buildscript {
    ext.safeExtGet = {prop, fallback ->
        rootProject.ext.has(prop) ? rootProject.ext.get(prop) : fallback
    }
}

apply plugin: 'com.android.library'
apply plugin: 'kotlin-android'

android {
    namespace "com.usesense.reactnative"
    compileSdkVersion safeExtGet('compileSdkVersion', 34)

    defaultConfig {
        // 28, matching the native ai.usesense:sdk requirement (minSdk 28 since
        // SDK v4.1). A lower value fails a consuming app's release manifest merge
        // against the SDK's own minSdk. Consuming apps must set minSdkVersion 28.
        minSdkVersion safeExtGet('minSdkVersion', 28)
        targetSdkVersion safeExtGet('targetSdkVersion', 34)
    }

    compileOptions {
        sourceCompatibility JavaVersion.VERSION_17
        targetCompatibility JavaVersion.VERSION_17
    }

    kotlinOptions {
        jvmTarget = "17"
    }
}

repositories {
    mavenCentral()
    mavenLocal()
    google()
}

dependencies {
    implementation "com.facebook.react:react-native:+"

    // UseSense Android SDK — published to Maven Central at
    // central.sonatype.com/artifact/ai.usesense/sdk. 4.6.5 is the floor:
    // earlier builds could hang forever on "Finalizing Enrollment" because
    // the Play Integrity token request had no timeout and the signal upload
    // joined it unbounded, wedging the verification before a single request
    // was sent. mavenCentral() is already in the `repositories` block above.
    // 4.6.6 is the floor: below it an upload that arrived incomplete was
    // reported as `provider`, so the runner told a subject holding a perfectly
    // good document that verification was "temporarily unavailable" and
    // offered a retry that re-sent identical bytes.
    // 4.6.7 is the floor: from it the runner reports whether the subject
    // scanned the document or chose a file, so failure guidance can name an
    // action they can actually take. Below it the server guesses from config.
    // 4.7.0 is the floor: below it frames_manifest reported a hardcoded
    // 640x480 regardless of what was captured. That is right for the legacy
    // path but wrong for v4, which captures 1280x720, and the server now
    // scales its screen-replay sharpness thresholds off that value, so
    // under-reporting made spoof detection more permissive on the better
    // capture path. 4.7.0 reports the real encoded size, caps frames at 960,
    // gzips the metadata, raises the 30s upload write timeout to 300s, and
    // emits real upload progress.
    // 4.8.0 is the floor: below it the Android SDK never ran its face mesh
    // pipeline, so no session uploaded a verification_package and the server
    // could not verify mesh integrity (it now excludes mesh for older Android
    // SDKs and applies the org's mesh policy from 4.8.0).
    // 4.9.0 is the floor: it adds server step-up round 2 (a second challenge
    // in the same session when a Step-up rule matches) and the camera-free
    // Device Trust step. Below it a step-up falls back to manual review and a
    // Device Trust step is settled from the network alone.
    // 4.9.1: capture screens take the org brand colour; a nonce-less
    // Device Trust step is re-read once, then fails cleanly.
    implementation "ai.usesense:sdk:4.9.2"

    implementation "org.jetbrains.kotlin:kotlin-stdlib:${safeExtGet('kotlinVersion', '2.0.0')}"
}