security-mcp 1.3.1 → 1.3.4

package/dist/gate/checks/secrets.js

@@ -62,7 +62,7 @@ const SECRET_PATTERNS = [
     // Infrastructure tokens
     { name: "hashicorp_vault_token", regex: /\bhvs\.[A-Za-z0-9]{24,}\b/, description: "HashiCorp Vault service token" },
     { name: "npm_token", regex: /\bnpm_[A-Za-z0-9]{36}\b/, description: "npm access token" },
-    { name: "npmrc_auth_token", regex: /_authToken\s*=\s*[A-Za-z0-9_\-\.]{10,}/, description: "npm _authToken in .npmrc" },
+    { name: "npmrc_auth_token", regex: /_authToken\s*=\s*[A-Za-z0-9_\-.]{10,}/, description: "npm _authToken in .npmrc" },
     { name: "docker_hub_pat", regex: /\bdckr_pat_[A-Za-z0-9\-_]{27}\b/, description: "Docker Hub personal access token" },
     { name: "terraform_cloud_token", regex: /\b[A-Za-z0-9]{14}\.atlasv1\.[A-Za-z0-9]{60,}\b/, description: "Terraform Cloud token" },
     { name: "datadog_api_key", regex: /\bDD_API_KEY\s*[:=]\s*["'][a-fA-F0-9]{32}["']/, description: "Datadog API key" },
@@ -181,46 +181,58 @@ export async function checkSecrets(_) {
         // ------------------------------------------------------------------
         // Fix 2: Encoding evasion — base64 and hex secondary pass
         // ------------------------------------------------------------------
-        // Base64 candidates: length >= 20, valid base64 chars
-        const b64Regex = /[A-Za-z0-9+/]{20,}={0,2}/g;
-        let b64Match;
-        while ((b64Match = b64Regex.exec(text)) !== null) {
-            const candidate = b64Match[0];
-            try {
-                const decoded = Buffer.from(candidate, "base64").toString("utf8");
-                // Only proceed if decoded output looks like printable ASCII (avoid false positives on binary)
-                if (!/^[\x20-\x7E\t\r\n]{8,}$/.test(decoded))
-                    continue;
-                const hit = matchSecretPatterns(decoded);
-                if (hit) {
-                    const preview = previewLine(text, b64Match.index);
-                    encodingHits.push(`${file}: base64-encoded ${hit.name} detected — encoded="${candidate.slice(0, 40)}…" decoded_match="[REDACTED]" context="${preview.slice(0, 80)}"`);
+        // SECURITY (CWE-400): a single multi-MB contiguous base64/hex run makes V8's
+        // regex engine throw RangeError ("Maximum call stack size exceeded"). The
+        // readFileSafe size cap bounds file size, but contain any residual throw here
+        // so one crafted repo file cannot crash the gate (docs tier) or silently drop
+        // all secret findings (full tier swallows the rejection via Promise.allSettled).
+        try {
+            // Base64 candidates: length >= 20, valid base64 chars
+            const b64Regex = /[A-Za-z0-9+/]{20,}={0,2}/g;
+            let b64Match;
+            while ((b64Match = b64Regex.exec(text)) !== null) {
+                const candidate = b64Match[0];
+                try {
+                    const decoded = Buffer.from(candidate, "base64").toString("utf8");
+                    // Only proceed if decoded output looks like printable ASCII (avoid false positives on binary)
+                    if (!/^[\x20-\x7E\t\r\n]{8,}$/.test(decoded))
+                        continue;
+                    const hit = matchSecretPatterns(decoded);
+                    if (hit) {
+                        const preview = previewLine(text, b64Match.index);
+                        encodingHits.push(`${file}: base64-encoded ${hit.name} detected — encoded="${candidate.slice(0, 40)}…" decoded_match="[REDACTED]" context="${preview.slice(0, 80)}"`);
+                    }
+                }
+                catch {
+                    // decode failed — skip
                 }
             }
-            catch {
-                // decode failed — skip
-            }
-        }
-        // Hex candidates: length >= 32, even number of hex chars
-        const hexRegex = /\b[0-9a-fA-F]{32,}\b/g;
-        let hexMatch;
-        while ((hexMatch = hexRegex.exec(text)) !== null) {
-            const candidate = hexMatch[0];
-            if (candidate.length % 2 !== 0)
-                continue;
-            try {
-                const decoded = Buffer.from(candidate, "hex").toString("utf8");
-                if (!/^[\x20-\x7E\t\r\n]{8,}$/.test(decoded))
+            // Hex candidates: length >= 32, even number of hex chars
+            const hexRegex = /\b[0-9a-fA-F]{32,}\b/g;
+            let hexMatch;
+            while ((hexMatch = hexRegex.exec(text)) !== null) {
+                const candidate = hexMatch[0];
+                if (candidate.length % 2 !== 0)
                     continue;
-                const hit = matchSecretPatterns(decoded);
-                if (hit) {
-                    const preview = previewLine(text, hexMatch.index);
-                    encodingHits.push(`${file}: hex-encoded ${hit.name} detected — encoded="${candidate.slice(0, 40)}…" decoded_match="[REDACTED]" context="${preview.slice(0, 80)}"`);
+                try {
+                    const decoded = Buffer.from(candidate, "hex").toString("utf8");
+                    if (!/^[\x20-\x7E\t\r\n]{8,}$/.test(decoded))
+                        continue;
+                    const hit = matchSecretPatterns(decoded);
+                    if (hit) {
+                        const preview = previewLine(text, hexMatch.index);
+                        encodingHits.push(`${file}: hex-encoded ${hit.name} detected — encoded="${candidate.slice(0, 40)}…" decoded_match="[REDACTED]" context="${preview.slice(0, 80)}"`);
+                    }
+                }
+                catch {
+                    // decode failed — skip
                 }
             }
-            catch {
-                // decode failed — skip
-            }
+        }
+        catch {
+            // CWE-400: regex engine RangeError or similar on a pathological file —
+            // skip this file's encoding pass rather than aborting the whole scan.
+            continue;
         }
     }
     // ------------------------------------------------------------------
@@ -354,7 +366,7 @@ export async function checkSecrets(_) {
             try {
                 await unlink(tmpReport);
             }
-            catch { }
+            catch { /* ignore cleanup failure */ }
         }
     }
     return findings;

package/dist/gate/cloud-controls/apply.js

@@ -0,0 +1,115 @@
+import { writeFile } from "node:fs/promises";
+import fg from "fast-glob";
+import { readFileSafe } from "../../repo/fs.js";
+import { applyEnsures } from "./hcl.js";
+import { detectTerraform } from "./detect.js";
+import { loadCloudRules } from "./types.js";
+const TF_GLOBS = ["**/*.tf"];
+const IGNORE = ["**/node_modules/**", "**/.git/**", "**/dist/**", "**/.claude/**", "src/gate/**"];
+const MAX_ITERATIONS = 500;
+function violationKey(v) {
+    return `${v.rule.ruleId}@@${v.file}@@${v.block?.name ?? "?"}`;
+}
+function isAutoApplicable(rule) {
+    const s = rule.remediate.strategy;
+    if (s === "manual")
+        return false;
+    if (s === "companion-resource")
+        return Boolean(rule.remediate.companion);
+    return Boolean(rule.remediate.ensure); // set-attr | insert-block
+}
+/** Apply a single violation's remediation to the document, returning new text (or unchanged). */
+function applyOne(text, v) {
+    const { remediate } = v.rule;
+    if (remediate.strategy === "companion-resource" && remediate.companion && v.block) {
+        const snippet = remediate.companion.replaceAll("${name}", v.block.name);
+        const sep = text.endsWith("\n") ? "\n" : "\n\n";
+        return text + sep + snippet.trimEnd() + "\n";
+    }
+    if (remediate.ensure && v.block) {
+        return applyEnsures(text, v.block, remediate.ensure);
+    }
+    return text;
+}
+/** Harden one Terraform document. Returns new text + per-violation outcomes. */
+function hardenText(file, original, rules) {
+    let text = original;
+    const applied = [];
+    const manualMap = new Map();
+    const skip = new Set();
+    for (let iter = 0; iter < MAX_ITERATIONS; iter++) {
+        const violations = detectTerraform(file, text, rules);
+        // Record manual / non-applicable violations once.
+        for (const v of violations) {
+            if (!isAutoApplicable(v.rule))
+                manualMap.set(violationKey(v), v);
+        }
+        const target = violations.find((v) => isAutoApplicable(v.rule) && !skip.has(violationKey(v)));
+        if (!target)
+            break;
+        const key = violationKey(target);
+        const candidate = applyOne(text, target);
+        if (candidate === text) {
+            skip.add(key);
+            manualMap.set(key, target);
+            continue;
+        }
+        // Verify the fix actually cleared this violation; otherwise revert + flag manual.
+        const after = detectTerraform(file, candidate, rules);
+        if (after.some((v) => violationKey(v) === key)) {
+            skip.add(key);
+            manualMap.set(key, target);
+            continue;
+        }
+        text = candidate;
+        applied.push(target);
+    }
+    return { text, applied, manual: Array.from(manualMap.values()) };
+}
+/**
+ * Auto-harden every Terraform file in the working tree against the FSBP/CIS
+ * ruleset. Writes changes in place when `write` is true (default). Each applied
+ * edit is verified by re-running its own detector before being kept; edits that
+ * cannot be applied safely are reported as manual.
+ */
+export async function autoHardenTree(opts) {
+    const write = opts?.write !== false;
+    const rules = await loadCloudRules();
+    const report = { applied: [], manual: [], filesChanged: [] };
+    if (rules.length === 0)
+        return report;
+    const files = await fg(TF_GLOBS, { dot: true, followSymbolicLinks: false, ignore: IGNORE });
+    for (const file of files) {
+        let original = "";
+        try {
+            original = await readFileSafe(file);
+        }
+        catch {
+            continue;
+        }
+        const { text, applied, manual } = hardenText(file, original, rules);
+        for (const v of applied) {
+            report.applied.push({
+                ruleId: v.rule.ruleId,
+                file,
+                resource: `${v.rule.detect.resourceType}.${v.block?.name ?? "?"}`,
+                frameworks: v.rule.frameworks
+            });
+        }
+        for (const v of manual) {
+            report.manual.push({
+                ruleId: v.rule.ruleId,
+                file,
+                resource: `${v.rule.detect.resourceType}.${v.block?.name ?? "?"}`,
+                reason: v.reason,
+                snippet: v.rule.remediate.snippet
+            });
+        }
+        if (text !== original) {
+            report.filesChanged.push(file);
+            if (write)
+                await writeFile(file, text, "utf-8");
+        }
+    }
+    return report;
+}

package/dist/gate/cloud-controls/bicep.js

@@ -0,0 +1,36 @@
+// Bicep resource extraction. Block-structured like HCL, so we reuse the
+// brace-balanced matcher to capture each `resource <name> '<type>@<ver>' = { ... }`
+// body. Detect-only — no auto-fix is attempted for Bicep.
+import { matchBrace } from "./hcl.js";
+// resource <symbolicName> '<type>@<apiVersion>' = [if (...)] { ... }
+const RESOURCE_HEADER = /resource\s+([A-Za-z_][A-Za-z0-9_]*)\s+'([^']+)'\s*=\s*(?:if\s*\([^)]*\)\s*)?\{/g;
+function lineOf(text, index) {
+    let line = 1;
+    for (let i = 0; i < index && i < text.length; i++) {
+        if (text[i] === "\n")
+            line++;
+    }
+    return line;
+}
+/** Parse all Bicep `resource` declarations, stripping the `@apiVersion` suffix from the type. */
+export function parseBicepResources(text) {
+    const out = [];
+    RESOURCE_HEADER.lastIndex = 0;
+    let m;
+    while ((m = RESOURCE_HEADER.exec(text)) !== null) {
+        const open = text.indexOf("{", m.index);
+        if (open < 0)
+            continue;
+        const close = matchBrace(text, open);
+        if (close < 0)
+            continue;
+        out.push({
+            type: m[2].split("@")[0],
+            name: m[1],
+            body: text.slice(open + 1, close),
+            line: lineOf(text, m.index)
+        });
+        RESOURCE_HEADER.lastIndex = close + 1;
+    }
+    return out;
+}

package/dist/gate/cloud-controls/cfn.js

@@ -0,0 +1,125 @@
+// CloudFormation / SAM template resource extraction (JSON and YAML).
+//
+// Detect-only: we locate each `Resources` entry and capture its text so a rule's
+// forbid/require regex can be scoped to one resource. Heuristic — YAML is parsed
+// by indentation, not a full YAML engine, so unusual layouts may be missed. No
+// auto-fix is attempted for CloudFormation (JSON re-serialize drops comments;
+// YAML anchors are unsafe to rewrite), so detection accuracy is sufficient.
+const CFN_TYPE = /Type\s*:\s*['"]?(AWS::[A-Za-z0-9]+::[A-Za-z0-9]+)/;
+/** Cheap pre-filter so we don't JSON.parse / scan every json/yaml in the repo. */
+export function looksLikeCfn(text) {
+    return (text.includes("AWSTemplateFormatVersion") ||
+        text.includes("AWS::Serverless") ||
+        /["']?Type["']?\s*:\s*["']?AWS::/.test(text));
+}
+function lineOf(text, index) {
+    let line = 1;
+    for (let i = 0; i < index && i < text.length; i++) {
+        if (text[i] === "\n")
+            line++;
+    }
+    return line;
+}
+function escapeRegex(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function asRecord(v) {
+    return v && typeof v === "object" && !Array.isArray(v) ? v : null;
+}
+function parseJsonCfn(text) {
+    let doc;
+    try {
+        doc = JSON.parse(text);
+    }
+    catch {
+        return [];
+    }
+    const root = asRecord(doc);
+    const resources = root && asRecord(root["Resources"]);
+    if (!resources)
+        return [];
+    const out = [];
+    for (const [name, resVal] of Object.entries(resources)) {
+        const res = asRecord(resVal);
+        const type = res?.["Type"];
+        if (typeof type !== "string" || !type.startsWith("AWS::"))
+            continue;
+        const re = new RegExp(`"${escapeRegex(name)}"\\s*:`);
+        const m = re.exec(text);
+        out.push({ type, name, body: JSON.stringify(res), line: m ? lineOf(text, m.index) : 1 });
+    }
+    return out;
+}
+function indentOf(line) {
+    return line.length - line.trimStart().length;
+}
+function findResourcesIndent(lines) {
+    for (let i = 0; i < lines.length; i++) {
+        const m = /^(\s*)Resources\s*:\s*$/.exec(lines[i]);
+        if (m)
+            return { start: i, indent: m[1].length };
+    }
+    return null;
+}
+function parseYamlCfn(text) {
+    const lines = text.split("\n");
+    const res = findResourcesIndent(lines);
+    if (!res)
+        return [];
+    // First logical-id sits at the indent level directly under "Resources:".
+    let childIndent = -1;
+    for (let i = res.start + 1; i < lines.length; i++) {
+        if (!lines[i].trim() || /^\s*#/.test(lines[i]))
+            continue;
+        const ind = indentOf(lines[i]);
+        if (ind <= res.indent)
+            return [];
+        childIndent = ind;
+        break;
+    }
+    if (childIndent < 0)
+        return [];
+    const out = [];
+    let name = "";
+    let start = -1;
+    let body = [];
+    const flush = () => {
+        if (!name)
+            return;
+        const text2 = body.join("\n");
+        const tm = CFN_TYPE.exec(text2);
+        if (tm)
+            out.push({ type: tm[1], name, body: text2, line: start + 1 });
+        name = "";
+        body = [];
+    };
+    for (let i = res.start + 1; i < lines.length; i++) {
+        const l = lines[i];
+        if (!l.trim()) {
+            if (name)
+                body.push(l);
+            continue;
+        }
+        const ind = indentOf(l);
+        if (ind <= res.indent) {
+            flush();
+            break;
+        }
+        if (ind === childIndent) {
+            const hm = /^\s*([A-Za-z0-9_]+)\s*:/.exec(l);
+            flush();
+            name = hm ? hm[1] : "";
+            start = i;
+            body = [l];
+        }
+        else if (name) {
+            body.push(l);
+        }
+    }
+    flush();
+    return out;
+}
+/** Parse all CloudFormation resources from a JSON or YAML template. */
+export function parseCfnResources(text) {
+    return text.trimStart().startsWith("{") ? parseJsonCfn(text) : parseYamlCfn(text);
+}

package/dist/gate/cloud-controls/detect.js

@@ -0,0 +1,104 @@
+import { parseResourceBlocks } from "./hcl.js";
+import { looksLikeCfn, parseCfnResources } from "./cfn.js";
+import { parseBicepResources } from "./bicep.js";
+function lineOf(text, index) {
+    let line = 1;
+    for (let i = 0; i < index && i < text.length; i++) {
+        if (text[i] === "\n")
+            line++;
+    }
+    return line;
+}
+function blockBody(text, block) {
+    return text.slice(block.bodyStart, block.bodyEnd);
+}
+function compile(pattern) {
+    return new RegExp(pattern, "i");
+}
+/**
+ * Does the file contain a resource of `companionType` that references
+ * `origType.name` (the offending resource)? Used for cross-resource rules such
+ * as an S3 bucket needing a matching aws_s3_bucket_public_access_block.
+ */
+function companionExists(blocks, fullText, companionType, origType, name) {
+    const ref = `${origType}.${name}`;
+    return blocks.some((b) => b.type === companionType && blockBody(fullText, b).includes(ref));
+}
+/** Evaluate every terraform-target rule against one parsed HCL document. */
+export function detectTerraform(file, text, rules) {
+    const blocks = parseResourceBlocks(text);
+    if (blocks.length === 0)
+        return [];
+    const violations = [];
+    for (const rule of rules) {
+        if (rule.detect.target !== "terraform")
+            continue;
+        const { resourceType, forbid, require, requireCompanionType } = rule.detect;
+        const forbidRe = forbid ? compile(forbid) : null;
+        const requireRe = require ? compile(require) : null;
+        for (const block of blocks) {
+            if (block.type !== resourceType)
+                continue;
+            const body = blockBody(text, block);
+            const line = lineOf(text, block.start);
+            if (forbidRe && forbidRe.test(body)) {
+                violations.push({ rule, file, line, block, reason: "insecure value present" });
+                continue;
+            }
+            if (requireRe && !requireRe.test(body)) {
+                violations.push({ rule, file, line, block, reason: "secure setting missing" });
+                continue;
+            }
+            if (requireCompanionType &&
+                !companionExists(blocks, text, requireCompanionType, resourceType, block.name)) {
+                violations.push({
+                    rule,
+                    file,
+                    line,
+                    block,
+                    reason: `missing companion ${requireCompanionType}`
+                });
+            }
+        }
+    }
+    return violations;
+}
+/**
+ * Evaluate forbid/require rules for one target against a list of already-parsed
+ * resources (CloudFormation or Bicep). Body-scoped regex, detect-only.
+ */
+function detectResources(file, rules, target, resources) {
+    if (resources.length === 0)
+        return [];
+    const violations = [];
+    for (const rule of rules) {
+        if (rule.detect.target !== target)
+            continue;
+        const { resourceType, forbid, require } = rule.detect;
+        const forbidRe = forbid ? compile(forbid) : null;
+        const requireRe = require ? compile(require) : null;
+        for (const res of resources) {
+            if (res.type !== resourceType)
+                continue;
+            if (forbidRe && forbidRe.test(res.body)) {
+                violations.push({ rule, file, line: res.line, reason: "insecure value present" });
+            }
+            else if (requireRe && !requireRe.test(res.body)) {
+                violations.push({ rule, file, line: res.line, reason: "secure setting missing" });
+            }
+        }
+    }
+    return violations;
+}
+/** Evaluate cloudformation-target rules against a JSON or YAML template. */
+export function detectCloudFormation(file, text, rules) {
+    if (!looksLikeCfn(text))
+        return [];
+    const resources = parseCfnResources(text);
+    return detectResources(file, rules, "cloudformation", resources);
+}
+/** Evaluate bicep-target rules against a Bicep document. */
+export function detectBicep(file, text, rules) {
+    const resources = parseBicepResources(text);
+    return detectResources(file, rules, "bicep", resources);
+}

package/dist/gate/cloud-controls/hcl.js

@@ -0,0 +1,140 @@
+// Lightweight, dependency-free HCL (Terraform) block utilities.
+//
+// These are intentionally heuristic — brace-balanced scanning, not a full HCL
+// parser. They are robust enough to locate `resource "type" "name" { ... }`
+// blocks and apply scoped attribute edits inside a single block, which is all
+// the detect-and-remediate engine needs. Edge cases (heredocs, unusual
+// formatting) may be missed; such rules degrade to "manual" remediation.
+const RESOURCE_HEADER = /resource\s+"([^"]+)"\s+"([^"]+)"\s*\{/g;
+/**
+ * Find the index of the "}" matching the "{" at openIdx. Skips braces that
+ * appear inside double-quoted strings and line comments (# and //).
+ * Returns -1 if unbalanced.
+ */
+export function matchBrace(text, openIdx) {
+    let depth = 0;
+    let inString = false;
+    let inLineComment = false;
+    for (let i = openIdx; i < text.length; i++) {
+        const ch = text[i];
+        if (inLineComment) {
+            if (ch === "\n")
+                inLineComment = false;
+            continue;
+        }
+        if (inString) {
+            if (ch === "\\") {
+                i++; // skip escaped char
+            }
+            else if (ch === '"') {
+                inString = false;
+            }
+            continue;
+        }
+        if (ch === '"') {
+            inString = true;
+        }
+        else if (ch === "#") {
+            inLineComment = true;
+        }
+        else if (ch === "/" && text[i + 1] === "/") {
+            inLineComment = true;
+            i++;
+        }
+        else if (ch === "{") {
+            depth++;
+        }
+        else if (ch === "}") {
+            depth--;
+            if (depth === 0)
+                return i;
+        }
+    }
+    return -1;
+}
+/** Parse all top-level `resource "type" "name"` blocks in a Terraform document. */
+export function parseResourceBlocks(text) {
+    const blocks = [];
+    RESOURCE_HEADER.lastIndex = 0;
+    let m;
+    while ((m = RESOURCE_HEADER.exec(text)) !== null) {
+        const openBrace = text.indexOf("{", m.index);
+        if (openBrace < 0)
+            continue;
+        const close = matchBrace(text, openBrace);
+        if (close < 0)
+            continue;
+        blocks.push({
+            type: m[1],
+            name: m[2],
+            start: m.index,
+            end: close + 1,
+            bodyStart: openBrace + 1,
+            bodyEnd: close
+        });
+        RESOURCE_HEADER.lastIndex = close + 1;
+    }
+    return blocks;
+}
+/**
+ * Ensure `attr = value` exists inside an HCL body string for a single-segment
+ * attribute. Replaces an existing assignment (even if the value differs) or
+ * inserts a new one at the top of the body. Returns the new body string.
+ */
+function ensureLeafAttr(body, attr, value, indent) {
+    const escaped = attr.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const assignRe = new RegExp(`^([ \\t]*)${escaped}(\\s*)=.*$`, "m");
+    if (assignRe.test(body)) {
+        return body.replace(assignRe, `$1${attr} = ${value}`);
+    }
+    const leading = body.startsWith("\n") ? "\n" : "";
+    const rest = body.startsWith("\n") ? body.slice(1) : body;
+    return `${leading}${indent}${attr} = ${value}\n${rest}`;
+}
+/** Build a fresh nested block chain `a { b { leaf = value } }` for a missing path. */
+function buildNestedChain(segs, value, indent) {
+    const [head, ...rest] = segs;
+    if (rest.length === 0) {
+        return `${indent}${head} = ${value}\n`;
+    }
+    const inner = buildNestedChain(rest, value, indent + "  ");
+    return `${indent}${head} {\n${inner}${indent}}\n`;
+}
+/**
+ * Ensure a nested-path attribute `a.b.c = value` inside an HCL body, creating
+ * any missing intermediate `block { ... }` levels. Handles arbitrary depth.
+ */
+function ensurePath(body, segs, value, indent) {
+    if (segs.length === 1) {
+        return ensureLeafAttr(body, segs[0], value, indent);
+    }
+    const [parent, ...rest] = segs;
+    const escaped = parent.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const headerRe = new RegExp(`(^|\\n)([ \\t]*)${escaped}\\s*\\{`);
+    const match = headerRe.exec(body);
+    if (match) {
+        const openBrace = body.indexOf("{", match.index + match[1].length);
+        const close = matchBrace(body, openBrace);
+        if (openBrace >= 0 && close >= 0) {
+            const innerBody = body.slice(openBrace + 1, close);
+            const newInner = ensurePath(innerBody, rest, value, indent + "  ");
+            return body.slice(0, openBrace + 1) + newInner + body.slice(close);
+        }
+    }
+    const block = buildNestedChain(segs, value, indent);
+    const leading = body.startsWith("\n") ? "\n" : "";
+    const restBody = body.startsWith("\n") ? body.slice(1) : body;
+    return `${leading}${block}${restBody}`;
+}
+/**
+ * Apply a set of dotted-path attribute assignments to one resource block in
+ * fullText, returning the rewritten document. Supports depth 1 (attr) and 2
+ * (parent.child). Unknown depths are skipped.
+ */
+export function applyEnsures(fullText, block, ensure) {
+    let body = fullText.slice(block.bodyStart, block.bodyEnd);
+    for (const [path, value] of Object.entries(ensure)) {
+        body = ensurePath(body, path.split("."), value, "  ");
+    }
+    return fullText.slice(0, block.bodyStart) + body + fullText.slice(block.bodyEnd);
+}