8 files changed, 1238 insertions, 0 deletions

diff --git a/vendor/github.com/hashicorp/hcl2/hcldec/block_labels.go b/vendor/github.com/hashicorp/hcl2/hcldec/block_labels.go
new file mode 100644
index 0000000..7e652e9
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcldec/block_labels.go
@@ -0,0 +1,21 @@
+package hcldec
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+type blockLabel struct {
+        Value string
+        Range hcl.Range
+}
+
+func labelsForBlock(block *hcl.Block) []blockLabel {
+        ret := make([]blockLabel, len(block.Labels))
+        for i := range block.Labels {
+                ret[i] = blockLabel{
+                        Value: block.Labels[i],
+                        Range: block.LabelRanges[i],
+                }
+        }
+        return ret
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcldec/decode.go b/vendor/github.com/hashicorp/hcl2/hcldec/decode.go
new file mode 100644
index 0000000..6cf93fe
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcldec/decode.go
@@ -0,0 +1,36 @@
+package hcldec
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+)
+
+func decode(body hcl.Body, blockLabels []blockLabel, ctx *hcl.EvalContext, spec Spec, partial bool) (cty.Value, hcl.Body, hcl.Diagnostics) {
+        schema := ImpliedSchema(spec)
+
+        var content *hcl.BodyContent
+        var diags hcl.Diagnostics
+        var leftovers hcl.Body
+
+        if partial {
+                content, leftovers, diags = body.PartialContent(schema)
+        } else {
+                content, diags = body.Content(schema)
+        }
+
+        val, valDiags := spec.decode(content, blockLabels, ctx)
+        diags = append(diags, valDiags...)
+
+        return val, leftovers, diags
+}
+
+func impliedType(spec Spec) cty.Type {
+        return spec.impliedType()
+}
+
+func sourceRange(body hcl.Body, blockLabels []blockLabel, spec Spec) hcl.Range {
+        schema := ImpliedSchema(spec)
+        content, _, _ := body.PartialContent(schema)
+
+        return spec.sourceRange(content, blockLabels)
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcldec/doc.go b/vendor/github.com/hashicorp/hcl2/hcldec/doc.go
new file mode 100644
index 0000000..23bfe54
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcldec/doc.go
@@ -0,0 +1,12 @@
+// Package hcldec provides a higher-level API for unpacking the content of
+// HCL bodies, implemented in terms of the low-level "Content" API exposed
+// by the bodies themselves.
+//
+// It allows decoding an entire nested configuration in a single operation
+// by providing a description of the intended structure.
+//
+// For some applications it may be more convenient to use the "gohcl"
+// package, which has a similar purpose but decodes directly into native
+// Go data types. hcldec instead targets the cty type system, and thus allows
+// a cty-driven application to remain within that type system.
+package hcldec
diff --git a/vendor/github.com/hashicorp/hcl2/hcldec/gob.go b/vendor/github.com/hashicorp/hcl2/hcldec/gob.go
new file mode 100644
index 0000000..e2027cf
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcldec/gob.go
@@ -0,0 +1,23 @@
+package hcldec
+
+import (
+        "encoding/gob"
+)
+
+func init() {
+        // Every Spec implementation should be registered with gob, so that
+        // specs can be sent over gob channels, such as using
+        // github.com/hashicorp/go-plugin with plugins that need to describe
+        // what shape of configuration they are expecting.
+        gob.Register(ObjectSpec(nil))
+        gob.Register(TupleSpec(nil))
+        gob.Register((*AttrSpec)(nil))
+        gob.Register((*LiteralSpec)(nil))
+        gob.Register((*ExprSpec)(nil))
+        gob.Register((*BlockSpec)(nil))
+        gob.Register((*BlockListSpec)(nil))
+        gob.Register((*BlockSetSpec)(nil))
+        gob.Register((*BlockMapSpec)(nil))
+        gob.Register((*BlockLabelSpec)(nil))
+        gob.Register((*DefaultSpec)(nil))
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcldec/public.go b/vendor/github.com/hashicorp/hcl2/hcldec/public.go
new file mode 100644
index 0000000..5d1f10a
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcldec/public.go
@@ -0,0 +1,78 @@
+package hcldec
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// Decode interprets the given body using the given specification and returns
+// the resulting value. If the given body is not valid per the spec, error
+// diagnostics are returned and the returned value is likely to be incomplete.
+//
+// The ctx argument may be nil, in which case any references to variables or
+// functions will produce error diagnostics.
+func Decode(body hcl.Body, spec Spec, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        val, _, diags := decode(body, nil, ctx, spec, false)
+        return val, diags
+}
+
+// PartialDecode is like Decode except that it permits "leftover" items in
+// the top-level body, which are returned as a new body to allow for
+// further processing.
+//
+// Any descendent block bodies are _not_ decoded partially and thus must
+// be fully described by the given specification.
+func PartialDecode(body hcl.Body, spec Spec, ctx *hcl.EvalContext) (cty.Value, hcl.Body, hcl.Diagnostics) {
+        return decode(body, nil, ctx, spec, true)
+}
+
+// ImpliedType returns the value type that should result from decoding the
+// given spec.
+func ImpliedType(spec Spec) cty.Type {
+        return impliedType(spec)
+}
+
+// SourceRange interprets the given body using the given specification and
+// then returns the source range of the value that would be used to
+// fulfill the spec.
+//
+// This can be used if application-level validation detects value errors, to
+// obtain a reasonable SourceRange to use for generated diagnostics. It works
+// best when applied to specific body items (e.g. using AttrSpec, BlockSpec, ...)
+// as opposed to entire bodies using ObjectSpec, TupleSpec. The result will
+// be less useful the broader the specification, so e.g. a spec that returns
+// the entirety of all of the blocks of a given type is likely to be
+// _particularly_ arbitrary and useless.
+//
+// If the given body is not valid per the given spec, the result is best-effort
+// and may not actually be something ideal. It's expected that an application
+// will already have used Decode or PartialDecode earlier and thus had an
+// opportunity to detect and report spec violations.
+func SourceRange(body hcl.Body, spec Spec) hcl.Range {
+        return sourceRange(body, nil, spec)
+}
+
+// ChildBlockTypes returns a map of all of the child block types declared
+// by the given spec, with block type names as keys and the associated
+// nested body specs as values.
+func ChildBlockTypes(spec Spec) map[string]Spec {
+        ret := map[string]Spec{}
+
+        // visitSameBodyChildren walks through the spec structure, calling
+        // the given callback for each descendent spec encountered. We are
+        // interested in the specs that reference attributes and blocks.
+        var visit visitFunc
+        visit = func(s Spec) {
+                if bs, ok := s.(blockSpec); ok {
+                        for _, blockS := range bs.blockHeaderSchemata() {
+                                ret[blockS.Type] = bs.nestedSpec()
+                        }
+                }
+
+                s.visitSameBodyChildren(visit)
+        }
+
+        visit(spec)
+
+        return ret
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcldec/schema.go b/vendor/github.com/hashicorp/hcl2/hcldec/schema.go
new file mode 100644
index 0000000..b57bd96
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcldec/schema.go
@@ -0,0 +1,36 @@
+package hcldec
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+// ImpliedSchema returns the *hcl.BodySchema implied by the given specification.
+// This is the schema that the Decode function will use internally to
+// access the content of a given body.
+func ImpliedSchema(spec Spec) *hcl.BodySchema {
+        var attrs []hcl.AttributeSchema
+        var blocks []hcl.BlockHeaderSchema
+
+        // visitSameBodyChildren walks through the spec structure, calling
+        // the given callback for each descendent spec encountered. We are
+        // interested in the specs that reference attributes and blocks.
+        var visit visitFunc
+        visit = func(s Spec) {
+                if as, ok := s.(attrSpec); ok {
+                        attrs = append(attrs, as.attrSchemata()...)
+                }
+
+                if bs, ok := s.(blockSpec); ok {
+                        blocks = append(blocks, bs.blockHeaderSchemata()...)
+                }
+
+                s.visitSameBodyChildren(visit)
+        }
+
+        visit(spec)
+
+        return &hcl.BodySchema{
+                Attributes: attrs,
+                Blocks:     blocks,
+        }
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcldec/spec.go b/vendor/github.com/hashicorp/hcl2/hcldec/spec.go
new file mode 100644
index 0000000..25cafcd
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcldec/spec.go
@@ -0,0 +1,998 @@
+package hcldec
+
+import (
+        "bytes"
+        "fmt"
+
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+        "github.com/zclconf/go-cty/cty/function"
+)
+
+// A Spec is a description of how to decode a hcl.Body to a cty.Value.
+//
+// The various other types in this package whose names end in "Spec" are
+// the spec implementations. The most common top-level spec is ObjectSpec,
+// which decodes body content into a cty.Value of an object type.
+type Spec interface {
+        // Perform the decode operation on the given body, in the context of
+        // the given block (which might be null), using the given eval context.
+        //
+        // "block" is provided only by the nested calls performed by the spec
+        // types that work on block bodies.
+        decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics)
+
+        // Return the cty.Type that should be returned when decoding a body with
+        // this spec.
+        impliedType() cty.Type
+
+        // Call the given callback once for each of the nested specs that would
+        // get decoded with the same body and block as the receiver. This should
+        // not descend into the nested specs used when decoding blocks.
+        visitSameBodyChildren(cb visitFunc)
+
+        // Determine the source range of the value that would be returned for the
+        // spec in the given content, in the context of the given block
+        // (which might be null). If the corresponding item is missing, return
+        // a place where it might be inserted.
+        sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range
+}
+
+type visitFunc func(spec Spec)
+
+// An ObjectSpec is a Spec that produces a cty.Value of an object type whose
+// attributes correspond to the keys of the spec map.
+type ObjectSpec map[string]Spec
+
+// attrSpec is implemented by specs that require attributes from the body.
+type attrSpec interface {
+        attrSchemata() []hcl.AttributeSchema
+}
+
+// blockSpec is implemented by specs that require blocks from the body.
+type blockSpec interface {
+        blockHeaderSchemata() []hcl.BlockHeaderSchema
+        nestedSpec() Spec
+}
+
+// specNeedingVariables is implemented by specs that can use variables
+// from the EvalContext, to declare which variables they need.
+type specNeedingVariables interface {
+        variablesNeeded(content *hcl.BodyContent) []hcl.Traversal
+}
+
+func (s ObjectSpec) visitSameBodyChildren(cb visitFunc) {
+        for _, c := range s {
+                cb(c)
+        }
+}
+
+func (s ObjectSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        vals := make(map[string]cty.Value, len(s))
+        var diags hcl.Diagnostics
+
+        for k, spec := range s {
+                var kd hcl.Diagnostics
+                vals[k], kd = spec.decode(content, blockLabels, ctx)
+                diags = append(diags, kd...)
+        }
+
+        return cty.ObjectVal(vals), diags
+}
+
+func (s ObjectSpec) impliedType() cty.Type {
+        if len(s) == 0 {
+                return cty.EmptyObject
+        }
+
+        attrTypes := make(map[string]cty.Type)
+        for k, childSpec := range s {
+                attrTypes[k] = childSpec.impliedType()
+        }
+        return cty.Object(attrTypes)
+}
+
+func (s ObjectSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range {
+        // This is not great, but the best we can do. In practice, it's rather
+        // strange to ask for the source range of an entire top-level body, since
+        // that's already readily available to the caller.
+        return content.MissingItemRange
+}
+
+// A TupleSpec is a Spec that produces a cty.Value of a tuple type whose
+// elements correspond to the elements of the spec slice.
+type TupleSpec []Spec
+
+func (s TupleSpec) visitSameBodyChildren(cb visitFunc) {
+        for _, c := range s {
+                cb(c)
+        }
+}
+
+func (s TupleSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        vals := make([]cty.Value, len(s))
+        var diags hcl.Diagnostics
+
+        for i, spec := range s {
+                var ed hcl.Diagnostics
+                vals[i], ed = spec.decode(content, blockLabels, ctx)
+                diags = append(diags, ed...)
+        }
+
+        return cty.TupleVal(vals), diags
+}
+
+func (s TupleSpec) impliedType() cty.Type {
+        if len(s) == 0 {
+                return cty.EmptyTuple
+        }
+
+        attrTypes := make([]cty.Type, len(s))
+        for i, childSpec := range s {
+                attrTypes[i] = childSpec.impliedType()
+        }
+        return cty.Tuple(attrTypes)
+}
+
+func (s TupleSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range {
+        // This is not great, but the best we can do. In practice, it's rather
+        // strange to ask for the source range of an entire top-level body, since
+        // that's already readily available to the caller.
+        return content.MissingItemRange
+}
+
+// An AttrSpec is a Spec that evaluates a particular attribute expression in
+// the body and returns its resulting value converted to the requested type,
+// or produces a diagnostic if the type is incorrect.
+type AttrSpec struct {
+        Name     string
+        Type     cty.Type
+        Required bool
+}
+
+func (s *AttrSpec) visitSameBodyChildren(cb visitFunc) {
+        // leaf node
+}
+
+// specNeedingVariables implementation
+func (s *AttrSpec) variablesNeeded(content *hcl.BodyContent) []hcl.Traversal {
+        attr, exists := content.Attributes[s.Name]
+        if !exists {
+                return nil
+        }
+
+        return attr.Expr.Variables()
+}
+
+// attrSpec implementation
+func (s *AttrSpec) attrSchemata() []hcl.AttributeSchema {
+        return []hcl.AttributeSchema{
+                {
+                        Name:     s.Name,
+                        Required: s.Required,
+                },
+        }
+}
+
+func (s *AttrSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range {
+        attr, exists := content.Attributes[s.Name]
+        if !exists {
+                return content.MissingItemRange
+        }
+
+        return attr.Expr.Range()
+}
+
+func (s *AttrSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        attr, exists := content.Attributes[s.Name]
+        if !exists {
+                // We don't need to check required and emit a diagnostic here, because
+                // that would already have happened when building "content".
+                return cty.NullVal(s.Type), nil
+        }
+
+        val, diags := attr.Expr.Value(ctx)
+
+        convVal, err := convert.Convert(val, s.Type)
+        if err != nil {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Incorrect attribute value type",
+                        Detail: fmt.Sprintf(
+                                "Inappropriate value for attribute %q: %s.",
+                                s.Name, err.Error(),
+                        ),
+                        Subject: attr.Expr.StartRange().Ptr(),
+                        Context: hcl.RangeBetween(attr.NameRange, attr.Expr.StartRange()).Ptr(),
+                })
+                // We'll return an unknown value of the _correct_ type so that the
+                // incomplete result can still be used for some analysis use-cases.
+                val = cty.UnknownVal(s.Type)
+        } else {
+                val = convVal
+        }
+
+        return val, diags
+}
+
+func (s *AttrSpec) impliedType() cty.Type {
+        return s.Type
+}
+
+// A LiteralSpec is a Spec that produces the given literal value, ignoring
+// the given body.
+type LiteralSpec struct {
+        Value cty.Value
+}
+
+func (s *LiteralSpec) visitSameBodyChildren(cb visitFunc) {
+        // leaf node
+}
+
+func (s *LiteralSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        return s.Value, nil
+}
+
+func (s *LiteralSpec) impliedType() cty.Type {
+        return s.Value.Type()
+}
+
+func (s *LiteralSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range {
+        // No sensible range to return for a literal, so the caller had better
+        // ensure it doesn't cause any diagnostics.
+        return hcl.Range{
+                Filename: "<unknown>",
+        }
+}
+
+// An ExprSpec is a Spec that evaluates the given expression, ignoring the
+// given body.
+type ExprSpec struct {
+        Expr hcl.Expression
+}
+
+func (s *ExprSpec) visitSameBodyChildren(cb visitFunc) {
+        // leaf node
+}
+
+// specNeedingVariables implementation
+func (s *ExprSpec) variablesNeeded(content *hcl.BodyContent) []hcl.Traversal {
+        return s.Expr.Variables()
+}
+
+func (s *ExprSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        return s.Expr.Value(ctx)
+}
+
+func (s *ExprSpec) impliedType() cty.Type {
+        // We can't know the type of our expression until we evaluate it
+        return cty.DynamicPseudoType
+}
+
+func (s *ExprSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range {
+        return s.Expr.Range()
+}
+
+// A BlockSpec is a Spec that produces a cty.Value by decoding the contents
+// of a single nested block of a given type, using a nested spec.
+//
+// If the Required flag is not set, the nested block may be omitted, in which
+// case a null value is produced. If it _is_ set, an error diagnostic is
+// produced if there are no nested blocks of the given type.
+type BlockSpec struct {
+        TypeName string
+        Nested   Spec
+        Required bool
+}
+
+func (s *BlockSpec) visitSameBodyChildren(cb visitFunc) {
+        // leaf node ("Nested" does not use the same body)
+}
+
+// blockSpec implementation
+func (s *BlockSpec) blockHeaderSchemata() []hcl.BlockHeaderSchema {
+        return []hcl.BlockHeaderSchema{
+                {
+                        Type:       s.TypeName,
+                        LabelNames: findLabelSpecs(s.Nested),
+                },
+        }
+}
+
+// blockSpec implementation
+func (s *BlockSpec) nestedSpec() Spec {
+        return s.Nested
+}
+
+// specNeedingVariables implementation
+func (s *BlockSpec) variablesNeeded(content *hcl.BodyContent) []hcl.Traversal {
+        var childBlock *hcl.Block
+        for _, candidate := range content.Blocks {
+                if candidate.Type != s.TypeName {
+                        continue
+                }
+
+                childBlock = candidate
+                break
+        }
+
+        if childBlock == nil {
+                return nil
+        }
+
+        return Variables(childBlock.Body, s.Nested)
+}
+
+func (s *BlockSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+
+        var childBlock *hcl.Block
+        for _, candidate := range content.Blocks {
+                if candidate.Type != s.TypeName {
+                        continue
+                }
+
+                if childBlock != nil {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  fmt.Sprintf("Duplicate %s block", s.TypeName),
+                                Detail: fmt.Sprintf(
+                                        "Only one block of type %q is allowed. Previous definition was at %s.",
+                                        s.TypeName, childBlock.DefRange.String(),
+                                ),
+                                Subject: &candidate.DefRange,
+                        })
+                        break
+                }
+
+                childBlock = candidate
+        }
+
+        if childBlock == nil {
+                if s.Required {
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  fmt.Sprintf("Missing %s block", s.TypeName),
+                                Detail: fmt.Sprintf(
+                                        "A block of type %q is required here.", s.TypeName,
+                                ),
+                                Subject: &content.MissingItemRange,
+                        })
+                }
+                return cty.NullVal(s.Nested.impliedType()), diags
+        }
+
+        if s.Nested == nil {
+                panic("BlockSpec with no Nested Spec")
+        }
+        val, _, childDiags := decode(childBlock.Body, labelsForBlock(childBlock), ctx, s.Nested, false)
+        diags = append(diags, childDiags...)
+        return val, diags
+}
+
+func (s *BlockSpec) impliedType() cty.Type {
+        return s.Nested.impliedType()
+}
+
+func (s *BlockSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range {
+        var childBlock *hcl.Block
+        for _, candidate := range content.Blocks {
+                if candidate.Type != s.TypeName {
+                        continue
+                }
+
+                childBlock = candidate
+                break
+        }
+
+        if childBlock == nil {
+                return content.MissingItemRange
+        }
+
+        return sourceRange(childBlock.Body, labelsForBlock(childBlock), s.Nested)
+}
+
+// A BlockListSpec is a Spec that produces a cty list of the results of
+// decoding all of the nested blocks of a given type, using a nested spec.
+type BlockListSpec struct {
+        TypeName string
+        Nested   Spec
+        MinItems int
+        MaxItems int
+}
+
+func (s *BlockListSpec) visitSameBodyChildren(cb visitFunc) {
+        // leaf node ("Nested" does not use the same body)
+}
+
+// blockSpec implementation
+func (s *BlockListSpec) blockHeaderSchemata() []hcl.BlockHeaderSchema {
+        return []hcl.BlockHeaderSchema{
+                {
+                        Type:       s.TypeName,
+                        LabelNames: findLabelSpecs(s.Nested),
+                },
+        }
+}
+
+// blockSpec implementation
+func (s *BlockListSpec) nestedSpec() Spec {
+        return s.Nested
+}
+
+// specNeedingVariables implementation
+func (s *BlockListSpec) variablesNeeded(content *hcl.BodyContent) []hcl.Traversal {
+        var ret []hcl.Traversal
+
+        for _, childBlock := range content.Blocks {
+                if childBlock.Type != s.TypeName {
+                        continue
+                }
+
+                ret = append(ret, Variables(childBlock.Body, s.Nested)...)
+        }
+
+        return ret
+}
+
+func (s *BlockListSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+
+        if s.Nested == nil {
+                panic("BlockListSpec with no Nested Spec")
+        }
+
+        var elems []cty.Value
+        var sourceRanges []hcl.Range
+        for _, childBlock := range content.Blocks {
+                if childBlock.Type != s.TypeName {
+                        continue
+                }
+
+                val, _, childDiags := decode(childBlock.Body, labelsForBlock(childBlock), ctx, s.Nested, false)
+                diags = append(diags, childDiags...)
+                elems = append(elems, val)
+                sourceRanges = append(sourceRanges, sourceRange(childBlock.Body, labelsForBlock(childBlock), s.Nested))
+        }
+
+        if len(elems) < s.MinItems {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  fmt.Sprintf("Insufficient %s blocks", s.TypeName),
+                        Detail:   fmt.Sprintf("At least %d %q blocks are required.", s.MinItems, s.TypeName),
+                        Subject:  &content.MissingItemRange,
+                })
+        } else if s.MaxItems > 0 && len(elems) > s.MaxItems {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  fmt.Sprintf("Too many %s blocks", s.TypeName),
+                        Detail:   fmt.Sprintf("No more than %d %q blocks are allowed", s.MaxItems, s.TypeName),
+                        Subject:  &sourceRanges[s.MaxItems],
+                })
+        }
+
+        var ret cty.Value
+
+        if len(elems) == 0 {
+                ret = cty.ListValEmpty(s.Nested.impliedType())
+        } else {
+                ret = cty.ListVal(elems)
+        }
+
+        return ret, diags
+}
+
+func (s *BlockListSpec) impliedType() cty.Type {
+        return cty.List(s.Nested.impliedType())
+}
+
+func (s *BlockListSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range {
+        // We return the source range of the _first_ block of the given type,
+        // since they are not guaranteed to form a contiguous range.
+
+        var childBlock *hcl.Block
+        for _, candidate := range content.Blocks {
+                if candidate.Type != s.TypeName {
+                        continue
+                }
+
+                childBlock = candidate
+                break
+        }
+
+        if childBlock == nil {
+                return content.MissingItemRange
+        }
+
+        return sourceRange(childBlock.Body, labelsForBlock(childBlock), s.Nested)
+}
+
+// A BlockSetSpec is a Spec that produces a cty set of the results of
+// decoding all of the nested blocks of a given type, using a nested spec.
+type BlockSetSpec struct {
+        TypeName string
+        Nested   Spec
+        MinItems int
+        MaxItems int
+}
+
+func (s *BlockSetSpec) visitSameBodyChildren(cb visitFunc) {
+        // leaf node ("Nested" does not use the same body)
+}
+
+// blockSpec implementation
+func (s *BlockSetSpec) blockHeaderSchemata() []hcl.BlockHeaderSchema {
+        return []hcl.BlockHeaderSchema{
+                {
+                        Type:       s.TypeName,
+                        LabelNames: findLabelSpecs(s.Nested),
+                },
+        }
+}
+
+// blockSpec implementation
+func (s *BlockSetSpec) nestedSpec() Spec {
+        return s.Nested
+}
+
+// specNeedingVariables implementation
+func (s *BlockSetSpec) variablesNeeded(content *hcl.BodyContent) []hcl.Traversal {
+        var ret []hcl.Traversal
+
+        for _, childBlock := range content.Blocks {
+                if childBlock.Type != s.TypeName {
+                        continue
+                }
+
+                ret = append(ret, Variables(childBlock.Body, s.Nested)...)
+        }
+
+        return ret
+}
+
+func (s *BlockSetSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+
+        if s.Nested == nil {
+                panic("BlockSetSpec with no Nested Spec")
+        }
+
+        var elems []cty.Value
+        var sourceRanges []hcl.Range
+        for _, childBlock := range content.Blocks {
+                if childBlock.Type != s.TypeName {
+                        continue
+                }
+
+                val, _, childDiags := decode(childBlock.Body, labelsForBlock(childBlock), ctx, s.Nested, false)
+                diags = append(diags, childDiags...)
+                elems = append(elems, val)
+                sourceRanges = append(sourceRanges, sourceRange(childBlock.Body, labelsForBlock(childBlock), s.Nested))
+        }
+
+        if len(elems) < s.MinItems {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  fmt.Sprintf("Insufficient %s blocks", s.TypeName),
+                        Detail:   fmt.Sprintf("At least %d %q blocks are required.", s.MinItems, s.TypeName),
+                        Subject:  &content.MissingItemRange,
+                })
+        } else if s.MaxItems > 0 && len(elems) > s.MaxItems {
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  fmt.Sprintf("Too many %s blocks", s.TypeName),
+                        Detail:   fmt.Sprintf("No more than %d %q blocks are allowed", s.MaxItems, s.TypeName),
+                        Subject:  &sourceRanges[s.MaxItems],
+                })
+        }
+
+        var ret cty.Value
+
+        if len(elems) == 0 {
+                ret = cty.SetValEmpty(s.Nested.impliedType())
+        } else {
+                ret = cty.SetVal(elems)
+        }
+
+        return ret, diags
+}
+
+func (s *BlockSetSpec) impliedType() cty.Type {
+        return cty.Set(s.Nested.impliedType())
+}
+
+func (s *BlockSetSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range {
+        // We return the source range of the _first_ block of the given type,
+        // since they are not guaranteed to form a contiguous range.
+
+        var childBlock *hcl.Block
+        for _, candidate := range content.Blocks {
+                if candidate.Type != s.TypeName {
+                        continue
+                }
+
+                childBlock = candidate
+                break
+        }
+
+        if childBlock == nil {
+                return content.MissingItemRange
+        }
+
+        return sourceRange(childBlock.Body, labelsForBlock(childBlock), s.Nested)
+}
+
+// A BlockMapSpec is a Spec that produces a cty map of the results of
+// decoding all of the nested blocks of a given type, using a nested spec.
+//
+// One level of map structure is created for each of the given label names.
+// There must be at least one given label name.
+type BlockMapSpec struct {
+        TypeName   string
+        LabelNames []string
+        Nested     Spec
+}
+
+func (s *BlockMapSpec) visitSameBodyChildren(cb visitFunc) {
+        // leaf node ("Nested" does not use the same body)
+}
+
+// blockSpec implementation
+func (s *BlockMapSpec) blockHeaderSchemata() []hcl.BlockHeaderSchema {
+        return []hcl.BlockHeaderSchema{
+                {
+                        Type:       s.TypeName,
+                        LabelNames: append(s.LabelNames, findLabelSpecs(s.Nested)...),
+                },
+        }
+}
+
+// blockSpec implementation
+func (s *BlockMapSpec) nestedSpec() Spec {
+        return s.Nested
+}
+
+// specNeedingVariables implementation
+func (s *BlockMapSpec) variablesNeeded(content *hcl.BodyContent) []hcl.Traversal {
+        var ret []hcl.Traversal
+
+        for _, childBlock := range content.Blocks {
+                if childBlock.Type != s.TypeName {
+                        continue
+                }
+
+                ret = append(ret, Variables(childBlock.Body, s.Nested)...)
+        }
+
+        return ret
+}
+
+func (s *BlockMapSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        var diags hcl.Diagnostics
+
+        if s.Nested == nil {
+                panic("BlockSetSpec with no Nested Spec")
+        }
+
+        elems := map[string]interface{}{}
+        for _, childBlock := range content.Blocks {
+                if childBlock.Type != s.TypeName {
+                        continue
+                }
+
+                childLabels := labelsForBlock(childBlock)
+                val, _, childDiags := decode(childBlock.Body, childLabels[len(s.LabelNames):], ctx, s.Nested, false)
+                targetMap := elems
+                for _, key := range childBlock.Labels[:len(s.LabelNames)-1] {
+                        if _, exists := targetMap[key]; !exists {
+                                targetMap[key] = make(map[string]interface{})
+                        }
+                        targetMap = targetMap[key].(map[string]interface{})
+                }
+
+                diags = append(diags, childDiags...)
+
+                key := childBlock.Labels[len(s.LabelNames)-1]
+                if _, exists := targetMap[key]; exists {
+                        labelsBuf := bytes.Buffer{}
+                        for _, label := range childBlock.Labels {
+                                fmt.Fprintf(&labelsBuf, " %q", label)
+                        }
+                        diags = append(diags, &hcl.Diagnostic{
+                                Severity: hcl.DiagError,
+                                Summary:  fmt.Sprintf("Duplicate %s block", s.TypeName),
+                                Detail: fmt.Sprintf(
+                                        "A block for %s%s was already defined. The %s labels must be unique.",
+                                        s.TypeName, labelsBuf.String(), s.TypeName,
+                                ),
+                                Subject: &childBlock.DefRange,
+                        })
+                        continue
+                }
+
+                targetMap[key] = val
+        }
+
+        if len(elems) == 0 {
+                return cty.MapValEmpty(s.Nested.impliedType()), diags
+        }
+
+        var ctyMap func(map[string]interface{}, int) cty.Value
+        ctyMap = func(raw map[string]interface{}, depth int) cty.Value {
+                vals := make(map[string]cty.Value, len(raw))
+                if depth == 1 {
+                        for k, v := range raw {
+                                vals[k] = v.(cty.Value)
+                        }
+                } else {
+                        for k, v := range raw {
+                                vals[k] = ctyMap(v.(map[string]interface{}), depth-1)
+                        }
+                }
+                return cty.MapVal(vals)
+        }
+
+        return ctyMap(elems, len(s.LabelNames)), diags
+}
+
+func (s *BlockMapSpec) impliedType() cty.Type {
+        ret := s.Nested.impliedType()
+        for _ = range s.LabelNames {
+                ret = cty.Map(ret)
+        }
+        return ret
+}
+
+func (s *BlockMapSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range {
+        // We return the source range of the _first_ block of the given type,
+        // since they are not guaranteed to form a contiguous range.
+
+        var childBlock *hcl.Block
+        for _, candidate := range content.Blocks {
+                if candidate.Type != s.TypeName {
+                        continue
+                }
+
+                childBlock = candidate
+                break
+        }
+
+        if childBlock == nil {
+                return content.MissingItemRange
+        }
+
+        return sourceRange(childBlock.Body, labelsForBlock(childBlock), s.Nested)
+}
+
+// A BlockLabelSpec is a Spec that returns a cty.String representing the
+// label of the block its given body belongs to, if indeed its given body
+// belongs to a block. It is a programming error to use this in a non-block
+// context, so this spec will panic in that case.
+//
+// This spec only works in the nested spec within a BlockSpec, BlockListSpec,
+// BlockSetSpec or BlockMapSpec.
+//
+// The full set of label specs used against a particular block must have a
+// consecutive set of indices starting at zero. The maximum index found
+// defines how many labels the corresponding blocks must have in cty source.
+type BlockLabelSpec struct {
+        Index int
+        Name  string
+}
+
+func (s *BlockLabelSpec) visitSameBodyChildren(cb visitFunc) {
+        // leaf node
+}
+
+func (s *BlockLabelSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        if s.Index >= len(blockLabels) {
+                panic("BlockListSpec used in non-block context")
+        }
+
+        return cty.StringVal(blockLabels[s.Index].Value), nil
+}
+
+func (s *BlockLabelSpec) impliedType() cty.Type {
+        return cty.String // labels are always strings
+}
+
+func (s *BlockLabelSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range {
+        if s.Index >= len(blockLabels) {
+                panic("BlockListSpec used in non-block context")
+        }
+
+        return blockLabels[s.Index].Range
+}
+
+func findLabelSpecs(spec Spec) []string {
+        maxIdx := -1
+        var names map[int]string
+
+        var visit visitFunc
+        visit = func(s Spec) {
+                if ls, ok := s.(*BlockLabelSpec); ok {
+                        if maxIdx < ls.Index {
+                                maxIdx = ls.Index
+                        }
+                        if names == nil {
+                                names = make(map[int]string)
+                        }
+                        names[ls.Index] = ls.Name
+                }
+                s.visitSameBodyChildren(visit)
+        }
+
+        visit(spec)
+
+        if maxIdx < 0 {
+                return nil // no labels at all
+        }
+
+        ret := make([]string, maxIdx+1)
+        for i := range ret {
+                name := names[i]
+                if name == "" {
+                        // Should never happen if the spec is conformant, since we require
+                        // consecutive indices starting at zero.
+                        name = fmt.Sprintf("missing%02d", i)
+                }
+                ret[i] = name
+        }
+
+        return ret
+}
+
+// DefaultSpec is a spec that wraps two specs, evaluating the primary first
+// and then evaluating the default if the primary returns a null value.
+//
+// The two specifications must have the same implied result type for correct
+// operation. If not, the result is undefined.
+type DefaultSpec struct {
+        Primary Spec
+        Default Spec
+}
+
+func (s *DefaultSpec) visitSameBodyChildren(cb visitFunc) {
+        cb(s.Primary)
+        cb(s.Default)
+}
+
+func (s *DefaultSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        val, diags := s.Primary.decode(content, blockLabels, ctx)
+        if val.IsNull() {
+                var moreDiags hcl.Diagnostics
+                val, moreDiags = s.Default.decode(content, blockLabels, ctx)
+                diags = append(diags, moreDiags...)
+        }
+        return val, diags
+}
+
+func (s *DefaultSpec) impliedType() cty.Type {
+        return s.Primary.impliedType()
+}
+
+func (s *DefaultSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range {
+        // We can't tell from here which of the two specs will ultimately be used
+        // in our result, so we'll just assume the first. This is usually the right
+        // choice because the default is often a literal spec that doesn't have a
+        // reasonable source range to return anyway.
+        return s.Primary.sourceRange(content, blockLabels)
+}
+
+// TransformExprSpec is a spec that wraps another and then evaluates a given
+// hcl.Expression on the result.
+//
+// The implied type of this spec is determined by evaluating the expression
+// with an unknown value of the nested spec's implied type, which may cause
+// the result to be imprecise. This spec should not be used in situations where
+// precise result type information is needed.
+type TransformExprSpec struct {
+        Wrapped      Spec
+        Expr         hcl.Expression
+        TransformCtx *hcl.EvalContext
+        VarName      string
+}
+
+func (s *TransformExprSpec) visitSameBodyChildren(cb visitFunc) {
+        cb(s.Wrapped)
+}
+
+func (s *TransformExprSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        wrappedVal, diags := s.Wrapped.decode(content, blockLabels, ctx)
+        if diags.HasErrors() {
+                // We won't try to run our function in this case, because it'll probably
+                // generate confusing additional errors that will distract from the
+                // root cause.
+                return cty.UnknownVal(s.impliedType()), diags
+        }
+
+        chiCtx := s.TransformCtx.NewChild()
+        chiCtx.Variables = map[string]cty.Value{
+                s.VarName: wrappedVal,
+        }
+        resultVal, resultDiags := s.Expr.Value(chiCtx)
+        diags = append(diags, resultDiags...)
+        return resultVal, diags
+}
+
+func (s *TransformExprSpec) impliedType() cty.Type {
+        wrappedTy := s.Wrapped.impliedType()
+        chiCtx := s.TransformCtx.NewChild()
+        chiCtx.Variables = map[string]cty.Value{
+                s.VarName: cty.UnknownVal(wrappedTy),
+        }
+        resultVal, _ := s.Expr.Value(chiCtx)
+        return resultVal.Type()
+}
+
+func (s *TransformExprSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range {
+        // We'll just pass through our wrapped range here, even though that's
+        // not super-accurate, because there's nothing better to return.
+        return s.Wrapped.sourceRange(content, blockLabels)
+}
+
+// TransformFuncSpec is a spec that wraps another and then evaluates a given
+// cty function with the result. The given function must expect exactly one
+// argument, where the result of the wrapped spec will be passed.
+//
+// The implied type of this spec is determined by type-checking the function
+// with an unknown value of the nested spec's implied type, which may cause
+// the result to be imprecise. This spec should not be used in situations where
+// precise result type information is needed.
+//
+// If the given function produces an error when run, this spec will produce
+// a non-user-actionable diagnostic message. It's the caller's responsibility
+// to ensure that the given function cannot fail for any non-error result
+// of the wrapped spec.
+type TransformFuncSpec struct {
+        Wrapped Spec
+        Func    function.Function
+}
+
+func (s *TransformFuncSpec) visitSameBodyChildren(cb visitFunc) {
+        cb(s.Wrapped)
+}
+
+func (s *TransformFuncSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
+        wrappedVal, diags := s.Wrapped.decode(content, blockLabels, ctx)
+        if diags.HasErrors() {
+                // We won't try to run our function in this case, because it'll probably
+                // generate confusing additional errors that will distract from the
+                // root cause.
+                return cty.UnknownVal(s.impliedType()), diags
+        }
+
+        resultVal, err := s.Func.Call([]cty.Value{wrappedVal})
+        if err != nil {
+                // This is not a good example of a diagnostic because it is reporting
+                // a programming error in the calling application, rather than something
+                // an end-user could act on.
+                diags = append(diags, &hcl.Diagnostic{
+                        Severity: hcl.DiagError,
+                        Summary:  "Transform function failed",
+                        Detail:   fmt.Sprintf("Decoder transform returned an error: %s", err),
+                        Subject:  s.sourceRange(content, blockLabels).Ptr(),
+                })
+                return cty.UnknownVal(s.impliedType()), diags
+        }
+
+        return resultVal, diags
+}
+
+func (s *TransformFuncSpec) impliedType() cty.Type {
+        wrappedTy := s.Wrapped.impliedType()
+        resultTy, err := s.Func.ReturnType([]cty.Type{wrappedTy})
+        if err != nil {
+                // Should never happen with a correctly-configured spec
+                return cty.DynamicPseudoType
+        }
+
+        return resultTy
+}
+
+func (s *TransformFuncSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range {
+        // We'll just pass through our wrapped range here, even though that's
+        // not super-accurate, because there's nothing better to return.
+        return s.Wrapped.sourceRange(content, blockLabels)
+}
diff --git a/vendor/github.com/hashicorp/hcl2/hcldec/variables.go b/vendor/github.com/hashicorp/hcl2/hcldec/variables.go
new file mode 100644
index 0000000..427b0d0
--- /dev/null
+++ b/vendor/github.com/hashicorp/hcl2/hcldec/variables.go
@@ -0,0 +1,34 @@
+package hcldec
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+// Variables processes the given body with the given spec and returns a
+// list of the variable traversals that would be required to decode
+// the same pairing of body and spec.
+//
+// This can be used to conditionally populate the variables in the EvalContext
+// passed to Decode, for applications where a static scope is insufficient.
+//
+// If the given body is not compliant with the given schema, the result may
+// be incomplete, but that's assumed to be okay because the eventual call
+// to Decode will produce error diagnostics anyway.
+func Variables(body hcl.Body, spec Spec) []hcl.Traversal {
+        schema := ImpliedSchema(spec)
+
+        content, _, _ := body.PartialContent(schema)
+
+        var vars []hcl.Traversal
+
+        if vs, ok := spec.(specNeedingVariables); ok {
+                vars = append(vars, vs.variablesNeeded(content)...)
+        }
+        spec.visitSameBodyChildren(func(s Spec) {
+                if vs, ok := s.(specNeedingVariables); ok {
+                        vars = append(vars, vs.variablesNeeded(content)...)
+                }
+        })
+
+        return vars
+}