@mrclrchtr/supi-code-intelligence 3.2.0 → 4.0.0

package/node_modules/@mrclrchtr/supi-tree-sitter/node_modules/@mrclrchtr/supi-code-runtime/src/capability/types.ts

@@ -4,6 +4,7 @@
  * tree-sitter) advertise what they can do.
  */
 
+import type { CodeQueryResult } from "../query-result.ts";
 import type {
   CalleeDepth,
   CalleesData,
@@ -12,6 +13,7 @@ import type {
   CodePosition,
   CodeResult,
   CodeSymbol,
+  DocumentCodeSymbol,
   ExportData,
   ImportData,
   NodeAtData,
@@ -44,32 +46,30 @@ export type CapabilityState =
 /**
  * Semantic analysis capability backed by a language server (LSP).
  *
- * Methods return `null` to signal absence (unavailable / inactive) and
- * an array to signal a successful query (possibly empty).
+ * Every read query preserves whether collection completed, completed only
+ * partially, or was unavailable. Successful empty arrays and protocol-level
+ * null values are completed observations rather than capability failures.
  */
 export interface SemanticProvider {
-  references(filePath: string, position: CodePosition): Promise<CodeLocation[] | null>;
-  implementation(filePath: string, position: CodePosition): Promise<CodeLocation[] | null>;
-  documentSymbols(filePath: string): Promise<CodeSymbol[] | null>;
-  workspaceSymbols(query: string): Promise<CodeSymbol[] | null>;
+  references(filePath: string, position: CodePosition): Promise<CodeQueryResult<CodeLocation[]>>;
+  implementation(
+    filePath: string,
+    position: CodePosition,
+  ): Promise<CodeQueryResult<CodeLocation[]>>;
+  documentSymbols(filePath: string): Promise<CodeQueryResult<DocumentCodeSymbol[]>>;
+  workspaceSymbols(query: string): Promise<CodeQueryResult<CodeSymbol[]>>;
 
-  /**
-   * Optional definition capability. Returns the definition location(s) for
-   * the symbol at the given position. When the provider cannot produce
-   * definition info, returns `null`.
-   */
-  definition?(filePath: string, position: CodePosition): Promise<CodeLocation[] | null>;
+  /** Optional definition capability with explicit completed-empty semantics. */
+  definition?(filePath: string, position: CodePosition): Promise<CodeQueryResult<CodeLocation[]>>;
 
   /**
-   * Optional hover capability. Returns a simplified type/signature info
-   * shape that does not depend on vscode-languageserver-types. When the
-   * provider cannot produce hover info (unavailable, unsupported file,
-   * no result at the given position), returns `null`.
+   * Optional hover capability. A completed `null` data value means the
+   * provider successfully found no hover at the requested point.
    */
   hover?(
     filePath: string,
     position: CodePosition,
-  ): Promise<{ contents: string; range?: SourceRange } | null>;
+  ): Promise<CodeQueryResult<{ contents: string; range?: SourceRange } | null>>;
 
   /**
    * Optional operation-aware refactor capability.
@@ -85,8 +85,8 @@ export interface SemanticProvider {
    * Optional rename capability. When present, the provider supports
    * precise semantic symbol-rename operations.
    *
-   * Kept as a low-level substrate helper for compatibility while the public
-   * tool surface still exposes a legacy `rename` alias.
+   * This remains a lower-level substrate helper for providers that expose
+   * symbol rename independently of their general refactor planner.
    */
   rename?(file: string, position: CodePosition, newName: string): Promise<RefactorResult>;
 
@@ -97,16 +97,6 @@ export interface SemanticProvider {
    * Kept as a low-level substrate helper and for lightweight introspection.
    */
   codeActions?(file: string, position: CodePosition): Promise<RefactorResult[]>;
-
-  /**
-   * Optional lightweight code action titles for display purposes.
-   * Returns simplified title/kind pairs at the given position.
-   * When the provider cannot produce code actions, returns `null`.
-   */
-  codeActionTitles?(
-    file: string,
-    position: CodePosition,
-  ): Promise<Array<{ title: string; kind?: string }> | null>;
 }
 
 /**

package/node_modules/@mrclrchtr/supi-tree-sitter/node_modules/@mrclrchtr/supi-code-runtime/src/index.ts

@@ -12,9 +12,12 @@ export type {
   CapabilityState,
   CodeLocation,
   CodePosition,
+  CodeQueryResult,
   CodeResult,
   CodeSymbol,
   ConfidenceMode,
+  DeclarationNesting,
+  DocumentCodeSymbol,
   ExportData,
   ImportData,
   NodeAtData,
@@ -29,8 +32,11 @@ export type {
   WorkspaceContext,
 } from "./api.ts";
 export {
+  completedCodeQuery,
   createWorkspaceContext,
   getDefaultWorkspaceRuntime,
-  normalizeRefactorOperation,
+  mapCodeQueryResult,
+  partialCodeQuery,
+  unavailableCodeQuery,
   WorkspaceRuntime,
 } from "./api.ts";

package/node_modules/@mrclrchtr/supi-tree-sitter/node_modules/@mrclrchtr/supi-code-runtime/src/query-result.ts

@@ -0,0 +1,42 @@
+/**
+ * Result of a read-only code-provider query.
+ *
+ * `completed` includes successful empty observations, such as an empty
+ * reference list or a protocol-level null hover. `partial` preserves usable
+ * data when a multi-provider query could not complete every branch.
+ * `unavailable` means the query did not establish a result.
+ */
+export type CodeQueryResult<T> =
+  | { readonly kind: "completed"; readonly data: T }
+  | { readonly kind: "partial"; readonly data: T; readonly reason: string }
+  | { readonly kind: "unavailable"; readonly reason: string };
+
+/** Construct a successfully completed code-query result, including empty data. */
+export function completedCodeQuery<T>(data: T): CodeQueryResult<T> {
+  return { kind: "completed", data };
+}
+
+/** Construct a usable but incomplete code-query result. */
+export function partialCodeQuery<T>(data: T, reason: string): CodeQueryResult<T> {
+  return { kind: "partial", data, reason };
+}
+
+/** Construct a code-query result that could not be established. */
+export function unavailableCodeQuery<T = never>(reason: string): CodeQueryResult<T> {
+  return { kind: "unavailable", reason };
+}
+
+/** Map completed or partial query data while preserving its availability state. */
+export function mapCodeQueryResult<T, U>(
+  result: CodeQueryResult<T>,
+  map: (data: T) => U,
+): CodeQueryResult<U> {
+  switch (result.kind) {
+    case "completed":
+      return completedCodeQuery(map(result.data));
+    case "partial":
+      return partialCodeQuery(map(result.data), result.reason);
+    case "unavailable":
+      return unavailableCodeQuery(result.reason);
+  }
+}

package/node_modules/@mrclrchtr/supi-tree-sitter/node_modules/@mrclrchtr/supi-code-runtime/src/types.ts

@@ -34,6 +34,9 @@ export interface SymbolAnchor {
   character: number;
 }
 
+/** Provider-backed nesting evidence for a declaration reported within one document. */
+export type DeclarationNesting = "top-level" | "nested" | "unknown";
+
 /**
  * A discovered symbol / declaration.
  *
@@ -51,9 +54,21 @@ export interface CodeSymbol {
   file: string;
   declarationAnchor: SymbolAnchor;
   nameAnchor?: SymbolAnchor;
+  /** Named symbolic container when reported; absence does not prove top-level nesting. */
   container?: string | null;
 }
 
+/**
+ * A document-scoped declaration with explicit hierarchy evidence.
+ *
+ * `unknown` means the provider returned a flat observation without an actual
+ * hierarchy. A reported container name remains metadata and does not promote
+ * a flat observation to known nesting.
+ */
+export interface DocumentCodeSymbol extends CodeSymbol {
+  nesting: DeclarationNesting;
+}
+
 // ── Result types ───────────────────────────────────────────────────────
 
 /**
@@ -143,11 +158,8 @@ export interface WorkspaceEdit {
 
 /**
  * Supported refactor operation names for the current semantic planning path.
- *
- * `rename` is kept as a legacy alias for the public rename-only surface.
  */
 export type RefactorOperation =
-  | "rename"
   | "rename_symbol"
   | "extract_function"
   | "extract_variable"
@@ -156,13 +168,6 @@ export type RefactorOperation =
   | "update_imports"
   | "delete_dead_code";
 
-/** Normalize legacy refactor aliases to their canonical operation names. */
-export function normalizeRefactorOperation(
-  operation: RefactorOperation,
-): Exclude<RefactorOperation, "rename"> {
-  return operation === "rename" ? "rename_symbol" : operation;
-}
-
 /**
  * Operation-aware refactor planning request.
  *

package/node_modules/@mrclrchtr/supi-tree-sitter/node_modules/@mrclrchtr/supi-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrclrchtr/supi-core",
-  "version": "3.2.0",
+  "version": "4.0.0",
   "description": "SuPi core — shared infrastructure for SuPi extensions (XML context tags, config system)",
   "license": "MIT",
   "repository": {
@@ -50,7 +50,6 @@
   },
   "main": "src/api.ts",
   "exports": {
-    "./abort-utils": "./src/abort-utils.ts",
     "./api": "./src/api.ts",
     "./config": "./src/config.ts",
     "./context": "./src/context.ts",
@@ -71,7 +70,6 @@
     "./status-spinner": "./src/status-spinner.ts",
     "./terminal": "./src/terminal.ts",
     "./tool-framework": "./src/tool-framework.ts",
-    "./prompt-surface": "./src/prompt-surface.ts",
-    "./types": "./src/types.ts"
+    "./prompt-surface": "./src/prompt-surface.ts"
   }
 }

package/node_modules/@mrclrchtr/supi-tree-sitter/node_modules/@mrclrchtr/supi-core/src/api.ts

@@ -6,8 +6,6 @@
 // For lighter imports, use one of the domain subpaths directly
 // (e.g. @mrclrchtr/supi-core/config, @mrclrchtr/supi-core/context).
 
-// biome-ignore lint/performance/noReExportAll: intentional convenience barrel
-export * from "./abort-utils.ts";
 // biome-ignore lint/performance/noReExportAll: intentional convenience barrel
 export * from "./config.ts";
 // biome-ignore lint/performance/noReExportAll: intentional convenience barrel
@@ -42,5 +40,3 @@ export * from "./status-spinner.ts";
 export * from "./terminal.ts";
 // biome-ignore lint/performance/noReExportAll: intentional convenience barrel
 export * from "./tool-framework.ts";
-// biome-ignore lint/performance/noReExportAll: intentional convenience barrel
-export * from "./types.ts";

package/node_modules/@mrclrchtr/supi-tree-sitter/node_modules/@mrclrchtr/supi-core/src/evidence-badge.ts

@@ -22,14 +22,15 @@ export interface EvidenceBadgeInput {
  * |------------------------------------------------------|---------------------------------------|
  * | shown=12, total=12, omitted=0, label="references"   | `12 references`                       |
  * | shown=8,  total=20, omitted=12, label="symbols"     | `8 of 20 symbols (12 omitted)`        |
- * | shown=5,  total=null, reason="timeout", label="matches" | `5 matches — timeout`              |
+ * | shown=5, total=null, omitted=2, reason="timeout" | `5 matches (2 collected omitted; more may exist — timeout)` |
  */
 export function formatEvidenceBadge(input: EvidenceBadgeInput): string {
   const { shownCount, totalCount, omittedCount, partialReason, label } = input;
 
   if (totalCount === null) {
     const reasonSuffix = partialReason ? ` — ${partialReason}` : "";
-    return `${shownCount} ${label}${reasonSuffix}`;
+    const omittedPrefix = (omittedCount ?? 0) > 0 ? `${omittedCount} collected omitted; ` : "";
+    return `${shownCount} ${label} (${omittedPrefix}more may exist${reasonSuffix})`;
   }
 
   if (omittedCount !== null && omittedCount > 0) {

package/node_modules/@mrclrchtr/supi-tree-sitter/node_modules/@mrclrchtr/supi-core/src/index.ts

@@ -6,8 +6,6 @@
 // For lighter imports, use one of the domain subpaths directly
 // (e.g. @mrclrchtr/supi-core/config, @mrclrchtr/supi-core/context).
 
-// biome-ignore lint/performance/noReExportAll: intentional convenience barrel
-export * from "./abort-utils.ts";
 // biome-ignore lint/performance/noReExportAll: intentional convenience barrel
 export * from "./config.ts";
 // biome-ignore lint/performance/noReExportAll: intentional convenience barrel
@@ -36,5 +34,3 @@ export * from "./status-spinner.ts";
 export * from "./terminal.ts";
 // biome-ignore lint/performance/noReExportAll: intentional convenience barrel
 export * from "./tool-framework.ts";
-// biome-ignore lint/performance/noReExportAll: intentional convenience barrel
-export * from "./types.ts";

package/node_modules/@mrclrchtr/supi-tree-sitter/node_modules/@mrclrchtr/supi-core/src/llm.ts

@@ -24,16 +24,6 @@ export interface WithRetryOptions {
   onRetry?: (attempt: number, delayMs: number) => void;
 }
 
-/**
- * Attempt an async operation with retries and exponential backoff.
- *
- * If the signal is already aborted on entry, the operation is skipped entirely.
- * If the signal aborts during a delay, the delay is cancelled immediately.
- *
- * @param fn - The async operation to retry.
- * @param options - Optional configuration for retries, backoff, signal, and callbacks.
- * @returns The result on success, or `null` if all attempts fail or the signal aborts.
- */
 /**
  * Create a promise that resolves after `ms` milliseconds, or rejects if
  * the signal fires before the timeout elapses.

package/node_modules/@mrclrchtr/supi-tree-sitter/node_modules/@mrclrchtr/supi-core/src/path-utils.ts

@@ -1,4 +1,5 @@
 import * as path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
 
 /** Strip pi's optional leading `@` file-path prefix from a tool input. */
 export function stripToolPathPrefix(target: string): string {
@@ -16,25 +17,28 @@ export function resolveToolPath(cwd: string, target: string): string {
   return path.resolve(cwd, stripToolPathPrefix(target));
 }
 
-/** Convert a file path to a file:// URI. */
+/**
+ * Convert a file path to a file:// URI.
+ *
+ * Uses Node's `pathToFileURL` to produce a standards-compliant URI with
+ * proper percent-encoding of spaces, hashes, and other special characters.
+ */
 export function fileToUri(filePath: string): string {
-  const resolved = path.resolve(filePath);
-  if (process.platform === "win32") {
-    return `file:///${resolved.replace(/\\/g, "/")}`;
-  }
-  return `file://${resolved}`;
+  return pathToFileURL(filePath).href;
 }
 
-/** Convert a file:// URI to a file path. */
+/**
+ * Convert a file:// URI to a file path.
+ *
+ * Uses Node's `fileURLToPath` for standards-compliant decoding. Non-file
+ * URIs are passed through unchanged so consumers (such as LSP diagnostic
+ * handling) remain compatible with non-file URI schemes.
+ */
 export function uriToFile(uri: string): string {
   if (!uri.startsWith("file://")) return uri;
-  let filePath = decodeURIComponent(uri.slice(7));
-  if (
-    process.platform === "win32" &&
-    filePath.startsWith("/") &&
-    /^[A-Za-z]:/.test(filePath.slice(1))
-  ) {
-    filePath = filePath.slice(1);
+  try {
+    return fileURLToPath(uri);
+  } catch {
+    return uri;
   }
-  return filePath;
 }

package/node_modules/@mrclrchtr/supi-tree-sitter/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@mrclrchtr/supi-tree-sitter",
-  "version": "3.2.0",
-  "description": "SuPi Tree-sitter extension — structural AST analysis for pi",
+  "version": "4.0.0",
+  "description": "SuPi Tree-sitter library — structural AST analysis for pi",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -18,7 +18,6 @@
   "keywords": [
     "pi",
     "pi-coding-agent",
-    "pi-extension",
     "tree-sitter",
     "ast",
     "syntax-tree",
@@ -35,30 +34,14 @@
   ],
   "dependencies": {
     "web-tree-sitter": "^0.26.8",
-    "@mrclrchtr/supi-code-runtime": "3.2.0",
-    "@mrclrchtr/supi-core": "3.2.0"
+    "@mrclrchtr/supi-code-runtime": "4.0.0",
+    "@mrclrchtr/supi-core": "4.0.0"
   },
   "bundledDependencies": [
     "@mrclrchtr/supi-code-runtime",
     "@mrclrchtr/supi-core",
     "web-tree-sitter"
   ],
-  "peerDependencies": {
-    "@earendil-works/pi-ai": "*",
-    "@earendil-works/pi-coding-agent": "*",
-    "typebox": "*"
-  },
-  "peerDependenciesMeta": {
-    "@earendil-works/pi-ai": {
-      "optional": true
-    },
-    "@earendil-works/pi-coding-agent": {
-      "optional": true
-    },
-    "typebox": {
-      "optional": true
-    }
-  },
   "main": "src/api.ts",
   "exports": {
     "./api": "./src/api.ts",

package/node_modules/@mrclrchtr/supi-tree-sitter/resources/grammars/bash/tree-sitter-bash.wasm.json

@@ -1,7 +1,7 @@
 {
   "source": {
     "npmPackage": "tree-sitter-bash",
-    "version": "0.23.3"
+    "version": "0.25.1"
   },
-  "sha256": "d1844429a58620f306b6f42aebe92298243ca8120cd833a3ab5d87c7a2e7b9fd"
+  "sha256": "8292919c88a0f7d3fb31d0cd0253ca5a9531bc1ede82b0537f2c63dd8abe6a7a"
 }

package/node_modules/@mrclrchtr/supi-tree-sitter/resources/grammars/c/tree-sitter-c.wasm.json

@@ -1,7 +1,7 @@
 {
   "source": {
     "npmPackage": "tree-sitter-c",
-    "version": "0.23.6"
+    "version": "0.24.1"
   },
-  "sha256": "146f85977800935f18b06940518b16ded13cf4007ef0e3190573b969a98b9adc"
+  "sha256": "c852c2a85ebf2beb636aa3b0ef7f7e70458684d74f6741b20dcb296885bed9f9"
 }

package/node_modules/@mrclrchtr/supi-tree-sitter/resources/grammars/go/tree-sitter-go.wasm.json

@@ -1,7 +1,7 @@
 {
   "source": {
     "npmPackage": "tree-sitter-go",
-    "version": "0.23.4"
+    "version": "0.25.0"
   },
-  "sha256": "6dfc8eacdad0a54d0cad0d888851bd19cdd14d82582f110f888bbf6f9e5e2d64"
+  "sha256": "9504573f352b20be7f2f1911754d710622aedc15afff16d5ed8fb5645681aee7"
 }

package/node_modules/@mrclrchtr/supi-tree-sitter/resources/grammars/javascript/tree-sitter-javascript.wasm.json

@@ -1,7 +1,7 @@
 {
   "source": {
     "npmPackage": "tree-sitter-javascript",
-    "version": "0.23.1"
+    "version": "0.25.0"
   },
-  "sha256": "4a378293fe7853cbee2836023be072dafa0e53b3b5edb245920838ca834ed121"
+  "sha256": "5fb488d0cabb4775a594bab85682de5ad6ce83c0d6ac997a9f82dd084d571240"
 }

package/node_modules/@mrclrchtr/supi-tree-sitter/resources/grammars/kotlin/tree-sitter-kotlin.wasm.json

@@ -6,7 +6,7 @@
     "releaseAsset": "https://github.com/fwcd/tree-sitter-kotlin/releases/download/0.3.8/tree-sitter-kotlin.wasm"
   },
   "generatedWith": {
-    "treeSitterCli": "0.22.6"
+    "treeSitterCli": "0.26.11"
   },
-  "sha256": "c624e7443b371c28adc5d81674e73067564c12555ebe3ed96a6c8db814b7602d"
+  "sha256": "e08447e36ad5d86f39f91f13defce0636aea1490b8d65dafde6fa72649422061"
 }

package/node_modules/@mrclrchtr/supi-tree-sitter/resources/grammars/python/tree-sitter-python.wasm.json

@@ -1,7 +1,7 @@
 {
   "source": {
     "npmPackage": "tree-sitter-python",
-    "version": "0.23.6"
+    "version": "0.25.0"
   },
-  "sha256": "8c93692fb368e288a5824cee55773c9b3602804f513bda48c97661e52e9c2da2"
+  "sha256": "16108b50df4ee9a30168794252ab55e7c93bfc5765d7fa0aa3e335752c515f47"
 }

package/node_modules/@mrclrchtr/supi-tree-sitter/resources/grammars/r/tree-sitter-r.wasm.json

@@ -1,7 +1,7 @@
 {
   "source": {
     "npmPackage": "@davisvaughan/tree-sitter-r",
-    "version": "1.2.0"
+    "version": "1.3.0"
   },
-  "sha256": "2a8f5acd1c53d91e0ec5c01a6830d8ac7f5a7f96f0ac4b3768c016c8e9d07711"
+  "sha256": "a39d2e71bd39c29bb7f144a03f41d6d9f0099fede4110c696dc0715a62c9fbe1"
 }

package/node_modules/@mrclrchtr/supi-tree-sitter/resources/grammars/rust/tree-sitter-rust.wasm.json

@@ -1,7 +1,7 @@
 {
   "source": {
     "npmPackage": "tree-sitter-rust",
-    "version": "0.23.3"
+    "version": "0.24.0"
   },
   "sha256": "f65f354215611fd94ad34134b3427eb3d58cbb745df7b6509ba722184db73d57"
 }

package/node_modules/@mrclrchtr/supi-tree-sitter/resources/grammars/sql/tree-sitter-sql.wasm.json

@@ -5,11 +5,11 @@
     "repository": "https://github.com/derekstride/tree-sitter-sql"
   },
   "generatedWith": {
-    "treeSitterCli": "0.22.6"
+    "treeSitterCli": "0.26.11"
   },
-  "sha256": "0871a3bd488ed39f5a521484337f07a43bd6aa95dbdf1cdd24744deecafa58fc",
+  "sha256": "9b93a15dc3eade66df4347731f2687b939daf987c8382660d6118e863604ab09",
   "trust": {
-    "note": "The @derekstride/tree-sitter-sql npm package is a devDependency only. It is never resolved at runtime — the vendored WASM above is the sole runtime artifact. The npm package's install script uses 'npx --yes' which some package managers flag as a supply-chain risk; pnpm ignores build scripts by default, so this script never runs during install. The WASM was built locally from the package source (not downloaded from npm). See scripts/generate-sql-wasm.mjs for the rebuild procedure.",
+    "note": "The @derekstride/tree-sitter-sql npm package is a devDependency only. It is never resolved at runtime; the vendored WASM above is the sole runtime artifact. This workspace explicitly disables the package's npx-based install script via pnpm allowBuilds. The WASM was built locally from the installed package source. See scripts/generate-sql-wasm.mjs for the rebuild procedure.",
     "alternativesConsidered": [
       "tree-sitter-sql (m-novikov, 2021, stale)",
       "tree-sitter-sql-bigquery (BigQuery-specific)",

package/node_modules/@mrclrchtr/supi-tree-sitter/scripts/generate-kotlin-wasm.mjs

@@ -38,6 +38,7 @@ function expectedReleaseAsset(version) {
 
 function assertKotlinWasmCurrent() {
   const kotlinPackage = readPackage("tree-sitter-kotlin");
+  const cliPackage = readPackage("tree-sitter-cli");
   const metadata = readMetadata();
   const actualSha = sha256(wasmPath);
   const errors = [];
@@ -55,6 +56,11 @@ function assertKotlinWasmCurrent() {
       "metadata release asset URL does not match the installed tree-sitter-kotlin version",
     );
   }
+  if (metadata.generatedWith?.treeSitterCli !== cliPackage.json.version) {
+    errors.push(
+      `metadata pins tree-sitter-cli ${metadata.generatedWith?.treeSitterCli}, but installed CLI is ${cliPackage.json.version}`,
+    );
+  }
   if (metadata.sha256 !== actualSha) {
     errors.push(`metadata sha256 ${metadata.sha256} does not match vendored file ${actualSha}`);
   }

package/node_modules/@mrclrchtr/supi-tree-sitter/scripts/generate-sql-wasm.mjs

@@ -8,10 +8,10 @@
  *
  * Trust considerations:
  * - The @derekstride/tree-sitter-sql install script uses "npx --yes", which
- *   some package managers flag as a supply-chain risk. pnpm ignores build
- *   scripts by default, so this script never runs during install.
+ *   some package managers flag as a supply-chain risk. This workspace disables
+ *   that package's build script explicitly via pnpm `allowBuilds`.
  * - The WASM is built locally from the installed package source (not downloaded
- *   from npm). The build uses tree-sitter-cli 0.22.6 with Emscripten/Docker.
+ *   from npm). The build uses tree-sitter-cli with Emscripten/Docker.
  * - Alternatives considered: tree-sitter-sql (m-novikov, stale since 2021),
  *   tree-sitter-sql-bigquery (dialect-specific), and dialect-specific grammars.
  *   derekstride/tree-sitter-sql is the most mature general-purpose SQL grammar.
@@ -55,6 +55,7 @@ function readMetadata() {
 
 function assertSqlWasmCurrent() {
   const sqlPackage = readPackage("@derekstride/tree-sitter-sql");
+  const cliPackage = readPackage("tree-sitter-cli");
   const metadata = readMetadata();
   const actualSha = sha256(wasmPath);
   const errors = [];
@@ -67,6 +68,11 @@ function assertSqlWasmCurrent() {
       `metadata pins @derekstride/tree-sitter-sql ${metadata.source?.version}, but installed package is ${sqlPackage.json.version}`,
     );
   }
+  if (metadata.generatedWith?.treeSitterCli !== cliPackage.json.version) {
+    errors.push(
+      `metadata pins tree-sitter-cli ${metadata.generatedWith?.treeSitterCli}, but installed CLI is ${cliPackage.json.version}`,
+    );
+  }
   if (metadata.sha256 !== actualSha) {
     errors.push(`metadata sha256 ${metadata.sha256} does not match vendored file ${actualSha}`);
   }
@@ -92,7 +98,7 @@ function generateSqlWasm() {
   try {
     fs.cpSync(sqlPackage.dir, grammarDir, { recursive: true });
 
-    // tree-sitter-cli 0.22.6 requires a "tree-sitter" section in package.json
+    // tree-sitter-cli requires a "tree-sitter" section in package.json
     const grammarPackageJsonPath = path.join(grammarDir, "package.json");
     const grammarPackageJson = JSON.parse(fs.readFileSync(grammarPackageJsonPath, "utf-8"));
     grammarPackageJson["tree-sitter"] = [{ scope: "source.sql" }];
@@ -128,6 +134,14 @@ function generateSqlWasm() {
         treeSitterCli: cliPackage.json.version,
       },
       sha256: checksum,
+      trust: {
+        note: "The @derekstride/tree-sitter-sql npm package is a devDependency only. It is never resolved at runtime; the vendored WASM above is the sole runtime artifact. This workspace explicitly disables the package's npx-based install script via pnpm allowBuilds. The WASM was built locally from the installed package source. See scripts/generate-sql-wasm.mjs for the rebuild procedure.",
+        alternativesConsidered: [
+          "tree-sitter-sql (m-novikov, 2021, stale)",
+          "tree-sitter-sql-bigquery (BigQuery-specific)",
+          "dialect-specific grammars (too narrow)",
+        ],
+      },
     };
     fs.writeFileSync(metadataPath, `${JSON.stringify(metadata, null, 2)}\n`);
     process.stdout.write(`Generated ${wasmPath}\n`);