aws-iam-language-server 0.0.15 → 0.0.17

package/src/data/servicereference/services.json

@@ -1 +1 @@
-["a2c","a4b","access-analyzer","account","acm","acm-pca","aco-automation","action-recommendations","activate","aidevops","aiops","airflow","airflow-serverless","amplify","amplifybackend","amplifyuibuilder","aoss","apigateway","app-integrations","appconfig","appfabric","appflow","application-autoscaling","application-signals","application-transformation","applicationinsights","appmesh","appmesh-preview","apprunner","appstream","appstudio","appsync","apptest","aps","arc-region-switch","arc-zonal-shift","arsenal","artifact","athena","auditmanager","autoscaling","autoscaling-plans","aws-marketplace","aws-marketplace-management","aws-mcp","aws-portal","awsconnector","b2bi","backup","backup-gateway","backup-search","backup-storage","batch","bcm-dashboards","bcm-data-exports","bcm-pricing-calculator","bcm-recommended-actions","bedrock","bedrock-agentcore","bedrock-mantle","billing","billingconductor","braket","budgets","bugbust","cases","cassandra","ce","chatbot","chime","cleanrooms","cleanrooms-ml","cloud9","clouddirectory","cloudformation","cloudfront","cloudfront-keyvaluestore","cloudhsm","cloudsearch","cloudshell","cloudtrail","cloudtrail-data","cloudwatch","codeartifact","codebuild","codecatalyst","codecommit","codeconnections","codedeploy","codedeploy-commands-secure","codeguru","codeguru-profiler","codeguru-reviewer","codeguru-security","codepipeline","codestar","codestar-connections","codestar-notifications","codewhisperer","cognito-identity","cognito-idp","cognito-sync","comprehend","comprehendmedical","compute-optimizer","config","connect","connect-campaigns","consoleapp","consolidatedbilling","controlcatalog","controltower","cost-optimization-hub","cur","customer-verification","databrew","dataexchange","datapipeline","datasync","datazone","dax","dbqms","deadline","detective","devicefarm","devops-guru","directconnect","discovery","dlm","dms","docdb-elastic","drs","ds","ds-data","dsql","dynamodb","ebs","ec2","ec2-instance-connect","ec2messages","ecr","ecr-public","ecs","ecs-mcp","eks","eks-auth","eks-mcp","elasticache","elasticbeanstalk","elasticfilesystem","elasticloadbalancing","elasticmapreduce","elastictranscoder","elemental-activations","elemental-appliances-software","elemental-inference","elemental-support-cases","elemental-support-content","emr-containers","emr-serverless","entityresolution","es","events","evidently","evs","execute-api","finspace","finspace-api","firehose","fis","fms","forecast","frauddetector","freertos","freetier","fsx","gamelift","gameliftstreams","geo","geo-maps","geo-places","geo-routes","glacier","globalaccelerator","glue","grafana","greengrass","groundstation","groundtruthlabeling","guardduty","health","health-agent","healthlake","honeycode","iam","identity-sync","identitystore","identitystore-auth","imagebuilder","importexport","inspector","inspector-scan","inspector2","inspector2-telemetry","interconnect","internetmonitor","invoicing","iot","iot-device-tester","iotanalytics","iotdeviceadvisor","iotevents","iotfleethub","iotfleetwise","iotjobsdata","iotmanagedintegrations","iotsitewise","iottwinmaker","iotwireless","iq","iq-permission","ivs","ivschat","kafka","kafka-cluster","kafkaconnect","kendra","kendra-ranking","kinesis","kinesisanalytics","kinesisvideo","kms","lakeformation","lambda","launchwizard","lex","license-manager","license-manager-linux-subscriptions","license-manager-user-subscriptions","lightsail","logs","lookoutequipment","lookoutmetrics","lookoutvision","m2","machinelearning","macie2","managedblockchain","managedblockchain-query","mapcredits","marketplacecommerceanalytics","mechanicalturk","mediaconnect","mediaconvert","mediaimport","medialive","mediapackage","mediapackage-vod","mediapackagev2","mediastore","mediatailor","medical-imaging","memorydb","mgh","mgn","migrationhub-orchestrator","migrationhub-strategy","mobileanalytics","mobiletargeting","monitron","mpa","mq","neptune-db","neptune-graph","network-firewall","network-security-director","networkflowmonitor","networkmanager","networkmanager-chat","networkmonitor","nimble","notifications","notifications-contacts","nova-act","oam","observabilityadmin","odb","omics","one","opensearch","opsworks","opsworks-cm","organizations","osis","outposts","panorama","partnercentral","partnercentral-account-management","payment-cryptography","payments","pca-connector-ad","pca-connector-scep","pcs","personalize","pi","pipes","polly","pricing","pricingplanmanager","private-networks","profile","proton","purchase-orders","q","qapps","qbusiness","qdeveloper","qldb","quicksight","ram","rbin","rds","rds-data","rds-db","redshift","redshift-data","redshift-serverless","refactor-spaces","rekognition","repostspace","resiliencehub","resource-explorer","resource-explorer-2","resource-groups","rhelkb","robomaker","rolesanywhere","route53","route53-recovery-cluster","route53-recovery-control-config","route53-recovery-readiness","route53domains","route53globalresolver","route53profiles","route53resolver","rtbfabric","rum","s3","s3-object-lambda","s3-outposts","s3express","s3tables","s3vectors","sagemaker","sagemaker-data-science-assistant","sagemaker-geospatial","sagemaker-mlflow","sagemaker-unified-studio-mcp","savingsplans","scheduler","schemas","scn","sdb","secretsmanager","security-ir","securityagent","securityhub","securitylake","serverlessrepo","servicecatalog","servicediscovery","serviceextract","servicequotas","ses","shield","signer","signin","simspaceweaver","sms","sms-voice","snow-device-management","snowball","sns","social-messaging","sqlworkbench","sqs","ssm","ssm-contacts","ssm-guiconnect","ssm-incidents","ssm-quicksetup","ssm-sap","ssmmessages","sso","sso-directory","sso-oauth","states","storagegateway","sts","support","support-console","supportapp","supportplans","sustainability","swf","synthetics","tag","tax","textract","thinclient","timestream","timestream-influxdb","tiros","tnb","transcribe","transfer","transform","transform-custom","translate","trustedadvisor","ts","user-subscriptions","uxc","vendor-insights","verified-access","verifiedpermissions","voiceid","vpc-lattice","vpc-lattice-svcs","vpce","waf","waf-regional","wafv2","wam","wellarchitected","wickr","wisdom","workdocs","worklink","workmail","workmailmessageflow","workspaces","workspaces-instances","workspaces-web","xray"]
+["a2c","a4b","access-analyzer","account","acm","acm-pca","aco-automation","action-recommendations","activate","aidevops","aiops","airflow","airflow-serverless","amplify","amplifybackend","amplifyuibuilder","aoss","apigateway","app-integrations","appconfig","appfabric","appflow","application-autoscaling","application-signals","application-transformation","applicationinsights","appmesh","appmesh-preview","apprunner","appstream","appstudio","appsync","apptest","aps","arc-region-switch","arc-zonal-shift","arsenal","artifact","athena","auditmanager","autoscaling","autoscaling-plans","aws-external-anthropic","aws-marketplace","aws-marketplace-management","aws-mcp","aws-portal","awsconnector","b2bi","backup","backup-gateway","backup-search","backup-storage","batch","bcm-dashboards","bcm-data-exports","bcm-pricing-calculator","bcm-recommended-actions","bedrock","bedrock-agentcore","bedrock-mantle","billing","billingconductor","braket","budgets","bugbust","cases","cassandra","ce","chatbot","chime","cleanrooms","cleanrooms-ml","cloud9","clouddirectory","cloudformation","cloudfront","cloudfront-keyvaluestore","cloudhsm","cloudsearch","cloudshell","cloudtrail","cloudtrail-data","cloudwatch","codeartifact","codebuild","codecatalyst","codecommit","codeconnections","codedeploy","codedeploy-commands-secure","codeguru","codeguru-profiler","codeguru-reviewer","codeguru-security","codepipeline","codestar","codestar-connections","codestar-notifications","codewhisperer","cognito-identity","cognito-idp","cognito-sync","comprehend","comprehendmedical","compute-optimizer","config","connect","connect-campaigns","consoleapp","consolidatedbilling","controlcatalog","controltower","cost-optimization-hub","cur","customer-verification","databrew","dataexchange","datapipeline","datasync","datazone","dax","dbqms","deadline","detective","devicefarm","devops-guru","directconnect","discovery","dlm","dms","docdb-elastic","drs","ds","ds-data","dsql","dynamodb","ebs","ec2","ec2-instance-connect","ec2messages","ecr","ecr-public","ecs","ecs-mcp","eks","eks-auth","eks-mcp","elasticache","elasticbeanstalk","elasticfilesystem","elasticloadbalancing","elasticmapreduce","elastictranscoder","elemental-activations","elemental-appliances-software","elemental-inference","elemental-support-cases","elemental-support-content","emr-containers","emr-serverless","entityresolution","es","events","evidently","evs","execute-api","finspace","finspace-api","firehose","fis","fms","forecast","frauddetector","freertos","freetier","fsx","gamelift","gameliftstreams","geo","geo-maps","geo-places","geo-routes","glacier","globalaccelerator","glue","grafana","greengrass","groundstation","groundtruthlabeling","guardduty","health","health-agent","healthlake","honeycode","iam","identity-sync","identitystore","identitystore-auth","imagebuilder","importexport","inspector","inspector-scan","inspector2","inspector2-telemetry","interconnect","internetmonitor","invoicing","iot","iot-device-tester","iotanalytics","iotdeviceadvisor","iotevents","iotfleethub","iotfleetwise","iotjobsdata","iotmanagedintegrations","iotsitewise","iottwinmaker","iotwireless","iq","iq-permission","ivs","ivschat","kafka","kafka-cluster","kafkaconnect","kendra","kendra-ranking","kinesis","kinesisanalytics","kinesisvideo","kms","lakeformation","lambda","launchwizard","lex","license-manager","license-manager-linux-subscriptions","license-manager-user-subscriptions","lightsail","logs","lookoutequipment","lookoutmetrics","lookoutvision","m2","machinelearning","macie2","managedblockchain","managedblockchain-query","mapcredits","marketplacecommerceanalytics","mechanicalturk","mediaconnect","mediaconvert","mediaimport","medialive","mediapackage","mediapackage-vod","mediapackagev2","mediastore","mediatailor","medical-imaging","memorydb","mgh","mgn","migrationhub-orchestrator","migrationhub-strategy","mobileanalytics","mobiletargeting","monitron","mpa","mq","neptune-db","neptune-graph","network-firewall","network-security-director","networkflowmonitor","networkmanager","networkmanager-chat","networkmonitor","nimble","notifications","notifications-contacts","nova-act","oam","observabilityadmin","odb","omics","one","opensearch","opsworks","opsworks-cm","organizations","osis","outposts","panorama","partnercentral","partnercentral-account-management","payment-cryptography","payments","pca-connector-ad","pca-connector-scep","pcs","personalize","pi","pipes","polly","pricing","pricingplanmanager","private-networks","profile","proton","purchase-orders","q","qapps","qbusiness","qdeveloper","qldb","quicksight","ram","rbin","rds","rds-data","rds-db","redshift","redshift-data","redshift-serverless","refactor-spaces","rekognition","repostspace","resiliencehub","resource-explorer","resource-explorer-2","resource-groups","rhelkb","robomaker","rolesanywhere","route53","route53-recovery-cluster","route53-recovery-control-config","route53-recovery-readiness","route53domains","route53globalresolver","route53profiles","route53resolver","rtbfabric","rum","s3","s3-object-lambda","s3-outposts","s3express","s3files","s3tables","s3vectors","sagemaker","sagemaker-data-science-assistant","sagemaker-geospatial","sagemaker-mlflow","sagemaker-unified-studio-mcp","savingsplans","scheduler","schemas","scn","sdb","secretsmanager","security-ir","securityagent","securityhub","securitylake","serverlessrepo","servicecatalog","servicediscovery","serviceextract","servicequotas","ses","shield","signer","signin","simspaceweaver","sms","sms-voice","snow-device-management","snowball","sns","social-messaging","sqlworkbench","sqs","ssm","ssm-contacts","ssm-guiconnect","ssm-incidents","ssm-quicksetup","ssm-sap","ssmmessages","sso","sso-directory","sso-oauth","states","storagegateway","sts","support","support-console","supportapp","supportplans","sustainability","swf","synthetics","tag","tax","textract","thinclient","timestream","timestream-influxdb","tiros","tnb","transcribe","transfer","transform","transform-custom","translate","trustedadvisor","ts","user-subscriptions","uxc","vendor-insights","verified-access","verifiedpermissions","voiceid","vpc-lattice","vpc-lattice-svcs","vpce","waf","waf-regional","wafv2","wam","wellarchitected","wickr","wisdom","workdocs","worklink","workmail","workmailmessageflow","workspaces","workspaces-instances","workspaces-web","xray"]

package/src/extension.js

@@ -9,6 +9,9 @@ export function activate(context) {
     };
     client = new LanguageClient('aws-iam-language-server', 'AWS IAM Language Server', serverOptions, {
         documentSelector: [{ language: 'json' }, { language: 'yaml' }, { language: 'terraform' }, { language: 'opentofu' }],
+        synchronize: {
+            configurationSection: 'aws-iam-language-server',
+        },
     });
     client.start();
 }

package/src/handlers/completion/action-value.d.ts

@@ -1,6 +1,4 @@
 import type { CompletionList } from 'vscode-languageserver';
 import type { ActionValueLocation } from '../../lib/iam-policy/location.ts';
-import type { Action } from '../../lib/iam-policy/reference/types.ts';
 import { type CompletionContext } from './index.ts';
 export declare function completeActionValue(location: ActionValueLocation, context: CompletionContext): CompletionList;
-export declare function formatActionDocumentation(action: Action): string;

package/src/handlers/completion/action-value.js

@@ -1,4 +1,5 @@
 import { CompletionItemKind, MarkupKind } from 'vscode-languageserver';
+import { formatActionDocumentation } from "../../lib/iam-policy/reference/documentation.js";
 import { ServiceReference } from "../../lib/iam-policy/reference/services.js";
 import { partialRange } from "./index.js";
 export function completeActionValue(location, context) {
@@ -44,20 +45,3 @@ export function completeActionValue(location, context) {
     }
     return { items, isIncomplete: false };
 }
-export function formatActionDocumentation(action) {
-    const parts = [];
-    if (action.accessLevel)
-        parts.push(`**Access Level**: ${action.accessLevel}`);
-    if (action.resourceTypes && action.resourceTypes.length > 0) {
-        const resources = action.resourceTypes.map((resourceType) => resourceType.required ? `- \`${resourceType.name}\` *(required)*` : `- \`${resourceType.name}\``);
-        parts.push(`**Resource types**\n${resources.join('\n')}`);
-    }
-    if (action.conditionKeys.length > 0) {
-        const keys = action.conditionKeys.map((key) => `- \`${key}\``);
-        parts.push(`**Condition keys**\n${keys.join('\n')}`);
-    }
-    if (action.dependentActions && action.dependentActions.length > 0) {
-        parts.push(`**Dependent actions:** ${action.dependentActions.map((depAction) => `\`${depAction}\``).join(', ')}`);
-    }
-    return parts.join('\n\n');
-}

package/src/handlers/completion/condition-block.js

@@ -1,16 +1,6 @@
 import { CompletionItemKind, MarkupKind } from 'vscode-languageserver';
+import { conditionBlockAttributes } from "../../lib/iam-policy/reference/documentation.js";
 import { partialRange } from "./index.js";
-const conditionBlockAttributes = {
-    test: {
-        description: 'The condition operator to evaluate (e.g., `StringEquals`, `ArnLike`, `IpAddress`).',
-    },
-    variable: {
-        description: 'The condition key to evaluate (e.g., `aws:SourceIp`, `s3:prefix`).',
-    },
-    values: {
-        description: 'List of values to compare against the condition key.',
-    },
-};
 export function completeConditionBlock(location, context) {
     const siblingKeys = context.handler.getSiblingKeys(context.uri, context.position);
     const range = partialRange(context.position, location.partial.length);

package/src/handlers/completion/condition-key.d.ts

@@ -1,6 +1,4 @@
 import type { CompletionList } from 'vscode-languageserver';
 import type { ConditionKeyLocation } from '../../lib/iam-policy/location.ts';
-import type { ConditionKey, GlobalConditionKey } from '../../lib/iam-policy/reference/types.ts';
 import { type CompletionContext } from './index.ts';
 export declare function completeConditionKey(location: ConditionKeyLocation, context: CompletionContext): CompletionList;
-export declare function formatConditionKeyDocumentation(types: string[], global: GlobalConditionKey | undefined, conditionKey?: ConditionKey): string;

package/src/handlers/completion/condition-key.js

@@ -1,4 +1,5 @@
 import { CompletionItemKind, MarkupKind } from 'vscode-languageserver';
+import { formatConditionKeyDocumentation } from "../../lib/iam-policy/reference/documentation.js";
 import { ServiceReference } from "../../lib/iam-policy/reference/services.js";
 import { expandActionPattern } from "../../lib/iam-policy/wildcard.js";
 import { partialRange } from "./index.js";
@@ -30,16 +31,19 @@ export function completeConditionKey(location, context) {
             if (location.partial && !key.name.toLowerCase().startsWith(location.partial.toLowerCase()))
                 continue;
             seen.add(key.name);
-            const global = globalByName.get(key.name);
-            const service = key.name.split(':')[0];
-            const conditionKeyData = service ? ServiceReference.getConditionKey(service, key.name) : undefined;
+            const globalKey = globalByName.get(key.name);
+            const keyDocs = [];
+            if (globalKey)
+                keyDocs.push(formatConditionKeyDocumentation(globalKey));
+            if (key)
+                keyDocs.push(formatConditionKeyDocumentation(key));
             items.push({
                 label: key.name,
                 kind: CompletionItemKind.Property,
                 textEdit: { range, newText: key.name },
                 documentation: {
                     kind: MarkupKind.Markdown,
-                    value: formatConditionKeyDocumentation(key.types, global, conditionKeyData),
+                    value: keyDocs.join('\n---\n'),
                 },
             });
         }
@@ -59,26 +63,9 @@ export function completeConditionKey(location, context) {
             textEdit: { range, newText: global.name },
             documentation: {
                 kind: MarkupKind.Markdown,
-                value: formatConditionKeyDocumentation([], global),
+                value: formatConditionKeyDocumentation(global),
             },
         });
     }
     return { items, isIncomplete: false };
 }
-export function formatConditionKeyDocumentation(types, global, conditionKey) {
-    const parts = [];
-    const description = global?.description ?? conditionKey?.description;
-    if (description)
-        parts.push(description);
-    const meta = [];
-    const type = types.length > 0 ? types.join(', ') : undefined;
-    if (type)
-        meta.push(`**Type:** ${type}`);
-    if (global?.valueType === 'multi')
-        meta.push('**Value type:** Multivalued');
-    if (global?.availability)
-        meta.push(`**Availability:** ${global.availability}`);
-    if (meta.length > 0)
-        parts.push(meta.join('\n\n'));
-    return parts.join('\n\n');
-}

package/src/handlers/completion/condition-operator.js

@@ -1,5 +1,6 @@
 import { CompletionItemKind, MarkupKind } from 'vscode-languageserver';
 import { conditionOperators } from "../../lib/iam-policy/condition-operators.js";
+import { formatConditionOperatorDocumentation } from "../../lib/iam-policy/reference/documentation.js";
 import { partialRange } from "./index.js";
 export function completeConditionOperator(location, context) {
     const statement = context.handler.getStatementContext(context.uri, context.position);
@@ -17,7 +18,7 @@ export function completeConditionOperator(location, context) {
             textEdit: { range, newText: name },
             documentation: {
                 kind: MarkupKind.Markdown,
-                value: operator.description,
+                value: formatConditionOperatorDocumentation(operator),
             },
         });
     }

package/src/handlers/completion/effect-value.js

@@ -1,16 +1,20 @@
-import { CompletionItemKind } from 'vscode-languageserver';
+import { CompletionItemKind, MarkupKind } from 'vscode-languageserver';
+import { effects, formatEffectDocumentation } from "../../lib/iam-policy/reference/documentation.js";
 import { partialRange } from "./index.js";
 export function completeEffectValue(location, context) {
-    const potentialLabels = ['Allow', 'Deny'];
     const range = partialRange(context.position, location.partial.length);
     const items = [];
-    for (const label of potentialLabels) {
-        if (location.partial && !label.toLowerCase().startsWith(location.partial.toLowerCase()))
+    for (const effect in effects) {
+        if (location.partial && !effects[effect].name.toLowerCase().startsWith(location.partial.toLowerCase()))
             continue;
         items.push({
-            label,
+            label: effects[effect].name,
             kind: CompletionItemKind.Enum,
-            textEdit: { range, newText: label },
+            textEdit: { range, newText: effects[effect].name },
+            documentation: {
+                kind: MarkupKind.Markdown,
+                value: formatEffectDocumentation(effects[effect]),
+            },
         });
     }
     return { items, isIncomplete: false };

package/src/handlers/completion/principal-block-type.js

@@ -1,24 +1,18 @@
-import { CompletionItemKind } from 'vscode-languageserver';
+import { CompletionItemKind, MarkupKind } from 'vscode-languageserver';
 import { principalTypes } from "../../lib/iam-policy/principals.js";
 import { partialRange } from "./index.js";
 export function completePrincipalBlockType(location, context) {
     const range = partialRange(context.position, location.partial.length);
     const items = [];
-    for (const [_id, principalType] of Object.entries(Object.assign({}, principalTypes, {
-        '*': {
-            value: '*',
-            description: 'Public Unauthenticated Access',
-            patterns: ['*'],
-        },
-    }))) {
-        if (location.partial && !principalType.value.toLowerCase().startsWith(location.partial.toLowerCase()))
+    for (const [_id, principalType] of Object.entries(principalTypes)) {
+        if (location.partial && !principalType.name.toLowerCase().startsWith(location.partial.toLowerCase()))
             continue;
         items.push({
-            label: principalType.value,
+            label: principalType.name,
             kind: CompletionItemKind.Enum,
-            textEdit: { range, newText: principalType.value },
+            textEdit: { range, newText: principalType.name },
             documentation: {
-                kind: 'markdown',
+                kind: MarkupKind.Markdown,
                 value: principalType.description,
             },
         });

package/src/handlers/completion/principal-block.js

@@ -1,13 +1,6 @@
 import { CompletionItemKind, MarkupKind } from 'vscode-languageserver';
+import { formatPrincipalBlockAttributeDocumentation, principalBlockAttributes, } from "../../lib/iam-policy/reference/documentation.js";
 import { partialRange } from "./index.js";
-const principalBlockAttributes = {
-    type: {
-        description: 'The type of principal. Valid values: `*`, `AWS`, `Service`, `Federated`, `CanonicalUser`.',
-    },
-    identifiers: {
-        description: 'List of principal identifiers. The format depends on the `type` attribute.',
-    },
-};
 export function completePrincipalBlock(location, context) {
     const siblingKeys = context.handler.getSiblingKeys(context.uri, context.position);
     const range = partialRange(context.position, location.partial.length);
@@ -23,7 +16,7 @@ export function completePrincipalBlock(location, context) {
             textEdit: { range, newText: name },
             documentation: {
                 kind: MarkupKind.Markdown,
-                value: attr.description,
+                value: formatPrincipalBlockAttributeDocumentation(attr),
             },
         });
     }

package/src/handlers/completion/principal-identifier-completions.js

@@ -1,4 +1,4 @@
-import { CompletionItemKind } from 'vscode-languageserver';
+import { CompletionItemKind, MarkupKind } from 'vscode-languageserver';
 import { partitions } from "../../lib/iam-policy/partitions.js";
 import { principalTypes } from "../../lib/iam-policy/principals.js";
 import { partialRange } from "./index.js";
@@ -42,22 +42,29 @@ export function completePrincipalIdentifier(principalType, partial, position) {
     const parts = partial.split(':');
     if (parts.length === 1) {
         if (config.arn.length > 0 && 'arn'.startsWith(partial.toLowerCase())) {
-            items.push({ label: 'arn', kind: CompletionItemKind.Constant, textEdit: { range, newText: 'arn' } });
+            items.push({
+                label: 'arn',
+                kind: CompletionItemKind.Constant,
+                textEdit: { range, newText: 'arn' },
+            });
         }
         for (const pattern of config.nonArn) {
             if (pattern.toLowerCase().startsWith(partial.toLowerCase())) {
-                items.push({ label: pattern, kind: CompletionItemKind.Value, textEdit: { range, newText: pattern } });
+                items.push({
+                    label: pattern,
+                    kind: CompletionItemKind.Value,
+                    textEdit: { range, newText: pattern },
+                });
             }
         }
     }
     else if (parts.length === 2) {
         for (const [id, partition] of Object.entries(partitions)) {
-            const prefix = `${parts[0]}:${id}`;
-            if (prefix.toLowerCase().startsWith(partial.toLowerCase())) {
+            if (`${parts[0]}:${id}`.toLowerCase().startsWith(partial.toLowerCase())) {
                 items.push({
                     label: id,
                     kind: CompletionItemKind.Enum,
-                    documentation: { kind: 'markdown', value: partition.name },
+                    documentation: { kind: MarkupKind.Markdown, value: partition.name },
                 });
             }
         }
@@ -65,8 +72,7 @@ export function completePrincipalIdentifier(principalType, partial, position) {
     else if (parts.length === 3) {
         const services = [...new Set(config.arn.map((pattern) => pattern.split(':')[2]))];
         for (const service of services) {
-            const prefix = `${parts[0]}:${parts[1]}:${service}`;
-            if (prefix.toLowerCase().startsWith(partial.toLowerCase())) {
+            if (`${parts[0]}:${parts[1]}:${service}`.toLowerCase().startsWith(partial.toLowerCase())) {
                 items.push({ label: service, kind: CompletionItemKind.Enum });
             }
         }
@@ -79,7 +85,7 @@ export function completePrincipalIdentifier(principalType, partial, position) {
             items.push({
                 label: ':',
                 kind: CompletionItemKind.Enum,
-                documentation: { kind: 'markdown', value: 'No region component for this service' },
+                documentation: { kind: MarkupKind.Markdown, value: 'No region component for this service' },
             });
         }
         else {
@@ -92,7 +98,7 @@ export function completePrincipalIdentifier(principalType, partial, position) {
                     items.push({
                         label: region.id,
                         kind: CompletionItemKind.Enum,
-                        documentation: { kind: 'markdown', value: region.name },
+                        documentation: { kind: MarkupKind.Markdown, value: region.name },
                     });
                 }
             }
@@ -104,7 +110,7 @@ export function completePrincipalIdentifier(principalType, partial, position) {
             label,
             kind: CompletionItemKind.Enum,
             textEdit: { range, newText: label },
-            documentation: { kind: 'markdown', value: 'AWS Account ID' },
+            documentation: { kind: MarkupKind.Markdown, value: 'AWS Account ID' },
         });
     }
     else {

package/src/handlers/completion/principal-type.js

@@ -1,4 +1,4 @@
-import { CompletionItemKind } from 'vscode-languageserver';
+import { CompletionItemKind, MarkupKind } from 'vscode-languageserver';
 import { principalTypes } from "../../lib/iam-policy/principals.js";
 import { partialRange } from "./index.js";
 export function completePrincipalType(location, context) {
@@ -8,16 +8,16 @@ export function completePrincipalType(location, context) {
     const range = partialRange(context.position, location.partial.length);
     const items = [];
     for (const [_id, principalType] of Object.entries(principalTypes)) {
-        if (existingTypes.includes(principalType.value))
+        if (existingTypes.includes(principalType.name))
             continue;
-        if (location.partial && !principalType.value.toLowerCase().startsWith(location.partial.toLowerCase()))
+        if (location.partial && !principalType.name.toLowerCase().startsWith(location.partial.toLowerCase()))
             continue;
         items.push({
-            label: principalType.value,
+            label: principalType.name,
             kind: CompletionItemKind.Enum,
-            textEdit: { range, newText: principalType.value },
+            textEdit: { range, newText: principalType.name },
             documentation: {
-                kind: 'markdown',
+                kind: MarkupKind.Markdown,
                 value: principalType.description,
             },
         });

package/src/handlers/completion/principal-value.js

@@ -1,4 +1,4 @@
-import { CompletionItemKind } from 'vscode-languageserver';
+import { CompletionItemKind, MarkupKind } from 'vscode-languageserver';
 import { partialRange } from "./index.js";
 export function completePrincipalValue(location, context) {
     const potentialLabels = ['*'];
@@ -12,7 +12,7 @@ export function completePrincipalValue(location, context) {
             kind: CompletionItemKind.Enum,
             textEdit: { range, newText: label },
             documentation: {
-                kind: 'markdown',
+                kind: MarkupKind.Markdown,
                 value: 'Public Unauthenticated Access',
             },
         });

package/src/handlers/completion/resource-value.js

@@ -1,5 +1,6 @@
-import { CompletionItemKind } from 'vscode-languageserver';
+import { CompletionItemKind, MarkupKind } from 'vscode-languageserver';
 import { partitions } from "../../lib/iam-policy/partitions.js";
+import { formatResourceDocumentation } from "../../lib/iam-policy/reference/documentation.js";
 import { ServiceReference } from "../../lib/iam-policy/reference/services.js";
 import { expandActionPattern } from "../../lib/iam-policy/wildcard.js";
 import { partialRange } from "./index.js";
@@ -11,20 +12,21 @@ export function completeResourceValue(location, context) {
     const statementActions = statement?.Action ?? statement?.NotAction ?? [];
     const expandedActions = statementActions.flatMap(expandActionPattern);
     const resources = ServiceReference.getResourcesForActions(expandedActions);
-    for (const [arn, resource] of resources.entries()) {
-        if (location.partial && !arn.toLowerCase().startsWith(location.partial.toLowerCase()))
-            continue;
-        items.push({
-            label: arn,
-            sortText: `0-${arn}`,
-            kind: CompletionItemKind.Value,
-            textEdit: { range, newText: arn },
-            detail: `${resource.service}/${resource.name}`,
-            documentation: {
-                kind: 'markdown',
-                value: [`**Condition Keys**:`, '', resource.conditionKeys.map((key) => `- \`${key}\``).join('\n')].join('\n'),
-            },
-        });
+    for (const resource of resources) {
+        for (const arn of resource.arnFormats) {
+            if (location.partial && !arn.toLowerCase().startsWith(location.partial.toLowerCase()))
+                continue;
+            items.push({
+                label: arn,
+                sortText: `0-${arn}`,
+                kind: CompletionItemKind.Value,
+                textEdit: { range, newText: arn },
+                documentation: {
+                    kind: MarkupKind.Markdown,
+                    value: formatResourceDocumentation(resource),
+                },
+            });
+        }
     }
     if (parts.length === 1) {
         // suggest only arn
@@ -43,7 +45,7 @@ export function completeResourceValue(location, context) {
             label: id,
             kind: CompletionItemKind.Enum,
             documentation: {
-                kind: 'markdown',
+                kind: MarkupKind.Markdown,
                 value: partition.name,
             },
         }));
@@ -72,16 +74,18 @@ export function completeResourceValue(location, context) {
         const service = parts[2];
         const resources = ServiceReference.getResourcesForActions(expandActionPattern(`${service}:*`));
         let hasRegionArn = false;
-        for (const arn of resources.keys()) {
-            if (arn.includes(`\${Region}`))
-                hasRegionArn = true;
+        for (const resource of resources) {
+            for (const arn of resource.arnFormats) {
+                if (arn.includes(`\${Region}`))
+                    hasRegionArn = true;
+            }
         }
         if (!hasRegionArn) {
             items.push({
                 label: ':',
                 kind: CompletionItemKind.Enum,
                 documentation: {
-                    kind: 'markdown',
+                    kind: MarkupKind.Markdown,
                     value: 'This service has no ARNs with a region component',
                 },
             });
@@ -94,7 +98,7 @@ export function completeResourceValue(location, context) {
                         label: region.id,
                         kind: CompletionItemKind.Enum,
                         documentation: {
-                            kind: 'markdown',
+                            kind: MarkupKind.Markdown,
                             value: region.name,
                         },
                     });
@@ -110,7 +114,7 @@ export function completeResourceValue(location, context) {
             kind: CompletionItemKind.Enum,
             textEdit: { range, newText: label },
             documentation: {
-                kind: 'markdown',
+                kind: MarkupKind.Markdown,
                 value: 'AWS Account ID',
             },
         });
@@ -121,30 +125,32 @@ export function completeResourceValue(location, context) {
         const region = parts[3];
         const account = parts[4];
         const resources = ServiceReference.getResourcesForActions(expandActionPattern(`${service}:*`));
-        for (const resource of resources.values()) {
-            const patternParts = resource.arn.split(':');
-            const patternRegion = patternParts[3];
-            const patternAccount = patternParts[4];
-            if (region.length > 0 !== patternRegion.length > 0)
-                continue;
-            if (account.length > 0 !== patternAccount.length > 0)
-                continue;
-            const label = resource.arn
-                .replace(`\${Partition}`, parts[1])
-                .replace(`\${Region}`, parts[3])
-                .replace(`\${Account}`, parts[4]);
-            if (location.partial && !label.toLowerCase().startsWith(location.partial.toLowerCase()))
-                continue;
-            items.push({
-                label,
-                kind: CompletionItemKind.Enum,
-                textEdit: { range, newText: label },
-                detail: resource.name,
-                documentation: {
-                    kind: 'markdown',
-                    value: [`**Condition Keys**:`, '', resource.conditionKeys.map((key) => `- \`${key}\``).join('\n')].join('\n'),
-                },
-            });
+        for (const resource of resources) {
+            for (const arn of resource.arnFormats) {
+                const patternParts = arn.split(':');
+                const patternRegion = patternParts[3];
+                const patternAccount = patternParts[4];
+                if (region.length > 0 !== patternRegion.length > 0)
+                    continue;
+                if (account.length > 0 !== patternAccount.length > 0)
+                    continue;
+                const label = arn
+                    .replace(`\${Partition}`, parts[1])
+                    .replace(`\${Region}`, parts[3])
+                    .replace(`\${Account}`, parts[4]);
+                if (location.partial && !label.toLowerCase().startsWith(location.partial.toLowerCase()))
+                    continue;
+                items.push({
+                    label,
+                    kind: CompletionItemKind.Enum,
+                    textEdit: { range, newText: label },
+                    detail: resource.name,
+                    documentation: {
+                        kind: MarkupKind.Markdown,
+                        value: [`**Condition Keys**:`, '', resource.conditionKeys.map((key) => `- \`${key}\``).join('\n')].join('\n'),
+                    },
+                });
+            }
         }
     }
     return { items, isIncomplete: false };

package/src/handlers/completion/statement-block.d.ts

@@ -2,9 +2,4 @@ import type { CompletionList } from 'vscode-languageserver';
 import type { StatementBlockLocation } from '../../lib/iam-policy/location.ts';
 import { type CompletionContext } from './index.ts';
 export declare function completeStatementBlock(location: StatementBlockLocation, context: CompletionContext): CompletionList;
-export declare function findHclElement(key: string): {
-    policyTypes: Array<"identity" | "resource">;
-    description: string;
-    group: string;
-    hclKey: string;
-} | null;
+export declare function findHclElement(key: string): import("../../lib/iam-policy/statement-keys.ts").PolicyElement | null;

package/src/handlers/completion/statement-block.js

@@ -32,7 +32,7 @@ export function completeStatementBlock(location, context) {
     return { items, isIncomplete: false };
 }
 export function findHclElement(key) {
-    for (const [, element] of Object.entries(StatementKeys)) {
+    for (const [_, element] of Object.entries(StatementKeys)) {
         if (element.hclKey === key)
             return element;
     }
@@ -43,7 +43,6 @@ function deriveExistingKeys(statement) {
         return [];
     const keys = [];
     for (const [name, element] of Object.entries(StatementKeys)) {
-        // sub-blocks (condition, principals, not_principals) allow multiples — never exclude them
         if (name === 'Condition' || name === 'Principal' || name === 'NotPrincipal')
             continue;
         if (name in statement) {

package/src/handlers/completion/statement-key.js

@@ -1,4 +1,5 @@
 import { CompletionItemKind, MarkupKind } from 'vscode-languageserver';
+import { formatStatementElementDocumentation } from "../../lib/iam-policy/reference/documentation.js";
 import { StatementKeys } from "../../lib/iam-policy/statement-keys.js";
 import { partialRange } from "./index.js";
 export function completeStatementKey(location, context) {
@@ -25,7 +26,7 @@ export function completeStatementKey(location, context) {
             textEdit: { range, newText: name },
             documentation: {
                 kind: MarkupKind.Markdown,
-                value: element.description,
+                value: formatStatementElementDocumentation(element),
             },
         });
     }

package/src/handlers/diagnostics/action.d.ts

@@ -1,6 +1,8 @@
-import type { Diagnostic } from 'vscode-languageclient';
-import type { StatementEntry } from '../../lib/treesitter/base.ts';
+import { type Diagnostic } from 'vscode-languageserver';
+import type { PolicyDocumentNode, StatementEntry } from '../../lib/treesitter/base.ts';
 import { ElementValidator } from './base.ts';
 export declare class ActionValidator extends ElementValidator {
+    #private;
+    constructor(policyDocument: PolicyDocumentNode, actionKeys: Set<string>);
     validate(entry: StatementEntry): Array<Diagnostic>;
 }