@invarn/cibuild 2.9.5 → 2.9.7

package/dist/src/commands/android-scanner.js

@@ -1,1639 +0,0 @@
-import { resolve, join, relative, dirname } from "node:path";
-import { existsSync, readFileSync, readdirSync } from "node:fs";
-import { parseSettingsModules } from "../shared/gradle-settings.js";
-// ---------------------------------------------------------------------------
-// File discovery
-// ---------------------------------------------------------------------------
-/**
- * Returns the list of gradle files to scan.
- * Always includes the root build.gradle and the app/ module.
- * Also parses settings.gradle to find any additional include'd modules.
- */
-function findGradleFiles(root) {
-    const candidates = [];
-    // Root-level build files
-    for (const name of ["build.gradle", "build.gradle.kts"]) {
-        const p = resolve(root, name);
-        if (existsSync(p))
-            candidates.push(p);
-    }
-    // Collect module directories from settings.gradle
-    const moduleDirs = new Set(["app"]); // always include app/
-    for (const name of ["settings.gradle", "settings.gradle.kts"]) {
-        const p = resolve(root, name);
-        if (!existsSync(p))
-            continue;
-        const content = readFileSync(p, "utf-8");
-        // One parser, shared with the detector. The regex that used to live here
-        // matched only the *first* argument of an `include`, so
-        // `include(":android", ":common", …)` — one call, eight modules in
-        // `SimonSchubert/LinuxCommandLibrary` — was read as one, and the module
-        // holding `jvmToolchain(21)` was never opened.
-        for (const mod of parseSettingsModules(content))
-            moduleDirs.add(mod);
-        // An included build is a Gradle project of its own, and a monorepo's
-        // convention plugins live in one. Its build file is where the Java level
-        // for every module it configures is often declared.
-        for (const included of parseIncludedBuilds(content)) {
-            for (const buildFile of ["build.gradle", "build.gradle.kts"]) {
-                const q = resolve(root, included, buildFile);
-                if (existsSync(q))
-                    candidates.push(q);
-            }
-        }
-    }
-    for (const mod of moduleDirs) {
-        for (const name of ["build.gradle", "build.gradle.kts"]) {
-            const p = resolve(root, mod, name);
-            if (existsSync(p))
-                candidates.push(p);
-        }
-    }
-    return candidates;
-}
-function safeRead(path) {
-    try {
-        return readFileSync(path, "utf-8");
-    }
-    catch {
-        return "";
-    }
-}
-function relPath(root, filePath) {
-    return relative(root, filePath);
-}
-/**
- * Returns line numbers for each match of a regex in file content.
- */
-function lineNumber(content, index) {
-    return content.slice(0, index).split("\n").length;
-}
-/** Extract all System.getenv("VAR") references. */
-function extractEnvVarRefs(content) {
-    const results = [];
-    const re = /System\.getenv\(\s*["']([^"']+)["']\s*\)/g;
-    let m;
-    while ((m = re.exec(content)) !== null) {
-        results.push({ name: m[1], line: lineNumber(content, m.index) });
-    }
-    return results;
-}
-/** Extract Groovy findProperty("prop") and Kotlin properties["prop"] references. */
-function extractPropertyRefs(content) {
-    const results = [];
-    // Groovy: project.findProperty("name") or findProperty("name")
-    const groovyRe = /(?:project\.)?findProperty\(\s*["']([^"']+)["']\s*\)/g;
-    let m;
-    while ((m = groovyRe.exec(content)) !== null) {
-        results.push({ name: m[1], line: lineNumber(content, m.index) });
-    }
-    // Kotlin DSL: properties["name"] or project.properties["name"]
-    const kotlinRe = /(?:project\.)?properties\["([^"]+)"\]/g;
-    while ((m = kotlinRe.exec(content)) !== null) {
-        results.push({ name: m[1], line: lineNumber(content, m.index) });
-    }
-    return results;
-}
-/**
- * Extract env var names from buildConfigField entries.
- * e.g. buildConfigField "String", "API_KEY", System.getenv("MAPS_API_KEY") ?: ""
- * Returns the System.getenv variable names embedded inside buildConfigField values.
- */
-function extractBuildConfigEnvRefs(content) {
-    const results = [];
-    // Match buildConfigField lines that also contain System.getenv
-    const lineRe = /buildConfigField\s*[\("]/g;
-    let m;
-    const envRe = /System\.getenv\(\s*["']([^"']+)["']\s*\)/g;
-    while ((m = lineRe.exec(content)) !== null) {
-        // Find the end of the statement (next newline or semicolon)
-        const lineEnd = content.indexOf("\n", m.index);
-        const slice = content.slice(m.index, lineEnd === -1 ? undefined : lineEnd + 1);
-        let em;
-        while ((em = envRe.exec(slice)) !== null) {
-            results.push({ name: em[1], line: lineNumber(content, m.index) });
-        }
-        envRe.lastIndex = 0;
-    }
-    return results;
-}
-/**
- * Returns true if the Google Secrets Gradle Plugin is applied.
- * This plugin reads local.properties (or a configured file) and auto-generates
- * BuildConfig fields — so if that file is absent in CI, fields won't be generated.
- */
-function detectSecretsPlugin(content) {
-    return (/alias\s*\(\s*libs\.plugins\.secrets\s*\)/.test(content) ||
-        /id\s*\(\s*["']com\.google\.android\.libraries\.mapsplatform\.secrets-gradle-plugin["']\s*\)/.test(content) ||
-        /id\s*["']com\.google\.android\.libraries\.mapsplatform\.secrets-gradle-plugin["']/.test(content));
-}
-/**
- * Extracts the `propertiesFileName` from a `secrets { }` block.
- * Defaults to "local.properties" if not configured.
- */
-function extractSecretsPropertiesFile(content) {
-    const block = extractBlockContent(content, "secrets");
-    if (!block)
-        return "local.properties";
-    const m = /propertiesFileName\s*=\s*["']([^"']+)["']/.exec(block);
-    return m ? m[1] : "local.properties";
-}
-// ---------------------------------------------------------------------------
-// Property keys the build reads out of the Secrets plugin's properties file
-// ---------------------------------------------------------------------------
-/**
- * True when this build file *applies* the Secrets plugin, as opposed to merely
- * declaring its version for other modules.
- *
- * A root build file almost always carries
- * `alias(libs.plugins.secrets) apply false` — the plugin is named there so a
- * module can apply it without repeating the version, and the root project
- * itself never loads a properties file. Reading that as "the root module
- * applies it" would aim the source walk below at the whole repository on the
- * strength of a line that applies nothing.
- *
- * Separate from `detectSecretsPlugin` on purpose: that one decides which
- * warnings are emitted, and this must not change them.
- */
-function appliesSecretsPlugin(content) {
-    const applied = content
-        .split("\n")
-        .filter((line) => !/\bapply\s+false\b/.test(line))
-        .join("\n");
-    return detectSecretsPlugin(applied);
-}
-/**
- * The `BuildConfig` fields the Android Gradle Plugin generates by itself.
- *
- * `BuildConfig.DEBUG` is the most-referenced constant in Android source, and
- * every one of these is generated whether or not a properties file exists — so
- * naming them costs more than the unused line the rest of this scan tolerates.
- * A property named `DEBUG` would make the Secrets plugin generate a `String
- * DEBUG` beside AGP's `boolean DEBUG`, and the build that was going to compile
- * stops compiling because of the file meant to rescue it.
- *
- * `FLAVOR_<dimension>` is generated once per flavor dimension, so it is matched
- * by prefix rather than listed.
- */
-const AGP_GENERATED_BUILD_CONFIG_FIELDS = new Set([
-    "DEBUG",
-    "APPLICATION_ID",
-    "BUILD_TYPE",
-    "FLAVOR",
-    "VERSION_CODE",
-    "VERSION_NAME",
-    "LIBRARY_PACKAGE_NAME",
-]);
-function isAgpGeneratedField(name) {
-    return AGP_GENERATED_BUILD_CONFIG_FIELDS.has(name) || name.startsWith("FLAVOR_");
-}
-/**
- * `BuildConfig.SOME_FIELD` references in a source file.
- *
- * Screaming snake case only: that is the convention for a generated constant,
- * and widening it to any identifier would pull in `BuildConfig.javaClass` and
- * every other member access on the class itself.
- */
-function extractBuildConfigFieldRefs(content) {
-    const names = [];
-    const re = /\bBuildConfig\.([A-Z][A-Z0-9_]*)\b/g;
-    let m;
-    while ((m = re.exec(content)) !== null) {
-        if (!isAgpGeneratedField(m[1]))
-            names.push(m[1]);
-    }
-    return names;
-}
-/**
- * The index of the character closing the bracket or parenthesis at `open`,
- * ignoring anything inside a string literal. -1 when it is never closed.
- */
-function matchingClose(content, open) {
-    const closing = content[open] === "[" ? "]" : ")";
-    let depth = 0;
-    let quote = "";
-    for (let i = open; i < content.length; i++) {
-        const ch = content[i];
-        if (quote) {
-            if (ch === "\\")
-                i++;
-            else if (ch === quote)
-                quote = "";
-            continue;
-        }
-        if (ch === '"' || ch === "'")
-            quote = ch;
-        else if (ch === "[" || ch === "(")
-            depth++;
-        else if (ch === "]" || ch === ")") {
-            depth--;
-            if (depth === 0)
-                return content[i] === closing ? i : -1;
-        }
-    }
-    return -1;
-}
-/** Split a map-literal body on its top-level commas — not ones nested or quoted. */
-function splitTopLevel(body) {
-    const parts = [];
-    let depth = 0;
-    let quote = "";
-    let start = 0;
-    for (let i = 0; i < body.length; i++) {
-        const ch = body[i];
-        if (quote) {
-            if (ch === "\\")
-                i++;
-            else if (ch === quote)
-                quote = "";
-            continue;
-        }
-        if (ch === '"' || ch === "'")
-            quote = ch;
-        else if (ch === "[" || ch === "(" || ch === "{")
-            depth++;
-        else if (ch === "]" || ch === ")" || ch === "}")
-            depth--;
-        else if (ch === "," && depth === 0) {
-            parts.push(body.slice(start, i));
-            start = i + 1;
-        }
-    }
-    parts.push(body.slice(start));
-    return parts;
-}
-/**
- * The keys of a map literal, in either language's spelling:
- * Groovy `[key: v, "key": v]`, Kotlin `mapOf("key" to v)`.
- */
-function mapLiteralKeys(body) {
-    const names = [];
-    for (const entry of splitTopLevel(body)) {
-        const kotlin = /^\s*["']([^"']+)["']\s+to\s/.exec(entry);
-        if (kotlin) {
-            names.push(kotlin[1]);
-            continue;
-        }
-        const groovy = /^\s*(?:["']([^"']+)["']|([A-Za-z_]\w*))\s*:/.exec(entry);
-        if (groovy)
-            names.push(groovy[1] ?? groovy[2]);
-    }
-    return names;
-}
-/**
- * Keys named in a `manifestPlaceholders` map in a build file.
- *
- * The Secrets plugin fills a placeholder from the property of the same name,
- * so a placeholder the build declares is a property the build reads. Every
- * spelling the two DSLs offer for the same map:
- *
- *     manifestPlaceholders["mapsApiKey"] = …        // both
- *     manifestPlaceholders.put("mapsApiKey", …)     // Groovy
- *     manifestPlaceholders = [mapsApiKey: …]        // Groovy
- *     manifestPlaceholders += mapOf("mapsApiKey" to …)   // Kotlin
- */
-function extractManifestPlaceholderKeys(content) {
-    const names = [];
-    for (const re of [
-        /manifestPlaceholders\s*\[\s*["']([^"']+)["']\s*\]/g,
-        /manifestPlaceholders\s*\.\s*put\s*\(\s*["']([^"']+)["']/g,
-    ]) {
-        let m;
-        while ((m = re.exec(content)) !== null)
-            names.push(m[1]);
-    }
-    // A whole map assigned, added or put at once. The opening bracket the regex
-    // ends on is where the literal starts; its match is where it ends.
-    const assigned = /manifestPlaceholders\s*(?:\.\s*putAll\s*\(\s*)?(?:\+?=\s*)?(?:mapOf\s*|mutableMapOf\s*)?[[(]/g;
-    let m;
-    while ((m = assigned.exec(content)) !== null) {
-        const open = m.index + m[0].length - 1;
-        const close = matchingClose(content, open);
-        if (close === -1)
-            continue;
-        names.push(...mapLiteralKeys(content.slice(open + 1, close)));
-        assigned.lastIndex = close;
-    }
-    return names;
-}
-/**
- * Placeholder names referenced in an `AndroidManifest.xml`, other than the ones
- * the Android Gradle Plugin injects itself.
- *
- * **This is what the Secrets plugin is mostly for.** Its own documentation, and
- * every Google Maps setup guide, puts the key in the manifest and nowhere else:
- *
- *     <meta-data android:name="com.google.android.geo.API_KEY"
- *                android:value="${MAPS_API_KEY}" />
- *
- * There is no `BuildConfig` reference and no `manifestPlaceholders` block —
- * the plugin reads `MAPS_API_KEY` from the properties file and substitutes it
- * during manifest merging. A scan that reads only build files and source sees
- * nothing at all in such a repository.
- *
- * `applicationId` is excluded because AGP supplies it from the variant. A name
- * a build file *declares* in `manifestPlaceholders` is not excluded: the build
- * supplies that one, so naming it costs the usual unused line, and telling the
- * two apart would mean resolving which module's manifest merges with which
- * module's build file.
- */
-const AGP_INJECTED_PLACEHOLDERS = new Set(["applicationId"]);
-function extractManifestXmlPlaceholders(content) {
-    const names = [];
-    const re = /\$\{([A-Za-z_][A-Za-z0-9_.]*)\}/g;
-    let m;
-    while ((m = re.exec(content)) !== null) {
-        if (!AGP_INJECTED_PLACEHOLDERS.has(m[1]))
-            names.push(m[1]);
-    }
-    return names;
-}
-/**
- * True when this build file loads the properties file itself, rather than
- * leaving it to the Secrets plugin.
- *
- * Every spelling seen in the wild reduces to naming the file or calling a
- * helper that names it: `rootProject.file("local.properties")`, AGP's own
- * `gradleLocalProperties(rootDir)`, and Compose's `localPropertiesFile`.
- */
-function readsPropertiesFileDirectly(content) {
-    return (/\blocal\.properties\b/.test(content) ||
-        /\bgradleLocalProperties\s*\(/.test(content) ||
-        /\blocalPropertiesFile\b/.test(content));
-}
-/**
- * Keys a build file reads out of a properties file it loaded itself.
- *
- * `getProperty("x")` is the direct form, with or without a default. The rest is
- * for the idiom that hides it: a repository defines its own one-line accessor —
- *
- *     def getProps(String name) {
- *       def f = rootProject.file('local.properties')
- *       if (f.exists()) { def p = new Properties(); p.load(...); return p[name] }
- *       return ""
- *     }
- *
- * — and every key then arrives as `getProps("sign.file")`, under a name chosen
- * by that repository. So a function whose *body* reads the properties file is
- * treated as an accessor for it, and the string literals at its call sites are
- * keys. Without that, a repository like this reads as having none.
- *
- * `properties["x"]` is deliberately not matched: that is the Gradle *project*
- * property channel — `gradle.properties` and `-P` — which `extractPropertyRefs`
- * already reports, and which is not this file.
- */
-function extractDirectPropertyReads(content) {
-    const names = [];
-    const direct = /\.\s*getProperty\s*\(\s*["']([^"']+)["']/g;
-    let m;
-    while ((m = direct.exec(content)) !== null)
-        names.push(m[1]);
-    for (const accessor of propertiesAccessorNames(content)) {
-        const call = new RegExp(`\\b${escapeForRegExp(accessor)}\\s*\\(\\s*["']([^"']+)["']`, "g");
-        let c;
-        while ((c = call.exec(content)) !== null)
-            names.push(c[1]);
-    }
-    return names;
-}
-function escapeForRegExp(value) {
-    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-/** Functions declared in this file whose body reads the properties file. */
-function propertiesAccessorNames(content) {
-    const names = [];
-    // Groovy `def name(...) {` and Kotlin `fun name(...) {`, which is how a
-    // build script declares one.
-    const decl = /\b(?:def|fun)\s+([A-Za-z_]\w*)\s*\([^)]*\)\s*(?::[^{]*)?\{/g;
-    let m;
-    while ((m = decl.exec(content)) !== null) {
-        // `matchingBrace` counts from inside the block, so hand it the index after
-        // the opening brace the declaration regex ended on.
-        const body = m.index + m[0].length;
-        const close = matchingBrace(content, body);
-        if (close === -1)
-            continue;
-        if (readsPropertiesFileDirectly(content.slice(body, close)))
-            names.push(m[1]);
-    }
-    return names;
-}
-/**
- * Keys that name a location on the machine running the build, not a value the
- * build needs supplied.
- *
- * Writing one into a generated file puts a developer's own SDK path onto a
- * runner, where it is wrong — and Gradle finds the SDK from `ANDROID_HOME`
- * when the key is absent, which is how every build on a runner resolves it.
- * The Secrets plugin ignores `sdk.dir` for the same reason.
- */
-const MACHINE_LOCAL_KEYS = new Set(["sdk.dir", "ndk.dir", "cmake.dir"]);
-// Bounds on the source walk, the way `findGradleFiles` bounds itself to the
-// files a build actually declares. A repository is an unbounded tree and this
-// runs on every scan of one.
-const SOURCE_EXTENSIONS = [".kt", ".kts", ".java"];
-const SOURCE_SKIP_DIRS = new Set(["build", "node_modules"]);
-/**
- * **Manifests get their own budget, and a source walk cannot spend it.**
- *
- * They shared one at first, with source walked first, and on a real application
- * that meant the manifests were never reached at all: 1743 source files against
- * a 1500-file cap left nothing, and the keys referenced only as `${KEY}` in a
- * manifest — which is most of them — came back missing. A scan that answers
- * well on a small repository and silently thins out on a large one is the worse
- * of the two failures, because the large one is the one someone is paid to
- * build.
- *
- * There are few manifests and many source files — 47 against 1743 in that same
- * application — so the two are not competing for a scarce resource, they were
- * just sharing the wrong one.
- */
-const SOURCE_FILE_CAP = 8000;
-const MANIFEST_FILE_CAP = 500;
-const SOURCE_DEPTH_CAP = 12;
-/** Source files under `dir`, up to the shared file budget. */
-function findSourceFiles(dir, budget, depth = 0) {
-    if (depth > SOURCE_DEPTH_CAP || budget.left <= 0)
-        return [];
-    let entries;
-    try {
-        entries = readdirSync(dir, { withFileTypes: true });
-    }
-    catch {
-        return [];
-    }
-    const files = [];
-    const subdirs = [];
-    for (const entry of entries) {
-        // Dot directories hold caches and VCS state, never source: `.git`,
-        // `.gradle`, `.idea`, `.kotlin`.
-        if (entry.name.startsWith("."))
-            continue;
-        if (entry.isDirectory()) {
-            if (!SOURCE_SKIP_DIRS.has(entry.name))
-                subdirs.push(join(dir, entry.name));
-        }
-        else if (SOURCE_EXTENSIONS.some((ext) => entry.name.endsWith(ext))) {
-            if (budget.left <= 0)
-                break;
-            budget.left--;
-            files.push(join(dir, entry.name));
-        }
-    }
-    for (const sub of subdirs)
-        files.push(...findSourceFiles(sub, budget, depth + 1));
-    return files;
-}
-/** The directories of `dirs` that no other member of `dirs` contains. */
-function outermost(dirs) {
-    return dirs.filter((dir) => !dirs.some((other) => other !== dir && dir.startsWith(other + "/")));
-}
-/** Manifests under `dir`, up to the shared file budget. */
-function findManifests(dir, budget, depth = 0) {
-    if (depth > SOURCE_DEPTH_CAP || budget.left <= 0)
-        return [];
-    let entries;
-    try {
-        entries = readdirSync(dir, { withFileTypes: true });
-    }
-    catch {
-        return [];
-    }
-    const found = [];
-    for (const entry of entries) {
-        if (entry.name.startsWith("."))
-            continue;
-        if (entry.isDirectory()) {
-            if (!SOURCE_SKIP_DIRS.has(entry.name)) {
-                found.push(...findManifests(join(dir, entry.name), budget, depth + 1));
-            }
-        }
-        else if (entry.name === "AndroidManifest.xml") {
-            if (budget.left <= 0)
-                break;
-            budget.left--;
-            found.push(join(dir, entry.name));
-        }
-    }
-    return found;
-}
-/**
- * The property names the build reads out of the properties file — see
- * `ScanResult.missingPropertyKeys`. Four sources, because a repository may use
- * any of them and most use exactly one:
- *
- *  - `${KEY}` in an `AndroidManifest.xml`, which the Secrets plugin fills. The
- *    commonest of the four by a distance, and the one its documentation shows.
- *  - `manifestPlaceholders` declared in a build file.
- *  - `BuildConfig.<FIELD>` in source, for a key read as a generated constant.
- *  - `getProperty("key")` in a build file that loads the properties file
- *    itself, for a build that does not use the plugin at all.
- *
- * Bounded to the modules that either apply the plugin or read the file
- * directly. A module that does neither cannot be reading a key out of it.
- */
-function collectPropertyKeys(gradleFiles) {
-    // A module with both a `build.gradle` and a `build.gradle.kts` yields its
-    // directory twice, and walking it twice would spend the file budget twice.
-    const moduleDirs = new Set();
-    const keys = new Set();
-    for (const filePath of gradleFiles) {
-        const content = safeRead(filePath);
-        const plugin = appliesSecretsPlugin(content);
-        const direct = readsPropertiesFileDirectly(content);
-        if (!plugin && !direct)
-            continue;
-        moduleDirs.add(dirname(filePath));
-        for (const key of extractManifestPlaceholderKeys(content))
-            keys.add(key);
-        if (direct)
-            for (const key of extractDirectPropertyReads(content))
-                keys.add(key);
-    }
-    if (moduleDirs.size === 0)
-        return [];
-    const sourceBudget = { left: SOURCE_FILE_CAP };
-    const manifestBudget = { left: MANIFEST_FILE_CAP };
-    for (const dir of outermost([...moduleDirs])) {
-        // Manifests first. They are the likeliest place for a key and the cheapest
-        // to read, so if anything is ever going to run short it must not be these.
-        for (const manifest of findManifests(dir, manifestBudget)) {
-            for (const name of extractManifestXmlPlaceholders(safeRead(manifest)))
-                keys.add(name);
-        }
-        for (const file of findSourceFiles(dir, sourceBudget)) {
-            for (const name of extractBuildConfigFieldRefs(safeRead(file)))
-                keys.add(name);
-        }
-    }
-    for (const key of MACHINE_LOCAL_KEYS)
-        keys.delete(key);
-    return [...keys].sort();
-}
-/** Parse property keys from a standard .properties file, skipping comments and blank lines. */
-function parsePropertyKeys(propertiesContent) {
-    return propertiesContent
-        .split("\n")
-        .map((l) => l.trim())
-        .filter((l) => l && !l.startsWith("#") && l.includes("="))
-        .map((l) => l.split("=")[0].trim())
-        .filter(Boolean);
-}
-/**
- * Removes `if (file("…").exists()) { … }` blocks from build-file content.
- *
- * A plugin applied inside one of these is *conditional on a file the build
- * may not have*. Projects use the idiom precisely so a checkout without the
- * credential still builds:
- *
- *     if (file("google-services.json").exists()) {
- *       apply(plugin = libs.plugins.gms.googleServices.get().pluginId)
- *     }
- *
- * Reading the declaration and ignoring the guard turns "this project builds
- * fine without a credential" into "this project cannot build without one" —
- * a warning that sends the user looking for a file the build never asks for.
- *
- * Brace matching skips quoted strings so a `{` inside a literal cannot end
- * the block early. Anything it cannot match to a close brace is left alone:
- * losing a real declaration is worse than keeping a guarded one.
- */
-export function stripExistenceGuardedBlocks(content) {
-    const guard = /if\s*\(\s*[A-Za-z0-9_.]*file\s*\(\s*[^)]*\)\s*\.exists\s*\(\s*\)\s*\)\s*\{/g;
-    let out = "";
-    let cursor = 0;
-    let match;
-    while ((match = guard.exec(content)) !== null) {
-        const bodyStart = match.index + match[0].length;
-        const end = matchingBrace(content, bodyStart);
-        if (end === -1)
-            continue;
-        out += content.slice(cursor, match.index);
-        cursor = end + 1;
-        guard.lastIndex = cursor;
-    }
-    return out + content.slice(cursor);
-}
-/** Index of the `}` closing a block whose body starts at `start`, or -1. */
-function matchingBrace(content, start) {
-    let depth = 1;
-    let quote = null;
-    for (let i = start; i < content.length; i++) {
-        const ch = content[i];
-        if (quote) {
-            if (ch === "\\")
-                i++;
-            else if (ch === quote)
-                quote = null;
-            continue;
-        }
-        if (ch === '"' || ch === "'")
-            quote = ch;
-        else if (ch === "{")
-            depth++;
-        else if (ch === "}" && --depth === 0)
-            return i;
-    }
-    return -1;
-}
-/**
- * Returns true if the GMS google-services plugin is applied unconditionally
- * in this content. A declaration guarded by the presence of
- * `google-services.json` is not a credential requirement — see
- * `stripExistenceGuardedBlocks`.
- */
-function detectGmsPlugin(content) {
-    const unguarded = stripExistenceGuardedBlocks(content);
-    return (/apply\s+plugin\s*:\s*['"]com\.google\.gms\.google-services['"]/.test(unguarded) ||
-        /id\s*\(\s*["']com\.google\.gms\.google-services["']\s*\)/.test(unguarded) ||
-        /id\s*["']com\.google\.gms\.google-services["']/.test(unguarded));
-}
-/** Returns true if a signingConfigs block exists. */
-function detectSigningConfigs(content) {
-    return /signingConfigs\s*\{/.test(content);
-}
-/**
- * Extract env var and property references from within signingConfigs blocks.
- * Looks for storeFile, storePassword, keyAlias, keyPassword assignments.
- */
-function parseSigningCredentialRefs(content) {
-    const results = [];
-    const blockRe = /signingConfigs\s*\{([\s\S]*?)^\s*\}/m;
-    const match = blockRe.exec(content);
-    if (!match)
-        return results;
-    const block = match[1];
-    const blockStart = match.index;
-    // System.getenv inside signing block
-    const envRe = /System\.getenv\(\s*["']([^"']+)["']\s*\)/g;
-    let m;
-    while ((m = envRe.exec(block)) !== null) {
-        results.push({ name: m[1], line: lineNumber(content, blockStart + m.index) });
-    }
-    // findProperty / properties[] inside signing block
-    const propRe = /(?:project\.)?findProperty\(\s*["']([^"']+)["']\s*\)|(?:project\.)?properties\["([^"]+)"\]/g;
-    while ((m = propRe.exec(block)) !== null) {
-        results.push({ name: m[1] ?? m[2], line: lineNumber(content, blockStart + m.index) });
-    }
-    return results;
-}
-/**
- * Extract referenced keystore file paths from signingConfigs.
- * Handles: storeFile file("path") and storeFile = file("path")
- */
-function extractKeystorePaths(content) {
-    const paths = [];
-    const re = /storeFile\s*(?:=\s*)?file\(\s*["']([^"']+)["']\s*\)/g;
-    let m;
-    while ((m = re.exec(content)) !== null) {
-        paths.push(m[1]);
-    }
-    return paths;
-}
-// ---------------------------------------------------------------------------
-// Java version detection
-// ---------------------------------------------------------------------------
-/**
- * Parses a raw version token into a major Java version number.
- * Handles formats: "21", "17", "1.8" (→ 8), "VERSION_21", "VERSION_1_8" (→ 8).
- */
-function parseJavaVersion(raw) {
-    // `JvmTarget.fromTarget("17")` names the version inside a string.
-    const fromTarget = /fromTarget\s*\(\s*["']([^"']+)["']/.exec(raw);
-    if (fromTarget)
-        return parseJavaVersion(fromTarget[1]);
-    // JavaVersion enum: VERSION_21, VERSION_17, VERSION_1_8
-    // JvmTarget enum:   JVM_21, JVM_17, JVM_1_8
-    const enumMatch = /(?:VERSION|JVM)_1_(\d)$/.exec(raw);
-    if (enumMatch)
-        return parseInt(enumMatch[1], 10);
-    const enumMatch2 = /(?:VERSION|JVM)_(\d+)$/.exec(raw);
-    if (enumMatch2)
-        return parseInt(enumMatch2[1], 10);
-    // String literal: "21", "17", "11", "1.8"
-    const legacyMatch = /^1\.(\d)$/.exec(raw.trim());
-    if (legacyMatch)
-        return parseInt(legacyMatch[1], 10);
-    const plain = parseInt(raw.trim(), 10);
-    if (!isNaN(plain))
-        return plain;
-    return undefined;
-}
-/**
- * Scans Gradle file content for Java / JVM version requirements and returns
- * the highest version number found.
- *
- * Detects:
- *   - sourceCompatibility / targetCompatibility (Groovy & Kotlin DSL)
- *   - kotlinOptions { jvmTarget = "21" }
- *   - jvmToolchain(21)  /  jvmToolchain { languageVersion.set(JavaLanguageVersion.of(21)) }
- *   - java { toolchain { languageVersion.set(JavaLanguageVersion.of(21)) } }
- */
-function detectJavaVersionInContent(content) {
-    const candidates = [];
-    // sourceCompatibility / targetCompatibility = JavaVersion.VERSION_21 or = "21" or = JavaVersion.VERSION_1_8
-    const compatRe = /(?:sourceCompatibility|targetCompatibility)\s*[=\s]+([A-Za-z0-9._]+)/g;
-    let m;
-    while ((m = compatRe.exec(content)) !== null) {
-        const v = parseJavaVersion(m[1]);
-        if (v)
-            candidates.push(v);
-    }
-    // jvmTarget, in every form a Kotlin build writes it:
-    //   jvmTarget = "21"                          (kotlinOptions, Groovy)
-    //   jvmTarget.set(JvmTarget.JVM_17)           (compilerOptions, the form
-    //                                              LinuxCommandLibrary uses
-    //                                              everywhere and we read in
-    //                                              none of them)
-    //   jvmTarget = JvmTarget.JVM_21
-    //   jvmTarget.set(JvmTarget.fromTarget("17"))
-    const jvmTargetFromTargetRe = /jvmTarget\s*(?:=|\.set\s*\(\s*)\s*JvmTarget\.fromTarget\s*\(\s*["']([^"']+)["']/g;
-    while ((m = jvmTargetFromTargetRe.exec(content)) !== null) {
-        const v = parseJavaVersion(m[1]);
-        if (v)
-            candidates.push(v);
-    }
-    const jvmTargetRe = /jvmTarget\s*(?:=|\.set\s*\(\s*)\s*(?:JvmTarget\.)?["']?([A-Za-z0-9._]+)["']?/g;
-    while ((m = jvmTargetRe.exec(content)) !== null) {
-        const v = parseJavaVersion(m[1]);
-        if (v)
-            candidates.push(v);
-    }
-    // jvmToolchain(21)
-    const toolchainRe = /jvmToolchain\s*\(\s*(\d+)\s*\)/g;
-    while ((m = toolchainRe.exec(content)) !== null) {
-        candidates.push(parseInt(m[1], 10));
-    }
-    // JavaLanguageVersion.of(21)
-    const langVerRe = /JavaLanguageVersion\.of\s*\(\s*(\d+)\s*\)/g;
-    while ((m = langVerRe.exec(content)) !== null) {
-        candidates.push(parseInt(m[1], 10));
-    }
-    return candidates.length > 0 ? Math.max(...candidates) : undefined;
-}
-/** The builds a settings file composes in, e.g. `includeBuild("build-logic")`. */
-export function parseIncludedBuilds(content) {
-    if (!content || typeof content !== "string")
-        return [];
-    const builds = [];
-    for (const m of content.matchAll(/includeBuild\s*\(?\s*["']([^"']+)["']/g)) {
-        if (!builds.includes(m[1]))
-            builds.push(m[1]);
-    }
-    return builds;
-}
-/**
- * A Java version pinned outside Gradle, and the file that pins it.
- *
- * `mihonapp/mihon` declares no Java level in any Gradle file and pins 21 in
- * `.github/.java-version`, which its own workflows consume through
- * `setup-java`'s `java-version-file:`. The project says what it needs; it
- * just does not say it in Gradle, and reading only Gradle files scanned it as
- * "nothing declared" and ran it on the default. Across the thirty clones,
- * three repositories pin with a version file and ten name a version in a
- * workflow.
- *
- * A pin is a **floor**, folded in with `Math.max` like every other
- * declaration — not an override.
- */
-export function detectPinnedJavaVersion(root) {
-    const found = [];
-    const offer = (version, source) => {
-        if (version !== undefined && version > 0)
-            found.push({ version, source });
-    };
-    for (const name of [".java-version", ".github/.java-version"]) {
-        const content = safeRead(resolve(root, name));
-        if (content)
-            offer(parseJavaVersion(content.trim().split("\n")[0] ?? ""), name);
-    }
-    // asdf / mise: `java temurin-21.0.3+9` — the major version is what matters.
-    const toolVersions = safeRead(resolve(root, ".tool-versions"));
-    if (toolVersions) {
-        const m = /^\s*java\s+(\S+)/m.exec(toolVersions);
-        if (m)
-            offer(parseJavaVersion(m[1].replace(/^[A-Za-z-]+-/, "")), ".tool-versions");
-    }
-    // SDKMAN: `java=17.0.9-tem`
-    const sdkmanrc = safeRead(resolve(root, ".sdkmanrc"));
-    if (sdkmanrc) {
-        const m = /^\s*java\s*=\s*(\S+)/m.exec(sdkmanrc);
-        if (m)
-            offer(parseJavaVersion(m[1]), ".sdkmanrc");
-    }
-    for (const workflow of listWorkflowFiles(root)) {
-        const content = safeRead(workflow);
-        if (!content)
-            continue;
-        const name = relative(root, workflow);
-        // `java-version: 21`, `java-version: '21'`, and a matrix list — take the
-        // highest, because that is the one that has to work.
-        for (const m of content.matchAll(/java-version\s*:\s*(.+)/g)) {
-            for (const token of m[1].split(/[,[\]\s]+/)) {
-                const cleaned = token.replace(/["']/g, "").trim();
-                if (cleaned)
-                    offer(parseJavaVersion(cleaned), name);
-            }
-        }
-        // `java-version-file: .github/.java-version` — read what it points at.
-        for (const m of content.matchAll(/java-version-file\s*:\s*["']?([^"'\s]+)/g)) {
-            const pinned = safeRead(resolve(root, m[1]));
-            if (pinned)
-                offer(parseJavaVersion(pinned.trim().split("\n")[0] ?? ""), m[1]);
-        }
-    }
-    if (found.length === 0)
-        return undefined;
-    return found.reduce((a, b) => (b.version > a.version ? b : a));
-}
-function listWorkflowFiles(root) {
-    const dir = resolve(root, ".github", "workflows");
-    try {
-        return readdirSync(dir)
-            .filter((f) => f.endsWith(".yml") || f.endsWith(".yaml"))
-            .map((f) => resolve(dir, f));
-    }
-    catch {
-        return [];
-    }
-}
-/**
- * Returns the highest Java version requirement found across all Gradle files,
- * or undefined if none is detected.
- */
-function detectRequiredJavaVersion(gradleFiles) {
-    const versions = [];
-    for (const filePath of gradleFiles) {
-        const content = safeRead(filePath);
-        const v = detectJavaVersionInContent(content);
-        if (v !== undefined)
-            versions.push(v);
-    }
-    return versions.length > 0 ? Math.max(...versions) : undefined;
-}
-/**
- * The Gradle version a wrapper pins, read out of its `distributionUrl`.
- * `…/gradle-8.9-bin.zip` → `8.9`.
- *
- * This bounds which JDK the project can build on: Gradle refuses to start on
- * a JDK newer than it knows about, so the wrapper is a hard ceiling that no
- * `sourceCompatibility` declaration can raise.
- *
- * The trailing `-bin` / `-all` belongs to the file name rather than the
- * version, and a release candidate spends two more hyphens on `-rc-1`, so the
- * version group has to be able to give its last segment back.
- */
-export function parseGradleWrapperVersion(content) {
-    const match = /gradle-(\d+(?:\.\d+)*(?:-[A-Za-z0-9.]+)*)-(?:bin|all)\.zip/.exec(content);
-    return match ? match[1] : undefined;
-}
-function detectGradleWrapperVersion(projectRoot) {
-    const path = resolve(projectRoot, "gradle", "wrapper", "gradle-wrapper.properties");
-    if (!existsSync(path))
-        return undefined;
-    return parseGradleWrapperVersion(safeRead(path));
-}
-/**
- * The newest Java release a given Gradle version can run on, or undefined
- * when the version string says nothing usable.
- */
-export function gradleJavaCeiling(gradleVersion) {
-    const parsed = /^(\d+)(?:\.(\d+))?/.exec(gradleVersion ?? "");
-    const major = parsed ? Number(parsed[1]) : NaN;
-    if (!Number.isInteger(major))
-        return undefined;
-    const minor = Number(parsed?.[2] ?? 0);
-    const atLeast = (m, n) => major > m || (major === m && minor >= n);
-    // Minor-aware, because the boundaries are minor releases. While 17 was the
-    // preferred JDK this was harmless — the ceiling only had to be right about
-    // whether 17 fitted. Preferring the newest makes it load-bearing: JDK 21
-    // arrived in Gradle 8.5, so 8.0 through 8.4 answering "21" would hand those
-    // projects a JDK their own wrapper refuses to start on.
-    // Gradle 9.1 added JDK 25; 9.0 tops out at 24. Without this the six corpus
-    // repositories declaring a level above 21 would still abstain, because a
-    // floor of 25 against a ceiling of 24 intersects with nothing — installing
-    // JDK 25 buys nothing if no ceiling ever reaches it.
-    if (atLeast(9, 1))
-        return 25;
-    if (major >= 9)
-        return 24;
-    if (atLeast(8, 5))
-        return 21;
-    if (atLeast(7, 3))
-        return 17;
-    if (atLeast(5, 0))
-        return 11;
-    return 8;
-}
-/** The oldest Java release a given Gradle version will start on. */
-export function gradleJavaFloor(gradleVersion) {
-    const major = Number(/^(\d+)\./.exec(gradleVersion ?? "")?.[1]);
-    if (!Number.isInteger(major))
-        return undefined;
-    return major >= 9 ? 17 : 8;
-}
-/**
- * The JDKs a build machine installs, and therefore the only values the
- * generated `set-java-version` step can satisfy.
- *
- * 11 joined the images on 2026-09-05, for Gradle 5.x and 6.x — which cannot
- * *start* on 17, whatever the sources declare. It is a fallback, never a
- * preference: the selection takes the newest JDK that fits, so 11 is reached
- * only when a wrapper's ceiling leaves nothing else.
- *
- * 8 and 25 joined on 2026-09-07, the companion half of the "newest the
- * wrapper allows" decision — the images carry every JDK we find a project
- * asking for, rather than a project bending to what they carry. 8 is 11's
- * argument one line further back (Gradle 4.x tops out at Java 8); 25 covers
- * the six repositories in the 150-repo corpus that declare a level above 21.
- * Nothing reaches 8 unless a wrapper ceiling forces it.
- */
-export const AVAILABLE_JAVA_VERSIONS = [8, 11, 17, 21, 25];
-/**
- * The newest JDK a build machine carries.
- *
- * It is no longer what the chooser falls back to. It used to be: with no JDK
- * satisfying both the sources and the wrapper, `runnableJavaVersion` returned
- * this — which on a project pinning a modern Java level under an old Gradle
- * wrapper is a JDK **above** that wrapper's ceiling, and the build dies at
- * `:app:processDebugMainManifest` with "module java.base does not opens
- * java.io to unnamed module". A number above the ceiling is not a fallback;
- * it is the failure, chosen deliberately and reported as success.
- */
-export const NEWEST_AVAILABLE_JAVA_VERSION = Math.max(...AVAILABLE_JAVA_VERSIONS);
-/**
- * The JDK to build on, with the reason attached — one place where the
- * constraints are resolved, so the answer and the explanation cannot disagree.
- *
- * They used to. The chooser fell back to the newest installed JDK whenever
- * nothing satisfied both constraints, and the sentence beside it had two
- * branches — a ceiling below every installed JDK, and a declaration above
- * every installed JDK — so the commonest shape of all fell through both and
- * said nothing at all. A project pinning Java 12 against a Gradle wrapper that
- * runs on 11 at most got Java 25 and silence.
- *
- * Three facts decide it:
- *
- *  - **What the build machine has.** Only `AVAILABLE_JAVA_VERSIONS` exist, so
- *    a project declaring 30 cannot simply be given 30.
- *  - **What Gradle can run on.** The wrapper sets a ceiling that source
- *    compatibility cannot raise: Gradle starts before it reads a single
- *    `sourceCompatibility`.
- *  - **What the sources ask for.** A declaration is a floor, not an exact
- *    request — a project declaring 11 compiles fine on 21.
- *
- * `kind` distinguishes the five outcomes:
- *
- *  - `unknown` — nothing declared and no readable wrapper. Nothing to go on
- *    and nothing to say.
- *  - `satisfies` — an installed JDK meets both the floor and the ceiling.
- *  - `capped-by-wrapper` — nothing meets both, and the wrapper is why. The
- *    ceiling is hard and the declaration is a preference, so the newest JDK
- *    the wrapper *can* run is the answer, and the caller says so.
- *  - `above-runners` — the declaration is above every installed JDK, and that
- *    rather than the wrapper is what binds. **No answer**: asking for it would
- *    fail when the JDK is selected, and quietly picking a lower one would be
- *    the guess this exists to avoid.
- *  - `wrapper-below-runners` — the ceiling is below every installed JDK. No
- *    answer exists.
- *
- * `above-runners` is checked before `capped-by-wrapper` so a project declaring
- * 99 against a modern wrapper is told about the machines rather than about its
- * wrapper: both bind, and the one it can act on is the one worth naming.
- */
-export function chooseJavaVersion(detectedJavaVersion, gradleVersion) {
-    const declared = Number(detectedJavaVersion) || 0;
-    const ceiling = gradleJavaCeiling(gradleVersion);
-    const floor = gradleJavaFloor(gradleVersion);
-    const installed = [...AVAILABLE_JAVA_VERSIONS].sort((a, b) => a - b);
-    const base = { declared, ceiling, installed };
-    if (!declared && floor === undefined) {
-        return { ...base, version: undefined, kind: "unknown" };
-    }
-    const wanted = Math.max(declared, floor ?? 0);
-    const usable = installed.filter((v) => v >= wanted && v <= (ceiling ?? Infinity));
-    // The newest that fits. Nothing reaches the oldest installed JDK unless a
-    // ceiling leaves nothing else, which is the only reason 8 and 11 are on the
-    // images at all.
-    if (usable.length > 0) {
-        return { ...base, version: usable[usable.length - 1], kind: "satisfies" };
-    }
-    if (declared > installed[installed.length - 1]) {
-        return { ...base, version: undefined, kind: "above-runners" };
-    }
-    const underCeiling = installed.filter((v) => v <= (ceiling ?? Infinity));
-    if (underCeiling.length > 0) {
-        return {
-            ...base,
-            version: underCeiling[underCeiling.length - 1],
-            kind: "capped-by-wrapper",
-        };
-    }
-    return { ...base, version: undefined, kind: "wrapper-below-runners" };
-}
-/**
- * The Java version to write into a generated pipeline: the **newest**
- * available JDK that satisfies both what the sources declare and what the
- * Gradle wrapper can run on.
- *
- * DECIDED 2026-09-06 (Alex), reversing Invarn PRD decision #15 ("17 is the
- * JDK whenever nothing forces otherwise"). The thirty-app study measured the
- * cost of preferring 17 in one direction and none in the other: two rows
- * failed because 17 was too *low* for a build plugin's own runtime
- * requirement, and no row failed because 21 was too high. A project targeting
- * 17 runs fine on 21; never the reverse.
- *
- * Source compatibility is a floor, not an exact request. Gradle starts before
- * it reads a single `sourceCompatibility`, so a wrapper pinning an old Gradle
- * caps the JDK no matter what the sources say — which is why the ceiling
- * above had to learn minor versions before this could ship.
- */
-export function runnableJavaVersion(detectedJavaVersion, gradleVersion) {
-    return chooseJavaVersion(detectedJavaVersion, gradleVersion).version;
-}
-/**
- * What the choice could not honour, as a sentence, or undefined when it
- * honoured everything.
- *
- * Silence is the failure this exists to prevent: a pipeline that quietly
- * overruled what a project asked for reads as the project's own problem, and
- * the commonest shape of all — an old wrapper under a modern declaration — was
- * the one that used to fall through every branch.
- *
- * `source` names the file that asked, when the caller knows it. The scan now
- * returns it, so "asks for Java 12" can become "asks for Java 12
- * (.github/workflows/Build.yml)" — a version with no provenance sends a reader
- * looking through every Gradle file for a number that is not in any of them.
- */
-export function javaVersionProblem(detectedJavaVersion, gradleVersion, source) {
-    const choice = chooseJavaVersion(detectedJavaVersion, gradleVersion);
-    if (choice.kind === "satisfies" || choice.kind === "unknown")
-        return undefined;
-    const { declared, ceiling, installed } = choice;
-    // "11, 17 and 21", not "11 and 17 and 21" — a human reads this next to a
-    // build that will not start.
-    const list = installed.length > 1
-        ? `${installed.slice(0, -1).join(", ")} and ${installed[installed.length - 1]}`
-        : String(installed[0]);
-    const asked = source ? `Java ${declared} (${source})` : `Java ${declared}`;
-    if (choice.kind === "wrapper-below-runners") {
-        return `Gradle ${gradleVersion} runs on Java ${ceiling} at most, and build machines carry only ${list}. This pipeline will very likely fail before it compiles anything — upgrade the Gradle wrapper.`;
-    }
-    if (choice.kind === "above-runners") {
-        return `This project declares Java ${declared}, and build machines carry only ${list}. Leaving JAVA_VERSION at the pipeline default — asking for ${declared} would fail at "Set the Java version", and quietly choosing a lower one would be a guess.`;
-    }
-    // capped-by-wrapper
-    const preamble = declared
-        ? `This project asks for ${asked}, and Gradle ${gradleVersion} runs on Java ${ceiling} at most.`
-        : `Gradle ${gradleVersion} runs on Java ${ceiling} at most.`;
-    return `${preamble} Building on ${choice.version} — the newest the wrapper allows.`;
-}
-// ---------------------------------------------------------------------------
-// Gitignore helper
-// ---------------------------------------------------------------------------
-const CI_RELEVANT_GITIGNORE_PATTERNS = [
-    { pattern: /google-services\.json/, label: "google-services.json" },
-    { pattern: /local\.properties/, label: "local.properties" },
-    { pattern: /keystore\.properties/, label: "keystore.properties" },
-    { pattern: /\.jks$|\.keystore$|\*\.jks|\*\.keystore/, label: "keystore files (*.jks / *.keystore)" },
-    { pattern: /\.env$|\*\.env/, label: ".env files" },
-];
-function checkGitignore(root) {
-    const gitignorePath = resolve(root, ".gitignore");
-    if (!existsSync(gitignorePath))
-        return [];
-    const content = safeRead(gitignorePath);
-    const lines = content.split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("#"));
-    const found = [];
-    for (const { pattern, label } of CI_RELEVANT_GITIGNORE_PATTERNS) {
-        if (lines.some((l) => pattern.test(l))) {
-            found.push(label);
-        }
-    }
-    return found;
-}
-// ---------------------------------------------------------------------------
-// Build variant detection
-// ---------------------------------------------------------------------------
-/**
- * Extracts the inner content of a named block using brace-counting.
- * e.g. extractBlockContent(content, "buildTypes") returns everything inside buildTypes { ... }.
- * Returns undefined if the block is not found.
- */
-function extractBlockContent(content, keyword) {
-    const keywordRe = new RegExp(`\\b${keyword}\\s*\\{`);
-    const match = keywordRe.exec(content);
-    if (!match)
-        return undefined;
-    const start = content.indexOf("{", match.index);
-    let depth = 0;
-    for (let i = start; i < content.length; i++) {
-        if (content[i] === "{")
-            depth++;
-        else if (content[i] === "}") {
-            depth--;
-            if (depth === 0)
-                return content.slice(start + 1, i);
-        }
-    }
-    return undefined;
-}
-const CONTROL_KEYWORDS = new Set([
-    "if", "else", "for", "while", "when", "try", "catch", "finally",
-    "return", "val", "var", "fun", "object", "class", "interface",
-]);
-/**
- * Extracts the names of direct child blocks from block content.
- * Handles both Groovy DSL (name { }) and Kotlin DSL (create("name") { } / getByName("name") { }).
- */
-function extractDirectChildNames(block) {
-    const names = [];
-    let depth = 0;
-    for (const line of block.split("\n")) {
-        const opens = (line.match(/\{/g) || []).length;
-        const closes = (line.match(/\}/g) || []).length;
-        if (depth === 0 && opens > 0) {
-            // Kotlin DSL: create("name") { or getByName("name") {
-            const kotlinMatch = /(?:create|getByName)\(\s*["'](\w+)["']\s*\)/.exec(line);
-            if (kotlinMatch) {
-                names.push(kotlinMatch[1]);
-            }
-            else {
-                // Groovy DSL: name { (identifier followed by optional whitespace then {)
-                const groovyMatch = /^\s*([a-z]\w*)\s*(?:\.\w+\s*)?\{/.exec(line);
-                if (groovyMatch && !CONTROL_KEYWORDS.has(groovyMatch[1])) {
-                    names.push(groovyMatch[1]);
-                }
-            }
-        }
-        depth += opens - closes;
-        if (depth < 0)
-            depth = 0;
-    }
-    return [...new Set(names)];
-}
-/** Source-set directories AGP defines itself, which never name a flavor. */
-const SHARED_SOURCE_SETS = new Set(["main", "test", "androidTest", "testFixtures"]);
-/** `testProd` and `androidTestProd` are `prod`'s test source sets, not flavors. */
-const TEST_SOURCE_SET_PREFIXES = ["test", "androidTest"];
-/**
- * What a source set holds. A directory under `src/` carrying none of these is
- * something a human left there, not a source set AGP would read.
- */
-const SOURCE_SET_CONTENTS = new Set([
-    "java",
-    "kotlin",
-    "res",
-    "resources",
-    "assets",
-    "aidl",
-    "jni",
-    "jniLibs",
-    "rs",
-    "renderscript",
-    "shaders",
-    "ml",
-    "baselineProfiles",
-    "AndroidManifest.xml",
-    "google-services.json",
-]);
-function safeReaddir(dir) {
-    try {
-        return readdirSync(dir, { withFileTypes: true }).map((e) => ({
-            name: e.name,
-            isDirectory: e.isDirectory(),
-        }));
-    }
-    catch {
-        return [];
-    }
-}
-/** `testProd` starts with the segment `test`; a flavor called `testing` does not. */
-function startsWithSegment(name, segment) {
-    if (!name.startsWith(segment) || name.length === segment.length)
-        return false;
-    const next = name[segment.length];
-    return next === next.toUpperCase() && next !== next.toLowerCase();
-}
-/** `ciDynamicDebug` ends with the segment `debug`; `staging` does not. */
-function endsWithSegment(name, segment) {
-    const capitalized = segment.charAt(0).toUpperCase() + segment.slice(1);
-    return name.length > capitalized.length && name.endsWith(capitalized);
-}
-/**
- * Product flavors read from the source sets a module has on disk.
- *
- * Modern Android declares its flavors in a convention plugin — an enum in
- * Kotlin source, applied through `create(flavor.name)` — so there is no
- * literal `productFlavors { … }` block anywhere to parse. The scan is static
- * by design (running a Gradle configuration phase to list flavors would cost
- * minutes on every `ci build`), so the evidence has to be something already on
- * disk. A flavor has a source set, which is the same evidence `invarn setup`
- * has always resolved `google-services.json` by.
- *
- * A directory under `<module>/src/` names a flavor when it is none of the
- * things AGP creates for its own reasons: the shared and test source sets, a
- * build type, a test source set for one flavor, or a variant — a flavor and a
- * build type already joined, which taking for a flavor would cross with the
- * build types a second time and offer `ciDynamicDebugDebug`.
- */
-function flavorsFromSourceSets(gradleFiles, buildTypes) {
-    const found = new Set();
-    for (const filePath of gradleFiles) {
-        const srcDir = join(dirname(filePath), "src");
-        for (const entry of safeReaddir(srcDir)) {
-            if (!entry.isDirectory)
-                continue;
-            const name = entry.name;
-            if (SHARED_SOURCE_SETS.has(name))
-                continue;
-            if (buildTypes.includes(name))
-                continue;
-            if (TEST_SOURCE_SET_PREFIXES.some((p) => startsWithSegment(name, p)))
-                continue;
-            if (buildTypes.some((bt) => endsWithSegment(name, bt)))
-                continue;
-            const holds = safeReaddir(join(srcDir, name));
-            if (!holds.some((child) => SOURCE_SET_CONTENTS.has(child.name)))
-                continue;
-            found.add(name);
-        }
-    }
-    // The filesystem's order is not a declaration order, so give it one.
-    return Array.from(found).sort();
-}
-/**
- * Detects build types and product flavors from Gradle files by static parsing,
- * falling back to the module's source sets for the flavors when no Gradle file
- * declares any (see `flavorsFromSourceSets`).
- *
- * Always includes "debug" and "release" as defaults.
- *
- * The fallback only ever runs when the literal scan found nothing, so a
- * project whose Gradle files declare flavors is decided by those files exactly
- * as before. Merging the two would let a leftover directory invent a flavor
- * the build does not have.
- */
-export function detectBuildVariants(gradleFiles) {
-    const buildTypeSet = new Set(["debug", "release"]);
-    const productFlavorSet = new Set();
-    for (const filePath of gradleFiles) {
-        const content = safeRead(filePath);
-        const buildTypesBlock = extractBlockContent(content, "buildTypes");
-        if (buildTypesBlock) {
-            for (const name of extractDirectChildNames(buildTypesBlock)) {
-                buildTypeSet.add(name);
-            }
-        }
-        const productFlavorsBlock = extractBlockContent(content, "productFlavors");
-        if (productFlavorsBlock) {
-            for (const name of extractDirectChildNames(productFlavorsBlock)) {
-                productFlavorSet.add(name);
-            }
-        }
-    }
-    const buildTypes = Array.from(buildTypeSet);
-    const productFlavors = productFlavorSet.size > 0
-        ? Array.from(productFlavorSet)
-        : flavorsFromSourceSets(gradleFiles, buildTypes);
-    const variants = productFlavors.length === 0
-        ? buildTypes
-        : productFlavors.flatMap((flavor) => buildTypes.map((bt) => `${flavor}${bt.charAt(0).toUpperCase()}${bt.slice(1)}`));
-    return { buildTypes, productFlavors, variants };
-}
-// ---------------------------------------------------------------------------
-// Main scanner
-// ---------------------------------------------------------------------------
-export async function scanAndroidProject(projectRoot) {
-    const warnings = [];
-    // Track env vars we've already warned about to avoid duplicates
-    const seenEnvVars = new Set();
-    const seenProperties = new Set();
-    // Compute gitignore items upfront — used in multiple sections below
-    const gitignoreItems = checkGitignore(projectRoot);
-    // ------------------------------------------------------------------
-    // 1. Missing files
-    // ------------------------------------------------------------------
-    if (!existsSync(resolve(projectRoot, "local.properties"))) {
-        warnings.push({
-            category: "missing-file",
-            severity: "warning",
-            message: "local.properties not found",
-            hint: "CI needs ANDROID_HOME set as an env var, or sdk.dir in local.properties",
-        });
-    }
-    // ------------------------------------------------------------------
-    // 2. Detect required Java version and build variants
-    // ------------------------------------------------------------------
-    const gradleFiles = findGradleFiles(projectRoot);
-    const declaredJavaVersion = detectRequiredJavaVersion(gradleFiles);
-    // A version file or a workflow pin is a floor like any declaration, and for
-    // a project that declares nothing in Gradle it is the only thing that says
-    // which JDK the build needs.
-    const pinnedJava = detectPinnedJavaVersion(projectRoot);
-    const detectedJavaVersion = declaredJavaVersion === undefined && pinnedJava === undefined
-        ? undefined
-        : Math.max(declaredJavaVersion ?? 0, pinnedJava?.version ?? 0);
-    // Only when the pin is what set the level. A Gradle file asking for as much
-    // or more is the thing a reader would find by looking, so naming the
-    // workflow there would point away from the answer.
-    const detectedJavaVersionSource = pinnedJava !== undefined && pinnedJava.version > (declaredJavaVersion ?? 0)
-        ? pinnedJava.source
-        : undefined;
-    const detectedGradleVersion = detectGradleWrapperVersion(projectRoot);
-    const buildVariants = detectBuildVariants(gradleFiles);
-    // ------------------------------------------------------------------
-    // 3. Scan Gradle files
-    // ------------------------------------------------------------------
-    let gmsDetected = false;
-    let gmsDetectedIn = "";
-    let signingDetected = false;
-    let signingDetectedIn = "";
-    for (const filePath of gradleFiles) {
-        const content = safeRead(filePath);
-        const rel = relPath(projectRoot, filePath);
-        // GMS plugin
-        if (detectGmsPlugin(content)) {
-            gmsDetected = true;
-            gmsDetectedIn = rel;
-        }
-        // Signing config
-        if (detectSigningConfigs(content)) {
-            signingDetected = true;
-            signingDetectedIn = rel;
-            // Keystore file paths referenced
-            for (const kPath of extractKeystorePaths(content)) {
-                const resolved = resolve(projectRoot, kPath);
-                if (!existsSync(resolved)) {
-                    warnings.push({
-                        category: "missing-file",
-                        severity: "warning",
-                        message: `Keystore file not found: ${kPath}`,
-                        hint: "Provide the keystore file as a secret file in CI or update the path in signingConfigs",
-                        location: rel,
-                    });
-                }
-            }
-            // Signing credential env var / property refs
-            for (const ref of parseSigningCredentialRefs(content)) {
-                if (!seenEnvVars.has(ref.name)) {
-                    seenEnvVars.add(ref.name);
-                    warnings.push({
-                        category: "signing-config",
-                        severity: "warning",
-                        message: `Signing credential referenced: ${ref.name}`,
-                        hint: `Add via: ci secrets add ${ref.name}`,
-                        location: `${rel}:${ref.line}`,
-                    });
-                }
-            }
-        }
-        // System.getenv() references (outside buildConfigField — caught separately)
-        for (const ref of extractEnvVarRefs(content)) {
-            if (!seenEnvVars.has(ref.name)) {
-                seenEnvVars.add(ref.name);
-                warnings.push({
-                    category: "env-var",
-                    severity: "warning",
-                    message: `Environment variable referenced: ${ref.name}`,
-                    hint: `Add via: ci secrets add ${ref.name}`,
-                    location: `${rel}:${ref.line}`,
-                });
-            }
-        }
-        // buildConfigField + System.getenv references
-        for (const ref of extractBuildConfigEnvRefs(content)) {
-            if (!seenEnvVars.has(ref.name)) {
-                seenEnvVars.add(ref.name);
-                warnings.push({
-                    category: "build-config",
-                    severity: "warning",
-                    message: `BuildConfig env var referenced: ${ref.name}`,
-                    hint: `Add via: ci secrets add ${ref.name}`,
-                    location: `${rel}:${ref.line}`,
-                });
-            }
-        }
-        // Gradle property references
-        for (const ref of extractPropertyRefs(content)) {
-            if (!seenProperties.has(ref.name)) {
-                seenProperties.add(ref.name);
-                warnings.push({
-                    category: "gradle-property",
-                    severity: "warning",
-                    message: `Gradle property referenced: ${ref.name}`,
-                    hint: "Define in gradle.properties or pass as -P flag on CI",
-                    location: `${rel}:${ref.line}`,
-                });
-            }
-        }
-    }
-    // ------------------------------------------------------------------
-    // 4. Google Secrets Gradle Plugin — detect missing local.properties
-    // ------------------------------------------------------------------
-    //
-    // The Secrets plugin reads a properties file (default: local.properties) and
-    // auto-generates BuildConfig fields.  If that file is gitignored / absent in CI
-    // the fields are not generated, causing "Unresolved reference" compile errors.
-    // We check once per unique properties file path across all modules.
-    // ------------------------------------------------------------------
-    const seenSecretsPropertiesFiles = new Set();
-    // First pass: collect the defaultPropertiesFileName from any build file that sets it.
-    // This is typically "secrets.defaults.properties" in the app module.
-    let secretsDefaultsFileName;
-    for (const filePath of gradleFiles) {
-        const content = safeRead(filePath);
-        const block = extractBlockContent(content, "secrets");
-        if (!block)
-            continue;
-        const m = /defaultPropertiesFileName\s*=\s*["']([^"']+)["']/.exec(block);
-        if (m) {
-            secretsDefaultsFileName = m[1];
-            break;
-        }
-    }
-    // Also look for any *.defaults.properties file in the project root as a fallback
-    if (!secretsDefaultsFileName) {
-        const candidates = ["secrets.defaults.properties", "local.defaults.properties"];
-        for (const c of candidates) {
-            if (existsSync(resolve(projectRoot, c))) {
-                secretsDefaultsFileName = c;
-                break;
-            }
-        }
-    }
-    for (const filePath of gradleFiles) {
-        const content = safeRead(filePath);
-        if (!detectSecretsPlugin(content))
-            continue;
-        const propsFileName = extractSecretsPropertiesFile(content);
-        if (seenSecretsPropertiesFiles.has(propsFileName))
-            continue;
-        seenSecretsPropertiesFiles.add(propsFileName);
-        // Warn when the properties file is gitignored — it won't be present on a clean CI machine
-        // even if it exists locally (e.g. local.properties with only sdk.dir).
-        const isGitignored = gitignoreItems.some((item) => item.includes(propsFileName));
-        if (!isGitignored)
-            continue;
-        // Find expected keys from the companion defaults file
-        const expectedKeys = secretsDefaultsFileName
-            ? parsePropertyKeys(safeRead(resolve(projectRoot, secretsDefaultsFileName)))
-            : [];
-        if (expectedKeys.length > 0) {
-            // Emit one warning per expected key so it shows up in the missing-secrets hint
-            for (const key of expectedKeys) {
-                warnings.push({
-                    category: "secrets-plugin",
-                    severity: "warning",
-                    message: `Secrets plugin key: ${key}`,
-                    hint: `Add via: ci secrets add ${key}`,
-                    location: propsFileName,
-                });
-            }
-        }
-        else {
-            warnings.push({
-                category: "secrets-plugin",
-                severity: "warning",
-                message: `Google Secrets Gradle Plugin reads '${propsFileName}' which is absent in CI`,
-                hint: `Inject '${propsFileName}' as a file step using a secret variable`,
-                location: relPath(projectRoot, filePath),
-            });
-        }
-    }
-    // ------------------------------------------------------------------
-    // 4b. Which keys that properties file has to declare
-    // ------------------------------------------------------------------
-    //
-    // Section 4 says the file is absent; this says what is in it. The two are
-    // separate because they answer different questions for different readers —
-    // the warnings above tell a person a file is missing, and this tells a
-    // generator what a stand-in for it has to contain.
-    // ------------------------------------------------------------------
-    const missingPropertyKeys = collectPropertyKeys(gradleFiles);
-    // ------------------------------------------------------------------
-    // 5. Firebase / GMS — check google-services.json after scanning all files
-    // ------------------------------------------------------------------
-    if (gmsDetected) {
-        // google-services.json can live in the root or in the app module dir
-        const candidatePaths = [
-            resolve(projectRoot, "google-services.json"),
-            resolve(projectRoot, "app", "google-services.json"),
-        ];
-        const found = candidatePaths.some((p) => existsSync(p));
-        if (!found) {
-            warnings.push({
-                category: "firebase",
-                severity: "warning",
-                message: `google-services.json not found (GMS plugin detected in ${gmsDetectedIn})`,
-                hint: "Add google-services.json as a secret file or generate it from env vars at build time",
-            });
-        }
-    }
-    // ------------------------------------------------------------------
-    // 5. Signing config summary warning (if detected and not already specific)
-    // ------------------------------------------------------------------
-    if (signingDetected) {
-        warnings.push({
-            category: "signing-config",
-            severity: "info",
-            message: `signingConfigs block found in ${signingDetectedIn}`,
-            hint: "Ensure keystore file and all signing credentials are available in the CI environment",
-        });
-    }
-    // ------------------------------------------------------------------
-    // 6. Gitignore cross-check
-    // ------------------------------------------------------------------
-    for (const item of gitignoreItems) {
-        // Only warn if we haven't already emitted a more specific warning for it
-        const alreadyCovered = (item === "google-services.json" && gmsDetected) ||
-            (item === "local.properties" && !existsSync(resolve(projectRoot, "local.properties")));
-        if (!alreadyCovered) {
-            warnings.push({
-                category: "missing-file",
-                severity: "info",
-                message: `${item} is in .gitignore — likely absent in CI`,
-                hint: "Provide this file as a secret or generate it at build time",
-            });
-        }
-    }
-    return {
-        warnings,
-        detectedJavaVersion,
-        detectedJavaVersionSource,
-        detectedGradleVersion,
-        buildVariants,
-        missingPropertyKeys,
-    };
-}
-// ---------------------------------------------------------------------------
-// Formatter
-// ---------------------------------------------------------------------------
-const CATEGORY_LABELS = {
-    "missing-file": "Missing files",
-    "env-var": "Environment variables referenced in Gradle files",
-    "gradle-property": "Gradle properties referenced",
-    "signing-config": "Signing configuration",
-    "build-config": "BuildConfig env vars",
-    "firebase": "Firebase / GMS",
-    "secrets-plugin": "Google Secrets Gradle Plugin (local.properties keys)",
-};
-export function formatScanResult(result) {
-    const lines = [];
-    const sep = "─".repeat(50);
-    // Always show the detected Java version, and the one the pipeline will
-    // actually name — they differ whenever the declaration is below the oldest
-    // installed JDK or above the newest, and saying only the first made the
-    // second look like it had been honoured.
-    //
-    // And when they differ, say why in the same breath. An answer that is not
-    // what was asked for, printed with no reason, reads as a fact about the
-    // project rather than as a decision made on its behalf.
-    if (result.detectedJavaVersion !== undefined) {
-        const willUse = runnableJavaVersion(result.detectedJavaVersion, result.detectedGradleVersion);
-        lines.push(willUse === undefined
-            ? `ℹ  Detected Java ${result.detectedJavaVersion} requirement — no installed JDK can satisfy it`
-            : `ℹ  Detected Java ${result.detectedJavaVersion} requirement — pipeline will use Java ${willUse}`);
-        const problem = javaVersionProblem(result.detectedJavaVersion, result.detectedGradleVersion, result.detectedJavaVersionSource);
-        if (problem)
-            lines.push(`   ${problem}`);
-        lines.push("");
-    }
-    if (result.warnings.length === 0) {
-        lines.push("✅ No potential unknowns detected.");
-        return lines.join("\n") + "\n";
-    }
-    lines.push(`⚠  Android Project Scan — Potential Unknowns`);
-    lines.push(sep);
-    lines.push("");
-    // Group by category
-    const byCategory = new Map();
-    for (const w of result.warnings) {
-        if (!byCategory.has(w.category))
-            byCategory.set(w.category, []);
-        byCategory.get(w.category).push(w);
-    }
-    for (const [cat, items] of byCategory) {
-        lines.push(`${CATEGORY_LABELS[cat]}:`);
-        for (const w of items) {
-            const icon = w.severity === "warning" ? "⚠ " : "ℹ ";
-            const loc = w.location ? `  (${w.location})` : "";
-            lines.push(`  ${icon} ${w.message}${loc}`);
-            if (w.hint) {
-                lines.push(`     Hint: ${w.hint}`);
-            }
-        }
-        lines.push("");
-    }
-    lines.push(sep);
-    const warnCount = result.warnings.filter((w) => w.severity === "warning").length;
-    const infoCount = result.warnings.filter((w) => w.severity === "info").length;
-    const parts = [];
-    if (warnCount > 0)
-        parts.push(`${warnCount} warning(s)`);
-    if (infoCount > 0)
-        parts.push(`${infoCount} info`);
-    lines.push(`${parts.join(", ")} found. Review before running on CI.`);
-    return lines.join("\n");
-}
-//# sourceMappingURL=android-scanner.js.map