@dailephd/my-dev-kit-lab 0.3.4 → 0.4.0

package/dist/src/mobile/android/audit/intentFilterAudit.js

@@ -0,0 +1,128 @@
+import { makeAndroidFinding } from "./androidFinding.js";
+import { buildAndroidManifestCheckResult } from "./checkResultBuilder.js";
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 3 — initial intent-filter audit.
+//
+// Distinct lens from the exported-component audit (agents.txt Batch 3
+// section 7.15): this audit does not repeat "is this exported and
+// unprotected" — it looks at the intent-filter *contents* themselves:
+// duplicate/malformed filter data, and custom (non-platform) actions on a
+// component that is reachable (explicitly exported, or unspecified-exported
+// with a filter). A standard MAIN/LAUNCHER filter is never flagged — that is
+// the required negative control (ANDROID-B3-22).
+// ---------------------------------------------------------------------------
+const STANDARD_ACTION_PREFIX = "android.intent.action.";
+const STANDARD_CATEGORY_PREFIX = "android.intent.category.";
+function isReachable(component) {
+    return component.exported === true || (component.exported === undefined && component.exportedRaw === undefined && component.intentFilters.length > 0);
+}
+function hasDuplicates(values) {
+    return new Set(values).size !== values.length;
+}
+function auditFilter(entry, kind, component, filter, findings) {
+    const identity = component.name || "(unnamed component)";
+    const actions = filter.actions ?? [];
+    const categories = filter.categories ?? [];
+    const dataElements = filter.dataElements ?? filter.filterData;
+    if (actions.length === 0 && dataElements.length === 0) {
+        findings.push(makeAndroidFinding({
+            ruleId: "android-intent-filter-empty-or-malformed",
+            title: `Empty or malformed <intent-filter> on ${kind} "${identity}"`,
+            severity: "informational",
+            confidence: "medium",
+            description: "This <intent-filter> declares no actions and no data elements, so it cannot match any implicit intent.",
+            manifestPath: entry.manifestPath,
+            identity,
+            location: filter.location,
+            evidenceDetails: [`kind=${kind}`],
+        }));
+        return;
+    }
+    if (hasDuplicates(actions) || hasDuplicates(categories)) {
+        findings.push(makeAndroidFinding({
+            ruleId: "android-intent-filter-duplicate-entries",
+            title: `Duplicate action/category entries in an <intent-filter> on ${kind} "${identity}"`,
+            severity: "informational",
+            confidence: "high",
+            description: "This <intent-filter> declares the same <action> or <category> more than once, which has no additional effect and may indicate a copy/paste mistake.",
+            manifestPath: entry.manifestPath,
+            identity,
+            location: filter.location,
+            evidenceDetails: [`actions=${actions.join(",")}`, `categories=${categories.join(",")}`],
+        }));
+    }
+    const isStandardLauncherFilter = actions.length === 1 &&
+        actions[0] === "android.intent.action.MAIN" &&
+        categories.every((c) => c === "android.intent.category.LAUNCHER" || c === "android.intent.category.DEFAULT");
+    if (isStandardLauncherFilter) {
+        // Negative control: a standard launcher entry point is expected and
+        // must not itself be reported as a finding (ANDROID-B3-22).
+        return;
+    }
+    const customActions = actions.filter((action) => !action.startsWith(STANDARD_ACTION_PREFIX));
+    if (customActions.length > 0 && isReachable(component)) {
+        findings.push(makeAndroidFinding({
+            ruleId: "android-intent-filter-custom-action-reachable",
+            title: `Custom action on a potentially reachable ${kind} "${identity}"`,
+            severity: "minor",
+            confidence: component.exported === true ? "high" : "medium",
+            description: `This <intent-filter> declares a custom (non-platform) action (${customActions.join(", ")}) on a component whose exported state is ${component.exported === true ? "explicitly true" : "unspecified with an intent filter present"}. Custom actions on reachable components broaden the app's externally triggerable surface and are worth reviewing, though the action name alone does not prove exploitability.`,
+            manifestPath: entry.manifestPath,
+            identity,
+            location: filter.location,
+            evidenceDetails: [`customActions=${customActions.join(",")}`, `exported=${component.exported ?? "unspecified"}`, `hasComponentPermission=${Boolean(component.permission)}`],
+            recommendation: "Confirm this custom action needs to be externally reachable, and add permission protection if not.",
+        }));
+    }
+    const unrecognizedCategories = categories.filter((c) => !c.startsWith(STANDARD_CATEGORY_PREFIX));
+    if (unrecognizedCategories.length > 0) {
+        findings.push(makeAndroidFinding({
+            ruleId: "android-intent-filter-non-standard-category",
+            title: `Non-standard intent-filter category on ${kind} "${identity}"`,
+            severity: "informational",
+            confidence: "medium",
+            description: `This <intent-filter> declares a category outside the standard android.intent.category.* namespace (${unrecognizedCategories.join(", ")}).`,
+            manifestPath: entry.manifestPath,
+            identity,
+            location: filter.location,
+            evidenceDetails: [`categories=${unrecognizedCategories.join(",")}`],
+        }));
+    }
+}
+function componentGroups(manifest) {
+    return [
+        { kind: "activity", components: manifest.activities },
+        { kind: "activity-alias", components: manifest.activityAliases ?? [] },
+        { kind: "service", components: manifest.services },
+        { kind: "receiver", components: manifest.receivers },
+    ];
+}
+export function auditAndroidIntentFilters(detection, manifests) {
+    const findings = [];
+    const evidence = [];
+    const warnings = [];
+    for (const entry of manifests) {
+        let filterCount = 0;
+        for (const group of componentGroups(entry.manifest)) {
+            for (const component of group.components) {
+                for (const filter of component.intentFilters) {
+                    filterCount += 1;
+                    auditFilter(entry, group.kind, component, filter, findings);
+                }
+            }
+        }
+        if (filterCount > 0) {
+            evidence.push(`${entry.manifestPath}: ${filterCount} intent-filter(s) inspected`);
+        }
+    }
+    return buildAndroidManifestCheckResult({
+        id: "android-intent-filters-audit",
+        category: "android-intent-filters",
+        title: "Android intent-filter audit",
+        detection,
+        manifests,
+        findings,
+        evidence,
+        warnings,
+    });
+}

package/dist/src/mobile/android/audit/permissionAudit.js

@@ -0,0 +1,142 @@
+import { makeAndroidFinding } from "./androidFinding.js";
+import { buildAndroidManifestCheckResult } from "./checkResultBuilder.js";
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 3 — initial Android permission audit.
+//
+// Conservative by design (agents.txt Batch 3 section 7.13): a declared
+// permission is not automatically a vulnerability. Ordinary connectivity
+// permissions (INTERNET etc.) never produce a finding. Recognized sensitive
+// permission groups produce a "minor" (review-required) finding. Unknown/
+// custom permissions produce an "informational" review finding. The only
+// escalation is foreground + background location declared together, which
+// still stays at "minor" (a legitimate, common pattern — not proof of
+// misuse).
+// ---------------------------------------------------------------------------
+const LOW_RISK_PERMISSIONS = new Set([
+    "android.permission.INTERNET",
+    "android.permission.ACCESS_NETWORK_STATE",
+    "android.permission.ACCESS_WIFI_STATE",
+    "android.permission.VIBRATE",
+    "android.permission.WAKE_LOCK",
+    "android.permission.RECEIVE_BOOT_COMPLETED",
+]);
+const SENSITIVE_PERMISSION_GROUPS = {
+    "android.permission.ACCESS_FINE_LOCATION": "location",
+    "android.permission.ACCESS_COARSE_LOCATION": "location",
+    "android.permission.ACCESS_BACKGROUND_LOCATION": "background-location",
+    "android.permission.CAMERA": "camera",
+    "android.permission.RECORD_AUDIO": "microphone",
+    "android.permission.READ_CONTACTS": "contacts",
+    "android.permission.WRITE_CONTACTS": "contacts",
+    "android.permission.GET_ACCOUNTS": "contacts",
+    "android.permission.READ_CALENDAR": "calendar",
+    "android.permission.WRITE_CALENDAR": "calendar",
+    "android.permission.SEND_SMS": "sms",
+    "android.permission.READ_SMS": "sms",
+    "android.permission.RECEIVE_SMS": "sms",
+    "android.permission.RECEIVE_MMS": "sms",
+    "android.permission.READ_CALL_LOG": "call-log",
+    "android.permission.WRITE_CALL_LOG": "call-log",
+    "android.permission.PROCESS_OUTGOING_CALLS": "call-log",
+    "android.permission.READ_PHONE_STATE": "phone",
+    "android.permission.CALL_PHONE": "phone",
+    "android.permission.BLUETOOTH_CONNECT": "nearby-devices",
+    "android.permission.BLUETOOTH_SCAN": "nearby-devices",
+    "android.permission.BLUETOOTH_ADVERTISE": "nearby-devices",
+    "android.permission.NEARBY_WIFI_DEVICES": "nearby-devices",
+    "android.permission.READ_EXTERNAL_STORAGE": "storage-legacy",
+    "android.permission.WRITE_EXTERNAL_STORAGE": "storage-legacy",
+    "android.permission.MANAGE_EXTERNAL_STORAGE": "storage-legacy",
+    "android.permission.READ_MEDIA_IMAGES": "media",
+    "android.permission.READ_MEDIA_VIDEO": "media",
+    "android.permission.READ_MEDIA_AUDIO": "media",
+    "android.permission.POST_NOTIFICATIONS": "notifications",
+    "android.permission.BODY_SENSORS": "body-sensors",
+    "android.permission.BODY_SENSORS_BACKGROUND": "body-sensors",
+    "android.permission.ACTIVITY_RECOGNITION": "activity-recognition",
+    "android.permission.FOREGROUND_SERVICE": "foreground-service",
+    "android.permission.REQUEST_INSTALL_PACKAGES": "package-install",
+    "android.permission.QUERY_ALL_PACKAGES": "package-visibility",
+};
+export function auditAndroidPermissions(detection, manifests) {
+    const findings = [];
+    const evidence = [];
+    const warnings = [];
+    for (const entry of manifests) {
+        const declaredNames = new Set(entry.manifest.permissions.map((p) => p.name));
+        const seen = new Set();
+        for (const permission of entry.manifest.permissions) {
+            if (seen.has(permission.name))
+                continue;
+            seen.add(permission.name);
+            if (LOW_RISK_PERMISSIONS.has(permission.name)) {
+                continue;
+            }
+            const group = SENSITIVE_PERMISSION_GROUPS[permission.name];
+            const duplicateCount = entry.manifest.permissions.filter((p) => p.name === permission.name).length;
+            const duplicateNote = duplicateCount > 1 ? [`declared ${duplicateCount} times (deduplicated for this finding)`] : [];
+            if (group === "background-location") {
+                const hasForeground = declaredNames.has("android.permission.ACCESS_FINE_LOCATION") || declaredNames.has("android.permission.ACCESS_COARSE_LOCATION");
+                findings.push(makeAndroidFinding({
+                    ruleId: hasForeground ? "android-permission-background-and-foreground-location" : "android-permission-sensitive",
+                    title: hasForeground
+                        ? "Background location declared alongside foreground location"
+                        : `Sensitive permission declared: ${permission.name}`,
+                    severity: "minor",
+                    confidence: "high",
+                    description: hasForeground
+                        ? "The manifest declares ACCESS_BACKGROUND_LOCATION together with a foreground location permission. This is a common, legitimate pattern, but background location access typically requires explicit justification for store review."
+                        : `The manifest declares the sensitive permission ${permission.name} (group: ${group}). This is not automatically a vulnerability; review that the app's functionality justifies the request.`,
+                    manifestPath: entry.manifestPath,
+                    identity: permission.name,
+                    location: permission.location,
+                    evidenceDetails: [`sourceElement=${permission.sourceElement ?? "uses-permission"}`, `group=${group}`, ...duplicateNote],
+                    recommendation: "Confirm the permission is required for a real user-facing feature and document the justification.",
+                }));
+                continue;
+            }
+            if (group) {
+                findings.push(makeAndroidFinding({
+                    ruleId: "android-permission-sensitive",
+                    title: `Sensitive permission declared: ${permission.name}`,
+                    severity: "minor",
+                    confidence: "high",
+                    description: `The manifest declares the sensitive permission ${permission.name} (group: ${group}). This is not automatically a vulnerability; review that the app's functionality justifies the request.`,
+                    manifestPath: entry.manifestPath,
+                    identity: permission.name,
+                    location: permission.location,
+                    evidenceDetails: [`sourceElement=${permission.sourceElement ?? "uses-permission"}`, `group=${group}`, ...duplicateNote],
+                    recommendation: "Confirm the permission is required for a real user-facing feature and document the justification.",
+                }));
+                continue;
+            }
+            if (!permission.name.startsWith("android.permission.")) {
+                findings.push(makeAndroidFinding({
+                    ruleId: "android-permission-unknown-custom",
+                    title: `Unknown custom permission declared: ${permission.name}`,
+                    severity: "informational",
+                    confidence: "high",
+                    description: `The manifest declares a custom permission "${permission.name}" that is not a recognized platform permission. This is not automatically dangerous; review its purpose and, if it protects app components, whether its protectionLevel is appropriate.`,
+                    manifestPath: entry.manifestPath,
+                    identity: permission.name,
+                    location: permission.location,
+                    evidenceDetails: [`sourceElement=${permission.sourceElement ?? "uses-permission"}`, ...duplicateNote],
+                    recommendation: "Review the custom permission's purpose and protection level.",
+                }));
+            }
+        }
+        if (entry.manifest.permissions.length > 0) {
+            evidence.push(`${entry.manifestPath}: ${entry.manifest.permissions.length} permission declaration(s) inspected`);
+        }
+    }
+    return buildAndroidManifestCheckResult({
+        id: "android-permissions-audit",
+        category: "android-permissions",
+        title: "Android permission audit",
+        detection,
+        manifests,
+        findings,
+        evidence,
+        warnings,
+    });
+}

package/dist/src/mobile/android/detect/androidTargetDetection.js

@@ -0,0 +1,18 @@
+import { createAndroidProfile } from "../profile.js";
+import { createAndroidTargetMetadata } from "../targetMetadata.js";
+import { detectAndroidProject } from "./detectAndroidProject.js";
+export function detectAndroidTarget(local) {
+    const detection = detectAndroidProject(local.targetRoot);
+    const androidProfile = createAndroidProfile({
+        detectionConfidence: detection.confidence,
+        evidence: detection.evidence,
+        unsupportedNotes: detection.warnings,
+        projectType: detection.projectKind,
+        projectSubtype: detection.uiToolkit,
+        supportedCapabilities: ["static-detection"],
+    });
+    return {
+        detection,
+        target: createAndroidTargetMetadata({ local, androidProfile, detection }),
+    };
+}

package/dist/src/mobile/android/detect/buildFileEvidence.js

@@ -0,0 +1,36 @@
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 2 — bounded, deterministic build.gradle(.kts) evidence
+// extraction.
+//
+// Extracts only the lexical signals needed for detection and classification
+// (plugin ids, namespace, applicationId, Compose build-feature/dependency
+// evidence). This is not a Gradle metadata parser (that is Batch 4's scope):
+// values that cannot be statically read as a literal are preserved as
+// "unresolved" evidence rather than guessed.
+// ---------------------------------------------------------------------------
+const ANDROID_APPLICATION_PLUGIN_PATTERN = /(['"`])com\.android\.application\1|id\s*\(\s*['"`]com\.android\.application['"`]\s*\)/;
+const ANDROID_LIBRARY_PLUGIN_PATTERN = /(['"`])com\.android\.library\1|id\s*\(\s*['"`]com\.android\.library['"`]\s*\)/;
+const KOTLIN_ANDROID_PLUGIN_PATTERN = /(['"`])org\.jetbrains\.kotlin\.android\1|kotlin\s*\(\s*['"`]android['"`]\s*\)|(['"`])kotlin-android\2/;
+const NAMESPACE_LITERAL_PATTERN = /\bnamespace\s*[=]?\s*['"]([^'"]+)['"]/;
+const NAMESPACE_UNRESOLVED_PATTERN = /\bnamespace\s*[=]?\s*(?!['"])[^\s\n]/;
+const APPLICATION_ID_LITERAL_PATTERN = /\bapplicationId\s*[=]?\s*['"]([^'"]+)['"]/;
+const APPLICATION_ID_UNRESOLVED_PATTERN = /\bapplicationId\s*[=]?\s*(?!['"])[^\s\n]/;
+const COMPOSE_BUILD_FEATURE_PATTERN = /\bcompose\s*[=]?\s*true\b/;
+const COMPOSE_DEPENDENCY_PATTERN = /androidx\.compose|compose-bom|compose\.(?:ui|material|material3|runtime|foundation)/;
+const COMPOSE_PLUGIN_PATTERN = /org\.jetbrains\.kotlin\.plugin\.compose|com\.android\.compose|compose-compiler/;
+export function extractBuildFileEvidence(text) {
+    const namespaceLiteral = text.match(NAMESPACE_LITERAL_PATTERN);
+    const applicationIdLiteral = text.match(APPLICATION_ID_LITERAL_PATTERN);
+    return {
+        androidApplicationPlugin: ANDROID_APPLICATION_PLUGIN_PATTERN.test(text),
+        androidLibraryPlugin: ANDROID_LIBRARY_PLUGIN_PATTERN.test(text),
+        kotlinAndroidPlugin: KOTLIN_ANDROID_PLUGIN_PATTERN.test(text),
+        namespace: namespaceLiteral?.[1],
+        namespaceUnresolved: !namespaceLiteral && NAMESPACE_UNRESOLVED_PATTERN.test(text),
+        applicationId: applicationIdLiteral?.[1],
+        applicationIdUnresolved: !applicationIdLiteral && APPLICATION_ID_UNRESOLVED_PATTERN.test(text),
+        composeBuildFeatureEvidence: COMPOSE_BUILD_FEATURE_PATTERN.test(text),
+        composeDependencyEvidence: COMPOSE_DEPENDENCY_PATTERN.test(text),
+        composePluginEvidence: COMPOSE_PLUGIN_PATTERN.test(text),
+    };
+}

package/dist/src/mobile/android/detect/classify.js

@@ -0,0 +1,150 @@
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 2 — deterministic, evidence-based classification policy.
+//
+// Pure functions only (no filesystem access) so the confidence/classification
+// policy can be unit tested independently of traversal. See agents.txt Batch
+// 2 section 7.4 for the evidence-strength tiers this implements:
+//   - Strong: an Android plugin id, or namespace/applicationId combined with
+//     an Android plugin, or a manifest inside an Android-style source set.
+//   - Supporting: source roots, res/, androidTest, wrapper, settings files,
+//     catalog aliases, Compose dependencies.
+//   - Weak: generic Gradle/Kotlin/Java files or directory names alone.
+// A project must never be confirmed Android from weak evidence alone.
+// ---------------------------------------------------------------------------
+const CONFIDENCE_RANK = { unknown: 0, low: 1, medium: 2, high: 3 };
+export function maxConfidence(a, b) {
+    return CONFIDENCE_RANK[a] >= CONFIDENCE_RANK[b] ? a : b;
+}
+function capConfidence(confidence, cap) {
+    return CONFIDENCE_RANK[confidence] <= CONFIDENCE_RANK[cap] ? confidence : cap;
+}
+// Classifies a single Gradle module from its collected static evidence.
+// Directory naming (e.g. a module literally called "app") is never used as a
+// signal — only plugin declarations, manifest presence, and Android-specific
+// identifiers.
+export function classifyModule(input) {
+    const evidence = [];
+    if (input.hasAndroidApplicationPlugin) {
+        evidence.push("com.android.application plugin declared");
+        const strongCombo = input.hasManifest || Boolean(input.namespace) || Boolean(input.applicationId);
+        if (input.hasManifest)
+            evidence.push("AndroidManifest.xml present in module source set");
+        if (input.namespace)
+            evidence.push(`namespace = "${input.namespace}"`);
+        if (input.applicationId)
+            evidence.push(`applicationId = "${input.applicationId}"`);
+        return { kind: "application", confidence: strongCombo ? "high" : "medium", evidence };
+    }
+    if (input.hasAndroidLibraryPlugin) {
+        evidence.push("com.android.library plugin declared");
+        const strongCombo = input.hasManifest || Boolean(input.namespace);
+        if (input.hasManifest)
+            evidence.push("AndroidManifest.xml present in module source set");
+        if (input.namespace)
+            evidence.push(`namespace = "${input.namespace}"`);
+        return { kind: "library", confidence: strongCombo ? "high" : "medium", evidence };
+    }
+    if (input.hasCatalogAndroidPluginAliasEvidence) {
+        evidence.push("version-catalog plugin alias referencing an Android Gradle Plugin entry");
+        return { kind: "unknown", confidence: "medium", evidence };
+    }
+    // Generic Java/Kotlin source roots are deliberately excluded from this
+    // list: they exist in any JVM project and are not Android-specific, so
+    // they must never by themselves push a module toward Android detection
+    // (agents.txt Batch 2 section 12.4 — generic Gradle/Kotlin/Java evidence
+    // must not trigger Android detection without Android-specific evidence).
+    const weakSignals = [];
+    if (input.hasManifest)
+        weakSignals.push("AndroidManifest.xml present without a resolved Android plugin");
+    if (input.namespace)
+        weakSignals.push(`namespace = "${input.namespace}" without a resolved Android plugin`);
+    if (input.applicationId)
+        weakSignals.push(`applicationId = "${input.applicationId}" without a resolved Android plugin`);
+    if (input.hasResDir)
+        weakSignals.push("res/ directory present");
+    if (weakSignals.length > 0) {
+        evidence.push(...weakSignals);
+        return { kind: "unknown", confidence: "low", evidence };
+    }
+    if (input.hasGenericBuildFile) {
+        evidence.push("Gradle build file present with no Android-specific evidence");
+        return { kind: "non-android", confidence: "medium", evidence };
+    }
+    return { kind: "unknown", confidence: "unknown", evidence: [] };
+}
+// Classifies UI toolkit usage for a single module. Conservative by design:
+// Kotlin usage alone never implies Compose, and res/ alone never implies
+// XML/View classification beyond what's asserted here (a literal layout
+// resource file, not merely a res/ directory).
+export function classifyModuleUiToolkit(input) {
+    const evidence = [];
+    const strongCompose = input.composeBuildFeatureEvidence || input.composeDependencyEvidence || input.composeSourceEvidence;
+    const strongView = input.hasResLayout;
+    if (input.composeBuildFeatureEvidence)
+        evidence.push("buildFeatures { compose = true }");
+    if (input.composeDependencyEvidence)
+        evidence.push("Compose dependency evidence in build file");
+    if (input.composeSourceEvidence)
+        evidence.push("@Composable/androidx.compose import evidence in source");
+    if (input.composePluginEvidence)
+        evidence.push("Compose compiler plugin evidence");
+    if (input.hasResLayout)
+        evidence.push("res/layout XML resource present");
+    if (input.viewSourceEvidence)
+        evidence.push("traditional Android View usage evidence in source");
+    if (strongCompose && strongView) {
+        return { uiToolkit: "mixed", evidence };
+    }
+    if (strongCompose) {
+        return { uiToolkit: "compose", evidence };
+    }
+    if (strongView) {
+        return { uiToolkit: "xml-view", evidence };
+    }
+    return { uiToolkit: "uncertain", evidence };
+}
+// Combines per-module kinds into the overall project-level classification.
+// Uses the widened ANDROID_PROJECT_KINDS vocabulary (see detection.ts) — a
+// project with both application and library modules is "mixed"; more than
+// one Android module of the same kind is "multi-module"; a single confirmed
+// module keeps its own kind; Android-ish-but-unresolved evidence with no
+// confirmed module is "partial"; nothing at all is "non-android".
+export function combineProjectKind(modules, hasUnresolvedAndroidEvidence) {
+    const applicationCount = modules.filter((module) => module.kind === "application").length;
+    const libraryCount = modules.filter((module) => module.kind === "library").length;
+    const unknownCount = modules.filter((module) => module.kind === "unknown").length;
+    if (applicationCount >= 1 && libraryCount >= 1)
+        return "mixed";
+    if (applicationCount + libraryCount > 1)
+        return "multi-module";
+    if (applicationCount === 1)
+        return "application";
+    if (libraryCount === 1)
+        return "library";
+    if (unknownCount > 0 || hasUnresolvedAndroidEvidence)
+        return "partial";
+    return "non-android";
+}
+export function combineProjectUiToolkit(modules) {
+    const androidModules = modules.filter((module) => module.kind === "application" || module.kind === "library");
+    const composeCount = androidModules.filter((module) => module.uiToolkit === "compose").length;
+    const viewCount = androidModules.filter((module) => module.uiToolkit === "xml-view").length;
+    const mixedCount = androidModules.filter((module) => module.uiToolkit === "mixed").length;
+    if (mixedCount > 0 || (composeCount > 0 && viewCount > 0))
+        return "mixed";
+    if (composeCount > 0)
+        return "compose";
+    if (viewCount > 0)
+        return "xml-view";
+    return "uncertain";
+}
+export function combineProjectConfidence(projectKind, moduleConfidences, hasNonAndroidEvidenceOnly) {
+    if (projectKind === "non-android") {
+        return hasNonAndroidEvidenceOnly ? "high" : "unknown";
+    }
+    const strongest = moduleConfidences.reduce((acc, confidence) => maxConfidence(acc, confidence), "unknown");
+    if (projectKind === "partial") {
+        return capConfidence(strongest, "medium");
+    }
+    return strongest;
+}