jvm-upgrade 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Theofilos Chamalis
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,181 @@
+# jvm-upgrade
+
+[![npm](https://img.shields.io/npm/v/jvm-upgrade.svg)](https://www.npmjs.com/package/jvm-upgrade)
+[![CI](https://github.com/Theofilos-Chamalis/jvm-upgrade/actions/workflows/ci.yml/badge.svg)](https://github.com/Theofilos-Chamalis/jvm-upgrade/actions/workflows/ci.yml)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+
+Find outdated libraries in **Java, Kotlin and Android** projects, read their changelogs, and upgrade them. Works with **Gradle** (Kotlin DSL, Groovy DSL, version catalogs) and **Maven**. Like `npm-upgrade`, but for the JVM.
+
+```sh
+npx jvm-upgrade
+```
+
+```
+Name                                   Current  Patch   Minor   Major
+androidx.core:core-ktx                 1.10.0   1.10.1  1.17.0
+com.android.application                8.5.0    8.5.2   8.13.0
+com.squareup.okhttp3:okhttp            4.9.0    4.9.3   4.12.0  5.1.0
+org.jetbrains.kotlin:kotlin-stdlib     1.9.0    1.9.25          2.2.20
+
+Run jvm-upgrade -u to apply the underlined versions (target: major), or jvm-upgrade -i to pick.
+```
+
+## Why
+
+- **Fast.** It reads Maven repositories directly and in parallel. It does not start Gradle or Maven.
+- **Safe.** It changes only the version text. Your comments and formatting stay. Files are written atomically, and nothing is written if any file changed under it.
+- **Changelogs.** See the release notes of every version between your version and the new one, right in the terminal.
+- **Every source.** Maven Central, Google Maven, Gradle Plugin Portal, JitPack, `mavenLocal()`, and any custom or private repository your build declares.
+- **Supply chain aware.** A cooldown window skips versions that are too new to trust.
+- **No trash.** No build output, no temp files left behind. The metadata cache lives in your OS cache folder and expires by itself.
+
+## Install
+
+```sh
+npm install -g jvm-upgrade
+```
+
+Or run it once with `npx jvm-upgrade`. Needs Node.js 20.12 or newer.
+
+## Usage
+
+```sh
+jvm-upgrade                 # list available upgrades (nothing is changed)
+jvm-upgrade -u              # apply the latest major versions
+jvm-upgrade -u -t minor     # apply the latest minor versions only
+jvm-upgrade -i              # pick versions and read changelogs interactively
+jvm-upgrade -l              # print the changelogs of the selected upgrades
+jvm-upgrade -c 7            # ignore versions published in the last 7 days
+jvm-upgrade path/to/project
+```
+
+### Interactive mode
+
+`jvm-upgrade -i` opens a picker:
+
+| Key | Action |
+|---|---|
+| `↑` `↓` | Move |
+| `←` `→` | Choose patch, minor, major or skip |
+| `space` | Select or unselect |
+| `a` | Select or unselect all |
+| `c` | Show the changelog for the chosen version |
+| `enter` | Apply |
+| `q` | Quit without changes |
+
+## Options
+
+| Option | Default | Description |
+|---|---|---|
+| `[directory]` | `.` | Project root to scan |
+| `-u, --upgrade` | | Write the upgrades to the build files |
+| `-i, --interactive` | | Pick upgrades in a terminal UI |
+| `-l, --changelog` | | Print the changelog of each selected upgrade |
+| `-t, --target <level>` | `major` | Highest jump allowed: `major`, `minor` or `patch` |
+| `-c, --cooldown <days>` | `0` | Skip versions published less than N days ago |
+| `--allow-downgrade` | | With `--cooldown`, roll back versions that are too new |
+| `--pre` | | Allow prereleases (alpha, beta, rc, ...) |
+| `--include <pattern>` | | Only check matching deps. Repeatable or comma separated |
+| `--exclude <pattern>` | | Skip matching deps |
+| `--repo <url>` | | Extra Maven repository to query. Repeatable |
+| `--format <format>` | `text` | `text` or `json` (JSON goes to stdout, the rest to stderr) |
+| `--error-on-outdated` | | Exit with code 1 when upgrades are available (for CI) |
+| `--verbose` | | Also list dependencies that are up to date |
+| `--no-progress` | | Hide progress bars |
+| `--concurrency <n>` | `8` | Parallel HTTP requests |
+| `--no-cache` | | Do not use the metadata cache |
+| `--clear-cache` | | Delete the metadata cache first |
+
+Patterns match `group` (`com.google.*`) or `group:artifact` (`org.jetbrains:*`, `junit:junit`). For plugins, the group is the plugin id.
+
+### Exit codes
+
+| Code | Meaning |
+|---|---|
+| `0` | Success |
+| `1` | Upgrades available (only with `--error-on-outdated`) |
+| `2` | Bad flag or config |
+| `3` | A build file could not be read |
+| `4` | Network or repository error |
+| `5` | A file changed while upgrading, so nothing was written |
+
+## What it reads
+
+| File | What |
+|---|---|
+| `build.gradle`, `build.gradle.kts` | Dependencies, `plugins {}`, `buildscript` classpath, `ext` / `val` / `extra` variables, repositories |
+| `settings.gradle(.kts)` | `pluginManagement`, `dependencyResolutionManagement`, extra version catalogs |
+| `gradle/libs.versions.toml` | `[versions]`, `[libraries]`, `[plugins]` |
+| `gradle.properties` | Version properties |
+| `gradle/wrapper/gradle-wrapper.properties` | The Gradle version itself |
+| `pom.xml` | Dependencies, dependency management, plugins, extensions, parent, `<properties>`, repositories |
+
+When a version comes from a variable (a catalog `version.ref`, a property, `ext`), the upgrade lands where the variable is defined. All libraries that share it are upgraded together, to a version that exists for all of them.
+
+Dynamic versions (`1.+`, `[1.0,2.0)`, `latest.release`) are shown but never rewritten.
+
+## Version rules
+
+1. Never go down (unless `--allow-downgrade`).
+2. Stable stays stable. If you use a prerelease, newer prereleases are allowed too. `--pre` allows all prereleases.
+3. Cooldown drops versions that are too new.
+4. `--target` sets the highest jump.
+5. The highest remaining version wins, using Gradle's version ordering.
+
+## Changelogs
+
+For each upgrade, jvm-upgrade looks for the source repository in the POM (`<scm>`, `<url>`, parent POMs), or uses the GitHub repo directly for JitPack. It then reads the GitHub releases between your version and the new one. If there are none, it reads `CHANGELOG.md` (and similar files) and cuts out the right sections. If it finds nothing, it gives you the link.
+
+Set `GITHUB_TOKEN` (or `GH_TOKEN`) to avoid GitHub rate limits.
+
+## Configuration
+
+### Project: `.jvm-upgrade.json`
+
+Put it in the project root, or in a module folder to override settings for that module. The closest file wins, and it inherits the rest from the parent folders.
+
+```json
+{
+  "target": "minor",
+  "cooldown": 7,
+  "pre": false,
+  "allowDowngrade": false,
+  "include": [],
+  "exclude": ["com.example:legacy-*"],
+  "repositories": ["https://repo.example.com/maven/"]
+}
+```
+
+### User: `~/.jvm-upgrade/config.json`
+
+Your defaults for every project. It takes all project keys, plus `cacheDir`, `noCache` and `concurrency`.
+
+### Private repositories: `~/.jvm-upgrade/credentials.json`
+
+```json
+{
+  "repositories": [
+    { "url": "https://nexus.example.com/", "token": "$NEXUS_TOKEN" },
+    { "url": "https://artifactory.example.com/", "username": "$ART_USER", "password": "$ART_PASS" }
+  ]
+}
+```
+
+Values that start with `$` come from environment variables. The longest matching URL prefix wins. Credentials are only sent to that host, and authenticated responses are never written to the disk cache.
+
+Set `JVM_UPGRADE_HOME` to use a different folder than `~/.jvm-upgrade`.
+
+## CI
+
+```sh
+npx jvm-upgrade --error-on-outdated --cooldown 7
+npx jvm-upgrade --format json > upgrades.json
+```
+
+## Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md). Issues with a small build file snippet are the best way to get a new notation supported.
+
+## License
+
+[MIT](LICENSE)

package/dist/apply.js

@@ -0,0 +1,55 @@
+import { randomBytes } from 'node:crypto';
+import { readFile, rename, rm, stat, writeFile } from 'node:fs/promises';
+export class EditConflictError extends Error {
+}
+/** Rewrites only the version literals. Every file is checked first, then written atomically. */
+export async function applyEdits(edits) {
+    const byFile = new Map();
+    for (const edit of edits) {
+        const list = byFile.get(edit.location.file) ?? [];
+        list.push(edit);
+        byFile.set(edit.location.file, list);
+    }
+    const outputs = [];
+    for (const [file, list] of byFile) {
+        outputs.push({ file, content: rewrite(file, await readFile(file, 'utf8'), list) });
+    }
+    for (const out of outputs)
+        await writeAtomic(out.file, out.content);
+}
+function rewrite(file, content, edits) {
+    const unique = new Map();
+    for (const edit of edits) {
+        const prev = unique.get(edit.location.start);
+        if (prev && prev.to !== edit.to) {
+            throw new EditConflictError(`${file}: two different upgrades target the same version (${prev.to} and ${edit.to})`);
+        }
+        unique.set(edit.location.start, edit);
+    }
+    const sorted = [...unique.values()].sort((a, b) => b.location.start - a.location.start);
+    let out = content;
+    let lastStart = Infinity;
+    for (const { location, from, to } of sorted) {
+        if (location.end > lastStart)
+            throw new EditConflictError(`${file}: overlapping edits`);
+        const current = out.slice(location.start, location.end);
+        if (current !== from) {
+            throw new EditConflictError(`${file}: expected "${from}" at offset ${location.start} but found "${current}". Was the file changed?`);
+        }
+        out = out.slice(0, location.start) + to + out.slice(location.end);
+        lastStart = location.start;
+    }
+    return out;
+}
+async function writeAtomic(file, content) {
+    const tmp = `${file}.${randomBytes(4).toString('hex')}.tmp`;
+    const { mode } = await stat(file);
+    try {
+        await writeFile(tmp, content, { mode });
+        await rename(tmp, file);
+    }
+    catch (e) {
+        await rm(tmp, { force: true });
+        throw e;
+    }
+}

package/dist/changelog.js

@@ -0,0 +1,207 @@
+import { fetchPom } from './repos.js';
+const CHANGELOG_FILES = ['CHANGELOG.md', 'CHANGES.md', 'HISTORY.md', 'RELEASE_NOTES.md', 'docs/CHANGELOG.md'];
+const MAX_RELEASE_PAGES = 5;
+const MAX_PARENT_DEPTH = 3;
+const POM_NOISE = /<(parent|scm|licenses|developers|contributors|organization|distributionManagement|issueManagement|ciManagement|mailingLists|repositories|pluginRepositories|build|reporting|profiles|dependencies|dependencyManagement)\b[\s\S]*?<\/\1>/g;
+export function normalizeScmUrl(raw) {
+    let s = raw.trim();
+    if (!s || s.includes('${'))
+        return undefined;
+    s = s.replace(/^scm:(git:|svn:|hg:)?/i, '');
+    s = s.replace(/^git@([^:]+):/i, 'https://$1/');
+    s = s.replace(/^(ssh|git|http):\/\/(git@)?/i, 'https://');
+    if (!/^https:\/\//i.test(s))
+        return undefined;
+    let url;
+    try {
+        url = new URL(s);
+    }
+    catch {
+        return undefined;
+    }
+    if (url.hostname.toLowerCase() === 'github.com' || url.hostname.toLowerCase() === 'www.github.com') {
+        const [owner, repo] = url.pathname.split('/').filter(Boolean);
+        if (!owner || !repo)
+            return undefined;
+        const clean = repo.replace(/\.git$/i, '');
+        return { github: { owner, repo: clean }, url: `https://github.com/${owner}/${clean}` };
+    }
+    return { url: s.replace(/\.git$/i, '').replace(/\/$/, '') };
+}
+function tagValue(xml, tag) {
+    return new RegExp(`<${tag}>\\s*([^<]*?)\\s*</${tag}>`).exec(xml)?.[1];
+}
+export function pomCandidates(pom) {
+    const scm = /<scm>([\s\S]*?)<\/scm>/.exec(pom)?.[1] ?? '';
+    const scmValues = ['url', 'connection', 'developerConnection'].map((t) => tagValue(scm, t));
+    return [...scmValues, tagValue(pom.replace(POM_NOISE, ''), 'url')].filter((v) => !!v);
+}
+export function pomParent(pom) {
+    const block = /<parent>([\s\S]*?)<\/parent>/.exec(pom)?.[1];
+    if (!block)
+        return undefined;
+    const group = tagValue(block, 'groupId');
+    const artifact = tagValue(block, 'artifactId');
+    const version = tagValue(block, 'version');
+    return group && artifact && version ? { group, artifact, version } : undefined;
+}
+function pickSource(candidates) {
+    const normalized = candidates.map(normalizeScmUrl).filter((s) => !!s);
+    return normalized.find((s) => s.github) ?? normalized[0];
+}
+export function androidxReleasesUrl(group) {
+    const [root, first, second] = group.split('.');
+    if (root !== 'androidx' || !first)
+        return undefined;
+    const name = first === 'compose' && second ? `compose-${second}` : first;
+    return `https://developer.android.com/jetpack/androidx/releases/${name}`;
+}
+export async function findSourceRepo(http, dep, version, repo) {
+    if (dep.kind === 'gradle')
+        return { url: `https://docs.gradle.org/${version}/release-notes.html` };
+    const [root, , owner] = dep.group.split('.');
+    if (dep.group.startsWith('com.github.') && owner) {
+        return { github: { owner, repo: dep.artifact }, url: `https://github.com/${owner}/${dep.artifact}` };
+    }
+    if (dep.group === 'org.jetbrains.kotlin' || dep.group.startsWith('org.jetbrains.kotlin.')) {
+        return { github: { owner: 'JetBrains', repo: 'kotlin' }, url: 'https://github.com/JetBrains/kotlin' };
+    }
+    const androidx = root === 'androidx' ? androidxReleasesUrl(dep.group) : undefined;
+    if (androidx)
+        return { url: androidx };
+    if (!repo)
+        return {};
+    let coords = {
+        group: dep.group,
+        artifact: dep.artifact,
+        version,
+    };
+    for (let depth = 0; coords && depth <= MAX_PARENT_DEPTH; depth++) {
+        const pom = await fetchPom(http, coords.group, coords.artifact, coords.version, repo);
+        if (!pom)
+            break;
+        const found = pickSource(pomCandidates(pom));
+        if (found)
+            return found;
+        coords = depth === 0 && dep.artifact.endsWith('.gradle.plugin') ? (pomFirstDependency(pom) ?? pomParent(pom)) : pomParent(pom);
+    }
+    return {};
+}
+/** Gradle plugin marker POMs only declare the real plugin artifact as their single dependency. */
+export function pomFirstDependency(pom) {
+    const block = /<dependency>([\s\S]*?)<\/dependency>/.exec(pom)?.[1];
+    const tag = (name) => block && new RegExp(`<${name}>\\s*([^<\\s]+)\\s*</${name}>`).exec(block)?.[1];
+    const group = tag('groupId');
+    const artifact = tag('artifactId');
+    const version = tag('version');
+    return group && artifact && version ? { group, artifact, version } : undefined;
+}
+export function normalizeTag(tag, artifact) {
+    let v = tag.trim();
+    const lower = () => v.toLowerCase();
+    const art = artifact.toLowerCase();
+    const slash = v.lastIndexOf('/');
+    if (slash !== -1) {
+        const scope = lower().slice(0, slash).split('/').pop();
+        if (!art.split(/[-_.]/).includes(scope) && scope !== art)
+            return v;
+        v = v.slice(slash + 1);
+    }
+    for (const prefix of [`${art}@`, `${art}-`, 'release-', 'v']) {
+        if (lower().startsWith(prefix))
+            v = v.slice(prefix.length);
+    }
+    return v;
+}
+const isVersionLike = (v) => /^\d+(\.\d+)*([-.+_][0-9A-Za-z.+_-]*)?$/.test(v);
+function inRange(v, from, to, compare) {
+    return compare(v, from) > 0 && compare(v, to) <= 0;
+}
+const sortDesc = (entries, compare) => entries.sort((a, b) => compare(b.version, a.version));
+async function releaseEntries(http, gh, artifact, from, to, compare) {
+    const entries = [];
+    for (let page = 1; page <= MAX_RELEASE_PAGES; page++) {
+        const res = await http
+            .get(`https://api.github.com/repos/${gh.owner}/${gh.repo}/releases?per_page=100&page=${page}`)
+            .catch(() => undefined);
+        if (res && (res.status === 403 || res.status === 429))
+            return { entries, rateLimited: true };
+        if (res?.status !== 200)
+            break;
+        const releases = JSON.parse(res.body);
+        const versions = [];
+        for (const r of releases) {
+            const version = normalizeTag(r.tag_name, artifact);
+            if (r.draft || !isVersionLike(version))
+                continue;
+            versions.push(version);
+            if (!inRange(version, from, to, compare))
+                continue;
+            entries.push({
+                version,
+                title: r.name || undefined,
+                body: r.body ?? '',
+                url: r.html_url,
+                date: r.published_at ?? undefined,
+            });
+        }
+        if (releases.length < 100 || versions.every((v) => compare(v, from) < 0))
+            break;
+    }
+    return { entries, rateLimited: false };
+}
+const HEADING = /^(#{1,3})\s+(.*?)\s*#*\s*$/;
+const VERSION_TOKEN = /(?:^|[^\w.])v?(\d+\.\d+(?:\.\d+)*(?:-[0-9A-Za-z][0-9A-Za-z.]*)?)(?![\w.])/;
+export function splitChangelog(markdown) {
+    const sections = [];
+    let current;
+    for (const line of markdown.split(/\r?\n/)) {
+        const heading = HEADING.exec(line);
+        if (heading) {
+            const level = heading[1].length;
+            const title = heading[2];
+            const version = VERSION_TOKEN.exec(title)?.[1];
+            if (version) {
+                current = { version, title, body: '', level, lines: [] };
+                sections.push(current);
+                continue;
+            }
+            if (current && level <= current.level)
+                current = undefined;
+        }
+        current?.lines.push(line);
+    }
+    return sections.map(({ version, title, lines }) => ({ version, title, body: lines.join('\n').trim() }));
+}
+async function changelogFileEntries(http, gh, from, to, compare) {
+    for (const file of CHANGELOG_FILES) {
+        const res = await http
+            .get(`https://raw.githubusercontent.com/${gh.owner}/${gh.repo}/HEAD/${file}`)
+            .catch(() => undefined);
+        if (res?.status !== 200)
+            continue;
+        const entries = splitChangelog(res.body).filter((e) => inRange(e.version, from, to, compare));
+        if (entries.length) {
+            const source = `https://github.com/${gh.owner}/${gh.repo}/blob/HEAD/${file}`;
+            return { entries: sortDesc(dedupe(entries), compare), source };
+        }
+    }
+    return undefined;
+}
+function dedupe(entries) {
+    const seen = new Set();
+    return entries.filter((e) => !seen.has(e.version) && !!seen.add(e.version));
+}
+export async function getChangelog(http, dep, from, to, repo, compare) {
+    const src = await findSourceRepo(http, dep, to, repo);
+    const gh = src.github;
+    if (!gh)
+        return { entries: [], source: src.url };
+    const releasesUrl = `https://github.com/${gh.owner}/${gh.repo}/releases`;
+    const releases = await releaseEntries(http, gh, dep.artifact, from, to, compare);
+    if (releases.entries.length)
+        return { entries: sortDesc(releases.entries, compare), source: releasesUrl };
+    if (releases.rateLimited)
+        return { entries: [], source: releasesUrl };
+    return (await changelogFileEntries(http, gh, from, to, compare)) ?? { entries: [], source: releasesUrl };
+}

package/dist/cli.js

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+import { EXIT, fail, main } from './main.js';
+main().then((code) => process.stdout.write('', () => process.exit(code)), (e) => fail(EXIT.network, e.message));

package/dist/config.js

@@ -0,0 +1,150 @@
+import { readFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { dirname, join, relative, resolve, sep } from 'node:path';
+import { TARGETS } from './types.js';
+export const PROJECT_CONFIG = '.jvm-upgrade.json';
+export const DEFAULTS = {
+    target: 'major',
+    pre: false,
+    cooldown: 0,
+    allowDowngrade: false,
+    include: [],
+    exclude: [],
+    repositories: [],
+    noCache: false,
+    concurrency: 8,
+};
+export class ConfigError extends Error {
+}
+export function userDir() {
+    return process.env.JVM_UPGRADE_HOME ?? join(homedir(), '.jvm-upgrade');
+}
+const PROJECT_KEYS = {
+    target: (v) => TARGETS.includes(v),
+    pre: (v) => typeof v === 'boolean',
+    cooldown: (v) => Number.isInteger(v) && v >= 0,
+    allowDowngrade: (v) => typeof v === 'boolean',
+    include: isStringArray,
+    exclude: isStringArray,
+    repositories: isStringArray,
+};
+const USER_KEYS = {
+    ...PROJECT_KEYS,
+    cacheDir: (v) => typeof v === 'string',
+    noCache: (v) => typeof v === 'boolean',
+    concurrency: (v) => Number.isInteger(v) && v > 0,
+};
+function isStringArray(v) {
+    return Array.isArray(v) && v.every((x) => typeof x === 'string');
+}
+async function readJson(file) {
+    let text;
+    try {
+        text = await readFile(file, 'utf8');
+    }
+    catch (e) {
+        if (e.code === 'ENOENT')
+            return undefined;
+        throw e;
+    }
+    try {
+        const data = JSON.parse(text);
+        if (data === null || typeof data !== 'object' || Array.isArray(data))
+            throw new Error('expected an object');
+        return data;
+    }
+    catch (e) {
+        throw new ConfigError(`${file}: invalid JSON (${e.message})`);
+    }
+}
+function validate(file, data, keys) {
+    for (const [key, value] of Object.entries(data)) {
+        const check = keys[key];
+        if (!check)
+            throw new ConfigError(`${file}: unknown option "${key}"`);
+        if (!check(value))
+            throw new ConfigError(`${file}: invalid value for "${key}"`);
+    }
+    return data;
+}
+export async function loadUserConfig() {
+    const file = join(userDir(), 'config.json');
+    const data = await readJson(file);
+    return { ...DEFAULTS, ...(data && validate(file, data, USER_KEYS)) };
+}
+/** Returns a resolver giving the merged project options for a build file ("closest config wins"). */
+export function projectConfigResolver(root, base) {
+    const cache = new Map();
+    const absRoot = resolve(root);
+    const forDir = (dir) => {
+        let hit = cache.get(dir);
+        if (!hit) {
+            hit = (async () => {
+                const parent = dir === absRoot || !isInside(absRoot, dir) ? base : await forDir(dirname(dir));
+                const file = join(dir, PROJECT_CONFIG);
+                const data = await readJson(file);
+                return data ? { ...parent, ...validate(file, data, PROJECT_KEYS) } : parent;
+            })();
+            cache.set(dir, hit);
+        }
+        return hit;
+    };
+    return (file) => {
+        const dir = dirname(resolve(file));
+        return forDir(dir.endsWith(`${sep}gradle`) && dirname(dir) === absRoot ? absRoot : dir);
+    };
+}
+function isInside(root, dir) {
+    const rel = relative(root, dir);
+    return rel !== '' && !rel.startsWith('..') && !rel.startsWith(sep);
+}
+export async function loadCredentials() {
+    const file = join(userDir(), 'credentials.json');
+    const data = await readJson(file);
+    if (!data)
+        return [];
+    const repos = data.repositories;
+    if (!Array.isArray(repos))
+        throw new ConfigError(`${file}: "repositories" must be an array`);
+    return repos.map((entry, i) => {
+        const at = `${file}: repositories[${i}]`;
+        if (typeof entry?.url !== 'string')
+            throw new ConfigError(`${at}: "url" is required`);
+        const hasToken = entry.token !== undefined;
+        const hasBasic = entry.username !== undefined || entry.password !== undefined;
+        if (hasToken === hasBasic)
+            throw new ConfigError(`${at}: use either "token" or "username" + "password"`);
+        const cred = { url: entry.url };
+        for (const key of ['token', 'username', 'password']) {
+            if (entry[key] === undefined)
+                continue;
+            if (typeof entry[key] !== 'string')
+                throw new ConfigError(`${at}: "${key}" must be a string`);
+            cred[key] = expandEnv(entry[key], at);
+        }
+        if (hasBasic && (cred.username === undefined || cred.password === undefined)) {
+            throw new ConfigError(`${at}: "username" and "password" are both required`);
+        }
+        return cred;
+    });
+}
+function expandEnv(value, at) {
+    if (!value.startsWith('$'))
+        return value;
+    const name = value.slice(1);
+    const env = process.env[name];
+    if (env === undefined)
+        throw new ConfigError(`${at}: environment variable ${name} is not set`);
+    return env;
+}
+function globToRegExp(glob) {
+    const body = glob.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*').replace(/\?/g, '.');
+    return new RegExp(`^${body}$`, 'i');
+}
+/** Patterns without ":" match the group only; "group:artifact" patterns match both. */
+export function matchesAny(patterns, group, artifact) {
+    return patterns.some((p) => globToRegExp(p).test(p.includes(':') ? `${group}:${artifact}` : group));
+}
+export function splitPatterns(values) {
+    return values.flatMap((v) => v.split(',')).map((v) => v.trim()).filter(Boolean);
+}