pyproject.toml

[build-system]
requires = ["setuptools>=68.0", "wheel"]
build-backend = "setuptools.build_meta"

[project]
# Distribution/PyPI token is disambiguated from opencut.app (the browser-based
# editor at github.com/OpenCut-app/OpenCut, ~48K stars) which would otherwise
# dominate search. The "-ppro" qualifier signals the Adobe Premiere Pro
# integration that uniquely identifies this project. The product name
# ("OpenCut"), the import package (`opencut`), the CLI commands, and the CEP/UXP
# extension IDs are unchanged. See README "Naming & distribution".
name = "opencut-ppro"
version = "1.45.0"
description = "OpenCut for Premiere Pro - local AI video editing automation (captions, audio, VFX) for Adobe Premiere Pro via CEP/UXP, CLI, REST, and MCP"
readme = "README.md"
license = {text = "MIT"}
requires-python = ">=3.11,<3.15"
authors = [
    {name = "OpenCut Contributors"},
]
keywords = [
    "video-editing", "premiere-pro", "silence-removal", "captions", "whisper",
    "ffmpeg", "podcast", "ai-video", "audio-processing", "visual-effects",
    "chromakey", "upscaling", "face-enhancement", "music-generation",
]
classifiers = [
    "Development Status :: 4 - Beta",
    "Intended Audience :: End Users/Desktop",
    "Topic :: Multimedia :: Video",
    "Topic :: Multimedia :: Sound/Audio",
    "License :: OSI Approved :: MIT License",
    "Programming Language :: Python :: 3",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3.12",
    "Programming Language :: Python :: 3.13",
    "Programming Language :: Python :: 3.14",
    "Operating System :: Microsoft :: Windows",
    "Operating System :: POSIX :: Linux",
    "Operating System :: MacOS",
]

dependencies = [
    # CVE-2026-7246 / PYSEC-2026-2132 — command injection in click.edit() via the
    # editor shell invocation, fixed in Click 8.3.3. Floor above it in every lane.
    "click>=8.3.3,<9",
    "rich>=13.0,<14",
    "flask>=3.1.3,<4",
    "flask-cors>=6.0,<7",
    "waitress>=3.0.1,<4",
    "python-json-logger>=2.0,<3",
    "psutil>=5.9",
    "keyring>=25.7,<26",
    # Ed25519 verification for authenticated plugin artifacts. PyCA
    # cryptography is Apache-2.0 OR BSD-3-Clause and supports Python 3.11+.
    "cryptography>=48.0.1,<49",
    # RA-23 — Werkzeug/Jinja2 ship transitively with flask and are always
    # present. Pin the resolver floor to the same security level the lockfile
    # already holds so `pip install opencut` (no lock) cannot pull the
    # vulnerable releases: Werkzeug CVE-2026-21860 / CVE-2025-66221
    # (safe_join Windows device-name DoS, fixed 3.1.5), CVE-2026-27199
    # (safe_join Windows device-name bypass causing hanging reads, fixed
    # 3.1.6), and Jinja2 CVE-2025-27516 (sandbox breakout, fixed 3.1.6).
    "Werkzeug>=3.1.6",
    "Jinja2>=3.1.6",
]

[project.optional-dependencies]
standard = [
    "faster-whisper>=1.1,<2",
    # PySceneDetect 0.7 requires the OpenCV distribution directly. Standard
    # and video use that provider rather than declaring a second cv2 package.
    "opencv-python>=5,<6",
    "Pillow>=12.3.0,<13",
    "numpy>=1.24",
    "librosa>=0.10,<1",
    # F123 — pydub dropped (vestigial; not imported by the OpenCut tree;
    # complicates Python 3.13 because pydub still imports stdlib audioop).
    # See opencut.core.audioop_shim for the optional 3.13 bridge if a
    # downstream plugin needs pydub.
    "noisereduce>=3.0,<4",
    "scenedetect>=0.7.1,<1",
    # RA-23 — requests/urllib3 enter transitively via faster-whisper's
    # huggingface-hub fetch path. Floor them to the lockfile security level so
    # this lane cannot resolve urllib3<2.6.3 (CVE-2026-21441 decompression-bomb
    # DoS) or requests<2.33.0 (CVE-2026-25645).
    "requests>=2.33.0",
    "urllib3>=2.6.3",
]
captions = [
    "faster-whisper>=1.1,<2",
    "Pillow>=12.3.0,<13",
]
audio = [
    "demucs>=4.0,<5",
    "pedalboard>=0.9,<1",
    "librosa>=0.10,<1",
    # F123 — pydub dropped (see [standard] extra for rationale).
    "noisereduce>=3.0,<4",
    "edge-tts>=6.1,<7",
]
video = [
    "opencv-python>=5,<6",
    "Pillow>=12.3.0,<13",
    "numpy>=1.24",
    "scenedetect>=0.7.1,<1",
]
ai = [
    "realesrgan>=0.3,<1",
    "rembg>=2.0,<3",
    "gfpgan>=1.3,<2",
    "insightface>=0.7,<1",
    "onnxruntime>=1.26,<2",
    # CVE-2026-24747 torch.load RCE bypasses weights_only; scan pickle weights.
    "picklescan>=1.0.3",
]
ai-gpu = [
    "realesrgan>=0.3,<1",
    "rembg>=2.0,<3",
    "gfpgan>=1.3,<2",
    "insightface>=0.7,<1",
    "onnxruntime-gpu>=1.26,<2",
    "picklescan>=1.0.3",
]
diarize = [
    "pyannote.audio>=4.0,<5",
]
nemo-asr = [
    # NeMo 2.7.3 publishes Linux as its supported OpenCut runtime lane.
    # Keep this heavyweight/model-loading stack separate from [all].
    "nemo_toolkit[asr]>=2.7.3,<2.8; sys_platform == 'linux'",
    "torch>=2.10.0; sys_platform == 'linux'",
    "huggingface-hub>=0.36,<1; sys_platform == 'linux'",
    "picklescan>=1.0.3; sys_platform == 'linux'",
]
auto-edit = [
    "auto-editor>=29.3,<30",
]
scene-ml = [
    "transnetv2-pytorch>=1.0.5,<2",
]
reframe = [
    "mediapipe>=0.10,<1",
]
mcp = [
    # F137 — pin to the stable 1.x line. MCP 2.x is a pre-alpha
    # rewrite (FastMCP → McpServer) and breaks our JSON-RPC server.
    "mcp>=1.26,<2",
]
otio = [
    "opentimelineio>=0.17,<1",
    # F126/F263 — adapters split out of core OTIO after 0.15; pin the AAF
    # adapter here so `opencut[otio]` keeps an Avid-compatible export
    # path without the user installing a second extra by hand. F263 refreshed
    # the pin to the currently published 2.x line so `opencut[all]` resolves.
    "otio-aaf-adapter>=2.0,<3",
]
tts = [
    "edge-tts>=6.1,<7",
    "kokoro>=0.3",
]
depth = [
    "torch>=2.10.0",
    "torchvision>=0.25.0",
    "picklescan>=1.0.3",
    # Standalone depth/model-loading features can take the current
    # Transformers security floor because they are not coupled to WhisperX.
    "transformers>=5.3",
]
torch-stack = [
    # WhisperX 3.8.x is intentionally absent: it requires torchvision<0.24,
    # which cannot coexist with OpenCut's torchvision>=0.25/Torch>=2.10
    # security floor. Runtime readiness reports that conflict explicitly.
    "demucs>=4.0,<5",
    "realesrgan>=0.3,<1",
    "gfpgan>=1.3,<2",
    "pyannote.audio>=4.0,<5",
    "transnetv2-pytorch>=1.0.5,<2",
    "torch>=2.10.0",
    "torchvision>=0.25.0",
    "picklescan>=1.0.3",
    "transformers>=5.3",
]
all = [
    "faster-whisper>=1.1,<2",
    # RA-15 - [all] is the release-audited convenience lane. Torch-backed
    # features remain explicit extras so pip-audit can fail closed here.
    "opencv-python>=5,<6",
    "Pillow>=12.3.0,<13",
    "numpy>=1.24",
    "librosa>=0.10,<1",
    # F123 — pydub dropped (see [standard] extra).
    "noisereduce>=3.0,<4",
    "scenedetect>=0.7.1,<1",
    "pedalboard>=0.9,<1",
    "edge-tts>=6.1,<7",
    "rembg>=2.0,<3",
    "insightface>=0.7,<1",
    "onnxruntime>=1.26,<2",
    "auto-editor>=29.3,<30",
    "opentimelineio>=0.17,<1",
    "otio-aaf-adapter>=2.0,<3",
    # RA-23 — floor the transitive web stack in the release-audited [all] lane
    # so a clean resolver (no requirements-lock.txt) cannot select vulnerable
    # urllib3/requests releases. Werkzeug/Jinja2 floors come from core deps.
    "requests>=2.33.0",
    "urllib3>=2.6.3",
]
dev = [
    "pytest>=7.0,<10",
    "pytest-cov>=4.0,<6",
    "pytest-xdist>=3.0,<5",
    "ruff>=0.1,<1",
    "pre-commit>=3.0,<4",
]

[project.scripts]
opencut = "opencut.cli:main"
opencut-server = "opencut.server:main"
opencut-mcp-server = "opencut.mcp_server:main"

[project.urls]
Homepage = "https://github.com/SysAdminDoc/OpenCut"
Repository = "https://github.com/SysAdminDoc/OpenCut"
Issues = "https://github.com/SysAdminDoc/OpenCut/issues"
Documentation = "https://github.com/SysAdminDoc/OpenCut/wiki"

[tool.setuptools.packages.find]
include = ["opencut*"]

[tool.pytest.ini_options]
markers = [
    "integration: requires real FFmpeg processing",
    "slow: tests that take >30 seconds",
]

[tool.ruff]
line-length = 120
target-version = "py311"