@dailephd/my-dev-kit-lab 0.3.4 → 0.4.1

package/dist/src/mobile/android/advancedSecurity/secretCandidates/matchSecretCandidates.js

@@ -0,0 +1,136 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 4 — narrow, deterministic in-memory secret-candidate matching.
+//
+// This is the ONLY layer that ever holds a raw candidate value. Callers
+// (analyzeSecretCandidates.ts) must redact/fingerprint immediately and never
+// store, log, or export the raw value from this module. Nothing in this
+// file is exported through index.ts.
+//
+// No entropy scoring is implemented: the structural markers (PEM headers)
+// and explicit sensitive-identifier context already meet the "high
+// confidence" bar the batch requires without it, and entropy alone must
+// never create a finding per agents.txt Batch 4 section 9.8 — omitting it
+// avoids speculative complexity with no corresponding required rule.
+// ---------------------------------------------------------------------------
+const PRIVATE_KEY_HEADER_PATTERN = /-----BEGIN ([A-Z0-9 ]*?PRIVATE KEY)-----/g;
+function findBlockEnd(content, searchStart, headerLabel) {
+    const footer = `-----END ${headerLabel}-----`;
+    const footerIndex = content.indexOf(footer, searchStart);
+    if (footerIndex === -1) {
+        // Unterminated block — bound the captured region rather than reading to
+        // end of file unbounded.
+        const MAX_UNTERMINATED_BLOCK_LENGTH = 4000;
+        return { end: Math.min(content.length, searchStart + MAX_UNTERMINATED_BLOCK_LENGTH), terminated: false };
+    }
+    return { end: footerIndex + footer.length, terminated: true };
+}
+function lineNumberAt(content, index) {
+    let line = 1;
+    for (let i = 0; i < index && i < content.length; i++) {
+        if (content[i] === "\n")
+            line++;
+    }
+    return line;
+}
+// Public keys and certificates ("-----BEGIN PUBLIC KEY-----",
+// "-----BEGIN CERTIFICATE-----") never match PRIVATE_KEY_HEADER_PATTERN
+// (which requires the literal substring "PRIVATE KEY") — the boundary is
+// enforced by construction, not a separate exclusion check.
+export function matchPrivateKeyBlocks(content) {
+    const matches = [];
+    for (const headerMatch of content.matchAll(PRIVATE_KEY_HEADER_PATTERN)) {
+        const headerLabel = headerMatch[1];
+        const startIndex = headerMatch.index ?? 0;
+        const { end, terminated } = findBlockEnd(content, startIndex, headerLabel);
+        matches.push({
+            line: lineNumberAt(content, startIndex),
+            headerLabel,
+            rawBlock: content.slice(startIndex, end),
+            terminated,
+        });
+    }
+    return matches;
+}
+// Sensitive identifier names that, when paired with a literal (never a
+// reference/placeholder), are treated as high-confidence secret-shaped
+// evidence. Deliberately narrow — matches agents.txt Batch 4 section 9.5.
+//
+// Splits the identifier into words (snake_case and camelCase boundaries)
+// rather than using a single \b-anchored regex, so real-world constant
+// naming like `SECRET_TOKEN`, `DB_PASSWORD`, or `placeholderSecret` is
+// recognized — a plain `\bsecret\b` regex fails on these because
+// underscore and camelCase transitions are not `\b` word boundaries.
+const SENSITIVE_SINGLE_WORDS = new Set(["password", "passwd", "pwd", "secret"]);
+const SENSITIVE_WORD_PAIRS = [
+    ["client", "secret"],
+    ["access", "token"],
+    ["bearer", "token"],
+    ["auth", "token"],
+    ["api", "secret"],
+    ["signing", "password"],
+    ["store", "password"],
+    ["key", "password"],
+    ["database", "password"],
+    ["db", "password"],
+];
+function splitIdentifierWords(identifier) {
+    return identifier
+        .replace(/([a-z0-9])([A-Z])/g, "$1_$2")
+        .split(/[_\-.\s]+/)
+        .map((word) => word.toLowerCase())
+        .filter((word) => word.length > 0);
+}
+function isSensitiveIdentifier(identifier) {
+    const words = splitIdentifierWords(identifier);
+    if (words.some((word) => SENSITIVE_SINGLE_WORDS.has(word)))
+        return true;
+    for (const [first, second] of SENSITIVE_WORD_PAIRS) {
+        for (let i = 0; i < words.length - 1; i++) {
+            if (words[i] === first && words[i + 1] === second)
+                return true;
+        }
+    }
+    return false;
+}
+// Finds `identifier = "value"` / `identifier: "value"` / `identifier="value"`
+// / `"identifier": "value"` (JSON-style quoted key) pairs anywhere on a line
+// (the value side quoting is required — code files never match an unquoted
+// right-hand side, so a variable/function reference such as
+// `val password = getPassword()` can never be mistaken for a literal).
+const KEY_VALUE_QUOTED_PATTERN = /["']?([A-Za-z_][A-Za-z0-9_]*)["']?\s*[:=]\s*["']([^"']*)["']/g;
+// Properties/YAML/TOML permit unquoted scalar values on a `key = value` /
+// `key: value` line; still requires the key itself to match the sensitive
+// identifier pattern.
+const KEY_VALUE_UNQUOTED_PATTERN = /^\s*([A-Za-z_][A-Za-z0-9_.-]*)\s*[:=]\s*(\S.*?)\s*$/;
+// Scans line-by-line (bounds work naturally; also gives exact line numbers
+// without a second pass). Returns only pairs whose *captured identifier*
+// (not just the line generally) matches a sensitive name — reference/
+// placeholder/empty-value filtering happens in analyzeSecretCandidates.ts,
+// which also owns redaction, so this function's return values are the last
+// point at which a raw value exists before that immediate conversion.
+export function matchSensitiveAssignments(content, fileKind) {
+    const matches = [];
+    const lines = content.split(/\r\n|\r|\n/);
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (fileKind === "config-unquoted") {
+            const unquoted = line.match(KEY_VALUE_UNQUOTED_PATTERN);
+            if (unquoted && isSensitiveIdentifier(unquoted[1])) {
+                matches.push({ line: i + 1, identifier: unquoted[1], rawValue: stripSurroundingQuotes(unquoted[2]) });
+            }
+            continue;
+        }
+        for (const pairMatch of line.matchAll(KEY_VALUE_QUOTED_PATTERN)) {
+            if (isSensitiveIdentifier(pairMatch[1])) {
+                matches.push({ line: i + 1, identifier: pairMatch[1], rawValue: pairMatch[2] });
+            }
+        }
+    }
+    return matches;
+}
+function stripSurroundingQuotes(value) {
+    if (value.length >= 2 && ((value[0] === '"' && value.endsWith('"')) || (value[0] === "'" && value.endsWith("'")))) {
+        return value.slice(1, -1);
+    }
+    return value;
+}

package/dist/src/mobile/android/advancedSecurity/secretCandidates/suppressValue.js

@@ -0,0 +1,61 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 4 — conservative placeholder/example/reference suppression.
+//
+// Deliberately a small, exact/narrow-normalized check list rather than a
+// large heuristic catalog (agents.txt Batch 4 section 9.9). Operates only on
+// the already-captured raw value (never re-reads the file), and this module
+// is not exported through index.ts.
+// ---------------------------------------------------------------------------
+const EXACT_PLACEHOLDER_VALUES = new Set([
+    "changeme",
+    "change_me",
+    "change-me",
+    "password",
+    "secret",
+    "example",
+    "sample",
+    "dummy",
+    "fake",
+    "test",
+    "your-token-here",
+    "your_token_here",
+    "replace-me",
+    "replace_me",
+    "redacted",
+    "masked",
+    "todo",
+    "xxx",
+    "placeholder",
+    "n/a",
+    "none",
+].map((v) => v.toLowerCase()));
+export function isEmptyValue(value) {
+    return value.trim().length === 0;
+}
+export function isObviousPlaceholderValue(value) {
+    const normalized = value.trim().toLowerCase();
+    if (normalized.length === 0)
+        return true;
+    if (EXACT_PLACEHOLDER_VALUES.has(normalized))
+        return true;
+    // Fully repeated single character (e.g. "****", "xxxxxxxx", "00000000").
+    if (/^(.)\1*$/.test(normalized))
+        return true;
+    return false;
+}
+// Environment/property/manifest-placeholder reference syntax embedded in the
+// literal itself (e.g. a Kotlin string template `"${DB_PASSWORD}"`, a
+// properties-file `${some.property}`, a shell-style `$VAR`, a Windows
+// `%VAR%`, or an Android manifest `@string/...`/`@xml/...` reference). Any
+// of these means the "literal" is not actually a hardcoded value.
+const REFERENCE_SYNTAX_PATTERN = /\$\{[^}]*\}|\$[A-Za-z_][A-Za-z0-9_]*|%[A-Za-z_][A-Za-z0-9_]*%|^@(string|xml|raw|array|integer|bool)\//;
+export function isReferenceSyntax(value) {
+    return REFERENCE_SYNTAX_PATTERN.test(value.trim());
+}
+// True when the value should never become a finding/candidate at all —
+// empty or an obvious placeholder/example. Reference syntax is handled
+// separately by the caller because it should surface as non-literal
+// metadata (Batch 4 section 9.12), not be silently dropped.
+export function shouldSuppressEntirely(value) {
+    return isEmptyValue(value) || isObviousPlaceholderValue(value);
+}

package/dist/src/mobile/android/advancedSecurity/secretCandidates/types.js

@@ -0,0 +1,11 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 4 — bounded secret-candidate scan contracts.
+//
+// Local to this feature; does not duplicate Batch 1's CandidateEvidence,
+// SecurityFinding, or the shared bounded-source-scan utility
+// (src/securityValidation/attackScenarios/boundedSourceScan.ts) — it wraps
+// the existing target-containment/glob-collection primitives
+// (src/core/fileGlobs.ts) with Android-appropriate exclusions and adds
+// structured skip evidence, which neither existing utility provides.
+// ---------------------------------------------------------------------------
+export {};

package/dist/src/mobile/android/advancedSecurity/sensitiveCategories.js

@@ -0,0 +1,34 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 1 — sensitive-data category vocabulary for later secret/
+// signing/configuration candidate scanners.
+//
+// Deliberately small and additive. This is not a security-severity scale
+// (see SecuritySeverity in src/securityValidation/types.ts, reused as-is by
+// candidateEvidence.ts) — it only classifies *what kind* of value a static
+// candidate looks like.
+//
+// A bare Firebase API key (the public `apiKey` field in google-services.json
+// / Firebase web config) must NOT be classified as "cloud-secret-key" or any
+// other private-secret category by default: Firebase API keys identify a
+// Firebase project but are not treated as confidential by Google's own
+// documentation, and misclassifying them would produce a permanent, noisy
+// false positive for a huge fraction of real Android apps. A later batch's
+// Firebase scanner should classify that value as "unknown-sensitive-value"
+// (or omit a candidate entirely) rather than a private-secret category.
+// ---------------------------------------------------------------------------
+export const SENSITIVE_DATA_CATEGORIES = [
+    "password",
+    "access-token",
+    "bearer-token",
+    "oauth-client-secret",
+    "cloud-secret-key",
+    "private-key",
+    "database-credential",
+    "signing-password",
+    "recovery-code",
+    "personal-data",
+    "unknown-sensitive-value",
+];
+export function isSensitiveDataCategory(value) {
+    return SENSITIVE_DATA_CATEGORIES.includes(value);
+}

package/dist/src/mobile/android/advancedSecurity/sensitiveData/classifyDirectExpression.js

@@ -0,0 +1,99 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 6 — shared bounded direct-expression classification.
+//
+// Classifies a single, already-extracted argument/value expression string
+// (captured by an analyzer's own bounded regex, e.g. the second argument to
+// a Log.d(...) call, or the value passed to putString(...)) into a coarse
+// syntactic kind. This performs no evaluation, no alias resolution beyond
+// what the caller already resolved, and no interprocedural analysis — it is
+// purely a classifier over the literal text of the expression.
+//
+// Safety invariant: `rawExpression` and the derived `literalValue` are
+// returned for the caller's own redaction step (via
+// makeCandidateEvidence/redactedPreviewForCandidate) — `boundedSummary` never
+// contains literal content, only the classified kind and shape, so a caller
+// that forgets to redact still cannot leak a raw value through the summary.
+// ---------------------------------------------------------------------------
+export const DIRECT_EXPRESSION_KINDS = [
+    "string-literal",
+    "numeric-literal",
+    "boolean-literal",
+    "null-literal",
+    "identifier",
+    "member-access",
+    "method-parameter",
+    "method-call",
+    "environment-lookup",
+    "property-lookup",
+    "placeholder-interpolation",
+    "collection-object",
+    "dynamic-unsupported",
+];
+const MAX_EXPRESSION_LENGTH = 400;
+function bound(expression) {
+    return expression.length > MAX_EXPRESSION_LENGTH ? `${expression.slice(0, MAX_EXPRESSION_LENGTH)}...` : expression;
+}
+function unquoteJavaKotlinString(literal) {
+    const tripleMatch = /^"""([\s\S]*)"""$/.exec(literal);
+    if (tripleMatch)
+        return tripleMatch[1];
+    const doubleMatch = /^"((?:[^"\\]|\\.)*)"$/.exec(literal);
+    if (doubleMatch) {
+        try {
+            return JSON.parse(literal);
+        }
+        catch {
+            return doubleMatch[1];
+        }
+    }
+    return undefined;
+}
+export function classifyDirectExpression(rawExpression) {
+    const trimmed = bound(rawExpression.trim());
+    const summaryFor = (kind) => `${kind} (length=${trimmed.length})`;
+    if (trimmed.length === 0) {
+        return { kind: "dynamic-unsupported", isDirectLiteral: false, boundedSummary: summaryFor("dynamic-unsupported") };
+    }
+    // Kotlin string templates / Java concatenation with a dynamic operand:
+    // treated as placeholder-interpolation, not a pure literal, even though it
+    // may still contain a sensitive literal fragment — callers that need the
+    // literal fragment extract it separately before classification.
+    if (/\$\{[^}]*\}|\$[A-Za-z_][\w]*/.test(trimmed) && /^"/.test(trimmed)) {
+        return { kind: "placeholder-interpolation", isDirectLiteral: false, boundedSummary: summaryFor("placeholder-interpolation") };
+    }
+    if (/^"[^"]*"\s*\+/.test(trimmed) || /\+\s*"[^"]*"$/.test(trimmed) || (/^".*"$/.test(trimmed) && /\+/.test(trimmed))) {
+        return { kind: "placeholder-interpolation", isDirectLiteral: false, boundedSummary: summaryFor("placeholder-interpolation") };
+    }
+    const unquoted = unquoteJavaKotlinString(trimmed);
+    if (unquoted !== undefined) {
+        return { kind: "string-literal", isDirectLiteral: true, literalValue: unquoted, boundedSummary: summaryFor("string-literal") };
+    }
+    if (/^-?\d+(\.\d+)?[fFdDlL]?$/.test(trimmed)) {
+        return { kind: "numeric-literal", isDirectLiteral: true, literalValue: trimmed, boundedSummary: summaryFor("numeric-literal") };
+    }
+    if (trimmed === "true" || trimmed === "false") {
+        return { kind: "boolean-literal", isDirectLiteral: true, literalValue: trimmed, boundedSummary: summaryFor("boolean-literal") };
+    }
+    if (trimmed === "null") {
+        return { kind: "null-literal", isDirectLiteral: false, boundedSummary: summaryFor("null-literal") };
+    }
+    if (/^(System\.getenv|getenv)\s*\(/.test(trimmed)) {
+        return { kind: "environment-lookup", isDirectLiteral: false, boundedSummary: summaryFor("environment-lookup") };
+    }
+    if (/^BuildConfig\./.test(trimmed)) {
+        return { kind: "property-lookup", isDirectLiteral: false, boundedSummary: summaryFor("property-lookup") };
+    }
+    if (/^[{\[]/.test(trimmed)) {
+        return { kind: "collection-object", isDirectLiteral: false, boundedSummary: summaryFor("collection-object") };
+    }
+    if (/^[A-Za-z_$][\w$]*(\.[A-Za-z_$][\w$]*)*\s*\(/.test(trimmed)) {
+        return { kind: "method-call", isDirectLiteral: false, boundedSummary: summaryFor("method-call") };
+    }
+    if (/^[A-Za-z_$][\w$]*(\.[A-Za-z_$][\w$]*)+$/.test(trimmed)) {
+        return { kind: "member-access", isDirectLiteral: false, boundedSummary: summaryFor("member-access") };
+    }
+    if (/^[A-Za-z_$][\w$]*$/.test(trimmed)) {
+        return { kind: "identifier", isDirectLiteral: false, boundedSummary: summaryFor("identifier") };
+    }
+    return { kind: "dynamic-unsupported", isDirectLiteral: false, boundedSummary: summaryFor("dynamic-unsupported") };
+}

package/dist/src/mobile/android/advancedSecurity/sensitiveData/classifySensitiveIdentifier.js

@@ -0,0 +1,111 @@
+const EXACT_WORD_CATEGORY = new Map([
+    // Authentication and credentials
+    ["password", "password"],
+    ["passwd", "password"],
+    ["pwd", "password"],
+    ["passcode", "password"],
+    ["pin", "password"],
+    ["secret", "unknown-sensitive-value"],
+    ["credential", "unknown-sensitive-value"],
+    ["credentials", "unknown-sensitive-value"],
+    ["auth", "access-token"],
+    ["authorization", "access-token"],
+    ["bearer", "bearer-token"],
+    ["bearertoken", "bearer-token"],
+    ["token", "access-token"],
+    ["accesstoken", "access-token"],
+    ["refreshtoken", "access-token"],
+    ["authtoken", "access-token"],
+    ["sessiontoken", "access-token"],
+    ["apisecret", "cloud-secret-key"],
+    ["clientsecret", "oauth-client-secret"],
+    // Signing and recovery
+    ["signingpassword", "signing-password"],
+    ["storepassword", "signing-password"],
+    ["keypassword", "signing-password"],
+    ["recoverycode", "recovery-code"],
+    ["backupcode", "recovery-code"],
+    ["otp", "recovery-code"],
+    ["onetimepassword", "recovery-code"],
+    // Personal and account data
+    ["email", "personal-data"],
+    ["phone", "personal-data"],
+    ["phonenumber", "personal-data"],
+    ["address", "personal-data"],
+    ["location", "personal-data"],
+    ["latitude", "personal-data"],
+    ["longitude", "personal-data"],
+    ["userid", "personal-data"],
+    ["accountid", "personal-data"],
+    ["deviceid", "personal-data"],
+    ["advertisingid", "personal-data"],
+    // Financial or regulated data (no dedicated category — reuses
+    // personal-data, the closest Batch 1 regulated-data category)
+    ["cardnumber", "personal-data"],
+    ["creditcard", "personal-data"],
+    ["bankaccount", "personal-data"],
+    ["ssn", "personal-data"],
+    ["taxid", "personal-data"],
+    // Database/session data
+    ["session", "access-token"],
+    ["cookie", "access-token"],
+    ["databasepassword", "database-credential"],
+    ["dbpassword", "database-credential"],
+    ["connectionstring", "database-credential"],
+]);
+// Public identifiers that must never be classified as sensitive by name
+// alone, even though a naive substring match might otherwise catch them.
+const PUBLIC_IDENTIFIER_WORDS = new Set([
+    "apikey",
+    "projectid",
+    "appid",
+    "packagename",
+    "storagebucket",
+    "databaseurl",
+    "senderid",
+    "clientid",
+    "mobilesdkappid",
+    "applicationid",
+    "namespace",
+]);
+// Splits camelCase/PascalCase/snake_case/kebab-case identifiers into
+// lowercase words, e.g. "userAuthToken" / "user_auth_token" -> ["user",
+// "auth", "token"].
+export function splitIdentifierWords(identifier) {
+    return identifier
+        .replace(/([a-z0-9])([A-Z])/g, "$1 $2")
+        .replace(/([A-Z]+)([A-Z][a-z])/g, "$1 $2")
+        .replace(/[-_.]+/g, " ")
+        .trim()
+        .split(/\s+/)
+        .filter(Boolean)
+        .map((word) => word.toLowerCase());
+}
+function normalizeCompound(words) {
+    return words.join("");
+}
+// Returns a classification only for a defensible direct match: either the
+// whole normalized identifier (with separators removed) matches a known
+// compound entry, or any individual word in the identifier exactly matches a
+// known single-word entry. Never matches on an arbitrary substring.
+export function classifySensitiveIdentifier(identifier) {
+    const words = splitIdentifierWords(identifier);
+    if (words.length === 0)
+        return undefined;
+    const compound = normalizeCompound(words);
+    if (PUBLIC_IDENTIFIER_WORDS.has(compound))
+        return undefined;
+    const compoundCategory = EXACT_WORD_CATEGORY.get(compound);
+    if (compoundCategory !== undefined) {
+        return { sensitiveDataCategory: compoundCategory, normalized: compound };
+    }
+    for (const word of words) {
+        if (PUBLIC_IDENTIFIER_WORDS.has(word))
+            continue;
+        const category = EXACT_WORD_CATEGORY.get(word);
+        if (category !== undefined) {
+            return { sensitiveDataCategory: category, normalized: word };
+        }
+    }
+    return undefined;
+}

package/dist/src/mobile/android/advancedSecurity/sensitiveData/index.js

@@ -0,0 +1,3 @@
+export { classifySensitiveIdentifier, splitIdentifierWords } from "./classifySensitiveIdentifier.js";
+export { classifyDirectExpression, DIRECT_EXPRESSION_KINDS } from "./classifyDirectExpression.js";
+export { executableMask, lineForOffset, methodScopes, scopeAt, sameScope } from "./localSourceContext.js";

package/dist/src/mobile/android/advancedSecurity/sensitiveData/localSourceContext.js

@@ -0,0 +1,90 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 6 — narrow shared local Java/Kotlin source-context helpers.
+//
+// Extracted (not copied verbatim) from the bounded masking/scope technique
+// Batch 5's WebView analyzer implemented privately in
+// advancedSecurity/webview/checkResult.ts. That file is left completely
+// unchanged (its own mask/scope logic stays inline) — this module is new,
+// additive code used only by the four Batch 6 analyzers, generalized just
+// enough to be language-general rather than SSL-callback-specific. It is
+// NOT a compiler front end: no AST, no symbol resolution, no cross-method
+// data flow. It only offers:
+//   - executableMask(): comment/string-masked text with byte-for-byte
+//     preserved offsets and line breaks, so downstream regexes never match
+//     inside a comment or a string literal, and reported line numbers stay
+//     correct against the original source.
+//   - methodScopes(): brace-depth-bounded method-like ranges (used for
+//     same-method correlation only — never cross-method).
+//   - lineForOffset(): 1-based line number for a byte offset.
+// ---------------------------------------------------------------------------
+const STRING_OR_COMMENT = /"""[\s\S]*?"""|"(?:[^"\\\n]|\\.)*"|'(?:[^'\\\n]|\\.)*'|\/\/[^\n]*|\/\*[\s\S]*?\*\//g;
+// Masks comment and string/char contents with spaces (preserving embedded
+// newlines) so line numbers and offsets never shift and downstream regexes
+// never match text that only appears inside a comment or a literal.
+export function executableMask(source) {
+    return source.replace(STRING_OR_COMMENT, (match) => match.replace(/[^\n]/g, " "));
+}
+export function lineForOffset(source, offset) {
+    let line = 1;
+    for (let i = 0; i < offset && i < source.length; i += 1) {
+        if (source[i] === "\n")
+            line += 1;
+    }
+    return line;
+}
+const METHOD_HEADER = /(?:fun|void|[A-Za-z_$][\w$.<>,?\[\] ]*?)\s+[A-Za-z_$][\w$]*\s*\([^)]*\)[^{;]*\{/g;
+function braceEnd(mask, openBraceIndex) {
+    let depth = 0;
+    for (let i = openBraceIndex; i < mask.length; i += 1) {
+        if (mask[i] === "{")
+            depth += 1;
+        else if (mask[i] === "}") {
+            depth -= 1;
+            if (depth === 0)
+                return i;
+        }
+    }
+    return mask.length - 1;
+}
+// Bounded, best-effort method-like scope extraction over already-masked
+// text. Overlapping/nested matches are tolerated (each open-brace found by
+// the header regex gets its own scope) — callers only use scope identity for
+// "same enclosing scope" correlation, never for accurate call-graph shape.
+export function methodScopes(mask) {
+    const scopes = [];
+    let match;
+    let id = 0;
+    METHOD_HEADER.lastIndex = 0;
+    while ((match = METHOD_HEADER.exec(mask)) !== null) {
+        const openBrace = match.index + match[0].length - 1;
+        if (mask[openBrace] !== "{")
+            continue;
+        const close = braceEnd(mask, openBrace);
+        scopes.push({ from: match.index, to: close, id });
+        id += 1;
+    }
+    return scopes;
+}
+// Innermost (smallest-span) scope containing offset, or undefined if offset
+// is not inside any recognized method-like range (e.g. field initializer).
+export function scopeAt(scopes, offset) {
+    let best;
+    for (const scope of scopes) {
+        if (offset >= scope.from && offset <= scope.to) {
+            if (best === undefined || scope.to - scope.from < best.to - best.from)
+                best = scope;
+        }
+    }
+    return best;
+}
+// Same-method correlation: true only when both offsets resolve to the same
+// enclosing scope id (or both resolve to no scope, treated as file-level and
+// therefore not correlated across arbitrary distance — callers should apply
+// an additional bounded-distance check for the no-scope case).
+export function sameScope(scopes, offsetA, offsetB) {
+    const a = scopeAt(scopes, offsetA);
+    const b = scopeAt(scopes, offsetB);
+    if (a === undefined || b === undefined)
+        return false;
+    return a.id === b.id;
+}

package/dist/src/mobile/android/advancedSecurity/sensitiveData/splitArguments.js

@@ -0,0 +1,59 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 6 — shared bounded top-level argument splitter.
+//
+// Splits a call's argument text on top-level commas only (commas nested
+// inside (), [], {}, or string/char literals are not split points). Used by
+// all four Batch 6 analyzers to pull individual arguments out of an already
+// bounded, already-masked-for-comments call match. Not a parser: does not
+// understand trailing lambdas, named/default arguments beyond a literal
+// `name = value` prefix strip, or varargs semantics.
+// ---------------------------------------------------------------------------
+const MAX_ARGUMENTS = 12;
+export function splitTopLevelArguments(argsText) {
+    const args = [];
+    let depth = 0;
+    let current = "";
+    let quote;
+    for (let i = 0; i < argsText.length; i += 1) {
+        const ch = argsText[i];
+        if (quote) {
+            current += ch;
+            if (ch === "\\") {
+                i += 1;
+                if (i < argsText.length)
+                    current += argsText[i];
+                continue;
+            }
+            if (ch === quote)
+                quote = undefined;
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            quote = ch;
+            current += ch;
+            continue;
+        }
+        if (ch === "(" || ch === "[" || ch === "{") {
+            depth += 1;
+            current += ch;
+            continue;
+        }
+        if (ch === ")" || ch === "]" || ch === "}") {
+            depth -= 1;
+            current += ch;
+            continue;
+        }
+        if (ch === "," && depth === 0) {
+            args.push(current.trim());
+            current = "";
+            if (args.length >= MAX_ARGUMENTS)
+                break;
+            continue;
+        }
+        current += ch;
+    }
+    if (current.trim().length > 0 || args.length === 0)
+        args.push(current.trim());
+    // Strip a leading `name = ` Kotlin named-argument prefix, if present.
+    return args.map((arg) => arg.replace(/^[A-Za-z_$][\w$]*\s*=\s*(?!=)/, ""));
+}