feat(vnext): add private parser worker protocol (#180)

## Summary
- add a strict private parser worker wire protocol and browser worker
endpoint
- load only literal PostgreSQL and BigQuery parser modules inside the
isolated worker
- fail closed on malformed messages, unsafe realms, overlap, and
poisoned parser descriptors
- add Node and Chromium coverage plus package artifact assertions

## Validation
- 1,159 Node tests passed with one intentional expected failure
- 4 Chromium worker tests passed
- typecheck, oxlint, test integrity, demo, package smoke, worker
placement, and changed coverage passed
- changed production coverage: 99.46% statements/lines and 100%
branches/functions
- exact-head adversarial review approved by architecture/security,
lifecycle/session, and packaging/browser reviewers

## Scope
Private infrastructure only: no public exports, session wiring, semantic
extraction, cache, or API compatibility commitment.

## Review policy
Copilot review is requested once for this PR. It will not be
re-requested after later pushes.

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Adds a private, versioned wire protocol and a dedicated module-worker
endpoint for `node-sql-parser` to run parsing in an isolated browser
worker. The endpoint now guards the entire backend operation and uses
stricter, bounded wire decoding; artifacts are production-shaped but
still private.

- **New Features**
- Closed protocol v1 for parse requests/responses; no AST, source text,
or raw errors on the wire; retryability derived from failure code.
- Dedicated worker endpoint that lazily loads `bigquery`/`postgresql`,
reuses the backend normalizer, and restores exact
`NodeSQLParser`/`global` descriptors around module load, decode, parser
construction, parse, and normalization.
- Single-flight only: one in-flight request; malformed or overlapping
requests emit a protocol error and then close.
- Outcomes include normalized statement kind, bounded unsupported
reasons, or bounded failure codes.

- **Bug Fixes**
- Guarded the full worker backend parse and permanently poison on
restoration failure; close the generation on `module-load` failures.
- Bounded and hardened wire decoding: accept only closed plain records,
enforce key limits, and avoid accessor traps.

<sup>Written for commit e06a42f.
Summary will update on new commits.</sup>

<a
href="https://cubic.dev/pr/marimo-team/codemirror-sql/pull/180?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>

<!-- End of auto-generated description by cubic. -->

Author: Light2Dark

docs/adr/0004-isolated-parser-execution.md

@@ -116,7 +116,9 @@ node-sql-parser/build/bigquery.js
 
 The worker verifies that `self === globalThis` and that no DOM window exists.
 It snapshots and restores the exact `NodeSQLParser` and `global` descriptors
-around dialect loading. Cleanup failure poisons that worker generation.
+around the complete backend operation: dialect loading, module decoding,
+parser construction, parsing, and output normalization. Cleanup failure
+poisons that worker generation.
 
 ### Private wire protocol
 
@@ -139,7 +141,7 @@ The initial response contains only one closed outcome:
 - Parsed normalized statement kind
 - Syntax rejection
 - Bounded unsupported reason
-- Bounded failure code plus retryability
+- Bounded failure code; retryability is derived from that code
 
 Messages do not contain:
 
@@ -150,6 +152,11 @@ Messages do not contain:
 - Absolute document ranges
 - Raw ASTs or generic payload bags
 
+The wire does not transport an independently supplied retryability boolean.
+The host treats only `module-load` as retryable; `backend` and
+`malformed-output` are terminal. A module-load failure closes the current
+worker generation so a retry cannot reuse a rejected dynamic-import realm.
+
 The host requires the current protocol version and correlation ID, validates
 all keys and closed values, and copies accepted data into new frozen objects.
 It then constructs an authentic `SqlParserAnalysis` with the exact pending

docs/vnext/node-sql-parser-adapter.md

@@ -59,8 +59,45 @@ exists, or `global` does not resolve exactly to `globalThis`, before loading a
 bundle. This blocks browser windows and Node DOM shims from exposing an
 unguarded secondary target. Pure Node loads restore the exact prior descriptors
 synchronously after module evaluation, including removing names that were
-previously absent. Cleanup failure permanently poisons loading. A
-dedicated-worker loader remains future work.
+previously absent. Cleanup failure permanently poisons loading. The dedicated
+worker applies the same exact restoration rule around the complete backend
+operation, including module evaluation, module decoding, parser construction,
+parsing, and output normalization.
+
+### Private browser worker endpoint
+
+The package contains a production-shaped but private module-worker endpoint.
+It is not exported from the package and is not reachable through `/vnext`.
+There is no public worker constructor, executor, queue, language-service
+module, or session integration yet.
+
+The endpoint:
+
+- uses only the extension-qualified PostgreSQL and BigQuery builds above;
+- loads each grammar lazily after a valid request;
+- reuses the realm-neutral backend engine for module, AST, and parser-error
+  normalization;
+- accepts and emits only a closed, versioned plain-data protocol;
+- returns normalized statement kind, bounded unsupported or failure evidence,
+  and never returns source text, raw errors, or backend ASTs;
+- derives retryability from the closed failure code instead of trusting a
+  separate wire flag;
+- restores the exact prior `NodeSQLParser` and `global` descriptors around
+  each complete backend operation; and
+- permanently poisons and closes its worker realm if cleanup cannot be proven
+  exact.
+
+The endpoint accepts only one request at a time. Overlap and malformed messages
+fail closed instead of creating an implicit worker-side queue. The future
+service-owned executor is responsible for serialization, correlation,
+deadlines, cancellation, generation replacement, and disposal.
+
+Direct Chromium tests construct this source module worker and exercise both
+real grammar builds. The separate worker-placement fixture remains
+diagnostic packaging evidence: it records resource timing, emitted chunk
+reachability, and bundle sizes with a fixture-owned protocol. It is not the
+public integration boundary and must not be read as evidence that an executor
+or session API already exists.
 
 Approximate local Node 24 arm64 measurements for the installed package were:
 

scripts/changed-coverage.mjs

@@ -34,7 +34,8 @@ const changedProductionFiles = execFileSync(
       !path.endsWith(".test.ts") &&
       !path.includes("/__tests__/") &&
       !path.includes("/browser_tests/") &&
-      path !== "src/debug.ts",
+      path !== "src/debug.ts" &&
+      path !== "src/vnext/node-sql-parser-browser-worker.ts",
   );
 const changedRuntimeFiles = (
   await Promise.all(

scripts/package-smoke.mjs

@@ -169,6 +169,21 @@ try {
   if (typeof packedPackage.dependencies?.["node-sql-parser"] !== "string") {
     throw new Error("Packed manifest does not declare node-sql-parser");
   }
+  const privateWorkerArtifacts = [
+    "dist/vnext/node-sql-parser-browser-worker.d.ts",
+    "dist/vnext/node-sql-parser-browser-worker.js",
+    "dist/vnext/node-sql-parser-browser-worker-endpoint.d.ts",
+    "dist/vnext/node-sql-parser-browser-worker-endpoint.js",
+    "dist/vnext/node-sql-parser-wire.d.ts",
+    "dist/vnext/node-sql-parser-wire.js",
+  ];
+  for (const artifact of privateWorkerArtifacts) {
+    if (!existsSync(join(packageDirectory, artifact))) {
+      throw new Error(
+        `Packed archive omitted private worker artifact ${artifact}`,
+      );
+    }
+  }
 
   writeFileSync(
     join(temporaryDirectory, "vnext-consumer.mjs"),