fix(cli): resolve prebuilt Java provider versions via repo1.maven.org (#285)

### Description

The Java integration tests (`provider-add`, `provider-list`,
`provider-upgrade`) have been intermittently failing, resolving a
prebuilt provider package version one or two below the expected maximum
(e.g. `0.2.55` → `0.2.53`/`0.2.54`).

#### Example Failed jobs

-
https://github.com/open-constructs/cdk-terrain/actions/runs/28284215519/job/83805855926?pr=284
-
https://github.com/open-constructs/cdk-terrain/actions/runs/28284215519/job/83805856150?pr=284

#### Cause

When adding a prebuilt Java provider, the resolver walks the npm
candidate versions highest-to-lowest and installs the first that exists
on Maven Central, using `JavaPackageManager.isNpmVersionAvailable` to
decide existence. That check queries the `search.maven.org/solrsearch`
index — a separate service from the artifact repository, and a flaky
one: under load it returns `HTTP 502` and can take ~90s to respond. A
failed search response reads as "version not found", so the resolver
drops to an older package.

#### Fix

This PR points the existence check at the artifact repository directly:

- **Probe `repo1.maven.org`**
([`package-manager.ts`](packages/@cdktn/cli-core/src/lib/dependencies/package-manager.ts)):
`JavaPackageManager.isNpmVersionAvailable` requests the artifact's
`.pom` directly
(`https://repo1.maven.org/maven2/<group>/<artifact>/<version>/<artifact>-<version>.pom`)
with a plain `fetch`, matching the shape of the other package managers'
probes — `200` means present, anything else means not available.
`repo1.maven.org` is the Fastly-fronted artifact CDN every Maven build
already relies on, so it is both the source of truth for "is this
artifact published" and reliably fast (~0.05s).

**Why a direct file check rather than the `central.sonatype.com` search
API:** the artifact CDN is the most reliable signal and the fastest,
with the fewest moving parts. The Sonatype Central search API is the
documented successor to `search.maven.org`, but it is still a search
index in front of the same artifacts; querying the artifact directly
depends only on the artifact itself.

### Checklist

- [x] I have updated the PR title to match [CDKTN's style
guide](https://github.com/open-constructs/cdk-terrain/blob/main/CONTRIBUTING.md#pull-requests-1)
- [x] I have run the linter on my code locally
- [x] I have performed a self-review of my code
- [x] I have commented my code, particularly in hard-to-understand areas
- [ ] I have made corresponding changes to the
[documentation](https://github.com/open-constructs/cdk-terrain-docs/tree/main/content)
if applicable
- [x] My changes generate no new warnings
- [x] I have added tests that prove my fix is effective or that my
feature works if applicable
- [x] New and existing unit tests pass locally with my changes

---------

Co-authored-by: Simon Heather <simon.heather@yulife.com>

Author: X-Guardian

packages/@cdktn/cli-core/src/lib/dependencies/package-manager.ts

@@ -521,7 +521,21 @@ class NugetPackageManager extends PackageManager {
   }
 }
 
+/**
+ * Shared base for the Java package managers (Maven and Gradle). Both install from Maven Central, so the check for
+ * whether a given provider version exists is common to both and lives here; the concrete subclasses differ only in how
+ * they declare and list dependencies (pom.xml vs build.gradle).
+ */
 abstract class JavaPackageManager extends PackageManager {
+  /**
+   * Reports whether `packageName@packageVersion` is published on Maven Central by probing the artifact repository for
+   * the version's `.pom` directly: HTTP 200 means present, anything else means not available.
+   *
+   * @param packageName - The Java coordinates in "group.artifact" form, e.g. "com.hashicorp.cdktf-provider-random".
+   * @param packageVersion - The exact version to check for.
+   * @returns `true` if the `.pom` exists on Maven Central, `false` otherwise.
+   * @throws If `packageName` is not in the expected "group.artifact" format.
+   */
   public async isNpmVersionAvailable(
     packageName: string,
     packageVersion: string,
@@ -535,23 +549,21 @@ abstract class JavaPackageManager extends PackageManager {
       );
     }
 
-    const packageIdentifier = parts.pop();
+    const artifactId = parts.pop();
     const groupId = parts.join(".");
 
-    const url = `https://search.maven.org/solrsearch/select?q=g:${groupId}+AND+a:${packageIdentifier}+AND+v:${packageVersion}&rows=5&wt=json`;
+    // Probe the artifact CDN directly for the .pom: 200 = present, anything else = not available.
+    const groupPath = groupId.replace(/\./g, "/");
+    const url = `https://repo1.maven.org/maven2/${groupPath}/${artifactId}/${packageVersion}/${artifactId}-${packageVersion}.pom`;
     logger.debug(
-      `Trying to find package version by querying Maven Central under '${url}'`,
+      `Checking whether ${packageName}@${packageVersion} exists on Maven Central under '${url}'`,
     );
     const response = await fetch(url);
-
-    const json = (await response.json()) as any;
     logger.debug(
-      `Got response from the Maven package search for ${packageName}: ${JSON.stringify(
-        json,
-      )}`,
+      `Maven Central responded HTTP ${response.status} for ${packageName}@${packageVersion}`,
     );
 
-    return (json?.response?.numFound ?? 0) > 0;
+    return response.ok;
   }
 }
 

packages/@cdktn/cli-core/src/test/lib/dependencies/package-manager.test.ts

@@ -0,0 +1,75 @@
+// Copyright (c) HashiCorp, Inc
+// SPDX-License-Identifier: MPL-2.0
+import { mkdtempSync } from "fs";
+import { tmpdir } from "os";
+import { join } from "path";
+import nock from "nock";
+import { Language } from "@cdktn/commons";
+import { PackageManager } from "../../../lib/dependencies/package-manager";
+
+const MAVEN_HOST = "https://repo1.maven.org";
+
+describe("package-manager", () => {
+  beforeAll(() => {
+    nock.disableNetConnect();
+  });
+
+  afterAll(() => {
+    nock.cleanAll();
+    nock.enableNetConnect();
+  });
+
+  afterEach(() => {
+    expect(nock.pendingMocks()).toEqual([]);
+    nock.cleanAll();
+  });
+
+  describe("JavaPackageManager.isNpmVersionAvailable", () => {
+    let manager: PackageManager;
+
+    function pomPath(version: string) {
+      // Mirrors the CDN layout probed by JavaPackageManager.isNpmVersionAvailable:
+      // groupId path / artifactId / version / artifactId-version.pom
+      return `/maven2/com/hashicorp/cdktf-provider-random/${version}/cdktf-provider-random-${version}.pom`;
+    }
+
+    beforeEach(() => {
+      // A bare temp dir (no build.gradle) resolves to the Maven manager.
+      const dir = mkdtempSync(join(tmpdir(), "cdktn-pm-test-"));
+      manager = PackageManager.forLanguage(Language.JAVA, dir);
+    });
+
+    it("returns true when the .pom exists on Maven Central (HTTP 200)", async () => {
+      nock(MAVEN_HOST).get(pomPath("0.2.64")).reply(200);
+
+      await expect(
+        manager.isNpmVersionAvailable(
+          "com.hashicorp.cdktf-provider-random",
+          "0.2.64",
+        ),
+      ).resolves.toBe(true);
+    });
+
+    it("returns false when the .pom is absent on Maven Central (HTTP 404)", async () => {
+      nock(MAVEN_HOST).get(pomPath("0.2.64")).reply(404);
+
+      await expect(
+        manager.isNpmVersionAvailable(
+          "com.hashicorp.cdktf-provider-random",
+          "0.2.64",
+        ),
+      ).resolves.toBe(false);
+    });
+
+    it("returns false on a non-200 response from Maven Central", async () => {
+      nock(MAVEN_HOST).get(pomPath("0.2.64")).reply(503);
+
+      await expect(
+        manager.isNpmVersionAvailable(
+          "com.hashicorp.cdktf-provider-random",
+          "0.2.64",
+        ),
+      ).resolves.toBe(false);
+    });
+  });
+});