config

type Compiled struct {
	Retries []CompiledRetry
	Ignores []CompiledIgnore
}

type CompiledIgnore struct {
	Name     string
	Patterns []*regexp.Regexp
	Message  string
}

type CompiledRetry struct {
	Name        string
	Patterns    []*regexp.Regexp
	MaxAttempts int
	Sleep       time.Duration
}

type Dependency struct {
	Name       string `hcl:"name,label"`
	ConfigPath string `hcl:"config_path"`
	// MockOutputs stands in for a dependency that has not been applied yet, so
	// `run-all plan` works on a greenfield stack. Held as an expression because
	// it may reference locals.
	MockOutputs hcl.Expression `hcl:"mock_outputs,optional"`
	// MockOutputsAllowedCommands checks which commands may consume the mocks.
	// Empty means NONE: a mocked value must never reach an apply, where it
	// would be written into real infrastructure as though it were a real id.
	MockOutputsAllowedCommands []string `hcl:"mock_outputs_allowed_terraform_commands,optional"`
}

type DependsOnBlock struct {
	Paths []string `hcl:"paths"`
}

type EngineBlock struct {
	// Source is a local path or an https URL to a BARE executable. Bare, not an
	// archive: an archive needs extracting, and extraction is a whole class of
	// path-traversal bug that simply cannot exist if there is nothing to unpack.
	Source string `hcl:"source"`
	// SHA256 is the digest of that executable. Required. An engine nobody pinned
	// is an engine nobody can prove.
	SHA256 string `hcl:"sha256"`
	// Version is recorded in the receipt. It never decides what gets downloaded.
	Version string `hcl:"version,optional"`
	// Meta is passed to the plugin on init, for whatever it needs to know.
	Meta map[string]string `hcl:"meta,optional"`
}

type ErrorsBlock struct {
	Retries []RetryRule  `hcl:"retry,block"`
	Ignores []IgnoreRule `hcl:"ignore,block"`
}

type Exclude struct {
	If      bool     `hcl:"if"`
	Actions []string `hcl:"actions,optional"`
}

type ExtraArguments struct {
	Name string `hcl:"name,label"`
	// Commands this applies to; empty means all.
	Commands  []string `hcl:"commands,optional"`
	Arguments []string `hcl:"arguments,optional"`
	// RequiredVarFiles are passed as -var-file and MUST exist.
	RequiredVarFiles []string `hcl:"required_var_files,optional"`
	// OptionalVarFiles are passed only when present, which is what lets one
	// parent config serve environments that do not all have the same files.
	OptionalVarFiles []string          `hcl:"optional_var_files,optional"`
	EnvVars          map[string]string `hcl:"env_vars,optional"`
}

type Feature struct {
	Name    string `hcl:"name,label"`
	Default string `hcl:"default,optional"`
}

type Field struct {
	Name string `json:"name"`
	// Kind is "attribute" or "block".
	Kind string `json:"kind"`
	// Type is the Go type rendered readably, which is the closest thing HCL has
	// to a declared type for these.
	Type     string `json:"type"`
	Required bool   `json:"required"`
	// Label is the block label's name where a block takes one, as in
	// dependency "network" { }.
	Label string `json:"label,omitempty"`
	// Doc is one sentence on what it is for.
	Doc string `json:"doc"`
	// Fields are a block's own contents, one level down.
	Fields []Field `json:"fields,omitempty"`
}

type Generate struct {
	Name     string `hcl:"name,label"`
	Path     string `hcl:"path"`
	Contents string `hcl:"contents"`
	// IfExists is accepted for Terragrunt compatibility. Vizier always
	// overwrites what it generates - the file is a build product - so this is
	// recorded rather than obeyed; rejecting the attribute outright just stopped
	// real configs from parsing.
	IfExists string `hcl:"if_exists,optional"`
}

type Hook struct {
	Name string `hcl:"name,label"`
	// Commands are the engine actions this hook applies to (plan/apply/destroy).
	// Empty means all of them.
	Commands []string `hcl:"commands,optional"`
	// Execute is the command and its arguments.
	Execute []string `hcl:"execute"`
	// WorkingDir defaults to the unit directory.
	WorkingDir string `hcl:"working_dir,optional"`
	// RunOnError makes an after-hook run even when the engine failed - the
	// difference between a cleanup hook that works and one that only works on
	// the happy path.
	RunOnError bool `hcl:"run_on_error,optional"`
	// SuppressStdout hides output from a chatty hook.
	SuppressStdout bool `hcl:"suppress_stdout,optional"`
	// OnErrors (error hooks only) limits the hook to failures whose message
	// matches one of these regexes.
	OnErrors []string `hcl:"on_errors,optional"`
}

type IgnoreRule struct {
	Name            string   `hcl:"name,label"`
	IgnorableErrors []string `hcl:"ignorable_errors"`
	Message         string   `hcl:"message"`
}

type Include struct {
	Name string `hcl:"name,label"`
	Path string `hcl:"path"`
	// Expose makes the parent readable as include.<label>.locals.<name>.
	// Terragrunt does NOT inherit locals silently, and neither do we: a child
	// that reads a parent's local should say so, or renaming a local in a
	// parent breaks children that never mentioned it.
	Expose bool `hcl:"expose,optional"`
	// MergeStrategy is shallow (default) or deep. Deep merges maps recursively
	// and concatenates lists, for parents that build up structure.
	MergeStrategy string `hcl:"merge_strategy,optional"`
}

type RemoteState struct {
	Backend string `hcl:"backend"`
	// Config is the backend's arguments. Held as an expression so it can use
	// locals and functions - deriving `key` from the path is the common case.
	Config   hcl.Expression       `hcl:"config"`
	Generate *RemoteStateGenerate `hcl:"generate,optional"`
	// contains filtered or unexported fields
}

type RemoteStateGenerate struct {
	Path     string `cty:"path"`
	IfExists string `cty:"if_exists"`
}

type RetryRule struct {
	Name            string   `hcl:"name,label"`
	RetryableErrors []string `hcl:"retryable_errors"`
	MaxAttempts     int      `hcl:"max_attempts,optional"`
	SleepSeconds    int      `hcl:"sleep_interval_sec,optional"`
}

type SourcesBlock struct {
	URLs []string `hcl:"urls"`
}

type Stack struct {
	Units  []StackUnit  `hcl:"unit,block"`
	Stacks []StackChild `hcl:"stack,block"`
	// locals is consumed by evalLocals before this decode runs; it is declared
	// here only so gohcl does not reject the block as unexpected. Without it,
	// `path = "${local.env}/vpc"` - the entire per-environment point of a stack -
	// cannot be written.
	Locals []struct {
		Remain hcl.Body `hcl:",remain"`
	} `hcl:"locals,block"`
}

type StackChild struct {
	Name   string    `hcl:"name,label"`
	Source string    `hcl:"source"`
	Path   string    `hcl:"path"`
	Values cty.Value `hcl:"values,optional"`
}

type StackUnit struct {
	Name string `hcl:"name,label"`
	// Source is the module the generated unit will use.
	Source string `hcl:"source"`
	// Path is where the unit is written, relative to the stack file.
	Path string `hcl:"path"`
	// Values become the generated unit's `inputs`.
	Values cty.Value `hcl:"values,optional"`
	// DependsOn generates `dependencies { paths = [...] }`, so ordering survives
	// generation. Without it a stack could only produce independent units, which
	// is not what any real environment looks like.
	DependsOn []string `hcl:"depends_on,optional"`
	// Verify is copied verbatim into the generated unit, so a stack cannot
	// become a way to generate units that skip verification.
	Verify *VerifyPolicy `hcl:"verify,block"`
}

type TerraformBlock struct {
	Source      string           `hcl:"source"`
	ExtraArgs   []ExtraArguments `hcl:"extra_arguments,block"`
	BeforeHooks []Hook           `hcl:"before_hook,block"`
	AfterHooks  []Hook           `hcl:"after_hook,block"`
	ErrorHooks  []Hook           `hcl:"error_hook,block"`
}

type Unit struct {
	Dir          string
	Terraform    *TerraformBlock
	Includes     []Include
	Dependencies []Dependency
	Verify       *VerifyPolicy
	// Engine, when set, replaces the process that executes this unit.
	Engine *EngineBlock
	// Sources lists repositories `vizier browse` should list. Root config only.
	Sources     *SourcesBlock
	Generates   []Generate
	RemoteState *RemoteState
	BeforeHooks []Hook
	AfterHooks  []Hook
	ErrorHooks  []Hook
	ExtraArgs   []ExtraArguments
	DependsOn   []string             // ordering-only dependencies (dependencies { paths })
	Locals      map[string]cty.Value // resolved in pass 1 (locals.go)
	// Exposed carries each `expose = true` parent, keyed by include label, for
	// the `include.<label>.locals.<name>` lookup.
	Exposed map[string]map[string]cty.Value
	// Errors is the compiled `errors {}` block: per-class retry and ignore rules.
	Errors *Compiled
	// Excludes are `exclude {}` blocks, already evaluated to a boolean.
	Excludes []Exclude
	// IAMRole is a role to assume for this unit's engine calls, so one tree can
	// span accounts without a wrapper script per environment.
	IAMRole            string
	IAMRoleDuration    int
	IAMRoleSessionName string
	// DownloadDir is where modules are materialised. Empty means
	// <unit>/.vizier-module, matching Terragrunt's per-unit default.
	DownloadDir string
	// Skip excludes a unit from execution while leaving it in the DAG, so its
	// outputs still feed dependents. There was no way at all to leave one unit
	// out of a run, so the only options were running it or deleting its config.
	Skip bool
	// EngineVersionConstraint and VizierVersionConstraint refuse a run under a
	// toolchain the config was not written for.
	//
	// The failure they prevent is quiet: a module that needs tofu 1.6 running
	// under 1.5 does not say "wrong version", it says something obscure about a
	// syntax it does not recognise, three units into a run. Terragrunt spells
	// these terraform_version_constraint and terragrunt_version_constraint; both
	// spellings are accepted so an existing config parses unchanged.
	EngineVersionConstraint string
	VizierVersionConstraint string
	// TerragruntVersionConstraint is PARSED so an existing Terragrunt config
	// still reads, and deliberately NOT enforced. It pins a different product's
	// version namespace: Terragrunt is on 0.x and vizier is on 1.x, so honouring
	// a real pin like ">= 0.45.0, < 0.46.0" against our own version refuses
	// every tree that carries one. Reported by `hcl validate` so it is visible
	// rather than silently ignored.
	TerragruntVersionConstraint string
	// RetryableErrors extends the built-in transient-failure patterns.
	// runner.RetryPolicy.Patterns existed and was never assigned from anywhere,
	// so the hardcoded list was the only list and a provider with its own
	// distinctive throttling message could not be accommodated.
	RetryableErrors []string
	// External marks a unit pulled in because something inside the tree depends
	// on it, but which lies outside --dir. It is checked and its outputs are read;
	// it is never executed. Pointing at environments/prod must not apply
	// something in shared/.
	External bool
	// contains filtered or unexported fields
}

type VerifyPolicy struct {
	RequireSigned *bool  `hcl:"require_signed"`
	MinStatus     string `hcl:"min_status,optional"`
	// AllowUnverified lists sources admitted without catalog proof. Matched by
	// PREFIX, so one entry covers a whole repo rather than needing the exact
	// string of every module in it.
	AllowUnverified []string `hcl:"allow_unverified,optional"`
	// SourceSHA256 pins the expected digest of a NON-catalog module's tree.
	//
	// This is how a client brings their own modules without giving up the
	// guarantee: they do not need to publish to any catalog or hold a signing
	// key, they just declare what they expect the code to be. The digest is
	// computed over sorted relative paths plus contents, so a renamed file
	// changes it, and Vizier's own generated files are excluded so it describes
	// the module rather than the run.
	SourceSHA256 string `hcl:"source_sha256,optional"`
	// AllowAnySource admits non-catalog modules with no pin at all. It is the
	// explicit way to say "this tree runs code from anywhere", and the receipt
	// records it - a bypass must never be invisible.
	AllowAnySource *bool `hcl:"allow_any_source,optional"`
}