@dailephd/my-dev-kit-lab 0.4.0 → 0.4.2

package/dist/src/mobile/android/advancedSecurity/backupConfiguration/analyzeBackupConfiguration.js

@@ -0,0 +1,300 @@
+import path from "node:path";
+import { makeAndroidFinding } from "../../audit/androidFinding.js";
+import { buildAndroidSourceLocation } from "../sourceLocation.js";
+import { makeCandidateEvidence } from "../candidateEvidence.js";
+import { extractManifestBackupEvidence } from "./manifestEvidence.js";
+function loc(targetRoot, absolutePath, position) {
+    return buildAndroidSourceLocation(targetRoot, absolutePath, position);
+}
+// A conservative, narrow "broad inclusion" signal: the entire root, or an
+// entire sensitive domain with no path narrowing ("." — the whole domain).
+function isBroadInclude(rule) {
+    if (rule.kind !== "include" || rule.malformed)
+        return false;
+    if (rule.domain === "root" || rule.domain === "device_root")
+        return true;
+    const sensitiveDomains = new Set(["sharedpref", "database", "external", "device_sharedpref", "device_database", "device_external"]);
+    return rule.domain !== undefined && sensitiveDomains.has(rule.domain) && rule.path === ".";
+}
+function analyzeRuleEntries(rules, ruleId, scopeLabel, sourceAbsolutePath, targetRoot, modulePath, sourceRelativePath) {
+    const candidates = [];
+    const evidenceText = [];
+    let hasBroadInclude = false;
+    for (const rule of rules) {
+        const location = loc(targetRoot, sourceAbsolutePath, { line: rule.location.line, column: rule.location.column });
+        if (rule.malformed) {
+            candidates.push(makeCandidateEvidence({
+                ruleId,
+                category: "android-backup-configuration",
+                confidence: "low",
+                modulePath,
+                location,
+                summary: `Malformed ${scopeLabel} rule: ${rule.malformedReason}`,
+                rawValue: `${rule.domainRaw ?? ""} ${rule.path ?? ""}`.trim(),
+                resolutionState: "malformed",
+            }));
+            continue;
+        }
+        if (rule.domain === undefined) {
+            candidates.push(makeCandidateEvidence({
+                ruleId,
+                category: "android-backup-configuration",
+                confidence: "low",
+                modulePath,
+                location,
+                summary: `Unsupported backup domain value in ${scopeLabel}: "${rule.domainRaw}"`,
+                rawValue: rule.domainRaw,
+                resolutionState: "unsupported",
+            }));
+            continue;
+        }
+        if (rule.kind === "exclude") {
+            evidenceText.push(`${sourceRelativePath}: ${scopeLabel} restrictive exclusion — domain=${rule.domain}, path=${rule.path}`);
+            continue;
+        }
+        if (isBroadInclude(rule)) {
+            hasBroadInclude = true;
+            candidates.push(makeCandidateEvidence({
+                ruleId,
+                category: "android-backup-configuration",
+                confidence: "medium",
+                modulePath,
+                location,
+                summary: `Broad ${scopeLabel} inclusion: domain=${rule.domain}, path=${rule.path}`,
+                rawValue: `${rule.domain}:${rule.path}`,
+                resolutionState: "resolved",
+                staticAnalysisLimitations: [
+                    "Domain/path naming is conservative evidence only; it does not prove the included data is actually sensitive or that a backup is ever performed.",
+                ],
+            }));
+        }
+    }
+    return { candidates, evidenceText, hasBroadInclude };
+}
+function analyzeBackupRulesParseResult(parseResult, ruleId, sourceRelativePath, targetRoot, modulePath) {
+    const sourceAbsolutePath = path.join(targetRoot, sourceRelativePath);
+    if (parseResult.state === "malformed-xml") {
+        return {
+            candidates: [
+                makeCandidateEvidence({
+                    ruleId,
+                    category: "android-backup-configuration",
+                    confidence: "medium",
+                    modulePath,
+                    location: loc(targetRoot, sourceAbsolutePath, parseResult.location ? { line: parseResult.location.line, column: parseResult.location.column } : undefined),
+                    summary: `Referenced backup rules file is malformed XML: ${parseResult.reason}`,
+                    rawValue: parseResult.reason,
+                    resolutionState: "malformed",
+                }),
+            ],
+            evidenceText: [],
+            hasBroadCloudOrLegacyInclude: false,
+        };
+    }
+    if (parseResult.state === "unsupported-root") {
+        return {
+            candidates: [
+                makeCandidateEvidence({
+                    ruleId,
+                    category: "android-backup-configuration",
+                    confidence: "medium",
+                    modulePath,
+                    location: loc(targetRoot, sourceAbsolutePath),
+                    summary: `Referenced XML file has an unsupported root element <${parseResult.rootTagName}>`,
+                    rawValue: parseResult.rootTagName,
+                    resolutionState: "unsupported",
+                }),
+            ],
+            evidenceText: [],
+            hasBroadCloudOrLegacyInclude: false,
+        };
+    }
+    if (parseResult.state === "parsed-full-backup-content") {
+        const result = analyzeRuleEntries(parseResult.model.rules, ruleId, "full-backup-content", sourceAbsolutePath, targetRoot, modulePath, sourceRelativePath);
+        return { candidates: result.candidates, evidenceText: result.evidenceText, hasBroadCloudOrLegacyInclude: result.hasBroadInclude };
+    }
+    // parsed-data-extraction-rules
+    const cloudResult = parseResult.model.cloudBackup
+        ? analyzeRuleEntries(parseResult.model.cloudBackup.rules, ruleId, "cloud-backup", sourceAbsolutePath, targetRoot, modulePath, sourceRelativePath)
+        : { candidates: [], evidenceText: [], hasBroadInclude: false };
+    const transferResult = parseResult.model.deviceTransfer
+        ? analyzeRuleEntries(parseResult.model.deviceTransfer.rules, ruleId, "device-transfer", sourceAbsolutePath, targetRoot, modulePath, sourceRelativePath)
+        : { candidates: [], evidenceText: [], hasBroadInclude: false };
+    // Device-transfer broadness stays a review candidate only — it is local
+    // device-to-device transfer, not cloud exfiltration, so it never
+    // contributes to the allowBackup-level "major" escalation.
+    return {
+        candidates: [...cloudResult.candidates, ...transferResult.candidates],
+        evidenceText: [...cloudResult.evidenceText, ...transferResult.evidenceText],
+        hasBroadCloudOrLegacyInclude: cloudResult.hasBroadInclude,
+    };
+}
+function analyzeXmlReferenceEvidence(evidence, ruleId, targetRoot, manifestAbsolutePath, modulePath, applicationLocation) {
+    switch (evidence.state) {
+        case "absent":
+            return { candidates: [], evidenceText: [], hasBroadInclude: false };
+        case "resolved": {
+            const result = analyzeBackupRulesParseResult(evidence.parseResult, ruleId, evidence.candidate.relativePath, targetRoot, modulePath);
+            return { candidates: result.candidates, evidenceText: result.evidenceText, hasBroadInclude: result.hasBroadCloudOrLegacyInclude };
+        }
+        case "ambiguous": {
+            const candidates = [
+                makeCandidateEvidence({
+                    ruleId,
+                    category: "android-backup-configuration",
+                    confidence: "low",
+                    modulePath,
+                    location: loc(targetRoot, manifestAbsolutePath, applicationLocation),
+                    summary: `Backup rules reference "${evidence.raw}" resolved to ${evidence.candidates.length} ambiguous candidates across source sets; no candidate was arbitrarily selected`,
+                    rawValue: evidence.raw,
+                    resolutionState: "unresolved",
+                }),
+            ];
+            let hasBroadInclude = false;
+            for (const candidate of evidence.candidates) {
+                const result = analyzeBackupRulesParseResult(candidate.parseResult, ruleId, candidate.candidate.relativePath, targetRoot, modulePath);
+                candidates.push(...result.candidates);
+                hasBroadInclude = hasBroadInclude || result.hasBroadCloudOrLegacyInclude;
+            }
+            return { candidates, evidenceText: [], hasBroadInclude };
+        }
+        case "missing":
+            return {
+                candidates: [
+                    makeCandidateEvidence({
+                        ruleId,
+                        category: "android-backup-configuration",
+                        confidence: "low",
+                        modulePath,
+                        location: loc(targetRoot, manifestAbsolutePath, applicationLocation),
+                        summary: `Backup rules reference "${evidence.raw}" did not resolve to any file in the searched source sets`,
+                        rawValue: evidence.raw,
+                        resolutionState: "missing",
+                        staticAnalysisLimitations: ["A missing referenced rules file is not automatically a vulnerability; runtime behavior cannot be proven statically."],
+                    }),
+                ],
+                evidenceText: [],
+                hasBroadInclude: false,
+            };
+        case "placeholder":
+            return {
+                candidates: [
+                    makeCandidateEvidence({
+                        ruleId,
+                        category: "android-backup-configuration",
+                        confidence: "low",
+                        modulePath,
+                        location: loc(targetRoot, manifestAbsolutePath, applicationLocation),
+                        summary: "Backup rules reference is an unresolved build-time placeholder",
+                        rawValue: evidence.raw,
+                        resolutionState: "unresolved",
+                    }),
+                ],
+                evidenceText: [],
+                hasBroadInclude: false,
+            };
+        case "malformed":
+            return {
+                candidates: [
+                    makeCandidateEvidence({
+                        ruleId,
+                        category: "android-backup-configuration",
+                        confidence: "low",
+                        modulePath,
+                        location: loc(targetRoot, manifestAbsolutePath, applicationLocation),
+                        summary: `Backup rules reference is malformed: ${evidence.reason}`,
+                        rawValue: evidence.raw,
+                        resolutionState: "malformed",
+                    }),
+                ],
+                evidenceText: [],
+                hasBroadInclude: false,
+            };
+        case "unsupported-type":
+        case "package-qualified":
+        case "module-unknown":
+            return {
+                candidates: [
+                    makeCandidateEvidence({
+                        ruleId,
+                        category: "android-backup-configuration",
+                        confidence: "low",
+                        modulePath,
+                        location: loc(targetRoot, manifestAbsolutePath, applicationLocation),
+                        summary: evidence.state === "module-unknown"
+                            ? "Backup rules reference could not be resolved because this manifest's module could not be determined"
+                            : `Backup rules reference is not a resolvable target-contained @xml/... resource (${evidence.state})`,
+                        rawValue: evidence.raw,
+                        resolutionState: "unsupported",
+                    }),
+                ],
+                evidenceText: [],
+                hasBroadInclude: false,
+            };
+    }
+}
+// Analyzes one already-parsed manifest's backup/data-extraction evidence.
+// Standalone until a later integration batch.
+export function analyzeManifestBackupConfiguration(targetRoot, entry) {
+    const evidence = extractManifestBackupEvidence(targetRoot, entry);
+    const candidates = [];
+    const findings = [];
+    const evidenceText = [];
+    const modulePath = entry.modulePath;
+    const manifestAbsolutePath = path.join(targetRoot, entry.manifestPath);
+    const applicationLocation = evidence.applicationLocation;
+    let hasBroadInclude = false;
+    // fullBackupContent — legacy literal states never touch the resource
+    // resolver/parser (there is no file to analyze).
+    const fullBackupContent = evidence.fullBackupContent;
+    if (fullBackupContent.state === "legacy-literal-true" || fullBackupContent.state === "legacy-literal-false") {
+        evidenceText.push(`${entry.manifestPath}: fullBackupContent is a legacy literal (${fullBackupContent.raw})`);
+    }
+    else {
+        const result = analyzeXmlReferenceEvidence(fullBackupContent, "android-backup-full-backup-content", targetRoot, manifestAbsolutePath, modulePath, applicationLocation);
+        candidates.push(...result.candidates);
+        evidenceText.push(...result.evidenceText);
+        hasBroadInclude = hasBroadInclude || result.hasBroadInclude;
+    }
+    const dataExtractionResult = analyzeXmlReferenceEvidence(evidence.dataExtractionRules, "android-backup-data-extraction-rules", targetRoot, manifestAbsolutePath, modulePath, applicationLocation);
+    candidates.push(...dataExtractionResult.candidates);
+    evidenceText.push(...dataExtractionResult.evidenceText);
+    hasBroadInclude = hasBroadInclude || dataExtractionResult.hasBroadInclude;
+    // allowBackup analysis — the only source of an actual SecurityFinding in
+    // this analyzer (agents.txt Batch 3 section 9.7/9.17).
+    if (evidence.allowBackup.state === "explicit-true") {
+        findings.push(makeAndroidFinding({
+            ruleId: "android-backup-allow-backup",
+            title: hasBroadInclude
+                ? "Application allows backup with a broad backup-rule inclusion"
+                : "Application manifest explicitly permits backup (android:allowBackup=\"true\")",
+            severity: hasBroadInclude ? "major" : "minor",
+            confidence: hasBroadInclude ? "high" : "medium",
+            description: hasBroadInclude
+                ? "The manifest sets android:allowBackup=\"true\" and the resolved backup rules include a broad root/domain inclusion with no narrowing. This is high-confidence static evidence of a broad backup surface; it does not prove any specific file is actually backed up or that backup ever runs."
+                : "The manifest sets android:allowBackup=\"true\" with no broad-rule evidence found. This alone is not a vulnerability — it is the platform's own default behavior when the attribute is unset on old targetSdk versions, and is a common, legitimate configuration.",
+            manifestPath: entry.manifestPath,
+            location: applicationLocation,
+            evidenceDetails: [`source=manifest-attribute`, `broadRuleEvidence=${hasBroadInclude}`],
+            recommendation: hasBroadInclude
+                ? "Narrow the backup rules to exclude sensitive domains, or set android:allowBackup=\"false\" if backup is not required."
+                : "Review whether backup should remain enabled and whether backup rules narrow the included data appropriately.",
+        }));
+    }
+    else if (evidence.allowBackup.state === "malformed") {
+        candidates.push(makeCandidateEvidence({
+            ruleId: "android-backup-allow-backup",
+            category: "android-backup-configuration",
+            confidence: "low",
+            modulePath,
+            location: loc(targetRoot, manifestAbsolutePath, applicationLocation),
+            summary: "android:allowBackup has an unresolved or malformed value",
+            rawValue: evidence.allowBackup.raw,
+            resolutionState: "malformed",
+        }));
+    }
+    else if (evidence.allowBackup.state === "explicit-false") {
+        evidenceText.push(`${entry.manifestPath}: allowBackup is explicitly false (restrictive)`);
+    }
+    return { evidence, candidates, findings, evidenceText };
+}

package/dist/src/mobile/android/advancedSecurity/backupConfiguration/checkResult.js

@@ -0,0 +1,41 @@
+import { buildAndroidManifestCheckResult } from "../../audit/checkResultBuilder.js";
+import { sortCandidateEvidence } from "../ordering.js";
+import { analyzeManifestBackupConfiguration } from "./analyzeBackupConfiguration.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 3 — standalone Android backup/data-extraction check result.
+//
+// Reuses the existing manifest-audit status-decision policy
+// (buildAndroidManifestCheckResult), mirroring Batch 2's checkResult.ts.
+// Standalone: not called from validateAndroidTarget / any active
+// orchestration, not rendered in reports, no CLI effect. Batch 8 integrates.
+// ---------------------------------------------------------------------------
+export const ANDROID_BACKUP_CONFIGURATION_AUDIT_CHECK_ID = "android-backup-configuration-audit";
+export function auditAndroidBackupConfiguration(targetRoot, detection, manifests) {
+    const findings = [];
+    const candidateEvidence = [];
+    const evidence = [];
+    const warnings = [];
+    for (const entry of manifests) {
+        const result = analyzeManifestBackupConfiguration(targetRoot, entry);
+        findings.push(...result.findings);
+        candidateEvidence.push(...result.candidates);
+        evidence.push(`${entry.manifestPath}: allowBackup=${result.evidence.allowBackup.state}, fullBackupContent=${result.evidence.fullBackupContent.state}, dataExtractionRules=${result.evidence.dataExtractionRules.state}`, ...result.evidenceText);
+    }
+    const base = buildAndroidManifestCheckResult({
+        id: ANDROID_BACKUP_CONFIGURATION_AUDIT_CHECK_ID,
+        category: "android-backup-configuration",
+        title: "Android backup and data-extraction configuration audit",
+        detection,
+        manifests,
+        findings,
+        evidence,
+        warnings: [
+            ...warnings,
+            "Static analysis only: does not evaluate Gradle manifest merging, Android resource overlays, or whether a backup actually occurs at runtime.",
+        ],
+    });
+    return {
+        ...base,
+        candidateEvidence: sortCandidateEvidence(candidateEvidence),
+    };
+}

package/dist/src/mobile/android/advancedSecurity/backupConfiguration/index.js

@@ -0,0 +1,8 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 3 — public exports for the standalone Android backup/data-
+// extraction audit. Mirrors Batch 2's networkSecurity/index.ts convention.
+// ---------------------------------------------------------------------------
+export { parseBackupRules } from "./parseBackupRules.js";
+export { extractManifestBackupEvidence } from "./manifestEvidence.js";
+export { analyzeManifestBackupConfiguration } from "./analyzeBackupConfiguration.js";
+export { auditAndroidBackupConfiguration, ANDROID_BACKUP_CONFIGURATION_AUDIT_CHECK_ID } from "./checkResult.js";

package/dist/src/mobile/android/advancedSecurity/backupConfiguration/manifestEvidence.js

@@ -0,0 +1,102 @@
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { parseAndroidResourceReference } from "../resourceReference.js";
+import { resolveAndroidXmlResourceReference } from "../resourceResolution.js";
+import { parseBackupRules } from "./parseBackupRules.js";
+function classifyBooleanAttribute(value, raw) {
+    if (value === true)
+        return { state: "explicit-true", raw: raw ?? "true" };
+    if (value === false)
+        return { state: "explicit-false", raw: raw ?? "false" };
+    if (raw !== undefined)
+        return { state: "malformed", raw };
+    return { state: "missing" };
+}
+function parseBackupRulesFile(absolutePath) {
+    let xmlText;
+    try {
+        xmlText = readFileSync(absolutePath, "utf8");
+    }
+    catch (error) {
+        return { state: "malformed-xml", reason: error instanceof Error ? error.message : "Unable to read the resolved backup rules file" };
+    }
+    return parseBackupRules(xmlText);
+}
+function classifyResolution(raw, resolution, targetRoot) {
+    switch (resolution.state) {
+        case "resolved": {
+            const candidate = resolution.candidates[0];
+            return {
+                state: "resolved",
+                raw,
+                modulePath: resolution.modulePath,
+                candidate,
+                parseResult: parseBackupRulesFile(path.join(targetRoot, candidate.relativePath)),
+            };
+        }
+        case "ambiguous":
+            return {
+                state: "ambiguous",
+                raw,
+                modulePath: resolution.modulePath,
+                candidates: resolution.candidates.map((candidate) => ({
+                    candidate,
+                    parseResult: parseBackupRulesFile(path.join(targetRoot, candidate.relativePath)),
+                })),
+            };
+        case "missing":
+            return { state: "missing", raw, modulePath: resolution.modulePath, searchedSourceSets: resolution.searchedSourceSets };
+        case "malformed-reference":
+            return { state: "malformed", raw, reason: resolution.reason };
+        case "unsupported-reference":
+            // Unreachable in practice — see Batch 2's manifestEvidence.ts for the
+            // identical rationale (this function only calls the resolver once a
+            // "parsed" xml-type reference is confirmed).
+            return { state: "unsupported-type", raw, resourceType: "type" in resolution.parsed ? resolution.parsed.type : "unknown" };
+    }
+}
+function classifyXmlReference(targetRoot, entry, raw) {
+    if (raw === undefined)
+        return { state: "absent" };
+    const parsedRef = parseAndroidResourceReference(raw);
+    if (parsedRef.state === "placeholder")
+        return { state: "placeholder", raw };
+    if (parsedRef.state === "malformed")
+        return { state: "malformed", raw, reason: parsedRef.reason };
+    if (parsedRef.state === "empty")
+        return { state: "malformed", raw, reason: "Reference is empty" };
+    if (parsedRef.state === "unsupported-type")
+        return { state: "unsupported-type", raw, resourceType: parsedRef.type };
+    if (parsedRef.state === "package-qualified")
+        return { state: "package-qualified", raw, packageQualifier: parsedRef.packageQualifier };
+    if (entry.modulePath === undefined)
+        return { state: "module-unknown", raw };
+    const moduleAbsolutePath = path.join(targetRoot, entry.modulePath);
+    const resolution = resolveAndroidXmlResourceReference(targetRoot, moduleAbsolutePath, raw);
+    return classifyResolution(raw, resolution, targetRoot);
+}
+function classifyFullBackupContent(targetRoot, entry) {
+    const raw = entry.manifest.application.fullBackupContentRef;
+    if (raw === "true")
+        return { state: "legacy-literal-true", raw };
+    if (raw === "false")
+        return { state: "legacy-literal-false", raw };
+    return classifyXmlReference(targetRoot, entry, raw);
+}
+// Extracts and classifies backup/data-extraction/debuggable/testOnly
+// evidence for one already-parsed manifest. `targetRoot` must be the
+// absolute Android target root.
+export function extractManifestBackupEvidence(targetRoot, entry) {
+    const app = entry.manifest.application;
+    return {
+        manifestPath: entry.manifestPath,
+        modulePath: entry.modulePath,
+        sourceSetKind: entry.sourceSetKind,
+        applicationLocation: app.location,
+        allowBackup: classifyBooleanAttribute(app.allowBackup, app.allowBackupRaw),
+        debuggable: classifyBooleanAttribute(app.debuggable, app.debuggableRaw),
+        testOnly: classifyBooleanAttribute(app.testOnly, app.testOnlyRaw),
+        fullBackupContent: classifyFullBackupContent(targetRoot, entry),
+        dataExtractionRules: classifyXmlReference(targetRoot, entry, app.dataExtractionRulesRef),
+    };
+}

package/dist/src/mobile/android/advancedSecurity/backupConfiguration/parseBackupRules.js

@@ -0,0 +1,110 @@
+import { findChildren, parseXmlDocument } from "../../manifest/xml/parseXml.js";
+import { BACKUP_DOMAIN_VALUES, MAX_BACKUP_RULES_PER_SCOPE, } from "./types.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 3 — dependency-free parser for the legacy
+// <full-backup-content> and newer <data-extraction-rules> XML formats.
+//
+// Builds on the existing bounded XML tree parser
+// (src/mobile/android/manifest/xml/parseXml.ts), mirroring Batch 2's
+// parseNetworkSecurityConfig.ts layering — no second XML tokenizer. Parses
+// exactly one already-resolved, target-contained file; never merges files,
+// never evaluates resource overlays, never invokes Gradle/Android SDK/
+// network. Malformed XML or an unsupported root never throws.
+// ---------------------------------------------------------------------------
+function getUnprefixedAttribute(element, localName) {
+    return element.attributes.find((attr) => attr.prefix === undefined && attr.localName === localName)?.value;
+}
+function parseBooleanAttribute(element, localName) {
+    const raw = getUnprefixedAttribute(element, localName);
+    if (raw === undefined)
+        return {};
+    if (raw === "true")
+        return { value: true, raw };
+    if (raw === "false")
+        return { value: false, raw };
+    return { raw };
+}
+function isBackupDomainValue(value) {
+    return BACKUP_DOMAIN_VALUES.includes(value);
+}
+function parseRuleEntry(kind, element) {
+    const domainRaw = getUnprefixedAttribute(element, "domain");
+    const path = getUnprefixedAttribute(element, "path");
+    const requireFlagsRaw = getUnprefixedAttribute(element, "requireFlags");
+    const domain = domainRaw !== undefined && isBackupDomainValue(domainRaw) ? domainRaw : undefined;
+    const malformed = domainRaw === undefined || path === undefined || path.length === 0;
+    const malformedReason = domainRaw === undefined ? "Missing domain attribute" : path === undefined || path.length === 0 ? "Missing or empty path attribute" : undefined;
+    return {
+        kind,
+        domainRaw,
+        domain,
+        path,
+        requireFlagsRaw,
+        location: element.location,
+        malformed,
+        malformedReason,
+    };
+}
+function parseRuleEntries(scopeElement) {
+    const includeEntries = findChildren(scopeElement, "include").map((el) => parseRuleEntry("include", el));
+    const excludeEntries = findChildren(scopeElement, "exclude").map((el) => parseRuleEntry("exclude", el));
+    // Preserves document order (include/exclude interleaving is semantically
+    // meaningful in the real format) rather than grouping by kind — includes
+    // are collected first only because findChildren is kind-specific; the
+    // caller should not assume this array reflects source order for mixed
+    // kinds beyond what findChildren naturally preserves per kind.
+    return [...includeEntries, ...excludeEntries].slice(0, MAX_BACKUP_RULES_PER_SCOPE);
+}
+function parseFullBackupContent(root, warnings) {
+    const knownChildren = new Set(["include", "exclude"]);
+    const unsupportedChildren = root.children.filter((child) => !knownChildren.has(child.localName)).map((child) => `<${child.tagName}> at line ${child.location.line}`);
+    const rules = parseRuleEntries(root);
+    if (rules.length >= MAX_BACKUP_RULES_PER_SCOPE) {
+        warnings.push(`<full-backup-content> rule count reached the bounded maximum of ${MAX_BACKUP_RULES_PER_SCOPE}; further rules were not processed.`);
+    }
+    return { rules, unsupportedChildren };
+}
+function parseDataExtractionRuleSet(element) {
+    const disableResult = parseBooleanAttribute(element, "disableIfNoEncryptionCapabilities");
+    return {
+        disableIfNoEncryptionCapabilities: disableResult.value,
+        disableIfNoEncryptionCapabilitiesRaw: disableResult.raw,
+        rules: parseRuleEntries(element),
+        location: element.location,
+    };
+}
+function parseDataExtractionRules(root, warnings) {
+    const knownChildren = new Set(["cloud-backup", "device-transfer"]);
+    const unsupportedChildren = root.children.filter((child) => !knownChildren.has(child.localName)).map((child) => `<${child.tagName}> at line ${child.location.line}`);
+    const cloudBackupEl = findChildren(root, "cloud-backup")[0];
+    if (findChildren(root, "cloud-backup").length > 1) {
+        warnings.push("Multiple <cloud-backup> elements found; only the first was used.");
+    }
+    const deviceTransferEl = findChildren(root, "device-transfer")[0];
+    if (findChildren(root, "device-transfer").length > 1) {
+        warnings.push("Multiple <device-transfer> elements found; only the first was used.");
+    }
+    return {
+        cloudBackup: cloudBackupEl ? parseDataExtractionRuleSet(cloudBackupEl) : undefined,
+        deviceTransfer: deviceTransferEl ? parseDataExtractionRuleSet(deviceTransferEl) : undefined,
+        unsupportedChildren,
+    };
+}
+// Parses either legacy full-backup-content or data-extraction-rules XML
+// text, selecting the semantic model by the document's actual root element.
+// Never throws for ordinary malformed external input.
+export function parseBackupRules(xmlText) {
+    const parsed = parseXmlDocument(xmlText);
+    if (!parsed.ok) {
+        return { state: "malformed-xml", reason: parsed.error.message, location: parsed.error.location };
+    }
+    const root = parsed.root;
+    const warnings = parsed.warnings.map((w) => `${w.message} (line ${w.location.line})`);
+    if (root.localName === "full-backup-content") {
+        return { state: "parsed-full-backup-content", model: parseFullBackupContent(root, warnings), warnings };
+    }
+    if (root.localName === "data-extraction-rules") {
+        return { state: "parsed-data-extraction-rules", model: parseDataExtractionRules(root, warnings), warnings };
+    }
+    return { state: "unsupported-root", rootTagName: root.tagName };
+}

package/dist/src/mobile/android/advancedSecurity/backupConfiguration/types.js

@@ -0,0 +1,27 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 3 — bounded backup/data-extraction XML parse-tree model.
+//
+// Covers both the legacy <full-backup-content> format (API <=30, still
+// widely used) and the newer <data-extraction-rules> format (API 31+,
+// separates <cloud-backup> from <device-transfer>). Local to Android
+// advanced security, mirroring Batch 2's networkSecurity/types.ts pattern —
+// not pushed into the generic XML tree model. Locations are line/column
+// only; file/module/source-set identity is attached by the caller once a
+// file is resolved (see manifestEvidence.ts).
+// ---------------------------------------------------------------------------
+export const BACKUP_DOMAIN_VALUES = [
+    "root",
+    "file",
+    "database",
+    "sharedpref",
+    "external",
+    "device_root",
+    "device_file",
+    "device_database",
+    "device_sharedpref",
+    "device_external",
+];
+// Defensive bound on the number of rule entries processed from one file —
+// mirrors Batch 2's MAX_DOMAIN_CONFIG_DEPTH bound philosophy (never let a
+// pathological fixture/target cause unbounded work).
+export const MAX_BACKUP_RULES_PER_SCOPE = 500;

package/dist/src/mobile/android/advancedSecurity/candidateEvidence.js

@@ -0,0 +1,50 @@
+import { fingerprintCandidateValue, redactedPreviewForCandidate } from "./redaction.js";
+// Resolution states for a static candidate's underlying evidence (e.g. did a
+// referenced resource file resolve, was a signing config path found). Kept
+// narrow and additive; overlaps deliberately with AndroidCheckStatus/XML
+// resource-resolution states where the underlying concept is the same
+// (resolved and missing/malformed/unsupported are shared vocabulary), but
+// this is not a duplicate of AndroidCheckStatus — a candidate's resolution
+// state describes one piece of referenced evidence, not an entire check.
+export const CANDIDATE_RESOLUTION_STATES = ["resolved", "unresolved", "missing", "malformed", "unsupported", "not-applicable"];
+function slug(value) {
+    return value
+        .replace(/[^a-zA-Z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "")
+        .toLowerCase();
+}
+// Deterministic, content-derived id (no counter, no timestamp) so equivalent
+// candidate evidence always produces the same id across repeated runs.
+function buildCandidateEvidenceId(ruleId, location, fingerprint) {
+    const locationPart = [location.path, location.line !== undefined ? `l${location.line}` : undefined, location.column !== undefined ? `c${location.column}` : undefined]
+        .filter((part) => Boolean(part))
+        .join(":");
+    return [ruleId, slug(locationPart), fingerprint.slice(0, 16)].join("--");
+}
+// Never accepts a raw secret value as a plain string parameter name to
+// discourage accidental logging at call sites — `rawValue` is redacted and
+// fingerprinted here, once, and the raw value is never stored on the
+// returned object.
+export function makeCandidateEvidence(input) {
+    const fingerprint = fingerprintCandidateValue(input.rawValue);
+    const redactedPreview = redactedPreviewForCandidate(input.rawValue);
+    const id = buildCandidateEvidenceId(input.ruleId, input.location, fingerprint);
+    return {
+        id,
+        ruleId: input.ruleId,
+        category: input.category,
+        sensitiveDataCategory: input.sensitiveDataCategory,
+        confidence: input.confidence,
+        modulePath: input.modulePath,
+        location: input.location,
+        summary: input.summary,
+        redactedPreview,
+        fingerprint,
+        resolutionState: input.resolutionState,
+        staticAnalysisLimitations: input.staticAnalysisLimitations ?? [],
+        relatedManifestComponentIds: input.relatedManifestComponentIds,
+        relatedResourceReferences: input.relatedResourceReferences,
+        relatedFindingIds: input.relatedFindingIds,
+        relatedCheckIds: input.relatedCheckIds,
+    };
+}