backup: uncommitted changes from MAC-M9FQ0900T3 2026-05-17 15:52:31

2026-05-17 15:52:31 +02:00
18 changed files with 497 additions and 4982 deletions
--- a/5
+++ b/5
@@ -12,6 +12,10 @@ RUN apt-get update && apt-get install -y --no-install-recommends curl unzip ca-c
 COPY scripts/download_bicep_ls.sh /scripts/
 RUN chmod +x /scripts/download_bicep_ls.sh && BICEP_VERSION=${BICEP_VERSION} /scripts/download_bicep_ls.sh
 # Download Azure DevOps pipeline schema for YAML task completions
 RUN curl -f -o /azdo-pipeline-schema.json \
    "https://raw.githubusercontent.com/microsoft/azure-pipelines-vscode/main/service-schema.json"
 # ── Stage 2: Python wheel build ───────────────────────────────────────────────
 FROM python:3.12-slim AS builder
@@ -41,6 +45,7 @@ RUN apt-get update \
 # Copy Bicep Language Server (baked in at build time — no volume needed)
 COPY --from=bicep-downloader /opt/bicep-langserver /opt/bicep-langserver
 COPY --from=bicep-downloader /azdo-pipeline-schema.json /azdo-pipeline-schema.json
 # Install Python package and dependencies
 COPY --from=builder /dist/*.whl /tmp/
--- a/EDITOR_SETUP.md
+++ b/EDITOR_SETUP.md
@@ -14,49 +14,17 @@ supports LSP WebSocket transport.
 ## IntelliJ IDEA setup (LSP4IJ)
-Install the [LSP4IJ](https://plugins.jetbrains.com/plugin/23257-lsp4ij) plugin, then add language servers:
+Install the [LSP4IJ](https://plugins.jetbrains.com/plugin/23257-lsp4ij) plugin, then:
 ### Bicep
 1. **Settings → Languages & Frameworks → LSP → Language Servers → +**
   - Name: `iLSP Bicep`
-   - Server type: `Command` (not WebSocket — see note below)
+   - Server type: `WebSocket`
-   - Command: `/Users/lrihni/Projects/iLSP/scripts/lsp_bridge_debug.sh wss://ilsp.i80.dk/bicep`
+   - URL: `wss://ilsp.i80.dk/bicep`
   - Arguments: (leave blank)
   - File pattern: `*.bicep;*.bicepparam`
-### YAML (Azure DevOps + GitHub Actions)
+2. **Add a file-type mapping** under the new server entry:
   - File type: `Bicep` (or pattern `*.bicep`)
-2. **Settings → Languages & Frameworks → LSP → Language Servers → +**
+3. **Disable Azure Toolkit Bicep completions** — this is critical if you have the
   - Name: `iLSP YAML`
   - Server type: `Command`
   - Command: `/Users/lrihni/Projects/iLSP/scripts/lsp_bridge_debug.sh wss://ilsp.i80.dk/yaml`
   - Arguments: (leave blank)
   - File pattern: `*.yaml;*.yml;azure-pipelines.yml`
 ### Python (optional)
 3. **Settings → Languages & Frameworks → LSP → Language Servers → +**
   - Name: `iLSP Python`
   - Server type: `Command`
   - Command: `/Users/lrihni/Projects/iLSP/scripts/lsp_bridge_debug.sh wss://ilsp.i80.dk/python`
   - Arguments: (leave blank)
   - File pattern: `*.py`
   > **Note**: LSP4IJ's WebSocket mode doesn't handle LSP Content-Length framing correctly,
   > causing "starting..." to hang or "Stream closed" errors. Use `lsp_bridge_debug.sh` wrapper
   > which calls `lsp_bridge.py` and logs errors to `/tmp/lsp_bridge_debug.log` for debugging.
 ### Troubleshooting
 If the language server doesn't start, check the debug log:
 ```bash
 tail -f /tmp/lsp_bridge_debug.log
 ```
 ### Disable conflicting plugins
 **Disable Azure Toolkit Bicep completions** — this is critical if you have the
   Azure Toolkit plugin installed. Without this step, IDEA merges completions from
   both LSP4IJ and Azure Toolkit, resulting in noisy suggestions (`resource`,
   `projectName`, Bicep schema types, etc.) appearing alongside iLSP results.
@@ -75,20 +43,13 @@ tail -f /tmp/lsp_bridge_debug.log
 ## Neovim setup
 > **Important**: `vim.lsp.rpc.connect(url)` does **not** speak WebSocket — it's a raw
 > TCP/pipe connector and will fail with `ENOENT` on a `wss://` URL (verified). Use
 > `cmd = { ".../scripts/lsp_bridge_debug.sh", "wss://..." }` instead (stdio ↔
 > WebSocket bridge, same one IntelliJ/LSP4IJ uses). Confirmed working end-to-end
 > (32 module completions returned) with the config below.
 ```lua
 -- In your LSP config (e.g. ~/.config/nvim/lua/lsp.lua)
 local BRIDGE = "/Users/lrihni/Projects/iLSP/scripts/lsp_bridge_debug.sh"
 -- Bicep
 vim.lsp.start({
  name = "ilsp-bicep",
-  cmd = { BRIDGE, "wss://ilsp.i80.dk/bicep" },
+  cmd = vim.lsp.rpc.connect("wss://ilsp.i80.dk/bicep"),
  root_dir = vim.fs.dirname(vim.fs.find({ "bicepconfig.json", ".git" }, { upward = true })[1]),
  filetypes = { "bicep" },
 })
@@ -96,7 +57,7 @@ vim.lsp.start({
 -- YAML (pipeline files)
 vim.lsp.start({
  name = "ilsp-yaml",
-  cmd = { BRIDGE, "wss://ilsp.i80.dk/yaml" },
+  cmd = vim.lsp.rpc.connect("wss://ilsp.i80.dk/yaml"),
  root_dir = vim.fs.dirname(vim.fs.find({ ".git" }, { upward = true })[1]),
  filetypes = { "yaml" },
 })
@@ -104,7 +65,7 @@ vim.lsp.start({
 -- Python
 vim.lsp.start({
  name = "ilsp-python",
-  cmd = { BRIDGE, "wss://ilsp.i80.dk/python" },
+  cmd = vim.lsp.rpc.connect("wss://ilsp.i80.dk/python"),
  root_dir = vim.fs.dirname(vim.fs.find({ "pyproject.toml", ".git" }, { upward = true })[1]),
  filetypes = { "python" },
 })
@@ -189,20 +150,12 @@ python3 scripts/sync_pipeline_templates.py   # → pipeline_templates_catalog.js
 python3 scripts/sync_iac_module_sources.py   # → iac_source_catalog.json (from DevOpsMCP)
 python3 scripts/sync_bicep_modules.py        # → bicep_modules_catalog.json
-# 2. Commit + push — Gitea Actions builds the image and Nomad redeploys it
+# 2. Push and deploy
-git add bicep_modules_catalog.json iac_source_catalog.json pipeline_templates_catalog.json
+bash scripts/push_catalogs.sh
 git commit -m "chore: refresh catalogs"
 git push
 ```
-> **Note**: `scripts/push_catalogs.sh` and the `/reload` endpoint only take effect if
+The `/reload` endpoint on the running service reloads catalogs from volume-mounted
-> `/data` is volume-mounted into the running container. **Production (`ilsp.nomad`)
+files if present, so you can update without a full redeploy for pipeline templates.
 > currently has no `/data` mount** — the underlying Nomad client has raw Docker bind
 > mounts disabled (`volumes are not enabled`), so `push_catalogs.sh` silently pushes
 > to a path the container never sees, and `/reload` is a no-op there. `/data` only
 > works for **local dev** via `make run-with-data`. In production, catalog updates
 > always require a commit + redeploy (as above) until the client is configured with
 > a proper Nomad `host_volume`.
 ---
--- a/README.md
+++ b/README.md
@@ -13,70 +13,6 @@ Provides smart autocomplete on top of standard LSPs:
 → See **[EDITOR_SETUP.md](EDITOR_SETUP.md)** for editor configuration and a full feature overview.
 ## LSP feature coverage
 Full capability audit against production (verified 2026-08-14) — everything below
 is confirmed working end-to-end over the live WebSocket endpoints, not just in
 theory:
 | Feature | Bicep (`/bicep`) | Python (`/python`) | YAML (`/yaml`) |
 |---|---|---|---|
 | Completions (+ internal catalogs) | ✅ | ✅ | ✅ |
 | Hover | ✅ | ✅ | ✅ |
 | Go to definition | ✅ | ✅ | — |
 | Find references | ✅ | ✅ | — |
 | Document symbols | ✅ | ✅ | — |
 | Document formatting | ✅ | ✅ | — |
 | Code actions | ✅ | ✅ | — |
 | Signature help | ✅ *(iLSP-provided)* | ✅ | — |
 | Folding range | ✅ *(iLSP-provided)* | ✅ | — |
 | Workspace symbol | ✅ *(iLSP-provided)* | ❌ (pylsp doesn't implement it) | — |
 | Diagnostics | ✅ | ✅ | ✅ |
 Bicep.LangServer itself (v0.46.1, latest) doesn't implement signature help,
 folding range, or workspace symbol — iLSP answers these three locally in the
 proxy (`ilsp/bicep_lsp/local_features.py`) instead of forwarding to a backend
 that would just error or return nothing.
 ### Confirmed examples (live against `wss://ilsp.i80.dk/bicep`)
 **Role-array completion** — cursor inside `roles: [...]` returns all 682 Azure
 built-in roles:
 ```
 roles: ['KEY_VAULT_SECRETS_USER', 'STORAGE_BLOB_DATA_CONTRIBUTOR', <cursor>]
 → 682 items: ACCESS_REVIEW_OPERATOR_SERVICE_ROLE, ACRDELETE, ACRIMAGESIGNER, ACRPULL, ACRPUSH, ...
 ```
 **Go to definition** — jumping from a variable usage to its declaration:
 ```bicep
 var storageName = '${projectName}storage'   # ← declared here (line 2)
 resource sa '...' = {
  name: storageName                          # ← cursor here → jumps to line 2
 }
 ```
 **Find references** — from the `storageName` declaration, finds both places
 it's used: the string interpolation `${projectName}storage` isn't a reference,
 but the `resource sa { name: storageName }` property assignment is — returns
 the declaration itself plus that 1 real usage (2 results total).
 **Document symbols** — outline for a file with params/vars/resources/modules:
 ```
 location, projectName, storageName, sa, roleAssignment, storageId
 ```
 **Signature help** — cursor right after `resourceId(`:
 ```
 resourceId(resourceType, resourceName1, resourceName2...)
                ^ active parameter highlighted
 ```
 **Folding range** — every multi-line `{}`/`[]`/`()` block returned as a
 collapsible region (nested blocks included).
 **Workspace symbol** — searching `"storage"` across all open documents in the
 editor session returns `storageName`, `storageId`, etc.
 ## Quick start
 ```bash
@@ -95,14 +31,9 @@ make health     # curl health endpoint
 ## Updating catalogs
 Catalogs are baked into the Docker image at build time — commit + push to update
 production (see [EDITOR_SETUP.md](EDITOR_SETUP.md#updating-catalogs) for the full
 workflow and a note on why `push_catalogs.sh` / `/reload` don't take effect in prod).
 ```bash
 python3 scripts/sync_pipeline_templates.py  # scan AzDO + GHA template repos
-python3 scripts/sync_bicep_modules.py       # from DevOpsMCP repo — needs az CLI + ACR access
+bash scripts/push_catalogs.sh               # scp to server + /reload
 git add *_catalog.json && git commit -m "chore: refresh catalogs" && git push
 ```
 ## Deploy
--- a/bicep_modules_catalog.json
+++ b/bicep_modules_catalog.json
--- a/ilsp/bicep_lsp/azure_roles.json
+++ b/ilsp/bicep_lsp/azure_roles.json
@@ -1,684 +0,0 @@
 [
  "ACCESS_REVIEW_OPERATOR_SERVICE_ROLE",
  "ACRDELETE",
  "ACRIMAGESIGNER",
  "ACRPULL",
  "ACRPUSH",
  "ACRQUARANTINEREADER",
  "ACRQUARANTINEWRITER",
  "ADVISOR_RECOMMENDATIONS_CONTRIBUTOR_ASSESSMENTS_AND_REVIEWS",
  "ADVISOR_REVIEWS_CONTRIBUTOR",
  "ADVISOR_REVIEWS_READER",
  "AGENTLESS_SCANNING_FOR_SERVERLESS_SCANNER_SERVICE_ROLE",
  "AGFOOD_PLATFORM_DATASET_ADMIN",
  "AGFOOD_PLATFORM_SENSOR_PARTNER_CONTRIBUTOR",
  "AGFOOD_PLATFORM_SERVICE_ADMIN",
  "AGFOOD_PLATFORM_SERVICE_CONTRIBUTOR",
  "AGFOOD_PLATFORM_SERVICE_READER",
  "ANYBUILD_BUILDER",
  "API_MANAGEMENT_DEVELOPER_PORTAL_CONTENT_EDITOR",
  "API_MANAGEMENT_SERVICE_CONTRIBUTOR",
  "API_MANAGEMENT_SERVICE_OPERATOR_ROLE",
  "API_MANAGEMENT_SERVICE_READER_ROLE",
  "API_MANAGEMENT_SERVICE_WORKSPACE_API_DEVELOPER",
  "API_MANAGEMENT_SERVICE_WORKSPACE_API_PRODUCT_MANAGER",
  "API_MANAGEMENT_WORKSPACE_API_DEVELOPER",
  "API_MANAGEMENT_WORKSPACE_API_PRODUCT_MANAGER",
  "API_MANAGEMENT_WORKSPACE_CONTRIBUTOR",
  "API_MANAGEMENT_WORKSPACE_READER",
  "APPGW_FOR_CONTAINERS_CONFIGURATION_MANAGER",
  "APPLICATION_GROUP_CONTRIBUTOR",
  "APPLICATION_INSIGHTS_COMPONENT_CONTRIBUTOR",
  "APPLICATION_INSIGHTS_SNAPSHOT_DEBUGGER",
  "APP_COMPLIANCE_AUTOMATION_ADMINISTRATOR",
  "APP_COMPLIANCE_AUTOMATION_READER",
  "APP_CONFIGURATION_CONTRIBUTOR",
  "APP_CONFIGURATION_DATA_OWNER",
  "APP_CONFIGURATION_DATA_READER",
  "APP_CONFIGURATION_DATA_SAS_USER",
  "APP_CONFIGURATION_READER",
  "APP_SERVICE_ENVIRONMENT_CONTRIBUTOR",
  "ARC_GATEWAY_MANAGER",
  "ATTESTATION_CONTRIBUTOR",
  "ATTESTATION_READER",
  "AUTOMATION_CONTRIBUTOR",
  "AUTOMATION_JOB_OPERATOR",
  "AUTOMATION_OPERATOR",
  "AUTOMATION_RUNBOOK_OPERATOR",
  "AUTONOMOUS_DEVELOPMENT_PLATFORM_DATA_CONTRIBUTOR_PREVIEW",
  "AUTONOMOUS_DEVELOPMENT_PLATFORM_DATA_OWNER_PREVIEW",
  "AUTONOMOUS_DEVELOPMENT_PLATFORM_DATA_READER_PREVIEW",
  "AUTO_ACTIONS_CONTRIBUTOR",
  "AVERE_CONTRIBUTOR",
  "AVERE_OPERATOR",
  "AVS_ON_FLEET_VIS_ROLE",
  "AVS_ORCHESTRATOR_ROLE",
  "AZUREML_COMPUTE_OPERATOR",
  "AZUREML_DATA_SCIENTIST",
  "AZUREML_METRICS_WRITER_PREVIEW",
  "AZUREML_REGISTRY_USER",
  "AZURE_AI_ACCOUNT_OWNER",
  "AZURE_AI_ADMINISTRATOR",
  "AZURE_AI_DEVELOPER",
  "AZURE_AI_ENTERPRISE_NETWORK_CONNECTION_APPROVER",
  "AZURE_AI_INFERENCE_DEPLOYMENT_OPERATOR",
  "AZURE_AI_PROJECT_MANAGER",
  "AZURE_AI_SAFETY_EVALUATOR",
  "AZURE_AI_USER",
  "AZURE_API_CENTER_COMPLIANCE_MANAGER",
  "AZURE_API_CENTER_CREDENTIAL_ACCESS_READER",
  "AZURE_API_CENTER_DATA_READER",
  "AZURE_API_CENTER_SERVICE_CONTRIBUTOR",
  "AZURE_API_CENTER_SERVICE_READER",
  "AZURE_ARC_ENABLED_KUBERNETES_CLUSTER_USER_ROLE",
  "AZURE_ARC_KUBERNETES_ADMIN",
  "AZURE_ARC_KUBERNETES_CLUSTER_ADMIN",
  "AZURE_ARC_KUBERNETES_VIEWER",
  "AZURE_ARC_KUBERNETES_WRITER",
  "AZURE_ARC_SCVMM_ADMINISTRATOR_ROLE",
  "AZURE_ARC_SCVMM_PRIVATE_CLOUDS_ONBOARDING",
  "AZURE_ARC_SCVMM_PRIVATE_CLOUD_USER",
  "AZURE_ARC_SCVMM_VM_CONTRIBUTOR",
  "AZURE_ARC_VMWARE_ADMINISTRATOR_ROLE",
  "AZURE_ARC_VMWARE_PRIVATE_CLOUDS_ONBOARDING",
  "AZURE_ARC_VMWARE_PRIVATE_CLOUD_USER",
  "AZURE_ARC_VMWARE_VM_CONTRIBUTOR",
  "AZURE_AUTOMANAGE_CONTRIBUTOR",
  "AZURE_BACKUP_SNAPSHOT_CONTRIBUTOR",
  "AZURE_BATCH_ACCOUNT_CONTRIBUTOR",
  "AZURE_BATCH_ACCOUNT_READER",
  "AZURE_BATCH_DATA_CONTRIBUTOR",
  "AZURE_BATCH_JOB_SUBMITTER",
  "AZURE_BATCH_SERVICE_ORCHESTRATION_ROLE",
  "AZURE_BOT_SERVICE_CONTRIBUTOR_ROLE",
  "AZURE_CENTER_FOR_SAP_SOLUTIONS_ADMINISTRATOR",
  "AZURE_CENTER_FOR_SAP_SOLUTIONS_MANAGEMENT_ROLE",
  "AZURE_CENTER_FOR_SAP_SOLUTIONS_READER",
  "AZURE_CENTER_FOR_SAP_SOLUTIONS_SERVICE_ROLE",
  "AZURE_CENTER_FOR_SAP_SOLUTIONS_SERVICE_ROLE_FOR_MANAGEMENT",
  "AZURE_CONNECTED_MACHINE_ONBOARDING",
  "AZURE_CONNECTED_MACHINE_RESOURCE_ADMINISTRATOR",
  "AZURE_CONNECTED_MACHINE_RESOURCE_MANAGER",
  "AZURE_CONNECTED_SQL_SERVER_ONBOARDING",
  "AZURE_CONTAINERAPPS_SESSION_EXECUTOR",
  "AZURE_CONTAINER_INSTANCES_CONTRIBUTOR_ROLE",
  "AZURE_CONTAINER_REGISTRY_SECURE_SUPPLY_CHAIN_OPERATOR_SERVICE_ROLE",
  "AZURE_CONTAINER_STORAGE_CONTRIBUTOR",
  "AZURE_CONTAINER_STORAGE_OPERATOR",
  "AZURE_CONTAINER_STORAGE_OWNER",
  "AZURE_CUSTOMER_LOCKBOX_APPROVER_FOR_SUBSCRIPTION",
  "AZURE_DEPLOYMENT_STACK_CONTRIBUTOR",
  "AZURE_DEPLOYMENT_STACK_OWNER",
  "AZURE_DEVICE_ONBOARDING_DISCOVERY_CONTRIBUTOR",
  "AZURE_DEVICE_UPDATE_AGENT",
  "AZURE_DIGITAL_TWINS_DATA_OWNER",
  "AZURE_DIGITAL_TWINS_DATA_READER",
  "AZURE_EDGE_HARDWARE_CENTER_ADMINISTRATOR",
  "AZURE_EDGE_ON_SITE_DEPLOYMENT_ENGINEER",
  "AZURE_EVENT_HUBS_DATA_OWNER",
  "AZURE_EVENT_HUBS_DATA_RECEIVER",
  "AZURE_EVENT_HUBS_DATA_SENDER",
  "AZURE_EXTENSION_FOR_SQL_SERVER_DEPLOYMENT",
  "AZURE_FILE_SYNC_ADMINISTRATOR",
  "AZURE_FILE_SYNC_READER",
  "AZURE_FRONT_DOOR_DOMAIN_CONTRIBUTOR",
  "AZURE_FRONT_DOOR_DOMAIN_READER",
  "AZURE_FRONT_DOOR_PROFILE_READER",
  "AZURE_FRONT_DOOR_SECRET_CONTRIBUTOR",
  "AZURE_FRONT_DOOR_SECRET_READER",
  "AZURE_HYBRID_DATABASE_ADMINISTRATOR_READ_ONLY_SERVICE_ROLE",
  "AZURE_IMPACT_INSIGHT_READER",
  "AZURE_KUBERNETES_FLEET_MANAGER_CONTRIBUTOR_ROLE",
  "AZURE_KUBERNETES_FLEET_MANAGER_HUB_AGENT_ROLE",
  "AZURE_KUBERNETES_FLEET_MANAGER_RBAC_ADMIN",
  "AZURE_KUBERNETES_FLEET_MANAGER_RBAC_CLUSTER_ADMIN",
  "AZURE_KUBERNETES_FLEET_MANAGER_RBAC_CLUSTER_READER",
  "AZURE_KUBERNETES_FLEET_MANAGER_RBAC_CLUSTER_WRITER",
  "AZURE_KUBERNETES_FLEET_MANAGER_RBAC_READER",
  "AZURE_KUBERNETES_FLEET_MANAGER_RBAC_WRITER",
  "AZURE_KUBERNETES_SERVICE_AGENT_POOL_MANAGER_ROLE",
  "AZURE_KUBERNETES_SERVICE_ARC_CLUSTER_ADMIN_ROLE",
  "AZURE_KUBERNETES_SERVICE_ARC_CLUSTER_USER_ROLE",
  "AZURE_KUBERNETES_SERVICE_ARC_CONTRIBUTOR_ROLE",
  "AZURE_KUBERNETES_SERVICE_CLUSTER_ADMIN_ROLE",
  "AZURE_KUBERNETES_SERVICE_CLUSTER_MONITORING_USER",
  "AZURE_KUBERNETES_SERVICE_CLUSTER_USER_ROLE",
  "AZURE_KUBERNETES_SERVICE_CONTRIBUTOR_ROLE",
  "AZURE_KUBERNETES_SERVICE_HYBRID_CLUSTER_ADMIN_ROLE",
  "AZURE_KUBERNETES_SERVICE_HYBRID_CLUSTER_USER_ROLE",
  "AZURE_KUBERNETES_SERVICE_HYBRID_CONTRIBUTOR_ROLE",
  "AZURE_KUBERNETES_SERVICE_POLICY_ADD_ON_DEPLOYMENT",
  "AZURE_KUBERNETES_SERVICE_RBAC_ADMIN",
  "AZURE_KUBERNETES_SERVICE_RBAC_CLUSTER_ADMIN",
  "AZURE_KUBERNETES_SERVICE_RBAC_READER",
  "AZURE_KUBERNETES_SERVICE_RBAC_WRITER",
  "AZURE_MACHINE_LEARNING_WORKSPACE_CONNECTION_SECRETS_READER",
  "AZURE_MANAGED_GRAFANA_WORKSPACE_CONTRIBUTOR",
  "AZURE_MAPS_CONTRIBUTOR",
  "AZURE_MAPS_DATA_CONTRIBUTOR",
  "AZURE_MAPS_DATA_READER",
  "AZURE_MAPS_DATA_READ_AND_BATCH_ROLE",
  "AZURE_MAPS_SEARCH_AND_RENDER_DATA_READER",
  "AZURE_MESSAGING_CATALOG_DATA_OWNER",
  "AZURE_MESSAGING_CONNECTORS_OWNER",
  "AZURE_MONITOR_DASHBOARDS_WITH_GRAFANA_CONTRIBUTOR",
  "AZURE_PROGRAMMABLE_CONNECTIVITY_GATEWAY_DATAPLANE_USER",
  "AZURE_PROGRAMMABLE_CONNECTIVITY_GATEWAY_USER",
  "AZURE_RED_HAT_OPENSHIFT_CLOUD_CONTROLLER_MANAGER",
  "AZURE_RED_HAT_OPENSHIFT_CLUSTER_INGRESS_OPERATOR",
  "AZURE_RED_HAT_OPENSHIFT_DISK_STORAGE_OPERATOR",
  "AZURE_RED_HAT_OPENSHIFT_FEDERATED_CREDENTIAL",
  "AZURE_RED_HAT_OPENSHIFT_FILE_STORAGE_OPERATOR",
  "AZURE_RED_HAT_OPENSHIFT_HOSTED_CONTROL_PLANES_CLUSTER_API_PROVIDER",
  "AZURE_RED_HAT_OPENSHIFT_HOSTED_CONTROL_PLANES_CONTROL_PLANE_OPERATOR",
  "AZURE_RED_HAT_OPENSHIFT_HOSTED_CONTROL_PLANES_SERVICE_MANAGED_IDENTITY",
  "AZURE_RED_HAT_OPENSHIFT_IMAGE_REGISTRY_OPERATOR",
  "AZURE_RED_HAT_OPENSHIFT_MACHINE_API_OPERATOR",
  "AZURE_RED_HAT_OPENSHIFT_NETWORK_OPERATOR",
  "AZURE_RED_HAT_OPENSHIFT_SERVICE_OPERATOR",
  "AZURE_RELAY_LISTENER",
  "AZURE_RELAY_OWNER",
  "AZURE_RELAY_SENDER",
  "AZURE_RESOURCE_BRIDGE_DEPLOYMENT_ROLE",
  "AZURE_RESOURCE_NOTIFICATIONS_SYSTEM_TOPICS_SUBSCRIBER",
  "AZURE_SERVICE_BUS_DATA_OWNER",
  "AZURE_SERVICE_BUS_DATA_RECEIVER",
  "AZURE_SERVICE_BUS_DATA_SENDER",
  "AZURE_SPHERE_CONTRIBUTOR",
  "AZURE_SPHERE_OWNER",
  "AZURE_SPHERE_PUBLISHER",
  "AZURE_SPHERE_READER",
  "AZURE_SPRING_APPS_APPLICATION_CONFIGURATION_SERVICE_CONFIG_FILE_PATTERN_READER_ROLE",
  "AZURE_SPRING_APPS_APPLICATION_CONFIGURATION_SERVICE_LOG_READER_ROLE",
  "AZURE_SPRING_APPS_CONNECT_ROLE",
  "AZURE_SPRING_APPS_JOB_EXECUTION_INSTANCE_LIST_ROLE",
  "AZURE_SPRING_APPS_JOB_LOG_READER_ROLE",
  "AZURE_SPRING_APPS_MANAGED_COMPONENTS_LOG_READER_ROLE",
  "AZURE_SPRING_APPS_REMOTE_DEBUGGING_ROLE",
  "AZURE_SPRING_APPS_SPRING_CLOUD_CONFIG_SERVER_LOG_READER_ROLE",
  "AZURE_SPRING_APPS_SPRING_CLOUD_GATEWAY_LOG_READER_ROLE",
  "AZURE_SPRING_CLOUD_CONFIG_SERVER_CONTRIBUTOR",
  "AZURE_SPRING_CLOUD_CONFIG_SERVER_READER",
  "AZURE_SPRING_CLOUD_DATA_READER",
  "AZURE_SPRING_CLOUD_SERVICE_REGISTRY_CONTRIBUTOR",
  "AZURE_SPRING_CLOUD_SERVICE_REGISTRY_READER",
  "AZURE_STACK_HCI_ADMINISTRATOR",
  "AZURE_STACK_HCI_CONNECTED_INFRAVMS",
  "AZURE_STACK_HCI_DEVICE_MANAGEMENT_ROLE",
  "AZURE_STACK_HCI_EDGE_MACHINE_CONTRIBUTOR_ROLE",
  "AZURE_STACK_HCI_VM_CONTRIBUTOR",
  "AZURE_STACK_HCI_VM_READER",
  "AZURE_STACK_REGISTRATION_OWNER",
  "AZURE_USAGE_BILLING_DATA_SENDER",
  "AZURE_VM_MANAGED_IDENTITIES_RESTORE_CONTRIBUTOR",
  "BACKUP_CONTRIBUTOR",
  "BACKUP_MUA_ADMIN",
  "BACKUP_MUA_OPERATOR",
  "BACKUP_OPERATOR",
  "BACKUP_READER",
  "BAYER_AG_POWERED_SERVICES_CROP_ID_SOLUTION_USER_ROLE",
  "BAYER_AG_POWERED_SERVICES_CWUM_SOLUTION",
  "BAYER_AG_POWERED_SERVICES_FIELD_IMAGERY_SOLUTION_SERVICE_ROLE",
  "BAYER_AG_POWERED_SERVICES_GDU_SOLUTION",
  "BAYER_AG_POWERED_SERVICES_HISTORICAL_WEATHER_DATA_SOLUTION_USER_ROLE",
  "BAYER_AG_POWERED_SERVICES_IMAGERY_SOLUTION",
  "BAYER_AG_POWERED_SERVICES_SMART_BOUNDARY_SOLUTION_USER_ROLE",
  "BILLING_READER",
  "BIZTALK_CONTRIBUTOR",
  "BLOCKCHAIN_MEMBER_NODE_ACCESS_PREVIEW",
  "BLUEPRINT_CONTRIBUTOR",
  "BLUEPRINT_OPERATOR",
  "CARBON_OPTIMIZATION_READER",
  "CDN_ENDPOINT_CONTRIBUTOR",
  "CDN_ENDPOINT_READER",
  "CDN_PROFILE_CONTRIBUTOR",
  "CDN_PROFILE_READER",
  "CHAOS_STUDIO_EXPERIMENT_CONTRIBUTOR",
  "CHAOS_STUDIO_OPERATOR",
  "CHAOS_STUDIO_READER",
  "CHAOS_STUDIO_TARGET_CONTRIBUTOR",
  "CLASSIC_NETWORK_CONTRIBUTOR",
  "CLASSIC_STORAGE_ACCOUNT_CONTRIBUTOR",
  "CLASSIC_STORAGE_ACCOUNT_KEY_OPERATOR_SERVICE_ROLE",
  "CLASSIC_VIRTUAL_MACHINE_CONTRIBUTOR",
  "CLEARDB_MYSQL_DB_CONTRIBUTOR",
  "CLOUDTEST_CONTRIBUTOR_ROLE",
  "COGNITIVE_SEARCH_SERVERLESS_DATA_CONTRIBUTOR_DEPRECATED",
  "COGNITIVE_SEARCH_SERVERLESS_DATA_READER_DEPRECATED",
  "COGNITIVE_SERVICES_CONTRIBUTOR",
  "COGNITIVE_SERVICES_CUSTOM_VISION_CONTRIBUTOR",
  "COGNITIVE_SERVICES_CUSTOM_VISION_DEPLOYMENT",
  "COGNITIVE_SERVICES_CUSTOM_VISION_LABELER",
  "COGNITIVE_SERVICES_CUSTOM_VISION_READER",
  "COGNITIVE_SERVICES_CUSTOM_VISION_TRAINER",
  "COGNITIVE_SERVICES_DATA_CONTRIBUTOR_PREVIEW",
  "COGNITIVE_SERVICES_DATA_READER",
  "COGNITIVE_SERVICES_FACE_CONTRIBUTOR",
  "COGNITIVE_SERVICES_FACE_RECOGNIZER",
  "COGNITIVE_SERVICES_IMMERSIVE_READER_USER",
  "COGNITIVE_SERVICES_LANGUAGE_OWNER",
  "COGNITIVE_SERVICES_LANGUAGE_READER",
  "COGNITIVE_SERVICES_LANGUAGE_WRITER",
  "COGNITIVE_SERVICES_LUIS_OWNER",
  "COGNITIVE_SERVICES_LUIS_READER",
  "COGNITIVE_SERVICES_LUIS_WRITER",
  "COGNITIVE_SERVICES_METRICS_ADVISOR_ADMINISTRATOR",
  "COGNITIVE_SERVICES_METRICS_ADVISOR_USER",
  "COGNITIVE_SERVICES_OPENAI_CONTRIBUTOR",
  "COGNITIVE_SERVICES_OPENAI_USER",
  "COGNITIVE_SERVICES_QNA_MAKER_EDITOR",
  "COGNITIVE_SERVICES_QNA_MAKER_READER",
  "COGNITIVE_SERVICES_SPEECH_CONTRIBUTOR",
  "COGNITIVE_SERVICES_SPEECH_USER",
  "COGNITIVE_SERVICES_USAGES_READER",
  "COGNITIVE_SERVICES_USER",
  "COLLABORATIVE_DATA_CONTRIBUTOR",
  "COLLABORATIVE_RUNTIME_OPERATOR",
  "COMMUNICATION_AND_EMAIL_SERVICE_OWNER",
  "COMMUNITY_CONTRIBUTOR_ROLE",
  "COMMUNITY_OWNER_ROLE",
  "COMMUNITY_READER_ROLE",
  "COMPUTE_DIAGNOSTICS_ROLE",
  "COMPUTE_FLEET_CONTRIBUTOR",
  "COMPUTE_GALLERY_ARTIFACTS_PUBLISHER",
  "COMPUTE_GALLERY_IMAGE_READER",
  "COMPUTE_GALLERY_SHARING_ADMIN",
  "COMPUTE_RECOMMENDATIONS_ROLE",
  "CONNECTED_CLUSTER_MANAGED_IDENTITY_CHECKACCESS_READER",
  "CONNECTOR_READER",
  "CONTAINERAPP_READER",
  "CONTAINER_APPS_CONNECTEDENVIRONMENTS_CONTRIBUTOR",
  "CONTAINER_APPS_CONNECTEDENVIRONMENTS_READER",
  "CONTAINER_APPS_CONTRIBUTOR",
  "CONTAINER_APPS_JOBS_CONTRIBUTOR",
  "CONTAINER_APPS_JOBS_OPERATOR",
  "CONTAINER_APPS_JOBS_READER",
  "CONTAINER_APPS_MANAGEDENVIRONMENTS_CONTRIBUTOR",
  "CONTAINER_APPS_MANAGEDENVIRONMENTS_READER",
  "CONTAINER_APPS_OPERATOR",
  "CONTAINER_APPS_SESSIONPOOLS_CONTRIBUTOR",
  "CONTAINER_APPS_SESSIONPOOLS_READER",
  "CONTAINER_INSTANCES_CONTRIBUTOR",
  "CONTAINER_REGISTRY_CACHE_RULE_ADMINISTRATOR",
  "CONTAINER_REGISTRY_CACHE_RULE_READER",
  "CONTAINER_REGISTRY_CONFIGURATION_READER_AND_DATA_ACCESS_CONFIGURATION_READER",
  "CONTAINER_REGISTRY_CONTRIBUTOR_AND_DATA_ACCESS_CONFIGURATION_ADMINISTRATOR",
  "CONTAINER_REGISTRY_CREDENTIAL_SET_ADMINISTRATOR",
  "CONTAINER_REGISTRY_CREDENTIAL_SET_READER",
  "CONTAINER_REGISTRY_DATA_IMPORTER_AND_DATA_READER",
  "CONTAINER_REGISTRY_REPOSITORY_CATALOG_LISTER",
  "CONTAINER_REGISTRY_REPOSITORY_CONTRIBUTOR",
  "CONTAINER_REGISTRY_REPOSITORY_READER",
  "CONTAINER_REGISTRY_REPOSITORY_WRITER",
  "CONTAINER_REGISTRY_TASKS_CONTRIBUTOR",
  "CONTAINER_REGISTRY_TRANSFER_PIPELINE_CONTRIBUTOR",
  "CONTRIBUTOR",
  "COSMOSBACKUPOPERATOR",
  "COSMOSRESTOREOPERATOR",
  "COSMOS_DB_ACCOUNT_READER_ROLE",
  "COSMOS_DB_OPERATOR",
  "COST_MANAGEMENT_CONTRIBUTOR",
  "COST_MANAGEMENT_READER",
  "CROSSCONNECTIONMANAGER",
  "CROSSCONNECTIONREADER",
  "CUSTOM_AUTOMATION_ROLE_ROOT",
  "DATA_BOUNDARY_TENANT_ADMINISTRATOR",
  "DATA_BOX_CONTRIBUTOR",
  "DATA_BOX_READER",
  "DATA_FACTORY_CONTRIBUTOR",
  "DATA_LABELING_LABELER",
  "DATA_LAKE_ANALYTICS_DEVELOPER",
  "DATA_OPERATOR_FOR_MANAGED_DISKS",
  "DATA_PURGER",
  "DEDICATED_HOST_CONTRIBUTOR_ROLE",
  "DEFENDER_CSPM_STORAGE_DATA_SCANNER",
  "DEFENDER_CSPM_STORAGE_SCANNER_OPERATOR",
  "DEFENDER_FOR_STORAGE_DATA_SCANNER",
  "DEFENDER_FOR_STORAGE_SCANNER_OPERATOR",
  "DEFENDER_KUBERNETES_AGENT_OPERATOR",
  "DEID_BATCH_DATA_OWNER",
  "DEID_BATCH_DATA_READER",
  "DEID_DATA_OWNER",
  "DEID_REALTIME_DATA_USER",
  "DEPLOYMENT_ENVIRONMENTS_READER",
  "DEPLOYMENT_ENVIRONMENTS_USER",
  "DESKTOP_VIRTUALIZATION_APPLICATION_GROUP_CONTRIBUTOR",
  "DESKTOP_VIRTUALIZATION_APPLICATION_GROUP_READER",
  "DESKTOP_VIRTUALIZATION_APP_ATTACH_CONTRIBUTOR",
  "DESKTOP_VIRTUALIZATION_CONTRIBUTOR",
  "DESKTOP_VIRTUALIZATION_HOST_POOL_CONTRIBUTOR",
  "DESKTOP_VIRTUALIZATION_HOST_POOL_READER",
  "DESKTOP_VIRTUALIZATION_POWER_ON_CONTRIBUTOR",
  "DESKTOP_VIRTUALIZATION_POWER_ON_OFF_CONTRIBUTOR",
  "DESKTOP_VIRTUALIZATION_READER",
  "DESKTOP_VIRTUALIZATION_SESSION_HOST_OPERATOR",
  "DESKTOP_VIRTUALIZATION_USER",
  "DESKTOP_VIRTUALIZATION_USER_SESSION_OPERATOR",
  "DESKTOP_VIRTUALIZATION_VIRTUAL_MACHINE_CONTRIBUTOR",
  "DESKTOP_VIRTUALIZATION_WORKSPACE_CONTRIBUTOR",
  "DESKTOP_VIRTUALIZATION_WORKSPACE_READER",
  "DEVCENTER_DEV_BOX_USER",
  "DEVCENTER_PROJECT_ADMIN",
  "DEVICE_PROVISIONING_SERVICE_DATA_CONTRIBUTOR",
  "DEVICE_PROVISIONING_SERVICE_DATA_READER",
  "DEVICE_UPDATE_ADMINISTRATOR",
  "DEVICE_UPDATE_CONTENT_ADMINISTRATOR",
  "DEVICE_UPDATE_CONTENT_READER",
  "DEVICE_UPDATE_DEPLOYMENTS_ADMINISTRATOR",
  "DEVICE_UPDATE_DEPLOYMENTS_READER",
  "DEVICE_UPDATE_READER",
  "DEVTEST_LABS_USER",
  "DICOM_DATA_OWNER",
  "DICOM_DATA_READER",
  "DISK_BACKUP_READER",
  "DISK_ENCRYPTION_SET_OPERATOR_FOR_MANAGED_DISKS",
  "DISK_POOL_OPERATOR",
  "DISK_RESTORE_OPERATOR",
  "DISK_SNAPSHOT_CONTRIBUTOR",
  "DNS_RESOLVER_CONTRIBUTOR",
  "DNS_ZONE_CONTRIBUTOR",
  "DOCUMENTDB_ACCOUNT_CONTRIBUTOR",
  "DOMAIN_SERVICES_CONTRIBUTOR",
  "DOMAIN_SERVICES_READER",
  "DURABLE_TASK_DATA_CONTRIBUTOR",
  "DURABLE_TASK_DATA_READER",
  "DURABLE_TASK_WORKER",
  "EDGE_MANAGEMENT_COPILOT_USER",
  "ELASTIC_SAN_NETWORK_ADMIN",
  "ELASTIC_SAN_OWNER",
  "ELASTIC_SAN_READER",
  "ELASTIC_SAN_SNAPSHOT_EXPORTER",
  "ELASTIC_SAN_VOLUME_GROUP_OWNER",
  "ELASTIC_SAN_VOLUME_IMPORTER",
  "ENCLAVE_APPROVER_ROLE",
  "ENCLAVE_CONTRIBUTOR_ROLE",
  "ENCLAVE_OWNER_ROLE",
  "ENCLAVE_READER_ROLE",
  "EVENTGRID_CONTRIBUTOR",
  "EVENTGRID_DATA_CONTRIBUTOR",
  "EVENTGRID_DATA_RECEIVER",
  "EVENTGRID_DATA_SENDER",
  "EVENTGRID_EVENTSUBSCRIPTION_CONTRIBUTOR",
  "EVENTGRID_EVENTSUBSCRIPTION_READER",
  "EVENTGRID_TOPICSPACES_PUBLISHER",
  "EVENTGRID_TOPICSPACES_SUBSCRIBER",
  "EXPERIMENTATION_ADMINISTRATOR",
  "EXPERIMENTATION_CONTRIBUTOR",
  "EXPERIMENTATION_METRIC_CONTRIBUTOR",
  "EXPERIMENTATION_READER",
  "FHIR_DATA_CONTRIBUTOR",
  "FHIR_DATA_CONVERTER",
  "FHIR_DATA_EXPORTER",
  "FHIR_DATA_IMPORTER",
  "FHIR_DATA_READER",
  "FHIR_DATA_WRITER",
  "FHIR_SMART_USER",
  "FIRMWARE_ANALYSIS_ADMIN",
  "FLUX_CONFIGURATIONS_CONTRIBUTOR",
  "GEOCATALOG_ADMINISTRATOR",
  "GEOCATALOG_READER",
  "GITOPS_LZ_LIST_ACTIONS",
  "GRAFANA_ADMIN",
  "GRAFANA_EDITOR",
  "GRAFANA_LIMITED_VIEWER",
  "GRAFANA_VIEWER",
  "GRAPH_OWNER",
  "GROUPQUOTA_READER",
  "GROUPQUOTA_REQUEST_OPERATOR",
  "GUEST_CONFIGURATION_RESOURCE_CONTRIBUTOR",
  "HDINSIGHT_CLUSTER_ADMIN",
  "HDINSIGHT_CLUSTER_OPERATOR",
  "HDINSIGHT_DOMAIN_SERVICES_CONTRIBUTOR",
  "HDINSIGHT_ON_AKS_CLUSTER_ADMIN",
  "HDINSIGHT_ON_AKS_CLUSTER_OPERATOR",
  "HDINSIGHT_ON_AKS_CLUSTER_POOL_ADMIN",
  "HEALTHCARE_AGENT_ADMIN",
  "HEALTHCARE_AGENT_EDITOR",
  "HEALTHCARE_AGENT_READER",
  "HEALTH_SAFEGUARDS_DATA_USER",
  "HIERARCHY_SETTINGS_ADMINISTRATOR",
  "HYBRIDCOMPUTE_MACHINE_LISTACCESSDETAILS_ACTION_IN_BUILT_ROLE",
  "HYBRID_SERVER_ONBOARDING",
  "HYBRID_SERVER_RESOURCE_ADMINISTRATOR",
  "IMPACT_READER",
  "IMPACT_REPORTER",
  "INTEGRATION_SERVICE_ENVIRONMENT_CONTRIBUTOR",
  "INTEGRATION_SERVICE_ENVIRONMENT_DEVELOPER",
  "INTELLIGENT_SYSTEMS_ACCOUNT_CONTRIBUTOR",
  "IOT_HUB_DATA_CONTRIBUTOR",
  "IOT_HUB_DATA_READER",
  "IOT_HUB_REGISTRY_CONTRIBUTOR",
  "IOT_HUB_TWIN_CONTRIBUTOR",
  "IPAM_POOL_USER",
  "ISSUE_CONTRIBUTOR",
  "KEY_VAULT_ADMINISTRATOR",
  "KEY_VAULT_CERTIFICATES_OFFICER",
  "KEY_VAULT_CERTIFICATE_USER",
  "KEY_VAULT_CONTRIBUTOR",
  "KEY_VAULT_CRYPTO_OFFICER",
  "KEY_VAULT_CRYPTO_SERVICE_ENCRYPTION_USER",
  "KEY_VAULT_CRYPTO_SERVICE_RELEASE_USER",
  "KEY_VAULT_CRYPTO_USER",
  "KEY_VAULT_DATA_ACCESS_ADMINISTRATOR",
  "KEY_VAULT_PURGE_OPERATOR",
  "KEY_VAULT_READER",
  "KEY_VAULT_SECRETS_OFFICER",
  "KEY_VAULT_SECRETS_USER",
  "KNOWLEDGE_CONSUMER",
  "KOSTNER_DFS_BASE_ROLE",
  "KUBERNETESRUNTIME_LOAD_BALANCER_CONTRIBUTOR_ROLE",
  "KUBERNETES_AGENTLESS_OPERATOR",
  "KUBERNETES_AGENT_OPERATOR",
  "KUBERNETES_AGENT_SUBSCRIPTION_LEVEL_OPERATOR",
  "KUBERNETES_CLUSTER_AZURE_ARC_ONBOARDING",
  "KUBERNETES_EXTENSION_CONTRIBUTOR",
  "KUBERNETES_NAMESPACE_USER",
  "KUBERNETES_RUNTIME_STORAGE_CLASS_CONTRIBUTOR_ROLE",
  "LAB_ASSISTANT",
  "LAB_CONTRIBUTOR",
  "LAB_CREATOR",
  "LAB_OPERATOR",
  "LAB_SERVICES_CONTRIBUTOR",
  "LAB_SERVICES_READER",
  "LANDING_ZONE_ACCOUNT_OWNER",
  "LANDING_ZONE_ACCOUNT_READER",
  "LANDING_ZONE_MANAGEMENT_OWNER",
  "LANDING_ZONE_MANAGEMENT_READER",
  "LOAD_TEST_CONTRIBUTOR",
  "LOAD_TEST_OWNER",
  "LOAD_TEST_READER",
  "LOCALNGFIREWALLADMINISTRATOR_ROLE",
  "LOCALRULESTACKSADMINISTRATOR_ROLE",
  "LOCKS_CONTRIBUTOR",
  "LOGIC_APPS_STANDARD_CONTRIBUTOR_PREVIEW",
  "LOGIC_APPS_STANDARD_DEVELOPER_PREVIEW",
  "LOGIC_APPS_STANDARD_OPERATOR_PREVIEW",
  "LOGIC_APPS_STANDARD_READER_PREVIEW",
  "LOGIC_APP_CONTRIBUTOR",
  "LOGIC_APP_OPERATOR",
  "LOG_ANALYTICS_CONTRIBUTOR",
  "LOG_ANALYTICS_READER",
  "MANAGED_APPLICATION_CONTRIBUTOR_ROLE",
  "MANAGED_APPLICATION_OPERATOR_ROLE",
  "MANAGED_APPLICATION_PUBLISHER_OPERATOR",
  "MANAGED_HSM_CONTRIBUTOR",
  "MANAGED_IDENTITY_CONTRIBUTOR",
  "MANAGED_IDENTITY_FEDERATED_IDENTITY_CREDENTIAL_CONTRIBUTOR",
  "MANAGED_IDENTITY_OPERATOR",
  "MANAGED_SERVICES_REGISTRATION_ASSIGNMENT_DELETE_ROLE",
  "MANAGEMENT_GROUP_CONTRIBUTOR",
  "MANAGEMENT_GROUP_READER",
  "MEDIA_SERVICES_ACCOUNT_ADMINISTRATOR",
  "MEDIA_SERVICES_LIVE_EVENTS_ADMINISTRATOR",
  "MEDIA_SERVICES_MEDIA_OPERATOR",
  "MEDIA_SERVICES_POLICY_ADMINISTRATOR",
  "MEDIA_SERVICES_STREAMING_ENDPOINTS_ADMINISTRATOR",
  "MICROSOFT_EDGE_WINFIELDS_FEDERATED_SUBSCRIPTION_READ_ACCESS_ROLE",
  "MICROSOFT_KUBERNETES_CONNECTED_CLUSTER_ROLE",
  "MICROSOFT_POWERBI_TENANT_OPERATIONS_ROLE",
  "MICROSOFT_SENTINEL_AUTOMATION_CONTRIBUTOR",
  "MICROSOFT_SENTINEL_BUSINESS_APPLICATIONS_AGENT_OPERATOR",
  "MICROSOFT_SENTINEL_CONTRIBUTOR",
  "MICROSOFT_SENTINEL_PLAYBOOK_OPERATOR",
  "MICROSOFT_SENTINEL_READER",
  "MICROSOFT_SENTINEL_RESPONDER",
  "MONITORING_CONTRIBUTOR",
  "MONITORING_DATA_READER",
  "MONITORING_METRICS_PUBLISHER",
  "MONITORING_READER",
  "MYSQL_BACKUP_AND_EXPORT_OPERATOR",
  "NETWORK_CONTRIBUTOR",
  "NEW_RELIC_APM_ACCOUNT_CONTRIBUTOR",
  "NEXUS_NETWORK_FABRIC_SERVICE_READER",
  "NEXUS_NETWORK_FABRIC_SERVICE_WRITER",
  "OBJECT_ANCHORS_ACCOUNT_OWNER",
  "OBJECT_ANCHORS_ACCOUNT_READER",
  "OBJECT_UNDERSTANDING_ACCOUNT_OWNER",
  "OBJECT_UNDERSTANDING_ACCOUNT_READER",
  "ONLINE_EXPERIMENTATION_CONTRIBUTOR",
  "ONLINE_EXPERIMENTATION_DATA_OWNER",
  "ONLINE_EXPERIMENTATION_DATA_READER",
  "ONLINE_EXPERIMENTATION_READER",
  "OPENCOST_RATE_CARD_READER",
  "OPERATOR_NEXUS_COMPUTE_CONTRIBUTOR_ROLE_PREVIEW",
  "OPERATOR_NEXUS_KEY_VAULT_WRITER_SERVICE_ROLE_PREVIEW",
  "OPERATOR_NEXUS_OWNER_PREVIEW",
  "ORACLE_DATABASE_AUTONOMOUS_DATABASE_ADMINISTRATOR",
  "ORACLE_DATABASE_EXADATA_INFRASTRUCTURE_ADMINISTRATOR_BUILT_IN_ROLE",
  "ORACLE_DATABASE_EXASCALE_STORAGE_VAULT_ADMINISTRATOR",
  "ORACLE_DATABASE_EXASCALE_VMCLUSTER_ADMINISTRATOR",
  "ORACLE_DATABASE_OWNER_BUILT_IN_ROLE",
  "ORACLE_DATABASE_READER_BUILT_IN_ROLE",
  "ORACLE_DATABASE_VMCLUSTER_ADMINISTRATOR_BUILT_IN_ROLE",
  "ORACLE_SUBSCRIPTIONS_MANAGER_BUILT_IN_ROLE",
  "OWNER",
  "PLAYFAB_CONTRIBUTOR",
  "PLAYFAB_READER",
  "POLICY_INSIGHTS_DATA_WRITER_PREVIEW",
  "PORTAL_DASHBOARD_WRITER_SERVICE_ROLE",
  "POSTGRESQL_FLEXIBLE_SERVER_LONG_TERM_RETENTION_BACKUP_ROLE",
  "POWER_PLATFORM_ACCOUNT_CONTRIBUTOR",
  "POWER_PLATFORM_ENTERPRISE_POLICY_CONTRIBUTOR",
  "PRIVATE_DNS_ZONE_CONTRIBUTOR",
  "PROCUREMENT_CONTRIBUTOR",
  "PROJECT_BABYLON_DATA_CURATOR",
  "PROJECT_BABYLON_DATA_READER",
  "PROJECT_BABYLON_DATA_SOURCE_ADMINISTRATOR",
  "PROVIDERHUB_CONTRIBUTOR",
  "PROVIDERHUB_READER",
  "QUANTUM_WORKSPACE_DATA_CONTRIBUTOR",
  "QUOTA_REQUEST_OPERATOR",
  "READER",
  "READER_AND_DATA_ACCESS",
  "REDIS_CACHE_CONTRIBUTOR",
  "REMOTE_RENDERING_ADMINISTRATOR",
  "REMOTE_RENDERING_CLIENT",
  "RESERVATION_PURCHASER",
  "RESOURCE_POLICY_CONTRIBUTOR",
  "ROLE_BASED_ACCESS_CONTROL_ADMINISTRATOR",
  "SAAS_HUB_CONTRIBUTOR",
  "SAVINGS_PLAN_PURCHASER",
  "SCHEDULED_EVENTS_CONTRIBUTOR",
  "SCHEDULED_PATCHING_CONTRIBUTOR",
  "SCHEDULER_JOB_COLLECTIONS_CONTRIBUTOR",
  "SCHEMA_REGISTRY_CONTRIBUTOR",
  "SCHEMA_REGISTRY_READER",
  "SEARCH_INDEX_DATA_CONTRIBUTOR",
  "SEARCH_INDEX_DATA_READER",
  "SEARCH_PARAMETER_MANAGER",
  "SEARCH_SERVICE_CONTRIBUTOR",
  "SECRETS_STORE_EXTENSION_OWNER",
  "SECURE_SCORE_READER",
  "SECURITY_ADMIN",
  "SECURITY_ASSESSMENT_CONTRIBUTOR",
  "SECURITY_DETONATION_CHAMBER_PUBLISHER",
  "SECURITY_DETONATION_CHAMBER_READER",
  "SECURITY_DETONATION_CHAMBER_SUBMISSION_MANAGER",
  "SECURITY_DETONATION_CHAMBER_SUBMITTER",
  "SECURITY_MANAGER_LEGACY",
  "SECURITY_READER",
  "SERVICES_HUB_OPERATOR",
  "SERVICE_CONNECTOR_CONTRIBUTOR",
  "SERVICE_FABRIC_CLUSTER_CONTRIBUTOR",
  "SERVICE_FABRIC_MANAGED_CLUSTER_CONTRIBUTOR",
  "SERVICE_GROUP_READER",
  "SIGNALR_ACCESSKEY_READER",
  "SIGNALR_APP_SERVER",
  "SIGNALR_REST_API_OWNER",
  "SIGNALR_REST_API_READER",
  "SIGNALR_SERVICE_OWNER",
  "SIGNALR_WEB_PUBSUB_CONTRIBUTOR",
  "SITE_RECOVERY_CONTRIBUTOR",
  "SITE_RECOVERY_OPERATOR",
  "SITE_RECOVERY_READER",
  "SPATIALMAPSACCOUNTS_ACCOUNT_OWNER",
  "SPATIAL_ANCHORS_ACCOUNT_CONTRIBUTOR",
  "SPATIAL_ANCHORS_ACCOUNT_OWNER",
  "SPATIAL_ANCHORS_ACCOUNT_READER",
  "SQLDB_MIGRATION_ROLE",
  "SQLMI_MIGRATION_ROLE",
  "SQLVM_MIGRATION_ROLE",
  "SQL_DB_CONTRIBUTOR",
  "SQL_MANAGED_INSTANCE_CONTRIBUTOR",
  "SQL_SECURITY_MANAGER",
  "SQL_SERVER_CONTRIBUTOR",
  "SSH_PUBLICKEYS_CONTRIBUTOR_ROLE",
  "SSH_PUBLICKEYS_READER_ROLE",
  "STANDBY_CONTAINER_GROUP_POOL_CONTRIBUTOR",
  "STORAGE_ACCOUNT_BACKUP_CONTRIBUTOR",
  "STORAGE_ACCOUNT_CONTRIBUTOR",
  "STORAGE_ACCOUNT_ENCRYPTION_SCOPE_CONTRIBUTOR_ROLE",
  "STORAGE_ACCOUNT_KEY_OPERATOR_SERVICE_ROLE",
  "STORAGE_BLOB_DATA_CONTRIBUTOR",
  "STORAGE_BLOB_DATA_OWNER",
  "STORAGE_BLOB_DATA_READER",
  "STORAGE_BLOB_DELEGATOR",
  "STORAGE_FILE_DATA_PRIVILEGED_CONTRIBUTOR",
  "STORAGE_FILE_DATA_PRIVILEGED_READER",
  "STORAGE_FILE_DATA_SMB_SHARE_CONTRIBUTOR",
  "STORAGE_FILE_DATA_SMB_SHARE_ELEVATED_CONTRIBUTOR",
  "STORAGE_FILE_DATA_SMB_SHARE_READER",
  "STORAGE_QUEUE_DATA_CONTRIBUTOR",
  "STORAGE_QUEUE_DATA_MESSAGE_PROCESSOR",
  "STORAGE_QUEUE_DATA_MESSAGE_SENDER",
  "STORAGE_QUEUE_DATA_READER",
  "STORAGE_TABLE_DATA_CONTRIBUTOR",
  "STORAGE_TABLE_DATA_READER",
  "STREAM_ANALYTICS_CONTRIBUTOR",
  "STREAM_ANALYTICS_QUERY_TESTER",
  "STREAM_ANALYTICS_READER",
  "SUBSCRIPTION_CREATOR",
  "SUBSCRIPTION_CREATOR_OLD",
  "SUPPORT_REQUEST_CONTRIBUTOR",
  "TAG_CONTRIBUTOR",
  "TAG_READER",
  "TEMPLATE_SPEC_CONTRIBUTOR",
  "TEMPLATE_SPEC_READER",
  "TEST_BASE_READER",
  "TOOLCHAINORCHESTRATOR_ADMIN_ROLE",
  "TOOLCHAINORCHESTRATOR_VIEWER_ROLE",
  "TRAFFIC_MANAGER_CONTRIBUTOR",
  "TRANSPARENCY_LOGS_OWNER",
  "TRUSTED_SIGNING_CERTIFICATE_PROFILE_SIGNER",
  "TRUSTED_SIGNING_IDENTITY_VERIFIER",
  "USAGE_BILLING_CONTRIBUTOR",
  "USER_ACCESS_ADMINISTRATOR",
  "VIDEO_INDEXER_RESTRICTED_VIEWER",
  "VIRTUAL_MACHINE_ADMINISTRATOR_LOGIN",
  "VIRTUAL_MACHINE_CONTRIBUTOR",
  "VIRTUAL_MACHINE_DATA_ACCESS_ADMINISTRATOR_PREVIEW",
  "VIRTUAL_MACHINE_LOCAL_USER_LOGIN",
  "VIRTUAL_MACHINE_USER_LOGIN",
  "VM_RESTORE_OPERATOR",
  "VM_SCANNER_OPERATOR",
  "WEBSITE_CONTRIBUTOR",
  "WEB_PLAN_CONTRIBUTOR",
  "WEB_PUBSUB_SERVICE_OWNER",
  "WEB_PUBSUB_SERVICE_READER",
  "WINDOWS_ADMIN_CENTER_ADMINISTRATOR_LOGIN",
  "WORKBOOK_CONTRIBUTOR",
  "WORKBOOK_READER",
  "WORKLOADBUILDER_MIGRATION_AGENT_ROLE",
  "WORKLOAD_ORCHESTRATION_IT_ADMIN",
  "WORKLOAD_ORCHESTRATION_SOLUTION_EXTERNAL_VALIDATOR"
 ]
--- a/ilsp/bicep_lsp/bicep_functions.py
+++ b/ilsp/bicep_lsp/bicep_functions.py
@@ -1,249 +0,0 @@
 """
 Curated signature database for Bicep's built-in functions.
 Bicep.LangServer (as of 0.46.1) does not implement textDocument/signatureHelp,
 so iLSP provides its own for the most commonly used built-in functions.
 Not exhaustive — covers the functions people actually type day to day.
 """
 from typing import Any
 # name -> list of parameter labels (one entry per overload, simplest form first)
 BUILTIN_FUNCTIONS: dict[str, dict[str, Any]] = {
    "resourceId": {
        "params": ["resourceType", "resourceName1", "resourceName2..."],
        "doc": "Returns the unique identifier of a resource. Also usable with a subscriptionId/resourceGroupName prefix.",
    },
    "subscriptionResourceId": {
        "params": ["subscriptionId", "resourceType", "resourceName1", "resourceName2..."],
        "doc": "Returns the unique identifier for a resource deployed at the subscription level.",
    },
    "tenantResourceId": {
        "params": ["resourceType", "resourceName1", "resourceName2..."],
        "doc": "Returns the unique identifier for a resource deployed at the tenant level.",
    },
    "extensionResourceId": {
        "params": ["resourceId", "resourceType", "resourceName1", "resourceName2..."],
        "doc": "Returns the resource ID for an extension resource, which is applied to another resource.",
    },
    "guid": {
        "params": ["baseString1", "baseString2..."],
        "doc": "Creates a deterministic GUID based on the values passed as parameters.",
    },
    "uniqueString": {
        "params": ["baseString1", "baseString2..."],
        "doc": "Creates a deterministic hash string based on the values passed as parameters (13 chars).",
    },
    "take": {
        "params": ["originalValue", "count"],
        "doc": "Returns a string or array with the specified number of elements from the start.",
    },
    "skip": {
        "params": ["originalValue", "count"],
        "doc": "Returns a string or array with all the elements after the specified number skipped.",
    },
    "first": {
        "params": ["arg1"],
        "doc": "Returns the first element of an array, or first character of a string.",
    },
    "last": {
        "params": ["arg1"],
        "doc": "Returns the last element of an array, or last character of a string.",
    },
    "length": {
        "params": ["arg1"],
        "doc": "Returns the number of elements in an array, characters in a string, or properties in an object.",
    },
    "concat": {
        "params": ["arg1", "arg2..."],
        "doc": "Combines multiple arrays or strings.",
    },
    "union": {
        "params": ["arg1", "arg2..."],
        "doc": "Returns a single array/object with all elements from the parameters, merging objects.",
    },
    "contains": {
        "params": ["container", "itemToFind"],
        "doc": "Checks whether an array contains a value, an object contains a key, or a string contains a substring.",
    },
    "empty": {
        "params": ["itemToTest"],
        "doc": "Determines if an array, object, or string is empty.",
    },
    "format": {
        "params": ["formatString", "arg1..."],
        "doc": "Creates a formatted string using .NET-style {0} placeholders.",
    },
    "join": {
        "params": ["inputArray", "delimiter"],
        "doc": "Joins multiple strings from an array into a single string, separated by delimiter.",
    },
    "split": {
        "params": ["inputString", "delimiter"],
        "doc": "Splits a string into an array using a delimiter.",
    },
    "replace": {
        "params": ["originalString", "oldString", "newString"],
        "doc": "Returns a new string with all instances of oldString replaced by newString.",
    },
    "toLower": {
        "params": ["stringToChange"],
        "doc": "Converts a string to lowercase.",
    },
    "toUpper": {
        "params": ["stringToChange"],
        "doc": "Converts a string to uppercase.",
    },
    "trim": {
        "params": ["stringToTrim"],
        "doc": "Removes leading/trailing whitespace from a string.",
    },
    "substring": {
        "params": ["stringToParse", "startIndex", "length"],
        "doc": "Returns a substring starting at the specified position.",
    },
    "padLeft": {
        "params": ["valueToPad", "totalLength", "paddingCharacter"],
        "doc": "Pads a string to a fixed total length by adding characters to the left.",
    },
    "startsWith": {
        "params": ["stringToSearch", "stringToFind"],
        "doc": "Checks whether a string starts with a value (case-insensitive).",
    },
    "endsWith": {
        "params": ["stringToSearch", "stringToFind"],
        "doc": "Checks whether a string ends with a value (case-insensitive).",
    },
    "indexOf": {
        "params": ["stringToSearch", "stringToFind"],
        "doc": "Returns the first position of a value within a string (case-insensitive).",
    },
    "reference": {
        "params": ["resourceNameOrIdentifier", "apiVersion", "'Full'"],
        "doc": "Returns an object representing a resource's runtime state.",
    },
    "listKeys": {
        "params": ["resourceNameOrIdentifier", "apiVersion"],
        "doc": "Returns the keys for a resource (e.g. storage account access keys).",
    },
    "listSecrets": {
        "params": ["resourceNameOrIdentifier", "apiVersion"],
        "doc": "Returns the secrets for a resource.",
    },
    "resourceGroup": {
        "params": [],
        "doc": "Returns an object representing the current resource group.",
    },
    "subscription": {
        "params": [],
        "doc": "Returns an object representing the current subscription.",
    },
    "deployment": {
        "params": [],
        "doc": "Returns an object representing the current deployment operation.",
    },
    "environment": {
        "params": [],
        "doc": "Returns an object describing the Azure cloud environment.",
    },
    "az": {
        "params": [],
        "doc": "Namespace for Azure Bicep built-in functions.",
    },
    "json": {
        "params": ["jsonString"],
        "doc": "Converts a valid JSON string into a JSON object / array.",
    },
    "string": {
        "params": ["valueToConvert"],
        "doc": "Converts the specified value to a string.",
    },
    "int": {
        "params": ["valueToConvert"],
        "doc": "Converts the specified value to an integer.",
    },
    "bool": {
        "params": ["value"],
        "doc": "Converts the specified value to a boolean.",
    },
    "array": {
        "params": ["valueToConvert"],
        "doc": "Converts the specified value to an array.",
    },
    "base64": {
        "params": ["inputString"],
        "doc": "Returns the base64 representation of the input string.",
    },
    "base64ToString": {
        "params": ["base64Value"],
        "doc": "Converts a base64 representation to a string.",
    },
    "dateTimeAdd": {
        "params": ["base", "duration", "format"],
        "doc": "Adds a time duration to a base UTC datetime value.",
    },
    "utcNow": {
        "params": ["format"],
        "doc": "Returns the current UTC datetime in the specified format.",
    },
    "loadTextContent": {
        "params": ["filePath", "encoding"],
        "doc": "Loads the content of the specified file as a string at compile time.",
    },
    "loadJsonContent": {
        "params": ["filePath", "jsonPath", "encoding"],
        "doc": "Loads the content of the specified JSON file at compile time.",
    },
    "loadFileAsBase64": {
        "params": ["filePath"],
        "doc": "Loads the specified file as a base64 string at compile time.",
    },
    "managementGroup": {
        "params": ["name"],
        "doc": "Returns an object representing the current or specified management group.",
    },
    "newGuid": {
        "params": [],
        "doc": "Returns a new (random, non-deterministic) GUID. Only valid for param defaults.",
    },
    "filter": {
        "params": ["array", "lambdaExpression"],
        "doc": "Filters an array using a custom filtering lambda expression.",
    },
    "map": {
        "params": ["array", "lambdaExpression"],
        "doc": "Applies a custom mapping lambda expression to each element of an array.",
    },
    "reduce": {
        "params": ["array", "initialValue", "lambdaExpression"],
        "doc": "Reduces an array with a custom lambda expression.",
    },
    "sort": {
        "params": ["array", "lambdaExpression"],
        "doc": "Sorts an array with a custom lambda expression comparator.",
    },
    "min": {
        "params": ["arg1", "arg2..."],
        "doc": "Returns the minimum value from an array of integers, or a comma-separated list.",
    },
    "max": {
        "params": ["arg1", "arg2..."],
        "doc": "Returns the maximum value from an array of integers, or a comma-separated list.",
    },
    "range": {
        "params": ["startIndex", "count"],
        "doc": "Creates an array of integers from startIndex to startIndex+count-1.",
    },
    "items": {
        "params": ["object"],
        "doc": "Returns an array of key/value pair objects that represent the properties of an object.",
    },
    "pickZones": {
        "params": ["providerNamespace", "resourceType", "location", "numberOfZones", "offset"],
        "doc": "Determines which availability zones are recommended for a resource type/location.",
    },
 }
 def get_signature(name: str) -> dict[str, Any] | None:
    return BUILTIN_FUNCTIONS.get(name)
--- a/ilsp/bicep_lsp/local_features.py
+++ b/ilsp/bicep_lsp/local_features.py
@@ -1,177 +0,0 @@
 """
 Local (non-forwarded) implementations of LSP features that Bicep.LangServer
 (as of 0.46.1) does not implement itself: textDocument/signatureHelp,
 textDocument/foldingRange, and workspace/symbol.
 These are intentionally simple, regex/bracket-based implementations — good
 enough for real editor usage, not a full Bicep parser. They run entirely in
 the iLSP proxy and never touch the underlying Bicep LS process.
 """
 from __future__ import annotations
 import re
 from typing import Any
 from .bicep_functions import get_signature
 _DECL_RE = re.compile(
    r"^\s*(resource|module|var|param|output|func|type)\s+([A-Za-z_][\w]*)",
 )
 _SYMBOL_KIND = {
    "resource": 6,   # Method-ish; LSP doesn't have a great "resource" kind, use Variable-family
    "module": 2,     # Module
    "var": 13,       # Variable
    "param": 13,     # Variable
    "output": 13,    # Variable
    "func": 12,      # Function
    "type": 5,       # Class
 }
 # ── signatureHelp ───────────────────────────────────────────────────────────
 def _find_enclosing_call(current: str) -> tuple[str, int] | None:
    """
    Walk backwards from the cursor to find the nearest unmatched '(' and the
    identifier immediately preceding it, returning (function_name, arg_index).
    Returns None if the cursor isn't inside a recognizable function call.
    """
    depth = 0
    comma_count = 0
    i = len(current) - 1
    in_string = False
    while i >= 0:
        ch = current[i]
        if ch == "'" and (i == 0 or current[i - 1] != "\\"):
            in_string = not in_string
        elif not in_string:
            if ch in ")]}":
                depth += 1
            elif ch in "(":
                if depth == 0:
                    # Found the opening paren for the innermost call
                    name_m = re.search(r"([A-Za-z_][\w]*)\s*$", current[:i])
                    if name_m:
                        return name_m.group(1), comma_count
                    return None
                depth -= 1
            elif ch in "[{":
                depth -= 1
            elif ch == "," and depth == 0:
                comma_count += 1
        i -= 1
    return None
 def compute_signature_help(lines: list[str], line: int, character: int) -> dict[str, Any] | None:
    if line >= len(lines):
        return None
    current = lines[line][:character]
    found = _find_enclosing_call(current)
    if not found:
        return None
    func_name, arg_index = found
    sig = get_signature(func_name)
    if not sig:
        return None
    params = sig["params"]
    parameters = [{"label": p} for p in params] if params else []
    active_param = min(arg_index, max(len(parameters) - 1, 0)) if parameters else 0
    label = f"{func_name}({', '.join(params)})"
    return {
        "signatures": [
            {
                "label": label,
                "documentation": {"kind": "markdown", "value": sig["doc"]},
                "parameters": parameters,
            }
        ],
        "activeSignature": 0,
        "activeParameter": active_param,
    }
 # ── foldingRange ────────────────────────────────────────────────────────────
 def compute_folding_ranges(lines: list[str]) -> list[dict[str, Any]]:
    """
    Simple stack-based bracket matcher over {}, [], () — collapses any
    multi-line bracket pair into a folding range. Also folds contiguous
    leading '//' comment blocks.
    """
    ranges: list[dict[str, Any]] = []
    stack: list[tuple[str, int]] = []
    in_string = False
    for lineno, text in enumerate(lines):
        i = 0
        while i < len(text):
            ch = text[i]
            if ch == "'" and (i == 0 or text[i - 1] != "\\"):
                in_string = not in_string
            elif not in_string:
                if ch in "{[(":
                    stack.append((ch, lineno))
                elif ch in "}])":
                    if stack:
                        _open_ch, open_line = stack.pop()
                        if lineno > open_line:
                            ranges.append({"startLine": open_line, "endLine": lineno, "kind": "region"})
            i += 1
    # Fold contiguous line-comment blocks (3+ lines)
    i = 0
    while i < len(lines):
        if lines[i].strip().startswith("//"):
            start = i
            while i < len(lines) and lines[i].strip().startswith("//"):
                i += 1
            if i - start >= 3:
                ranges.append({"startLine": start, "endLine": i - 1, "kind": "comment"})
        else:
            i += 1
    ranges.sort(key=lambda r: (r["startLine"], r["endLine"]))
    return ranges
 # ── workspace/symbol ────────────────────────────────────────────────────────
 def compute_workspace_symbols(docs: dict[str, list[str]], query: str) -> list[dict[str, Any]]:
    """
    Best-effort workspace symbol search over documents currently open in this
    editor session (iLSP has no full-workspace index — only what the client
    has opened). Matches top-level resource/module/var/param/output/func/type
    declarations whose name contains the query (case-insensitive).
    """
    query_l = query.lower()
    results: list[dict[str, Any]] = []
    for uri, lines in docs.items():
        for lineno, text in enumerate(lines):
            m = _DECL_RE.match(text)
            if not m:
                continue
            kind_word, name = m.group(1), m.group(2)
            if query_l and query_l not in name.lower():
                continue
            start_char = text.index(name, m.end(1))
            results.append({
                "name": name,
                "kind": _SYMBOL_KIND.get(kind_word, 13),
                "location": {
                    "uri": uri,
                    "range": {
                        "start": {"line": lineno, "character": start_char},
                        "end": {"line": lineno, "character": start_char + len(name)},
                    },
                },
                "containerName": kind_word,
            })
    return results
--- a/ilsp/bicep_lsp/modules.py
+++ b/ilsp/bicep_lsp/modules.py
@@ -18,20 +18,8 @@ from typing import Any
 logger = logging.getLogger(__name__)
 # Known Azure enum values not always captured in the catalog schema
 def _load_azure_roles() -> list[str]:
    """Load Azure roles from azure_roles.json (generated from bicep/lookup/rbaclookup)."""
    roles_file = pathlib.Path(__file__).parent / "azure_roles.json"
    if roles_file.exists():
        try:
            return json.loads(roles_file.read_text())
        except Exception as e:
            logger.warning("Failed to load azure_roles.json: %s", e)
    return []
 _KNOWN_ENUMS: dict[str, list[str]] = {
    "principalType": ["User", "Group", "ServicePrincipal", "Device", "ForeignGroup"],
    "roles": _load_azure_roles(),
    "roleDefinitionIds": _load_azure_roles(),  # alias for roles
 }
 # Catalog is baked into the image root at /bicep_modules_catalog.json
@@ -48,6 +36,34 @@ _IAC_SOURCE_PATHS = [
    pathlib.Path(__file__).parent.parent.parent / "iac_source_catalog.json",  # dev
 ]
 # Principals catalog — known object IDs for array params (e.g. additionalAccess)
 # Format: {"params": {"additionalAccess": [{"id": "<guid>", "label": "...", "description": "..."}]}}
 _PRINCIPALS_CATALOG_PATHS = [
    pathlib.Path("/data/principals_catalog.json"),          # volume-mount (freshest)
    pathlib.Path("/principals_catalog.json"),               # baked into image (fallback)
    pathlib.Path(__file__).parent.parent.parent / "principals_catalog.json",  # dev
 ]
 def _load_principals_catalog() -> dict[str, list[dict[str, Any]]]:
    """Load principals catalog for array param completions.
    Returns dict keyed by param name (e.g. 'additionalAccess') → list of
    {id, label, description} entries.
    """
    for path in _PRINCIPALS_CATALOG_PATHS:
        if path.exists():
            try:
                data = json.loads(path.read_text())
                params = data.get("params", {})
                count = sum(len(v) for v in params.values())
                logger.info("Principals catalog loaded from %s: %d entries", path, count)
                return params
            except Exception:
                logger.exception("Failed to parse principals catalog at %s", path)
    logger.debug("No principals_catalog.json found — array param completions unavailable")
    return {}
 def _load_iac_source_catalog() -> dict[str, dict[str, Any]]:
    """Load IAC source catalog for enriched param descriptions.
@@ -106,12 +122,14 @@ class BicepModuleCatalog:
    _modules: list[dict[str, Any]] = []
    _iac: dict[str, dict[str, Any]] = {}  # module name → IAC source info
    _principals: dict[str, list[dict[str, Any]]] = {}  # param name → [{id, label, description}]
    @classmethod
    def load(cls) -> None:
-        """Load both catalogs from disk. Call once at startup."""
+        """Load all catalogs from disk. Call once at startup."""
        cls._modules = _load_catalog()
        cls._iac = _load_iac_source_catalog()
        cls._principals = _load_principals_catalog()
    @classmethod
    def _iac_param_map(cls, module_name: str) -> dict[str, dict[str, Any]]:
@@ -258,6 +276,44 @@ class BicepModuleCatalog:
            })
        return items
    @classmethod
    def param_array_item_completion_items(
        cls,
        module_name: str,
        version: str,
        param_name: str,
        has_open_quote: bool = False,
    ) -> list[dict[str, Any]]:
        """Completions for items inside an array param (e.g. additionalAccess objectIds).
        Looks up known entries from the principals catalog keyed by param name.
        """
        entries = cls._principals.get(param_name, [])
        if not entries:
            return []
        items = []
        for i, entry in enumerate(entries):
            val = entry["id"]
            label = entry.get("label", val)
            description = entry.get("description", "")
            insert = f"{val}'" if has_open_quote else f"'{val}'"
            doc = f"**{label}**\n\n`{val}`"
            if description:
                doc += f"\n\n{description}"
            items.append({
                "label": label,
                "kind": 12,  # Value
                "detail": val,  # GUID shown as detail
                "insertText": insert,
                "sortText": f"0_lru_arr_{i:03d}_{label}",
                "documentation": {
                    "kind": "markdown",
                    "value": doc,
                },
            })
        return items
    @classmethod
    def param_completion_items(cls, module_name: str, version: str) -> list[dict[str, Any]]:
        """Param completions for a specific module+version combination."""
@@ -280,56 +336,6 @@ class BicepModuleCatalog:
        iac_params = cls._iac_param_map(module_name)
        items = []
        # Build snippet for full params block (shown first)
        snippet_params = []
        tabstop = 1
        for param_name, param_info in ver_params.items():
            iac = iac_params.get(param_name, {})
            required = iac.get("required", False)
            ptype = param_info.get("type", "any")
            allowed = param_info.get("allowed", [])
            # Include required params + first few optional params in snippet
            if required or len(snippet_params) < 5:
                if allowed:
                    # Enum: use placeholder with first allowed value
                    placeholder = f"'{allowed[0]}'"
                elif ptype == "bool":
                    placeholder = "true"
                elif ptype == "int":
                    placeholder = "0"
                elif ptype == "array":
                    placeholder = "[]"
                elif ptype == "object":
                    placeholder = "{{}}"
                else:
                    placeholder = "''"
                snippet_params.append(f"  {param_name}: ${{{tabstop}:{placeholder}}}")
                tabstop += 1
        if snippet_params:
            snippet_text = "\n" + "\n".join(snippet_params) + "\n"
            required_count = sum(1 for p, i in ver_params.items()
                                if iac_params.get(p, {}).get("required", False))
            items.append({
                "label": "⚡ Fill params block",
                "kind": 15,  # Snippet
                "detail": f"{len(snippet_params)} params ({required_count} required)",
                "insertText": snippet_text,
                "insertTextFormat": 2,  # Snippet
                "sortText": "0_lru_snippet_000",
                "documentation": {
                    "kind": "markdown",
                    "value": (
                        f"**Fill params block**\n\n"
                        f"Inserts {len(snippet_params)} params for `{module_name}`.\n"
                        f"Use Tab to navigate between fields."
                    ),
                },
            })
        # Individual param completions
        for param_name, param_info in ver_params.items():
            ptype = param_info.get("type", "any")
            allowed = param_info.get("allowed", [])
--- a/ilsp/bicep_lsp/proxy.py
+++ b/ilsp/bicep_lsp/proxy.py
@@ -27,11 +27,6 @@ import subprocess
 import threading
 from typing import Any
 from .local_features import (
    compute_folding_ranges,
    compute_signature_help,
    compute_workspace_symbols,
 )
 from .modules import BicepModuleCatalog
 logger = logging.getLogger(__name__)
@@ -135,6 +130,19 @@ class _ProxySession:
                    mod_name = last_mod.group(1)
                    mod_ver = last_mod.group(2)
                    # Array item context: cursor inside [...] for an array param.
                    # Must be checked BEFORE value_m, since array lines also match
                    # the value pattern (e.g. `additionalAccess: ['`).
                    array_m = re.search(r"^\s*(\w+):\s*\[", current)
                    if array_m and current.count("[") > current.count("]"):
                        return {
                            "type": "param_array_item",
                            "module": mod_name,
                            "version": mod_ver,
                            "param": array_m.group(1),
                            "has_open_quote": bool(re.search(r"'[^']*$", current)),
                        }
                    # Check if cursor is after 'paramname: ' on the current line
                    # (value context — inject enum/allowed values)
                    value_m = re.search(r"^\s*(\w+):\s*('?)([^'{}]*)$", current)
@@ -147,43 +155,6 @@ class _ProxySession:
                            "has_open_quote": bool(value_m.group(2)),
                        }
                    # Check if cursor is inside an array value for a param
                    # e.g. "roles: ['KEY_VAULT_" or "roles: [  '"
                    array_m = re.search(r"^\s*(\w+):\s*\[[^\]]*?('?)([^',\]]*)$", current)
                    if array_m and array_m.group(1) not in {"params", "name", "module", "resource"}:
                        return {
                            "type": "param_value",
                            "module": mod_name,
                            "version": mod_ver,
                            "param": array_m.group(1),
                            "has_open_quote": bool(array_m.group(2)),
                        }
                    # Check if cursor is inside a multi-line array element
                    # e.g. "          'APP_CONFIG" on line after "roles: ["
                    # Walk backwards to find the array opening
                    for lookback_idx in range(line_idx - 1, max(0, line_idx - 10), -1):
                        prev_line = lines[lookback_idx]
                        # Found array opening like "roles: [" or "    roles: ["
                        array_open_m = re.match(r"^\s*(\w+):\s*\[$", prev_line.rstrip())
                        if array_open_m:
                            param_name = array_open_m.group(1)
                            if param_name not in {"params", "name", "module", "resource"}:
                                # Check if current line is inside the array (has quote or is indented)
                                if re.match(r"^\s+('?)([^',\]]*)\s*$", current):
                                    has_quote = bool(re.match(r"^\s+'", current))
                                    return {
                                        "type": "param_value",
                                        "module": mod_name,
                                        "version": mod_ver,
                                        "param": param_name,
                                        "has_open_quote": has_quote,
                                    }
                            break
                        # Stop if we hit a closing bracket (we're outside the array)
                        if "]" in prev_line:
                            break
                    return {
                        "type": "param",
                        "module": mod_name,
@@ -192,12 +163,8 @@ class _ProxySession:
        return {"type": "unknown"}
-    def pop_context(self, msg_id) -> dict | None:
+    def pop_context(self, msg_id) -> dict:
-        """Return the tracked completion context for msg_id, or None if this
+        return self.pending.pop(msg_id, {"type": "unknown"})
        response id does not correspond to a textDocument/completion request
        we recorded (e.g. hover/definition/references/... responses must never
        be treated as completion responses)."""
        return self.pending.pop(msg_id, None)
 # ── Completion injection ───────────────────────────────────────────────────────
@@ -243,11 +210,18 @@ def _inject_completions(msg: dict[str, Any], context: dict | None = None) -> byt
            context["param"],
            context.get("has_open_quote", False),
        )
    elif ctx_type == "param_array_item":
        lru_items = BicepModuleCatalog.param_array_item_completion_items(
            context["module"],
            context["version"],
            context["param"],
            context.get("has_open_quote", False),
        )
    else:
        # Default: module name completions
        lru_items = BicepModuleCatalog.as_completion_items()
-    if ctx_type in ("version", "param", "param_value"):
+    if ctx_type in ("version", "param", "param_value", "param_array_item"):
        # Always replace LS completions for private-registry contexts — the
        # Bicep LS doesn't know about our ACR, so anything it returns is noise.
        # Even if lru_items is empty (no enum values for a param), suppress LS.
@@ -270,26 +244,8 @@ def _inject_completions(msg: dict[str, Any], context: dict | None = None) -> byt
    return json.dumps(msg).encode()
 def _local_response(msg_id, result: Any) -> bytes:
    return json.dumps({"jsonrpc": "2.0", "id": msg_id, "result": result}).encode()
 class _LockedConn:
    """Wraps a socket so concurrent writers (locally-answered responses vs.
    forwarded LS responses) never interleave partial frames on the wire."""
    def __init__(self, conn: socket.socket, lock: threading.Lock) -> None:
        self._conn = conn
        self._lock = lock
    def sendall(self, data: bytes) -> None:
        with self._lock:
            self._conn.sendall(data)
 def _client_to_ls(
    conn_file,
    conn: socket.socket,
    proc_stdin,
    session: _ProxySession,
 ) -> None:
@@ -299,7 +255,6 @@ def _client_to_ls(
            logger.debug("Client→LS: %d bytes", len(body))
            # Track document state and completion context (never block forwarding)
            forward = True
            try:
                msg = json.loads(body)
                method = msg.get("method", "")
@@ -315,33 +270,9 @@ def _client_to_ls(
                        session.update_doc(uri, changes[-1].get("text", ""))
                elif method == "textDocument/completion":
                    session.record_completion_request(msg)
                elif method == "textDocument/signatureHelp":
                    # Bicep.LangServer doesn't implement this — answer locally.
                    forward = False
                    params = msg.get("params", {})
                    uri = params.get("textDocument", {}).get("uri", "")
                    pos = params.get("position", {})
                    lines = session.docs.get(uri, [])
                    result = compute_signature_help(lines, pos.get("line", 0), pos.get("character", 0))
                    conn.sendall(_frame(_local_response(msg.get("id"), result)))
                elif method == "textDocument/foldingRange":
                    # Bicep.LangServer doesn't implement this — answer locally.
                    forward = False
                    uri = msg.get("params", {}).get("textDocument", {}).get("uri", "")
                    lines = session.docs.get(uri, [])
                    result = compute_folding_ranges(lines)
                    conn.sendall(_frame(_local_response(msg.get("id"), result)))
                elif method == "workspace/symbol":
                    # Bicep.LangServer doesn't implement this — answer locally,
                    # scoped to documents open in this editor session.
                    forward = False
                    query = msg.get("params", {}).get("query", "")
                    result = compute_workspace_symbols(session.docs, query)
                    conn.sendall(_frame(_local_response(msg.get("id"), result)))
            except Exception:
-                forward = True  # parsing/handling errors must never block forwarding
+                pass  # parsing errors must never block forwarding
            if forward:
            framed = _frame(body)
            proc_stdin.write(framed)
            proc_stdin.flush()
@@ -368,26 +299,10 @@ def _ls_to_client(
            logger.debug("LS→Client: %d bytes", len(body))
            try:
                msg = json.loads(body)
-                context = None
+                context: dict = {}
                if "id" in msg and "result" in msg:
                    context = session.pop_context(msg["id"])
                # Only rewrite responses that actually correspond to a
                # textDocument/completion request we tracked — any other
                # response (hover, definition, references, documentSymbol,
                # formatting, codeAction, ...) must pass through untouched.
                if context is not None:
                out = _inject_completions(msg, context)
                elif msg.get("method") is None and isinstance(msg.get("result"), dict) and "capabilities" in msg.get("result", {}):
                    # This is the initialize response — advertise the extra
                    # capabilities iLSP answers locally (Bicep.LangServer
                    # itself doesn't implement these).
                    caps = msg["result"]["capabilities"]
                    caps["signatureHelpProvider"] = {"triggerCharacters": ["(", ","]}
                    caps["foldingRangeProvider"] = True
                    caps["workspaceSymbolProvider"] = True
                    out = json.dumps(msg).encode()
                else:
                    out = body
            except json.JSONDecodeError:
                out = body
            conn.sendall(_frame(out))
@@ -411,22 +326,16 @@ def _handle_client(conn: socket.socket, addr: tuple) -> None:
    # Unbuffered read from the socket — critical for correct LSP framing
    conn_file = conn.makefile("rb", buffering=0)
    # t1 may write locally-answered responses (signatureHelp/foldingRange/
    # workspace-symbol) to conn concurrently with t2's LS responses — a lock
    # prevents interleaved/corrupted frames on the wire.
    send_lock = threading.Lock()
    locked_conn = _LockedConn(conn, send_lock)
    # t1: client → LS  (finishes when client closes write side)
    t1 = threading.Thread(
        target=_client_to_ls,
-        args=(conn_file, locked_conn, proc.stdin, session),
+        args=(conn_file, proc.stdin, session),
        daemon=True,
    )
    # t2: LS → client  (finishes when LS closes stdout)
    t2 = threading.Thread(
        target=_ls_to_client,
-        args=(proc.stdout, locked_conn, session),
+        args=(proc.stdout, conn, session),
        daemon=True,
    )
    t1.start()
--- a/principals_catalog.json
+++ b/principals_catalog.json
@@ -0,0 +1,11 @@
 {
  "params": {
    "additionalAccess": [
      {
        "id": "c88bf29d-b13a-4153-9738-8995085a451e",
        "label": "LRIADMPRO-IaC-Bicep",
        "description": "IaC Bicep pipeline service principal"
      }
    ]
  }
 }
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -24,11 +24,6 @@ ilsp = "ilsp.server:main"
 where = ["."]
 include = ["ilsp*"]
 [tool.setuptools.package-data]
 "ilsp.bicep_lsp" = ["*.json"]
 "ilsp.yaml_lsp" = ["*.json"]
 "ilsp.python_lsp" = ["*.json"]
 [project.optional-dependencies]
 dev = [
    "pytest>=8.0",
--- a/scripts/extract_roles_from_rbaclookup.py
+++ b/scripts/extract_roles_from_rbaclookup.py
@@ -1,70 +0,0 @@
 #!/usr/bin/env python3
 """
 Extract all Azure role names from rbacLookup.bicep and generate Python code
 for _KNOWN_ENUMS in modules.py.
 Usage:
    python3 scripts/extract_roles_from_rbaclookup.py /path/to/rbacLookup.bicep
 """
 import re
 import sys
 from pathlib import Path
 def extract_role_names(bicep_file: Path) -> list[str]:
    """Extract all role names from the rbacLookup.bicep var roles = {...} block."""
    content = bicep_file.read_text()
    # Find the "var roles = {" block
    roles_match = re.search(r'@export\(\)\s*var\s+roles\s*=\s*\{(.+?)\n\}', content, re.DOTALL)
    if not roles_match:
        raise ValueError("Could not find 'var roles = {' block in Bicep file")
    roles_block = roles_match.group(1)
    # Extract all role names (keys before the colon)
    # Pattern: "  ROLE_NAME: 'guid'"
    role_names = re.findall(r'^\s+([A-Z_]+):', roles_block, re.MULTILINE)
    return sorted(role_names)
 def generate_python_code(role_names: list[str]) -> str:
    """Generate Python code for _KNOWN_ENUMS["roles"]."""
    lines = ['_KNOWN_ENUMS = {']
    lines.append('    "roles": [')
    for role in role_names:
        lines.append(f'        "{role}",')
    lines.append('    ],')
    lines.append('    "roleDefinitionIds": [  # alias for roles')
    for role in role_names:
        lines.append(f'        "{role}",')
    lines.append('    ],')
    lines.append('}')
    return '\n'.join(lines)
 if __name__ == "__main__":
    if len(sys.argv) < 2:
        print("Usage: extract_roles_from_rbaclookup.py /path/to/rbacLookup.bicep", file=sys.stderr)
        sys.exit(1)
    bicep_path = Path(sys.argv[1])
    if not bicep_path.exists():
        print(f"Error: File not found: {bicep_path}", file=sys.stderr)
        sys.exit(1)
    try:
        roles = extract_role_names(bicep_path)
        print(f"# Extracted {len(roles)} roles from {bicep_path.name}")
        print(f"# Generated: {Path(__file__).name}\n")
        print(generate_python_code(roles))
    except Exception as e:
        print(f"Error: {e}", file=sys.stderr)
        sys.exit(1)
--- a/scripts/lsp_bridge.py
+++ b/scripts/lsp_bridge.py
@@ -17,7 +17,6 @@ frames straight to stdout.
 import asyncio
 import ssl
 import sys
 import traceback
 import websockets
@@ -72,9 +71,8 @@ async def main(uri: str) -> None:
                    if msg is None:
                        break
                    await ws.send(msg)
-            except Exception as e:
+            except Exception:
-                print(f"stdin_to_ws error: {e}", file=sys.stderr)
+                pass
                traceback.print_exc(file=sys.stderr)
        async def ws_to_stdout() -> None:
            try:
@@ -82,9 +80,8 @@ async def main(uri: str) -> None:
                    data = frame if isinstance(frame, bytes) else frame.encode()
                    sys.stdout.buffer.write(data)
                    sys.stdout.buffer.flush()
-            except Exception as e:
+            except Exception:
-                print(f"ws_to_stdout error: {e}", file=sys.stderr)
+                pass
                traceback.print_exc(file=sys.stderr)
        await asyncio.gather(stdin_to_ws(), ws_to_stdout())
@@ -93,9 +90,4 @@ if __name__ == "__main__":
    if len(sys.argv) < 2:
        print("Usage: lsp_bridge.py <wss://...>", file=sys.stderr)
        sys.exit(1)
    try:
    asyncio.run(main(sys.argv[1]))
    except Exception as e:
        print(f"Fatal error: {e}", file=sys.stderr)
        traceback.print_exc(file=sys.stderr)
        sys.exit(1)
--- a/scripts/lsp_bridge_debug.sh
+++ b/scripts/lsp_bridge_debug.sh
@@ -1,12 +0,0 @@
 #!/bin/bash
 # Wrapper for lsp_bridge.py that logs to a file for debugging IntelliJ issues
 LOG_FILE="/tmp/lsp_bridge_debug.log"
 echo "=== LSP Bridge started at $(date) ===" >> "$LOG_FILE"
 echo "Args: $@" >> "$LOG_FILE"
 echo "PWD: $(pwd)" >> "$LOG_FILE"
 echo "Python: $(which python3)" >> "$LOG_FILE"
 echo "" >> "$LOG_FILE"
 exec /opt/homebrew/bin/python3 /Users/lrihni/Projects/iLSP/scripts/lsp_bridge.py "$@" 2>> "$LOG_FILE"
--- a/scripts/push_catalogs.sh
+++ b/scripts/push_catalogs.sh
@@ -31,6 +31,7 @@ BICEP_CATALOG="$DEVOPS_MCP_REPO/bicep_modules_catalog.json"
 IAC_CATALOG="$DEVOPS_MCP_REPO/iac_source_catalog.json"
 ILSP_REPO="$(cd "$(dirname "$0")/.." && pwd)"
 TMPL_CATALOG="$ILSP_REPO/pipeline_templates_catalog.json"
 PRINCIPALS_CATALOG="$ILSP_REPO/principals_catalog.json"
 echo "── iLSP catalog push ──────────────────────────────"
@@ -50,6 +51,13 @@ if [[ ! -f "$TMPL_CATALOG" ]]; then
 fi
 echo "  ✓ $(basename "$TMPL_CATALOG")  ($(du -sh "$TMPL_CATALOG" | cut -f1))"
 if [[ ! -f "$PRINCIPALS_CATALOG" ]]; then
  echo "  ✗ Not found: $PRINCIPALS_CATALOG"
  echo "    Run: python3 $ILSP_REPO/scripts/sync_principals_catalog.py"
  exit 1
 fi
 echo "  ✓ $(basename "$PRINCIPALS_CATALOG")  ($(du -sh "$PRINCIPALS_CATALOG" | cut -f1))"
 # Copy iac_source_catalog.json to iLSP repo root so it gets baked into the Docker image
 echo ""
 echo "  → Copying iac_source_catalog.json to iLSP repo root (for Docker bake) …"
@@ -59,7 +67,7 @@ echo "  ✓ Copied to $ILSP_REPO/iac_source_catalog.json"
 echo ""
 echo "  → Copying to $AUTOBOX:$REMOTE_DIR/ …"
 ssh "$AUTOBOX" "mkdir -p $REMOTE_DIR"
-scp "$BICEP_CATALOG" "$IAC_CATALOG" "$TMPL_CATALOG" "$AUTOBOX:$REMOTE_DIR/"
+scp "$BICEP_CATALOG" "$IAC_CATALOG" "$TMPL_CATALOG" "$PRINCIPALS_CATALOG" "$AUTOBOX:$REMOTE_DIR/"
 echo "  ✓ Upload done"
 if [[ "$NO_RELOAD" == "true" ]]; then
@@ -78,5 +86,5 @@ else
 fi
 echo ""
-echo "  Done. Bicep + YAML pipeline template completions updated."
+echo "  Done. Bicep + YAML pipeline template + principals completions updated."
 echo "  Note: iac_source_catalog.json was copied to repo root — commit + push to bake into next Docker image."
--- a/scripts/sync_principals_catalog.py
+++ b/scripts/sync_principals_catalog.py
@@ -0,0 +1,214 @@
 #!/usr/bin/env python3
 """
 sync_principals_catalog.py — Build principals_catalog.json by scanning .bicep files
 for array param values (GUIDs) and their inline comments.
 Scans configured IaC repo directories for patterns like:
    additionalAccess: ['c88bf29d-...'] // LRIADMPRO-IaC-Bicep
    additionalAccess: [
      'c88bf29d-...' // LRIADMPRO-IaC-Bicep
      'another-guid' // Another-SP
    ]
 Usage:
    python3 scripts/sync_principals_catalog.py
    python3 scripts/sync_principals_catalog.py --paths ~/IdeaProjects/Bitbucket/IaC
    python3 scripts/sync_principals_catalog.py --dry-run
    python3 scripts/sync_principals_catalog.py --output /path/to/principals_catalog.json
 """
 import argparse
 import json
 import logging
 import pathlib
 import re
 import sys
 from datetime import datetime, timezone
 from typing import Any
 logging.basicConfig(level=logging.INFO, format="%(levelname)s  %(message)s")
 log = logging.getLogger(__name__)
 _REPO_ROOT = pathlib.Path(__file__).parent.parent
 _DEFAULT_OUTPUT = _REPO_ROOT / "principals_catalog.json"
 # Default paths to scan — adjust to match your IaC repo locations
 _DEFAULT_SCAN_PATHS = [
    "~/IdeaProjects/Bitbucket/IaC",
    "~/IdeaProjects/Bitbucket/LRU",
 ]
 # Matches a UUID/GUID
 _GUID_RE = re.compile(
    r"[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}"
 )
 # Matches a single quoted GUID optionally followed by an inline comment:
 #   'c88bf29d-...'  // Some label text
 #   'c88bf29d-...'  // or with hash comments
 _ITEM_RE = re.compile(
    r"'(" + _GUID_RE.pattern + r")'\s*(?://+\s*(.+?)\s*)?$",
    re.IGNORECASE,
 )
 # Matches the opening of an array param assignment:
 #   additionalAccess: [  or  additionalAccess: ['guid'
 _ARRAY_OPEN_RE = re.compile(r"^\s*(\w+)\s*:\s*\[")
 def _extract_label(comment: str | None) -> str | None:
    """Clean up an inline comment to use as a display label."""
    if not comment:
        return None
    # Strip trailing punctuation and whitespace
    return comment.strip().rstrip(".,;")
 def scan_file(path: pathlib.Path) -> dict[str, list[dict[str, Any]]]:
    """Scan a single .bicep file and return {param_name: [{id, label, source}]}."""
    try:
        text = path.read_text(encoding="utf-8")
    except Exception as exc:
        log.debug("Cannot read %s: %s", path, exc)
        return {}
    lines = text.splitlines()
    results: dict[str, list[dict[str, Any]]] = {}
    i = 0
    while i < len(lines):
        line = lines[i]
        array_m = _ARRAY_OPEN_RE.match(line)
        if not array_m:
            i += 1
            continue
        param_name = array_m.group(1)
        # Collect all characters on this and subsequent lines until array closes
        collected = line[array_m.end() - 1:]  # from '[' onwards
        j = i + 1
        # If the array doesn't close on the same line, keep accumulating
        while collected.count("[") > collected.count("]") and j < len(lines):
            collected += "\n" + lines[j]
            j += 1
        # Extract all GUID items from the collected block
        for item_line in collected.splitlines():
            m = _ITEM_RE.search(item_line)
            if not m:
                continue
            guid = m.group(1).lower()
            label = _extract_label(m.group(2))
            entry: dict[str, Any] = {
                "id": guid,
                "label": label or guid,
                "source": str(path),
            }
            if label:
                entry["description"] = f"From {path.name}"
            results.setdefault(param_name, [])
            results[param_name].append(entry)
        i = j
    return results
 def scan_paths(paths: list[pathlib.Path]) -> dict[str, list[dict[str, Any]]]:
    """Scan all .bicep files under the given paths, deduplicating GUIDs per param."""
    # param_name → {guid → entry}  (dict for dedup)
    merged: dict[str, dict[str, dict[str, Any]]] = {}
    files_scanned = 0
    for base in paths:
        if not base.exists():
            log.warning("Path not found, skipping: %s", base)
            continue
        for bicep_file in sorted(base.rglob("*.bicep")):
            file_results = scan_file(bicep_file)
            files_scanned += 1
            for param, entries in file_results.items():
                bucket = merged.setdefault(param, {})
                for entry in entries:
                    guid = entry["id"]
                    if guid not in bucket:
                        bucket[guid] = entry
                    else:
                        # Keep the entry with the most informative label
                        existing = bucket[guid]
                        if entry.get("label") and entry["label"] != guid:
                            if existing.get("label") == guid or not existing.get("label"):
                                bucket[guid] = entry
    log.info("Scanned %d .bicep files across %d path(s)", files_scanned, len(paths))
    # Flatten back to lists, sorted by label
    return {
        param: sorted(entries.values(), key=lambda e: e.get("label", e["id"]).lower())
        for param, entries in sorted(merged.items())
    }
 def build_catalog(scan_paths_list: list[pathlib.Path]) -> dict[str, Any]:
    params = scan_paths(scan_paths_list)
    total = sum(len(v) for v in params.values())
    log.info("Found %d unique entries across %d param(s)", total, len(params))
    return {
        "synced_at": datetime.now(timezone.utc).isoformat(),
        "entry_count": total,
        "params": params,
    }
 def main() -> None:
    parser = argparse.ArgumentParser(
        description=__doc__,
        formatter_class=argparse.RawDescriptionHelpFormatter,
    )
    parser.add_argument(
        "--paths",
        nargs="+",
        default=_DEFAULT_SCAN_PATHS,
        metavar="PATH",
        help="Directories to scan for .bicep files (default: %(default)s)",
    )
    parser.add_argument(
        "--dry-run",
        action="store_true",
        help="Print findings without writing the catalog",
    )
    parser.add_argument(
        "--output",
        default=str(_DEFAULT_OUTPUT),
        help="Output JSON file (default: %(default)s)",
    )
    args = parser.parse_args()
    resolved = [pathlib.Path(p).expanduser().resolve() for p in args.paths]
    catalog = build_catalog(resolved)
    if args.dry_run:
        print(f"\n── Principals catalog (dry-run) ──────────────────────")
        if not catalog["params"]:
            print("  No GUID values found in .bicep files.")
        for param, entries in catalog["params"].items():
            print(f"\n  param: {param}  ({len(entries)} entries)")
            for e in entries:
                print(f"    {e['label']:<40}  {e['id']}")
        print(f"\n  Total: {catalog['entry_count']} entries")
        return
    out = pathlib.Path(args.output)
    # Strip internal 'source' field — not needed at runtime
    for entries in catalog["params"].values():
        for e in entries:
            e.pop("source", None)
    out.write_text(json.dumps(catalog, indent=2, ensure_ascii=False), encoding="utf-8")
    log.info("Written: %s  (%d entries)", out, catalog["entry_count"])
 if __name__ == "__main__":
    main()
--- a/tests/test_local_features.py
+++ b/tests/test_local_features.py
@@ -1,132 +0,0 @@
 import json
 from ilsp.bicep_lsp.local_features import (
    compute_folding_ranges,
    compute_signature_help,
    compute_workspace_symbols,
 )
 # ── signatureHelp ────────────────────────────────────────────────────────────
 def test_signature_help_simple_call():
    lines = ["var id = resourceId('Microsoft.Storage/storageAccounts', "]
    result = compute_signature_help(lines, 0, len(lines[0]))
    assert result is not None
    sig = result["signatures"][0]
    assert sig["label"].startswith("resourceId(")
    assert result["activeParameter"] == 1
 def test_signature_help_first_arg():
    lines = ["var g = guid("]
    result = compute_signature_help(lines, 0, len(lines[0]))
    assert result is not None
    assert result["activeParameter"] == 0
    assert result["signatures"][0]["label"].startswith("guid(")
 def test_signature_help_unknown_function_returns_none():
    lines = ["var x = notARealFunction("]
    result = compute_signature_help(lines, 0, len(lines[0]))
    assert result is None
 def test_signature_help_outside_call_returns_none():
    lines = ["var x = 'hello world'"]
    result = compute_signature_help(lines, 0, len(lines[0]))
    assert result is None
 def test_signature_help_nested_call_uses_innermost():
    lines = ["var x = concat(toLower("]
    result = compute_signature_help(lines, 0, len(lines[0]))
    assert result is not None
    assert result["signatures"][0]["label"].startswith("toLower(")
 # ── foldingRange ─────────────────────────────────────────────────────────────
 def test_folding_range_multiline_object():
    lines = [
        "resource sa 'Microsoft.Storage/storageAccounts@2023-01-01' = {",
        "  name: 'demo'",
        "  sku: {",
        "    name: 'Standard_LRS'",
        "  }",
        "}",
    ]
    ranges = compute_folding_ranges(lines)
    assert {"startLine": 0, "endLine": 5, "kind": "region"} in ranges
    assert {"startLine": 2, "endLine": 4, "kind": "region"} in ranges
 def test_folding_range_ignores_single_line_brackets():
    lines = ["var x = { a: 1 }"]
    ranges = compute_folding_ranges(lines)
    assert ranges == []
 def test_folding_range_comment_block():
    lines = [
        "// line one",
        "// line two",
        "// line three",
        "var x = 1",
    ]
    ranges = compute_folding_ranges(lines)
    assert {"startLine": 0, "endLine": 2, "kind": "comment"} in ranges
 def test_folding_range_short_comment_block_not_folded():
    lines = ["// only one line", "var x = 1"]
    ranges = compute_folding_ranges(lines)
    assert not any(r["kind"] == "comment" for r in ranges)
 # ── workspace/symbol ─────────────────────────────────────────────────────────
 def test_workspace_symbol_finds_declarations():
    docs = {
        "file:///a.bicep": [
            "param location string = 'westeurope'",
            "var storageName = 'demo'",
            "resource sa 'Microsoft.Storage/storageAccounts@2023-01-01' = {",
            "  name: storageName",
            "}",
            "module roleAssignment 'br/modules:modules/roleassignments:2.0.x' = {",
            "  name: 'ra'",
            "}",
        ],
    }
    results = compute_workspace_symbols(docs, "")
    names = {r["name"] for r in results}
    assert names == {"location", "storageName", "sa", "roleAssignment"}
 def test_workspace_symbol_filters_by_query():
    docs = {
        "file:///a.bicep": [
            "var storageName = 'demo'",
            "var otherThing = 'x'",
        ],
    }
    results = compute_workspace_symbols(docs, "storage")
    assert len(results) == 1
    assert results[0]["name"] == "storageName"
 def test_workspace_symbol_query_is_case_insensitive():
    docs = {"file:///a.bicep": ["var StorageName = 'demo'"]}
    results = compute_workspace_symbols(docs, "storagename")
    assert len(results) == 1
 def test_workspace_symbol_searches_across_multiple_documents():
    docs = {
        "file:///a.bicep": ["var fromA = 1"],
        "file:///b.bicep": ["var fromB = 2"],
    }
    results = compute_workspace_symbols(docs, "")
    names = {r["name"] for r in results}
    assert names == {"fromA", "fromB"}
--- a/tests/test_proxy.py
+++ b/tests/test_proxy.py
@@ -18,6 +18,7 @@ def test_frame_produces_correct_header():
@pytest.fixture(autouse=True)
 def reset_modules():
    BicepModuleCatalog._modules = []
    BicepModuleCatalog._principals = {}
    yield
@@ -173,12 +174,8 @@ def test_param_completions_injected_on_param_context():
    assert "roleDefinitionIds" in labels
    assert "principalId" in labels
    assert "principalType" in labels
-    # First item is now the snippet completion
+    assert items[0]["sortText"].startswith("0_lru_param_")
-    assert items[0]["label"] == "⚡ Fill params block"
+    assert items[0]["kind"] == 5  # Field
    assert items[0]["kind"] == 15  # Snippet
    # Second item should be a regular param
    assert items[1]["sortText"].startswith("0_lru_param_")
    assert items[1]["kind"] == 5  # Field
 def test_param_completion_items_have_insert_text():
@@ -186,12 +183,7 @@ def test_param_completion_items_have_insert_text():
        "roleassignments", versions=["1.1.x"], schema=_ROLEASSIGNMENTS_SCHEMA
    )]
    items = BicepModuleCatalog.param_completion_items("roleassignments", "1.1.x")
-    # First item should be the snippet completion
+    for item in items:
    assert items[0]["label"] == "⚡ Fill params block"
    assert items[0]["insertTextFormat"] == 2
    assert "principalId" in items[0]["insertText"]
    # Individual param items should have ": " suffix
    for item in items[1:]:
        assert item["insertText"].endswith(": ")
@@ -311,48 +303,6 @@ def test_detect_param_value_context_open_quote():
    assert ctx["has_open_quote"] is True
 def test_detect_param_value_context_in_array():
    """Cursor inside array value → param_value context."""
    lines = [
        "module myMod 'br/modules:roleassignments:1.1.x' = {",
        "  params: {",
        "    roles: ['KEY_VAULT_",  # ← cursor inside array element
        "  }",
        "}",
    ]
    session = _make_session_with_doc(URI, lines)
    # character = len("    roles: ['KEY_VAULT_") = 23
    ctx = session._detect_context(URI, {"line": 2, "character": 23})
    assert ctx["type"] == "param_value"
    assert ctx["module"] == "roleassignments"
    assert ctx["param"] == "roles"
    assert ctx["has_open_quote"] is True
 def test_detect_param_value_context_in_multiline_array():
    """Cursor in multi-line array element → param_value context."""
    lines = [
        "module myMod 'br/modules:roleassignments:2.0.x' = {",
        "  params: {",
        "    assignments: [",
        "      {",
        "        roles: [",
        "          'APP_CONFIGURATION_",  # ← cursor on separate line
        "        ]",
        "      }",
        "    ]",
        "  }",
        "}",
    ]
    session = _make_session_with_doc(URI, lines)
    # character = len("          'APP_CONFIGURATION_") = 27
    ctx = session._detect_context(URI, {"line": 5, "character": 27})
    assert ctx["type"] == "param_value"
    assert ctx["module"] == "roleassignments"
    assert ctx["param"] == "roles"
    assert ctx["has_open_quote"] is True
 def test_param_value_items_from_catalog_allowed():
    """environmentType completions come from catalog 'allowed' field."""
    BicepModuleCatalog._modules = [_make_module(
@@ -404,24 +354,6 @@ def test_param_value_items_known_enum_fallback():
    assert "User" in labels
 def test_param_value_items_roles_enum():
    """roles parameter uses _KNOWN_ENUMS for Azure role completions."""
    BicepModuleCatalog._modules = [_make_module(
        "roleassignments",
        versions=["1.1.x"],
        schema={"1.1.x": {"parameters": {
            "roles": {"type": "array"},  # no 'allowed' in catalog
        }}},
    )]
    items = BicepModuleCatalog.param_value_completion_items(
        "roleassignments", "1.1.x", "roles"
    )
    labels = [i["label"] for i in items]
    assert "KEY_VAULT_SECRETS_USER" in labels
    assert "STORAGE_BLOB_DATA_READER" in labels
    assert "CONTRIBUTOR" in labels
 def test_param_value_items_empty_for_free_string():
    """A plain string param with no allowed values returns no completions."""
    BicepModuleCatalog._modules = [_make_module(
@@ -455,6 +387,111 @@ def test_param_value_injected_in_completion_response():
    assert labels == ["DEV", "TEST", "PROD"]
 # ── Array item completion tests ────────────────────────────────────────────────
 def test_detect_param_array_item_context():
    """Cursor inside [...] for an array param → param_array_item context."""
    lines = [
        "module keyVault 'br/modules:modules/keyvault:2.1.x' = {",
        "  params: {",
        "    additionalAccess: ['",  # ← cursor after opening quote inside array
        "  }",
        "}",
    ]
    session = _make_session_with_doc(URI, lines)
    # character 24 = after the `'` (4 spaces + 16 "additionalAccess" + 2 ": " + 1 "[" + 1 "'" = 24)
    ctx = session._detect_context(URI, {"line": 2, "character": 24})
    assert ctx["type"] == "param_array_item"
    assert ctx["module"] == "modules/keyvault"
    assert ctx["param"] == "additionalAccess"
    assert ctx["has_open_quote"] is True
 def test_detect_param_array_item_context_no_quote():
    """Cursor at start of empty array → param_array_item, no open quote."""
    lines = [
        "module keyVault 'br/modules:modules/keyvault:2.1.x' = {",
        "  params: {",
        "    additionalAccess: [",  # ← cursor after [
        "  }",
        "}",
    ]
    session = _make_session_with_doc(URI, lines)
    ctx = session._detect_context(URI, {"line": 2, "character": 23})
    assert ctx["type"] == "param_array_item"
    assert ctx["has_open_quote"] is False
 def test_detect_param_array_item_context_after_existing_item():
    """Cursor after an existing item inside array → still param_array_item."""
    lines = [
        "module keyVault 'br/modules:modules/keyvault:2.1.x' = {",
        "  params: {",
        "    additionalAccess: ['c88bf29d-b13a-4153-9738-8995085a451e', '",
        "  }",
        "}",
    ]
    session = _make_session_with_doc(URI, lines)
    char = len("    additionalAccess: ['c88bf29d-b13a-4153-9738-8995085a451e', '")
    ctx = session._detect_context(URI, {"line": 2, "character": char})
    assert ctx["type"] == "param_array_item"
    assert ctx["has_open_quote"] is True
 def test_param_array_item_completion_items():
    """param_array_item_completion_items returns entries from principals catalog."""
    BicepModuleCatalog._principals = {
        "additionalAccess": [
            {"id": "aaaa-bbbb", "label": "My-SP", "description": "Test SP"},
        ]
    }
    items = BicepModuleCatalog.param_array_item_completion_items(
        "modules/keyvault", "2.1.x", "additionalAccess"
    )
    assert len(items) == 1
    assert items[0]["label"] == "My-SP"
    assert items[0]["detail"] == "aaaa-bbbb"
    assert items[0]["insertText"] == "'aaaa-bbbb'"
 def test_param_array_item_completion_items_open_quote():
    BicepModuleCatalog._principals = {
        "additionalAccess": [{"id": "aaaa-bbbb", "label": "My-SP"}]
    }
    items = BicepModuleCatalog.param_array_item_completion_items(
        "modules/keyvault", "2.1.x", "additionalAccess", has_open_quote=True
    )
    assert items[0]["insertText"] == "aaaa-bbbb'"
 def test_param_array_item_empty_when_no_catalog_entry():
    BicepModuleCatalog._principals = {}
    items = BicepModuleCatalog.param_array_item_completion_items(
        "modules/keyvault", "2.1.x", "additionalAccess"
    )
    assert items == []
 def test_param_array_item_injected_in_completion_response():
    """Full pipeline: param_array_item context injects principal completions."""
    BicepModuleCatalog._principals = {
        "additionalAccess": [{"id": "aaaa-1111", "label": "IaC-SP", "description": "Pipeline SP"}]
    }
    msg = _completion_response([{"label": "noise", "sortText": "z"}])
    ctx = {
        "type": "param_array_item",
        "module": "modules/keyvault",
        "version": "2.1.x",
        "param": "additionalAccess",
        "has_open_quote": False,
    }
    out = json.loads(_inject_completions(msg, ctx))
    items = out["result"]["items"]
    assert len(items) == 1
    assert items[0]["label"] == "IaC-SP"
    assert items[0]["detail"] == "aaaa-1111"
 def test_detect_unknown_context_outside_module():
    lines = ["var x = 'hello'"]
    session = _make_session_with_doc(URI, lines)
@@ -502,7 +539,6 @@ def test_session_records_and_pops_context():
    assert ctx["type"] == "param"
    assert ctx["module"] == "appservice"
-    # Second pop (or any untracked id) returns None — the response must pass
+    # Second pop returns unknown
-    # through untouched rather than being mistaken for a completion response.
+    assert session.pop_context(42)["type"] == "unknown"
    assert session.pop_context(42) is None