aws-iam-ls 0.0.0

package/src/handlers/completion/condition-operator.js

@@ -0,0 +1,22 @@
+import { CompletionItemKind, MarkupKind } from 'vscode-languageserver';
+import { conditionOperators } from "../../lib/iam-policy/condition-operators.js";
+export function completeConditionOperator(location, context) {
+    const statement = context.handler.getStatementContext(context.uri, context.position);
+    const existingOperators = Object.keys(statement?.Condition ?? {});
+    const items = [];
+    for (const [name, operator] of Object.entries(conditionOperators)) {
+        if (existingOperators.includes(name))
+            continue;
+        if (location.partial && !name.toLowerCase().startsWith(location.partial.toLowerCase()))
+            continue;
+        items.push({
+            label: name,
+            kind: CompletionItemKind.Operator,
+            documentation: {
+                kind: MarkupKind.Markdown,
+                value: operator.description,
+            },
+        });
+    }
+    return { items, isIncomplete: false };
+}

package/src/handlers/completion/effect-value.d.ts

@@ -0,0 +1,4 @@
+import type { CompletionList } from 'vscode-languageserver';
+import type { EffectValueLocation } from '../../lib/iam-policy/location.ts';
+import type { CompletionContext } from './index.ts';
+export declare function completeEffectValue(location: EffectValueLocation, _context: CompletionContext): CompletionList;

package/src/handlers/completion/effect-value.js

@@ -0,0 +1,14 @@
+import { CompletionItemKind } from 'vscode-languageserver';
+export function completeEffectValue(location, _context) {
+    const potentialLabels = ['Allow', 'Deny'];
+    const items = [];
+    for (const label of potentialLabels) {
+        if (location.partial && !label.toLowerCase().startsWith(location.partial.toLowerCase()))
+            continue;
+        items.push({
+            label,
+            kind: CompletionItemKind.Enum,
+        });
+    }
+    return { items, isIncomplete: false };
+}

package/src/handlers/completion/index.d.ts

@@ -0,0 +1,14 @@
+import type { CompletionList, CompletionParams } from 'vscode-languageserver';
+import type { TextDocuments } from 'vscode-languageserver/node.js';
+import type { TextDocument } from 'vscode-languageserver-textdocument';
+import type { TreeBase } from '../../lib/treesitter/base.ts';
+import type { TreeManager } from '../../lib/treesitter/manager.ts';
+export type CompletionContext = {
+    handler: TreeBase;
+    uri: string;
+    position: {
+        line: number;
+        column: number;
+    };
+};
+export declare function handleCompletionRequest(params: CompletionParams, _documents: TextDocuments<TextDocument>, treeManager: TreeManager): Promise<CompletionList>;

package/src/handlers/completion/index.js

@@ -0,0 +1,96 @@
+import { InsertTextFormat } from 'vscode-languageserver';
+import { resolvePolicyLocation } from "../../lib/iam-policy/location.js";
+import { completeActionValue } from "./action-value.js";
+import { completeConditionBlock } from "./condition-block.js";
+import { completeConditionKey } from "./condition-key.js";
+import { completeConditionOperator } from "./condition-operator.js";
+import { completeEffectValue } from "./effect-value.js";
+import { completePrincipalBlock } from "./principal-block.js";
+import { completePrincipalBlockIdentifier } from "./principal-block-identifier.js";
+import { completePrincipalBlockType } from "./principal-block-type.js";
+import { completePrincipalType } from "./principal-type.js";
+import { completePrincipalTypedValue } from "./principal-typed-value.js";
+import { completePrincipalValue } from "./principal-value.js";
+import { completeResourceValue } from "./resource-value.js";
+import { completeStatementBlock } from "./statement-block.js";
+import { completeStatementKey } from "./statement-key.js";
+const emptyResult = { items: [], isIncomplete: false };
+export async function handleCompletionRequest(params, _documents, treeManager) {
+    const handler = treeManager.getLanguageHandler(params.textDocument.uri);
+    if (!handler)
+        return emptyResult;
+    const position = { line: params.position.line, column: params.position.character };
+    const cursorContext = handler.getCursorContext(params.textDocument.uri, position);
+    if (!cursorContext)
+        return emptyResult;
+    const location = resolvePolicyLocation(cursorContext);
+    const result = handleLocationCompletion(location, {
+        handler,
+        uri: params.textDocument.uri,
+        position,
+    });
+    result.items = result.items.map(toSnippet);
+    return result;
+}
+function handleLocationCompletion(location, context) {
+    if (location.type === 'statement-key') {
+        return completeStatementKey(location, context);
+    }
+    else if (location.type === 'statement-block') {
+        return completeStatementBlock(location, context);
+    }
+    else if (location.type === 'effect-value') {
+        return completeEffectValue(location, context);
+    }
+    else if (location.type === 'action-value') {
+        return completeActionValue(location, context);
+    }
+    else if (location.type === 'resource-value') {
+        return completeResourceValue(location, context);
+    }
+    else if (location.type === 'principal-value') {
+        return completePrincipalValue(location, context);
+    }
+    else if (location.type === 'principal-type') {
+        return completePrincipalType(location, context);
+    }
+    else if (location.type === 'principal-block') {
+        return completePrincipalBlock(location, context);
+    }
+    else if (location.type === 'principal-block-identifier') {
+        return completePrincipalBlockIdentifier(location, context);
+    }
+    else if (location.type === 'principal-block-type') {
+        return completePrincipalBlockType(location, context);
+    }
+    else if (location.type === 'principal-typed-value') {
+        return completePrincipalTypedValue(location, context);
+    }
+    else if (location.type === 'condition-block') {
+        return completeConditionBlock(location, context);
+    }
+    else if (location.type === 'condition-key') {
+        return completeConditionKey(location, context);
+    }
+    else if (location.type === 'condition-operator') {
+        return completeConditionOperator(location, context);
+    }
+    return emptyResult;
+}
+function toSnippet(item) {
+    const text = item.insertText ?? item.label;
+    const snippetPlaceholderPattern = /\$\{([^}]+)\}/g;
+    if (!snippetPlaceholderPattern.test(text))
+        return item;
+    let tabStop = 0;
+    const seen = new Map();
+    const snippetText = text.replace(snippetPlaceholderPattern, (_match, name) => {
+        if (!seen.has(name)) {
+            seen.set(name, ++tabStop);
+        }
+        return `\${${seen.get(name)}:${name}}`;
+    });
+    item.insertText = snippetText;
+    item.insertTextFormat = InsertTextFormat.Snippet;
+    return item;
+}

package/src/handlers/completion/principal-block-identifier.d.ts

@@ -0,0 +1,4 @@
+import type { CompletionList } from 'vscode-languageserver';
+import type { PrincipalBlockIdentifierLocation } from '../../lib/iam-policy/location.ts';
+import type { CompletionContext } from './index.ts';
+export declare function completePrincipalBlockIdentifier(location: PrincipalBlockIdentifierLocation, _context: CompletionContext): CompletionList;

package/src/handlers/completion/principal-block-identifier.js

@@ -0,0 +1,4 @@
+import { completePrincipalIdentifier } from "./principal-identifier-completions.js";
+export function completePrincipalBlockIdentifier(location, _context) {
+    return completePrincipalIdentifier(location.principalType, location.partial);
+}

package/src/handlers/completion/principal-block-type.d.ts

@@ -0,0 +1,4 @@
+import type { CompletionList } from 'vscode-languageserver';
+import type { PrincipalBlockTypeLocation } from '../../lib/iam-policy/location.ts';
+import type { CompletionContext } from './index.ts';
+export declare function completePrincipalBlockType(location: PrincipalBlockTypeLocation, _context: CompletionContext): CompletionList;

package/src/handlers/completion/principal-block-type.js

@@ -0,0 +1,24 @@
+import { CompletionItemKind } from 'vscode-languageserver';
+import { principalTypes } from "../../lib/iam-policy/principals.js";
+export function completePrincipalBlockType(location, _context) {
+    const items = [];
+    for (const [_id, principalType] of Object.entries(Object.assign({}, principalTypes, {
+        '*': {
+            value: '*',
+            description: 'Public Unauthenticated Access',
+            patterns: ['*'],
+        },
+    }))) {
+        if (location.partial && !principalType.value.toLowerCase().startsWith(location.partial.toLowerCase()))
+            continue;
+        items.push({
+            label: principalType.value,
+            kind: CompletionItemKind.Enum,
+            documentation: {
+                kind: 'markdown',
+                value: principalType.description,
+            },
+        });
+    }
+    return { items, isIncomplete: false };
+}

package/src/handlers/completion/principal-block.d.ts

@@ -0,0 +1,4 @@
+import type { CompletionList } from 'vscode-languageserver';
+import type { PrincipalBlockLocation } from '../../lib/iam-policy/location.ts';
+import type { CompletionContext } from './index.ts';
+export declare function completePrincipalBlock(location: PrincipalBlockLocation, context: CompletionContext): CompletionList;

package/src/handlers/completion/principal-block.js

@@ -0,0 +1,28 @@
+import { CompletionItemKind, MarkupKind } from 'vscode-languageserver';
+const principalBlockAttributes = {
+    type: {
+        description: 'The type of principal. Valid values: `*`, `AWS`, `Service`, `Federated`, `CanonicalUser`.',
+    },
+    identifiers: {
+        description: 'List of principal identifiers. The format depends on the `type` attribute.',
+    },
+};
+export function completePrincipalBlock(location, context) {
+    const siblingKeys = context.handler.getSiblingKeys(context.uri, context.position);
+    const items = [];
+    for (const [name, attr] of Object.entries(principalBlockAttributes)) {
+        if (siblingKeys.includes(name))
+            continue;
+        if (location.partial && !name.toLowerCase().startsWith(location.partial.toLowerCase()))
+            continue;
+        items.push({
+            label: name,
+            kind: CompletionItemKind.Field,
+            documentation: {
+                kind: MarkupKind.Markdown,
+                value: attr.description,
+            },
+        });
+    }
+    return { items, isIncomplete: false };
+}

package/src/handlers/completion/principal-identifier-completions.d.ts

@@ -0,0 +1,2 @@
+import type { CompletionList } from 'vscode-languageserver';
+export declare function completePrincipalIdentifier(principalType: string | null, partial: string): CompletionList;

package/src/handlers/completion/principal-identifier-completions.js

@@ -0,0 +1,131 @@
+import { CompletionItemKind } from 'vscode-languageserver';
+import { partitions } from "../../lib/iam-policy/partitions.js";
+import { principalTypes } from "../../lib/iam-policy/principals.js";
+const PARTITION_PLACEHOLDER = `\${Partition}`;
+const REGION_PLACEHOLDER = `\${Region}`;
+const ACCOUNT_PLACEHOLDER = `\${Account}`;
+function getPatternsForType(principalType) {
+    switch (principalType) {
+        case '*':
+            return { arn: [], nonArn: ['*'] };
+        case 'AWS':
+            return {
+                arn: principalTypes.aws.patterns.filter((pattern) => pattern.startsWith('arn:')),
+                nonArn: principalTypes.aws.patterns.filter((pattern) => !pattern.startsWith('arn:')),
+            };
+        case 'Federated':
+            return {
+                arn: principalTypes.federated.patterns.filter((pattern) => pattern.startsWith('arn:')),
+                nonArn: principalTypes.federated.patterns.filter((pattern) => !pattern.startsWith('arn:')),
+            };
+        case 'Service':
+            return { arn: [], nonArn: [...principalTypes.service.patterns] };
+        default:
+            return null;
+    }
+}
+export function completePrincipalIdentifier(principalType, partial) {
+    if (!principalType)
+        return { items: [], isIncomplete: false };
+    const config = getPatternsForType(principalType);
+    if (!config)
+        return { items: [], isIncomplete: false };
+    const items = [];
+    if (!partial) {
+        for (const pattern of [...config.nonArn, ...config.arn]) {
+            items.push({ label: pattern, kind: CompletionItemKind.Value });
+        }
+        return { items, isIncomplete: false };
+    }
+    const parts = partial.split(':');
+    if (parts.length === 1) {
+        if (config.arn.length > 0 && 'arn'.startsWith(partial.toLowerCase())) {
+            items.push({ label: 'arn', kind: CompletionItemKind.Constant });
+        }
+        for (const pattern of config.nonArn) {
+            if (pattern.toLowerCase().startsWith(partial.toLowerCase())) {
+                items.push({ label: pattern, kind: CompletionItemKind.Value });
+            }
+        }
+    }
+    else if (parts.length === 2) {
+        for (const [id, partition] of Object.entries(partitions)) {
+            const prefix = `${parts[0]}:${id}`;
+            if (prefix.toLowerCase().startsWith(partial.toLowerCase())) {
+                items.push({
+                    label: id,
+                    kind: CompletionItemKind.Enum,
+                    documentation: { kind: 'markdown', value: partition.name },
+                });
+            }
+        }
+    }
+    else if (parts.length === 3) {
+        const services = [...new Set(config.arn.map((pattern) => pattern.split(':')[2]))];
+        for (const service of services) {
+            const prefix = `${parts[0]}:${parts[1]}:${service}`;
+            if (prefix.toLowerCase().startsWith(partial.toLowerCase())) {
+                items.push({ label: service, kind: CompletionItemKind.Enum });
+            }
+        }
+    }
+    else if (parts.length === 4) {
+        const service = parts[2];
+        const serviceArns = config.arn.filter((pattern) => pattern.split(':')[2] === service);
+        const hasRegionArn = serviceArns.some((pattern) => pattern.split(':')[3].length > 0);
+        if (!hasRegionArn) {
+            items.push({
+                label: ':',
+                kind: CompletionItemKind.Enum,
+                documentation: { kind: 'markdown', value: 'No region component for this service' },
+            });
+        }
+        else {
+            const partition = parts[1] === 'aws' || parts[1] === 'aws-us-gov' || parts[1] === 'aws-cn'
+                ? partitions[parts[1]]
+                : partitions.aws;
+            for (const region of partition.regions) {
+                const prefix = `${parts[0]}:${parts[1]}:${parts[2]}:${region.id}`;
+                if (prefix.toLowerCase().startsWith(partial.toLowerCase())) {
+                    items.push({
+                        label: region.id,
+                        kind: CompletionItemKind.Enum,
+                        documentation: { kind: 'markdown', value: region.name },
+                    });
+                }
+            }
+        }
+    }
+    else if (parts.length === 5) {
+        items.push({
+            label: `${partial}:`,
+            kind: CompletionItemKind.Enum,
+            documentation: { kind: 'markdown', value: 'AWS Account ID' },
+        });
+    }
+    else {
+        const service = parts[2];
+        const region = parts[3];
+        const account = parts[4];
+        const matching = config.arn.filter((pattern) => {
+            const patternParts = pattern.split(':');
+            if (patternParts[2] !== service)
+                return false;
+            if (region.length > 0 !== patternParts[3].length > 0)
+                return false;
+            if (account.length > 0 !== patternParts[4].length > 0)
+                return false;
+            return true;
+        });
+        for (const pattern of matching) {
+            const label = pattern
+                .replace(PARTITION_PLACEHOLDER, parts[1])
+                .replace(REGION_PLACEHOLDER, region)
+                .replace(ACCOUNT_PLACEHOLDER, account);
+            if (!label.toLowerCase().startsWith(partial.toLowerCase()))
+                continue;
+            items.push({ label, kind: CompletionItemKind.Value });
+        }
+    }
+    return { items, isIncomplete: false };
+}

package/src/handlers/completion/principal-type.d.ts

@@ -0,0 +1,4 @@
+import type { CompletionList } from 'vscode-languageserver';
+import type { PrincipalTypeLocation } from '../../lib/iam-policy/location.ts';
+import type { CompletionContext } from './index.ts';
+export declare function completePrincipalType(location: PrincipalTypeLocation, context: CompletionContext): CompletionList;

package/src/handlers/completion/principal-type.js

@@ -0,0 +1,23 @@
+import { CompletionItemKind } from 'vscode-languageserver';
+import { principalTypes } from "../../lib/iam-policy/principals.js";
+export function completePrincipalType(location, context) {
+    const statement = context.handler.getStatementContext(context.uri, context.position);
+    const principal = statement?.Principal ?? statement?.NotPrincipal;
+    const existingTypes = principal && typeof principal === 'object' ? Object.keys(principal) : [];
+    const items = [];
+    for (const [_id, principalType] of Object.entries(principalTypes)) {
+        if (existingTypes.includes(principalType.value))
+            continue;
+        if (location.partial && !principalType.value.toLowerCase().startsWith(location.partial.toLowerCase()))
+            continue;
+        items.push({
+            label: principalType.value,
+            kind: CompletionItemKind.Enum,
+            documentation: {
+                kind: 'markdown',
+                value: principalType.description,
+            },
+        });
+    }
+    return { items, isIncomplete: false };
+}

package/src/handlers/completion/principal-typed-value.d.ts

@@ -0,0 +1,4 @@
+import type { CompletionList } from 'vscode-languageserver';
+import type { PrincipalTypedValueLocation } from '../../lib/iam-policy/location.ts';
+import type { CompletionContext } from './index.ts';
+export declare function completePrincipalTypedValue(location: PrincipalTypedValueLocation, _context: CompletionContext): CompletionList;

package/src/handlers/completion/principal-typed-value.js

@@ -0,0 +1,4 @@
+import { completePrincipalIdentifier } from "./principal-identifier-completions.js";
+export function completePrincipalTypedValue(location, _context) {
+    return completePrincipalIdentifier(location.principalType, location.partial);
+}

package/src/handlers/completion/principal-value.d.ts

@@ -0,0 +1,4 @@
+import type { CompletionList } from 'vscode-languageserver';
+import type { PrincipalValueLocation } from '../../lib/iam-policy/location.ts';
+import type { CompletionContext } from './index.ts';
+export declare function completePrincipalValue(location: PrincipalValueLocation, _context: CompletionContext): CompletionList;

package/src/handlers/completion/principal-value.js

@@ -0,0 +1,18 @@
+import { CompletionItemKind } from 'vscode-languageserver';
+export function completePrincipalValue(location, _context) {
+    const potentialLabels = ['*'];
+    const items = [];
+    for (const label of potentialLabels) {
+        if (location.partial && !label.toLowerCase().startsWith(location.partial.toLowerCase()))
+            continue;
+        items.push({
+            label,
+            kind: CompletionItemKind.Enum,
+            documentation: {
+                kind: 'markdown',
+                value: 'Public Unauthenticated Access',
+            },
+        });
+    }
+    return { items, isIncomplete: false };
+}

package/src/handlers/completion/resource-value.d.ts

@@ -0,0 +1,4 @@
+import type { CompletionList } from 'vscode-languageserver';
+import type { ResourceValueLocation } from '../../lib/iam-policy/location.ts';
+import type { CompletionContext } from './index.ts';
+export declare function completeResourceValue(location: ResourceValueLocation, context: CompletionContext): CompletionList;

package/src/handlers/completion/resource-value.js

@@ -0,0 +1,144 @@
+import { CompletionItemKind } from 'vscode-languageserver';
+import { partitions } from "../../lib/iam-policy/partitions.js";
+import { ServiceReference } from "../../lib/iam-policy/reference/services.js";
+import { expandActionPattern } from "../../lib/iam-policy/wildcard.js";
+export function completeResourceValue(location, context) {
+    const parts = location.partial.split(':');
+    const items = [];
+    const statement = context.handler.getStatementContext(context.uri, context.position);
+    const statementActions = statement?.Action ?? statement?.NotAction ?? [];
+    const expandedActions = statementActions.flatMap(expandActionPattern);
+    const resources = ServiceReference.getResourcesForActions(expandedActions);
+    for (const [arn, resource] of resources.entries()) {
+        if (location.partial && !arn.toLowerCase().startsWith(location.partial.toLowerCase()))
+            continue;
+        items.push({
+            label: arn,
+            sortText: `0-${arn}`,
+            kind: CompletionItemKind.Value,
+            detail: `${resource.service}/${resource.name}`,
+            documentation: {
+                kind: 'markdown',
+                value: [`**Condition Keys**:`, '', resource.conditionKeys.map((key) => `- \`${key}\``).join('\n')].join('\n'),
+            },
+        });
+    }
+    if (parts.length === 1) {
+        // suggest only arn
+        const label = 'arn';
+        if (!location.partial || label.toLowerCase().startsWith(location.partial.toLowerCase())) {
+            items.push({
+                label,
+                kind: CompletionItemKind.Constant,
+            });
+        }
+    }
+    else if (parts.length === 2) {
+        // suggest partitions
+        const potentialItems = Object.entries(partitions).map(([id, partition]) => ({
+            label: id,
+            kind: CompletionItemKind.Enum,
+            documentation: {
+                kind: 'markdown',
+                value: partition.name,
+            },
+        }));
+        for (const item of potentialItems) {
+            if (!location.partial || `${parts[0]}:${item.label.toLowerCase()}`.startsWith(location.partial.toLowerCase())) {
+                items.push(item);
+            }
+        }
+    }
+    else if (parts.length === 3) {
+        // suggest services
+        const services = ServiceReference.getAllServices();
+        for (const service of services) {
+            if (!location.partial ||
+                `${parts[0]}:${parts[1]}:${service}`.toLowerCase().startsWith(location.partial.toLowerCase())) {
+                items.push({
+                    label: service,
+                    kind: CompletionItemKind.Enum,
+                });
+            }
+        }
+    }
+    else if (parts.length === 4) {
+        // suggest regions
+        const partition = parts[1] === 'aws' || parts[1] === 'aws-us-gov' || parts[1] === 'aws-cn' ? partitions[parts[1]] : partitions.aws;
+        const service = parts[2];
+        const resources = ServiceReference.getResourcesForActions(expandActionPattern(`${service}:*`));
+        let hasRegionArn = false;
+        for (const arn of resources.keys()) {
+            if (arn.includes(`\${Region}`))
+                hasRegionArn = true;
+        }
+        if (!hasRegionArn) {
+            items.push({
+                label: ':',
+                kind: CompletionItemKind.Enum,
+                documentation: {
+                    kind: 'markdown',
+                    value: 'This service has no ARNs with a region component',
+                },
+            });
+        }
+        else {
+            for (const region of partition.regions) {
+                if (!location.partial ||
+                    `${parts[0]}:${parts[1]}:${parts[2]}:${region.id}`.toLowerCase().startsWith(location.partial.toLowerCase())) {
+                    items.push({
+                        label: region.id,
+                        kind: CompletionItemKind.Enum,
+                        documentation: {
+                            kind: 'markdown',
+                            value: region.name,
+                        },
+                    });
+                }
+            }
+        }
+    }
+    else if (parts.length === 5) {
+        // suggest account
+        items.push({
+            label: `${location.partial}:`,
+            kind: CompletionItemKind.Enum,
+            documentation: {
+                kind: 'markdown',
+                value: '# AWS Account ID',
+            },
+        });
+    }
+    else {
+        // suggest service resources
+        const service = parts[2];
+        const region = parts[3];
+        const account = parts[4];
+        const resources = ServiceReference.getResourcesForActions(expandActionPattern(`${service}:*`));
+        for (const resource of resources.values()) {
+            const patternParts = resource.arn.split(':');
+            const patternRegion = patternParts[3];
+            const patternAccount = patternParts[4];
+            if (region.length > 0 !== patternRegion.length > 0)
+                continue;
+            if (account.length > 0 !== patternAccount.length > 0)
+                continue;
+            const label = resource.arn
+                .replace(`\${Partition}`, parts[1])
+                .replace(`\${Region}`, parts[3])
+                .replace(`\${Account}`, parts[4]);
+            if (location.partial && !label.toLowerCase().startsWith(location.partial.toLowerCase()))
+                continue;
+            items.push({
+                label,
+                kind: CompletionItemKind.Enum,
+                detail: resource.name,
+                documentation: {
+                    kind: 'markdown',
+                    value: [`**Condition Keys**:`, '', resource.conditionKeys.map((key) => `- \`${key}\``).join('\n')].join('\n'),
+                },
+            });
+        }
+    }
+    return { items, isIncomplete: false };
+}

package/src/handlers/completion/statement-block.d.ts

@@ -0,0 +1,10 @@
+import type { CompletionList } from 'vscode-languageserver';
+import type { StatementBlockLocation } from '../../lib/iam-policy/location.ts';
+import type { CompletionContext } from './index.ts';
+export declare function completeStatementBlock(location: StatementBlockLocation, context: CompletionContext): CompletionList;
+export declare function findHclElement(key: string): {
+    policyTypes: Array<"identity" | "resource">;
+    description: string;
+    group: string;
+    hclKey: string;
+} | null;

package/src/handlers/completion/statement-block.js

@@ -0,0 +1,51 @@
+import { CompletionItemKind, MarkupKind } from 'vscode-languageserver';
+import { StatementKeys } from "../../lib/iam-policy/statement-keys.js";
+export function completeStatementBlock(location, context) {
+    const statement = context.handler.getStatementContext(context.uri, context.position);
+    const existingKeys = deriveExistingKeys(statement);
+    const existingGroups = new Set();
+    for (const key of existingKeys) {
+        const element = findHclElement(key);
+        if (element)
+            existingGroups.add(element.group);
+    }
+    const items = [];
+    for (const [, element] of Object.entries(StatementKeys)) {
+        if (existingKeys.includes(element.hclKey))
+            continue;
+        if (existingGroups.has(element.group))
+            continue;
+        if (location.partial && !element.hclKey.toLowerCase().startsWith(location.partial.toLowerCase()))
+            continue;
+        items.push({
+            label: element.hclKey,
+            kind: CompletionItemKind.Field,
+            documentation: {
+                kind: MarkupKind.Markdown,
+                value: element.description,
+            },
+        });
+    }
+    return { items, isIncomplete: false };
+}
+export function findHclElement(key) {
+    for (const [, element] of Object.entries(StatementKeys)) {
+        if (element.hclKey === key)
+            return element;
+    }
+    return null;
+}
+function deriveExistingKeys(statement) {
+    if (!statement)
+        return [];
+    const keys = [];
+    for (const [name, element] of Object.entries(StatementKeys)) {
+        // sub-blocks (condition, principals, not_principals) allow multiples — never exclude them
+        if (name === 'Condition' || name === 'Principal' || name === 'NotPrincipal')
+            continue;
+        if (name in statement) {
+            keys.push(element.hclKey);
+        }
+    }
+    return keys;
+}

package/src/handlers/completion/statement-key.d.ts

@@ -0,0 +1,4 @@
+import type { CompletionList } from 'vscode-languageserver';
+import type { StatementKeyLocation } from '../../lib/iam-policy/location.ts';
+import type { CompletionContext } from './index.ts';
+export declare function completeStatementKey(location: StatementKeyLocation, context: CompletionContext): CompletionList;