configs

type Backend struct {
	Type   string
	Config hcl.Body
	Eval   *StaticEvaluator

	TypeRange hcl.Range
	DeclRange hcl.Range
}

type Check struct {
	Name string

	DataResource *Resource
	Asserts      []*CheckRule

	DeclRange hcl.Range
}

type CheckRule struct {
	// Condition is an expression that must evaluate to true if the condition
	// holds or false if it does not. If the expression produces an error then
	// that's considered to be a bug in the module defining the check.
	//
	// The available variables in a condition expression vary depending on what
	// a check is attached to. For example, validation rules attached to
	// input variables can only refer to the variable that is being validated.
	Condition hcl.Expression

	// ErrorMessage should be one or more full sentences, which should be in
	// English for consistency with the rest of the error message output but
	// can in practice be in any language. The message should describe what is
	// required for the condition to return true in a way that would make sense
	// to a caller of the module.
	//
	// The error message expression has the same variables available for
	// interpolation as the corresponding condition.
	ErrorMessage hcl.Expression

	DeclRange hcl.Range
}

type CloudConfig struct {
	Config hcl.Body

	DeclRange hcl.Range
	// contains filtered or unexported fields
}

type Config struct {
	// RootModule points to the Config for the root module within the same
	// module tree as this module. If this module _is_ the root module then
	// this is self-referential.
	Root *Config

	// ParentModule points to the Config for the module that directly calls
	// this module. If this is the root module then this field is nil.
	Parent *Config

	// Path is a sequence of module logical names that traverse from the root
	// module to this config. Path is empty for the root module.
	//
	// This should only be used to display paths to the end-user in rare cases
	// where we are talking about the static module tree, before module calls
	// have been resolved. In most cases, an addrs.ModuleInstance describing
	// a node in the dynamic module tree is better, since it will then include
	// any keys resulting from evaluating "count" and "for_each" arguments.
	Path addrs.Module

	// ChildModules points to the Config for each of the direct child modules
	// called from this module. The keys in this map match the keys in
	// Module.ModuleCalls.
	Children map[string]*Config

	// Module points to the object describing the configuration for the
	// various elements (variables, resources, etc) defined by this module.
	Module *Module

	// CallRange is the source range for the header of the module block that
	// requested this module.
	//
	// This field is meaningless for the root module, where its contents are undefined.
	CallRange hcl.Range

	// SourceAddr is the source address that the referenced module was requested
	// from, as specified in configuration. SourceAddrRaw is the same
	// information, but as the raw string the user originally entered.
	//
	// These fields are meaningless for the root module, where their contents are undefined.
	SourceAddr    addrs.ModuleSource
	SourceAddrRaw string

	// SourceAddrRange is the location in the configuration source where the
	// SourceAddr value was set, for use in diagnostic messages.
	//
	// This field is meaningless for the root module, where its contents are undefined.
	SourceAddrRange hcl.Range

	// Version is the specific version that was selected for this module,
	// based on version constraints given in configuration.
	//
	// This field is nil if the module was loaded from a non-registry source,
	// since versions are not supported for other sources.
	//
	// This field is meaningless for the root module, where it will always
	// be nil.
	Version *version.Version
}

type Connection struct {
	Config hcl.Body

	DeclRange hcl.Range
}

type Container interface {
	// Accessible should return true if the resource specified by addr can
	// reference other items within this Container.
	//
	// Typically, that means that addr will either be the container itself or
	// something within the container.
	Accessible(addr addrs.Referenceable) bool
}

type File struct {
	Backends          []*Backend
	CloudConfigs      []*CloudConfig
	Lives             []*Live
	ProviderConfigs   []*Provider
	ProviderMetas     []*ProviderMeta
	RequiredProviders []*RequiredProviders
	Encryptions       []*config.EncryptionConfig

	Variables []*Variable
	Locals    []*Local
	Outputs   []*Output

	ModuleCalls []*ModuleCall

	ManagedResources   []*Resource
	DataResources      []*Resource
	EphemeralResources []*Resource

	Moved   []*Moved
	Import  []*Import
	Removed []*Removed

	Checks []*Check
}

type Import struct {
	ID hcl.Expression

	// Identity is an alternative to ID, which is used to identify the resource instance
	// by its 'Resource Identity'.
	Identity hcl.Expression

	// To is the address HCL expression given in the `import` block configuration.
	// It supports the following address formats:
	// - aws_s3_bucket.my_bucket
	// - module.my_module.aws_s3_bucket.my_bucket
	// - aws_s3_bucket.my_bucket["static_key"]
	// - module.my_module[0].aws_s3_bucket.my_buckets["static_key"]
	// - aws_s3_bucket.my_bucket[expression]
	// - module.my_module[expression].aws_s3_bucket.my_buckets[expression]
	// A dynamic instance key supports a dynamic expression like - a variable, a local, a condition (for example,
	//  ternary), a resource block attribute, a data block attribute, etc.
	To hcl.Expression
	// StaticTo is the corresponding resource and module that the address is referring to. When decoding, as long
	// as the `to` field is in the accepted format, we could determine the actual modules and resource that the
	// address represents. However, we do not yet know for certain what module instance and resource instance this
	// address refers to. So, Static import is mainly used to figure out the Module and Resource, and Provider of the
	// import target resource
	// If we could not determine the StaticTo when decoding the block, then the address is in an unacceptable format
	StaticTo addrs.ConfigResource
	// ResolvedTo will be a reference to the resource instance of the import target, if it can be resolved when decoding
	// the `import` block. If the `to` field does not represent a static address
	// (for example: module.my_module[var.var1].aws_s3_bucket.bucket), then this will be nil.
	// However, if the address is static and can be fully resolved at decode time
	// (for example: module.my_module[2].aws_s3_bucket.bucket), then this will be a reference to the resource instance's
	// address
	// Mainly used for early validations on the import block address, for example making sure there are no duplicate
	// import blocks targeting the same resource
	ResolvedTo *addrs.AbsResourceInstance

	ForEach hcl.Expression

	ProviderConfigRef *ProviderConfigRef
	Provider          addrs.Provider

	DeclRange         hcl.Range
	ProviderDeclRange hcl.Range
}

type Live struct {
	// Estate is the name of the estate this configuration owns, as it appears
	// in the tofu-estate marker described by live/MARKERS.md. It is
	// optional: when it is not set, the estate name is derived from the
	// tofu-estate tags the configuration already stamps, and a configuration
	// that stamps none (or several) is told to name one here.
	//
	// The value must be a literal string. An estate name assembled from a
	// variable would mean the identity of the thing that owns live resources
	// depends on how a run was invoked, and ownership records that move with
	// the invocation are not ownership records.
	Estate string

	// EstateSet distinguishes an absent estate argument from one set to the
	// empty string, so that the second can be an error rather than silently
	// meaning "derive it".
	EstateSet bool

	// EstateRange is where the "estate" argument was written, the zero value
	// when the block does not set it. It is recorded so that a diagnostic
	// about the estate can point at the argument that named it rather than at
	// the whole block, which is what DeclRange gives.
	EstateRange hcl.Range

	// DeclRange is the "live" block's own header, which is what a diagnostic
	// about the block as a whole points at - a backend beside it, or a
	// stateless refusal that has no more specific argument to name. For a
	// live configuration read from the sidecar file it is the start of that
	// file, so the same diagnostics point at the file instead.
	DeclRange hcl.Range

	// Sidecar records that this live configuration was read from the
	// [LiveSidecarFilename] sidecar file rather than from a live block inside
	// a terraform block. The two sources are equivalent everywhere else; the
	// field exists so that a module carrying both can be told exactly which
	// two places disagree, rather than getting the duplicate-block error
	// meant for two live blocks in .tf files.
	Sidecar bool

	// Policy is the optional nested "policy" block: one verb per ownership
	// quadrant (declared-in-source x carries-the-tag), plus the tag those
	// quadrants read and the delete quadrant's safety rails. Nil when the
	// live block sets no policy block at all, which must mean today's fixed
	// behavior (issue #67's "existing estates change nothing").
	//
	// This struct is the raw decode only - the literal string an author
	// wrote for each attribute, or its zero value with the matching *Set
	// flag false when they left it out. It deliberately knows nothing about
	// which verbs are valid for which quadrant: that is
	// internal/live/policy's ValidVerbs matrix, enforced at lint time by
	// internal/live/lint, the same layering every other semantic rule about
	// this fork's configuration follows (compare Estate above, whose own
	// grammar is checked by internal/live/discovery.ValidEstateName rather
	// than here).
	Policy *LivePolicy

	// RecordStore is the nested "record_store" block: where GitHub issue
	// #73's record-backed logical types (null_resource, terraform_data,
	// time_*, non-sensitive random_*) persist their micro-state, and where
	// issue #364's per-instance record will live.
	//
	// It is NEVER nil for a decoded live configuration. A live block that
	// declares no record_store block gets the implied local one
	// ([impliedRecordStore]): HANDOFF.md's "compatible out of the box" says
	// "a local record store is implied when none is declared, the way stock
	// implies local state", so declaring an estate is the whole setup step
	// and the record rung is available to every estate from its first run.
	// [LiveRecordStore.Implied] tells the two apart for a diagnostic that
	// needs to point at something the author actually wrote.
	//
	// A configuration with no live block at all still has no record store,
	// because a nil *Live has no fields: there is no estate, so there is
	// nothing to imply a store for. That is the case every reader must keep
	// treating as "no record store", and it is the only one left.
	//
	// See [LiveRecordStore].
	RecordStore *LiveRecordStore

	// Strict is the optional nested "strict" block: GitHub issue #365's
	// profile toggles, each one of the principles this fork exists for
	// turned into a setting whose default is today's behavior. Nil when the
	// live block sets no strict block at all, which must mean exactly what
	// a configuration written before the block existed got - the same
	// "absent means absent" contract Policy and RecordStore already follow,
	// and the thing that makes HANDOFF.md's "compatible out of the box"
	// true by construction rather than by review.
	//
	// Like [Live.Policy], this is the raw decode only: the literal string
	// an author wrote, with no opinion on whether it means anything. That
	// judgement needs internal/live/strict's vocabulary and belongs to
	// internal/live/lint.
	Strict *LiveStrict
}

type LivePolicy struct {
	// DeclaredTagged, DeclaredUntagged, UndeclaredTagged and
	// UndeclaredUntagged are the four quadrant verbs, named for their
	// policy-block attribute: "declared_tagged" and so on. Each is the
	// literal string an author wrote - "converge", "delete", or whatever
	// they typed, valid or not; a typo is caught by
	// internal/live/lint.checkLivePolicy, not here, because deciding
	// validity needs the per-quadrant matrix and this package does not
	// depend on it. The matching *Set field distinguishes an omitted
	// attribute (which resolves to today's fixed behavior for that
	// quadrant) from one written out.
	DeclaredTagged      string
	DeclaredTaggedSet   bool
	DeclaredTaggedRange hcl.Range

	DeclaredUntagged      string
	DeclaredUntaggedSet   bool
	DeclaredUntaggedRange hcl.Range

	UndeclaredTagged      string
	UndeclaredTaggedSet   bool
	UndeclaredTaggedRange hcl.Range

	UndeclaredUntagged      string
	UndeclaredUntaggedSet   bool
	UndeclaredUntaggedRange hcl.Range

	// TagKey and TagValue name the tag every quadrant's "tagged" half is
	// read against. Both are optional; omitted, they default to the estate
	// marker (internal/live/policy.Build fills in markers.TagEstate and
	// this estate's name), which is the reading every quadrant had before
	// this block existed. A configuration sets them to use a preservation
	// tag distinct from the estate marker instead - issue #67's "one
	// semantic question for the maintainer to confirm".
	TagKey      string
	TagKeySet   bool
	TagKeyRange hcl.Range

	TagValue      string
	TagValueSet   bool
	TagValueRange hcl.Range

	// Scope narrows a delete-quadrant verb's reach. Nil when the policy
	// block sets no scope block. internal/live/lint refuses a quadrant
	// explicitly assigned "delete" with no scope block at all - "an
	// unscoped account-wide purge is a lint refusal, not a default" per
	// issue #67 - so a Policy that later carries a delete verb and a nil
	// Scope can only happen if that check was skipped.
	Scope *LivePolicyScope

	// Threshold is the delete quadrant's first-run guard: a policy whose
	// delete quadrant would touch more resources than this refuses to
	// apply. Parsed and validated as a non-negative literal integer here;
	// enforcing it against an actual roster is the behavioral half's job
	// (issue #67, "First-run protection"), not this package's.
	Threshold      int
	ThresholdSet   bool
	ThresholdRange hcl.Range

	// DeclRange is the "policy" block's own header.
	DeclRange hcl.Range
}

type LivePolicyScope struct {
	// Services, Types and Regions each narrow what a delete-quadrant verb
	// may reach: provider service namespaces, resource type names, and
	// regions, respectively. Every one is optional and any combination may
	// be set; an empty list is indistinguishable from an absent attribute,
	// because in both cases nothing was named to narrow by, so
	// internal/live/lint requires at least one of the three to be
	// non-empty in a scope block that accompanies a delete quadrant.
	Services []string
	Types    []string
	Regions  []string

	// DeclRange is the "scope" block's own header.
	DeclRange hcl.Range
}

type LiveRecordStore struct {
	// Type is the block's label: "local", "ssm", or "s3". Validated against
	// exactly those three spellings in decodeRecordStoreBlock; nothing else
	// reaches this field.
	Type      string
	TypeRange hcl.Range

	// Path is the "local" backend's directory, relative to the module
	// directory. Optional; empty means the caller's own default (a
	// ".tofu-records" directory beside the module, mirroring plain local
	// state's default filename). Literal string, relative, and confined to
	// the module directory: see validateRecordStorePath.
	Path      string
	PathSet   bool
	PathRange hcl.Range

	// Bucket is the "s3" backend's bucket name. Required for that backend;
	// unused by the other two.
	Bucket      string
	BucketSet   bool
	BucketRange hcl.Range

	// KeyPrefix overrides the "ssm" and "s3" backends' default key
	// namespace, which the caller derives from the estate name. Optional.
	// When set, it must stay disjoint from the receipts namespace
	// (live/RECEIPTS.md's "/tofu-receipts/<estate>/<effect>"): a key_prefix
	// whose first "/"-delimited segment is literally "tofu-receipts" is a
	// decode error, so a record can never be written where a receipt's own
	// namespace lives. See validateRecordStoreKeyPrefix.
	KeyPrefix      string
	KeyPrefixSet   bool
	KeyPrefixRange hcl.Range

	// Region overrides the "ssm" and "s3" backends' AWS region. Optional;
	// empty defers to the ordinary AWS SDK default-config chain (environment,
	// shared config, IMDS), the same as every other AWS client this fork
	// builds when a caller names no region.
	Region      string
	RegionSet   bool
	RegionRange hcl.Range

	// DeclRange is the "record_store" block's own header, or - for the
	// implied store - the live block's own header, since that is the
	// nearest thing the author wrote.
	DeclRange hcl.Range

	// Implied is true for the store [impliedRecordStore] fills in when the
	// live block declares no record_store block of its own.
	//
	// Nothing about where a record GOES may branch on this. An implied
	// local store and one written out as `record_store "local" {}` are the
	// same store, holding the same records under the same keys in the same
	// directory, and internal/live/lint's implied_record_store_test.go
	// asserts that by value. That is the whole point of implying it: a
	// reader deciding differently would make the default a third behavior
	// rather than the default one.
	//
	// What it is for is the question "did the author ASK for a store", which
	// is a different question and has exactly two readers today:
	//
	//   - internal/live/lint's strict-markers check, which refuses
	//     `markers "record"` without a declared store. That block is an
	//     author giving UP an available marker for a record, and naming
	//     where the record goes stays part of turning it on.
	//   - internal/command's statelessApplyGuidedDiscovery, which leaves
	//     guided discovery - an opt-in cost optimization that was reached
	//     by declaring a store - opt-in.
	//
	// It is also what a diagnostic reads to say "your live block has the
	// implied local record store" rather than pointing at a block the author
	// never wrote, and what a test reads to assert which of the two it got.
	Implied bool
}

type LiveStrict struct {
	// MarkerRepair is the literal string an author wrote for the
	// "marker_repair" argument - "repair", "never", or whatever they typed,
	// valid or not. Validity is internal/live/strict's vocabulary, checked
	// at lint time by internal/live/lint.checkLiveStrict, for the same
	// reason [LivePolicy]'s quadrant verbs are checked there: this package
	// does not depend on that one.
	//
	// MarkerRepairSet distinguishes an omitted argument, which resolves to
	// internal/live/strict.DefaultMarkerRepair and therefore to today's
	// behavior, from one written out.
	MarkerRepair      string
	MarkerRepairSet   bool
	MarkerRepairRange hcl.Range

	// Secrets is the literal string an author wrote for the "secrets"
	// argument - "store", "refuse", or whatever they typed, valid or not.
	// Read the same way [LiveStrict.MarkerRepair] is, by the same decoder,
	// and judged the same place: internal/live/strict says what the
	// spellings mean and internal/live/lint refuses the ones that mean
	// nothing.
	//
	// SecretsSet distinguishes an omitted argument, which resolves to
	// internal/live/strict.DefaultSecrets, from one written out. The two
	// must behave identically for the default spelling - GitHub issue #101's
	// standing lesson - and the flag exists so that a reader can tell the
	// difference for a diagnostic's Subject range without changing the
	// verdict.
	Secrets      string
	SecretsSet   bool
	SecretsRange hcl.Range

	// NoSourceCreate is the literal string an author wrote for the
	// "no_source_create" argument - "refuse", "create", or whatever they
	// typed, valid or not. GitHub issue #365's ruling-4 toggle
	// (rfc/20260823-foundation-order-ruling.md): a no-source instance (no
	// record, no marker, and an identity nothing - neither the static
	// evaluator nor #388's plan-node seam - can derive) refuses by default;
	// this selects stock's own behavior of planning a create instead. Read
	// the same way [LiveStrict.Secrets] is, by the same decoder;
	// internal/live/strict says what the spellings mean.
	//
	// NoSourceCreateSet distinguishes an omitted argument, which resolves
	// to internal/live/strict.DefaultNoSourceCreate, from one written out,
	// the same reason [LiveStrict.SecretsSet] exists.
	NoSourceCreate      string
	NoSourceCreateSet   bool
	NoSourceCreateRange hcl.Range

	// MarkersRecord is the optional nested `markers "record"` block: which
	// resources hold their identity in the estate's record store instead of
	// in an ownership marker tag, HANDOFF.md's "per-type or per-address
	// markers = record, for tag budgets and tag policies, trading IAM
	// governability for a record-held identity". Nil when the strict block
	// declares no such block, which must mean today's behavior - every
	// taggable resource is marked.
	//
	// It is a LABELED block rather than an attribute because HANDOFF's
	// phrasing is shorthand for what is really a selection with two lists,
	// and because the label leaves room for the inverse selection
	// (`markers "tag"`) without a grammar change.
	//
	// Like every other field here this is the raw decode: two literal lists
	// of strings, with no opinion on whether the type names exist or the
	// addresses parse. That judgement needs internal/addrs' target grammar
	// and the provider's schemas, and belongs to internal/live/lint - the
	// same layering [Live.Estate] already has, whose grammar is checked by
	// internal/live/discovery.ValidEstateName rather than here.
	MarkersRecord *LiveStrictMarkers

	// DeclRange is the "strict" block's own header.
	DeclRange hcl.Range
}

type LiveStrictMarkers struct {
	// Kind is the block's label. "record" is the only one this fork knows
	// today; decodeStrictBlock refuses anything else, so nothing else
	// reaches this field.
	Kind      string
	KindRange hcl.Range

	// Types names resource types whose every instance this selection
	// covers, in the same literal-list-of-strings shape
	// [LivePolicyScope.Types] uses and read by the same decode helper.
	Types      []string
	TypesSet   bool
	TypesRange hcl.Range

	// Addresses names individual resources this selection covers, in the
	// `-target` grammar (internal/addrs' ParseTargetStr): module-qualified
	// or not, whole-resource, with no wildcards. Parsed by
	// internal/live/lint rather than here.
	Addresses      []string
	AddressesSet   bool
	AddressesRange hcl.Range

	// DeclRange is the "markers" block's own header.
	DeclRange hcl.Range
}

type Local struct {
	Name string
	Expr hcl.Expression

	DeclRange hcl.Range
}

type ManagedResource struct {
	Connection   *Connection
	Provisioners []*Provisioner

	CreateBeforeDestroy bool
	PreventDestroy      hcl.Expression
	// Destroy attribute indicates if the resource should be destroy once it is planned for destruction. This attribute corresponds to the `lifecycle.destroy` attribute.
	// The default behavior is to destroy the resource when it is planned for destruction, so the value of false will skip destroying the resource.
	// Note that the resource will still be removed from the state file even if Destroy is set to false but won't call the underlying provider for destruction.
	// This field will accept only constant boolean expressions. This is of type hcl.Expression to make future extensions of dynamic evaluation easier.
	Destroy          hcl.Expression
	IgnoreChanges    []hcl.Traversal
	IgnoreAllChanges bool

	CreateBeforeDestroySet bool
}

type MockProvider struct {
	Name       string
	NameRange  hcl.Range
	Alias      string
	AliasRange *hcl.Range // nil if no alias set

	DeclRange hcl.Range

	ForEach   hcl.Expression
	Instances map[addrs.InstanceKey]instances.RepetitionData

	MockResources     []*MockResource
	OverrideResources []*OverrideResource
}

type MockResource struct {
	Mode     addrs.ResourceMode
	Type     string
	Defaults map[string]cty.Value
}

type Module struct {

	// Any other caller that constructs a module directly with NewModule may
	// assign a suitable value to this attribute before using it for other
	// purposes. It should be treated as immutable by all consumers of Module
	// values.
	SourceDir string

	Backend              *Backend
	CloudConfig          *CloudConfig
	Live                 *Live
	ProviderConfigs      map[string]*Provider
	ProviderRequirements *RequiredProviders
	ProviderLocalNames   map[addrs.Provider]string
	ProviderMetas        map[addrs.Provider]*ProviderMeta
	Encryption           *config.EncryptionConfig

	Variables map[string]*Variable
	Locals    map[string]*Local
	Outputs   map[string]*Output

	ModuleCalls map[string]*ModuleCall

	ManagedResources   map[string]*Resource
	DataResources      map[string]*Resource
	EphemeralResources map[string]*Resource

	Moved   []*Moved
	Import  []*Import
	Removed []*Removed

	Checks map[string]*Check

	Tests map[string]*TestFile

	// IsOverridden indicates if the module is being overridden. It's used in
	// testing framework to not call the underlying module.
	IsOverridden bool

	// StaticEvaluator is used to evaluate static expressions in the scope of the Module.
	StaticEvaluator *StaticEvaluator

	// ActiveExperiments is not currently used and so is always nil, but is
	// reserved to be a place to capture a module's active experiments if we
	// begin using language experiments in a later release.
	ActiveExperiments experiments.Set
}

type ModuleCall struct {
	Name string

	Source        hcl.Expression
	SourceAddrRaw string
	SourceAddr    addrs.ModuleSource
	SourceSet     bool

	// Used when building the corresponding StaticModuleCall
	Variables StaticModuleVariables
	Workspace string

	Config hcl.Body

	VersionAttr *hcl.Attribute
	Version     VersionConstraint

	Count   hcl.Expression
	ForEach hcl.Expression
	Enabled hcl.Expression

	Providers []PassedProviderConfig

	DependsOn []hcl.Traversal

	DeclRange hcl.Range
}

type ModuleRequest struct {
	// Name is the "logical name" of the module call within configuration.
	// This is provided in case the name is used as part of a storage key
	// for the module, but implementations must otherwise treat it as an
	// opaque string. It is guaranteed to have already been validated as an
	// HCL identifier and UTF-8 encoded.
	Name string

	// Path is a list of logical names that traverse from the root module to
	// this module. This can be used, for example, to form a lookup key for
	// each distinct module call in a configuration, allowing for multiple
	// calls with the same name at different points in the tree.
	Path addrs.Module

	// SourceAddr is the source address string provided by the user in
	// configuration.
	SourceAddr addrs.ModuleSource

	// SourceAddrRange is the source range for the SourceAddr value as it
	// was provided in configuration. This can and should be used to generate
	// diagnostics about the source address having invalid syntax, referring
	// to a non-existent object, etc.
	SourceAddrRange hcl.Range

	// VersionConstraint is the version constraint applied to the module in
	// configuration. This data structure includes the source range for
	// the constraint, which can and should be used to generate diagnostics
	// about constraint-related issues, such as constraints that eliminate all
	// available versions of a module whose source is otherwise valid.
	VersionConstraint VersionConstraint

	// Parent is the partially-constructed module tree node that the loaded
	// module will be added to. Callers may refer to any field of this
	// structure except Children, which is still under construction when
	// ModuleRequest objects are created and thus has undefined content.
	// The main reason this is provided is so that full module paths can
	// be constructed for uniqueness.
	Parent *Config

	// CallRange is the source range for the header of the "module" block
	// in configuration that prompted this request. This can be used as the
	// subject of an error diagnostic that relates to the module call itself,
	// rather than to either its source address or its version number.
	CallRange hcl.Range

	// This is where variables and other information from the calling module
	// are propagated to the child module for use in the static evaluator
	Call StaticModuleCall
}

type ModuleRequirements struct {
	Name         string
	SourceAddr   addrs.ModuleSource
	SourceDir    string
	Requirements getproviders.Requirements
	Children     map[string]*ModuleRequirements
	Tests        map[string]*TestFileModuleRequirements
}

type ModuleWalker interface {
	// LoadModule finds and loads a requested child module.
	//
	// If errors are detected during loading, implementations should return them
	// in the diagnostics object. If the diagnostics object contains any errors
	// then the caller will tolerate the returned module being nil or incomplete.
	// If no errors are returned, it should be non-nil and complete.
	//
	// Full validation need not have been performed but an implementation should
	// ensure that the basic file- and module-validations performed by the
	// LoadConfigDir function (valid syntax, no namespace collisions, etc) have
	// been performed before returning a module.
	LoadModule(ctx context.Context, req *ModuleRequest) (*Module, *version.Version, hcl.Diagnostics)
}

type ModuleWalkerFunc func(ctx context.Context, req *ModuleRequest) (*Module, *version.Version, hcl.Diagnostics)

type Moved struct {
	From *addrs.MoveEndpoint
	To   *addrs.MoveEndpoint

	DeclRange hcl.Range
}

type Output struct {
	Name        string
	Description string
	Expr        hcl.Expression
	DependsOn   []hcl.Traversal
	Sensitive   bool
	Deprecated  string
	Ephemeral   bool

	Preconditions []*CheckRule

	DescriptionSet bool
	SensitiveSet   bool
	EphemeralSet   bool

	DeclRange hcl.Range

	// IsOverridden indicates if the output is being overridden. It's used in
	// testing framework to not evaluate expression and use OverrideValue instead.
	IsOverridden bool
	// OverrideValue is only valid if IsOverridden is set to true. The value
	// should be used instead of evaluated expression. It's possible to have no
	// OverrideValue even with IsOverridden is set to true.
	OverrideValue *cty.Value
}

type OverrideModule struct {
	// Target references module call to override.
	Target       hcl.Traversal
	TargetParsed addrs.Module

	// Outputs represents fields to use instead
	// of the real module call output.
	Outputs map[string]cty.Value
}

type OverrideResource struct {
	// Target references resource or data block to override.
	Target       hcl.Traversal
	TargetParsed *addrs.ConfigResource

	// Mode indicates if the Target is resource or data block.
	Mode addrs.ResourceMode

	// Values represents fields to use as defaults
	// if they are not present in configuration.
	Values map[string]cty.Value
}

type Parser struct {
	// contains filtered or unexported fields
}

type PassedProviderConfig struct {
	InChild  *ProviderConfigRef
	InParent *ProviderConfigRef
}

type Provider struct {
	Name       string
	NameRange  hcl.Range
	Alias      string
	AliasRange *hcl.Range // nil if no alias set

	Version VersionConstraint

	Config hcl.Body

	DeclRange hcl.Range

	// IsMocked indicates if this provider has been mocked. It is used in
	// testing framework to instantiate test provider wrapper.
	IsMocked          bool
	MockResources     []*MockResource
	OverrideResources []*OverrideResource

	ForEach   hcl.Expression
	Instances map[addrs.InstanceKey]instances.RepetitionData
	// contains filtered or unexported fields
}

type ProviderConfigRef struct {
	Name       string
	NameRange  hcl.Range
	Alias      string
	AliasRange *hcl.Range // nil if alias not set

	KeyExpression hcl.Expression
	// contains filtered or unexported fields
}

type ProviderMeta struct {
	Provider string
	Config   hcl.Body

	ProviderRange hcl.Range
	DeclRange     hcl.Range
}

type Provisioner struct {
	Type       string
	Config     hcl.Body
	Connection *Connection
	When       ProvisionerWhen
	OnFailure  ProvisionerOnFailure

	DeclRange hcl.Range
	TypeRange hcl.Range
}

type ProvisionerOnFailure int

type ProvisionerWhen int

type ReferenceCategory string

type RefusedReference struct {
	// Category classifies the referenced object. See [ReferenceCategory].
	Category ReferenceCategory

	// Subject is the referenced object itself, module-relative, exactly as
	// the reference parser produced it.
	Subject addrs.Referenceable

	// Module is the module the referencing expression belongs to: the
	// evaluating module's call path, with no instance keys, because a static
	// evaluator is shared by every instance of its module.
	Module addrs.Module

	// NeededBy names the static identifier whose evaluation needed the
	// refused reference - the top of the evaluation stack, rendered the way
	// the diagnostic's own text renders it.
	NeededBy string
}

type Removed struct {
	From *addrs.RemoveEndpoint

	Destroy    bool
	DestroySet bool

	Provisioners []*Provisioner

	DeclRange hcl.Range
}

type RequiredProvider struct {
	Name        string
	Source      string
	Type        addrs.Provider
	Requirement VersionConstraint
	DeclRange   hcl.Range
	Aliases     []addrs.LocalProviderConfig
}

type RequiredProviders struct {
	RequiredProviders map[string]*RequiredProvider
	DeclRange         hcl.Range
}

type Resource struct {
	Mode    addrs.ResourceMode
	Name    string
	Type    string
	Config  hcl.Body
	Count   hcl.Expression
	Enabled hcl.Expression
	ForEach hcl.Expression

	ProviderConfigRef *ProviderConfigRef
	Provider          addrs.Provider

	Preconditions  []*CheckRule
	Postconditions []*CheckRule

	DependsOn []hcl.Traversal

	TriggersReplacement []hcl.Expression

	// Managed is populated only for Mode = addrs.ManagedResourceMode,
	// containing the additional fields that apply to managed resources.
	// For all other resource modes, this field is nil.
	Managed *ManagedResource

	// Container links a scoped resource back up to the resources that contains
	// it. This field is referenced during static analysis to check whether any
	// references are also made from within the same container.
	//
	// If this is nil, then this resource is essentially public.
	Container Container

	// IsOverridden indicates if the resource is being overridden. It's used in
	// testing framework to not call the underlying provider.
	IsOverridden bool
	// OverrideValues are only valid if IsOverridden is set to true. The values
	// should be used to compose mock provider response. It is possible to have
	// zero-length OverrideValues even if IsOverridden is set to true.
	OverrideValues map[string]cty.Value

	DeclRange hcl.Range
	TypeRange hcl.Range
}

type SelectiveLoader int

type StaticDataLookup func(addr addrs.Resource) (cty.Value, bool)

type StaticEvaluator struct {
	// contains filtered or unexported fields
}

type StaticIdentifier struct {
	Module    addrs.Module
	Subject   string
	DeclRange hcl.Range
}

type StaticModuleCall struct {
	// contains filtered or unexported fields
}

type StaticModuleOutputLookup func(call addrs.ModuleCall) (cty.Value, bool)

type StaticModuleVariables func(v *Variable) (cty.Value, hcl.Diagnostics)

type TestCommand rune

type TestFile struct {
	// Variables defines a set of global variable definitions that should be set
	// for every run block within the test file.
	Variables map[string]hcl.Expression

	// Providers defines a set of providers that are available to run blocks
	// within this test file.
	//
	// If empty, tests should use the default providers for the module under
	// test.
	Providers map[string]*Provider

	// Runs defines the sequential list of run blocks that should be executed in
	// order.
	Runs []*TestRun

	// OverrideResources is a list of resources to be overridden with static values.
	// Underlying providers shouldn't be called for overridden resources.
	OverrideResources []*OverrideResource

	// OverrideModules is a list of modules to be overridden with static values.
	// Underlying modules shouldn't be called.
	OverrideModules []*OverrideModule

	// MockProviders is a map of providers that should be mocked. It is merged
	// with Providers map to use later when instantiating provider instance.
	MockProviders map[string]*MockProvider

	VariablesDeclRange hcl.Range
}

type TestFileModuleRequirements struct {
	Requirements getproviders.Requirements
	Runs         map[string]*ModuleRequirements
}

type TestMode rune

type TestRun struct {
	Name string

	// Command is the OpenTofu command to execute.
	//
	// One of ['apply', 'plan'].
	Command TestCommand

	// Options contains the embedded plan options that will affect the given
	// Command. These should map to the options documented here:
	//   - https://opentofu.org/docs/cli/commands/plan/#planning-options
	//
	// Note, that the Variables are a top level concept and not embedded within
	// the options despite being listed as plan options in the documentation.
	Options *TestRunOptions

	// Variables defines a set of variable definitions for this command.
	//
	// Any variables specified locally that clash with the global variables will
	// take precedence over the global definition.
	Variables map[string]hcl.Expression

	// Providers specifies the set of providers that should be loaded into the
	// module for this run block.
	//
	// Providers specified here must be configured in one of the provider blocks
	// for this file. If empty, the run block will load the default providers
	// for the module under test.
	Providers []PassedProviderConfig

	// CheckRules defines the list of assertions/validations that should be
	// checked by this run block.
	CheckRules []*CheckRule

	// Module defines an address of another module that should be loaded and
	// executed as part of this run block instead of the module under test.
	//
	// We support loading from all the module sources, like local directories, registry,
	// generic git repos, github, bitbucket, s3 and gcs repositories.
	Module *TestRunModuleCall

	// ConfigUnderTest describes the configuration this run block should execute
	// against.
	//
	// In typical cases, this will be null and the config under test is the
	// configuration within the directory the tofu test command is
	// executing within. However, when Module is set the config under test is
	// whichever config is defined by Module. This field is then set during the
	// configuration load process and should be used when the test is executed.
	ConfigUnderTest *Config

	// ExpectFailures should be a list of checkable objects that are expected
	// to report a failure from their custom conditions as part of this test
	// run.
	ExpectFailures []hcl.Traversal

	// OverrideResources is a list of resources to be overridden with static values.
	// Underlying providers shouldn't be called for overridden resources.
	OverrideResources []*OverrideResource

	// OverrideModules is a list of modules to be overridden with static values.
	// Underlying modules shouldn't be called.
	OverrideModules []*OverrideModule

	NameDeclRange      hcl.Range
	VariablesDeclRange hcl.Range
	DeclRange          hcl.Range
}

type TestRunModuleCall struct {
	// Source is the source of the module to test.
	Source addrs.ModuleSource

	// Version is the version of the module to load from the registry.
	Version VersionConstraint

	DeclRange       hcl.Range
	SourceDeclRange hcl.Range
}

type TestRunOptions struct {
	// Mode is the planning mode to run in. One of ['normal', 'refresh-only'].
	Mode TestMode

	// Refresh is analogous to the -refresh=false OpenTofu plan option.
	Refresh bool

	// Replace is analogous to the -refresh=ADDRESS OpenTofu plan option.
	Replace []hcl.Traversal

	// Target is analogous to the -target=ADDRESS OpenTofu plan option.
	Target []hcl.Traversal

	DeclRange hcl.Range
}

type Variable struct {
	Name        string
	Description string
	Default     cty.Value

	// Only used inside modules that have *some* variable with ConstSet.
	// This allows us to match terraform's validation in their imitation
	// of our static eval concept.
	Const bool

	// Type is the concrete type of the variable value.
	Type cty.Type
	// ConstraintType is used for decoding and type conversions, and may
	// contain nested ObjectWithOptionalAttr types.
	ConstraintType cty.Type
	TypeDefaults   *typeexpr.Defaults

	ParsingMode VariableParsingMode
	Validations []*CheckRule
	Sensitive   bool
	Deprecated  string
	Ephemeral   bool

	DescriptionSet bool
	SensitiveSet   bool
	EphemeralSet   bool
	ConstSet       bool

	// Nullable indicates that null is a valid value for this variable. Setting
	// Nullable to false means that the module can expect this variable to
	// never be null.
	Nullable    bool
	NullableSet bool

	DeclRange hcl.Range
}

type VariableParsingMode rune

type VariableTypeHint rune

type VersionConstraint struct {
	Required    version.Constraints
	RequiredSet versions.Set // New style
	DeclRange   hcl.Range
}