@dailephd/my-dev-kit-lab 0.4.0 → 0.4.1

package/dist/src/mobile/android/advancedSecurity/sensitiveStorage/types.js

@@ -0,0 +1,4 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 6 — sensitive-storage evidence contracts.
+// ---------------------------------------------------------------------------
+export {};

package/dist/src/mobile/android/advancedSecurity/signingConfiguration/analyzeSigningConfiguration.js

@@ -0,0 +1,270 @@
+import fs from "node:fs";
+import path from "node:path";
+import { makeAndroidFinding } from "../../audit/androidFinding.js";
+import { buildAndroidSourceLocation } from "../sourceLocation.js";
+import { makeCandidateEvidence } from "../candidateEvidence.js";
+import { extractSigningConfigurations } from "./extractSigningConfigurations.js";
+function loc(targetRoot, absolutePath, position) {
+    return buildAndroidSourceLocation(targetRoot, absolutePath, position);
+}
+function analyzeCredential(fieldLabel, value, configName, modulePath, location, buildFileRelativePath) {
+    if (value.state === "literal" && value.fingerprint !== undefined) {
+        return {
+            candidates: [],
+            findings: [
+                makeAndroidFinding({
+                    ruleId: "android-signing-password-literal",
+                    title: `Literal ${fieldLabel} in signing configuration "${configName}"`,
+                    severity: "major",
+                    confidence: "high",
+                    description: `The signing configuration "${configName}" sets a literal ${fieldLabel} value. This is high-confidence static evidence of a hardcoded signing credential; it is not proof the credential unlocks any specific keystore.`,
+                    manifestPath: buildFileRelativePath,
+                    identity: value.fingerprint,
+                    location: { line: location.line },
+                    evidenceDetails: [`signingConfig=${configName}`, `field=${fieldLabel}`, `redactedPreview=${value.redactedPreview}`],
+                    recommendation: "Remove the literal credential and load it from an environment variable or a local, untracked properties file instead.",
+                }),
+            ],
+            evidenceText: [],
+            hasLiteral: true,
+        };
+    }
+    if (value.state === "environment-reference" || value.state === "gradle-property-reference" || value.state === "local-property-reference") {
+        return {
+            candidates: [],
+            findings: [],
+            evidenceText: [`${configName}.${fieldLabel} is a ${value.state} (informational, not a hardcoded credential)`],
+            hasLiteral: false,
+        };
+    }
+    if (value.state === "variable-reference" || value.state === "method-call" || value.state === "dynamic") {
+        return {
+            candidates: [
+                makeCandidateEvidence({
+                    ruleId: "android-signing-password-literal",
+                    category: "android-signing-configuration",
+                    confidence: "low",
+                    modulePath,
+                    location,
+                    summary: `Signing configuration "${configName}"'s ${fieldLabel} is a dynamic/unresolved expression`,
+                    rawValue: value.rawExpression,
+                    resolutionState: "unresolved",
+                }),
+            ],
+            findings: [],
+            evidenceText: [],
+            hasLiteral: false,
+        };
+    }
+    return { candidates: [], findings: [], evidenceText: [], hasLiteral: false };
+}
+function analyzeStoreFile(targetRoot, config, modulePath, moduleDirRelative, location) {
+    const { storeFile } = config;
+    if (storeFile.state === "missing")
+        return { candidates: [], evidenceText: [`${config.name}.storeFile is not set`] };
+    if (storeFile.state !== "literal" || storeFile.literalValue === undefined) {
+        return {
+            candidates: [
+                makeCandidateEvidence({
+                    ruleId: "android-signing-keystore-candidate",
+                    category: "android-signing-configuration",
+                    confidence: "low",
+                    modulePath,
+                    location,
+                    summary: `Signing configuration "${config.name}"'s storeFile is a dynamic/unresolved expression`,
+                    rawValue: storeFile.rawExpression,
+                    resolutionState: "unresolved",
+                }),
+            ],
+            evidenceText: [],
+        };
+    }
+    const literalPath = storeFile.literalValue;
+    if (path.isAbsolute(literalPath)) {
+        return {
+            candidates: [
+                makeCandidateEvidence({
+                    ruleId: "android-signing-path-leakage",
+                    category: "android-signing-configuration",
+                    confidence: "medium",
+                    modulePath,
+                    location,
+                    summary: `Signing configuration "${config.name}" references an absolute local storeFile path`,
+                    rawValue: literalPath,
+                    resolutionState: "resolved",
+                    staticAnalysisLimitations: ["The absolute path may reveal local workstation directory structure; it was not resolved or opened."],
+                }),
+            ],
+            evidenceText: [],
+        };
+    }
+    const resolvedAbsolute = path.join(targetRoot, moduleDirRelative, literalPath);
+    const exists = fileExistsSafely(resolvedAbsolute);
+    if (!exists) {
+        return {
+            candidates: [
+                makeCandidateEvidence({
+                    ruleId: "android-signing-keystore-candidate",
+                    category: "android-signing-configuration",
+                    confidence: "low",
+                    modulePath,
+                    location,
+                    summary: `Signing configuration "${config.name}" references a keystore file that was not found in the target`,
+                    rawValue: literalPath,
+                    resolutionState: "missing",
+                    staticAnalysisLimitations: ["A missing referenced keystore is review evidence, not proof that signing is broken."],
+                }),
+            ],
+            evidenceText: [],
+        };
+    }
+    return { candidates: [], evidenceText: [`${config.name}.storeFile resolves to a target-contained file: ${literalPath}`] };
+}
+function fileExistsSafely(absolutePath) {
+    try {
+        return fs.existsSync(absolutePath);
+    }
+    catch {
+        return false;
+    }
+}
+function extractReleaseSigningConfigName(signingConfigRef) {
+    const getByNameMatch = signingConfigRef.match(/signingConfigs\.getByName\(\s*["'](\w[\w-]*)["']\s*\)/);
+    if (getByNameMatch)
+        return getByNameMatch[1];
+    const dotMatch = signingConfigRef.match(/signingConfigs\.(\w[\w-]*)/);
+    if (dotMatch)
+        return dotMatch[1];
+    const namedMatch = signingConfigRef.match(/signingConfigs\.named\(\s*["'](\w[\w-]*)["']\s*\)/);
+    if (namedMatch)
+        return namedMatch[1];
+    return undefined;
+}
+export function analyzeModuleSigningConfiguration(targetRoot, gradleModule, buildFileText, allKeystoreCandidates) {
+    const candidates = [];
+    const findings = [];
+    const evidenceText = [];
+    const modulePath = gradleModule.path;
+    const isLibraryOnlyModule = gradleModule.isLibrary === true && gradleModule.isApplication !== true;
+    const buildFileRelativePath = gradleModule.buildFilePath ?? modulePath;
+    const buildFileAbsolutePath = path.join(targetRoot, buildFileRelativePath);
+    const location = loc(targetRoot, buildFileAbsolutePath);
+    const signingConfigs = extractSigningConfigurations(buildFileText);
+    const literalCredentialConfigNames = new Set();
+    for (const config of signingConfigs) {
+        const storePasswordResult = analyzeCredential("storePassword", config.storePassword, config.name, modulePath, location, buildFileRelativePath);
+        const keyPasswordResult = analyzeCredential("keyPassword", config.keyPassword, config.name, modulePath, location, buildFileRelativePath);
+        const storeFileResult = analyzeStoreFile(targetRoot, config, modulePath, modulePath, location);
+        if (storePasswordResult.hasLiteral || keyPasswordResult.hasLiteral)
+            literalCredentialConfigNames.add(config.name);
+        if (isLibraryOnlyModule) {
+            // Downgrade findings to candidates for library-only modules — never
+            // suppress the evidence entirely, just its release-signing weight.
+            for (const finding of [...storePasswordResult.findings, ...keyPasswordResult.findings]) {
+                candidates.push(makeCandidateEvidence({
+                    ruleId: finding.id.split("--")[0],
+                    category: "android-signing-configuration",
+                    confidence: "low",
+                    modulePath,
+                    location,
+                    summary: `${finding.title} (library module — not an installable application)`,
+                    rawValue: undefined,
+                    resolutionState: "not-applicable",
+                }));
+            }
+        }
+        else {
+            findings.push(...storePasswordResult.findings, ...keyPasswordResult.findings);
+        }
+        candidates.push(...storePasswordResult.candidates, ...keyPasswordResult.candidates, ...storeFileResult.candidates);
+        evidenceText.push(...storePasswordResult.evidenceText, ...keyPasswordResult.evidenceText, ...storeFileResult.evidenceText);
+        // keyAlias is metadata only — never a finding/candidate by itself.
+        if (config.keyAlias.state === "literal") {
+            evidenceText.push(`${config.name}.keyAlias=${config.keyAlias.literalValue}`);
+        }
+    }
+    // --- release build-type <-> signingConfig correlation ---
+    const releaseBuildTypes = (gradleModule.buildTypeDetails ?? []).filter((bt) => bt.name === "release");
+    for (const buildType of releaseBuildTypes) {
+        if (buildType.signingConfigRef === undefined)
+            continue;
+        const referencedName = extractReleaseSigningConfigName(buildType.signingConfigRef);
+        if (referencedName === undefined) {
+            candidates.push(makeCandidateEvidence({
+                ruleId: "android-signing-debug-in-release",
+                category: "android-signing-configuration",
+                confidence: "low",
+                modulePath,
+                location,
+                summary: `Release build type's signingConfig is a dynamic/unresolved expression: ${buildType.signingConfigRef}`,
+                rawValue: buildType.signingConfigRef,
+                resolutionState: "unresolved",
+            }));
+            continue;
+        }
+        if (referencedName === "debug") {
+            const debugFinding = makeAndroidFinding({
+                ruleId: "android-signing-debug-in-release",
+                title: 'Release build type explicitly uses signingConfigs.debug',
+                severity: "major",
+                confidence: "high",
+                description: "The release build type's signingConfig references signingConfigs.debug. This is high-confidence risky release-configuration evidence; it does not prove a shipped APK was actually signed with the debug key (variant/flavor selection is not evaluated).",
+                manifestPath: buildFileRelativePath,
+                identity: "release-debug-signing",
+                evidenceDetails: [`buildType=release`, `signingConfigRef=${buildType.signingConfigRef}`],
+                recommendation: "Configure a dedicated release signing configuration and remove the reference to signingConfigs.debug.",
+            });
+            if (isLibraryOnlyModule) {
+                candidates.push(makeCandidateEvidence({
+                    ruleId: "android-signing-debug-in-release",
+                    category: "android-signing-configuration",
+                    confidence: "low",
+                    modulePath,
+                    location,
+                    summary: `${debugFinding.title} (library module — not an installable application)`,
+                    rawValue: undefined,
+                    resolutionState: "not-applicable",
+                }));
+            }
+            else {
+                findings.push(debugFinding);
+            }
+            continue;
+        }
+        const referencedConfigExists = signingConfigs.some((c) => c.name === referencedName);
+        if (!referencedConfigExists) {
+            candidates.push(makeCandidateEvidence({
+                ruleId: "android-signing-debug-in-release",
+                category: "android-signing-configuration",
+                confidence: "low",
+                modulePath,
+                location,
+                summary: `Release build type references signing config "${referencedName}", which has no matching definition in this build file`,
+                rawValue: referencedName,
+                resolutionState: "missing",
+            }));
+            continue;
+        }
+        evidenceText.push(`release build type references named signing config "${referencedName}" (ordinary metadata)`);
+        // --- committed-keystore + literal-credential + release correlation ---
+        if (literalCredentialConfigNames.has(referencedName)) {
+            const referencedConfig = signingConfigs.find((c) => c.name === referencedName);
+            const storeFileName = referencedConfig.storeFile.state === "literal" ? path.basename(referencedConfig.storeFile.literalValue ?? "") : undefined;
+            const committedKeystore = storeFileName ? allKeystoreCandidates.find((k) => path.basename(k.relativePath) === storeFileName) : undefined;
+            if (committedKeystore && !isLibraryOnlyModule) {
+                findings.push(makeAndroidFinding({
+                    ruleId: "android-signing-keystore-candidate",
+                    title: `Release signing configuration "${referencedName}" correlates with a committed keystore and a literal credential`,
+                    severity: "major",
+                    confidence: "high",
+                    description: `The release build type references signing configuration "${referencedName}", which has a literal password and a matching committed keystore file (${committedKeystore.relativePath}) in the target. This is a high-confidence aligned static signal; it does not prove the credential is valid or that this keystore is used in a published artifact.`,
+                    manifestPath: committedKeystore.relativePath,
+                    identity: `${referencedName}-committed-keystore-correlation`,
+                    evidenceDetails: [`signingConfig=${referencedName}`, `keystore=${committedKeystore.relativePath}`],
+                    recommendation: "Remove the committed keystore and credential from source control; use a secure, out-of-repo signing mechanism (e.g. CI secret store).",
+                }));
+            }
+        }
+    }
+    return { candidates, findings, evidenceText };
+}

package/dist/src/mobile/android/advancedSecurity/signingConfiguration/checkResult.js

@@ -0,0 +1,119 @@
+import fs from "node:fs";
+import path from "node:path";
+import { buildAndroidSourceLocation } from "../sourceLocation.js";
+import { makeCandidateEvidence } from "../candidateEvidence.js";
+import { sortCandidateEvidence } from "../ordering.js";
+import { discoverKeystoreCandidates } from "./discoverKeystoreCandidates.js";
+import { analyzeModuleSigningConfiguration } from "./analyzeSigningConfiguration.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 4 — standalone Android signing-configuration check result.
+//
+// Operates over Gradle module metadata rather than parsed manifests, so it
+// cannot reuse buildAndroidManifestCheckResult. Standalone: not called from
+// validateAndroidTarget / any active orchestration, not rendered in reports,
+// no CLI effect. Batch 8 integrates.
+// ---------------------------------------------------------------------------
+export const ANDROID_SIGNING_CONFIGURATION_AUDIT_CHECK_ID = "android-signing-configuration-audit";
+export function auditAndroidSigningConfiguration(targetRoot, detection, gradleModules) {
+    if (detection.projectKind === "non-android") {
+        return {
+            id: ANDROID_SIGNING_CONFIGURATION_AUDIT_CHECK_ID,
+            category: "android-signing-configuration",
+            title: "Android signing configuration audit",
+            status: "unsupported",
+            requirementLevel: "optional",
+            ran: false,
+            skipped: true,
+            skipInfo: {
+                checkId: ANDROID_SIGNING_CONFIGURATION_AUDIT_CHECK_ID,
+                reason: "Target was not detected as an Android project.",
+                requirementLevel: "optional",
+                missingCapability: "android-detection",
+                verdictImpact: "does not apply to a non-Android target",
+                recommendedNextAction: "Re-run against an Android Gradle project, or verify project detection.",
+            },
+            evidence: [],
+            findings: [],
+            warnings: [],
+            errors: [],
+            sourcePaths: [],
+            confidence: "unknown",
+            environmentRequirements: [],
+            candidateEvidence: [],
+        };
+    }
+    const modulePaths = gradleModules.map((m) => m.path);
+    const keystoreCandidates = discoverKeystoreCandidates(targetRoot, modulePaths);
+    const findingsById = new Map();
+    const candidatesById = new Map();
+    const evidence = [];
+    const warnings = [];
+    const sourcePaths = [];
+    const correlatedKeystorePaths = new Set();
+    for (const module of gradleModules) {
+        if (module.buildFilePath === undefined) {
+            warnings.push(`${module.path}: no build file path known; signing configuration was not analyzed for this module`);
+            continue;
+        }
+        const absolutePath = path.join(targetRoot, module.buildFilePath);
+        let text;
+        try {
+            text = fs.readFileSync(absolutePath, "utf8");
+        }
+        catch {
+            warnings.push(`${module.buildFilePath}: could not be read; signing configuration was not analyzed for this module`);
+            continue;
+        }
+        sourcePaths.push(module.buildFilePath);
+        const result = analyzeModuleSigningConfiguration(targetRoot, module, text, keystoreCandidates);
+        for (const finding of result.findings) {
+            findingsById.set(finding.id, finding);
+            if (finding.affectedFiles)
+                for (const p of finding.affectedFiles)
+                    correlatedKeystorePaths.add(p);
+        }
+        for (const candidate of result.candidates)
+            candidatesById.set(candidate.id, candidate);
+        evidence.push(`${module.path}: ${result.evidenceText.length} evidence note(s), ${result.findings.length} finding(s)`, ...result.evidenceText);
+    }
+    // Baseline review evidence for every committed keystore not already
+    // covered by a higher-confidence correlation finding above.
+    for (const keystore of keystoreCandidates) {
+        if (correlatedKeystorePaths.has(keystore.relativePath))
+            continue;
+        const absolutePath = path.join(targetRoot, keystore.relativePath);
+        candidatesById.set(`keystore-candidate--${keystore.relativePath}`, makeCandidateEvidence({
+            ruleId: "android-signing-keystore-candidate",
+            category: "android-signing-configuration",
+            confidence: "low",
+            modulePath: keystore.modulePath,
+            location: buildAndroidSourceLocation(targetRoot, absolutePath),
+            summary: `Committed keystore-like file found: ${keystore.relativePath}`,
+            rawValue: undefined,
+            resolutionState: "resolved",
+            staticAnalysisLimitations: [
+                "File contents were not read, opened, or validated; this does not prove the file contains a production release key.",
+            ],
+        }));
+    }
+    const findings = [...findingsById.values()].sort((a, b) => a.id.localeCompare(b.id));
+    const candidateEvidence = sortCandidateEvidence([...candidatesById.values()]);
+    const hasReportableFinding = findings.some((f) => f.severity !== "informational");
+    return {
+        id: ANDROID_SIGNING_CONFIGURATION_AUDIT_CHECK_ID,
+        category: "android-signing-configuration",
+        title: "Android signing configuration audit",
+        status: hasReportableFinding ? "failed" : "passed",
+        requirementLevel: "required",
+        ran: true,
+        skipped: false,
+        evidence,
+        findings,
+        warnings: [...warnings, "Static analysis only: does not open keystores, validate credentials, evaluate Gradle, or inspect APK/AAB signing."],
+        errors: [],
+        sourcePaths,
+        confidence: warnings.length > 0 ? "medium" : "high",
+        environmentRequirements: [],
+        candidateEvidence,
+    };
+}

package/dist/src/mobile/android/advancedSecurity/signingConfiguration/discoverKeystoreCandidates.js

@@ -0,0 +1,55 @@
+import { collectFilesForGlobs } from "../../../../core/fileGlobs.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 4 — committed keystore-file candidate discovery.
+//
+// Reuses the existing target-contained glob collector (src/core/fileGlobs.ts)
+// for traversal — no second traversal engine. Discovery is by file
+// path/extension ONLY: this module never opens, reads, or inspects file
+// contents (per agents.txt Batch 4 section 9.16).
+// ---------------------------------------------------------------------------
+const KEYSTORE_EXTENSIONS = [".jks", ".keystore", ".p12", ".pfx"];
+const KEYSTORE_GLOBS = ["**/*.jks", "**/*.keystore", "**/*.p12", "**/*.pfx"];
+const EXCLUDED_PATH_SEGMENTS = [".gradle/", "build/", "out/", "reports/"];
+function isExcludedPath(relativePath) {
+    const normalized = `${relativePath.replace(/\\/g, "/")}/`;
+    return EXCLUDED_PATH_SEGMENTS.some((segment) => normalized.includes(`/${segment}`) || normalized.startsWith(segment));
+}
+function inferModulePath(relativePath, knownModulePaths) {
+    const normalized = relativePath.replace(/\\/g, "/");
+    let best;
+    for (const modulePath of knownModulePaths) {
+        const prefix = `${modulePath.replace(/\\/g, "/")}/`;
+        if (normalized.startsWith(prefix) && (best === undefined || modulePath.length > best.length)) {
+            best = modulePath;
+        }
+    }
+    return best;
+}
+// Discovers target-contained files whose extension matches a conventional
+// Android/Java signing-container format. Path/metadata only — content is
+// never read, opened, or validated.
+export function discoverKeystoreCandidates(targetRoot, knownModulePaths = []) {
+    const candidateMap = new Map();
+    for (const glob of KEYSTORE_GLOBS) {
+        let matches;
+        try {
+            matches = collectFilesForGlobs(targetRoot, [glob]);
+        }
+        catch {
+            continue;
+        }
+        for (const match of matches) {
+            const normalizedRel = match.relativePath.replace(/\\/g, "/");
+            if (isExcludedPath(normalizedRel))
+                continue;
+            candidateMap.set(normalizedRel, match.absolutePath);
+        }
+    }
+    return [...candidateMap.keys()]
+        .sort((a, b) => a.localeCompare(b))
+        .map((relativePath) => ({
+        relativePath,
+        modulePath: inferModulePath(relativePath, knownModulePaths),
+        extension: KEYSTORE_EXTENSIONS.find((ext) => relativePath.toLowerCase().endsWith(ext)) ?? "",
+    }));
+}

package/dist/src/mobile/android/advancedSecurity/signingConfiguration/extractSigningConfigurations.js

@@ -0,0 +1,81 @@
+import { extractBooleanLiteral, extractLiteral, extractNamedSubBlocks, stripComments } from "../../gradle/moduleMetadataExtractor.js";
+import { fingerprintCandidateValue, redactedPreviewForCandidate } from "../redaction.js";
+function classifyExpressionState(result) {
+    if (result.value !== undefined)
+        return "literal";
+    if (result.raw === undefined)
+        return "missing";
+    const raw = result.raw;
+    if (/\bSystem\.getenv\b|\bproviders\.environmentVariable\b/.test(raw))
+        return "environment-reference";
+    if (/\bproviders\.gradleProperty\b|\bproject\.findProperty\b|\bfindProperty\(|(?<![A-Za-z0-9_.])\bproperty\(/.test(raw))
+        return "gradle-property-reference";
+    if (/\blocalProperties\b/i.test(raw))
+        return "local-property-reference";
+    if (/[A-Za-z_][A-Za-z0-9_]*\s*\(/.test(raw))
+        return "method-call";
+    if (/^[A-Za-z_][A-Za-z0-9_.]*$/.test(raw))
+        return "variable-reference";
+    return "dynamic";
+}
+// Bounded raw-expression preview for non-literal states. These are
+// expressions (e.g. `System.getenv("STORE_PASSWORD")`), not secrets
+// themselves, but still bounded/control-char-stripped for safety and
+// consistency with the rest of the codebase's evidence conventions.
+function boundedRawExpression(raw) {
+    return redactedPreviewForCandidate(raw, { maxLength: 120, edgeLength: 60 });
+}
+function extractPathValue(content, keys) {
+    const result = extractLiteral(content, keys);
+    const state = classifyExpressionState(result);
+    if (state === "literal")
+        return { state, literalValue: result.value };
+    if (result.raw !== undefined)
+        return { state, rawExpression: boundedRawExpression(result.raw) };
+    return { state: "missing" };
+}
+// storeFile is conventionally wrapped as `storeFile file("name.jks")` /
+// `storeFile = file("name.jks")` in both DSLs — the plain extractLiteral
+// literal-match never fires here (a call expression intervenes before the
+// quoted string), so the literal path is unwrapped explicitly first.
+function extractStoreFileValue(content) {
+    const fileWrapped = content.match(/\bstoreFile\s*=?\s*file\(\s*["']([^"']*)["']\s*\)/);
+    if (fileWrapped)
+        return { state: "literal", literalValue: fileWrapped[1] };
+    return extractPathValue(content, ["storeFile"]);
+}
+function extractCredentialValue(content, keys) {
+    const result = extractLiteral(content, keys);
+    const state = classifyExpressionState(result);
+    if (state === "literal" && result.value !== undefined) {
+        return { state, redactedPreview: redactedPreviewForCandidate(result.value), fingerprint: fingerprintCandidateValue(result.value) };
+    }
+    if (result.raw !== undefined)
+        return { state, rawExpression: boundedRawExpression(result.raw) };
+    return { state: "missing" };
+}
+function extractSigningConfigEntry(name, content) {
+    const v1 = extractBooleanLiteral(content, ["enableV1Signing", "v1SigningEnabled"]);
+    const v2 = extractBooleanLiteral(content, ["enableV2Signing", "v2SigningEnabled"]);
+    const v3 = extractBooleanLiteral(content, ["enableV3Signing", "v3SigningEnabled"]);
+    const v4 = extractBooleanLiteral(content, ["enableV4Signing", "v4SigningEnabled"]);
+    return {
+        name,
+        storeFile: extractStoreFileValue(content),
+        storePassword: extractCredentialValue(content, ["storePassword"]),
+        keyAlias: extractPathValue(content, ["keyAlias"]),
+        keyPassword: extractCredentialValue(content, ["keyPassword"]),
+        enableV1Signing: v1.value,
+        enableV2Signing: v2.value,
+        enableV3Signing: v3.value,
+        enableV4Signing: v4.value,
+    };
+}
+// Extracts every named entry inside a module build file's `signingConfigs { }`
+// block. Returns an empty array (never throws) when no such block exists.
+export function extractSigningConfigurations(rawBuildFileText) {
+    const text = stripComments(rawBuildFileText);
+    return extractNamedSubBlocks(text, "signingConfigs")
+        .map(({ name, content }) => extractSigningConfigEntry(name, content))
+        .sort((a, b) => a.name.localeCompare(b.name));
+}

package/dist/src/mobile/android/advancedSecurity/signingConfiguration/index.js

@@ -0,0 +1,8 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 4 — public exports for the standalone Android signing-
+// configuration audit.
+// ---------------------------------------------------------------------------
+export { extractSigningConfigurations } from "./extractSigningConfigurations.js";
+export { discoverKeystoreCandidates } from "./discoverKeystoreCandidates.js";
+export { analyzeModuleSigningConfiguration } from "./analyzeSigningConfiguration.js";
+export { auditAndroidSigningConfiguration, ANDROID_SIGNING_CONFIGURATION_AUDIT_CHECK_ID } from "./checkResult.js";

package/dist/src/mobile/android/advancedSecurity/signingConfiguration/types.js

@@ -0,0 +1,20 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 4 — signing-configuration model.
+//
+// Deliberately a NEW, separate type — not an additive field on the shared,
+// already-actively-rendered AndroidGradleModuleInfo/AndroidGradleMetadata
+// (src/mobile/android/gradle/types.ts). That type flows into the real,
+// currently-rendered v0.4.0 Android JSON/text report via the active
+// android-gradle-metadata check; adding a raw or even redacted-preview
+// credential field to it would put secret-shaped data on a path that already
+// renders today, before this batch's own non-disclosure guarantees can be
+// verified end-to-end by Batch 8. Keeping this type local to the standalone,
+// unregistered signingConfiguration feature means it can only ever reach a
+// report once Batch 8 deliberately wires it in.
+//
+// storeFile/keyAlias are not secrets (a path and an alias name), so their
+// literal value is retained directly. storePassword/keyPassword literal
+// values are NEVER retained here — only a redacted preview and fingerprint
+// (Batch 1 owners), computed immediately at extraction time.
+// ---------------------------------------------------------------------------
+export {};

package/dist/src/mobile/android/advancedSecurity/sourceLocation.js

@@ -0,0 +1,15 @@
+import { relativeWithinRoot } from "../../../core/pathSafety.js";
+// `absolutePath` must already be an absolute, filesystem-resolved path (the
+// same convention relativeWithinRoot's existing callers use, e.g. the
+// manifest reader) — a relative path here would be resolved against the
+// process cwd, not root, and silently produce the wrong location.
+export function buildAndroidSourceLocation(root, absolutePath, position) {
+    const relativePath = relativeWithinRoot(root, absolutePath);
+    return {
+        path: relativePath,
+        line: position?.line,
+        column: position?.column,
+        startLine: position?.startLine,
+        endLine: position?.endLine,
+    };
+}