@dailephd/my-dev-kit-lab 0.3.4 → 0.4.1

package/dist/src/mobile/android/gradle/validate/targetMutation.js

@@ -0,0 +1,45 @@
+import { captureTargetSnapshot, diffTargetSnapshots } from "../../../../securityValidation/attackScenarios/targetSnapshot.js";
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 4 — target mutation evidence for optional Gradle execution
+// (agents.txt Batch 4 section 7.24).
+//
+// Reuses the existing read-only git-status snapshot/diff helpers from
+// src/securityValidation/attackScenarios/targetSnapshot.ts (Batch 1's
+// "reuse, don't create a second target-status model" rule) and layers a
+// narrow Android-specific classifier on top of the diff to separate expected
+// generated build output from unexpected tracked-file changes.
+// ---------------------------------------------------------------------------
+export { captureTargetSnapshot };
+const ANDROID_GENERATED_PATH_PATTERNS = [/^\.gradle\//, /(^|\/)build\//];
+export function isExpectedAndroidGeneratedPath(entryPath) {
+    const normalized = entryPath.replace(/\\/g, "/");
+    return ANDROID_GENERATED_PATH_PATTERNS.some((pattern) => pattern.test(normalized));
+}
+// Compares a before/after snapshot pair, distinguishing generated build
+// output (untracked/added paths under build/ or .gradle/) from anything
+// else — a tracked-file modification, or a new file outside those
+// directories, is always reported as unexpected regardless of its status
+// code.
+export function buildTargetMutationReport(before, after) {
+    const diff = diffTargetSnapshots(before, after);
+    if (!diff.comparable) {
+        return { comparable: false, reason: diff.reason, expectedGeneratedChanges: [], unexpectedChanges: [], preExistingChangeCount: 0 };
+    }
+    const expectedGeneratedChanges = [];
+    const unexpectedChanges = [];
+    for (const entry of diff.newEntries) {
+        const isUntrackedOrAdded = entry.code === "??" || entry.code.includes("A");
+        if (isUntrackedOrAdded && isExpectedAndroidGeneratedPath(entry.path)) {
+            expectedGeneratedChanges.push(entry.path);
+        }
+        else {
+            unexpectedChanges.push(entry.path);
+        }
+    }
+    return {
+        comparable: true,
+        expectedGeneratedChanges: expectedGeneratedChanges.sort((a, b) => a.localeCompare(b)),
+        unexpectedChanges: unexpectedChanges.sort((a, b) => a.localeCompare(b)),
+        preExistingChangeCount: diff.preExistingEntries.length,
+    };
+}

package/dist/src/mobile/android/gradle/validate/taskListParser.js

@@ -0,0 +1,24 @@
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 4 — bounded `gradlew tasks --all` output parsing
+// (agents.txt Batch 4 section 7.20).
+//
+// Extracts task names conservatively: only lines shaped like
+// `taskName - description text` are treated as task declarations. Task
+// descriptions are never treated as identifiers, and this parser never
+// treats its output as authoritative security evidence — it is only used to
+// decide whether a later allowlisted operation should be attempted or
+// skipped.
+// ---------------------------------------------------------------------------
+const TASK_LINE_PATTERN = /^([A-Za-z][\w:]*)\s+-\s+.+$/;
+export function parseGradleTaskNames(tasksOutput) {
+    const names = new Set();
+    for (const line of tasksOutput.split(/\r?\n/)) {
+        const match = line.match(TASK_LINE_PATTERN);
+        if (match)
+            names.add(match[1]);
+    }
+    return names;
+}
+export function isGradleTaskAvailable(taskNames, taskName) {
+    return taskNames.has(taskName);
+}

package/dist/src/mobile/android/gradle/versionCatalogMetadata.js

@@ -0,0 +1,94 @@
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 4 — bounded gradle/libs.versions.toml version resolution.
+//
+// Extends Batch 2's alias-name-only evidence (detect/versionCatalogEvidence.ts)
+// with just enough section-aware parsing to resolve a plugin/library alias to
+// its declared `id`/`module` and version literal (including one level of
+// `version.ref` indirection into the `[versions]` table). This is still not
+// a general TOML parser: bundles, rich-version constraints, and nested
+// tables beyond [versions]/[plugins]/[libraries] are not resolved.
+// ---------------------------------------------------------------------------
+const SECTION_HEADER_PATTERN = /^\[(versions|plugins|libraries|bundles)\]\s*$/;
+const SIMPLE_VERSION_PATTERN = /^([A-Za-z0-9_-]+)\s*=\s*"([^"]*)"\s*$/;
+const TABLE_ENTRY_PATTERN = /^([A-Za-z0-9_-]+)\s*=\s*\{([^}]*)\}\s*$/;
+function parseEntryBody(body) {
+    const entry = {};
+    const idMatch = body.match(/\bid\s*=\s*"([^"]*)"/);
+    if (idMatch)
+        entry.id = idMatch[1];
+    const moduleMatch = body.match(/\bmodule\s*=\s*"([^"]*)"/);
+    if (moduleMatch)
+        entry.module = moduleMatch[1];
+    const versionRefMatch = body.match(/\bversion\.ref\s*=\s*"([^"]*)"/);
+    if (versionRefMatch) {
+        entry.versionRef = versionRefMatch[1];
+    }
+    else {
+        const versionMatch = body.match(/\bversion\s*=\s*"([^"]*)"/);
+        if (versionMatch)
+            entry.version = versionMatch[1];
+    }
+    return entry;
+}
+// Parses gradle/libs.versions.toml text into [versions]/[plugins]/[libraries]
+// maps. Unknown sections (e.g. [bundles]) and malformed lines are ignored
+// rather than causing a parse failure.
+export function parseVersionCatalog(text) {
+    const versions = {};
+    const plugins = {};
+    const libraries = {};
+    let currentSection;
+    for (const rawLine of text.split(/\r?\n/)) {
+        const line = rawLine.trim();
+        if (!line || line.startsWith("#"))
+            continue;
+        const sectionMatch = line.match(SECTION_HEADER_PATTERN);
+        if (sectionMatch) {
+            currentSection = sectionMatch[1];
+            continue;
+        }
+        if (!currentSection)
+            continue;
+        if (currentSection === "versions") {
+            const match = line.match(SIMPLE_VERSION_PATTERN);
+            if (match)
+                versions[match[1]] = match[2];
+            continue;
+        }
+        if (currentSection === "plugins" || currentSection === "libraries") {
+            const tableMatch = line.match(TABLE_ENTRY_PATTERN);
+            if (tableMatch) {
+                const [, alias, body] = tableMatch;
+                (currentSection === "plugins" ? plugins : libraries)[alias] = parseEntryBody(body);
+                continue;
+            }
+            const simpleMatch = line.match(SIMPLE_VERSION_PATTERN);
+            if (simpleMatch) {
+                // A bare `alias = "id:group:version"` shorthand form (used mainly
+                // for libraries) — preserved as the module string, unresolved
+                // further, since splitting it safely requires assumptions this
+                // batch does not make.
+                (currentSection === "plugins" ? plugins : libraries)[simpleMatch[1]] = { module: simpleMatch[2] };
+            }
+        }
+    }
+    return { versions, plugins, libraries };
+}
+// Resolves a catalog entry's version literal, following one level of
+// version.ref indirection into the [versions] table. Returns undefined
+// (unresolved) rather than guessing when the reference is missing.
+export function resolveCatalogVersion(catalog, entry) {
+    if (entry.version)
+        return entry.version;
+    if (entry.versionRef)
+        return catalog.versions[entry.versionRef];
+    return undefined;
+}
+// Converts a Gradle version-catalog accessor path (e.g. from
+// `libs.plugins.android.application`, the `android.application` suffix) back
+// to its kebab-case alias key convention (`android-application`), the
+// inverse of the accessor-generation convention used elsewhere in this
+// codebase (see detect/detectAndroidProject.ts's catalogAliasToAccessorSuffix).
+export function accessorSuffixToCatalogAlias(accessorSuffix) {
+    return accessorSuffix.replace(/\./g, "-");
+}

package/dist/src/mobile/android/gradle/wrapperMetadata.js

@@ -0,0 +1,32 @@
+const DISTRIBUTION_URL_PATTERN = /^distributionUrl\s*=\s*(.+)$/m;
+const CHECKSUM_PROPERTY_PATTERN = /^distributionSha256Sum\s*=\s*(.+)$/m;
+// Gradle distribution URLs look like:
+//   https\://services.gradle.org/distributions/gradle-8.5-bin.zip
+// (the colon is escaped because .properties files use `\:` for literal
+// colons in values). Captures the version and bin/all distribution type.
+const GRADLE_VERSION_PATTERN = /gradle-(\d+(?:\.\d+){1,3}(?:-\w+)?)-(bin|all)\.zip/;
+function unescapePropertiesValue(raw) {
+    return raw.trim().replace(/\\:/g, ":").replace(/\\\//g, "/");
+}
+export function parseWrapperProperties(text) {
+    const warnings = [];
+    const urlMatch = text.match(DISTRIBUTION_URL_PATTERN);
+    const distributionUrl = urlMatch ? unescapePropertiesValue(urlMatch[1]) : undefined;
+    const checksumPropertyPresent = CHECKSUM_PROPERTY_PATTERN.test(text);
+    if (!distributionUrl) {
+        warnings.push("gradle-wrapper.properties has no distributionUrl property.");
+        return { distributionType: "unknown", checksumPropertyPresent, warnings };
+    }
+    const versionMatch = distributionUrl.match(GRADLE_VERSION_PATTERN);
+    if (!versionMatch) {
+        warnings.push(`Could not deterministically extract a Gradle version from distributionUrl: "${distributionUrl}".`);
+        return { distributionUrl, distributionType: "unknown", checksumPropertyPresent, warnings };
+    }
+    return {
+        distributionUrl,
+        gradleVersion: versionMatch[1],
+        distributionType: versionMatch[2],
+        checksumPropertyPresent,
+        warnings,
+    };
+}

package/dist/src/mobile/android/manifest/parseAndroidManifest.js

@@ -0,0 +1,364 @@
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { relativeWithinRoot, resolveWithinRoot } from "../../../core/pathSafety.js";
+import { ANDROID_NAMESPACE_URI, findChildren, getAttribute, parseXmlDocument, } from "./xml/parseXml.js";
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 3 — AndroidManifest.xml parser.
+//
+// Maps the bounded XML tree from ./xml/parseXml.ts onto the Batch 1
+// AndroidManifestModel contract. Static, deterministic, read-only: no
+// resource-reference resolution, no manifest-placeholder resolution (values
+// like @string/app_name and ${applicationId} are preserved verbatim), and no
+// manifest merging. Malformed input always produces a valid (possibly
+// mostly-empty) AndroidManifestModel with the problem recorded in
+// `parseWarnings`/`unsupportedConstructs` rather than throwing.
+// ---------------------------------------------------------------------------
+function toLocation(xmlLocation) {
+    return { line: xmlLocation.line, column: xmlLocation.column };
+}
+function getUnprefixedAttribute(element, localName) {
+    return element.attributes.find((attr) => attr.prefix === undefined && attr.localName === localName)?.value;
+}
+function androidAttr(element, localName) {
+    return getAttribute(element, localName, ANDROID_NAMESPACE_URI)?.value;
+}
+function parseBooleanAttr(element, localName, warnings, context) {
+    const attr = getAttribute(element, localName, ANDROID_NAMESPACE_URI);
+    if (!attr)
+        return {};
+    if (attr.value === "true")
+        return { value: true, raw: attr.value };
+    if (attr.value === "false")
+        return { value: false, raw: attr.value };
+    warnings.push(`${context}: android:${localName} has an unresolved or malformed value "${attr.value}" (line ${attr.location.line}) — not normalized to true or false.`);
+    return { raw: attr.value };
+}
+function parseIntAttr(element, localName, warnings, context) {
+    const attr = getAttribute(element, localName, ANDROID_NAMESPACE_URI);
+    if (!attr)
+        return undefined;
+    const parsed = Number.parseInt(attr.value, 10);
+    if (Number.isNaN(parsed)) {
+        warnings.push(`${context}: android:${localName} is not a resolvable integer ("${attr.value}", line ${attr.location.line}).`);
+        return undefined;
+    }
+    return parsed;
+}
+const LAUNCHER_ACTION = "android.intent.action.MAIN";
+const LAUNCHER_CATEGORY = "android.intent.category.LAUNCHER";
+const VIEW_ACTION = "android.intent.action.VIEW";
+const BROWSABLE_CATEGORY = "android.intent.category.BROWSABLE";
+function parseIntentFilter(element, warnings) {
+    const actions = findChildren(element, "action")
+        .map((a) => androidAttr(a, "name"))
+        .filter((v) => Boolean(v));
+    const categories = findChildren(element, "category")
+        .map((c) => androidAttr(c, "name"))
+        .filter((v) => Boolean(v));
+    const autoVerifyResult = parseBooleanAttr(element, "autoVerify", warnings, "intent-filter");
+    const dataElements = findChildren(element, "data").map((d) => ({
+        dataScheme: androidAttr(d, "scheme"),
+        dataHost: androidAttr(d, "host"),
+        dataPath: androidAttr(d, "path"),
+        dataPathPrefix: androidAttr(d, "pathPrefix"),
+        dataPathPattern: androidAttr(d, "pathPattern"),
+        autoVerify: autoVerifyResult.value,
+        location: toLocation(d.location),
+    }));
+    const isDeepLinkCandidate = actions.includes(VIEW_ACTION) && (categories.includes(BROWSABLE_CATEGORY) || dataElements.length > 0);
+    for (const child of element.children) {
+        if (child.localName !== "action" && child.localName !== "category" && child.localName !== "data") {
+            warnings.push(`Unsupported intent-filter child element <${child.tagName}> at line ${child.location.line} (preserved as a warning, not parsed).`);
+        }
+    }
+    return {
+        filterData: dataElements,
+        actions,
+        categories,
+        dataElements,
+        autoVerify: autoVerifyResult.value,
+        isDeepLinkCandidate,
+        location: toLocation(element.location),
+    };
+}
+function parseComponent(kind, element, warnings) {
+    const context = `<${kind}> at line ${element.location.line}`;
+    const name = androidAttr(element, "name");
+    if (!name) {
+        warnings.push(`${context} is missing android:name.`);
+    }
+    const exportedResult = parseBooleanAttr(element, "exported", warnings, context);
+    const enabledResult = parseBooleanAttr(element, "enabled", warnings, context);
+    const permission = androidAttr(element, "permission");
+    const intentFilters = findChildren(element, "intent-filter").map((filterEl) => parseIntentFilter(filterEl, warnings));
+    const isLauncherActivity = (kind === "activity" || kind === "activity-alias") &&
+        intentFilters.some((filter) => filter.actions?.includes(LAUNCHER_ACTION) && filter.categories?.includes(LAUNCHER_CATEGORY));
+    const component = {
+        kind,
+        name: name ?? "",
+        exported: exportedResult.value,
+        exportedRaw: exportedResult.raw,
+        enabled: enabledResult.value,
+        permission,
+        intentFilters,
+        isLauncherActivity: isLauncherActivity || undefined,
+        location: toLocation(element.location),
+    };
+    if (kind === "provider") {
+        component.readPermission = androidAttr(element, "readPermission");
+        component.writePermission = androidAttr(element, "writePermission");
+        const authoritiesRaw = androidAttr(element, "authorities");
+        component.authoritiesRaw = authoritiesRaw;
+        component.authorities = authoritiesRaw ? authoritiesRaw.split(";").map((s) => s.trim()).filter(Boolean) : undefined;
+        const grantUriPermissions = parseBooleanAttr(element, "grantUriPermissions", warnings, context);
+        component.grantUriPermissions = grantUriPermissions.value;
+        component.grantUriPermissionsRaw = grantUriPermissions.raw;
+        component.metadata = findChildren(element, "meta-data").map((metadata) => ({
+            name: androidAttr(metadata, "name"),
+            resource: androidAttr(metadata, "resource"),
+            value: androidAttr(metadata, "value"),
+            location: toLocation(metadata.location),
+        }));
+    }
+    return component;
+}
+// Parses AndroidManifest.xml source text into the normalized contract. Pure
+// (no filesystem access) so it can be unit tested directly against inline
+// XML strings.
+export function parseAndroidManifestSource(xmlText, manifestPath) {
+    const parseWarnings = [];
+    const unsupportedConstructs = [];
+    const parsed = parseXmlDocument(xmlText);
+    for (const warning of parsed.warnings) {
+        parseWarnings.push(`${warning.message} (line ${warning.location.line}, column ${warning.location.column})`);
+    }
+    if (!parsed.ok) {
+        parseWarnings.push(`Malformed XML: ${parsed.error.message} (line ${parsed.error.location.line}, column ${parsed.error.location.column})`);
+        return {
+            manifestPath,
+            application: {},
+            permissions: [],
+            usesFeatures: [],
+            activities: [],
+            activityAliases: [],
+            services: [],
+            receivers: [],
+            providers: [],
+            deepLinks: [],
+            parseWarnings,
+            unsupportedConstructs,
+        };
+    }
+    const root = parsed.root;
+    if (root.localName !== "manifest") {
+        parseWarnings.push(`Root element is <${root.tagName}>, not <manifest> — manifest could not be interpreted.`);
+        return {
+            manifestPath,
+            application: {},
+            permissions: [],
+            usesFeatures: [],
+            activities: [],
+            activityAliases: [],
+            services: [],
+            receivers: [],
+            providers: [],
+            deepLinks: [],
+            parseWarnings,
+            unsupportedConstructs,
+        };
+    }
+    const packageName = getUnprefixedAttribute(root, "package");
+    const permissionElementNames = [
+        ["uses-permission", "uses-permission"],
+        ["uses-permission-sdk-23", "uses-permission-sdk-23"],
+        ["uses-permission-sdk-m", "uses-permission-sdk-m"],
+    ];
+    const permissions = [];
+    for (const [elementName, sourceElement] of permissionElementNames) {
+        for (const el of findChildren(root, elementName)) {
+            const name = androidAttr(el, "name");
+            if (!name) {
+                parseWarnings.push(`<${elementName}> at line ${el.location.line} is missing android:name.`);
+                continue;
+            }
+            permissions.push({
+                name,
+                maxSdkVersion: parseIntAttr(el, "maxSdkVersion", parseWarnings, `<${elementName}> "${name}"`),
+                sourceElement,
+                location: toLocation(el.location),
+            });
+        }
+    }
+    const usesFeatures = findChildren(root, "uses-feature")
+        .map((el) => {
+        const name = androidAttr(el, "name");
+        if (!name) {
+            parseWarnings.push(`<uses-feature> at line ${el.location.line} is missing android:name.`);
+            return undefined;
+        }
+        return {
+            name,
+            required: parseBooleanAttr(el, "required", parseWarnings, `<uses-feature> "${name}"`).value,
+            location: toLocation(el.location),
+        };
+    })
+        .filter((v) => v !== undefined);
+    const applicationElements = findChildren(root, "application");
+    const applicationEl = applicationElements[0];
+    if (!applicationEl) {
+        unsupportedConstructs.push("Manifest has no <application> element.");
+    }
+    if (applicationElements.length > 1) {
+        parseWarnings.push(`Manifest declares ${applicationElements.length} <application> elements; only the first was used.`);
+    }
+    const usesCleartextTrafficResult = applicationEl
+        ? parseBooleanAttr(applicationEl, "usesCleartextTraffic", parseWarnings, "<application>")
+        : undefined;
+    const allowBackupResult = applicationEl ? parseBooleanAttr(applicationEl, "allowBackup", parseWarnings, "<application>") : undefined;
+    const debuggableResult = applicationEl ? parseBooleanAttr(applicationEl, "debuggable", parseWarnings, "<application>") : undefined;
+    const testOnlyResult = applicationEl ? parseBooleanAttr(applicationEl, "testOnly", parseWarnings, "<application>") : undefined;
+    const application = applicationEl
+        ? {
+            name: androidAttr(applicationEl, "name"),
+            label: androidAttr(applicationEl, "label"),
+            iconRef: androidAttr(applicationEl, "icon"),
+            enabled: parseBooleanAttr(applicationEl, "enabled", parseWarnings, "<application>").value,
+            permission: androidAttr(applicationEl, "permission"),
+            allowBackup: allowBackupResult?.value,
+            allowBackupRaw: allowBackupResult?.raw,
+            debuggable: debuggableResult?.value,
+            debuggableRaw: debuggableResult?.raw,
+            usesCleartextTraffic: usesCleartextTrafficResult?.value,
+            usesCleartextTrafficRaw: usesCleartextTrafficResult?.raw,
+            networkSecurityConfigRef: androidAttr(applicationEl, "networkSecurityConfig"),
+            fullBackupContentRef: androidAttr(applicationEl, "fullBackupContent"),
+            dataExtractionRulesRef: androidAttr(applicationEl, "dataExtractionRules"),
+            testOnly: testOnlyResult?.value,
+            testOnlyRaw: testOnlyResult?.raw,
+            location: toLocation(applicationEl.location),
+        }
+        : {};
+    const activities = applicationEl ? findChildren(applicationEl, "activity").map((el) => parseComponent("activity", el, parseWarnings)) : [];
+    const activityAliases = applicationEl
+        ? findChildren(applicationEl, "activity-alias").map((el) => parseComponent("activity-alias", el, parseWarnings))
+        : [];
+    const services = applicationEl ? findChildren(applicationEl, "service").map((el) => parseComponent("service", el, parseWarnings)) : [];
+    const receivers = applicationEl ? findChildren(applicationEl, "receiver").map((el) => parseComponent("receiver", el, parseWarnings)) : [];
+    const providers = applicationEl ? findChildren(applicationEl, "provider").map((el) => parseComponent("provider", el, parseWarnings)) : [];
+    if (applicationEl) {
+        const knownChildNames = new Set(["activity", "activity-alias", "service", "receiver", "provider", "meta-data"]);
+        for (const child of applicationEl.children) {
+            if (!knownChildNames.has(child.localName)) {
+                unsupportedConstructs.push(`Unsupported <application> child element <${child.tagName}> at line ${child.location.line}.`);
+            }
+        }
+    }
+    const deepLinks = [];
+    let launcherActivityName;
+    for (const component of [...activities, ...activityAliases]) {
+        if (component.isLauncherActivity && !launcherActivityName) {
+            launcherActivityName = component.name;
+        }
+        for (const filter of component.intentFilters) {
+            if (filter.isDeepLinkCandidate) {
+                deepLinks.push(...(filter.dataElements ?? filter.filterData));
+            }
+        }
+    }
+    return {
+        manifestPath,
+        packageName,
+        application,
+        permissions,
+        usesFeatures,
+        activities,
+        activityAliases,
+        services,
+        receivers,
+        providers,
+        deepLinks,
+        launcherActivityName,
+        parseWarnings,
+        unsupportedConstructs,
+    };
+}
+// Reads and parses a manifest file. `manifestRelativePath` must already be
+// target-relative (as returned by AndroidDetectionResult.manifestPaths); this
+// re-validates containment before reading so a caller-supplied path can never
+// escape targetRoot.
+export function parseAndroidManifestFile(targetRoot, manifestRelativePath) {
+    const resolvedRoot = path.resolve(targetRoot);
+    let absolutePath;
+    try {
+        absolutePath = resolveWithinRoot(resolvedRoot, manifestRelativePath);
+    }
+    catch (error) {
+        return {
+            manifestPath: manifestRelativePath,
+            application: {},
+            permissions: [],
+            usesFeatures: [],
+            activities: [],
+            activityAliases: [],
+            services: [],
+            receivers: [],
+            providers: [],
+            deepLinks: [],
+            parseWarnings: [`Manifest path rejected: ${error instanceof Error ? error.message : "path escapes target root"}`],
+            unsupportedConstructs: [],
+        };
+    }
+    const normalizedPath = relativeWithinRoot(resolvedRoot, absolutePath);
+    let xmlText;
+    try {
+        xmlText = readFileSync(absolutePath, "utf8");
+    }
+    catch (error) {
+        return {
+            manifestPath: normalizedPath,
+            application: {},
+            permissions: [],
+            usesFeatures: [],
+            activities: [],
+            activityAliases: [],
+            services: [],
+            receivers: [],
+            providers: [],
+            deepLinks: [],
+            parseWarnings: [`Could not read manifest file: ${error instanceof Error ? error.message : "unknown error"}`],
+            unsupportedConstructs: [],
+        };
+    }
+    return parseAndroidManifestSource(xmlText, normalizedPath);
+}
+const KNOWN_SOURCE_SET_KINDS = ["main", "debug", "release", "androidTest", "test"];
+function inferSourceSetKind(manifestPath) {
+    const segments = manifestPath.split("/");
+    const srcIndex = segments.indexOf("src");
+    const sourceSetSegment = srcIndex !== -1 ? segments[srcIndex + 1] : undefined;
+    return KNOWN_SOURCE_SET_KINDS.includes(sourceSetSegment ?? "")
+        ? sourceSetSegment
+        : "other";
+}
+function inferModulePath(manifestPath) {
+    const srcIndex = manifestPath.indexOf("/src/");
+    return srcIndex === -1 ? undefined : manifestPath.slice(0, srcIndex);
+}
+// Parses every manifest path from a Batch 2 AndroidDetectionResult
+// independently. One malformed manifest never prevents the others from being
+// parsed. Does not merge manifests — each entry stands alone, tagged with its
+// inferred module and source-set association for later batches to use.
+export function parseAllAndroidManifests(targetRoot, detection) {
+    const moduleManifestMap = new Map();
+    for (const module of detection.modules) {
+        for (const manifestPath of module.manifestPaths) {
+            moduleManifestMap.set(manifestPath, module.path);
+        }
+    }
+    return [...detection.manifestPaths].sort((a, b) => a.localeCompare(b)).map((manifestPath) => ({
+        manifestPath,
+        modulePath: moduleManifestMap.get(manifestPath) ?? inferModulePath(manifestPath),
+        sourceSetKind: inferSourceSetKind(manifestPath),
+        manifest: parseAndroidManifestFile(targetRoot, manifestPath),
+    }));
+}

package/dist/src/mobile/android/manifest/types.js

@@ -0,0 +1,29 @@
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 1 — AndroidManifest model foundation.
+// v0.4.0 Batch 3 — narrow additive inherited-contract corrections needed by
+// manifest parsing and the initial audits (see agents.txt Batch 3 section
+// 6.7). Every change below only adds new optional fields/enum members or a
+// new optional array — no existing required field, type, or enum value was
+// removed or retyped, so all Batch 1/2 object literals remain valid:
+//   - AndroidManifestComponentKind gained "activity-alias" (section 7.6).
+//   - AndroidManifestComponent gained optional `exportedRaw` so a malformed
+//     android:exported value can be distinguished from "unspecified"
+//     (`exported` stays undefined in both cases; `exportedRaw` preserves the
+//     literal attribute text when present) — section 7.7's invariant that
+//     malformed values must never be normalized to false requires this.
+//   - AndroidManifestModel gained optional `activityAliases` (section 7.6).
+//   - AndroidIntentFilter gained optional `actions`/`categories`/
+//     `dataElements` so multiple sibling <action>/<category>/<data> children
+//     can be preserved independently (section 7.8) without discarding the
+//     original `filterData` field, which Batch 1 tests and any external
+//     consumer may already rely on; the parser keeps populating both.
+//   - AndroidIntentFilterData gained optional `location` (section 7.11).
+//   - AndroidPermissionDeclaration gained optional `sourceElement` so
+//     uses-permission / uses-permission-sdk-23 / uses-permission-sdk-m are
+//     not conflated (section 7.4, ANDROID-B3-03).
+//
+// Normalized data contracts consumed by the manifest parser and the
+// permission/component/deep-link auditors added in later batches. This file
+// defines shape only — no XML parsing and no finding generation happen here.
+// ---------------------------------------------------------------------------
+export {};