pyproject.toml

[build-system]
requires = ["setuptools>=68.0", "wheel"]
build-backend = "setuptools.build_meta"

[project]
# Distribution/PyPI token is disambiguated from opencut.app (the browser-based
# editor at github.com/OpenCut-app/OpenCut, ~48K stars) which would otherwise
# dominate search. The "-ppro" qualifier signals the Adobe Premiere Pro
# integration that uniquely identifies this project. The product name
# ("OpenCut"), the import package (`opencut`), the CLI commands, and the CEP/UXP
# extension IDs are unchanged. See README "Naming & distribution".
name = "opencut-ppro"
version = "1.33.1"
description = "OpenCut for Premiere Pro - local AI video editing automation (captions, audio, VFX) for Adobe Premiere Pro via CEP/UXP, CLI, REST, and MCP"
readme = "README.md"
license = {text = "MIT"}
requires-python = ">=3.11"
authors = [
    {name = "OpenCut Contributors"},
]
keywords = [
    "video-editing", "premiere-pro", "silence-removal", "captions", "whisper",
    "ffmpeg", "podcast", "ai-video", "audio-processing", "visual-effects",
    "chromakey", "upscaling", "face-enhancement", "music-generation",
]
classifiers = [
    "Development Status :: 4 - Beta",
    "Intended Audience :: End Users/Desktop",
    "Topic :: Multimedia :: Video",
    "Topic :: Multimedia :: Sound/Audio",
    "License :: OSI Approved :: MIT License",
    "Programming Language :: Python :: 3",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3.12",
    "Programming Language :: Python :: 3.13",
    "Operating System :: Microsoft :: Windows",
    "Operating System :: POSIX :: Linux",
    "Operating System :: MacOS",
]

dependencies = [
    "click>=8.0,<9",
    "rich>=13.0,<14",
    "flask>=3.1.3,<4",
    "flask-cors>=6.0,<7",
    "waitress>=3.0.1,<4",
    "python-json-logger>=2.0,<3",
    "psutil>=5.9",
    # RA-23 — Werkzeug/Jinja2 ship transitively with flask and are always
    # present. Pin the resolver floor to the same security level the lockfile
    # already holds so `pip install opencut` (no lock) cannot pull the
    # vulnerable releases: Werkzeug CVE-2026-21860 / CVE-2025-66221
    # (safe_join Windows device-name DoS, fixed 3.1.5), CVE-2026-27199
    # (safe_join Windows device-name bypass causing hanging reads, fixed
    # 3.1.6), and Jinja2 CVE-2025-27516 (sandbox breakout, fixed 3.1.6).
    "Werkzeug>=3.1.6",
    "Jinja2>=3.1.6",
]

[project.optional-dependencies]
standard = [
    "faster-whisper>=1.1,<2",
    "opencv-python-headless>=4.13,<5",
    "Pillow>=12.2,<13",
    "numpy>=1.24",
    "librosa>=0.10,<1",
    # F123 — pydub dropped (vestigial; not imported by the OpenCut tree;
    # complicates Python 3.13 because pydub still imports stdlib audioop).
    # See opencut.core.audioop_shim for the optional 3.13 bridge if a
    # downstream plugin needs pydub.
    "noisereduce>=3.0,<4",
    "scenedetect[opencv]>=0.6,<1",
    # RA-23 — requests/urllib3 enter transitively via faster-whisper's
    # huggingface-hub fetch path. Floor them to the lockfile security level so
    # this lane cannot resolve urllib3<2.6.3 (CVE-2026-21441 decompression-bomb
    # DoS) or requests<2.33.0 (CVE-2026-25645).
    "requests>=2.33.0",
    "urllib3>=2.6.3",
]
captions = [
    "faster-whisper>=1.1,<2",
    "Pillow>=12.2,<13",
]
captions-whisperx = [
    "whisperx>=3.8.5,<4",
]
audio = [
    "demucs>=4.0,<5",
    "pedalboard>=0.9,<1",
    "librosa>=0.10,<1",
    # F123 — pydub dropped (see [standard] extra for rationale).
    "noisereduce>=3.0,<4",
    "edge-tts>=6.1,<7",
]
video = [
    "opencv-python-headless>=4.13,<5",
    "Pillow>=12.2,<13",
    "numpy>=1.24",
    "scenedetect[opencv]>=0.6,<1",
]
ai = [
    "realesrgan>=0.3,<1",
    "rembg>=2.0,<3",
    "gfpgan>=1.3,<2",
    "insightface>=0.7,<1",
    "onnxruntime>=1.26,<2",
]
ai-gpu = [
    "realesrgan>=0.3,<1",
    "rembg>=2.0,<3",
    "gfpgan>=1.3,<2",
    "insightface>=0.7,<1",
    "onnxruntime-gpu>=1.26,<2",
]
music = [
    # F263 — AudioCraft 1.x hard-pins Torch 2.1 and is not compatible with
    # the current WhisperX/Torch 2.8 stack or Python 3.12+ wheels. Keep it as
    # an explicit Python 3.11 music install instead of pulling it into [all].
    "audiocraft>=1.3,<2; python_version < '3.12'",
]
diarize = [
    "pyannote.audio>=4.0,<5",
]
auto-edit = [
    "auto-editor>=29.3,<30",
]
scene-ml = [
    "transnetv2-pytorch>=1.0.5,<2",
]
enhance = [
    # F263 — resemble-enhance 0.0.1 hard-pins Torch 2.1.1 and deepspeed
    # 0.12.4. Keep it as an explicit Python 3.11 enhancement install instead
    # of pulling it into [all] with the current WhisperX/pyannote Torch stack.
    "resemble-enhance>=0.0.1,<1; python_version < '3.12'",
]
mcp = [
    # F137 — pin to the stable 1.x line. MCP 2.x is a pre-alpha
    # rewrite (FastMCP → McpServer) and breaks our JSON-RPC server.
    "mcp>=1.26,<2",
]
otio = [
    "opentimelineio>=0.17,<1",
    # F126/F263 — adapters split out of core OTIO after 0.15; pin the AAF
    # adapter here so `opencut[otio]` keeps an Avid-compatible export
    # path without the user installing a second extra by hand. F263 refreshed
    # the pin to the currently published 2.x line so `opencut[all]` resolves.
    "otio-aaf-adapter>=2.0,<3",
]
tts = [
    "edge-tts>=6.1,<7",
    "kokoro>=0.3",
]
depth = [
    "torch>=2.6",
    "torchvision>=0.21",
    # Standalone depth/model-loading features can take the current
    # Transformers security floor because they are not coupled to WhisperX.
    "transformers>=5.3",
]
torch-stack = [
    # RA-15 - keep Torch/Transformers-backed feature stacks out of the
    # release-audited [all] lane until their advisory and resolver posture is
    # clean. Users who accept that larger surface can install
    # `opencut[all,torch-stack]` or the narrower feature extras directly.
    "whisperx>=3.8.5,<4",
    "demucs>=4.0,<5",
    "realesrgan>=0.3,<1",
    "gfpgan>=1.3,<2",
    "pyannote.audio>=4.0,<5",
    "transnetv2-pytorch>=1.0.5,<2",
    "torch>=2.6",
    "torchvision>=0.21",
    # WhisperX 3.8.x requires huggingface-hub<1, while Transformers 5.x
    # requires huggingface-hub>=1.x. Keep this lane explicit and audit-gated
    # until WhisperX supports the Transformers 5 dependency stack.
    "transformers>=4.30",
]
all = [
    "faster-whisper>=1.1,<2",
    # RA-15 - [all] is the release-audited convenience lane. Torch-backed
    # features remain explicit extras so pip-audit can fail closed here.
    "opencv-python-headless>=4.13,<5",
    "Pillow>=12.2,<13",
    "numpy>=1.24",
    "librosa>=0.10,<1",
    # F123 — pydub dropped (see [standard] extra).
    "noisereduce>=3.0,<4",
    "scenedetect[opencv]>=0.6,<1",
    "pedalboard>=0.9,<1",
    "edge-tts>=6.1,<7",
    "rembg>=2.0,<3",
    "insightface>=0.7,<1",
    "onnxruntime>=1.26,<2",
    "auto-editor>=29.3,<30",
    "opentimelineio>=0.17,<1",
    "otio-aaf-adapter>=2.0,<3",
    # RA-23 — floor the transitive web stack in the release-audited [all] lane
    # so a clean resolver (no requirements-lock.txt) cannot select vulnerable
    # urllib3/requests releases. Werkzeug/Jinja2 floors come from core deps.
    "requests>=2.33.0",
    "urllib3>=2.6.3",
]
dev = [
    "pytest>=7.0,<10",
    "pytest-cov>=4.0,<6",
    "pytest-xdist>=3.0,<5",
    "ruff>=0.1,<1",
    "pre-commit>=3.0,<4",
]

[project.scripts]
opencut = "opencut.cli:main"
opencut-server = "opencut.server:main"
opencut-mcp-server = "opencut.mcp_server:main"

[project.urls]
Homepage = "https://github.com/SysAdminDoc/OpenCut"
Repository = "https://github.com/SysAdminDoc/OpenCut"
Issues = "https://github.com/SysAdminDoc/OpenCut/issues"
Documentation = "https://github.com/SysAdminDoc/OpenCut/wiki"

[tool.setuptools.packages.find]
include = ["opencut*"]

[tool.pytest.ini_options]
markers = [
    "integration: requires real FFmpeg processing",
    "slow: tests that take >30 seconds",
]

[tool.ruff]
line-length = 120
target-version = "py311"