aws-iam-language-server 0.0.16 → 0.0.18

package/src/lib/iam-policy/reference/documentation.js

@@ -0,0 +1,171 @@
+export const conditionBlockAttributes = {
+    test: {
+        description: 'The condition operator to evaluate (e.g., `StringEquals`, `ArnLike`, `IpAddress`).',
+    },
+    variable: {
+        description: 'The condition key to evaluate (e.g., `aws:SourceIp`, `s3:prefix`).',
+    },
+    values: {
+        description: 'List of values to compare against the condition key.',
+    },
+};
+export const effects = {
+    Allow: {
+        name: 'Allow',
+        description: [
+            'Grants access to the specified resources and actions.',
+            'By default, all requests are implicitly denied.',
+            'An `Allow` overrides implicit denies but never overrides an explicit `Deny`.',
+        ].join('\n'),
+    },
+    Deny: {
+        name: 'Deny',
+        description: [
+            'Explicitly denies access to the specified resources and actions.',
+            'An explicit `Deny` always takes precedence, it overrides any `Allow` statements.',
+        ].join('\n'),
+    },
+};
+export const principalBlockAttributes = {
+    type: {
+        name: 'type',
+        description: 'The type of principal. Valid values: `*`, `AWS`, `Service`, `Federated`, `CanonicalUser`.',
+    },
+    identifiers: {
+        name: 'identifiers',
+        description: 'List of principal identifiers. The format depends on the `type` attribute.',
+    },
+};
+export const principalTypedValues = {
+    '*': {
+        name: 'Everyone',
+        description: 'All principals of this type',
+    },
+    Service: {
+        name: 'AWS Service',
+        description: 'Grants a service access to this resource',
+    },
+    Account: {
+        name: 'AWS Account',
+        description: 'Grants all entities within an account access to this resource',
+    },
+    Role: {
+        name: 'IAM Role',
+        description: 'Grants a specific role access to this resource',
+    },
+    RoleSession: {
+        name: 'Assumed Role Session',
+        description: 'Grants a specific role session access to this resource',
+    },
+    User: {
+        name: 'IAM User',
+        description: 'Grants a specific user access to this resource',
+    },
+    FederatedOidc: {
+        name: 'Federated OIDC Provider',
+        description: 'Grants a specific OIDC IdP access to this resource',
+    },
+    FederatedSaml: {
+        name: 'Federated SAML Provider',
+        description: 'Grants a specific SAML IdP access to this resource',
+    },
+    FederatedIdentity: {
+        name: 'Federated Identity',
+        description: 'Grants an integrated IdP access to this resource',
+    },
+};
+export function formatStatementElementDocumentation(element) {
+    const parts = [];
+    parts.push(`**${element.name}**`);
+    parts.push(`_${element.description}_`);
+    parts.push(`\n**Policy Types**: ${element.policyTypes.join(',')}`);
+    return parts.join('\n');
+}
+export function formatActionDocumentation(action) {
+    const parts = [];
+    parts.push(`**${action.service}:${action.name}**`);
+    if (action.description)
+        parts.push(`_${action.description}_`);
+    if (action.accessLevel)
+        parts.push(`\n**Access Level**: _${action.accessLevel}_`);
+    if (action.resourceTypes && action.resourceTypes.length > 0) {
+        parts.push(`\n**Resource types**`);
+        for (const resource of action.resourceTypes) {
+            if (resource.required)
+                parts.push(`- \`${resource.name}\` _*(required)*_`);
+            else
+                parts.push(`- \`${resource.name}\``);
+        }
+    }
+    if (action.conditionKeys.length > 0) {
+        parts.push(`\n**Condition keys**`);
+        for (const conditionKey of action.conditionKeys) {
+            parts.push(`- \`${conditionKey}\``);
+        }
+    }
+    if (action.dependentActions && action.dependentActions.length > 0) {
+        parts.push(`\n**Dependent actions:**`);
+        for (const dependentAction of action.dependentActions) {
+            parts.push(`- \`${dependentAction}\``);
+        }
+    }
+    return parts.join('\n');
+}
+export function formatResourceDocumentation(resource) {
+    const parts = [];
+    parts.push(`**${resource.service}/${resource.name}**`);
+    if (resource.arnFormats.length > 0) {
+        parts.push(`\n**ARN Formats**`);
+        for (const conditionKey of resource.conditionKeys) {
+            parts.push(`- \`${conditionKey}\``);
+        }
+    }
+    if (resource.conditionKeys.length > 0) {
+        parts.push(`\n**Condition Keys**`);
+        for (const conditionKey of resource.conditionKeys) {
+            parts.push(`- \`${conditionKey}\``);
+        }
+    }
+    return parts.join('\n');
+}
+export function formatConditionKeyDocumentation(conditionKey) {
+    const parts = [];
+    parts.push(`**${conditionKey.name}**`);
+    if (conditionKey.description)
+        parts.push(`_${conditionKey.description}_`);
+    if (conditionKey.types.length > 0)
+        parts.push(`\n**Type:** _${conditionKey.types.join(',')}_`);
+    if (conditionKey.availability)
+        parts.push(`\n**Availability:** _${conditionKey.availability}_`);
+    return parts.join('\n');
+}
+export function formatConditionOperatorDocumentation(operator) {
+    const parts = [];
+    parts.push(`**${operator.name}**`);
+    parts.push(`_${operator.description}_`);
+    return parts.join('\n');
+}
+export function formatEffectDocumentation(effect) {
+    const parts = [];
+    parts.push(`**${effect.name}**`);
+    parts.push(`_${effect.description}_`);
+    return parts.join('\n');
+}
+export function formatPrincipalBlockAttributeDocumentation(attribute) {
+    const parts = [];
+    parts.push(`**${attribute.name}**`);
+    parts.push(`_${attribute.description}_`);
+    return parts.join('\n');
+}
+export function formatPrincipalTypeDocumentation(principal) {
+    const parts = [];
+    parts.push(`**${principal.name}**`);
+    parts.push(`_${principal.description}_`);
+    return parts.join('\n');
+}
+export function formatPrincipalTypedValueDocumentation(principal) {
+    const parts = [];
+    parts.push(`**${principal.name}**`);
+    parts.push(`_${principal.description}_`);
+    return parts.join('\n');
+}

package/src/lib/iam-policy/reference/services.d.ts

@@ -1,5 +1,5 @@
 import { type ArnParts } from '../arn.ts';
-import type { Action, ConditionKey, GlobalConditionKey, ResourceDef, ServiceData } from './types.ts';
+import type { Action, ConditionKey, ResourceDef, ServiceData } from './types.ts';
 export declare class ServiceReference {
     #private;
     static getServiceData(service: string): ServiceData | undefined;
@@ -7,18 +7,10 @@ export declare class ServiceReference {
     static getAllActions(): Array<string>;
     static getAllServices(): Array<string>;
     static getActionsForService(service: string): Array<Action>;
-    static getConditionKeysForActions(actions: string[]): Array<{
-        name: string;
-        types: string[];
-    }>;
-    static getGlobalConditionKeys(): Array<GlobalConditionKey>;
+    static getConditionKeysForActions(actions: string[]): Array<ConditionKey>;
+    static getGlobalConditionKeys(): Array<ConditionKey>;
     static getAction(action: string): Action | undefined;
     static getConditionKey(service: string, keyName: string): ConditionKey | undefined;
-    static getResources(arn: ArnParts): ResourceDef[];
-    static getResourcesForActions(actions: string[]): Map<string, {
-        service: string;
-        name: string;
-        arn: string;
-        conditionKeys: Array<string>;
-    }>;
+    static getResources(arn: ArnParts): Array<ResourceDef>;
+    static getResourcesForActions(actions: Array<string>): Array<ResourceDef>;
 }

package/src/lib/iam-policy/reference/services.js

@@ -70,15 +70,12 @@ export class ServiceReference {
             const actionDef = serviceData.actions[actionName];
             if (actionDef?.conditionKeys) {
                 for (const keyName of actionDef.conditionKeys) {
-                    if (!keys.has(keyName)) {
-                        const keyDef = serviceData.conditionKeys[keyName];
-                        keys.set(keyName, keyDef?.types ?? []);
-                    }
+                    keys.set(keyName, serviceData.conditionKeys[keyName]);
                 }
             }
         }
         const sorted = [...keys.entries()].sort((a, b) => a[0].localeCompare(b[0]));
-        return sorted.map(([name, types]) => ({ name, types }));
+        return sorted.map(([_name, key]) => key);
     }
     static getGlobalConditionKeys() {
         if (!ServiceReference.#globalConditionKeys) {
@@ -116,7 +113,7 @@ export class ServiceReference {
         return matches;
     }
     static getResourcesForActions(actions) {
-        const resources = new Map();
+        const resources = [];
         for (const action of actions) {
             const [service, actionName] = action.split(':');
             const serviceData = ServiceReference.getServiceData(service);
@@ -128,14 +125,7 @@ export class ServiceReference {
             for (const actionResource of actionDef.resources) {
                 const resourceDef = serviceData.resources.find((r) => r.name === actionResource.name);
                 if (resourceDef) {
-                    for (const arn of resourceDef.arnFormats) {
-                        resources.set(arn, {
-                            service,
-                            name: resourceDef.name,
-                            arn,
-                            conditionKeys: resourceDef.conditionKeys,
-                        });
-                    }
+                    resources.push(resourceDef);
                 }
             }
         }

package/src/lib/iam-policy/reference/types.d.ts

@@ -2,12 +2,6 @@ export type Services = Array<{
     service: string;
     url: string;
 }>;
-export type GlobalConditionKey = {
-    name: string;
-    valueType: 'single' | 'multi';
-    availability: string;
-    description: string;
-};
 export type RawReference = {
     Name: string;
     Version: string;
@@ -45,11 +39,7 @@ export type ServiceData = {
     name: string;
     url?: string;
     actions: Record<string, Action>;
-    resources: Array<{
-        name: string;
-        arnFormats: Array<string>;
-        conditionKeys: Array<string>;
-    }>;
+    resources: Array<ResourceDef>;
     conditionKeys: Record<string, ConditionKey>;
 };
 export type Action = {
@@ -71,11 +61,31 @@ export type Action = {
     iamUrl?: string;
 };
 export type ResourceDef = {
+    service: string;
     name: string;
     arnFormats: Array<string>;
     conditionKeys: Array<string>;
 };
 export type ConditionKey = {
+    name: string;
     types: Array<string>;
     description?: string;
+    availability?: string;
+};
+export type Effect = {
+    name: string;
+    description: string;
+};
+export type PrincipalBlockAttribute = {
+    name: string;
+    description: string;
+};
+export type PrincipalType = {
+    name: string;
+    description: string;
+    patterns: Array<string>;
+};
+export type PrincipalTypedValue = {
+    name: string;
+    description: string;
 };

package/src/lib/iam-policy/statement-keys.d.ts

@@ -1,8 +1,8 @@
-type PolicyElement = {
+export type PolicyElement = {
+    name: string;
     policyTypes: Array<'identity' | 'resource'>;
     description: string;
     group: string;
     hclKey: string;
 };
 export declare const StatementKeys: Record<string, PolicyElement>;
-export {};

package/src/lib/iam-policy/statement-keys.js

@@ -1,158 +1,110 @@
 export const StatementKeys = {
     Sid: {
+        name: 'Sid',
         policyTypes: ['identity', 'resource'],
-        description: `An optional identifier for a policy statement.
-Use it as a descriptive label to distinguish statements within a policy.
-
-The \`Sid\` value must be unique within a policy document.
-It may only contain ASCII uppercase letters (A-Z), lowercase letters (a-z), and numbers (0-9).
-
-In services that support an \`Id\` element (such as SQS and SNS), the \`Sid\` serves as a sub-ID of the policy document's \`Id\`.
-These services may require \`Sid\` and enforce additional uniqueness constraints — consult the service-specific documentation.
-
-> **Note:** The IAM API does not expose the \`Sid\`.
-> You cannot retrieve a specific statement by its ID.`,
+        description: [
+            'An optional identifier for a policy statement.',
+            'Use it as a descriptive label to distinguish statements within a policy.',
+            'The `Sid` value must be unique within a policy document.',
+            'It may only contain ASCII uppercase letters (A-Z), lowercase letters (a-z), and numbers (0-9).',
+        ].join('\n'),
         hclKey: 'sid',
         group: 'sid',
     },
     Effect: {
+        name: 'Effect',
         policyTypes: ['identity', 'resource'],
-        description: `A required element that specifies whether the statement allows or explicitly denies access.
-Valid values are \`Allow\` and \`Deny\` (case-sensitive).
-
-By default, access to resources is implicitly denied.
-Set \`Effect\` to \`Allow\` to grant access.
-Set \`Effect\` to \`Deny\` to explicitly deny access — an explicit deny always overrides any allow.`,
+        description: [
+            'A required element that specifies whether the statement allows or explicitly denies access.',
+            'Valid values are `Allow` and `Deny` (case-sensitive).',
+            'By default, access to resources is implicitly denied.',
+            'Set `Effect` to `Allow` to grant access and set `Effect` to `Deny` to explicitly deny access.',
+        ].join('\n'),
         hclKey: 'effect',
         group: 'effect',
     },
     Principal: {
+        name: 'Principal',
         policyTypes: ['resource'],
-        description: `Specifies the principal that is allowed or denied access to a resource.
-Required in resource-based policies (e.g. S3 bucket policies, KMS key policies, role trust policies).
-Cannot be used in identity-based policies — the principal is implicitly the identity the policy is attached to.
-
-The value can be an AWS account, IAM user, IAM role, federated identity, AWS service, or canonical user:
-
-- **AWS account** — \`{ "AWS": "arn:aws:iam::123456789012:root" }\` or \`{ "AWS": "123456789012" }\`
-- **IAM role** — \`{ "AWS": "arn:aws:iam::123456789012:role/role-name" }\`
-- **IAM user** — \`{ "AWS": "arn:aws:iam::123456789012:user/user-name" }\`
-- **AWS service** — \`{ "Service": "ecs.amazonaws.com" }\`
-- **Federated (OIDC/SAML)** — \`{ "Federated": "cognito-identity.amazonaws.com" }\` or a SAML provider ARN
-- **Canonical user** — \`{ "CanonicalUser": "64-char-hex-id" }\` (S3-specific, equivalent to an account ID)
-- **All principals** — \`"*"\` or \`{ "AWS": "*" }\`
-
-Use arrays to specify multiple principals of the same type.
-Multiple principals are evaluated as a logical OR.
-
-> **Warning:** Using \`"Principal": "*"\` with \`"Effect": "Allow"\` grants public access.
-> Always scope with a \`Condition\` element unless public access is intended.
-
-> **Note:** IAM resolves role and user ARNs in trust policies to unique principal IDs.
-> If you delete and recreate the role or user, the trust relationship breaks.
-> Use the \`aws:PrincipalArn\` condition key to avoid this.`,
+        description: [
+            'Specifies the principal that is allowed or denied access to a resource.',
+            'Required in resource-based policies, but cannot be used in identity-based policies.',
+            'The value can be an AWS account, IAM user, IAM role, federated identity, AWS service, or canonical user.',
+        ].join('\n'),
         group: 'principal',
         hclKey: 'principals',
     },
     NotPrincipal: {
+        name: 'NotPrincipal',
         policyTypes: ['resource'],
-        description: `Matches every principal *except* the ones specified.
-Must be used with \`"Effect": "Deny"\` — using it with \`"Effect": "Allow"\` is not supported.
-Only valid in resource-based policies; not supported in identity-based policies, role trust policies, SCPs, or RCPs.
-
-When specifying an IAM user or role, you must also include the account ARN.
-Otherwise the policy may deny access to the entire account.
-
-> **Warning:** Do not use \`NotPrincipal\` with \`Deny\` for principals that have a permissions boundary attached.
-> The \`NotPrincipal\` element will always deny those principals regardless of the values specified.
-
-> **Recommended alternative:** Use \`"Principal": "*"\` with a \`Condition\` using \`ArnNotEquals\` on \`aws:PrincipalArn\` (or \`StringNotEquals\` on \`aws:PrincipalServiceName\` for services).
-> AWS does not recommend \`NotPrincipal\` for new resource-based policies due to the difficulty of troubleshooting interactions across multiple policy types.`,
+        description: [
+            'Matches every principal *except* the ones specified.',
+            'Must be used with `"Effect": "Deny"`, using it with `"Effect": "Allow"` is not supported.',
+            'Only valid in resource-based policies, it is not supported in identity-based policies.',
+            'When specifying an IAM user or role, you must also include the account ARN.',
+        ].join('\n'),
         group: 'principal',
         hclKey: 'not_principals',
     },
     Action: {
+        name: 'Action',
         policyTypes: ['identity', 'resource'],
-        description: `Specifies the actions that the statement allows or denies.
-Each statement must include either \`Action\` or \`NotAction\`.
-
-Actions use the format \`service:action\` (e.g. \`s3:GetObject\`, \`iam:CreateUser\`).
-Action names are case-insensitive.
-Use an array to specify multiple actions.
-
-Wildcards are supported:
-- \`*\` matches any combination of characters (e.g. \`s3:*\` for all S3 actions, \`iam:*AccessKey*\` for all access key actions)
-- \`?\` matches any single character`,
+        description: [
+            'Specifies the actions that the statement allows or denies.',
+            'Actions use the format `service:action` (e.g. `s3:GetObject`, `iam:CreateUser`).',
+            'Action names are case-insensitive.',
+        ].join('\n'),
         group: 'action',
         hclKey: 'actions',
     },
     NotAction: {
+        name: 'NotAction',
         policyTypes: ['identity', 'resource'],
-        description: `Matches every action *except* the ones specified.
-Each statement must include either \`Action\` or \`NotAction\`.
-
-With \`"Effect": "Allow"\`, grants access to all applicable actions except those listed.
-With \`"Effect": "Deny"\`, denies all applicable actions except those listed.
-The \`Resource\` element determines which actions and services are applicable.
-
-> **Warning:** \`NotAction\` with \`"Effect": "Allow"\` can grant more permissions than intended, since it allows all actions not explicitly excluded — including actions in other services.
-> Prefer using \`NotAction\` with \`"Effect": "Deny"\` to restrict access while still requiring explicit allows elsewhere.`,
+        description: [
+            'Matches every action *except* the ones specified.',
+            'With `"Effect": "Allow"`, grants access to all applicable actions except those listed.',
+            'With `"Effect": "Deny"`, denies all applicable actions except those listed.',
+            'The `Resource` element determines which actions and services are applicable.',
+        ].join('\n'),
         group: 'action',
         hclKey: 'not_actions',
     },
     Resource: {
+        name: 'Resource',
         policyTypes: ['identity', 'resource'],
-        description: `Specifies the object or objects that the statement applies to.
-Each statement must include either \`Resource\` or \`NotResource\`.
-
-Resources are identified by ARN (e.g. \`arn:aws:s3:::my-bucket/*\`).
-The ARN format varies by service — consult the service documentation for the correct format.
-Use an array to specify multiple resources.
-
-Wildcards are supported within ARNs:
-
-- \`*\` matches any combination of characters, including \`/\`
-- \`?\` matches any single character
-- Wildcards cannot be used in the service segment of an ARN
-
-Some actions do not support resource-level permissions.
-In those cases, use \`"Resource": "*"\` to apply the statement to all resources.
-
-Policy variables (e.g. \`\${aws:username}\`) can be used in the resource-specific portion of the ARN.`,
+        description: [
+            'Specifies the object or objects that the statement applies to.',
+            'Each statement must include either `Resource` or `NotResource`.',
+            'Resources are identified by ARN (e.g. `arn:aws:s3:::my-bucket/*`).',
+            'Some actions do not support resource-level permissions.',
+            'In those cases, use `"Resource": "*"` to apply the statement to all resources.',
+        ].join('\n'),
         group: 'resource',
         hclKey: 'resources',
     },
     NotResource: {
+        name: 'NotResource',
         policyTypes: ['identity', 'resource'],
-        description: `Matches every resource *except* the ones specified.
-Each statement must include either \`Resource\` or \`NotResource\`.
-
-With \`"Effect": "Deny"\`, denies access to all resources except those listed.
-With \`"Effect": "Allow"\`, grants access to all resources except those listed.
-
-> **Warning:** \`NotResource\` with \`"Effect": "Allow"\` can grant far more permissions than intended — including actions across other services and resources.
-> Never combine \`"Effect": "Allow"\`, \`"Action": "*"\`, and \`NotResource\`, as this grants access to nearly everything in the account.
-> Prefer using \`NotResource\` with \`"Effect": "Deny"\`.`,
+        description: [
+            'Matches every resource *except* the ones specified.',
+            'With `"Effect": "Deny"`, denies access to all resources except those listed.',
+            'With `"Effect": "Allow"`, grants access to all resources except those listed.',
+        ].join('\n'),
         group: 'resource',
         hclKey: 'not_resources',
     },
     Condition: {
+        name: 'Condition',
         policyTypes: ['identity', 'resource'],
-        description: `An optional element that specifies conditions under which the statement is in effect.
-
-The structure is \`{ "Operator": { "ConditionKey": "Value" } }\`:
-- **Condition operator** — the type of comparison (e.g. \`StringEquals\`, \`ArnLike\`, \`IpAddress\`, \`NumericLessThan\`, \`Bool\`, \`Null\`)
-- **Condition key** — a value from the request context to evaluate (e.g. \`aws:SourceIp\`, \`s3:prefix\`, \`aws:PrincipalArn\`)
-- **Condition value** — the value to compare against
-
-Condition keys are either **global** (prefixed with \`aws:\`, available across all services) or **service-specific** (prefixed with the service namespace).
-Condition key names are case-insensitive; values are case-sensitive unless using a case-insensitive operator like \`StringEqualsIgnoreCase\`.
-
-When multiple values are specified for a single key, they are evaluated as **OR**.
-When multiple keys or operators are specified, they are evaluated as **AND**.
-
-If a condition key is not present in the request context, it does not match — except when using \`ForAllValues\`, which may return true for a missing key.
-Use the \`Null\` condition operator to explicitly check whether a key exists.`,
+        description: [
+            'An optional element that specifies conditions under which the statement is in effect.',
+            'Condition keys are either **global** (available across all services) or **service-specific**.',
+            'Condition key names are case-insensitive.',
+            'Values are case-sensitive unless using a case-insensitive operator like `StringEqualsIgnoreCase`.',
+            'When multiple values are specified for a single key, they are evaluated as **OR**.',
+            'When multiple keys or operators are specified, they are evaluated as **AND**.',
+            'If a condition key is not present in the request context, it does not match, except when using `ForAllValues`.',
+        ].join('\n'),
         hclKey: 'condition',
         group: 'condition',
     },

package/src/lib/treesitter/yaml.js

@@ -431,7 +431,7 @@ export class TreeYaml extends TreeBase {
                 // a mapping {s3: null} instead of a scalar). If the mapping has one pair with
                 // no value and sits inside a block_sequence_item, collapse it: treat the key
                 // text + ":" as a partial value and skip past the mapping.
-                if (this.#isColonInducedMapping(current)) {
+                if (this.#isColonInducedMapping(current) || this.#isColonInducedMappingInPairValue(current, position)) {
                     const pair = current.namedChildren.find((child) => child.type === 'block_mapping_pair');
                     const keyText = pair ? this.#getPairKeyText(pair) : null;
                     if (keyText) {
@@ -482,7 +482,9 @@ export class TreeYaml extends TreeBase {
             // When nodeBefore lands on the ":" inside a colon-induced mapping, we enter
             // via the inner pair (setting role='value', keys=['s3']). When we reach the
             // parent mapping, undo that contribution and collapse to colonPartial.
-            if (current.type === 'block_mapping' && role !== null && this.#isColonInducedMapping(current)) {
+            if (current.type === 'block_mapping' &&
+                role !== null &&
+                (this.#isColonInducedMapping(current) || this.#isColonInducedMappingInPairValue(current, position))) {
                 const pair = current.namedChildren.find((child) => child.type === 'block_mapping_pair');
                 const keyText = pair ? this.#getPairKeyText(pair) : null;
                 if (keyText && keys.length > 0 && keys[0] === keyText) {
@@ -649,6 +651,28 @@ export class TreeYaml extends TreeBase {
             parent = parent.parent;
         return parent?.type === 'block_sequence_item';
     }
+    /**
+     * Detect a colon-induced mapping inside a mapping pair value (e.g., "s3:" under
+     * "StringEquals:" is parsed as a nested mapping {s3: null} instead of a scalar value).
+     * Only matches when the cursor is on the pair's line with no space after the colon
+     * (position at or before the pair end). When there IS a space (cursor past pair end),
+     * the existing pairOnLine check handles it as a legitimate key-value context.
+     */
+    #isColonInducedMappingInPairValue(mapping, position) {
+        const pairs = mapping.namedChildren.filter((child) => child.type === 'block_mapping_pair');
+        if (pairs.length !== 1)
+            return false;
+        if (pairs[0].namedChildren.length > 1)
+            return false;
+        if (pairs[0].startPosition.row !== position.line)
+            return false;
+        if (position.character > pairs[0].endPosition.column)
+            return false;
+        let parent = mapping.parent;
+        while (parent && parent.type === 'block_node')
+            parent = parent.parent;
+        return parent?.type === 'block_mapping_pair';
+    }
     /**
      * Walk up, skipping block_node wrappers.
      */