Make Phileas embeddable without hand-declaring its transitive dependencies

[jzonthemtn]

Problem

Phileas 4.x ships as a single ai.philterd:phileas artifact whose runtime functionality depends on ~14 third-party libraries (httpclient5, httpcore5, pdfbox/pdfbox-io, antlr4-runtime, libphonenumber, json-schema-validator, phisql, several commons-* libraries, ff3, gson). For some consumers those transitive dependencies do not come along, so the consumer has to rediscover and hand-declare every one of them, pinned to the exact versions Phileas expects.

This came up integrating Phileas 4.1.0 into the OpenSearch and Elasticsearch search-redact plugins (philterd/search-redact-opensearch-plugin, philterd/search-redact-elasticsearch-plugin). Their plugin build does not resolve Phileas's transitive dependencies, so the plugins now carry a hand-copied list of ~14 implementation lines mirroring Phileas's POM. That list is brittle: it drifts every time Phileas changes a dependency or a version.

What I confirmed

• Philter (a Maven consumer) declares only ai.philterd:phileas and builds, so Phileas's transitive dependencies do resolve for a standard Maven consumer. The published POM lists all 23 dependencies with resolvable version properties, no <optional> markers, and there is no Gradle Module Metadata file.
• So this is not a flat-out broken POM for Maven. The gap is for consumers that do not take transitive dependencies (the search-engine plugin build model is the concrete case), where assembling Phileas's dependency closure by hand is the only option today.

Proposed solutions (any one resolves it; a shaded artifact is the most robust)

1. Publish a shaded/all-in-one artifact (for example ai.philterd:phileas-all, or a shaded classifier) that bundles Phileas plus its runtime dependencies into one jar. Embedders (search plugins, UDFs, agents) then add one dependency and get everything, regardless of how their build handles transitives. This is the cleanest fix for embedding into sandboxed/plugin environments.
2. Verify and document transitive resolution for both Maven and Gradle consumers, and confirm the published POM declares all runtime dependencies at compile scope with resolvable versions, so a plain implementation("ai.philterd:phileas:<version>") pulls the full closure.
3. Publish a BOM (ai.philterd:phileas-bom) that pins the versions of Phileas plus its dependencies, so consumers that must list dependencies explicitly can import the BOM and omit versions, instead of hard-coding them.

Acceptance criteria

• A consumer can depend on Phileas and obtain its full runtime dependency closure without hand-listing individual libraries, via at least one of: a shaded artifact, verified transitive resolution, or a published BOM.
• The chosen mechanism is documented in the Phileas docs (how to embed Phileas as a dependency).
• The search-redact OpenSearch and Elasticsearch plugins are updated to use the new mechanism, removing their hand-copied dependency list.
• No em-dashes in any added docs.

Related

• Consumers affected: philterd/search-redact-opensearch-plugin, philterd/search-redact-elasticsearch-plugin (currently working around this with explicit dependency declarations).