@dailephd/my-dev-kit-lab 0.4.0 → 0.4.2

package/dist/src/mobile/android/advancedSecurity/sensitiveStorage/analyzeSensitiveStorage.js

@@ -0,0 +1,182 @@
+import { makeAndroidFinding } from "../../audit/androidFinding.js";
+import { makeCandidateEvidence } from "../candidateEvidence.js";
+import { buildAndroidSourceLocation } from "../sourceLocation.js";
+import { classifyDirectExpression } from "../sensitiveData/classifyDirectExpression.js";
+import { classifySensitiveIdentifier } from "../sensitiveData/classifySensitiveIdentifier.js";
+import { splitIdentifierWords } from "../sensitiveData/classifySensitiveIdentifier.js";
+import { collectStorageEvidence } from "./collectStorageEvidence.js";
+const SENSITIVE_FILE_NAME_WORDS = new Set([
+    "credentials",
+    "password",
+    "passwords",
+    "token",
+    "tokens",
+    "secret",
+    "secrets",
+    "session",
+    "auth",
+    "cookies",
+    "privatekey",
+    "account",
+    "userprofile",
+]);
+function literalOf(expression) {
+    if (expression === undefined)
+        return undefined;
+    const classification = classifyDirectExpression(expression);
+    return classification.kind === "string-literal" ? classification.literalValue : undefined;
+}
+function isIdentifierExpression(expression) {
+    if (expression === undefined)
+        return undefined;
+    const classification = classifyDirectExpression(expression);
+    return classification.kind === "identifier" || classification.kind === "member-access" ? expression.replace(/^.*\./, "") : undefined;
+}
+function fileNameLooksSensitive(pathHint) {
+    const literal = literalOf(pathHint);
+    const candidate = literal ?? pathHint;
+    if (!candidate)
+        return false;
+    const words = splitIdentifierWords(candidate.replace(/\.[a-z0-9]+$/i, ""));
+    return words.some((word) => SENSITIVE_FILE_NAME_WORDS.has(word));
+}
+function hasWorldMode(modeExpression) {
+    return modeExpression !== undefined && /MODE_WORLD_READABLE|MODE_WORLD_WRITEABLE/.test(modeExpression);
+}
+function hasPrivateMode(modeExpression) {
+    return modeExpression !== undefined && /MODE_PRIVATE/.test(modeExpression) && !hasWorldMode(modeExpression);
+}
+function sensitiveIdentifierFor(expression) {
+    if (expression === undefined)
+        return undefined;
+    const literal = literalOf(expression);
+    if (literal !== undefined)
+        return classifySensitiveIdentifier(literal);
+    const identifier = isIdentifierExpression(expression);
+    return identifier !== undefined ? classifySensitiveIdentifier(identifier) : undefined;
+}
+export function analyzeSensitiveStorageFile(targetRoot, file) {
+    const candidates = [];
+    const findings = [];
+    const matches = collectStorageEvidence(file.content);
+    const location = (m) => buildAndroidSourceLocation(targetRoot, file.absolutePath, { line: m.line });
+    const limitations = ["Bounded lexical source analysis; does not evaluate runtime storage contents, filesystem permissions, or scoped-storage behavior for a specific device or API level."];
+    const finding = (ruleId, title, m, evidenceDetails, severity = "major") => findings.push(makeAndroidFinding({
+        ruleId,
+        title,
+        severity,
+        confidence: "high",
+        description: `${title}. Static source evidence only; does not prove data was stored at runtime or that another application can access it.`,
+        manifestPath: file.relativePath,
+        identity: `${m.api}:${m.line}`,
+        location: { line: m.line },
+        evidenceDetails,
+        recommendation: "Avoid storing sensitive data in plaintext; use EncryptedSharedPreferences/EncryptedFile or an equivalent platform-provided encryption wrapper.",
+    }));
+    const candidate = (ruleId, m, summary, rawValue, confidence, resolutionState = "resolved") => candidates.push(makeCandidateEvidence({
+        ruleId,
+        category: "android-sensitive-storage",
+        confidence,
+        modulePath: file.modulePath,
+        location: location(m),
+        summary,
+        rawValue,
+        resolutionState,
+        staticAnalysisLimitations: limitations,
+    }));
+    for (const m of matches) {
+        if (m.kind === "shared-preferences-get") {
+            if (hasWorldMode(m.modeExpression)) {
+                finding("android-sensitive-preferences", "SharedPreferences opened with a world-readable/world-writable mode", m, [`mode=${m.modeExpression}`]);
+            }
+            else if (hasPrivateMode(m.modeExpression)) {
+                candidate("android-sensitive-preferences", m, "SharedPreferences opened with MODE_PRIVATE (restrictive, not encryption)", m.modeExpression, "low", "not-applicable");
+            }
+            else if (m.modeExpression !== undefined && classifyDirectExpression(m.modeExpression).kind !== "string-literal") {
+                candidate("android-sensitive-preferences", m, "SharedPreferences mode is dynamic or unresolved", m.modeExpression, "low", "unresolved");
+            }
+            continue;
+        }
+        if (m.kind === "shared-preferences-write") {
+            const sensitive = sensitiveIdentifierFor(m.keyExpression);
+            if (!sensitive || m.valueExpression === undefined)
+                continue;
+            const valueClassification = classifyDirectExpression(m.valueExpression);
+            if (valueClassification.kind === "string-literal") {
+                finding("android-sensitive-preferences", `Direct ${sensitive.sensitiveDataCategory} written to plaintext SharedPreferences`, m, [`key=${m.keyExpression}`]);
+            }
+            else {
+                candidate("android-sensitive-preferences", m, `Sensitive key "${m.keyExpression}" written with a dynamic SharedPreferences value`, m.valueExpression, "medium", "unresolved");
+            }
+            continue;
+        }
+        if (m.kind === "datastore-write") {
+            const sensitive = sensitiveIdentifierFor(m.keyExpression);
+            if (!sensitive)
+                continue;
+            candidate("android-sensitive-preferences", m, `Sensitive DataStore key "${m.keyExpression}" written`, m.valueExpression, "medium", "unresolved");
+            continue;
+        }
+        if (m.kind === "internal-file-write") {
+            if (hasWorldMode(m.modeExpression)) {
+                finding("android-sensitive-unsafe-file-database-storage", "Internal file opened with a world-readable/world-writable mode", m, [`mode=${m.modeExpression}`]);
+                continue;
+            }
+            const nameSensitive = fileNameLooksSensitive(m.pathHint) || (m.receiver !== "(unresolved)" && Boolean(sensitiveIdentifierFor(m.receiver)));
+            const valueSensitive = sensitiveIdentifierFor(m.valueExpression);
+            if (!nameSensitive && !valueSensitive)
+                continue;
+            const valueClassification = m.valueExpression !== undefined ? classifyDirectExpression(m.valueExpression) : undefined;
+            if (valueSensitive && valueClassification?.kind === "string-literal") {
+                finding("android-sensitive-unsafe-file-database-storage", "Direct sensitive value written to a plaintext internal file", m, [`file=${m.pathHint ?? m.receiver}`]);
+            }
+            else {
+                candidate("android-sensitive-unsafe-file-database-storage", m, "Sensitive internal file write candidate", m.valueExpression ?? m.pathHint, "medium", "unresolved");
+            }
+            continue;
+        }
+        if (m.kind === "external-file-write") {
+            const isPublic = /getExternalStorageDirectory|getExternalStoragePublicDirectory/.test(m.api);
+            const isCache = /ExternalCacheDir/.test(m.api);
+            const nameSensitive = fileNameLooksSensitive(m.pathHint);
+            if (!nameSensitive)
+                continue;
+            if (isPublic) {
+                finding("android-sensitive-external-storage", "Sensitive-looking path written to shared public external storage", m, [`path=${m.pathHint}`]);
+            }
+            else if (isCache) {
+                candidate("android-sensitive-external-storage", m, "Sensitive-looking path written to external cache", m.pathHint, "medium");
+            }
+            else {
+                candidate("android-sensitive-external-storage", m, "Sensitive-looking path written to app-specific external storage", m.pathHint, "medium");
+            }
+            continue;
+        }
+        if (m.kind === "database-write") {
+            if (m.api === "ContentValues.put") {
+                const sensitive = sensitiveIdentifierFor(m.keyExpression);
+                if (!sensitive)
+                    continue;
+                const valueClassification = m.valueExpression !== undefined ? classifyDirectExpression(m.valueExpression) : undefined;
+                if (valueClassification?.kind === "string-literal") {
+                    finding("android-sensitive-unsafe-file-database-storage", "Direct sensitive value inserted into a local database column", m, [`column=${m.keyExpression}`]);
+                }
+                else {
+                    candidate("android-sensitive-unsafe-file-database-storage", m, `Sensitive database column "${m.keyExpression}" candidate`, m.valueExpression, "medium", "unresolved");
+                }
+            }
+            else if (m.api === "execSQL" && m.valueExpression !== undefined) {
+                const words = splitIdentifierWords(m.valueExpression);
+                if (words.some((word) => classifySensitiveIdentifier(word))) {
+                    candidate("android-sensitive-unsafe-file-database-storage", m, "Sensitive-looking column name referenced in a raw SQL statement", m.valueExpression, "low");
+                }
+            }
+            continue;
+        }
+        if (m.kind === "encrypted-storage-reference") {
+            candidate("android-sensitive-preferences", m, `Protective encrypted-storage API referenced: ${m.api}`, m.api, "low", "not-applicable");
+            continue;
+        }
+    }
+    return { candidates, findings };
+}

package/dist/src/mobile/android/advancedSecurity/sensitiveStorage/checkResult.js

@@ -0,0 +1,74 @@
+import { sortCandidateEvidence } from "../ordering.js";
+import { discoverSecretSourceFiles } from "../secretCandidates/discoverSecretSourceFiles.js";
+import { analyzeSensitiveStorageFile } from "./analyzeSensitiveStorage.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 6 — standalone Android sensitive-storage check result.
+// Follows the exact Batch 4/5 standalone pattern: not called from
+// validateAndroidTarget / any active orchestration, not rendered in reports,
+// no CLI effect. Batch 8 integrates.
+// ---------------------------------------------------------------------------
+export const ANDROID_SENSITIVE_STORAGE_AUDIT_CHECK_ID = "android-sensitive-storage-audit";
+export function auditAndroidSensitiveStorage(targetRoot, detection) {
+    if (detection.projectKind === "non-android") {
+        return {
+            id: ANDROID_SENSITIVE_STORAGE_AUDIT_CHECK_ID,
+            category: "android-sensitive-storage",
+            title: "Android sensitive-storage audit",
+            status: "unsupported",
+            requirementLevel: "optional",
+            ran: false,
+            skipped: true,
+            skipInfo: {
+                checkId: ANDROID_SENSITIVE_STORAGE_AUDIT_CHECK_ID,
+                reason: "Target was not detected as an Android project.",
+                requirementLevel: "optional",
+                missingCapability: "android-detection",
+                verdictImpact: "does not apply to a non-Android target",
+                recommendedNextAction: "Re-run against an Android Gradle project, or verify project detection.",
+            },
+            evidence: [],
+            findings: [],
+            warnings: [],
+            errors: [],
+            sourcePaths: [],
+            confidence: "unknown",
+            environmentRequirements: [],
+            candidateEvidence: [],
+        };
+    }
+    const modulePaths = detection.modules.map((m) => m.path);
+    const { files, skipped } = discoverSecretSourceFiles(targetRoot, modulePaths);
+    const sourceFiles = files.filter((file) => /\.(java|kt)$/.test(file.relativePath));
+    const findingsById = new Map();
+    const candidatesById = new Map();
+    for (const file of sourceFiles) {
+        const result = analyzeSensitiveStorageFile(targetRoot, file);
+        for (const f of result.findings)
+            findingsById.set(f.id, f);
+        for (const c of result.candidates)
+            candidatesById.set(c.id, c);
+    }
+    const findings = [...findingsById.values()].sort((a, b) => a.id.localeCompare(b.id));
+    const candidateEvidence = sortCandidateEvidence([...candidatesById.values()]);
+    const hasReportableFinding = findings.some((f) => f.severity !== "informational");
+    return {
+        id: ANDROID_SENSITIVE_STORAGE_AUDIT_CHECK_ID,
+        category: "android-sensitive-storage",
+        title: "Android sensitive-storage audit",
+        status: hasReportableFinding ? "failed" : "passed",
+        requirementLevel: "required",
+        ran: true,
+        skipped: false,
+        evidence: [`${sourceFiles.length} Java/Kotlin file(s) scanned`],
+        findings,
+        warnings: [
+            ...skipped.map((s) => `${s.relativePath}: skipped (${s.reason}${s.detail ? `: ${s.detail}` : ""})`),
+            "Static analysis only: does not inspect runtime storage contents, filesystem permissions, or database records.",
+        ],
+        errors: [],
+        sourcePaths: sourceFiles.map((f) => f.relativePath),
+        confidence: skipped.length > 0 ? "medium" : "high",
+        environmentRequirements: [],
+        candidateEvidence,
+    };
+}

package/dist/src/mobile/android/advancedSecurity/sensitiveStorage/collectStorageEvidence.js

@@ -0,0 +1,109 @@
+import { executableMask, lineForOffset } from "../sensitiveData/localSourceContext.js";
+import { splitTopLevelArguments } from "../sensitiveData/splitArguments.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 6 — bounded direct evidence collection for sensitive-storage
+// APIs (SharedPreferences, DataStore, internal/external file writes,
+// database/ContentValues writes, and encrypted-storage references).
+//
+// Purely lexical: call shapes are matched over comment/string-masked text
+// (so nothing inside a comment or string literal is matched as executable
+// code), but every captured group offset is then re-sliced out of the
+// ORIGINAL, unmasked content (via regex match "indices", the `d` flag) —
+// masked text has string-literal interiors blanked out, so reading argument
+// text directly from a masked capture group would silently lose every
+// string-literal key/value. Nothing in this file constructs CandidateEvidence
+// or SecurityFinding, and nothing here is exported outside sensitiveStorage/.
+// ---------------------------------------------------------------------------
+const PUT_CALL = /([A-Za-z_][\w.]*)\.(?:edit\(\)\.)?(putString|putStringSet|putInt|putLong|putFloat|putBoolean|remove|clear|apply|commit)\s*\(([^;\n]*?)\)/gd;
+const GET_PREFS = /(?:([A-Za-z_][\w.]*)\.)?(getSharedPreferences|PreferenceManager\.getDefaultSharedPreferences)\s*\(([^;\n]*?)\)/gd;
+const DATASTORE_EDIT = /([A-Za-z_][\w.]*)\[\s*([A-Za-z_][\w.]*)\s*\]\s*=\s*([^;\n]+)/gd;
+const INTERNAL_FILE_WRITE = /(?:([A-Za-z_][\w.]*)\.)?(openFileOutput|writeText|appendText)\s*\(([^;\n]*?)\)/gd;
+const FILE_STREAM_CTOR = /new\s+(FileOutputStream|FileWriter|BufferedWriter)\s*\(([^;\n]*?)\)/gd;
+const EXTERNAL_PATH_API = /(Environment\.getExternalStorageDirectory|Environment\.getExternalStoragePublicDirectory|[A-Za-z_][\w.]*\.getExternalFilesDir|[A-Za-z_][\w.]*\.externalFilesDir|[A-Za-z_][\w.]*\.getExternalCacheDir|[A-Za-z_][\w.]*\.externalCacheDir)\s*\(?([^;\n)]*)\)?/gd;
+const CONTENT_VALUES_PUT = /([A-Za-z_][\w.]*)\.put\s*\(([^;\n]*?)\)/gd;
+const EXEC_SQL = /([A-Za-z_][\w.]*)\.execSQL\s*\(([^;\n]*?)\)/gd;
+const ENCRYPTED_STORAGE_REFERENCE = /\b(EncryptedSharedPreferences|EncryptedFile|MasterKey|AndroidKeyStore|SQLCipher)\b/gd;
+function realGroup(content, match, group) {
+    const span = match.indices?.[group];
+    if (!span)
+        return match[group];
+    return content.slice(span[0], span[1]);
+}
+function pushMatch(list, content, kind, api, offset, extra) {
+    list.push({ kind, api, receiver: extra.receiver ?? "(unresolved)", offset, line: lineForOffset(content, offset), ...extra });
+}
+export function collectStorageEvidence(content) {
+    const mask = executableMask(content);
+    const matches = [];
+    for (const match of mask.matchAll(PUT_CALL)) {
+        const offset = match.index ?? 0;
+        const args = splitTopLevelArguments(realGroup(content, match, 3) ?? "");
+        pushMatch(matches, content, "shared-preferences-write", `SharedPreferences.Editor.${match[2]}`, offset, {
+            receiver: match[1],
+            keyExpression: args[0],
+            valueExpression: args[1],
+        });
+    }
+    for (const match of mask.matchAll(GET_PREFS)) {
+        const offset = match.index ?? 0;
+        const args = splitTopLevelArguments(realGroup(content, match, 3) ?? "");
+        pushMatch(matches, content, "shared-preferences-get", match[2], offset, {
+            receiver: match[1] ?? match[2],
+            pathHint: args[0],
+            modeExpression: args[1],
+        });
+    }
+    for (const match of mask.matchAll(DATASTORE_EDIT)) {
+        const offset = match.index ?? 0;
+        pushMatch(matches, content, "datastore-write", "DataStore.edit[key]=", offset, {
+            receiver: match[1],
+            keyExpression: match[2],
+            valueExpression: realGroup(content, match, 3),
+        });
+    }
+    for (const match of mask.matchAll(INTERNAL_FILE_WRITE)) {
+        const offset = match.index ?? 0;
+        const args = splitTopLevelArguments(realGroup(content, match, 3) ?? "");
+        pushMatch(matches, content, "internal-file-write", match[2], offset, {
+            receiver: match[1],
+            pathHint: match[2] === "openFileOutput" ? args[0] : undefined,
+            modeExpression: match[2] === "openFileOutput" ? args[1] : undefined,
+            valueExpression: match[2] !== "openFileOutput" ? args[0] : undefined,
+        });
+    }
+    for (const match of mask.matchAll(FILE_STREAM_CTOR)) {
+        const offset = match.index ?? 0;
+        const args = splitTopLevelArguments(realGroup(content, match, 2) ?? "");
+        pushMatch(matches, content, "internal-file-write", `new ${match[1]}`, offset, {
+            pathHint: args[0],
+        });
+    }
+    for (const match of mask.matchAll(EXTERNAL_PATH_API)) {
+        const offset = match.index ?? 0;
+        pushMatch(matches, content, "external-file-write", match[1], offset, {
+            pathHint: realGroup(content, match, 2),
+        });
+    }
+    for (const match of mask.matchAll(CONTENT_VALUES_PUT)) {
+        const offset = match.index ?? 0;
+        const args = splitTopLevelArguments(realGroup(content, match, 2) ?? "");
+        pushMatch(matches, content, "database-write", "ContentValues.put", offset, {
+            receiver: match[1],
+            keyExpression: args[0],
+            valueExpression: args[1],
+        });
+    }
+    for (const match of mask.matchAll(EXEC_SQL)) {
+        const offset = match.index ?? 0;
+        const args = splitTopLevelArguments(realGroup(content, match, 2) ?? "");
+        pushMatch(matches, content, "database-write", "execSQL", offset, {
+            receiver: match[1],
+            valueExpression: args[0],
+        });
+    }
+    for (const match of mask.matchAll(ENCRYPTED_STORAGE_REFERENCE)) {
+        const offset = match.index ?? 0;
+        pushMatch(matches, content, "encrypted-storage-reference", match[1], offset, {});
+    }
+    return matches.sort((a, b) => a.offset - b.offset);
+}

package/dist/src/mobile/android/advancedSecurity/sensitiveStorage/index.js

@@ -0,0 +1 @@
+export { auditAndroidSensitiveStorage, ANDROID_SENSITIVE_STORAGE_AUDIT_CHECK_ID } from "./checkResult.js";

package/dist/src/mobile/android/advancedSecurity/sensitiveStorage/types.js

@@ -0,0 +1,4 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 6 — sensitive-storage evidence contracts.
+// ---------------------------------------------------------------------------
+export {};

package/dist/src/mobile/android/advancedSecurity/signingConfiguration/analyzeSigningConfiguration.js

@@ -0,0 +1,270 @@
+import fs from "node:fs";
+import path from "node:path";
+import { makeAndroidFinding } from "../../audit/androidFinding.js";
+import { buildAndroidSourceLocation } from "../sourceLocation.js";
+import { makeCandidateEvidence } from "../candidateEvidence.js";
+import { extractSigningConfigurations } from "./extractSigningConfigurations.js";
+function loc(targetRoot, absolutePath, position) {
+    return buildAndroidSourceLocation(targetRoot, absolutePath, position);
+}
+function analyzeCredential(fieldLabel, value, configName, modulePath, location, buildFileRelativePath) {
+    if (value.state === "literal" && value.fingerprint !== undefined) {
+        return {
+            candidates: [],
+            findings: [
+                makeAndroidFinding({
+                    ruleId: "android-signing-password-literal",
+                    title: `Literal ${fieldLabel} in signing configuration "${configName}"`,
+                    severity: "major",
+                    confidence: "high",
+                    description: `The signing configuration "${configName}" sets a literal ${fieldLabel} value. This is high-confidence static evidence of a hardcoded signing credential; it is not proof the credential unlocks any specific keystore.`,
+                    manifestPath: buildFileRelativePath,
+                    identity: value.fingerprint,
+                    location: { line: location.line },
+                    evidenceDetails: [`signingConfig=${configName}`, `field=${fieldLabel}`, `redactedPreview=${value.redactedPreview}`],
+                    recommendation: "Remove the literal credential and load it from an environment variable or a local, untracked properties file instead.",
+                }),
+            ],
+            evidenceText: [],
+            hasLiteral: true,
+        };
+    }
+    if (value.state === "environment-reference" || value.state === "gradle-property-reference" || value.state === "local-property-reference") {
+        return {
+            candidates: [],
+            findings: [],
+            evidenceText: [`${configName}.${fieldLabel} is a ${value.state} (informational, not a hardcoded credential)`],
+            hasLiteral: false,
+        };
+    }
+    if (value.state === "variable-reference" || value.state === "method-call" || value.state === "dynamic") {
+        return {
+            candidates: [
+                makeCandidateEvidence({
+                    ruleId: "android-signing-password-literal",
+                    category: "android-signing-configuration",
+                    confidence: "low",
+                    modulePath,
+                    location,
+                    summary: `Signing configuration "${configName}"'s ${fieldLabel} is a dynamic/unresolved expression`,
+                    rawValue: value.rawExpression,
+                    resolutionState: "unresolved",
+                }),
+            ],
+            findings: [],
+            evidenceText: [],
+            hasLiteral: false,
+        };
+    }
+    return { candidates: [], findings: [], evidenceText: [], hasLiteral: false };
+}
+function analyzeStoreFile(targetRoot, config, modulePath, moduleDirRelative, location) {
+    const { storeFile } = config;
+    if (storeFile.state === "missing")
+        return { candidates: [], evidenceText: [`${config.name}.storeFile is not set`] };
+    if (storeFile.state !== "literal" || storeFile.literalValue === undefined) {
+        return {
+            candidates: [
+                makeCandidateEvidence({
+                    ruleId: "android-signing-keystore-candidate",
+                    category: "android-signing-configuration",
+                    confidence: "low",
+                    modulePath,
+                    location,
+                    summary: `Signing configuration "${config.name}"'s storeFile is a dynamic/unresolved expression`,
+                    rawValue: storeFile.rawExpression,
+                    resolutionState: "unresolved",
+                }),
+            ],
+            evidenceText: [],
+        };
+    }
+    const literalPath = storeFile.literalValue;
+    if (path.isAbsolute(literalPath)) {
+        return {
+            candidates: [
+                makeCandidateEvidence({
+                    ruleId: "android-signing-path-leakage",
+                    category: "android-signing-configuration",
+                    confidence: "medium",
+                    modulePath,
+                    location,
+                    summary: `Signing configuration "${config.name}" references an absolute local storeFile path`,
+                    rawValue: literalPath,
+                    resolutionState: "resolved",
+                    staticAnalysisLimitations: ["The absolute path may reveal local workstation directory structure; it was not resolved or opened."],
+                }),
+            ],
+            evidenceText: [],
+        };
+    }
+    const resolvedAbsolute = path.join(targetRoot, moduleDirRelative, literalPath);
+    const exists = fileExistsSafely(resolvedAbsolute);
+    if (!exists) {
+        return {
+            candidates: [
+                makeCandidateEvidence({
+                    ruleId: "android-signing-keystore-candidate",
+                    category: "android-signing-configuration",
+                    confidence: "low",
+                    modulePath,
+                    location,
+                    summary: `Signing configuration "${config.name}" references a keystore file that was not found in the target`,
+                    rawValue: literalPath,
+                    resolutionState: "missing",
+                    staticAnalysisLimitations: ["A missing referenced keystore is review evidence, not proof that signing is broken."],
+                }),
+            ],
+            evidenceText: [],
+        };
+    }
+    return { candidates: [], evidenceText: [`${config.name}.storeFile resolves to a target-contained file: ${literalPath}`] };
+}
+function fileExistsSafely(absolutePath) {
+    try {
+        return fs.existsSync(absolutePath);
+    }
+    catch {
+        return false;
+    }
+}
+function extractReleaseSigningConfigName(signingConfigRef) {
+    const getByNameMatch = signingConfigRef.match(/signingConfigs\.getByName\(\s*["'](\w[\w-]*)["']\s*\)/);
+    if (getByNameMatch)
+        return getByNameMatch[1];
+    const dotMatch = signingConfigRef.match(/signingConfigs\.(\w[\w-]*)/);
+    if (dotMatch)
+        return dotMatch[1];
+    const namedMatch = signingConfigRef.match(/signingConfigs\.named\(\s*["'](\w[\w-]*)["']\s*\)/);
+    if (namedMatch)
+        return namedMatch[1];
+    return undefined;
+}
+export function analyzeModuleSigningConfiguration(targetRoot, gradleModule, buildFileText, allKeystoreCandidates) {
+    const candidates = [];
+    const findings = [];
+    const evidenceText = [];
+    const modulePath = gradleModule.path;
+    const isLibraryOnlyModule = gradleModule.isLibrary === true && gradleModule.isApplication !== true;
+    const buildFileRelativePath = gradleModule.buildFilePath ?? modulePath;
+    const buildFileAbsolutePath = path.join(targetRoot, buildFileRelativePath);
+    const location = loc(targetRoot, buildFileAbsolutePath);
+    const signingConfigs = extractSigningConfigurations(buildFileText);
+    const literalCredentialConfigNames = new Set();
+    for (const config of signingConfigs) {
+        const storePasswordResult = analyzeCredential("storePassword", config.storePassword, config.name, modulePath, location, buildFileRelativePath);
+        const keyPasswordResult = analyzeCredential("keyPassword", config.keyPassword, config.name, modulePath, location, buildFileRelativePath);
+        const storeFileResult = analyzeStoreFile(targetRoot, config, modulePath, modulePath, location);
+        if (storePasswordResult.hasLiteral || keyPasswordResult.hasLiteral)
+            literalCredentialConfigNames.add(config.name);
+        if (isLibraryOnlyModule) {
+            // Downgrade findings to candidates for library-only modules — never
+            // suppress the evidence entirely, just its release-signing weight.
+            for (const finding of [...storePasswordResult.findings, ...keyPasswordResult.findings]) {
+                candidates.push(makeCandidateEvidence({
+                    ruleId: finding.id.split("--")[0],
+                    category: "android-signing-configuration",
+                    confidence: "low",
+                    modulePath,
+                    location,
+                    summary: `${finding.title} (library module — not an installable application)`,
+                    rawValue: undefined,
+                    resolutionState: "not-applicable",
+                }));
+            }
+        }
+        else {
+            findings.push(...storePasswordResult.findings, ...keyPasswordResult.findings);
+        }
+        candidates.push(...storePasswordResult.candidates, ...keyPasswordResult.candidates, ...storeFileResult.candidates);
+        evidenceText.push(...storePasswordResult.evidenceText, ...keyPasswordResult.evidenceText, ...storeFileResult.evidenceText);
+        // keyAlias is metadata only — never a finding/candidate by itself.
+        if (config.keyAlias.state === "literal") {
+            evidenceText.push(`${config.name}.keyAlias=${config.keyAlias.literalValue}`);
+        }
+    }
+    // --- release build-type <-> signingConfig correlation ---
+    const releaseBuildTypes = (gradleModule.buildTypeDetails ?? []).filter((bt) => bt.name === "release");
+    for (const buildType of releaseBuildTypes) {
+        if (buildType.signingConfigRef === undefined)
+            continue;
+        const referencedName = extractReleaseSigningConfigName(buildType.signingConfigRef);
+        if (referencedName === undefined) {
+            candidates.push(makeCandidateEvidence({
+                ruleId: "android-signing-debug-in-release",
+                category: "android-signing-configuration",
+                confidence: "low",
+                modulePath,
+                location,
+                summary: `Release build type's signingConfig is a dynamic/unresolved expression: ${buildType.signingConfigRef}`,
+                rawValue: buildType.signingConfigRef,
+                resolutionState: "unresolved",
+            }));
+            continue;
+        }
+        if (referencedName === "debug") {
+            const debugFinding = makeAndroidFinding({
+                ruleId: "android-signing-debug-in-release",
+                title: 'Release build type explicitly uses signingConfigs.debug',
+                severity: "major",
+                confidence: "high",
+                description: "The release build type's signingConfig references signingConfigs.debug. This is high-confidence risky release-configuration evidence; it does not prove a shipped APK was actually signed with the debug key (variant/flavor selection is not evaluated).",
+                manifestPath: buildFileRelativePath,
+                identity: "release-debug-signing",
+                evidenceDetails: [`buildType=release`, `signingConfigRef=${buildType.signingConfigRef}`],
+                recommendation: "Configure a dedicated release signing configuration and remove the reference to signingConfigs.debug.",
+            });
+            if (isLibraryOnlyModule) {
+                candidates.push(makeCandidateEvidence({
+                    ruleId: "android-signing-debug-in-release",
+                    category: "android-signing-configuration",
+                    confidence: "low",
+                    modulePath,
+                    location,
+                    summary: `${debugFinding.title} (library module — not an installable application)`,
+                    rawValue: undefined,
+                    resolutionState: "not-applicable",
+                }));
+            }
+            else {
+                findings.push(debugFinding);
+            }
+            continue;
+        }
+        const referencedConfigExists = signingConfigs.some((c) => c.name === referencedName);
+        if (!referencedConfigExists) {
+            candidates.push(makeCandidateEvidence({
+                ruleId: "android-signing-debug-in-release",
+                category: "android-signing-configuration",
+                confidence: "low",
+                modulePath,
+                location,
+                summary: `Release build type references signing config "${referencedName}", which has no matching definition in this build file`,
+                rawValue: referencedName,
+                resolutionState: "missing",
+            }));
+            continue;
+        }
+        evidenceText.push(`release build type references named signing config "${referencedName}" (ordinary metadata)`);
+        // --- committed-keystore + literal-credential + release correlation ---
+        if (literalCredentialConfigNames.has(referencedName)) {
+            const referencedConfig = signingConfigs.find((c) => c.name === referencedName);
+            const storeFileName = referencedConfig.storeFile.state === "literal" ? path.basename(referencedConfig.storeFile.literalValue ?? "") : undefined;
+            const committedKeystore = storeFileName ? allKeystoreCandidates.find((k) => path.basename(k.relativePath) === storeFileName) : undefined;
+            if (committedKeystore && !isLibraryOnlyModule) {
+                findings.push(makeAndroidFinding({
+                    ruleId: "android-signing-keystore-candidate",
+                    title: `Release signing configuration "${referencedName}" correlates with a committed keystore and a literal credential`,
+                    severity: "major",
+                    confidence: "high",
+                    description: `The release build type references signing configuration "${referencedName}", which has a literal password and a matching committed keystore file (${committedKeystore.relativePath}) in the target. This is a high-confidence aligned static signal; it does not prove the credential is valid or that this keystore is used in a published artifact.`,
+                    manifestPath: committedKeystore.relativePath,
+                    identity: `${referencedName}-committed-keystore-correlation`,
+                    evidenceDetails: [`signingConfig=${referencedName}`, `keystore=${committedKeystore.relativePath}`],
+                    recommendation: "Remove the committed keystore and credential from source control; use a secure, out-of-repo signing mechanism (e.g. CI secret store).",
+                }));
+            }
+        }
+    }
+    return { candidates, findings, evidenceText };
+}