feat(vnext): add private parser worker protocol

[Light2Dark]

Summary

• add a strict private parser worker wire protocol and browser worker endpoint
• load only literal PostgreSQL and BigQuery parser modules inside the isolated worker
• fail closed on malformed messages, unsafe realms, overlap, and poisoned parser descriptors
• add Node and Chromium coverage plus package artifact assertions

Validation

• 1,159 Node tests passed with one intentional expected failure
• 4 Chromium worker tests passed
• typecheck, oxlint, test integrity, demo, package smoke, worker placement, and changed coverage passed
• changed production coverage: 99.46% statements/lines and 100% branches/functions
• exact-head adversarial review approved by architecture/security, lifecycle/session, and packaging/browser reviewers

Scope

Private infrastructure only: no public exports, session wiring, semantic extraction, cache, or API compatibility commitment.

Review policy

Copilot review is requested once for this PR. It will not be re-requested after later pushes.

---

Summary by cubic

Adds a private, versioned wire protocol and a dedicated module-worker endpoint for node-sql-parser to run parsing in an isolated browser worker. The endpoint now guards the entire backend operation and uses stricter, bounded wire decoding; artifacts are production-shaped but still private.

• New Features

  • Closed protocol v1 for parse requests/responses; no AST, source text, or raw errors on the wire; retryability derived from failure code.
  • Dedicated worker endpoint that lazily loads bigquery/postgresql, reuses the backend normalizer, and restores exact NodeSQLParser/global descriptors around module load, decode, parser construction, parse, and normalization.
  • Single-flight only: one in-flight request; malformed or overlapping requests emit a protocol error and then close.
  • Outcomes include normalized statement kind, bounded unsupported reasons, or bounded failure codes.

• Bug Fixes

  • Guarded the full worker backend parse and permanently poison on restoration failure; close the generation on module-load failures.
  • Bounded and hardened wire decoding: accept only closed plain records, enforce key limits, and avoid accessor traps.

^{Written for commit e06a42f. Summary will update on new commits.}

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	98.46% (🎯 91%)	192 / 195
🔵	Statements	98.46% (🎯 91%)	193 / 196
🔵	Functions	100% (🎯 90%)	41 / 41
🔵	Branches	98.12% (🎯 85%)	157 / 160

File Coverage

File	Stmts	Branches	Functions	Lines	Uncovered Lines
Changed Files
src/vnext/node-sql-parser-browser-worker-endpoint.ts	98.03%	96.29%	100%	98.03%	180, 311
src/vnext/node-sql-parser-wire.ts	98.93%	99.05%	100%	98.92%	85

Generated in workflow #700 for commit e06a42f by the Vitest Coverage Report Action

[Copilot]

Pull request overview

Adds private “vnext” infrastructure for running node-sql-parser inside an isolated browser Worker, using a strict, versioned wire protocol that fails closed on malformed/unsafe inputs and avoids leaking source text, ASTs, or raw errors. This fits the codebase’s ongoing effort to harden SQL parsing by isolating untrusted parser code and tightening contracts around inputs/outputs.

Changes:

• Introduces a closed v1 wire protocol with strict encode/decode validation and bounded outcome surfaces (src/vnext/node-sql-parser-wire.ts + tests).
• Adds a dedicated browser Worker endpoint that lazily imports only BigQuery/PostgreSQL builds, restores guarded globals around imports, enforces single-flight requests, and closes on protocol or realm violations (src/vnext/node-sql-parser-browser-worker-endpoint.ts + Worker entry + browser/node tests).
• Updates test/CI packaging and coverage tooling to account for the private Worker artifact and browser dependency pre-optimization (Vitest configs + smoke/coverage scripts + docs/ADR updates).

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
vitest.config.ts	Excludes the Worker entry module from coverage measurement.
vitest.browser.config.ts	Pre-optimizes node-sql-parser BigQuery/PostgreSQL builds for browser Worker tests.
src/vnext/node-sql-parser-wire.ts	Implements the private, versioned wire protocol with strict request/message codecs.
src/vnext/node-sql-parser-browser-worker.ts	Adds the browser Worker entrypoint wiring grammar loaders to the endpoint installer.
src/vnext/node-sql-parser-browser-worker-endpoint.ts	Implements the isolated Worker endpoint with single-flight handling, guarded-global restoration, and fail-closed behavior.
src/vnext/browser_tests/node-sql-parser-browser-worker.test.ts	Chromium-level tests validating the real Worker module and closed protocol behavior.
src/vnext/tests/node-sql-parser-wire.test.ts	Node tests for wire codec strictness, closed enums, and non-leakage properties.
src/vnext/tests/node-sql-parser-browser-worker-endpoint.test.ts	Node tests for endpoint state machine, poisoning/cleanup guarantees, and error handling.
scripts/package-smoke.mjs	Asserts packed artifacts include the private Worker and wire modules.
scripts/changed-coverage.mjs	Excludes the Worker entry module from “changed production coverage” tracking.
docs/vnext/node-sql-parser-adapter.md	Documents the private browser Worker endpoint and its safety properties.
docs/adr/0004-isolated-parser-execution.md	Updates ADR to clarify retryability is derived from closed failure codes, not a separate wire flag.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[cubic-dev-ai]

All reported issues were addressed across 12 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>