@binclusive/tree-sitter-swift-wasm

The tree-sitter Swift grammar vendored as a checksum-pinned .wasm asset, with zero runtime dependencies.

Upstream publishes the wasm only as a GitHub release asset, so there is nothing on npm to depend on. This package republishes the asset unmodified, which lets a consumer resolve the grammar by package name through ordinary module resolution instead of standing up a second acquisition mechanism for one language. Full provenance, the reproduce command and the upgrade procedure are in PROVENANCE.md.

Install

Pin it exactly. The grammar version decides what the scanner can see, so it is a correctness input, not a compatible-upgrade axis:

pnpm add -E @binclusive/tree-sitter-swift-wasm

Use

import { readFile } from "node:fs/promises";
import { fileURLToPath } from "node:url";
import {
  SWIFT_GRAMMAR,
  SWIFT_GRAMMAR_WASM_SPECIFIER,
} from "@binclusive/tree-sitter-swift-wasm";
import { Language, Parser } from "web-tree-sitter";

const wasmPath = fileURLToPath(import.meta.resolve(SWIFT_GRAMMAR_WASM_SPECIFIER));

// Verify before you parse: a wrong or truncated grammar under-parses SILENTLY, so it
// surfaces as missing findings rather than an error.
const bytes = await readFile(wasmPath);
const digest = Buffer.from(
  await crypto.subtle.digest("SHA-256", bytes),
).toString("hex");
if (digest !== SWIFT_GRAMMAR.sha256) throw new Error("Swift grammar digest mismatch");

await Parser.init();
const parser = new Parser();
parser.setLanguage(await Language.load(wasmPath));

import.meta.resolve is the load-bearing detail: resolution runs through this package's exports map by name. A directory join off the consumer's import.meta.url is the exact mechanism behind #3120 — it resolves on the machine that built the image and nowhere else.

Exports

The entry point is constants only — no node: imports, no runtime dependency — so it loads on Node, Workers and the browser alike.

Publishing

The workspace tests verify the committed bytes; verify:tarball verifies the artifact a customer actually receives. It packs, installs the tarball into a throwaway directory outside this repo, resolves the wasm by package name from that install and parses Swift with it — so a broken files list or publishConfig exports map fails here rather than at a consumer:

pnpm --filter @binclusive/tree-sitter-swift-wasm verify:tarball

Then publish the tarball (this workspace publishes packed tarballs rather than running pnpm publish in place):

cd packages/tree-sitter-swift-wasm
pnpm build
pnpm pack
npm publish --access public binclusive-tree-sitter-swift-wasm-<version>.tgz

A freshly published version is not installable in this workspace for about a day — the minimumReleaseAge supply-chain gate rejects it — so publish before the consumer bump that needs it, not alongside.

Licence

The grammar is MIT, © 2021 alex-pinkus. The upstream notice ships verbatim in LICENSE and applies to the vendored wasm, which is the unmodified upstream artifact. This package adds no separately-licensed code.