Description

<dependency>
    <groupId>ai.evalguard</groupId>
    <artifactId>evalguard-sdk</artifactId>
    <version>1.1.0</version>
</dependency>

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>ai.evalguard</groupId>
    <artifactId>evalguard-sdk</artifactId>
    <!-- Bumped 2026-05-16: 0.1.0 → 1.0.0 to match the User-Agent
         hard-coded in EvalGuardClient.java line 51 and to reflect
         the feature-complete status (Evals/Security/Traces/Firewall/
         Monitoring/FinOps/Compliance/Prompts/Datasets/Gateway/
         Benchmarks/Webhooks/Audit/AI SBOM/Threat Intel/Annotations,
         retry+backoff+Retry-After). Published to Maven Central under
         ai.evalguard:evalguard-sdk (1.0.0/1.0.1/1.0.2/1.0.3 all live as of
         2026-07-16; 1.0.4 = E2E contract-drift fixes, republished by the
         founder via the publish-java-sdk CI job on the self-hosted runner).
         Verify live versions at repo1.maven.org/maven2/ai/evalguard/
         evalguard-sdk/maven-metadata.xml. Keep <version> in lockstep with
         USER_AGENT in EvalGuardClient.java.

         2026-08-02: was 1.0.8 — the version ALREADY on Maven Central, and this
         tree is NOT what Central serves as 1.0.8. Verified by diffing the
         published `evalguard-sdk-1.0.8-sources.jar` against src/main/java:
         5 of 8 published sources differ, SecretRedactor.java is new, and the
         published POM pins jackson 2.18.8 while this one pins 2.18.9 (an
         unreleased CVE-patch bump, commit ccbf7aec2). Both builds report
         `evalguard-java/1.0.8` in User-Agent, which is exactly why the drift
         went unnoticed.

         MINOR, not PATCH: the tree carries a deliberate behaviour change since
         1.0.8 — FirewallCheckResult.blocked is now boxed, so a 200 carrying no
         verdict BLOCKS instead of silently reading as "allowed" (see the DTO's
         javadoc and EvalGuardContentFilterFailClosedTest) — plus new public API
         (hasVerdict(), SecretRedactor, GatewayStats, DriftSummary,
         CostDailyPoint). No public type was removed; GatewayStatsResponse is
         retained as an alias, so the jar stays binary-compatible.

         Publishing remains a separate, human act: publish-java-sdk.yml fires
         only on a pushed `java-sdk-v*` tag. Editing this line ships nothing. -->
    <version>1.1.0</version>
    <packaging>jar</packaging>

    <name>EvalGuard Java SDK</name>
    <description>Java SDK for EvalGuard — evaluate, red-team, and guard LLM applications</description>
    <url>https://evalguard.ai</url>

    <licenses>
        <license>
            <name>Apache License, Version 2.0</name>
            <url>https://www.apache.org/licenses/LICENSE-2.0</url>
            <distribution>repo</distribution>
        </license>
    </licenses>

    <developers>
        <developer>
            <id>evalguard</id>
            <name>EvalGuard</name>
            <email>support@evalguard.ai</email>
            <organization>EvalGuard</organization>
            <organizationUrl>https://evalguard.ai</organizationUrl>
        </developer>
    </developers>

    <scm>
        <connection>scm:git:git://github.com/EvalGuardAi/evalguard.git</connection>
        <developerConnection>scm:git:ssh://github.com:EvalGuardAi/evalguard.git</developerConnection>
        <url>https://github.com/EvalGuardAi/evalguard/tree/main/packages/java-sdk</url>
        <tag>HEAD</tag>
    </scm>

    <properties>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <maven.compiler.source>17</maven.compiler.source>
        <maven.compiler.target>17</maven.compiler.target>
        <jackson.version>2.18.9</jackson.version>
        <slf4j.version>2.0.16</slf4j.version>
        <langchain4j.version>0.36.2</langchain4j.version>
        <spring.boot.version>3.3.13</spring.boot.version>
        <spring.ai.version>1.0.7</spring.ai.version>
        <junit.version>5.11.3</junit.version>
        <mockito.version>5.14.2</mockito.version>
    </properties>

    <dependencies>
        <!-- Core JSON handling -->
        <dependency>
            <groupId>com.fasterxml.jackson.core</groupId>
            <artifactId>jackson-databind</artifactId>
            <version>${jackson.version}</version>
        </dependency>
        <dependency>
            <groupId>com.fasterxml.jackson.core</groupId>
            <artifactId>jackson-annotations</artifactId>
            <version>${jackson.version}</version>
        </dependency>
        <!-- Java 8 date/time module — EvalGuardClient registers JavaTimeModule.
             Was missing → compilation failed (caught by the 2026-06-08 dry-run). -->
        <dependency>
            <groupId>com.fasterxml.jackson.datatype</groupId>
            <artifactId>jackson-datatype-jsr310</artifactId>
            <version>${jackson.version}</version>
        </dependency>

        <!-- Logging API (users bring their own binding) -->
        <dependency>
            <groupId>org.slf4j</groupId>
            <artifactId>slf4j-api</artifactId>
            <version>${slf4j.version}</version>
        </dependency>

        <!-- Optional integration: langchain4j (marked optional; users opt-in) -->
        <dependency>
            <groupId>dev.langchain4j</groupId>
            <artifactId>langchain4j-core</artifactId>
            <version>${langchain4j.version}</version>
            <optional>true</optional>
        </dependency>

        <!-- Optional integration: Spring Boot autoconfigure (users opt-in) -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-autoconfigure</artifactId>
            <version>${spring.boot.version}</version>
            <optional>true</optional>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-web</artifactId>
            <version>6.1.21</version>
            <optional>true</optional>
        </dependency>
        <!-- Optional integration: Spring AI advisor (EvalGuardInterceptor /
             EvalGuardGuardrailAdvisor). Was missing → compilation failed.
             NOTE: the source mixes GA + pre-1.0 advisor API names and may need
             reconciliation against this version (dry-run will confirm). -->
        <dependency>
            <groupId>org.springframework.ai</groupId>
            <artifactId>spring-ai-client-chat</artifactId>
            <version>${spring.ai.version}</version>
            <optional>true</optional>
        </dependency>

        <!-- Test scope -->
        <dependency>
            <groupId>org.junit.jupiter</groupId>
            <artifactId>junit-jupiter</artifactId>
            <version>${junit.version}</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.mockito</groupId>
            <artifactId>mockito-core</artifactId>
            <version>${mockito.version}</version>
            <scope>test</scope>
        </dependency>
    </dependencies>

    <build>
        <resources>
            <resource>
                <directory>src/main/resources</directory>
                <!-- 1.0.5: the Spring Boot auto-config class
                     (ai.evalguard.spring.EvalGuardAutoConfiguration) is WIP-gated and
                     excluded from compilation below (drifted Spring AI API), so its
                     AutoConfiguration.imports marker MUST NOT ship: Spring Boot scans every
                     such file on the classpath at startup and fails the application context
                     when the referenced class is absent — this broke EVERY Spring Boot 3.x app
                     that merely had the 1.0.4 jar present. Re-include this resource only when
                     the spring/* adapters are un-excluded and compiled. -->
                <excludes>
                    <exclude>META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports</exclude>
                </excludes>
            </resource>
        </resources>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <version>3.13.0</version>
                <configuration>
                    <!-- WIP-gated 2026-06-08: these 3 integration adapters were written
                         against API versions that have since drifted and do NOT compile —
                         Spring AI renamed CallAroundAdvisorChain -> CallAdvisorChain (and
                         changed the adviseCall signature) in 1.0 GA, and langchain4j 0.36.2
                         has symbol mismatches in the model listener. The CORE EvalGuardClient
                         and the langchain4j EvalGuardContentFilter compile and ship. Reconcile
                         these against pinned API versions and re-include them (do it with a
                         local JVM — far faster than CI dry-runs). See PUBLISHING.md. -->
                    <excludes>
                        <exclude>**/spring/*.java</exclude>
                        <exclude>**/langchain4j/EvalGuardChatModelListener.java</exclude>
                    </excludes>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-surefire-plugin</artifactId>
                <version>3.5.2</version>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-source-plugin</artifactId>
                <version>3.3.1</version>
                <executions>
                    <execution>
                        <id>attach-sources</id>
                        <goals><goal>jar-no-fork</goal></goals>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-javadoc-plugin</artifactId>
                <version>3.11.2</version>
                <executions>
                    <execution>
                        <id>attach-javadocs</id>
                        <goals><goal>jar</goal></goals>
                    </execution>
                </executions>
                <configuration>
                    <doclint>none</doclint>
                    <!-- The WIP-gated adapters excluded from compilation must also be
                         excluded from javadoc, else attach-javadocs fails resolving their
                         drifted Spring AI / langchain4j symbols (caught by dry-run #3). -->
                    <sourceFileExcludes>
                        <sourceFileExclude>**/spring/*.java</sourceFileExclude>
                        <sourceFileExclude>**/langchain4j/EvalGuardChatModelListener.java</sourceFileExclude>
                    </sourceFileExcludes>
                </configuration>
            </plugin>
        </plugins>
    </build>

    <!-- No <distributionManagement> needed: the central-publishing-maven-plugin
         (release profile below) uploads the signed bundle directly to the Sonatype
         Central Portal. Legacy OSSRH (s01.oss.sonatype.org) was sunset 2025-06-30. -->


    <profiles>
        <profile>
            <id>release</id>
            <build>
                <plugins>
                    <!-- GPG signing — required for Maven Central -->
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-gpg-plugin</artifactId>
                        <version>3.2.7</version>
                        <executions>
                            <execution>
                                <id>sign-artifacts</id>
                                <phase>verify</phase>
                                <goals><goal>sign</goal></goals>
                                <configuration>
                                    <gpgArguments>
                                        <arg>--pinentry-mode</arg>
                                        <arg>loopback</arg>
                                    </gpgArguments>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>

                    <!-- Publish to Maven Central via the Sonatype Central Portal
                         (replaces legacy OSSRH/nexus-staging, sunset 2025-06-30).
                         Reads credentials from the Maven settings server id `central`
                         (wired by setup-java in publish-java-sdk.yml). autoPublish
                         releases automatically once validation passes; set it to false
                         to require a manual "Publish" click on the first release. -->
                    <plugin>
                        <groupId>org.sonatype.central</groupId>
                        <artifactId>central-publishing-maven-plugin</artifactId>
                        <!-- 0.11.0: 0.7.0 crashed deserializing the Central API
                             response after upload (Unrecognized field "warnings"),
                             reporting BUILD FAILURE even though 1.0.0/1.0.1 both
                             published fine. 0.8.0+ tolerates the new field. -->
                        <version>0.11.0</version>
                        <extensions>true</extensions>
                        <configuration>
                            <publishingServerId>central</publishingServerId>
                            <autoPublish>true</autoPublish>
                            <waitUntil>published</waitUntil>
                        </configuration>
                    </plugin>
                </plugins>
            </build>
        </profile>
    </profiles>
</project>