diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..03f1a68
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,32 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: main
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        java: ['11', '17', '21']
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: ${{ matrix.java }}
+          cache: maven
+
+      - name: Run tests
+        run: ./mvnw test -B
diff --git a/.mvn/wrapper/maven-wrapper.properties b/.mvn/wrapper/maven-wrapper.properties
new file mode 100644
index 0000000..ffcab66
--- /dev/null
+++ b/.mvn/wrapper/maven-wrapper.properties
@@ -0,0 +1,3 @@
+wrapperVersion=3.3.4
+distributionType=only-script
+distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.9/apache-maven-3.9.9-bin.zip
diff --git a/.tool-versions b/.tool-versions
new file mode 100644
index 0000000..8c4e8ae
--- /dev/null
+++ b/.tool-versions
@@ -0,0 +1,2 @@
+java temurin-11.0.30+7
+maven 3.9.9
diff --git a/mvnw b/mvnw
new file mode 100755
index 0000000..bd8896b
--- /dev/null
+++ b/mvnw
@@ -0,0 +1,295 @@
+#!/bin/sh
+# ----------------------------------------------------------------------------
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+# ----------------------------------------------------------------------------
+
+# ----------------------------------------------------------------------------
+# Apache Maven Wrapper startup batch script, version 3.3.4
+#
+# Optional ENV vars
+# -----------------
+#   JAVA_HOME - location of a JDK home dir, required when download maven via java source
+#   MVNW_REPOURL - repo url base for downloading maven distribution
+#   MVNW_USERNAME/MVNW_PASSWORD - user and password for downloading maven
+#   MVNW_VERBOSE - true: enable verbose log; debug: trace the mvnw script; others: silence the output
+# ----------------------------------------------------------------------------
+
+set -euf
+[ "${MVNW_VERBOSE-}" != debug ] || set -x
+
+# OS specific support.
+native_path() { printf %s\\n "$1"; }
+case "$(uname)" in
+CYGWIN* | MINGW*)
+  [ -z "${JAVA_HOME-}" ] || JAVA_HOME="$(cygpath --unix "$JAVA_HOME")"
+  native_path() { cygpath --path --windows "$1"; }
+  ;;
+esac
+
+# set JAVACMD and JAVACCMD
+set_java_home() {
+  # For Cygwin and MinGW, ensure paths are in Unix format before anything is touched
+  if [ -n "${JAVA_HOME-}" ]; then
+    if [ -x "$JAVA_HOME/jre/sh/java" ]; then
+      # IBM's JDK on AIX uses strange locations for the executables
+      JAVACMD="$JAVA_HOME/jre/sh/java"
+      JAVACCMD="$JAVA_HOME/jre/sh/javac"
+    else
+      JAVACMD="$JAVA_HOME/bin/java"
+      JAVACCMD="$JAVA_HOME/bin/javac"
+
+      if [ ! -x "$JAVACMD" ] || [ ! -x "$JAVACCMD" ]; then
+        echo "The JAVA_HOME environment variable is not defined correctly, so mvnw cannot run." >&2
+        echo "JAVA_HOME is set to \"$JAVA_HOME\", but \"\$JAVA_HOME/bin/java\" or \"\$JAVA_HOME/bin/javac\" does not exist." >&2
+        return 1
+      fi
+    fi
+  else
+    JAVACMD="$(
+      'set' +e
+      'unset' -f command 2>/dev/null
+      'command' -v java
+    )" || :
+    JAVACCMD="$(
+      'set' +e
+      'unset' -f command 2>/dev/null
+      'command' -v javac
+    )" || :
+
+    if [ ! -x "${JAVACMD-}" ] || [ ! -x "${JAVACCMD-}" ]; then
+      echo "The java/javac command does not exist in PATH nor is JAVA_HOME set, so mvnw cannot run." >&2
+      return 1
+    fi
+  fi
+}
+
+# hash string like Java String::hashCode
+hash_string() {
+  str="${1:-}" h=0
+  while [ -n "$str" ]; do
+    char="${str%"${str#?}"}"
+    h=$(((h * 31 + $(LC_CTYPE=C printf %d "'$char")) % 4294967296))
+    str="${str#?}"
+  done
+  printf %x\\n $h
+}
+
+verbose() { :; }
+[ "${MVNW_VERBOSE-}" != true ] || verbose() { printf %s\\n "${1-}"; }
+
+die() {
+  printf %s\\n "$1" >&2
+  exit 1
+}
+
+trim() {
+  # MWRAPPER-139:
+  #   Trims trailing and leading whitespace, carriage returns, tabs, and linefeeds.
+  #   Needed for removing poorly interpreted newline sequences when running in more
+  #   exotic environments such as mingw bash on Windows.
+  printf "%s" "${1}" | tr -d '[:space:]'
+}
+
+scriptDir="$(dirname "$0")"
+scriptName="$(basename "$0")"
+
+# parse distributionUrl and optional distributionSha256Sum, requires .mvn/wrapper/maven-wrapper.properties
+while IFS="=" read -r key value; do
+  case "${key-}" in
+  distributionUrl) distributionUrl=$(trim "${value-}") ;;
+  distributionSha256Sum) distributionSha256Sum=$(trim "${value-}") ;;
+  esac
+done <"$scriptDir/.mvn/wrapper/maven-wrapper.properties"
+[ -n "${distributionUrl-}" ] || die "cannot read distributionUrl property in $scriptDir/.mvn/wrapper/maven-wrapper.properties"
+
+case "${distributionUrl##*/}" in
+maven-mvnd-*bin.*)
+  MVN_CMD=mvnd.sh _MVNW_REPO_PATTERN=/maven/mvnd/
+  case "${PROCESSOR_ARCHITECTURE-}${PROCESSOR_ARCHITEW6432-}:$(uname -a)" in
+  *AMD64:CYGWIN* | *AMD64:MINGW*) distributionPlatform=windows-amd64 ;;
+  :Darwin*x86_64) distributionPlatform=darwin-amd64 ;;
+  :Darwin*arm64) distributionPlatform=darwin-aarch64 ;;
+  :Linux*x86_64*) distributionPlatform=linux-amd64 ;;
+  *)
+    echo "Cannot detect native platform for mvnd on $(uname)-$(uname -m), use pure java version" >&2
+    distributionPlatform=linux-amd64
+    ;;
+  esac
+  distributionUrl="${distributionUrl%-bin.*}-$distributionPlatform.zip"
+  ;;
+maven-mvnd-*) MVN_CMD=mvnd.sh _MVNW_REPO_PATTERN=/maven/mvnd/ ;;
+*) MVN_CMD="mvn${scriptName#mvnw}" _MVNW_REPO_PATTERN=/org/apache/maven/ ;;
+esac
+
+# apply MVNW_REPOURL and calculate MAVEN_HOME
+# maven home pattern: ~/.m2/wrapper/dists/{apache-maven-<version>,maven-mvnd-<version>-<platform>}/<hash>
+[ -z "${MVNW_REPOURL-}" ] || distributionUrl="$MVNW_REPOURL$_MVNW_REPO_PATTERN${distributionUrl#*"$_MVNW_REPO_PATTERN"}"
+distributionUrlName="${distributionUrl##*/}"
+distributionUrlNameMain="${distributionUrlName%.*}"
+distributionUrlNameMain="${distributionUrlNameMain%-bin}"
+MAVEN_USER_HOME="${MAVEN_USER_HOME:-${HOME}/.m2}"
+MAVEN_HOME="${MAVEN_USER_HOME}/wrapper/dists/${distributionUrlNameMain-}/$(hash_string "$distributionUrl")"
+
+exec_maven() {
+  unset MVNW_VERBOSE MVNW_USERNAME MVNW_PASSWORD MVNW_REPOURL || :
+  exec "$MAVEN_HOME/bin/$MVN_CMD" "$@" || die "cannot exec $MAVEN_HOME/bin/$MVN_CMD"
+}
+
+if [ -d "$MAVEN_HOME" ]; then
+  verbose "found existing MAVEN_HOME at $MAVEN_HOME"
+  exec_maven "$@"
+fi
+
+case "${distributionUrl-}" in
+*?-bin.zip | *?maven-mvnd-?*-?*.zip) ;;
+*) die "distributionUrl is not valid, must match *-bin.zip or maven-mvnd-*.zip, but found '${distributionUrl-}'" ;;
+esac
+
+# prepare tmp dir
+if TMP_DOWNLOAD_DIR="$(mktemp -d)" && [ -d "$TMP_DOWNLOAD_DIR" ]; then
+  clean() { rm -rf -- "$TMP_DOWNLOAD_DIR"; }
+  trap clean HUP INT TERM EXIT
+else
+  die "cannot create temp dir"
+fi
+
+mkdir -p -- "${MAVEN_HOME%/*}"
+
+# Download and Install Apache Maven
+verbose "Couldn't find MAVEN_HOME, downloading and installing it ..."
+verbose "Downloading from: $distributionUrl"
+verbose "Downloading to: $TMP_DOWNLOAD_DIR/$distributionUrlName"
+
+# select .zip or .tar.gz
+if ! command -v unzip >/dev/null; then
+  distributionUrl="${distributionUrl%.zip}.tar.gz"
+  distributionUrlName="${distributionUrl##*/}"
+fi
+
+# verbose opt
+__MVNW_QUIET_WGET=--quiet __MVNW_QUIET_CURL=--silent __MVNW_QUIET_UNZIP=-q __MVNW_QUIET_TAR=''
+[ "${MVNW_VERBOSE-}" != true ] || __MVNW_QUIET_WGET='' __MVNW_QUIET_CURL='' __MVNW_QUIET_UNZIP='' __MVNW_QUIET_TAR=v
+
+# normalize http auth
+case "${MVNW_PASSWORD:+has-password}" in
+'') MVNW_USERNAME='' MVNW_PASSWORD='' ;;
+has-password) [ -n "${MVNW_USERNAME-}" ] || MVNW_USERNAME='' MVNW_PASSWORD='' ;;
+esac
+
+if [ -z "${MVNW_USERNAME-}" ] && command -v wget >/dev/null; then
+  verbose "Found wget ... using wget"
+  wget ${__MVNW_QUIET_WGET:+"$__MVNW_QUIET_WGET"} "$distributionUrl" -O "$TMP_DOWNLOAD_DIR/$distributionUrlName" || die "wget: Failed to fetch $distributionUrl"
+elif [ -z "${MVNW_USERNAME-}" ] && command -v curl >/dev/null; then
+  verbose "Found curl ... using curl"
+  curl ${__MVNW_QUIET_CURL:+"$__MVNW_QUIET_CURL"} -f -L -o "$TMP_DOWNLOAD_DIR/$distributionUrlName" "$distributionUrl" || die "curl: Failed to fetch $distributionUrl"
+elif set_java_home; then
+  verbose "Falling back to use Java to download"
+  javaSource="$TMP_DOWNLOAD_DIR/Downloader.java"
+  targetZip="$TMP_DOWNLOAD_DIR/$distributionUrlName"
+  cat >"$javaSource" <<-END
+	public class Downloader extends java.net.Authenticator
+	{
+	  protected java.net.PasswordAuthentication getPasswordAuthentication()
+	  {
+	    return new java.net.PasswordAuthentication( System.getenv( "MVNW_USERNAME" ), System.getenv( "MVNW_PASSWORD" ).toCharArray() );
+	  }
+	  public static void main( String[] args ) throws Exception
+	  {
+	    setDefault( new Downloader() );
+	    java.nio.file.Files.copy( java.net.URI.create( args[0] ).toURL().openStream(), java.nio.file.Paths.get( args[1] ).toAbsolutePath().normalize() );
+	  }
+	}
+	END
+  # For Cygwin/MinGW, switch paths to Windows format before running javac and java
+  verbose " - Compiling Downloader.java ..."
+  "$(native_path "$JAVACCMD")" "$(native_path "$javaSource")" || die "Failed to compile Downloader.java"
+  verbose " - Running Downloader.java ..."
+  "$(native_path "$JAVACMD")" -cp "$(native_path "$TMP_DOWNLOAD_DIR")" Downloader "$distributionUrl" "$(native_path "$targetZip")"
+fi
+
+# If specified, validate the SHA-256 sum of the Maven distribution zip file
+if [ -n "${distributionSha256Sum-}" ]; then
+  distributionSha256Result=false
+  if [ "$MVN_CMD" = mvnd.sh ]; then
+    echo "Checksum validation is not supported for maven-mvnd." >&2
+    echo "Please disable validation by removing 'distributionSha256Sum' from your maven-wrapper.properties." >&2
+    exit 1
+  elif command -v sha256sum >/dev/null; then
+    if echo "$distributionSha256Sum  $TMP_DOWNLOAD_DIR/$distributionUrlName" | sha256sum -c - >/dev/null 2>&1; then
+      distributionSha256Result=true
+    fi
+  elif command -v shasum >/dev/null; then
+    if echo "$distributionSha256Sum  $TMP_DOWNLOAD_DIR/$distributionUrlName" | shasum -a 256 -c >/dev/null 2>&1; then
+      distributionSha256Result=true
+    fi
+  else
+    echo "Checksum validation was requested but neither 'sha256sum' or 'shasum' are available." >&2
+    echo "Please install either command, or disable validation by removing 'distributionSha256Sum' from your maven-wrapper.properties." >&2
+    exit 1
+  fi
+  if [ $distributionSha256Result = false ]; then
+    echo "Error: Failed to validate Maven distribution SHA-256, your Maven distribution might be compromised." >&2
+    echo "If you updated your Maven version, you need to update the specified distributionSha256Sum property." >&2
+    exit 1
+  fi
+fi
+
+# unzip and move
+if command -v unzip >/dev/null; then
+  unzip ${__MVNW_QUIET_UNZIP:+"$__MVNW_QUIET_UNZIP"} "$TMP_DOWNLOAD_DIR/$distributionUrlName" -d "$TMP_DOWNLOAD_DIR" || die "failed to unzip"
+else
+  tar xzf${__MVNW_QUIET_TAR:+"$__MVNW_QUIET_TAR"} "$TMP_DOWNLOAD_DIR/$distributionUrlName" -C "$TMP_DOWNLOAD_DIR" || die "failed to untar"
+fi
+
+# Find the actual extracted directory name (handles snapshots where filename != directory name)
+actualDistributionDir=""
+
+# First try the expected directory name (for regular distributions)
+if [ -d "$TMP_DOWNLOAD_DIR/$distributionUrlNameMain" ]; then
+  if [ -f "$TMP_DOWNLOAD_DIR/$distributionUrlNameMain/bin/$MVN_CMD" ]; then
+    actualDistributionDir="$distributionUrlNameMain"
+  fi
+fi
+
+# If not found, search for any directory with the Maven executable (for snapshots)
+if [ -z "$actualDistributionDir" ]; then
+  # enable globbing to iterate over items
+  set +f
+  for dir in "$TMP_DOWNLOAD_DIR"/*; do
+    if [ -d "$dir" ]; then
+      if [ -f "$dir/bin/$MVN_CMD" ]; then
+        actualDistributionDir="$(basename "$dir")"
+        break
+      fi
+    fi
+  done
+  set -f
+fi
+
+if [ -z "$actualDistributionDir" ]; then
+  verbose "Contents of $TMP_DOWNLOAD_DIR:"
+  verbose "$(ls -la "$TMP_DOWNLOAD_DIR")"
+  die "Could not find Maven distribution directory in extracted archive"
+fi
+
+verbose "Found extracted Maven distribution directory: $actualDistributionDir"
+printf %s\\n "$distributionUrl" >"$TMP_DOWNLOAD_DIR/$actualDistributionDir/mvnw.url"
+mv -- "$TMP_DOWNLOAD_DIR/$actualDistributionDir" "$MAVEN_HOME" || [ -d "$MAVEN_HOME" ] || die "fail to move MAVEN_HOME"
+
+clean || :
+exec_maven "$@"
diff --git a/mvnw.cmd b/mvnw.cmd
new file mode 100644
index 0000000..5761d94
--- /dev/null
+++ b/mvnw.cmd
@@ -0,0 +1,189 @@
+<# : batch portion
+@REM ----------------------------------------------------------------------------
+@REM Licensed to the Apache Software Foundation (ASF) under one
+@REM or more contributor license agreements.  See the NOTICE file
+@REM distributed with this work for additional information
+@REM regarding copyright ownership.  The ASF licenses this file
+@REM to you under the Apache License, Version 2.0 (the
+@REM "License"); you may not use this file except in compliance
+@REM with the License.  You may obtain a copy of the License at
+@REM
+@REM    http://www.apache.org/licenses/LICENSE-2.0
+@REM
+@REM Unless required by applicable law or agreed to in writing,
+@REM software distributed under the License is distributed on an
+@REM "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+@REM KIND, either express or implied.  See the License for the
+@REM specific language governing permissions and limitations
+@REM under the License.
+@REM ----------------------------------------------------------------------------
+
+@REM ----------------------------------------------------------------------------
+@REM Apache Maven Wrapper startup batch script, version 3.3.4
+@REM
+@REM Optional ENV vars
+@REM   MVNW_REPOURL - repo url base for downloading maven distribution
+@REM   MVNW_USERNAME/MVNW_PASSWORD - user and password for downloading maven
+@REM   MVNW_VERBOSE - true: enable verbose log; others: silence the output
+@REM ----------------------------------------------------------------------------
+
+@IF "%__MVNW_ARG0_NAME__%"=="" (SET __MVNW_ARG0_NAME__=%~nx0)
+@SET __MVNW_CMD__=
+@SET __MVNW_ERROR__=
+@SET __MVNW_PSMODULEP_SAVE=%PSModulePath%
+@SET PSModulePath=
+@FOR /F "usebackq tokens=1* delims==" %%A IN (`powershell -noprofile "& {$scriptDir='%~dp0'; $script='%__MVNW_ARG0_NAME__%'; icm -ScriptBlock ([Scriptblock]::Create((Get-Content -Raw '%~f0'))) -NoNewScope}"`) DO @(
+  IF "%%A"=="MVN_CMD" (set __MVNW_CMD__=%%B) ELSE IF "%%B"=="" (echo %%A) ELSE (echo %%A=%%B)
+)
+@SET PSModulePath=%__MVNW_PSMODULEP_SAVE%
+@SET __MVNW_PSMODULEP_SAVE=
+@SET __MVNW_ARG0_NAME__=
+@SET MVNW_USERNAME=
+@SET MVNW_PASSWORD=
+@IF NOT "%__MVNW_CMD__%"=="" ("%__MVNW_CMD__%" %*)
+@echo Cannot start maven from wrapper >&2 && exit /b 1
+@GOTO :EOF
+: end batch / begin powershell #>
+
+$ErrorActionPreference = "Stop"
+if ($env:MVNW_VERBOSE -eq "true") {
+  $VerbosePreference = "Continue"
+}
+
+# calculate distributionUrl, requires .mvn/wrapper/maven-wrapper.properties
+$distributionUrl = (Get-Content -Raw "$scriptDir/.mvn/wrapper/maven-wrapper.properties" | ConvertFrom-StringData).distributionUrl
+if (!$distributionUrl) {
+  Write-Error "cannot read distributionUrl property in $scriptDir/.mvn/wrapper/maven-wrapper.properties"
+}
+
+switch -wildcard -casesensitive ( $($distributionUrl -replace '^.*/','') ) {
+  "maven-mvnd-*" {
+    $USE_MVND = $true
+    $distributionUrl = $distributionUrl -replace '-bin\.[^.]*$',"-windows-amd64.zip"
+    $MVN_CMD = "mvnd.cmd"
+    break
+  }
+  default {
+    $USE_MVND = $false
+    $MVN_CMD = $script -replace '^mvnw','mvn'
+    break
+  }
+}
+
+# apply MVNW_REPOURL and calculate MAVEN_HOME
+# maven home pattern: ~/.m2/wrapper/dists/{apache-maven-<version>,maven-mvnd-<version>-<platform>}/<hash>
+if ($env:MVNW_REPOURL) {
+  $MVNW_REPO_PATTERN = if ($USE_MVND -eq $False) { "/org/apache/maven/" } else { "/maven/mvnd/" }
+  $distributionUrl = "$env:MVNW_REPOURL$MVNW_REPO_PATTERN$($distributionUrl -replace "^.*$MVNW_REPO_PATTERN",'')"
+}
+$distributionUrlName = $distributionUrl -replace '^.*/',''
+$distributionUrlNameMain = $distributionUrlName -replace '\.[^.]*$','' -replace '-bin$',''
+
+$MAVEN_M2_PATH = "$HOME/.m2"
+if ($env:MAVEN_USER_HOME) {
+  $MAVEN_M2_PATH = "$env:MAVEN_USER_HOME"
+}
+
+if (-not (Test-Path -Path $MAVEN_M2_PATH)) {
+    New-Item -Path $MAVEN_M2_PATH -ItemType Directory | Out-Null
+}
+
+$MAVEN_WRAPPER_DISTS = $null
+if ((Get-Item $MAVEN_M2_PATH).Target[0] -eq $null) {
+  $MAVEN_WRAPPER_DISTS = "$MAVEN_M2_PATH/wrapper/dists"
+} else {
+  $MAVEN_WRAPPER_DISTS = (Get-Item $MAVEN_M2_PATH).Target[0] + "/wrapper/dists"
+}
+
+$MAVEN_HOME_PARENT = "$MAVEN_WRAPPER_DISTS/$distributionUrlNameMain"
+$MAVEN_HOME_NAME = ([System.Security.Cryptography.SHA256]::Create().ComputeHash([byte[]][char[]]$distributionUrl) | ForEach-Object {$_.ToString("x2")}) -join ''
+$MAVEN_HOME = "$MAVEN_HOME_PARENT/$MAVEN_HOME_NAME"
+
+if (Test-Path -Path "$MAVEN_HOME" -PathType Container) {
+  Write-Verbose "found existing MAVEN_HOME at $MAVEN_HOME"
+  Write-Output "MVN_CMD=$MAVEN_HOME/bin/$MVN_CMD"
+  exit $?
+}
+
+if (! $distributionUrlNameMain -or ($distributionUrlName -eq $distributionUrlNameMain)) {
+  Write-Error "distributionUrl is not valid, must end with *-bin.zip, but found $distributionUrl"
+}
+
+# prepare tmp dir
+$TMP_DOWNLOAD_DIR_HOLDER = New-TemporaryFile
+$TMP_DOWNLOAD_DIR = New-Item -Itemtype Directory -Path "$TMP_DOWNLOAD_DIR_HOLDER.dir"
+$TMP_DOWNLOAD_DIR_HOLDER.Delete() | Out-Null
+trap {
+  if ($TMP_DOWNLOAD_DIR.Exists) {
+    try { Remove-Item $TMP_DOWNLOAD_DIR -Recurse -Force | Out-Null }
+    catch { Write-Warning "Cannot remove $TMP_DOWNLOAD_DIR" }
+  }
+}
+
+New-Item -Itemtype Directory -Path "$MAVEN_HOME_PARENT" -Force | Out-Null
+
+# Download and Install Apache Maven
+Write-Verbose "Couldn't find MAVEN_HOME, downloading and installing it ..."
+Write-Verbose "Downloading from: $distributionUrl"
+Write-Verbose "Downloading to: $TMP_DOWNLOAD_DIR/$distributionUrlName"
+
+$webclient = New-Object System.Net.WebClient
+if ($env:MVNW_USERNAME -and $env:MVNW_PASSWORD) {
+  $webclient.Credentials = New-Object System.Net.NetworkCredential($env:MVNW_USERNAME, $env:MVNW_PASSWORD)
+}
+[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
+$webclient.DownloadFile($distributionUrl, "$TMP_DOWNLOAD_DIR/$distributionUrlName") | Out-Null
+
+# If specified, validate the SHA-256 sum of the Maven distribution zip file
+$distributionSha256Sum = (Get-Content -Raw "$scriptDir/.mvn/wrapper/maven-wrapper.properties" | ConvertFrom-StringData).distributionSha256Sum
+if ($distributionSha256Sum) {
+  if ($USE_MVND) {
+    Write-Error "Checksum validation is not supported for maven-mvnd. `nPlease disable validation by removing 'distributionSha256Sum' from your maven-wrapper.properties."
+  }
+  Import-Module $PSHOME\Modules\Microsoft.PowerShell.Utility -Function Get-FileHash
+  if ((Get-FileHash "$TMP_DOWNLOAD_DIR/$distributionUrlName" -Algorithm SHA256).Hash.ToLower() -ne $distributionSha256Sum) {
+    Write-Error "Error: Failed to validate Maven distribution SHA-256, your Maven distribution might be compromised. If you updated your Maven version, you need to update the specified distributionSha256Sum property."
+  }
+}
+
+# unzip and move
+Expand-Archive "$TMP_DOWNLOAD_DIR/$distributionUrlName" -DestinationPath "$TMP_DOWNLOAD_DIR" | Out-Null
+
+# Find the actual extracted directory name (handles snapshots where filename != directory name)
+$actualDistributionDir = ""
+
+# First try the expected directory name (for regular distributions)
+$expectedPath = Join-Path "$TMP_DOWNLOAD_DIR" "$distributionUrlNameMain"
+$expectedMvnPath = Join-Path "$expectedPath" "bin/$MVN_CMD"
+if ((Test-Path -Path $expectedPath -PathType Container) -and (Test-Path -Path $expectedMvnPath -PathType Leaf)) {
+  $actualDistributionDir = $distributionUrlNameMain
+}
+
+# If not found, search for any directory with the Maven executable (for snapshots)
+if (!$actualDistributionDir) {
+  Get-ChildItem -Path "$TMP_DOWNLOAD_DIR" -Directory | ForEach-Object {
+    $testPath = Join-Path $_.FullName "bin/$MVN_CMD"
+    if (Test-Path -Path $testPath -PathType Leaf) {
+      $actualDistributionDir = $_.Name
+    }
+  }
+}
+
+if (!$actualDistributionDir) {
+  Write-Error "Could not find Maven distribution directory in extracted archive"
+}
+
+Write-Verbose "Found extracted Maven distribution directory: $actualDistributionDir"
+Rename-Item -Path "$TMP_DOWNLOAD_DIR/$actualDistributionDir" -NewName $MAVEN_HOME_NAME | Out-Null
+try {
+  Move-Item -Path "$TMP_DOWNLOAD_DIR/$MAVEN_HOME_NAME" -Destination $MAVEN_HOME_PARENT | Out-Null
+} catch {
+  if (! (Test-Path -Path "$MAVEN_HOME" -PathType Container)) {
+    Write-Error "fail to move MAVEN_HOME"
+  }
+} finally {
+  try { Remove-Item $TMP_DOWNLOAD_DIR -Recurse -Force | Out-Null }
+  catch { Write-Warning "Cannot remove $TMP_DOWNLOAD_DIR" }
+}
+
+Write-Output "MVN_CMD=$MAVEN_HOME/bin/$MVN_CMD"
diff --git a/src/test/java/com/organization/accessgrid/HttpRoundTripTest.java b/src/test/java/com/organization/accessgrid/HttpRoundTripTest.java
new file mode 100644
index 0000000..d72dec7
--- /dev/null
+++ b/src/test/java/com/organization/accessgrid/HttpRoundTripTest.java
@@ -0,0 +1,241 @@
+package com.organization.accessgrid;
+
+import com.sun.net.httpserver.HttpServer;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import static org.junit.jupiter.api.Assertions.*;
+
+import java.lang.reflect.Method;
+import java.net.InetSocketAddress;
+import java.net.URI;
+import java.net.http.HttpRequest;
+
+/**
+ * Tests that verify:
+ * 1. Request construction — correct paths, headers, and signatures
+ * 2. Error handling — proper exceptions for non-2xx responses
+ *
+ * Path tests use reflection to inspect HttpRequest objects built by private
+ * methods. These assert the CORRECT routes as defined by the Rails API and
+ * other SDKs. They FAIL because the Java SDK uses stale paths:
+ *   - /nfc-keys instead of /v1/key-cards
+ *   - /enterprise/templates instead of /v1/console/card-templates
+ *   - BASE_URL bakes in /v1 when it shouldn't (other SDKs use base without /v1)
+ *
+ * Error handling tests use a local HTTP server and call sendRequest directly
+ * (package-private method) to verify exception behavior.
+ */
+public class HttpRoundTripTest {
+    private static HttpServer server;
+    private static int port;
+
+    private static volatile int responseStatus = 200;
+    private static volatile String responseBody = "{}";
+
+    private AccessGridClient client;
+    private Method createSignedRequest;
+    private Method createSignedGetRequest;
+
+    @BeforeAll
+    static void startServer() throws Exception {
+        server = HttpServer.create(new InetSocketAddress(0), 0);
+        server.createContext("/", exchange -> {
+            byte[] resp = responseBody.getBytes();
+            exchange.sendResponseHeaders(responseStatus, resp.length);
+            exchange.getResponseBody().write(resp);
+            exchange.getResponseBody().close();
+        });
+        server.setExecutor(null);
+        server.start();
+        port = server.getAddress().getPort();
+    }
+
+    @AfterAll
+    static void stopServer() {
+        if (server != null) {
+            server.stop(0);
+        }
+    }
+
+    @BeforeEach
+    void setUp() throws Exception {
+        client = new AccessGridClient("test-account", "test-secret");
+        responseStatus = 200;
+        responseBody = "{}";
+
+        // Access private request-building methods via reflection
+        createSignedRequest = AccessGridClient.class.getDeclaredMethod(
+            "createSignedRequest", String.class, String.class, String.class);
+        createSignedRequest.setAccessible(true);
+
+        createSignedGetRequest = AccessGridClient.class.getDeclaredMethod(
+            "createSignedGetRequest", String.class, String.class);
+        createSignedGetRequest.setAccessible(true);
+    }
+
+    // ══════════════════════════════════════════════════════════════════════════
+    // Path verification — these FAIL because the SDK uses stale paths.
+    // The correct base URL should NOT include /v1 (matching Ruby/C#/Go SDKs).
+    // The correct endpoint paths should include /v1/ prefix.
+    // ══════════════════════════════════════════════════════════════════════════
+
+    @Test
+    public void provisionPathShouldBeV1KeyCards() throws Exception {
+        HttpRequest request = (HttpRequest) createSignedRequest.invoke(
+            client, "POST", "/nfc-keys", "{}");
+
+        String path = request.uri().getPath();
+        assertEquals("/v1/key-cards", path,
+            "provision should POST to /v1/key-cards — "
+            + "currently uses stale path /nfc-keys (resolves to " + path + ")");
+    }
+
+    @Test
+    public void getCardPathShouldBeV1KeyCards() throws Exception {
+        HttpRequest request = (HttpRequest) createSignedGetRequest.invoke(
+            client, "/nfc-keys/0xc4rd1d", "{\"id\":\"0xc4rd1d\"}");
+
+        String path = request.uri().getPath();
+        assertEquals("/v1/key-cards/0xc4rd1d", path,
+            "get should GET from /v1/key-cards/{id} — "
+            + "currently uses stale path (resolves to " + path + ")");
+    }
+
+    @Test
+    public void createTemplatePathShouldBeV1ConsoleCardTemplates() throws Exception {
+        HttpRequest request = (HttpRequest) createSignedRequest.invoke(
+            client, "POST", "/enterprise/templates", "{}");
+
+        String path = request.uri().getPath();
+        assertEquals("/v1/console/card-templates", path,
+            "createTemplate should POST to /v1/console/card-templates — "
+            + "currently uses stale path /enterprise/templates (resolves to " + path + ")");
+    }
+
+    // ══════════════════════════════════════════════════════════════════════════
+    // Header verification
+    // ══════════════════════════════════════════════════════════════════════════
+
+    @Test
+    public void postRequestIncludesAuthHeaders() throws Exception {
+        HttpRequest request = (HttpRequest) createSignedRequest.invoke(
+            client, "POST", "/nfc-keys", "{\"test\":true}");
+
+        assertEquals("test-account",
+            request.headers().firstValue("X-ACCT-ID").orElse(null),
+            "Request should include X-ACCT-ID header");
+
+        String sig = request.headers().firstValue("X-PAYLOAD-SIG").orElse(null);
+        assertNotNull(sig, "Request should include X-PAYLOAD-SIG header");
+        assertFalse(sig.isEmpty(), "X-PAYLOAD-SIG should not be empty");
+        assertTrue(sig.matches("^[0-9a-f]+$"),
+            "X-PAYLOAD-SIG should be a hex string");
+
+        assertEquals("application/json",
+            request.headers().firstValue("Content-Type").orElse(null),
+            "Request should set Content-Type to application/json");
+    }
+
+    @Test
+    public void getRequestIncludesAuthHeaders() throws Exception {
+        HttpRequest request = (HttpRequest) createSignedGetRequest.invoke(
+            client, "/nfc-keys/0xc4rd1d", "{\"id\":\"0xc4rd1d\"}");
+
+        assertEquals("test-account",
+            request.headers().firstValue("X-ACCT-ID").orElse(null),
+            "GET request should include X-ACCT-ID header");
+
+        assertNotNull(
+            request.headers().firstValue("X-PAYLOAD-SIG").orElse(null),
+            "GET request should include X-PAYLOAD-SIG header");
+    }
+
+    @Test
+    public void getRequestIncludesSigPayloadQueryParam() throws Exception {
+        HttpRequest request = (HttpRequest) createSignedGetRequest.invoke(
+            client, "/nfc-keys/0xc4rd1d", "{\"id\":\"0xc4rd1d\"}");
+
+        String query = request.uri().getQuery();
+        assertNotNull(query, "GET request should include query parameters");
+        assertTrue(query.contains("sig_payload="),
+            "GET request should include sig_payload query parameter");
+    }
+
+    // ══════════════════════════════════════════════════════════════════════════
+    // Error handling — uses mock HTTP server and calls sendRequest directly
+    // (sendRequest is package-private)
+    // ══════════════════════════════════════════════════════════════════════════
+
+    private HttpRequest buildMockRequest(String method, String path) {
+        HttpRequest.Builder builder = HttpRequest.newBuilder()
+            .uri(URI.create("http://localhost:" + port + path))
+            .header("Content-Type", "application/json");
+
+        if (method.equals("GET")) {
+            builder.GET();
+        } else {
+            builder.method(method, HttpRequest.BodyPublishers.ofString("{}"));
+        }
+        return builder.build();
+    }
+
+    @Test
+    public void errorResponse401ThrowsException() {
+        responseStatus = 401;
+        responseBody = "{\"message\":\"Invalid credentials\"}";
+
+        AccessGridClient.AccessGridException ex = assertThrows(
+            AccessGridClient.AccessGridException.class,
+            () -> client.sendRequest(buildMockRequest("POST", "/v1/key-cards")));
+
+        assertTrue(ex.getMessage().contains("Invalid credentials"),
+            "Exception should contain error message from response body");
+    }
+
+    @Test
+    public void errorResponse404ThrowsException() {
+        responseStatus = 404;
+        responseBody = "{\"message\":\"Resource not found\"}";
+
+        AccessGridClient.AccessGridException ex = assertThrows(
+            AccessGridClient.AccessGridException.class,
+            () -> client.sendRequest(buildMockRequest("GET", "/v1/key-cards/bad-id")));
+
+        assertTrue(ex.getMessage().contains("Resource not found"),
+            "Exception should contain error message from response body");
+    }
+
+    @Test
+    public void errorResponse500ThrowsException() {
+        responseStatus = 500;
+        responseBody = "{\"message\":\"Internal server error\"}";
+
+        AccessGridClient.AccessGridException ex = assertThrows(
+            AccessGridClient.AccessGridException.class,
+            () -> client.sendRequest(buildMockRequest("POST", "/v1/console/card-templates")));
+
+        assertTrue(ex.getMessage().contains("Internal server error"),
+            "Exception should contain error message from response body");
+    }
+
+    @Test
+    public void errorResponseWithEmptyBody() {
+        responseStatus = 503;
+        responseBody = "";
+
+        assertThrows(
+            AccessGridClient.AccessGridException.class,
+            () -> client.sendRequest(buildMockRequest("GET", "/v1/key-cards")));
+    }
+
+    @Test
+    public void successResponseDoesNotThrow() throws Exception {
+        responseStatus = 200;
+        responseBody = "{\"id\":\"0x1\"}";
+
+        // Should not throw
+        client.sendRequest(buildMockRequest("GET", "/v1/key-cards/0x1"));
+    }
+}
diff --git a/src/test/java/com/organization/accessgrid/ModelDeserializationTest.java b/src/test/java/com/organization/accessgrid/ModelDeserializationTest.java
new file mode 100644
index 0000000..03cfbae
--- /dev/null
+++ b/src/test/java/com/organization/accessgrid/ModelDeserializationTest.java
@@ -0,0 +1,241 @@
+package com.organization.accessgrid;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.datatype.jsr310.JavaTimeModule;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import static org.junit.jupiter.api.Assertions.*;
+
+/**
+ * Tests that JSON API responses deserialize correctly into model classes.
+ * Uses the same ObjectMapper configuration as the production client.
+ */
+public class ModelDeserializationTest {
+    private ObjectMapper mapper;
+
+    @BeforeEach
+    public void setUp() {
+        mapper = new ObjectMapper();
+        mapper.registerModule(new JavaTimeModule());
+    }
+
+    @Test
+    public void cardBasicFields() throws Exception {
+        String json = "{"
+            + "\"id\": \"0xc4rd1d\","
+            + "\"card_template_id\": \"0xd3adb00b5\","
+            + "\"full_name\": \"Employee Name\","
+            + "\"state\": \"active\","
+            + "\"card_number\": \"12345\","
+            + "\"site_code\": \"001\","
+            + "\"expiration_date\": \"2025-12-31T00:00:00Z\""
+            + "}";
+
+        Models.Card card = mapper.readValue(json, Models.Card.class);
+
+        assertEquals("0xc4rd1d", card.getId());
+        assertEquals("0xd3adb00b5", card.getCardTemplateId());
+        assertEquals("Employee Name", card.getFullName());
+        assertEquals("active", card.getState());
+        assertEquals("12345", card.getCardNumber());
+        assertEquals("001", card.getSiteCode());
+        assertEquals("2025-12-31T00:00:00Z", card.getExpirationDate());
+    }
+
+    @Test
+    public void cardInstallUrl() throws Exception {
+        String json = "{"
+            + "\"id\": \"0xc4rd1d\","
+            + "\"install_url\": \"https://accessgrid.com/install/0xc4rd1d\","
+            + "\"direct_install_url\": \"https://accessgrid.com/direct/0xc4rd1d\""
+            + "}";
+
+        Models.Card card = mapper.readValue(json, Models.Card.class);
+
+        // install_url is mapped to both 'url' and 'installUrl' fields via
+        // duplicate @JsonProperty("install_url") — verify what actually happens
+        assertEquals("https://accessgrid.com/install/0xc4rd1d", card.getInstallUrl());
+        assertEquals("https://accessgrid.com/install/0xc4rd1d", card.getUrl());
+        assertEquals("https://accessgrid.com/direct/0xc4rd1d", card.getDirectInstallUrl());
+    }
+
+    @Test
+    public void cardWithDevices() throws Exception {
+        String json = "{"
+            + "\"id\": \"0xc4rd1d\","
+            + "\"state\": \"active\","
+            + "\"devices\": ["
+            + "  {"
+            + "    \"id\": \"dev_001\","
+            + "    \"platform\": \"apple\","
+            + "    \"device_type\": \"iphone\","
+            + "    \"status\": \"active\","
+            + "    \"created_at\": \"2024-01-01T00:00:00Z\","
+            + "    \"updated_at\": \"2024-06-01T00:00:00Z\""
+            + "  },"
+            + "  {"
+            + "    \"id\": \"dev_002\","
+            + "    \"platform\": \"apple\","
+            + "    \"device_type\": \"watch\","
+            + "    \"status\": \"active\","
+            + "    \"created_at\": \"2024-02-01T00:00:00Z\","
+            + "    \"updated_at\": \"2024-06-15T00:00:00Z\""
+            + "  }"
+            + "]"
+            + "}";
+
+        Models.Card card = mapper.readValue(json, Models.Card.class);
+
+        assertNotNull(card.getDevices());
+        assertEquals(2, card.getDevices().size());
+
+        Models.Device device = card.getDevices().get(0);
+        assertEquals("dev_001", device.getId());
+        assertEquals("apple", device.getPlatform());
+        assertEquals("iphone", device.getDeviceType());
+        assertEquals("active", device.getStatus());
+        assertEquals("2024-01-01T00:00:00Z", device.getCreatedAt());
+        assertEquals("2024-06-01T00:00:00Z", device.getUpdatedAt());
+    }
+
+    @Test
+    public void cardWithMetadata() throws Exception {
+        String json = "{"
+            + "\"id\": \"0xc4rd1d\","
+            + "\"metadata\": {"
+            + "  \"department\": \"Engineering\","
+            + "  \"floor\": 3"
+            + "}"
+            + "}";
+
+        Models.Card card = mapper.readValue(json, Models.Card.class);
+
+        assertNotNull(card.getMetadata());
+        assertEquals("Engineering", card.getMetadata().get("department"));
+        assertEquals(3, card.getMetadata().get("floor"));
+    }
+
+    @Test
+    public void cardNullOptionalFields() throws Exception {
+        String json = "{"
+            + "\"id\": \"0xc4rd1d\","
+            + "\"state\": \"active\""
+            + "}";
+
+        Models.Card card = mapper.readValue(json, Models.Card.class);
+
+        assertEquals("0xc4rd1d", card.getId());
+        assertEquals("active", card.getState());
+        assertNull(card.getFullName());
+        assertNull(card.getDevices());
+        assertNull(card.getMetadata());
+        assertNull(card.getInstallUrl());
+    }
+
+    @Test
+    public void templateAllFields() throws Exception {
+        String json = "{"
+            + "\"id\": \"0xd3adb00b5\","
+            + "\"name\": \"Employee NFC key\","
+            + "\"platform\": \"apple\","
+            + "\"use_case\": \"employee_badge\","
+            + "\"protocol\": \"desfire\","
+            + "\"allow_on_multiple_devices\": true,"
+            + "\"watch_count\": 2,"
+            + "\"iphone_count\": 3,"
+            + "\"issued_keys_count\": 150,"
+            + "\"active_keys_count\": 142,"
+            + "\"created_at\": \"2024-01-01T00:00:00Z\","
+            + "\"last_published_at\": \"2024-06-01T12:00:00Z\""
+            + "}";
+
+        Models.Template template = mapper.readValue(json, Models.Template.class);
+
+        assertEquals("0xd3adb00b5", template.getId());
+        assertEquals("Employee NFC key", template.getName());
+        assertEquals("apple", template.getPlatform());
+        assertEquals("employee_badge", template.getUseCase());
+        assertEquals("desfire", template.getProtocol());
+        assertTrue(template.isAllowOnMultipleDevices());
+        assertEquals(2, template.getWatchCount());
+        assertEquals(3, template.getIphoneCount());
+        assertEquals(150, template.getIssuedKeysCount());
+        assertEquals(142, template.getActiveKeysCount());
+        assertEquals("2024-01-01T00:00:00Z", template.getCreatedAt());
+        assertEquals("2024-06-01T12:00:00Z", template.getLastPublishedAt());
+    }
+
+    @Test
+    public void templateDesign() throws Exception {
+        String json = "{"
+            + "\"background_color\": \"#FFFFFF\","
+            + "\"label_color\": \"#000000\","
+            + "\"label_secondary_color\": \"#333333\","
+            + "\"background_image\": \"https://example.com/bg.png\","
+            + "\"logo_image\": \"https://example.com/logo.png\","
+            + "\"icon_image\": \"https://example.com/icon.png\""
+            + "}";
+
+        Models.TemplateDesign design = mapper.readValue(json, Models.TemplateDesign.class);
+
+        assertEquals("#FFFFFF", design.getBackgroundColor());
+        assertEquals("#000000", design.getLabelColor());
+        assertEquals("#333333", design.getLabelSecondaryColor());
+        assertEquals("https://example.com/bg.png", design.getBackgroundImage());
+        assertEquals("https://example.com/logo.png", design.getLogoImage());
+        assertEquals("https://example.com/icon.png", design.getIconImage());
+    }
+
+    @Test
+    public void supportInfo() throws Exception {
+        String json = "{"
+            + "\"support_url\": \"https://help.example.com\","
+            + "\"support_phone_number\": \"+1-555-123-4567\","
+            + "\"support_email\": \"support@example.com\","
+            + "\"privacy_policy_url\": \"https://example.com/privacy\","
+            + "\"terms_and_conditions_url\": \"https://example.com/terms\""
+            + "}";
+
+        Models.SupportInfo info = mapper.readValue(json, Models.SupportInfo.class);
+
+        assertEquals("https://help.example.com", info.getSupportUrl());
+        assertEquals("+1-555-123-4567", info.getSupportPhoneNumber());
+        assertEquals("support@example.com", info.getSupportEmail());
+        assertEquals("https://example.com/privacy", info.getPrivacyPolicyUrl());
+        assertEquals("https://example.com/terms", info.getTermsAndConditionsUrl());
+    }
+
+    @Test
+    public void deviceStandalone() throws Exception {
+        String json = "{"
+            + "\"id\": \"dev_001\","
+            + "\"platform\": \"google\","
+            + "\"device_type\": \"phone\","
+            + "\"status\": \"suspended\","
+            + "\"created_at\": \"2024-03-15T10:30:00Z\","
+            + "\"updated_at\": \"2024-07-20T14:00:00Z\""
+            + "}";
+
+        Models.Device device = mapper.readValue(json, Models.Device.class);
+
+        assertEquals("dev_001", device.getId());
+        assertEquals("google", device.getPlatform());
+        assertEquals("phone", device.getDeviceType());
+        assertEquals("suspended", device.getStatus());
+        assertEquals("2024-03-15T10:30:00Z", device.getCreatedAt());
+        assertEquals("2024-07-20T14:00:00Z", device.getUpdatedAt());
+    }
+
+    @Test
+    public void unknownFieldsAreIgnored() throws Exception {
+        String json = "{"
+            + "\"id\": \"0xc4rd1d\","
+            + "\"state\": \"active\","
+            + "\"some_future_field\": \"should not break\""
+            + "}";
+
+        // Should not throw even with unknown fields
+        Models.Card card = mapper.readValue(json, Models.Card.class);
+        assertEquals("0xc4rd1d", card.getId());
+    }
+}
diff --git a/src/test/java/com/organization/accessgrid/VersionConsistencyTest.java b/src/test/java/com/organization/accessgrid/VersionConsistencyTest.java
new file mode 100644
index 0000000..f224fee
--- /dev/null
+++ b/src/test/java/com/organization/accessgrid/VersionConsistencyTest.java
@@ -0,0 +1,103 @@
+package com.organization.accessgrid;
+
+import org.junit.jupiter.api.Test;
+import static org.junit.jupiter.api.Assertions.*;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+/**
+ * Validates that .tool-versions, CI workflow, and Maven wrapper
+ * all target consistent versions.
+ */
+public class VersionConsistencyTest {
+
+    // ══════════════════════════════════════════════════════════════════════════
+    // TARGET VERSIONS - Update these when upgrading
+    // ══════════════════════════════════════════════════════════════════════════
+    private static final String TARGET_JAVA = "temurin-11.0.30+7";
+    private static final String TARGET_MAVEN = "3.9.9";
+
+    private static final Path ROOT = Paths.get(System.getProperty("user.dir"));
+
+    private String readFile(String relativePath) throws IOException {
+        return Files.readString(ROOT.resolve(relativePath));
+    }
+
+    private String majorVersion(String javaVersion) {
+        // "temurin-11.0.30+7" → "11"
+        Matcher m = Pattern.compile("(\\d+)").matcher(javaVersion);
+        if (m.find()) {
+            return m.group(1);
+        }
+        return javaVersion;
+    }
+
+    private String toolVersionsEntry(String content, String tool) {
+        for (String line : content.split("\n")) {
+            String[] parts = line.trim().split("\\s+", 2);
+            if (parts.length == 2 && parts[0].equals(tool)) {
+                return parts[1];
+            }
+        }
+        return null;
+    }
+
+    @Test
+    public void toolVersionsJavaMatchesTarget() throws IOException {
+        String content = readFile(".tool-versions");
+        String javaVersion = toolVersionsEntry(content, "java");
+
+        assertNotNull(javaVersion, ".tool-versions should contain a java entry");
+        assertEquals(TARGET_JAVA, javaVersion,
+            ".tool-versions java should match TARGET_JAVA");
+    }
+
+    @Test
+    public void toolVersionsMavenMatchesTarget() throws IOException {
+        String content = readFile(".tool-versions");
+        String mavenVersion = toolVersionsEntry(content, "maven");
+
+        assertNotNull(mavenVersion, ".tool-versions should contain a maven entry");
+        assertEquals(TARGET_MAVEN, mavenVersion,
+            ".tool-versions maven should match TARGET_MAVEN");
+    }
+
+    @Test
+    public void ciMatrixIncludesTargetJava() throws IOException {
+        String content = readFile(".github/workflows/ci.yml");
+
+        // Extract java: ['11', '17', '21'] matrix
+        Matcher m = Pattern.compile("java:\\s*\\[([^\\]]+)\\]").matcher(content);
+        assertTrue(m.find(), "CI workflow should contain a java version matrix");
+
+        String raw = m.group(1);
+        List<String> versions = new ArrayList<>();
+        for (String v : raw.split(",")) {
+            versions.add(v.trim().replaceAll("['\"]", ""));
+        }
+
+        String targetMajor = majorVersion(TARGET_JAVA);
+        assertTrue(versions.contains(targetMajor),
+            "CI matrix " + versions + " should include target major version " + targetMajor);
+    }
+
+    @Test
+    public void mavenWrapperMatchesTarget() throws IOException {
+        String content = readFile(".mvn/wrapper/maven-wrapper.properties");
+
+        // Extract version from distributionUrl=...apache-maven-3.9.9-bin.zip
+        Matcher m = Pattern.compile("apache-maven-([\\d.]+)-bin\\.zip").matcher(content);
+        assertTrue(m.find(), "maven-wrapper.properties should contain a distributionUrl");
+
+        String wrapperMaven = m.group(1);
+        assertEquals(TARGET_MAVEN, wrapperMaven,
+            "Maven wrapper version should match TARGET_MAVEN");
+    }
+}