.waiters[k] = val
-        }
-        w.lock.Unlock()
-
-        // Return the waiter
-        return nil, val
-}
-
-// Must be called with w.lock held.
-func (w *ComparedValue) init() {
-        w.waiters = make(map[interface{}]*Value)
-        if w.Func == nil {
-                w.Func = func(k, v interface{}) bool { return k == v }
-        }
-}
diff --git a/vendor/github.com/hashicorp/terraform/helper/shadow/keyed_value.go b/vendor/github.com/hashicorp/terraform/helper/shadow/keyed_value.go
deleted file mode 100644
index 432b036..0000000
--- a/vendor/github.com/hashicorp/terraform/helper/shadow/keyed_value.go
+++ /dev/null
@@ -1,151 +0,0 @@
-package shadow
-
-import (
-        "sync"
-)
-
-// KeyedValue is a struct that coordinates a value by key. If a value is
-// not available for a give key, it'll block until it is available.
-type KeyedValue struct {
-        lock    sync.Mutex
-        once    sync.Once
-        values  map[string]interface{}
-        waiters map[string]*Value
-        closed  bool
-}
-
-// Close closes the value. This can never fail. For a definition of
-// "close" see the ErrClosed docs.
-func (w *KeyedValue) Close() error {
-        w.lock.Lock()
-        defer w.lock.Unlock()
-
-        // Set closed to true always
-        w.closed = true
-
-        // For all waiters, complete with ErrClosed
-        for k, val := range w.waiters {
-                val.SetValue(ErrClosed)
-                delete(w.waiters, k)
-        }
-
-        return nil
-}
-
-// Value returns the value that was set for the given key, or blocks
-// until one is available.
-func (w *KeyedValue) Value(k string) interface{} {
-        w.lock.Lock()
-        v, val := w.valueWaiter(k)
-        w.lock.Unlock()
-
-        // If we have no waiter, then return the value
-        if val == nil {
-                return v
-        }
-
-        // We have a waiter, so wait
-        return val.Value()
-}
-
-// WaitForChange waits for the value with the given key to be set again.
-// If the key isn't set, it'll wait for an initial value. Note that while
-// it is called "WaitForChange", the value isn't guaranteed to _change_;
-// this will return when a SetValue is called for the given k.
-func (w *KeyedValue) WaitForChange(k string) interface{} {
-        w.lock.Lock()
-        w.once.Do(w.init)
-
-        // If we're closed, we're closed
-        if w.closed {
-                w.lock.Unlock()
-                return ErrClosed
-        }
-
-        // Check for an active waiter. If there isn't one, make it
-        val := w.waiters[k]
-        if val == nil {
-                val = new(Value)
-                w.waiters[k] = val
-        }
-        w.lock.Unlock()
-
-        // And wait
-        return val.Value()
-}
-
-// ValueOk gets the value for the given key, returning immediately if the
-// value doesn't exist. The second return argument is true if the value exists.
-func (w *KeyedValue) ValueOk(k string) (interface{}, bool) {
-        w.lock.Lock()
-        defer w.lock.Unlock()
-
-        v, val := w.valueWaiter(k)
-        return v, val == nil
-}
-
-func (w *KeyedValue) SetValue(k string, v interface{}) {
-        w.lock.Lock()
-        defer w.lock.Unlock()
-        w.setValue(k, v)
-}
-
-// Init will initialize the key to a given value only if the key has
-// not been set before. This is safe to call multiple times and in parallel.
-func (w *KeyedValue) Init(k string, v interface{}) {
-        w.lock.Lock()
-        defer w.lock.Unlock()
-
-        // If we have a waiter, set the value.
-        _, val := w.valueWaiter(k)
-        if val != nil {
-                w.setValue(k, v)
-        }
-}
-
-// Must be called with w.lock held.
-func (w *KeyedValue) init() {
-        w.values = make(map[string]interface{})
-        w.waiters = make(map[string]*Value)
-}
-
-// setValue is like SetValue but assumes the lock is held.
-func (w *KeyedValue) setValue(k string, v interface{}) {
-        w.once.Do(w.init)
-
-        // Set the value, always
-        w.values[k] = v
-
-        // If we have a waiter, set it
-        if val, ok := w.waiters[k]; ok {
-                val.SetValue(v)
-                delete(w.waiters, k)
-        }
-}
-
-// valueWaiter gets the value or the Value waiter for a given key.
-//
-// This must be called with lock held.
-func (w *KeyedValue) valueWaiter(k string) (interface{}, *Value) {
-        w.once.Do(w.init)
-
-        // If we have this value already, return it
-        if v, ok := w.values[k]; ok {
-                return v, nil
-        }
-
-        // If we're closed, return that
-        if w.closed {
-                return ErrClosed, nil
-        }
-
-        // No pending value, check for a waiter
-        val := w.waiters[k]
-        if val == nil {
-                val = new(Value)
-                w.waiters[k] = val
-        }
-
-        // Return the waiter
-        return nil, val
-}
diff --git a/vendor/github.com/hashicorp/terraform/helper/shadow/ordered_value.go b/vendor/github.com/hashicorp/terraform/helper/shadow/ordered_value.go
deleted file mode 100644
index 0a43d4d..0000000
--- a/vendor/github.com/hashicorp/terraform/helper/shadow/ordered_value.go
+++ /dev/null
@@ -1,66 +0,0 @@
-package shadow
-
-import (
-        "container/list"
-        "sync"
-)
-
-// OrderedValue is a struct that keeps track of a value in the order
-// it is set. Each time Value() is called, it will return the most recent
-// calls value then discard it.
-//
-// This is unlike Value that returns the same value once it is set.
-type OrderedValue struct {
-        lock    sync.Mutex
-        values  *list.List
-        waiters *list.List
-}
-
-// Value returns the last value that was set, or blocks until one
-// is received.
-func (w *OrderedValue) Value() interface{} {
-        w.lock.Lock()
-
-        // If we have a pending value already, use it
-        if w.values != nil && w.values.Len() > 0 {
-                front := w.values.Front()
-                w.values.Remove(front)
-                w.lock.Unlock()
-                return front.Value
-        }
-
-        // No pending value, create a waiter
-        if w.waiters == nil {
-                w.waiters = list.New()
-        }
-
-        var val Value
-        w.waiters.PushBack(&val)
-        w.lock.Unlock()
-
-        // Return the value once we have it
-        return val.Value()
-}
-
-// SetValue sets the latest value.
-func (w *OrderedValue) SetValue(v interface{}) {
-        w.lock.Lock()
-        defer w.lock.Unlock()
-
-        // If we have a waiter, notify it
-        if w.waiters != nil && w.waiters.Len() > 0 {
-                front := w.waiters.Front()
-                w.waiters.Remove(front)
-
-                val := front.Value.(*Value)
-                val.SetValue(v)
-                return
-        }
-
-        // Add it to the list of values
-        if w.values == nil {
-                w.values = list.New()
-        }
-
-        w.values.PushBack(v)
-}
diff --git a/vendor/github.com/hashicorp/terraform/helper/shadow/value.go b/vendor/github.com/hashicorp/terraform/helper/shadow/value.go
deleted file mode 100644
index 178b7e7..0000000
--- a/vendor/github.com/hashicorp/terraform/helper/shadow/value.go
+++ /dev/null
@@ -1,87 +0,0 @@
-package shadow
-
-import (
-        "errors"
-        "sync"
-)
-
-// ErrClosed is returned by any closed values.
-//
-// A "closed value" is when the shadow has been notified that the real
-// side is complete and any blocking values will _never_ be satisfied
-// in the future. In this case, this error is returned. If a value is already
-// available, that is still returned.
-var ErrClosed = errors.New("shadow closed")
-
-// Value is a struct that coordinates a value between two
-// parallel routines. It is similar to atomic.Value except that when
-// Value is called if it isn't set it will wait for it.
-//
-// The Value can be closed with Close, which will cause any future
-// blocking operations to return immediately with ErrClosed.
-type Value struct {
-        lock     sync.Mutex
-        cond     *sync.Cond
-        value    interface{}
-        valueSet bool
-}
-
-func (v *Value) Lock() {
-        v.lock.Lock()
-}
-
-func (v *Value) Unlock() {
-        v.lock.Unlock()
-}
-
-// Close closes the value. This can never fail. For a definition of
-// "close" see the struct docs.
-func (w *Value) Close() error {
-        w.lock.Lock()
-        set := w.valueSet
-        w.lock.Unlock()
-
-        // If we haven't set the value, set it
-        if !set {
-                w.SetValue(ErrClosed)
-        }
-
-        // Done
-        return nil
-}
-
-// Value returns the value that was set.
-func (w *Value) Value() interface{} {
-        w.lock.Lock()
-        defer w.lock.Unlock()
-
-        // If we already have a value just return
-        for !w.valueSet {
-                // No value, setup the condition variable if we have to
-                if w.cond == nil {
-                        w.cond = sync.NewCond(&w.lock)
-                }
-
-                // Wait on it
-                w.cond.Wait()
-        }
-
-        // Return the value
-        return w.value
-}
-
-// SetValue sets the value.
-func (w *Value) SetValue(v interface{}) {
-        w.lock.Lock()
-        defer w.lock.Unlock()
-
-        // Set the value
-        w.valueSet = true
-        w.value = v
-
-        // If we have a condition, clear it
-        if w.cond != nil {
-                w.cond.Broadcast()
-                w.cond = nil
-        }
-}
diff --git a/vendor/github.com/hashicorp/terraform/httpclient/client.go b/vendor/github.com/hashicorp/terraform/httpclient/client.go
new file mode 100644
index 0000000..bb06beb
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/httpclient/client.go
@@ -0,0 +1,18 @@
+package httpclient
+
+import (
+        "net/http"
+
+        cleanhttp "github.com/hashicorp/go-cleanhttp"
+)
+
+// New returns the DefaultPooledClient from the cleanhttp
+// package that will also send a Terraform User-Agent string.
+func New() *http.Client {
+        cli := cleanhttp.DefaultPooledClient()
+        cli.Transport = &userAgentRoundTripper{
+                userAgent: UserAgentString(),
+                inner:     cli.Transport,
+        }
+        return cli
+}
diff --git a/vendor/github.com/hashicorp/terraform/httpclient/useragent.go b/vendor/github.com/hashicorp/terraform/httpclient/useragent.go
new file mode 100644
index 0000000..5e28017
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/httpclient/useragent.go
@@ -0,0 +1,40 @@
+package httpclient
+
+import (
+        "fmt"
+        "log"
+        "net/http"
+        "os"
+        "strings"
+
+        "github.com/hashicorp/terraform/version"
+)
+
+const userAgentFormat = "Terraform/%s"
+const uaEnvVar = "TF_APPEND_USER_AGENT"
+
+func UserAgentString() string {
+        ua := fmt.Sprintf(userAgentFormat, version.Version)
+
+        if add := os.Getenv(uaEnvVar); add != "" {
+                add = strings.TrimSpace(add)
+                if len(add) > 0 {
+                        ua += " " + add
+                        log.Printf("[DEBUG] Using modified User-Agent: %s", ua)
+                }
+        }
+
+        return ua
+}
+
+type userAgentRoundTripper struct {
+        inner     http.RoundTripper
+        userAgent string
+}
+
+func (rt *userAgentRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
+        if _, ok := req.Header["User-Agent"]; !ok {
+                req.Header.Set("User-Agent", rt.userAgent)
+        }
+        return rt.inner.RoundTrip(req)
+}
diff --git a/vendor/github.com/hashicorp/terraform/plugin/client.go b/vendor/github.com/hashicorp/terraform/plugin/client.go
index 3a5cb7a..7e2f4fe 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/client.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/client.go
@@ -1,8 +1,10 @@
 package plugin
 
 import (
+        "os"
         "os/exec"
 
+        hclog "github.com/hashicorp/go-hclog"
         plugin "github.com/hashicorp/go-plugin"
         "github.com/hashicorp/terraform/plugin/discovery"
 )
@@ -10,11 +12,18 @@ import (
 // ClientConfig returns a configuration object that can be used to instantiate
 // a client for the plugin described by the given metadata.
 func ClientConfig(m discovery.PluginMeta) *plugin.ClientConfig {
+        logger := hclog.New(&hclog.LoggerOptions{
+                Name:   "plugin",
+                Level:  hclog.Trace,
+                Output: os.Stderr,
+        })
+
         return &plugin.ClientConfig{
                 Cmd:             exec.Command(m.Path),
                 HandshakeConfig: Handshake,
                 Managed:         true,
                 Plugins:         PluginMap,
+                Logger:          logger,
         }
 }
 
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/find.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/find.go
index f5bc4c1..f053312 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/discovery/find.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/find.go
@@ -3,6 +3,7 @@ package discovery
 import (
         "io/ioutil"
         "log"
+        "os"
         "path/filepath"
         "strings"
 )
@@ -59,7 +60,6 @@ func findPluginPaths(kind string, dirs []string) []string {
                         fullName := item.Name()
 
                         if !strings.HasPrefix(fullName, prefix) {
-                                log.Printf("[DEBUG] skipping %q, not a %s", fullName, kind)
                                 continue
                         }
 
@@ -71,6 +71,12 @@ func findPluginPaths(kind string, dirs []string) []string {
                                         continue
                                 }
 
+                                // Check that the file we found is usable
+                                if !pathIsFile(absPath) {
+                                        log.Printf("[ERROR] ignoring non-file %s", absPath)
+                                        continue
+                                }
+
                                 log.Printf("[DEBUG] found %s %q", kind, fullName)
                                 ret = append(ret, filepath.Clean(absPath))
                                 continue
@@ -83,7 +89,13 @@ func findPluginPaths(kind string, dirs []string) []string {
                                 continue
                         }
 
-                        log.Printf("[WARNING] found legacy %s %q", kind, fullName)
+                        // Check that the file we found is usable
+                        if !pathIsFile(absPath) {
+                                log.Printf("[ERROR] ignoring non-file %s", absPath)
+                                continue
+                        }
+
+                        log.Printf("[WARN] found legacy %s %q", kind, fullName)
 
                         ret = append(ret, filepath.Clean(absPath))
                 }
@@ -92,6 +104,17 @@ func findPluginPaths(kind string, dirs []string) []string {
         return ret
 }
 
+// Returns true if and only if the given path refers to a file or a symlink
+// to a file.
+func pathIsFile(path string) bool {
+        info, err := os.Stat(path)
+        if err != nil {
+                return false
+        }
+
+        return !info.IsDir()
+}
+
 // ResolvePluginPaths takes a list of paths to plugin executables (as returned
 // by e.g. FindPluginPaths) and produces a PluginMetaSet describing the
 // referenced plugins.
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/get.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/get.go
index 241b5cb..815640f 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/discovery/get.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/get.go
@@ -3,19 +3,22 @@ package discovery
 import (
         "errors"
         "fmt"
+        "io"
         "io/ioutil"
         "log"
         "net/http"
         "os"
+        "path/filepath"
         "runtime"
         "strconv"
         "strings"
 
         "golang.org/x/net/html"
 
-        cleanhttp "github.com/hashicorp/go-cleanhttp"
         getter "github.com/hashicorp/go-getter"
         multierror "github.com/hashicorp/go-multierror"
+        "github.com/hashicorp/terraform/httpclient"
+        "github.com/mitchellh/cli"
 )
 
 // Releases are located by parsing the html listing from releases.hashicorp.com.
@@ -30,7 +33,19 @@ const protocolVersionHeader = "x-terraform-protocol-version"
 
 var releaseHost = "https://releases.hashicorp.com"
 
-var httpClient = cleanhttp.DefaultClient()
+var httpClient *http.Client
+
+func init() {
+        httpClient = httpclient.New()
+
+        httpGetter := &getter.HttpGetter{
+                Client: httpClient,
+                Netrc:  true,
+        }
+
+        getter.Getters["http"] = httpGetter
+        getter.Getters["https"] = httpGetter
+}
 
 // An Installer maintains a local cache of plugins by downloading plugins
 // from an online repository.
@@ -47,6 +62,10 @@ type Installer interface {
 type ProviderInstaller struct {
         Dir string
 
+        // Cache is used to access and update a local cache of plugins if non-nil.
+        // Can be nil to disable caching.
+        Cache PluginCache
+
         PluginProtocolVersion uint
 
         // OS and Arch specify the OS and architecture that should be used when
@@ -58,6 +77,8 @@ type ProviderInstaller struct {
 
         // Skip checksum and signature verification
         SkipVerify bool
+
+        Ui cli.Ui // Ui for output
 }
 
 // Get is part of an implementation of type Installer, and attempts to download
@@ -98,6 +119,12 @@ func (i *ProviderInstaller) Get(provider string, req Constraints) (PluginMeta, e
         // sort them newest to oldest
         Versions(versions).Sort()
 
+        // Ensure that our installation directory exists
+        err = os.MkdirAll(i.Dir, os.ModePerm)
+        if err != nil {
+                return PluginMeta{}, fmt.Errorf("failed to create plugin dir %s: %s", i.Dir, err)
+        }
+
         // take the first matching plugin we find
         for _, v := range versions {
                 url := i.providerURL(provider, v.String())
@@ -116,8 +143,9 @@ func (i *ProviderInstaller) Get(provider string, req Constraints) (PluginMeta, e
 
                 log.Printf("[DEBUG] fetching provider info for %s version %s", provider, v)
                 if checkPlugin(url, i.PluginProtocolVersion) {
-                        log.Printf("[DEBUG] getting provider %q version %q at %s", provider, v, url)
-                        err := getter.Get(i.Dir, url)
+                        i.Ui.Info(fmt.Sprintf("- Downloading plugin for provider %q (%s)...", provider, v.String()))
+                        log.Printf("[DEBUG] getting provider %q version %q", provider, v)
+                        err := i.install(provider, v, url)
                         if err != nil {
                                 return PluginMeta{}, err
                         }
@@ -164,6 +192,98 @@ func (i *ProviderInstaller) Get(provider string, req Constraints) (PluginMeta, e
         return PluginMeta{}, ErrorNoVersionCompatible
 }
 
+func (i *ProviderInstaller) install(provider string, version Version, url string) error {
+        if i.Cache != nil {
+                log.Printf("[DEBUG] looking for provider %s %s in plugin cache", provider, version)
+                cached := i.Cache.CachedPluginPath("provider", provider, version)
+                if cached == "" {
+                        log.Printf("[DEBUG] %s %s not yet in cache, so downloading %s", provider, version, url)
+                        err := getter.Get(i.Cache.InstallDir(), url)
+                        if err != nil {
+                                return err
+                        }
+                        // should now be in cache
+                        cached = i.Cache.CachedPluginPath("provider", provider, version)
+                        if cached == "" {
+                                // should never happen if the getter is behaving properly
+                                // and the plugins are packaged properly.
+                                return fmt.Errorf("failed to find downloaded plugin in cache %s", i.Cache.InstallDir())
+                        }
+                }
+
+                // Link or copy the cached binary into our install dir so the
+                // normal resolution machinery can find it.
+                filename := filepath.Base(cached)
+                targetPath := filepath.Join(i.Dir, filename)
+
+                log.Printf("[DEBUG] installing %s %s to %s from local cache %s", provider, version, targetPath, cached)
+
+                // Delete if we can. If there's nothing there already then no harm done.
+                // This is important because we can't create a link if there's
+                // already a file of the same name present.
+                // (any other error here we'll catch below when we try to write here)
+                os.Remove(targetPath)
+
+                // We don't attempt linking on Windows because links are not
+                // comprehensively supported by all tools/apps in Windows and
+                // so we choose to be conservative to avoid creating any
+                // weird issues for Windows users.
+                linkErr := errors.New("link not supported for Windows") // placeholder error, never actually returned
+                if runtime.GOOS != "windows" {
+                        // Try hard linking first. Hard links are preferable because this
+                        // creates a self-contained directory that doesn't depend on the
+                        // cache after install.
+                        linkErr = os.Link(cached, targetPath)
+
+                        // If that failed, try a symlink. This _does_ depend on the cache
+                        // after install, so the user must manage the cache more carefully
+                        // in this case, but avoids creating redundant copies of the
+                        // plugins on disk.
+                        if linkErr != nil {
+                                linkErr = os.Symlink(cached, targetPath)
+                        }
+                }
+
+                // If we still have an error then we'll try a copy as a fallback.
+                // In this case either the OS is Windows or the target filesystem
+                // can't support symlinks.
+                if linkErr != nil {
+                        srcFile, err := os.Open(cached)
+                        if err != nil {
+                                return fmt.Errorf("failed to open cached plugin %s: %s", cached, err)
+                        }
+                        defer srcFile.Close()
+
+                        destFile, err := os.OpenFile(targetPath, os.O_TRUNC|os.O_CREATE|os.O_WRONLY, os.ModePerm)
+                        if err != nil {
+                                return fmt.Errorf("failed to create %s: %s", targetPath, err)
+                        }
+
+                        _, err = io.Copy(destFile, srcFile)
+                        if err != nil {
+                                destFile.Close()
+                                return fmt.Errorf("failed to copy cached plugin from %s to %s: %s", cached, targetPath, err)
+                        }
+
+                        err = destFile.Close()
+                        if err != nil {
+                                return fmt.Errorf("error creating %s: %s", targetPath, err)
+                        }
+                }
+
+                // One way or another, by the time we get here we should have either
+                // a link or a copy of the cached plugin within i.Dir, as expected.
+        } else {
+                log.Printf("[DEBUG] plugin cache is disabled, so downloading %s %s from %s", provider, version, url)
+                err := getter.Get(i.Dir, url)
+                if err != nil {
+                        return err
+                }
+        }
+
+        return nil
+}
+
 func (i *ProviderInstaller) PurgeUnused(used map[string]PluginMeta) (PluginMetaSet, error) {
         purge := make(PluginMetaSet)
 
@@ -261,7 +381,7 @@ func checkPlugin(url string, pluginProtocolVersion uint) bool {
         if proto == "" {
                 // The header isn't present, but we don't make this error fatal since
                 // the latest version will probably work.
-                log.Printf("[WARNING] missing %s from: %s", protocolVersionHeader, url)
+                log.Printf("[WARN] missing %s from: %s", protocolVersionHeader, url)
                 return true
         }
 
@@ -422,3 +542,7 @@ func getFile(url string) ([]byte, error) {
         }
         return data, nil
 }
+
+func GetReleaseHost() string {
+        return releaseHost
+}
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/get_cache.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/get_cache.go
new file mode 100644
index 0000000..1a10042
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/get_cache.go
@@ -0,0 +1,48 @@
+package discovery
+
+// PluginCache is an interface implemented by objects that are able to maintain
+// a cache of plugins.
+type PluginCache interface {
+        // CachedPluginPath returns a path where the requested plugin is already
+        // cached, or an empty string if the requested plugin is not yet cached.
+        CachedPluginPath(kind string, name string, version Version) string
+
+        // InstallDir returns the directory that new plugins should be installed into
+        // in order to populate the cache. This directory should be used as the
+        // first argument to getter.Get when downloading plugins with go-getter.
+        //
+        // After installing into this directory, use CachedPluginPath to obtain the
+        // path where the plugin was installed.
+        InstallDir() string
+}
+
+// NewLocalPluginCache returns a PluginCache that caches plugins in a
+// given local directory.
+func NewLocalPluginCache(dir string) PluginCache {
+        return &pluginCache{
+                Dir: dir,
+        }
+}
+
+type pluginCache struct {
+        Dir string
+}
+
+func (c *pluginCache) CachedPluginPath(kind string, name string, version Version) string {
+        allPlugins := FindPlugins(kind, []string{c.Dir})
+        plugins := allPlugins.WithName(name).WithVersion(version)
+
+        if plugins.Count() == 0 {
+                // nothing cached
+                return ""
+        }
+
+        // There should generally be only one plugin here; if there's more than
+        // one match for some reason then we'll just choose one arbitrarily.
+        plugin := plugins.Newest()
+        return plugin.Path
+}
+
+func (c *pluginCache) InstallDir() string {
+        return c.Dir
+}
diff --git a/vendor/github.com/hashicorp/terraform/plugin/resource_provider.go b/vendor/github.com/hashicorp/terraform/plugin/resource_provider.go
index 473f786..d6a433c 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/resource_provider.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/resource_provider.go
@@ -41,6 +41,24 @@ func (p *ResourceProvider) Stop() error {
         return err
 }
 
+func (p *ResourceProvider) GetSchema(req *terraform.ProviderSchemaRequest) (*terraform.ProviderSchema, error) {
+        var result ResourceProviderGetSchemaResponse
+        args := &ResourceProviderGetSchemaArgs{
+                Req: req,
+        }
+
+        err := p.Client.Call("Plugin.GetSchema", args, &result)
+        if err != nil {
+                return nil, err
+        }
+
+        if result.Error != nil {
+                err = result.Error
+        }
+
+        return result.Schema, err
+}
+
 func (p *ResourceProvider) Input(
         input terraform.UIInput,
         c *terraform.ResourceConfig) (*terraform.ResourceConfig, error) {
@@ -312,6 +330,15 @@ type ResourceProviderStopResponse struct {
         Error *plugin.BasicError
 }
 
+type ResourceProviderGetSchemaArgs struct {
+        Req *terraform.ProviderSchemaRequest
+}
+
+type ResourceProviderGetSchemaResponse struct {
+        Schema *terraform.ProviderSchema
+        Error  *plugin.BasicError
+}
+
 type ResourceProviderConfigureResponse struct {
         Error *plugin.BasicError
 }
@@ -418,6 +445,18 @@ func (s *ResourceProviderServer) Stop(
         return nil
 }
 
+func (s *ResourceProviderServer) GetSchema(
+        args *ResourceProviderGetSchemaArgs,
+        result *ResourceProviderGetSchemaResponse,
+) error {
+        schema, err := s.Provider.GetSchema(args.Req)
+        result.Schema = schema
+        if err != nil {
+                result.Error = plugin.NewBasicError(err)
+        }
+        return nil
+}
+
 func (s *ResourceProviderServer) Input(
         args *ResourceProviderInputArgs,
         reply *ResourceProviderInputResponse) error {
diff --git a/vendor/github.com/hashicorp/terraform/registry/client.go b/vendor/github.com/hashicorp/terraform/registry/client.go
new file mode 100644
index 0000000..a18e6b8
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/registry/client.go
@@ -0,0 +1,227 @@
+package registry
+
+import (
+        "encoding/json"
+        "fmt"
+        "io/ioutil"
+        "log"
+        "net/http"
+        "net/url"
+        "path"
+        "strings"
+        "time"
+
+        "github.com/hashicorp/terraform/httpclient"
+        "github.com/hashicorp/terraform/registry/regsrc"
+        "github.com/hashicorp/terraform/registry/response"
+        "github.com/hashicorp/terraform/svchost"
+        "github.com/hashicorp/terraform/svchost/disco"
+        "github.com/hashicorp/terraform/version"
+)
+
+const (
+        xTerraformGet     = "X-Terraform-Get"
+        xTerraformVersion = "X-Terraform-Version"
+        requestTimeout    = 10 * time.Second
+        serviceID         = "modules.v1"
+)
+
+var tfVersion = version.String()
+
+// Client provides methods to query Terraform Registries.
+type Client struct {
+        // this is the client to be used for all requests.
+        client *http.Client
+
+        // services is a required *disco.Disco, which may have services and
+        // credentials pre-loaded.
+        services *disco.Disco
+}
+
+// NewClient returns a new initialized registry client.
+func NewClient(services *disco.Disco, client *http.Client) *Client {
+        if services == nil {
+                services = disco.New()
+        }
+
+        if client == nil {
+                client = httpclient.New()
+                client.Timeout = requestTimeout
+        }
+
+        services.Transport = client.Transport
+
+        return &Client{
+                client:   client,
+                services: services,
+        }
+}
+
+// Discover queries the host, and returns the url for the registry.
+func (c *Client) Discover(host svchost.Hostname) (*url.URL, error) {
+        service, err := c.services.DiscoverServiceURL(host, serviceID)
+        if err != nil {
+                return nil, err
+        }
+        if !strings.HasSuffix(service.Path, "/") {
+                service.Path += "/"
+        }
+        return service, nil
+}
+
+// Versions queries the registry for a module, and returns the available versions.
+func (c *Client) Versions(module *regsrc.Module) (*response.ModuleVersions, error) {
+        host, err := module.SvcHost()
+        if err != nil {
+                return nil, err
+        }
+
+        service, err := c.Discover(host)
+        if err != nil {
+                return nil, err
+        }
+
+        p, err := url.Parse(path.Join(module.Module(), "versions"))
+        if err != nil {
+                return nil, err
+        }
+
+        service = service.ResolveReference(p)
+
+        log.Printf("[DEBUG] fetching module versions from %q", service)
+
+        req, err := http.NewRequest("GET", service.String(), nil)
+        if err != nil {
+                return nil, err
+        }
+
+        c.addRequestCreds(host, req)
+        req.Header.Set(xTerraformVersion, tfVersion)
+
+        resp, err := c.client.Do(req)
+        if err != nil {
+                return nil, err
+        }
+        defer resp.Body.Close()
+
+        switch resp.StatusCode {
+        case http.StatusOK:
+                // OK
+        case http.StatusNotFound:
+                return nil, &errModuleNotFound{addr: module}
+        default:
+                return nil, fmt.Errorf("error looking up module versions: %s", resp.Status)
+        }
+
+        var versions response.ModuleVersions
+
+        dec := json.NewDecoder(resp.Body)
+        if err := dec.Decode(&versions); err != nil {
+                return nil, err
+        }
+
+        for _, mod := range versions.Modules {
+                for _, v := range mod.Versions {
+                        log.Printf("[DEBUG] found available version %q for %s", v.Version, mod.Source)
+                }
+        }
+
+        return &versions, nil
+}
+
+func (c *Client) addRequestCreds(host svchost.Hostname, req *http.Request) {
+        creds, err := c.services.CredentialsForHost(host)
+        if err != nil {
+                log.Printf("[WARN] Failed to get credentials for %s: %s (ignoring)", host, err)
+                return
+        }
+
+        if creds != nil {
+                creds.PrepareRequest(req)
+        }
+}
+
+// Location find the download location for a specific version module.
+// This returns a string, because the final location may contain special go-getter syntax.
+func (c *Client) Location(module *regsrc.Module, version string) (string, error) {
+        host, err := module.SvcHost()
+        if err != nil {
+                return "", err
+        }
+
+        service, err := c.Discover(host)
+        if err != nil {
+                return "", err
+        }
+
+        var p *url.URL
+        if version == "" {
+                p, err = url.Parse(path.Join(module.Module(), "download"))
+        } else {
+                p, err = url.Parse(path.Join(module.Module(), version, "download"))
+        }
+        if err != nil {
+                return "", err
+        }
+        download := service.ResolveReference(p)
+
+        log.Printf("[DEBUG] looking up module location from %q", download)
+
+        req, err := http.NewRequest("GET", download.String(), nil)
+        if err != nil {
+                return "", err
+        }
+
+        c.addRequestCreds(host, req)
+        req.Header.Set(xTerraformVersion, tfVersion)
+
+        resp, err := c.client.Do(req)
+        if err != nil {
+                return "", err
+        }
+        defer resp.Body.Close()
+
+        // there should be no body, but save it for logging
+        body, err := ioutil.ReadAll(resp.Body)
+        if err != nil {
+                return "", fmt.Errorf("error reading response body from registry: %s", err)
+        }
+
+        switch resp.StatusCode {
+        case http.StatusOK, http.StatusNoContent:
+                // OK
+        case http.StatusNotFound:
+                return "", fmt.Errorf("module %q version %q not found", module, version)
+        default:
+                // anything else is an error:
+                return "", fmt.Errorf("error getting download location for %q: %s resp:%s", module, resp.Status, body)
+        }
+
+        // the download location is in the X-Terraform-Get header
+        location := resp.Header.Get(xTerraformGet)
+        if location == "" {
+                return "", fmt.Errorf("failed to get download URL for %q: %s resp:%s", module, resp.Status, body)
+        }
+
+        // If location looks like it's trying to be a relative URL, treat it as
+        // one.
+        //
+        // We don't do this for just _any_ location, since the X-Terraform-Get
+        // header is a go-getter location rather than a URL, and so not all
+        // possible values will parse reasonably as URLs.)
+        //
+        // When used in conjunction with go-getter we normally require this header
+        // to be an absolute URL, but we are more liberal here because third-party
+        // registry implementations may not "know" their own absolute URLs if
+        // e.g. they are running behind a reverse proxy frontend, or such.
+        if strings.HasPrefix(location, "/") || strings.HasPrefix(location, "./") || strings.HasPrefix(location, "../") {
+                locationURL, err := url.Parse(location)
+                if err != nil {
+                        return "", fmt.Errorf("invalid relative URL for %q: %s", module, err)
+                }
+                locationURL = download.ResolveReference(locationURL)
+                location = locationURL.String()
+        }
+
+        return location, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/registry/errors.go b/vendor/github.com/hashicorp/terraform/registry/errors.go
new file mode 100644
index 0000000..b8dcd31
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/registry/errors.go
@@ -0,0 +1,23 @@
+package registry
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/terraform/registry/regsrc"
+)
+
+type errModuleNotFound struct {
+        addr *regsrc.Module
+}
+
+func (e *errModuleNotFound) Error() string {
+        return fmt.Sprintf("module %s not found", e.addr)
+}
+
+// IsModuleNotFound returns true only if the given error is a "module not found"
+// error. This allows callers to recognize this particular error condition
+// as distinct from operational errors such as poor network connectivity.
+func IsModuleNotFound(err error) bool {
+        _, ok := err.(*errModuleNotFound)
+        return ok
+}
diff --git a/vendor/github.com/hashicorp/terraform/registry/regsrc/friendly_host.go b/vendor/github.com/hashicorp/terraform/registry/regsrc/friendly_host.go
new file mode 100644
index 0000000..14b4dce
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/registry/regsrc/friendly_host.go
@@ -0,0 +1,140 @@
+package regsrc
+
+import (
+        "regexp"
+        "strings"
+
+        "github.com/hashicorp/terraform/svchost"
+)
+
+var (
+        // InvalidHostString is a placeholder returned when a raw host can't be
+        // converted by IDNA spec. It will never be returned for any host for which
+        // Valid() is true.
+        InvalidHostString = "<invalid host>"
+
+        // urlLabelEndSubRe is a sub-expression that matches any character that's
+        // allowed at the start or end of a URL label according to RFC1123.
+        urlLabelEndSubRe = "[0-9A-Za-z]"
+
+        // urlLabelEndSubRe is a sub-expression that matches any character that's
+        // allowed at in a non-start or end of a URL label according to RFC1123.
+        urlLabelMidSubRe = "[0-9A-Za-z-]"
+
+        // urlLabelUnicodeSubRe is a sub-expression that matches any non-ascii char
+        // in an IDN (Unicode) display URL. It's not strict - there are only ~15k
+        // valid Unicode points in IDN RFC (some with conditions). We are just going
+        // with being liberal with matching and then erroring if we fail to convert
+        // to punycode later (which validates chars fully). This at least ensures
+        // ascii chars dissalowed by the RC1123 parts above don't become legal
+        // again.
+        urlLabelUnicodeSubRe = "[^[:ascii:]]"
+
+        // hostLabelSubRe is the sub-expression that matches a valid hostname label.
+        // It does not anchor the start or end so it can be composed into more
+        // complex RegExps below. Note that for sanity we don't handle disallowing
+        // raw punycode in this regexp (esp. since re2 doesn't support negative
+        // lookbehind, but we can capture it's presence here to check later).
+        hostLabelSubRe = "" +
+                // Match valid initial char, or unicode char
+                "(?:" + urlLabelEndSubRe + "|" + urlLabelUnicodeSubRe + ")" +
+                // Optionally, match 0 to 61 valid URL or Unicode chars,
+                // followed by one valid end char or unicode char
+                "(?:" +
+                "(?:" + urlLabelMidSubRe + "|" + urlLabelUnicodeSubRe + "){0,61}" +
+                "(?:" + urlLabelEndSubRe + "|" + urlLabelUnicodeSubRe + ")" +
+                ")?"
+
+        // hostSubRe is the sub-expression that matches a valid host prefix.
+        // Allows custom port.
+        hostSubRe = hostLabelSubRe + "(?:\\." + hostLabelSubRe + ")+(?::\\d+)?"
+
+        // hostRe is a regexp that matches a valid host prefix. Additional
+        // validation of unicode strings is needed for matches.
+        hostRe = regexp.MustCompile("^" + hostSubRe + "$")
+)
+
+// FriendlyHost describes a registry instance identified in source strings by a
+// simple bare hostname like registry.terraform.io.
+type FriendlyHost struct {
+        Raw string
+}
+
+func NewFriendlyHost(host string) *FriendlyHost {
+        return &FriendlyHost{Raw: host}
+}
+
+// ParseFriendlyHost attempts to parse a valid "friendly host" prefix from the
+// given string. If no valid prefix is found, host will be nil and rest will
+// contain the full source string. The host prefix must terminate at the end of
+// the input or at the first / character. If one or more characters exist after
+// the first /, they will be returned as rest (without the / delimiter).
+// Hostnames containing punycode WILL be parsed successfully since they may have
+// come from an internal normalized source string, however should be considered
+// invalid if the string came from a user directly. This must be checked
+// explicitly for user-input strings by calling Valid() on the
+// returned host.
+func ParseFriendlyHost(source string) (host *FriendlyHost, rest string) {
+        parts := strings.SplitN(source, "/", 2)
+
+        if hostRe.MatchString(parts[0]) {
+                host = &FriendlyHost{Raw: parts[0]}
+                if len(parts) == 2 {
+                        rest = parts[1]
+                }
+                return
+        }
+
+        // No match, return whole string as rest along with nil host
+        rest = source
+        return
+}
+
+// Valid returns whether the host prefix is considered valid in any case.
+// Example of invalid prefixes might include ones that don't conform to the host
+// name specifications. Not that IDN prefixes containing punycode are not valid
+// input which we expect to always be in user-input or normalised display form.
+func (h *FriendlyHost) Valid() bool {
+        return svchost.IsValid(h.Raw)
+}
+
+// Display returns the host formatted for display to the user in CLI or web
+// output.
+func (h *FriendlyHost) Display() string {
+        return svchost.ForDisplay(h.Raw)
+}
+
+// Normalized returns the host formatted for internal reference or comparison.
+func (h *FriendlyHost) Normalized() string {
+        host, err := svchost.ForComparison(h.Raw)
+        if err != nil {
+                return InvalidHostString
+        }
+        return string(host)
+}
+
+// String returns the host formatted as the user originally typed it assuming it
+// was parsed from user input.
+func (h *FriendlyHost) String() string {
+        return h.Raw
+}
+
+// Equal compares the FriendlyHost against another instance taking normalization
+// into account. Invalid hosts cannot be compared and will always return false.
+func (h *FriendlyHost) Equal(other *FriendlyHost) bool {
+        if other == nil {
+                return false
+        }
+
+        otherHost, err := svchost.ForComparison(other.Raw)
+        if err != nil {
+                return false
+        }
+
+        host, err := svchost.ForComparison(h.Raw)
+        if err != nil {
+                return false
+        }
+
+        return otherHost == host
+}
diff --git a/vendor/github.com/hashicorp/terraform/registry/regsrc/module.go b/vendor/github.com/hashicorp/terraform/registry/regsrc/module.go
new file mode 100644
index 0000000..325706e
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/registry/regsrc/module.go
@@ -0,0 +1,205 @@
+package regsrc
+
+import (
+        "errors"
+        "fmt"
+        "regexp"
+        "strings"
+
+        "github.com/hashicorp/terraform/svchost"
+)
+
+var (
+        ErrInvalidModuleSource = errors.New("not a valid registry module source")
+
+        // nameSubRe is the sub-expression that matches a valid module namespace or
+        // name. It's strictly a super-set of what GitHub allows for user/org and
+        // repo names respectively, but more restrictive than our original repo-name
+        // regex which allowed periods but could cause ambiguity with hostname
+        // prefixes. It does not anchor the start or end so it can be composed into
+        // more complex RegExps below. Alphanumeric with - and _ allowed in non
+        // leading or trailing positions. Max length 64 chars. (GitHub username is
+        // 38 max.)
+        nameSubRe = "[0-9A-Za-z](?:[0-9A-Za-z-_]{0,62}[0-9A-Za-z])?"
+
+        // providerSubRe is the sub-expression that matches a valid provider. It
+        // does not anchor the start or end so it can be composed into more complex
+        // RegExps below. Only lowercase chars and digits are supported in practice.
+        // Max length 64 chars.
+        providerSubRe = "[0-9a-z]{1,64}"
+
+        // moduleSourceRe is a regular expression that matches the basic
+        // namespace/name/provider[//...] format for registry sources. It assumes
+        // any FriendlyHost prefix has already been removed if present.
+        moduleSourceRe = regexp.MustCompile(
+                fmt.Sprintf("^(%s)\\/(%s)\\/(%s)(?:\\/\\/(.*))?$",
+                        nameSubRe, nameSubRe, providerSubRe))
+
+        // NameRe is a regular expression defining the format allowed for namespace
+        // or name fields in module registry implementations.
+        NameRe = regexp.MustCompile("^" + nameSubRe + "$")
+
+        // ProviderRe is a regular expression defining the format allowed for
+        // provider fields in module registry implementations.
+        ProviderRe = regexp.MustCompile("^" + providerSubRe + "$")
+
+        // these hostnames are not allowed as registry sources, because they are
+        // already special case module sources in terraform.
+        disallowed = map[string]bool{
+                "github.com":    true,
+                "bitbucket.org": true,
+        }
+)
+
+// Module describes a Terraform Registry Module source.
+type Module struct {
+        // RawHost is the friendly host prefix if one was present. It might be nil
+        // if the original source had no host prefix which implies
+        // PublicRegistryHost but is distinct from having an actual pointer to
+        // PublicRegistryHost since it encodes the fact the original string didn't
+        // include a host prefix at all which is significant for recovering actual
+        // input not just normalized form. Most callers should access it with Host()
+        // which will return public registry host instance if it's nil.
+        RawHost      *FriendlyHost
+        RawNamespace string
+        RawName      string
+        RawProvider  string
+        RawSubmodule string
+}
+
+// NewModule construct a new module source from separate parts. Pass empty
+// string if host or submodule are not needed.
+func NewModule(host, namespace, name, provider, submodule string) (*Module, error) {
+        m := &Module{
+                RawNamespace: namespace,
+                RawName:      name,
+                RawProvider:  provider,
+                RawSubmodule: submodule,
+        }
+        if host != "" {
+                h := NewFriendlyHost(host)
+                if h != nil {
+                        fmt.Println("HOST:", h)
+                        if !h.Valid() || disallowed[h.Display()] {
+                                return nil, ErrInvalidModuleSource
+                        }
+                }
+                m.RawHost = h
+        }
+        return m, nil
+}
+
+// ParseModuleSource attempts to parse source as a Terraform registry module
+// source. If the string is not found to be in a valid format,
+// ErrInvalidModuleSource is returned. Note that this can only be used on
+// "input" strings, e.g. either ones supplied by the user or potentially
+// normalised but in Display form (unicode). It will fail to parse a source with
+// a punycoded domain since this is not permitted input from a user. If you have
+// an already normalized string internally, you can compare it without parsing
+// by comparing with the normalized version of the subject with the normal
+// string equality operator.
+func ParseModuleSource(source string) (*Module, error) {
+        // See if there is a friendly host prefix.
+        host, rest := ParseFriendlyHost(source)
+        if host != nil {
+                if !host.Valid() || disallowed[host.Display()] {
+                        return nil, ErrInvalidModuleSource
+                }
+        }
+
+        matches := moduleSourceRe.FindStringSubmatch(rest)
+        if len(matches) < 4 {
+                return nil, ErrInvalidModuleSource
+        }
+
+        m := &Module{
+                RawHost:      host,
+                RawNamespace: matches[1],
+                RawName:      matches[2],
+                RawProvider:  matches[3],
+        }
+
+        if len(matches) == 5 {
+                m.RawSubmodule = matches[4]
+        }
+
+        return m, nil
+}
+
+// Display returns the source formatted for display to the user in CLI or web
+// output.
+func (m *Module) Display() string {
+        return m.formatWithPrefix(m.normalizedHostPrefix(m.Host().Display()), false)
+}
+
+// Normalized returns the source formatted for internal reference or comparison.
+func (m *Module) Normalized() string {
+        return m.formatWithPrefix(m.normalizedHostPrefix(m.Host().Normalized()), false)
+}
+
+// String returns the source formatted as the user originally typed it assuming
+// it was parsed from user input.
+func (m *Module) String() string {
+        // Don't normalize public registry hostname - leave it exactly like the user
+        // input it.
+        hostPrefix := ""
+        if m.RawHost != nil {
+                hostPrefix = m.RawHost.String() + "/"
+        }
+        return m.formatWithPrefix(hostPrefix, true)
+}
+
+// Equal compares the module source against another instance taking
+// normalization into account.
+func (m *Module) Equal(other *Module) bool {
+        return m.Normalized() == other.Normalized()
+}
+
+// Host returns the FriendlyHost object describing which registry this module is
+// in. If the original source string had not host component this will return the
+// PublicRegistryHost.
+func (m *Module) Host() *FriendlyHost {
+        if m.RawHost == nil {
+                return PublicRegistryHost
+        }
+        return m.RawHost
+}
+
+func (m *Module) normalizedHostPrefix(host string) string {
+        if m.Host().Equal(PublicRegistryHost) {
+                return ""
+        }
+        return host + "/"
+}
+
+func (m *Module) formatWithPrefix(hostPrefix string, preserveCase bool) string {
+        suffix := ""
+        if m.RawSubmodule != "" {
+                suffix = "//" + m.RawSubmodule
+        }
+        str := fmt.Sprintf("%s%s/%s/%s%s", hostPrefix, m.RawNamespace, m.RawName,
+                m.RawProvider, suffix)
+
+        // lower case by default
+        if !preserveCase {
+                return strings.ToLower(str)
+        }
+        return str
+}
+
+// Module returns just the registry ID of the module, without a hostname or
+// suffix.
+func (m *Module) Module() string {
+        return fmt.Sprintf("%s/%s/%s", m.RawNamespace, m.RawName, m.RawProvider)
+}
+
+// SvcHost returns the svchost.Hostname for this module. Since FriendlyHost may
+// contain an invalid hostname, this also returns an error indicating if it
+// could be converted to a svchost.Hostname. If no host is specified, the
+// default PublicRegistryHost is returned.
+func (m *Module) SvcHost() (svchost.Hostname, error) {
+        if m.RawHost == nil {
+                return svchost.ForComparison(PublicRegistryHost.Raw)
+        }
+        return svchost.ForComparison(m.RawHost.Raw)
+}
diff --git a/vendor/github.com/hashicorp/terraform/registry/regsrc/regsrc.go b/vendor/github.com/hashicorp/terraform/registry/regsrc/regsrc.go
new file mode 100644
index 0000000..c430bf1
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/registry/regsrc/regsrc.go
@@ -0,0 +1,8 @@
+// Package regsrc provides helpers for working with source strings that identify
+// resources within a Terraform registry.
+package regsrc
+
+var (
+        // PublicRegistryHost is a FriendlyHost that represents the public registry.
+        PublicRegistryHost = NewFriendlyHost("registry.terraform.io")
+)
diff --git a/vendor/github.com/hashicorp/terraform/registry/response/module.go b/vendor/github.com/hashicorp/terraform/registry/response/module.go
new file mode 100644
index 0000000..3bd2b3d
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/registry/response/module.go
@@ -0,0 +1,93 @@
+package response
+
+import (
+        "time"
+)
+
+// Module is the response structure with the data for a single module version.
+type Module struct {
+        ID string `json:"id"`
+
+        //---------------------------------------------------------------
+        // Metadata about the overall module.
+
+        Owner       string    `json:"owner"`
+        Namespace   string    `json:"namespace"`
+        Name        string    `json:"name"`
+        Version     string    `json:"version"`
+        Provider    string    `json:"provider"`
+        Description string    `json:"description"`
+        Source      string    `json:"source"`
+        PublishedAt time.Time `json:"published_at"`
+        Downloads   int       `json:"downloads"`
+        Verified    bool      `json:"verified"`
+}
+
+// ModuleDetail represents a module in full detail.
+type ModuleDetail struct {
+        Module
+
+        //---------------------------------------------------------------
+        // Metadata about the overall module. This is only available when
+        // requesting the specific module (not in list responses).
+
+        // Root is the root module.
+        Root *ModuleSubmodule `json:"root"`
+
+        // Submodules are the other submodules that are available within
+        // this module.
+        Submodules []*ModuleSubmodule `json:"submodules"`
+
+        //---------------------------------------------------------------
+        // The fields below are only set when requesting this specific
+        // module. They are available to easily know all available versions
+        // and providers without multiple API calls.
+
+        Providers []string `json:"providers"` // All available providers
+        Versions  []string `json:"versions"`  // All versions
+}
+
+// ModuleSubmodule is the metadata about a specific submodule within
+// a module. This includes the root module as a special case.
+type ModuleSubmodule struct {
+        Path   string `json:"path"`
+        Readme string `json:"readme"`
+        Empty  bool   `json:"empty"`
+
+        Inputs       []*ModuleInput    `json:"inputs"`
+        Outputs      []*ModuleOutput   `json:"outputs"`
+        Dependencies []*ModuleDep      `json:"dependencies"`
+        Resources    []*ModuleResource `json:"resources"`
+}
+
+// ModuleInput is an input for a module.
+type ModuleInput struct {
+        Name        string `json:"name"`
+        Description string `json:"description"`
+        Default     string `json:"default"`
+}
+
+// ModuleOutput is an output for a module.
+type ModuleOutput struct {
+        Name        string `json:"name"`
+        Description string `json:"description"`
+}
+
+// ModuleDep is an output for a module.
+type ModuleDep struct {
+        Name    string `json:"name"`
+        Source  string `json:"source"`
+        Version string `json:"version"`
+}
+
+// ModuleProviderDep is the output for a provider dependency
+type ModuleProviderDep struct {
+        Name    string `json:"name"`
+        Version string `json:"version"`
+}
+
+// ModuleResource is an output for a module.
+type ModuleResource struct {
+        Name string `json:"name"`
+        Type string `json:"type"`
+}
diff --git a/vendor/github.com/hashicorp/terraform/registry/response/module_list.go b/vendor/github.com/hashicorp/terraform/registry/response/module_list.go
new file mode 100644
index 0000000..9783748
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/registry/response/module_list.go
@@ -0,0 +1,7 @@
+package response
+
+// ModuleList is the response structure for a pageable list of modules.
+type ModuleList struct {
+        Meta    PaginationMeta `json:"meta"`
+        Modules []*Module      `json:"modules"`
+}
diff --git a/vendor/github.com/hashicorp/terraform/registry/response/module_provider.go b/vendor/github.com/hashicorp/terraform/registry/response/module_provider.go
new file mode 100644
index 0000000..e48499d
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/registry/response/module_provider.go
@@ -0,0 +1,14 @@
+package response
+
+// ModuleProvider represents a single provider for modules.
+type ModuleProvider struct {
+        Name        string `json:"name"`
+        Downloads   int    `json:"downloads"`
+        ModuleCount int    `json:"module_count"`
+}
+
+// ModuleProviderList is the response structure for a pageable list of ModuleProviders.
+type ModuleProviderList struct {
+        Meta      PaginationMeta    `json:"meta"`
+        Providers []*ModuleProvider `json:"providers"`
+}
diff --git a/vendor/github.com/hashicorp/terraform/registry/response/module_versions.go b/vendor/github.com/hashicorp/terraform/registry/response/module_versions.go
new file mode 100644
index 0000000..f69e975
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/registry/response/module_versions.go
@@ -0,0 +1,32 @@
+package response
+
+// ModuleVersions is the response format that contains all metadata about module
+// versions needed for terraform CLI to resolve version constraints. See RFC
+// TF-042 for details on this format.
+type ModuleVersions struct {
+        Modules []*ModuleProviderVersions `json:"modules"`
+}
+
+// ModuleProviderVersions is the response format for a single module instance,
+// containing metadata about all versions and their dependencies.
+type ModuleProviderVersions struct {
+        Source   string           `json:"source"`
+        Versions []*ModuleVersion `json:"versions"`
+}
+
+// ModuleVersion is the output metadata for a given version needed by CLI to
+// resolve candidate versions to satisfy requirements.
+type ModuleVersion struct {
+        Version    string              `json:"version"`
+        Root       VersionSubmodule    `json:"root"`
+        Submodules []*VersionSubmodule `json:"submodules"`
+}
+
+// VersionSubmodule is the output metadata for a submodule within a given
+// version needed by CLI to resolve candidate versions to satisfy requirements.
+// When representing the Root in JSON the path is omitted.
+type VersionSubmodule struct {
+        Path         string               `json:"path,omitempty"`
+        Providers    []*ModuleProviderDep `json:"providers"`
+        Dependencies []*ModuleDep         `json:"dependencies"`
+}
diff --git a/vendor/github.com/hashicorp/terraform/registry/response/pagination.go b/vendor/github.com/hashicorp/terraform/registry/response/pagination.go
new file mode 100644
index 0000000..75a9254
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/registry/response/pagination.go
@@ -0,0 +1,65 @@
+package response
+
+import (
+        "net/url"
+        "strconv"
+)
+
+// PaginationMeta is a structure included in responses for pagination.
+type PaginationMeta struct {
+        Limit         int    `json:"limit"`
+        CurrentOffset int    `json:"current_offset"`
+        NextOffset    *int   `json:"next_offset,omitempty"`
+        PrevOffset    *int   `json:"prev_offset,omitempty"`
+        NextURL       string `json:"next_url,omitempty"`
+        PrevURL       string `json:"prev_url,omitempty"`
+}
+
+// NewPaginationMeta populates pagination meta data from result parameters
+func NewPaginationMeta(offset, limit int, hasMore bool, currentURL string) PaginationMeta {
+        pm := PaginationMeta{
+                Limit:         limit,
+                CurrentOffset: offset,
+        }
+
+        // Calculate next/prev offsets, leave nil if not valid pages
+        nextOffset := offset + limit
+        if hasMore {
+                pm.NextOffset = &nextOffset
+        }
+
+        prevOffset := offset - limit
+        if prevOffset < 0 {
+                prevOffset = 0
+        }
+        if prevOffset < offset {
+                pm.PrevOffset = &prevOffset
+        }
+
+        // If URL format provided, populate URLs. Intentionally swallow URL errors for now, API should
+        // catch missing URLs if we call with bad URL arg (and we care about them being present).
+        if currentURL != "" && pm.NextOffset != nil {
+                pm.NextURL, _ = setQueryParam(currentURL, "offset", *pm.NextOffset, 0)
+        }
+        if currentURL != "" && pm.PrevOffset != nil {
+                pm.PrevURL, _ = setQueryParam(currentURL, "offset", *pm.PrevOffset, 0)
+        }
+
+        return pm
+}
+
+func setQueryParam(baseURL, key string, val, defaultVal int) (string, error) {
+        u, err := url.Parse(baseURL)
+        if err != nil {
+                return "", err
+        }
+        q := u.Query()
+        if val == defaultVal {
+                // elide param if it's the default value
+                q.Del(key)
+        } else {
+                q.Set(key, strconv.Itoa(val))
+        }
+        u.RawQuery = q.Encode()
+        return u.String(), nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/registry/response/redirect.go b/vendor/github.com/hashicorp/terraform/registry/response/redirect.go
new file mode 100644
index 0000000..d5eb49b
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/registry/response/redirect.go
@@ -0,0 +1,6 @@
+package response
+
+// Redirect causes the frontend to perform a window redirect.
+type Redirect struct {
+        URL string `json:"url"`
+}
diff --git a/vendor/github.com/hashicorp/terraform/svchost/auth/cache.go b/vendor/github.com/hashicorp/terraform/svchost/auth/cache.go
new file mode 100644
index 0000000..4f0d168
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/svchost/auth/cache.go
@@ -0,0 +1,45 @@
+package auth
+
+import (
+        "github.com/hashicorp/terraform/svchost"
+)
+
+// CachingCredentialsSource creates a new credentials source that wraps another
+// and caches its results in memory, on a per-hostname basis.
+//
+// No means is provided for expiration of cached credentials, so a caching
+// credentials source should have a limited lifetime (one Terraform operation,
+// for example) to ensure that time-limited credentials don't expire before
+// their cache entries do.
+func CachingCredentialsSource(source CredentialsSource) CredentialsSource {
+        return &cachingCredentialsSource{
+                source: source,
+                cache:  map[svchost.Hostname]HostCredentials{},
+        }
+}
+
+type cachingCredentialsSource struct {
+        source CredentialsSource
+        cache  map[svchost.Hostname]HostCredentials
+}
+
+// ForHost passes the given hostname on to the wrapped credentials source and
+// caches the result to return for future requests with the same hostname.
+//
+// Both credentials and non-credentials (nil) responses are cached.
+//
+// No cache entry is created if the wrapped source returns an error, to allow
+// the caller to retry the failing operation.
+func (s *cachingCredentialsSource) ForHost(host svchost.Hostname) (HostCredentials, error) {
+        if cache, cached := s.cache[host]; cached {
+                return cache, nil
+        }
+
+        result, err := s.source.ForHost(host)
+        if err != nil {
+                return result, err
+        }
+
+        s.cache[host] = result
+        return result, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/svchost/auth/credentials.go b/vendor/github.com/hashicorp/terraform/svchost/auth/credentials.go
new file mode 100644
index 0000000..0372c16
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/svchost/auth/credentials.go
@@ -0,0 +1,63 @@
+// Package auth contains types and functions to manage authentication
+// credentials for service hosts.
+package auth
+
+import (
+        "net/http"
+
+        "github.com/hashicorp/terraform/svchost"
+)
+
+// Credentials is a list of CredentialsSource objects that can be tried in
+// turn until one returns credentials for a host, or one returns an error.
+//
+// A Credentials is itself a CredentialsSource, wrapping its members.
+// In principle one CredentialsSource can be nested inside another, though
+// there is no good reason to do so.
+type Credentials []CredentialsSource
+
+// NoCredentials is an empty CredentialsSource that always returns nil
+// when asked for credentials.
+var NoCredentials CredentialsSource = Credentials{}
+
+// A CredentialsSource is an object that may be able to provide credentials
+// for a given host.
+//
+// Credentials lookups are not guaranteed to be concurrency-safe. Callers
+// using these facilities in concurrent code must use external concurrency
+// primitives to prevent race conditions.
+type CredentialsSource interface {
+        // ForHost returns a non-nil HostCredentials if the source has credentials
+        // available for the host, and a nil HostCredentials if it does not.
+        //
+        // If an error is returned, progress through a list of CredentialsSources
+        // is halted and the error is returned to the user.
+        ForHost(host svchost.Hostname) (HostCredentials, error)
+}
+
+// HostCredentials represents a single set of credentials for a particular
+// host.
+type HostCredentials interface {
+        // PrepareRequest modifies the given request in-place to apply the
+        // receiving credentials. The usual behavior of this method is to
+        // add some sort of Authorization header to the request.
+        PrepareRequest(req *http.Request)
+
+        // Token returns the authentication token.
+        Token() string
+}
+
+// ForHost iterates over the contained CredentialsSource objects and
+// tries to obtain credentials for the given host from each one in turn.
+//
+// If any source returns either a non-nil HostCredentials or a non-nil error
+// then this result is returned. Otherwise, the result is nil, nil.
+func (c Credentials) ForHost(host svchost.Hostname) (HostCredentials, error) {
+        for _, source := range c {
+                creds, err := source.ForHost(host)
+                if creds != nil || err != nil {
+                        return creds, err
+                }
+        }
+        return nil, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/svchost/auth/from_map.go b/vendor/github.com/hashicorp/terraform/svchost/auth/from_map.go
new file mode 100644
index 0000000..f91006a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/svchost/auth/from_map.go
@@ -0,0 +1,18 @@
+package auth
+
+// HostCredentialsFromMap converts a map of key-value pairs from a credentials
+// definition provided by the user (e.g. in a config file, or via a credentials
+// helper) into a HostCredentials object if possible, or returns nil if
+// no credentials could be extracted from the map.
+//
+// This function ignores map keys it is unfamiliar with, to allow for future
+// expansion of the credentials map format for new credential types.
+func HostCredentialsFromMap(m map[string]interface{}) HostCredentials {
+        if m == nil {
+                return nil
+        }
+        if token, ok := m["token"].(string); ok {
+                return HostCredentialsToken(token)
+        }
+        return nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/svchost/auth/helper_program.go b/vendor/github.com/hashicorp/terraform/svchost/auth/helper_program.go
new file mode 100644
index 0000000..d72ffe3
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/svchost/auth/helper_program.go
@@ -0,0 +1,80 @@
+package auth
+
+import (
+        "bytes"
+        "encoding/json"
+        "fmt"
+        "os/exec"
+        "path/filepath"
+
+        "github.com/hashicorp/terraform/svchost"
+)
+
+type helperProgramCredentialsSource struct {
+        executable string
+        args       []string
+}
+
+// HelperProgramCredentialsSource returns a CredentialsSource that runs the
+// given program with the given arguments in order to obtain credentials.
+//
+// The given executable path must be an absolute path; it is the caller's
+// responsibility to validate and process a relative path or other input
+// provided by an end-user. If the given path is not absolute, this
+// function will panic.
+//
+// When credentials are requested, the program will be run in a child process
+// with the given arguments along with two additional arguments added to the
+// end of the list: the literal string "get", followed by the requested
+// hostname in ASCII compatibility form (punycode form).
+func HelperProgramCredentialsSource(executable string, args ...string) CredentialsSource {
+        if !filepath.IsAbs(executable) {
+                panic("NewCredentialsSourceHelperProgram requires absolute path to executable")
+        }
+
+        fullArgs := make([]string, len(args)+1)
+        fullArgs[0] = executable
+        copy(fullArgs[1:], args)
+
+        return &helperProgramCredentialsSource{
+                executable: executable,
+                args:       fullArgs,
+        }
+}
+
+func (s *helperProgramCredentialsSource) ForHost(host svchost.Hostname) (HostCredentials, error) {
+        args := make([]string, len(s.args), len(s.args)+2)
+        copy(args, s.args)
+        args = append(args, "get")
+        args = append(args, string(host))
+
+        outBuf := bytes.Buffer{}
+        errBuf := bytes.Buffer{}
+
+        cmd := exec.Cmd{
+                Path:   s.executable,
+                Args:   args,
+                Stdin:  nil,
+                Stdout: &outBuf,
+                Stderr: &errBuf,
+        }
+        err := cmd.Run()
+        if _, isExitErr := err.(*exec.ExitError); isExitErr {
+                errText := errBuf.String()
+                if errText == "" {
+                        // Shouldn't happen for a well-behaved helper program
+                        return nil, fmt.Errorf("error in %s, but it produced no error message", s.executable)
+                }
+                return nil, fmt.Errorf("error in %s: %s", s.executable, errText)
+        } else if err != nil {
+                return nil, fmt.Errorf("failed to run %s: %s", s.executable, err)
+        }
+
+        var m map[string]interface{}
+        err = json.Unmarshal(outBuf.Bytes(), &m)
+        if err != nil {
+                return nil, fmt.Errorf("malformed output from %s: %s", s.executable, err)
+        }
+
+        return HostCredentialsFromMap(m), nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/svchost/auth/static.go b/vendor/github.com/hashicorp/terraform/svchost/auth/static.go
new file mode 100644
index 0000000..5373fdd
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/svchost/auth/static.go
@@ -0,0 +1,28 @@
+package auth
+
+import (
+        "github.com/hashicorp/terraform/svchost"
+)
+
+// StaticCredentialsSource is a credentials source that retrieves credentials
+// from the provided map. It returns nil if a requested hostname is not
+// present in the map.
+//
+// The caller should not modify the given map after passing it to this function.
+func StaticCredentialsSource(creds map[svchost.Hostname]map[string]interface{}) CredentialsSource {
+        return staticCredentialsSource(creds)
+}
+
+type staticCredentialsSource map[svchost.Hostname]map[string]interface{}
+
+func (s staticCredentialsSource) ForHost(host svchost.Hostname) (HostCredentials, error) {
+        if s == nil {
+                return nil, nil
+        }
+
+        if m, exists := s[host]; exists {
+                return HostCredentialsFromMap(m), nil
+        }
+
+        return nil, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/svchost/auth/token_credentials.go b/vendor/github.com/hashicorp/terraform/svchost/auth/token_credentials.go
new file mode 100644
index 0000000..9358bcb
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/svchost/auth/token_credentials.go
@@ -0,0 +1,25 @@
+package auth
+
+import (
+        "net/http"
+)
+
+// HostCredentialsToken is a HostCredentials implementation that represents a
+// single "bearer token", to be sent to the server via an Authorization header
+// with the auth type set to "Bearer"
+type HostCredentialsToken string
+
+// PrepareRequest alters the given HTTP request by setting its Authorization
+// header to the string "Bearer " followed by the encapsulated authentication
+// token.
+func (tc HostCredentialsToken) PrepareRequest(req *http.Request) {
+        if req.Header == nil {
+                req.Header = http.Header{}
+        }
+        req.Header.Set("Authorization", "Bearer "+string(tc))
+}
+
+// Token returns the authentication token.
+func (tc HostCredentialsToken) Token() string {
+        return string(tc)
+}
diff --git a/vendor/github.com/hashicorp/terraform/svchost/disco/disco.go b/vendor/github.com/hashicorp/terraform/svchost/disco/disco.go
new file mode 100644
index 0000000..1963cbd
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/svchost/disco/disco.go
@@ -0,0 +1,259 @@
+// Package disco handles Terraform's remote service discovery protocol.
+//
+// This protocol allows mapping from a service hostname, as produced by the
+// svchost package, to a set of services supported by that host and the
+// endpoint information for each supported service.
+package disco
+
+import (
+        "encoding/json"
+        "errors"
+        "fmt"
+        "io"
+        "io/ioutil"
+        "log"
+        "mime"
+        "net/http"
+        "net/url"
+        "time"
+
+        cleanhttp "github.com/hashicorp/go-cleanhttp"
+        "github.com/hashicorp/terraform/httpclient"
+        "github.com/hashicorp/terraform/svchost"
+        "github.com/hashicorp/terraform/svchost/auth"
+)
+
+const (
+        // Fixed path to the discovery manifest.
+        discoPath = "/.well-known/terraform.json"
+
+        // Arbitrary-but-small number to prevent runaway redirect loops.
+        maxRedirects = 3
+
+        // Arbitrary-but-small time limit to prevent UI "hangs" during discovery.
+        discoTimeout = 11 * time.Second
+
+        // 1MB - to prevent abusive services from using loads of our memory.
+        maxDiscoDocBytes = 1 * 1024 * 1024
+)
+
+// httpTransport is overridden during tests, to skip TLS verification.
+var httpTransport = cleanhttp.DefaultPooledTransport()
+
+// Disco is the main type in this package, which allows discovery on given
+// hostnames and caches the results by hostname to avoid repeated requests
+// for the same information.
+type Disco struct {
+        hostCache map[svchost.Hostname]*Host
+        credsSrc  auth.CredentialsSource
+
+        // Transport is a custom http.RoundTripper to use.
+        Transport http.RoundTripper
+}
+
+// New returns a new initialized discovery object.
+func New() *Disco {
+        return NewWithCredentialsSource(nil)
+}
+
+// NewWithCredentialsSource returns a new discovery object initialized with
+// the given credentials source.
+func NewWithCredentialsSource(credsSrc auth.CredentialsSource) *Disco {
+        return &Disco{
+                hostCache: make(map[svchost.Hostname]*Host),
+                credsSrc:  credsSrc,
+                Transport: httpTransport,
+        }
+}
+
+// SetCredentialsSource provides a credentials source that will be used to
+// add credentials to outgoing discovery requests, where available.
+//
+// If this method is never called, no outgoing discovery requests will have
+// credentials.
+func (d *Disco) SetCredentialsSource(src auth.CredentialsSource) {
+        d.credsSrc = src
+}
+
+// CredentialsForHost returns a non-nil HostCredentials if the embedded source has
+// credentials available for the host, and a nil HostCredentials if it does not.
+func (d *Disco) CredentialsForHost(hostname svchost.Hostname) (auth.HostCredentials, error) {
+        if d.credsSrc == nil {
+                return nil, nil
+        }
+        return d.credsSrc.ForHost(hostname)
+}
+
+// ForceHostServices provides a pre-defined set of services for a given
+// host, which prevents the receiver from attempting network-based discovery
+// for the given host. Instead, the given services map will be returned
+// verbatim.
+//
+// When providing "forced" services, any relative URLs are resolved against
+// the initial discovery URL that would have been used for network-based
+// discovery, yielding the same results as if the given map were published
+// at the host's default discovery URL, though using absolute URLs is strongly
+// recommended to make the configured behavior more explicit.
+func (d *Disco) ForceHostServices(hostname svchost.Hostname, services map[string]interface{}) {
+        if services == nil {
+                services = map[string]interface{}{}
+        }
+
+        d.hostCache[hostname] = &Host{
+                discoURL: &url.URL{
+                        Scheme: "https",
+                        Host:   string(hostname),
+                        Path:   discoPath,
+                },
+                hostname:  hostname.ForDisplay(),
+                services:  services,
+                transport: d.Transport,
+        }
+}
+
+// Discover runs the discovery protocol against the given hostname (which must
+// already have been validated and prepared with svchost.ForComparison) and
+// returns an object describing the services available at that host.
+//
+// If a given hostname supports no Terraform services at all, a non-nil but
+// empty Host object is returned. When giving feedback to the end user about
+// such situations, we say "host <name> does not provide a <service> service",
+// regardless of whether that is due to that service specifically being absent
+// or due to the host not providing Terraform services at all, since we don't
+// wish to expose the detail of whole-host discovery to an end-user.
+func (d *Disco) Discover(hostname svchost.Hostname) (*Host, error) {
+        if host, cached := d.hostCache[hostname]; cached {
+                return host, nil
+        }
+
+        host, err := d.discover(hostname)
+        if err != nil {
+                return nil, err
+        }
+        d.hostCache[hostname] = host
+
+        return host, nil
+}
+
+// DiscoverServiceURL is a convenience wrapper for discovery on a given
+// hostname and then looking up a particular service in the result.
+func (d *Disco) DiscoverServiceURL(hostname svchost.Hostname, serviceID string) (*url.URL, error) {
+        host, err := d.Discover(hostname)
+        if err != nil {
+                return nil, err
+        }
+        return host.ServiceURL(serviceID)
+}
+
+// discover implements the actual discovery process, with its result cached
+// by the public-facing Discover method.
+func (d *Disco) discover(hostname svchost.Hostname) (*Host, error) {
+        discoURL := &url.URL{
+                Scheme: "https",
+                Host:   hostname.String(),
+                Path:   discoPath,
+        }
+
+        client := &http.Client{
+                Transport: d.Transport,
+                Timeout:   discoTimeout,
+
+                CheckRedirect: func(req *http.Request, via []*http.Request) error {
+                        log.Printf("[DEBUG] Service discovery redirected to %s", req.URL)
+                        if len(via) > maxRedirects {
+                                return errors.New("too many redirects") // this error will never actually be seen
+                        }
+                        return nil
+                },
+        }
+
+        req := &http.Request{
+                Header: make(http.Header),
+                Method: "GET",
+                URL:    discoURL,
+        }
+        req.Header.Set("Accept", "application/json")
+        req.Header.Set("User-Agent", httpclient.UserAgentString())
+
+        creds, err := d.CredentialsForHost(hostname)
+        if err != nil {
+                log.Printf("[WARN] Failed to get credentials for %s: %s (ignoring)", hostname, err)
+        }
+        if creds != nil {
+                // Update the request to include credentials.
+                creds.PrepareRequest(req)
+        }
+
+        log.Printf("[DEBUG] Service discovery for %s at %s", hostname, discoURL)
+
+        resp, err := client.Do(req)
+        if err != nil {
+                return nil, fmt.Errorf("Failed to request discovery document: %v", err)
+        }
+        defer resp.Body.Close()
+
+        host := &Host{
+                // Use the discovery URL from resp.Request in
+                // case the client followed any redirects.
+                discoURL:  resp.Request.URL,
+                hostname:  hostname.ForDisplay(),
+                transport: d.Transport,
+        }
+
+        // Return the host without any services.
+        if resp.StatusCode == 404 {
+                return host, nil
+        }
+
+        if resp.StatusCode != 200 {
+                return nil, fmt.Errorf("Failed to request discovery document: %s", resp.Status)
+        }
+
+        contentType := resp.Header.Get("Content-Type")
+        mediaType, _, err := mime.ParseMediaType(contentType)
+        if err != nil {
+                return nil, fmt.Errorf("Discovery URL has a malformed Content-Type %q", contentType)
+        }
+        if mediaType != "application/json" {
+                return nil, fmt.Errorf("Discovery URL returned an unsupported Content-Type %q", mediaType)
+        }
+
+        // This doesn't catch chunked encoding, because ContentLength is -1 in that case.
+        if resp.ContentLength > maxDiscoDocBytes {
+                // Size limit here is not a contractual requirement and so we may
+                // adjust it over time if we find a different limit is warranted.
+                return nil, fmt.Errorf(
+                        "Discovery doc response is too large (got %d bytes; limit %d)",
+                        resp.ContentLength, maxDiscoDocBytes,
+                )
+        }
+
+        // If the response is using chunked encoding then we can't predict its
+        // size, but we'll at least prevent reading the entire thing into memory.
+        lr := io.LimitReader(resp.Body, maxDiscoDocBytes)
+
+        servicesBytes, err := ioutil.ReadAll(lr)
+        if err != nil {
+                return nil, fmt.Errorf("Error reading discovery document body: %v", err)
+        }
+
+        var services map[string]interface{}
+        err = json.Unmarshal(servicesBytes, &services)
+        if err != nil {
+                return nil, fmt.Errorf("Failed to decode discovery document as a JSON object: %v", err)
+        }
+        host.services = services
+
+        return host, nil
+}
+
+// Forget invalidates any cached record of the given hostname. If the host
+// has no cache entry then this is a no-op.
+func (d *Disco) Forget(hostname svchost.Hostname) {
+        delete(d.hostCache, hostname)
+}
+
+// ForgetAll is like Forget, but for all of the hostnames that have cache entries.
+func (d *Disco) ForgetAll() {
+        d.hostCache = make(map[svchost.Hostname]*Host)
+}
diff --git a/vendor/github.com/hashicorp/terraform/svchost/disco/host.go b/vendor/github.com/hashicorp/terraform/svchost/disco/host.go
new file mode 100644
index 0000000..ab9514c
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/svchost/disco/host.go
@@ -0,0 +1,264 @@
+package disco
+
+import (
+        "encoding/json"
+        "fmt"
+        "log"
+        "net/http"
+        "net/url"
+        "os"
+        "strconv"
+        "strings"
+        "time"
+
+        "github.com/hashicorp/go-version"
+        "github.com/hashicorp/terraform/httpclient"
+)
+
+const versionServiceID = "versions.v1"
+
+// Host represents a service discovered host.
+type Host struct {
+        discoURL  *url.URL
+        hostname  string
+        services  map[string]interface{}
+        transport http.RoundTripper
+}
+
+// Constraints represents the version constraints of a service.
+type Constraints struct {
+        Service   string   `json:"service"`
+        Product   string   `json:"product"`
+        Minimum   string   `json:"minimum"`
+        Maximum   string   `json:"maximum"`
+        Excluding []string `json:"excluding"`
+}
+
+// ErrServiceNotProvided is returned when the service is not provided.
+type ErrServiceNotProvided struct {
+        hostname string
+        service  string
+}
+
+// Error returns a customized error message.
+func (e *ErrServiceNotProvided) Error() string {
+        if e.hostname == "" {
+                return fmt.Sprintf("host does not provide a %s service", e.service)
+        }
+        return fmt.Sprintf("host %s does not provide a %s service", e.hostname, e.service)
+}
+
+// ErrVersionNotSupported is returned when the version is not supported.
+type ErrVersionNotSupported struct {
+        hostname string
+        service  string
+        version  string
+}
+
+// Error returns a customized error message.
+func (e *ErrVersionNotSupported) Error() string {
+        if e.hostname == "" {
+                return fmt.Sprintf("host does not support %s version %s", e.service, e.version)
+        }
+        return fmt.Sprintf("host %s does not support %s version %s", e.hostname, e.service, e.version)
+}
+
+// ErrNoVersionConstraints is returned when checkpoint was disabled
+// or the endpoint to query for version constraints was unavailable.
+type ErrNoVersionConstraints struct {
+        disabled bool
+}
+
+// Error returns a customized error message.
+func (e *ErrNoVersionConstraints) Error() string {
+        if e.disabled {
+                return "checkpoint disabled"
+        }
+        return "unable to contact versions service"
+}
+
+// ServiceURL returns the URL associated with the given service identifier,
+// which should be of the form "servicename.vN".
+//
+// A non-nil result is always an absolute URL with a scheme of either HTTPS
+// or HTTP.
+func (h *Host) ServiceURL(id string) (*url.URL, error) {
+        svc, ver, err := parseServiceID(id)
+        if err != nil {
+                return nil, err
+        }
+
+        // No services supported for an empty Host.
+        if h == nil || h.services == nil {
+                return nil, &ErrServiceNotProvided{service: svc}
+        }
+
+        urlStr, ok := h.services[id].(string)
+        if !ok {
+                // See if we have a matching service as that would indicate
+                // the service is supported, but not the requested version.
+                for serviceID := range h.services {
+                        if strings.HasPrefix(serviceID, svc+".") {
+                                return nil, &ErrVersionNotSupported{
+                                        hostname: h.hostname,
+                                        service:  svc,
+                                        version:  ver.Original(),
+                                }
+                        }
+                }
+
+                // No discovered services match the requested service.
+                return nil, &ErrServiceNotProvided{hostname: h.hostname, service: svc}
+        }
+
+        u, err := url.Parse(urlStr)
+        if err != nil {
+                return nil, fmt.Errorf("Failed to parse service URL: %v", err)
+        }
+
+        // Make relative URLs absolute using our discovery URL.
+        if !u.IsAbs() {
+                u = h.discoURL.ResolveReference(u)
+        }
+
+        if u.Scheme != "https" && u.Scheme != "http" {
+                return nil, fmt.Errorf("Service URL is using an unsupported scheme: %s", u.Scheme)
+        }
+        if u.User != nil {
+                return nil, fmt.Errorf("Embedded username/password information is not permitted")
+        }
+
+        // Fragment part is irrelevant, since we're not a browser.
+        u.Fragment = ""
+
+        return h.discoURL.ResolveReference(u), nil
+}
+
+// VersionConstraints returns the contraints for a given service identifier
+// (which should be of the form "servicename.vN") and product.
+//
+// When an exact (service and version) match is found, the constraints for
+// that service are returned.
+//
+// When the requested version is not provided but the service is, we will
+// search for all alternative versions. If mutliple alternative versions
+// are found, the contrains of the latest available version are returned.
+//
+// When a service is not provided at all an error will be returned instead.
+//
+// When checkpoint is disabled or when a 404 is returned after making the
+// HTTP call, an ErrNoVersionConstraints error will be returned.
+func (h *Host) VersionConstraints(id, product string) (*Constraints, error) {
+        svc, _, err := parseServiceID(id)
+        if err != nil {
+                return nil, err
+        }
+
+        // Return early if checkpoint is disabled.
+        if disabled := os.Getenv("CHECKPOINT_DISABLE"); disabled != "" {
+                return nil, &ErrNoVersionConstraints{disabled: true}
+        }
+
+        // No services supported for an empty Host.
+        if h == nil || h.services == nil {
+                return nil, &ErrServiceNotProvided{service: svc}
+        }
+
+        // Try to get the service URL for the version service and
+        // return early if the service isn't provided by the host.
+        u, err := h.ServiceURL(versionServiceID)
+        if err != nil {
+                return nil, err
+        }
+
+        // Check if we have an exact (service and version) match.
+        if _, ok := h.services[id].(string); !ok {
+                // If we don't have an exact match, we search for all matching
+                // services and then use the service ID of the latest version.
+                var services []string
+                for serviceID := range h.services {
+                        if strings.HasPrefix(serviceID, svc+".") {
+                                services = append(services, serviceID)
+                        }
+                }
+
+                if len(services) == 0 {
+                        // No discovered services match the requested service.
+                        return nil, &ErrServiceNotProvided{hostname: h.hostname, service: svc}
+                }
+
+                // Set id to the latest service ID we found.
+                var latest *version.Version
+                for _, serviceID := range services {
+                        if _, ver, err := parseServiceID(serviceID); err == nil {
+                                if latest == nil || latest.LessThan(ver) {
+                                        id = serviceID
+                                        latest = ver
+                                }
+                        }
+                }
+        }
+
+        // Set a default timeout of 1 sec for the versions request (in milliseconds)
+        timeout := 1000
+        if v, err := strconv.Atoi(os.Getenv("CHECKPOINT_TIMEOUT")); err == nil {
+                timeout = v
+        }
+
+        client := &http.Client{
+                Transport: h.transport,
+                Timeout:   time.Duration(timeout) * time.Millisecond,
+        }
+
+        // Prepare the service URL by setting the service and product.
+        v := u.Query()
+        v.Set("product", product)
+        u.Path += id
+        u.RawQuery = v.Encode()
+
+        // Create a new request.
+        req, err := http.NewRequest("GET", u.String(), nil)
+        if err != nil {
+                return nil, fmt.Errorf("Failed to create version constraints request: %v", err)
+        }
+        req.Header.Set("Accept", "application/json")
+        req.Header.Set("User-Agent", httpclient.UserAgentString())
+
+        log.Printf("[DEBUG] Retrieve version constraints for service %s and product %s", id, product)
+
+        resp, err := client.Do(req)
+        if err != nil {
+                return nil, fmt.Errorf("Failed to request version constraints: %v", err)
+        }
+        defer resp.Body.Close()
+
+        if resp.StatusCode == 404 {
+                return nil, &ErrNoVersionConstraints{disabled: false}
+        }
+
+        if resp.StatusCode != 200 {
+                return nil, fmt.Errorf("Failed to request version constraints: %s", resp.Status)
+        }
+
+        // Parse the constraints from the response body.
+        result := &Constraints{}
+        if err := json.NewDecoder(resp.Body).Decode(result); err != nil {
+                return nil, fmt.Errorf("Error parsing version constraints: %v", err)
+        }
+
+        return result, nil
+}
+
+func parseServiceID(id string) (string, *version.Version, error) {
+        parts := strings.SplitN(id, ".", 2)
+        if len(parts) != 2 {
+                return "", nil, fmt.Errorf("Invalid service ID format (i.e. service.vN): %s", id)
+        }
+
+        version, err := version.NewVersion(parts[1])
+        if err != nil {
+                return "", nil, fmt.Errorf("Invalid service version: %v", err)
+        }
+
+        return parts[0], version, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/svchost/label_iter.go b/vendor/github.com/hashicorp/terraform/svchost/label_iter.go
new file mode 100644
index 0000000..af8ccba
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/svchost/label_iter.go
@@ -0,0 +1,69 @@
+package svchost
+
+import (
+        "strings"
+)
+
+// A labelIter allows iterating over domain name labels.
+//
+// This type is copied from golang.org/x/net/idna, where it is used
+// to segment hostnames into their separate labels for analysis. We use
+// it for the same purpose here, in ForComparison.
+type labelIter struct {
+        orig     string
+        slice    []string
+        curStart int
+        curEnd   int
+        i        int
+}
+
+func (l *labelIter) reset() {
+        l.curStart = 0
+        l.curEnd = 0
+        l.i = 0
+}
+
+func (l *labelIter) done() bool {
+        return l.curStart >= len(l.orig)
+}
+
+func (l *labelIter) result() string {
+        if l.slice != nil {
+                return strings.Join(l.slice, ".")
+        }
+        return l.orig
+}
+
+func (l *labelIter) label() string {
+        if l.slice != nil {
+                return l.slice[l.i]
+        }
+        p := strings.IndexByte(l.orig[l.curStart:], '.')
+        l.curEnd = l.curStart + p
+        if p == -1 {
+                l.curEnd = len(l.orig)
+        }
+        return l.orig[l.curStart:l.curEnd]
+}
+
+// next sets the value to the next label. It skips the last label if it is empty.
+func (l *labelIter) next() {
+        l.i++
+        if l.slice != nil {
+                if l.i >= len(l.slice) || l.i == len(l.slice)-1 && l.slice[l.i] == "" {
+                        l.curStart = len(l.orig)
+                }
+        } else {
+                l.curStart = l.curEnd + 1
+                if l.curStart == len(l.orig)-1 && l.orig[l.curStart] == '.' {
+                        l.curStart = len(l.orig)
+                }
+        }
+}
+
+func (l *labelIter) set(s string) {
+        if l.slice == nil {
+                l.slice = strings.Split(l.orig, ".")
+        }
+        l.slice[l.i] = s
+}
diff --git a/vendor/github.com/hashicorp/terraform/svchost/svchost.go b/vendor/github.com/hashicorp/terraform/svchost/svchost.go
new file mode 100644
index 0000000..4eded14
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/svchost/svchost.go
@@ -0,0 +1,207 @@
+// Package svchost deals with the representations of the so-called "friendly
+// hostnames" that we use to represent systems that provide Terraform-native
+// remote services, such as module registry, remote operations, etc.
+//
+// Friendly hostnames are specified such that, as much as possible, they
+// are consistent with how web browsers think of hostnames, so that users
+// can bring their intuitions about how hostnames behave when they access
+// a Terraform Enterprise instance's web UI (or indeed any other website)
+// and have this behave in a similar way.
+package svchost
+
+import (
+        "errors"
+        "fmt"
+        "strconv"
+        "strings"
+
+        "golang.org/x/net/idna"
+)
+
+// Hostname is specialized name for string that indicates that the string
+// has been converted to (or was already in) the storage and comparison form.
+//
+// Hostname values are not suitable for display in the user-interface. Use
+// the ForDisplay method to obtain a form suitable for display in the UI.
+//
+// Unlike user-supplied hostnames, strings of type Hostname (assuming they
+// were constructed by a function within this package) can be compared for
+// equality using the standard Go == operator.
+type Hostname string
+
+// acePrefix is the ASCII Compatible Encoding prefix, used to indicate that
+// a domain name label is in "punycode" form.
+const acePrefix = "xn--"
+
+// displayProfile is a very liberal idna profile that we use to do
+// normalization for display without imposing validation rules.
+var displayProfile = idna.New(
+        idna.MapForLookup(),
+        idna.Transitional(true),
+)
+
+// ForDisplay takes a user-specified hostname and returns a normalized form of
+// it suitable for display in the UI.
+//
+// If the input is so invalid that no normalization can be performed then
+// this will return the input, assuming that the caller still wants to
+// display _something_. This function is, however, more tolerant than the
+// other functions in this package and will make a best effort to prepare
+// _any_ given hostname for display.
+//
+// For validation, use either IsValid (for explicit validation) or
+// ForComparison (which implicitly validates, returning an error if invalid).
+func ForDisplay(given string) string {
+        var portPortion string
+        if colonPos := strings.Index(given, ":"); colonPos != -1 {
+                given, portPortion = given[:colonPos], given[colonPos:]
+        }
+        portPortion, _ = normalizePortPortion(portPortion)
+
+        ascii, err := displayProfile.ToASCII(given)
+        if err != nil {
+                return given + portPortion
+        }
+        display, err := displayProfile.ToUnicode(ascii)
+        if err != nil {
+                return given + portPortion
+        }
+        return display + portPortion
+}
+
+// IsValid returns true if the given user-specified hostname is a valid
+// service hostname.
+//
+// Validity is determined by complying with the RFC 5891 requirements for
+// names that are valid for domain lookup (section 5), with the additional
+// requirement that user-supplied forms must not _already_ contain
+// Punycode segments.
+func IsValid(given string) bool {
+        _, err := ForComparison(given)
+        return err == nil
+}
+
+// ForComparison takes a user-specified hostname and returns a normalized
+// form of it suitable for storage and comparison. The result is not suitable
+// for display to end-users because it uses Punycode to represent non-ASCII
+// characters, and this form is unreadable for non-ASCII-speaking humans.
+//
+// The result is typed as Hostname -- a specialized name for string -- so that
+// other APIs can make it clear within the type system whether they expect a
+// user-specified or display-form hostname or a value already normalized for
+// comparison.
+//
+// The returned Hostname is not valid if the returned error is non-nil.
+func ForComparison(given string) (Hostname, error) {
+        var portPortion string
+        if colonPos := strings.Index(given, ":"); colonPos != -1 {
+                given, portPortion = given[:colonPos], given[colonPos:]
+        }
+
+        var err error
+        portPortion, err = normalizePortPortion(portPortion)
+        if err != nil {
+                return Hostname(""), err
+        }
+
+        if given == "" {
+                return Hostname(""), fmt.Errorf("empty string is not a valid hostname")
+        }
+
+        // First we'll apply our additional constraint that Punycode must not
+        // be given directly by the user. This is not an IDN specification
+        // requirement, but we prohibit it to force users to use human-readable
+        // hostname forms within Terraform configuration.
+        labels := labelIter{orig: given}
+        for ; !labels.done(); labels.next() {
+                label := labels.label()
+                if label == "" {
+                        return Hostname(""), fmt.Errorf(
+                                "hostname contains empty label (two consecutive periods)",
+                        )
+                }
+                if strings.HasPrefix(label, acePrefix) {
+                        return Hostname(""), fmt.Errorf(
+                                "hostname label %q specified in punycode format; service hostnames must be given in unicode",
+                                label,
+                        )
+                }
+        }
+
+        result, err := idna.Lookup.ToASCII(given)
+        if err != nil {
+                return Hostname(""), err
+        }
+        return Hostname(result + portPortion), nil
+}
+
+// ForDisplay returns a version of the receiver that is appropriate for display
+// in the UI. This includes converting any punycode labels to their
+// corresponding Unicode characters.
+//
+// A round-trip through ForComparison and this ForDisplay method does not
+// guarantee the same result as calling this package's top-level ForDisplay
+// function, since a round-trip through the Hostname type implies stricter
+// handling than we do when doing basic display-only processing.
+func (h Hostname) ForDisplay() string {
+        given := string(h)
+        var portPortion string
+        if colonPos := strings.Index(given, ":"); colonPos != -1 {
+                given, portPortion = given[:colonPos], given[colonPos:]
+        }
+        // We don't normalize the port portion here because we assume it's
+        // already been normalized on the way in.
+
+        result, err := idna.Lookup.ToUnicode(given)
+        if err != nil {
+                // Should never happen, since type Hostname indicates that a string
+                // passed through our validation rules.
+                panic(fmt.Errorf("ForDisplay called on invalid Hostname: %s", err))
+        }
+        return result + portPortion
+}
+
+func (h Hostname) String() string {
+        return string(h)
+}
+
+func (h Hostname) GoString() string {
+        return fmt.Sprintf("svchost.Hostname(%q)", string(h))
+}
+
+// normalizePortPortion attempts to normalize the "port portion" of a hostname,
+// which begins with the first colon in the hostname and should be followed
+// by a string of decimal digits.
+//
+// If the port portion is valid, a normalized version of it is returned along
+// with a nil error.
+//
+// If the port portion is invalid, the input string is returned verbatim along
+// with a non-nil error.
+//
+// An empty string is a valid port portion representing the absense of a port.
+// If non-empty, the first character must be a colon.
+func normalizePortPortion(s string) (string, error) {
+        if s == "" {
+                return s, nil
+        }
+
+        if s[0] != ':' {
+                // should never happen, since caller tends to guarantee the presence
+                // of a colon due to how it's extracted from the string.
+                return s, errors.New("port portion is missing its initial colon")
+        }
+
+        numStr := s[1:]
+        num, err := strconv.Atoi(numStr)
+        if err != nil {
+                return s, errors.New("port portion contains non-digit characters")
+        }
+        if num == 443 {
+                return "", nil // ":443" is the default
+        }
+        if num > 65535 {
+                return s, errors.New("port number is greater than 65535")
+        }
+        return fmt.Sprintf(":%d", num), nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/context.go b/vendor/github.com/hashicorp/terraform/terraform/context.go
index a814a85..f133cc2 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/context.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/context.go
@@ -8,11 +8,13 @@ import (
         "strings"
         "sync"
 
+        "github.com/hashicorp/terraform/tfdiags"
+
         "github.com/hashicorp/go-multierror"
         "github.com/hashicorp/hcl"
         "github.com/hashicorp/terraform/config"
         "github.com/hashicorp/terraform/config/module"
-        "github.com/hashicorp/terraform/helper/experiment"
+        "github.com/hashicorp/terraform/version"
 )
 
 // InputMode defines what sort of input will be asked for when Input
@@ -123,7 +125,7 @@ type Context struct {
 func NewContext(opts *ContextOpts) (*Context, error) {
         // Validate the version requirement if it is given
         if opts.Module != nil {
-                if err := checkRequiredVersion(opts.Module); err != nil {
+                if err := CheckRequiredVersion(opts.Module); err != nil {
                         return nil, err
                 }
         }
@@ -143,19 +145,14 @@ func NewContext(opts *ContextOpts) (*Context, error) {
 
         // If our state is from the future, then error. Callers can avoid
         // this error by explicitly setting `StateFutureAllowed`.
-        if !opts.StateFutureAllowed && state.FromFutureTerraform() {
-                return nil, fmt.Errorf(
-                        "Terraform doesn't allow running any operations against a state\n"+
-                                "that was written by a future Terraform version. The state is\n"+
-                                "reporting it is written by Terraform '%s'.\n\n"+
-                                "Please run at least that version of Terraform to continue.",
-                        state.TFVersion)
+        if err := CheckStateVersion(state); err != nil && !opts.StateFutureAllowed {
+                return nil, err
         }
 
         // Explicitly reset our state version to our current version so that
         // any operations we do will write out that our latest version
         // has run.
-        state.TFVersion = Version
+        state.TFVersion = version.Version
 
         // Determine parallelism, default to 10. We do this both to limit
         // CPU pressure but also to have an extra guard against rate throttling
@@ -465,7 +462,7 @@ func (c *Context) Input(mode InputMode) error {
                 }
 
                 // Do the walk
-                if _, err := c.walk(graph, nil, walkInput); err != nil {
+                if _, err := c.walk(graph, walkInput); err != nil {
                         return err
                 }
         }
@@ -490,6 +487,13 @@ func (c *Context) Input(mode InputMode) error {
 func (c *Context) Apply() (*State, error) {
         defer c.acquireRun("apply")()
 
+        // Check there are no empty target parameter values
+        for _, target := range c.targets {
+                if target == "" {
+                        return nil, fmt.Errorf("Target parameter must not have empty value")
+                }
+        }
+
         // Copy our own state
         c.state = c.state.DeepCopy()
 
@@ -506,7 +510,7 @@ func (c *Context) Apply() (*State, error) {
         }
 
         // Walk the graph
-        walker, err := c.walk(graph, graph, operation)
+        walker, err := c.walk(graph, operation)
         if len(walker.ValidationErrors) > 0 {
                 err = multierror.Append(err, walker.ValidationErrors...)
         }
@@ -527,19 +531,27 @@ func (c *Context) Apply() (*State, error) {
 func (c *Context) Plan() (*Plan, error) {
         defer c.acquireRun("plan")()
 
+        // Check there are no empty target parameter values
+        for _, target := range c.targets {
+                if target == "" {
+                        return nil, fmt.Errorf("Target parameter must not have empty value")
+                }
+        }
+
         p := &Plan{
                 Module:  c.module,
                 Vars:    c.variables,
                 State:   c.state,
                 Targets: c.targets,
 
-                TerraformVersion: VersionString(),
+                TerraformVersion: version.String(),
                 ProviderSHA256s:  c.providerSHA256s,
         }
 
         var operation walkOperation
         if c.destroy {
                 operation = walkPlanDestroy
+                p.Destroy = true
         } else {
                 // Set our state to be something temporary. We do this so that
                 // the plan can update a fake state so that variables work, then
@@ -575,7 +587,7 @@ func (c *Context) Plan() (*Plan, error) {
         }
 
         // Do the walk
-        walker, err := c.walk(graph, graph, operation)
+        walker, err := c.walk(graph, operation)
         if err != nil {
                 return nil, err
         }
@@ -630,7 +642,7 @@ func (c *Context) Refresh() (*State, error) {
         }
 
         // Do the walk
-        if _, err := c.walk(graph, graph, walkRefresh); err != nil {
+        if _, err := c.walk(graph, walkRefresh); err != nil {
                 return nil, err
         }
 
@@ -670,29 +682,27 @@ func (c *Context) Stop() {
 }
 
 // Validate validates the configuration and returns any warnings or errors.
-func (c *Context) Validate() ([]string, []error) {
+func (c *Context) Validate() tfdiags.Diagnostics {
         defer c.acquireRun("validate")()
 
-        var errs error
+        var diags tfdiags.Diagnostics
 
         // Validate the configuration itself
-        if err := c.module.Validate(); err != nil {
-                errs = multierror.Append(errs, err)
-        }
+        diags = diags.Append(c.module.Validate())
 
         // This only needs to be done for the root module, since inter-module
         // variables are validated in the module tree.
         if config := c.module.Config(); config != nil {
                 // Validate the user variables
-                if err := smcUserVariables(config, c.variables); len(err) > 0 {
-                        errs = multierror.Append(errs, err...)
+                for _, err := range smcUserVariables(config, c.variables) {
+                        diags = diags.Append(err)
                 }
         }
 
         // If we have errors at this point, the graphing has no chance,
         // so just bail early.
-        if errs != nil {
-                return nil, []error{errs}
+        if diags.HasErrors() {
+                return diags
         }
 
         // Build the graph so we can walk it and run Validate on nodes.
@@ -701,24 +711,29 @@ func (c *Context) Validate() ([]string, []error) {
         // graph again later after Planning.
         graph, err := c.Graph(GraphTypeValidate, nil)
         if err != nil {
-                return nil, []error{err}
+                diags = diags.Append(err)
+                return diags
         }
 
         // Walk
-        walker, err := c.walk(graph, graph, walkValidate)
+        walker, err := c.walk(graph, walkValidate)
         if err != nil {
-                return nil, multierror.Append(errs, err).Errors
+                diags = diags.Append(err)
         }
 
-        // Return the result
-        rerrs := multierror.Append(errs, walker.ValidationErrors...)
-
         sort.Strings(walker.ValidationWarnings)
-        sort.Slice(rerrs.Errors, func(i, j int) bool {
-                return rerrs.Errors[i].Error() < rerrs.Errors[j].Error()
+        sort.Slice(walker.ValidationErrors, func(i, j int) bool {
+                return walker.ValidationErrors[i].Error() < walker.ValidationErrors[j].Error()
         })
 
-        return walker.ValidationWarnings, rerrs.Errors
+        for _, warn := range walker.ValidationWarnings {
+                diags = diags.Append(tfdiags.SimpleWarning(warn))
+        }
+        for _, err := range walker.ValidationErrors {
+                diags = diags.Append(err)
+        }
+
+        return diags
 }
 
 // Module returns the module tree associated with this context.
@@ -792,33 +807,11 @@ func (c *Context) releaseRun() {
         c.runContext = nil
 }
 
-func (c *Context) walk(
-        graph, shadow *Graph, operation walkOperation) (*ContextGraphWalker, error) {
+func (c *Context) walk(graph *Graph, operation walkOperation) (*ContextGraphWalker, error) {
         // Keep track of the "real" context which is the context that does
         // the real work: talking to real providers, modifying real state, etc.
         realCtx := c
 
-        // If we don't want shadowing, remove it
-        if !experiment.Enabled(experiment.X_shadow) {
-                shadow = nil
-        }
-
-        // Just log this so we can see it in a debug log
-        if !c.shadow {
-                log.Printf("[WARN] terraform: shadow graph disabled")
-                shadow = nil
-        }
-
-        // If we have a shadow graph, walk that as well
-        var shadowCtx *Context
-        var shadowCloser Shadow
-        if shadow != nil {
-                // Build the shadow context. In the process, override the real context
-                // with the one that is wrapped so that the shadow context can verify
-                // the results of the real.
-                realCtx, shadowCtx, shadowCloser = newShadowContext(c)
-        }
-
         log.Printf("[DEBUG] Starting graph walk: %s", operation.String())
 
         walker := &ContextGraphWalker{
@@ -837,90 +830,6 @@ func (c *Context) walk(
         close(watchStop)
         <-watchWait
 
-        // If we have a shadow graph and we interrupted the real graph, then
-        // we just close the shadow and never verify it. It is non-trivial to
-        // recreate the exact execution state up until an interruption so this
-        // isn't supported with shadows at the moment.
-        if shadowCloser != nil && c.sh.Stopped() {
-                // Ignore the error result, there is nothing we could care about
-                shadowCloser.CloseShadow()
-
-                // Set it to nil so we don't do anything
-                shadowCloser = nil
-        }
-
-        // If we have a shadow graph, wait for that to complete.
-        if shadowCloser != nil {
-                // Build the graph walker for the shadow. We also wrap this in
-                // a panicwrap so that panics are captured. For the shadow graph,
-                // we just want panics to be normal errors rather than to crash
-                // Terraform.
-                shadowWalker := GraphWalkerPanicwrap(&ContextGraphWalker{
-                        Context:   shadowCtx,
-                        Operation: operation,
-                })
-
-                // Kick off the shadow walk. This will block on any operations
-                // on the real walk so it is fine to start first.
-                log.Printf("[INFO] Starting shadow graph walk: %s", operation.String())
-                shadowCh := make(chan error)
-                go func() {
-                        shadowCh <- shadow.Walk(shadowWalker)
-                }()
-
-                // Notify the shadow that we're done
-                if err := shadowCloser.CloseShadow(); err != nil {
-                        c.shadowErr = multierror.Append(c.shadowErr, err)
-                }
-
-                // Wait for the walk to end
-                log.Printf("[DEBUG] Waiting for shadow graph to complete...")
-                shadowWalkErr := <-shadowCh
-
-                // Get any shadow errors
-                if err := shadowCloser.ShadowError(); err != nil {
-                        c.shadowErr = multierror.Append(c.shadowErr, err)
-                }
-
-                // Verify the contexts (compare)
-                if err := shadowContextVerify(realCtx, shadowCtx); err != nil {
-                        c.shadowErr = multierror.Append(c.shadowErr, err)
-                }
-
-                // At this point, if we're supposed to fail on error, then
-                // we PANIC. Some tests just verify that there is an error,
-                // so simply appending it to realErr and returning could hide
-                // shadow problems.
-                //
-                // This must be done BEFORE appending shadowWalkErr since the
-                // shadowWalkErr may include expected errors.
-                //
-                // We only do this if we don't have a real error. In the case of
-                // a real error, we can't guarantee what nodes were and weren't
-                // traversed in parallel scenarios so we can't guarantee no
-                // shadow errors.
-                if c.shadowErr != nil && contextFailOnShadowError && realErr == nil {
-                        panic(multierror.Prefix(c.shadowErr, "shadow graph:"))
-                }
-
-                // Now, if we have a walk error, we append that through
-                if shadowWalkErr != nil {
-                        c.shadowErr = multierror.Append(c.shadowErr, shadowWalkErr)
-                }
-
-                if c.shadowErr == nil {
-                        log.Printf("[INFO] Shadow graph success!")
-                } else {
-                        log.Printf("[ERROR] Shadow graph error: %s", c.shadowErr)
-
-                        // If we're supposed to fail on shadow errors, then report it
-                        if contextFailOnShadowError {
-                                realErr = multierror.Append(realErr, multierror.Prefix(
-                                        c.shadowErr, "shadow graph:"))
-                        }
-                }
-        }
-
         return walker, realErr
 }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/context_import.go b/vendor/github.com/hashicorp/terraform/terraform/context_import.go
index f1d5776..e940143 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/context_import.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/context_import.go
@@ -66,7 +66,7 @@ func (c *Context) Import(opts *ImportOpts) (*State, error) {
         }
 
         // Walk it
-        if _, err := c.walk(graph, nil, walkImport); err != nil {
+        if _, err := c.walk(graph, walkImport); err != nil {
                 return c.state, err
         }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/diff.go b/vendor/github.com/hashicorp/terraform/terraform/diff.go
index fd1687e..d6dc550 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/diff.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/diff.go
@@ -23,6 +23,12 @@ const (
         DiffUpdate
         DiffDestroy
         DiffDestroyCreate
+
+        // DiffRefresh is only used in the UI for displaying diffs.
+        // Managed resource reads never appear in plan, and when data source
+        // reads appear they are represented as DiffCreate in core before
+        // transforming to DiffRefresh in the UI layer.
+        DiffRefresh // TODO: Actually use DiffRefresh in core too, for less confusion
 )
 
 // multiVal matches the index key to a flatmapped set, list or map
@@ -831,7 +837,14 @@ func (d *InstanceDiff) Same(d2 *InstanceDiff) (bool, string) {
                         }
                 }
 
-                // TODO: check for the same value if not computed
+                // We don't compare the values because we can't currently actually
+                // guarantee to generate the same value two two diffs created from
+                // the same state+config: we have some pesky interpolation functions
+                // that do not behave as pure functions (uuid, timestamp) and so they
+                // can be different each time a diff is produced.
+                // FIXME: Re-organize our config handling so that we don't re-evaluate
+                // expressions when we produce a second comparison diff during
+                // apply (for EvalCompareDiff).
         }
 
         // Check for leftover attributes
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval.go b/vendor/github.com/hashicorp/terraform/terraform/eval.go
index 3cb088a..10d9c22 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval.go
@@ -49,11 +49,11 @@ func EvalRaw(n EvalNode, ctx EvalContext) (interface{}, error) {
                 path = strings.Join(ctx.Path(), ".")
         }
 
-        log.Printf("[DEBUG] %s: eval: %T", path, n)
+        log.Printf("[TRACE] %s: eval: %T", path, n)
         output, err := n.Eval(ctx)
         if err != nil {
                 if _, ok := err.(EvalEarlyExitError); ok {
-                        log.Printf("[DEBUG] %s: eval: %T, err: %s", path, n, err)
+                        log.Printf("[TRACE] %s: eval: %T, err: %s", path, n, err)
                 } else {
                         log.Printf("[ERROR] %s: eval: %T, err: %s", path, n, err)
                 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_apply.go b/vendor/github.com/hashicorp/terraform/terraform/eval_apply.go
index 2f6a497..b9b4806 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_apply.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_apply.go
@@ -112,7 +112,7 @@ func (n *EvalApplyPre) Eval(ctx EvalContext) (interface{}, error) {
         }
         state.init()
 
-        {
+        if resourceHasUserVisibleApply(n.Info) {
                 // Call post-apply hook
                 err := ctx.Hook(func(h Hook) (HookAction, error) {
                         return h.PreApply(n.Info, state, diff)
@@ -136,7 +136,7 @@ type EvalApplyPost struct {
 func (n *EvalApplyPost) Eval(ctx EvalContext) (interface{}, error) {
         state := *n.State
 
-        {
+        if resourceHasUserVisibleApply(n.Info) {
                 // Call post-apply hook
                 err := ctx.Hook(func(h Hook) (HookAction, error) {
                         return h.PostApply(n.Info, state, *n.Error)
@@ -149,6 +149,22 @@ func (n *EvalApplyPost) Eval(ctx EvalContext) (interface{}, error) {
         return nil, *n.Error
 }
 
+// resourceHasUserVisibleApply returns true if the given resource is one where
+// apply actions should be exposed to the user.
+//
+// Certain resources do apply actions only as an implementation detail, so
+// these should not be advertised to code outside of this package.
+func resourceHasUserVisibleApply(info *InstanceInfo) bool {
+        addr := info.ResourceAddress()
+
+        // Only managed resources have user-visible apply actions.
+        // In particular, this excludes data resources since we "apply" these
+        // only as an implementation detail of removing them from state when
+        // they are destroyed. (When reading, they don't get here at all because
+        // we present them as "Refresh" actions.)
+        return addr.Mode == config.ManagedResourceMode
+}
+
 // EvalApplyProvisioners is an EvalNode implementation that executes
 // the provisioners for a resource.
 //
@@ -211,11 +227,8 @@ func (n *EvalApplyProvisioners) Eval(ctx EvalContext) (interface{}, error) {
                         state.Tainted = true
                 }
 
-                if n.Error != nil {
-                        *n.Error = multierror.Append(*n.Error, err)
-                } else {
-                        return nil, err
-                }
+                *n.Error = multierror.Append(*n.Error, err)
+                return nil, err
         }
 
         {
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_context.go b/vendor/github.com/hashicorp/terraform/terraform/eval_context.go
index a1f815b..86481de 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_context.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_context.go
@@ -22,11 +22,11 @@ type EvalContext interface {
         // Input is the UIInput object for interacting with the UI.
         Input() UIInput
 
-        // InitProvider initializes the provider with the given name and
+        // InitProvider initializes the provider with the given type and name, and
         // returns the implementation of the resource provider or an error.
         //
         // It is an error to initialize the same provider more than once.
-        InitProvider(string) (ResourceProvider, error)
+        InitProvider(typ string, name string) (ResourceProvider, error)
 
         // Provider gets the provider instance with the given name (already
         // initialized) or returns nil if the provider isn't initialized.
@@ -40,8 +40,6 @@ type EvalContext interface {
         // is used to store the provider configuration for inheritance lookups
         // with ParentProviderConfig().
         ConfigureProvider(string, *ResourceConfig) error
-        SetProviderConfig(string, *ResourceConfig) error
-        ParentProviderConfig(string) *ResourceConfig
 
         // ProviderInput and SetProviderInput are used to configure providers
         // from user input.
@@ -69,6 +67,13 @@ type EvalContext interface {
         // that is currently being acted upon.
         Interpolate(*config.RawConfig, *Resource) (*ResourceConfig, error)
 
+        // InterpolateProvider takes a ProviderConfig and interpolates it with the
+        // stored interpolation scope. Since provider configurations can be
+        // inherited, the interpolation scope may be different from the current
+        // context path. Interplation is otherwise executed the same as in the
+        // Interpolation method.
+        InterpolateProvider(*config.ProviderConfig, *Resource) (*ResourceConfig, error)
+
         // SetVariables sets the variables for the module within
         // this context with the name n. This function call is additive:
         // the second parameter is merged with any previous call.
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_context_builtin.go b/vendor/github.com/hashicorp/terraform/terraform/eval_context_builtin.go
index 3dcfb22..1b6ee5a 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_context_builtin.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_context_builtin.go
@@ -4,7 +4,6 @@ import (
         "context"
         "fmt"
         "log"
-        "strings"
         "sync"
 
         "github.com/hashicorp/terraform/config"
@@ -34,7 +33,6 @@ type BuiltinEvalContext struct {
         Hooks               []Hook
         InputValue          UIInput
         ProviderCache       map[string]ResourceProvider
-        ProviderConfigCache map[string]*ResourceConfig
         ProviderInputConfig map[string]map[string]interface{}
         ProviderLock        *sync.Mutex
         ProvisionerCache    map[string]ResourceProvisioner
@@ -80,12 +78,12 @@ func (ctx *BuiltinEvalContext) Input() UIInput {
         return ctx.InputValue
 }
 
-func (ctx *BuiltinEvalContext) InitProvider(n string) (ResourceProvider, error) {
+func (ctx *BuiltinEvalContext) InitProvider(typeName, name string) (ResourceProvider, error) {
         ctx.once.Do(ctx.init)
 
         // If we already initialized, it is an error
-        if p := ctx.Provider(n); p != nil {
-                return nil, fmt.Errorf("Provider '%s' already initialized", n)
+        if p := ctx.Provider(name); p != nil {
+                return nil, fmt.Errorf("Provider '%s' already initialized", name)
         }
 
         // Warning: make sure to acquire these locks AFTER the call to Provider
@@ -93,18 +91,12 @@ func (ctx *BuiltinEvalContext) InitProvider(n string) (ResourceProvider, error)
         ctx.ProviderLock.Lock()
         defer ctx.ProviderLock.Unlock()
 
-        providerPath := make([]string, len(ctx.Path())+1)
-        copy(providerPath, ctx.Path())
-        providerPath[len(providerPath)-1] = n
-        key := PathCacheKey(providerPath)
-
-        typeName := strings.SplitN(n, ".", 2)[0]
-        p, err := ctx.Components.ResourceProvider(typeName, key)
+        p, err := ctx.Components.ResourceProvider(typeName, name)
         if err != nil {
                 return nil, err
         }
 
-        ctx.ProviderCache[key] = p
+        ctx.ProviderCache[name] = p
         return p, nil
 }
 
@@ -114,11 +106,7 @@ func (ctx *BuiltinEvalContext) Provider(n string) ResourceProvider {
         ctx.ProviderLock.Lock()
         defer ctx.ProviderLock.Unlock()
 
-        providerPath := make([]string, len(ctx.Path())+1)
-        copy(providerPath, ctx.Path())
-        providerPath[len(providerPath)-1] = n
-
-        return ctx.ProviderCache[PathCacheKey(providerPath)]
+        return ctx.ProviderCache[n]
 }
 
 func (ctx *BuiltinEvalContext) CloseProvider(n string) error {
@@ -127,15 +115,11 @@ func (ctx *BuiltinEvalContext) CloseProvider(n string) error {
         ctx.ProviderLock.Lock()
         defer ctx.ProviderLock.Unlock()
 
-        providerPath := make([]string, len(ctx.Path())+1)
-        copy(providerPath, ctx.Path())
-        providerPath[len(providerPath)-1] = n
-
         var provider interface{}
-        provider = ctx.ProviderCache[PathCacheKey(providerPath)]
+        provider = ctx.ProviderCache[n]
         if provider != nil {
                 if p, ok := provider.(ResourceProviderCloser); ok {
-                        delete(ctx.ProviderCache, PathCacheKey(providerPath))
+                        delete(ctx.ProviderCache, n)
                         return p.Close()
                 }
         }
@@ -149,28 +133,9 @@ func (ctx *BuiltinEvalContext) ConfigureProvider(
         if p == nil {
                 return fmt.Errorf("Provider '%s' not initialized", n)
         }
-
-        if err := ctx.SetProviderConfig(n, cfg); err != nil {
-                return nil
-        }
-
         return p.Configure(cfg)
 }
 
-func (ctx *BuiltinEvalContext) SetProviderConfig(
-        n string, cfg *ResourceConfig) error {
-        providerPath := make([]string, len(ctx.Path())+1)
-        copy(providerPath, ctx.Path())
-        providerPath[len(providerPath)-1] = n
-
-        // Save the configuration
-        ctx.ProviderLock.Lock()
-        ctx.ProviderConfigCache[PathCacheKey(providerPath)] = cfg
-        ctx.ProviderLock.Unlock()
-
-        return nil
-}
-
 func (ctx *BuiltinEvalContext) ProviderInput(n string) map[string]interface{} {
         ctx.ProviderLock.Lock()
         defer ctx.ProviderLock.Unlock()
@@ -203,27 +168,6 @@ func (ctx *BuiltinEvalContext) SetProviderInput(n string, c map[string]interface
         ctx.ProviderLock.Unlock()
 }
 
-func (ctx *BuiltinEvalContext) ParentProviderConfig(n string) *ResourceConfig {
-        ctx.ProviderLock.Lock()
-        defer ctx.ProviderLock.Unlock()
-
-        // Make a copy of the path so we can safely edit it
-        path := ctx.Path()
-        pathCopy := make([]string, len(path)+1)
-        copy(pathCopy, path)
-
-        // Go up the tree.
-        for i := len(path) - 1; i >= 0; i-- {
-                pathCopy[i+1] = n
-                k := PathCacheKey(pathCopy[:i+2])
-                if v, ok := ctx.ProviderConfigCache[k]; ok {
-                        return v
-                }
-        }
-
-        return nil
-}
-
 func (ctx *BuiltinEvalContext) InitProvisioner(
         n string) (ResourceProvisioner, error) {
         ctx.once.Do(ctx.init)
@@ -289,6 +233,7 @@ func (ctx *BuiltinEvalContext) CloseProvisioner(n string) error {
 
 func (ctx *BuiltinEvalContext) Interpolate(
         cfg *config.RawConfig, r *Resource) (*ResourceConfig, error) {
+
         if cfg != nil {
                 scope := &InterpolationScope{
                         Path:     ctx.Path(),
@@ -311,6 +256,35 @@ func (ctx *BuiltinEvalContext) Interpolate(
         return result, nil
 }
 
+func (ctx *BuiltinEvalContext) InterpolateProvider(
+        pc *config.ProviderConfig, r *Resource) (*ResourceConfig, error) {
+
+        var cfg *config.RawConfig
+
+        if pc != nil && pc.RawConfig != nil {
+                scope := &InterpolationScope{
+                        Path:     ctx.Path(),
+                        Resource: r,
+                }
+
+                cfg = pc.RawConfig
+
+                vs, err := ctx.Interpolater.Values(scope, cfg.Variables)
+                if err != nil {
+                        return nil, err
+                }
+
+                // Do the interpolation
+                if err := cfg.Interpolate(vs); err != nil {
+                        return nil, err
+                }
+        }
+
+        result := NewResourceConfig(cfg)
+        result.interpolateForce()
+        return result, nil
+}
+
 func (ctx *BuiltinEvalContext) Path() []string {
         return ctx.PathValue
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_context_mock.go b/vendor/github.com/hashicorp/terraform/terraform/eval_context_mock.go
index 4f90d5b..6464517 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_context_mock.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_context_mock.go
@@ -45,14 +45,6 @@ type MockEvalContext struct {
         ConfigureProviderConfig *ResourceConfig
         ConfigureProviderError  error
 
-        SetProviderConfigCalled bool
-        SetProviderConfigName   string
-        SetProviderConfigConfig *ResourceConfig
-
-        ParentProviderConfigCalled bool
-        ParentProviderConfigName   string
-        ParentProviderConfigConfig *ResourceConfig
-
         InitProvisionerCalled      bool
         InitProvisionerName        string
         InitProvisionerProvisioner ResourceProvisioner
@@ -72,6 +64,12 @@ type MockEvalContext struct {
         InterpolateConfigResult *ResourceConfig
         InterpolateError        error
 
+        InterpolateProviderCalled       bool
+        InterpolateProviderConfig       *config.ProviderConfig
+        InterpolateProviderResource     *Resource
+        InterpolateProviderConfigResult *ResourceConfig
+        InterpolateProviderError        error
+
         PathCalled bool
         PathPath   []string
 
@@ -109,7 +107,7 @@ func (c *MockEvalContext) Input() UIInput {
         return c.InputInput
 }
 
-func (c *MockEvalContext) InitProvider(n string) (ResourceProvider, error) {
+func (c *MockEvalContext) InitProvider(t, n string) (ResourceProvider, error) {
         c.InitProviderCalled = true
         c.InitProviderName = n
         return c.InitProviderProvider, c.InitProviderError
@@ -134,20 +132,6 @@ func (c *MockEvalContext) ConfigureProvider(n string, cfg *ResourceConfig) error
         return c.ConfigureProviderError
 }
 
-func (c *MockEvalContext) SetProviderConfig(
-        n string, cfg *ResourceConfig) error {
-        c.SetProviderConfigCalled = true
-        c.SetProviderConfigName = n
-        c.SetProviderConfigConfig = cfg
-        return nil
-}
-
-func (c *MockEvalContext) ParentProviderConfig(n string) *ResourceConfig {
-        c.ParentProviderConfigCalled = true
-        c.ParentProviderConfigName = n
-        return c.ParentProviderConfigConfig
-}
-
 func (c *MockEvalContext) ProviderInput(n string) map[string]interface{} {
         c.ProviderInputCalled = true
         c.ProviderInputName = n
@@ -186,6 +170,14 @@ func (c *MockEvalContext) Interpolate(
         return c.InterpolateConfigResult, c.InterpolateError
 }
 
+func (c *MockEvalContext) InterpolateProvider(
+        config *config.ProviderConfig, resource *Resource) (*ResourceConfig, error) {
+        c.InterpolateProviderCalled = true
+        c.InterpolateProviderConfig = config
+        c.InterpolateProviderResource = resource
+        return c.InterpolateProviderConfigResult, c.InterpolateError
+}
+
 func (c *MockEvalContext) Path() []string {
         c.PathCalled = true
         return c.PathPath
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_diff.go b/vendor/github.com/hashicorp/terraform/terraform/eval_diff.go
index c35f908..26205ce 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_diff.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_diff.go
@@ -6,6 +6,7 @@ import (
         "strings"
 
         "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/version"
 )
 
 // EvalCompareDiff is an EvalNode implementation that compares two diffs
@@ -60,7 +61,7 @@ func (n *EvalCompareDiff) Eval(ctx EvalContext) (interface{}, error) {
                                 "\n"+
                                 "Also include as much context as you can about your config, state, "+
                                 "and the steps you performed to trigger this error.\n",
-                        n.Info.Id, Version, n.Info.Id, reason, one, two)
+                        n.Info.Id, version.Version, n.Info.Id, reason, one, two)
         }
 
         return nil, nil
@@ -255,11 +256,15 @@ func (n *EvalDiff) processIgnoreChanges(diff *InstanceDiff) error {
                 containers := groupContainers(diff)
                 keep := map[string]bool{}
                 for _, v := range containers {
-                        if v.keepDiff() {
+                        if v.keepDiff(ignorableAttrKeys) {
                                 // At least one key has changes, so list all the sibling keys
-                                // to keep in the diff.
+                                // to keep in the diff
                                 for k := range v {
                                         keep[k] = true
+                                        // this key may have been added by the user to ignore, but
+                                        // if it's a subkey in a container, we need to un-ignore it
+                                        // to keep the complete containter.
+                                        delete(ignorableAttrKeys, k)
                                 }
                         }
                 }
@@ -291,10 +296,17 @@ func (n *EvalDiff) processIgnoreChanges(diff *InstanceDiff) error {
 // a group of key-*ResourceAttrDiff pairs from the same flatmapped container
 type flatAttrDiff map[string]*ResourceAttrDiff
 
-// we need to keep all keys if any of them have a diff
-func (f flatAttrDiff) keepDiff() bool {
-        for _, v := range f {
-                if !v.Empty() && !v.NewComputed {
+// we need to keep all keys if any of them have a diff that's not ignored
+func (f flatAttrDiff) keepDiff(ignoreChanges map[string]bool) bool {
+        for k, v := range f {
+                ignore := false
+                for attr := range ignoreChanges {
+                        if strings.HasPrefix(k, attr) {
+                                ignore = true
+                        }
+                }
+
+                if !v.Empty() && !v.NewComputed && !ignore {
                         return true
                 }
         }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_interpolate.go b/vendor/github.com/hashicorp/terraform/terraform/eval_interpolate.go
index 6825ff5..6a78a6b 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_interpolate.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_interpolate.go
@@ -1,18 +1,50 @@
 package terraform
 
-import "github.com/hashicorp/terraform/config"
+import (
+        "log"
+
+        "github.com/hashicorp/terraform/config"
+)
 
 // EvalInterpolate is an EvalNode implementation that takes a raw
 // configuration and interpolates it.
 type EvalInterpolate struct {
-        Config   *config.RawConfig
-        Resource *Resource
-        Output   **ResourceConfig
+        Config        *config.RawConfig
+        Resource      *Resource
+        Output        **ResourceConfig
+        ContinueOnErr bool
 }
 
 func (n *EvalInterpolate) Eval(ctx EvalContext) (interface{}, error) {
         rc, err := ctx.Interpolate(n.Config, n.Resource)
         if err != nil {
+                if n.ContinueOnErr {
+                        log.Printf("[WARN] Interpolation %q failed: %s", n.Config.Key, err)
+                        return nil, EvalEarlyExitError{}
+                }
+                return nil, err
+        }
+
+        if n.Output != nil {
+                *n.Output = rc
+        }
+
+        return nil, nil
+}
+
+// EvalInterpolateProvider is an EvalNode implementation that takes a
+// ProviderConfig and interpolates it. Provider configurations are the only
+// "inherited" type of configuration we have, and the original raw config may
+// have a different interpolation scope.
+type EvalInterpolateProvider struct {
+        Config   *config.ProviderConfig
+        Resource *Resource
+        Output   **ResourceConfig
+}
+
+func (n *EvalInterpolateProvider) Eval(ctx EvalContext) (interface{}, error) {
+        rc, err := ctx.InterpolateProvider(n.Config, n.Resource)
+        if err != nil {
                 return nil, err
         }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_local.go b/vendor/github.com/hashicorp/terraform/terraform/eval_local.go
new file mode 100644
index 0000000..a4b2a50
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_local.go
@@ -0,0 +1,86 @@
+package terraform
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/terraform/config"
+)
+
+// EvalLocal is an EvalNode implementation that evaluates the
+// expression for a local value and writes it into a transient part of
+// the state.
+type EvalLocal struct {
+        Name  string
+        Value *config.RawConfig
+}
+
+func (n *EvalLocal) Eval(ctx EvalContext) (interface{}, error) {
+        cfg, err := ctx.Interpolate(n.Value, nil)
+        if err != nil {
+                return nil, fmt.Errorf("local.%s: %s", n.Name, err)
+        }
+
+        state, lock := ctx.State()
+        if state == nil {
+                return nil, fmt.Errorf("cannot write local value to nil state")
+        }
+
+        // Get a write lock so we can access the state
+        lock.Lock()
+        defer lock.Unlock()
+
+        // Look for the module state. If we don't have one, create it.
+        mod := state.ModuleByPath(ctx.Path())
+        if mod == nil {
+                mod = state.AddModule(ctx.Path())
+        }
+
+        // Get the value from the config
+        var valueRaw interface{} = config.UnknownVariableValue
+        if cfg != nil {
+                var ok bool
+                valueRaw, ok = cfg.Get("value")
+                if !ok {
+                        valueRaw = ""
+                }
+                if cfg.IsComputed("value") {
+                        valueRaw = config.UnknownVariableValue
+                }
+        }
+
+        if mod.Locals == nil {
+                // initialize
+                mod.Locals = map[string]interface{}{}
+        }
+        mod.Locals[n.Name] = valueRaw
+
+        return nil, nil
+}
+
+// EvalDeleteLocal is an EvalNode implementation that deletes a Local value
+// from the state. Locals aren't persisted, but we don't need to evaluate them
+// during destroy.
+type EvalDeleteLocal struct {
+        Name string
+}
+
+func (n *EvalDeleteLocal) Eval(ctx EvalContext) (interface{}, error) {
+        state, lock := ctx.State()
+        if state == nil {
+                return nil, nil
+        }
+
+        // Get a write lock so we can access this instance
+        lock.Lock()
+        defer lock.Unlock()
+
+        // Look for the module state. If we don't have one, create it.
+        mod := state.ModuleByPath(ctx.Path())
+        if mod == nil {
+                return nil, nil
+        }
+
+        delete(mod.Locals, n.Name)
+
+        return nil, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_output.go b/vendor/github.com/hashicorp/terraform/terraform/eval_output.go
index cf61781..a834627 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_output.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_output.go
@@ -41,15 +41,16 @@ type EvalWriteOutput struct {
         Name      string
         Sensitive bool
         Value     *config.RawConfig
+        // ContinueOnErr allows interpolation to fail during Input
+        ContinueOnErr bool
 }
 
 // TODO: test
 func (n *EvalWriteOutput) Eval(ctx EvalContext) (interface{}, error) {
+        // This has to run before we have a state lock, since interpolation also
+        // reads the state
         cfg, err := ctx.Interpolate(n.Value, nil)
-        if err != nil {
-                // Log error but continue anyway
-                log.Printf("[WARN] Output interpolation %q failed: %s", n.Name, err)
-        }
+        // handle the error after we have the module from the state
 
         state, lock := ctx.State()
         if state == nil {
@@ -59,13 +60,27 @@ func (n *EvalWriteOutput) Eval(ctx EvalContext) (interface{}, error) {
         // Get a write lock so we can access this instance
         lock.Lock()
         defer lock.Unlock()
-
         // Look for the module state. If we don't have one, create it.
         mod := state.ModuleByPath(ctx.Path())
         if mod == nil {
                 mod = state.AddModule(ctx.Path())
         }
 
+        // handling the interpolation error
+        if err != nil {
+                if n.ContinueOnErr || flagWarnOutputErrors {
+                        log.Printf("[ERROR] Output interpolation %q failed: %s", n.Name, err)
+                        // if we're continuing, make sure the output is included, and
+                        // marked as unknown
+                        mod.Outputs[n.Name] = &OutputState{
+                                Type:  "string",
+                                Value: config.UnknownVariableValue,
+                        }
+                        return nil, EvalEarlyExitError{}
+                }
+                return nil, err
+        }
+
         // Get the value from the config
         var valueRaw interface{} = config.UnknownVariableValue
         if cfg != nil {
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_provider.go b/vendor/github.com/hashicorp/terraform/terraform/eval_provider.go
index 092fd18..61f6ff9 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_provider.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_provider.go
@@ -6,17 +6,6 @@ import (
         "github.com/hashicorp/terraform/config"
 )
 
-// EvalSetProviderConfig sets the parent configuration for a provider
-// without configuring that provider, validating it, etc.
-type EvalSetProviderConfig struct {
-        Provider string
-        Config   **ResourceConfig
-}
-
-func (n *EvalSetProviderConfig) Eval(ctx EvalContext) (interface{}, error) {
-        return nil, ctx.SetProviderConfig(n.Provider, *n.Config)
-}
-
 // EvalBuildProviderConfig outputs a *ResourceConfig that is properly
 // merged with parents and inputs on top of what is configured in the file.
 type EvalBuildProviderConfig struct {
@@ -28,7 +17,7 @@ type EvalBuildProviderConfig struct {
 func (n *EvalBuildProviderConfig) Eval(ctx EvalContext) (interface{}, error) {
         cfg := *n.Config
 
-        // If we have a configuration set, then merge that in
+        // If we have an Input configuration set, then merge that in
         if input := ctx.ProviderInput(n.Provider); input != nil {
                 // "input" is a map of the subset of config values that were known
                 // during the input walk, set by EvalInputProvider. Note that
@@ -40,13 +29,7 @@ func (n *EvalBuildProviderConfig) Eval(ctx EvalContext) (interface{}, error) {
                         return nil, err
                 }
 
-                merged := cfg.raw.Merge(rc)
-                cfg = NewResourceConfig(merged)
-        }
-
-        // Get the parent configuration if there is one
-        if parent := ctx.ParentProviderConfig(n.Provider); parent != nil {
-                merged := cfg.raw.Merge(parent.raw)
+                merged := rc.Merge(cfg.raw)
                 cfg = NewResourceConfig(merged)
         }
 
@@ -69,11 +52,12 @@ func (n *EvalConfigProvider) Eval(ctx EvalContext) (interface{}, error) {
 // and returns nothing. The provider can be retrieved again with the
 // EvalGetProvider node.
 type EvalInitProvider struct {
-        Name string
+        TypeName string
+        Name     string
 }
 
 func (n *EvalInitProvider) Eval(ctx EvalContext) (interface{}, error) {
-        return ctx.InitProvider(n.Name)
+        return ctx.InitProvider(n.TypeName, n.Name)
 }
 
 // EvalCloseProvider is an EvalNode implementation that closes provider
@@ -116,12 +100,8 @@ type EvalInputProvider struct {
 }
 
 func (n *EvalInputProvider) Eval(ctx EvalContext) (interface{}, error) {
-        // If we already configured this provider, then don't do this again
-        if v := ctx.ProviderInput(n.Name); v != nil {
-                return nil, nil
-        }
-
         rc := *n.Config
+        orig := rc.DeepCopy()
 
         // Wrap the input into a namespace
         input := &PrefixUIInput{
@@ -138,27 +118,20 @@ func (n *EvalInputProvider) Eval(ctx EvalContext) (interface{}, error) {
                         "Error configuring %s: %s", n.Name, err)
         }
 
-        // Set the input that we received so that child modules don't attempt
-        // to ask for input again.
+        // We only store values that have changed through Input.
+        // The goal is to cache cache input responses, not to provide a complete
+        // config for other providers.
+        confMap := make(map[string]interface{})
         if config != nil && len(config.Config) > 0 {
-                // This repository of provider input results on the context doesn't
-                // retain config.ComputedKeys, so we need to filter those out here
-                // in order that later users of this data won't try to use the unknown
-                // value placeholder as if it were a literal value. This map is just
-                // of known values we've been able to complete so far; dynamic stuff
-                // will be merged in by EvalBuildProviderConfig on subsequent
-                // (post-input) walks.
-                confMap := config.Config
-                if config.ComputedKeys != nil {
-                        for _, key := range config.ComputedKeys {
-                                delete(confMap, key)
+                // any values that weren't in the original ResourcConfig will be cached
+                for k, v := range config.Config {
+                        if _, ok := orig.Config[k]; !ok {
+                                confMap[k] = v
                         }
                 }
-
-                ctx.SetProviderInput(n.Name, confMap)
-        } else {
-                ctx.SetProviderInput(n.Name, map[string]interface{}{})
         }
 
+        ctx.SetProviderInput(n.Name, confMap)
+
         return nil, nil
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_state.go b/vendor/github.com/hashicorp/terraform/terraform/eval_state.go
index 126a0e6..1182690 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_state.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_state.go
@@ -1,6 +1,8 @@
 package terraform
 
-import "fmt"
+import (
+        "fmt"
+)
 
 // EvalReadState is an EvalNode implementation that reads the
 // primary InstanceState for a specific resource out of the state.
@@ -212,37 +214,6 @@ func writeInstanceToState(
         return nil, nil
 }
 
-// EvalClearPrimaryState is an EvalNode implementation that clears the primary
-// instance from a resource state.
-type EvalClearPrimaryState struct {
-        Name string
-}
-
-func (n *EvalClearPrimaryState) Eval(ctx EvalContext) (interface{}, error) {
-        state, lock := ctx.State()
-
-        // Get a read lock so we can access this instance
-        lock.RLock()
-        defer lock.RUnlock()
-
-        // Look for the module state. If we don't have one, then it doesn't matter.
-        mod := state.ModuleByPath(ctx.Path())
-        if mod == nil {
-                return nil, nil
-        }
-
-        // Look for the resource state. If we don't have one, then it is okay.
-        rs := mod.Resources[n.Name]
-        if rs == nil {
-                return nil, nil
-        }
-
-        // Clear primary from the resource state
-        rs.Primary = nil
-
-        return nil, nil
-}
-
 // EvalDeposeState is an EvalNode implementation that takes the primary
 // out of a state and makes it Deposed. This is done at the beginning of
 // create-before-destroy calls so that the create can create while preserving
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_validate.go b/vendor/github.com/hashicorp/terraform/terraform/eval_validate.go
index 478aa64..3e5a84c 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_validate.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_validate.go
@@ -144,16 +144,20 @@ func (n *EvalValidateProvisioner) validateConnConfig(connConfig *ResourceConfig)
 
                 // For type=ssh only (enforced in ssh communicator)
                 PrivateKey        interface{} `mapstructure:"private_key"`
+                HostKey           interface{} `mapstructure:"host_key"`
                 Agent             interface{} `mapstructure:"agent"`
                 BastionHost       interface{} `mapstructure:"bastion_host"`
+                BastionHostKey    interface{} `mapstructure:"bastion_host_key"`
                 BastionPort       interface{} `mapstructure:"bastion_port"`
                 BastionUser       interface{} `mapstructure:"bastion_user"`
                 BastionPassword   interface{} `mapstructure:"bastion_password"`
                 BastionPrivateKey interface{} `mapstructure:"bastion_private_key"`
+                AgentIdentity     interface{} `mapstructure:"agent_identity"`
 
                 // For type=winrm only (enforced in winrm communicator)
                 HTTPS    interface{} `mapstructure:"https"`
                 Insecure interface{} `mapstructure:"insecure"`
+                NTLM     interface{} `mapstructure:"use_ntlm"`
                 CACert   interface{} `mapstructure:"cacert"`
         }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/evaltree_provider.go b/vendor/github.com/hashicorp/terraform/terraform/evaltree_provider.go
index 00392ef..0c3da48 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/evaltree_provider.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/evaltree_provider.go
@@ -1,17 +1,24 @@
 package terraform
 
 import (
+        "strings"
+
         "github.com/hashicorp/terraform/config"
 )
 
 // ProviderEvalTree returns the evaluation tree for initializing and
 // configuring providers.
-func ProviderEvalTree(n string, config *config.RawConfig) EvalNode {
+func ProviderEvalTree(n *NodeApplyableProvider, config *config.ProviderConfig) EvalNode {
         var provider ResourceProvider
         var resourceConfig *ResourceConfig
 
+        typeName := strings.SplitN(n.NameValue, ".", 2)[0]
+
         seq := make([]EvalNode, 0, 5)
-        seq = append(seq, &EvalInitProvider{Name: n})
+        seq = append(seq, &EvalInitProvider{
+                TypeName: typeName,
+                Name:     n.Name(),
+        })
 
         // Input stuff
         seq = append(seq, &EvalOpFilter{
@@ -19,20 +26,20 @@ func ProviderEvalTree(n string, config *config.RawConfig) EvalNode {
                 Node: &EvalSequence{
                         Nodes: []EvalNode{
                                 &EvalGetProvider{
-                                        Name:   n,
+                                        Name:   n.Name(),
                                         Output: &provider,
                                 },
-                                &EvalInterpolate{
+                                &EvalInterpolateProvider{
                                         Config: config,
                                         Output: &resourceConfig,
                                 },
                                 &EvalBuildProviderConfig{
-                                        Provider: n,
+                                        Provider: n.NameValue,
                                         Config:   &resourceConfig,
                                         Output:   &resourceConfig,
                                 },
                                 &EvalInputProvider{
-                                        Name:     n,
+                                        Name:     n.NameValue,
                                         Provider: &provider,
                                         Config:   &resourceConfig,
                                 },
@@ -45,15 +52,15 @@ func ProviderEvalTree(n string, config *config.RawConfig) EvalNode {
                 Node: &EvalSequence{
                         Nodes: []EvalNode{
                                 &EvalGetProvider{
-                                        Name:   n,
+                                        Name:   n.Name(),
                                         Output: &provider,
                                 },
-                                &EvalInterpolate{
+                                &EvalInterpolateProvider{
                                         Config: config,
                                         Output: &resourceConfig,
                                 },
                                 &EvalBuildProviderConfig{
-                                        Provider: n,
+                                        Provider: n.NameValue,
                                         Config:   &resourceConfig,
                                         Output:   &resourceConfig,
                                 },
@@ -61,10 +68,6 @@ func ProviderEvalTree(n string, config *config.RawConfig) EvalNode {
                                         Provider: &provider,
                                         Config:   &resourceConfig,
                                 },
-                                &EvalSetProviderConfig{
-                                        Provider: n,
-                                        Config:   &resourceConfig,
-                                },
                         },
                 },
         })
@@ -75,22 +78,18 @@ func ProviderEvalTree(n string, config *config.RawConfig) EvalNode {
                 Node: &EvalSequence{
                         Nodes: []EvalNode{
                                 &EvalGetProvider{
-                                        Name:   n,
+                                        Name:   n.Name(),
                                         Output: &provider,
                                 },
-                                &EvalInterpolate{
+                                &EvalInterpolateProvider{
                                         Config: config,
                                         Output: &resourceConfig,
                                 },
                                 &EvalBuildProviderConfig{
-                                        Provider: n,
+                                        Provider: n.NameValue,
                                         Config:   &resourceConfig,
                                         Output:   &resourceConfig,
                                 },
-                                &EvalSetProviderConfig{
-                                        Provider: n,
-                                        Config:   &resourceConfig,
-                                },
                         },
                 },
         })
@@ -102,7 +101,7 @@ func ProviderEvalTree(n string, config *config.RawConfig) EvalNode {
                 Node: &EvalSequence{
                         Nodes: []EvalNode{
                                 &EvalConfigProvider{
-                                        Provider: n,
+                                        Provider: n.Name(),
                                         Config:   &resourceConfig,
                                 },
                         },
diff --git a/vendor/github.com/hashicorp/terraform/terraform/features.go b/vendor/github.com/hashicorp/terraform/terraform/features.go
new file mode 100644
index 0000000..97c77bd
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/features.go
@@ -0,0 +1,7 @@
+package terraform
+
+import "os"
+
+// This file holds feature flags for the next release
+
+var flagWarnOutputErrors = os.Getenv("TF_WARN_OUTPUT_ERRORS") != ""
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph.go b/vendor/github.com/hashicorp/terraform/terraform/graph.go
index 48ce6a3..735ec4e 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph.go
@@ -70,7 +70,7 @@ func (g *Graph) walk(walker GraphWalker) error {
         // Walk the graph.
         var walkFn dag.WalkFunc
         walkFn = func(v dag.Vertex) (rerr error) {
-                log.Printf("[DEBUG] vertex '%s.%s': walking", path, dag.VertexName(v))
+                log.Printf("[TRACE] vertex '%s.%s': walking", path, dag.VertexName(v))
                 g.DebugVisitInfo(v, g.debugName)
 
                 // If we have a panic wrap GraphWalker and a panic occurs, recover
@@ -118,7 +118,7 @@ func (g *Graph) walk(walker GraphWalker) error {
 
                         // Allow the walker to change our tree if needed. Eval,
                         // then callback with the output.
-                        log.Printf("[DEBUG] vertex '%s.%s': evaluating", path, dag.VertexName(v))
+                        log.Printf("[TRACE] vertex '%s.%s': evaluating", path, dag.VertexName(v))
 
                         g.DebugVertexInfo(v, fmt.Sprintf("evaluating %T(%s)", v, path))
 
@@ -132,7 +132,7 @@ func (g *Graph) walk(walker GraphWalker) error {
                 // If the node is dynamically expanded, then expand it
                 if ev, ok := v.(GraphNodeDynamicExpandable); ok {
                         log.Printf(
-                                "[DEBUG] vertex '%s.%s': expanding/walking dynamic subgraph",
+                                "[TRACE] vertex '%s.%s': expanding/walking dynamic subgraph",
                                 path,
                                 dag.VertexName(v))
 
@@ -154,7 +154,7 @@ func (g *Graph) walk(walker GraphWalker) error {
                 // If the node has a subgraph, then walk the subgraph
                 if sn, ok := v.(GraphNodeSubgraph); ok {
                         log.Printf(
-                                "[DEBUG] vertex '%s.%s': walking subgraph",
+                                "[TRACE] vertex '%s.%s': walking subgraph",
                                 path,
                                 dag.VertexName(v))
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_apply.go b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_apply.go
index 38a90f2..0c2b233 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_apply.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_apply.go
@@ -87,12 +87,8 @@ func (b *ApplyGraphBuilder) Steps() []GraphTransformer {
                 // Attach the state
                 &AttachStateTransformer{State: b.State},
 
-                // Create all the providers
-                &MissingProviderTransformer{Providers: b.Providers, Concrete: concreteProvider},
-                &ProviderTransformer{},
-                &DisableProviderTransformer{},
-                &ParentProviderTransformer{},
-                &AttachProviderConfigTransformer{Module: b.Module},
+                // add providers
+                TransformProviders(b.Providers, concreteProvider, b.Module),
 
                 // Destruction ordering
                 &DestroyEdgeTransformer{Module: b.Module, State: b.State},
@@ -108,15 +104,36 @@ func (b *ApplyGraphBuilder) Steps() []GraphTransformer {
                 // Add root variables
                 &RootVariableTransformer{Module: b.Module},
 
+                // Add the local values
+                &LocalTransformer{Module: b.Module},
+
                 // Add the outputs
                 &OutputTransformer{Module: b.Module},
 
                 // Add module variables
                 &ModuleVariableTransformer{Module: b.Module},
 
+                // Remove modules no longer present in the config
+                &RemovedModuleTransformer{Module: b.Module, State: b.State},
+
                 // Connect references so ordering is correct
                 &ReferenceTransformer{},
 
+                // Handle destroy time transformations for output and local values.
+                // Reverse the edges from outputs and locals, so that
+                // interpolations don't fail during destroy.
+                // Create a destroy node for outputs to remove them from the state.
+                // Prune unreferenced values, which may have interpolations that can't
+                // be resolved.
+                GraphTransformIf(
+                        func() bool { return b.Destroy },
+                        GraphTransformMulti(
+                                &DestroyValueReferenceTransformer{},
+                                &DestroyOutputTransformer{},
+                                &PruneUnusedValuesTransformer{},
+                        ),
+                ),
+
                 // Add the node to fix the state count boundaries
                 &CountBoundaryTransformer{},
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_import.go b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_import.go
index 7070c59..07a1eaf 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_import.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_import.go
@@ -52,12 +52,7 @@ func (b *ImportGraphBuilder) Steps() []GraphTransformer {
                 // Add the import steps
                 &ImportStateTransformer{Targets: b.ImportTargets},
 
-                // Provider-related transformations
-                &MissingProviderTransformer{Providers: b.Providers, Concrete: concreteProvider},
-                &ProviderTransformer{},
-                &DisableProviderTransformer{},
-                &ParentProviderTransformer{},
-                &AttachProviderConfigTransformer{Module: mod},
+                TransformProviders(b.Providers, concreteProvider, mod),
 
                 // This validates that the providers only depend on variables
                 &ImportProviderValidateTransformer{},
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_plan.go b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_plan.go
index 4b29bbb..f8dd0fc 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_plan.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_plan.go
@@ -71,6 +71,9 @@ func (b *PlanGraphBuilder) Steps() []GraphTransformer {
                         Module:   b.Module,
                 },
 
+                // Add the local values
+                &LocalTransformer{Module: b.Module},
+
                 // Add the outputs
                 &OutputTransformer{Module: b.Module},
 
@@ -81,6 +84,12 @@ func (b *PlanGraphBuilder) Steps() []GraphTransformer {
                         Module:   b.Module,
                 },
 
+                // Create orphan output nodes
+                &OrphanOutputTransformer{
+                        Module: b.Module,
+                        State:  b.State,
+                },
+
                 // Attach the configuration to any resources
                 &AttachResourceConfigTransformer{Module: b.Module},
 
@@ -90,12 +99,7 @@ func (b *PlanGraphBuilder) Steps() []GraphTransformer {
                 // Add root variables
                 &RootVariableTransformer{Module: b.Module},
 
-                // Create all the providers
-                &MissingProviderTransformer{Providers: b.Providers, Concrete: b.ConcreteProvider},
-                &ProviderTransformer{},
-                &DisableProviderTransformer{},
-                &ParentProviderTransformer{},
-                &AttachProviderConfigTransformer{Module: b.Module},
+                TransformProviders(b.Providers, b.ConcreteProvider, b.Module),
 
                 // Provisioner-related transformations. Only add these if requested.
                 GraphTransformIf(
@@ -107,7 +111,12 @@ func (b *PlanGraphBuilder) Steps() []GraphTransformer {
                 ),
 
                 // Add module variables
-                &ModuleVariableTransformer{Module: b.Module},
+                &ModuleVariableTransformer{
+                        Module: b.Module,
+                },
+
+                // Remove modules no longer present in the config
+                &RemovedModuleTransformer{Module: b.Module, State: b.State},
 
                 // Connect so that the references are ready for targeting. We'll
                 // have to connect again later for providers and so on.
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_refresh.go b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_refresh.go
index 3d3e968..9638d4c 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_refresh.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_refresh.go
@@ -126,12 +126,10 @@ func (b *RefreshGraphBuilder) Steps() []GraphTransformer {
                 // Add root variables
                 &RootVariableTransformer{Module: b.Module},
 
-                // Create all the providers
-                &MissingProviderTransformer{Providers: b.Providers, Concrete: concreteProvider},
-                &ProviderTransformer{},
-                &DisableProviderTransformer{},
-                &ParentProviderTransformer{},
-                &AttachProviderConfigTransformer{Module: b.Module},
+                TransformProviders(b.Providers, concreteProvider, b.Module),
+
+                // Add the local values
+                &LocalTransformer{Module: b.Module},
 
                 // Add the outputs
                 &OutputTransformer{Module: b.Module},
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_walk_context.go b/vendor/github.com/hashicorp/terraform/terraform/graph_walk_context.go
index e63b460..89f376e 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_walk_context.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_walk_context.go
@@ -32,7 +32,6 @@ type ContextGraphWalker struct {
         interpolaterVars    map[string]map[string]interface{}
         interpolaterVarLock sync.Mutex
         providerCache       map[string]ResourceProvider
-        providerConfigCache map[string]*ResourceConfig
         providerLock        sync.Mutex
         provisionerCache    map[string]ResourceProvisioner
         provisionerLock     sync.Mutex
@@ -73,7 +72,6 @@ func (w *ContextGraphWalker) EnterPath(path []string) EvalContext {
                 InputValue:          w.Context.uiInput,
                 Components:          w.Context.components,
                 ProviderCache:       w.providerCache,
-                ProviderConfigCache: w.providerConfigCache,
                 ProviderInputConfig: w.Context.providerInputConfig,
                 ProviderLock:        &w.providerLock,
                 ProvisionerCache:    w.provisionerCache,
@@ -151,7 +149,6 @@ func (w *ContextGraphWalker) ExitEvalTree(
 func (w *ContextGraphWalker) init() {
         w.contexts = make(map[string]*BuiltinEvalContext, 5)
         w.providerCache = make(map[string]ResourceProvider, 5)
-        w.providerConfigCache = make(map[string]*ResourceConfig, 5)
         w.provisionerCache = make(map[string]ResourceProvisioner, 5)
         w.interpolaterVars = make(map[string]map[string]interface{}, 5)
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graphtype_string.go b/vendor/github.com/hashicorp/terraform/terraform/graphtype_string.go
index e97b485..95ef4e9 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graphtype_string.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graphtype_string.go
@@ -2,7 +2,7 @@
 
 package terraform
 
-import "fmt"
+import "strconv"
 
 const _GraphType_name = "GraphTypeInvalidGraphTypeLegacyGraphTypeRefreshGraphTypePlanGraphTypePlanDestroyGraphTypeApplyGraphTypeInputGraphTypeValidate"
 
@@ -10,7 +10,7 @@ var _GraphType_index = [...]uint8{0, 16, 31, 47, 60, 80, 94, 108, 125}
 
 func (i GraphType) String() string {
         if i >= GraphType(len(_GraphType_index)-1) {
-                return fmt.Sprintf("GraphType(%d)", i)
+                return "GraphType(" + strconv.FormatInt(int64(i), 10) + ")"
         }
         return _GraphType_name[_GraphType_index[i]:_GraphType_index[i+1]]
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/instancetype_string.go b/vendor/github.com/hashicorp/terraform/terraform/instancetype_string.go
index f69267c..b8e7d1f 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/instancetype_string.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/instancetype_string.go
@@ -2,7 +2,7 @@
 
 package terraform
 
-import "fmt"
+import "strconv"
 
 const _InstanceType_name = "TypeInvalidTypePrimaryTypeTaintedTypeDeposed"
 
@@ -10,7 +10,7 @@ var _InstanceType_index = [...]uint8{0, 11, 22, 33, 44}
 
 func (i InstanceType) String() string {
         if i < 0 || i >= InstanceType(len(_InstanceType_index)-1) {
-                return fmt.Sprintf("InstanceType(%d)", i)
+                return "InstanceType(" + strconv.FormatInt(int64(i), 10) + ")"
         }
         return _InstanceType_name[_InstanceType_index[i]:_InstanceType_index[i+1]]
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/interpolate.go b/vendor/github.com/hashicorp/terraform/terraform/interpolate.go
index 22ddce6..4f4e178 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/interpolate.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/interpolate.go
@@ -90,6 +90,8 @@ func (i *Interpolater) Values(
                         err = i.valueSimpleVar(scope, n, v, result)
                 case *config.TerraformVariable:
                         err = i.valueTerraformVar(scope, n, v, result)
+                case *config.LocalVariable:
+                        err = i.valueLocalVar(scope, n, v, result)
                 case *config.UserVariable:
                         err = i.valueUserVar(scope, n, v, result)
                 default:
@@ -140,7 +142,6 @@ func (i *Interpolater) valueModuleVar(
         n string,
         v *config.ModuleVariable,
         result map[string]ast.Variable) error {
-
         // Build the path to the child module we want
         path := make([]string, len(scope.Path), len(scope.Path)+1)
         copy(path, scope.Path)
@@ -317,7 +318,6 @@ func (i *Interpolater) valueTerraformVar(
         n string,
         v *config.TerraformVariable,
         result map[string]ast.Variable) error {
-
         // "env" is supported for backward compatibility, but it's deprecated and
         // so we won't advertise it as being allowed in the error message. It will
         // be removed in a future version of Terraform.
@@ -335,6 +335,59 @@ func (i *Interpolater) valueTerraformVar(
         return nil
 }
 
+func (i *Interpolater) valueLocalVar(
+        scope *InterpolationScope,
+        n string,
+        v *config.LocalVariable,
+        result map[string]ast.Variable,
+) error {
+        i.StateLock.RLock()
+        defer i.StateLock.RUnlock()
+
+        modTree := i.Module
+        if len(scope.Path) > 1 {
+                modTree = i.Module.Child(scope.Path[1:])
+        }
+
+        // Get the resource from the configuration so we can verify
+        // that the resource is in the configuration and so we can access
+        // the configuration if we need to.
+        var cl *config.Local
+        for _, l := range modTree.Config().Locals {
+                if l.Name == v.Name {
+                        cl = l
+                        break
+                }
+        }
+
+        if cl == nil {
+                return fmt.Errorf("%s: no local value of this name has been declared", n)
+        }
+
+        // Get the relevant module
+        module := i.State.ModuleByPath(scope.Path)
+        if module == nil {
+                result[n] = unknownVariable()
+                return nil
+        }
+
+        rawV, exists := module.Locals[v.Name]
+        if !exists {
+                result[n] = unknownVariable()
+                return nil
+        }
+
+        varV, err := hil.InterfaceToVariable(rawV)
+        if err != nil {
+                // Should never happen, since interpolation should always produce
+                // something we can feed back in to interpolation.
+                return fmt.Errorf("%s: %s", n, err)
+        }
+
+        result[n] = varV
+        return nil
+}
+
 func (i *Interpolater) valueUserVar(
         scope *InterpolationScope,
         n string,
@@ -465,6 +518,16 @@ func (i *Interpolater) computeResourceVariable(
                 return &v, err
         }
 
+        // special case for the "id" field which is usually also an attribute
+        if v.Field == "id" && r.Primary.ID != "" {
+                // This is usually pulled from the attributes, but is sometimes missing
+                // during destroy. We can return the ID field in this case.
+                // FIXME: there should only be one ID to rule them all.
+                log.Printf("[WARN] resource %s missing 'id' attribute", v.ResourceId())
+                v, err := hil.InterfaceToVariable(r.Primary.ID)
+                return &v, err
+        }
+
         // computed list or map attribute
         _, isList = r.Primary.Attributes[v.Field+".#"]
         _, isMap = r.Primary.Attributes[v.Field+".%"]
@@ -602,6 +665,11 @@ func (i *Interpolater) computeResourceMultiVariable(
                         continue
                 }
 
+                if v.Field == "id" && r.Primary.ID != "" {
+                        log.Printf("[WARN] resource %s missing 'id' attribute", v.ResourceId())
+                        values = append(values, r.Primary.ID)
+                }
+
                 // computed list or map attribute
                 _, isList := r.Primary.Attributes[v.Field+".#"]
                 _, isMap := r.Primary.Attributes[v.Field+".%"]
@@ -646,7 +714,6 @@ func (i *Interpolater) computeResourceMultiVariable(
 func (i *Interpolater) interpolateComplexTypeAttribute(
         resourceID string,
         attributes map[string]string) (ast.Variable, error) {
-
         // We can now distinguish between lists and maps in state by the count field:
         //    - lists (and by extension, sets) use the traditional .# notation
         //    - maps use the newer .% notation
@@ -722,7 +789,8 @@ func (i *Interpolater) resourceCountMax(
         // If we're NOT applying, then we assume we can read the count
         // from the state. Plan and so on may not have any state yet so
         // we do a full interpolation.
-        if i.Operation != walkApply {
+        // Don't forget walkDestroy, which is a special case of walkApply
+        if !(i.Operation == walkApply || i.Operation == walkDestroy) {
                 if cr == nil {
                         return 0, nil
                 }
@@ -753,7 +821,13 @@ func (i *Interpolater) resourceCountMax(
         // use "cr.Count()" but that doesn't work if the count is interpolated
         // and we can't guarantee that so we instead depend on the state.
         max := -1
-        for k, _ := range ms.Resources {
+        for k, s := range ms.Resources {
+                // This resource may have been just removed, in which case the Primary
+                // may be nil, or just empty.
+                if s == nil || s.Primary == nil || len(s.Primary.Attributes) == 0 {
+                        continue
+                }
+
                 // Get the index number for this resource
                 index := ""
                 if k == id {
diff --git a/vendor/github.com/hashicorp/terraform/terraform/module_dependencies.go b/vendor/github.com/hashicorp/terraform/terraform/module_dependencies.go
index b9f44a0..4594cb6 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/module_dependencies.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/module_dependencies.go
@@ -17,7 +17,6 @@ import (
 // present in the configuration. This is guaranteed not to happen for any
 // configuration that has passed a call to Config.Validate().
 func ModuleTreeDependencies(root *module.Tree, state *State) *moduledeps.Module {
-
         // First we walk the configuration tree to build the overall structure
         // and capture the explicit/implicit/inherited provider dependencies.
         deps := moduleTreeConfigDependencies(root, nil)
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_data_refresh.go b/vendor/github.com/hashicorp/terraform/terraform/node_data_refresh.go
index 45129b3..d5ca641 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_data_refresh.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_data_refresh.go
@@ -27,6 +27,7 @@ func (n *NodeRefreshableDataResource) DynamicExpand(ctx EvalContext) (*Graph, er
         concreteResource := func(a *NodeAbstractResource) dag.Vertex {
                 // Add the config and state since we don't do that via transforms
                 a.Config = n.Config
+                a.ResolvedProvider = n.ResolvedProvider
 
                 return &NodeRefreshableDataResourceInstance{
                         NodeAbstractResource: a,
@@ -107,7 +108,9 @@ func (n *NodeRefreshableDataResourceInstance) EvalTree() EvalNode {
         // Get the state if we have it, if not we build it
         rs := n.ResourceState
         if rs == nil {
-                rs = &ResourceState{}
+                rs = &ResourceState{
+                        Provider: n.ResolvedProvider,
+                }
         }
 
         // If the config isn't empty we update the state
@@ -145,7 +148,7 @@ func (n *NodeRefreshableDataResourceInstance) EvalTree() EvalNode {
                         &EvalWriteState{
                                 Name:         stateId,
                                 ResourceType: rs.Type,
-                                Provider:     rs.Provider,
+                                Provider:     n.ResolvedProvider,
                                 Dependencies: rs.Dependencies,
                                 State:        &state, // state is nil here
                         },
@@ -185,7 +188,7 @@ func (n *NodeRefreshableDataResourceInstance) EvalTree() EvalNode {
                         // provider configurations that need this data during
                         // refresh/plan.
                         &EvalGetProvider{
-                                Name:   n.ProvidedBy()[0],
+                                Name:   n.ResolvedProvider,
                                 Output: &provider,
                         },
 
@@ -207,7 +210,7 @@ func (n *NodeRefreshableDataResourceInstance) EvalTree() EvalNode {
                         &EvalWriteState{
                                 Name:         stateId,
                                 ResourceType: rs.Type,
-                                Provider:     rs.Provider,
+                                Provider:     n.ResolvedProvider,
                                 Dependencies: rs.Dependencies,
                                 State:        &state,
                         },
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_local.go b/vendor/github.com/hashicorp/terraform/terraform/node_local.go
new file mode 100644
index 0000000..d387222
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_local.go
@@ -0,0 +1,66 @@
+package terraform
+
+import (
+        "fmt"
+        "strings"
+
+        "github.com/hashicorp/terraform/config"
+)
+
+// NodeLocal represents a named local value in a particular module.
+//
+// Local value nodes only have one operation, common to all walk types:
+// evaluate the result and place it in state.
+type NodeLocal struct {
+        PathValue []string
+        Config    *config.Local
+}
+
+func (n *NodeLocal) Name() string {
+        result := fmt.Sprintf("local.%s", n.Config.Name)
+        if len(n.PathValue) > 1 {
+                result = fmt.Sprintf("%s.%s", modulePrefixStr(n.PathValue), result)
+        }
+
+        return result
+}
+
+// GraphNodeSubPath
+func (n *NodeLocal) Path() []string {
+        return n.PathValue
+}
+
+// RemovableIfNotTargeted
+func (n *NodeLocal) RemoveIfNotTargeted() bool {
+        return true
+}
+
+// GraphNodeReferenceable
+func (n *NodeLocal) ReferenceableName() []string {
+        name := fmt.Sprintf("local.%s", n.Config.Name)
+        return []string{name}
+}
+
+// GraphNodeReferencer
+func (n *NodeLocal) References() []string {
+        var result []string
+        result = append(result, ReferencesFromConfig(n.Config.RawConfig)...)
+        for _, v := range result {
+                split := strings.Split(v, "/")
+                for i, s := range split {
+                        split[i] = s + ".destroy"
+                }
+
+                result = append(result, strings.Join(split, "/"))
+        }
+
+        return result
+}
+
+// GraphNodeEvalable
+func (n *NodeLocal) EvalTree() EvalNode {
+        return &EvalLocal{
+                Name:  n.Config.Name,
+                Value: n.Config.RawConfig,
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_module_destroy.go b/vendor/github.com/hashicorp/terraform/terraform/node_module_destroy.go
deleted file mode 100644
index 319df1e..0000000
--- a/vendor/github.com/hashicorp/terraform/terraform/node_module_destroy.go
+++ /dev/null
@@ -1,29 +0,0 @@
-package terraform
-
-import (
-        "fmt"
-)
-
-// NodeDestroyableModule represents a module destruction.
-type NodeDestroyableModuleVariable struct {
-        PathValue []string
-}
-
-func (n *NodeDestroyableModuleVariable) Name() string {
-        result := "plan-destroy"
-        if len(n.PathValue) > 1 {
-                result = fmt.Sprintf("%s.%s", modulePrefixStr(n.PathValue), result)
-        }
-
-        return result
-}
-
-// GraphNodeSubPath
-func (n *NodeDestroyableModuleVariable) Path() []string {
-        return n.PathValue
-}
-
-// GraphNodeEvalable
-func (n *NodeDestroyableModuleVariable) EvalTree() EvalNode {
-        return &EvalDiffDestroyModule{Path: n.PathValue}
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_module_removed.go b/vendor/github.com/hashicorp/terraform/terraform/node_module_removed.go
new file mode 100644
index 0000000..bb3e5ee
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_module_removed.go
@@ -0,0 +1,77 @@
+package terraform
+
+import (
+        "fmt"
+        "log"
+        "reflect"
+)
+
+// NodeModuleRemoved represents a module that is no longer in the
+// config.
+type NodeModuleRemoved struct {
+        PathValue []string
+}
+
+func (n *NodeModuleRemoved) Name() string {
+        return fmt.Sprintf("%s (removed)", modulePrefixStr(n.PathValue))
+}
+
+// GraphNodeSubPath
+func (n *NodeModuleRemoved) Path() []string {
+        return n.PathValue
+}
+
+// GraphNodeEvalable
+func (n *NodeModuleRemoved) EvalTree() EvalNode {
+        return &EvalOpFilter{
+                Ops: []walkOperation{walkRefresh, walkApply, walkDestroy},
+                Node: &EvalDeleteModule{
+                        PathValue: n.PathValue,
+                },
+        }
+}
+
+func (n *NodeModuleRemoved) ReferenceGlobal() bool {
+        return true
+}
+
+func (n *NodeModuleRemoved) References() []string {
+        return []string{modulePrefixStr(n.PathValue)}
+}
+
+// EvalDeleteModule is an EvalNode implementation that removes an empty module
+// entry from the state.
+type EvalDeleteModule struct {
+        PathValue []string
+}
+
+func (n *EvalDeleteModule) Eval(ctx EvalContext) (interface{}, error) {
+        state, lock := ctx.State()
+        if state == nil {
+                return nil, nil
+        }
+
+        // Get a write lock so we can access this instance
+        lock.Lock()
+        defer lock.Unlock()
+
+        // Make sure we have a clean state
+        // Destroyed resources aren't deleted, they're written with an ID of "".
+        state.prune()
+
+        // find the module and delete it
+        for i, m := range state.Modules {
+                if reflect.DeepEqual(m.Path, n.PathValue) {
+                        if !m.Empty() {
+                                // a targeted apply may leave module resources even without a config,
+                                // so just log this and return.
+                                log.Printf("[DEBUG] cannot remove module %s, not empty", modulePrefixStr(n.PathValue))
+                                break
+                        }
+                        state.Modules = append(state.Modules[:i], state.Modules[i+1:]...)
+                        break
+                }
+        }
+
+        return nil, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_module_variable.go b/vendor/github.com/hashicorp/terraform/terraform/node_module_variable.go
index 13fe8fc..66ff7d5 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_module_variable.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_module_variable.go
@@ -92,11 +92,24 @@ func (n *NodeApplyableModuleVariable) EvalTree() EvalNode {
         // within the variables mapping.
         var config *ResourceConfig
         variables := make(map[string]interface{})
+
         return &EvalSequence{
                 Nodes: []EvalNode{
-                        &EvalInterpolate{
-                                Config: n.Value,
-                                Output: &config,
+                        &EvalOpFilter{
+                                Ops: []walkOperation{walkInput},
+                                Node: &EvalInterpolate{
+                                        Config:        n.Value,
+                                        Output:        &config,
+                                        ContinueOnErr: true,
+                                },
+                        },
+                        &EvalOpFilter{
+                                Ops: []walkOperation{walkRefresh, walkPlan, walkApply,
+                                        walkDestroy, walkValidate},
+                                Node: &EvalInterpolate{
+                                        Config: n.Value,
+                                        Output: &config,
+                                },
                         },
 
                         &EvalVariableBlock{
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_output.go b/vendor/github.com/hashicorp/terraform/terraform/node_output.go
index 9017a63..83e9925 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_output.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_output.go
@@ -69,12 +69,22 @@ func (n *NodeApplyableOutput) References() []string {
 
 // GraphNodeEvalable
 func (n *NodeApplyableOutput) EvalTree() EvalNode {
-        return &EvalOpFilter{
-                Ops: []walkOperation{walkRefresh, walkPlan, walkApply,
-                        walkDestroy, walkInput, walkValidate},
-                Node: &EvalSequence{
-                        Nodes: []EvalNode{
-                                &EvalWriteOutput{
+        return &EvalSequence{
+                Nodes: []EvalNode{
+                        &EvalOpFilter{
+                                // Don't let interpolation errors stop Input, since it happens
+                                // before Refresh.
+                                Ops: []walkOperation{walkInput},
+                                Node: &EvalWriteOutput{
+                                        Name:          n.Config.Name,
+                                        Sensitive:     n.Config.Sensitive,
+                                        Value:         n.Config.RawConfig,
+                                        ContinueOnErr: true,
+                                },
+                        },
+                        &EvalOpFilter{
+                                Ops: []walkOperation{walkRefresh, walkPlan, walkApply, walkValidate, walkDestroy, walkPlanDestroy},
+                                Node: &EvalWriteOutput{
                                         Name:      n.Config.Name,
                                         Sensitive: n.Config.Sensitive,
                                         Value:     n.Config.RawConfig,
@@ -83,3 +93,61 @@ func (n *NodeApplyableOutput) EvalTree() EvalNode {
                 },
         }
 }
+
+// NodeDestroyableOutput represents an output that is "destroybale":
+// its application will remove the output from the state.
+type NodeDestroyableOutput struct {
+        PathValue []string
+        Config    *config.Output // Config is the output in the config
+}
+
+func (n *NodeDestroyableOutput) Name() string {
+        result := fmt.Sprintf("output.%s (destroy)", n.Config.Name)
+        if len(n.PathValue) > 1 {
+                result = fmt.Sprintf("%s.%s", modulePrefixStr(n.PathValue), result)
+        }
+
+        return result
+}
+
+// GraphNodeSubPath
+func (n *NodeDestroyableOutput) Path() []string {
+        return n.PathValue
+}
+
+// RemovableIfNotTargeted
+func (n *NodeDestroyableOutput) RemoveIfNotTargeted() bool {
+        // We need to add this so that this node will be removed if
+        // it isn't targeted or a dependency of a target.
+        return true
+}
+
+// This will keep the destroy node in the graph if its corresponding output
+// node is also in the destroy graph.
+func (n *NodeDestroyableOutput) TargetDownstream(targetedDeps, untargetedDeps *dag.Set) bool {
+        return true
+}
+
+// GraphNodeReferencer
+func (n *NodeDestroyableOutput) References() []string {
+        var result []string
+        result = append(result, n.Config.DependsOn...)
+        result = append(result, ReferencesFromConfig(n.Config.RawConfig)...)
+        for _, v := range result {
+                split := strings.Split(v, "/")
+                for i, s := range split {
+                        split[i] = s + ".destroy"
+                }
+
+                result = append(result, strings.Join(split, "/"))
+        }
+
+        return result
+}
+
+// GraphNodeEvalable
+func (n *NodeDestroyableOutput) EvalTree() EvalNode {
+        return &EvalDeleteOutput{
+                Name: n.Config.Name,
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_output_orphan.go b/vendor/github.com/hashicorp/terraform/terraform/node_output_orphan.go
index 636a15d..0fd1554 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_output_orphan.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_output_orphan.go
@@ -19,6 +19,11 @@ func (n *NodeOutputOrphan) Name() string {
         return result
 }
 
+// GraphNodeReferenceable
+func (n *NodeOutputOrphan) ReferenceableName() []string {
+        return []string{"output." + n.OutputName}
+}
+
 // GraphNodeSubPath
 func (n *NodeOutputOrphan) Path() []string {
         return n.PathValue
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_provider.go b/vendor/github.com/hashicorp/terraform/terraform/node_provider.go
index 8e2c176..2071ab1 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_provider.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_provider.go
@@ -7,5 +7,5 @@ type NodeApplyableProvider struct {
 
 // GraphNodeEvalable
 func (n *NodeApplyableProvider) EvalTree() EvalNode {
-        return ProviderEvalTree(n.NameValue, n.ProviderConfig())
+        return ProviderEvalTree(n, n.ProviderConfig())
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_provider_abstract.go b/vendor/github.com/hashicorp/terraform/terraform/node_provider_abstract.go
index 6cc8365..9e490f7 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_provider_abstract.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_provider_abstract.go
@@ -2,6 +2,7 @@ package terraform
 
 import (
         "fmt"
+        "strings"
 
         "github.com/hashicorp/terraform/config"
         "github.com/hashicorp/terraform/dag"
@@ -24,13 +25,22 @@ type NodeAbstractProvider struct {
         Config *config.ProviderConfig
 }
 
-func (n *NodeAbstractProvider) Name() string {
-        result := fmt.Sprintf("provider.%s", n.NameValue)
-        if len(n.PathValue) > 1 {
-                result = fmt.Sprintf("%s.%s", modulePrefixStr(n.PathValue), result)
+func ResolveProviderName(name string, path []string) string {
+        if strings.Contains(name, "provider.") {
+                // already resolved
+                return name
+        }
+
+        name = fmt.Sprintf("provider.%s", name)
+        if len(path) >= 1 {
+                name = fmt.Sprintf("%s.%s", modulePrefixStr(path), name)
         }
 
-        return result
+        return name
+}
+
+func (n *NodeAbstractProvider) Name() string {
+        return ResolveProviderName(n.NameValue, n.PathValue)
 }
 
 // GraphNodeSubPath
@@ -60,12 +70,12 @@ func (n *NodeAbstractProvider) ProviderName() string {
 }
 
 // GraphNodeProvider
-func (n *NodeAbstractProvider) ProviderConfig() *config.RawConfig {
+func (n *NodeAbstractProvider) ProviderConfig() *config.ProviderConfig {
         if n.Config == nil {
                 return nil
         }
 
-        return n.Config.RawConfig
+        return n.Config
 }
 
 // GraphNodeAttachProvider
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_provider_disabled.go b/vendor/github.com/hashicorp/terraform/terraform/node_provider_disabled.go
index 25e7e62..a00bc46 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_provider_disabled.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_provider_disabled.go
@@ -20,7 +20,7 @@ func (n *NodeDisabledProvider) EvalTree() EvalNode {
         var resourceConfig *ResourceConfig
         return &EvalSequence{
                 Nodes: []EvalNode{
-                        &EvalInterpolate{
+                        &EvalInterpolateProvider{
                                 Config: n.ProviderConfig(),
                                 Output: &resourceConfig,
                         },
@@ -29,10 +29,6 @@ func (n *NodeDisabledProvider) EvalTree() EvalNode {
                                 Config:   &resourceConfig,
                                 Output:   &resourceConfig,
                         },
-                        &EvalSetProviderConfig{
-                                Provider: n.ProviderName(),
-                                Config:   &resourceConfig,
-                        },
                 },
         }
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_abstract.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_abstract.go
index 50bb707..73509c8 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_abstract.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_abstract.go
@@ -33,6 +33,9 @@ type NodeAbstractResource struct {
         ResourceState *ResourceState   // ResourceState is the ResourceState for this
 
         Targets []ResourceAddress // Set from GraphNodeTargetable
+
+        // The address of the provider this resource will use
+        ResolvedProvider string
 }
 
 func (n *NodeAbstractResource) Name() string {
@@ -170,20 +173,24 @@ func (n *NodeAbstractResource) StateReferences() []string {
         return deps
 }
 
+func (n *NodeAbstractResource) SetProvider(p string) {
+        n.ResolvedProvider = p
+}
+
 // GraphNodeProviderConsumer
-func (n *NodeAbstractResource) ProvidedBy() []string {
+func (n *NodeAbstractResource) ProvidedBy() string {
         // If we have a config we prefer that above all else
         if n.Config != nil {
-                return []string{resourceProvider(n.Config.Type, n.Config.Provider)}
+                return resourceProvider(n.Config.Type, n.Config.Provider)
         }
 
         // If we have state, then we will use the provider from there
         if n.ResourceState != nil && n.ResourceState.Provider != "" {
-                return []string{n.ResourceState.Provider}
+                return n.ResourceState.Provider
         }
 
         // Use our type
-        return []string{resourceProvider(n.Addr.Type, "")}
+        return resourceProvider(n.Addr.Type, "")
 }
 
 // GraphNodeProvisionerConsumer
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_apply.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_apply.go
index 3599782..40ee1cf 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_apply.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_apply.go
@@ -124,6 +124,27 @@ func (n *NodeApplyableResource) evalTreeDataResource(
                                 Then: EvalNoop{},
                         },
 
+                        // Normally we interpolate count as a preparation step before
+                        // a DynamicExpand, but an apply graph has pre-expanded nodes
+                        // and so the count would otherwise never be interpolated.
+                        //
+                        // This is redundant when there are multiple instances created
+                        // from the same config (count > 1) but harmless since the
+                        // underlying structures have mutexes to make this concurrency-safe.
+                        //
+                        // In most cases this isn't actually needed because we dealt with
+                        // all of the counts during the plan walk, but we do it here
+                        // for completeness because other code assumes that the
+                        // final count is always available during interpolation.
+                        //
+                        // Here we are just populating the interpolated value in-place
+                        // inside this RawConfig object, like we would in
+                        // NodeAbstractCountResource.
+                        &EvalInterpolate{
+                                Config:        n.Config.RawCount,
+                                ContinueOnErr: true,
+                        },
+
                         // We need to re-interpolate the config here, rather than
                         // just using the diff's values directly, because we've
                         // potentially learned more variable values during the
@@ -135,7 +156,7 @@ func (n *NodeApplyableResource) evalTreeDataResource(
                         },
 
                         &EvalGetProvider{
-                                Name:   n.ProvidedBy()[0],
+                                Name:   n.ResolvedProvider,
                                 Output: &provider,
                         },
 
@@ -158,7 +179,7 @@ func (n *NodeApplyableResource) evalTreeDataResource(
                         &EvalWriteState{
                                 Name:         stateId,
                                 ResourceType: n.Config.Type,
-                                Provider:     n.Config.Provider,
+                                Provider:     n.ResolvedProvider,
                                 Dependencies: stateDeps,
                                 State:        &state,
                         },
@@ -236,13 +257,35 @@ func (n *NodeApplyableResource) evalTreeManagedResource(
                                 },
                         },
 
+                        // Normally we interpolate count as a preparation step before
+                        // a DynamicExpand, but an apply graph has pre-expanded nodes
+                        // and so the count would otherwise never be interpolated.
+                        //
+                        // This is redundant when there are multiple instances created
+                        // from the same config (count > 1) but harmless since the
+                        // underlying structures have mutexes to make this concurrency-safe.
+                        //
+                        // In most cases this isn't actually needed because we dealt with
+                        // all of the counts during the plan walk, but we need to do this
+                        // in order to support interpolation of resource counts from
+                        // apply-time-interpolated expressions, such as those in
+                        // "provisioner" blocks.
+                        //
+                        // Here we are just populating the interpolated value in-place
+                        // inside this RawConfig object, like we would in
+                        // NodeAbstractCountResource.
+                        &EvalInterpolate{
+                                Config:        n.Config.RawCount,
+                                ContinueOnErr: true,
+                        },
+
                         &EvalInterpolate{
                                 Config:   n.Config.RawConfig.Copy(),
                                 Resource: resource,
                                 Output:   &resourceConfig,
                         },
                         &EvalGetProvider{
-                                Name:   n.ProvidedBy()[0],
+                                Name:   n.ResolvedProvider,
                                 Output: &provider,
                         },
                         &EvalReadState{
@@ -283,7 +326,7 @@ func (n *NodeApplyableResource) evalTreeManagedResource(
                         },
 
                         &EvalGetProvider{
-                                Name:   n.ProvidedBy()[0],
+                                Name:   n.ResolvedProvider,
                                 Output: &provider,
                         },
                         &EvalReadState{
@@ -308,7 +351,7 @@ func (n *NodeApplyableResource) evalTreeManagedResource(
                         &EvalWriteState{
                                 Name:         stateId,
                                 ResourceType: n.Config.Type,
-                                Provider:     n.Config.Provider,
+                                Provider:     n.ResolvedProvider,
                                 Dependencies: stateDeps,
                                 State:        &state,
                         },
@@ -332,7 +375,7 @@ func (n *NodeApplyableResource) evalTreeManagedResource(
                                 Else: &EvalWriteState{
                                         Name:         stateId,
                                         ResourceType: n.Config.Type,
-                                        Provider:     n.Config.Provider,
+                                        Provider:     n.ResolvedProvider,
                                         Dependencies: stateDeps,
                                         State:        &state,
                                 },
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_destroy.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_destroy.go
index c2efd2c..657bbee 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_destroy.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_destroy.go
@@ -102,8 +102,9 @@ func (n *NodeDestroyResource) DynamicExpand(ctx EvalContext) (*Graph, error) {
 
         // We want deposed resources in the state to be destroyed
         steps = append(steps, &DeposedTransformer{
-                State: state,
-                View:  n.Addr.stateId(),
+                State:            state,
+                View:             n.Addr.stateId(),
+                ResolvedProvider: n.ResolvedProvider,
         })
 
         // Target
@@ -148,7 +149,9 @@ func (n *NodeDestroyResource) EvalTree() EvalNode {
         // Get our state
         rs := n.ResourceState
         if rs == nil {
-                rs = &ResourceState{}
+                rs = &ResourceState{
+                        Provider: n.ResolvedProvider,
+                }
         }
 
         var diffApply *InstanceDiff
@@ -188,7 +191,7 @@ func (n *NodeDestroyResource) EvalTree() EvalNode {
                                 &EvalInstanceInfo{Info: info},
 
                                 &EvalGetProvider{
-                                        Name:   n.ProvidedBy()[0],
+                                        Name:   n.ResolvedProvider,
                                         Output: &provider,
                                 },
                                 &EvalReadState{
@@ -272,7 +275,7 @@ func (n *NodeDestroyResource) EvalTree() EvalNode {
                                 &EvalWriteState{
                                         Name:         stateId,
                                         ResourceType: n.Addr.Type,
-                                        Provider:     rs.Provider,
+                                        Provider:     n.ResolvedProvider,
                                         Dependencies: rs.Dependencies,
                                         State:        &state,
                                 },
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan.go
index 52bbf88..1afae7a 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan.go
@@ -27,6 +27,7 @@ func (n *NodePlannableResource) DynamicExpand(ctx EvalContext) (*Graph, error) {
         concreteResource := func(a *NodeAbstractResource) dag.Vertex {
                 // Add the config and state since we don't do that via transforms
                 a.Config = n.Config
+                a.ResolvedProvider = n.ResolvedProvider
 
                 return &NodePlannableResourceInstance{
                         NodeAbstractResource: a,
@@ -37,6 +38,7 @@ func (n *NodePlannableResource) DynamicExpand(ctx EvalContext) (*Graph, error) {
         concreteResourceOrphan := func(a *NodeAbstractResource) dag.Vertex {
                 // Add the config and state since we don't do that via transforms
                 a.Config = n.Config
+                a.ResolvedProvider = n.ResolvedProvider
 
                 return &NodePlannableResourceOrphan{
                         NodeAbstractResource: a,
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_instance.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_instance.go
index b529569..7d9fcdd 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_instance.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_instance.go
@@ -97,7 +97,7 @@ func (n *NodePlannableResourceInstance) evalTreeDataResource(
                         },
 
                         &EvalGetProvider{
-                                Name:   n.ProvidedBy()[0],
+                                Name:   n.ResolvedProvider,
                                 Output: &provider,
                         },
 
@@ -112,7 +112,7 @@ func (n *NodePlannableResourceInstance) evalTreeDataResource(
                         &EvalWriteState{
                                 Name:         stateId,
                                 ResourceType: n.Config.Type,
-                                Provider:     n.Config.Provider,
+                                Provider:     n.ResolvedProvider,
                                 Dependencies: stateDeps,
                                 State:        &state,
                         },
@@ -143,7 +143,7 @@ func (n *NodePlannableResourceInstance) evalTreeManagedResource(
                                 Output:   &resourceConfig,
                         },
                         &EvalGetProvider{
-                                Name:   n.ProvidedBy()[0],
+                                Name:   n.ResolvedProvider,
                                 Output: &provider,
                         },
                         // Re-run validation to catch any errors we missed, e.g. type
@@ -177,7 +177,7 @@ func (n *NodePlannableResourceInstance) evalTreeManagedResource(
                         &EvalWriteState{
                                 Name:         stateId,
                                 ResourceType: n.Config.Type,
-                                Provider:     n.Config.Provider,
+                                Provider:     n.ResolvedProvider,
                                 Dependencies: stateDeps,
                                 State:        &state,
                         },
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_refresh.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_refresh.go
index cd4fe92..697bd49 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_refresh.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_refresh.go
@@ -30,6 +30,7 @@ func (n *NodeRefreshableManagedResource) DynamicExpand(ctx EvalContext) (*Graph,
         concreteResource := func(a *NodeAbstractResource) dag.Vertex {
                 // Add the config and state since we don't do that via transforms
                 a.Config = n.Config
+                a.ResolvedProvider = n.ResolvedProvider
 
                 return &NodeRefreshableManagedResourceInstance{
                         NodeAbstractResource: a,
@@ -149,7 +150,7 @@ func (n *NodeRefreshableManagedResourceInstance) evalTreeManagedResource() EvalN
         return &EvalSequence{
                 Nodes: []EvalNode{
                         &EvalGetProvider{
-                                Name:   n.ProvidedBy()[0],
+                                Name:   n.ResolvedProvider,
                                 Output: &provider,
                         },
                         &EvalReadState{
@@ -165,7 +166,7 @@ func (n *NodeRefreshableManagedResourceInstance) evalTreeManagedResource() EvalN
                         &EvalWriteState{
                                 Name:         stateId,
                                 ResourceType: n.ResourceState.Type,
-                                Provider:     n.ResourceState.Provider,
+                                Provider:     n.ResolvedProvider,
                                 Dependencies: n.ResourceState.Dependencies,
                                 State:        &state,
                         },
@@ -212,15 +213,21 @@ func (n *NodeRefreshableManagedResourceInstance) evalTreeManagedResourceNoState(
         // Determine the dependencies for the state.
         stateDeps := n.StateReferences()
 
+        // n.Config can be nil if the config and state don't match
+        var raw *config.RawConfig
+        if n.Config != nil {
+                raw = n.Config.RawConfig.Copy()
+        }
+
         return &EvalSequence{
                 Nodes: []EvalNode{
                         &EvalInterpolate{
-                                Config:   n.Config.RawConfig.Copy(),
+                                Config:   raw,
                                 Resource: resource,
                                 Output:   &resourceConfig,
                         },
                         &EvalGetProvider{
-                                Name:   n.ProvidedBy()[0],
+                                Name:   n.ResolvedProvider,
                                 Output: &provider,
                         },
                         // Re-run validation to catch any errors we missed, e.g. type
@@ -250,7 +257,7 @@ func (n *NodeRefreshableManagedResourceInstance) evalTreeManagedResourceNoState(
                         &EvalWriteState{
                                 Name:         stateID,
                                 ResourceType: n.Config.Type,
-                                Provider:     n.Config.Provider,
+                                Provider:     n.ResolvedProvider,
                                 Dependencies: stateDeps,
                                 State:        &state,
                         },
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_validate.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_validate.go
index f528f24..0df223d 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_validate.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_validate.go
@@ -39,6 +39,7 @@ func (n *NodeValidatableResource) DynamicExpand(ctx EvalContext) (*Graph, error)
         concreteResource := func(a *NodeAbstractResource) dag.Vertex {
                 // Add the config and state since we don't do that via transforms
                 a.Config = n.Config
+                a.ResolvedProvider = n.ResolvedProvider
 
                 return &NodeValidatableResourceInstance{
                         NodeAbstractResource: a,
@@ -108,7 +109,7 @@ func (n *NodeValidatableResourceInstance) EvalTree() EvalNode {
                                 Config: &n.Config.RawConfig,
                         },
                         &EvalGetProvider{
-                                Name:   n.ProvidedBy()[0],
+                                Name:   n.ResolvedProvider,
                                 Output: &provider,
                         },
                         &EvalInterpolate{
diff --git a/vendor/github.com/hashicorp/terraform/terraform/path.go b/vendor/github.com/hashicorp/terraform/terraform/path.go
index ca99685..51dd412 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/path.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/path.go
@@ -1,24 +1,10 @@
 package terraform
 
 import (
-        "crypto/md5"
-        "encoding/hex"
+        "strings"
 )
 
 // PathCacheKey returns a cache key for a module path.
-//
-// TODO: test
 func PathCacheKey(path []string) string {
-        // There is probably a better way to do this, but this is working for now.
-        // We just create an MD5 hash of all the MD5 hashes of all the path
-        // elements. This gets us the property that it is unique per ordering.
-        hash := md5.New()
-        for _, p := range path {
-                single := md5.Sum([]byte(p))
-                if _, err := hash.Write(single[:]); err != nil {
-                        panic(err)
-                }
-        }
-
-        return hex.EncodeToString(hash.Sum(nil))
+        return strings.Join(path, "|")
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/plan.go b/vendor/github.com/hashicorp/terraform/terraform/plan.go
index 51d6652..30db195 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/plan.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/plan.go
@@ -10,6 +10,7 @@ import (
         "sync"
 
         "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/version"
 )
 
 func init() {
@@ -26,18 +27,54 @@ func init() {
 // necessary to make a change: the state, diff, config, backend config, etc.
 // This is so that it can run alone without any other data.
 type Plan struct {
-        Diff    *Diff
-        Module  *module.Tree
-        State   *State
-        Vars    map[string]interface{}
+        // Diff describes the resource actions that must be taken when this
+        // plan is applied.
+        Diff *Diff
+
+        // Module represents the entire configuration that was present when this
+        // plan was created.
+        Module *module.Tree
+
+        // State is the Terraform state that was current when this plan was
+        // created.
+        //
+        // It is not allowed to apply a plan that has a stale state, since its
+        // diff could be outdated.
+        State *State
+
+        // Vars retains the variables that were set when creating the plan, so
+        // that the same variables can be applied during apply.
+        Vars map[string]interface{}
+
+        // Targets, if non-empty, contains a set of resource address strings that
+        // identify graph nodes that were selected as targets for plan.
+        //
+        // When targets are set, any graph node that is not directly targeted or
+        // indirectly targeted via dependencies is excluded from the graph.
         Targets []string
 
+        // TerraformVersion is the version of Terraform that was used to create
+        // this plan.
+        //
+        // It is not allowed to apply a plan created with a different version of
+        // Terraform, since the other fields of this structure may be interpreted
+        // in different ways between versions.
         TerraformVersion string
-        ProviderSHA256s  map[string][]byte
+
+        // ProviderSHA256s is a map giving the SHA256 hashes of the exact binaries
+        // used as plugins for each provider during plan.
+        //
+        // These must match between plan and apply to ensure that the diff is
+        // correctly interpreted, since different provider versions may have
+        // different attributes or attribute value constraints.
+        ProviderSHA256s map[string][]byte
 
         // Backend is the backend that this plan should use and store data with.
         Backend *BackendState
 
+        // Destroy indicates that this plan was created for a full destroy operation
+        Destroy bool
+
         once sync.Once
 }
 
@@ -67,6 +104,7 @@ func (p *Plan) contextOpts(base *ContextOpts) (*ContextOpts, error) {
         opts.Module = p.Module
         opts.Targets = p.Targets
         opts.ProviderSHA256s = p.ProviderSHA256s
+        opts.Destroy = p.Destroy
 
         if opts.State == nil {
                 opts.State = p.State
@@ -79,10 +117,10 @@ func (p *Plan) contextOpts(base *ContextOpts) (*ContextOpts, error) {
                 // the state, there is little chance that these aren't actually equal.
                 // Log the error condition for reference, but continue with the state
                 // we have.
-                log.Println("[WARNING] Plan state and ContextOpts state are not equal")
+                log.Println("[WARN] Plan state and ContextOpts state are not equal")
         }
 
-        thisVersion := VersionString()
+        thisVersion := version.String()
         if p.TerraformVersion != "" && p.TerraformVersion != thisVersion {
                 return nil, fmt.Errorf(
                         "plan was created with a different version of Terraform (created with %s, but running %s)",
diff --git a/vendor/github.com/hashicorp/terraform/terraform/resource.go b/vendor/github.com/hashicorp/terraform/terraform/resource.go
index 0acf0be..2f5ebb5 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/resource.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/resource.go
@@ -88,6 +88,46 @@ func (i *InstanceInfo) HumanId() string {
                 i.Id)
 }
 
+// ResourceAddress returns the address of the resource that the receiver is describing.
+func (i *InstanceInfo) ResourceAddress() *ResourceAddress {
+        // GROSS: for tainted and deposed instances, their status gets appended
+        // to i.Id to create a unique id for the graph node. Historically these
+        // ids were displayed to the user, so it's designed to be human-readable:
+        //   "aws_instance.bar.0 (deposed #0)"
+        //
+        // So here we detect such suffixes and try to interpret them back to
+        // their original meaning so we can then produce a ResourceAddress
+        // with a suitable InstanceType.
+        id := i.Id
+        instanceType := TypeInvalid
+        if idx := strings.Index(id, " ("); idx != -1 {
+                remain := id[idx:]
+                id = id[:idx]
+
+                switch {
+                case strings.Contains(remain, "tainted"):
+                        instanceType = TypeTainted
+                case strings.Contains(remain, "deposed"):
+                        instanceType = TypeDeposed
+                }
+        }
+
+        addr, err := parseResourceAddressInternal(id)
+        if err != nil {
+                // should never happen, since that would indicate a bug in the
+                // code that constructed this InstanceInfo.
+                panic(fmt.Errorf("InstanceInfo has invalid Id %s", id))
+        }
+        if len(i.ModulePath) > 1 {
+                addr.Path = i.ModulePath[1:] // trim off "root" prefix, which is implied
+        }
+        if instanceType != TypeInvalid {
+                addr.InstanceTypeSet = true
+                addr.InstanceType = instanceType
+        }
+        return addr
+}
+
 func (i *InstanceInfo) uniqueId() string {
         prefix := i.HumanId()
         if v := i.uniqueExtra; v != "" {
@@ -306,7 +346,7 @@ func (c *ResourceConfig) get(
                                 if err != nil {
                                         return nil, false
                                 }
-                                if i >= int64(cv.Len()) {
+                                if int(i) < 0 || int(i) >= cv.Len() {
                                         return nil, false
                                 }
                                 current = cv.Index(int(i)).Interface()
diff --git a/vendor/github.com/hashicorp/terraform/terraform/resource_address.go b/vendor/github.com/hashicorp/terraform/terraform/resource_address.go
index 8badca8..a64f5d8 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/resource_address.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/resource_address.go
@@ -42,9 +42,9 @@ func (r *ResourceAddress) Copy() *ResourceAddress {
                 Type:         r.Type,
                 Mode:         r.Mode,
         }
-        for _, p := range r.Path {
-                n.Path = append(n.Path, p)
-        }
+
+        n.Path = append(n.Path, r.Path...)
+
         return n
 }
 
@@ -362,40 +362,41 @@ func (addr *ResourceAddress) Less(other *ResourceAddress) bool {
 
         switch {
 
-        case len(addr.Path) < len(other.Path):
-                return true
+        case len(addr.Path) != len(other.Path):
+                return len(addr.Path) < len(other.Path)
 
         case !reflect.DeepEqual(addr.Path, other.Path):
                 // If the two paths are the same length but don't match, we'll just
                 // cheat and compare the string forms since it's easier than
-                // comparing all of the path segments in turn.
+                // comparing all of the path segments in turn, and lexicographic
+                // comparison is correct for the module path portion.
                 addrStr := addr.String()
                 otherStr := other.String()
                 return addrStr < otherStr
 
-        case addr.Mode == config.DataResourceMode && other.Mode != config.DataResourceMode:
-                return true
+        case addr.Mode != other.Mode:
+                return addr.Mode == config.DataResourceMode
 
-        case addr.Type < other.Type:
-                return true
+        case addr.Type != other.Type:
+                return addr.Type < other.Type
 
-        case addr.Name < other.Name:
-                return true
+        case addr.Name != other.Name:
+                return addr.Name < other.Name
 
-        case addr.Index < other.Index:
+        case addr.Index != other.Index:
                 // Since "Index" is -1 for an un-indexed address, this also conveniently
                 // sorts unindexed addresses before indexed ones, should they both
                 // appear for some reason.
-                return true
+                return addr.Index < other.Index
 
-        case other.InstanceTypeSet && !addr.InstanceTypeSet:
-                return true
+        case addr.InstanceTypeSet != other.InstanceTypeSet:
+                return !addr.InstanceTypeSet
 
-        case addr.InstanceType < other.InstanceType:
+        case addr.InstanceType != other.InstanceType:
                 // InstanceType is actually an enum, so this is just an arbitrary
                 // sort based on the enum numeric values, and thus not particularly
                 // meaningful.
-                return true
+                return addr.InstanceType < other.InstanceType
 
         default:
                 return false
diff --git a/vendor/github.com/hashicorp/terraform/terraform/resource_provider.go b/vendor/github.com/hashicorp/terraform/terraform/resource_provider.go
index 7d78f67..93fd14f 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/resource_provider.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/resource_provider.go
@@ -21,6 +21,15 @@ type ResourceProvider interface {
         * Functions related to the provider
         *********************************************************************/
 
+        // ProviderSchema returns the config schema for the main provider
+        // configuration, as would appear in a "provider" block in the
+        // configuration files.
+        //
+        // Currently not all providers support schema. Callers must therefore
+        // first call Resources and DataSources and ensure that at least one
+        // resource or data source has the SchemaAvailable flag set.
+        GetSchema(*ProviderSchemaRequest) (*ProviderSchema, error)
+
         // Input is called to ask the provider to ask the user for input
         // for completing the configuration if necesarry.
         //
@@ -183,11 +192,25 @@ type ResourceProviderCloser interface {
 type ResourceType struct {
         Name       string // Name of the resource, example "instance" (no provider prefix)
         Importable bool   // Whether this resource supports importing
+
+        // SchemaAvailable is set if the provider supports the ProviderSchema,
+        // ResourceTypeSchema and DataSourceSchema methods. Although it is
+        // included on each resource type, it's actually a provider-wide setting
+        // that's smuggled here only because that avoids a breaking change to
+        // the plugin protocol.
+        SchemaAvailable bool
 }
 
 // DataSource is a data source that a resource provider implements.
 type DataSource struct {
         Name string
+
+        // SchemaAvailable is set if the provider supports the ProviderSchema,
+        // ResourceTypeSchema and DataSourceSchema methods. Although it is
+        // included on each resource type, it's actually a provider-wide setting
+        // that's smuggled here only because that avoids a breaking change to
+        // the plugin protocol.
+        SchemaAvailable bool
 }
 
 // ResourceProviderResolver is an interface implemented by objects that are
diff --git a/vendor/github.com/hashicorp/terraform/terraform/resource_provider_mock.go b/vendor/github.com/hashicorp/terraform/terraform/resource_provider_mock.go
index f531533..4000e3d 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/resource_provider_mock.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/resource_provider_mock.go
@@ -1,6 +1,8 @@
 package terraform
 
-import "sync"
+import (
+        "sync"
+)
 
 // MockResourceProvider implements ResourceProvider but mocks out all the
 // calls for testing purposes.
@@ -12,6 +14,10 @@ type MockResourceProvider struct {
 
         CloseCalled                    bool
         CloseError                     error
+        GetSchemaCalled                bool
+        GetSchemaRequest               *ProviderSchemaRequest
+        GetSchemaReturn                *ProviderSchema
+        GetSchemaReturnError           error
         InputCalled                    bool
         InputInput                     UIInput
         InputConfig                    *ResourceConfig
@@ -92,8 +98,19 @@ func (p *MockResourceProvider) Close() error {
         return p.CloseError
 }
 
+func (p *MockResourceProvider) GetSchema(req *ProviderSchemaRequest) (*ProviderSchema, error) {
+        p.Lock()
+        defer p.Unlock()
+
+        p.GetSchemaCalled = true
+        p.GetSchemaRequest = req
+        return p.GetSchemaReturn, p.GetSchemaReturnError
+}
+
 func (p *MockResourceProvider) Input(
         input UIInput, c *ResourceConfig) (*ResourceConfig, error) {
+        p.Lock()
+        defer p.Unlock()
         p.InputCalled = true
         p.InputInput = input
         p.InputConfig = c
@@ -186,6 +203,7 @@ func (p *MockResourceProvider) Diff(
         p.DiffInfo = info
         p.DiffState = state
         p.DiffDesired = desired
+
         if p.DiffFn != nil {
                 return p.DiffFn(info, state, desired)
         }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/schemas.go b/vendor/github.com/hashicorp/terraform/terraform/schemas.go
new file mode 100644
index 0000000..ec46efc
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/schemas.go
@@ -0,0 +1,34 @@
+package terraform
+
+import (
+        "github.com/hashicorp/terraform/config/configschema"
+)
+
+type Schemas struct {
+        Providers ProviderSchemas
+}
+
+// ProviderSchemas is a map from provider names to provider schemas.
+//
+// The names in this map are the direct plugin name (e.g. "aws") rather than
+// any alias name (e.g. "aws.foo"), since.
+type ProviderSchemas map[string]*ProviderSchema
+
+// ProviderSchema represents the schema for a provider's own configuration
+// and the configuration for some or all of its resources and data sources.
+//
+// The completeness of this structure depends on how it was constructed.
+// When constructed for a configuration, it will generally include only
+// resource types and data sources used by that configuration.
+type ProviderSchema struct {
+        Provider      *configschema.Block
+        ResourceTypes map[string]*configschema.Block
+        DataSources   map[string]*configschema.Block
+}
+
+// ProviderSchemaRequest is used to describe to a ResourceProvider which
+// aspects of schema are required, when calling the GetSchema method.
+type ProviderSchemaRequest struct {
+        ResourceTypes []string
+        DataSources   []string
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/shadow.go b/vendor/github.com/hashicorp/terraform/terraform/shadow.go
deleted file mode 100644
index 4632559..0000000
--- a/vendor/github.com/hashicorp/terraform/terraform/shadow.go
+++ /dev/null
@@ -1,28 +0,0 @@
-package terraform
-
-// Shadow is the interface that any "shadow" structures must implement.
-//
-// A shadow structure is an interface implementation (typically) that
-// shadows a real implementation and verifies that the same behavior occurs
-// on both. The semantics of this behavior are up to the interface itself.
-//
-// A shadow NEVER modifies real values or state. It must always be safe to use.
-//
-// For example, a ResourceProvider shadow ensures that the same operations
-// are done on the same resources with the same configurations.
-//
-// The typical usage of a shadow following this interface is to complete
-// the real operations, then call CloseShadow which tells the shadow that
-// the real side is done. Then, once the shadow is also complete, call
-// ShadowError to find any errors that may have been caught.
-type Shadow interface {
-        // CloseShadow tells the shadow that the REAL implementation is
-        // complete. Therefore, any calls that would block should now return
-        // immediately since no more changes will happen to the real side.
-        CloseShadow() error
-
-        // ShadowError returns the errors that the shadow has found.
-        // This should be called AFTER CloseShadow and AFTER the shadow is
-        // known to be complete (no more calls to it).
-        ShadowError() error
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/shadow_components.go b/vendor/github.com/hashicorp/terraform/terraform/shadow_components.go
deleted file mode 100644
index 116cf84..0000000
--- a/vendor/github.com/hashicorp/terraform/terraform/shadow_components.go
+++ /dev/null
@@ -1,273 +0,0 @@
-package terraform
-
-import (
-        "fmt"
-        "sync"
-
-        "github.com/hashicorp/go-multierror"
-        "github.com/hashicorp/terraform/helper/shadow"
-)
-
-// newShadowComponentFactory creates a shadowed contextComponentFactory
-// so that requests to create new components result in both a real and
-// shadow side.
-func newShadowComponentFactory(
-        f contextComponentFactory) (contextComponentFactory, *shadowComponentFactory) {
-        // Create the shared data
-        shared := &shadowComponentFactoryShared{contextComponentFactory: f}
-
-        // Create the real side
-        real := &shadowComponentFactory{
-                shadowComponentFactoryShared: shared,
-        }
-
-        // Create the shadow
-        shadow := &shadowComponentFactory{
-                shadowComponentFactoryShared: shared,
-                Shadow: true,
-        }
-
-        return real, shadow
-}
-
-// shadowComponentFactory is the shadow side. Any components created
-// with this factory are fake and will not cause real work to happen.
-//
-// Unlike other shadowers, the shadow component factory will allow the
-// shadow to create _any_ component even if it is never requested on the
-// real side. This is because errors will happen later downstream as function
-// calls are made to the shadows that are never matched on the real side.
-type shadowComponentFactory struct {
-        *shadowComponentFactoryShared
-
-        Shadow bool // True if this should return the shadow
-        lock   sync.Mutex
-}
-
-func (f *shadowComponentFactory) ResourceProvider(
-        n, uid string) (ResourceProvider, error) {
-        f.lock.Lock()
-        defer f.lock.Unlock()
-
-        real, shadow, err := f.shadowComponentFactoryShared.ResourceProvider(n, uid)
-        var result ResourceProvider = real
-        if f.Shadow {
-                result = shadow
-        }
-
-        return result, err
-}
-
-func (f *shadowComponentFactory) ResourceProvisioner(
-        n, uid string) (ResourceProvisioner, error) {
-        f.lock.Lock()
-        defer f.lock.Unlock()
-
-        real, shadow, err := f.shadowComponentFactoryShared.ResourceProvisioner(n, uid)
-        var result ResourceProvisioner = real
-        if f.Shadow {
-                result = shadow
-        }
-
-        return result, err
-}
-
-// CloseShadow is called when the _real_ side is complete. This will cause
-// all future blocking operations to return immediately on the shadow to
-// ensure the shadow also completes.
-func (f *shadowComponentFactory) CloseShadow() error {
-        // If we aren't the shadow, just return
-        if !f.Shadow {
-                return nil
-        }
-
-        // Lock ourselves so we don't modify state
-        f.lock.Lock()
-        defer f.lock.Unlock()
-
-        // Grab our shared state
-        shared := f.shadowComponentFactoryShared
-
-        // If we're already closed, its an error
-        if shared.closed {
-                return fmt.Errorf("component factory shadow already closed")
-        }
-
-        // Close all the providers and provisioners and return the error
-        var result error
-        for _, n := range shared.providerKeys {
-                _, shadow, err := shared.ResourceProvider(n, n)
-                if err == nil && shadow != nil {
-                        if err := shadow.CloseShadow(); err != nil {
-                                result = multierror.Append(result, err)
-                        }
-                }
-        }
-
-        for _, n := range shared.provisionerKeys {
-                _, shadow, err := shared.ResourceProvisioner(n, n)
-                if err == nil && shadow != nil {
-                        if err := shadow.CloseShadow(); err != nil {
-                                result = multierror.Append(result, err)
-                        }
-                }
-        }
-
-        // Mark ourselves as closed
-        shared.closed = true
-
-        return result
-}
-
-func (f *shadowComponentFactory) ShadowError() error {
-        // If we aren't the shadow, just return
-        if !f.Shadow {
-                return nil
-        }
-
-        // Lock ourselves so we don't modify state
-        f.lock.Lock()
-        defer f.lock.Unlock()
-
-        // Grab our shared state
-        shared := f.shadowComponentFactoryShared
-
-        // If we're not closed, its an error
-        if !shared.closed {
-                return fmt.Errorf("component factory must be closed to retrieve errors")
-        }
-
-        // Close all the providers and provisioners and return the error
-        var result error
-        for _, n := range shared.providerKeys {
-                _, shadow, err := shared.ResourceProvider(n, n)
-                if err == nil && shadow != nil {
-                        if err := shadow.ShadowError(); err != nil {
-                                result = multierror.Append(result, err)
-                        }
-                }
-        }
-
-        for _, n := range shared.provisionerKeys {
-                _, shadow, err := shared.ResourceProvisioner(n, n)
-                if err == nil && shadow != nil {
-                        if err := shadow.ShadowError(); err != nil {
-                                result = multierror.Append(result, err)
-                        }
-                }
-        }
-
-        return result
-}
-
-// shadowComponentFactoryShared is shared data between the two factories.
-//
-// It is NOT SAFE to run any function on this struct in parallel. Lock
-// access to this struct.
-type shadowComponentFactoryShared struct {
-        contextComponentFactory
-
-        closed          bool
-        providers       shadow.KeyedValue
-        providerKeys    []string
-        provisioners    shadow.KeyedValue
-        provisionerKeys []string
-}
-
-// shadowResourceProviderFactoryEntry is the entry that is stored in
-// the Shadows key/value for a provider.
-type shadowComponentFactoryProviderEntry struct {
-        Real   ResourceProvider
-        Shadow shadowResourceProvider
-        Err    error
-}
-
-type shadowComponentFactoryProvisionerEntry struct {
-        Real   ResourceProvisioner
-        Shadow shadowResourceProvisioner
-        Err    error
-}
-
-func (f *shadowComponentFactoryShared) ResourceProvider(
-        n, uid string) (ResourceProvider, shadowResourceProvider, error) {
-        // Determine if we already have a value
-        raw, ok := f.providers.ValueOk(uid)
-        if !ok {
-                // Build the entry
-                var entry shadowComponentFactoryProviderEntry
-
-                // No value, initialize. Create the original
-                p, err := f.contextComponentFactory.ResourceProvider(n, uid)
-                if err != nil {
-                        entry.Err = err
-                        p = nil // Just to be sure
-                }
-
-                if p != nil {
-                        // Create the shadow
-                        real, shadow := newShadowResourceProvider(p)
-                        entry.Real = real
-                        entry.Shadow = shadow
-
-                        if f.closed {
-                                shadow.CloseShadow()
-                        }
-                }
-
-                // Store the value
-                f.providers.SetValue(uid, &entry)
-                f.providerKeys = append(f.providerKeys, uid)
-                raw = &entry
-        }
-
-        // Read the entry
-        entry, ok := raw.(*shadowComponentFactoryProviderEntry)
-        if !ok {
-                return nil, nil, fmt.Errorf("Unknown value for shadow provider: %#v", raw)
-        }
-
-        // Return
-        return entry.Real, entry.Shadow, entry.Err
-}
-
-func (f *shadowComponentFactoryShared) ResourceProvisioner(
-        n, uid string) (ResourceProvisioner, shadowResourceProvisioner, error) {
-        // Determine if we already have a value
-        raw, ok := f.provisioners.ValueOk(uid)
-        if !ok {
-                // Build the entry
-                var entry shadowComponentFactoryProvisionerEntry
-
-                // No value, initialize. Create the original
-                p, err := f.contextComponentFactory.ResourceProvisioner(n, uid)
-                if err != nil {
-                        entry.Err = err
-                        p = nil // Just to be sure
-                }
-
-                if p != nil {
-                        // For now, just create a mock since we don't support provisioners yet
-                        real, shadow := newShadowResourceProvisioner(p)
-                        entry.Real = real
-                        entry.Shadow = shadow
-
-                        if f.closed {
-                                shadow.CloseShadow()
-                        }
-                }
-
-                // Store the value
-                f.provisioners.SetValue(uid, &entry)
-                f.provisionerKeys = append(f.provisionerKeys, uid)
-                raw = &entry
-        }
-
-        // Read the entry
-        entry, ok := raw.(*shadowComponentFactoryProvisionerEntry)
-        if !ok {
-                return nil, nil, fmt.Errorf("Unknown value for shadow provisioner: %#v", raw)
-        }
-
-        // Return
-        return entry.Real, entry.Shadow, entry.Err
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/shadow_context.go b/vendor/github.com/hashicorp/terraform/terraform/shadow_context.go
deleted file mode 100644
index 5588af2..0000000
--- a/vendor/github.com/hashicorp/terraform/terraform/shadow_context.go
+++ /dev/null
@@ -1,158 +0,0 @@
-package terraform
-
-import (
-        "fmt"
-        "strings"
-
-        "github.com/hashicorp/go-multierror"
-        "github.com/mitchellh/copystructure"
-)
-
-// newShadowContext creates a new context that will shadow the given context
-// when walking the graph. The resulting context should be used _only once_
-// for a graph walk.
-//
-// The returned Shadow should be closed after the graph walk with the
-// real context is complete. Errors from the shadow can be retrieved there.
-//
-// Most importantly, any operations done on the shadow context (the returned
-// context) will NEVER affect the real context. All structures are deep
-// copied, no real providers or resources are used, etc.
-func newShadowContext(c *Context) (*Context, *Context, Shadow) {
-        // Copy the targets
-        targetRaw, err := copystructure.Copy(c.targets)
-        if err != nil {
-                panic(err)
-        }
-
-        // Copy the variables
-        varRaw, err := copystructure.Copy(c.variables)
-        if err != nil {
-                panic(err)
-        }
-
-        // Copy the provider inputs
-        providerInputRaw, err := copystructure.Copy(c.providerInputConfig)
-        if err != nil {
-                panic(err)
-        }
-
-        // The factories
-        componentsReal, componentsShadow := newShadowComponentFactory(c.components)
-
-        // Create the shadow
-        shadow := &Context{
-                components: componentsShadow,
-                destroy:    c.destroy,
-                diff:       c.diff.DeepCopy(),
-                hooks:      nil,
-                meta:       c.meta,
-                module:     c.module,
-                state:      c.state.DeepCopy(),
-                targets:    targetRaw.([]string),
-                variables:  varRaw.(map[string]interface{}),
-
-                // NOTE(mitchellh): This is not going to work for shadows that are
-                // testing that input results in the proper end state. At the time
-                // of writing, input is not used in any state-changing graph
-                // walks anyways, so this checks nothing. We set it to this to avoid
-                // any panics but even a "nil" value worked here.
-                uiInput: new(MockUIInput),
-
-                // Hardcoded to 4 since parallelism in the shadow doesn't matter
-                // a ton since we're doing far less compared to the real side
-                // and our operations are MUCH faster.
-                parallelSem:         NewSemaphore(4),
-                providerInputConfig: providerInputRaw.(map[string]map[string]interface{}),
-        }
-
-        // Create the real context. This is effectively just a copy of
-        // the context given except we need to modify some of the values
-        // to point to the real side of a shadow so the shadow can compare values.
-        real := &Context{
-                // The fields below are changed.
-                components: componentsReal,
-
-                // The fields below are direct copies
-                destroy: c.destroy,
-                diff:    c.diff,
-                // diffLock - no copy
-                hooks:  c.hooks,
-                meta:   c.meta,
-                module: c.module,
-                sh:     c.sh,
-                state:  c.state,
-                // stateLock - no copy
-                targets:   c.targets,
-                uiInput:   c.uiInput,
-                variables: c.variables,
-
-                // l - no copy
-                parallelSem:         c.parallelSem,
-                providerInputConfig: c.providerInputConfig,
-                runContext:          c.runContext,
-                runContextCancel:    c.runContextCancel,
-                shadowErr:           c.shadowErr,
-        }
-
-        return real, shadow, &shadowContextCloser{
-                Components: componentsShadow,
-        }
-}
-
-// shadowContextVerify takes the real and shadow context and verifies they
-// have equal diffs and states.
-func shadowContextVerify(real, shadow *Context) error {
-        var result error
-
-        // The states compared must be pruned so they're minimal/clean
-        real.state.prune()
-        shadow.state.prune()
-
-        // Compare the states
-        if !real.state.Equal(shadow.state) {
-                result = multierror.Append(result, fmt.Errorf(
-                        "Real and shadow states do not match! "+
-                                "Real state:\n\n%s\n\n"+
-                                "Shadow state:\n\n%s\n\n",
-                        real.state, shadow.state))
-        }
-
-        // Compare the diffs
-        if !real.diff.Equal(shadow.diff) {
-                result = multierror.Append(result, fmt.Errorf(
-                        "Real and shadow diffs do not match! "+
-                                "Real diff:\n\n%s\n\n"+
-                                "Shadow diff:\n\n%s\n\n",
-                        real.diff, shadow.diff))
-        }
-
-        return result
-}
-
-// shadowContextCloser is the io.Closer returned by newShadowContext that
-// closes all the shadows and returns the results.
-type shadowContextCloser struct {
-        Components *shadowComponentFactory
-}
-
-// Close closes the shadow context.
-func (c *shadowContextCloser) CloseShadow() error {
-        return c.Components.CloseShadow()
-}
-
-func (c *shadowContextCloser) ShadowError() error {
-        err := c.Components.ShadowError()
-        if err == nil {
-                return nil
-        }
-
-        // This is a sad edge case: if the configuration contains uuid() at
-        // any point, we cannot reason aboyt the shadow execution. Tested
-        // with Context2Plan_shadowUuid.
-        if strings.Contains(err.Error(), "uuid()") {
-                err = nil
-        }
-
-        return err
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/shadow_resource_provider.go b/vendor/github.com/hashicorp/terraform/terraform/shadow_resource_provider.go
deleted file mode 100644
index 9741d7e..0000000
--- a/vendor/github.com/hashicorp/terraform/terraform/shadow_resource_provider.go
+++ /dev/null
@@ -1,815 +0,0 @@
-package terraform
-
-import (
-        "fmt"
-        "log"
-        "sync"
-
-        "github.com/hashicorp/go-multierror"
-        "github.com/hashicorp/terraform/helper/shadow"
-)
-
-// shadowResourceProvider implements ResourceProvider for the shadow
-// eval context defined in eval_context_shadow.go.
-//
-// This is used to verify behavior with a real provider. This shouldn't
-// be used directly.
-type shadowResourceProvider interface {
-        ResourceProvider
-        Shadow
-}
-
-// newShadowResourceProvider creates a new shadowed ResourceProvider.
-//
-// This will assume a well behaved real ResourceProvider. For example,
-// it assumes that the `Resources` call underneath doesn't change values
-// since once it is called on the real provider, it will be cached and
-// returned in the shadow since number of calls to that shouldn't affect
-// actual behavior.
-//
-// However, with calls like Apply, call order is taken into account,
-// parameters are checked for equality, etc.
-func newShadowResourceProvider(p ResourceProvider) (ResourceProvider, shadowResourceProvider) {
-        // Create the shared data
-        shared := shadowResourceProviderShared{}
-
-        // Create the real provider that does actual work
-        real := &shadowResourceProviderReal{
-                ResourceProvider: p,
-                Shared:           &shared,
-        }
-
-        // Create the shadow that watches the real value
-        shadow := &shadowResourceProviderShadow{
-                Shared: &shared,
-
-                resources:   p.Resources(),
-                dataSources: p.DataSources(),
-        }
-
-        return real, shadow
-}
-
-// shadowResourceProviderReal is the real resource provider. Function calls
-// to this will perform real work. This records the parameters and return
-// values and call order for the shadow to reproduce.
-type shadowResourceProviderReal struct {
-        ResourceProvider
-
-        Shared *shadowResourceProviderShared
-}
-
-func (p *shadowResourceProviderReal) Close() error {
-        var result error
-        if c, ok := p.ResourceProvider.(ResourceProviderCloser); ok {
-                result = c.Close()
-        }
-
-        p.Shared.CloseErr.SetValue(result)
-        return result
-}
-
-func (p *shadowResourceProviderReal) Input(
-        input UIInput, c *ResourceConfig) (*ResourceConfig, error) {
-        cCopy := c.DeepCopy()
-
-        result, err := p.ResourceProvider.Input(input, c)
-        p.Shared.Input.SetValue(&shadowResourceProviderInput{
-                Config:    cCopy,
-                Result:    result.DeepCopy(),
-                ResultErr: err,
-        })
-
-        return result, err
-}
-
-func (p *shadowResourceProviderReal) Validate(c *ResourceConfig) ([]string, []error) {
-        warns, errs := p.ResourceProvider.Validate(c)
-        p.Shared.Validate.SetValue(&shadowResourceProviderValidate{
-                Config:     c.DeepCopy(),
-                ResultWarn: warns,
-                ResultErr:  errs,
-        })
-
-        return warns, errs
-}
-
-func (p *shadowResourceProviderReal) Configure(c *ResourceConfig) error {
-        cCopy := c.DeepCopy()
-
-        err := p.ResourceProvider.Configure(c)
-        p.Shared.Configure.SetValue(&shadowResourceProviderConfigure{
-                Config: cCopy,
-                Result: err,
-        })
-
-        return err
-}
-
-func (p *shadowResourceProviderReal) Stop() error {
-        return p.ResourceProvider.Stop()
-}
-
-func (p *shadowResourceProviderReal) ValidateResource(
-        t string, c *ResourceConfig) ([]string, []error) {
-        key := t
-        configCopy := c.DeepCopy()
-
-        // Real operation
-        warns, errs := p.ResourceProvider.ValidateResource(t, c)
-
-        // Initialize to ensure we always have a wrapper with a lock
-        p.Shared.ValidateResource.Init(
-                key, &shadowResourceProviderValidateResourceWrapper{})
-
-        // Get the result
-        raw := p.Shared.ValidateResource.Value(key)
-        wrapper, ok := raw.(*shadowResourceProviderValidateResourceWrapper)
-        if !ok {
-                // If this fails then we just continue with our day... the shadow
-                // will fail to but there isn't much we can do.
-                log.Printf(
-                        "[ERROR] unknown value in ValidateResource shadow value: %#v", raw)
-                return warns, errs
-        }
-
-        // Lock the wrapper for writing and record our call
-        wrapper.Lock()
-        defer wrapper.Unlock()
-
-        wrapper.Calls = append(wrapper.Calls, &shadowResourceProviderValidateResource{
-                Config: configCopy,
-                Warns:  warns,
-                Errors: errs,
-        })
-
-        // With it locked, call SetValue again so that it triggers WaitForChange
-        p.Shared.ValidateResource.SetValue(key, wrapper)
-
-        // Return the result
-        return warns, errs
-}
-
-func (p *shadowResourceProviderReal) Apply(
-        info *InstanceInfo,
-        state *InstanceState,
-        diff *InstanceDiff) (*InstanceState, error) {
-        // Thse have to be copied before the call since call can modify
-        stateCopy := state.DeepCopy()
-        diffCopy := diff.DeepCopy()
-
-        result, err := p.ResourceProvider.Apply(info, state, diff)
-        p.Shared.Apply.SetValue(info.uniqueId(), &shadowResourceProviderApply{
-                State:     stateCopy,
-                Diff:      diffCopy,
-                Result:    result.DeepCopy(),
-                ResultErr: err,
-        })
-
-        return result, err
-}
-
-func (p *shadowResourceProviderReal) Diff(
-        info *InstanceInfo,
-        state *InstanceState,
-        desired *ResourceConfig) (*InstanceDiff, error) {
-        // Thse have to be copied before the call since call can modify
-        stateCopy := state.DeepCopy()
-        desiredCopy := desired.DeepCopy()
-
-        result, err := p.ResourceProvider.Diff(info, state, desired)
-        p.Shared.Diff.SetValue(info.uniqueId(), &shadowResourceProviderDiff{
-                State:     stateCopy,
-                Desired:   desiredCopy,
-                Result:    result.DeepCopy(),
-                ResultErr: err,
-        })
-
-        return result, err
-}
-
-func (p *shadowResourceProviderReal) Refresh(
-        info *InstanceInfo,
-        state *InstanceState) (*InstanceState, error) {
-        // Thse have to be copied before the call since call can modify
-        stateCopy := state.DeepCopy()
-
-        result, err := p.ResourceProvider.Refresh(info, state)
-        p.Shared.Refresh.SetValue(info.uniqueId(), &shadowResourceProviderRefresh{
-                State:     stateCopy,
-                Result:    result.DeepCopy(),
-                ResultErr: err,
-        })
-
-        return result, err
-}
-
-func (p *shadowResourceProviderReal) ValidateDataSource(
-        t string, c *ResourceConfig) ([]string, []error) {
-        key := t
-        configCopy := c.DeepCopy()
-
-        // Real operation
-        warns, errs := p.ResourceProvider.ValidateDataSource(t, c)
-
-        // Initialize
-        p.Shared.ValidateDataSource.Init(
-                key, &shadowResourceProviderValidateDataSourceWrapper{})
-
-        // Get the result
-        raw := p.Shared.ValidateDataSource.Value(key)
-        wrapper, ok := raw.(*shadowResourceProviderValidateDataSourceWrapper)
-        if !ok {
-                // If this fails then we just continue with our day... the shadow
-                // will fail to but there isn't much we can do.
-                log.Printf(
-                        "[ERROR] unknown value in ValidateDataSource shadow value: %#v", raw)
-                return warns, errs
-        }
-
-        // Lock the wrapper for writing and record our call
-        wrapper.Lock()
-        defer wrapper.Unlock()
-
-        wrapper.Calls = append(wrapper.Calls, &shadowResourceProviderValidateDataSource{
-                Config: configCopy,
-                Warns:  warns,
-                Errors: errs,
-        })
-
-        // Set it
-        p.Shared.ValidateDataSource.SetValue(key, wrapper)
-
-        // Return the result
-        return warns, errs
-}
-
-func (p *shadowResourceProviderReal) ReadDataDiff(
-        info *InstanceInfo,
-        desired *ResourceConfig) (*InstanceDiff, error) {
-        // These have to be copied before the call since call can modify
-        desiredCopy := desired.DeepCopy()
-
-        result, err := p.ResourceProvider.ReadDataDiff(info, desired)
-        p.Shared.ReadDataDiff.SetValue(info.uniqueId(), &shadowResourceProviderReadDataDiff{
-                Desired:   desiredCopy,
-                Result:    result.DeepCopy(),
-                ResultErr: err,
-        })
-
-        return result, err
-}
-
-func (p *shadowResourceProviderReal) ReadDataApply(
-        info *InstanceInfo,
-        diff *InstanceDiff) (*InstanceState, error) {
-        // Thse have to be copied before the call since call can modify
-        diffCopy := diff.DeepCopy()
-
-        result, err := p.ResourceProvider.ReadDataApply(info, diff)
-        p.Shared.ReadDataApply.SetValue(info.uniqueId(), &shadowResourceProviderReadDataApply{
-                Diff:      diffCopy,
-                Result:    result.DeepCopy(),
-                ResultErr: err,
-        })
-
-        return result, err
-}
-
-// shadowResourceProviderShadow is the shadow resource provider. Function
-// calls never affect real resources. This is paired with the "real" side
-// which must be called properly to enable recording.
-type shadowResourceProviderShadow struct {
-        Shared *shadowResourceProviderShared
-
-        // Cached values that are expected to not change
-        resources   []ResourceType
-        dataSources []DataSource
-
-        Error     error // Error is the list of errors from the shadow
-        ErrorLock sync.Mutex
-}
-
-type shadowResourceProviderShared struct {
-        // NOTE: Anytime a value is added here, be sure to add it to
-        // the Close() method so that it is closed.
-
-        CloseErr           shadow.Value
-        Input              shadow.Value
-        Validate           shadow.Value
-        Configure          shadow.Value
-        ValidateResource   shadow.KeyedValue
-        Apply              shadow.KeyedValue
-        Diff               shadow.KeyedValue
-        Refresh            shadow.KeyedValue
-        ValidateDataSource shadow.KeyedValue
-        ReadDataDiff       shadow.KeyedValue
-        ReadDataApply      shadow.KeyedValue
-}
-
-func (p *shadowResourceProviderShared) Close() error {
-        return shadow.Close(p)
-}
-
-func (p *shadowResourceProviderShadow) CloseShadow() error {
-        err := p.Shared.Close()
-        if err != nil {
-                err = fmt.Errorf("close error: %s", err)
-        }
-
-        return err
-}
-
-func (p *shadowResourceProviderShadow) ShadowError() error {
-        return p.Error
-}
-
-func (p *shadowResourceProviderShadow) Resources() []ResourceType {
-        return p.resources
-}
-
-func (p *shadowResourceProviderShadow) DataSources() []DataSource {
-        return p.dataSources
-}
-
-func (p *shadowResourceProviderShadow) Close() error {
-        v := p.Shared.CloseErr.Value()
-        if v == nil {
-                return nil
-        }
-
-        return v.(error)
-}
-
-func (p *shadowResourceProviderShadow) Input(
-        input UIInput, c *ResourceConfig) (*ResourceConfig, error) {
-        // Get the result of the input call
-        raw := p.Shared.Input.Value()
-        if raw == nil {
-                return nil, nil
-        }
-
-        result, ok := raw.(*shadowResourceProviderInput)
-        if !ok {
-                p.ErrorLock.Lock()
-                defer p.ErrorLock.Unlock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Unknown 'input' shadow value: %#v", raw))
-                return nil, nil
-        }
-
-        // Compare the parameters, which should be identical
-        if !c.Equal(result.Config) {
-                p.ErrorLock.Lock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Input had unequal configurations (real, then shadow):\n\n%#v\n\n%#v",
-                        result.Config, c))
-                p.ErrorLock.Unlock()
-        }
-
-        // Return the results
-        return result.Result, result.ResultErr
-}
-
-func (p *shadowResourceProviderShadow) Validate(c *ResourceConfig) ([]string, []error) {
-        // Get the result of the validate call
-        raw := p.Shared.Validate.Value()
-        if raw == nil {
-                return nil, nil
-        }
-
-        result, ok := raw.(*shadowResourceProviderValidate)
-        if !ok {
-                p.ErrorLock.Lock()
-                defer p.ErrorLock.Unlock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Unknown 'validate' shadow value: %#v", raw))
-                return nil, nil
-        }
-
-        // Compare the parameters, which should be identical
-        if !c.Equal(result.Config) {
-                p.ErrorLock.Lock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Validate had unequal configurations (real, then shadow):\n\n%#v\n\n%#v",
-                        result.Config, c))
-                p.ErrorLock.Unlock()
-        }
-
-        // Return the results
-        return result.ResultWarn, result.ResultErr
-}
-
-func (p *shadowResourceProviderShadow) Configure(c *ResourceConfig) error {
-        // Get the result of the call
-        raw := p.Shared.Configure.Value()
-        if raw == nil {
-                return nil
-        }
-
-        result, ok := raw.(*shadowResourceProviderConfigure)
-        if !ok {
-                p.ErrorLock.Lock()
-                defer p.ErrorLock.Unlock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Unknown 'configure' shadow value: %#v", raw))
-                return nil
-        }
-
-        // Compare the parameters, which should be identical
-        if !c.Equal(result.Config) {
-                p.ErrorLock.Lock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Configure had unequal configurations (real, then shadow):\n\n%#v\n\n%#v",
-                        result.Config, c))
-                p.ErrorLock.Unlock()
-        }
-
-        // Return the results
-        return result.Result
-}
-
-// Stop returns immediately.
-func (p *shadowResourceProviderShadow) Stop() error {
-        return nil
-}
-
-func (p *shadowResourceProviderShadow) ValidateResource(t string, c *ResourceConfig) ([]string, []error) {
-        // Unique key
-        key := t
-
-        // Get the initial value
-        raw := p.Shared.ValidateResource.Value(key)
-
-        // Find a validation with our configuration
-        var result *shadowResourceProviderValidateResource
-        for {
-                // Get the value
-                if raw == nil {
-                        p.ErrorLock.Lock()
-                        defer p.ErrorLock.Unlock()
-                        p.Error = multierror.Append(p.Error, fmt.Errorf(
-                                "Unknown 'ValidateResource' call for %q:\n\n%#v",
-                                key, c))
-                        return nil, nil
-                }
-
-                wrapper, ok := raw.(*shadowResourceProviderValidateResourceWrapper)
-                if !ok {
-                        p.ErrorLock.Lock()
-                        defer p.ErrorLock.Unlock()
-                        p.Error = multierror.Append(p.Error, fmt.Errorf(
-                                "Unknown 'ValidateResource' shadow value for %q: %#v", key, raw))
-                        return nil, nil
-                }
-
-                // Look for the matching call with our configuration
-                wrapper.RLock()
-                for _, call := range wrapper.Calls {
-                        if call.Config.Equal(c) {
-                                result = call
-                                break
-                        }
-                }
-                wrapper.RUnlock()
-
-                // If we found a result, exit
-                if result != nil {
-                        break
-                }
-
-                // Wait for a change so we can get the wrapper again
-                raw = p.Shared.ValidateResource.WaitForChange(key)
-        }
-
-        return result.Warns, result.Errors
-}
-
-func (p *shadowResourceProviderShadow) Apply(
-        info *InstanceInfo,
-        state *InstanceState,
-        diff *InstanceDiff) (*InstanceState, error) {
-        // Unique key
-        key := info.uniqueId()
-        raw := p.Shared.Apply.Value(key)
-        if raw == nil {
-                p.ErrorLock.Lock()
-                defer p.ErrorLock.Unlock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Unknown 'apply' call for %q:\n\n%#v\n\n%#v",
-                        key, state, diff))
-                return nil, nil
-        }
-
-        result, ok := raw.(*shadowResourceProviderApply)
-        if !ok {
-                p.ErrorLock.Lock()
-                defer p.ErrorLock.Unlock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Unknown 'apply' shadow value for %q: %#v", key, raw))
-                return nil, nil
-        }
-
-        // Compare the parameters, which should be identical
-        if !state.Equal(result.State) {
-                p.ErrorLock.Lock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Apply %q: state had unequal states (real, then shadow):\n\n%#v\n\n%#v",
-                        key, result.State, state))
-                p.ErrorLock.Unlock()
-        }
-
-        if !diff.Equal(result.Diff) {
-                p.ErrorLock.Lock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Apply %q: unequal diffs (real, then shadow):\n\n%#v\n\n%#v",
-                        key, result.Diff, diff))
-                p.ErrorLock.Unlock()
-        }
-
-        return result.Result, result.ResultErr
-}
-
-func (p *shadowResourceProviderShadow) Diff(
-        info *InstanceInfo,
-        state *InstanceState,
-        desired *ResourceConfig) (*InstanceDiff, error) {
-        // Unique key
-        key := info.uniqueId()
-        raw := p.Shared.Diff.Value(key)
-        if raw == nil {
-                p.ErrorLock.Lock()
-                defer p.ErrorLock.Unlock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Unknown 'diff' call for %q:\n\n%#v\n\n%#v",
-                        key, state, desired))
-                return nil, nil
-        }
-
-        result, ok := raw.(*shadowResourceProviderDiff)
-        if !ok {
-                p.ErrorLock.Lock()
-                defer p.ErrorLock.Unlock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Unknown 'diff' shadow value for %q: %#v", key, raw))
-                return nil, nil
-        }
-
-        // Compare the parameters, which should be identical
-        if !state.Equal(result.State) {
-                p.ErrorLock.Lock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Diff %q had unequal states (real, then shadow):\n\n%#v\n\n%#v",
-                        key, result.State, state))
-                p.ErrorLock.Unlock()
-        }
-        if !desired.Equal(result.Desired) {
-                p.ErrorLock.Lock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Diff %q had unequal states (real, then shadow):\n\n%#v\n\n%#v",
-                        key, result.Desired, desired))
-                p.ErrorLock.Unlock()
-        }
-
-        return result.Result, result.ResultErr
-}
-
-func (p *shadowResourceProviderShadow) Refresh(
-        info *InstanceInfo,
-        state *InstanceState) (*InstanceState, error) {
-        // Unique key
-        key := info.uniqueId()
-        raw := p.Shared.Refresh.Value(key)
-        if raw == nil {
-                p.ErrorLock.Lock()
-                defer p.ErrorLock.Unlock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Unknown 'refresh' call for %q:\n\n%#v",
-                        key, state))
-                return nil, nil
-        }
-
-        result, ok := raw.(*shadowResourceProviderRefresh)
-        if !ok {
-                p.ErrorLock.Lock()
-                defer p.ErrorLock.Unlock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Unknown 'refresh' shadow value: %#v", raw))
-                return nil, nil
-        }
-
-        // Compare the parameters, which should be identical
-        if !state.Equal(result.State) {
-                p.ErrorLock.Lock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Refresh %q had unequal states (real, then shadow):\n\n%#v\n\n%#v",
-                        key, result.State, state))
-                p.ErrorLock.Unlock()
-        }
-
-        return result.Result, result.ResultErr
-}
-
-func (p *shadowResourceProviderShadow) ValidateDataSource(
-        t string, c *ResourceConfig) ([]string, []error) {
-        // Unique key
-        key := t
-
-        // Get the initial value
-        raw := p.Shared.ValidateDataSource.Value(key)
-
-        // Find a validation with our configuration
-        var result *shadowResourceProviderValidateDataSource
-        for {
-                // Get the value
-                if raw == nil {
-                        p.ErrorLock.Lock()
-                        defer p.ErrorLock.Unlock()
-                        p.Error = multierror.Append(p.Error, fmt.Errorf(
-                                "Unknown 'ValidateDataSource' call for %q:\n\n%#v",
-                                key, c))
-                        return nil, nil
-                }
-
-                wrapper, ok := raw.(*shadowResourceProviderValidateDataSourceWrapper)
-                if !ok {
-                        p.ErrorLock.Lock()
-                        defer p.ErrorLock.Unlock()
-                        p.Error = multierror.Append(p.Error, fmt.Errorf(
-                                "Unknown 'ValidateDataSource' shadow value: %#v", raw))
-                        return nil, nil
-                }
-
-                // Look for the matching call with our configuration
-                wrapper.RLock()
-                for _, call := range wrapper.Calls {
-                        if call.Config.Equal(c) {
-                                result = call
-                                break
-                        }
-                }
-                wrapper.RUnlock()
-
-                // If we found a result, exit
-                if result != nil {
-                        break
-                }
-
-                // Wait for a change so we can get the wrapper again
-                raw = p.Shared.ValidateDataSource.WaitForChange(key)
-        }
-
-        return result.Warns, result.Errors
-}
-
-func (p *shadowResourceProviderShadow) ReadDataDiff(
-        info *InstanceInfo,
-        desired *ResourceConfig) (*InstanceDiff, error) {
-        // Unique key
-        key := info.uniqueId()
-        raw := p.Shared.ReadDataDiff.Value(key)
-        if raw == nil {
-                p.ErrorLock.Lock()
-                defer p.ErrorLock.Unlock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Unknown 'ReadDataDiff' call for %q:\n\n%#v",
-                        key, desired))
-                return nil, nil
-        }
-
-        result, ok := raw.(*shadowResourceProviderReadDataDiff)
-        if !ok {
-                p.ErrorLock.Lock()
-                defer p.ErrorLock.Unlock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Unknown 'ReadDataDiff' shadow value for %q: %#v", key, raw))
-                return nil, nil
-        }
-
-        // Compare the parameters, which should be identical
-        if !desired.Equal(result.Desired) {
-                p.ErrorLock.Lock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "ReadDataDiff %q had unequal configs (real, then shadow):\n\n%#v\n\n%#v",
-                        key, result.Desired, desired))
-                p.ErrorLock.Unlock()
-        }
-
-        return result.Result, result.ResultErr
-}
-
-func (p *shadowResourceProviderShadow) ReadDataApply(
-        info *InstanceInfo,
-        d *InstanceDiff) (*InstanceState, error) {
-        // Unique key
-        key := info.uniqueId()
-        raw := p.Shared.ReadDataApply.Value(key)
-        if raw == nil {
-                p.ErrorLock.Lock()
-                defer p.ErrorLock.Unlock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Unknown 'ReadDataApply' call for %q:\n\n%#v",
-                        key, d))
-                return nil, nil
-        }
-
-        result, ok := raw.(*shadowResourceProviderReadDataApply)
-        if !ok {
-                p.ErrorLock.Lock()
-                defer p.ErrorLock.Unlock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Unknown 'ReadDataApply' shadow value for %q: %#v", key, raw))
-                return nil, nil
-        }
-
-        // Compare the parameters, which should be identical
-        if !d.Equal(result.Diff) {
-                p.ErrorLock.Lock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "ReadDataApply: unequal diffs (real, then shadow):\n\n%#v\n\n%#v",
-                        result.Diff, d))
-                p.ErrorLock.Unlock()
-        }
-
-        return result.Result, result.ResultErr
-}
-
-func (p *shadowResourceProviderShadow) ImportState(info *InstanceInfo, id string) ([]*InstanceState, error) {
-        panic("import not supported by shadow graph")
-}
-
-// The structs for the various function calls are put below. These structs
-// are used to carry call information across the real/shadow boundaries.
-
-type shadowResourceProviderInput struct {
-        Config    *ResourceConfig
-        Result    *ResourceConfig
-        ResultErr error
-}
-
-type shadowResourceProviderValidate struct {
-        Config     *ResourceConfig
-        ResultWarn []string
-        ResultErr  []error
-}
-
-type shadowResourceProviderConfigure struct {
-        Config *ResourceConfig
-        Result error
-}
-
-type shadowResourceProviderValidateResourceWrapper struct {
-        sync.RWMutex
-
-        Calls []*shadowResourceProviderValidateResource
-}
-
-type shadowResourceProviderValidateResource struct {
-        Config *ResourceConfig
-        Warns  []string
-        Errors []error
-}
-
-type shadowResourceProviderApply struct {
-        State     *InstanceState
-        Diff      *InstanceDiff
-        Result    *InstanceState
-        ResultErr error
-}
-
-type shadowResourceProviderDiff struct {
-        State     *InstanceState
-        Desired   *ResourceConfig
-        Result    *InstanceDiff
-        ResultErr error
-}
-
-type shadowResourceProviderRefresh struct {
-        State     *InstanceState
-        Result    *InstanceState
-        ResultErr error
-}
-
-type shadowResourceProviderValidateDataSourceWrapper struct {
-        sync.RWMutex
-
-        Calls []*shadowResourceProviderValidateDataSource
-}
-
-type shadowResourceProviderValidateDataSource struct {
-        Config *ResourceConfig
-        Warns  []string
-        Errors []error
-}
-
-type shadowResourceProviderReadDataDiff struct {
-        Desired   *ResourceConfig
-        Result    *InstanceDiff
-        ResultErr error
-}
-
-type shadowResourceProviderReadDataApply struct {
-        Diff      *InstanceDiff
-        Result    *InstanceState
-        ResultErr error
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/shadow_resource_provisioner.go b/vendor/github.com/hashicorp/terraform/terraform/shadow_resource_provisioner.go
deleted file mode 100644
index 60a4908..0000000
--- a/vendor/github.com/hashicorp/terraform/terraform/shadow_resource_provisioner.go
+++ /dev/null
@@ -1,282 +0,0 @@
-package terraform
-
-import (
-        "fmt"
-        "io"
-        "log"
-        "sync"
-
-        "github.com/hashicorp/go-multierror"
-        "github.com/hashicorp/terraform/helper/shadow"
-)
-
-// shadowResourceProvisioner implements ResourceProvisioner for the shadow
-// eval context defined in eval_context_shadow.go.
-//
-// This is used to verify behavior with a real provisioner. This shouldn't
-// be used directly.
-type shadowResourceProvisioner interface {
-        ResourceProvisioner
-        Shadow
-}
-
-// newShadowResourceProvisioner creates a new shadowed ResourceProvisioner.
-func newShadowResourceProvisioner(
-        p ResourceProvisioner) (ResourceProvisioner, shadowResourceProvisioner) {
-        // Create the shared data
-        shared := shadowResourceProvisionerShared{
-                Validate: shadow.ComparedValue{
-                        Func: shadowResourceProvisionerValidateCompare,
-                },
-        }
-
-        // Create the real provisioner that does actual work
-        real := &shadowResourceProvisionerReal{
-                ResourceProvisioner: p,
-                Shared:              &shared,
-        }
-
-        // Create the shadow that watches the real value
-        shadow := &shadowResourceProvisionerShadow{
-                Shared: &shared,
-        }
-
-        return real, shadow
-}
-
-// shadowResourceProvisionerReal is the real resource provisioner. Function calls
-// to this will perform real work. This records the parameters and return
-// values and call order for the shadow to reproduce.
-type shadowResourceProvisionerReal struct {
-        ResourceProvisioner
-
-        Shared *shadowResourceProvisionerShared
-}
-
-func (p *shadowResourceProvisionerReal) Close() error {
-        var result error
-        if c, ok := p.ResourceProvisioner.(ResourceProvisionerCloser); ok {
-                result = c.Close()
-        }
-
-        p.Shared.CloseErr.SetValue(result)
-        return result
-}
-
-func (p *shadowResourceProvisionerReal) Validate(c *ResourceConfig) ([]string, []error) {
-        warns, errs := p.ResourceProvisioner.Validate(c)
-        p.Shared.Validate.SetValue(&shadowResourceProvisionerValidate{
-                Config:     c,
-                ResultWarn: warns,
-                ResultErr:  errs,
-        })
-
-        return warns, errs
-}
-
-func (p *shadowResourceProvisionerReal) Apply(
-        output UIOutput, s *InstanceState, c *ResourceConfig) error {
-        err := p.ResourceProvisioner.Apply(output, s, c)
-
-        // Write the result, grab a lock for writing. This should nver
-        // block long since the operations below don't block.
-        p.Shared.ApplyLock.Lock()
-        defer p.Shared.ApplyLock.Unlock()
-
-        key := s.ID
-        raw, ok := p.Shared.Apply.ValueOk(key)
-        if !ok {
-                // Setup a new value
-                raw = &shadow.ComparedValue{
-                        Func: shadowResourceProvisionerApplyCompare,
-                }
-
-                // Set it
-                p.Shared.Apply.SetValue(key, raw)
-        }
-
-        compareVal, ok := raw.(*shadow.ComparedValue)
-        if !ok {
-                // Just log and return so that we don't cause the real side
-                // any side effects.
-                log.Printf("[ERROR] unknown value in 'apply': %#v", raw)
-                return err
-        }
-
-        // Write the resulting value
-        compareVal.SetValue(&shadowResourceProvisionerApply{
-                Config:    c,
-                ResultErr: err,
-        })
-
-        return err
-}
-
-func (p *shadowResourceProvisionerReal) Stop() error {
-        return p.ResourceProvisioner.Stop()
-}
-
-// shadowResourceProvisionerShadow is the shadow resource provisioner. Function
-// calls never affect real resources. This is paired with the "real" side
-// which must be called properly to enable recording.
-type shadowResourceProvisionerShadow struct {
-        Shared *shadowResourceProvisionerShared
-
-        Error     error // Error is the list of errors from the shadow
-        ErrorLock sync.Mutex
-}
-
-type shadowResourceProvisionerShared struct {
-        // NOTE: Anytime a value is added here, be sure to add it to
-        // the Close() method so that it is closed.
-
-        CloseErr  shadow.Value
-        Validate  shadow.ComparedValue
-        Apply     shadow.KeyedValue
-        ApplyLock sync.Mutex // For writing only
-}
-
-func (p *shadowResourceProvisionerShared) Close() error {
-        closers := []io.Closer{
-                &p.CloseErr,
-        }
-
-        for _, c := range closers {
-                // This should never happen, but we don't panic because a panic
-                // could affect the real behavior of Terraform and a shadow should
-                // never be able to do that.
-                if err := c.Close(); err != nil {
-                        return err
-                }
-        }
-
-        return nil
-}
-
-func (p *shadowResourceProvisionerShadow) CloseShadow() error {
-        err := p.Shared.Close()
-        if err != nil {
-                err = fmt.Errorf("close error: %s", err)
-        }
-
-        return err
-}
-
-func (p *shadowResourceProvisionerShadow) ShadowError() error {
-        return p.Error
-}
-
-func (p *shadowResourceProvisionerShadow) Close() error {
-        v := p.Shared.CloseErr.Value()
-        if v == nil {
-                return nil
-        }
-
-        return v.(error)
-}
-
-func (p *shadowResourceProvisionerShadow) Validate(c *ResourceConfig) ([]string, []error) {
-        // Get the result of the validate call
-        raw := p.Shared.Validate.Value(c)
-        if raw == nil {
-                return nil, nil
-        }
-
-        result, ok := raw.(*shadowResourceProvisionerValidate)
-        if !ok {
-                p.ErrorLock.Lock()
-                defer p.ErrorLock.Unlock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Unknown 'validate' shadow value: %#v", raw))
-                return nil, nil
-        }
-
-        // We don't need to compare configurations because we key on the
-        // configuration so just return right away.
-        return result.ResultWarn, result.ResultErr
-}
-
-func (p *shadowResourceProvisionerShadow) Apply(
-        output UIOutput, s *InstanceState, c *ResourceConfig) error {
-        // Get the value based on the key
-        key := s.ID
-        raw := p.Shared.Apply.Value(key)
-        if raw == nil {
-                return nil
-        }
-
-        compareVal, ok := raw.(*shadow.ComparedValue)
-        if !ok {
-                p.ErrorLock.Lock()
-                defer p.ErrorLock.Unlock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Unknown 'apply' shadow value: %#v", raw))
-                return nil
-        }
-
-        // With the compared value, we compare against our config
-        raw = compareVal.Value(c)
-        if raw == nil {
-                return nil
-        }
-
-        result, ok := raw.(*shadowResourceProvisionerApply)
-        if !ok {
-                p.ErrorLock.Lock()
-                defer p.ErrorLock.Unlock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Unknown 'apply' shadow value: %#v", raw))
-                return nil
-        }
-
-        return result.ResultErr
-}
-
-func (p *shadowResourceProvisionerShadow) Stop() error {
-        // For the shadow, we always just return nil since a Stop indicates
-        // that we were interrupted and shadows are disabled during interrupts
-        // anyways.
-        return nil
-}
-
-// The structs for the various function calls are put below. These structs
-// are used to carry call information across the real/shadow boundaries.
-
-type shadowResourceProvisionerValidate struct {
-        Config     *ResourceConfig
-        ResultWarn []string
-        ResultErr  []error
-}
-
-type shadowResourceProvisionerApply struct {
-        Config    *ResourceConfig
-        ResultErr error
-}
-
-func shadowResourceProvisionerValidateCompare(k, v interface{}) bool {
-        c, ok := k.(*ResourceConfig)
-        if !ok {
-                return false
-        }
-
-        result, ok := v.(*shadowResourceProvisionerValidate)
-        if !ok {
-                return false
-        }
-
-        return c.Equal(result.Config)
-}
-
-func shadowResourceProvisionerApplyCompare(k, v interface{}) bool {
-        c, ok := k.(*ResourceConfig)
-        if !ok {
-                return false
-        }
-
-        result, ok := v.(*shadowResourceProvisionerApply)
-        if !ok {
-                return false
-        }
-
-        return c.Equal(result.Config)
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/state.go b/vendor/github.com/hashicorp/terraform/terraform/state.go
index 0c46194..04b14a6 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/state.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/state.go
@@ -9,6 +9,7 @@ import (
         "io"
         "io/ioutil"
         "log"
+        "os"
         "reflect"
         "sort"
         "strconv"
@@ -16,10 +17,12 @@ import (
         "sync"
 
         "github.com/hashicorp/go-multierror"
+        "github.com/hashicorp/go-uuid"
         "github.com/hashicorp/go-version"
         "github.com/hashicorp/terraform/config"
         "github.com/mitchellh/copystructure"
-        "github.com/satori/go.uuid"
+
+        tfversion "github.com/hashicorp/terraform/version"
 )
 
 const (
@@ -664,7 +667,7 @@ func (s *State) FromFutureTerraform() bool {
         }
 
         v := version.Must(version.NewVersion(s.TFVersion))
-        return SemVersion.LessThan(v)
+        return tfversion.SemVer.LessThan(v)
 }
 
 func (s *State) Init() {
@@ -704,7 +707,11 @@ func (s *State) EnsureHasLineage() {
 
 func (s *State) ensureHasLineage() {
         if s.Lineage == "" {
-                s.Lineage = uuid.NewV4().String()
+                lineage, err := uuid.GenerateUUID()
+                if err != nil {
+                        panic(fmt.Errorf("Failed to generate lineage: %v", err))
+                }
+                s.Lineage = lineage
                 log.Printf("[DEBUG] New state was assigned lineage %q\n", s.Lineage)
         } else {
                 log.Printf("[TRACE] Preserving existing state lineage %q\n", s.Lineage)
@@ -977,6 +984,10 @@ type ModuleState struct {
         // always disjoint, so the path represents amodule tree
         Path []string `json:"path"`
 
+        // Locals are kept only transiently in-memory, because we can always
+        // re-compute them.
+        Locals map[string]interface{} `json:"-"`
+
         // Outputs declared by the module and maintained for each module
         // even though only the root module technically needs to be kept.
         // This allows operators to inspect values at the boundaries.
@@ -1083,7 +1094,7 @@ func (m *ModuleState) Orphans(c *config.Config) []string {
         defer m.Unlock()
 
         keys := make(map[string]struct{})
-        for k, _ := range m.Resources {
+        for k := range m.Resources {
                 keys[k] = struct{}{}
         }
 
@@ -1091,7 +1102,7 @@ func (m *ModuleState) Orphans(c *config.Config) []string {
                 for _, r := range c.Resources {
                         delete(keys, r.Id())
 
-                        for k, _ := range keys {
+                        for k := range keys {
                                 if strings.HasPrefix(k, r.Id()+".") {
                                         delete(keys, k)
                                 }
@@ -1100,7 +1111,32 @@ func (m *ModuleState) Orphans(c *config.Config) []string {
         }
 
         result := make([]string, 0, len(keys))
-        for k, _ := range keys {
+        for k := range keys {
+                result = append(result, k)
+        }
+
+        return result
+}
+
+// RemovedOutputs returns a list of outputs that are in the State but aren't
+// present in the configuration itself.
+func (m *ModuleState) RemovedOutputs(c *config.Config) []string {
+        m.Lock()
+        defer m.Unlock()
+
+        keys := make(map[string]struct{})
+        for k := range m.Outputs {
+                keys[k] = struct{}{}
+        }
+
+        if c != nil {
+                for _, o := range c.Outputs {
+                        delete(keys, o.Name)
+                }
+        }
+
+        result := make([]string, 0, len(keys))
+        for k := range keys {
                 result = append(result, k)
         }
 
@@ -1308,6 +1344,10 @@ func (m *ModuleState) String() string {
         return buf.String()
 }
 
+func (m *ModuleState) Empty() bool {
+        return len(m.Locals) == 0 && len(m.Outputs) == 0 && len(m.Resources) == 0
+}
+
 // ResourceStateKey is a structured representation of the key used for the
 // ModuleState.Resources mapping
 type ResourceStateKey struct {
@@ -1681,7 +1721,20 @@ func (s *InstanceState) Equal(other *InstanceState) bool {
                 // We only do the deep check if both are non-nil. If one is nil
                 // we treat it as equal since their lengths are both zero (check
                 // above).
-                if !reflect.DeepEqual(s.Meta, other.Meta) {
+                //
+                // Since this can contain numeric values that may change types during
+                // serialization, let's compare the serialized values.
+                sMeta, err := json.Marshal(s.Meta)
+                if err != nil {
+                        // marshaling primitives shouldn't ever error out
+                        panic(err)
+                }
+                otherMeta, err := json.Marshal(other.Meta)
+                if err != nil {
+                        panic(err)
+                }
+
+                if !bytes.Equal(sMeta, otherMeta) {
                         return false
                 }
         }
@@ -1824,11 +1877,19 @@ var ErrNoState = errors.New("no state")
 // ReadState reads a state structure out of a reader in the format that
 // was written by WriteState.
 func ReadState(src io.Reader) (*State, error) {
+        // check for a nil file specifically, since that produces a platform
+        // specific error if we try to use it in a bufio.Reader.
+        if f, ok := src.(*os.File); ok && f == nil {
+                return nil, ErrNoState
+        }
+
         buf := bufio.NewReader(src)
+
         if _, err := buf.Peek(1); err != nil {
-                // the error is either io.EOF or "invalid argument", and both are from
-                // an empty state.
-                return nil, ErrNoState
+                if err == io.EOF {
+                        return nil, ErrNoState
+                }
+                return nil, err
         }
 
         if err := testForV0State(buf); err != nil {
@@ -1891,7 +1952,7 @@ func ReadState(src io.Reader) (*State, error) {
                 result = v3State
         default:
                 return nil, fmt.Errorf("Terraform %s does not support state version %d, please update.",
-                        SemVersion.String(), versionIdentifier.Version)
+                        tfversion.SemVer.String(), versionIdentifier.Version)
         }
 
         // If we reached this place we must have a result set
@@ -1935,7 +1996,7 @@ func ReadStateV2(jsonBytes []byte) (*State, error) {
         // version that we don't understand
         if state.Version > StateVersion {
                 return nil, fmt.Errorf("Terraform %s does not support state version %d, please update.",
-                        SemVersion.String(), state.Version)
+                        tfversion.SemVer.String(), state.Version)
         }
 
         // Make sure the version is semantic
@@ -1970,7 +2031,7 @@ func ReadStateV3(jsonBytes []byte) (*State, error) {
         // version that we don't understand
         if state.Version > StateVersion {
                 return nil, fmt.Errorf("Terraform %s does not support state version %d, please update.",
-                        SemVersion.String(), state.Version)
+                        tfversion.SemVer.String(), state.Version)
         }
 
         // Make sure the version is semantic
@@ -2126,6 +2187,19 @@ func (s moduleStateSort) Swap(i, j int) {
         s[i], s[j] = s[j], s[i]
 }
 
+// StateCompatible returns an error if the state is not compatible with the
+// current version of terraform.
+func CheckStateVersion(state *State) error {
+        if state == nil {
+                return nil
+        }
+
+        if state.FromFutureTerraform() {
+                return fmt.Errorf(stateInvalidTerraformVersionErr, state.TFVersion)
+        }
+        return nil
+}
+
 const stateValidateErrMultiModule = `
 Multiple modules with the same path: %s
 
@@ -2134,3 +2208,11 @@ in your state file that point to the same module. This will cause Terraform
 to behave in unexpected and error prone ways and is invalid. Please back up
 and modify your state file manually to resolve this.
 `
+
+const stateInvalidTerraformVersionErr = `
+Terraform doesn't allow running any operations against a state
+that was written by a future Terraform version. The state is
+reporting it is written by Terraform '%s'
+
+Please run at least that version of Terraform to continue.
+`
diff --git a/vendor/github.com/hashicorp/terraform/terraform/test_failure b/vendor/github.com/hashicorp/terraform/terraform/test_failure
deleted file mode 100644
index 5d3ad1a..0000000
--- a/vendor/github.com/hashicorp/terraform/terraform/test_failure
+++ /dev/null
@@ -1,9 +0,0 @@
---- FAIL: TestContext2Plan_moduleProviderInherit (0.01s)
-        context_plan_test.go:552: bad: []string{"child"}
-map[string]dag.Vertex{}
-"module.middle.null"
-map[string]dag.Vertex{}
-"module.middle.module.inner.null"
-map[string]dag.Vertex{}
-"aws"
-FAIL
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform.go b/vendor/github.com/hashicorp/terraform/terraform/transform.go
index f4a431a..0e47f20 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform.go
@@ -1,6 +1,8 @@
 package terraform
 
 import (
+        "log"
+
         "github.com/hashicorp/terraform/dag"
 )
 
@@ -40,6 +42,9 @@ func (t *graphTransformerMulti) Transform(g *Graph) error {
                 if err := t.Transform(g); err != nil {
                         return err
                 }
+                log.Printf(
+                        "[TRACE] Graph after step %T:\n\n%s",
+                        t, g.StringWithNodeTypes())
         }
 
         return nil
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_attach_config_provider.go b/vendor/github.com/hashicorp/terraform/terraform/transform_attach_config_provider.go
index 10506ea..39cf097 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_attach_config_provider.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_attach_config_provider.go
@@ -1,10 +1,7 @@
 package terraform
 
 import (
-        "log"
-
         "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/config/module"
 )
 
 // GraphNodeAttachProvider is an interface that must be implemented by nodes
@@ -19,62 +16,3 @@ type GraphNodeAttachProvider interface {
         // Sets the configuration
         AttachProvider(*config.ProviderConfig)
 }
-
-// AttachProviderConfigTransformer goes through the graph and attaches
-// provider configuration structures to nodes that implement the interfaces
-// above.
-//
-// The attached configuration structures are directly from the configuration.
-// If they're going to be modified, a copy should be made.
-type AttachProviderConfigTransformer struct {
-        Module *module.Tree // Module is the root module for the config
-}
-
-func (t *AttachProviderConfigTransformer) Transform(g *Graph) error {
-        if err := t.attachProviders(g); err != nil {
-                return err
-        }
-
-        return nil
-}
-
-func (t *AttachProviderConfigTransformer) attachProviders(g *Graph) error {
-        // Go through and find GraphNodeAttachProvider
-        for _, v := range g.Vertices() {
-                // Only care about GraphNodeAttachProvider implementations
-                apn, ok := v.(GraphNodeAttachProvider)
-                if !ok {
-                        continue
-                }
-
-                // Determine what we're looking for
-                path := normalizeModulePath(apn.Path())
-                path = path[1:]
-                name := apn.ProviderName()
-                log.Printf("[TRACE] Attach provider request: %#v %s", path, name)
-
-                // Get the configuration.
-                tree := t.Module.Child(path)
-                if tree == nil {
-                        continue
-                }
-
-                // Go through the provider configs to find the matching config
-                for _, p := range tree.Config().ProviderConfigs {
-                        // Build the name, which is "name.alias" if an alias exists
-                        current := p.Name
-                        if p.Alias != "" {
-                                current += "." + p.Alias
-                        }
-
-                        // If the configs match then attach!
-                        if current == name {
-                                log.Printf("[TRACE] Attaching provider config: %#v", p)
-                                apn.AttachProvider(p)
-                                break
-                        }
-                }
-        }
-
-        return nil
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_deposed.go b/vendor/github.com/hashicorp/terraform/terraform/transform_deposed.go
index 2148cef..87a1f9c 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_deposed.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_deposed.go
@@ -12,6 +12,9 @@ type DeposedTransformer struct {
         // View, if non-empty, is the ModuleState.View used around the state
         // to find deposed resources.
         View string
+
+        // The provider used by the resourced which were deposed
+        ResolvedProvider string
 }
 
 func (t *DeposedTransformer) Transform(g *Graph) error {
@@ -33,14 +36,16 @@ func (t *DeposedTransformer) Transform(g *Graph) error {
                 if len(rs.Deposed) == 0 {
                         continue
                 }
+
                 deposed := rs.Deposed
 
                 for i, _ := range deposed {
                         g.Add(&graphNodeDeposedResource{
-                                Index:        i,
-                                ResourceName: k,
-                                ResourceType: rs.Type,
-                                Provider:     rs.Provider,
+                                Index:            i,
+                                ResourceName:     k,
+                                ResourceType:     rs.Type,
+                                ProviderName:     rs.Provider,
+                                ResolvedProvider: t.ResolvedProvider,
                         })
                 }
         }
@@ -50,18 +55,23 @@ func (t *DeposedTransformer) Transform(g *Graph) error {
 
 // graphNodeDeposedResource is the graph vertex representing a deposed resource.
 type graphNodeDeposedResource struct {
-        Index        int
-        ResourceName string
-        ResourceType string
-        Provider     string
+        Index            int
+        ResourceName     string
+        ResourceType     string
+        ProviderName     string
+        ResolvedProvider string
 }
 
 func (n *graphNodeDeposedResource) Name() string {
         return fmt.Sprintf("%s (deposed #%d)", n.ResourceName, n.Index)
 }
 
-func (n *graphNodeDeposedResource) ProvidedBy() []string {
-        return []string{resourceProvider(n.ResourceName, n.Provider)}
+func (n *graphNodeDeposedResource) ProvidedBy() string {
+        return resourceProvider(n.ResourceName, n.ProviderName)
+}
+
+func (n *graphNodeDeposedResource) SetProvider(p string) {
+        n.ResolvedProvider = p
 }
 
 // GraphNodeEvalable impl.
@@ -81,7 +91,7 @@ func (n *graphNodeDeposedResource) EvalTree() EvalNode {
                 Node: &EvalSequence{
                         Nodes: []EvalNode{
                                 &EvalGetProvider{
-                                        Name:   n.ProvidedBy()[0],
+                                        Name:   n.ResolvedProvider,
                                         Output: &provider,
                                 },
                                 &EvalReadStateDeposed{
@@ -98,7 +108,7 @@ func (n *graphNodeDeposedResource) EvalTree() EvalNode {
                                 &EvalWriteStateDeposed{
                                         Name:         n.ResourceName,
                                         ResourceType: n.ResourceType,
-                                        Provider:     n.Provider,
+                                        Provider:     n.ResolvedProvider,
                                         State:        &state,
                                         Index:        n.Index,
                                 },
@@ -114,7 +124,7 @@ func (n *graphNodeDeposedResource) EvalTree() EvalNode {
                 Node: &EvalSequence{
                         Nodes: []EvalNode{
                                 &EvalGetProvider{
-                                        Name:   n.ProvidedBy()[0],
+                                        Name:   n.ResolvedProvider,
                                         Output: &provider,
                                 },
                                 &EvalReadStateDeposed{
@@ -147,7 +157,7 @@ func (n *graphNodeDeposedResource) EvalTree() EvalNode {
                                 &EvalWriteStateDeposed{
                                         Name:         n.ResourceName,
                                         ResourceType: n.ResourceType,
-                                        Provider:     n.Provider,
+                                        Provider:     n.ResolvedProvider,
                                         State:        &state,
                                         Index:        n.Index,
                                 },
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_destroy_edge.go b/vendor/github.com/hashicorp/terraform/terraform/transform_destroy_edge.go
index 22be1ab..a06ff29 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_destroy_edge.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_destroy_edge.go
@@ -119,17 +119,15 @@ func (t *DestroyEdgeTransformer) Transform(g *Graph) error {
                 return &NodeApplyableProvider{NodeAbstractProvider: a}
         }
         steps := []GraphTransformer{
+                // Add the local values
+                &LocalTransformer{Module: t.Module},
+
                 // Add outputs and metadata
                 &OutputTransformer{Module: t.Module},
                 &AttachResourceConfigTransformer{Module: t.Module},
                 &AttachStateTransformer{State: t.State},
 
-                // Add providers since they can affect destroy order as well
-                &MissingProviderTransformer{AllowAny: true, Concrete: providerFn},
-                &ProviderTransformer{},
-                &DisableProviderTransformer{},
-                &ParentProviderTransformer{},
-                &AttachProviderConfigTransformer{Module: t.Module},
+                TransformProviders(nil, providerFn, t.Module),
 
                 // Add all the variables. We can depend on resources through
                 // variables due to module parameters, and we need to properly
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_import_state.go b/vendor/github.com/hashicorp/terraform/terraform/transform_import_state.go
index 081df2f..fcbff65 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_import_state.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_import_state.go
@@ -21,9 +21,9 @@ func (t *ImportStateTransformer) Transform(g *Graph) error {
                 }
 
                 nodes = append(nodes, &graphNodeImportState{
-                        Addr:     addr,
-                        ID:       target.ID,
-                        Provider: target.Provider,
+                        Addr:         addr,
+                        ID:           target.ID,
+                        ProviderName: target.Provider,
                 })
         }
 
@@ -36,9 +36,10 @@ func (t *ImportStateTransformer) Transform(g *Graph) error {
 }
 
 type graphNodeImportState struct {
-        Addr     *ResourceAddress // Addr is the resource address to import to
-        ID       string           // ID is the ID to import as
-        Provider string           // Provider string
+        Addr             *ResourceAddress // Addr is the resource address to import to
+        ID               string           // ID is the ID to import as
+        ProviderName     string           // Provider string
+        ResolvedProvider string           // provider node address
 
         states []*InstanceState
 }
@@ -47,8 +48,12 @@ func (n *graphNodeImportState) Name() string {
         return fmt.Sprintf("%s (import id: %s)", n.Addr, n.ID)
 }
 
-func (n *graphNodeImportState) ProvidedBy() []string {
-        return []string{resourceProvider(n.Addr.Type, n.Provider)}
+func (n *graphNodeImportState) ProvidedBy() string {
+        return resourceProvider(n.Addr.Type, n.ProviderName)
+}
+
+func (n *graphNodeImportState) SetProvider(p string) {
+        n.ResolvedProvider = p
 }
 
 // GraphNodeSubPath
@@ -72,7 +77,7 @@ func (n *graphNodeImportState) EvalTree() EvalNode {
         return &EvalSequence{
                 Nodes: []EvalNode{
                         &EvalGetProvider{
-                                Name:   n.ProvidedBy()[0],
+                                Name:   n.ResolvedProvider,
                                 Output: &provider,
                         },
                         &EvalImportState{
@@ -149,10 +154,11 @@ func (n *graphNodeImportState) DynamicExpand(ctx EvalContext) (*Graph, error) {
         // is safe.
         for i, state := range n.states {
                 g.Add(&graphNodeImportStateSub{
-                        Target:   addrs[i],
-                        Path_:    n.Path(),
-                        State:    state,
-                        Provider: n.Provider,
+                        Target:           addrs[i],
+                        Path_:            n.Path(),
+                        State:            state,
+                        ProviderName:     n.ProviderName,
+                        ResolvedProvider: n.ResolvedProvider,
                 })
         }
 
@@ -170,10 +176,11 @@ func (n *graphNodeImportState) DynamicExpand(ctx EvalContext) (*Graph, error) {
 // and is part of the subgraph. This node is responsible for refreshing
 // and adding a resource to the state once it is imported.
 type graphNodeImportStateSub struct {
-        Target   *ResourceAddress
-        State    *InstanceState
-        Path_    []string
-        Provider string
+        Target           *ResourceAddress
+        State            *InstanceState
+        Path_            []string
+        ProviderName     string
+        ResolvedProvider string
 }
 
 func (n *graphNodeImportStateSub) Name() string {
@@ -216,7 +223,7 @@ func (n *graphNodeImportStateSub) EvalTree() EvalNode {
         return &EvalSequence{
                 Nodes: []EvalNode{
                         &EvalGetProvider{
-                                Name:   resourceProvider(info.Type, n.Provider),
+                                Name:   n.ResolvedProvider,
                                 Output: &provider,
                         },
                         &EvalRefresh{
@@ -233,7 +240,7 @@ func (n *graphNodeImportStateSub) EvalTree() EvalNode {
                         &EvalWriteState{
                                 Name:         key.String(),
                                 ResourceType: info.Type,
-                                Provider:     resourceProvider(info.Type, n.Provider),
+                                Provider:     n.ResolvedProvider,
                                 State:        &state,
                         },
                 },
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_local.go b/vendor/github.com/hashicorp/terraform/terraform/transform_local.go
new file mode 100644
index 0000000..95ecfc0
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_local.go
@@ -0,0 +1,40 @@
+package terraform
+
+import (
+        "github.com/hashicorp/terraform/config/module"
+)
+
+// LocalTransformer is a GraphTransformer that adds all the local values
+// from the configuration to the graph.
+type LocalTransformer struct {
+        Module *module.Tree
+}
+
+func (t *LocalTransformer) Transform(g *Graph) error {
+        return t.transformModule(g, t.Module)
+}
+
+func (t *LocalTransformer) transformModule(g *Graph, m *module.Tree) error {
+        if m == nil {
+                // Can't have any locals if there's no config
+                return nil
+        }
+
+        for _, local := range m.Config().Locals {
+                node := &NodeLocal{
+                        PathValue: normalizeModulePath(m.Path()),
+                        Config:    local,
+                }
+
+                g.Add(node)
+        }
+
+        // Also populate locals for child modules
+        for _, c := range m.Children() {
+                if err := t.transformModule(g, c); err != nil {
+                        return err
+                }
+        }
+
+        return nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_output.go b/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_output.go
index 49568d5..aea2bd0 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_output.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_output.go
@@ -21,43 +21,32 @@ func (t *OrphanOutputTransformer) Transform(g *Graph) error {
                 return nil
         }
 
-        return t.transform(g, t.Module)
-}
-
-func (t *OrphanOutputTransformer) transform(g *Graph, m *module.Tree) error {
-        // Get our configuration, and recurse into children
-        var c *config.Config
-        if m != nil {
-                c = m.Config()
-                for _, child := range m.Children() {
-                        if err := t.transform(g, child); err != nil {
-                                return err
-                        }
+        for _, ms := range t.State.Modules {
+                if err := t.transform(g, ms); err != nil {
+                        return err
                 }
         }
+        return nil
+}
 
-        // Get the state. If there is no state, then we have no orphans!
-        path := normalizeModulePath(m.Path())
-        state := t.State.ModuleByPath(path)
-        if state == nil {
+func (t *OrphanOutputTransformer) transform(g *Graph, ms *ModuleState) error {
+        if ms == nil {
                 return nil
         }
 
-        // Make a map of the valid outputs
-        valid := make(map[string]struct{})
-        for _, o := range c.Outputs {
-                valid[o.Name] = struct{}{}
-        }
+        path := normalizeModulePath(ms.Path)
 
-        // Go through the outputs and find the ones that aren't in our config.
-        for n, _ := range state.Outputs {
-                // If it is in the valid map, then ignore
-                if _, ok := valid[n]; ok {
-                        continue
-                }
+        // Get the config for this path, which is nil if the entire module has been
+        // removed.
+        var c *config.Config
+        if m := t.Module.Child(path[1:]); m != nil {
+                c = m.Config()
+        }
 
-                // Orphan!
+        // add all the orphaned outputs to the graph
+        for _, n := range ms.RemovedOutputs(c) {
                 g.Add(&NodeOutputOrphan{OutputName: n, PathValue: path})
+
         }
 
         return nil
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_output.go b/vendor/github.com/hashicorp/terraform/terraform/transform_output.go
index b260f4c..faa25e4 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_output.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_output.go
@@ -1,7 +1,10 @@
 package terraform
 
 import (
+        "log"
+
         "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/dag"
 )
 
 // OutputTransformer is a GraphTransformer that adds all the outputs
@@ -41,11 +44,6 @@ func (t *OutputTransformer) transform(g *Graph, m *module.Tree) error {
 
         // Add all outputs here
         for _, o := range os {
-                // Build the node.
-                //
-                // NOTE: For now this is just an "applyable" output. As we build
-                // new graph builders for the other operations I suspect we'll
-                // find a way to parameterize this, require new transforms, etc.
                 node := &NodeApplyableOutput{
                         PathValue: normalizeModulePath(m.Path()),
                         Config:    o,
@@ -57,3 +55,41 @@ func (t *OutputTransformer) transform(g *Graph, m *module.Tree) error {
 
         return nil
 }
+
+// DestroyOutputTransformer is a GraphTransformer that adds nodes to delete
+// outputs during destroy. We need to do this to ensure that no stale outputs
+// are ever left in the state.
+type DestroyOutputTransformer struct {
+}
+
+func (t *DestroyOutputTransformer) Transform(g *Graph) error {
+        for _, v := range g.Vertices() {
+                output, ok := v.(*NodeApplyableOutput)
+                if !ok {
+                        continue
+                }
+
+                // create the destroy node for this output
+                node := &NodeDestroyableOutput{
+                        PathValue: output.PathValue,
+                        Config:    output.Config,
+                }
+
+                log.Printf("[TRACE] creating %s", node.Name())
+                g.Add(node)
+
+                deps, err := g.Descendents(v)
+                if err != nil {
+                        return err
+                }
+
+                // the destroy node must depend on the eval node
+                deps.Add(v)
+
+                for _, d := range deps.List() {
+                        log.Printf("[TRACE] %s depends on %s", node.Name(), dag.VertexName(d))
+                        g.Connect(dag.BasicEdge(node, d))
+                }
+        }
+        return nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_provider.go b/vendor/github.com/hashicorp/terraform/terraform/transform_provider.go
index b9695d5..c4772b4 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_provider.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_provider.go
@@ -1,19 +1,46 @@
 package terraform
 
 import (
+        "errors"
         "fmt"
         "log"
         "strings"
 
         "github.com/hashicorp/go-multierror"
+        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/config/module"
         "github.com/hashicorp/terraform/dag"
 )
 
+func TransformProviders(providers []string, concrete ConcreteProviderNodeFunc, mod *module.Tree) GraphTransformer {
+        return GraphTransformMulti(
+                // Add providers from the config
+                &ProviderConfigTransformer{
+                        Module:    mod,
+                        Providers: providers,
+                        Concrete:  concrete,
+                },
+                // Add any remaining missing providers
+                &MissingProviderTransformer{
+                        Providers: providers,
+                        Concrete:  concrete,
+                },
+                // Connect the providers
+                &ProviderTransformer{},
+                // Remove unused providers and proxies
+                &PruneProviderTransformer{},
+                // Connect provider to their parent provider nodes
+                &ParentProviderTransformer{},
+        )
+}
+
 // GraphNodeProvider is an interface that nodes that can be a provider
-// must implement. The ProviderName returned is the name of the provider
-// they satisfy.
+// must implement.
+// ProviderName returns the name of the provider this satisfies.
+// Name returns the full name of the provider in the config.
 type GraphNodeProvider interface {
         ProviderName() string
+        Name() string
 }
 
 // GraphNodeCloseProvider is an interface that nodes that can be a close
@@ -25,9 +52,12 @@ type GraphNodeCloseProvider interface {
 
 // GraphNodeProviderConsumer is an interface that nodes that require
 // a provider must implement. ProvidedBy must return the name of the provider
-// to use.
+// to use. This may be a provider by type, type.alias or a fully resolved
+// provider name
 type GraphNodeProviderConsumer interface {
-        ProvidedBy() []string
+        ProvidedBy() string
+        // Set the resolved provider address for this resource.
+        SetProvider(string)
 }
 
 // ProviderTransformer is a GraphTransformer that maps resources to
@@ -41,18 +71,52 @@ func (t *ProviderTransformer) Transform(g *Graph) error {
         m := providerVertexMap(g)
         for _, v := range g.Vertices() {
                 if pv, ok := v.(GraphNodeProviderConsumer); ok {
-                        for _, p := range pv.ProvidedBy() {
-                                target := m[providerMapKey(p, pv)]
-                                if target == nil {
-                                        println(fmt.Sprintf("%#v\n\n%#v", m, providerMapKey(p, pv)))
-                                        err = multierror.Append(err, fmt.Errorf(
-                                                "%s: provider %s couldn't be found",
-                                                dag.VertexName(v), p))
-                                        continue
+                        p := pv.ProvidedBy()
+
+                        key := providerMapKey(p, pv)
+                        target := m[key]
+
+                        sp, ok := pv.(GraphNodeSubPath)
+                        if !ok && target == nil {
+                                // no target, and no path to walk up
+                                err = multierror.Append(err, fmt.Errorf(
+                                        "%s: provider %s couldn't be found",
+                                        dag.VertexName(v), p))
+                                break
+                        }
+
+                        // if we don't have a provider at this level, walk up the path looking for one
+                        for i := 1; target == nil; i++ {
+                                path := normalizeModulePath(sp.Path())
+                                if len(path) < i {
+                                        break
+                                }
+
+                                key = ResolveProviderName(p, path[:len(path)-i])
+                                target = m[key]
+                                if target != nil {
+                                        break
                                 }
+                        }
+
+                        if target == nil {
+                                err = multierror.Append(err, fmt.Errorf(
+                                        "%s: configuration for %s is not present; a provider configuration block is required for all operations",
+                                        dag.VertexName(v), p,
+                                ))
+                                break
+                        }
 
-                                g.Connect(dag.BasicEdge(v, target))
+                        // see if this in  an inherited provider
+                        if p, ok := target.(*graphNodeProxyProvider); ok {
+                                g.Remove(p)
+                                target = p.Target()
+                                key = target.(GraphNodeProvider).Name()
                         }
+
+                        log.Printf("[DEBUG] resource %s using provider %s", dag.VertexName(pv), key)
+                        pv.SetProvider(key)
+                        g.Connect(dag.BasicEdge(v, target))
                 }
         }
 
@@ -67,36 +131,32 @@ type CloseProviderTransformer struct{}
 
 func (t *CloseProviderTransformer) Transform(g *Graph) error {
         pm := providerVertexMap(g)
-        cpm := closeProviderVertexMap(g)
+        cpm := make(map[string]*graphNodeCloseProvider)
         var err error
-        for _, v := range g.Vertices() {
-                if pv, ok := v.(GraphNodeProviderConsumer); ok {
-                        for _, p := range pv.ProvidedBy() {
-                                key := p
-                                source := cpm[key]
-
-                                if source == nil {
-                                        // Create a new graphNodeCloseProvider and add it to the graph
-                                        source = &graphNodeCloseProvider{ProviderNameValue: p}
-                                        g.Add(source)
-
-                                        // Close node needs to depend on provider
-                                        provider, ok := pm[key]
-                                        if !ok {
-                                                err = multierror.Append(err, fmt.Errorf(
-                                                        "%s: provider %s couldn't be found for closing",
-                                                        dag.VertexName(v), p))
-                                                continue
-                                        }
-                                        g.Connect(dag.BasicEdge(source, provider))
-
-                                        // Make sure we also add the new graphNodeCloseProvider to the map
-                                        // so we don't create and add any duplicate graphNodeCloseProviders.
-                                        cpm[key] = source
-                                }
 
-                                // Close node depends on all nodes provided by the provider
-                                g.Connect(dag.BasicEdge(source, v))
+        for _, v := range pm {
+                p := v.(GraphNodeProvider)
+
+                // get the close provider of this type if we alread created it
+                closer := cpm[p.Name()]
+
+                if closer == nil {
+                        // create a closer for this provider type
+                        closer = &graphNodeCloseProvider{ProviderNameValue: p.Name()}
+                        g.Add(closer)
+                        cpm[p.Name()] = closer
+                }
+
+                // Close node depends on the provider itself
+                // this is added unconditionally, so it will connect to all instances
+                // of the provider. Extra edges will be removed by transitive
+                // reduction.
+                g.Connect(dag.BasicEdge(closer, p))
+
+                // connect all the provider's resources to the close node
+                for _, s := range g.UpEdges(p).List() {
+                        if _, ok := s.(GraphNodeProviderConsumer); ok {
+                                g.Connect(dag.BasicEdge(closer, s))
                         }
                 }
         }
@@ -104,18 +164,14 @@ func (t *CloseProviderTransformer) Transform(g *Graph) error {
         return err
 }
 
-// MissingProviderTransformer is a GraphTransformer that adds nodes
-// for missing providers into the graph. Specifically, it creates provider
-// configuration nodes for all the providers that we support. These are
-// pruned later during an optimization pass.
+// MissingProviderTransformer is a GraphTransformer that adds nodes for all
+// required providers into the graph. Specifically, it creates provider
+// configuration nodes for all the providers that we support. These are pruned
+// later during an optimization pass.
 type MissingProviderTransformer struct {
         // Providers is the list of providers we support.
         Providers []string
 
-        // AllowAny will not check that a provider is supported before adding
-        // it to the graph.
-        AllowAny bool
-
         // Concrete, if set, overrides how the providers are made.
         Concrete ConcreteProviderNodeFunc
 }
@@ -128,99 +184,57 @@ func (t *MissingProviderTransformer) Transform(g *Graph) error {
                 }
         }
 
-        // Create a set of our supported providers
-        supported := make(map[string]struct{}, len(t.Providers))
-        for _, v := range t.Providers {
-                supported[v] = struct{}{}
-        }
-
-        // Get the map of providers we already have in our graph
+        var err error
         m := providerVertexMap(g)
-
-        // Go through all the provider consumers and make sure we add
-        // that provider if it is missing. We use a for loop here instead
-        // of "range" since we'll modify check as we go to add more to check.
-        check := g.Vertices()
-        for i := 0; i < len(check); i++ {
-                v := check[i]
-
+        for _, v := range g.Vertices() {
                 pv, ok := v.(GraphNodeProviderConsumer)
                 if !ok {
                         continue
                 }
 
-                // If this node has a subpath, then we use that as a prefix
-                // into our map to check for an existing provider.
-                var path []string
-                if sp, ok := pv.(GraphNodeSubPath); ok {
-                        raw := normalizeModulePath(sp.Path())
-                        if len(raw) > len(rootModulePath) {
-                                path = raw
-                        }
-                }
+                p := pv.ProvidedBy()
+                // this may be the resolved provider from the state, so we need to get
+                // the base provider name.
+                parts := strings.SplitAfter(p, "provider.")
+                p = parts[len(parts)-1]
 
-                for _, p := range pv.ProvidedBy() {
-                        key := providerMapKey(p, pv)
-                        if _, ok := m[key]; ok {
-                                // This provider already exists as a configure node
-                                continue
-                        }
+                key := ResolveProviderName(p, nil)
+                provider := m[key]
 
-                        // If the provider has an alias in it, we just want the type
-                        ptype := p
-                        if idx := strings.IndexRune(p, '.'); idx != -1 {
-                                ptype = p[:idx]
-                        }
+                // we already have it
+                if provider != nil {
+                        continue
+                }
 
-                        if !t.AllowAny {
-                                if _, ok := supported[ptype]; !ok {
-                                        // If we don't support the provider type, skip it.
-                                        // Validation later will catch this as an error.
-                                        continue
-                                }
-                        }
+                // we don't implicitly create aliased providers
+                if strings.Contains(p, ".") {
+                        log.Println("[DEBUG] not adding missing provider alias:", p)
+                        continue
+                }
 
-                        // Add the missing provider node to the graph
-                        v := t.Concrete(&NodeAbstractProvider{
-                                NameValue: p,
-                                PathValue: path,
-                        }).(dag.Vertex)
-                        if len(path) > 0 {
-                                // We'll need the parent provider as well, so let's
-                                // add a dummy node to check to make sure that we add
-                                // that parent provider.
-                                check = append(check, &graphNodeProviderConsumerDummy{
-                                        ProviderValue: p,
-                                        PathValue:     path[:len(path)-1],
-                                })
-                        }
+                log.Println("[DEBUG] adding missing provider:", p)
 
-                        m[key] = g.Add(v)
-                }
+                // create the misisng top-level provider
+                provider = t.Concrete(&NodeAbstractProvider{
+                        NameValue: p,
+                }).(dag.Vertex)
+
+                m[key] = g.Add(provider)
         }
 
-        return nil
+        return err
 }
 
 // ParentProviderTransformer connects provider nodes to their parents.
 //
 // This works by finding nodes that are both GraphNodeProviders and
 // GraphNodeSubPath. It then connects the providers to their parent
-// path.
+// path. The parent provider is always at the root level.
 type ParentProviderTransformer struct{}
 
 func (t *ParentProviderTransformer) Transform(g *Graph) error {
-        // Make a mapping of path to dag.Vertex, where path is: "path.name"
-        m := make(map[string]dag.Vertex)
-
-        // Also create a map that maps a provider to its parent
-        parentMap := make(map[dag.Vertex]string)
-        for _, raw := range g.Vertices() {
-                // If it is the flat version, then make it the non-flat version.
-                // We eventually want to get rid of the flat version entirely so
-                // this is a stop-gap while it still exists.
-                var v dag.Vertex = raw
-
+        pm := providerVertexMap(g)
+        for _, v := range g.Vertices() {
                 // Only care about providers
                 pn, ok := v.(GraphNodeProvider)
                 if !ok || pn.ProviderName() == "" {
@@ -228,53 +242,48 @@ func (t *ParentProviderTransformer) Transform(g *Graph) error {
                 }
 
                 // Also require a subpath, if there is no subpath then we
-                // just totally ignore it. The expectation of this transform is
-                // that it is used with a graph builder that is already flattened.
-                var path []string
-                if pn, ok := raw.(GraphNodeSubPath); ok {
-                        path = pn.Path()
-                }
-                path = normalizeModulePath(path)
-
-                // Build the key with path.name i.e. "child.subchild.aws"
-                key := fmt.Sprintf("%s.%s", strings.Join(path, "."), pn.ProviderName())
-                m[key] = raw
-
-                // Determine the parent if we're non-root. This is length 1 since
-                // the 0 index should be "root" since we normalize above.
-                if len(path) > 1 {
-                        path = path[:len(path)-1]
-                        key := fmt.Sprintf("%s.%s", strings.Join(path, "."), pn.ProviderName())
-                        parentMap[raw] = key
+                // can't have a parent.
+                if pn, ok := v.(GraphNodeSubPath); ok {
+                        if len(normalizeModulePath(pn.Path())) <= 1 {
+                                continue
+                        }
                 }
-        }
 
-        // Connect!
-        for v, key := range parentMap {
-                if parent, ok := m[key]; ok {
+                // this provider may be disabled, but we can only get it's name from
+                // the ProviderName string
+                name := ResolveProviderName(strings.SplitN(pn.ProviderName(), " ", 2)[0], nil)
+                parent := pm[name]
+                if parent != nil {
                         g.Connect(dag.BasicEdge(v, parent))
                 }
-        }
 
+        }
         return nil
 }
 
-// PruneProviderTransformer is a GraphTransformer that prunes all the
-// providers that aren't needed from the graph. A provider is unneeded if
-// no resource or module is using that provider.
+// PruneProviderTransformer removes any providers that are not actually used by
+// anything, and provider proxies. This avoids the provider being initialized
+// and configured.  This both saves resources but also avoids errors since
+// configuration may imply initialization which may require auth.
 type PruneProviderTransformer struct{}
 
 func (t *PruneProviderTransformer) Transform(g *Graph) error {
         for _, v := range g.Vertices() {
-                // We only care about the providers
-                if pn, ok := v.(GraphNodeProvider); !ok || pn.ProviderName() == "" {
+                // We only care about providers
+                pn, ok := v.(GraphNodeProvider)
+                if !ok || pn.ProviderName() == "" {
                         continue
                 }
-                // Does anything depend on this? If not, then prune it.
-                if s := g.UpEdges(v); s.Len() == 0 {
-                        if nv, ok := v.(dag.NamedVertex); ok {
-                                log.Printf("[DEBUG] Pruning provider with no dependencies: %s", nv.Name())
-                        }
+
+                // ProxyProviders will have up edges, but we're now done with them in the graph
+                if _, ok := v.(*graphNodeProxyProvider); ok {
+                        log.Printf("[DEBUG] pruning proxy provider %s", dag.VertexName(v))
+                        g.Remove(v)
+                }
+
+                // Remove providers with no dependencies.
+                if g.UpEdges(v).Len() == 0 {
+                        log.Printf("[DEBUG] pruning unused provider %s", dag.VertexName(v))
                         g.Remove(v)
                 }
         }
@@ -285,23 +294,26 @@ func (t *PruneProviderTransformer) Transform(g *Graph) error {
 // providerMapKey is a helper that gives us the key to use for the
 // maps returned by things such as providerVertexMap.
 func providerMapKey(k string, v dag.Vertex) string {
-        pathPrefix := ""
-        if sp, ok := v.(GraphNodeSubPath); ok {
-                raw := normalizeModulePath(sp.Path())
-                if len(raw) > len(rootModulePath) {
-                        pathPrefix = modulePrefixStr(raw) + "."
-                }
+        if strings.Contains(k, "provider.") {
+                // this is already resolved
+                return k
         }
 
-        return pathPrefix + k
+        // we create a dummy provider to
+        var path []string
+        if sp, ok := v.(GraphNodeSubPath); ok {
+                path = normalizeModulePath(sp.Path())
+        }
+        return ResolveProviderName(k, path)
 }
 
 func providerVertexMap(g *Graph) map[string]dag.Vertex {
         m := make(map[string]dag.Vertex)
         for _, v := range g.Vertices() {
                 if pv, ok := v.(GraphNodeProvider); ok {
-                        key := providerMapKey(pv.ProviderName(), v)
-                        m[key] = v
+                        // TODO:  The Name may have meta info, like " (disabled)"
+                        name := strings.SplitN(pv.Name(), " ", 2)[0]
+                        m[name] = v
                 }
         }
 
@@ -324,7 +336,7 @@ type graphNodeCloseProvider struct {
 }
 
 func (n *graphNodeCloseProvider) Name() string {
-        return fmt.Sprintf("provider.%s (close)", n.ProviderNameValue)
+        return n.ProviderNameValue + " (close)"
 }
 
 // GraphNodeEvalable impl.
@@ -362,19 +374,233 @@ func (n *graphNodeCloseProvider) RemoveIfNotTargeted() bool {
         return true
 }
 
-// graphNodeProviderConsumerDummy is a struct that never enters the real
-// graph (though it could to no ill effect). It implements
-// GraphNodeProviderConsumer and GraphNodeSubpath as a way to force
-// certain transformations.
-type graphNodeProviderConsumerDummy struct {
-        ProviderValue string
-        PathValue     []string
+// graphNodeProxyProvider is a GraphNodeProvider implementation that is used to
+// store the name and value of a provider node for inheritance between modules.
+// These nodes are only used to store the data while loading the provider
+// configurations, and are removed after all the resources have been connected
+// to their providers.
+type graphNodeProxyProvider struct {
+        nameValue string
+        path      []string
+        target    GraphNodeProvider
+}
+
+func (n *graphNodeProxyProvider) ProviderName() string {
+        return n.Target().ProviderName()
+}
+
+func (n *graphNodeProxyProvider) Name() string {
+        return ResolveProviderName(n.nameValue, n.path)
+}
+
+// find the concrete provider instance
+func (n *graphNodeProxyProvider) Target() GraphNodeProvider {
+        switch t := n.target.(type) {
+        case *graphNodeProxyProvider:
+                return t.Target()
+        default:
+                return n.target
+        }
+}
+
+// ProviderConfigTransformer adds all provider nodes from the configuration and
+// attaches the configs.
+type ProviderConfigTransformer struct {
+        Providers []string
+        Concrete  ConcreteProviderNodeFunc
+
+        // each provider node is stored here so that the proxy nodes can look up
+        // their targets by name.
+        providers map[string]GraphNodeProvider
+        // record providers that can be overriden with a proxy
+        proxiable map[string]bool
+
+        // Module is the module to add resources from.
+        Module *module.Tree
 }
 
-func (n *graphNodeProviderConsumerDummy) Path() []string {
-        return n.PathValue
+func (t *ProviderConfigTransformer) Transform(g *Graph) error {
+        // If no module is given, we don't do anything
+        if t.Module == nil {
+                return nil
+        }
+
+        // If the module isn't loaded, that is simply an error
+        if !t.Module.Loaded() {
+                return errors.New("module must be loaded for ProviderConfigTransformer")
+        }
+
+        t.providers = make(map[string]GraphNodeProvider)
+        t.proxiable = make(map[string]bool)
+
+        // Start the transformation process
+        if err := t.transform(g, t.Module); err != nil {
+                return err
+        }
+
+        // finally attach the configs to the new nodes
+        return t.attachProviderConfigs(g)
 }
 
-func (n *graphNodeProviderConsumerDummy) ProvidedBy() []string {
-        return []string{n.ProviderValue}
+func (t *ProviderConfigTransformer) transform(g *Graph, m *module.Tree) error {
+        // If no config, do nothing
+        if m == nil {
+                return nil
+        }
+
+        // Add our resources
+        if err := t.transformSingle(g, m); err != nil {
+                return err
+        }
+
+        // Transform all the children.
+        for _, c := range m.Children() {
+                if err := t.transform(g, c); err != nil {
+                        return err
+                }
+        }
+        return nil
+}
+
+func (t *ProviderConfigTransformer) transformSingle(g *Graph, m *module.Tree) error {
+        log.Printf("[TRACE] ProviderConfigTransformer: Starting for path: %v", m.Path())
+
+        // Get the configuration for this module
+        conf := m.Config()
+
+        // Build the path we're at
+        path := m.Path()
+        if len(path) > 0 {
+                path = append([]string{RootModuleName}, path...)
+        }
+
+        // add all providers from the configuration
+        for _, p := range conf.ProviderConfigs {
+                name := p.Name
+                if p.Alias != "" {
+                        name += "." + p.Alias
+                }
+
+                v := t.Concrete(&NodeAbstractProvider{
+                        NameValue: name,
+                        PathValue: path,
+                })
+
+                // Add it to the graph
+                g.Add(v)
+                fullName := ResolveProviderName(name, path)
+                t.providers[fullName] = v.(GraphNodeProvider)
+                t.proxiable[fullName] = len(p.RawConfig.RawMap()) == 0
+        }
+
+        // Now replace the provider nodes with proxy nodes if a provider was being
+        // passed in, and create implicit proxies if there was no config. Any extra
+        // proxies will be removed in the prune step.
+        return t.addProxyProviders(g, m)
+}
+
+func (t *ProviderConfigTransformer) addProxyProviders(g *Graph, m *module.Tree) error {
+        path := m.Path()
+
+        // can't add proxies at the root
+        if len(path) == 0 {
+                return nil
+        }
+
+        parentPath := path[:len(path)-1]
+        parent := t.Module.Child(parentPath)
+        if parent == nil {
+                return nil
+        }
+
+        var parentCfg *config.Module
+        for _, mod := range parent.Config().Modules {
+                if mod.Name == m.Name() {
+                        parentCfg = mod
+                        break
+                }
+        }
+
+        if parentCfg == nil {
+                // this can't really happen during normal execution.
+                return fmt.Errorf("parent module config not found for %s", m.Name())
+        }
+
+        // Go through all the providers the parent is passing in, and add proxies to
+        // the parent provider nodes.
+        for name, parentName := range parentCfg.Providers {
+                fullName := ResolveProviderName(name, path)
+                fullParentName := ResolveProviderName(parentName, parentPath)
+
+                parentProvider := t.providers[fullParentName]
+
+                if parentProvider == nil {
+                        return fmt.Errorf("missing provider %s", fullParentName)
+                }
+
+                proxy := &graphNodeProxyProvider{
+                        nameValue: name,
+                        path:      path,
+                        target:    parentProvider,
+                }
+
+                concreteProvider := t.providers[fullName]
+
+                // replace the concrete node with the provider passed in
+                if concreteProvider != nil && t.proxiable[fullName] {
+                        g.Replace(concreteProvider, proxy)
+                        t.providers[fullName] = proxy
+                        continue
+                }
+
+                // aliased providers can't be implicitly passed in
+                if strings.Contains(name, ".") {
+                        continue
+                }
+
+                // There was no concrete provider, so add this as an implicit provider.
+                // The extra proxy will be pruned later if it's unused.
+                g.Add(proxy)
+                t.providers[fullName] = proxy
+        }
+        return nil
+}
+
+func (t *ProviderConfigTransformer) attachProviderConfigs(g *Graph) error {
+        for _, v := range g.Vertices() {
+                // Only care about GraphNodeAttachProvider implementations
+                apn, ok := v.(GraphNodeAttachProvider)
+                if !ok {
+                        continue
+                }
+
+                // Determine what we're looking for
+                path := normalizeModulePath(apn.Path())[1:]
+                name := apn.ProviderName()
+                log.Printf("[TRACE] Attach provider request: %#v %s", path, name)
+
+                // Get the configuration.
+                tree := t.Module.Child(path)
+                if tree == nil {
+                        continue
+                }
+
+                // Go through the provider configs to find the matching config
+                for _, p := range tree.Config().ProviderConfigs {
+                        // Build the name, which is "name.alias" if an alias exists
+                        current := p.Name
+                        if p.Alias != "" {
+                                current += "." + p.Alias
+                        }
+
+                        // If the configs match then attach!
+                        if current == name {
+                                log.Printf("[TRACE] Attaching provider config: %#v", p)
+                                apn.AttachProvider(p)
+                                break
+                        }
+                }
+        }
+
+        return nil
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_provider_disable.go b/vendor/github.com/hashicorp/terraform/terraform/transform_provider_disable.go
deleted file mode 100644
index d9919f3..0000000
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_provider_disable.go
+++ /dev/null
@@ -1,50 +0,0 @@
-package terraform
-
-import (
-        "fmt"
-
-        "github.com/hashicorp/terraform/dag"
-)
-
-// DisableProviderTransformer "disables" any providers that are not actually
-// used by anything. This avoids the provider being initialized and configured.
-// This both saves resources but also avoids errors since configuration
-// may imply initialization which may require auth.
-type DisableProviderTransformer struct{}
-
-func (t *DisableProviderTransformer) Transform(g *Graph) error {
-        for _, v := range g.Vertices() {
-                // We only care about providers
-                pn, ok := v.(GraphNodeProvider)
-                if !ok || pn.ProviderName() == "" {
-                        continue
-                }
-
-                // If we have dependencies, then don't disable
-                if g.UpEdges(v).Len() > 0 {
-                        continue
-                }
-
-                // Get the path
-                var path []string
-                if pn, ok := v.(GraphNodeSubPath); ok {
-                        path = pn.Path()
-                }
-
-                // Disable the provider by replacing it with a "disabled" provider
-                disabled := &NodeDisabledProvider{
-                        NodeAbstractProvider: &NodeAbstractProvider{
-                                NameValue: pn.ProviderName(),
-                                PathValue: path,
-                        },
-                }
-
-                if !g.Replace(v, disabled) {
-                        panic(fmt.Sprintf(
-                                "vertex disappeared from under us: %s",
-                                dag.VertexName(v)))
-                }
-        }
-
-        return nil
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_reference.go b/vendor/github.com/hashicorp/terraform/terraform/transform_reference.go
index c545235..be8c7f9 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_reference.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_reference.go
@@ -76,6 +76,85 @@ func (t *ReferenceTransformer) Transform(g *Graph) error {
         return nil
 }
 
+// DestroyReferenceTransformer is a GraphTransformer that reverses the edges
+// for locals and outputs that depend on other nodes which will be
+// removed during destroy. If a destroy node is evaluated before the local or
+// output value, it will be removed from the state, and the later interpolation
+// will fail.
+type DestroyValueReferenceTransformer struct{}
+
+func (t *DestroyValueReferenceTransformer) Transform(g *Graph) error {
+        vs := g.Vertices()
+        for _, v := range vs {
+                switch v.(type) {
+                case *NodeApplyableOutput, *NodeLocal:
+                        // OK
+                default:
+                        continue
+                }
+
+                // reverse any outgoing edges so that the value is evaluated first.
+                for _, e := range g.EdgesFrom(v) {
+                        target := e.Target()
+
+                        // only destroy nodes will be evaluated in reverse
+                        if _, ok := target.(GraphNodeDestroyer); !ok {
+                                continue
+                        }
+
+                        log.Printf("[TRACE] output dep: %s", dag.VertexName(target))
+
+                        g.RemoveEdge(e)
+                        g.Connect(&DestroyEdge{S: target, T: v})
+                }
+        }
+
+        return nil
+}
+
+// PruneUnusedValuesTransformer is s GraphTransformer that removes local and
+// output values which are not referenced in the graph. Since outputs and
+// locals always need to be evaluated, if they reference a resource that is not
+// available in the state the interpolation could fail.
+type PruneUnusedValuesTransformer struct{}
+
+func (t *PruneUnusedValuesTransformer) Transform(g *Graph) error {
+        // this might need multiple runs in order to ensure that pruning a value
+        // doesn't effect a previously checked value.
+        for removed := 0; ; removed = 0 {
+                for _, v := range g.Vertices() {
+                        switch v.(type) {
+                        case *NodeApplyableOutput, *NodeLocal:
+                                // OK
+                        default:
+                                continue
+                        }
+
+                        dependants := g.UpEdges(v)
+
+                        switch dependants.Len() {
+                        case 0:
+                                // nothing at all depends on this
+                                g.Remove(v)
+                                removed++
+                        case 1:
+                                // because an output's destroy node always depends on the output,
+                                // we need to check for the case of a single destroy node.
+                                d := dependants.List()[0]
+                                if _, ok := d.(*NodeDestroyableOutput); ok {
+                                        g.Remove(v)
+                                        removed++
+                                }
+                        }
+                }
+                if removed == 0 {
+                        break
+                }
+        }
+
+        return nil
+}
+
 // ReferenceMap is a structure that can be used to efficiently check
 // for references on a graph.
 type ReferenceMap struct {
@@ -96,6 +175,7 @@ func (m *ReferenceMap) References(v dag.Vertex) ([]dag.Vertex, []string) {
         var matches []dag.Vertex
         var missing []string
         prefix := m.prefix(v)
+
         for _, ns := range rn.References() {
                 found := false
                 for _, n := range strings.Split(ns, "/") {
@@ -108,19 +188,14 @@ func (m *ReferenceMap) References(v dag.Vertex) ([]dag.Vertex, []string) {
                         // Mark that we found a match
                         found = true
 
-                        // Make sure this isn't a self reference, which isn't included
-                        selfRef := false
                         for _, p := range parents {
+                                // don't include self-references
                                 if p == v {
-                                        selfRef = true
-                                        break
+                                        continue
                                 }
-                        }
-                        if selfRef {
-                                continue
+                                matches = append(matches, p)
                         }
 
-                        matches = append(matches, parents...)
                         break
                 }
 
@@ -296,14 +371,21 @@ func ReferenceFromInterpolatedVar(v config.InterpolatedVariable) []string {
                 return []string{fmt.Sprintf("%s.%d/%s.N", id, idx, id)}
         case *config.UserVariable:
                 return []string{fmt.Sprintf("var.%s", v.Name)}
+        case *config.LocalVariable:
+                return []string{fmt.Sprintf("local.%s", v.Name)}
         default:
                 return nil
         }
 }
 
 func modulePrefixStr(p []string) string {
+        // strip "root"
+        if len(p) > 0 && p[0] == rootModulePath[0] {
+                p = p[1:]
+        }
+
         parts := make([]string, 0, len(p)*2)
-        for _, p := range p[1:] {
+        for _, p := range p {
                 parts = append(parts, "module", p)
         }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_removed_modules.go b/vendor/github.com/hashicorp/terraform/terraform/transform_removed_modules.go
new file mode 100644
index 0000000..2e05edb
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_removed_modules.go
@@ -0,0 +1,32 @@
+package terraform
+
+import (
+        "log"
+
+        "github.com/hashicorp/terraform/config/module"
+)
+
+// RemoveModuleTransformer implements GraphTransformer to add nodes indicating
+// when a module was removed from the configuration.
+type RemovedModuleTransformer struct {
+        Module *module.Tree // root module
+        State  *State
+}
+
+func (t *RemovedModuleTransformer) Transform(g *Graph) error {
+        // nothing to remove if there's no state!
+        if t.State == nil {
+                return nil
+        }
+
+        for _, m := range t.State.Modules {
+                c := t.Module.Child(m.Path[1:])
+                if c != nil {
+                        continue
+                }
+
+                log.Printf("[DEBUG] module %s no longer in config\n", modulePrefixStr(m.Path))
+                g.Add(&NodeModuleRemoved{PathValue: m.Path})
+        }
+        return nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_resource_count.go b/vendor/github.com/hashicorp/terraform/terraform/transform_resource_count.go
index cda35cb..e528b37 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_resource_count.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_resource_count.go
@@ -37,7 +37,9 @@ func (t *ResourceCountTransformer) Transform(g *Graph) error {
                 addr.Index = index
 
                 // Build the abstract node and the concrete one
-                abstract := &NodeAbstractResource{Addr: addr}
+                abstract := &NodeAbstractResource{
+                        Addr: addr,
+                }
                 var node dag.Vertex = abstract
                 if f := t.Concrete; f != nil {
                         node = f(abstract)
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_targets.go b/vendor/github.com/hashicorp/terraform/terraform/transform_targets.go
index 4f117b4..af6defe 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_targets.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_targets.go
@@ -73,9 +73,11 @@ func (t *TargetsTransformer) Transform(g *Graph) error {
                         if _, ok := v.(GraphNodeResource); ok {
                                 removable = true
                         }
+
                         if vr, ok := v.(RemovableIfNotTargeted); ok {
                                 removable = vr.RemoveIfNotTargeted()
                         }
+
                         if removable && !targetedNodes.Include(v) {
                                 log.Printf("[DEBUG] Removing %q, filtered by targeting.", dag.VertexName(v))
                                 g.Remove(v)
@@ -135,7 +137,10 @@ func (t *TargetsTransformer) selectTargetedNodes(
                         }
                 }
         }
+        return t.addDependencies(targetedNodes, g)
+}
 
+func (t *TargetsTransformer) addDependencies(targetedNodes *dag.Set, g *Graph) (*dag.Set, error) {
         // Handle nodes that need to be included if their dependencies are included.
         // This requires multiple passes since we need to catch transitive
         // dependencies if and only if they are via other nodes that also
@@ -157,11 +162,6 @@ func (t *TargetsTransformer) selectTargetedNodes(
                         }
 
                         dependers = dependers.Filter(func(dv interface{}) bool {
-                                // Can ignore nodes that are already targeted
-                                /*if targetedNodes.Include(dv) {
-                                        return false
-                                }*/
-
                                 _, ok := dv.(GraphNodeTargetDownstream)
                                 return ok
                         })
@@ -180,6 +180,7 @@ func (t *TargetsTransformer) selectTargetedNodes(
                                 // depending on in case that informs its decision about whether
                                 // it is safe to be targeted.
                                 deps := g.DownEdges(v)
+
                                 depsTargeted := deps.Intersection(targetedNodes)
                                 depsUntargeted := deps.Difference(depsTargeted)
 
@@ -193,7 +194,50 @@ func (t *TargetsTransformer) selectTargetedNodes(
                 }
         }
 
-        return targetedNodes, nil
+        return targetedNodes.Filter(func(dv interface{}) bool {
+                return filterPartialOutputs(dv, targetedNodes, g)
+        }), nil
+}
+
+// Outputs may have been included transitively, but if any of their
+// dependencies have been pruned they won't be resolvable.
+// If nothing depends on the output, and the output is missing any
+// dependencies, remove it from the graph.
+// This essentially maintains the previous behavior where interpolation in
+// outputs would fail silently, but can now surface errors where the output
+// is required.
+func filterPartialOutputs(v interface{}, targetedNodes *dag.Set, g *Graph) bool {
+        // should this just be done with TargetDownstream?
+        if _, ok := v.(*NodeApplyableOutput); !ok {
+                return true
+        }
+
+        dependers := g.UpEdges(v)
+        for _, d := range dependers.List() {
+                if _, ok := d.(*NodeCountBoundary); ok {
+                        continue
+                }
+
+                if !targetedNodes.Include(d) {
+                        // this one is going to be removed, so it doesn't count
+                        continue
+                }
+
+                // as soon as we see a real dependency, we mark this as
+                // non-removable
+                return true
+        }
+
+        depends := g.DownEdges(v)
+
+        for _, d := range depends.List() {
+                if !targetedNodes.Include(d) {
+                        log.Printf("[WARN] %s missing targeted dependency %s, removing from the graph",
+                                dag.VertexName(v), dag.VertexName(d))
+                        return false
+                }
+        }
+        return true
 }
 
 func (t *TargetsTransformer) nodeIsTarget(
diff --git a/vendor/github.com/hashicorp/terraform/terraform/ui_output_mock.go b/vendor/github.com/hashicorp/terraform/terraform/ui_output_mock.go
index 7852bc4..d828c92 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/ui_output_mock.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/ui_output_mock.go
@@ -1,13 +1,18 @@
 package terraform
 
+import "sync"
+
 // MockUIOutput is an implementation of UIOutput that can be used for tests.
 type MockUIOutput struct {
+        sync.Mutex
         OutputCalled  bool
         OutputMessage string
         OutputFn      func(string)
 }
 
 func (o *MockUIOutput) Output(v string) {
+        o.Lock()
+        defer o.Unlock()
         o.OutputCalled = true
         o.OutputMessage = v
         if o.OutputFn != nil {
diff --git a/vendor/github.com/hashicorp/terraform/terraform/user_agent.go b/vendor/github.com/hashicorp/terraform/terraform/user_agent.go
index 700be2a..a42613e 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/user_agent.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/user_agent.go
@@ -1,14 +1,13 @@
 package terraform
 
 import (
-        "fmt"
-        "runtime"
+        "github.com/hashicorp/terraform/httpclient"
 )
 
-// The standard Terraform User-Agent format
-const UserAgent = "Terraform %s (%s)"
-
 // Generate a UserAgent string
+//
+// Deprecated: Use httpclient.UserAgentString if you are setting your
+// own User-Agent header.
 func UserAgentString() string {
-        return fmt.Sprintf(UserAgent, VersionString(), runtime.Version())
+        return httpclient.UserAgentString()
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/version.go b/vendor/github.com/hashicorp/terraform/terraform/version.go
index d61b11e..ac73015 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/version.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/version.go
@@ -1,31 +1,10 @@
 package terraform
 
 import (
-        "fmt"
-
-        "github.com/hashicorp/go-version"
+        "github.com/hashicorp/terraform/version"
 )
 
-// The main version number that is being run at the moment.
-const Version = "0.10.0"
-
-// A pre-release marker for the version. If this is "" (empty string)
-// then it means that it is a final release. Otherwise, this is a pre-release
-// such as "dev" (in development), "beta", "rc1", etc.
-var VersionPrerelease = "dev"
-
-// SemVersion is an instance of version.Version. This has the secondary
-// benefit of verifying during tests and init time that our version is a
-// proper semantic version, which should always be the case.
-var SemVersion = version.Must(version.NewVersion(Version))
-
-// VersionHeader is the header name used to send the current terraform version
-// in http requests.
-const VersionHeader = "Terraform-Version"
-
+// TODO: update providers to use the version package directly
 func VersionString() string {
-        if VersionPrerelease != "" {
-                return fmt.Sprintf("%s-%s", Version, VersionPrerelease)
-        }
-        return Version
+        return version.String()
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/version_required.go b/vendor/github.com/hashicorp/terraform/terraform/version_required.go
index 3cbbf56..1f43045 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/version_required.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/version_required.go
@@ -6,19 +6,21 @@ import (
         "github.com/hashicorp/go-version"
         "github.com/hashicorp/terraform/config"
         "github.com/hashicorp/terraform/config/module"
+
+        tfversion "github.com/hashicorp/terraform/version"
 )
 
-// checkRequiredVersion verifies that any version requirements specified by
+// CheckRequiredVersion verifies that any version requirements specified by
 // the configuration are met.
 //
 // This checks the root module as well as any additional version requirements
 // from child modules.
 //
 // This is tested in context_test.go.
-func checkRequiredVersion(m *module.Tree) error {
+func CheckRequiredVersion(m *module.Tree) error {
         // Check any children
         for _, c := range m.Children() {
-                if err := checkRequiredVersion(c); err != nil {
+                if err := CheckRequiredVersion(c); err != nil {
                         return err
                 }
         }
@@ -49,7 +51,7 @@ func checkRequiredVersion(m *module.Tree) error {
                         tf.RequiredVersion, err)
         }
 
-        if !cs.Check(SemVersion) {
+        if !cs.Check(tfversion.SemVer) {
                 return fmt.Errorf(
                         "The currently running version of Terraform doesn't meet the\n"+
                                 "version requirements explicitly specified by the configuration.\n"+
@@ -62,7 +64,7 @@ func checkRequiredVersion(m *module.Tree) error {
                                 "  Current version: %s",
                         module,
                         tf.RequiredVersion,
-                        SemVersion)
+                        tfversion.SemVer)
         }
 
         return nil
diff --git a/vendor/github.com/hashicorp/terraform/terraform/walkoperation_string.go b/vendor/github.com/hashicorp/terraform/terraform/walkoperation_string.go
index cbd78dd..4cfc528 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/walkoperation_string.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/walkoperation_string.go
@@ -2,7 +2,7 @@
 
 package terraform
 
-import "fmt"
+import "strconv"
 
 const _walkOperation_name = "walkInvalidwalkInputwalkApplywalkPlanwalkPlanDestroywalkRefreshwalkValidatewalkDestroywalkImport"
 
@@ -10,7 +10,7 @@ var _walkOperation_index = [...]uint8{0, 11, 20, 29, 37, 52, 63, 75, 86, 96}
 
 func (i walkOperation) String() string {
         if i >= walkOperation(len(_walkOperation_index)-1) {
-                return fmt.Sprintf("walkOperation(%d)", i)
+                return "walkOperation(" + strconv.FormatInt(int64(i), 10) + ")"
         }
         return _walkOperation_name[_walkOperation_index[i]:_walkOperation_index[i+1]]
 }
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/diagnostic.go b/vendor/github.com/hashicorp/terraform/tfdiags/diagnostic.go
new file mode 100644
index 0000000..2c23f76
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/diagnostic.go
@@ -0,0 +1,26 @@
+package tfdiags
+
+type Diagnostic interface {
+        Severity() Severity
+        Description() Description
+        Source() Source
+}
+
+type Severity rune
+
+//go:generate stringer -type=Severity
+
+const (
+        Error   Severity = 'E'
+        Warning Severity = 'W'
+)
+
+type Description struct {
+        Summary string
+        Detail  string
+}
+
+type Source struct {
+        Subject *SourceRange
+        Context *SourceRange
+}
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/diagnostics.go b/vendor/github.com/hashicorp/terraform/tfdiags/diagnostics.go
new file mode 100644
index 0000000..667ba80
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/diagnostics.go
@@ -0,0 +1,181 @@
+package tfdiags
+
+import (
+        "bytes"
+        "fmt"
+
+        "github.com/hashicorp/errwrap"
+        multierror "github.com/hashicorp/go-multierror"
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+// Diagnostics is a list of diagnostics. Diagnostics is intended to be used
+// where a Go "error" might normally be used, allowing richer information
+// to be conveyed (more context, support for warnings).
+//
+// A nil Diagnostics is a valid, empty diagnostics list, thus allowing
+// heap allocation to be avoided in the common case where there are no
+// diagnostics to report at all.
+type Diagnostics []Diagnostic
+
+// Append is the main interface for constructing Diagnostics lists, taking
+// an existing list (which may be nil) and appending the new objects to it
+// after normalizing them to be implementations of Diagnostic.
+//
+// The usual pattern for a function that natively "speaks" diagnostics is:
+//
+//     // Create a nil Diagnostics at the start of the function
+//     var diags diag.Diagnostics
+//
+//     // At later points, build on it if errors / warnings occur:
+//     foo, err := DoSomethingRisky()
+//     if err != nil {
+//         diags = diags.Append(err)
+//     }
+//
+//     // Eventually return the result and diagnostics in place of error
+//     return result, diags
+//
+// Append accepts a variety of different diagnostic-like types, including
+// native Go errors and HCL diagnostics. It also knows how to unwrap
+// a multierror.Error into separate error diagnostics. It can be passed
+// another Diagnostics to concatenate the two lists. If given something
+// it cannot handle, this function will panic.
+func (diags Diagnostics) Append(new ...interface{}) Diagnostics {
+        for _, item := range new {
+                if item == nil {
+                        continue
+                }
+
+                switch ti := item.(type) {
+                case Diagnostic:
+                        diags = append(diags, ti)
+                case Diagnostics:
+                        diags = append(diags, ti...) // flatten
+                case diagnosticsAsError:
+                        diags = diags.Append(ti.Diagnostics) // unwrap
+                case hcl.Diagnostics:
+                        for _, hclDiag := range ti {
+                                diags = append(diags, hclDiagnostic{hclDiag})
+                        }
+                case *hcl.Diagnostic:
+                        diags = append(diags, hclDiagnostic{ti})
+                case *multierror.Error:
+                        for _, err := range ti.Errors {
+                                diags = append(diags, nativeError{err})
+                        }
+                case error:
+                        switch {
+                        case errwrap.ContainsType(ti, Diagnostics(nil)):
+                                // If we have an errwrap wrapper with a Diagnostics hiding
+                                // inside then we'll unpick it here to get access to the
+                                // individual diagnostics.
+                                diags = diags.Append(errwrap.GetType(ti, Diagnostics(nil)))
+                        case errwrap.ContainsType(ti, hcl.Diagnostics(nil)):
+                                // Likewise, if we have HCL diagnostics we'll unpick that too.
+                                diags = diags.Append(errwrap.GetType(ti, hcl.Diagnostics(nil)))
+                        default:
+                                diags = append(diags, nativeError{ti})
+                        }
+                default:
+                        panic(fmt.Errorf("can't construct diagnostic(s) from %T", item))
+                }
+        }
+
+        // Given the above, we should never end up with a non-nil empty slice
+        // here, but we'll make sure of that so callers can rely on empty == nil
+        if len(diags) == 0 {
+                return nil
+        }
+
+        return diags
+}
+
+// HasErrors returns true if any of the diagnostics in the list have
+// a severity of Error.
+func (diags Diagnostics) HasErrors() bool {
+        for _, diag := range diags {
+                if diag.Severity() == Error {
+                        return true
+                }
+        }
+        return false
+}
+
+// ForRPC returns a version of the receiver that has been simplified so that
+// it is friendly to RPC protocols.
+//
+// Currently this means that it can be serialized with encoding/gob and
+// subsequently re-inflated. It may later grow to include other serialization
+// formats.
+//
+// Note that this loses information about the original objects used to
+// construct the diagnostics, so e.g. the errwrap API will not work as
+// expected on an error-wrapped Diagnostics that came from ForRPC.
+func (diags Diagnostics) ForRPC() Diagnostics {
+        ret := make(Diagnostics, len(diags))
+        for i := range diags {
+                ret[i] = makeRPCFriendlyDiag(diags[i])
+        }
+        return ret
+}
+
+// Err flattens a diagnostics list into a single Go error, or to nil
+// if the diagnostics list does not include any error-level diagnostics.
+//
+// This can be used to smuggle diagnostics through an API that deals in
+// native errors, but unfortunately it will lose naked warnings (warnings
+// that aren't accompanied by at least one error) since such APIs have no
+// mechanism through which to report these.
+//
+//     return result, diags.Error()
+func (diags Diagnostics) Err() error {
+        if !diags.HasErrors() {
+                return nil
+        }
+        return diagnosticsAsError{diags}
+}
+
+type diagnosticsAsError struct {
+        Diagnostics
+}
+
+func (dae diagnosticsAsError) Error() string {
+        diags := dae.Diagnostics
+        switch {
+        case len(diags) == 0:
+                // should never happen, since we don't create this wrapper if
+                // there are no diagnostics in the list.
+                return "no errors"
+        case len(diags) == 1:
+                desc := diags[0].Description()
+                if desc.Detail == "" {
+                        return desc.Summary
+                }
+                return fmt.Sprintf("%s: %s", desc.Summary, desc.Detail)
+        default:
+                var ret bytes.Buffer
+                fmt.Fprintf(&ret, "%d problems:\n", len(diags))
+                for _, diag := range dae.Diagnostics {
+                        desc := diag.Description()
+                        if desc.Detail == "" {
+                                fmt.Fprintf(&ret, "\n- %s", desc.Summary)
+                        } else {
+                                fmt.Fprintf(&ret, "\n- %s: %s", desc.Summary, desc.Detail)
+                        }
+                }
+                return ret.String()
+        }
+}
+
+// WrappedErrors is an implementation of errwrap.Wrapper so that an error-wrapped
+// diagnostics object can be picked apart by errwrap-aware code.
+func (dae diagnosticsAsError) WrappedErrors() []error {
+        var errs []error
+        for _, diag := range dae.Diagnostics {
+                if wrapper, isErr := diag.(nativeError); isErr {
+                        errs = append(errs, wrapper.err)
+                }
+        }
+        return errs
+}
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/doc.go b/vendor/github.com/hashicorp/terraform/tfdiags/doc.go
new file mode 100644
index 0000000..c427879
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/doc.go
@@ -0,0 +1,16 @@
+// Package tfdiags is a utility package for representing errors and
+// warnings in a manner that allows us to produce good messages for the
+// user.
+//
+// "diag" is short for "diagnostics", and is meant as a general word for
+// feedback to a user about potential or actual problems.
+//
+// A design goal for this package is for it to be able to provide rich
+// messaging where possible but to also be pragmatic about dealing with
+// generic errors produced by system components that _can't_ provide
+// such rich messaging. As a consequence, the main types in this package --
+// Diagnostics and Diagnostic -- are designed so that they can be "smuggled"
+// over an error channel and then be unpacked at the other end, so that
+// error diagnostics (at least) can transit through APIs that are not
+// aware of this package.
+package tfdiags
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/error.go b/vendor/github.com/hashicorp/terraform/tfdiags/error.go
new file mode 100644
index 0000000..35edc30
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/error.go
@@ -0,0 +1,23 @@
+package tfdiags
+
+// nativeError is a Diagnostic implementation that wraps a normal Go error
+type nativeError struct {
+        err error
+}
+
+var _ Diagnostic = nativeError{}
+
+func (e nativeError) Severity() Severity {
+        return Error
+}
+
+func (e nativeError) Description() Description {
+        return Description{
+                Summary: e.err.Error(),
+        }
+}
+
+func (e nativeError) Source() Source {
+        // No source information available for a native error
+        return Source{}
+}
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/hcl.go b/vendor/github.com/hashicorp/terraform/tfdiags/hcl.go
new file mode 100644
index 0000000..24851f4
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/hcl.go
@@ -0,0 +1,77 @@
+package tfdiags
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+// hclDiagnostic is a Diagnostic implementation that wraps a HCL Diagnostic
+type hclDiagnostic struct {
+        diag *hcl.Diagnostic
+}
+
+var _ Diagnostic = hclDiagnostic{}
+
+func (d hclDiagnostic) Severity() Severity {
+        switch d.diag.Severity {
+        case hcl.DiagWarning:
+                return Warning
+        default:
+                return Error
+        }
+}
+
+func (d hclDiagnostic) Description() Description {
+        return Description{
+                Summary: d.diag.Summary,
+                Detail:  d.diag.Detail,
+        }
+}
+
+func (d hclDiagnostic) Source() Source {
+        var ret Source
+        if d.diag.Subject != nil {
+                rng := SourceRangeFromHCL(*d.diag.Subject)
+                ret.Subject = &rng
+        }
+        if d.diag.Context != nil {
+                rng := SourceRangeFromHCL(*d.diag.Context)
+                ret.Context = &rng
+        }
+        return ret
+}
+
+// SourceRangeFromHCL constructs a SourceRange from the corresponding range
+// type within the HCL package.
+func SourceRangeFromHCL(hclRange hcl.Range) SourceRange {
+        return SourceRange{
+                Filename: hclRange.Filename,
+                Start: SourcePos{
+                        Line:   hclRange.Start.Line,
+                        Column: hclRange.Start.Column,
+                        Byte:   hclRange.Start.Byte,
+                },
+                End: SourcePos{
+                        Line:   hclRange.End.Line,
+                        Column: hclRange.End.Column,
+                        Byte:   hclRange.End.Byte,
+                },
+        }
+}
+
+// ToHCL constructs a HCL Range from the receiving SourceRange. This is the
+// opposite of SourceRangeFromHCL.
+func (r SourceRange) ToHCL() hcl.Range {
+        return hcl.Range{
+                Filename: r.Filename,
+                Start: hcl.Pos{
+                        Line:   r.Start.Line,
+                        Column: r.Start.Column,
+                        Byte:   r.Start.Byte,
+                },
+                End: hcl.Pos{
+                        Line:   r.End.Line,
+                        Column: r.End.Column,
+                        Byte:   r.End.Byte,
+                },
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/rpc_friendly.go b/vendor/github.com/hashicorp/terraform/tfdiags/rpc_friendly.go
new file mode 100644
index 0000000..6cc95cc
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/rpc_friendly.go
@@ -0,0 +1,53 @@
+package tfdiags
+
+import (
+        "encoding/gob"
+)
+
+type rpcFriendlyDiag struct {
+        Severity_ Severity
+        Summary_  string
+        Detail_   string
+        Subject_  *SourceRange
+        Context_  *SourceRange
+}
+
+// rpcFriendlyDiag transforms a given diagnostic so that is more friendly to
+// RPC.
+//
+// In particular, it currently returns an object that can be serialized and
+// later re-inflated using gob. This definition may grow to include other
+// serializations later.
+func makeRPCFriendlyDiag(diag Diagnostic) Diagnostic {
+        desc := diag.Description()
+        source := diag.Source()
+        return &rpcFriendlyDiag{
+                Severity_: diag.Severity(),
+                Summary_:  desc.Summary,
+                Detail_:   desc.Detail,
+                Subject_:  source.Subject,
+                Context_:  source.Context,
+        }
+}
+
+func (d *rpcFriendlyDiag) Severity() Severity {
+        return d.Severity_
+}
+
+func (d *rpcFriendlyDiag) Description() Description {
+        return Description{
+                Summary: d.Summary_,
+                Detail:  d.Detail_,
+        }
+}
+
+func (d *rpcFriendlyDiag) Source() Source {
+        return Source{
+                Subject: d.Subject_,
+                Context: d.Context_,
+        }
+}
+
+func init() {
+        gob.Register((*rpcFriendlyDiag)(nil))
+}
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/severity_string.go b/vendor/github.com/hashicorp/terraform/tfdiags/severity_string.go
new file mode 100644
index 0000000..0b1249b
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/severity_string.go
@@ -0,0 +1,21 @@
+// Code generated by "stringer -type=Severity"; DO NOT EDIT.
+
+package tfdiags
+
+import "strconv"
+
+const (
+        _Severity_name_0 = "Error"
+        _Severity_name_1 = "Warning"
+)
+
+func (i Severity) String() string {
+        switch {
+        case i == 69:
+                return _Severity_name_0
+        case i == 87:
+                return _Severity_name_1
+        default:
+                return "Severity(" + strconv.FormatInt(int64(i), 10) + ")"
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/simple_warning.go b/vendor/github.com/hashicorp/terraform/tfdiags/simple_warning.go
new file mode 100644
index 0000000..fb3ac98
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/simple_warning.go
@@ -0,0 +1,25 @@
+package tfdiags
+
+type simpleWarning string
+
+var _ Diagnostic = simpleWarning("")
+
+// SimpleWarning constructs a simple (summary-only) warning diagnostic.
+func SimpleWarning(msg string) Diagnostic {
+        return simpleWarning(msg)
+}
+
+func (e simpleWarning) Severity() Severity {
+        return Warning
+}
+
+func (e simpleWarning) Description() Description {
+        return Description{
+                Summary: string(e),
+        }
+}
+
+func (e simpleWarning) Source() Source {
+        // No source information available for a native error
+        return Source{}
+}
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/source_range.go b/vendor/github.com/hashicorp/terraform/tfdiags/source_range.go
new file mode 100644
index 0000000..3031168
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/source_range.go
@@ -0,0 +1,35 @@
+package tfdiags
+
+import (
+        "fmt"
+        "os"
+        "path/filepath"
+)
+
+type SourceRange struct {
+        Filename   string
+        Start, End SourcePos
+}
+
+type SourcePos struct {
+        Line, Column, Byte int
+}
+
+// StartString returns a string representation of the start of the range,
+// including the filename and the line and column numbers.
+func (r SourceRange) StartString() string {
+        filename := r.Filename
+
+        // We'll try to relative-ize our filename here so it's less verbose
+        // in the common case of being in the current working directory. If not,
+        // we'll just show the full path.
+        wd, err := os.Getwd()
+        if err == nil {
+                relFn, err := filepath.Rel(wd, filename)
+                if err == nil {
+                        filename = relFn
+                }
+        }
+
+        return fmt.Sprintf("%s:%d,%d", filename, r.Start.Line, r.Start.Column)
+}
diff --git a/vendor/github.com/hashicorp/terraform/version/version.go b/vendor/github.com/hashicorp/terraform/version/version.go
new file mode 100644
index 0000000..b21b297
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/version/version.go
@@ -0,0 +1,36 @@
+// The version package provides a location to set the release versions for all
+// packages to consume, without creating import cycles.
+//
+// This package should not import any other terraform packages.
+package version
+
+import (
+        "fmt"
+
+        version "github.com/hashicorp/go-version"
+)
+
+// The main version number that is being run at the moment.
+var Version = "0.11.12"
+
+// A pre-release marker for the version. If this is "" (empty string)
+// then it means that it is a final release. Otherwise, this is a pre-release
+// such as "dev" (in development), "beta", "rc1", etc.
+var Prerelease = "dev"
+
+// SemVer is an instance of version.Version. This has the secondary
+// benefit of verifying during tests and init time that our version is a
+// proper semantic version, which should always be the case.
+var SemVer = version.Must(version.NewVersion(Version))
+
+// Header is the header name used to send the current terraform version
+// in http requests.
+const Header = "Terraform-Version"
+
+// String returns the complete version string, including prerelease
+func String() string {
+        if Prerelease != "" {
+                return fmt.Sprintf("%s-%s", Version, Prerelease)
+        }
+        return Version
+}