Cargo.toml

[package]
name        = "mindex"
version     = "2.0.0"
edition     = "2024"
authors     = ["Сергей Боголюбов"]
license     = "MIT"
repository  = "https://github.com/silencespeakstruth/mindex"
readme      = "README.md"
description = "Local-first semantic code search: dense Qwen3-Embedding retrieval, tree-sitter symbols and agent research over your own repositories."
keywords    = ["code-search", "rag", "embeddings", "tree-sitter", "mcp"]
categories  = ["development-tools"]

[dependencies]
axum = { version = "0.8.9", features = ["json", "macros"] }
axum-server = { version = "0.8.0", features = ["tls-rustls"] }
bytes = "1"
h3 = "0.0.8"
h3-quinn = "0.0.10"
quinn = { version = "0.11", default-features = false, features = ["rustls", "runtime-tokio"] }
rustls-pemfile = "2"
tokio = { version = "1.52.3", features = ["full"] }
tower = { version = "0.5", features = ["util"] }
tracing = "0.1.44"
tracing-subscriber = { version = "0.3.23", features = ["env-filter", "json"] }
tree-sitter            = "0.26.9"
tree-sitter-tags       = "0.26.11"
tree-sitter-rust       = "0.24.2"
# Block grammar only (`LANGUAGE`); the inline grammar is not used. Documentation
# has no tags query, so this grammar carries chunking and nothing else.
tree-sitter-md         = { version = "0.5.3", features = ["parser"] }
tree-sitter-python     = "0.25.0"
tree-sitter-javascript = "0.25.0"
tree-sitter-typescript = "0.23.2"
tree-sitter-go         = "0.25.0"
tree-sitter-c          = "0.24.2"
tree-sitter-cpp        = "0.23.4"
tree-sitter-java       = "0.23.5"
tree-sitter-c-sharp    = "0.23.5"
tree-sitter-ruby       = "0.23.1"
tree-sitter-php        = "0.24.2"
tree-sitter-bash       = "0.25.1"
tree-sitter-html       = "0.23.2"
tree-sitter-css        = "0.25.0"
tree-sitter-json       = "0.24.8"
tree-sitter-scala      = "0.26.0"
tree-sitter-haskell    = "0.23.1"
tree-sitter-ocaml      = "0.25.0"
tree-sitter-zig        = "1.1.2"
tree-sitter-sequel     = "0.3.11"
# The `-ng` fork, not `tree-sitter-toml`: the original is stuck at tree-sitter 0.20
# and its `links` key collides with the modern grammars above.
tree-sitter-toml-ng    = "0.7.0"
tree-sitter-yaml       = "0.7.2"
serde = { version = "1.0.228", features = ["derive"] }
serde_json = "1.0.150"
thiserror = "2.0.18"
# Scoped bearer tokens (`backend/auth.rs`). All five were already in the tree
# transitively, so this promotes them to direct dependencies rather than growing
# it. A JWT crate was considered and declined: the requirement was control over
# the signing secret's copies in memory, and a library that copies the key into
# its own key type puts one beyond reach of any zeroing here. Owning ~100 lines
# also closes the algorithm-confusion family by construction — see `verify`.
hmac = "0.13.0"
base64 = "0.22.1"
subtle = "2.6.1"
zeroize = "1.8.2"
getrandom = "0.3.4"
tokenizers = { version = "0.23.1", features = ["http"] }
rustls = { version = "0.23.40", default-features = false, features = ["ring"] }
tokio-util = { version = "0.7.18", features = ["rt", "futures-util"] }
rusqlite = { version = "0.40.0", features = ["bundled", "hooks", "uuid"] }
uuid = { version = "1.23.2", features = ["serde", "v4"] }
sha2 = "0.11.0"
hex = "0.4.3"
reqwest = { version = "0.13.4", features = ["json", "stream"] }
tokio-stream = "0.1"
futures-core = "0.3"
async-trait = "0.1.89"
url = { version = "2.5.8", features = ["serde"] }
bytemuck = "1.25.0"
clap = { version = "4.6.1", features = ["derive"] }
toml = "0.9"
qdrant-client = "1.18.0"
glob = "0.3.3"
# OpenAPI/Swagger. `axum_extras` lets the `#[utoipa::path]` macro infer Path/Query/Json
# extractors; `vendored` bundles the Swagger UI assets into the binary so the build
# (incl. the offline `cargo fetch --locked` Docker layer) never reaches the network.
utoipa = { version = "5.5", features = ["axum_extras"] }
utoipa-swagger-ui = { version = "9.0", default-features = false, features = ["axum", "vendored"] }
# Metrics. Chosen over `metrics` + `metrics-exporter-prometheus` because its
# `Registry` is a plain value threaded through constructors, not a process-global
# recorder — the same rule config follows, and the only shape under which two
# unit tests in one binary can each own an independent metric set.
prometheus-client = "0.25.0"
http-body-util = "0.1"

[dev-dependencies]
# Exercises the `?stream=` query grammar in unit tests exactly as axum's Query
# extractor parses it (axum uses serde_urlencoded internally).
serde_urlencoded = "0.7"
# The signing key file's permission and round-trip tests need a real file: the
# mode is the thing under test, so a fake filesystem would test nothing.
tempfile = "3"