DID-7743: [SDK-JAVA] Official Java and Kotlin server SDK: complete API surface, webhooks, Authentication, Transactions, generated types and tests

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# The Didit backend team reviews every change.
+* @didit-protocol/backend

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,38 @@
+name: Bug report
+description: Something in the Java or Kotlin SDK does not work as documented.
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Never paste API keys, webhook secrets, tokens or personal data. Security issues go to
+        GitHub private vulnerability reporting or support@didit.me (see SECURITY.md).
+  - type: input
+    id: version
+    attributes:
+      label: SDK version
+      placeholder: 0.1.0
+    validations:
+      required: true
+  - type: input
+    id: runtime
+    attributes:
+      label: Java or Kotlin version and OS
+      placeholder: Java 21, Linux
+    validations:
+      required: true
+  - type: textarea
+    id: what
+    attributes:
+      label: What happened, and what you expected
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Code to reproduce
+      render: java
+  - type: input
+    id: request-id
+    attributes:
+      label: Request id from the error, if any

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Didit support
+    url: mailto:support@didit.me
+    about: Questions about your account, the API or the console.
+  - name: API reference
+    url: https://docs.didit.me
+    about: The documentation of every endpoint.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,14 @@
+name: Feature request
+description: Suggest an improvement to the Java or Kotlin SDK.
+labels: [enhancement]
+body:
+  - type: textarea
+    id: need
+    attributes:
+      label: What you want to do
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: How the SDK could help

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,14 @@
+## What changes
+
+<!-- One or two sentences. Use a conventional commit title: feat:, fix:, chore:, docs:, ... -->
+
+## Checklist
+
+- [ ] Generated code is untouched by hand (`python3 codegen/generate.py --check` passes)
+- [ ] Tests added or updated (`./gradlew build`)
+- [ ] README updated for public API changes
+- [ ] `docs/DESIGN.md` unchanged, or changed in all seven SDK repositories in the same words
+
+## Parity
+
+Parity: same change in the other six SDK repositories (`sdk-python`, `sdk-node`, `sdk-go`, `sdk-php`, `sdk-ruby`, `sdk-dotnet`), or not applicable because ...

.github/dependabot.yml

@@ -0,0 +1,19 @@
+version: 2
+updates:
+  - package-ecosystem: gradle
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      build-tools:
+        patterns: ["*errorprone*", "*nullaway*", "*spotless*", "*google-java-format*", "*kotlin*", "*junit*", "*maven-publish*"]
+      examples:
+        patterns: ["*spring*", "*javalin*", "*ktor*", "*slf4j*"]
+    commit-message:
+      prefix: "chore(deps)"
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "ci(deps)"

.github/workflows/ci.yml

@@ -0,0 +1,139 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: Test (Java ${{ matrix.java }}, ${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest]
+        java: [11, 17, 21, 25]
+        include:
+          - os: macos-latest
+            java: 21
+          - os: windows-latest
+            java: 21
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          distribution: temurin
+          # The compiler and Gradle run on 21; the tests run on the matrix version.
+          java-version: |
+            ${{ matrix.java }}
+            21
+      - uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0
+      - name: Unit, generated, contract, webhook and Authentication tests
+        run: ./gradlew :test "-PtestJavaVersion=${{ matrix.java }}" "-Porg.gradle.java.installations.fromEnv=JAVA_HOME_${{ matrix.java }}_X64,JAVA_HOME_${{ matrix.java }}_ARM64,JAVA_HOME_21_X64,JAVA_HOME_21_ARM64"
+      - name: Core coverage of 90 % or more
+        if: matrix.os == 'ubuntu-latest' && matrix.java == 21
+        run: ./gradlew :jacocoTestCoverageVerification
+
+  checks:
+    name: Static checks, Javadoc and packaging
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          distribution: temurin
+          java-version: 21
+      - uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0
+      - name: Formatting (google-java-format, ktfmt)
+        run: ./gradlew spotlessCheck
+      - name: Compile with -Werror, errorprone and NullAway
+        run: ./gradlew compileJava compileTestJava
+      - name: Javadoc (doclint, warnings as errors)
+        run: ./gradlew javadoc
+      - name: Package the jars and the POM
+        run: ./gradlew publishToMavenLocal
+
+  codegen:
+    name: Generated code is up to date
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+      - name: Generator tests
+        run: python3 -m unittest discover -s codegen/tests -t codegen
+      - name: Regenerate and compare
+        run: python3 codegen/generate.py --check
+
+  examples:
+    name: Examples and Kotlin API tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          distribution: temurin
+          java-version: |
+            17
+            21
+      - uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0
+      - name: Build the examples (Spring Boot, Javalin, Ktor, Kotlin) and run their tests
+        run: ./gradlew :examples:build "-Porg.gradle.java.installations.fromEnv=JAVA_HOME_17_X64,JAVA_HOME_21_X64"
+      - name: Quickstart against the local mock API
+        run: ./gradlew :examples:quickstartDemo "-Porg.gradle.java.installations.fromEnv=JAVA_HOME_17_X64,JAVA_HOME_21_X64"
+
+  secret-scan:
+    name: Secret scan (gitleaks, full history)
+    runs-on: ubuntu-latest
+    env:
+      GITLEAKS_VERSION: 8.30.1
+      GITLEAKS_SHA256: 551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Install gitleaks
+        run: |
+          curl -sSfL -o gitleaks.tar.gz "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
+          echo "${GITLEAKS_SHA256}  gitleaks.tar.gz" | sha256sum -c -
+          tar -xzf gitleaks.tar.gz gitleaks
+      - name: Scan every commit
+        run: ./gitleaks git --config .gitleaks.toml --redact --verbose --no-banner .
+
+  live:
+    name: Live sandbox smoke tests
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          distribution: temurin
+          java-version: 21
+      - uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0
+      - name: Smoke tests (skipped without DIDIT_SANDBOX_API_KEY)
+        env:
+          DIDIT_SANDBOX_API_KEY: ${{ secrets.DIDIT_SANDBOX_API_KEY }}
+          DIDIT_SANDBOX_WORKFLOW_ID: ${{ vars.DIDIT_SANDBOX_WORKFLOW_ID }}
+        run: ./gradlew :liveTest

.github/workflows/release-please.yml

@@ -0,0 +1,79 @@
+# Release plumbing (DESIGN 13). Off until the repository variable RELEASES_ENABLED is "true":
+# nothing is published before Alex approves the first release, and not before 2026-11-01.
+#
+# On each push to main, release-please keeps a release pull request up to date (version bump and
+# CHANGELOG.md from conventional commits). Merging it creates the tag and the GitHub release; the
+# publish job then waits for an approval on the "maven-central" environment, builds, signs and
+# uploads to Maven Central through the Central Portal, and attests the jars (build provenance).
+# Publishing runs in this workflow because a release created with the default token does not
+# start other workflows.
+name: Release
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release
+  cancel-in-progress: false
+
+jobs:
+  release-please:
+    if: vars.RELEASES_ENABLED == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+      issues: write
+    outputs:
+      release_created: ${{ steps.release.outputs.release_created }}
+      tag_name: ${{ steps.release.outputs.tag_name }}
+    steps:
+      - id: release
+        uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
+        with:
+          token: ${{ secrets.RELEASE_PLEASE_TOKEN || github.token }}
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json
+
+  publish:
+    needs: release-please
+    if: needs.release-please.outputs.release_created == 'true'
+    runs-on: ubuntu-latest
+    environment: maven-central
+    permissions:
+      contents: read
+      id-token: write
+      attestations: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ needs.release-please.outputs.tag_name }}
+          persist-credentials: false
+      - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          distribution: temurin
+          java-version: 21
+      - uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0
+      - name: Check the tag matches the library version
+        run: |
+          version=$(grep '^version=' gradle.properties | cut -d= -f2)
+          grep -q "VERSION = \"${version}\"" src/main/java/me/didit/core/Version.java
+          test "v${version}" = "${{ needs.release-please.outputs.tag_name }}"
+      - name: Test
+        run: ./gradlew check
+      - name: Sign and upload to Maven Central
+        env:
+          ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
+          ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
+          ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.MAVEN_SIGNING_KEY }}
+          ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.MAVEN_SIGNING_KEY_PASSWORD }}
+        run: ./gradlew publishAndReleaseToMavenCentral --no-configuration-cache
+      - name: Attest the published jars
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        with:
+          subject-path: build/libs/*.jar