Offer a hybrid ML-KEM key exchange group first in properties files

Proprietary

Prepends an ML-KEM hybrid key-exchange group to a jdk.tls.namedGroups value in a .properties file, under either the bare key or Gradle's systemProp. prefix. The group goes first because first means most preferred. An entry that already names any ML-KEM group is left alone silently and produces no row: the JSSE API throws on a duplicate group, so re-running this recipe has to be a no-op. A repository with no such entry is deliberately not given one — on JDK 27 the absence of a pin is the good state.

io.moderne.cryptography.pqc.AddHybridTlsNamedGroupToProperties

Optional

The hybrid named group to offer first. Kept as a single option on purpose: draft-ietf-tls-ecdhe-mlkem is still an IETF draft, so a rename at RFC promotion is a one-line default change rather than a sweep through the recipes. Default X25519MLKEM768, which is what JEP 527 puts first in the JDK 27 provider default.

rewrite (the default) prepends the hybrid group. report leaves every entry untouched and only marks it and records a row — for estates whose group pins are deliberate, typically because a middlebox chokes on the larger ML-KEM key share or because ClientHello size is constrained.

mod run . --recipe=io.moderne.cryptography.pqc.AddHybridTlsNamedGroupToProperties

Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.