@dailephd/my-dev-kit-lab 0.3.3 → 0.4.0

package/dist/src/mobile/android/audit/exportedComponentAudit.js

@@ -0,0 +1,183 @@
+import { makeAndroidFinding } from "./androidFinding.js";
+import { buildAndroidManifestCheckResult } from "./checkResultBuilder.js";
+function componentGroups(manifest) {
+    return [
+        { kind: "activity", components: manifest.activities },
+        { kind: "activity-alias", components: manifest.activityAliases ?? [] },
+        { kind: "service", components: manifest.services },
+        { kind: "receiver", components: manifest.receivers },
+        { kind: "provider", components: manifest.providers },
+    ];
+}
+function isProtectedNonProvider(component, applicationPermission) {
+    return Boolean(component.permission) || Boolean(applicationPermission);
+}
+function providerProtection(component) {
+    if (component.permission)
+        return "protected";
+    if (component.readPermission && component.writePermission)
+        return "protected";
+    if (component.readPermission || component.writePermission)
+        return "partial";
+    return "unprotected";
+}
+export function auditAndroidExportedComponents(detection, manifests) {
+    const findings = [];
+    const evidence = [];
+    const warnings = [];
+    for (const entry of manifests) {
+        const applicationPermission = entry.manifest.application.permission;
+        let inspectedCount = 0;
+        for (const group of componentGroups(entry.manifest)) {
+            for (const component of group.components) {
+                inspectedCount += 1;
+                const hasFilters = component.intentFilters.length > 0;
+                const identity = component.name || "(unnamed component)";
+                // Malformed exported value: never normalized to true or false.
+                if (component.exported === undefined && component.exportedRaw !== undefined) {
+                    findings.push(makeAndroidFinding({
+                        ruleId: "android-component-malformed-exported",
+                        title: `${group.kind} "${identity}" has a malformed android:exported value`,
+                        severity: "minor",
+                        confidence: "low",
+                        description: `android:exported="${component.exportedRaw}" could not be statically resolved to true or false. Effective exported state is unknown and must be reviewed manually.`,
+                        manifestPath: entry.manifestPath,
+                        identity,
+                        location: component.location,
+                        evidenceDetails: [`kind=${group.kind}`, `exportedRaw=${component.exportedRaw}`],
+                        recommendation: "Resolve the android:exported value to an explicit true/false literal.",
+                    }));
+                    continue;
+                }
+                if (component.exported === false) {
+                    continue;
+                }
+                if (component.exported === undefined) {
+                    if (hasFilters) {
+                        findings.push(makeAndroidFinding({
+                            ruleId: "android-component-unspecified-exported-with-filter",
+                            title: `${group.kind} "${identity}" has an intent filter but no explicit android:exported value`,
+                            severity: "minor",
+                            confidence: "medium",
+                            description: "This component declares an intent filter but does not set android:exported explicitly. Effective exported state depends on the target/compile SDK and manifest context, and must be reviewed rather than assumed.",
+                            manifestPath: entry.manifestPath,
+                            identity,
+                            location: component.location,
+                            evidenceDetails: [`kind=${group.kind}`, `intentFilterCount=${component.intentFilters.length}`],
+                            recommendation: "Set android:exported explicitly to document the intended behavior.",
+                        }));
+                    }
+                    continue;
+                }
+                // component.exported === true from here on.
+                if (group.kind === "provider") {
+                    const protection = providerProtection(component);
+                    if (protection === "unprotected") {
+                        findings.push(makeAndroidFinding({
+                            ruleId: "android-provider-exported-unprotected",
+                            title: `Exported provider "${identity}" has no permission protection`,
+                            severity: "major",
+                            confidence: "high",
+                            description: "This <provider> is explicitly exported and declares no permission, readPermission, or writePermission. Any app on the device may query or modify its data unless finer-grained protection exists elsewhere (e.g. path-level permissions not visible here).",
+                            manifestPath: entry.manifestPath,
+                            identity,
+                            location: component.location,
+                            evidenceDetails: [
+                                `authorities=${(component.authorities ?? []).join(",") || "(none parsed)"}`,
+                                `grantUriPermissions=${component.grantUriPermissions ?? "unspecified"}`,
+                            ],
+                            recommendation: "Add android:permission, or both readPermission and writePermission, or set android:exported=\"false\" if external access is not required.",
+                        }));
+                    }
+                    else if (protection === "partial") {
+                        findings.push(makeAndroidFinding({
+                            ruleId: "android-provider-exported-partial-protection",
+                            title: `Exported provider "${identity}" only protects one of read/write access`,
+                            severity: "minor",
+                            confidence: "medium",
+                            description: "This <provider> defines only one of readPermission/writePermission, leaving the other operation unprotected.",
+                            manifestPath: entry.manifestPath,
+                            identity,
+                            location: component.location,
+                            evidenceDetails: [`readPermission=${component.readPermission ?? "(none)"}`, `writePermission=${component.writePermission ?? "(none)"}`],
+                            recommendation: "Protect both read and write access, or document why only one is intentionally protected.",
+                        }));
+                    }
+                    else {
+                        findings.push(makeAndroidFinding({
+                            ruleId: "android-provider-exported-protected",
+                            title: `Exported provider "${identity}" is permission-protected`,
+                            severity: "informational",
+                            confidence: "high",
+                            description: "This <provider> is explicitly exported but protection evidence (permission or read+write permissions) is present.",
+                            manifestPath: entry.manifestPath,
+                            identity,
+                            location: component.location,
+                            evidenceDetails: [`permission=${component.permission ?? "(none)"}`],
+                        }));
+                    }
+                    continue;
+                }
+                const protected_ = isProtectedNonProvider(component, applicationPermission);
+                if (protected_) {
+                    findings.push(makeAndroidFinding({
+                        ruleId: "android-component-exported-protected",
+                        title: `Exported ${group.kind} "${identity}" is permission-protected`,
+                        severity: "informational",
+                        confidence: "high",
+                        description: `This ${group.kind} is explicitly exported and protected by ${component.permission ? `component-level permission "${component.permission}"` : `an application-level permission ("${applicationPermission}")`}.`,
+                        manifestPath: entry.manifestPath,
+                        identity,
+                        location: component.location,
+                        evidenceDetails: [`kind=${group.kind}`, `hasIntentFilters=${hasFilters}`, `permission=${component.permission ?? applicationPermission}`],
+                    }));
+                }
+                else if (component.isLauncherActivity) {
+                    // A standard launcher activity being exported and unprotected is
+                    // expected, required Android behavior (it must be exported to be
+                    // launchable from the home screen) — informational only, not a
+                    // review-required finding (agents.txt Batch 3 section 7.19,
+                    // "Standard launcher activity evidence" = informational/low tier).
+                    findings.push(makeAndroidFinding({
+                        ruleId: "android-component-launcher-activity-exported",
+                        title: `Launcher activity "${identity}" is exported (expected)`,
+                        severity: "informational",
+                        confidence: "high",
+                        description: "This is the app's launcher activity (MAIN/LAUNCHER intent filter). Being exported without permission protection is expected, standard behavior for a launcher entry point.",
+                        manifestPath: entry.manifestPath,
+                        identity,
+                        location: component.location,
+                        evidenceDetails: [`kind=${group.kind}`],
+                    }));
+                }
+                else {
+                    findings.push(makeAndroidFinding({
+                        ruleId: "android-component-exported-unprotected",
+                        title: `Exported ${group.kind} "${identity}" has no deterministic permission protection`,
+                        severity: "minor",
+                        confidence: hasFilters ? "high" : "medium",
+                        description: `This ${group.kind} is explicitly exported and no component-level or application-level permission was found in this manifest. Effective protection could still exist via a permission defined in another source set or module, which lowers confidence here.`,
+                        manifestPath: entry.manifestPath,
+                        identity,
+                        location: component.location,
+                        evidenceDetails: [`kind=${group.kind}`, `hasIntentFilters=${hasFilters}`],
+                        recommendation: "Add android:permission if this component should not be freely reachable by other apps, or confirm android:exported=\"true\" is intentional.",
+                    }));
+                }
+            }
+        }
+        if (inspectedCount > 0) {
+            evidence.push(`${entry.manifestPath}: ${inspectedCount} component(s) inspected`);
+        }
+    }
+    return buildAndroidManifestCheckResult({
+        id: "android-exported-components-audit",
+        category: "android-components",
+        title: "Android exported-component audit",
+        detection,
+        manifests,
+        findings,
+        evidence,
+        warnings,
+    });
+}

package/dist/src/mobile/android/audit/intentFilterAudit.js

@@ -0,0 +1,128 @@
+import { makeAndroidFinding } from "./androidFinding.js";
+import { buildAndroidManifestCheckResult } from "./checkResultBuilder.js";
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 3 — initial intent-filter audit.
+//
+// Distinct lens from the exported-component audit (agents.txt Batch 3
+// section 7.15): this audit does not repeat "is this exported and
+// unprotected" — it looks at the intent-filter *contents* themselves:
+// duplicate/malformed filter data, and custom (non-platform) actions on a
+// component that is reachable (explicitly exported, or unspecified-exported
+// with a filter). A standard MAIN/LAUNCHER filter is never flagged — that is
+// the required negative control (ANDROID-B3-22).
+// ---------------------------------------------------------------------------
+const STANDARD_ACTION_PREFIX = "android.intent.action.";
+const STANDARD_CATEGORY_PREFIX = "android.intent.category.";
+function isReachable(component) {
+    return component.exported === true || (component.exported === undefined && component.exportedRaw === undefined && component.intentFilters.length > 0);
+}
+function hasDuplicates(values) {
+    return new Set(values).size !== values.length;
+}
+function auditFilter(entry, kind, component, filter, findings) {
+    const identity = component.name || "(unnamed component)";
+    const actions = filter.actions ?? [];
+    const categories = filter.categories ?? [];
+    const dataElements = filter.dataElements ?? filter.filterData;
+    if (actions.length === 0 && dataElements.length === 0) {
+        findings.push(makeAndroidFinding({
+            ruleId: "android-intent-filter-empty-or-malformed",
+            title: `Empty or malformed <intent-filter> on ${kind} "${identity}"`,
+            severity: "informational",
+            confidence: "medium",
+            description: "This <intent-filter> declares no actions and no data elements, so it cannot match any implicit intent.",
+            manifestPath: entry.manifestPath,
+            identity,
+            location: filter.location,
+            evidenceDetails: [`kind=${kind}`],
+        }));
+        return;
+    }
+    if (hasDuplicates(actions) || hasDuplicates(categories)) {
+        findings.push(makeAndroidFinding({
+            ruleId: "android-intent-filter-duplicate-entries",
+            title: `Duplicate action/category entries in an <intent-filter> on ${kind} "${identity}"`,
+            severity: "informational",
+            confidence: "high",
+            description: "This <intent-filter> declares the same <action> or <category> more than once, which has no additional effect and may indicate a copy/paste mistake.",
+            manifestPath: entry.manifestPath,
+            identity,
+            location: filter.location,
+            evidenceDetails: [`actions=${actions.join(",")}`, `categories=${categories.join(",")}`],
+        }));
+    }
+    const isStandardLauncherFilter = actions.length === 1 &&
+        actions[0] === "android.intent.action.MAIN" &&
+        categories.every((c) => c === "android.intent.category.LAUNCHER" || c === "android.intent.category.DEFAULT");
+    if (isStandardLauncherFilter) {
+        // Negative control: a standard launcher entry point is expected and
+        // must not itself be reported as a finding (ANDROID-B3-22).
+        return;
+    }
+    const customActions = actions.filter((action) => !action.startsWith(STANDARD_ACTION_PREFIX));
+    if (customActions.length > 0 && isReachable(component)) {
+        findings.push(makeAndroidFinding({
+            ruleId: "android-intent-filter-custom-action-reachable",
+            title: `Custom action on a potentially reachable ${kind} "${identity}"`,
+            severity: "minor",
+            confidence: component.exported === true ? "high" : "medium",
+            description: `This <intent-filter> declares a custom (non-platform) action (${customActions.join(", ")}) on a component whose exported state is ${component.exported === true ? "explicitly true" : "unspecified with an intent filter present"}. Custom actions on reachable components broaden the app's externally triggerable surface and are worth reviewing, though the action name alone does not prove exploitability.`,
+            manifestPath: entry.manifestPath,
+            identity,
+            location: filter.location,
+            evidenceDetails: [`customActions=${customActions.join(",")}`, `exported=${component.exported ?? "unspecified"}`, `hasComponentPermission=${Boolean(component.permission)}`],
+            recommendation: "Confirm this custom action needs to be externally reachable, and add permission protection if not.",
+        }));
+    }
+    const unrecognizedCategories = categories.filter((c) => !c.startsWith(STANDARD_CATEGORY_PREFIX));
+    if (unrecognizedCategories.length > 0) {
+        findings.push(makeAndroidFinding({
+            ruleId: "android-intent-filter-non-standard-category",
+            title: `Non-standard intent-filter category on ${kind} "${identity}"`,
+            severity: "informational",
+            confidence: "medium",
+            description: `This <intent-filter> declares a category outside the standard android.intent.category.* namespace (${unrecognizedCategories.join(", ")}).`,
+            manifestPath: entry.manifestPath,
+            identity,
+            location: filter.location,
+            evidenceDetails: [`categories=${unrecognizedCategories.join(",")}`],
+        }));
+    }
+}
+function componentGroups(manifest) {
+    return [
+        { kind: "activity", components: manifest.activities },
+        { kind: "activity-alias", components: manifest.activityAliases ?? [] },
+        { kind: "service", components: manifest.services },
+        { kind: "receiver", components: manifest.receivers },
+    ];
+}
+export function auditAndroidIntentFilters(detection, manifests) {
+    const findings = [];
+    const evidence = [];
+    const warnings = [];
+    for (const entry of manifests) {
+        let filterCount = 0;
+        for (const group of componentGroups(entry.manifest)) {
+            for (const component of group.components) {
+                for (const filter of component.intentFilters) {
+                    filterCount += 1;
+                    auditFilter(entry, group.kind, component, filter, findings);
+                }
+            }
+        }
+        if (filterCount > 0) {
+            evidence.push(`${entry.manifestPath}: ${filterCount} intent-filter(s) inspected`);
+        }
+    }
+    return buildAndroidManifestCheckResult({
+        id: "android-intent-filters-audit",
+        category: "android-intent-filters",
+        title: "Android intent-filter audit",
+        detection,
+        manifests,
+        findings,
+        evidence,
+        warnings,
+    });
+}

package/dist/src/mobile/android/audit/permissionAudit.js

@@ -0,0 +1,142 @@
+import { makeAndroidFinding } from "./androidFinding.js";
+import { buildAndroidManifestCheckResult } from "./checkResultBuilder.js";
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 3 — initial Android permission audit.
+//
+// Conservative by design (agents.txt Batch 3 section 7.13): a declared
+// permission is not automatically a vulnerability. Ordinary connectivity
+// permissions (INTERNET etc.) never produce a finding. Recognized sensitive
+// permission groups produce a "minor" (review-required) finding. Unknown/
+// custom permissions produce an "informational" review finding. The only
+// escalation is foreground + background location declared together, which
+// still stays at "minor" (a legitimate, common pattern — not proof of
+// misuse).
+// ---------------------------------------------------------------------------
+const LOW_RISK_PERMISSIONS = new Set([
+    "android.permission.INTERNET",
+    "android.permission.ACCESS_NETWORK_STATE",
+    "android.permission.ACCESS_WIFI_STATE",
+    "android.permission.VIBRATE",
+    "android.permission.WAKE_LOCK",
+    "android.permission.RECEIVE_BOOT_COMPLETED",
+]);
+const SENSITIVE_PERMISSION_GROUPS = {
+    "android.permission.ACCESS_FINE_LOCATION": "location",
+    "android.permission.ACCESS_COARSE_LOCATION": "location",
+    "android.permission.ACCESS_BACKGROUND_LOCATION": "background-location",
+    "android.permission.CAMERA": "camera",
+    "android.permission.RECORD_AUDIO": "microphone",
+    "android.permission.READ_CONTACTS": "contacts",
+    "android.permission.WRITE_CONTACTS": "contacts",
+    "android.permission.GET_ACCOUNTS": "contacts",
+    "android.permission.READ_CALENDAR": "calendar",
+    "android.permission.WRITE_CALENDAR": "calendar",
+    "android.permission.SEND_SMS": "sms",
+    "android.permission.READ_SMS": "sms",
+    "android.permission.RECEIVE_SMS": "sms",
+    "android.permission.RECEIVE_MMS": "sms",
+    "android.permission.READ_CALL_LOG": "call-log",
+    "android.permission.WRITE_CALL_LOG": "call-log",
+    "android.permission.PROCESS_OUTGOING_CALLS": "call-log",
+    "android.permission.READ_PHONE_STATE": "phone",
+    "android.permission.CALL_PHONE": "phone",
+    "android.permission.BLUETOOTH_CONNECT": "nearby-devices",
+    "android.permission.BLUETOOTH_SCAN": "nearby-devices",
+    "android.permission.BLUETOOTH_ADVERTISE": "nearby-devices",
+    "android.permission.NEARBY_WIFI_DEVICES": "nearby-devices",
+    "android.permission.READ_EXTERNAL_STORAGE": "storage-legacy",
+    "android.permission.WRITE_EXTERNAL_STORAGE": "storage-legacy",
+    "android.permission.MANAGE_EXTERNAL_STORAGE": "storage-legacy",
+    "android.permission.READ_MEDIA_IMAGES": "media",
+    "android.permission.READ_MEDIA_VIDEO": "media",
+    "android.permission.READ_MEDIA_AUDIO": "media",
+    "android.permission.POST_NOTIFICATIONS": "notifications",
+    "android.permission.BODY_SENSORS": "body-sensors",
+    "android.permission.BODY_SENSORS_BACKGROUND": "body-sensors",
+    "android.permission.ACTIVITY_RECOGNITION": "activity-recognition",
+    "android.permission.FOREGROUND_SERVICE": "foreground-service",
+    "android.permission.REQUEST_INSTALL_PACKAGES": "package-install",
+    "android.permission.QUERY_ALL_PACKAGES": "package-visibility",
+};
+export function auditAndroidPermissions(detection, manifests) {
+    const findings = [];
+    const evidence = [];
+    const warnings = [];
+    for (const entry of manifests) {
+        const declaredNames = new Set(entry.manifest.permissions.map((p) => p.name));
+        const seen = new Set();
+        for (const permission of entry.manifest.permissions) {
+            if (seen.has(permission.name))
+                continue;
+            seen.add(permission.name);
+            if (LOW_RISK_PERMISSIONS.has(permission.name)) {
+                continue;
+            }
+            const group = SENSITIVE_PERMISSION_GROUPS[permission.name];
+            const duplicateCount = entry.manifest.permissions.filter((p) => p.name === permission.name).length;
+            const duplicateNote = duplicateCount > 1 ? [`declared ${duplicateCount} times (deduplicated for this finding)`] : [];
+            if (group === "background-location") {
+                const hasForeground = declaredNames.has("android.permission.ACCESS_FINE_LOCATION") || declaredNames.has("android.permission.ACCESS_COARSE_LOCATION");
+                findings.push(makeAndroidFinding({
+                    ruleId: hasForeground ? "android-permission-background-and-foreground-location" : "android-permission-sensitive",
+                    title: hasForeground
+                        ? "Background location declared alongside foreground location"
+                        : `Sensitive permission declared: ${permission.name}`,
+                    severity: "minor",
+                    confidence: "high",
+                    description: hasForeground
+                        ? "The manifest declares ACCESS_BACKGROUND_LOCATION together with a foreground location permission. This is a common, legitimate pattern, but background location access typically requires explicit justification for store review."
+                        : `The manifest declares the sensitive permission ${permission.name} (group: ${group}). This is not automatically a vulnerability; review that the app's functionality justifies the request.`,
+                    manifestPath: entry.manifestPath,
+                    identity: permission.name,
+                    location: permission.location,
+                    evidenceDetails: [`sourceElement=${permission.sourceElement ?? "uses-permission"}`, `group=${group}`, ...duplicateNote],
+                    recommendation: "Confirm the permission is required for a real user-facing feature and document the justification.",
+                }));
+                continue;
+            }
+            if (group) {
+                findings.push(makeAndroidFinding({
+                    ruleId: "android-permission-sensitive",
+                    title: `Sensitive permission declared: ${permission.name}`,
+                    severity: "minor",
+                    confidence: "high",
+                    description: `The manifest declares the sensitive permission ${permission.name} (group: ${group}). This is not automatically a vulnerability; review that the app's functionality justifies the request.`,
+                    manifestPath: entry.manifestPath,
+                    identity: permission.name,
+                    location: permission.location,
+                    evidenceDetails: [`sourceElement=${permission.sourceElement ?? "uses-permission"}`, `group=${group}`, ...duplicateNote],
+                    recommendation: "Confirm the permission is required for a real user-facing feature and document the justification.",
+                }));
+                continue;
+            }
+            if (!permission.name.startsWith("android.permission.")) {
+                findings.push(makeAndroidFinding({
+                    ruleId: "android-permission-unknown-custom",
+                    title: `Unknown custom permission declared: ${permission.name}`,
+                    severity: "informational",
+                    confidence: "high",
+                    description: `The manifest declares a custom permission "${permission.name}" that is not a recognized platform permission. This is not automatically dangerous; review its purpose and, if it protects app components, whether its protectionLevel is appropriate.`,
+                    manifestPath: entry.manifestPath,
+                    identity: permission.name,
+                    location: permission.location,
+                    evidenceDetails: [`sourceElement=${permission.sourceElement ?? "uses-permission"}`, ...duplicateNote],
+                    recommendation: "Review the custom permission's purpose and protection level.",
+                }));
+            }
+        }
+        if (entry.manifest.permissions.length > 0) {
+            evidence.push(`${entry.manifestPath}: ${entry.manifest.permissions.length} permission declaration(s) inspected`);
+        }
+    }
+    return buildAndroidManifestCheckResult({
+        id: "android-permissions-audit",
+        category: "android-permissions",
+        title: "Android permission audit",
+        detection,
+        manifests,
+        findings,
+        evidence,
+        warnings,
+    });
+}

package/dist/src/mobile/android/detect/androidTargetDetection.js

@@ -0,0 +1,18 @@
+import { createAndroidProfile } from "../profile.js";
+import { createAndroidTargetMetadata } from "../targetMetadata.js";
+import { detectAndroidProject } from "./detectAndroidProject.js";
+export function detectAndroidTarget(local) {
+    const detection = detectAndroidProject(local.targetRoot);
+    const androidProfile = createAndroidProfile({
+        detectionConfidence: detection.confidence,
+        evidence: detection.evidence,
+        unsupportedNotes: detection.warnings,
+        projectType: detection.projectKind,
+        projectSubtype: detection.uiToolkit,
+        supportedCapabilities: ["static-detection"],
+    });
+    return {
+        detection,
+        target: createAndroidTargetMetadata({ local, androidProfile, detection }),
+    };
+}

package/dist/src/mobile/android/detect/buildFileEvidence.js

@@ -0,0 +1,36 @@
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 2 — bounded, deterministic build.gradle(.kts) evidence
+// extraction.
+//
+// Extracts only the lexical signals needed for detection and classification
+// (plugin ids, namespace, applicationId, Compose build-feature/dependency
+// evidence). This is not a Gradle metadata parser (that is Batch 4's scope):
+// values that cannot be statically read as a literal are preserved as
+// "unresolved" evidence rather than guessed.
+// ---------------------------------------------------------------------------
+const ANDROID_APPLICATION_PLUGIN_PATTERN = /(['"`])com\.android\.application\1|id\s*\(\s*['"`]com\.android\.application['"`]\s*\)/;
+const ANDROID_LIBRARY_PLUGIN_PATTERN = /(['"`])com\.android\.library\1|id\s*\(\s*['"`]com\.android\.library['"`]\s*\)/;
+const KOTLIN_ANDROID_PLUGIN_PATTERN = /(['"`])org\.jetbrains\.kotlin\.android\1|kotlin\s*\(\s*['"`]android['"`]\s*\)|(['"`])kotlin-android\2/;
+const NAMESPACE_LITERAL_PATTERN = /\bnamespace\s*[=]?\s*['"]([^'"]+)['"]/;
+const NAMESPACE_UNRESOLVED_PATTERN = /\bnamespace\s*[=]?\s*(?!['"])[^\s\n]/;
+const APPLICATION_ID_LITERAL_PATTERN = /\bapplicationId\s*[=]?\s*['"]([^'"]+)['"]/;
+const APPLICATION_ID_UNRESOLVED_PATTERN = /\bapplicationId\s*[=]?\s*(?!['"])[^\s\n]/;
+const COMPOSE_BUILD_FEATURE_PATTERN = /\bcompose\s*[=]?\s*true\b/;
+const COMPOSE_DEPENDENCY_PATTERN = /androidx\.compose|compose-bom|compose\.(?:ui|material|material3|runtime|foundation)/;
+const COMPOSE_PLUGIN_PATTERN = /org\.jetbrains\.kotlin\.plugin\.compose|com\.android\.compose|compose-compiler/;
+export function extractBuildFileEvidence(text) {
+    const namespaceLiteral = text.match(NAMESPACE_LITERAL_PATTERN);
+    const applicationIdLiteral = text.match(APPLICATION_ID_LITERAL_PATTERN);
+    return {
+        androidApplicationPlugin: ANDROID_APPLICATION_PLUGIN_PATTERN.test(text),
+        androidLibraryPlugin: ANDROID_LIBRARY_PLUGIN_PATTERN.test(text),
+        kotlinAndroidPlugin: KOTLIN_ANDROID_PLUGIN_PATTERN.test(text),
+        namespace: namespaceLiteral?.[1],
+        namespaceUnresolved: !namespaceLiteral && NAMESPACE_UNRESOLVED_PATTERN.test(text),
+        applicationId: applicationIdLiteral?.[1],
+        applicationIdUnresolved: !applicationIdLiteral && APPLICATION_ID_UNRESOLVED_PATTERN.test(text),
+        composeBuildFeatureEvidence: COMPOSE_BUILD_FEATURE_PATTERN.test(text),
+        composeDependencyEvidence: COMPOSE_DEPENDENCY_PATTERN.test(text),
+        composePluginEvidence: COMPOSE_PLUGIN_PATTERN.test(text),
+    };
+}