[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

[project]
name = "prismor"
dynamic = ["version"]
description = "Runtime security for AI coding agents: policy enforcement, secret prevention, and supply-chain blocking."
readme = "PYPI.md"
requires-python = ">=3.8"
license = "Apache-2.0"
license-files = ["LICENSE"]
authors = [{ name = "Prismor Security", email = "hello@prismor.dev" }]
keywords = [
    "security",
    "ai-agents",
    "llm",
    "prompt-injection",
    "supply-chain",
    "claude-code",
    "policy-enforcement",
]
classifiers = [
    "Development Status :: 4 - Beta",
    "Intended Audience :: Developers",
    "Topic :: Security",
    "Topic :: Software Development :: Quality Assurance",
    "Operating System :: POSIX",
    "Operating System :: MacOS",
    "Programming Language :: Python :: 3",
]
dependencies = [
    "pyyaml>=6.0",
    # Ed25519 checks on the signed org policy and advisory feed. The openssl CLI
    # fallback can't do them on macOS (LibreSSL) or Windows (no openssl).
    "cryptography>=41",
    "tomli>=1.1.0; python_version < '3.11'",
]

[project.optional-dependencies]
dev = ["build", "pytest", "cryptography>=41", "PyJWT[crypto]>=2.8"]
# Kept so existing `pip install "prismor[signing]"` commands still resolve;
# cryptography is now a core dependency.
signing = ["cryptography>=41"]
# Verified end-user identity (settings.identity): JWT + JWKS verification.
# `pip install "prismor[identity]"`. docs/identity-verification.md
identity = ["PyJWT[crypto]>=2.8"]
# LLM layer of the semantic prompt-injection guard on hosts without the Claude
# Code CLI: routes to any provider via litellm. `pip install "prismor[semantic]"`.
semantic = ["litellm>=1.40"]
# Framework adapters ship inside this package (prismor.<framework>);
# the extras just pull the framework itself so `pip install "prismor[langchain]"`
# is a one-liner. See adapters/ for the sources and docs/frameworks-*.
langchain = ["langchain-core>=0.2"]
crewai = ["crewai>=0.30"]
openai-agents = ["openai-agents>=0.0.1"]
browser-use = ["browser-use>=0.1.0"]
pydantic-ai = ["pydantic-ai-slim>=0.1"]
autogen-core = ["autogen-core>=0.4"]
agno = ["agno>=1.0"]
semantic-kernel = ["semantic-kernel>=1.0"]
google-adk = ["google-adk>=1.0"]
agent-framework = ["agent-framework>=1.0"]
llamaindex = ["llama-index-core>=0.12"]
smolagents = ["smolagents>=1.0"]
ag2 = ["ag2>=0.9"]
beeai = ["beeai-framework>=0.1"]
# Live-verified with an ANTHROPIC_API_KEY (the SDK runs the bundled claude
# CLI) — see docs/frameworks-claude-agent-sdk.md for the method.
claude-agent-sdk = ["claude-agent-sdk>=0.1"]
frameworks = [
    "langchain-core>=0.2",
    "crewai>=0.30",
    "openai-agents>=0.0.1",
    "browser-use>=0.1.0",
    "pydantic-ai-slim>=0.1",
    "autogen-core>=0.4",
    "agno>=1.0",
    "semantic-kernel>=1.0",
    "google-adk>=1.0",
    "agent-framework>=1.0",
    "llama-index-core>=0.12",
    "smolagents>=1.0",
    "ag2>=0.9",
    "beeai-framework>=0.1",
    "claude-agent-sdk>=0.1",
]

[project.urls]
Homepage = "https://www.prismor.dev"
Repository = "https://github.com/PrismorSec/prismor"
Documentation = "https://www.prismor.dev/docs"

[project.scripts]
prismor = "prismor.runtime.immunity_cli:main"
immunity = "prismor.runtime.immunity_cli:main"   # deprecated alias — prints a notice; removed in a future release

# Hermes Agent plugin auto-discovery entry point
[project.entry-points."hermes_agent.plugins"]
prismor-cloak = "prismor.runtime.cloaking.hermes_plugin_entry:register"

[tool.hatch.version]
path = "prismor/runtime/__init__.py"

[tool.hatch.build.targets.wheel]
packages = [
    "prismor",
    "supplychain",
    # Framework adapter implementations — bundled so the extras above work
    # without separate adapter packages on PyPI.
    "adapters/langchain/prismor_langchain",
    "adapters/crewai/prismor_crewai",
    "adapters/openai-agents/prismor_openai",
    "adapters/browser-use/prismor_browser_use",
    "adapters/pydantic-ai/prismor_pydantic_ai",
    "adapters/autogen-core/prismor_autogen_core",
    "adapters/agno/prismor_agno",
    "adapters/semantic-kernel/prismor_semantic_kernel",
    "adapters/google-adk/prismor_google_adk",
    "adapters/agent-framework/prismor_agent_framework",
    "adapters/llamaindex/prismor_llamaindex",
    "adapters/smolagents/prismor_smolagents",
    "adapters/ag2/prismor_ag2",
    "adapters/beeai/prismor_beeai",
    "adapters/claude-agent-sdk/prismor_claude_agent_sdk",
]

# Bundle runtime data into the wheel under prismor/runtime/data/
[tool.hatch.build.targets.wheel.force-include]
# prismor.<framework> namespace shims (PEP 420 — no __init__.py above
# the leaf, so the prismor/ and prismor/ levels stay namespaces).
"adapters/langchain/prismor/langchain/__init__.py" = "prismor/langchain/__init__.py"
"adapters/crewai/prismor/crewai/__init__.py" = "prismor/crewai/__init__.py"
"adapters/openai-agents/prismor/openai/__init__.py" = "prismor/openai/__init__.py"
"adapters/browser-use/prismor/browser_use/__init__.py" = "prismor/browser_use/__init__.py"
"adapters/pydantic-ai/prismor/pydantic_ai/__init__.py" = "prismor/pydantic_ai/__init__.py"
"adapters/autogen-core/prismor/autogen_core/__init__.py" = "prismor/autogen_core/__init__.py"
"adapters/agno/prismor/agno/__init__.py" = "prismor/agno/__init__.py"
"adapters/semantic-kernel/prismor/semantic_kernel/__init__.py" = "prismor/semantic_kernel/__init__.py"
"adapters/google-adk/prismor/google_adk/__init__.py" = "prismor/google_adk/__init__.py"
"adapters/agent-framework/prismor/agent_framework/__init__.py" = "prismor/agent_framework/__init__.py"
"adapters/llamaindex/prismor/llamaindex/__init__.py" = "prismor/llamaindex/__init__.py"
"adapters/smolagents/prismor/smolagents/__init__.py" = "prismor/smolagents/__init__.py"
"adapters/ag2/prismor/ag2/__init__.py" = "prismor/ag2/__init__.py"
"adapters/beeai/prismor/beeai/__init__.py" = "prismor/beeai/__init__.py"
"adapters/claude-agent-sdk/prismor/claude_agent_sdk/__init__.py" = "prismor/claude_agent_sdk/__init__.py"
"immunity-agent.pth" = "immunity-agent.pth"
"advisories/immunity-feed.json" = "prismor/runtime/data/advisories/immunity-feed.json"
"advisories/immunity-feed.json.sig" = "prismor/runtime/data/advisories/immunity-feed.json.sig"
"keys/public.pub" = "prismor/runtime/data/keys/public.pub"
"templates/policy-tests-owasp.yaml" = "prismor/runtime/data/templates/policy-tests-owasp.yaml"
"templates/CLAUDE.md.template" = "prismor/runtime/data/templates/CLAUDE.md.template"
"prismor/runtime/cloaking/hermes-plugin/plugin.yaml" = "prismor/runtime/data/cloaking/hermes-plugin/plugin.yaml"
"prismor/runtime/cloaking/hermes-plugin/__init__.py" = "prismor/runtime/data/cloaking/hermes-plugin/__init__.py"
# Bundle the immunity-agent Claude skill (SKILL.md + its docs/, minus the heavy
# unreferenced demo.gif) so `prismor setup` can install it into a workspace's
# .claude/skills/ directory. Files are listed explicitly — a `docs/` directory
# mapping would drag in demo.gif (force-include ignores wheel `exclude`).
"SKILL.md" = "prismor/runtime/data/SKILL.md"
"docs/acp.md" = "prismor/runtime/data/docs/acp.md"
"docs/agentic-architecture-review.md" = "prismor/runtime/data/docs/agentic-architecture-review.md"
"docs/architecture.md" = "prismor/runtime/data/docs/architecture.md"
"docs/attestation-bundle.md" = "prismor/runtime/data/docs/attestation-bundle.md"
"docs/attribute-conditions.md" = "prismor/runtime/data/docs/attribute-conditions.md"
"docs/audit-trail.md" = "prismor/runtime/data/docs/audit-trail.md"
"docs/authzen.md" = "prismor/runtime/data/docs/authzen.md"
"docs/canary.md" = "prismor/runtime/data/docs/canary.md"
"docs/cli-reference.md" = "prismor/runtime/data/docs/cli-reference.md"
"docs/cloud-agents.md" = "prismor/runtime/data/docs/cloud-agents.md"
"docs/connecting-to-the-platform.md" = "prismor/runtime/data/docs/connecting-to-the-platform.md"
"docs/claude-cowork.md" = "prismor/runtime/data/docs/claude-cowork.md"
"docs/chatgpt.md" = "prismor/runtime/data/docs/chatgpt.md"
"docs/copilot-studio.md" = "prismor/runtime/data/docs/copilot-studio.md"
"docs/dashboard.md" = "prismor/runtime/data/docs/dashboard.md"
"docs/data-boundary.md" = "prismor/runtime/data/docs/data-boundary.md"
"docs/decision-contract.md" = "prismor/runtime/data/docs/decision-contract.md"
"docs/deploy-docker.md" = "prismor/runtime/data/docs/deploy-docker.md"
"docs/deploy-intune.md" = "prismor/runtime/data/docs/deploy-intune.md"
"docs/deploy-jamf.md" = "prismor/runtime/data/docs/deploy-jamf.md"
"docs/dev-insights.md" = "prismor/runtime/data/docs/dev-insights.md"
"docs/docker.md" = "prismor/runtime/data/docs/docker.md"
"docs/elevenlabs.md" = "prismor/runtime/data/docs/elevenlabs.md"
"docs/enterprise-tool-access.md" = "prismor/runtime/data/docs/enterprise-tool-access.md"
"docs/extensions.md" = "prismor/runtime/data/docs/extensions.md"
"docs/faq.md" = "prismor/runtime/data/docs/faq.md"
"docs/frameworks-agent-framework.md" = "prismor/runtime/data/docs/frameworks-agent-framework.md"
"docs/frameworks-llamaindex.md" = "prismor/runtime/data/docs/frameworks-llamaindex.md"
"docs/frameworks-smolagents.md" = "prismor/runtime/data/docs/frameworks-smolagents.md"
"docs/frameworks-ag2.md" = "prismor/runtime/data/docs/frameworks-ag2.md"
"docs/frameworks-agno.md" = "prismor/runtime/data/docs/frameworks-agno.md"
"docs/frameworks-autogen-core.md" = "prismor/runtime/data/docs/frameworks-autogen-core.md"
"docs/frameworks-beeai.md" = "prismor/runtime/data/docs/frameworks-beeai.md"
"docs/frameworks-browser-use.md" = "prismor/runtime/data/docs/frameworks-browser-use.md"
"docs/frameworks-claude-agent-sdk.md" = "prismor/runtime/data/docs/frameworks-claude-agent-sdk.md"
"docs/frameworks-crewai.md" = "prismor/runtime/data/docs/frameworks-crewai.md"
"docs/frameworks-google-adk.md" = "prismor/runtime/data/docs/frameworks-google-adk.md"
"docs/frameworks-langchain.md" = "prismor/runtime/data/docs/frameworks-langchain.md"
"docs/frameworks-mastra.md" = "prismor/runtime/data/docs/frameworks-mastra.md"
"docs/frameworks-openai-agents.md" = "prismor/runtime/data/docs/frameworks-openai-agents.md"
"docs/frameworks-overview.md" = "prismor/runtime/data/docs/frameworks-overview.md"
"docs/frameworks-pydantic-ai.md" = "prismor/runtime/data/docs/frameworks-pydantic-ai.md"
"docs/frameworks-semantic-kernel.md" = "prismor/runtime/data/docs/frameworks-semantic-kernel.md"
"docs/frameworks-vercel-ai.md" = "prismor/runtime/data/docs/frameworks-vercel-ai.md"
"docs/getting-started.md" = "prismor/runtime/data/docs/getting-started.md"
"docs/glossary.md" = "prismor/runtime/data/docs/glossary.md"
"docs/governance-surfaces.md" = "prismor/runtime/data/docs/governance-surfaces.md"
"docs/hermes.md" = "prismor/runtime/data/docs/hermes.md"
"docs/hosted-evaluation.md" = "prismor/runtime/data/docs/hosted-evaluation.md"
"docs/iam.md" = "prismor/runtime/data/docs/iam.md"
"docs/identity-verification.md" = "prismor/runtime/data/docs/identity-verification.md"
"docs/inference-hook.md" = "prismor/runtime/data/docs/inference-hook.md"
"docs/installation.md" = "prismor/runtime/data/docs/installation.md"
"docs/learning.md" = "prismor/runtime/data/docs/learning.md"
"docs/live-telemetry.md" = "prismor/runtime/data/docs/live-telemetry.md"
"docs/llm-proxy.md" = "prismor/runtime/data/docs/llm-proxy.md"
"docs/mcp-gateway.md" = "prismor/runtime/data/docs/mcp-gateway.md"
"docs/memory-integrity.md" = "prismor/runtime/data/docs/memory-integrity.md"
"docs/modes.md" = "prismor/runtime/data/docs/modes.md"
"docs/n8n.md" = "prismor/runtime/data/docs/n8n.md"
"docs/network-isolation.md" = "prismor/runtime/data/docs/network-isolation.md"
"docs/observability.md" = "prismor/runtime/data/docs/observability.md"
"docs/openclaw.md" = "prismor/runtime/data/docs/openclaw.md"
"docs/pause-and-login.md" = "prismor/runtime/data/docs/pause-and-login.md"
"docs/policy-layers-and-exemptions.md" = "prismor/runtime/data/docs/policy-layers-and-exemptions.md"
"docs/prismor-runtime.md" = "prismor/runtime/data/docs/prismor-runtime.md"
"docs/prompt-guardrails.md" = "prismor/runtime/data/docs/prompt-guardrails.md"
"docs/query-your-data.md" = "prismor/runtime/data/docs/query-your-data.md"
"docs/scoped-agent.md" = "prismor/runtime/data/docs/scoped-agent.md"
"docs/sdk-integration.md" = "prismor/runtime/data/docs/sdk-integration.md"
"docs/semantic-guard.md" = "prismor/runtime/data/docs/semantic-guard.md"
"docs/skill-scanner.md" = "prismor/runtime/data/docs/skill-scanner.md"
"docs/subagent-limits.md" = "prismor/runtime/data/docs/subagent-limits.md"
"docs/subagents.md" = "prismor/runtime/data/docs/subagents.md"
"docs/supply-chain.md" = "prismor/runtime/data/docs/supply-chain.md"
"docs/sweep-and-cloak.md" = "prismor/runtime/data/docs/sweep-and-cloak.md"
"docs/system-install.md" = "prismor/runtime/data/docs/system-install.md"
"docs/telemetry-receipts.md" = "prismor/runtime/data/docs/telemetry-receipts.md"
"docs/telemetry-sinks.md" = "prismor/runtime/data/docs/telemetry-sinks.md"
"docs/tool-access-precedence.md" = "prismor/runtime/data/docs/tool-access-precedence.md"
"docs/tool-tags.md" = "prismor/runtime/data/docs/tool-tags.md"
"docs/transcript-ingest.md" = "prismor/runtime/data/docs/transcript-ingest.md"

[tool.hatch.build.targets.sdist]
include = [
    "prismor/runtime/",
    "supplychain/",
    # The wheel is built FROM the sdist in CI — the bundled framework adapters
    # (impl modules + namespace shims) must ride along or the published wheel
    # ships shims that import nothing (the 1.14.1 bug).
    "adapters/",
    "immunity-agent.pth",
    "advisories/immunity-feed.json",
    "advisories/immunity-feed.json.sig",
    "keys/public.pub",
    "templates/",
    # Bundled Claude skill — needed in the sdist so the wheel's force-include
    # (build_wheel runs from the unpacked sdist) can find them. Only the .md
    # files; the heavy unreferenced docs/demo.gif stays out.
    "SKILL.md",
    "docs/*.md",
    "PYPI.md",
    "LICENSE",
]

# Type checking is advisory (not a CI gate). Scoped to shipped code so a local
# venv/, build/ or a nested worktree is never walked (#585). See CONTRIBUTING.md.
[tool.pyright]
include = ["prismor", "adapters", "supplychain"]
exclude = ["**/node_modules", "**/__pycache__", "**/.*", "venv", "build", "dist"]