aws-iam-ls 0.0.0

package/src/lib/treesitter/hcl.js

@@ -0,0 +1,888 @@
+import { resolve } from 'node:path';
+import { Language } from 'web-tree-sitter';
+import { TreeBase } from "./base.js";
+export class TreeHcl extends TreeBase {
+    static async init() {
+        const grammarDir = resolve(import.meta.dirname, '../../grammars');
+        const language = await Language.load(resolve(grammarDir, 'tree-sitter-hcl.wasm'));
+        return new TreeHcl(language);
+    }
+    getCursorContext(uri, position) {
+        const node = this.getNodeAtPosition(uri, position);
+        if (!node)
+            return null;
+        const nodeBefore = position.column > 0 ? this.getNodeAtPosition(uri, { line: position.line, column: position.column - 1 }) : null;
+        // Try jsonencode mode first (more specific structure)
+        const jsonencodeContext = this.#tryJsonencodeMode(node, nodeBefore, position);
+        if (jsonencodeContext)
+            return jsonencodeContext;
+        // Try block mode
+        const blockContext = this.#tryBlockMode(node, nodeBefore, position);
+        if (blockContext)
+            return blockContext;
+        // Try error recovery (unterminated strings break the tree)
+        return this.#tryRecoverFromError(node, nodeBefore, position);
+    }
+    getStatementContext(uri, position) {
+        const node = this.getNodeAtPosition(uri, position);
+        if (!node)
+            return null;
+        // Try jsonencode mode
+        const statementObject = this.#findJsonencodeStatementObject(node);
+        if (statementObject)
+            return this.#extractJsonencodeStatementContext(statementObject);
+        // Try block mode
+        const statementBlock = this.#findStatementBlock(node);
+        if (statementBlock) {
+            const statementBody = statementBlock.namedChildren.find((child) => child.type === 'body') ?? null;
+            if (statementBody)
+                return this.#extractBlockStatementContext(statementBody);
+        }
+        return null;
+    }
+    getSiblingKeys(uri, position) {
+        const node = this.getNodeAtPosition(uri, position);
+        if (!node)
+            return [];
+        // Try jsonencode mode
+        const statementObject = this.#findJsonencodeStatementObject(node);
+        if (statementObject)
+            return this.#collectObjectExistingKeys(this.#findInnermostObject(node, statementObject));
+        // Try block mode
+        const statementBlock = this.#findStatementBlock(node);
+        if (statementBlock) {
+            const statementBody = statementBlock.namedChildren.find((child) => child.type === 'body') ?? null;
+            if (!statementBody)
+                return [];
+            let keysBody = this.#findInnermostBody(node, statementBody);
+            // When cursor lands on a sub-block node, use that block's body
+            if (node.type === 'block') {
+                const subBody = node.namedChildren.find((child) => child.type === 'body');
+                if (subBody)
+                    keysBody = subBody;
+            }
+            return this.#collectBodyExistingKeys(keysBody);
+        }
+        return [];
+    }
+    // ---------------------------------------------------------------------------
+    // Jsonencode mode — object/object_elem/tuple, PascalCase keys, same as JSON
+    // ---------------------------------------------------------------------------
+    #tryJsonencodeMode(node, nodeBefore, position) {
+        let statementObject = this.#findJsonencodeStatementObject(node);
+        if (!statementObject && nodeBefore)
+            statementObject = this.#findJsonencodeStatementObject(nodeBefore);
+        if (!statementObject)
+            return null;
+        const context1 = this.#resolveJsonencodeCursorContext(node, statementObject, position);
+        const context2 = nodeBefore ? this.#resolveJsonencodeCursorContext(nodeBefore, statementObject, position) : null;
+        return this.#pickBestCursorContext(context1, context2);
+    }
+    #resolveJsonencodeCursorContext(node, statementObject, position) {
+        const cursorPath = this.#buildJsonencodeCursorPath(node, statementObject, position);
+        if (cursorPath.role === 'value' && !this.#isInsideQuote(node))
+            return null;
+        return { ...cursorPath, policyFormat: 'standard' };
+    }
+    #findJsonencodeStatementObject(node) {
+        let current = node;
+        while (current) {
+            if (current.type === 'object' && this.#isInsideStatementTuple(current)) {
+                return current;
+            }
+            current = current.parent;
+        }
+        return null;
+    }
+    /**
+     * Check that an object is an element of a tuple whose enclosing object_elem
+     * has the key "Statement".
+     */
+    #isInsideStatementTuple(object) {
+        // Walk up through expression/collection_value wrappers to reach the tuple
+        let current = object.parent;
+        while (current && (current.type === 'collection_value' || current.type === 'expression')) {
+            current = current.parent;
+        }
+        if (current?.type !== 'tuple')
+            return false;
+        // Walk up from tuple through wrappers to reach the object_elem
+        current = current.parent;
+        while (current && (current.type === 'collection_value' || current.type === 'expression')) {
+            current = current.parent;
+        }
+        if (current?.type !== 'object_elem')
+            return false;
+        return this.#getObjectElemKey(current) === 'Statement';
+    }
+    #buildJsonencodeCursorPath(cursorNode, statementObject, position) {
+        const keys = [];
+        let role = null;
+        let previous = null;
+        let current = cursorNode;
+        while (current && current.id !== statementObject.id) {
+            if (current.type === 'object' && role === null) {
+                role = 'key';
+            }
+            if (current.type === 'object_elem') {
+                const elementKey = this.#getObjectElemKey(current);
+                const keyExpression = current.namedChildren.find((child) => child.type === 'expression');
+                if (role === null) {
+                    if (previous && keyExpression && previous.id === keyExpression.id) {
+                        role = 'key';
+                    }
+                    else {
+                        role = 'value';
+                        if (elementKey)
+                            keys.unshift(elementKey);
+                    }
+                }
+                else {
+                    if (elementKey)
+                        keys.unshift(elementKey);
+                }
+            }
+            previous = current;
+            current = current.parent;
+        }
+        // When cursor falls on the statementObject (e.g., after an incomplete elem like
+        // "Effect = "), check if a child elem or ERROR node is on the same line.
+        if (role === null && cursorNode.id === statementObject.id) {
+            for (const child of statementObject.namedChildren) {
+                if (child.startPosition.row !== position.line)
+                    continue;
+                if (child.type === 'object_elem' || child.type === 'ERROR') {
+                    const elementKey = this.#getObjectElemKey(child);
+                    if (elementKey) {
+                        keys.unshift(elementKey);
+                        role = 'value';
+                        break;
+                    }
+                }
+            }
+        }
+        if (role === null)
+            role = 'key';
+        const partial = this.#extractJsonencodePartial(cursorNode, position);
+        return { keys, role, partial };
+    }
+    #getObjectElemKey(element) {
+        const keyExpression = element.namedChildren.find((child) => child.type === 'expression');
+        if (!keyExpression)
+            return null;
+        const variableExpression = keyExpression.namedChildren.find((child) => child.type === 'variable_expr');
+        if (!variableExpression)
+            return null;
+        const id = variableExpression.namedChildren.find((child) => child.type === 'identifier');
+        return id?.text ?? null;
+    }
+    #findInnermostObject(node, statementObject) {
+        let current = node;
+        while (current && current.id !== statementObject.id) {
+            if (current.type === 'object')
+                return current;
+            current = current.parent;
+        }
+        return statementObject;
+    }
+    #collectObjectExistingKeys(object) {
+        return object.namedChildren
+            .filter((child) => child.type === 'object_elem')
+            .map((element) => this.#getObjectElemKey(element))
+            .filter((key) => key !== null);
+    }
+    #extractJsonencodePartial(node, position) {
+        let current = node;
+        while (current) {
+            if (current.type === 'identifier' || current.type === 'template_literal') {
+                if (position.line === current.startPosition.row) {
+                    return current.text.slice(0, position.column - current.startPosition.column);
+                }
+                return current.text;
+            }
+            if (current.type === 'object' || current.type === 'object_elem')
+                break;
+            current = current.parent;
+        }
+        return '';
+    }
+    // ---------------------------------------------------------------------------
+    // Block mode — block/body/attribute, snake_case keys
+    // ---------------------------------------------------------------------------
+    #tryBlockMode(node, nodeBefore, position) {
+        let statementBlock = this.#findStatementBlock(node);
+        if (!statementBlock && nodeBefore)
+            statementBlock = this.#findStatementBlock(nodeBefore);
+        if (!statementBlock)
+            return null;
+        const statementBody = statementBlock.namedChildren.find((child) => child.type === 'body') ?? null;
+        // If cursor is inside the body, do normal cursor path walk
+        if (statementBody && this.#isDescendantOf(node, statementBody)) {
+            // Cursor right after a closing quote — no completions
+            if (nodeBefore?.type === 'quoted_template_end')
+                return null;
+            const context1 = this.#resolveBlockCursorContext(node, statementBody, position);
+            const context2 = nodeBefore ? this.#resolveBlockCursorContext(nodeBefore, statementBody, position) : null;
+            return this.#pickBestCursorContext(context1, context2);
+        }
+        // Cursor is on the block itself (outside body span) — statement-key level
+        const partial = this.#extractBlockPartial(node, position);
+        // Check for incomplete attributes on the same line (may be in ERROR nodes
+        // when tree-sitter can't parse the body due to a missing value)
+        const searchParent = statementBody ?? statementBlock;
+        for (const child of searchParent.namedChildren) {
+            if (child.startPosition.row !== position.line)
+                continue;
+            if (child.type === 'attribute' || child.type === 'ERROR') {
+                const id = child.namedChildren.find((namedChild) => namedChild.type === 'identifier');
+                if (id) {
+                    if (!this.#isInsideQuote(node) && (!nodeBefore || !this.#isInsideQuote(nodeBefore)))
+                        return null;
+                    return {
+                        keys: [id.text],
+                        role: 'value',
+                        partial: '',
+                        policyFormat: 'hcl-block',
+                    };
+                }
+            }
+        }
+        return {
+            keys: [],
+            role: 'key',
+            partial,
+            policyFormat: 'hcl-block',
+        };
+    }
+    #resolveBlockCursorContext(node, statementBody, position) {
+        const cursorPath = this.#buildBlockCursorPath(node, statementBody, position);
+        if (cursorPath.role === 'value' && !this.#isInsideQuote(node))
+            return null;
+        // When inside a principals block's identifiers attribute, read the sibling
+        // type attribute and append its value to the cursor path keys so the location
+        // resolver can emit principal-block-identifier with the correct type.
+        if ((cursorPath.keys[0] === 'principals' || cursorPath.keys[0] === 'not_principals') &&
+            cursorPath.keys[1] === 'identifiers' &&
+            cursorPath.role === 'value') {
+            const principalsBlock = this.#findEnclosingBlock(node, cursorPath.keys[0], statementBody);
+            if (principalsBlock) {
+                const blockBody = principalsBlock.namedChildren.find((child) => child.type === 'body');
+                const typeValue = blockBody ? this.#readAttributeStringValue(blockBody, 'type') : null;
+                if (typeValue)
+                    cursorPath.keys.push(typeValue);
+            }
+        }
+        return { ...cursorPath, policyFormat: 'hcl-block' };
+    }
+    #findStatementBlock(node) {
+        let current = node;
+        while (current) {
+            if (current.type === 'block' && this.#getBlockIdentifier(current) === 'statement') {
+                return current;
+            }
+            current = current.parent;
+        }
+        return null;
+    }
+    #getBlockIdentifier(block) {
+        const id = block.namedChildren.find((child) => child.type === 'identifier');
+        return id?.text ?? null;
+    }
+    #isDescendantOf(node, ancestor) {
+        let current = node;
+        while (current) {
+            if (current.id === ancestor.id)
+                return true;
+            current = current.parent;
+        }
+        return false;
+    }
+    #buildBlockCursorPath(cursorNode, statementBody, position) {
+        const keys = [];
+        let role = null;
+        let previous = null;
+        let current = cursorNode;
+        while (current && current.id !== statementBody.id) {
+            if (current.type === 'body' && role === null) {
+                role = 'key';
+            }
+            if (current.type === 'attribute') {
+                const attrKey = current.namedChildren.find((child) => child.type === 'identifier');
+                if (role === null) {
+                    if (previous && attrKey && previous.id === attrKey.id) {
+                        role = 'key';
+                    }
+                    else {
+                        role = 'value';
+                        if (attrKey)
+                            keys.unshift(attrKey.text);
+                    }
+                }
+                else {
+                    if (attrKey)
+                        keys.unshift(attrKey.text);
+                }
+            }
+            // Sub-blocks (e.g. condition, principals) contribute their identifier as a key
+            if (current.type === 'block') {
+                const blockIdentifier = this.#getBlockIdentifier(current);
+                if (blockIdentifier === 'condition' ||
+                    blockIdentifier === 'principals' ||
+                    blockIdentifier === 'not_principals') {
+                    if (role === null)
+                        role = 'key';
+                    keys.unshift(blockIdentifier);
+                }
+            }
+            previous = current;
+            current = current.parent;
+        }
+        if (role === null)
+            role = 'key';
+        const partial = this.#extractBlockPartial(cursorNode, position);
+        return { keys, role, partial };
+    }
+    #findEnclosingBlock(node, blockName, statementBody) {
+        let current = node;
+        while (current && current.id !== statementBody.id) {
+            if (current.type === 'block' && this.#getBlockIdentifier(current) === blockName)
+                return current;
+            current = current.parent;
+        }
+        return null;
+    }
+    #readAttributeStringValue(body, name) {
+        for (const child of body.namedChildren) {
+            if (child.type !== 'attribute')
+                continue;
+            const id = child.namedChildren.find((namedChild) => namedChild.type === 'identifier');
+            if (id?.text !== name)
+                continue;
+            const expression = child.namedChildren.find((namedChild) => namedChild.type === 'expression');
+            const literal = expression?.namedChildren.find((child) => child.type === 'literal_value');
+            const string = literal?.namedChildren.find((child) => child.type === 'string_lit');
+            const template = string?.namedChildren.find((child) => child.type === 'template_literal');
+            return template?.text ?? null;
+        }
+        return null;
+    }
+    #findInnermostBody(node, statementBody) {
+        let current = node;
+        while (current && current.id !== statementBody.id) {
+            if (current.type === 'body')
+                return current;
+            current = current.parent;
+        }
+        return statementBody;
+    }
+    #collectBodyExistingKeys(body) {
+        const keys = [];
+        for (const child of body.namedChildren) {
+            if (child.type === 'attribute') {
+                const id = child.namedChildren.find((namedChild) => namedChild.type === 'identifier');
+                if (id)
+                    keys.push(id.text);
+            }
+            // Sub-blocks (e.g. condition) are not included — HCL allows multiples
+        }
+        return keys;
+    }
+    #hasBodyAttribute(body, name) {
+        return body.namedChildren.some((child) => child.type === 'attribute' && child.namedChildren.some((id) => id.type === 'identifier' && id.text === name));
+    }
+    #extractBlockPartial(node, position) {
+        let current = node;
+        while (current) {
+            if (current.type === 'identifier' || current.type === 'template_literal') {
+                if (position.line === current.startPosition.row) {
+                    return current.text.slice(0, position.column - current.startPosition.column);
+                }
+                return current.text;
+            }
+            if (current.type === 'body' || current.type === 'attribute' || current.type === 'block')
+                break;
+            current = current.parent;
+        }
+        return '';
+    }
+    // ---------------------------------------------------------------------------
+    // Shared
+    // ---------------------------------------------------------------------------
+    #isInsideQuote(node) {
+        let current = node;
+        while (current) {
+            // The closing quote is part of string_lit but the cursor is past the string content
+            if (current.type === 'quoted_template_end')
+                return false;
+            if (current.type === 'quoted_template' ||
+                current.type === 'template_literal' ||
+                current.type === 'string_lit' ||
+                current.type === 'quoted_template_start')
+                return true;
+            if (current.type === 'attribute' ||
+                current.type === 'object_elem' ||
+                current.type === 'body' ||
+                current.type === 'object')
+                return false;
+            current = current.parent;
+        }
+        return false;
+    }
+    /**
+     * When tree-sitter produces a root-level ERROR (e.g., unterminated quote in
+     * a value like `actions = ["`), scan the ERROR children for statement context.
+     */
+    #tryRecoverFromError(node, nodeBefore, position) {
+        let errorNode = node;
+        while (errorNode && errorNode.type !== 'ERROR') {
+            errorNode = errorNode.parent;
+        }
+        if (!errorNode)
+            return null;
+        // Cursor must be inside a quote. In ERROR recovery, the cursor node is the
+        // ERROR itself so isInsideQuote won't find an ancestor. Check for a
+        // quoted_template_start child on the cursor line before the cursor position.
+        const hasQuoteOnLine = this.#isInsideQuote(node) ||
+            (nodeBefore && this.#isInsideQuote(nodeBefore)) ||
+            errorNode.children.some((child) => child.type === 'quoted_template_start' &&
+                child.startPosition.row === position.line &&
+                child.endPosition.column <= position.column);
+        if (!hasQuoteOnLine)
+            return null;
+        let foundStatement = false;
+        let policyFormat = null;
+        let lastKey = null;
+        let lastKeyFromAttribute = false;
+        // Sub-block tracking (principals, not_principals, condition)
+        const subBlockNames = new Set(['principals', 'not_principals', 'condition']);
+        let pendingSubBlockId = null;
+        let subBlockKey = null;
+        let subBlockTypeValue = null;
+        for (const child of errorNode.children) {
+            // Stop at children past the cursor
+            if (child.startPosition.row > position.line)
+                break;
+            // Detect statement marker: `identifier "statement"` (block) or
+            // `expression > variable_expr > identifier "Statement"` (jsonencode)
+            if (!foundStatement) {
+                if (child.type === 'identifier' && child.text === 'statement') {
+                    foundStatement = true;
+                    policyFormat = 'hcl-block';
+                }
+                else if (child.type === 'expression') {
+                    const id = this.#getExpressionIdentifier(child);
+                    if (id === 'Statement') {
+                        foundStatement = true;
+                        policyFormat = 'standard';
+                    }
+                }
+                continue;
+            }
+            // Confirm sub-block entry when we see block_start after a known sub-block identifier
+            if (child.type === 'block_start' && pendingSubBlockId) {
+                subBlockKey = pendingSubBlockId;
+                subBlockTypeValue = null;
+                pendingSubBlockId = null;
+                continue;
+            }
+            pendingSubBlockId = null;
+            // Exit sub-block on block_end
+            if (child.type === 'block_end' && subBlockKey) {
+                subBlockKey = null;
+                subBlockTypeValue = null;
+                continue;
+            }
+            // Track key identifiers after statement marker
+            if (child.type === 'identifier') {
+                lastKey = child.text;
+                lastKeyFromAttribute = false;
+                if (subBlockNames.has(child.text)) {
+                    pendingSubBlockId = child.text;
+                }
+            }
+            else if (child.type === 'expression') {
+                const id = this.#getExpressionIdentifier(child);
+                if (id) {
+                    lastKey = id;
+                    lastKeyFromAttribute = false;
+                }
+            }
+            else if (child.type === 'object_elem') {
+                const key = this.#getObjectElemKey(child);
+                if (key) {
+                    lastKey = key;
+                    lastKeyFromAttribute = true;
+                }
+            }
+            else if (child.type === 'attribute') {
+                const id = child.namedChildren.find((namedChild) => namedChild.type === 'identifier');
+                if (id) {
+                    lastKey = id.text;
+                    lastKeyFromAttribute = true;
+                    // Read type attribute value inside a principals sub-block
+                    if (subBlockKey && (subBlockKey === 'principals' || subBlockKey === 'not_principals') && id.text === 'type') {
+                        const expression = child.namedChildren.find((namedChild) => namedChild.type === 'expression');
+                        const literal = expression?.namedChildren.find((child) => child.type === 'literal_value');
+                        const string = literal?.namedChildren.find((child) => child.type === 'string_lit');
+                        const template = string?.namedChildren.find((child) => child.type === 'template_literal');
+                        if (template)
+                            subBlockTypeValue = template.text;
+                    }
+                }
+            }
+        }
+        if (!foundStatement || !lastKey || !policyFormat)
+            return null;
+        // Extract partial: when the key came from an attribute/object_elem that
+        // contains the quote (e.g., `effect = "`), it's empty. When the cursor node
+        // is inside a string (open quote slurped subsequent lines), extract from the
+        // template_literal. Otherwise extract from ERROR node text.
+        let partial = '';
+        if (!lastKeyFromAttribute) {
+            if (this.#isInsideQuote(node)) {
+                partial = this.#extractQuotedPartial(node, position);
+            }
+            else if (nodeBefore && this.#isInsideQuote(nodeBefore)) {
+                partial = this.#extractQuotedPartial(nodeBefore, position);
+            }
+            else {
+                partial = this.#extractPartialFromErrorNode(errorNode, position);
+            }
+        }
+        // Build keys with sub-block prefix when inside a sub-block
+        const keys = subBlockKey ? [subBlockKey, lastKey] : [lastKey];
+        if (subBlockKey &&
+            (subBlockKey === 'principals' || subBlockKey === 'not_principals') &&
+            lastKey === 'identifiers' &&
+            subBlockTypeValue) {
+            keys.push(subBlockTypeValue);
+        }
+        return {
+            keys,
+            role: 'value',
+            partial,
+            policyFormat,
+        };
+    }
+    /**
+     * Extract partial from inside a quoted string (when the open quote caused
+     * tree-sitter to slurp subsequent lines into a string_lit).
+     */
+    #extractQuotedPartial(node, position) {
+        let current = node;
+        while (current) {
+            if (current.type === 'template_literal') {
+                if (position.line === current.startPosition.row) {
+                    return current.text.slice(0, position.column - current.startPosition.column);
+                }
+                return '';
+            }
+            if (current.type === 'quoted_template_start')
+                return '';
+            if (current.type === 'string_lit') {
+                // Cursor is right after the opening quote, no template_literal yet
+                return '';
+            }
+            current = current.parent;
+        }
+        return '';
+    }
+    #extractPartialFromErrorNode(errorNode, position) {
+        let afterColumn = 0;
+        for (const child of errorNode.children) {
+            if (child.startPosition.row !== position.line)
+                continue;
+            // Only consider children that end on the same line (multi-line children
+            // like attributes have endPosition from a different row)
+            if (child.endPosition.row !== position.line)
+                continue;
+            if (child.endPosition.column <= position.column) {
+                afterColumn = child.endPosition.column;
+            }
+        }
+        const lines = errorNode.text.split('\n');
+        const lineIndex = position.line - errorNode.startPosition.row;
+        if (lineIndex < 0 || lineIndex >= lines.length)
+            return '';
+        const line = lines[lineIndex];
+        const startColumn = lineIndex === 0 ? errorNode.startPosition.column : 0;
+        return line.slice(afterColumn - startColumn, position.column - startColumn);
+    }
+    #getExpressionIdentifier(expression) {
+        const variableExpression = expression.namedChildren.find((child) => child.type === 'variable_expr');
+        if (!variableExpression)
+            return null;
+        const id = variableExpression.namedChildren.find((child) => child.type === 'identifier');
+        return id?.text ?? null;
+    }
+    #pickBestCursorContext(a, b) {
+        if (!a)
+            return b;
+        if (!b)
+            return a;
+        if (a.partial === '' && b.partial !== '')
+            return b;
+        if (a.partial === '' && b.partial === '' && b.keys.length > a.keys.length)
+            return b;
+        return a;
+    }
+    /**
+     * Read all string values from an attribute in an HCL body.
+     * Handles both single string (`actions = "s3:GetObject"`) and
+     * tuple (`actions = ["s3:GetObject", "s3:PutObject"]`) forms.
+     */
+    #readAttributeStringValues(body, name) {
+        for (const child of body.namedChildren) {
+            if (child.type !== 'attribute')
+                continue;
+            const id = child.namedChildren.find((namedChild) => namedChild.type === 'identifier');
+            if (id?.text !== name)
+                continue;
+            const expression = child.namedChildren.find((namedChild) => namedChild.type === 'expression');
+            if (!expression)
+                return [];
+            // Single string literal
+            const literal = expression.namedChildren.find((child) => child.type === 'literal_value');
+            if (literal) {
+                const string = literal.namedChildren.find((child) => child.type === 'string_lit');
+                const template = string?.namedChildren.find((child) => child.type === 'template_literal');
+                return template?.text ? [template.text] : [];
+            }
+            // Tuple of strings
+            let tuple = expression.namedChildren.find((child) => child.type === 'tuple');
+            if (!tuple) {
+                const collectionValue = expression.namedChildren.find((child) => child.type === 'collection_value');
+                tuple = collectionValue?.namedChildren.find((child) => child.type === 'tuple') ?? undefined;
+            }
+            if (tuple) {
+                const values = [];
+                for (const element of tuple.namedChildren) {
+                    const elementExpression = element.type === 'expression' ? element : null;
+                    const elementLiteral = elementExpression?.namedChildren.find((child) => child.type === 'literal_value');
+                    const elementString = elementLiteral?.namedChildren.find((child) => child.type === 'string_lit');
+                    const elementTemplate = elementString?.namedChildren.find((child) => child.type === 'template_literal');
+                    if (elementTemplate?.text)
+                        values.push(elementTemplate.text);
+                }
+                return values;
+            }
+        }
+        return [];
+    }
+    /**
+     * Read string values from an HCL expression (string literal or tuple of strings).
+     */
+    #readExpressionStringValues(expression) {
+        const literal = expression.namedChildren.find((child) => child.type === 'literal_value');
+        if (literal) {
+            const string = literal.namedChildren.find((child) => child.type === 'string_lit');
+            const template = string?.namedChildren.find((child) => child.type === 'template_literal');
+            return template?.text ? [template.text] : [];
+        }
+        let tuple = expression.namedChildren.find((child) => child.type === 'tuple');
+        if (!tuple) {
+            const collectionValue = expression.namedChildren.find((child) => child.type === 'collection_value');
+            tuple = collectionValue?.namedChildren.find((child) => child.type === 'tuple') ?? undefined;
+        }
+        if (tuple) {
+            const values = [];
+            for (const element of tuple.namedChildren) {
+                const elementExpression = element.type === 'expression' ? element : null;
+                const elementLiteral = elementExpression?.namedChildren.find((child) => child.type === 'literal_value');
+                const elementString = elementLiteral?.namedChildren.find((child) => child.type === 'string_lit');
+                const elementTemplate = elementString?.namedChildren.find((child) => child.type === 'template_literal');
+                if (elementTemplate?.text)
+                    values.push(elementTemplate.text);
+            }
+            return values;
+        }
+        return [];
+    }
+    /**
+     * Extract statement structure from an HCL block body (snake_case attributes).
+     */
+    #extractBlockStatementContext(statementBody) {
+        const context = {};
+        const sid = this.#readAttributeStringValue(statementBody, 'sid');
+        if (sid)
+            context.Sid = sid;
+        const effect = this.#readAttributeStringValue(statementBody, 'effect');
+        if (effect)
+            context.Effect = effect;
+        if (this.#hasBodyAttribute(statementBody, 'actions'))
+            context.Action = this.#readAttributeStringValues(statementBody, 'actions');
+        if (this.#hasBodyAttribute(statementBody, 'not_actions'))
+            context.NotAction = this.#readAttributeStringValues(statementBody, 'not_actions');
+        if (this.#hasBodyAttribute(statementBody, 'resources'))
+            context.Resource = this.#readAttributeStringValues(statementBody, 'resources');
+        if (this.#hasBodyAttribute(statementBody, 'not_resources'))
+            context.NotResource = this.#readAttributeStringValues(statementBody, 'not_resources');
+        // Read condition sub-blocks: condition { test = "Op" variable = "key" values = [...] }
+        const condition = {};
+        for (const child of statementBody.namedChildren) {
+            if (child.type !== 'block' || this.#getBlockIdentifier(child) !== 'condition')
+                continue;
+            const blockBody = child.namedChildren.find((namedChild) => namedChild.type === 'body');
+            if (!blockBody)
+                continue;
+            const test = this.#readAttributeStringValue(blockBody, 'test');
+            const variable = this.#readAttributeStringValue(blockBody, 'variable');
+            const values = this.#readAttributeStringValues(blockBody, 'values');
+            if (test) {
+                if (!condition[test])
+                    condition[test] = {};
+                if (variable)
+                    condition[test][variable] = values;
+            }
+        }
+        if (Object.keys(condition).length > 0)
+            context.Condition = condition;
+        // Read principals/not_principals sub-blocks
+        for (const blockName of ['principals', 'not_principals']) {
+            const principals = {};
+            for (const child of statementBody.namedChildren) {
+                if (child.type !== 'block' || this.#getBlockIdentifier(child) !== blockName)
+                    continue;
+                const blockBody = child.namedChildren.find((namedChild) => namedChild.type === 'body');
+                if (!blockBody)
+                    continue;
+                const type = this.#readAttributeStringValue(blockBody, 'type');
+                const identifiers = this.#readAttributeStringValues(blockBody, 'identifiers');
+                if (type) {
+                    if (type === '*') {
+                        if (blockName === 'principals')
+                            context.Principal = '*';
+                        else
+                            context.NotPrincipal = '*';
+                        break;
+                    }
+                    principals[type] = identifiers;
+                }
+            }
+            if (Object.keys(principals).length > 0) {
+                if (blockName === 'principals')
+                    context.Principal = principals;
+                else
+                    context.NotPrincipal = principals;
+            }
+        }
+        return context;
+    }
+    /**
+     * Extract statement structure from an HCL jsonencode object (PascalCase keys).
+     */
+    #extractJsonencodeStatementContext(statementObject) {
+        const context = {};
+        for (const child of statementObject.namedChildren) {
+            if (child.type !== 'object_elem')
+                continue;
+            const key = this.#getObjectElemKey(child);
+            const expressions = child.namedChildren.filter((namedChild) => namedChild.type === 'expression');
+            const valueExpression = expressions.length >= 2 ? expressions[1] : null;
+            if (!valueExpression)
+                continue;
+            if (key === 'Sid') {
+                const values = this.#readExpressionStringValues(valueExpression);
+                if (values.length > 0)
+                    context.Sid = values[0];
+            }
+            else if (key === 'Effect') {
+                const values = this.#readExpressionStringValues(valueExpression);
+                if (values.length > 0)
+                    context.Effect = values[0];
+            }
+            else if (key === 'Action') {
+                context.Action = this.#readExpressionStringValues(valueExpression);
+            }
+            else if (key === 'NotAction') {
+                context.NotAction = this.#readExpressionStringValues(valueExpression);
+            }
+            else if (key === 'Resource') {
+                context.Resource = this.#readExpressionStringValues(valueExpression);
+            }
+            else if (key === 'NotResource') {
+                context.NotResource = this.#readExpressionStringValues(valueExpression);
+            }
+            else if (key === 'Principal' || key === 'NotPrincipal') {
+                const value = this.#readJsonencodePrincipalValue(valueExpression);
+                if (value) {
+                    if (key === 'Principal')
+                        context.Principal = value;
+                    else
+                        context.NotPrincipal = value;
+                }
+            }
+            else if (key === 'Condition') {
+                context.Condition = this.#readJsonencodeConditionValue(valueExpression);
+            }
+        }
+        return context;
+    }
+    #readJsonencodePrincipalValue(expression) {
+        const values = this.#readExpressionStringValues(expression);
+        if (values.length === 1 && values[0] === '*')
+            return '*';
+        let object = expression.namedChildren.find((child) => child.type === 'object');
+        if (!object) {
+            const collectionValue = expression.namedChildren.find((child) => child.type === 'collection_value');
+            object = collectionValue?.namedChildren.find((child) => child.type === 'object') ?? undefined;
+        }
+        if (!object)
+            return null;
+        const result = {};
+        for (const child of object.namedChildren) {
+            if (child.type !== 'object_elem')
+                continue;
+            const typeKey = this.#getObjectElemKey(child);
+            const expressions = child.namedChildren.filter((namedChild) => namedChild.type === 'expression');
+            const valueExpressionession = expressions.length >= 2 ? expressions[1] : null;
+            if (typeKey && valueExpressionession)
+                result[typeKey] = this.#readExpressionStringValues(valueExpressionession);
+        }
+        return Object.keys(result).length > 0 ? result : null;
+    }
+    #readJsonencodeConditionValue(expression) {
+        const result = {};
+        let object = expression.namedChildren.find((child) => child.type === 'object');
+        if (!object) {
+            const collectionValue = expression.namedChildren.find((child) => child.type === 'collection_value');
+            object = collectionValue?.namedChildren.find((child) => child.type === 'object') ?? undefined;
+        }
+        if (!object)
+            return result;
+        for (const operatorElement of object.namedChildren) {
+            if (operatorElement.type !== 'object_elem')
+                continue;
+            const operator = this.#getObjectElemKey(operatorElement);
+            if (!operator)
+                continue;
+            const expressions = operatorElement.namedChildren.filter((child) => child.type === 'expression');
+            const valueExpressionession = expressions.length >= 2 ? expressions[1] : null;
+            if (!valueExpressionession) {
+                result[operator] = {};
+                continue;
+            }
+            let innerObject = valueExpressionession.namedChildren.find((child) => child.type === 'object');
+            if (!innerObject) {
+                const collectionValue = valueExpressionession.namedChildren.find((child) => child.type === 'collection_value');
+                innerObject = collectionValue?.namedChildren.find((child) => child.type === 'object') ?? undefined;
+            }
+            if (!innerObject) {
+                result[operator] = {};
+                continue;
+            }
+            const keys = {};
+            for (const keyElement of innerObject.namedChildren) {
+                if (keyElement.type !== 'object_elem')
+                    continue;
+                const conditionKey = this.#getObjectElemKey(keyElement);
+                const keyExpressionessions = keyElement.namedChildren.filter((child) => child.type === 'expression');
+                const keyValueExpression = keyExpressionessions.length >= 2 ? keyExpressionessions[1] : null;
+                if (conditionKey && keyValueExpression)
+                    keys[conditionKey] = this.#readExpressionStringValues(keyValueExpression);
+            }
+            result[operator] = keys;
+        }
+        return result;
+    }
+}