@dailephd/my-dev-kit-lab 0.3.4 → 0.4.1

package/dist/src/mobile/android/advancedSecurity/firebaseGoogle/collectFirebaseServiceEvidence.js

@@ -0,0 +1,193 @@
+import { executableMask, lineForOffset, methodScopes, scopeAt } from "../sensitiveData/localSourceContext.js";
+import { splitTopLevelArguments } from "../sensitiveData/splitArguments.js";
+import { classifyDirectExpression } from "../sensitiveData/classifyDirectExpression.js";
+import { classifySensitiveIdentifier } from "../sensitiveData/classifySensitiveIdentifier.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 6 — bounded Firebase/Google service-use, collection-metadata,
+// and analytics-event evidence collection. Purely lexical: Gradle files are
+// never evaluated, no dependency graph is resolved, and no Bundle/object
+// contents are inferred beyond direct same-method arguments.
+// ---------------------------------------------------------------------------
+const GRADLE_PLUGIN = /\bid\s*\(?["']([\w.-]*google-services|com\.google\.firebase\.crashlytics)["']\)?/g;
+const GRADLE_DEPENDENCY = /["'](?:com\.google\.firebase:)?(firebase-(?:database|firestore|storage|auth|analytics|crashlytics|messaging|perf))[:"']/g;
+// Gradle dependency/plugin coordinates are always string literals, unlike
+// Java/Kotlin executable calls — masking string *contents* (executableMask)
+// would blank out exactly the text this scanner needs to match. Only
+// comments are masked here; string literals are left intact.
+const COMMENT_ONLY = /\/\/[^\n]*|\/\*[\s\S]*?\*\//g;
+function maskCommentsOnly(source) {
+    return source.replace(COMMENT_ONLY, (match) => match.replace(/[^\n]/g, " "));
+}
+const SERVICE_BY_ARTIFACT = {
+    "firebase-database": "database",
+    "firebase-firestore": "firestore",
+    "firebase-storage": "storage",
+    "firebase-auth": "auth",
+    "firebase-analytics": "analytics",
+    "firebase-crashlytics": "crashlytics",
+    "firebase-messaging": "messaging",
+    "firebase-perf": "performance",
+};
+const SOURCE_USAGE = [
+    [/\bFirebaseDatabase\b/, "database"],
+    [/\bFirebaseFirestore\b/, "firestore"],
+    [/\bFirebaseStorage\b/, "storage"],
+    [/\bFirebaseAuth\b/, "auth"],
+    [/\bFirebaseAnalytics\b/, "analytics"],
+    [/\bFirebaseCrashlytics\b/, "crashlytics"],
+    [/\bFirebaseMessaging(?:Service)?\b/, "messaging"],
+    [/\bFirebasePerformance\b/, "performance"],
+];
+export function collectGradleServiceEvidence(file) {
+    const evidence = [];
+    const mask = maskCommentsOnly(file.content);
+    for (const match of mask.matchAll(GRADLE_PLUGIN)) {
+        const offset = match.index ?? 0;
+        evidence.push({
+            service: match[1].includes("crashlytics") ? "crashlytics" : "database",
+            source: "gradle-plugin",
+            detail: match[1],
+            relativePath: file.relativePath,
+            modulePath: file.modulePath,
+            line: lineForOffset(file.content, offset),
+        });
+    }
+    for (const match of mask.matchAll(GRADLE_DEPENDENCY)) {
+        const offset = match.index ?? 0;
+        const service = SERVICE_BY_ARTIFACT[match[1]];
+        if (!service)
+            continue;
+        evidence.push({
+            service,
+            source: "gradle-dependency",
+            detail: match[1],
+            relativePath: file.relativePath,
+            modulePath: file.modulePath,
+            line: lineForOffset(file.content, offset),
+        });
+    }
+    return evidence;
+}
+export function collectSourceServiceEvidence(file) {
+    const evidence = [];
+    const mask = executableMask(file.content);
+    for (const [pattern, service] of SOURCE_USAGE) {
+        const re = new RegExp(pattern.source, "g");
+        for (const match of mask.matchAll(re)) {
+            const offset = match.index ?? 0;
+            evidence.push({
+                service,
+                source: /^import\b/.test(mask.slice(Math.max(0, offset - 8), offset)) ? "source-import" : "source-usage",
+                detail: match[0],
+                relativePath: file.relativePath,
+                modulePath: file.modulePath,
+                line: lineForOffset(file.content, offset),
+            });
+        }
+    }
+    return evidence;
+}
+const COLLECTION_SETTER = /\b(setAnalyticsCollectionEnabled|setCrashlyticsCollectionEnabled|setAutoInitEnabled)\s*\(([^;\n]*?)\)/gd;
+function realGroup(content, match, group) {
+    const span = match.indices?.[group];
+    return span ? content.slice(span[0], span[1]) : match[group];
+}
+const SETTER_SERVICE = {
+    setAnalyticsCollectionEnabled: "analytics",
+    setCrashlyticsCollectionEnabled: "crashlytics",
+    setAutoInitEnabled: "messaging",
+};
+function stateOf(argument) {
+    if (argument === undefined)
+        return "dynamic";
+    const classification = classifyDirectExpression(argument);
+    if (classification.kind === "boolean-literal")
+        return argument.trim() === "true" ? "true" : "false";
+    return "dynamic";
+}
+export function collectCollectionSetterEvidence(file) {
+    const mask = executableMask(file.content);
+    const evidence = [];
+    for (const match of mask.matchAll(COLLECTION_SETTER)) {
+        const offset = match.index ?? 0;
+        const args = splitTopLevelArguments(realGroup(file.content, match, 2) ?? "");
+        evidence.push({
+            service: SETTER_SERVICE[match[1]],
+            state: stateOf(args[0]),
+            relativePath: file.relativePath,
+            modulePath: file.modulePath,
+            line: lineForOffset(file.content, offset),
+        });
+    }
+    return evidence;
+}
+const META_DATA_TAG = /<meta-data\b[^>]*\/?>(?:\s*<\/meta-data>)?/g;
+const NAME_ATTR = /android:name\s*=\s*"([^"]*)"/;
+const VALUE_ATTR = /android:value\s*=\s*"([^"]*)"/;
+const COLLECTION_META_NAMES = new Set([
+    "firebase_analytics_collection_enabled",
+    "firebase_crashlytics_collection_enabled",
+    "firebase_messaging_auto_init_enabled",
+    "firebase_performance_collection_enabled",
+]);
+export function collectManifestCollectionMetadata(file) {
+    const evidence = [];
+    for (const match of file.content.matchAll(META_DATA_TAG)) {
+        const tag = match[0];
+        const name = NAME_ATTR.exec(tag)?.[1];
+        if (!name || !COLLECTION_META_NAMES.has(name))
+            continue;
+        const rawValue = VALUE_ATTR.exec(tag)?.[1];
+        const state = rawValue === "true" ? "true" : rawValue === "false" ? "false" : "dynamic";
+        evidence.push({
+            name,
+            rawValue: rawValue ?? "(missing)",
+            state,
+            relativePath: file.relativePath,
+            line: lineForOffset(file.content, match.index ?? 0),
+        });
+    }
+    return evidence;
+}
+const LOG_EVENT_CALL = /\b(?:FirebaseAnalytics|analytics)\.getInstance\([^)]*\)\.logEvent\s*\(([^;\n]*?)\)|\blogEvent\s*\(([^;\n]*?)\)/gd;
+const BUNDLE_PUT = /([A-Za-z_][\w.]*)\.(putString|putLong|putDouble|putBoolean)\s*\(([^;\n]*?)\)/gd;
+export function collectAnalyticsEventEvidence(file) {
+    const mask = executableMask(file.content);
+    const scopes = methodScopes(mask);
+    const evidence = [];
+    const bundlePuts = [];
+    for (const match of mask.matchAll(BUNDLE_PUT)) {
+        const offset = match.index ?? 0;
+        const args = splitTopLevelArguments(realGroup(file.content, match, 3) ?? "");
+        bundlePuts.push({ key: args[0], value: args[1], offset, scopeId: scopeAt(scopes, offset)?.id });
+    }
+    for (const match of mask.matchAll(LOG_EVENT_CALL)) {
+        const offset = match.index ?? 0;
+        const rawArgs = realGroup(file.content, match, 1) ?? realGroup(file.content, match, 2) ?? "";
+        const args = splitTopLevelArguments(rawArgs);
+        const scopeId = scopeAt(scopes, offset)?.id;
+        let sensitiveKey;
+        let sensitiveValue;
+        let isDirectLiteral = false;
+        for (const put of bundlePuts.filter((p) => p.scopeId === scopeId)) {
+            const literal = put.key !== undefined && classifyDirectExpression(put.key).kind === "string-literal" ? classifyDirectExpression(put.key).literalValue : undefined;
+            const classification = literal !== undefined ? classifySensitiveIdentifier(literal) : undefined;
+            if (classification) {
+                sensitiveKey = put.key;
+                sensitiveValue = put.value;
+                isDirectLiteral = put.value !== undefined && classifyDirectExpression(put.value).kind === "string-literal";
+                break;
+            }
+        }
+        evidence.push({
+            eventNameExpression: args[0],
+            sensitiveParameterKey: sensitiveKey,
+            sensitiveParameterValueExpression: sensitiveValue,
+            isDirectLiteralValue: isDirectLiteral,
+            relativePath: file.relativePath,
+            modulePath: file.modulePath,
+            line: lineForOffset(file.content, offset),
+        });
+    }
+    return evidence;
+}

package/dist/src/mobile/android/advancedSecurity/firebaseGoogle/discoverFirebaseArtifacts.js

@@ -0,0 +1,128 @@
+import fs from "node:fs";
+import { collectFilesForGlobs } from "../../../../core/fileGlobs.js";
+import { discoverSecretSourceFiles, MAX_SECRET_SCAN_FILE_BYTES } from "../secretCandidates/discoverSecretSourceFiles.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 6 — bounded, target-contained discovery of Firebase/Google
+// configuration and rules artifacts.
+//
+// google-services.json and firebase.json are already covered by Batch 4's
+// discoverSecretSourceFiles (its glob list includes **/*.json), so those are
+// reused directly rather than re-discovered. .firebaserc and *.rules files
+// are not covered by that glob list (dotfiles and a non-listed extension),
+// so a small supplemental scan reuses collectFilesForGlobs (the same
+// target-containment primitive discoverSecretSourceFiles itself wraps)
+// rather than introducing a second traversal engine.
+// ---------------------------------------------------------------------------
+const NUL_CHAR = String.fromCharCode(0);
+function readSupplemental(targetRoot, globs, knownModulePaths) {
+    const files = [];
+    const skipped = [];
+    const matches = [];
+    const seen = new Set();
+    for (const glob of globs) {
+        let globMatches;
+        try {
+            globMatches = collectFilesForGlobs(targetRoot, [glob]);
+        }
+        catch {
+            continue;
+        }
+        for (const match of globMatches) {
+            if (seen.has(match.relativePath))
+                continue;
+            seen.add(match.relativePath);
+            matches.push(match);
+        }
+    }
+    for (const match of matches) {
+        const relativePath = match.relativePath.replace(/\\/g, "/");
+        if (relativePath.includes("node_modules/") || relativePath.includes(".gradle/") || relativePath.includes("build/"))
+            continue;
+        let stat;
+        try {
+            stat = fs.statSync(match.absolutePath);
+        }
+        catch (error) {
+            skipped.push({ relativePath, reason: "unreadable", detail: error instanceof Error ? error.message : undefined });
+            continue;
+        }
+        if (!stat.isFile())
+            continue;
+        if (stat.size > MAX_SECRET_SCAN_FILE_BYTES) {
+            skipped.push({ relativePath, reason: "oversized", detail: `${stat.size} bytes exceeds ${MAX_SECRET_SCAN_FILE_BYTES}` });
+            continue;
+        }
+        let content;
+        try {
+            content = fs.readFileSync(match.absolutePath, "utf8");
+        }
+        catch (error) {
+            skipped.push({ relativePath, reason: "unreadable", detail: error instanceof Error ? error.message : undefined });
+            continue;
+        }
+        if (content.indexOf(NUL_CHAR) !== -1) {
+            skipped.push({ relativePath, reason: "binary-like" });
+            continue;
+        }
+        const modulePath = knownModulePaths.find((m) => relativePath.startsWith(`${m}/`));
+        files.push({ relativePath, absolutePath: match.absolutePath, modulePath, content });
+    }
+    return { files, skipped };
+}
+export function discoverFirebaseArtifacts(targetRoot, knownModulePaths = []) {
+    const { files, skipped } = discoverSecretSourceFiles(targetRoot, knownModulePaths);
+    const googleServicesFiles = [];
+    const firebaseJsonFiles = [];
+    const databaseRulesJsonFiles = [];
+    const gradleFiles = [];
+    const sourceFiles = [];
+    const manifestFiles = [];
+    const foundRelativePaths = new Set();
+    for (const file of files) {
+        const lower = file.relativePath.toLowerCase();
+        foundRelativePaths.add(file.relativePath);
+        if (lower.endsWith("google-services.json"))
+            googleServicesFiles.push(file);
+        else if (lower.endsWith("/firebase.json") || lower === "firebase.json")
+            firebaseJsonFiles.push(file);
+        else if (lower.endsWith("database.rules.json"))
+            databaseRulesJsonFiles.push(file);
+        else if (/\.(gradle|gradle\.kts)$/.test(lower))
+            gradleFiles.push(file);
+        else if (/\.(java|kt)$/.test(lower))
+            sourceFiles.push(file);
+        else if (lower.endsWith("androidmanifest.xml"))
+            manifestFiles.push(file);
+    }
+    // Root-level filenames (e.g. a repo-root database.rules.json) are not
+    // matched by "**/*.json"-style globs, which require at least one path
+    // separator (the same limitation Batch 4's discovery module documents) —
+    // explicit root-level literals fill that gap for Firebase's well-known
+    // conventional filenames, deduplicated against what discoverSecretSourceFiles
+    // already found.
+    const rc = readSupplemental(targetRoot, ["**/.firebaserc", ".firebaserc"], knownModulePaths);
+    const rules = readSupplemental(targetRoot, ["**/*.rules", "firestore.rules", "storage.rules", "database.rules"], knownModulePaths);
+    const rootJson = readSupplemental(targetRoot, ["google-services.json", "firebase.json", "database.rules.json"], knownModulePaths);
+    for (const file of rootJson.files) {
+        if (foundRelativePaths.has(file.relativePath))
+            continue;
+        const lower = file.relativePath.toLowerCase();
+        if (lower.endsWith("google-services.json"))
+            googleServicesFiles.push(file);
+        else if (lower.endsWith("firebase.json"))
+            firebaseJsonFiles.push(file);
+        else if (lower.endsWith("database.rules.json"))
+            databaseRulesJsonFiles.push(file);
+    }
+    return {
+        googleServicesFiles,
+        firebaseJsonFiles,
+        firebaseRcFiles: rc.files,
+        databaseRulesJsonFiles,
+        rulesFiles: rules.files,
+        gradleFiles,
+        sourceFiles,
+        manifestFiles,
+        skipped: [...skipped, ...rc.skipped, ...rules.skipped, ...rootJson.skipped],
+    };
+}

package/dist/src/mobile/android/advancedSecurity/firebaseGoogle/index.js

@@ -0,0 +1 @@
+export { auditAndroidFirebaseGoogleServices, ANDROID_FIREBASE_GOOGLE_SERVICES_AUDIT_CHECK_ID } from "./checkResult.js";

package/dist/src/mobile/android/advancedSecurity/firebaseGoogle/parseDatabaseRules.js

@@ -0,0 +1,55 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 6 — bounded local Realtime Database rules parser.
+//
+// Recursively walks the parsed JSON tree collecting .read/.write/.validate/
+// .indexOn entries with their JSON path. This is not the Firebase rules
+// evaluator: no runtime auth is evaluated, and a local rules file is never
+// treated as proof of the deployed configuration.
+// ---------------------------------------------------------------------------
+const MAX_DEPTH = 40;
+const MAX_NODES = 20_000;
+const MAX_CONDITION_LENGTH = 200;
+const RULE_KEYS = new Set([".read", ".write", ".validate", ".indexOn"]);
+function summarize(value) {
+    const text = typeof value === "string" ? value : JSON.stringify(value);
+    return text.length > MAX_CONDITION_LENGTH ? `${text.slice(0, MAX_CONDITION_LENGTH)}...` : text;
+}
+export function parseDatabaseRules(file) {
+    let parsed;
+    try {
+        parsed = JSON.parse(file.content);
+    }
+    catch {
+        return { file, malformed: true, entries: [], boundsExceeded: false };
+    }
+    const root = parsed && typeof parsed === "object" ? parsed.rules ?? parsed : parsed;
+    const entries = [];
+    let nodeCount = 0;
+    let boundsExceeded = false;
+    function walk(node, jsonPath, depth) {
+        if (boundsExceeded)
+            return;
+        nodeCount += 1;
+        if (nodeCount > MAX_NODES || depth > MAX_DEPTH) {
+            boundsExceeded = true;
+            return;
+        }
+        if (node === null || typeof node !== "object" || Array.isArray(node))
+            return;
+        for (const [key, value] of Object.entries(node)) {
+            if (RULE_KEYS.has(key)) {
+                entries.push({
+                    jsonPath,
+                    operation: key,
+                    literalBoolean: typeof value === "boolean" ? value : undefined,
+                    conditionSummary: summarize(value),
+                    depth,
+                });
+                continue;
+            }
+            walk(value, jsonPath === "/" ? `/${key}` : `${jsonPath}/${key}`, depth + 1);
+        }
+    }
+    walk(root, "/", 0);
+    return { file, malformed: false, entries, boundsExceeded };
+}

package/dist/src/mobile/android/advancedSecurity/firebaseGoogle/parseFirebaseConfig.js

@@ -0,0 +1,75 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 6 — bounded, safe firebase.json and .firebaserc parsing.
+// Only the sections relevant to Android security review (rules file
+// references, project aliases) are extracted; hosting/functions/emulators
+// sections are intentionally ignored (they are unrelated to Android
+// security findings per agents.txt Batch 6 section 13.7).
+// ---------------------------------------------------------------------------
+function asRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value) ? value : undefined;
+}
+function asArray(value) {
+    return Array.isArray(value) ? value : undefined;
+}
+function asString(value) {
+    return typeof value === "string" ? value : undefined;
+}
+function collectRulesPaths(section) {
+    const paths = [];
+    const record = asRecord(section);
+    if (record) {
+        const rules = asString(record.rules);
+        if (rules)
+            paths.push(rules);
+        return paths;
+    }
+    const array = asArray(section);
+    if (array) {
+        for (const entry of array) {
+            const entryRecord = asRecord(entry);
+            const rules = asString(entryRecord?.rules);
+            if (rules)
+                paths.push(rules);
+        }
+    }
+    return paths;
+}
+export function parseFirebaseJson(file) {
+    let parsed;
+    try {
+        parsed = JSON.parse(file.content);
+    }
+    catch {
+        return { file, malformed: true, databaseRulesPaths: [], firestoreRulesPaths: [], storageRulesPaths: [] };
+    }
+    const root = asRecord(parsed);
+    if (!root)
+        return { file, malformed: true, databaseRulesPaths: [], firestoreRulesPaths: [], storageRulesPaths: [] };
+    return {
+        file,
+        malformed: false,
+        databaseRulesPaths: collectRulesPaths(root.database),
+        firestoreRulesPaths: collectRulesPaths(root.firestore),
+        storageRulesPaths: collectRulesPaths(root.storage),
+    };
+}
+export function parseFirebaseRc(file) {
+    let parsed;
+    try {
+        parsed = JSON.parse(file.content);
+    }
+    catch {
+        return { file, malformed: true, aliases: {} };
+    }
+    const root = asRecord(parsed);
+    const projects = asRecord(root?.projects);
+    if (!projects)
+        return { file, malformed: false, aliases: {} };
+    const aliases = {};
+    for (const [alias, value] of Object.entries(projects)) {
+        const projectId = asString(value);
+        if (projectId)
+            aliases[alias] = projectId;
+    }
+    return { file, malformed: false, defaultProject: aliases.default, aliases };
+}

package/dist/src/mobile/android/advancedSecurity/firebaseGoogle/parseFirestoreStorageRules.js

@@ -0,0 +1,88 @@
+import { executableMask, lineForOffset } from "../sensitiveData/localSourceContext.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 6 — bounded local Firestore/Storage security-rules parser.
+//
+// A brace-aware, comment/string-masked local scanner over `match { ... }` /
+// `allow ...: if ...;` syntax — not a full Firebase rules-language compiler.
+// Functions, imports, and complex boolean expressions are preserved only as
+// a bounded condition summary; this module never evaluates a condition and
+// never claims a rule is (or is not) the deployed configuration.
+// ---------------------------------------------------------------------------
+const MAX_MATCH_BLOCKS = 500;
+const MAX_ALLOW_STATEMENTS = 1000;
+const MAX_CONDITION_LENGTH = 300;
+const MATCH_HEADER = /\bmatch\s+([^\n{]+?)\s*\{/g;
+const ALLOW_STATEMENT = /\ballow\s+([A-Za-z,\s]+?)\s*(?::\s*if\s+([^;]+?))?\s*;/g;
+const TEST_MODE_TIME = /request\.time\s*[<>]=?\s*timestamp\.(date|value)\s*\(/;
+function braceEnd(mask, openBraceIndex) {
+    let depth = 0;
+    for (let i = openBraceIndex; i < mask.length; i += 1) {
+        if (mask[i] === "{")
+            depth += 1;
+        else if (mask[i] === "}") {
+            depth -= 1;
+            if (depth === 0)
+                return i;
+        }
+    }
+    return mask.length - 1;
+}
+function boundedCondition(condition) {
+    if (condition === undefined)
+        return "(no condition — always allowed)";
+    const trimmed = condition.trim();
+    return trimmed.length > MAX_CONDITION_LENGTH ? `${trimmed.slice(0, MAX_CONDITION_LENGTH)}...` : trimmed;
+}
+export function parseFirestoreOrStorageRules(file, service) {
+    const mask = executableMask(file.content);
+    let boundsExceeded = false;
+    const blocks = [];
+    for (const match of mask.matchAll(MATCH_HEADER)) {
+        if (blocks.length >= MAX_MATCH_BLOCKS) {
+            boundsExceeded = true;
+            break;
+        }
+        const from = match.index ?? 0;
+        const openBrace = from + match[0].length - 1;
+        blocks.push({ pattern: match[1].trim(), from, to: braceEnd(mask, openBrace) });
+    }
+    function enclosingPattern(offset) {
+        let best;
+        for (const block of blocks) {
+            if (offset >= block.from && offset <= block.to) {
+                if (best === undefined || block.to - block.from < best.to - best.from)
+                    best = block;
+            }
+        }
+        return best?.pattern ?? "(unresolved match scope)";
+    }
+    const matches = [];
+    let allowCount = 0;
+    for (const match of mask.matchAll(ALLOW_STATEMENT)) {
+        if (allowCount >= MAX_ALLOW_STATEMENTS) {
+            boundsExceeded = true;
+            break;
+        }
+        allowCount += 1;
+        const offset = match.index ?? 0;
+        const operations = match[1]
+            .split(",")
+            .map((op) => op.trim())
+            .filter(Boolean);
+        const conditionRaw = match[2]?.trim();
+        const isLiteralTrue = conditionRaw === undefined || conditionRaw === "true";
+        const isLiteralFalse = conditionRaw === "false";
+        matches.push({
+            service,
+            matchPath: enclosingPattern(offset),
+            operations,
+            conditionSummary: boundedCondition(conditionRaw),
+            isLiteralTrue,
+            isLiteralFalse,
+            hasAuthCondition: conditionRaw !== undefined && /request\.auth/.test(conditionRaw),
+            isTestModeTimeCondition: conditionRaw !== undefined && TEST_MODE_TIME.test(conditionRaw),
+            line: lineForOffset(file.content, offset),
+        });
+    }
+    return { file, malformed: false, matches, boundsExceeded };
+}

package/dist/src/mobile/android/advancedSecurity/firebaseGoogle/parseGoogleServicesConfig.js

@@ -0,0 +1,55 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 6 — bounded, safe google-services.json parsing.
+//
+// A bare Firebase API key is not a private secret by format (see
+// sensitiveCategories.ts) — this parser only records bounded presence
+// metadata (a count) for oauth_client/api_key entries, never the values
+// themselves. Malformed JSON is handled safely (never throws to the
+// caller); unsupported/unexpected shapes degrade to an empty client list
+// rather than crashing.
+// ---------------------------------------------------------------------------
+function asRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value) ? value : undefined;
+}
+function asArray(value) {
+    return Array.isArray(value) ? value : undefined;
+}
+function asString(value) {
+    return typeof value === "string" ? value : undefined;
+}
+export function parseGoogleServicesConfig(file) {
+    let parsed;
+    try {
+        parsed = JSON.parse(file.content);
+    }
+    catch {
+        return { file, malformed: true, clients: [] };
+    }
+    const root = asRecord(parsed);
+    if (!root)
+        return { file, malformed: true, clients: [] };
+    const projectInfo = asRecord(root.project_info);
+    const clientsRaw = asArray(root.client) ?? [];
+    const clients = clientsRaw.map((entry) => {
+        const clientRecord = asRecord(entry) ?? {};
+        const clientInfo = asRecord(clientRecord.client_info);
+        const androidClientInfo = asRecord(clientInfo?.android_client_info);
+        const oauthClient = asArray(clientRecord.oauth_client) ?? [];
+        const apiKey = asArray(clientRecord.api_key) ?? [];
+        return {
+            packageName: asString(androidClientInfo?.package_name),
+            mobileSdkAppId: asString(clientInfo?.mobilesdk_app_id),
+            apiKeyCount: apiKey.length,
+            oauthClientCount: oauthClient.length,
+        };
+    });
+    return {
+        file,
+        malformed: false,
+        projectId: asString(projectInfo?.project_id),
+        projectNumber: asString(projectInfo?.project_number),
+        storageBucket: asString(projectInfo?.storage_bucket),
+        firebaseUrl: asString(projectInfo?.firebase_url),
+        clients,
+    };
+}

package/dist/src/mobile/android/advancedSecurity/firebaseGoogle/types.js

@@ -0,0 +1,6 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 6 — Firebase/Google services semantic contracts. Local to
+// this feature; does not duplicate Batch 1's CandidateEvidence/
+// SecurityFinding/AndroidCheckResult.
+// ---------------------------------------------------------------------------
+export {};