Cargo.toml

[package]
name = "zerograph"
version = "0.7.2"
edition = "2021"
rust-version = "1.98"
description = "A project knowledge graph built and queried at zero API tokens"
license = "MIT"
repository = "https://github.com/devmaxxx/zerograph"

[dependencies]
anyhow = "=1.0.104"
blake3 = "=1.8.7"
clap = { version = "=4.6.6", features = ["derive"] }
globset = "=0.4.20"
hf-hub = { version = "=0.5.0", default-features = false, features = ["ureq", "native-tls"] }
ignore = "=0.4.33"
rayon = "=1.12.0"
regex = "=1.13.1"
rust-stemmers = "=1.2.0"
serde = { version = "=1.0.229", features = ["derive"] }
serde_json = "=1.0.151"
serde_yaml = "=0.9.34"
ort = { version = "=2.0.0-rc.13", default-features = false, features = ["std", "api-24", "download-binaries", "tls-native"] }
streaming-iterator = "=0.1.9"
toml = "=1.1.4"
tokenizers = { version = "=0.22.2", default-features = false, features = ["onig"] }
tree-sitter = "=0.27.0"
tree-sitter-typescript = "=0.23.2"
# C#'s grammar: the tree-sitter org's crate, 1 file of 1,194 with an error in the 2026-09-11 census.
# Razor has no usable grammar and is read through this one by blanking (L6).
tree-sitter-c-sharp = "=0.23.5"
# Kotlin: -sg over -ng because both parse all 126 .kt files of the pinned fixture with no ERROR
# node and -sg is the maintained line; -ng is the fallback if MSVC cannot build -sg.
tree-sitter-kotlin-sg = "=0.4.1"
# Java: the tree-sitter org's grammar, the only one on this ABI.
tree-sitter-java = "=0.23.5"
# PostgreSQL. Chosen over tree-sitter-sequel 0.3.11, which errors in 72 of the census's 95 .sql files;
# 1.2.4 parses every one and is not a beta. It is the largest grammar in the build (+14.6 MB stripped),
# so it is read against the archive bar rather than assumed small.
tree-sitter-postgres = "=1.2.4"
# The only GraphQL grammar on tree-sitter 0.27's ABI; none of the census's 191 files has an error.
tree-sitter-graphql = "=0.2.1"
# Rust and Python: the tree-sitter org's grammars, both MIT and on tree-sitter 0.27's ABI.
tree-sitter-rust = "=0.24.2"
tree-sitter-python = "=0.25.0"
# Bicep, HCL and Shell. Each parsed its census corpus with no ERROR node except bash's 4 of 131 files,
# all below a function body (spec §0); licences MIT, Apache-2.0 and MIT.
tree-sitter-bash = "=0.25.1"
tree-sitter-bicep = "=1.1.0"
tree-sitter-hcl = "=1.1.0"
# Dart: the only grammar crate on tree-sitter 0.27's ABI (spec §2). MIT.
tree-sitter-dart = "=0.2.0"
# Swift: the only maintained grammar crate (spec §2). MIT. 3.7 MB stripped; spec §9 item 3 is the files-only alternative.
tree-sitter-swift = "=0.7.3"
# Lua: the tree-sitter-grammars crate, the one ast-grep carries. MIT, ABI 15, 0.35 MB of parser source.
tree-sitter-lua = "=0.5.0"
# Go: the tree-sitter org's grammar, the one ast-grep carries. MIT, ABI 15, 1.5 MB of parser source.
tree-sitter-go = "=0.25.0"
# C: the tree-sitter org's grammar, the one ast-grep carries. MIT, ABI 15, 3.7 MB of parser source.
tree-sitter-c = "=0.24.2"
# C++: the tree-sitter org's grammar, the one ast-grep carries. MIT, ABI 14.
tree-sitter-cpp = "=0.23.4"
# PHP: the tree-sitter org's grammar at 0.24.2, the newest inside ast-grep's `^0.24.0`. MIT, ABI 15, 13.4 MB
# of parser source for its two parsers. We read `LANGUAGE_PHP`, which takes HTML before `<?php`.
tree-sitter-php = "=0.24.2"
# Ruby: the tree-sitter org's grammar, the one ast-grep carries. MIT, ABI 14, 15 MB of parser source.
tree-sitter-ruby = "=0.23.1"
# Elixir: the elixir-lang grammar, the one ast-grep carries. Apache-2.0, ABI 14.
tree-sitter-elixir = "=0.3.5"
# Scala: the tree-sitter org's grammar, the one ast-grep carries. MIT, ABI 15, 26 MB of parser source.
tree-sitter-scala = "=0.26.2"
# OCaml: the tree-sitter org's grammar, its own crate because ast-grep does not carry it. MIT, ABI 15. We
# read `LANGUAGE_OCAML` and `LANGUAGE_OCAML_INTERFACE`, never its type grammar.
tree-sitter-ocaml = "=0.26.0"
# Detection and grammars behind `lang::detect` and `Lang::grammar`: its extension table and the grammars
# it carries. Default features off, because the default compiles 27 grammars and nine of them we never
# read. Each feature is a grammar pinned above; Cargo unifies the two into one copy, and the `=` pins keep
# `cargo update` from moving a grammar inside ast-grep's caret range.
ast-grep-language = { version = "=0.45.3", default-features = false, features = [
    "tree-sitter-bash", "tree-sitter-c", "tree-sitter-c-sharp", "tree-sitter-cpp", "tree-sitter-dart", "tree-sitter-go", "tree-sitter-hcl", "tree-sitter-java",
    "tree-sitter-kotlin", "tree-sitter-lua", "tree-sitter-php", "tree-sitter-python", "tree-sitter-rust", "tree-sitter-swift", "tree-sitter-typescript",
    "tree-sitter-ruby", "tree-sitter-elixir", "tree-sitter-scala",
] }
postcard = { version = "=1.1.3", features = ["use-std"] }
# Credentials inside files that are read (src/secrets.rs). Without `native`: its CLI, walker, logger and
# thread pool are not needed to scan a string, and the walk here is `ignore`'s.
secrets_scanner = { version = "=0.2.3", default-features = false }
# Already in the tree through `regex`; named here to find which rules a text's keywords call for.
aho-corasick = "=1.1.5"
# A newer zerograph on npm, checked at most daily from an interactive run (src/update.rs). Its ureq 3
# and native-tls unify with hf-hub's, so no second HTTP or TLS stack is built.
update-informer = { version = "=1.3.0", default-features = false, features = ["npm", "ureq", "native-tls"] }

[dev-dependencies]
tempfile = "=3.27.0"

# `serve` catches SIGTERM so its socket file goes with it, and background work lowers its own
# priority; std has no API for either, and libc is in the lock already through indicatif's console.
[target.'cfg(unix)'.dependencies]
libc = "=0.2.189"

# std has no AF_UNIX on Windows; socket2 has, and is in the lock already through hf-hub's client.
# The file identity behind the socket name is the same story: `MetadataExt::file_index` carries it
# and has been unstable since 2019 (rust-lang/rust#63010), so the handle is asked directly, through
# a crate ort already puts in the lock. Background priority for the refreshes nobody waits on is
# asked of the same crate.
[target.'cfg(windows)'.dependencies]
socket2 = "=0.6.5"
windows-sys = { version = "=0.61.2", features = ["Win32_Foundation", "Win32_Storage_FileSystem", "Win32_System_Threading"] }

[profile.release]
lto = "thin"

# The secret scanner compiles hundreds of regexes, which an unoptimised regex-automata does seven
# times slower: every test that builds a store would pay that, not only the scanner's own.
[profile.dev.package.regex-automata]
opt-level = 3
[profile.dev.package.regex-syntax]
opt-level = 3
[profile.dev.package.aho-corasick]
opt-level = 3
[profile.dev.package.secrets_scanner]
opt-level = 3