Description

<dependency>
    <groupId>org.pijota</groupId>
    <artifactId>pijota</artifactId>
    <version>0.2.2</version>
</dependency>

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>

  <groupId>org.pijota</groupId>
  <artifactId>pijota</artifactId>
  <version>0.2.2</version>
  <packaging>jar</packaging>

  <name>Pijota</name>
  <description>A local-first AI coding agent for people who live in terminals.</description>
  <url>https://pijota.org</url>
  <inceptionYear>2026</inceptionYear>

  <licenses>
    <license>
      <name>Apache License, Version 2.0</name>
      <url>https://www.apache.org/licenses/LICENSE-2.0.txt</url>
      <distribution>repo</distribution>
    </license>
  </licenses>

  <developers>
    <developer>
      <id>mukel</id>
      <name>Alfonso² Peterssen</name>
      <url>https://github.com/mukel</url>
    </developer>
  </developers>

  <!-- The repository these coordinates are cut from. Central keeps its copy forever, so this is the address that has
       to still resolve years from now: github.com/mukel/pijota, which is where the remote actually points. -->
  <scm>
    <connection>scm:git:https://github.com/mukel/pijota.git</connection>
    <developerConnection>scm:git:ssh://git@github.com/mukel/pijota.git</developerConnection>
    <!-- The tag this version was cut from, not HEAD: Central keeps the POM forever, and a reader years from now needs
         the commit that produced these bytes. Move it with the version. -->
    <tag>v0.2.2</tag>
    <url>https://github.com/mukel/pijota</url>
  </scm>

  <issueManagement>
    <system>GitHub Issues</system>
    <url>https://github.com/mukel/pijota/issues</url>
  </issueManagement>

  <properties>
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>

    <!-- Fixes every timestamp Maven writes into the jars, so two builds of this tag produce byte-identical artifacts
         and anyone can rebuild the release and check it matches what Central serves. Without it the jars carry the
         moment they were built and no two agree, which is exactly the property a reader wants when the question is
         "is the artifact I downloaded the source I am reading". Bump it when the version is bumped. -->
    <project.build.outputTimestamp>2026-08-05T00:00:00Z</project.build.outputTimestamp>

    <!-- Empty by default; the coverage profile's jacoco:prepare-agent replaces it with the agent's -javaagent. The
         surefire <argLine> below must interpolate it with @{...} late binding, or setting argLine there discards the
         agent and every coverage report comes out empty. -->
    <argLine/>

    <maven.compiler.release>21</maven.compiler.release>

    <commonmark.version>0.29.0</commonmark.version>
    <jackson.version>2.22.1</jackson.version>
    <jline.version>4.3.1</jline.version>
    <junit.version>6.1.2</junit.version>
    <langchain4j.version>1.18.1</langchain4j.version>
    <slf4j.version>2.0.18</slf4j.version>
    <!-- logback 1.6.x still targets slf4j 2.0.18, so this pair stays consistent; slf4j 2.1.0 is
         alpha-only, which is why slf4j.version does not move with it -->
    <logback.version>1.6.1</logback.version>

    <!-- Collapse BrowserSession's settle/consent waits for the test suite (overridable: make test-live sets false so
         the real-browser @Tag("live") tests keep production timings). -->
    <pijota.browser.fastSettle>true</pijota.browser.fastSettle>

    <!-- PGO hook for the native build (Oracle GraalVM). Default duplicates no-fallback (a harmless no-op); the
         native-pgo-* make targets override it with the pgo-instrument / pgo=profile flags. See the Makefile. -->
    <pgo.arg>--no-fallback</pgo.arg>

    <!-- Directory holding the musl-built static libs (libz.a + the libatomic_asneeded.a stub) for the -Pstatic
         build; populated by `make setup-musl`. Override with -Dmusl.libdir=... if you put them elsewhere. -->
    <musl.libdir>${user.home}/.local/share/pijota-staticlibs/lib</musl.libdir>

    <!-- web-UI libraries downloaded into the build (not committed); see web/vendor/README.md -->
    <marked.version>12.0.0</marked.version>
    <dompurify.version>3.0.9</dompurify.version>
    <highlightjs.version>11.9.0</highlightjs.version>
    <inter.version>5.1.1</inter.version>
    <!-- Inter variable (Latin subset) for readable, OS-consistent UI type -->
    <inter.sha512>5e90f48b923bb95aeb49691d03dade8825c119b2fa28977ea170c41548900f4e0165e2869f97c7a9380d7ff8ff331a1da855500e5f7b0dfd2b9abd77a386bbf3</inter.sha512>
    <!-- PDF.js (legacy UMD build) downloaded into the build for browser-side PDF→markdown; see browser/README.md -->
    <pdfjs.version>3.11.174</pdfjs.version>
  </properties>

  <dependencyManagement>
    <dependencies>
      <dependency>
        <groupId>dev.langchain4j</groupId>
        <artifactId>langchain4j-bom</artifactId>
        <version>${langchain4j.version}</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>
    </dependencies>
  </dependencyManagement>

  <dependencies>
    <!-- LLM providers -->
    <dependency>
      <groupId>dev.langchain4j</groupId>
      <artifactId>langchain4j-core</artifactId>
    </dependency>
    <dependency>
      <groupId>dev.langchain4j</groupId>
      <artifactId>langchain4j-open-ai</artifactId>
      <exclusions>
        <!-- jtokkit bundles ~7MB of .tiktoken BPE vocab; pijota never tokenizes locally (token counts come from
             the API response, and context estimation uses CompactionManager), so it is dead weight. -->
        <exclusion>
          <groupId>com.knuddels</groupId>
          <artifactId>jtokkit</artifactId>
        </exclusion>
      </exclusions>
    </dependency>
    <dependency>
      <groupId>dev.langchain4j</groupId>
      <artifactId>langchain4j-google-ai-gemini</artifactId>
    </dependency>
    <dependency>
      <groupId>dev.langchain4j</groupId>
      <artifactId>langchain4j-anthropic</artifactId>
    </dependency>
    <dependency>
      <!-- The JDK HttpClient backend (a transitive runtime dep of the providers above); made explicit so we can build
           a proxied JdkHttpClientBuilder at compile time and route the LLM providers through an HTTP proxy. -->
      <groupId>dev.langchain4j</groupId>
      <artifactId>langchain4j-http-client-jdk</artifactId>
    </dependency>

    <!-- Terminal -->
    <dependency>
      <groupId>org.jline</groupId>
      <artifactId>jline-terminal</artifactId>
      <version>${jline.version}</version>
    </dependency>

    <!-- JSON -->
    <dependency>
      <groupId>com.fasterxml.jackson.core</groupId>
      <artifactId>jackson-databind</artifactId>
      <version>${jackson.version}</version>
    </dependency>
    <dependency>
      <groupId>com.fasterxml.jackson.datatype</groupId>
      <artifactId>jackson-datatype-jsr310</artifactId>
      <version>${jackson.version}</version>
    </dependency>

    <!-- Markdown parsing -->
    <dependency>
      <groupId>org.commonmark</groupId>
      <artifactId>commonmark</artifactId>
      <version>${commonmark.version}</version>
    </dependency>
    <dependency>
      <groupId>org.commonmark</groupId>
      <artifactId>commonmark-ext-gfm-tables</artifactId>
      <version>${commonmark.version}</version>
    </dependency>
    <dependency>
      <groupId>org.commonmark</groupId>
      <artifactId>commonmark-ext-gfm-strikethrough</artifactId>
      <version>${commonmark.version}</version>
    </dependency>

    <!-- QR code generation (terminal QR for /remote-control); pure Java, no reflection, native-image friendly. -->
    <dependency>
      <groupId>io.nayuki</groupId>
      <artifactId>qrcodegen</artifactId>
      <version>1.8.0</version>
    </dependency>

    <!-- Logging -->
    <dependency>
      <groupId>org.slf4j</groupId>
      <artifactId>slf4j-api</artifactId>
      <version>${slf4j.version}</version>
    </dependency>
    <dependency>
      <groupId>ch.qos.logback</groupId>
      <artifactId>logback-classic</artifactId>
      <version>${logback.version}</version>
    </dependency>

    <!-- Testing -->
    <dependency>
      <groupId>org.junit.jupiter</groupId>
      <artifactId>junit-jupiter</artifactId>
      <version>${junit.version}</version>
      <scope>test</scope>
    </dependency>
  </dependencies>

  <build>
    <resources>
      <resource>
        <directory>src/main/resources</directory>
        <!-- Developer notes about where the vendored browser scripts come from. They belong next to the scripts in the
             tree, not inside the binary every user downloads: nothing loads them, and the one message that mentions
             the file names it as a source path to go and read. -->
        <excludes>
          <exclude>browser/README.md</exclude>
          <exclude>web/vendor/README.md</exclude>
          <exclude>web/vendor/.gitignore</exclude>
        </excludes>
      </resource>
      <resource>
        <!-- Packaged from the repository root rather than copied into resources: `pijota license` has to print the
             same text the repository carries, and two copies of a license are two texts that can disagree. -->
        <directory>${project.basedir}</directory>
        <includes>
          <include>LICENSE</include>
          <include>NOTICE</include>
        </includes>
      </resource>
    </resources>
    <plugins>
      <plugin>
        <!-- Reads the maven.compiler.release property automatically; no <configuration> needed. -->
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-compiler-plugin</artifactId>
        <version>3.14.1</version>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-jar-plugin</artifactId>
        <version>3.5.0</version>
        <configuration>
          <archive>
            <manifest>
              <addDefaultImplementationEntries>true</addDefaultImplementationEntries>
              <mainClass>org.pijota.Main</mainClass>
            </manifest>
            <!-- JLine loads a native lib; grant it up front so `java -jar` doesn't print a native-access WARNING on
                 startup (JDK 24+). The shade profile inherits this manifest; the native image is unaffected. -->
            <manifestEntries>
              <Enable-Native-Access>ALL-UNNAMED</Enable-Native-Access>
            </manifestEntries>
          </archive>
        </configuration>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-surefire-plugin</artifactId>
        <version>3.5.4</version>
        <configuration>
          <!-- Run test classes across 4 reused JVMs (sweet spot on this suite: ~19s vs ~27s serial; more forks lose
               to JVM-startup overhead). Safe here, tests use ephemeral ports and per-JVM system properties. -->
          <forkCount>4</forkCount>
          <reuseForks>true</reuseForks>
          <!-- A real -D on the forked JVM's command line, so the tests that assert pijota propagates system
               properties to its worker and sub-agent processes have something to observe. Surefire's
               systemPropertyVariables below do not appear in getInputArguments(), so without this those tests assert
               against an empty list and pass no matter what the code does.
               @{argLine} keeps whatever jacoco:prepare-agent put there; replacing it outright silently turns
               coverage off. -->
          <argLine>@{argLine} -Dpijota.test.propagationMarker=observed</argLine>
          <!-- Collapse BrowserSession's settle/consent waits (no protocol event to react to) against the instantly-
               ready FakeChrome; the load wait itself is event-driven. Cuts ~30s off the suite. Test-only: the
               packaged/native build skips tests, so this never reaches a production artifact. -->
          <systemPropertyVariables>
            <pijota.browser.fastSettle>${pijota.browser.fastSettle}</pijota.browser.fastSettle>
            <!-- No automatic model discovery from the suite. Logging in or out triggers a refresh, and a unit test
                 driving that path asked every configured provider over the network, using whatever credentials the
                 developer had in their environment, and wrote a models-cache.json into their own home. This is the
                 switch that exists for "never reach out on its own"; an explicit /refresh still would, which is why
                 no test should call one. -->
            <pijota.offline>true</pijota.offline>
            <!-- Every test's ~/.pijota, under target/ and per fork, so the suite cannot read or write the
                 developer's real one. The comment above records what that cost once: a test reached the network
                 with their credentials and left a models-cache.json in their home. Switching off discovery closed
                 one door; this closes the room. Per fork because forks are reused and run in parallel, and
                 `mvn clean` disposes of it. -->
            <pijota.home>${project.build.directory}/test-home-${surefire.forkNumber}</pijota.home>
          </systemPropertyVariables>
        </configuration>
      </plugin>
      <!-- Fetch the web-UI libraries into the build (web/vendor/ stays free of minified blobs). They land on the
           classpath under /web/vendor/ so WebServer serves them locally (offline-capable, no CDN). Pinned + sha512
           verified; cached after first download, so rebuilds work offline. Runs before tests (generate-resources). -->
      <plugin>
        <groupId>com.googlecode.maven-download-plugin</groupId>
        <artifactId>download-maven-plugin</artifactId>
        <version>1.13.0</version>
        <!-- Shared across all executions; each one only sets its url + filename + sha512. -->
        <configuration>
          <outputDirectory>${project.build.outputDirectory}/web/vendor</outputDirectory>
        </configuration>
        <executions>
          <execution>
            <id>vendor-marked</id>
            <goals>
              <goal>wget</goal>
            </goals>
            <phase>generate-resources</phase>
            <configuration>
              <url>https://cdn.jsdelivr.net/npm/marked@${marked.version}/marked.min.js</url>
              <outputFileName>marked.min.js</outputFileName>
              <sha512>b6383c23677a162d0e046cf572c9abed17c8e2eba961a09f2ff46a8554534b8d91306c1f06c8f00469a1ce123e7b674f9b27b0f1c164a319d5906bc00c32ef6e</sha512>
            </configuration>
          </execution>
          <execution>
            <id>vendor-dompurify</id>
            <goals>
              <goal>wget</goal>
            </goals>
            <phase>generate-resources</phase>
            <configuration>
              <url>https://cdn.jsdelivr.net/npm/dompurify@${dompurify.version}/dist/purify.min.js</url>
              <outputFileName>purify.min.js</outputFileName>
              <sha512>f7e8a500e79763cab2d9bc3f879d4c9a588d347bddca14e92c896a0e65690f6eb3f158d526c509b64e6b85b0c852f6220fe1291a802ed314daecc859a211508c</sha512>
            </configuration>
          </execution>
          <execution>
            <id>vendor-highlight-js</id>
            <goals>
              <goal>wget</goal>
            </goals>
            <phase>generate-resources</phase>
            <configuration>
              <url>https://cdn.jsdelivr.net/gh/highlightjs/cdn-release@${highlightjs.version}/build/highlight.min.js</url>
              <outputFileName>highlight.min.js</outputFileName>
              <sha512>0fd814cb1aa36bb841b645a93d61adf707db7da30656df609f20af61afa3a23c303c72c2cd49b98bcae993bbc3ef035e7bd6c0df9798223a1b60f690b8a4b531</sha512>
            </configuration>
          </execution>
          <execution>
            <id>vendor-hljs-theme-dark</id>
            <goals>
              <goal>wget</goal>
            </goals>
            <phase>generate-resources</phase>
            <configuration>
              <url>https://cdn.jsdelivr.net/gh/highlightjs/cdn-release@${highlightjs.version}/build/styles/github-dark.min.css</url>
              <outputFileName>github-dark.min.css</outputFileName>
              <sha512>acefa89514e471fdf4e03401c525b1967f095c2cd31e52a721d9cc53062f41af7f25de1c41a36422d2148fa6789ef5b576a2b448a5cb6e7f61e0ac194cdb40cb</sha512>
            </configuration>
          </execution>
          <execution>
            <id>vendor-hljs-theme-light</id>
            <goals>
              <goal>wget</goal>
            </goals>
            <phase>generate-resources</phase>
            <configuration>
              <url>https://cdn.jsdelivr.net/gh/highlightjs/cdn-release@${highlightjs.version}/build/styles/github.min.css</url>
              <outputFileName>github.min.css</outputFileName>
              <sha512>d1a3d0cb2799ad68fdb02038e949665a028e3f49948a92d0e8e657bbc97821c0260f6bb7d443c4cbd55c20cbe5ed2a0068a7bc6cb5d9858a0c684fe29fe81c80</sha512>
            </configuration>
          </execution>
          <execution>
            <id>vendor-inter-font</id>
            <goals>
              <goal>wget</goal>
            </goals>
            <phase>generate-resources</phase>
            <configuration>
              <url>https://cdn.jsdelivr.net/npm/@fontsource-variable/inter@${inter.version}/files/inter-latin-wght-normal.woff2</url>
              <outputFileName>inter.woff2</outputFileName>
              <sha512>${inter.sha512}</sha512>
            </configuration>
          </execution>
          <!-- PDF.js (legacy UMD build) for browser-side PDF→markdown, lands in browser/, not web/vendor/. -->
          <execution>
            <id>browser-pdfjs</id>
            <goals>
              <goal>wget</goal>
            </goals>
            <phase>generate-resources</phase>
            <configuration>
              <url>https://cdn.jsdelivr.net/npm/pdfjs-dist@${pdfjs.version}/legacy/build/pdf.min.js</url>
              <outputDirectory>${project.build.outputDirectory}/browser</outputDirectory>
              <outputFileName>pdf.min.js</outputFileName>
              <sha512>431a997469cbe6d1a441d5750a867d5e458d9ab7d60adba604018272d77d90d9cc25a2ad03fcc7ac9519b0a4c47d3f522c0d9dcef99d042885bbfc433f8b61ee</sha512>
            </configuration>
          </execution>
          <execution>
            <id>browser-pdfjs-worker</id>
            <goals>
              <goal>wget</goal>
            </goals>
            <phase>generate-resources</phase>
            <configuration>
              <url>https://cdn.jsdelivr.net/npm/pdfjs-dist@${pdfjs.version}/legacy/build/pdf.worker.min.js</url>
              <outputDirectory>${project.build.outputDirectory}/browser</outputDirectory>
              <outputFileName>pdf.worker.min.js</outputFileName>
              <sha512>0ea062719cd081d2e7ffa5c1d55a153fbd6f489b8b9ae23aaa92ccd315a41e732d6b9c9255226cd50af377922408d0075dcc8dc67ce2e459e0f7f6541e948193</sha512>
            </configuration>
          </execution>
        </executions>
      </plugin>
      <plugin>
        <groupId>com.diffplug.spotless</groupId>
        <artifactId>spotless-maven-plugin</artifactId>
        <version>3.7.0</version>
        <configuration>
          <java>
            <eclipse>
              <version>4.34</version>
              <file>${project.basedir}/eclipse-formatter.xml</file>
            </eclipse>
            <!-- The order the codebase already used by a large majority: ours, then everyone else's, then the JDK's,
                 with static imports last. Enforced here so it stays that way without anyone having to notice. -->
            <importOrder>
              <order>org.pijota,,java,javax,\#</order>
            </importOrder>
            <removeUnusedImports/>
          </java>
          <pom>
            <sortPom>
              <nrOfIndentSpace>2</nrOfIndentSpace>
              <expandEmptyElements>false</expandEmptyElements>
            </sortPom>
          </pom>
        </configuration>
        <executions>
          <execution>
            <id>spotless-check</id>
            <goals>
              <goal>check</goal>
            </goals>
            <phase>verify</phase>
          </execution>
        </executions>
      </plugin>
    </plugins>
  </build>

  <profiles>
    <profile>
      <id>release</id>
      <build>
        <plugins>
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-source-plugin</artifactId>
            <version>3.4.0</version>
            <executions>
              <execution>
                <id>attach-sources</id>
                <goals>
                  <goal>jar-no-fork</goal>
                </goals>
              </execution>
            </executions>
          </plugin>
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-javadoc-plugin</artifactId>
            <version>3.12.0</version>
            <configuration>
              <doclint>none</doclint>
              <quiet>true</quiet>
            </configuration>
            <executions>
              <execution>
                <id>attach-javadocs</id>
                <goals>
                  <goal>jar</goal>
                </goals>
              </execution>
            </executions>
          </plugin>
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-gpg-plugin</artifactId>
            <version>3.2.8</version>
            <executions>
              <execution>
                <id>sign-artifacts</id>
                <goals>
                  <goal>sign</goal>
                </goals>
                <phase>verify</phase>
              </execution>
            </executions>
          </plugin>
          <plugin>
            <groupId>org.sonatype.central</groupId>
            <artifactId>central-publishing-maven-plugin</artifactId>
            <version>0.11.0</version>
            <extensions>true</extensions>
            <configuration>
              <publishingServerId>central</publishingServerId>
            </configuration>
          </plugin>
        </plugins>
      </build>
    </profile>
    <profile>
      <!-- opt-in (mvn -Pcoverage test jacoco:report); kept out of the default build so normal/transcend builds skip the agent -->
      <id>coverage</id>
      <build>
        <plugins>
          <plugin>
            <groupId>org.jacoco</groupId>
            <artifactId>jacoco-maven-plugin</artifactId>
            <version>0.8.15</version>
            <executions>
              <execution>
                <id>prepare-agent</id>
                <goals>
                  <goal>prepare-agent</goal>
                </goals>
              </execution>
              <execution>
                <id>report</id>
                <goals>
                  <goal>report</goal>
                </goals>
                <phase>test</phase>
              </execution>
            </executions>
          </plugin>
        </plugins>
      </build>
    </profile>
    <profile>
      <id>fat</id>
      <build>
        <plugins>
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-shade-plugin</artifactId>
            <version>3.6.0</version>
            <executions>
              <execution>
                <goals>
                  <goal>shade</goal>
                </goals>
                <phase>package</phase>
                <configuration>
                  <transformers>
                    <transformer implementation="org.apache.maven.plugins.shade.resource.ServicesResourceTransformer"/>
                    <!-- JLine 4 resolves terminal providers from META-INF/jline/providers/* (not META-INF/services),
                         so the default shade clobbering would drop ExecTerminalProvider — the only provider that can
                         set raw mode on a native image — and the native build would run cooked (control chars typed
                         literally, no Ctrl-Z, broken Backspace). Append every provider file instead. -->
                    <transformer implementation="org.apache.maven.plugins.shade.resource.AppendingTransformer">
                      <resource>META-INF/jline/providers/exec</resource>
                    </transformer>
                    <transformer implementation="org.apache.maven.plugins.shade.resource.AppendingTransformer">
                      <resource>META-INF/jline/providers/dumb</resource>
                    </transformer>
                  </transformers>
                  <filters>
                    <filter>
                      <artifact>*:*</artifact>
                      <excludes>
                        <exclude>META-INF/*.SF</exclude>
                        <exclude>META-INF/*.DSA</exclude>
                        <exclude>META-INF/*.RSA</exclude>
                      </excludes>
                    </filter>
                  </filters>
                </configuration>
              </execution>
            </executions>
          </plugin>
        </plugins>
      </build>
    </profile>
    <profile>
      <id>native</id>
      <build>
        <plugins>
          <plugin>
            <groupId>org.graalvm.buildtools</groupId>
            <artifactId>native-maven-plugin</artifactId>
            <!-- Do not go back to 1.1.6: it fails at native-image time with NoClassDefFoundError
                 org/apache/maven/shared/utils/logging/MessageUtils, which 1.1.7 fixes. -->
            <version>1.1.7</version>
            <extensions>true</extensions>
            <configuration>
              <imageName>pj</imageName>
              <mainClass>org.pijota.Main</mainClass>
              <buildArgs>
                <!-- Correctness flags (no-fallback, https url protocol, Jackson build-time init, pijota / logging
                     run-time init) are embedded so ANY native-image build gets them (bare native-image, jbang app
                     install with native, etc.): src/main/resources/META-INF/native-image/org.pijota/pijota/
                     native-image.properties. Only this distribution's size/CPU tuning stays here. -->
                <buildArg>-Os</buildArg>
                <!-- optimize for binary size (default is -O2, tuned for speed) -->
                <!-- Portable distribution: target a baseline CPU instead of the build host's (default targets the
                     build machine → the binary may SIGILL on older/other CPUs). For a fully standalone (statically
                     linked, no libc dependency) binary, build with the `static` profile (see `make native-static`). -->
                <buildArg>-march=compatibility</buildArg>
                <buildArg>${pgo.arg}</buildArg>
                <!-- no-op by default; set by `make native-pgo-*` (see Makefile) -->
                <buildArg>-H:+ReportExceptionStackTraces</buildArg>
              </buildArgs>
              <!-- HARMLESS native-image warning (build still succeeds): langchain4j-anthropic 1.16.3 ships a stale
                   META-INF/native-image proxy-config.json registering a dynamic proxy for the Retrofit interface
                   dev.langchain4j.model.anthropic.internal.api.AnthropicApi, which 1.16.3 REMOVED (it now speaks HTTP
                   via the JDK client, so no proxy is needed). native-image then warns that it "cannot register dynamic
                   proxy ... AnthropicApi not found" plus a deprecated proxy-config notice. It cannot be suppressed
                   here: the exclude-config option does not cover the legacy proxy-config scan, and native-image has no
                   flag to ignore it. The clean fix is upstream (langchain4j dropping the stale file); repackaging the
                   dependency just to strip one config file is not worth shading this carefully-tuned build. -->
            </configuration>
            <executions>
              <execution>
                <id>native-image</id>
                <goals>
                  <goal>compile-no-fork</goal>
                </goals>
                <phase>package</phase>
              </execution>
            </executions>
          </plugin>
        </plugins>
      </build>
    </profile>
    <profile>
      <!-- Fully standalone (no libc dependency) static binary. Use with -Pnative (see `make native-static`). LINUX-ONLY:
           GraalVM static+musl linking (the buildArgs below) is supported only on linux-amd64; on macOS/Windows use
           -Pnative (dynamically linked, portable). Requires a musl toolchain + musl-built zlib on PATH; `make
           setup-musl` provisions them. musl (not glibc) because static glibc breaks DNS/getaddrinfo, which this
           networking agent needs. The buildArgs here merge with the native profile's. -->
      <id>static</id>
      <build>
        <plugins>
          <plugin>
            <groupId>org.graalvm.buildtools</groupId>
            <artifactId>native-maven-plugin</artifactId>
            <configuration>
              <buildArgs combine.children="append">
                <buildArg>--static</buildArg>
                <buildArg>--libc=musl</buildArg>
                <!-- musl link needs libz.a + a libatomic_asneeded.a stub (gcc/musl-gcc specs quirk). Point both the
                     query-code probe compiles (CCompilerOption) and the final image link (CLibraryPath) at them. -->
                <buildArg>-H:CCompilerOption=-L${musl.libdir}</buildArg>
                <buildArg>-H:CLibraryPath=${musl.libdir}</buildArg>
              </buildArgs>
            </configuration>
          </plugin>
        </plugins>
      </build>
    </profile>
  </profiles>
</project>