@intentius/chant-lexicon-cedar 0.124.31 → 0.124.33

package/dist/lint/post-synth/dwde010.js

@@ -0,0 +1,84 @@
+import { DOGWOOD_BINARY_NAME, DOGWOOD_SEARCH_ORDER, findDogwoodBinary, formatDogwoodDiagnostic, runDogwoodValidate, } from "../../dogwood/cli.js";
+import { describeBundle, planDogwoodRuns } from "./dogwood-helpers.js";
+export const dwde010 = {
+    id: "DWDE010",
+    description: "Emitted dogwood policy sets validate clean under `dogwood validate`, when the binary is available",
+    check(ctx) {
+        const plan = planDogwoodRuns(ctx);
+        if (!plan.hasPolicies)
+            return [];
+        const binary = findDogwoodBinary();
+        if (!binary) {
+            return [
+                {
+                    checkId: "DWDE010",
+                    severity: "info",
+                    message: `This build emitted dogwood .dw policies, but no \`${DOGWOOD_BINARY_NAME}\` binary was found, so full .dw validation did not run — the DWDC walls checked what TypeScript can answer and nothing checked macro expansion, the temporal type check, or the Cedar body against the action schema. chant looked at ${DOGWOOD_SEARCH_ORDER}. See chant #1659.`,
+                    lexicon: plan.lexicon,
+                },
+            ];
+        }
+        if (plan.blocked) {
+            return [
+                {
+                    checkId: "DWDE010",
+                    severity: "info",
+                    message: `This build emitted dogwood .dw policies and \`${DOGWOOD_BINARY_NAME}\` is available, but ${plan.blocked}, so full .dw validation did not run. See chant #1659.`,
+                    lexicon: plan.lexicon,
+                },
+            ];
+        }
+        const diagnostics = [];
+        for (const prepared of plan.bundles) {
+            const where = describeBundle(prepared);
+            const result = runDogwoodValidate(binary.path, prepared.bundle);
+            if (result.kind === "unusable") {
+                diagnostics.push({
+                    checkId: "DWDE010",
+                    severity: "warning",
+                    message: `Dogwood policy set ${where} could not be validated — ${result.reason}. The policy set was neither accepted nor rejected.`,
+                    entity: prepared.source,
+                    lexicon: prepared.lexicon,
+                });
+                continue;
+            }
+            if (result.kind === "fatal") {
+                for (const finding of [result.error, ...result.related]) {
+                    diagnostics.push({
+                        checkId: "DWDE010",
+                        severity: "error",
+                        message: `Dogwood policy set ${where} could not be parsed or lowered: ${formatDogwoodDiagnostic(finding)}`,
+                        entity: prepared.source,
+                        lexicon: prepared.lexicon,
+                    });
+                }
+                continue;
+            }
+            if (result.kind === "rejected") {
+                for (const finding of result.errors) {
+                    diagnostics.push({
+                        checkId: "DWDE010",
+                        severity: "error",
+                        message: `Dogwood policy set ${where} fails \`dogwood validate\`: ${formatDogwoodDiagnostic(finding)}`,
+                        entity: prepared.source,
+                        lexicon: prepared.lexicon,
+                    });
+                }
+            }
+            // Upstream's own warnings ride along at warning severity. They do not
+            // fail `dogwood validate` (`passed` ignores them), and they should not
+            // fail a build either — but dropping them would throw away the half of
+            // the report that says a policy is legal and pointless.
+            for (const finding of result.warnings) {
+                diagnostics.push({
+                    checkId: "DWDE010",
+                    severity: "warning",
+                    message: `Dogwood policy set ${where} draws a \`dogwood validate\` warning: ${formatDogwoodDiagnostic(finding)}`,
+                    entity: prepared.source,
+                    lexicon: prepared.lexicon,
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/dwde011.js

@@ -0,0 +1,67 @@
+import { findDogwoodBinary, runDogwoodLower } from "../../dogwood/cli.js";
+import { describeBundle, planDogwoodRuns } from "./dogwood-helpers.js";
+import { loadWasm, validatePolicySet } from "./wasm-helpers.js";
+export const dwde011 = {
+    id: "DWDE011",
+    description: "The Cedar `dogwood lower` produces validates clean against the augmented schema (cedar-wasm validate)",
+    check(ctx) {
+        const plan = planDogwoodRuns(ctx);
+        if (!plan.hasPolicies || plan.blocked || plan.bundles.length === 0)
+            return [];
+        const binary = findDogwoodBinary();
+        if (!binary)
+            return [];
+        // A missing validator is not this check's finding to report; the cedar leg
+        // says so already through CEDC010.
+        const wasm = loadWasm();
+        if (!wasm)
+            return [];
+        const diagnostics = [];
+        for (const prepared of plan.bundles) {
+            const where = describeBundle(prepared);
+            const lowered = runDogwoodLower(binary.path, prepared.bundle);
+            if (lowered.kind === "unusable") {
+                diagnostics.push({
+                    checkId: "DWDE011",
+                    severity: "warning",
+                    message: `Dogwood policy set ${where} could not be lowered to Cedar — ${lowered.reason}. Its non-temporal body was not checked by Cedar's validator.`,
+                    entity: prepared.source,
+                    lexicon: prepared.lexicon,
+                });
+                continue;
+            }
+            if (lowered.kind === "fatal") {
+                // The same fatal DWDE010 reports from its own run. Saying it twice
+                // helps nobody, so this arm stays quiet and lets the validate leg own
+                // the parse/lower channel.
+                continue;
+            }
+            const { cedarPolicies, cedarSchema } = lowered.value;
+            // The lowered policies go in as Cedar text. cedar-wasm synthesizes ids
+            // (`policy0`, `policy1`) for a bare-string set and does not read `@id`
+            // annotations as ids (#1648), so a finding names the .dw file it came
+            // from as well as the id the validator used.
+            const outcome = validatePolicySet(wasm, { staticPolicies: cedarPolicies }, cedarSchema);
+            if (outcome.failure) {
+                diagnostics.push({
+                    checkId: "DWDE011",
+                    severity: "error",
+                    message: `The Cedar lowered from dogwood policy set ${where} could not be validated: ${outcome.failure}`,
+                    entity: prepared.source,
+                    lexicon: prepared.lexicon,
+                });
+                continue;
+            }
+            for (const finding of outcome.errors) {
+                diagnostics.push({
+                    checkId: "DWDE011",
+                    severity: "error",
+                    message: `The Cedar lowered from dogwood policy set ${where} fails Cedar validation (lowered policy "${finding.policyId}"): ${finding.message}`,
+                    entity: prepared.source,
+                    lexicon: prepared.lexicon,
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/dwds010.js

@@ -0,0 +1,21 @@
+import { dogwoodSchemaFiles, readEventSchema } from "../../dogwood/scan.js";
+export const dwds010 = {
+    id: "DWDS010",
+    description: "An emitted dogwood event schema pins its temporal predicates to a request-side value",
+    check(ctx) {
+        const diagnostics = [];
+        for (const schema of dogwoodSchemaFiles(ctx)) {
+            const facts = readEventSchema(schema.text);
+            if (facts.kinds.length === 0 || facts.hasPin)
+                continue;
+            diagnostics.push({
+                checkId: "DWDS010",
+                severity: "warning",
+                message: `Dogwood event schema "${schema.source}" declares no pinned field, so temporal predicates correlate across every principal — wider than upstream's default, which pins callerPrincipal to the deciding request's principal. Add a pinned field, or record why cross-principal correlation is wanted.`,
+                entity: schema.source,
+                lexicon: schema.lexicon,
+            });
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/index.js

@@ -0,0 +1,36 @@
+import { cedc010 } from "./cedc010.js";
+import { cedc011 } from "./cedc011.js";
+import { cedc012 } from "./cedc012.js";
+import { cedc013 } from "./cedc013.js";
+import { cedc014 } from "./cedc014.js";
+import { cede010 } from "./cede010.js";
+import { cede011 } from "./cede011.js";
+import { ceds010 } from "./ceds010.js";
+import { ceds011 } from "./ceds011.js";
+import { ceds012 } from "./ceds012.js";
+import { dwdc010 } from "./dwdc010.js";
+import { dwdc011 } from "./dwdc011.js";
+import { dwdc012 } from "./dwdc012.js";
+import { dwdc013 } from "./dwdc013.js";
+import { dwde010 } from "./dwde010.js";
+import { dwde011 } from "./dwde011.js";
+import { dwds010 } from "./dwds010.js";
+export const postSynthChecks = [
+    cedc010,
+    cedc011,
+    cedc012,
+    cedc013,
+    cedc014,
+    cede010,
+    cede011,
+    ceds010,
+    ceds011,
+    ceds012,
+    dwdc010,
+    dwdc011,
+    dwdc012,
+    dwdc013,
+    dwde010,
+    dwde011,
+    dwds010,
+];

package/dist/lint/post-synth/wasm-helpers.js

@@ -0,0 +1,234 @@
+/**
+ * The `cedar-wasm` seam for the cedar post-synth checks.
+ *
+ * Cedar's real parser and validator ship as `@cedar-policy/cedar-wasm`, which
+ * runs in-process — no CLI on PATH, no Docker. Everything the checks need from
+ * it goes through this module so the traps live in one place. The traps, all
+ * of them empirically verified against 4.12.0 (chant #1648):
+ *
+ * 1. **`type: "success"` does not mean valid.** `failure` means the *call*
+ *    failed; `success` means validation *ran*, and can carry any number of
+ *    `validationErrors`. {@link validatePolicySet} asserts both.
+ * 2. **`validationErrors` ordering is non-deterministic** — the validator
+ *    parallelizes across policies and never re-sorts. Forty identical calls
+ *    produced six distinct orderings. Everything this module returns is sorted
+ *    by `policyId` then `message`, so a check's output is stable.
+ * 3. **Malformed input throws instead of returning a failure answer.** Missing
+ *    fields on a call struct raise a bare serde `Error` whose `line 1 column N`
+ *    refers to the internal call struct, not to anything the user wrote — it is
+ *    meaningless to surface. {@link call} wraps every entry point and normalizes
+ *    both channels into one result type.
+ * 4. **A bare-string policy set gets synthesized ids** (`policy0`, `policy1`),
+ *    and `@id` annotations do *not* become the policy id. Everything here
+ *    passes `staticPolicies` as a `Record<PolicyId, Policy>` keyed by chant's
+ *    own ids, so a diagnostic names something a reader can find.
+ * 5. **Only `strict` validation mode exists** in this build; any other value
+ *    throws. The settings are left at their default rather than passed.
+ *
+ * Only the `/nodejs` flavor is imported. The root/`esm` flavor imports the
+ * `.wasm` as an ES module, which Bun cannot start (`__wbindgen_start is not a
+ * function`) and Node only supports behind an experimental warning printed on
+ * every run; `/web` needs an explicit `initSync`. `/nodejs` is the one flavor
+ * that loads under `node`, `tsx`, `vitest`, and `bun` alike.
+ *
+ * Excluded from check auto-discovery by the "helper" filename filter.
+ */
+import { createRequire } from "module";
+import { isRecord, } from "./cedar-helpers.js";
+let cached;
+let loadError;
+/**
+ * The wasm module, loaded on first use.
+ *
+ * Lazy and `require`-based on purpose. The post-synth barrel is imported
+ * statically by `plugin.ts`, and every `chant lint`/`chant audit` run loads
+ * every active lexicon's plugin — a top-level import would pull 4 MB of wasm
+ * into any build that merely has cedar installed. `check()` is synchronous, so
+ * `await import()` is not available; `createRequire` is. The `/nodejs` flavor
+ * is CommonJS with a synchronous `readFileSync` init, so there is nothing to
+ * await anyway.
+ */
+export function loadWasm() {
+    if (cached || loadError)
+        return cached;
+    try {
+        const require = createRequire(import.meta.url);
+        cached = require("@cedar-policy/cedar-wasm/nodejs");
+    }
+    catch (err) {
+        loadError = err instanceof Error ? err.message : String(err);
+    }
+    return cached;
+}
+/** Why the wasm could not be loaded, if it could not be. */
+export function wasmLoadError() {
+    loadWasm();
+    return loadError;
+}
+/** Reset the module cache. Test-only — lets a test exercise the load-failure path. */
+export function resetWasmCache() {
+    cached = undefined;
+    loadError = undefined;
+}
+/**
+ * Run a wasm call, turning a thrown serde error into a result rather than an
+ * exception (trap 3 above). The thrown message is deliberately not passed
+ * through verbatim: its positions point into the internal call struct.
+ */
+export function call(what, fn) {
+    try {
+        return { ok: true, value: fn() };
+    }
+    catch (err) {
+        const raw = err instanceof Error ? err.message : String(err);
+        // Strip the internal `at line 1 column 42` suffix — it locates a field in
+        // the serialized call struct, never anything in the user's policy.
+        const message = raw.replace(/\s+at line \d+ column \d+\.?$/, "");
+        return { ok: false, message: `${what} could not be run by cedar-wasm: ${message}` };
+    }
+}
+/** The first line of a Cedar `DetailedError`, with its `help` when it has one. */
+export function describeError(error) {
+    return error.help ? `${error.message} (${error.help})` : error.message;
+}
+// ── Condition bodies ──────────────────────────────────────────────
+/**
+ * chant's serializer carries a `when`/`unless` body as Cedar expression
+ * *source* under a `__expr` key, because the authored model holds expression
+ * strings until schema-driven codegen (#1650) makes them typed trees. `__expr`
+ * is not part of Cedar's JSON policy grammar — the deserializer rejects it
+ * ("unknown variant `__expr`") — so anything handed to the wasm has to have
+ * those bodies parsed into real expression JSON first.
+ *
+ * There is no expression-level entry point in the package, so the expression
+ * is parsed inside a throwaway policy and the resulting condition body lifted
+ * back out. A source expression that does not parse is the finding CEDC011
+ * reports.
+ */
+export const EXPR_KEY = "__expr";
+function parseExpression(wasm, expression) {
+    const answer = call("condition expression", () => wasm.policyToJson(`permit(principal, action, resource) when { ${expression} };`));
+    if (!answer.ok)
+        return answer;
+    if (answer.value.type === "failure") {
+        return { ok: false, message: answer.value.errors.map(describeError).join("; ") };
+    }
+    const conditions = answer.value.json.conditions;
+    const body = Array.isArray(conditions) && isRecord(conditions[0]) ? conditions[0].body : undefined;
+    if (body === undefined)
+        return { ok: false, message: "expression parsed to no condition body" };
+    return { ok: true, value: body };
+}
+/** Replace every `__expr` body in a policy set with parsed expression JSON. */
+export function normalizePolicySet(wasm, set) {
+    const staticPolicies = {};
+    const templates = {};
+    const expressionFailures = [];
+    for (const entry of set.entries) {
+        const target = entry.template ? templates : staticPolicies;
+        target[entry.key] = normalizePolicy(wasm, entry.key, entry.policy, expressionFailures);
+    }
+    const doc = set.doc ?? {};
+    const policySet = {
+        staticPolicies,
+        templates,
+        templateLinks: Array.isArray(doc.templateLinks) ? doc.templateLinks : [],
+    };
+    return { policySet, expressionFailures };
+}
+function normalizePolicy(wasm, key, policy, failures) {
+    if (!Array.isArray(policy.conditions))
+        return policy;
+    const conditions = policy.conditions.map((clause) => {
+        if (!isRecord(clause) || !isRecord(clause.body))
+            return clause;
+        const expression = clause.body[EXPR_KEY];
+        if (typeof expression !== "string")
+            return clause;
+        const parsed = parseExpression(wasm, expression);
+        if (!parsed.ok) {
+            failures.push({
+                key,
+                kind: typeof clause.kind === "string" ? clause.kind : "when",
+                expression,
+                message: parsed.message,
+            });
+            // Leave a body the deserializer accepts so the rest of the set still
+            // validates — the unparseable clause is reported by CEDC011, not by a
+            // cascade of confusing structural errors from every other check.
+            return { ...clause, body: { Value: true } };
+        }
+        return { ...clause, body: parsed.value };
+    });
+    return { ...policy, conditions };
+}
+/**
+ * The project's Cedar schema, if the build emitted one beside the policies.
+ *
+ * Two forms, both of which the wasm accepts — but only as the right JS type: a
+ * `string` is *always* read as human-readable `.cedarschema`, never as JSON, so
+ * a `.cedarschema.json` file has to be `JSON.parse`d into a live object first
+ * or the parser reports "unexpected token `{`" against perfectly valid JSON.
+ *
+ * Reads `ctx.outputs` only. Nothing emits a schema today — schema-driven
+ * codegen is #1650 — which is exactly why CEDE010 says so out loud instead of
+ * passing silently.
+ */
+export function findSchema(ctx) {
+    for (const [, output] of ctx.outputs) {
+        if (typeof output === "string")
+            continue;
+        for (const [filename, content] of Object.entries(output.files ?? {})) {
+            if (typeof content !== "string")
+                continue;
+            if (filename.endsWith(".cedarschema.json")) {
+                try {
+                    const parsed = JSON.parse(content);
+                    if (isRecord(parsed))
+                        return { schema: parsed, source: filename };
+                }
+                catch {
+                    continue; // a schema that is not JSON is not a schema we can use
+                }
+            }
+            else if (filename.endsWith(".cedarschema")) {
+                return { schema: content, source: filename };
+            }
+        }
+    }
+    return undefined;
+}
+function sortFindings(findings) {
+    return [...findings].sort((a, b) => a.policyId.localeCompare(b.policyId) || a.message.localeCompare(b.message));
+}
+function flatten(errors) {
+    return errors.map((e) => ({ policyId: e.policyId, message: describeError(e.error) }));
+}
+/** Validate a normalized policy set against a schema. Never throws. */
+export function validatePolicySet(wasm, policySet, schema) {
+    const answer = call("validate", () => wasm.validate({ schema, policies: policySet }));
+    if (!answer.ok)
+        return { errors: [], warnings: [], failure: answer.message };
+    if (answer.value.type === "failure") {
+        return {
+            errors: [],
+            warnings: [],
+            failure: answer.value.errors.map(describeError).join("; "),
+        };
+    }
+    // `success` only means validation RAN. The findings are in the arrays.
+    return {
+        errors: sortFindings(flatten(answer.value.validationErrors)),
+        warnings: sortFindings(flatten(answer.value.validationWarnings)),
+    };
+}
+/** Parse-only gate, for when there is no schema to validate against. */
+export function parsePolicySet(wasm, policySet) {
+    const answer = call("checkParsePolicySet", () => wasm.checkParsePolicySet(policySet));
+    if (!answer.ok)
+        return answer;
+    if (answer.value.type === "failure") {
+        return { ok: true, value: answer.value.errors.map(describeError).sort() };
+    }
+    return { ok: true, value: [] };
+}

package/dist/lint/rules/index.js

@@ -0,0 +1,9 @@
+import { cedarPolicyShapeRule } from "./policy-shape.js";
+export { cedarPolicyShapeRule, CEDAR_EFFECTS } from "./policy-shape.js";
+/**
+ * All lint rules provided by this lexicon (imported by plugin.ts's lintRules()).
+ *
+ * Pre-synth rules are wired by hand — unlike post-synth checks, they are not
+ * auto-discovered. Add the import above and the entry below.
+ */
+export const rules = [cedarPolicyShapeRule];

package/dist/lint/rules/policy-shape.js

@@ -0,0 +1,114 @@
+import { ts } from "@intentius/chant/lint/typescript";
+/** Module specifiers whose exports construct Cedar declarables. */
+const CEDAR_MODULE = /chant-lexicon-cedar/;
+/** The two effects Cedar has. */
+export const CEDAR_EFFECTS = ["permit", "forbid"];
+function importedCedarBindings(sourceFile) {
+    const names = new Set();
+    for (const statement of sourceFile.statements) {
+        if (!ts.isImportDeclaration(statement))
+            continue;
+        if (!ts.isStringLiteral(statement.moduleSpecifier))
+            continue;
+        if (!CEDAR_MODULE.test(statement.moduleSpecifier.text))
+            continue;
+        const bindings = statement.importClause?.namedBindings;
+        if (bindings && ts.isNamedImports(bindings)) {
+            for (const element of bindings.elements)
+                names.add(element.name.text);
+        }
+        if (statement.importClause?.name)
+            names.add(statement.importClause.name.text);
+    }
+    return names;
+}
+/** The callee identifier of a `new X(…)` / `X(…)` expression, if it has one. */
+function calleeName(node) {
+    return ts.isIdentifier(node.expression) ? node.expression.text : undefined;
+}
+/** The last object-literal argument — where chant resources carry their props. */
+function propsLiteral(node) {
+    const args = [...(node.arguments ?? [])];
+    for (let i = args.length - 1; i >= 0; i--) {
+        const arg = args[i];
+        if (ts.isObjectLiteralExpression(arg))
+            return arg;
+    }
+    return undefined;
+}
+function property(obj, key) {
+    for (const prop of obj.properties) {
+        if (!ts.isPropertyAssignment(prop))
+            continue;
+        if (!ts.isIdentifier(prop.name) && !ts.isStringLiteral(prop.name))
+            continue;
+        if (prop.name.text === key)
+            return prop;
+    }
+    return undefined;
+}
+function lineCol(sourceFile, node) {
+    const { line, character } = sourceFile.getLineAndCharacterOfPosition(node.getStart());
+    return { line: line + 1, column: character + 1 };
+}
+export const cedarPolicyShapeRule = {
+    id: "CEDC001",
+    severity: "error",
+    category: "correctness",
+    description: "A Cedar policy declaration must use effect permit or forbid, and must not carry an empty when/unless clause",
+    check(context) {
+        const { sourceFile } = context;
+        const diagnostics = [];
+        const cedarBindings = importedCedarBindings(sourceFile);
+        if (cedarBindings.size === 0)
+            return diagnostics;
+        const report = (node, message) => {
+            const { line, column } = lineCol(sourceFile, node);
+            diagnostics.push({
+                file: sourceFile.fileName,
+                line,
+                column,
+                ruleId: "CEDC001",
+                severity: "error",
+                message,
+            });
+        };
+        function inspect(node) {
+            const callee = calleeName(node);
+            if (!callee || !cedarBindings.has(callee))
+                return;
+            const props = propsLiteral(node);
+            if (!props)
+                return;
+            const effect = property(props, "effect");
+            if (effect && ts.isStringLiteral(effect.initializer)) {
+                const value = effect.initializer.text;
+                if (!CEDAR_EFFECTS.includes(value)) {
+                    report(effect, `Cedar policy effect "${value}" is not a Cedar effect — the language has only permit and forbid, and anything that is not "forbid" is emitted as a permit. Write effect: "forbid" if that is what was meant.`);
+                }
+            }
+            for (const clause of ["when", "unless"]) {
+                const guard = property(props, clause);
+                if (!guard)
+                    continue;
+                const entries = ts.isArrayLiteralExpression(guard.initializer)
+                    ? guard.initializer.elements
+                    : [guard.initializer];
+                for (const entry of entries) {
+                    if (!ts.isStringLiteral(entry) && !ts.isNoSubstitutionTemplateLiteral(entry))
+                        continue;
+                    if (entry.text.trim() !== "")
+                        continue;
+                    report(entry, `Cedar policy has an empty ${clause} clause. An empty guard serializes to ${clause} {  }, which is not a Cedar expression and makes the whole policy set unparseable — write the condition, or drop the entry.`);
+                }
+            }
+        }
+        function visit(node) {
+            if (ts.isCallExpression(node) || ts.isNewExpression(node))
+                inspect(node);
+            ts.forEachChild(node, visit);
+        }
+        visit(sourceFile);
+        return diagnostics;
+    },
+};

package/dist/lsp/completions.js

@@ -0,0 +1,52 @@
+import { lexiconCompletions } from "@intentius/chant/lsp/lexicon-providers";
+import { cedarIndex, cedarRegistry } from "./registry.js";
+/**
+ * Completions over the schema-derived registry.
+ *
+ * Two shapes come out of core's generic provider: class names after `new `,
+ * and property names inside a constructor's object literal. Both are useful
+ * here — `new Policy({` completes `effect`/`principal`/`action`/…, and
+ * `new Doc` completes `Document`.
+ *
+ * The third shape is Cedar's own: a scope names an *action constant*, not a
+ * class, and those are plain `const` exports rather than constructors, so no
+ * `new ` ever precedes them. {@link actionCompletions} covers that position.
+ */
+export function completions(ctx) {
+    const generic = lexiconCompletions(ctx, cedarIndex(), "Cedar declaration");
+    if (generic.length > 0)
+        return generic;
+    return actionCompletions(ctx);
+}
+/**
+ * Action constants in a scope position.
+ *
+ * `action: { eq: <cursor> }` and `action: { in: [<cursor>` are where an action
+ * is named, and the generated constants (`ReadAction`, `WriteAction`, …) are
+ * the only correct values. Matching on the surrounding text rather than on a
+ * parsed AST keeps this cheap and is what the other lexicons' providers do.
+ */
+export function actionCompletions(ctx) {
+    const linePrefix = ctx.linePrefix ?? "";
+    if (!/\baction\s*:\s*\{\s*(eq|in)\s*:\s*\[?\s*[A-Za-z]*$/.test(linePrefix))
+        return [];
+    const prefix = (ctx.wordAtCursor ?? "").toLowerCase();
+    const registry = cedarRegistry();
+    return Object.entries(registry)
+        .filter(([, entry]) => entry.kind === "resource" && entry.resourceType.includes("::Action::"))
+        .filter(([className]) => !prefix || className.toLowerCase().startsWith(prefix))
+        .sort(([a], [b]) => a.localeCompare(b))
+        .map(([className, entry]) => ({
+        label: className,
+        insertText: className,
+        kind: "resource",
+        detail: entry.resourceType,
+        documentation: [
+            `Cedar action: \`${entry.resourceType}\``,
+            entry.principalTypes?.length ? `Principals: ${entry.principalTypes.join(", ")}` : "",
+            entry.resourceTypes?.length ? `Resources: ${entry.resourceTypes.join(", ")}` : "",
+        ]
+            .filter(Boolean)
+            .join("\n"),
+    }));
+}