@dailephd/my-dev-kit-lab 0.4.0 → 0.4.1

package/dist/src/mobile/android/advancedSecurity/networkSecurity/analyzeNetworkSecurity.js

@@ -0,0 +1,394 @@
+import path from "node:path";
+import { makeAndroidFinding } from "../../audit/androidFinding.js";
+import { buildAndroidSourceLocation } from "../sourceLocation.js";
+import { makeCandidateEvidence } from "../candidateEvidence.js";
+import { extractManifestNetworkSecurityEvidence } from "./manifestEvidence.js";
+import { deriveEffectiveNetworkPolicy } from "./deriveEffectiveNetworkPolicy.js";
+function loc(targetRoot, absolutePath, position) {
+    return buildAndroidSourceLocation(targetRoot, absolutePath, position);
+}
+function analyzeScopeCleartext(scope, sourceRelativePath) {
+    if (scope.cleartextTrafficPermitted !== true)
+        return undefined;
+    const isBase = scope.kind === "base";
+    const domainsText = scope.domains.map((d) => d.normalized).filter((d) => d.length > 0).join(", ");
+    return makeAndroidFinding({
+        ruleId: "android-network-cleartext-traffic",
+        title: isBase
+            ? "Network Security Config base configuration permits cleartext traffic"
+            : `Network Security Config domain configuration permits cleartext traffic${domainsText ? ` (${domainsText})` : ""}`,
+        severity: isBase ? "major" : "minor",
+        confidence: "high",
+        description: isBase
+            ? "The Network Security Config's <base-config> sets cleartextTrafficPermitted=\"true\", which is high-confidence static evidence that cleartext (unencrypted) HTTP traffic is permitted application-wide unless narrowed by a more specific domain-config. This does not prove cleartext traffic actually occurs at runtime."
+            : `A <domain-config> sets cleartextTrafficPermitted="true" for the scoped domain(s) above. This is high-confidence static evidence limited to that domain scope${scope.domains.some((d) => d.includeSubdomains) ? " (including subdomains for at least one entry)" : ""}, not proof that cleartext traffic actually occurs at runtime.`,
+        manifestPath: sourceRelativePath,
+        identity: scope.scopeId,
+        location: { line: scope.location.line, column: scope.location.column },
+        evidenceDetails: [
+            `scope=${scope.kind}`,
+            `cleartextTrafficSource=${scope.cleartextTrafficSource}`,
+            ...(isBase ? [] : [`domains=${domainsText || "(none declared; scope has no resolvable domain list)"}`]),
+        ],
+        recommendation: "Disable cleartext traffic unless a specific, documented use case requires it, and scope any exception as narrowly as possible.",
+    });
+}
+function analyzeScopeTrustAnchors(scope, sourceAbsolutePath, targetRoot, modulePath, sourceRelativePath) {
+    const candidates = [];
+    const findings = [];
+    if (scope.trustAnchorsChain.length === 0)
+        return { candidates, findings };
+    // The nearest entry in the chain is the one that actually governs this
+    // scope (own, or the closest ancestor it inherited from) — not every
+    // entry in the chain, which would double-count inherited certificates
+    // once per descendant scope.
+    const nearest = scope.trustAnchorsChain[0];
+    for (const cert of nearest.certificates) {
+        const location = loc(targetRoot, sourceAbsolutePath, { line: cert.location.line, column: cert.location.column });
+        if (cert.sourceKind === "user") {
+            findings.push(makeAndroidFinding({
+                ruleId: "android-network-user-added-trust-anchor",
+                title: `${scope.kind === "base" ? "Base" : "Domain-scoped"} configuration trusts user-added certificate authorities`,
+                severity: scope.kind === "base" ? "major" : "minor",
+                confidence: "high",
+                description: "The configuration includes <certificates src=\"user\">, meaning certificates a device user has added to the trust store are trusted for TLS connections in this scope. This is high-confidence static evidence of the trust configuration itself, not proof of an active interception (e.g. MITM) attack.",
+                manifestPath: sourceRelativePath,
+                identity: scope.scopeId,
+                location: { line: cert.location.line, column: cert.location.column },
+                evidenceDetails: [`scope=${scope.kind}`, `certificatesSrc=user`, cert.overridePinsRaw !== undefined ? `overridePins=${cert.overridePinsRaw}` : undefined].filter((v) => Boolean(v)),
+                recommendation: "Avoid trusting user-added CAs in release configuration unless a specific, reviewed use case (e.g. enterprise proxy/MDM) requires it.",
+            }));
+        }
+        else if (cert.sourceKind === "raw-resource") {
+            candidates.push(makeCandidateEvidence({
+                ruleId: "android-network-user-added-trust-anchor",
+                category: "android-network-security",
+                confidence: "medium",
+                modulePath,
+                location,
+                summary: `Custom raw certificate authority referenced (@raw/${cert.rawResourceName ?? "?"}) in ${scope.kind} configuration`,
+                rawValue: cert.rawResourceName,
+                resolutionState: "resolved",
+                staticAnalysisLimitations: ["Certificate contents were not inspected or validated; a custom CA is not automatically unsafe."],
+            }));
+        }
+        else if (cert.sourceKind === "unknown") {
+            candidates.push(makeCandidateEvidence({
+                ruleId: "android-network-user-added-trust-anchor",
+                category: "android-network-security",
+                confidence: "low",
+                modulePath,
+                location,
+                summary: `Unrecognized <certificates src="..."> value in ${scope.kind} configuration`,
+                rawValue: cert.srcRaw,
+                resolutionState: "unsupported",
+            }));
+        }
+        // "system" is normal evidence, not a finding or candidate by itself.
+    }
+    return { candidates, findings };
+}
+function analyzeDebugOverrides(debugTrustAnchors, sourceAbsolutePath, targetRoot, modulePath) {
+    if (!debugTrustAnchors)
+        return [];
+    return debugTrustAnchors.certificates.map((cert) => makeCandidateEvidence({
+        ruleId: "android-network-debug-trust-override",
+        category: "android-network-security",
+        confidence: "low",
+        modulePath,
+        location: loc(targetRoot, sourceAbsolutePath, { line: cert.location.line, column: cert.location.column }),
+        summary: `Debug-only trust override: <certificates src="${cert.srcRaw ?? "unknown"}">`,
+        rawValue: cert.srcRaw,
+        resolutionState: "resolved",
+        staticAnalysisLimitations: [
+            "<debug-overrides> only applies to builds with android:debuggable=\"true\" and must never be treated as active release-build policy.",
+        ],
+    }));
+}
+const BROAD_DOMAIN_MAX_SINGLE_LABEL_LENGTH = 3;
+function analyzeDomainBroadness(scope, sourceAbsolutePath, targetRoot, modulePath) {
+    const candidates = [];
+    for (const domain of scope.domains) {
+        const location = loc(targetRoot, sourceAbsolutePath, { line: domain.location.line, column: domain.location.column });
+        if (domain.malformed) {
+            candidates.push(makeCandidateEvidence({
+                ruleId: "android-network-broad-domain-config",
+                category: "android-network-security",
+                confidence: "low",
+                modulePath,
+                location,
+                summary: "Empty or malformed <domain> entry",
+                rawValue: domain.textRaw,
+                resolutionState: "malformed",
+            }));
+            continue;
+        }
+        const isWildcardLike = domain.normalized.includes("*");
+        // A conservative "narrow" broadness signal only: a bare, very short
+        // single-label host (no dot at all) is unusual for a real public/
+        // internal domain and worth a low-confidence review candidate. Ordinary
+        // multi-label domains (including internal-looking ones) never match —
+        // per section 9.8, ambiguous/potentially-legitimate internal domains
+        // must remain unflagged rather than produce false positives.
+        const isSuspiciouslyShortSingleLabel = !domain.normalized.includes(".") && domain.normalized.length <= BROAD_DOMAIN_MAX_SINGLE_LABEL_LENGTH;
+        if (isWildcardLike || isSuspiciouslyShortSingleLabel) {
+            candidates.push(makeCandidateEvidence({
+                ruleId: "android-network-broad-domain-config",
+                category: "android-network-security",
+                confidence: "low",
+                modulePath,
+                location,
+                summary: `Potentially broad domain candidate: "${domain.normalized}"${domain.includeSubdomains ? " (includeSubdomains)" : ""}`,
+                rawValue: domain.textRaw,
+                resolutionState: "resolved",
+                staticAnalysisLimitations: [
+                    "Domain registrability/ownership was not verified (no network or public-suffix-list access); this may be a legitimate internal or short hostname.",
+                ],
+            }));
+        }
+    }
+    return candidates;
+}
+function analyzePinSet(pinSet, sourceAbsolutePath, targetRoot, modulePath) {
+    if (!pinSet)
+        return [];
+    const candidates = [];
+    candidates.push(makeCandidateEvidence({
+        ruleId: "android-network-pinning-metadata",
+        category: "android-network-security",
+        confidence: "high",
+        modulePath,
+        location: loc(targetRoot, sourceAbsolutePath, { line: pinSet.location.line, column: pinSet.location.column }),
+        summary: `Certificate pin-set present (${pinSet.pins.length} pin(s)${pinSet.expirationRaw ? `, expiration=${pinSet.expirationRaw}` : ", no expiration set"})`,
+        rawValue: pinSet.expirationRaw,
+        resolutionState: pinSet.expirationMalformed ? "malformed" : "resolved",
+        staticAnalysisLimitations: [
+            "Pin values were not validated against any live certificate or TLS connection; presence of pin metadata does not prove pinning is effective at runtime, and its absence is not automatically a vulnerability.",
+            ...(pinSet.expirationMalformed ? ["expiration attribute is not in the expected YYYY-MM-DD format."] : []),
+        ],
+    }));
+    for (const pin of pinSet.pins) {
+        if (pin.malformed || !pin.digestSupported) {
+            candidates.push(makeCandidateEvidence({
+                ruleId: "android-network-pinning-unresolved",
+                category: "android-network-security",
+                confidence: "medium",
+                modulePath,
+                location: loc(targetRoot, sourceAbsolutePath, { line: pin.location.line, column: pin.location.column }),
+                summary: pin.malformed ? `Malformed pin entry: ${pin.malformedReason}` : `Unsupported pin digest algorithm: "${pin.digestRaw}"`,
+                rawValue: pin.valuePreview,
+                resolutionState: pin.malformed ? "malformed" : "unsupported",
+            }));
+        }
+    }
+    return candidates;
+}
+function analyzeParsedFile(parseResult, fileRelativePath, targetRoot, modulePath) {
+    const fileAbsolutePath = path.join(targetRoot, fileRelativePath);
+    const policy = deriveEffectiveNetworkPolicy(parseResult);
+    const candidates = [];
+    const findings = [];
+    const scopes = [...(policy.baseScope ? [policy.baseScope] : []), ...policy.domainScopes];
+    for (const scope of scopes) {
+        const cleartextFinding = analyzeScopeCleartext(scope, fileRelativePath);
+        if (cleartextFinding)
+            findings.push(cleartextFinding);
+        const trustResult = analyzeScopeTrustAnchors(scope, fileAbsolutePath, targetRoot, modulePath, fileRelativePath);
+        candidates.push(...trustResult.candidates);
+        findings.push(...trustResult.findings);
+        candidates.push(...analyzeDomainBroadness(scope, fileAbsolutePath, targetRoot, modulePath));
+        candidates.push(...analyzePinSet(scope.pinSet, fileAbsolutePath, targetRoot, modulePath));
+    }
+    candidates.push(...analyzeDebugOverrides(policy.debugTrustAnchors, fileAbsolutePath, targetRoot, modulePath));
+    return { candidates, findings, baseCleartextExplicitFalse: policy.baseScope?.cleartextTrafficPermitted === false };
+}
+function analyzeResolvedOrAmbiguousFile(fileRelativePath, parseResult, targetRoot, modulePath) {
+    const fileAbsolutePath = path.join(targetRoot, fileRelativePath);
+    if (parseResult.state === "malformed-xml") {
+        return {
+            candidates: [
+                makeCandidateEvidence({
+                    ruleId: "android-network-security-config",
+                    category: "android-network-security",
+                    confidence: "medium",
+                    modulePath,
+                    location: loc(targetRoot, fileAbsolutePath, parseResult.location ? { line: parseResult.location.line, column: parseResult.location.column } : undefined),
+                    summary: `Referenced Network Security Config is malformed XML: ${parseResult.reason}`,
+                    rawValue: parseResult.reason,
+                    resolutionState: "malformed",
+                }),
+            ],
+            findings: [],
+            baseCleartextExplicitFalse: false,
+        };
+    }
+    if (parseResult.state === "unsupported-root") {
+        return {
+            candidates: [
+                makeCandidateEvidence({
+                    ruleId: "android-network-security-config",
+                    category: "android-network-security",
+                    confidence: "medium",
+                    modulePath,
+                    location: loc(targetRoot, fileAbsolutePath),
+                    summary: `Referenced XML file has an unsupported root element <${parseResult.rootTagName}>, not <network-security-config>`,
+                    rawValue: parseResult.rootTagName,
+                    resolutionState: "unsupported",
+                }),
+            ],
+            findings: [],
+            baseCleartextExplicitFalse: false,
+        };
+    }
+    return analyzeParsedFile(parseResult, fileRelativePath, targetRoot, modulePath);
+}
+// Analyzes one already-parsed manifest's cleartext/Network Security Config
+// evidence, without touching validateAndroidTarget or any active
+// orchestration (this function is standalone until a later integration
+// batch).
+export function analyzeManifestNetworkSecurity(targetRoot, entry) {
+    const evidence = extractManifestNetworkSecurityEvidence(targetRoot, entry);
+    const candidates = [];
+    const findings = [];
+    const modulePath = entry.modulePath;
+    const manifestAbsolutePath = path.join(targetRoot, entry.manifestPath);
+    const nsc = evidence.networkSecurityConfig;
+    let anyResolvedNsc = false;
+    let anyResolvedBaseExplicitFalse = false;
+    if (nsc.state === "resolved") {
+        anyResolvedNsc = true;
+        const result = analyzeResolvedOrAmbiguousFile(nsc.candidate.relativePath, nsc.parseResult, targetRoot, modulePath);
+        candidates.push(...result.candidates);
+        findings.push(...result.findings);
+        anyResolvedBaseExplicitFalse = result.baseCleartextExplicitFalse;
+    }
+    else if (nsc.state === "ambiguous") {
+        anyResolvedNsc = true;
+        candidates.push(makeCandidateEvidence({
+            ruleId: "android-network-security-config",
+            category: "android-network-security",
+            confidence: "low",
+            modulePath,
+            location: loc(targetRoot, manifestAbsolutePath, evidence.applicationLocation),
+            summary: `networkSecurityConfig reference "${nsc.raw}" resolved to ${nsc.candidates.length} ambiguous candidates across source sets; no candidate was arbitrarily selected`,
+            rawValue: nsc.raw,
+            resolutionState: "unresolved",
+            staticAnalysisLimitations: ["Android resource-overlay precedence between the candidates was not evaluated."],
+        }));
+        let anyBaseFalse = false;
+        for (const candidate of nsc.candidates) {
+            const result = analyzeResolvedOrAmbiguousFile(candidate.candidate.relativePath, candidate.parseResult, targetRoot, modulePath);
+            candidates.push(...result.candidates);
+            findings.push(...result.findings);
+            anyBaseFalse = anyBaseFalse || result.baseCleartextExplicitFalse;
+        }
+        anyResolvedBaseExplicitFalse = anyBaseFalse;
+    }
+    else if (nsc.state === "missing") {
+        candidates.push(makeCandidateEvidence({
+            ruleId: "android-network-security-config",
+            category: "android-network-security",
+            confidence: "low",
+            modulePath,
+            location: loc(targetRoot, manifestAbsolutePath, evidence.applicationLocation),
+            summary: `networkSecurityConfig reference "${nsc.raw}" did not resolve to any file in the searched source sets`,
+            rawValue: nsc.raw,
+            resolutionState: "missing",
+            staticAnalysisLimitations: ["A missing referenced configuration is not automatically a vulnerability; runtime behavior in this case cannot be proven statically."],
+        }));
+    }
+    else if (nsc.state === "placeholder") {
+        candidates.push(makeCandidateEvidence({
+            ruleId: "android-network-security-config",
+            category: "android-network-security",
+            confidence: "low",
+            modulePath,
+            location: loc(targetRoot, manifestAbsolutePath, evidence.applicationLocation),
+            summary: "networkSecurityConfig is an unresolved build-time placeholder",
+            rawValue: nsc.raw,
+            resolutionState: "unresolved",
+        }));
+    }
+    else if (nsc.state === "malformed") {
+        candidates.push(makeCandidateEvidence({
+            ruleId: "android-network-security-config",
+            category: "android-network-security",
+            confidence: "low",
+            modulePath,
+            location: loc(targetRoot, manifestAbsolutePath, evidence.applicationLocation),
+            summary: `networkSecurityConfig reference is malformed: ${nsc.reason}`,
+            rawValue: nsc.raw,
+            resolutionState: "malformed",
+        }));
+    }
+    else if (nsc.state === "unsupported-type" || nsc.state === "package-qualified" || nsc.state === "module-unknown") {
+        candidates.push(makeCandidateEvidence({
+            ruleId: "android-network-security-config",
+            category: "android-network-security",
+            confidence: "low",
+            modulePath,
+            location: loc(targetRoot, manifestAbsolutePath, evidence.applicationLocation),
+            summary: nsc.state === "module-unknown"
+                ? "networkSecurityConfig reference could not be resolved because this manifest's module could not be determined"
+                : `networkSecurityConfig reference is not a resolvable target-contained @xml/... resource (${nsc.state})`,
+            rawValue: nsc.raw,
+            resolutionState: "unsupported",
+        }));
+    }
+    if (evidence.usesCleartextTraffic.state === "malformed") {
+        candidates.push(makeCandidateEvidence({
+            ruleId: "android-network-cleartext-traffic",
+            category: "android-network-security",
+            confidence: "low",
+            modulePath,
+            location: loc(targetRoot, manifestAbsolutePath, evidence.applicationLocation),
+            summary: "android:usesCleartextTraffic has an unresolved or malformed value",
+            rawValue: evidence.usesCleartextTraffic.raw,
+            resolutionState: "malformed",
+        }));
+    }
+    else if (evidence.usesCleartextTraffic.state === "explicit-true") {
+        if (!anyResolvedNsc) {
+            findings.push(makeAndroidFinding({
+                ruleId: "android-network-cleartext-traffic",
+                title: "Manifest explicitly permits cleartext traffic (android:usesCleartextTraffic=\"true\")",
+                severity: "major",
+                confidence: "high",
+                description: "The manifest's <application> element sets android:usesCleartextTraffic=\"true\" with no resolvable Network Security Config to narrow it. This is high-confidence static evidence that cleartext (unencrypted) HTTP traffic is permitted application-wide; it is not proof that cleartext traffic actually occurs at runtime.",
+                manifestPath: entry.manifestPath,
+                location: evidence.applicationLocation,
+                evidenceDetails: ["source=manifest-attribute", "networkSecurityConfig=absent-or-unresolved"],
+                recommendation: "Set android:usesCleartextTraffic=\"false\" unless a specific, documented use case requires cleartext traffic.",
+            }));
+        }
+        else if (anyResolvedBaseExplicitFalse) {
+            candidates.push(makeCandidateEvidence({
+                ruleId: "android-network-cleartext-traffic",
+                category: "android-network-security",
+                confidence: "medium",
+                modulePath,
+                location: loc(targetRoot, manifestAbsolutePath, evidence.applicationLocation),
+                summary: "android:usesCleartextTraffic=\"true\" conflicts with the resolved Network Security Config's <base-config cleartextTrafficPermitted=\"false\">",
+                rawValue: evidence.usesCleartextTraffic.raw,
+                resolutionState: "resolved",
+                staticAnalysisLimitations: [
+                    "Precedence between the manifest attribute and the Network Security Config was not evaluated for a specific Android API level; this is conflicting static configuration, not a confirmed runtime state.",
+                ],
+            }));
+        }
+        else {
+            findings.push(makeAndroidFinding({
+                ruleId: "android-network-cleartext-traffic",
+                title: "Manifest explicitly permits cleartext traffic (android:usesCleartextTraffic=\"true\")",
+                severity: "major",
+                confidence: "high",
+                description: "The manifest's <application> element sets android:usesCleartextTraffic=\"true\". A Network Security Config is present but does not explicitly set cleartextTrafficPermitted=\"false\" at the base level, so this attribute's effect is not contradicted by static evidence.",
+                manifestPath: entry.manifestPath,
+                location: evidence.applicationLocation,
+                evidenceDetails: ["source=manifest-attribute", "networkSecurityConfig=resolved-non-contradicting"],
+                recommendation: "Set android:usesCleartextTraffic=\"false\" unless a specific, documented use case requires cleartext traffic.",
+            }));
+        }
+    }
+    return { evidence, candidates, findings };
+}

package/dist/src/mobile/android/advancedSecurity/networkSecurity/checkResult.js

@@ -0,0 +1,47 @@
+import { buildAndroidManifestCheckResult } from "../../audit/checkResultBuilder.js";
+import { sortCandidateEvidence } from "../ordering.js";
+import { analyzeManifestNetworkSecurity } from "./analyzeNetworkSecurity.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 2 — standalone Android network-security check result.
+//
+// Reuses the existing manifest-audit status-decision policy
+// (buildAndroidManifestCheckResult, src/mobile/android/audit/
+// checkResultBuilder.ts) rather than inventing a second one — this check
+// operates over the same AndroidManifestParseEntry[] shape as the four
+// v0.4.0 manifest audits.
+//
+// Deliberately standalone: this function is exercised directly by tests but
+// is NOT called from validateAndroidTarget / any active orchestration, not
+// rendered in text/JSON reports, and does not affect the CLI. A later
+// integration batch (Batch 8 per the version plan) wires it in.
+// ---------------------------------------------------------------------------
+export const ANDROID_NETWORK_SECURITY_AUDIT_CHECK_ID = "android-network-security-audit";
+export function auditAndroidNetworkSecurity(targetRoot, detection, manifests) {
+    const findings = [];
+    const candidateEvidence = [];
+    const evidence = [];
+    const warnings = [];
+    for (const entry of manifests) {
+        const result = analyzeManifestNetworkSecurity(targetRoot, entry);
+        findings.push(...result.findings);
+        candidateEvidence.push(...result.candidates);
+        evidence.push(`${entry.manifestPath}: usesCleartextTraffic=${result.evidence.usesCleartextTraffic.state}, networkSecurityConfig=${result.evidence.networkSecurityConfig.state}`);
+    }
+    const base = buildAndroidManifestCheckResult({
+        id: ANDROID_NETWORK_SECURITY_AUDIT_CHECK_ID,
+        category: "android-network-security",
+        title: "Android cleartext traffic and Network Security Config audit",
+        detection,
+        manifests,
+        findings,
+        evidence,
+        warnings: [
+            ...warnings,
+            "Static analysis only: does not evaluate Gradle manifest merging, Android resource overlays, or runtime network/TLS behavior.",
+        ],
+    });
+    return {
+        ...base,
+        candidateEvidence: sortCandidateEvidence(candidateEvidence),
+    };
+}

package/dist/src/mobile/android/advancedSecurity/networkSecurity/deriveEffectiveNetworkPolicy.js

@@ -0,0 +1,52 @@
+import { MAX_DOMAIN_CONFIG_DEPTH } from "./types.js";
+function walkDomainConfig(node, scopeId, depth, inheritedDomains, inheritedTrustAnchorsChain, baseCleartextTrafficPermitted, out) {
+    if (depth > MAX_DOMAIN_CONFIG_DEPTH)
+        return;
+    const domains = node.domains.length > 0 ? node.domains : inheritedDomains;
+    const domainsInherited = node.domains.length === 0 && inheritedDomains.length > 0;
+    const cleartextTrafficPermitted = node.cleartextTrafficPermitted ?? baseCleartextTrafficPermitted;
+    const cleartextTrafficSource = node.cleartextTrafficPermitted !== undefined ? "explicit" : baseCleartextTrafficPermitted !== undefined ? "inherited-from-base" : "unspecified";
+    const trustAnchorsChain = node.trustAnchors ? [node.trustAnchors, ...inheritedTrustAnchorsChain] : inheritedTrustAnchorsChain;
+    const trustAnchorsSource = node.trustAnchors ? "own" : trustAnchorsChain.length > 0 ? "inherited" : "unspecified";
+    out.push({
+        scopeId,
+        kind: "domain",
+        depth,
+        domains,
+        domainsInherited,
+        cleartextTrafficPermitted,
+        cleartextTrafficSource,
+        trustAnchorsChain,
+        trustAnchorsSource,
+        pinSet: node.pinSet,
+        location: node.location,
+    });
+    node.nested.forEach((child, index) => {
+        walkDomainConfig(child, `${scopeId}>domain-config[${index}]`, depth + 1, domains, trustAnchorsChain, baseCleartextTrafficPermitted, out);
+    });
+}
+// Derives deterministic effective policy from a "parsed" Network Security
+// Config result. Callers must narrow to the "parsed" state first — a
+// malformed/unsupported-root parse result has no policy to derive.
+export function deriveEffectiveNetworkPolicy(parsed) {
+    const baseScope = parsed.baseConfig
+        ? {
+            scopeId: "base-config",
+            kind: "base",
+            depth: 0,
+            domains: [],
+            domainsInherited: false,
+            cleartextTrafficPermitted: parsed.baseConfig.cleartextTrafficPermitted,
+            cleartextTrafficSource: parsed.baseConfig.cleartextTrafficPermitted !== undefined ? "explicit" : "unspecified",
+            trustAnchorsChain: parsed.baseConfig.trustAnchors ? [parsed.baseConfig.trustAnchors] : [],
+            trustAnchorsSource: parsed.baseConfig.trustAnchors ? "own" : "unspecified",
+            pinSet: parsed.baseConfig.pinSet,
+            location: parsed.baseConfig.location,
+        }
+        : undefined;
+    const domainScopes = [];
+    parsed.domainConfigs.forEach((node, index) => {
+        walkDomainConfig(node, `domain-config[${index}]`, 0, [], baseScope?.trustAnchorsChain ?? [], baseScope?.cleartextTrafficPermitted, domainScopes);
+    });
+    return { baseScope, domainScopes, debugTrustAnchors: parsed.debugOverrides?.trustAnchors };
+}

package/dist/src/mobile/android/advancedSecurity/networkSecurity/index.js

@@ -0,0 +1,14 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 2 — public exports for the standalone Android network-
+// security (cleartext traffic / Network Security Config) audit.
+//
+// Exports only what a later integration batch (or a test) needs: the parser,
+// the effective-policy deriver, the analyzer, and the standalone check-result
+// builder. Internal helpers (attribute parsing, bounded previews, per-scope
+// finding builders) stay unexported.
+// ---------------------------------------------------------------------------
+export { parseNetworkSecurityConfig } from "./parseNetworkSecurityConfig.js";
+export { deriveEffectiveNetworkPolicy } from "./deriveEffectiveNetworkPolicy.js";
+export { extractManifestNetworkSecurityEvidence } from "./manifestEvidence.js";
+export { analyzeManifestNetworkSecurity } from "./analyzeNetworkSecurity.js";
+export { auditAndroidNetworkSecurity, ANDROID_NETWORK_SECURITY_AUDIT_CHECK_ID } from "./checkResult.js";

package/dist/src/mobile/android/advancedSecurity/networkSecurity/manifestEvidence.js

@@ -0,0 +1,109 @@
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { parseAndroidResourceReference } from "../resourceReference.js";
+import { resolveAndroidXmlResourceReference } from "../resourceResolution.js";
+import { parseNetworkSecurityConfig } from "./parseNetworkSecurityConfig.js";
+function classifyUsesCleartextTraffic(entry) {
+    const app = entry.manifest.application;
+    if (app.usesCleartextTraffic === true)
+        return { state: "explicit-true", raw: app.usesCleartextTrafficRaw ?? "true" };
+    if (app.usesCleartextTraffic === false)
+        return { state: "explicit-false", raw: app.usesCleartextTrafficRaw ?? "false" };
+    if (app.usesCleartextTrafficRaw !== undefined)
+        return { state: "malformed", raw: app.usesCleartextTrafficRaw };
+    return { state: "missing" };
+}
+function parseNetworkSecurityConfigFile(absolutePath) {
+    let xmlText;
+    try {
+        xmlText = readFileSync(absolutePath, "utf8");
+    }
+    catch (error) {
+        return { state: "malformed-xml", reason: error instanceof Error ? error.message : "Unable to read the resolved Network Security Config file" };
+    }
+    return parseNetworkSecurityConfig(xmlText);
+}
+function classifyResolution(raw, resolution, targetRoot) {
+    switch (resolution.state) {
+        case "resolved": {
+            const candidate = resolution.candidates[0];
+            return {
+                state: "resolved",
+                raw,
+                modulePath: resolution.modulePath,
+                candidate,
+                parseResult: parseNetworkSecurityConfigFile(path.join(targetRoot, candidate.relativePath)),
+            };
+        }
+        case "ambiguous":
+            return {
+                state: "ambiguous",
+                raw,
+                modulePath: resolution.modulePath,
+                candidates: resolution.candidates.map((candidate) => ({
+                    candidate,
+                    parseResult: parseNetworkSecurityConfigFile(path.join(targetRoot, candidate.relativePath)),
+                })),
+            };
+        case "missing":
+            return { state: "missing", raw, modulePath: resolution.modulePath, searchedSourceSets: resolution.searchedSourceSets };
+        case "malformed-reference":
+            return { state: "malformed", raw, reason: resolution.reason };
+        case "unsupported-reference":
+            // Unreachable in practice: this function only calls the resolver once
+            // parseAndroidResourceReference has already confirmed a "parsed"
+            // (xml-type) reference, so the resolver's own unsupported-reference
+            // branch (package-qualified/non-xml) cannot trigger from this path.
+            // Handled defensively rather than asserted unreachable.
+            return {
+                state: "unsupported-type",
+                raw,
+                resourceType: "type" in resolution.parsed ? resolution.parsed.type : "unknown",
+            };
+    }
+}
+// Extracts and classifies cleartext-traffic/Network Security Config evidence
+// for one already-parsed manifest. `targetRoot` must be the absolute Android
+// target root (the same root the manifest/resource resolver operate within).
+export function extractManifestNetworkSecurityEvidence(targetRoot, entry) {
+    const usesCleartextTraffic = classifyUsesCleartextTraffic(entry);
+    const raw = entry.manifest.application.networkSecurityConfigRef;
+    let networkSecurityConfig;
+    if (raw === undefined) {
+        networkSecurityConfig = { state: "absent" };
+    }
+    else {
+        const parsedRef = parseAndroidResourceReference(raw);
+        if (parsedRef.state === "placeholder") {
+            networkSecurityConfig = { state: "placeholder", raw };
+        }
+        else if (parsedRef.state === "malformed") {
+            networkSecurityConfig = { state: "malformed", raw, reason: parsedRef.reason };
+        }
+        else if (parsedRef.state === "empty") {
+            networkSecurityConfig = { state: "malformed", raw, reason: "Reference is empty" };
+        }
+        else if (parsedRef.state === "unsupported-type") {
+            networkSecurityConfig = { state: "unsupported-type", raw, resourceType: parsedRef.type };
+        }
+        else if (parsedRef.state === "package-qualified") {
+            networkSecurityConfig = { state: "package-qualified", raw, packageQualifier: parsedRef.packageQualifier };
+        }
+        else if (entry.modulePath === undefined) {
+            networkSecurityConfig = { state: "module-unknown", raw };
+        }
+        else {
+            const moduleAbsolutePath = path.join(targetRoot, entry.modulePath);
+            const resolution = resolveAndroidXmlResourceReference(targetRoot, moduleAbsolutePath, raw);
+            networkSecurityConfig = classifyResolution(raw, resolution, targetRoot);
+        }
+    }
+    return {
+        manifestPath: entry.manifestPath,
+        modulePath: entry.modulePath,
+        sourceSetKind: entry.sourceSetKind,
+        applicationLocation: entry.manifest.application.location,
+        usesCleartextTraffic,
+        networkSecurityConfig,
+    };
+}