@dailephd/my-dev-kit-lab 0.3.3 → 0.4.0

package/dist/src/mobile/android/manifest/parseAndroidManifest.js

@@ -0,0 +1,341 @@
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { relativeWithinRoot, resolveWithinRoot } from "../../../core/pathSafety.js";
+import { ANDROID_NAMESPACE_URI, findChildren, getAttribute, parseXmlDocument, } from "./xml/parseXml.js";
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 3 — AndroidManifest.xml parser.
+//
+// Maps the bounded XML tree from ./xml/parseXml.ts onto the Batch 1
+// AndroidManifestModel contract. Static, deterministic, read-only: no
+// resource-reference resolution, no manifest-placeholder resolution (values
+// like @string/app_name and ${applicationId} are preserved verbatim), and no
+// manifest merging. Malformed input always produces a valid (possibly
+// mostly-empty) AndroidManifestModel with the problem recorded in
+// `parseWarnings`/`unsupportedConstructs` rather than throwing.
+// ---------------------------------------------------------------------------
+function toLocation(xmlLocation) {
+    return { line: xmlLocation.line, column: xmlLocation.column };
+}
+function getUnprefixedAttribute(element, localName) {
+    return element.attributes.find((attr) => attr.prefix === undefined && attr.localName === localName)?.value;
+}
+function androidAttr(element, localName) {
+    return getAttribute(element, localName, ANDROID_NAMESPACE_URI)?.value;
+}
+function parseBooleanAttr(element, localName, warnings, context) {
+    const attr = getAttribute(element, localName, ANDROID_NAMESPACE_URI);
+    if (!attr)
+        return {};
+    if (attr.value === "true")
+        return { value: true, raw: attr.value };
+    if (attr.value === "false")
+        return { value: false, raw: attr.value };
+    warnings.push(`${context}: android:${localName} has an unresolved or malformed value "${attr.value}" (line ${attr.location.line}) — not normalized to true or false.`);
+    return { raw: attr.value };
+}
+function parseIntAttr(element, localName, warnings, context) {
+    const attr = getAttribute(element, localName, ANDROID_NAMESPACE_URI);
+    if (!attr)
+        return undefined;
+    const parsed = Number.parseInt(attr.value, 10);
+    if (Number.isNaN(parsed)) {
+        warnings.push(`${context}: android:${localName} is not a resolvable integer ("${attr.value}", line ${attr.location.line}).`);
+        return undefined;
+    }
+    return parsed;
+}
+const LAUNCHER_ACTION = "android.intent.action.MAIN";
+const LAUNCHER_CATEGORY = "android.intent.category.LAUNCHER";
+const VIEW_ACTION = "android.intent.action.VIEW";
+const BROWSABLE_CATEGORY = "android.intent.category.BROWSABLE";
+function parseIntentFilter(element, warnings) {
+    const actions = findChildren(element, "action")
+        .map((a) => androidAttr(a, "name"))
+        .filter((v) => Boolean(v));
+    const categories = findChildren(element, "category")
+        .map((c) => androidAttr(c, "name"))
+        .filter((v) => Boolean(v));
+    const autoVerifyResult = parseBooleanAttr(element, "autoVerify", warnings, "intent-filter");
+    const dataElements = findChildren(element, "data").map((d) => ({
+        dataScheme: androidAttr(d, "scheme"),
+        dataHost: androidAttr(d, "host"),
+        dataPath: androidAttr(d, "path"),
+        dataPathPrefix: androidAttr(d, "pathPrefix"),
+        dataPathPattern: androidAttr(d, "pathPattern"),
+        autoVerify: autoVerifyResult.value,
+        location: toLocation(d.location),
+    }));
+    const isDeepLinkCandidate = actions.includes(VIEW_ACTION) && (categories.includes(BROWSABLE_CATEGORY) || dataElements.length > 0);
+    for (const child of element.children) {
+        if (child.localName !== "action" && child.localName !== "category" && child.localName !== "data") {
+            warnings.push(`Unsupported intent-filter child element <${child.tagName}> at line ${child.location.line} (preserved as a warning, not parsed).`);
+        }
+    }
+    return {
+        filterData: dataElements,
+        actions,
+        categories,
+        dataElements,
+        autoVerify: autoVerifyResult.value,
+        isDeepLinkCandidate,
+        location: toLocation(element.location),
+    };
+}
+function parseComponent(kind, element, warnings) {
+    const context = `<${kind}> at line ${element.location.line}`;
+    const name = androidAttr(element, "name");
+    if (!name) {
+        warnings.push(`${context} is missing android:name.`);
+    }
+    const exportedResult = parseBooleanAttr(element, "exported", warnings, context);
+    const enabledResult = parseBooleanAttr(element, "enabled", warnings, context);
+    const permission = androidAttr(element, "permission");
+    const intentFilters = findChildren(element, "intent-filter").map((filterEl) => parseIntentFilter(filterEl, warnings));
+    const isLauncherActivity = (kind === "activity" || kind === "activity-alias") &&
+        intentFilters.some((filter) => filter.actions?.includes(LAUNCHER_ACTION) && filter.categories?.includes(LAUNCHER_CATEGORY));
+    const component = {
+        kind,
+        name: name ?? "",
+        exported: exportedResult.value,
+        exportedRaw: exportedResult.raw,
+        enabled: enabledResult.value,
+        permission,
+        intentFilters,
+        isLauncherActivity: isLauncherActivity || undefined,
+        location: toLocation(element.location),
+    };
+    if (kind === "provider") {
+        component.readPermission = androidAttr(element, "readPermission");
+        component.writePermission = androidAttr(element, "writePermission");
+        const authoritiesRaw = androidAttr(element, "authorities");
+        component.authorities = authoritiesRaw ? authoritiesRaw.split(";").map((s) => s.trim()).filter(Boolean) : undefined;
+        component.grantUriPermissions = parseBooleanAttr(element, "grantUriPermissions", warnings, context).value;
+    }
+    return component;
+}
+// Parses AndroidManifest.xml source text into the normalized contract. Pure
+// (no filesystem access) so it can be unit tested directly against inline
+// XML strings.
+export function parseAndroidManifestSource(xmlText, manifestPath) {
+    const parseWarnings = [];
+    const unsupportedConstructs = [];
+    const parsed = parseXmlDocument(xmlText);
+    for (const warning of parsed.warnings) {
+        parseWarnings.push(`${warning.message} (line ${warning.location.line}, column ${warning.location.column})`);
+    }
+    if (!parsed.ok) {
+        parseWarnings.push(`Malformed XML: ${parsed.error.message} (line ${parsed.error.location.line}, column ${parsed.error.location.column})`);
+        return {
+            manifestPath,
+            application: {},
+            permissions: [],
+            usesFeatures: [],
+            activities: [],
+            activityAliases: [],
+            services: [],
+            receivers: [],
+            providers: [],
+            deepLinks: [],
+            parseWarnings,
+            unsupportedConstructs,
+        };
+    }
+    const root = parsed.root;
+    if (root.localName !== "manifest") {
+        parseWarnings.push(`Root element is <${root.tagName}>, not <manifest> — manifest could not be interpreted.`);
+        return {
+            manifestPath,
+            application: {},
+            permissions: [],
+            usesFeatures: [],
+            activities: [],
+            activityAliases: [],
+            services: [],
+            receivers: [],
+            providers: [],
+            deepLinks: [],
+            parseWarnings,
+            unsupportedConstructs,
+        };
+    }
+    const packageName = getUnprefixedAttribute(root, "package");
+    const permissionElementNames = [
+        ["uses-permission", "uses-permission"],
+        ["uses-permission-sdk-23", "uses-permission-sdk-23"],
+        ["uses-permission-sdk-m", "uses-permission-sdk-m"],
+    ];
+    const permissions = [];
+    for (const [elementName, sourceElement] of permissionElementNames) {
+        for (const el of findChildren(root, elementName)) {
+            const name = androidAttr(el, "name");
+            if (!name) {
+                parseWarnings.push(`<${elementName}> at line ${el.location.line} is missing android:name.`);
+                continue;
+            }
+            permissions.push({
+                name,
+                maxSdkVersion: parseIntAttr(el, "maxSdkVersion", parseWarnings, `<${elementName}> "${name}"`),
+                sourceElement,
+                location: toLocation(el.location),
+            });
+        }
+    }
+    const usesFeatures = findChildren(root, "uses-feature")
+        .map((el) => {
+        const name = androidAttr(el, "name");
+        if (!name) {
+            parseWarnings.push(`<uses-feature> at line ${el.location.line} is missing android:name.`);
+            return undefined;
+        }
+        return {
+            name,
+            required: parseBooleanAttr(el, "required", parseWarnings, `<uses-feature> "${name}"`).value,
+            location: toLocation(el.location),
+        };
+    })
+        .filter((v) => v !== undefined);
+    const applicationElements = findChildren(root, "application");
+    const applicationEl = applicationElements[0];
+    if (!applicationEl) {
+        unsupportedConstructs.push("Manifest has no <application> element.");
+    }
+    if (applicationElements.length > 1) {
+        parseWarnings.push(`Manifest declares ${applicationElements.length} <application> elements; only the first was used.`);
+    }
+    const application = applicationEl
+        ? {
+            name: androidAttr(applicationEl, "name"),
+            label: androidAttr(applicationEl, "label"),
+            iconRef: androidAttr(applicationEl, "icon"),
+            enabled: parseBooleanAttr(applicationEl, "enabled", parseWarnings, "<application>").value,
+            permission: androidAttr(applicationEl, "permission"),
+            allowBackup: parseBooleanAttr(applicationEl, "allowBackup", parseWarnings, "<application>").value,
+            debuggable: parseBooleanAttr(applicationEl, "debuggable", parseWarnings, "<application>").value,
+            usesCleartextTraffic: parseBooleanAttr(applicationEl, "usesCleartextTraffic", parseWarnings, "<application>").value,
+            networkSecurityConfigRef: androidAttr(applicationEl, "networkSecurityConfig"),
+        }
+        : {};
+    const activities = applicationEl ? findChildren(applicationEl, "activity").map((el) => parseComponent("activity", el, parseWarnings)) : [];
+    const activityAliases = applicationEl
+        ? findChildren(applicationEl, "activity-alias").map((el) => parseComponent("activity-alias", el, parseWarnings))
+        : [];
+    const services = applicationEl ? findChildren(applicationEl, "service").map((el) => parseComponent("service", el, parseWarnings)) : [];
+    const receivers = applicationEl ? findChildren(applicationEl, "receiver").map((el) => parseComponent("receiver", el, parseWarnings)) : [];
+    const providers = applicationEl ? findChildren(applicationEl, "provider").map((el) => parseComponent("provider", el, parseWarnings)) : [];
+    if (applicationEl) {
+        const knownChildNames = new Set(["activity", "activity-alias", "service", "receiver", "provider", "meta-data"]);
+        for (const child of applicationEl.children) {
+            if (!knownChildNames.has(child.localName)) {
+                unsupportedConstructs.push(`Unsupported <application> child element <${child.tagName}> at line ${child.location.line}.`);
+            }
+        }
+    }
+    const deepLinks = [];
+    let launcherActivityName;
+    for (const component of [...activities, ...activityAliases]) {
+        if (component.isLauncherActivity && !launcherActivityName) {
+            launcherActivityName = component.name;
+        }
+        for (const filter of component.intentFilters) {
+            if (filter.isDeepLinkCandidate) {
+                deepLinks.push(...(filter.dataElements ?? filter.filterData));
+            }
+        }
+    }
+    return {
+        manifestPath,
+        packageName,
+        application,
+        permissions,
+        usesFeatures,
+        activities,
+        activityAliases,
+        services,
+        receivers,
+        providers,
+        deepLinks,
+        launcherActivityName,
+        parseWarnings,
+        unsupportedConstructs,
+    };
+}
+// Reads and parses a manifest file. `manifestRelativePath` must already be
+// target-relative (as returned by AndroidDetectionResult.manifestPaths); this
+// re-validates containment before reading so a caller-supplied path can never
+// escape targetRoot.
+export function parseAndroidManifestFile(targetRoot, manifestRelativePath) {
+    const resolvedRoot = path.resolve(targetRoot);
+    let absolutePath;
+    try {
+        absolutePath = resolveWithinRoot(resolvedRoot, manifestRelativePath);
+    }
+    catch (error) {
+        return {
+            manifestPath: manifestRelativePath,
+            application: {},
+            permissions: [],
+            usesFeatures: [],
+            activities: [],
+            activityAliases: [],
+            services: [],
+            receivers: [],
+            providers: [],
+            deepLinks: [],
+            parseWarnings: [`Manifest path rejected: ${error instanceof Error ? error.message : "path escapes target root"}`],
+            unsupportedConstructs: [],
+        };
+    }
+    const normalizedPath = relativeWithinRoot(resolvedRoot, absolutePath);
+    let xmlText;
+    try {
+        xmlText = readFileSync(absolutePath, "utf8");
+    }
+    catch (error) {
+        return {
+            manifestPath: normalizedPath,
+            application: {},
+            permissions: [],
+            usesFeatures: [],
+            activities: [],
+            activityAliases: [],
+            services: [],
+            receivers: [],
+            providers: [],
+            deepLinks: [],
+            parseWarnings: [`Could not read manifest file: ${error instanceof Error ? error.message : "unknown error"}`],
+            unsupportedConstructs: [],
+        };
+    }
+    return parseAndroidManifestSource(xmlText, normalizedPath);
+}
+const KNOWN_SOURCE_SET_KINDS = ["main", "debug", "release", "androidTest", "test"];
+function inferSourceSetKind(manifestPath) {
+    const segments = manifestPath.split("/");
+    const srcIndex = segments.indexOf("src");
+    const sourceSetSegment = srcIndex !== -1 ? segments[srcIndex + 1] : undefined;
+    return KNOWN_SOURCE_SET_KINDS.includes(sourceSetSegment ?? "")
+        ? sourceSetSegment
+        : "other";
+}
+function inferModulePath(manifestPath) {
+    const srcIndex = manifestPath.indexOf("/src/");
+    return srcIndex === -1 ? undefined : manifestPath.slice(0, srcIndex);
+}
+// Parses every manifest path from a Batch 2 AndroidDetectionResult
+// independently. One malformed manifest never prevents the others from being
+// parsed. Does not merge manifests — each entry stands alone, tagged with its
+// inferred module and source-set association for later batches to use.
+export function parseAllAndroidManifests(targetRoot, detection) {
+    const moduleManifestMap = new Map();
+    for (const module of detection.modules) {
+        for (const manifestPath of module.manifestPaths) {
+            moduleManifestMap.set(manifestPath, module.path);
+        }
+    }
+    return [...detection.manifestPaths].sort((a, b) => a.localeCompare(b)).map((manifestPath) => ({
+        manifestPath,
+        modulePath: moduleManifestMap.get(manifestPath) ?? inferModulePath(manifestPath),
+        sourceSetKind: inferSourceSetKind(manifestPath),
+        manifest: parseAndroidManifestFile(targetRoot, manifestPath),
+    }));
+}

package/dist/src/mobile/android/manifest/types.js

@@ -0,0 +1,29 @@
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 1 — AndroidManifest model foundation.
+// v0.4.0 Batch 3 — narrow additive inherited-contract corrections needed by
+// manifest parsing and the initial audits (see agents.txt Batch 3 section
+// 6.7). Every change below only adds new optional fields/enum members or a
+// new optional array — no existing required field, type, or enum value was
+// removed or retyped, so all Batch 1/2 object literals remain valid:
+//   - AndroidManifestComponentKind gained "activity-alias" (section 7.6).
+//   - AndroidManifestComponent gained optional `exportedRaw` so a malformed
+//     android:exported value can be distinguished from "unspecified"
+//     (`exported` stays undefined in both cases; `exportedRaw` preserves the
+//     literal attribute text when present) — section 7.7's invariant that
+//     malformed values must never be normalized to false requires this.
+//   - AndroidManifestModel gained optional `activityAliases` (section 7.6).
+//   - AndroidIntentFilter gained optional `actions`/`categories`/
+//     `dataElements` so multiple sibling <action>/<category>/<data> children
+//     can be preserved independently (section 7.8) without discarding the
+//     original `filterData` field, which Batch 1 tests and any external
+//     consumer may already rely on; the parser keeps populating both.
+//   - AndroidIntentFilterData gained optional `location` (section 7.11).
+//   - AndroidPermissionDeclaration gained optional `sourceElement` so
+//     uses-permission / uses-permission-sdk-23 / uses-permission-sdk-m are
+//     not conflated (section 7.4, ANDROID-B3-03).
+//
+// Normalized data contracts consumed by the manifest parser and the
+// permission/component/deep-link auditors added in later batches. This file
+// defines shape only — no XML parsing and no finding generation happen here.
+// ---------------------------------------------------------------------------
+export {};

package/dist/src/mobile/android/manifest/xml/parseXml.js

@@ -0,0 +1,313 @@
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 3 — bounded, deterministic, dependency-free XML parser for
+// AndroidManifest.xml.
+//
+// No XML parsing dependency exists in this repository (see package.json —
+// zero runtime dependencies), so this hand-written recursive-descent scanner
+// avoids adding one, per agents.txt Batch 3 section 7.2 ("prefer a small
+// bounded parser implementation ... Do not use brittle global regular
+// expressions as the primary XML parser"). This is a manual character
+// scanner (no regex-based tokenization), tracks line/column for every
+// element and attribute, and resolves XML namespace URIs from `xmlns`/
+// `xmlns:*` declarations rather than assuming any particular prefix — so an
+// `android:` attribute is recognized even if a manifest (unusually)
+// re-prefixes the Android namespace.
+//
+// Deliberately NOT implemented (out of scope for a manifest-only parser):
+// DTD/entity resolution beyond skipping DOCTYPE, full XML 1.1 conformance,
+// processing-instruction data, and CDATA content extraction (CDATA is
+// skipped as opaque text — AndroidManifest.xml has no meaningful use of it).
+// ---------------------------------------------------------------------------
+export const ANDROID_NAMESPACE_URI = "http://schemas.android.com/apk/res/android";
+class XmlSyntaxError extends Error {
+    location;
+    constructor(message, location) {
+        super(message);
+        this.location = location;
+    }
+}
+const NAME_START_PATTERN = /[A-Za-z_:]/;
+const NAME_CHAR_PATTERN = /[A-Za-z0-9_.:-]/;
+function isNameStartChar(ch) {
+    return ch !== undefined && NAME_START_PATTERN.test(ch);
+}
+function isNameChar(ch) {
+    return ch !== undefined && NAME_CHAR_PATTERN.test(ch);
+}
+function isWhitespace(ch) {
+    return ch === " " || ch === "\t" || ch === "\n" || ch === "\r";
+}
+class Scanner {
+    text;
+    pos = 0;
+    line = 1;
+    column = 1;
+    constructor(text) {
+        // Strip a UTF-8 BOM if present so it doesn't count as document content.
+        this.text = text.charCodeAt(0) === 0xfeff ? text.slice(1) : text;
+    }
+    loc() {
+        return { line: this.line, column: this.column };
+    }
+    eof() {
+        return this.pos >= this.text.length;
+    }
+    peek(offset = 0) {
+        return this.text[this.pos + offset];
+    }
+    startsWith(literal) {
+        return this.text.startsWith(literal, this.pos);
+    }
+    advance() {
+        const ch = this.text[this.pos];
+        if (ch === undefined) {
+            throw new XmlSyntaxError("Unexpected end of document", this.loc());
+        }
+        this.pos += 1;
+        if (ch === "\n") {
+            this.line += 1;
+            this.column = 1;
+        }
+        else {
+            this.column += 1;
+        }
+        return ch;
+    }
+    skipWhitespace() {
+        while (!this.eof() && isWhitespace(this.peek()))
+            this.advance();
+    }
+    expect(literal) {
+        if (!this.startsWith(literal)) {
+            throw new XmlSyntaxError(`Expected "${literal}"`, this.loc());
+        }
+        for (let i = 0; i < literal.length; i++)
+            this.advance();
+    }
+    skipUntil(literal) {
+        while (!this.eof() && !this.startsWith(literal))
+            this.advance();
+        if (this.eof()) {
+            throw new XmlSyntaxError(`Unterminated construct, expected "${literal}"`, this.loc());
+        }
+        this.expect(literal);
+    }
+}
+function resolveNamespace(prefix, scope) {
+    return scope.get(prefix ?? "");
+}
+function splitQualifiedName(qualifiedName) {
+    const colonIndex = qualifiedName.indexOf(":");
+    if (colonIndex === -1)
+        return { localName: qualifiedName };
+    return { prefix: qualifiedName.slice(0, colonIndex), localName: qualifiedName.slice(colonIndex + 1) };
+}
+function readName(scanner) {
+    const start = scanner.loc();
+    if (!isNameStartChar(scanner.peek())) {
+        throw new XmlSyntaxError("Expected a name", start);
+    }
+    let name = "";
+    while (isNameChar(scanner.peek()))
+        name += scanner.advance();
+    return name;
+}
+function readQuotedValue(scanner) {
+    const quote = scanner.peek();
+    if (quote !== `"` && quote !== `'`) {
+        throw new XmlSyntaxError("Expected a quoted attribute value", scanner.loc());
+    }
+    scanner.advance();
+    let value = "";
+    while (!scanner.eof() && scanner.peek() !== quote) {
+        value += scanner.advance();
+    }
+    if (scanner.eof()) {
+        throw new XmlSyntaxError("Unterminated attribute value", scanner.loc());
+    }
+    scanner.advance();
+    return decodeXmlEntities(value);
+}
+function decodeXmlEntities(raw) {
+    return raw
+        .replace(/&lt;/g, "<")
+        .replace(/&gt;/g, ">")
+        .replace(/&apos;/g, "'")
+        .replace(/&quot;/g, '"')
+        .replace(/&#(\d+);/g, (_, dec) => String.fromCodePoint(Number(dec)))
+        .replace(/&#x([0-9a-fA-F]+);/g, (_, hex) => String.fromCodePoint(parseInt(hex, 16)))
+        .replace(/&amp;/g, "&");
+}
+function skipMisc(scanner, warnings) {
+    // Skips whitespace, comments, the XML declaration/processing instructions,
+    // and DOCTYPE declarations that may appear between/around elements.
+    for (;;) {
+        scanner.skipWhitespace();
+        if (scanner.startsWith("<!--")) {
+            scanner.skipUntil("-->");
+            continue;
+        }
+        if (scanner.startsWith("<?")) {
+            scanner.skipUntil("?>");
+            continue;
+        }
+        if (scanner.startsWith("<!DOCTYPE") || scanner.startsWith("<!doctype")) {
+            warnings.push({ message: "DOCTYPE declaration encountered and skipped (not evaluated)", location: scanner.loc() });
+            scanner.skipUntil(">");
+            continue;
+        }
+        if (scanner.startsWith("<![CDATA[")) {
+            scanner.skipUntil("]]>");
+            continue;
+        }
+        break;
+    }
+}
+function parseAttributes(scanner) {
+    const rawAttributes = [];
+    for (;;) {
+        scanner.skipWhitespace();
+        const next = scanner.peek();
+        if (next === undefined || next === "/" || next === ">")
+            break;
+        const location = scanner.loc();
+        const rawName = readName(scanner);
+        scanner.skipWhitespace();
+        scanner.expect("=");
+        scanner.skipWhitespace();
+        const value = readQuotedValue(scanner);
+        rawAttributes.push({ rawName, value, location });
+    }
+    // Build the namespace scope contributed by this element's own xmlns/xmlns:*
+    // attributes so attribute namespace resolution can use it immediately
+    // (XML allows an element to both declare and use a namespace prefix).
+    const localScope = new Map();
+    for (const attr of rawAttributes) {
+        if (attr.rawName === "xmlns") {
+            localScope.set("", attr.value);
+        }
+        else if (attr.rawName.startsWith("xmlns:")) {
+            localScope.set(attr.rawName.slice("xmlns:".length), attr.value);
+        }
+    }
+    return { rawAttributes, localScope };
+}
+// Resolves each raw attribute's namespace URI against the combined
+// (ancestor + this element's own) namespace scope. `xmlns`/`xmlns:*`
+// attributes themselves are preserved as regular attributes (some manifest
+// tooling inspects them) but are not namespace-resolved.
+function resolveAttributeNamespaces(rawAttributes, scope, warnings) {
+    return rawAttributes.map(({ rawName, value, location }) => {
+        const { prefix, localName } = splitQualifiedName(rawName);
+        if (rawName === "xmlns" || rawName.startsWith("xmlns:")) {
+            return { rawName, localName, value, location };
+        }
+        if (prefix === undefined) {
+            return { rawName, localName, value, location };
+        }
+        const namespaceUri = resolveNamespace(prefix, scope);
+        if (namespaceUri === undefined) {
+            warnings.push({ message: `Unresolved namespace prefix "${prefix}" on attribute "${rawName}"`, location });
+        }
+        return { rawName, prefix, localName, namespaceUri, value, location };
+    });
+}
+function parseElement(scanner, parentScope, warnings) {
+    const location = scanner.loc();
+    scanner.expect("<");
+    const tagName = readName(scanner);
+    const { rawAttributes, localScope } = parseAttributes(scanner);
+    const scope = localScope.size > 0 ? new Map([...parentScope, ...localScope]) : parentScope;
+    const attributes = resolveAttributeNamespaces(rawAttributes, scope, warnings);
+    const { prefix, localName } = splitQualifiedName(tagName);
+    const namespaceUri = prefix !== undefined ? resolveNamespace(prefix, scope) : resolveNamespace(undefined, scope);
+    scanner.skipWhitespace();
+    if (scanner.startsWith("/>")) {
+        scanner.expect("/>");
+        return { tagName, prefix, localName, namespaceUri, attributes, children: [], location };
+    }
+    scanner.expect(">");
+    const children = [];
+    for (;;) {
+        skipTextAndMisc(scanner, warnings);
+        if (scanner.startsWith("</")) {
+            scanner.expect("</");
+            const closingName = readName(scanner);
+            scanner.skipWhitespace();
+            scanner.expect(">");
+            if (closingName !== tagName) {
+                throw new XmlSyntaxError(`Mismatched closing tag: expected "</${tagName}>" but found "</${closingName}>"`, location);
+            }
+            break;
+        }
+        if (scanner.eof()) {
+            throw new XmlSyntaxError(`Unterminated element "<${tagName}>" (missing closing tag)`, location);
+        }
+        if (scanner.peek() === "<" && isNameStartChar(scanner.peek(1))) {
+            children.push(parseElement(scanner, scope, warnings));
+            continue;
+        }
+        // Any other content (unexpected `<` not matching a comment/PI/CDATA/
+        // element/closing-tag pattern) is treated as malformed input.
+        throw new XmlSyntaxError("Unexpected content while looking for a child element or closing tag", scanner.loc());
+    }
+    return { tagName, prefix, localName, namespaceUri, attributes, children, location };
+}
+function skipTextAndMisc(scanner, warnings) {
+    for (;;) {
+        if (scanner.startsWith("<!--")) {
+            scanner.skipUntil("-->");
+            continue;
+        }
+        if (scanner.startsWith("<![CDATA[")) {
+            scanner.skipUntil("]]>");
+            continue;
+        }
+        if (scanner.startsWith("<?")) {
+            scanner.skipUntil("?>");
+            continue;
+        }
+        if (scanner.peek() === "<")
+            break;
+        if (scanner.eof())
+            break;
+        // Plain text content between elements — not meaningful for manifest
+        // structure, so it is discarded rather than stored.
+        scanner.advance();
+        continue;
+    }
+}
+// Parses `xmlText` into a small element tree. Never throws: all failures are
+// reported via the `ok: false` branch with a bounded message and location.
+export function parseXmlDocument(xmlText) {
+    const warnings = [];
+    try {
+        const scanner = new Scanner(xmlText);
+        skipMisc(scanner, warnings);
+        if (scanner.eof() || scanner.peek() !== "<") {
+            return { ok: false, error: { message: "No root element found", location: scanner.loc() }, warnings };
+        }
+        const root = parseElement(scanner, new Map(), warnings);
+        skipMisc(scanner, warnings);
+        if (!scanner.eof()) {
+            warnings.push({ message: "Unexpected trailing content after the root element was ignored", location: scanner.loc() });
+        }
+        return { ok: true, root, warnings };
+    }
+    catch (error) {
+        if (error instanceof XmlSyntaxError) {
+            return { ok: false, error: { message: error.message, location: error.location }, warnings };
+        }
+        return {
+            ok: false,
+            error: { message: error instanceof Error ? error.message : "Unknown XML parse error", location: { line: 1, column: 1 } },
+            warnings,
+        };
+    }
+}
+export function findChildren(element, localName, namespaceUri) {
+    return element.children.filter((child) => child.localName === localName && (namespaceUri === undefined || child.namespaceUri === namespaceUri));
+}
+export function getAttribute(element, localName, namespaceUri = ANDROID_NAMESPACE_URI) {
+    return element.attributes.find((attr) => attr.localName === localName && attr.namespaceUri === namespaceUri);
+}