<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0
         http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>dev.tnsai</groupId>
    <artifactId>tnsai-parent</artifactId>
    <version>0.18.7</version>
    <packaging>pom</packaging>

    <name>TnsAI Parent</name>
    <description>Parent POM for the TnsAI framework — aggregates modules, pins versions, shares plugin configuration.</description>
    <url>https://github.com/TnsAI-Framework/TnsAI</url>
    <inceptionYear>2024</inceptionYear>

    <licenses>
        <license>
            <name>Apache License, Version 2.0</name>
            <url>https://www.apache.org/licenses/LICENSE-2.0</url>
            <distribution>repo</distribution>
        </license>
    </licenses>

    <developers>
        <developer>
            <id>tansuasici</id>
            <name>Tansu Asici</name>
            <email>tansuasici@gmail.com</email>
            <url>https://github.com/tansuasici</url>
            <roles>
                <role>architect</role>
                <role>developer</role>
            </roles>
            <timezone>Europe/Istanbul</timezone>
        </developer>
    </developers>

    <scm>
        <connection>scm:git:git://github.com/TnsAI-Framework/TnsAI.git</connection>
        <developerConnection>scm:git:ssh://github.com:TnsAI-Framework/TnsAI.git</developerConnection>
        <url>https://github.com/TnsAI-Framework/TnsAI/tree/main</url>
        <tag>HEAD</tag>
    </scm>

    <issueManagement>
        <system>GitHub Issues</system>
        <url>https://github.com/TnsAI-Framework/TnsAI/issues</url>
    </issueManagement>

    <modules>
        <module>tnsai-core</module>
        <module>tnsai-llm</module>
        <module>tnsai-intelligence</module>
        <module>tnsai-rag</module>
        <module>tnsai-coordination</module>
        <module>tnsai-quality</module>
        <module>tnsai-evaluation</module>
        <module>tnsai-mcp</module>
        <module>tnsai-tools</module>
        <module>tnsai-channels</module>
        <module>tnsai-payments</module>
        <module>tnsai-integration</module>
        <module>tnsai-server</module>
        <module>tnsai-rewrite</module>
        <module>tnsai-bom</module>
    </modules>

    <properties>
        <maven.compiler.source>21</maven.compiler.source>
        <maven.compiler.target>21</maven.compiler.target>
        <maven.compiler.release>21</maven.compiler.release>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>

        <!-- Core library versions -->
        <jackson.version>2.22.4</jackson.version>
        <jackson3.version>3.2.4</jackson3.version>
        <okhttp.version>5.5.0</okhttp.version>
        <kotlin.version>2.4.21</kotlin.version>
        <slf4j.version>2.0.20</slf4j.version>
        <junit.version>6.1.3</junit.version>
        <mockito.version>5.24.0</mockito.version>
        <lombok.version>1.18.48</lombok.version>
        <dotenv.version>3.2.0</dotenv.version>
        <jmustache.version>1.16</jmustache.version>
        <logback.version>1.6.5</logback.version>
        <logstash-logback-encoder.version>9.0</logstash-logback-encoder.version>
        <resilience4j.version>2.4.0</resilience4j.version>
        <commons-jexl3.version>3.7.0</commons-jexl3.version>
        <jsoup.version>1.23.2</jsoup.version>
        <aws.sdk.version>2.56.0</aws.sdk.version>
        <pdfbox.version>3.0.8</pdfbox.version>
        <poi.version>5.5.1</poi.version>
        <archunit.version>1.5.1</archunit.version>
        <javalin.version>7.2.3</javalin.version>
        <jetty.version>12.1.13</jetty.version>
        <asm.version>9.11.1</asm.version>
        <log4j.version>2.25.5</log4j.version>
        <opentelemetry.version>1.67.0</opentelemetry.version>
        <prometheus.version>1.17.1</prometheus.version>
        <prometheus.client.version>1.9.0</prometheus.client.version>
        <h2.version>2.5.252</h2.version>
        <jsr305.version>3.0.2</jsr305.version>
        <jedis.version>8.0.2</jedis.version>
        <sqlite.jdbc.version>3.53.4.0</sqlite.jdbc.version>
        <postgresql.version>42.7.14</postgresql.version>
        <web3j.version>6.0.0</web3j.version>

        <!-- Plugin versions -->
        <maven-compiler-plugin.version>3.16.0</maven-compiler-plugin.version>
        <maven-surefire-plugin.version>3.6.0</maven-surefire-plugin.version>
        <maven-javadoc-plugin.version>3.12.0</maven-javadoc-plugin.version>
        <maven-source-plugin.version>3.4.0</maven-source-plugin.version>
        <maven-gpg-plugin.version>3.2.8</maven-gpg-plugin.version>
        <maven-deploy-plugin.version>3.2.0</maven-deploy-plugin.version>
        <cyclonedx-maven-plugin.version>2.9.3</cyclonedx-maven-plugin.version>
        <jacoco.version>0.8.15</jacoco.version>
        <checkstyle.plugin.version>3.6.0</checkstyle.plugin.version>
        <spotbugs.plugin.version>4.10.5.0</spotbugs.plugin.version>
        <japicmp.plugin.version>0.26.3</japicmp.plugin.version>

        <!--
          Issue #203 release-pipeline gates. Toggle these on the command
          line to bypass the API-compat check on intentional breaking
          minor-version bumps:
            mvn verify -Pquality -Denforce.api.compat=false
          Default ON (true) so the gate fires by default in CI.
          Per-module skip flag for the pom-only / bom modules that have
          no Java API surface to compare:
            mvn verify -Pquality -Djapicmp.skip=true   (used by tnsai-bom)
        -->
        <enforce.api.compat>true</enforce.api.compat>
        <japicmp.skip>false</japicmp.skip>
        <!--
          japicmp's baseline = the last published release,
          MEASURED FROM main's tags at runtime by scripts/api-compat-check.sh,
          which passes -Djapicmp.baseline.version=<derived>. Per the Release
          charter (owner decision 2026-09-18) the baseline is NOT written down
          here — it is measured from main each time, so it cannot drift from the
          POM version once dev carries a -SNAPSHOT. (Supersedes TAN-5642's pin.)

          The value below is a SELF-DESCRIBING SENTINEL, not a version. The
          plugin's oldVersion path interpolates ${japicmp.baseline.version}, so
          leaving the property undefined would drop a literal placeholder into
          the path. The script always overrides it via -D; a script-less
          `mvn -Pquality verify` instead fails looking for a file whose name
          points back at the script, rather than an unexplained unresolved ${...}.
        -->
        <japicmp.baseline.version>SET-BY-scripts/api-compat-check.sh</japicmp.baseline.version>
        <enforcer.plugin.version>3.6.2</enforcer.plugin.version>

        <!--
          Default empty value for surefire's @{argLine} late-binding placeholder.
          When -Pquality is active, jacoco's `prepare-agent` overwrites this with
          the `-javaagent:jacoco.jar=...` argument; when not, surefire still needs
          the property to exist so it expands to empty instead of the literal
          string "@{argLine}" (which the JVM would reject as an unknown flag).
        -->
        <argLine></argLine>
    </properties>

    <dependencyManagement>
        <dependencies>
            <!-- Intra-module deps (reactor versions) -->
            <dependency>
                <groupId>dev.tnsai</groupId>
                <artifactId>tnsai-core</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>dev.tnsai</groupId>
                <artifactId>tnsai-llm</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>dev.tnsai</groupId>
                <artifactId>tnsai-intelligence</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>dev.tnsai</groupId>
                <artifactId>tnsai-rag</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>dev.tnsai</groupId>
                <artifactId>tnsai-coordination</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>dev.tnsai</groupId>
                <artifactId>tnsai-quality</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>dev.tnsai</groupId>
                <artifactId>tnsai-evaluation</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>dev.tnsai</groupId>
                <artifactId>tnsai-mcp</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>dev.tnsai</groupId>
                <artifactId>tnsai-tools</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>dev.tnsai</groupId>
                <artifactId>tnsai-channels</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>dev.tnsai</groupId>
                <artifactId>tnsai-integration</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>dev.tnsai</groupId>
                <artifactId>tnsai-server</artifactId>
                <version>${project.version}</version>
            </dependency>

            <!-- External library BOM-like pins -->
            <dependency>
                <groupId>com.fasterxml.jackson</groupId>
                <artifactId>jackson-bom</artifactId>
                <version>${jackson.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>

            <!-- Resilience4j -->
            <dependency>
                <groupId>io.github.resilience4j</groupId>
                <artifactId>resilience4j-circuitbreaker</artifactId>
                <version>${resilience4j.version}</version>
            </dependency>
            <dependency>
                <groupId>io.github.resilience4j</groupId>
                <artifactId>resilience4j-bulkhead</artifactId>
                <version>${resilience4j.version}</version>
            </dependency>
            <dependency>
                <groupId>io.github.resilience4j</groupId>
                <artifactId>resilience4j-ratelimiter</artifactId>
                <version>${resilience4j.version}</version>
            </dependency>
            <dependency>
                <groupId>io.github.resilience4j</groupId>
                <artifactId>resilience4j-retry</artifactId>
                <version>${resilience4j.version}</version>
            </dependency>
            <dependency>
                <groupId>io.github.resilience4j</groupId>
                <artifactId>resilience4j-timelimiter</artifactId>
                <version>${resilience4j.version}</version>
            </dependency>

            <!-- Apache Commons JEXL — expression evaluator for @Contract (TNS-552) -->
            <dependency>
                <groupId>org.apache.commons</groupId>
                <artifactId>commons-jexl3</artifactId>
                <version>${commons-jexl3.version}</version>
            </dependency>

            <!-- OkHttp -->
            <dependency>
                <groupId>com.squareup.okhttp3</groupId>
                <artifactId>okhttp-jvm</artifactId>
                <version>${okhttp.version}</version>
            </dependency>
            <dependency>
                <groupId>com.squareup.okhttp3</groupId>
                <artifactId>mockwebserver3</artifactId>
                <version>${okhttp.version}</version>
            </dependency>

            <!-- Kotlin stdlib -->
            <dependency>
                <groupId>org.jetbrains.kotlin</groupId>
                <artifactId>kotlin-stdlib</artifactId>
                <version>${kotlin.version}</version>
            </dependency>

            <!-- Logging -->
            <dependency>
                <groupId>org.slf4j</groupId>
                <artifactId>slf4j-api</artifactId>
                <version>${slf4j.version}</version>
            </dependency>
            <dependency>
                <groupId>ch.qos.logback</groupId>
                <artifactId>logback-classic</artifactId>
                <version>${logback.version}</version>
            </dependency>
            <dependency>
                <groupId>net.logstash.logback</groupId>
                <artifactId>logstash-logback-encoder</artifactId>
                <version>${logstash-logback-encoder.version}</version>
            </dependency>

            <!-- Jackson 3 BOM: manages the whole tools.jackson line that logstash-logback-encoder and web3j (compile scope in tnsai-payments) bring transitively -->
            <dependency>
                <groupId>tools.jackson</groupId>
                <artifactId>jackson-bom</artifactId>
                <version>${jackson3.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>

            <!-- Jetty BOMs: lift the line Javalin brings into tnsai-server past GHSA-6m7j-pjmp-crgq (jetty-security) and GHSA-4hxv-32vm-5h2m (jetty-server) -->
            <dependency>
                <groupId>org.eclipse.jetty</groupId>
                <artifactId>jetty-bom</artifactId>
                <version>${jetty.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
            <dependency>
                <groupId>org.eclipse.jetty.ee10</groupId>
                <artifactId>jetty-ee10-bom</artifactId>
                <version>${jetty.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>

            <!-- ASM BOM (asm, asm-commons, asm-tree via jetty-ee10-annotations; asm via json-smart): OW2 ASM before 9.11 DoS family, GHSA-9vfw-838x-23h7 and siblings -->
            <dependency>
                <groupId>org.ow2.asm</groupId>
                <artifactId>asm-bom</artifactId>
                <version>${asm.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>

            <!-- log4j-api (via poi-ooxml in tnsai-rag): GHSA-qv9r-c865-cp47 -->
            <dependency>
                <groupId>org.apache.logging.log4j</groupId>
                <artifactId>log4j-api</artifactId>
                <version>${log4j.version}</version>
            </dependency>

            <!-- Lombok -->
            <dependency>
                <groupId>org.projectlombok</groupId>
                <artifactId>lombok</artifactId>
                <version>${lombok.version}</version>
                <scope>provided</scope>
            </dependency>

            <!-- Utility libs -->
            <dependency>
                <groupId>io.github.cdimascio</groupId>
                <artifactId>dotenv-java</artifactId>
                <version>${dotenv.version}</version>
            </dependency>
            <dependency>
                <groupId>com.samskivert</groupId>
                <artifactId>jmustache</artifactId>
                <version>${jmustache.version}</version>
            </dependency>
            <dependency>
                <groupId>org.jsoup</groupId>
                <artifactId>jsoup</artifactId>
                <version>${jsoup.version}</version>
            </dependency>
            <dependency>
                <groupId>com.google.code.findbugs</groupId>
                <artifactId>jsr305</artifactId>
                <version>${jsr305.version}</version>
                <optional>true</optional>
            </dependency>

            <!-- AWS SDK -->
            <dependency>
                <groupId>software.amazon.awssdk</groupId>
                <artifactId>bedrockruntime</artifactId>
                <version>${aws.sdk.version}</version>
            </dependency>
            <dependency>
                <groupId>software.amazon.awssdk</groupId>
                <artifactId>s3</artifactId>
                <version>${aws.sdk.version}</version>
            </dependency>

            <!-- PDF parsing -->
            <dependency>
                <groupId>org.apache.pdfbox</groupId>
                <artifactId>pdfbox</artifactId>
                <version>${pdfbox.version}</version>
            </dependency>
            <dependency>
                <groupId>org.apache.poi</groupId>
                <artifactId>poi-ooxml</artifactId>
                <version>${poi.version}</version>
            </dependency>

            <!-- Web framework -->
            <dependency>
                <groupId>io.javalin</groupId>
                <artifactId>javalin</artifactId>
                <version>${javalin.version}</version>
            </dependency>

            <!-- Observability -->
            <dependency>
                <groupId>io.opentelemetry</groupId>
                <artifactId>opentelemetry-bom</artifactId>
                <version>${opentelemetry.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
            <dependency>
                <groupId>io.micrometer</groupId>
                <artifactId>micrometer-registry-prometheus</artifactId>
                <version>${prometheus.version}</version>
            </dependency>
            <dependency>
                <groupId>io.prometheus</groupId>
                <artifactId>prometheus-metrics-core</artifactId>
                <version>${prometheus.client.version}</version>
            </dependency>

            <!-- Testing -->
            <dependency>
                <groupId>org.junit</groupId>
                <artifactId>junit-bom</artifactId>
                <version>${junit.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
            <dependency>
                <groupId>org.mockito</groupId>
                <artifactId>mockito-core</artifactId>
                <version>${mockito.version}</version>
                <scope>test</scope>
            </dependency>
            <dependency>
                <groupId>org.mockito</groupId>
                <artifactId>mockito-junit-jupiter</artifactId>
                <version>${mockito.version}</version>
                <scope>test</scope>
            </dependency>
            <dependency>
                <groupId>com.tngtech.archunit</groupId>
                <artifactId>archunit-junit5</artifactId>
                <version>${archunit.version}</version>
                <scope>test</scope>
            </dependency>
            <dependency>
                <groupId>com.h2database</groupId>
                <artifactId>h2</artifactId>
                <version>${h2.version}</version>
                <scope>test</scope>
            </dependency>
            <dependency>
                <groupId>redis.clients</groupId>
                <artifactId>jedis</artifactId>
                <version>${jedis.version}</version>
            </dependency>
            <dependency>
                <groupId>org.xerial</groupId>
                <artifactId>sqlite-jdbc</artifactId>
                <version>${sqlite.jdbc.version}</version>
            </dependency>
            <dependency>
                <groupId>org.postgresql</groupId>
                <artifactId>postgresql</artifactId>
                <version>${postgresql.version}</version>
            </dependency>
            <!--
                web3j-crypto is the lightweight slice of web3j that we need for
                EIP-712 typed-data hashing + secp256k1 signing in the x402
                payment broker (TNS-449). Pulling the full web3j artifact would
                add JSON-RPC clients, contract binding generators, and a much
                larger transitive surface we don't use. Crypto-only keeps the
                opt-in tnsai-payments module slim.
            -->
            <dependency>
                <groupId>org.web3j</groupId>
                <artifactId>crypto</artifactId>
                <version>${web3j.version}</version>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <build>
        <pluginManagement>
            <plugins>
                <!--
                  Pinned: the release deploys into a staging tree with
                  -DaltDeploymentRepository=id::url, a form maven-deploy-plugin
                  accepts from 3.0. Unpinned, the version comes from the Maven
                  running the build, and the runners' Maven 3.8 binds 2.7.
                -->
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-deploy-plugin</artifactId>
                    <version>${maven-deploy-plugin.version}</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-compiler-plugin</artifactId>
                    <version>${maven-compiler-plugin.version}</version>
                    <configuration>
                        <source>${maven.compiler.source}</source>
                        <target>${maven.compiler.target}</target>
                        <release>${maven.compiler.release}</release>
                        <compilerArgs>
                            <arg>-parameters</arg>
                        </compilerArgs>
                        <annotationProcessorPaths>
                            <path>
                                <groupId>org.projectlombok</groupId>
                                <artifactId>lombok</artifactId>
                                <version>${lombok.version}</version>
                            </path>
                        </annotationProcessorPaths>
                        <forceLegacyJavacApi>true</forceLegacyJavacApi>
                    </configuration>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-surefire-plugin</artifactId>
                    <version>${maven-surefire-plugin.version}</version>
                    <configuration>
                        <useSystemClassLoader>false</useSystemClassLoader>
                        <!--
                          Explicit Mockito javaagent (replaces -XX:+EnableDynamicAgentLoading).
                          The agent path is resolved by maven-dependency-plugin's `properties`
                          goal (bound below) into the property `org.mockito:mockito-core:jar`.
                          Future JDKs will disallow dynamic agent self-attach; this preempts that.

                          @{argLine} is the late-binding placeholder used by jacoco's
                          `prepare-agent` goal to inject `-javaagent:jacoco.jar` at test
                          time. Without this prefix, -Pquality's coverage report stays
                          empty ("Skipping JaCoCo execution due to missing execution data").
                        -->
                        <argLine>
                            @{argLine}
                            -javaagent:${org.mockito:mockito-core:jar}
                            --add-opens java.base/java.lang=ALL-UNNAMED
                            --add-opens java.base/java.lang.reflect=ALL-UNNAMED
                            --add-opens java.base/java.util=ALL-UNNAMED
                        </argLine>
                    </configuration>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-javadoc-plugin</artifactId>
                    <version>${maven-javadoc-plugin.version}</version>
                    <configuration>
                        <doclint>none</doclint>
                        <quiet>true</quiet>
                        <failOnError>false</failOnError>
                        <show>public</show>
                        <nohelp>true</nohelp>
                        <charset>UTF-8</charset>
                        <docencoding>UTF-8</docencoding>
                        <encoding>UTF-8</encoding>
                    </configuration>
                </plugin>
            </plugins>
        </pluginManagement>

        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-dependency-plugin</artifactId>
                <executions>
                    <execution>
                        <id>resolve-test-agents</id>
                        <phase>process-test-classes</phase>
                        <goals>
                            <goal>properties</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-surefire-plugin</artifactId>
            </plugin>
            <!--
              JaCoCo runs by default (not under -Pquality) so the CI coverage
              gate in tnsai-core fires on every PR via the standard
              `mvn verify` step. The agent overhead is negligible vs. the
              regression-protection win for the issue #9 protected classes.
              -Pquality additionally enables checkstyle/spotbugs/japicmp.
            -->
            <plugin>
                <groupId>org.jacoco</groupId>
                <artifactId>jacoco-maven-plugin</artifactId>
                <version>${jacoco.version}</version>
                <executions>
                    <execution>
                        <id>prepare-agent</id>
                        <phase>initialize</phase>
                        <goals>
                            <goal>prepare-agent</goal>
                        </goals>
                    </execution>
                    <execution>
                        <id>report</id>
                        <phase>verify</phase>
                        <goals>
                            <goal>report</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
        </plugins>
    </build>

    <profiles>
        <!-- Quality profile: mvn verify -Pquality -->
        <profile>
            <id>quality</id>
            <build>
                <plugins>
                    <!--
                      jacoco moved to default <build> in this pom — runs on every
                      verify so the issue-9 coverage gate (in tnsai-core) fires
                      without -Pquality. -Pquality now only adds the slower
                      static-analysis tools below.
                    -->
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-checkstyle-plugin</artifactId>
                        <version>${checkstyle.plugin.version}</version>
                        <configuration>
                            <consoleOutput>true</consoleOutput>
                            <failOnViolation>false</failOnViolation>
                        </configuration>
                    </plugin>
                    <plugin>
                        <groupId>com.github.spotbugs</groupId>
                        <artifactId>spotbugs-maven-plugin</artifactId>
                        <version>${spotbugs.plugin.version}</version>
                        <configuration>
                            <effort>Max</effort>
                            <threshold>Medium</threshold>
                            <failOnError>false</failOnError>
                        </configuration>
                    </plugin>

                    <!--
                      japicmp — API breaking-change detector.
                      Compares the current build's public API against the
                      previously-released artifact. Fails
                      verify if a method/class/signature was removed or
                      narrowed (i.e. a binary-incompatible change).

                      Why patch-release-aware: pre-1.0 SemVer convention
                      treats minor bumps as the right place for breaking
                      changes (BREAKING in CHANGELOG → 0.X+1.0). Patch
                      releases must NOT break consumers. The default
                      `breakBuildOnBinaryIncompatibleModifications` set to
                      `${enforce.api.compat}` lets intentional breaking
                      releases bypass with `-Denforce.api.compat=false`.

                      Skipped on the parent + bom modules — they have no
                      Java API. Configured on individual modules via a
                      property check (skip=true when no previous published
                      version exists yet).

                      Issue #203 (release pipeline hardening — 2026-05-02).
                    -->
                    <plugin>
                        <groupId>com.github.siom79.japicmp</groupId>
                        <artifactId>japicmp-maven-plugin</artifactId>
                        <version>${japicmp.plugin.version}</version>
                        <configuration>
                            <oldVersion>
                                <file>
                                    <!--
                                      Bytes from the published repository
                                      via scripts/api-compat-check.sh, not
                                      ~/.m2. Maven RELEASE compared the
                                      build to itself when main kept the
                                      tagged version (TAN-5642 / ADR-018).
                                    -->
                                    <path>${project.build.directory}/japicmp-baseline/${project.artifactId}-${japicmp.baseline.version}.jar</path>
                                </file>
                            </oldVersion>
                            <newVersion>
                                <file>
                                    <path>${project.build.directory}/${project.build.finalName}.jar</path>
                                </file>
                            </newVersion>
                            <parameter>
                                <!--
                                  Toggle: -Denforce.api.compat=false on
                                  intentional minor-bump breaking
                                  releases (per CHANGELOG); otherwise
                                  treat any binary incompatibility as a
                                  build failure.
                                -->
                                <breakBuildOnBinaryIncompatibleModifications>${enforce.api.compat}</breakBuildOnBinaryIncompatibleModifications>
                                <breakBuildOnSourceIncompatibleModifications>false</breakBuildOnSourceIncompatibleModifications>
                                <!-- Bot-friendly output for CI logs -->
                                <onlyModified>true</onlyModified>
                                <skipPomModules>true</skipPomModules>
                                <ignoreMissingClasses>true</ignoreMissingClasses>
                            </parameter>
                            <skip>${japicmp.skip}</skip>
                        </configuration>
                        <executions>
                            <execution>
                                <id>cmp</id>
                                <phase>verify</phase>
                                <goals>
                                    <goal>cmp</goal>
                                </goals>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>

        <!--
          Release profile: sources, javadoc, SBOM and signatures. There is no
          <distributionManagement>; scripts/dry-deploy-validate.sh deploys into
          a local staging tree with -DaltDeploymentRepository and
          scripts/publish-maven-repo.sh uploads that tree to repo.tnsai.dev.
        -->
        <profile>
            <id>release</id>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-source-plugin</artifactId>
                        <version>${maven-source-plugin.version}</version>
                        <executions>
                            <execution>
                                <id>attach-sources</id>
                                <goals>
                                    <goal>jar-no-fork</goal>
                                </goals>
                            </execution>
                        </executions>
                    </plugin>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-javadoc-plugin</artifactId>
                        <executions>
                            <execution>
                                <id>attach-javadocs</id>
                                <goals>
                                    <goal>jar</goal>
                                </goals>
                            </execution>
                        </executions>
                    </plugin>
                    <!--
                      CycloneDX SBOM, attached to every released artifact.

                      Why this is not optional here: GitHub's dependency graph
                      only records *declared* Maven dependencies, so the whole
                      transitive closure (netty, jetty, vertx, bcprov, …) is
                      invisible to Dependabot — it has never raised an alert for
                      any of them and structurally cannot (TAN-5267). An SBOM
                      enumerates the resolved closure, so consumers and scanners
                      (OSV, Grype, Dependency-Track) can see what actually ships.

                      Bound to `package` so the SBOM exists before maven-gpg-plugin
                      signs at `verify` — the signature then covers the SBOM too.
                    -->
                    <plugin>
                        <groupId>org.cyclonedx</groupId>
                        <artifactId>cyclonedx-maven-plugin</artifactId>
                        <version>${cyclonedx-maven-plugin.version}</version>
                        <executions>
                            <execution>
                                <id>attach-sbom</id>
                                <phase>package</phase>
                                <goals>
                                    <goal>makeBom</goal>
                                </goals>
                            </execution>
                        </executions>
                        <configuration>
                            <projectType>library</projectType>
                            <outputFormat>json</outputFormat>
                            <!-- runtime closure: what a consumer actually gets -->
                            <includeCompileScope>true</includeCompileScope>
                            <includeRuntimeScope>true</includeRuntimeScope>
                            <includeProvidedScope>false</includeProvidedScope>
                            <includeTestScope>false</includeTestScope>
                        </configuration>
                    </plugin>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-gpg-plugin</artifactId>
                        <version>${maven-gpg-plugin.version}</version>
                        <executions>
                            <execution>
                                <id>sign-artifacts</id>
                                <phase>verify</phase>
                                <goals>
                                    <goal>sign</goal>
                                </goals>
                                <configuration>
                                    <gpgArguments>
                                        <arg>--pinentry-mode</arg>
                                        <arg>loopback</arg>
                                    </gpgArguments>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>
    </profiles>
</project>
