<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0
                             https://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>io.keikai</groupId>
    <artifactId>axyra-sheets</artifactId>
    <version>0.1.0.FL.20260815-Eval</version>
    <packaging>jar</packaging>

    <name>Axyra Sheets — Java SDK</name>
    <description>Java SDK for the Axyra Sheets engine. Embeddable Excel-compatible spreadsheet.</description>
    <url>https://www.keikai.io/axyra</url>

    <licenses>
        <license>
            <name>Proprietary</name>
            <comments>Commercial license. Contact licensing@potix.com.</comments>
        </license>
    </licenses>

    <organization>
        <name>Potix Corporation</name>
        <url>https://www.potix.com</url>
    </organization>

    <properties>
        <!-- Java 17: the public API uses sealed interfaces + records (CellValue). -->
        <maven.compiler.release>17</maven.compiler.release>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <!--
          Development override for the native library location. Empty by
          default (the loader then extracts the platform library embedded
          under /native/<os>-<arch>/ in this jar). Pass
          `-Daxyra.native.path=/abs/path/to/libaxyra_jni.dylib` to point the
          loader at a locally-built cdylib instead.
        -->
        <axyra.native.path></axyra.native.path>
    </properties>

    <dependencies>
        <!--
          Rich objects (cell styles, and later charts / pivots / validation /
          conditional formats) cross the JNI boundary as JSON with a documented
          flat schema. Jackson handles that (de)serialization on the Java side.
        -->
        <dependency>
            <groupId>com.fasterxml.jackson.core</groupId>
            <artifactId>jackson-databind</artifactId>
            <!-- keep on the newest 2.x patch: the nightly dependency-check
                 gate fails the FL build on any HIGH/CRITICAL CVE here -->
            <version>2.22.1</version>
        </dependency>

        <dependency>
            <groupId>org.junit.jupiter</groupId>
            <artifactId>junit-jupiter</artifactId>
            <version>5.10.2</version>
            <scope>test</scope>
        </dependency>
    </dependencies>

    <profiles>
        <!--
          Release packaging: build the axyra-sheets-ffi-jni cdylib for the
          current host and stage it under src/main/resources/native/<platform>/
          so the jar embeds it (zero-config consumers — the loader
          auto-detects os/arch at runtime and extracts from the classpath).
          Run once per release platform, then package: the jar carries the
          union of everything staged. Regular dev/CI builds skip this profile
          and run tests against -Daxyra.native.path.
        -->
        <profile>
            <id>bundle-natives</id>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.codehaus.mojo</groupId>
                        <artifactId>exec-maven-plugin</artifactId>
                        <version>3.2.0</version>
                        <executions>
                            <execution>
                                <id>build-native</id>
                                <phase>generate-resources</phase>
                                <goals><goal>exec</goal></goals>
                                <configuration>
                                    <executable>bash</executable>
                                    <arguments>
                                        <argument>${project.basedir}/build-native.sh</argument>
                                    </arguments>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>
    </profiles>

    <build>
        <plugins>
            <plugin>
                <!-- OWASP dependency scan; invoked explicitly by the Jenkins FL
                     job (mvn dependency-check:check) — no lifecycle binding, so
                     regular builds and GitHub CI are unaffected. failBuildOnCVSS
                     7 fails the goal on any HIGH or CRITICAL finding. -->
                <groupId>org.owasp</groupId>
                <artifactId>dependency-check-maven</artifactId>
                <version>12.2.2</version>
                <configuration>
                    <nvdApiKey>0169c05a-3473-47a5-84e3-e9a8ed37afa2</nvdApiKey>
                    <nvdApiDelay>16000</nvdApiDelay>
                    <assemblyAnalyzerEnabled>false</assemblyAnalyzerEnabled>
                    <!-- no failBuildOnCVSS here: the gating policy lives in
                         the Jenkins FL job (-DfailBuildOnCVSS=7), keeping the
                         pom neutral the same way the Keikai build does -->
                    <formats>
                        <format>XML</format>
                        <format>HTML</format>
                    </formats>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-surefire-plugin</artifactId>
                <version>3.2.5</version>
                <configuration>
                    <!--
                      Forward the native-lib override into the forked test JVM
                      so `AxyraNative.load()` (which reads this system property)
                      can pick up a locally-built cdylib. Empty unless
                      `-Daxyra.native.path=...` is passed on the command line.
                    -->
                    <systemPropertyVariables>
                        <axyra.native.path>${axyra.native.path}</axyra.native.path>
                    </systemPropertyVariables>
                </configuration>
                <executions>
                    <!--
                      EvalFileLimitTest exhausts the process-global evaluation
                      file budget (100 gated ops, no reset), so it must not
                      share a JVM with the rest of the suite: it is excluded
                      here and runs alone in the dedicated execution below.
                    -->
                    <execution>
                        <id>default-test</id>
                        <configuration>
                            <excludes>
                                <exclude>**/EvalFileLimitTest.java</exclude>
                            </excludes>
                        </configuration>
                    </execution>
                    <execution>
                        <id>eval-file-limit</id>
                        <goals>
                            <goal>test</goal>
                        </goals>
                        <configuration>
                            <includes>
                                <include>**/EvalFileLimitTest.java</include>
                            </includes>
                            <reuseForks>false</reuseForks>
                        </configuration>
                    </execution>
                </executions>
            </plugin>
        </plugins>
    </build>
</project>
