@dailephd/my-dev-kit-lab 0.4.0 → 0.4.2

package/dist/src/mobile/android/advancedSecurity/releaseConfiguration/analyzeReleaseConfiguration.js

@@ -0,0 +1,221 @@
+import path from "node:path";
+import { makeAndroidFinding } from "../../audit/androidFinding.js";
+import { buildAndroidSourceLocation } from "../sourceLocation.js";
+import { makeCandidateEvidence } from "../candidateEvidence.js";
+import { extractManifestReleaseEvidence } from "./manifestEvidence.js";
+const RELEASE_BUILD_TYPE_NAME = "release";
+function loc(targetRoot, absolutePath, position) {
+    return buildAndroidSourceLocation(targetRoot, absolutePath, position);
+}
+// Exact-name match only (agents.txt Batch 3 section 9.11) — no guessing by
+// substring, no flavor/variant evaluation. All matches are preserved (a
+// module could in principle declare more than one via extraction quirks);
+// ambiguity is never resolved arbitrarily.
+function findReleaseLikeBuildTypes(gradleModule) {
+    return (gradleModule?.buildTypeDetails ?? []).filter((buildType) => buildType.name === RELEASE_BUILD_TYPE_NAME);
+}
+export function analyzeApplicationReleaseConfiguration(targetRoot, entry, gradleModules) {
+    const manifestEvidence = extractManifestReleaseEvidence(entry);
+    const candidates = [];
+    const findings = [];
+    const evidenceText = [];
+    const modulePath = entry.modulePath;
+    const manifestAbsolutePath = path.join(targetRoot, entry.manifestPath);
+    const gradleModule = gradleModules.find((m) => m.path === modulePath);
+    // Only suppressed (downgraded to candidate) when a module is confidently
+    // library-only — an ambiguous/unknown module type is still treated as an
+    // application for conservative reporting purposes.
+    const isLibraryOnlyModule = gradleModule?.isLibrary === true && gradleModule?.isApplication !== true;
+    // --- manifest debuggable ---
+    if (manifestEvidence.debuggable.state === "explicit-true") {
+        if (isLibraryOnlyModule) {
+            candidates.push(makeCandidateEvidence({
+                ruleId: "android-release-debuggable",
+                category: "android-release-configuration",
+                confidence: "low",
+                modulePath,
+                location: loc(targetRoot, manifestAbsolutePath, manifestEvidence.applicationLocation),
+                summary: 'android:debuggable="true" declared in a library module manifest (not an installable application)',
+                rawValue: manifestEvidence.debuggable.raw,
+                resolutionState: "not-applicable",
+            }));
+        }
+        else {
+            findings.push(makeAndroidFinding({
+                ruleId: "android-release-debuggable",
+                title: 'Manifest explicitly enables debuggable (android:debuggable="true")',
+                severity: "major",
+                confidence: "high",
+                description: 'The manifest\'s <application> element sets android:debuggable="true". This is high-confidence static evidence of a risky configuration if shipped in a release build; it does not prove the published/installed APK is actually debuggable — Gradle build-type configuration and manifest merging are not evaluated here.',
+                manifestPath: entry.manifestPath,
+                location: manifestEvidence.applicationLocation,
+                evidenceDetails: ["source=manifest-attribute"],
+                recommendation: 'Set android:debuggable="false" (or omit it) for release builds; confirm no debug manifest overlay reaches production.',
+            }));
+        }
+    }
+    else if (manifestEvidence.debuggable.state === "malformed") {
+        candidates.push(makeCandidateEvidence({
+            ruleId: "android-release-debuggable",
+            category: "android-release-configuration",
+            confidence: "low",
+            modulePath,
+            location: loc(targetRoot, manifestAbsolutePath, manifestEvidence.applicationLocation),
+            summary: "android:debuggable has an unresolved or malformed value",
+            rawValue: manifestEvidence.debuggable.raw,
+            resolutionState: "malformed",
+        }));
+    }
+    else if (manifestEvidence.debuggable.state === "explicit-false") {
+        evidenceText.push(`${entry.manifestPath}: manifest debuggable is explicitly false (safe)`);
+    }
+    // --- manifest testOnly ---
+    if (manifestEvidence.testOnly.state === "explicit-true") {
+        if (isLibraryOnlyModule) {
+            candidates.push(makeCandidateEvidence({
+                ruleId: "android-release-test-only",
+                category: "android-release-configuration",
+                confidence: "low",
+                modulePath,
+                location: loc(targetRoot, manifestAbsolutePath, manifestEvidence.applicationLocation),
+                summary: 'android:testOnly="true" declared in a library module manifest',
+                rawValue: manifestEvidence.testOnly.raw,
+                resolutionState: "not-applicable",
+            }));
+        }
+        else {
+            findings.push(makeAndroidFinding({
+                ruleId: "android-release-test-only",
+                title: 'Manifest explicitly marks the application test-only (android:testOnly="true")',
+                severity: "major",
+                confidence: "high",
+                description: 'The manifest\'s <application> element sets android:testOnly="true", which the platform install mechanism (and Play Store) treats as release-blocking. This does not prove the package was ever installed or published.',
+                manifestPath: entry.manifestPath,
+                location: manifestEvidence.applicationLocation,
+                evidenceDetails: ["source=manifest-attribute"],
+                recommendation: 'Remove android:testOnly="true" before release; confirm no test/debug manifest overlay reaches production.',
+            }));
+        }
+    }
+    else if (manifestEvidence.testOnly.state === "malformed") {
+        candidates.push(makeCandidateEvidence({
+            ruleId: "android-release-test-only",
+            category: "android-release-configuration",
+            confidence: "low",
+            modulePath,
+            location: loc(targetRoot, manifestAbsolutePath, manifestEvidence.applicationLocation),
+            summary: "android:testOnly has an unresolved or malformed value",
+            rawValue: manifestEvidence.testOnly.raw,
+            resolutionState: "malformed",
+        }));
+    }
+    // --- Gradle release build-type ---
+    const releaseBuildTypes = findReleaseLikeBuildTypes(gradleModule);
+    const buildFileRelativePath = gradleModule?.buildFilePath;
+    const buildFileAbsolutePath = buildFileRelativePath !== undefined ? path.join(targetRoot, buildFileRelativePath) : undefined;
+    const fallbackLocation = buildFileAbsolutePath !== undefined ? loc(targetRoot, buildFileAbsolutePath) : loc(targetRoot, manifestAbsolutePath);
+    if (releaseBuildTypes.length === 0) {
+        candidates.push(makeCandidateEvidence({
+            ruleId: "android-release-build-type-configuration",
+            category: "android-release-configuration",
+            confidence: "low",
+            modulePath,
+            location: fallbackLocation,
+            summary: `No "release" build type was statically found for module ${modulePath ?? "(unknown)"}`,
+            rawValue: undefined,
+            resolutionState: "missing",
+            staticAnalysisLimitations: [
+                "A missing release build type is not automatically a vulnerability; Gradle default build types, convention plugins, and variant configuration are not evaluated.",
+            ],
+        }));
+    }
+    let gradleReleaseDebuggableTrue = false;
+    let gradleReleaseDebuggableFalse = false;
+    for (const buildType of releaseBuildTypes) {
+        if (buildType.debuggableState === "literal-true") {
+            gradleReleaseDebuggableTrue = true;
+            if (!isLibraryOnlyModule) {
+                findings.push(makeAndroidFinding({
+                    ruleId: "android-release-debuggable",
+                    title: `Release build type "${buildType.name}" sets debuggable=true`,
+                    severity: "major",
+                    confidence: "high",
+                    description: `The Gradle release build type "${buildType.name}" sets a literal debuggable=true. This is high-confidence static evidence; it does not prove a built APK is actually debuggable — build-type/flavor/variant selection and Gradle conventions are not evaluated.`,
+                    manifestPath: buildFileRelativePath ?? entry.manifestPath,
+                    identity: buildType.name,
+                    evidenceDetails: [`buildType=${buildType.name}`, "source=gradle-literal"],
+                    recommendation: "Set debuggable=false (or remove the override) for the release build type.",
+                }));
+            }
+            else {
+                candidates.push(makeCandidateEvidence({
+                    ruleId: "android-release-debuggable",
+                    category: "android-release-configuration",
+                    confidence: "low",
+                    modulePath,
+                    location: fallbackLocation,
+                    summary: `Library module's "${buildType.name}" build type sets debuggable=true (not an installable application)`,
+                    rawValue: buildType.debuggableRaw,
+                    resolutionState: "not-applicable",
+                }));
+            }
+        }
+        else if (buildType.debuggableState === "literal-false") {
+            gradleReleaseDebuggableFalse = true;
+            evidenceText.push(`${modulePath ?? "(unknown module)"}: release build type "${buildType.name}" debuggable is explicitly false (safe)`);
+        }
+        else if (buildType.debuggableState === "dynamic") {
+            candidates.push(makeCandidateEvidence({
+                ruleId: "android-release-debuggable",
+                category: "android-release-configuration",
+                confidence: "medium",
+                modulePath,
+                location: fallbackLocation,
+                summary: `Release build type "${buildType.name}" debuggable value is a dynamic/unresolved expression`,
+                rawValue: buildType.debuggableRaw,
+                resolutionState: "unresolved",
+            }));
+        }
+        // Minification/resource-shrinking/signingConfig — release-hardening
+        // metadata only, never a finding (agents.txt Batch 3 sections 9.13/9.16).
+        evidenceText.push(`${modulePath ?? "(unknown module)"}: release build type "${buildType.name}" minifyEnabled=${buildType.minifyEnabledState}, shrinkResources=${buildType.shrinkResourcesState}`);
+        if (buildType.signingConfigRef !== undefined) {
+            evidenceText.push(`${modulePath ?? "(unknown module)"}: release build type "${buildType.name}" signingConfig=${buildType.signingConfigRef}`);
+        }
+    }
+    // --- manifest/Gradle correlation (never invents a build-time winner) ---
+    if (manifestEvidence.debuggable.state === "explicit-true" && gradleReleaseDebuggableTrue) {
+        evidenceText.push(`${entry.manifestPath}: manifest debuggable=true aligns with release build type debuggable=true (aligned risky evidence)`);
+    }
+    else if (manifestEvidence.debuggable.state === "explicit-true" && gradleReleaseDebuggableFalse) {
+        candidates.push(makeCandidateEvidence({
+            ruleId: "android-release-debuggable",
+            category: "android-release-configuration",
+            confidence: "medium",
+            modulePath,
+            location: loc(targetRoot, manifestAbsolutePath, manifestEvidence.applicationLocation),
+            summary: "Manifest debuggable=true conflicts with the release build type's literal debuggable=false",
+            rawValue: manifestEvidence.debuggable.raw,
+            resolutionState: "resolved",
+            staticAnalysisLimitations: [
+                "Precedence between the manifest attribute and Gradle build-type configuration was not evaluated; this is conflicting static evidence, not a confirmed build-time value.",
+            ],
+        }));
+    }
+    else if (manifestEvidence.debuggable.state === "explicit-false" && gradleReleaseDebuggableTrue) {
+        candidates.push(makeCandidateEvidence({
+            ruleId: "android-release-debuggable",
+            category: "android-release-configuration",
+            confidence: "medium",
+            modulePath,
+            location: loc(targetRoot, manifestAbsolutePath, manifestEvidence.applicationLocation),
+            summary: "Manifest debuggable=false conflicts with the release build type's literal debuggable=true",
+            rawValue: manifestEvidence.debuggable.raw,
+            resolutionState: "resolved",
+            staticAnalysisLimitations: [
+                "Precedence between the manifest attribute and Gradle build-type configuration was not evaluated; this is conflicting static evidence, not a confirmed build-time value.",
+            ],
+        }));
+    }
+    return { manifestEvidence, candidates, findings, evidenceText };
+}

package/dist/src/mobile/android/advancedSecurity/releaseConfiguration/checkResult.js

@@ -0,0 +1,39 @@
+import { buildAndroidManifestCheckResult } from "../../audit/checkResultBuilder.js";
+import { sortCandidateEvidence } from "../ordering.js";
+import { analyzeApplicationReleaseConfiguration } from "./analyzeReleaseConfiguration.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 3 — standalone Android debuggable/testOnly/release build-type
+// check result. Mirrors Batch 2/Batch 3-backup's checkResult.ts convention.
+// Standalone: not called from validateAndroidTarget / any active
+// orchestration, not rendered in reports, no CLI effect. Batch 8 integrates.
+// ---------------------------------------------------------------------------
+export const ANDROID_RELEASE_CONFIGURATION_AUDIT_CHECK_ID = "android-release-configuration-audit";
+export function auditAndroidReleaseConfiguration(targetRoot, detection, manifests, gradleModules) {
+    const findings = [];
+    const candidateEvidence = [];
+    const evidence = [];
+    const warnings = [];
+    for (const entry of manifests) {
+        const result = analyzeApplicationReleaseConfiguration(targetRoot, entry, gradleModules);
+        findings.push(...result.findings);
+        candidateEvidence.push(...result.candidates);
+        evidence.push(`${entry.manifestPath}: debuggable=${result.manifestEvidence.debuggable.state}, testOnly=${result.manifestEvidence.testOnly.state}`, ...result.evidenceText);
+    }
+    const base = buildAndroidManifestCheckResult({
+        id: ANDROID_RELEASE_CONFIGURATION_AUDIT_CHECK_ID,
+        category: "android-release-configuration",
+        title: "Android debuggable, testOnly, and release build-type configuration audit",
+        detection,
+        manifests,
+        findings,
+        evidence,
+        warnings: [
+            ...warnings,
+            "Static analysis only: does not evaluate Gradle variant/flavor selection, manifest merging, or whether a published APK is actually debuggable.",
+        ],
+    });
+    return {
+        ...base,
+        candidateEvidence: sortCandidateEvidence(candidateEvidence),
+    };
+}

package/dist/src/mobile/android/advancedSecurity/releaseConfiguration/index.js

@@ -0,0 +1,7 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 3 — public exports for the standalone Android debuggable/
+// testOnly/release build-type audit.
+// ---------------------------------------------------------------------------
+export { extractManifestReleaseEvidence } from "./manifestEvidence.js";
+export { analyzeApplicationReleaseConfiguration } from "./analyzeReleaseConfiguration.js";
+export { auditAndroidReleaseConfiguration, ANDROID_RELEASE_CONFIGURATION_AUDIT_CHECK_ID } from "./checkResult.js";

package/dist/src/mobile/android/advancedSecurity/releaseConfiguration/manifestEvidence.js

@@ -0,0 +1,19 @@
+function classifyBooleanAttribute(value, raw) {
+    if (value === true)
+        return { state: "explicit-true", raw: raw ?? "true" };
+    if (value === false)
+        return { state: "explicit-false", raw: raw ?? "false" };
+    if (raw !== undefined)
+        return { state: "malformed", raw };
+    return { state: "missing" };
+}
+export function extractManifestReleaseEvidence(entry) {
+    const app = entry.manifest.application;
+    return {
+        manifestPath: entry.manifestPath,
+        modulePath: entry.modulePath,
+        applicationLocation: app.location,
+        debuggable: classifyBooleanAttribute(app.debuggable, app.debuggableRaw),
+        testOnly: classifyBooleanAttribute(app.testOnly, app.testOnlyRaw),
+    };
+}

package/dist/src/mobile/android/advancedSecurity/resourceReference.js

@@ -0,0 +1,69 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 1 — Android resource-reference parsing (`@xml/...` and
+// similar). This is genuinely new: no resource-reference resolution exists
+// anywhere in the codebase yet (the manifest parser stores refs like
+// `application.networkSecurityConfigRef` verbatim, by design — see
+// src/mobile/android/manifest/types.ts's comment). This module only parses
+// the reference string into a structured shape; resourceResolution.ts
+// resolves it against the filesystem.
+// ---------------------------------------------------------------------------
+export const SUPPORTED_ANDROID_RESOURCE_TYPES = ["xml"];
+const RESOURCE_NAME_PATTERN = /^[a-z0-9_]+$/;
+// Parses a raw manifest/resource attribute value such as `@xml/network_security_config`.
+// Never throws — every input maps to a structured state.
+export function parseAndroidResourceReference(raw) {
+    if (raw.length === 0) {
+        return { state: "empty", raw };
+    }
+    const trimmed = raw.trim();
+    if (trimmed.length === 0) {
+        return { state: "malformed", raw, reason: "Reference is whitespace-only" };
+    }
+    // A `@string/app_name`-style placeholder that itself resolves to another
+    // resource is out of scope for this parser (only concrete @xml/... value
+    // references are supported); an unresolved build-variable placeholder such
+    // as `${networkSecurityConfig}` is reported distinctly.
+    if (/^\$\{.*\}$/.test(trimmed)) {
+        return { state: "placeholder", raw };
+    }
+    if (!trimmed.startsWith("@")) {
+        return { state: "malformed", raw, reason: "Reference does not start with \"@\"" };
+    }
+    const body = trimmed.slice(1);
+    if (body.length === 0) {
+        return { state: "malformed", raw, reason: "Reference has no content after \"@\"" };
+    }
+    // Package-qualified external reference: @com.example.lib:xml/name
+    const colonIndex = body.indexOf(":");
+    let packageQualifier;
+    let rest = body;
+    if (colonIndex !== -1) {
+        packageQualifier = body.slice(0, colonIndex);
+        rest = body.slice(colonIndex + 1);
+        if (packageQualifier.length === 0) {
+            return { state: "malformed", raw, reason: "Empty package qualifier before \":\"" };
+        }
+    }
+    const slashIndex = rest.indexOf("/");
+    if (slashIndex === -1) {
+        return { state: "malformed", raw, reason: "Reference is missing a \"/\" between resource type and name" };
+    }
+    const type = rest.slice(0, slashIndex);
+    const name = rest.slice(slashIndex + 1);
+    if (type.length === 0) {
+        return { state: "malformed", raw, reason: "Reference is missing a resource type" };
+    }
+    if (name.length === 0) {
+        return { state: "malformed", raw, reason: "Reference is missing a resource name" };
+    }
+    if (!RESOURCE_NAME_PATTERN.test(name)) {
+        return { state: "malformed", raw, reason: `Resource name "${name}" is not a valid Android resource identifier` };
+    }
+    if (packageQualifier !== undefined) {
+        return { state: "package-qualified", raw, packageQualifier, type, name };
+    }
+    if (!SUPPORTED_ANDROID_RESOURCE_TYPES.includes(type)) {
+        return { state: "unsupported-type", raw, type, name };
+    }
+    return { state: "parsed", raw, type: type, name };
+}

package/dist/src/mobile/android/advancedSecurity/resourceResolution.js

@@ -0,0 +1,118 @@
+import fs from "node:fs";
+import path from "node:path";
+import { relativeWithinRoot, resolveWithinRoot } from "../../../core/pathSafety.js";
+import { parseAndroidResourceReference } from "./resourceReference.js";
+const DEFAULT_SOURCE_SETS = ["main", "debug", "release"];
+// Returns true only when `candidatePath` both lexically resolves within root
+// (resolveWithinRoot) AND, if it is or passes through a symlink, its real
+// path also resolves within root. Never throws — a filesystem error (e.g.
+// broken symlink) is treated as "does not safely resolve".
+function isSafelyContainedExistingFile(root, candidatePath) {
+    try {
+        resolveWithinRoot(root, candidatePath);
+    }
+    catch {
+        return false;
+    }
+    let stat;
+    try {
+        stat = fs.lstatSync(candidatePath);
+    }
+    catch {
+        return false;
+    }
+    if (!stat.isFile() && !stat.isSymbolicLink()) {
+        return false;
+    }
+    if (stat.isSymbolicLink()) {
+        let realPath;
+        try {
+            realPath = fs.realpathSync(candidatePath);
+        }
+        catch {
+            return false;
+        }
+        try {
+            resolveWithinRoot(root, realPath);
+        }
+        catch {
+            return false;
+        }
+        try {
+            if (!fs.statSync(realPath).isFile())
+                return false;
+        }
+        catch {
+            return false;
+        }
+    }
+    return true;
+}
+function listCandidateSourceSets(root, modulePath) {
+    const srcDir = path.join(modulePath, "src");
+    let entries;
+    try {
+        entries = fs.readdirSync(srcDir);
+    }
+    catch {
+        return [...DEFAULT_SOURCE_SETS];
+    }
+    const discovered = new Set(DEFAULT_SOURCE_SETS);
+    for (const entry of entries) {
+        const entryPath = path.join(srcDir, entry);
+        try {
+            resolveWithinRoot(root, entryPath);
+        }
+        catch {
+            continue;
+        }
+        let stat;
+        try {
+            stat = fs.lstatSync(entryPath);
+        }
+        catch {
+            continue;
+        }
+        if (stat.isDirectory() || stat.isSymbolicLink()) {
+            discovered.add(entry);
+        }
+    }
+    // Deterministic order: independent of readdirSync's filesystem-dependent
+    // enumeration order.
+    return [...discovered].sort((a, b) => a.localeCompare(b));
+}
+export function resolveAndroidXmlResourceReference(root, modulePath, rawReference) {
+    const parsed = parseAndroidResourceReference(rawReference);
+    if (parsed.state === "malformed" || parsed.state === "empty" || parsed.state === "placeholder") {
+        return {
+            state: "malformed-reference",
+            reference: rawReference,
+            modulePath: relativeWithinRoot(root, modulePath),
+            reason: parsed.state === "malformed" ? parsed.reason : `Reference is ${parsed.state}, not a concrete resource value`,
+        };
+    }
+    if (parsed.state === "unsupported-type" || parsed.state === "package-qualified") {
+        return {
+            state: "unsupported-reference",
+            reference: rawReference,
+            modulePath: relativeWithinRoot(root, modulePath),
+            parsed,
+        };
+    }
+    const sourceSets = listCandidateSourceSets(root, modulePath);
+    const candidates = [];
+    for (const sourceSet of sourceSets) {
+        const candidatePath = path.join(modulePath, "src", sourceSet, "res", parsed.type, `${parsed.name}.xml`);
+        if (isSafelyContainedExistingFile(root, candidatePath)) {
+            candidates.push({ sourceSet, relativePath: relativeWithinRoot(root, candidatePath) });
+        }
+    }
+    const relativeModulePath = relativeWithinRoot(root, modulePath);
+    if (candidates.length === 0) {
+        return { state: "missing", reference: rawReference, modulePath: relativeModulePath, searchedSourceSets: sourceSets };
+    }
+    if (candidates.length === 1) {
+        return { state: "resolved", reference: rawReference, modulePath: relativeModulePath, candidates: [candidates[0]] };
+    }
+    return { state: "ambiguous", reference: rawReference, modulePath: relativeModulePath, candidates };
+}

package/dist/src/mobile/android/advancedSecurity/ruleIds.js

@@ -0,0 +1,141 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 1 — stable rule identifiers for the advanced Android security
+// checks planned for later v0.4.1 batches.
+//
+// This file defines identifiers only. No detector, finding, or check runs
+// because a rule id exists here — later batches implement the check logic
+// and reference these ids. Follows the existing per-audit-file "android-"
+// prefixed string-literal convention (see src/mobile/android/audit/*.ts:
+// android-permission-*, android-component-*, android-deep-link-*,
+// android-intent-filter-*) rather than inventing a second id scheme.
+// ---------------------------------------------------------------------------
+export const ANDROID_NETWORK_SECURITY_RULE_IDS = [
+    "android-network-cleartext-traffic",
+    "android-network-security-config",
+    "android-network-user-added-trust-anchor",
+    "android-network-debug-trust-override",
+    "android-network-broad-domain-config",
+    "android-network-pinning-metadata",
+    "android-network-pinning-unresolved",
+];
+export const ANDROID_BACKUP_RELEASE_RULE_IDS = [
+    "android-backup-allow-backup",
+    "android-backup-full-backup-content",
+    "android-backup-data-extraction-rules",
+    "android-release-debuggable",
+    "android-release-test-only",
+    "android-release-build-type-configuration",
+];
+export const ANDROID_SECRETS_SIGNING_RULE_IDS = [
+    "android-secret-hardcoded-candidate",
+    "android-secret-private-key-candidate",
+    "android-secret-token-password-candidate",
+    "android-signing-password-literal",
+    "android-signing-keystore-candidate",
+    "android-signing-path-leakage",
+    "android-signing-debug-in-release",
+];
+export const ANDROID_WEBVIEW_RULE_IDS = [
+    "android-webview-javascript-enabled",
+    "android-webview-javascript-interface-exposure",
+    "android-webview-file-content-access",
+    "android-webview-universal-file-url-access",
+    "android-webview-mixed-content",
+    "android-webview-ssl-error-proceed",
+    "android-webview-debugging-enabled",
+    "android-webview-suspicious-url-loading",
+];
+export const ANDROID_FILE_PROVIDER_RULE_IDS = [
+    "android-file-provider-exported",
+    "android-file-provider-missing-protection",
+    "android-file-provider-broad-paths",
+    "android-file-provider-missing-paths-xml",
+    "android-file-provider-malformed-paths-xml",
+    "android-file-provider-unresolved-reference",
+];
+export const ANDROID_SENSITIVE_DATA_RULE_IDS = [
+    "android-sensitive-external-storage",
+    "android-sensitive-preferences",
+    "android-sensitive-unsafe-file-database-storage",
+    "android-sensitive-logging",
+    "android-sensitive-clipboard-write",
+    "android-sensitive-clipboard-read-review",
+];
+export const ANDROID_FIREBASE_GOOGLE_RULE_IDS = [
+    "android-firebase-realtime-database-permissive-rules",
+    "android-firebase-firestore-permissive-rules",
+    "android-firebase-storage-permissive-rules",
+    "android-firebase-missing-local-rules",
+    "android-firebase-google-configuration-evidence",
+];
+export const ANDROID_OPTIONAL_TOOL_RULE_IDS = [
+    "android-optional-tool-semgrep-evidence",
+    "android-optional-tool-osv-evidence",
+    "android-optional-tool-lint-evidence",
+    "android-optional-tool-dependency-check-evidence",
+];
+// All planned v0.4.1 advanced Android rule ids in one deterministic,
+// duplicate-free list. Uniqueness across every family is verified by a
+// regression test (ANDROID-V041-B1-01) rather than assumed.
+export const ANDROID_ADVANCED_RULE_IDS = [
+    ...ANDROID_NETWORK_SECURITY_RULE_IDS,
+    ...ANDROID_BACKUP_RELEASE_RULE_IDS,
+    ...ANDROID_SECRETS_SIGNING_RULE_IDS,
+    ...ANDROID_WEBVIEW_RULE_IDS,
+    ...ANDROID_FILE_PROVIDER_RULE_IDS,
+    ...ANDROID_SENSITIVE_DATA_RULE_IDS,
+    ...ANDROID_FIREBASE_GOOGLE_RULE_IDS,
+    ...ANDROID_OPTIONAL_TOOL_RULE_IDS,
+];
+// New v0.4.1 check categories, additive to ANDROID_CHECK_CATEGORIES in
+// src/mobile/android/validation/checkResult.ts. Kept here (rather than only
+// inline in that file) so rule ids and their owning category live next to
+// each other; checkResult.ts re-exports/spreads this list additively.
+export const ANDROID_ADVANCED_CHECK_CATEGORIES = [
+    "android-network-security",
+    "android-backup-configuration",
+    "android-release-configuration",
+    "android-secret-candidates",
+    "android-signing-configuration",
+    "android-webview",
+    "android-file-provider",
+    "android-sensitive-storage",
+    "android-sensitive-logging",
+    "android-clipboard",
+    "android-firebase-google-services",
+    "android-semgrep",
+    "android-osv",
+    "android-lint",
+    "android-dependency-check",
+];
+const RULE_ID_TO_CATEGORY = new Map([
+    ...ANDROID_NETWORK_SECURITY_RULE_IDS.map((id) => [id, "android-network-security"]),
+    ...ANDROID_BACKUP_RELEASE_RULE_IDS.map((id) => [id, id.startsWith("android-backup-") ? "android-backup-configuration" : "android-release-configuration"]),
+    ...ANDROID_SECRETS_SIGNING_RULE_IDS.map((id) => [id, id.startsWith("android-secret-") ? "android-secret-candidates" : "android-signing-configuration"]),
+    ...ANDROID_WEBVIEW_RULE_IDS.map((id) => [id, "android-webview"]),
+    ...ANDROID_FILE_PROVIDER_RULE_IDS.map((id) => [id, "android-file-provider"]),
+    ...ANDROID_SENSITIVE_DATA_RULE_IDS.map((id) => {
+        if (id === "android-sensitive-logging")
+            return [id, "android-sensitive-logging"];
+        if (id.startsWith("android-sensitive-clipboard"))
+            return [id, "android-clipboard"];
+        return [id, "android-sensitive-storage"];
+    }),
+    ...ANDROID_FIREBASE_GOOGLE_RULE_IDS.map((id) => [id, "android-firebase-google-services"]),
+    ...ANDROID_OPTIONAL_TOOL_RULE_IDS.map((id) => {
+        if (id === "android-optional-tool-semgrep-evidence")
+            return [id, "android-semgrep"];
+        if (id === "android-optional-tool-osv-evidence")
+            return [id, "android-osv"];
+        if (id === "android-optional-tool-lint-evidence")
+            return [id, "android-lint"];
+        return [id, "android-dependency-check"];
+    }),
+]);
+export function categoryForAdvancedRuleId(ruleId) {
+    const category = RULE_ID_TO_CATEGORY.get(ruleId);
+    if (category === undefined) {
+        throw new Error(`No category registered for advanced Android rule id: ${ruleId}`);
+    }
+    return category;
+}