build.gradle.kts

import org.jetbrains.kotlin.gradle.targets.wasm.yarn.WasmYarnPlugin
import org.jetbrains.kotlin.gradle.targets.wasm.yarn.WasmYarnRootExtension

plugins {
    alias(libs.plugins.android.kotlin.multiplatform.library) apply false
    alias(libs.plugins.androidApplication) apply false
    alias(libs.plugins.kotlinMultiplatform) apply false
    alias(libs.plugins.composeMultiplatform) apply false
    alias(libs.plugins.composeCompiler) apply false
    alias(libs.plugins.vanniktech.mavenPublish) apply false
    alias(libs.plugins.spotless) apply false
    alias(libs.plugins.detekt) apply false
    alias(libs.plugins.bcv) apply false
    // Applied at the root so docs and coverage can aggregate across the published modules.
    alias(libs.plugins.dokka)
    alias(libs.plugins.kover)
}

// ---------------------------------------------------------------------------
// Aggregate API docs (Dokka) and coverage (Kover) across the published library
// modules. The ≥80% coverage gate is enforced on the merged report so that
// thinly-unit-tested transport modules don't each need to clear the bar alone.
// ---------------------------------------------------------------------------
val publishedLibraryModules = listOf(":core", ":transport-tcp", ":transport-ws")

dependencies {
    publishedLibraryModules.forEach {
        dokka(project(it))
        kover(project(it))
    }
}

kover {
    reports {
        total {
            xml {
                onCheck = false
            }
        }
        verify {
            rule {
                minBound(80)
            }
        }
    }
}

// ---------------------------------------------------------------------------
// Security: pin the transitive npm `ws` dependency to a patched version.
// The wasmJs target's JS dev/test toolchain (webpack-dev-server / karma) pulls
// in `ws`, which Kotlin otherwise resolves to a vulnerable version:
//   - uninitialized-memory disclosure (GHSA-58qx-3vcg-4xpx; fixed in 8.20.1)
//   - memory-exhaustion DoS via tiny fragments   (fixed in 8.21.0)
// The wasmJs target uses its own Yarn store (kotlin-js-store/wasm/yarn.lock),
// so the override targets the Wasm Yarn plugin/extension — not the JS one.
// After changing this pin, regenerate the lockfile with:
//   ./gradlew kotlinWasmUpgradeYarnLock
// ---------------------------------------------------------------------------
plugins.withType<WasmYarnPlugin> {
    the<WasmYarnRootExtension>().resolution("ws", "8.21.0")
}