@dailephd/my-dev-kit-lab 0.3.3 → 0.4.0

package/dist/src/mobile/android/validate/detectionAndImmutabilityCheckResults.js

@@ -0,0 +1,177 @@
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 5 — the three required check families that no prior batch
+// produced an AndroidCheckResult for: project detection, manifest parsing
+// (as distinct from the audits that consume parsed manifests), and target
+// immutability evidence (agents.txt Batch 5 section 10.1).
+// ---------------------------------------------------------------------------
+export function buildAndroidDetectionCheckResult(detection) {
+    const sourcePaths = [...detection.gradleSettingsFiles, ...detection.rootBuildFiles].sort((a, b) => a.localeCompare(b));
+    if (detection.projectKind === "non-android") {
+        return {
+            id: "android-project-detection",
+            category: "android-detection",
+            title: "Android project detection",
+            status: "unsupported",
+            requirementLevel: "optional",
+            ran: true,
+            skipped: true,
+            skipInfo: {
+                checkId: "android-project-detection",
+                reason: "Target was not detected as an Android project.",
+                requirementLevel: "optional",
+                missingCapability: "android-evidence",
+                verdictImpact: "does not apply to a non-Android target",
+                recommendedNextAction: "Confirm the target is an Android Gradle project.",
+            },
+            evidence: detection.evidence,
+            findings: [],
+            warnings: detection.warnings,
+            errors: [],
+            sourcePaths,
+            confidence: detection.confidence,
+            environmentRequirements: [],
+        };
+    }
+    const isPartial = detection.projectKind === "partial" || detection.projectKind === "unknown" || detection.partialOrUnsupportedStructure;
+    return {
+        id: "android-project-detection",
+        category: "android-detection",
+        title: "Android project detection",
+        status: isPartial ? "inconclusive" : "passed",
+        requirementLevel: "required",
+        ran: true,
+        skipped: false,
+        evidence: detection.evidence,
+        findings: [],
+        warnings: detection.warnings,
+        errors: [],
+        sourcePaths,
+        confidence: detection.confidence,
+        environmentRequirements: [],
+    };
+}
+const MALFORMED_PREFIX = "Malformed XML:";
+export function buildAndroidManifestParsingCheckResult(detection, manifests) {
+    const sourcePaths = manifests.map((m) => m.manifestPath);
+    if (detection.projectKind === "non-android") {
+        return {
+            id: "android-manifest-parsing",
+            category: "android-manifest",
+            title: "Android manifest parsing",
+            status: "unsupported",
+            requirementLevel: "optional",
+            ran: false,
+            skipped: true,
+            skipInfo: {
+                checkId: "android-manifest-parsing",
+                reason: "Target was not detected as an Android project.",
+                requirementLevel: "optional",
+                missingCapability: "android-detection",
+                verdictImpact: "does not apply to a non-Android target",
+                recommendedNextAction: "Confirm the target is an Android Gradle project.",
+            },
+            evidence: [],
+            findings: [],
+            warnings: [],
+            errors: [],
+            sourcePaths: [],
+            confidence: "unknown",
+            environmentRequirements: [],
+        };
+    }
+    if (manifests.length === 0) {
+        return {
+            id: "android-manifest-parsing",
+            category: "android-manifest",
+            title: "Android manifest parsing",
+            status: "inconclusive",
+            requirementLevel: "required",
+            ran: true,
+            skipped: false,
+            evidence: [],
+            findings: [],
+            warnings: ["No AndroidManifest.xml was found for this target."],
+            errors: [],
+            sourcePaths: [],
+            confidence: "unknown",
+            environmentRequirements: [],
+        };
+    }
+    const malformed = manifests.filter((m) => m.manifest.parseWarnings.some((w) => w.startsWith(MALFORMED_PREFIX)));
+    const allMalformed = malformed.length === manifests.length;
+    const warnings = manifests.flatMap((m) => m.manifest.parseWarnings);
+    if (allMalformed) {
+        return {
+            id: "android-manifest-parsing",
+            category: "android-manifest",
+            title: "Android manifest parsing",
+            status: "error",
+            requirementLevel: "required",
+            ran: true,
+            skipped: false,
+            evidence: [],
+            findings: [],
+            warnings,
+            errors: malformed.flatMap((m) => m.manifest.parseWarnings.filter((w) => w.startsWith(MALFORMED_PREFIX))),
+            sourcePaths,
+            confidence: "unknown",
+            environmentRequirements: [],
+        };
+    }
+    const confidence = malformed.length > 0 ? "medium" : "high";
+    return {
+        id: "android-manifest-parsing",
+        category: "android-manifest",
+        title: "Android manifest parsing",
+        status: "passed",
+        requirementLevel: "required",
+        ran: true,
+        skipped: false,
+        evidence: [`${manifests.length} manifest(s) parsed independently (not merged)`],
+        findings: [],
+        warnings,
+        errors: [],
+        sourcePaths,
+        confidence,
+        environmentRequirements: [],
+    };
+}
+export function buildAndroidTargetImmutabilityCheckResult(mutation) {
+    if (!mutation.comparable) {
+        return {
+            id: "android-target-immutability",
+            category: "android-target-immutability",
+            title: "Android target immutability",
+            status: "inconclusive",
+            requirementLevel: "optional",
+            ran: true,
+            skipped: false,
+            evidence: [],
+            findings: [],
+            warnings: [`Target mutation evidence unavailable: ${mutation.reason ?? "unknown reason"}`],
+            errors: [],
+            sourcePaths: [],
+            confidence: "unknown",
+            environmentRequirements: [],
+            targetModificationObserved: undefined,
+        };
+    }
+    const unexpected = mutation.unexpectedChanges.length > 0;
+    return {
+        id: "android-target-immutability",
+        category: "android-target-immutability",
+        title: "Android target immutability",
+        status: unexpected ? "failed" : "passed",
+        requirementLevel: "optional",
+        ran: true,
+        skipped: false,
+        evidence: mutation.expectedGeneratedChanges.map((p) => `generatedOutput=${p}`),
+        findings: [],
+        warnings: unexpected ? [`Unexpected target change(s): ${mutation.unexpectedChanges.join(", ")}`] : [],
+        errors: [],
+        sourcePaths: [],
+        confidence: "high",
+        environmentRequirements: [],
+        targetModificationObserved: unexpected,
+    };
+}

package/dist/src/mobile/android/validate/playReadinessChecklist.js

@@ -0,0 +1,145 @@
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 5 — bounded Play-readiness checklist placeholders (agents.txt
+// Batch 5 section 14).
+//
+// Informational and planning-oriented only. Never claims Google Play
+// approval, compliance, upload readiness, or publication readiness — no
+// network access, no live policy lookup. Manual/policy placeholder items are
+// always "manual-check-required" regardless of local evidence.
+// ---------------------------------------------------------------------------
+export const ANDROID_PLAY_READINESS_ITEM_STATUSES = [
+    "confirmed",
+    "missing",
+    "unresolved",
+    "manual-check-required",
+    "not-applicable",
+];
+const MANUAL_POLICY_ITEMS = [
+    { id: "privacy-policy-required", title: "Privacy policy", detail: "Privacy policy requirement must be assessed manually." },
+    { id: "play-data-safety-declaration", title: "Data Safety declaration", detail: "Google Play Data Safety declaration must be completed manually." },
+    {
+        id: "sensitive-permission-justification",
+        title: "Sensitive permission justification",
+        detail: "Sensitive or restricted permission declarations may require additional forms or justification.",
+    },
+    { id: "store-listing-content", title: "Store listing content", detail: "Store listing content must be prepared manually." },
+    { id: "release-notes", title: "Release notes", detail: "Release notes must be prepared." },
+    { id: "app-access-instructions", title: "App access instructions", detail: "App access instructions may be required." },
+    { id: "content-rating", title: "Content rating", detail: "Content rating must be completed." },
+    {
+        id: "target-audience-content-declarations",
+        title: "Target audience and content",
+        detail: "Target audience and content declarations must be completed.",
+    },
+    { id: "ads-declaration", title: "Ads declaration", detail: "Ads declaration may be required." },
+    {
+        id: "testing-track-account-requirements",
+        title: "Testing track and account requirements",
+        detail: "Testing-track and account requirements must be checked separately.",
+    },
+    {
+        id: "current-play-policy-review",
+        title: "Current Google Play policy review",
+        detail: "Current Google Play policies must be reviewed at publication time. This tool performs no live policy lookup.",
+    },
+];
+function itemsForLibrary() {
+    const applicationItemIds = [
+        "app-module-identified",
+        "application-id-resolved",
+        "namespace-resolved",
+        "version-code-resolved",
+        "version-name-resolved",
+        "min-sdk-resolved",
+        "target-sdk-resolved",
+        "compile-sdk-resolved",
+        "target-sdk-policy-check",
+        "launcher-activity-identified",
+        "application-label-present",
+        "application-icon-present",
+        "adaptive-round-icon-evidence",
+        "permissions-summary-available",
+    ];
+    const items = applicationItemIds.map((id) => ({
+        id,
+        title: id,
+        status: "not-applicable",
+        detail: "Google Play application readiness does not apply directly to a library artifact.",
+    }));
+    for (const policyItem of MANUAL_POLICY_ITEMS) {
+        items.push({ ...policyItem, status: "not-applicable" });
+    }
+    return items;
+}
+export function buildAndroidPlayReadinessChecklist(input) {
+    if (input.isNonAndroid) {
+        return {
+            applicable: false,
+            note: "This target was not detected as an Android project. Play-readiness checklist items are not applicable.",
+            items: itemsForLibrary().map((item) => ({ ...item, detail: "Target was not detected as an Android project." })),
+        };
+    }
+    if (input.isLibraryOnly) {
+        return {
+            applicable: false,
+            note: "This target is a pure Android library. Play-readiness checklist items are not applicable to a library artifact.",
+            items: itemsForLibrary(),
+        };
+    }
+    const { releaseMetadata, manifests } = input;
+    const hasLauncher = manifests.some((m) => Boolean(m.launcherActivityName));
+    const hasLabel = manifests.some((m) => Boolean(m.application.label));
+    const hasIcon = manifests.some((m) => Boolean(m.application.iconRef));
+    const hasAdaptiveIconEvidence = manifests.some((m) => Boolean(m.application.adaptiveIconEvidence));
+    const permissionsAvailable = manifests.length > 0;
+    const resolvedOrManual = (value, unresolvedFieldName) => {
+        if (value !== undefined && value !== null && value !== "")
+            return "confirmed";
+        const wasAttempted = releaseMetadata.unresolvedFields.some((f) => f.startsWith(`${unresolvedFieldName}:`));
+        return wasAttempted ? "unresolved" : "missing";
+    };
+    const items = [
+        {
+            id: "app-module-identified",
+            title: "Application module identified",
+            status: releaseMetadata.applicationModulePath ? "confirmed" : "missing",
+            detail: releaseMetadata.applicationModuleSelectionNote,
+        },
+        { id: "application-id-resolved", title: "applicationId resolved", status: resolvedOrManual(releaseMetadata.applicationId, "applicationId"), detail: releaseMetadata.applicationId ?? "Not statically resolved." },
+        { id: "namespace-resolved", title: "namespace resolved", status: resolvedOrManual(releaseMetadata.namespace, "namespace"), detail: releaseMetadata.namespace ?? "Not statically resolved." },
+        { id: "version-code-resolved", title: "versionCode resolved", status: resolvedOrManual(releaseMetadata.versionCode, "versionCode"), detail: String(releaseMetadata.versionCode ?? "Not statically resolved.") },
+        { id: "version-name-resolved", title: "versionName resolved", status: resolvedOrManual(releaseMetadata.versionName, "versionName"), detail: releaseMetadata.versionName ?? "Not statically resolved." },
+        { id: "min-sdk-resolved", title: "minSdk resolved", status: resolvedOrManual(releaseMetadata.minSdk, "minSdk"), detail: String(releaseMetadata.minSdk ?? "Not statically resolved.") },
+        { id: "target-sdk-resolved", title: "targetSdk resolved", status: resolvedOrManual(releaseMetadata.targetSdk, "targetSdk"), detail: String(releaseMetadata.targetSdk ?? "Not statically resolved.") },
+        { id: "compile-sdk-resolved", title: "compileSdk resolved", status: resolvedOrManual(releaseMetadata.compileSdk, "compileSdk"), detail: String(releaseMetadata.compileSdk ?? "Not statically resolved.") },
+        {
+            id: "target-sdk-policy-check",
+            title: "Current Google Play target SDK policy",
+            status: "manual-check-required",
+            detail: "Current Google Play target SDK policy must be checked separately — not evaluated by this tool.",
+        },
+        { id: "launcher-activity-identified", title: "Launcher activity identified", status: hasLauncher ? "confirmed" : "missing", detail: hasLauncher ? "Launcher activity found in a parsed manifest." : "No launcher activity evidence found." },
+        { id: "application-label-present", title: "Application label reference present", status: hasLabel ? "confirmed" : "missing", detail: hasLabel ? "android:label present." : "No android:label found on <application>." },
+        { id: "application-icon-present", title: "Application icon reference present", status: hasIcon ? "confirmed" : "missing", detail: hasIcon ? "android:icon present." : "No android:icon found on <application>." },
+        {
+            id: "adaptive-round-icon-evidence",
+            title: "Round/adaptive icon evidence",
+            status: hasAdaptiveIconEvidence ? "confirmed" : "unresolved",
+            detail: "Adaptive/round icon resources are not resolved by this tool; only direct manifest evidence, if any, is reflected here.",
+        },
+        {
+            id: "permissions-summary-available",
+            title: "Permissions summary available",
+            status: permissionsAvailable ? "confirmed" : "missing",
+            detail: "See the permissions audit section for the full declared-permission summary.",
+        },
+    ];
+    for (const policyItem of MANUAL_POLICY_ITEMS) {
+        items.push({ ...policyItem, status: "manual-check-required" });
+    }
+    return {
+        applicable: true,
+        note: "Bounded, local-evidence-only checklist. Confirms what static analysis found; every policy/manual item still requires human review before a Play Store submission. No live Google Play policy lookup was performed.",
+        items,
+    };
+}

package/dist/src/mobile/android/validate/validateAndroidTarget.js

@@ -0,0 +1,172 @@
+import fs from "node:fs";
+import path from "node:path";
+import { resolveLocalProjectTarget } from "../../../core/localProjectTarget.js";
+import { detectAndroidProject } from "../detect/detectAndroidProject.js";
+import { createAndroidProfile } from "../profile.js";
+import { createAndroidTargetMetadata } from "../targetMetadata.js";
+import { parseAllAndroidManifests } from "../manifest/parseAndroidManifest.js";
+import { auditAndroidPermissions } from "../audit/permissionAudit.js";
+import { auditAndroidExportedComponents } from "../audit/exportedComponentAudit.js";
+import { auditAndroidIntentFilters } from "../audit/intentFilterAudit.js";
+import { auditAndroidDeepLinks } from "../audit/deepLinkAudit.js";
+import { readAndroidGradleMetadata } from "../gradle/readAndroidGradleMetadata.js";
+import { buildAndroidGradleMetadataCheckResult } from "../gradle/gradleMetadataCheckResult.js";
+import { buildAndroidReleaseMetadataSummary } from "../gradle/releaseMetadataSummary.js";
+import { runOptionalGradleValidation } from "../gradle/validate/runOptionalGradleValidation.js";
+import { captureTargetSnapshot, buildTargetMutationReport } from "../gradle/validate/targetMutation.js";
+import { buildAndroidPlayReadinessChecklist } from "./playReadinessChecklist.js";
+import { calculateAndroidVerdict } from "./androidVerdict.js";
+import { buildAndroidDetectionCheckResult, buildAndroidManifestParsingCheckResult, buildAndroidTargetImmutabilityCheckResult, } from "./detectionAndImmutabilityCheckResults.js";
+import { ANDROID_VALIDATION_ARTIFACT_TYPE, ANDROID_VALIDATION_SCHEMA_VERSION, } from "../validation/result.js";
+function readToolPackageMetadata(toolRoot) {
+    try {
+        const pkgRaw = fs.readFileSync(path.join(toolRoot, "package.json"), "utf8");
+        const pkg = JSON.parse(pkgRaw);
+        return { toolPackageName: pkg.name ?? "my-dev-kit-lab", toolPackageVersion: pkg.version ?? "unknown" };
+    }
+    catch {
+        return { toolPackageName: "my-dev-kit-lab", toolPackageVersion: "unknown" };
+    }
+}
+function hasGitDirectory(targetRoot) {
+    try {
+        return fs.existsSync(path.join(targetRoot, ".git"));
+    }
+    catch {
+        return false;
+    }
+}
+export async function validateAndroidTarget(options) {
+    const startedAt = new Date().toISOString();
+    const startedMs = Date.now();
+    // 1. Resolve the local target.
+    const local = resolveLocalProjectTarget(options.targetPath, options.toolRoot);
+    const resolvedTargetRoot = path.resolve(local.targetRoot);
+    const hasGit = local.hasGit || hasGitDirectory(resolvedTargetRoot);
+    // 2. Capture initial target snapshot (read-only).
+    const snapshotBefore = captureTargetSnapshot(resolvedTargetRoot, hasGit);
+    // 3. Detect and classify the Android project.
+    const detection = detectAndroidProject(resolvedTargetRoot);
+    // 5. Build Android target metadata / profile.
+    const androidProfile = createAndroidProfile({
+        detectionConfidence: detection.confidence,
+        evidence: detection.evidence,
+        unsupportedNotes: detection.warnings,
+        projectType: detection.projectKind,
+        projectSubtype: detection.uiToolkit,
+        supportedCapabilities: ["static-detection", "manifest-analysis", "gradle-metadata"],
+    });
+    const targetMetadata = createAndroidTargetMetadata({ local, androidProfile, detection });
+    // 6-7. Parse every discovered manifest independently (module/source-set
+    // association preserved by parseAllAndroidManifests itself).
+    const manifestEntries = parseAllAndroidManifests(resolvedTargetRoot, detection);
+    const manifests = manifestEntries.map((e) => e.manifest);
+    // 8-11. Four static audits — failure isolation: each returns its own
+    // AndroidCheckResult/findings independently of the others.
+    const permissionsCheck = auditAndroidPermissions(detection, manifestEntries);
+    const componentsCheck = auditAndroidExportedComponents(detection, manifestEntries);
+    const intentFiltersCheck = auditAndroidIntentFilters(detection, manifestEntries);
+    const deepLinksCheck = auditAndroidDeepLinks(detection, manifestEntries);
+    // 12-14. Static Gradle metadata + release metadata summary.
+    const gradle = readAndroidGradleMetadata(resolvedTargetRoot, detection);
+    const gradleMetadataCheck = buildAndroidGradleMetadataCheckResult(detection, gradle);
+    const releaseMetadata = buildAndroidReleaseMetadataSummary(detection, gradle);
+    // Detection + manifest-parsing checks (required families with no prior
+    // batch owner).
+    const detectionCheck = buildAndroidDetectionCheckResult(detection);
+    const manifestParsingCheck = buildAndroidManifestParsingCheckResult(detection, manifestEntries);
+    // 15-16. Optional Gradle operations — never run unless explicitly requested.
+    const requestedOperationIds = options.requestedGradleOperationIds ?? [];
+    const gradleOperationResults = requestedOperationIds.length > 0
+        ? await runOptionalGradleValidation({
+            enabled: true,
+            targetRoot: resolvedTargetRoot,
+            detection,
+            operationIds: requestedOperationIds,
+            executor: options.gradleExecutor,
+            allowWithoutTaskDiscovery: options.allowGradleWithoutTaskDiscovery,
+            platform: options.platform,
+        })
+        : [];
+    // 17. Target mutation evidence — captured regardless of whether Gradle ran,
+    // so the static-only path also proves it made no changes.
+    const snapshotAfter = captureTargetSnapshot(resolvedTargetRoot, hasGit);
+    const targetMutation = buildTargetMutationReport(snapshotBefore, snapshotAfter);
+    const immutabilityCheck = buildAndroidTargetImmutabilityCheckResult(targetMutation);
+    // 18. Assemble checks/findings in deterministic order (agents.txt section 10.3).
+    const checks = [
+        detectionCheck,
+        manifestParsingCheck,
+        permissionsCheck,
+        componentsCheck,
+        intentFiltersCheck,
+        deepLinksCheck,
+        gradleMetadataCheck,
+        ...gradleOperationResults,
+        immutabilityCheck,
+    ];
+    const findingsById = new Map();
+    for (const check of checks) {
+        for (const finding of check.findings) {
+            // Exact-duplicate dedupe by id only (agents.txt section 10.4) —
+            // distinct manifests/components/permissions/deep-links always produce
+            // distinct ids (see androidFinding.ts's content-derived id builder),
+            // so this never collapses genuinely different evidence.
+            if (!findingsById.has(finding.id)) {
+                findingsById.set(finding.id, finding);
+            }
+        }
+    }
+    const findings = [...findingsById.values()].sort((a, b) => a.id.localeCompare(b.id));
+    const skippedChecks = checks.flatMap((c) => (c.skipInfo ? [c.skipInfo] : []));
+    const warnings = checks.flatMap((c) => c.warnings);
+    const errors = checks.flatMap((c) => c.errors);
+    const environmentLimitations = [...new Set(checks.flatMap((c) => c.environmentRequirements))];
+    // 19. Play-readiness checklist placeholders.
+    const isLibraryOnly = detection.projectKind === "library";
+    const isNonAndroid = detection.projectKind === "non-android";
+    const playReadiness = buildAndroidPlayReadinessChecklist({ isLibraryOnly, isNonAndroid, releaseMetadata, manifests });
+    // 20. Verdict.
+    const multipleApplicationModules = detection.applicationModules.length > 1;
+    const { verdict, recommendedNextStep, reasons } = calculateAndroidVerdict({
+        checks,
+        findings,
+        detection,
+        playReadiness,
+        targetMutation,
+        multipleApplicationModules,
+    });
+    const finishedAt = new Date().toISOString();
+    const durationMs = Date.now() - startedMs;
+    const { toolPackageName, toolPackageVersion } = readToolPackageMetadata(options.toolRoot);
+    return {
+        schemaVersion: ANDROID_VALIDATION_SCHEMA_VERSION,
+        artifactType: ANDROID_VALIDATION_ARTIFACT_TYPE,
+        tool: { toolRoot: path.resolve(options.toolRoot), toolPackageName, toolPackageVersion },
+        target: targetMetadata,
+        profile: androidProfile,
+        detection,
+        manifests,
+        gradle,
+        checks,
+        findings,
+        skippedChecks,
+        warnings,
+        errors,
+        releaseMetadataSummary: {
+            available: Boolean(releaseMetadata.applicationModulePath),
+            note: releaseMetadata.applicationModuleSelectionNote,
+        },
+        releaseMetadata,
+        playReadinessSummary: { available: playReadiness.applicable, note: playReadiness.note },
+        playReadiness,
+        verdict,
+        verdictReasons: reasons,
+        recommendedNextStep,
+        targetMutationEvidence: targetMutation,
+        reportReferences: [],
+        startedAt,
+        finishedAt,
+        durationMs,
+    };
+}

package/dist/src/mobile/android/validation/checkResult.js

@@ -0,0 +1,51 @@
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 1 — Android check-result and skip-representation contracts.
+//
+// Reuses SecurityFinding and CommandExecutionResult from the existing
+// security-validation types rather than duplicating a finding/command-result
+// schema. Android needs a wider status vocabulary than SecurityCheckStatus
+// ("passed"/"failed"/"skipped"/"warning") because static Android checks can
+// be genuinely inconclusive or unsupported on a given project, and
+// command-backed checks can error out before producing a verdict-relevant
+// result — none of those outcomes may ever be normalized as "passed".
+// ---------------------------------------------------------------------------
+export const ANDROID_CHECK_STATUSES = [
+    "passed",
+    "failed",
+    "skipped",
+    "inconclusive",
+    "unsupported",
+    "not-run",
+    "error",
+];
+// Statuses that must never be treated as a passing result by a verdict
+// calculator. Defined once here so later batches share one source of truth.
+export const ANDROID_NON_PASSING_STATUSES = [
+    "failed",
+    "skipped",
+    "inconclusive",
+    "unsupported",
+    "not-run",
+    "error",
+];
+// v0.4.0 Batch 3 — added "android-intent-filters" (additive) so the intent-
+// filter audit has its own category distinct from "android-components",
+// which covers exported-component evidence generally.
+// v0.4.0 Batch 5 — added "android-target-immutability" (additive) for the
+// required target mutation/immutability check (agents.txt Batch 5 section
+// 10.1).
+export const ANDROID_CHECK_CATEGORIES = [
+    "android-detection",
+    "android-manifest",
+    "android-gradle",
+    "android-permissions",
+    "android-components",
+    "android-intent-filters",
+    "android-deep-links",
+    "android-release-metadata",
+    "android-play-readiness",
+    "android-target-immutability",
+];
+export function isPassingAndroidStatus(status) {
+    return status === "passed";
+}

package/dist/src/mobile/android/validation/result.js

@@ -0,0 +1,25 @@
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 1 — Android validation result contract.
+// v0.4.0 Batch 5 — narrow additive inherited-contract corrections needed to
+// carry a real verdict and rich release/Play-readiness data (see agents.txt
+// Batch 5 section 6.6):
+//   - `verdict` widened from the single placeholder literal to
+//     `AndroidVerdictValue` (ReleaseVerdict | "not-calculated"), reusing the
+//     existing security-validation ReleaseVerdict vocabulary instead of
+//     inventing a second one (Batch 1's own comment anticipated this: "this
+//     type grows without being a breaking change — the placeholder value
+//     remains valid"). Every existing "not-calculated" literal stays valid.
+//   - `releaseMetadataSummary`/`playReadinessSummary` (the Batch 1 {available,
+//     note} placeholders) are UNCHANGED in shape — existing object literals
+//     using them remain valid — with new sibling fields `releaseMetadata`/
+//     `playReadiness` added for the actual structured data, avoiding a
+//     breaking retype of the original fields.
+//   - `verdictReasons` and `targetMutationEvidence` are new optional fields.
+// ---------------------------------------------------------------------------
+export const ANDROID_VALIDATION_SCHEMA_VERSION = "android-validation-v1";
+export const ANDROID_VALIDATION_ARTIFACT_TYPE = "android-validation-result";
+// A single placeholder value: this batch and detection/manifest/gradle
+// batches must never assert release readiness. A concrete verdict policy is
+// introduced by a later batch, at which point this type grows without being
+// a breaking change (the placeholder value remains valid).
+export const ANDROID_VERDICT_NOT_CALCULATED = "not-calculated";

package/dist/src/mobile/index.js

@@ -0,0 +1,42 @@
+export { MOBILE_PLATFORMS, MOBILE_CONFIDENCE_LEVELS, MOBILE_VALIDATION_CAPABILITIES } from "./types.js";
+export { ANDROID_PLATFORM, ANDROID_PROFILE_ID, createAndroidProfile, isAndroidProfile } from "./android/profile.js";
+export { ANDROID_PROJECT_KINDS, ANDROID_UI_TOOLKITS } from "./android/detection.js";
+export { detectAndroidProject } from "./android/detect/detectAndroidProject.js";
+export { detectAndroidTarget } from "./android/detect/androidTargetDetection.js";
+export { parseDeclaredModules } from "./android/detect/settingsModules.js";
+export { extractBuildFileEvidence } from "./android/detect/buildFileEvidence.js";
+export { extractVersionCatalogEvidence } from "./android/detect/versionCatalogEvidence.js";
+export { classifyModule, classifyModuleUiToolkit, combineProjectKind, combineProjectUiToolkit, combineProjectConfidence, } from "./android/detect/classify.js";
+export { createAndroidTargetMetadata } from "./android/targetMetadata.js";
+export { parseAndroidManifestSource, parseAndroidManifestFile, parseAllAndroidManifests, } from "./android/manifest/parseAndroidManifest.js";
+export { parseXmlDocument, findChildren, getAttribute, ANDROID_NAMESPACE_URI } from "./android/manifest/xml/parseXml.js";
+export { parseWrapperProperties } from "./android/gradle/wrapperMetadata.js";
+export { parseVersionCatalog, resolveCatalogVersion, accessorSuffixToCatalogAlias } from "./android/gradle/versionCatalogMetadata.js";
+export { extractModuleGradleMetadata } from "./android/gradle/moduleMetadataExtractor.js";
+export { resolvePluginVersion } from "./android/gradle/pluginVersionExtractor.js";
+export { parseSettingsMetadata } from "./android/gradle/settingsMetadata.js";
+export { readAndroidGradleMetadata } from "./android/gradle/readAndroidGradleMetadata.js";
+export { buildAndroidGradleMetadataCheckResult } from "./android/gradle/gradleMetadataCheckResult.js";
+export { buildAndroidReleaseMetadataSummary } from "./android/gradle/releaseMetadataSummary.js";
+export { ALLOWLISTED_OPERATION_IDS, isAllowlistedOperationId, GRADLE_OPERATIONS } from "./android/gradle/validate/operations.js";
+export { buildGradleCommandPlan } from "./android/gradle/validate/planner.js";
+export { createRealGradleCommandExecutor } from "./android/gradle/validate/executor.js";
+export { parseGradleTaskNames, isGradleTaskAvailable } from "./android/gradle/validate/taskListParser.js";
+export { buildTargetMutationReport, isExpectedAndroidGeneratedPath, captureTargetSnapshot } from "./android/gradle/validate/targetMutation.js";
+export { buildGradleOperationCheckResult } from "./android/gradle/validate/operationCheckResult.js";
+export { runOptionalGradleValidation } from "./android/gradle/validate/runOptionalGradleValidation.js";
+export { ANDROID_CHECK_STATUSES, ANDROID_NON_PASSING_STATUSES, ANDROID_CHECK_CATEGORIES, isPassingAndroidStatus, } from "./android/validation/checkResult.js";
+export { ANDROID_VALIDATION_SCHEMA_VERSION, ANDROID_VALIDATION_ARTIFACT_TYPE, ANDROID_VERDICT_NOT_CALCULATED, } from "./android/validation/result.js";
+export { toAndroidReportModel, serializeAndroidReportModel } from "./android/report/model.js";
+export { renderAndroidTextReport } from "./android/report/renderAndroidReport.js";
+export { writeAndroidReportFiles } from "./android/report/writeAndroidReportFiles.js";
+export { makeAndroidFinding } from "./android/audit/androidFinding.js";
+export { buildAndroidManifestCheckResult } from "./android/audit/checkResultBuilder.js";
+export { auditAndroidPermissions } from "./android/audit/permissionAudit.js";
+export { auditAndroidExportedComponents } from "./android/audit/exportedComponentAudit.js";
+export { auditAndroidIntentFilters } from "./android/audit/intentFilterAudit.js";
+export { auditAndroidDeepLinks } from "./android/audit/deepLinkAudit.js";
+export { ANDROID_PLAY_READINESS_ITEM_STATUSES, buildAndroidPlayReadinessChecklist } from "./android/validate/playReadinessChecklist.js";
+export { calculateAndroidVerdict, androidVerdictToHumanLabel } from "./android/validate/androidVerdict.js";
+export { buildAndroidDetectionCheckResult, buildAndroidManifestParsingCheckResult, buildAndroidTargetImmutabilityCheckResult, } from "./android/validate/detectionAndImmutabilityCheckResults.js";
+export { validateAndroidTarget } from "./android/validate/validateAndroidTarget.js";

package/dist/src/mobile/types.js

@@ -0,0 +1,27 @@
+// Shared mobile-platform contracts for my-dev-kit-lab's mobile/Android
+// validation substrate (v0.4.0 Batch 1).
+//
+// Android is the only implemented platform. Additional platform ids may be
+// added to MOBILE_PLATFORMS in a future version once real detection and
+// validation exist for them — this file must never claim support for a
+// platform that has no implementation behind it.
+export const MOBILE_PLATFORMS = ["android"];
+// Confidence in a detection/classification/evidence claim. "unknown" is used
+// when confidence itself could not be determined (distinct from "low", which
+// asserts a deliberately weak but present signal).
+export const MOBILE_CONFIDENCE_LEVELS = ["unknown", "low", "medium", "high"];
+// Validation capabilities a profile can declare support for. This batch only
+// defines the vocabulary; no capability is exercised until its owning batch
+// implements it. Capabilities are declarative metadata, not proof of
+// execution — a profile listing a capability does not mean a check ran.
+export const MOBILE_VALIDATION_CAPABILITIES = [
+    "static-detection",
+    "manifest-analysis",
+    "gradle-metadata",
+    "gradle-task-execution",
+    "permission-audit",
+    "component-audit",
+    "deep-link-audit",
+    "release-metadata-summary",
+    "play-readiness-checklist",
+];

package/dist/src/securityValidation/attackScenarios/attackProfile.js

@@ -2,10 +2,12 @@ import { SECURITY_PROFILE_IDS } from "../validate/cliOptions.js";
 import { NODE_CLI_PACKAGE_PROFILE } from "./profiles/nodeCliPackageProfile.js";
 import { LOCAL_TOOL_PROFILE } from "./profiles/localToolProfile.js";
 import { NPM_PACKAGE_PROFILE } from "./profiles/npmPackageProfile.js";
+import { ANDROID_PROFILE } from "./profiles/androidProfile.js";
 const PROFILE_REGISTRY = {
     "node-cli-package": NODE_CLI_PACKAGE_PROFILE,
     "local-tool": LOCAL_TOOL_PROFILE,
     "npm-package": NPM_PACKAGE_PROFILE,
+    android: ANDROID_PROFILE,
 };
 // Resolves a profile id to its definition. Throws a clean, descriptive Error
 // for unknown ids (mirrors Batch 1's --profile validation error style).