[package]
exclude = [
"*.7z",
"*.log",
"*.env",
"*.png",
"*.jpg",
"*.bak",
"*.bak.*",
"*.*.bak",
"*.*.bak.*",
"*.tmp",
"*.tmp.*",
"*.*.tmp",
"*.*.tmp.*",
"*.journal",
"*.journal.*",
"*.*.journal",
"*.*.journal.*",
"*.atomwrite_tmp",
"*.atomwrite_tmp.*",
"*atomwrite_tmp*",
"*_tmp*",
"*.atomwrite-*",
"*atomwrite-*",
"*.atom_*",
"*atom_*",
"*.atom-*",
"*atom-*",
"*._agent_tmp*",
"._agent_tmp*",
"*agent_tmp*",
"*.tmp_*",
"*.*.tmp_*",
"gaps.md",
"**/gaps.md",
"graphrag.sqlite",
"**/graphrag.sqlite",
"graphrag.sqlite.enrich-queue.sqlite",
"**/graphrag.sqlite.enrich-queue.sqlite",
"graphrag.sqlite-wal",
"**/graphrag.sqlite-wal",
".enrich-queue.sqlite",
"**/.enrich-queue.sqlite",
".enrich-queue.sqlite-shm",
"**/.enrich-queue.sqlite-shm",
".ingest-queue.sqlite-shm",
"**/.ingest-queue.sqlite-shm",
".ingest-queue.sqlite-wal",
"**/.ingest-queue.sqlite-wal",
"CLAUDE.md",
"base_*/**",
"docs_rules*/**",
".atomwrite_*/**",
".atomwrite-*/**",
".atomwrite*/**",
".tmp*/**",
".atom_*/**",
".atom-*/**",
".agent_*/**",
"_agent_*/**",
".staging*/**",
".tmp_*/**",
".setting.cyber/**",
"docs_rules_ingest/**",
".claude/**",
".skill-build/**",
".enrich-overnight/**",
".archive/**",
"uploads/**",
"docs_bugs/**",
]
name = "sqlite-graphrag"
version = "1.2.8"
edition = "2021"
rust-version = "1.88"
description = "Persistent GraphRAG memory for Claude Code, Codex, Cursor, and 27 AI agents — one self-contained ~19 MiB Rust binary, zero daemon. Never re-explain your codebase again. Hybrid retrieval (FTS5 BM25 + cosine similarity + multi-hop graph traversal) surfaces the right memory in milliseconds. Embedding and entity enrichment run as parallel REST calls against your cloud LLM — no fragile headless subprocesses, no ONNX runtime, no model downloads. Soft-delete with full version history, transactional atomic writes, BLAKE3-tracked mutations. OAuth-only: raw API keys ABORT the spawn."
license = "Apache-2.0 OR MIT"
repository = "https://github.com/danilo-aguiar-br/sqlite-graphrag"
homepage = "https://docs.rs/sqlite-graphrag"
documentation = "https://docs.rs/sqlite-graphrag"
readme = "README.md"
keywords = ["graphrag", "sqlite", "llm", "embeddings", "memory"]
categories = ["command-line-utilities", "database", "api-bindings"]
default-run = "sqlite-graphrag"
include = [
"src/**/*.rs",
"Cargo.toml",
"Cargo.lock",
"/README.md",
"README.pt-BR.md",
"CHANGELOG.md",
"CHANGELOG.pt-BR.md",
"LICENSE",
"LICENSE-MIT",
"LICENSE-APACHE",
"CODE_OF_CONDUCT.md",
"CODE_OF_CONDUCT.pt-BR.md",
"CONTRIBUTING.md",
"CONTRIBUTING.pt-BR.md",
"SECURITY.md",
"SECURITY.pt-BR.md",
"INTEGRATIONS.md",
"INTEGRATIONS.pt-BR.md",
"llms.txt",
"llms-full.txt",
"llms.pt-BR.txt",
"docs/AGENTS.md",
"docs/AGENTS.pt-BR.md",
"docs/COOKBOOK.md",
"docs/COOKBOOK.pt-BR.md",
"docs/HOW_TO_USE.md",
"docs/HOW_TO_USE.pt-BR.md",
"docs/MIGRATION.md",
"docs/MIGRATION.pt-BR.md",
"docs/TESTING.md",
"docs/TESTING.pt-BR.md",
"docs/CROSS_PLATFORM.md",
"docs/CROSS_PLATFORM.pt-BR.md",
"docs/HEADLESS_INVOCATION.md",
"docs/HEADLESS_INVOCATION.pt-BR.md",
"docs/TEST_PLAN.md",
"docs/TEST_PLAN.pt-BR.md",
"docs/DOCUMENTATION_FRAMEWORK.md",
"docs/decisions/INDEX.md",
"docs/decisions/adr-*.md",
"docs/decisions/adr-*.pt-BR.md",
"docs/schemas/*.schema.json",
"docs/schemas/README.md",
"skills/sqlite-graphrag-en/SKILL.md",
"skills/sqlite-graphrag-pt/SKILL.md",
"rust-toolchain.toml",
".cargo/config.toml",
"benches/**/*.rs",
"tests/**/*.rs",
"migrations/**/*",
"scripts/*.sh",
]
# `include` above is what actually decides the tarball. The `exclude` key at the
# top of `[package]` is carried on purpose and is NOT what protects this crate:
# Cargo IGNORES `exclude` entirely whenever `include` is present, which the
# release tooling reports as `CRATES_EXCLUDE_EFFECTIVE=0` on every run.
#
# It stays because the release SSOT keeps every project's manifest carrying the
# same junk list, so a reader comparing two repositories sees one shape. Read it
# as documentation of what must never ship, never as the mechanism that stops it.
#
# The mechanism is this `include` allowlist plus the package-list gate, which
# runs `cargo package --list` and fails on any junk match. Anything that must
# stay out of the crate stays out by NOT being listed in `include`.
[[bin]]
name = "sqlite-graphrag"
path = "src/main.rs"
[[bench]]
name = "cli_benchmarks"
harness = false
[[bench]]
name = "regression_baseline"
harness = false
# G54 (v1.0.80): retrieval-quality micro-benchmark for `recall` and
# `hybrid-search`. Opt-in only — runs only when
# `SQLITE_GRAPHRAG_BENCH_OPT_IN=1` is set; the regular CI gate that runs
# `cargo bench --bench regression_baseline` does NOT touch this bench.
[[bench]]
name = "retrieval_bench"
harness = false
[[test]]
name = "loom_lock_slots"
path = "tests/loom_lock_slots.rs"
[dependencies]
# rusqlite pinned at 0.37; upgrade to 0.39 deferred — refinery 0.9.1 (currently
# published) constrains rusqlite to ">=0.23, <=0.38" (refinery_core/Cargo.toml at
# v0.9.1). Native SQLite linking forbids two rusqlite versions in the graph
# (see https://stackoverflow.com/questions/69403524). Reassess when a refinery
# release supporting rusqlite 0.39 ships; tracked for v1.0.41.
async-trait = "0.1"
semver = { version = "1", features = ["serde"] }
ahash = "0.8"
rusqlite = { version = "0.37", features = ["bundled", "blob", "load_extension", "functions", "trace", "backup"] }
# v1.0.76: sqlite-vec REMOVED. All vector search now runs in pure Rust over a
# `memory_embeddings(memory_id, embedding BLOB, source)` table, with cosine
# similarity computed on demand. This eliminates a heavy build-time dep and
# the `load_extension` runtime cost. The `vec` command is now an alias for
# inspecting the embeddings table.
clap = { version = "4.6", features = ["derive"] }
clap_complete = "4"
serde = { version = "1", features = ["derive"] }
serde_json = "1"
tracing = { version = "0.1", features = ["attributes"] }
tracing-subscriber = { version = "0.3", features = ["json", "env-filter", "fmt", "ansi", "registry", "tracing-log"] }
# GAP-SG-99: non-blocking rolling file appender; WorkerGuard held for flush on shutdown.
tracing-appender = "0.2.5"
refinery = { version = "0.9", features = ["rusqlite"] }
# v1.0.76: siphasher pinned to 1.x to compute migration checksums in
# the `migrate --rehash` subcommand. Same algorithm and same version
# that refinery-core 0.9.1 uses internally (SipHasher13 over
# name | version | sql). Without this dep we would have to vendor the
# SipHasher13 implementation; the dep is already in the build graph
# transitively, so this entry only makes the link explicit.
siphasher = "1"
anyhow = "1"
thiserror = "2"
toml = "0.8"
# `pure` drops the hand-written C/assembly backends. On x86_64 the build script
# then routes SSE2/SSE4.1/AVX2 through Rust `std::arch` intrinsics instead, so
# the hash stays vectorised and only the assembly edge and AVX-512 are given up:
# measured 6130 -> 5007 MiB/s on a 512 KiB buffer, which is 18 microseconds more
# per maximum-size body, against a SQLite write and a REST round trip. Buying
# back those microseconds costs a C toolchain in every consumer's build.
blake3 = { version = "1", default-features = false, features = ["std", "pure"] }
directories = "5"
# fastrand: dependency-free PRNG for jitter (H7+M7); MSRV 1.36, ~30 LOC, no transitive deps
fastrand = "2"
fs4 = { version = "0.9", features = ["sync"] }
interprocess = "2"
regex = "1"
# v1.0.93: reqwest for direct OpenRouter API embedding — replaces CLI subprocess spawning
reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "json"] }
secrecy = { version = "0.10", features = ["serde"] }
tokio = { version = "1", features = ["rt-multi-thread", "sync", "time", "io-util", "macros", "process"] }
tokio-util = { version = "0.7", features = ["rt"] }
chrono = { version = "0.4", default-features = false, features = ["clock", "serde"] }
chrono-tz = "0.10"
sysinfo = { version = "0.32", default-features = false, features = ["system"] }
ctrlc = { version = "3.4", features = ["termination"] }
# v1.0.82 GAP-002: SIGTERM + SIGHUP coverage that the ctrlc crate cannot
# provide (it only handles SIGINT on Unix; SIGTERM/SIGHUP need their own
# async-signal-safe handler). `signal-hook-iterator` is the documented
# cross-platform pattern for registering multiple signals with a single
# C-level handler that just writes to a pipe. The `iterator` feature is
# unix-only by design.
signal-hook = { version = "0.3", default-features = false, features = ["iterator"] }
# Pin preventivo — constant_time_eq 0.4.3 bumped MSRV para 1.95.0 em versão patch.
# Entra como dep transitiva de blake3 (range ^0.4). Sem este pin, `cargo install`
# sem --locked resolve 0.4.3 e quebra a instalação em toolchains 1.88..1.94.
# Reavaliar quando CI passar em 1.95 e `rust-version` avançar para 1.95.
constant_time_eq = "=0.4.2"
# parking_lot: faster Mutex + deadlock detection in debug builds (P09 parallelism gap)
parking_lot = "0.12"
libc = "0.2"
rayon = "1.10"
text-splitter = { version = "0.30.1", default-features = false, features = ["markdown"] }
# v1.0.76: fastembed, ort, ndarray, tokenizers, hf-hub removed from the
# default build. Embedding generation is now LLM headless only (claude
# code / codex CLI OAuth). The default build is a small, fast Rust
# binary that delegates generation to external processes.
# v1.0.79: the optional legacy dependencies and the `embedding-legacy`,
# `ner-legacy` and `full` features were removed entirely (originally
# scheduled for v1.1.0). The CLI is LLM-only with no local-model path.
unicode-normalization = "0.1.25"
tempfile = "3"
sys-locale = "0.3"
wait-timeout = "0.2"
which = "7"
zeroize = "1"
# GAP-E2E-007 (v1.0.89): schemars 0.8 generates JSON Schema from Rust types
# at compile time. Pinned to 0.8 because 1.0 introduced breaking API changes
# (e.g. `schema_for!` macro signature). Must-Ignore (`additionalProperties: true`)
# per docs_rules/rules_rust_json_e_ndjson.md line 537.
# Lives in [dependencies] because the derive macro is used on the production
# `HealthResponse` struct in src/commands/health.rs, not just in tests.
schemars = "0.8"
# v1.0.97: llm_json repairs malformed JSON from OpenRouter chat models
# (markdown code fences, trailing commas, unquoted keys) before re-parsing.
llm_json = "1.0.3"
# v1.0.97: tiktoken-rs (cl100k_base BPE) for exact token counts — used as a
# conservative proxy for the qwen3-embedding-8b ~32K-token context ceiling.
tiktoken-rs = "0.12"
rapidfuzz = "0.5"
[target.'cfg(windows)'.dependencies]
# G29 (v1.0.68): pinned exact to 0.59.0 because HANDLE type changed
# from `isize` (0.48/0.52) to `*mut c_void` (>= 0.59); future patch versions
# could regress again. Tracked in Cargo.lock via `cargo update -p windows-sys`.
# GAP-SG-144: the Security/Authorization modules back the DACL hardening in
# `config::restrict_to_current_user`, which is the Windows counterpart of the
# `0o600` applied under `cfg(unix)`. No new crate enters the graph — only
# additional feature gates on the already-pinned dependency.
windows-sys = { version = "=0.59.0", features = [
"Win32_System_Console",
"Win32_System_Threading",
"Win32_Security",
"Win32_Security_Authorization",
"Win32_Foundation",
] }
[dev-dependencies]
assert_cmd = "2"
insta = { version = "1", features = ["json"] }
tracing-test = "0.2"
criterion = { version = "0.5", features = ["html_reports"] }
proptest = { version = "1", features = ["std"] }
tempfile = "3"
predicates = "3"
serde_json = "1"
serial_test = "3"
mockall = "0.13"
wiremock = "0.6"
libc = "0.2"
jsonschema = "0.29"
# Same configuration as the runtime dependency: `pure` keeps blake3 on its Rust
# backend instead of compiling the SIMD assembly, so the default features are
# not re-enabled behind `cargo test`. This is NOT a C-free build. `cc` stays in
# the graph because `libsqlite3-sys` builds the bundled SQLite and `ring` builds
# the rustls crypto backend; `Cargo.lock` also lists it under `generator` and
# `iana-time-zone-haiku`. The lockfile is not feature-resolved, so the
# `blake3 -> cc` edge is recorded there even though `pure` never invokes it.
blake3 = { version = "1", default-features = false, features = ["std", "pure"] }
[target.'cfg(sqlite_graphrag_loom)'.dev-dependencies]
# Só compila quando RUSTFLAGS="--cfg sqlite_graphrag_loom" é passado — previne livelock térmico.
# Incidente 2026-04-19: loom ativado sem gate saturou i9-14900KF em Tjmax 100°C.
loom = "0.7"
[profile.release]
lto = "fat"
codegen-units = 1
strip = true
opt-level = 3
panic = "abort"
debug = false
overflow-checks = false
incremental = false
[profile.release.package."*"]
opt-level = 3
[profile.bench]
inherits = "release"
debug = 1
[features]
# Opt-in for the 29 slow integration test files that spawn the binary repeatedly.
#
# GAP-SG-271: this comment used to say "future heavy tests (stress/exhaustive
# property tests)", which described nothing that was actually behind it. What sat
# here were the five strict schema-contract suites — the only tests that compare
# the binary's real stdout against `docs/schemas/*.schema.json` — and `cargo test`
# is this project's ONLY automatic gate, so gating them meant the published
# contract had no enforcement at all. Those five now run unconditionally.
#
# A comment that describes the wrong contents is worse than no comment: it
# answers the reviewer's question with a reassurance instead of a fact.
slow-tests = []
# Enable parking_lot deadlock detection thread (10s polling interval).
deadlock-detection = ["parking_lot/deadlock_detection"]
# v1.0.76 — Default LLM-only build
# The default build (no features) is the LLM-only build: it does NOT pull in
# fastembed / ort / ndarray / tokenizers / hf-hub. All embedding generation,
# NER, and vector search run in pure Rust over the embeddings table, with
# generation delegated to claude code / codex CLI headless (OAuth, no MCP,
# no hooks). The CLI is one-shot; there is no daemon.
llm-only = []
# v1.0.79 (G42 follow-up): the legacy features `embedding-legacy`,
# `ner-legacy` and `full` were REMOVED (originally scheduled for v1.1.0)
# together with the optional fastembed / ort / ndarray / tokenizers /
# hf-hub dependencies. There is no local-model build path any more.
[profile.dev]
opt-level = 1
[profile.dev.package."*"]
opt-level = 2
[lints.rust]
# `sqlite_graphrag_miri` was registered here for the mimalloc allocator gate,
# which v1.2.2 removed along with mimalloc itself. Nothing reads the cfg now.
unexpected_cfgs = { level = "warn", check-cfg = ['cfg(sqlite_graphrag_loom)'] }
[lints.rustdoc]
# The 64 unresolved links the v1.2.7 pre-publish gate found had been invisible
# since v1.1.1, and not because anyone was careless. The rustdoc book states it
# outright: these lints "are only available when running rustdoc, not rustc".
# `cargo check`, `cargo clippy -- -D warnings` and `cargo test --lib` are all
# structurally blind to them, and those are the gates this project actually
# runs. `missing_docs` is the documented exception to that rule, and it is also
# the one doc lint that never regressed — same crate, same `deny`, opposite
# outcome, explained entirely by which tool can see it.
#
# Declaring the level here rather than in RUSTDOCFLAGS is the point. RFC 3389
# maps the `rustdoc` table onto the rustdoc command, so `cargo doc` fails on its
# own instead of depending on someone remembering an environment variable that
# lives in a script outside the repo.
#
# GAP-SG-228 corrected an over-claim written here: this block once said
# `cargo test --doc` failed on its own too. Measured on v1.2.8, it does not.
# `rustdoc --test` extracts doctests without resolving intra-doc links, so it
# exits 0 on a tree where `cargo doc --no-deps` exits 101. `cargo doc` is the
# ONLY tool that sees this class, and it is not among the gates this repository
# runs — `no_ci_workflows_gate` declares `cargo test` as the only automatic one.
# `tests/rustdoc_link_gate.rs` closes `private_intra_doc_links` statically, in
# milliseconds and without the build lock. The other two lints below remain
# enforced only by `cargo doc`; that leftover is tracked in `gaps.md`.
broken_intra_doc_links = "deny"
private_intra_doc_links = "deny"
invalid_html_tags = "deny"