<Project Sdk="Microsoft.NET.Sdk">

  <PropertyGroup>
    <TargetFramework>net10.0</TargetFramework>
    <ImplicitUsings>enable</ImplicitUsings>
    <Nullable>enable</Nullable>
    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
  </PropertyGroup>

  <ItemGroup>
    <FrameworkReference Include="Microsoft.AspNetCore.App" />
  </ItemGroup>

  <ItemGroup>
    <ProjectReference Include="../ZB.MOM.WW.ScadaBridge.Commons/ZB.MOM.WW.ScadaBridge.Commons.csproj" />
    <ProjectReference Include="../ZB.MOM.WW.ScadaBridge.Communication/ZB.MOM.WW.ScadaBridge.Communication.csproj" />
    <!-- AuditWriteMiddleware reads AuditLogOptions.InboundMaxBytes to bound
         per-request request/response audit capture at the source. -->
    <ProjectReference Include="../ZB.MOM.WW.ScadaBridge.AuditLog/ZB.MOM.WW.ScadaBridge.AuditLog.csproj" />
  </ItemGroup>

  <ItemGroup>
    <InternalsVisibleTo Include="ZB.MOM.WW.ScadaBridge.InboundAPI.Tests" />
  </ItemGroup>

  <ItemGroup>
    <PackageReference Include="Microsoft.CodeAnalysis.CSharp.Scripting" />
    <!-- Inbound-API auth re-arch (A+B): the POST /api/{methodName} auth path is
         served by the shared ZB.MOM.WW.Auth.ApiKeys verifier (Bearer sbk_<keyId>_<secret>,
         scope = method name) instead of the legacy peppered-HMAC X-API-Key path.
         AddZbApiKeyAuth (DI helper) lives in this package and brings the
         Abstractions contracts (IApiKeyVerifier / ApiKeyOptions) transitively. -->
    <PackageReference Include="ZB.MOM.WW.Auth.ApiKeys" />
  </ItemGroup>

</Project>
