<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>io.decentralchain</groupId>
    <artifactId>java-sdk</artifactId>
    <version>2.0.2</version>
    <packaging>jar</packaging>

    <properties>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <!-- Reproducible builds: set to release date on each release, kept as
             baseline date for SNAPSHOT. `mvn artifact:check-buildplan` verifies. -->
        <project.build.outputTimestamp>2026-05-30T00:00:00Z</project.build.outputTimestamp>
        <jacoco.version>0.8.15</jacoco.version>
        <spotbugs.version>4.10.4.1</spotbugs.version>
        <checkstyle.version>3.6.0</checkstyle.version>
        <spotless.version>3.10.3</spotless.version>
        <!-- Coverage thresholds — unit-test-only baseline.
             Docker integration tests bring this to ~70%+.
             Override in CI: -Djacoco.line.ratio=0.70 -Djacoco.branch.ratio=0.60 -->
        <jacoco.line.ratio>0.20</jacoco.line.ratio>
        <jacoco.branch.ratio>0.07</jacoco.branch.ratio>
        <!-- Signing plugins: skip locally; CI overrides to false.
             GPG:      -Dgpg.skip=false (maven-gpg-plugin respects this natively)
             Sigstore: -Dsigstore.skip=false (keyless OIDC, requires GitHub Actions) -->
        <sigstore.skip>true</sigstore.skip>
    </properties>

    <name>DecentralChain Java SDK</name>
    <description>Java SDK for the DecentralChain blockchain</description>
    <url>https://github.com/Decentral-America/DecentralChain/tree/main/packages/jvm/java-sdk</url>

    <organization>
        <name>DecentralChain / Blockchain Costa Rica</name>
        <url>https://decentralchain.io</url>
    </organization>

    <licenses>
        <license>
            <name>MIT License</name>
            <url>https://opensource.org/licenses/MIT</url>
            <distribution>repo</distribution>
        </license>
    </licenses>

    <scm>
        <connection>scm:git:git://github.com/Decentral-America/DecentralChain.git</connection>
        <developerConnection>scm:git:ssh://git@github.com/Decentral-America/DecentralChain.git</developerConnection>
        <url>https://github.com/Decentral-America/DecentralChain/tree/main/packages/jvm/java-sdk</url>
    </scm>

    <developers>
        <developer>
            <id>josue</id>
            <name>Josué Rojas</name>
            <email>josue.rojas@decentralchain.io</email>
            <organization>DecentralChain</organization>
            <organizationUrl>https://decentralchain.io</organizationUrl>
            <roles>
                <role>Developer</role>
            </roles>
        </developer>
    </developers>

    <repositories>
        <repository>
            <id>central-portal-snapshots</id>
            <url>https://central.sonatype.com/repository/maven-snapshots/</url>
            <releases>
                <enabled>false</enabled>
            </releases>
            <snapshots>
                <enabled>true</enabled>
            </snapshots>
        </repository>
    </repositories>

    <distributionManagement>
        <snapshotRepository>
            <id>central</id>
            <url>https://central.sonatype.com/repository/maven-snapshots/</url>
        </snapshotRepository>
    </distributionManagement>

    <build>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-enforcer-plugin</artifactId>
                <version>3.6.3</version>
                <executions>
                    <execution>
                        <id>enforce-maven</id>
                        <goals>
                            <goal>enforce</goal>
                        </goals>
                        <configuration>
                            <rules>
                                <requireMavenVersion>
                                    <version>3.9.2</version>
                                </requireMavenVersion>
                                <requireJavaVersion>
                                    <version>25</version>
                                </requireJavaVersion>
                                <banDuplicatePomDependencyVersions/>
                            </rules>
                        </configuration>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <version>3.16.0</version>
                <configuration>
                    <release>25</release>
                    <showWarnings>true</showWarnings>
                    <showDeprecation>true</showDeprecation>
                    <compilerArgs>
                        <arg>-Xlint:all</arg>
                        <arg>-Xlint:-serial</arg>
                        <arg>-Xlint:-processing</arg>
                    </compilerArgs>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-source-plugin</artifactId>
                <version>3.4.0</version>
                <executions>
                    <execution>
                        <id>attach-sources</id>
                        <goals>
                            <goal>jar-no-fork</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-surefire-plugin</artifactId>
                <version>3.6.0</version>
                <configuration>
                    <argLine>${jacoco.agent.argLine}</argLine>
                </configuration>
            </plugin>
            <!-- Coverage -->
            <plugin>
                <groupId>org.jacoco</groupId>
                <artifactId>jacoco-maven-plugin</artifactId>
                <version>${jacoco.version}</version>
                <executions>
                    <execution>
                        <id>prepare-agent</id>
                        <goals><goal>prepare-agent</goal></goals>
                        <configuration>
                            <propertyName>jacoco.agent.argLine</propertyName>
                        </configuration>
                    </execution>
                    <execution>
                        <id>report</id>
                        <phase>verify</phase>
                        <goals><goal>report</goal></goals>
                    </execution>
                    <execution>
                        <id>check</id>
                        <phase>verify</phase>
                        <goals><goal>check</goal></goals>
                        <configuration>
                            <rules>
                                <rule>
                                    <element>BUNDLE</element>
                                    <limits>
                                        <limit>
                                            <counter>LINE</counter>
                                            <value>COVEREDRATIO</value>
                                            <minimum>${jacoco.line.ratio}</minimum>
                                        </limit>
                                        <limit>
                                            <counter>BRANCH</counter>
                                            <value>COVEREDRATIO</value>
                                            <minimum>${jacoco.branch.ratio}</minimum>
                                        </limit>
                                    </limits>
                                </rule>
                            </rules>
                        </configuration>
                    </execution>
                </executions>
            </plugin>
            <!-- Static analysis -->
            <plugin>
                <groupId>com.github.spotbugs</groupId>
                <artifactId>spotbugs-maven-plugin</artifactId>
                <version>${spotbugs.version}</version>
                <configuration>
                    <effort>Max</effort>
                    <threshold>High</threshold>
                    <failOnError>true</failOnError>
                    <!-- FindSecBugs: OWASP security detector plugin (1.14.0, Jun 2025) -->
                    <plugins>
                        <plugin>
                            <groupId>com.h3xstream.findsecbugs</groupId>
                            <artifactId>findsecbugs-plugin</artifactId>
                            <version>1.14.0</version>
                        </plugin>
                    </plugins>
                </configuration>
                <executions>
                    <execution>
                        <id>spotbugs-check</id>
                        <phase>verify</phase>
                        <goals><goal>check</goal></goals>
                    </execution>
                </executions>
            </plugin>
            <!-- Static analysis: PMD — report-only; enable failOnViolation in a
                 dedicated PR once upstream debt is baselined. -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-pmd-plugin</artifactId>
                <version>3.28.0</version>
                <configuration>
                    <targetJdk>25</targetJdk>
                    <failOnViolation>false</failOnViolation>
                    <printFailingErrors>true</printFailingErrors>
                </configuration>
                <executions>
                    <execution>
                        <id>pmd-check</id>
                        <phase>verify</phase>
                        <goals><goal>check</goal></goals>
                    </execution>
                </executions>
            </plugin>
            <!-- Code style: google-java-format (via Spotless) + Checkstyle enforced.
                 Remaining suppressions in checkstyle-suppressions.xml cover upstream
                 SDK debt (NeedBraces, MissingJavadoc) and two domain-specific
                 identifiers (dApp in InvokeAction, TI in Node). -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-checkstyle-plugin</artifactId>
                <version>${checkstyle.version}</version>
                <configuration>
                    <configLocation>google_checks.xml</configLocation>
                    <suppressionsLocation>${project.basedir}/checkstyle-suppressions.xml</suppressionsLocation>
                    <consoleOutput>false</consoleOutput>
                    <failOnViolation>true</failOnViolation>
                    <logViolationsToConsole>true</logViolationsToConsole>
                    <violationSeverity>warning</violationSeverity>
                    <excludes>**/module-info.java</excludes>
                </configuration>
                <executions>
                    <execution>
                        <id>checkstyle-report</id>
                        <phase>verify</phase>
                        <goals><goal>check</goal></goals>
                    </execution>
                </executions>
            </plugin>
            <!-- Code formatter: google-java-format enforced via Spotless.
                 Fix locally: ./mvnw spotless:apply
                 CI enforcement: spotless:check bound to verify phase. -->
            <plugin>
                <groupId>com.diffplug.spotless</groupId>
                <artifactId>spotless-maven-plugin</artifactId>
                <version>${spotless.version}</version>
                <configuration>
                    <java>
                        <googleJavaFormat>
                            <version>1.36.1</version>
                            <style>GOOGLE</style>
                        </googleJavaFormat>
                        <removeUnusedImports/>
                    </java>
                </configuration>
                <executions>
                    <execution>
                        <id>spotless-check</id>
                        <phase>verify</phase>
                        <goals><goal>check</goal></goals>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-javadoc-plugin</artifactId>
                <version>3.12.0</version>
                <configuration>
                    <source>25</source>
                </configuration>
                <executions>
                    <execution>
                        <id>attach-javadocs</id>
                        <goals>
                            <goal>jar</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>dev.sigstore</groupId>
                <artifactId>sigstore-maven-plugin</artifactId>
                <version>2.3.0</version>
                <configuration>
                    <skip>${sigstore.skip}</skip>
                </configuration>
                <executions>
                    <execution>
                        <id>sign</id>
                        <goals>
                            <goal>sign</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
            <!-- SBOM generation for supply-chain transparency -->
            <plugin>
                <groupId>org.cyclonedx</groupId>
                <artifactId>cyclonedx-maven-plugin</artifactId>
                <version>2.9.3</version>
                <executions>
                    <execution>
                        <id>make-bom</id>
                        <phase>package</phase>
                        <goals>
                            <goal>makeBom</goal>
                        </goals>
                    </execution>
                </executions>
                <configuration>
                    <!-- central-publishing-maven-plugin sets maven.deploy.skip=true,
                         which triggers CycloneDX's skipNotDeployed guard. Force-enable
                         BOM generation regardless of the deploy lifecycle state. -->
                    <skipNotDeployed>false</skipNotDeployed>
                    <skip>false</skip>
                    <projectType>library</projectType>
                    <schemaVersion>1.6</schemaVersion>
                    <includeBomSerialNumber>true</includeBomSerialNumber>
                    <includeCompileScope>true</includeCompileScope>
                    <includeTestScope>false</includeTestScope>
                    <includeRuntimeScope>true</includeRuntimeScope>
                    <includeSystemScope>false</includeSystemScope>
                    <includeProvidedScope>false</includeProvidedScope>
                    <outputName>bom</outputName>
                </configuration>
            </plugin>
        </plugins>
    </build>

    <dependencyManagement>
        <dependencies>
            <!-- kotlin-stdlib 2.4.21: transitive runtime dependency; pins past CVE-2026-53914
                 (fixed in Kotlin 2.4.20), which the release audit gate (CVSS >= 7) rejects at 2.3.0. -->
            <dependency>
                <groupId>org.jetbrains.kotlin</groupId>
                <artifactId>kotlin-stdlib</artifactId>
                <version>2.4.21</version>
            </dependency>

            <!-- Netty BOM: pins the whole netty-* family pulled in transitively via
                 org.web3j:crypto -> tuweni-bytes -> vertx-core (was 4.1.115.Final,
                 vulnerable to CVE-2026-42583 / HIGH). Bumped from 4.1.135.Final: that
                 version still carried CVE-2026-59901 (Bzip2Decoder infinite loop),
                 CVE-2026-55831/55833 (HTTP codec), CVE-2026-56745 (SpdyHttpDecoder
                 ByteBuf leak) — all fixed in 4.1.136.Final. Moved from the 4.1.x line to
                 4.2.18.Final to align with io.decentralchain:transactions (already on 4.2.x)
                 and node-scala. -->
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-bom</artifactId>
                <version>4.2.18.Final</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
            <!-- protobuf-java 4.36.2 — latest stable -->
            <dependency>
                <groupId>com.google.protobuf</groupId>
                <artifactId>protobuf-java</artifactId>
                <version>4.36.2</version>
            </dependency>
            <dependency>
                <groupId>commons-codec</groupId>
                <artifactId>commons-codec</artifactId>
                <version>1.22.1</version>
            </dependency>
            <dependency>
                <groupId>org.apache.commons</groupId>
                <artifactId>commons-compress</artifactId>
                <version>1.28.0</version>
            </dependency>
            <dependency>
                <groupId>com.fasterxml.jackson.core</groupId>
                <artifactId>jackson-core</artifactId>
                <!-- 2.22.1 fixes GHSA-r7wm-3cxj-wff9 (async parser maxNumberLength
                     bypass, HIGH — incomplete fix in 2.22.0). -->
                <version>2.22.3</version>
            </dependency>
            <dependency>
                <groupId>com.fasterxml.jackson.core</groupId>
                <artifactId>jackson-databind</artifactId>
                <!-- 2.22.0 fixed CVE-2026-54512/54513/54514/54516/54517/54518.
                     2.22.1 additionally fixes CVE-2026-54515 (medium), now published. -->
                <version>2.22.3</version>
            </dependency>
            <!-- Jackson 3 (tools.jackson) transitive via org.web3j:crypto 6.x (pulls 3.1.0);
                 pinned to latest 3.x patch, same policy as the Jackson 2 pins above. -->
            <dependency>
                <groupId>tools.jackson.core</groupId>
                <artifactId>jackson-core</artifactId>
                <version>3.2.3</version>
            </dependency>
            <dependency>
                <groupId>tools.jackson.core</groupId>
                <artifactId>jackson-databind</artifactId>
                <version>3.2.3</version>
            </dependency>
            <!-- vertx-core transitive via org.web3j:crypto -> tuweni-bytes -> vertx-core.
                 web3j 6.0.0 pulls tuweni 2.7.0 -> vertx 4.5.11 (CVE-2026-1002, CVE-2026-6860).
                 tuweni 2.8.0 dropped the Buffer.buffer(ByteBuf) call that kept vertx on
                 4.5.x, so pin tuweni 2.8.0 + vertx 5.2.0 (javap-verified; see
                 transactions/pom.xml). -->
            <dependency>
                <groupId>io.vertx</groupId>
                <artifactId>vertx-core</artifactId>
                <version>5.2.0</version>
            </dependency>
            <dependency>
                <groupId>io.consensys.tuweni</groupId>
                <artifactId>tuweni-bytes</artifactId>
                <version>2.8.0</version>
            </dependency>
            <dependency>
                <groupId>io.consensys.tuweni</groupId>
                <artifactId>tuweni-units</artifactId>
                <version>2.8.0</version>
            </dependency>
            <!-- logback-core transitive via logback-classic. Pinned explicitly (not
                 just via logback-classic's own version) so static analysis tools
                 that don't resolve transitive POMs still see the patched version. -->
            <dependency>
                <groupId>ch.qos.logback</groupId>
                <artifactId>logback-core</artifactId>
                <version>1.6.4</version>
            </dependency>
            <!-- bcprov-jdk18on 1.86 — SECURITY OVERRIDE. io.decentralchain:crypto:2.0.7 as
                 published on Maven Central declares Bouncy Castle 1.84 (CVE-2026-8763 CRITICAL,
                 CVE-2026-13506 HIGH, both fixed in 1.85). The in-repo crypto module is already on
                 1.86 but not yet re-released, so pin it here for every transitive path. -->
            <dependency>
                <groupId>org.bouncycastle</groupId>
                <artifactId>bcprov-jdk18on</artifactId>
                <version>1.86</version>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <dependencies>
        <!-- DCC transactions (fork of io.decentralchain:transactions; see KNOWN-2 resolution) -->
        <dependency>
            <groupId>io.decentralchain</groupId>
            <artifactId>transactions</artifactId>
            <version>1.1.0</version>
        </dependency>

        <!-- DCC crypto primitives (Curve25519, key derivation, hashing, Base58, RSA)
             Direct dep needed for io.decentralchain.crypto.* imports in util classes.
             Replaces the transitive io.decentralchain:crypto pulled via transactions.
             See DCC-264. -->
        <dependency>
            <groupId>io.decentralchain</groupId>
            <artifactId>crypto</artifactId>
            <version>2.0.8</version>
        </dependency>

        <!-- RIDE Compiler (DCC local build from packages/ride) -->
        <dependency>
            <groupId>io.decentralchain</groupId>
            <artifactId>ride</artifactId>
            <version>1.6.2</version>
        </dependency>

        <!-- logging (runtime / test only)
             1.5.32 pulls in logback-core vulnerable to CVE-2026-10532 (fixed 1.5.34)
             and CVE-2026-9828 (fixed 1.5.33) — bumped to latest 1.5.x patch. -->
        <dependency>
            <groupId>ch.qos.logback</groupId>
            <artifactId>logback-classic</artifactId>
            <version>1.6.4</version>
            <scope>test</scope>
        </dependency>

        <!-- protobuf-schemas: io.decentralchain.protobuf.* and
             io.decentralchain.events.protobuf.* generated classes.
             Required for EthereumTransactionFromProtobufTest. -->
        <dependency>
            <groupId>io.decentralchain</groupId>
            <artifactId>protobuf-schemas</artifactId>
            <version>1.6.6</version>
            <scope>test</scope>
        </dependency>

        <!-- testing -->
        <dependency>
            <groupId>org.junit.jupiter</groupId>
            <artifactId>junit-jupiter</artifactId>
            <version>6.1.3</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.assertj</groupId>
            <artifactId>assertj-core</artifactId>
            <version>3.27.7</version>
            <scope>test</scope>
        </dependency>
        <!-- testcontainers 2.x — junit-jupiter module dropped; container lifecycle
             handled via static initializer in BaseTestWithNodeInDocker -->
        <dependency>
            <groupId>org.testcontainers</groupId>
            <artifactId>testcontainers</artifactId>
            <version>2.0.5</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.mockito</groupId>
            <artifactId>mockito-core</artifactId>
            <version>5.24.0</version>
            <scope>test</scope>
        </dependency>
    </dependencies>

    <profiles>
        <!-- 'release' profile: GPG-sign + publish to Maven Central Portal -->
        <!-- Activate with: ./mvnw deploy -P release                        -->
        <profile>
            <id>release</id>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-gpg-plugin</artifactId>
                        <version>3.2.8</version>
                        <executions>
                            <execution>
                                <id>sign-artifacts</id>
                                <phase>verify</phase>
                                <goals>
                                    <goal>sign</goal>
                                </goals>
                                <configuration>
                                    <gpgArguments>
                                        <arg>--pinentry-mode</arg>
                                        <arg>loopback</arg>
                                    </gpgArguments>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>
                    <plugin>
                        <groupId>org.sonatype.central</groupId>
                        <artifactId>central-publishing-maven-plugin</artifactId>
                        <version>0.11.0</version>
                        <extensions>true</extensions>
                        <configuration>
                            <publishingServerId>central</publishingServerId>
                            <deploymentName>${project.artifactId}-${project.version}</deploymentName>
                            <autoPublish>false</autoPublish>
                        </configuration>
                    </plugin>
                </plugins>
            </build>
        </profile>
    </profiles>
</project>
