[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

[project]
name = "zerodom"
version = "0.0.9"
description = "Terminal-native DOM perception for red teams and AI agents. Hook into live Chrome sessions, cut HTML tokens 98.9% (median) and map attack surfaces from the CLI."
# PyPI cannot resolve relative image paths and the repo is private, so the full
# README's screenshots would render broken. This one is image-free.
readme = "README.pypi.md"
requires-python = ">=3.10"
license = "Apache-2.0"
license-files = ["LICENSE"]
keywords = ["appsec", "red-team", "security", "attack-surface", "pentest", "bug-bounty", "dom", "mcp", "ai-agents", "llm", "chrome", "cdp", "playwright", "tokens"]
authors = [{ name = "Syed Husnain Khalid", email = "contact@vexralabs.com" }]
classifiers = [
    "Development Status :: 4 - Beta",
    "Intended Audience :: Developers",
    "Intended Audience :: Information Technology",
    "Environment :: Console",
    "License :: OSI Approved :: Apache Software License",
    "Programming Language :: Python :: 3 :: Only",
    "Topic :: Security",
    "Topic :: Software Development :: Testing",
    "Topic :: Internet :: WWW/HTTP :: Browsers",
    "Topic :: Text Processing :: Markup :: HTML",
]
dependencies = [
    # lxml only — BeautifulSoup's tree construction alone costs ~60ms on a 5k-node
    # page, which does not fit the <50ms budget. See zerodom/parser.py.
    "lxml",
    "tiktoken",
    # Cap the next major on the two fast-moving deps: the MCP SDK is young and
    # `from mcp.server import MCPServer` is exactly the kind of import a major
    # can move, and Playwright majors couple to a browser build. A breaking
    # release must not silently break a fresh `pip install zerodom`. Tested on
    # mcp 2.2, playwright 1.62. The stable deps stay uncapped for embeddability.
    "mcp[cli]<3",
    "playwright<2",
    # `zerodom scan` reads YAML surface rules (zerodom/surfaces.py).
    "pyyaml",
    # Only for `zerodom relay` (zerodom/relay.py) — the local WS bridge between
    # our own connect_over_cdp and Microsoft's Playwright extension. See
    # docs/DECISIONS.md D11.
    "websockets",
]

[project.urls]
Homepage = "https://zerodom.vexralabs.com"
Documentation = "https://zerodom.vexralabs.com/docs/introduction"
Changelog = "https://zerodom.vexralabs.com/docs/changelog"
Repository = "https://github.com/DevHusnainAi/zerodom"
Issues = "https://github.com/DevHusnainAi/zerodom/issues"

[dependency-groups]
dev = ["pytest"]

[project.scripts]
zerodom = "zerodom.cli:main"
zerodom-mcp = "zerodom.mcp_server:main"

[tool.hatch.build.targets.wheel]
packages = ["zerodom"]

# The Chrome extension lives at the repo root (an MV3 popup can't load files from
# outside its own directory), so it's copied into the wheel here for
# `zerodom extension` to point "Load unpacked" at after a plain `pip install`.
[tool.hatch.build.targets.wheel.force-include]
"extension" = "zerodom/extension"

[tool.hatch.build.targets.sdist]
# The README points at GitHub-hosted images, so shipping 1.5MB of PNGs in every
# source download buys nothing.
exclude = ["assets", "demo", ".github"]