<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0
                             https://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>io.keikai</groupId>
    <artifactId>axyra-sheets</artifactId>
    <version>1.0.0-Beta.FL.20261016-Eval</version>
    <packaging>jar</packaging>

    <name>Axyra Sheets — Java SDK</name>
    <description>Java SDK for the Axyra Sheets engine. Embeddable Excel-compatible spreadsheet.</description>
    <url>https://www.keikai.io/axyra</url>

    <licenses>
        <license>
            <name>Proprietary</name>
            <comments>Commercial license. Contact licensing@potix.com.</comments>
        </license>
    </licenses>

    <organization>
        <name>Potix Corporation</name>
        <url>https://www.potix.com</url>
    </organization>

    <properties>
        <!-- Java 17: the public API uses sealed interfaces + records (CellValue). -->
        <maven.compiler.release>17</maven.compiler.release>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <!--
          Development override for the native library location. Empty by
          default (the loader then extracts the platform library embedded
          under /native/<os>-<arch>/ in this jar). Pass
          `-Daxyra.native.path=/abs/path/to/libaxyra_jni.dylib` to point the
          loader at a locally-built cdylib instead.
        -->
        <axyra.native.path></axyra.native.path>
        <!--
          Which copy this build is. Every build published today (the nightly
          FL build on the eval repository) is the evaluation copy, which
          carries the Axyra Trial License Agreement: see the trial-license
          profile. A commercial release passes `-Daxyra.edition=official`.
          This default only feeds the tests; the profile reads the command line.
        -->
        <axyra.edition>eval</axyra.edition>
    </properties>

    <dependencies>
        <!--
          Rich objects (cell styles, and later charts / pivots / validation /
          conditional formats) cross the JNI boundary as JSON with a documented
          flat schema. Jackson handles that (de)serialization on the Java side.
        -->
        <dependency>
            <groupId>com.fasterxml.jackson.core</groupId>
            <artifactId>jackson-databind</artifactId>
            <!-- keep on the newest 2.x patch: the nightly dependency-check
                 gate fails the FL build on any HIGH/CRITICAL CVE here -->
            <version>2.22.3</version>
        </dependency>

        <dependency>
            <groupId>org.junit.jupiter</groupId>
            <artifactId>junit-jupiter</artifactId>
            <version>5.10.2</version>
            <scope>test</scope>
        </dependency>

        <!--
          Apache POI, test scope only — never shipped, never on the SDK's
          runtime path. It reads a saved .xls back as a neutral third party in
          XlsDrawingLayerPoiTest: this engine's own reader and writer share
          assumptions and would agree with each other about a mistake, so the
          drawing layer is checked by a parser that shares none of them.
        -->
        <dependency>
            <groupId>org.apache.poi</groupId>
            <artifactId>poi</artifactId>
            <version>5.4.1</version>
            <scope>test</scope>
        </dependency>
    </dependencies>

    <profiles>
        <!--
          Release packaging: build the axyra-sheets-ffi-jni cdylib for the
          current host and stage it under src/main/resources/native/<platform>/
          so the jar embeds it (zero-config consumers — the loader
          auto-detects os/arch at runtime and extracts from the classpath).
          Run once per release platform, then package: the jar carries the
          union of everything staged. Regular dev/CI builds skip this profile
          and run tests against -Daxyra.native.path.
        -->
        <profile>
            <id>bundle-natives</id>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.codehaus.mojo</groupId>
                        <artifactId>exec-maven-plugin</artifactId>
                        <version>3.2.0</version>
                        <executions>
                            <execution>
                                <id>build-native</id>
                                <phase>generate-resources</phase>
                                <goals><goal>exec</goal></goals>
                                <configuration>
                                    <executable>bash</executable>
                                    <arguments>
                                        <argument>${project.basedir}/build-native.sh</argument>
                                    </arguments>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>

        <!--
          The evaluation copy's terms: the Axyra Trial License Agreement
          (TRIAL_LICENSE.txt at the repository root) travels in the jar as
          META-INF/TRIAL_LICENSE.txt, as Keikai's evaluation zip carries
          cmldoc/TRIAL_LICENSE. The jar is what reaches the customer: the FL
          job's bundle is unpacked by the upload job, which deploys only the
          jar, the pom and the javadoc jar. On unless the build passes
          `-Daxyra.edition=official` (a commercial release, whose customers
          sign their own agreement); TrialLicenseResourceTest checks both ways.
        -->
        <profile>
            <id>trial-license</id>
            <activation>
                <property>
                    <name>axyra.edition</name>
                    <value>!official</value>
                </property>
            </activation>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-resources-plugin</artifactId>
                        <!-- the version the FL job's Maven already binds -->
                        <version>3.3.1</version>
                        <executions>
                            <execution>
                                <id>trial-license</id>
                                <phase>process-resources</phase>
                                <goals><goal>copy-resources</goal></goals>
                                <configuration>
                                    <outputDirectory>${project.build.outputDirectory}/META-INF</outputDirectory>
                                    <resources>
                                        <resource>
                                            <directory>${project.basedir}/..</directory>
                                            <includes>
                                                <include>TRIAL_LICENSE.txt</include>
                                            </includes>
                                        </resource>
                                    </resources>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>

        <!--
          The other side of trial-license: a commercial build deletes the
          META-INF/TRIAL_LICENSE.txt an earlier evaluation build left in
          target/classes, so `package` without `clean` cannot put the trial
          agreement into a commercial jar.
        -->
        <profile>
            <id>official-edition</id>
            <activation>
                <property>
                    <name>axyra.edition</name>
                    <value>official</value>
                </property>
            </activation>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-clean-plugin</artifactId>
                        <!-- the version the FL job's Maven already binds -->
                        <version>3.2.0</version>
                        <executions>
                            <execution>
                                <id>drop-trial-license</id>
                                <phase>process-resources</phase>
                                <goals><goal>clean</goal></goals>
                                <configuration>
                                    <excludeDefaultDirectories>true</excludeDefaultDirectories>
                                    <filesets>
                                        <fileset>
                                            <directory>${project.build.outputDirectory}/META-INF</directory>
                                            <includes>
                                                <include>TRIAL_LICENSE.txt</include>
                                            </includes>
                                        </fileset>
                                    </filesets>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>
    </profiles>

    <build>
        <plugins>
            <plugin>
                <!-- SBOM (CycloneDX) of the jar's Java dependencies, as the
                     Keikai build writes one: target/axyra-sheets-sbom-cyclonedx.json
                     at package. The native layer's SBOM comes from
                     tools/security/rust-scan.sh; a release's sbom/ folder
                     carries both. -->
                <groupId>org.cyclonedx</groupId>
                <artifactId>cyclonedx-maven-plugin</artifactId>
                <version>2.9.2</version>
                <executions>
                    <execution>
                        <phase>package</phase>
                        <goals>
                            <goal>makeBom</goal>
                        </goals>
                    </execution>
                </executions>
                <configuration>
                    <outputFormat>json</outputFormat>
                    <schemaVersion>1.6</schemaVersion>
                    <projectType>library</projectType>
                    <includeTestScope>false</includeTestScope>
                    <outputName>axyra-sheets-sbom-cyclonedx</outputName>
                </configuration>
            </plugin>
            <plugin>
                <!-- OWASP dependency scan, configured as the Keikai build's: the
                     check goal is bound to the lifecycle (verify), every report
                     format is written so SonarQube and the Jenkins
                     Dependency-Check publisher can read one, and accepted
                     findings live in owasp-suppressions.xml. Skip it on a
                     local build with -Ddependency-check.skip=true. It sees the
                     jar's Java dependencies only; the native layer's are
                     covered by tools/security/rust-scan.sh. -->
                <groupId>org.owasp</groupId>
                <artifactId>dependency-check-maven</artifactId>
                <version>12.2.2</version>
                <configuration>
                    <nvdApiKey>0169c05a-3473-47a5-84e3-e9a8ed37afa2</nvdApiKey>
                    <nvdApiDelay>16000</nvdApiDelay>
                    <assemblyAnalyzerEnabled>false</assemblyAnalyzerEnabled>
                    <!-- no failBuildOnCVSS here: the gating policy lives in
                         the Jenkins FL job (-DfailBuildOnCVSS=7), keeping the
                         pom neutral the same way the Keikai build does -->
                    <formats>
                        <format>ALL</format>
                    </formats>
                    <suppressionFiles>
                        <suppressionFile>${project.basedir}/owasp-suppressions.xml</suppressionFile>
                    </suppressionFiles>
                </configuration>
                <executions>
                    <execution>
                        <goals>
                            <goal>check</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <!--
                  HTML API reference. The `jar` goal binds to `package`, so
                  `mvn package` / `mvn deploy` attach
                  axyra-sheets-<version>-javadoc.jar; the unpacked pages stay
                  under target/apidocs/. Same plugin version as the Keikai
                  build. doclint stays on (minus the `missing` group, which
                  only reports undocumented @param/@return) so a broken
                  {@link} fails the build instead of shipping a dead link.
                  Skip locally with -Dmaven.javadoc.skip=true.
                -->
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-javadoc-plugin</artifactId>
                <version>3.6.3</version>
                <configuration>
                    <doclint>all,-missing</doclint>
                    <excludePackageNames>io.keikai.axyra.sheets.internal</excludePackageNames>
                </configuration>
                <executions>
                    <execution>
                        <id>attach-javadocs</id>
                        <goals>
                            <goal>jar</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <!-- Attaches axyra-sheets-<version>-sources.jar on package.
                     Java sources only: src/main/resources holds nothing but
                     the staged native libraries, which belong in the main jar
                     and would double the size of the sources jar. -->
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-source-plugin</artifactId>
                <version>3.3.1</version>
                <configuration>
                    <excludeResources>true</excludeResources>
                </configuration>
                <executions>
                    <execution>
                        <id>attach-sources</id>
                        <goals>
                            <goal>jar-no-fork</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-surefire-plugin</artifactId>
                <version>3.2.5</version>
                <configuration>
                    <!--
                      Forward the native-lib override into the forked test JVM
                      so `AxyraNative.load()` (which reads this system property)
                      can pick up a locally-built cdylib. Empty unless
                      `-Daxyra.native.path=...` is passed on the command line.
                    -->
                    <systemPropertyVariables>
                        <axyra.native.path>${axyra.native.path}</axyra.native.path>
                        <axyra.edition>${axyra.edition}</axyra.edition>
                    </systemPropertyVariables>
                </configuration>
                <executions>
                    <!--
                      EvalFileLimitTest exhausts the process-global evaluation
                      file budget (100 gated ops, no reset), so it must not
                      share a JVM with the rest of the suite: it is excluded
                      here and runs alone in the dedicated execution below.
                    -->
                    <execution>
                        <id>default-test</id>
                        <configuration>
                            <excludes>
                                <exclude>**/EvalFileLimitTest.java</exclude>
                            </excludes>
                        </configuration>
                    </execution>
                    <execution>
                        <id>eval-file-limit</id>
                        <goals>
                            <goal>test</goal>
                        </goals>
                        <configuration>
                            <includes>
                                <include>**/EvalFileLimitTest.java</include>
                            </includes>
                            <reuseForks>false</reuseForks>
                        </configuration>
                    </execution>
                </executions>
            </plugin>
        </plugins>
    </build>
</project>
