cartouche

defmodule Cartouche.MixProject do
  use Mix.Project

  def project do
    [
      app: :cartouche,
      version: "0.6.0",
      elixir: "~> 1.17",
      elixirc_paths: elixirc_paths(Mix.env()),
      start_permanent: Mix.env() == :prod,
      deps: deps(),
      aliases: aliases(),
      name: "Cartouche",
      description: "Lightweight Ethereum and Solana RPC client for Elixir",
      source_url: "https://github.com/zenhive/cartouche",
      docs: [
        main: "readme",
        extras: ["README.md", "CHANGELOG.md"],
        # CHANGELOG entries reference hidden generated modules (e.g.
        # `Cartouche.Contract.IConsole`, which has `@moduledoc false`) as
        # historical narrative — not as API documentation. ex_doc otherwise
        # warns and `mix docs --warnings-as-errors` (the pre-commit hook)
        # blocks the commit. Skip on CHANGELOG.md only; README and source
        # docstrings remain strict.
        skip_undefined_reference_warnings_on: ["CHANGELOG.md"]
      ],
      # plt_*_path pin keeps the PLT outside _build/ so CI can cache it
      # independently of the deps cache (which invalidates on mix.lock).
      #
      # plt_add_deps: :apps_direct skips transitive dep recursion (default is
      # :app_tree). Tidewave/bandit's dev-only HTTP stack (plug, finch, mint,
      # gun, cowlib, etc.) is not in lib/'s call graph and bloats the PLT.
      #
      # plt_ignore_apps strips two clusters on top of :apps_direct:
      #   1. Goth — optional runtime auth dependency for the CloudKMS signer.
      #      The signer now calls KMS via Req directly; Goth only mints the
      #      bearer token.
      #   2. Dev-only direct deps (bandit, tidewave) — pulled in via the
      #      `tidewave` mix alias, never called from lib/. Including them
      #      means every Tidewave or Bandit minor bump invalidates the
      #      cartouche PLT, dragging incremental rebuilds back into the
      #      20+ minute range.
      dialyzer: [
        plt_add_deps: :apps_direct,
        plt_local_path: "priv/plts",
        plt_core_path: "priv/plts",
        plt_add_apps: [:mix, :ex_unit],
        plt_ignore_apps: [
          :goth,
          :bandit,
          :tidewave
        ]
      ],
      test_coverage: [ignore_modules: [Cartouche.Contract.IConsole]],
      package: package()
    ]
  end

  # ZenHive dev-branch only: preferred envs for our tooling.
  #
  # ci / precommit / precommit.full pin :test so every step (compile, credo,
  # test.json, dialyzer) runs in one consistent env — dialyzer then builds a
  # `priv/plts/*_deps-test.plt`. CI (harness.yml) keeps its own MIX_ENV=dev
  # dialyzer step with the cached dev PLT; the alias is for local + the harness
  # reviewer's `check_command`, where a single-env run is simpler.
  def cli do
    [
      preferred_envs: [
        "test.json": :test,
        "dialyzer.json": :dev,
        integration: :test,
        ci: :test,
        precommit: :test,
        "precommit.full": :test
      ]
    ]
  end

  defp package do
    [
      files: ["lib", "mix.exs", "README*", "LICENSE*", "CHANGELOG*"],
      maintainers: ["ZenHive"],
      licenses: ["MIT"],
      links: %{
        "GitHub" => "https://github.com/zenhive/cartouche",
        "Changelog" => "https://hexdocs.pm/cartouche/changelog.html"
      }
    ]
  end

  # Run "mix help compile.app" to learn about applications.
  def application do
    [
      mod: {Cartouche.Application, []},
      extra_applications: [:logger]
    ]
  end

  # Specifies which paths to compile per environment.
  defp elixirc_paths(:test), do: ["lib", "test/support"]
  defp elixirc_paths(_), do: ["lib"]

  # Run "mix help deps" to learn about dependencies.
  defp deps do
    [
      # zenhive/dev override: bumped from upstream's ~> 0.31.1 so :reach (needs
      # makeup_elixir ~> 1.0) can resolve. Never cherry-picked into PR branches
      # (they fork from `main` and keep upstream's pin).
      {:ex_doc, "~> 0.40.1", only: :dev, runtime: false},
      {:jason, "~> 1.4.5"},
      # Bumped to ~> 3.1 (2026-05-08). Decimal 3.0 tightens IEEE 754 decimal128
      # bounds (precision 28 → 34, exponent capped at ±6_144, CVE-2026-32686
      # DoS-bounded parsing) and fixes `to_integer("0.0")` infinite loop. No
      # changes to rounding modes, comparison, or normalization semantics —
      # safe for wei/fee token math (uint256 max ~78 digits << 6_178 string
      # cap). See https://github.com/ericmj/decimal/blob/main/CHANGELOG.md.
      {:decimal, "~> 3.1"},
      {:req, "~> 0.6.2 or ~> 0.7"},
      # Test-only intent: Req.Test builds `Plug.Conn`s for the stub plugs that
      # mock cartouche's outbound RPC calls. Req lists plug as optional. Scoped
      # `only: [:dev, :test]` (not `:test`) because the dev-only `tidewave` dep
      # already pulls plug `only: :dev` — a narrower `:only` here fails the
      # env-match check. Still excluded from prod (PLT + published deps).
      {:plug, "~> 1.16", only: [:dev, :test]},
      {:ex_sha3, "~> 0.1.5"},
      {:curvy, "~> 0.3.1"},
      {:goth, "~> 1.4.5", optional: true},
      {:ex_rlp, "~> 0.6.0"},
      # Promoted from transitive (via :hieroglyph) to direct so consumer
      # mix.exs files don't need to add it to use Cartouche.describe/0,1,2.
      # Floor is 0.9.1, not 0.9.0: 0.9.0's runtime @spec→JSON-Schema enrichment
      # crashed (CaseClauseError in json_spec) on the `%{non_neg_integer() =>
      # <<_::256>>}` spec of Solana.Transaction.sign_partial/2, taking down
      # Cartouche.describe/0 and __api__/1. Fixed in descripex 0.9.1.
      {:descripex, "~> 0.11"},
      # Formerly `{:abi, path: "../abi"}`. The fork has been renamed and
      # published on hex.pm as `hieroglyph` 1.0.0 (hex package name only;
      # module namespace remains `ABI`). Switching to hex unblocks
      # `mix hex.publish` here (which rejects path/git deps).
      # `override: true` dropped at publish time — no transitive dep
      # pulls `hieroglyph` or `:abi`, so nothing needs overriding, and
      # hex rejects overrides on published packages.
      {:hieroglyph, "~> 1.5"},
      {:junit_formatter, "~> 3.4.0", only: [:test]}
    ] ++ zenhive_dev_deps()
  end

  # ZenHive dev-branch only. Never merged back to main (tracks upstream).
  # PR branches fork from `main` so these never appear in any upstream diff.
  defp zenhive_dev_deps do
    [
      {:styler, "~> 1.11.0", only: [:dev, :test], runtime: false},
      {:ex_unit_json, "~> 0.6.0", only: [:dev, :test], runtime: false},
      {:dialyzer_json, "~> 0.2.0", only: [:dev, :test], runtime: false},
      {:credo, "~> 1.7.18", only: [:dev, :test], runtime: false},
      {:dialyxir, "~> 1.4.7", only: [:dev, :test], runtime: false},
      {:sobelow, "~> 0.14.1", only: [:dev, :test], runtime: false},
      {:doctor, "~> 0.23.0", only: [:dev, :test], runtime: false},
      {:meck, "~> 1.2.0", only: [:dev, :test], runtime: false},
      {:ex_dna, "~> 1.5.1", only: [:dev, :test], runtime: false},
      {:ex_ast, "~> 0.12", only: [:dev, :test], runtime: false},
      {:ex_slop, "~> 0.4", only: [:dev, :test], runtime: false},
      {:mix_audit, "~> 2.1", only: [:dev, :test], runtime: false},
      {:reach, "~> 2.7", only: [:dev, :test], runtime: false},
      {:tidewave, "~> 0.6", only: :dev},
      {:bandit, "~> 1.12", only: :dev}
      # :boxart intentionally omitted — conflicts with upstream ex_doc 0.31.1
      # (needs makeup_elixir ~> 1.0, ex_doc pulls ~> 0.14). Terminal --graph
      # rendering is optional; text/json output still works for all reach.* tasks.
    ]
  end

  # ZenHive dev-branch only. Tidewave alias — port registered in
  # ~/.claude/tidewave-ports.md. Never merged back to main.
  defp aliases do
    [
      tidewave: [
        "run --no-halt -e 'Agent.start(fn -> Bandit.start_link(plug: Tidewave, port: 4013) end)'"
      ],
      integration: ["test.json --only integration"],
      manifest: ["descripex.manifest --pretty --output api_manifest.json --app cartouche"],
      # Fast local pre-commit loop — skips the cold-PLT dialyzer and full coverage
      # pass so it stays sub-minute on incremental edits.
      precommit: [
        "compile --warnings-as-errors",
        "format --check-formatted",
        "credo --strict --ignore Credo.Check.Design.TagTODO,Credo.Check.Design.TagFIXME",
        "ex_dna --max-clones 0",
        "test.json --exclude integration"
      ],
      # Comprehensive gate — this is the harness reviewer's `check_command` and
      # the `mix ci` target. Mirrors .github/workflows/harness.yml (the tuned CI
      # is still ground truth; harness.yml keeps its own dev-PLT dialyzer step and
      # the sobelow `--mark-skip-all` drift check, which is CI-only bookkeeping).
      "precommit.full": [
        "compile --warnings-as-errors",
        "format --check-formatted",
        "credo --strict --ignore Credo.Check.Design.TagTODO,Credo.Check.Design.TagFIXME",
        "doctor --raise",
        "ex_dna --max-clones 0",
        "reach.check --arch --smells",
        "sobelow --config",
        "test.json --cover --cover-threshold 85 --summary-only --exclude integration",
        "dialyzer"
      ],
      ci: ["precommit.full"]
    ]
  end
end