@dailephd/my-dev-kit-lab 0.3.4 → 0.4.0

package/dist/src/mobile/android/gradle/validate/operationCheckResult.js

@@ -0,0 +1,99 @@
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 4 — per-operation Gradle validation check-result construction
+// (agents.txt Batch 4 section 7.26).
+//
+// Status semantics differ slightly by operation:
+//   - wrapper-version: nonzero/spawn-failure -> "error" (this is the
+//     simplest possible invocation; a failure here is an orchestration
+//     problem, not a build/environment nuance).
+//   - tasks: nonzero/spawn-failure -> "inconclusive" (configuration or
+//     environment prevented task discovery, not a security-relevant
+//     failure).
+//   - assemble-debug / unit-test-debug / lint-debug: spawn-failure ->
+//     "inconclusive" (environment incomplete); nonzero exit with a real
+//     process result -> "failed" (a genuine build/test/lint failure is
+//     validation evidence, never a fabricated SecurityFinding — section
+//     7.27).
+// A timed-out operation is always "inconclusive", never "passed" or
+// silently "error" (section 7.22).
+// ---------------------------------------------------------------------------
+const MAX_OUTPUT_SUMMARY_LENGTH = 4000;
+function boundedSummary(text) {
+    if (text.length <= MAX_OUTPUT_SUMMARY_LENGTH)
+        return { summary: text, truncated: false };
+    return { summary: text.slice(0, MAX_OUTPUT_SUMMARY_LENGTH), truncated: true };
+}
+function statusForResult(operationId, result) {
+    if (result.timedOut)
+        return "inconclusive";
+    if (result.exitCode === null) {
+        return operationId === "wrapper-version" ? "error" : "inconclusive";
+    }
+    if (result.exitCode === 0)
+        return "passed";
+    if (operationId === "wrapper-version")
+        return "error";
+    if (operationId === "tasks")
+        return "inconclusive";
+    return "failed";
+}
+function confidenceForStatus(status) {
+    switch (status) {
+        case "passed":
+        case "failed":
+            return "high";
+        case "inconclusive":
+            return "medium";
+        default:
+            return "unknown";
+    }
+}
+export function buildGradleOperationCheckResult(plan, result, mutation) {
+    const status = statusForResult(plan.operationId, result);
+    const confidence = confidenceForStatus(status);
+    const stdoutBound = boundedSummary(result.stdout);
+    const stderrBound = boundedSummary(result.stderr);
+    const warnings = [];
+    if (result.timedOut)
+        warnings.push(`Operation timed out after ${plan.timeoutMs}ms.`);
+    if (result.exitCode === null && !result.timedOut)
+        warnings.push("Command could not be spawned or resolved (see stderr evidence).");
+    if (stdoutBound.truncated)
+        warnings.push("stdout was truncated for this result.");
+    if (stderrBound.truncated)
+        warnings.push("stderr was truncated for this result.");
+    if (!mutation.comparable)
+        warnings.push(`Target mutation evidence unavailable: ${mutation.reason ?? "unknown reason"}`);
+    if (mutation.unexpectedChanges.length > 0) {
+        warnings.push(`Unexpected target change(s) observed after this operation: ${mutation.unexpectedChanges.join(", ")}`);
+    }
+    const boundedCommand = {
+        ...result,
+        stdout: stdoutBound.summary,
+        stderr: stderrBound.summary,
+    };
+    return {
+        id: `android-gradle-${plan.operationId}`,
+        category: "android-gradle",
+        title: `Gradle operation: ${plan.operationId}`,
+        status,
+        requirementLevel: "optional",
+        ran: true,
+        skipped: false,
+        evidence: [
+            `exitCode=${result.exitCode ?? "null"}`,
+            `durationMs=${result.durationMs}`,
+            `expectedGeneratedPaths=${plan.expectedGeneratedPaths.join(",") || "(none)"}`,
+            ...mutation.expectedGeneratedChanges.map((p) => `generatedOutput=${p}`),
+        ],
+        findings: [],
+        warnings,
+        errors: result.exitCode === null && !result.timedOut ? [stderrBound.summary || "Command could not be spawned or resolved."] : [],
+        durationMs: result.durationMs,
+        command: boundedCommand,
+        sourcePaths: [plan.wrapperExecutablePath],
+        confidence,
+        environmentRequirements: plan.environmentLimitations,
+        targetModificationObserved: mutation.comparable ? mutation.unexpectedChanges.length > 0 : undefined,
+    };
+}

package/dist/src/mobile/android/gradle/validate/operations.js

@@ -0,0 +1,68 @@
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 4 — allowlisted optional Gradle validation operations
+// (agents.txt Batch 4 section 7.17).
+//
+// This is the ONLY place operation-to-argument mappings are defined. The
+// planner (planner.ts) rejects any operation id not in ALLOWLISTED_OPERATION_IDS
+// before a command is ever constructed — arbitrary task strings are never
+// accepted from a caller.
+// ---------------------------------------------------------------------------
+export const ALLOWLISTED_OPERATION_IDS = ["wrapper-version", "tasks", "assemble-debug", "unit-test-debug", "lint-debug"];
+export function isAllowlistedOperationId(value) {
+    return ALLOWLISTED_OPERATION_IDS.includes(value);
+}
+// Conservative, bounded timeouts (agents.txt section 7.22). No retries, no
+// unbounded execution — a timed-out operation is terminated and reported
+// inconclusive/error, never passed.
+const SHORT_TIMEOUT_MS = 30_000;
+const MODERATE_TIMEOUT_MS = 120_000;
+const LONG_TIMEOUT_MS = 600_000;
+// Safety flags applied to every operation: --no-daemon avoids leaving a
+// background Gradle daemon running after this process exits, --console=plain
+// keeps output parseable, and --offline prevents this batch from
+// intentionally triggering network access (agents.txt section 7.18) — the
+// tradeoff is that operations needing uncached dependencies will fail or
+// report inconclusive rather than silently downloading them.
+const SAFETY_FLAGS = ["--no-daemon", "--console=plain"];
+const OFFLINE_SAFETY_FLAGS = [...SAFETY_FLAGS, "--offline"];
+export const GRADLE_OPERATIONS = {
+    "wrapper-version": {
+        id: "wrapper-version",
+        args: ["--version"],
+        timeoutMs: SHORT_TIMEOUT_MS,
+        mayCreateBuildOutputs: true, // Gradle creates/updates .gradle/ on first invocation.
+        description: "Reports the Gradle version the wrapper would use, without building anything.",
+    },
+    tasks: {
+        id: "tasks",
+        gradleTaskName: "tasks",
+        args: ["tasks", "--all", ...OFFLINE_SAFETY_FLAGS],
+        timeoutMs: MODERATE_TIMEOUT_MS,
+        mayCreateBuildOutputs: true,
+        description: "Lists available Gradle tasks so later operations can be skipped safely when unavailable.",
+    },
+    "assemble-debug": {
+        id: "assemble-debug",
+        gradleTaskName: "assembleDebug",
+        args: ["assembleDebug", ...OFFLINE_SAFETY_FLAGS],
+        timeoutMs: LONG_TIMEOUT_MS,
+        mayCreateBuildOutputs: true,
+        description: "Assembles the debug variant (no signing, no release build, no publishing).",
+    },
+    "unit-test-debug": {
+        id: "unit-test-debug",
+        gradleTaskName: "testDebugUnitTest",
+        args: ["testDebugUnitTest", ...OFFLINE_SAFETY_FLAGS],
+        timeoutMs: LONG_TIMEOUT_MS,
+        mayCreateBuildOutputs: true,
+        description: "Runs local (non-instrumented) debug unit tests.",
+    },
+    "lint-debug": {
+        id: "lint-debug",
+        gradleTaskName: "lintDebug",
+        args: ["lintDebug", ...OFFLINE_SAFETY_FLAGS],
+        timeoutMs: LONG_TIMEOUT_MS,
+        mayCreateBuildOutputs: true,
+        description: "Runs Android Lint for the debug variant. Lint output is not parsed into security findings in this batch.",
+    },
+};

package/dist/src/mobile/android/gradle/validate/planner.js

@@ -0,0 +1,49 @@
+import fs from "node:fs";
+import path from "node:path";
+import { resolveWithinRoot } from "../../../../core/pathSafety.js";
+import { GRADLE_OPERATIONS, isAllowlistedOperationId } from "./operations.js";
+function wrapperScriptNameForPlatform(platform) {
+    return platform === "win32" ? "gradlew.bat" : "gradlew";
+}
+export function buildGradleCommandPlan(operationId, targetRoot, detection, platform = process.platform) {
+    if (!isAllowlistedOperationId(operationId)) {
+        return { rejected: true, reason: `Unknown or unsupported Gradle operation id: "${operationId}". Only allowlisted operations may be planned.` };
+    }
+    const resolvedRoot = path.resolve(targetRoot);
+    const wrapperScriptName = wrapperScriptNameForPlatform(platform);
+    let wrapperExecutablePath;
+    try {
+        wrapperExecutablePath = resolveWithinRoot(resolvedRoot, wrapperScriptName);
+    }
+    catch {
+        return { rejected: true, reason: `Wrapper path escapes the target root: ${wrapperScriptName}` };
+    }
+    if (!fs.existsSync(wrapperExecutablePath)) {
+        return {
+            rejected: true,
+            reason: `No ${wrapperScriptName} was found at the target root. Optional Gradle validation requires a Gradle wrapper checked into the target for this platform.`,
+        };
+    }
+    const definition = GRADLE_OPERATIONS[operationId];
+    const expectedGeneratedPaths = definition.mayCreateBuildOutputs
+        ? [".gradle/", "build/", ...detection.modules.map((m) => `${m.path}/build/`)]
+        : [];
+    const environmentLimitations = [
+        "Requires a local or downloadable Gradle distribution matching the wrapper version — this planner does not verify one is available.",
+        "Requires a Java runtime on PATH — this planner does not verify Java availability.",
+    ];
+    if (definition.args.includes("--offline")) {
+        environmentLimitations.push("Runs with --offline; tasks needing uncached dependencies will fail or report inconclusive rather than downloading them.");
+    }
+    return {
+        rejected: false,
+        operationId,
+        wrapperExecutablePath,
+        args: definition.args,
+        cwd: resolvedRoot,
+        timeoutMs: definition.timeoutMs,
+        mayCreateBuildOutputs: definition.mayCreateBuildOutputs,
+        expectedGeneratedPaths,
+        environmentLimitations,
+    };
+}

package/dist/src/mobile/android/gradle/validate/runOptionalGradleValidation.js

@@ -0,0 +1,113 @@
+import fs from "node:fs";
+import path from "node:path";
+import { GRADLE_OPERATIONS } from "./operations.js";
+import { buildGradleCommandPlan } from "./planner.js";
+import { createRealGradleCommandExecutor } from "./executor.js";
+import { buildGradleOperationCheckResult } from "./operationCheckResult.js";
+import { buildTargetMutationReport, captureTargetSnapshot } from "./targetMutation.js";
+import { isGradleTaskAvailable, parseGradleTaskNames } from "./taskListParser.js";
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 4 — optional Gradle validation orchestrator (agents.txt Batch
+// 4 sections 7.17, 7.20, 7.24, 7.26).
+//
+// Static metadata collection (readAndroidGradleMetadata.ts) never calls this
+// module. This orchestrator only ever runs a Gradle command when
+// `enabled: true` is passed explicitly — every other code path returns a
+// "not-run" result without touching the filesystem beyond a target
+// git-status snapshot. Task-gated operations (assemble/test/lint) are
+// skipped, not attempted, unless task availability was already discovered
+// via the "tasks" operation earlier in the same call (or the caller opts in
+// via allowWithoutTaskDiscovery).
+// ---------------------------------------------------------------------------
+const TASK_GATED_OPERATIONS = new Set(["assemble-debug", "unit-test-debug", "lint-debug"]);
+function notRunResult(operationId) {
+    return {
+        id: `android-gradle-${operationId}`,
+        category: "android-gradle",
+        title: `Gradle operation: ${operationId}`,
+        status: "not-run",
+        requirementLevel: "optional",
+        ran: false,
+        skipped: false,
+        evidence: [],
+        findings: [],
+        warnings: [],
+        errors: [],
+        sourcePaths: [],
+        confidence: "unknown",
+        environmentRequirements: [],
+    };
+}
+function skippedResult(operationId, reason, missingCapability) {
+    return {
+        id: `android-gradle-${operationId}`,
+        category: "android-gradle",
+        title: `Gradle operation: ${operationId}`,
+        status: "skipped",
+        requirementLevel: "optional",
+        ran: false,
+        skipped: true,
+        skipInfo: {
+            checkId: `android-gradle-${operationId}`,
+            reason,
+            requirementLevel: "optional",
+            missingCapability,
+            verdictImpact: "optional Gradle validation evidence is unavailable for this operation",
+            recommendedNextAction: "Re-run with the required precondition satisfied, or accept reduced evidence.",
+        },
+        evidence: [],
+        findings: [],
+        warnings: [],
+        errors: [],
+        sourcePaths: [],
+        confidence: "unknown",
+        environmentRequirements: [],
+    };
+}
+function hasGitDirectory(targetRoot) {
+    try {
+        return fs.existsSync(path.join(targetRoot, ".git"));
+    }
+    catch {
+        return false;
+    }
+}
+export async function runOptionalGradleValidation(options) {
+    if (!options.enabled) {
+        return options.operationIds.map((id) => notRunResult(id));
+    }
+    const executor = options.executor ?? createRealGradleCommandExecutor();
+    const platform = options.platform ?? process.platform;
+    const resolvedRoot = path.resolve(options.targetRoot);
+    const hasGit = hasGitDirectory(resolvedRoot);
+    let discoveredTaskNames;
+    const results = [];
+    for (const operationId of options.operationIds) {
+        if (TASK_GATED_OPERATIONS.has(operationId)) {
+            if (!discoveredTaskNames && !options.allowWithoutTaskDiscovery) {
+                results.push(skippedResult(operationId, "Task availability was not discovered (the 'tasks' operation did not run successfully first) and allowWithoutTaskDiscovery was not set.", "gradle-task-discovery"));
+                continue;
+            }
+            const gradleTaskName = GRADLE_OPERATIONS[operationId].gradleTaskName;
+            if (discoveredTaskNames && !isGradleTaskAvailable(discoveredTaskNames, gradleTaskName)) {
+                results.push(skippedResult(operationId, `Task "${gradleTaskName}" is not available in this project.`, "gradle-task"));
+                continue;
+            }
+        }
+        const plan = buildGradleCommandPlan(operationId, resolvedRoot, options.detection, platform);
+        if (plan.rejected) {
+            results.push(skippedResult(operationId, plan.reason, "gradle-wrapper"));
+            continue;
+        }
+        const before = captureTargetSnapshot(resolvedRoot, hasGit);
+        const commandResult = await executor(plan);
+        const after = captureTargetSnapshot(resolvedRoot, hasGit);
+        const mutation = buildTargetMutationReport(before, after);
+        const checkResult = buildGradleOperationCheckResult(plan, commandResult, mutation);
+        results.push(checkResult);
+        if (operationId === "tasks" && checkResult.status === "passed") {
+            discoveredTaskNames = parseGradleTaskNames(commandResult.stdout);
+        }
+    }
+    return results;
+}

package/dist/src/mobile/android/gradle/validate/targetMutation.js

@@ -0,0 +1,45 @@
+import { captureTargetSnapshot, diffTargetSnapshots } from "../../../../securityValidation/attackScenarios/targetSnapshot.js";
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 4 — target mutation evidence for optional Gradle execution
+// (agents.txt Batch 4 section 7.24).
+//
+// Reuses the existing read-only git-status snapshot/diff helpers from
+// src/securityValidation/attackScenarios/targetSnapshot.ts (Batch 1's
+// "reuse, don't create a second target-status model" rule) and layers a
+// narrow Android-specific classifier on top of the diff to separate expected
+// generated build output from unexpected tracked-file changes.
+// ---------------------------------------------------------------------------
+export { captureTargetSnapshot };
+const ANDROID_GENERATED_PATH_PATTERNS = [/^\.gradle\//, /(^|\/)build\//];
+export function isExpectedAndroidGeneratedPath(entryPath) {
+    const normalized = entryPath.replace(/\\/g, "/");
+    return ANDROID_GENERATED_PATH_PATTERNS.some((pattern) => pattern.test(normalized));
+}
+// Compares a before/after snapshot pair, distinguishing generated build
+// output (untracked/added paths under build/ or .gradle/) from anything
+// else — a tracked-file modification, or a new file outside those
+// directories, is always reported as unexpected regardless of its status
+// code.
+export function buildTargetMutationReport(before, after) {
+    const diff = diffTargetSnapshots(before, after);
+    if (!diff.comparable) {
+        return { comparable: false, reason: diff.reason, expectedGeneratedChanges: [], unexpectedChanges: [], preExistingChangeCount: 0 };
+    }
+    const expectedGeneratedChanges = [];
+    const unexpectedChanges = [];
+    for (const entry of diff.newEntries) {
+        const isUntrackedOrAdded = entry.code === "??" || entry.code.includes("A");
+        if (isUntrackedOrAdded && isExpectedAndroidGeneratedPath(entry.path)) {
+            expectedGeneratedChanges.push(entry.path);
+        }
+        else {
+            unexpectedChanges.push(entry.path);
+        }
+    }
+    return {
+        comparable: true,
+        expectedGeneratedChanges: expectedGeneratedChanges.sort((a, b) => a.localeCompare(b)),
+        unexpectedChanges: unexpectedChanges.sort((a, b) => a.localeCompare(b)),
+        preExistingChangeCount: diff.preExistingEntries.length,
+    };
+}

package/dist/src/mobile/android/gradle/validate/taskListParser.js

@@ -0,0 +1,24 @@
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 4 — bounded `gradlew tasks --all` output parsing
+// (agents.txt Batch 4 section 7.20).
+//
+// Extracts task names conservatively: only lines shaped like
+// `taskName - description text` are treated as task declarations. Task
+// descriptions are never treated as identifiers, and this parser never
+// treats its output as authoritative security evidence — it is only used to
+// decide whether a later allowlisted operation should be attempted or
+// skipped.
+// ---------------------------------------------------------------------------
+const TASK_LINE_PATTERN = /^([A-Za-z][\w:]*)\s+-\s+.+$/;
+export function parseGradleTaskNames(tasksOutput) {
+    const names = new Set();
+    for (const line of tasksOutput.split(/\r?\n/)) {
+        const match = line.match(TASK_LINE_PATTERN);
+        if (match)
+            names.add(match[1]);
+    }
+    return names;
+}
+export function isGradleTaskAvailable(taskNames, taskName) {
+    return taskNames.has(taskName);
+}

package/dist/src/mobile/android/gradle/versionCatalogMetadata.js

@@ -0,0 +1,94 @@
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 4 — bounded gradle/libs.versions.toml version resolution.
+//
+// Extends Batch 2's alias-name-only evidence (detect/versionCatalogEvidence.ts)
+// with just enough section-aware parsing to resolve a plugin/library alias to
+// its declared `id`/`module` and version literal (including one level of
+// `version.ref` indirection into the `[versions]` table). This is still not
+// a general TOML parser: bundles, rich-version constraints, and nested
+// tables beyond [versions]/[plugins]/[libraries] are not resolved.
+// ---------------------------------------------------------------------------
+const SECTION_HEADER_PATTERN = /^\[(versions|plugins|libraries|bundles)\]\s*$/;
+const SIMPLE_VERSION_PATTERN = /^([A-Za-z0-9_-]+)\s*=\s*"([^"]*)"\s*$/;
+const TABLE_ENTRY_PATTERN = /^([A-Za-z0-9_-]+)\s*=\s*\{([^}]*)\}\s*$/;
+function parseEntryBody(body) {
+    const entry = {};
+    const idMatch = body.match(/\bid\s*=\s*"([^"]*)"/);
+    if (idMatch)
+        entry.id = idMatch[1];
+    const moduleMatch = body.match(/\bmodule\s*=\s*"([^"]*)"/);
+    if (moduleMatch)
+        entry.module = moduleMatch[1];
+    const versionRefMatch = body.match(/\bversion\.ref\s*=\s*"([^"]*)"/);
+    if (versionRefMatch) {
+        entry.versionRef = versionRefMatch[1];
+    }
+    else {
+        const versionMatch = body.match(/\bversion\s*=\s*"([^"]*)"/);
+        if (versionMatch)
+            entry.version = versionMatch[1];
+    }
+    return entry;
+}
+// Parses gradle/libs.versions.toml text into [versions]/[plugins]/[libraries]
+// maps. Unknown sections (e.g. [bundles]) and malformed lines are ignored
+// rather than causing a parse failure.
+export function parseVersionCatalog(text) {
+    const versions = {};
+    const plugins = {};
+    const libraries = {};
+    let currentSection;
+    for (const rawLine of text.split(/\r?\n/)) {
+        const line = rawLine.trim();
+        if (!line || line.startsWith("#"))
+            continue;
+        const sectionMatch = line.match(SECTION_HEADER_PATTERN);
+        if (sectionMatch) {
+            currentSection = sectionMatch[1];
+            continue;
+        }
+        if (!currentSection)
+            continue;
+        if (currentSection === "versions") {
+            const match = line.match(SIMPLE_VERSION_PATTERN);
+            if (match)
+                versions[match[1]] = match[2];
+            continue;
+        }
+        if (currentSection === "plugins" || currentSection === "libraries") {
+            const tableMatch = line.match(TABLE_ENTRY_PATTERN);
+            if (tableMatch) {
+                const [, alias, body] = tableMatch;
+                (currentSection === "plugins" ? plugins : libraries)[alias] = parseEntryBody(body);
+                continue;
+            }
+            const simpleMatch = line.match(SIMPLE_VERSION_PATTERN);
+            if (simpleMatch) {
+                // A bare `alias = "id:group:version"` shorthand form (used mainly
+                // for libraries) — preserved as the module string, unresolved
+                // further, since splitting it safely requires assumptions this
+                // batch does not make.
+                (currentSection === "plugins" ? plugins : libraries)[simpleMatch[1]] = { module: simpleMatch[2] };
+            }
+        }
+    }
+    return { versions, plugins, libraries };
+}
+// Resolves a catalog entry's version literal, following one level of
+// version.ref indirection into the [versions] table. Returns undefined
+// (unresolved) rather than guessing when the reference is missing.
+export function resolveCatalogVersion(catalog, entry) {
+    if (entry.version)
+        return entry.version;
+    if (entry.versionRef)
+        return catalog.versions[entry.versionRef];
+    return undefined;
+}
+// Converts a Gradle version-catalog accessor path (e.g. from
+// `libs.plugins.android.application`, the `android.application` suffix) back
+// to its kebab-case alias key convention (`android-application`), the
+// inverse of the accessor-generation convention used elsewhere in this
+// codebase (see detect/detectAndroidProject.ts's catalogAliasToAccessorSuffix).
+export function accessorSuffixToCatalogAlias(accessorSuffix) {
+    return accessorSuffix.replace(/\./g, "-");
+}

package/dist/src/mobile/android/gradle/wrapperMetadata.js

@@ -0,0 +1,32 @@
+const DISTRIBUTION_URL_PATTERN = /^distributionUrl\s*=\s*(.+)$/m;
+const CHECKSUM_PROPERTY_PATTERN = /^distributionSha256Sum\s*=\s*(.+)$/m;
+// Gradle distribution URLs look like:
+//   https\://services.gradle.org/distributions/gradle-8.5-bin.zip
+// (the colon is escaped because .properties files use `\:` for literal
+// colons in values). Captures the version and bin/all distribution type.
+const GRADLE_VERSION_PATTERN = /gradle-(\d+(?:\.\d+){1,3}(?:-\w+)?)-(bin|all)\.zip/;
+function unescapePropertiesValue(raw) {
+    return raw.trim().replace(/\\:/g, ":").replace(/\\\//g, "/");
+}
+export function parseWrapperProperties(text) {
+    const warnings = [];
+    const urlMatch = text.match(DISTRIBUTION_URL_PATTERN);
+    const distributionUrl = urlMatch ? unescapePropertiesValue(urlMatch[1]) : undefined;
+    const checksumPropertyPresent = CHECKSUM_PROPERTY_PATTERN.test(text);
+    if (!distributionUrl) {
+        warnings.push("gradle-wrapper.properties has no distributionUrl property.");
+        return { distributionType: "unknown", checksumPropertyPresent, warnings };
+    }
+    const versionMatch = distributionUrl.match(GRADLE_VERSION_PATTERN);
+    if (!versionMatch) {
+        warnings.push(`Could not deterministically extract a Gradle version from distributionUrl: "${distributionUrl}".`);
+        return { distributionUrl, distributionType: "unknown", checksumPropertyPresent, warnings };
+    }
+    return {
+        distributionUrl,
+        gradleVersion: versionMatch[1],
+        distributionType: versionMatch[2],
+        checksumPropertyPresent,
+        warnings,
+    };
+}