Wire typescript generation

.github/actions/binding-tools/action.yml

@@ -2,7 +2,7 @@ name: Prepare binding tools
 description: Select targets, install the exact compilers and prerequisites, and build the shared generator
 inputs:
   targets:
-    description: Comma-separated package-key:go or package-key:python targets, or all
+    description: Comma-separated package-key:go, package-key:python, or package-key:typescript targets, or all
     required: true
   publication:
     description: Include the committed package dependency closure for publication
@@ -17,6 +17,12 @@ outputs:
   has-python:
     description: Whether a Python target is selected
     value: ${{ steps.configure.outputs.has-python }}
+  typescript-version:
+    description: Exact catalog Node.js version, empty when no TypeScript target is selected
+    value: ${{ steps.configure.outputs.typescript-version }}
+  has-typescript:
+    description: Whether a TypeScript target is selected
+    value: ${{ steps.configure.outputs.has-typescript }}
   source-commit:
     description: Checked-out source commit
     value: ${{ steps.configure.outputs.source-commit }}
@@ -53,6 +59,7 @@ runs:
           python tooling/extension-bindings/ci/generation.py configure --targets "$INPUT_TARGETS"
           python tooling/extension-bindings/ci/generate-go.py configure --targets "$INPUT_TARGETS"
           python tooling/extension-bindings/ci/generate-python.py configure --targets "$INPUT_TARGETS"
+          python tooling/extension-bindings/ci/generate-typescript.py configure --targets "$INPUT_TARGETS"
         fi
     - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
       with:
@@ -110,6 +117,18 @@ runs:
           printf 'RC_PYTHON_PROFILER_BIN=%s\n' "$tools/python-venv/bin/runtimeconditions-python-profiler"
           printf 'RC_PYTHON_PROFILER_ARTIFACT=%s\n' "$wheel"
         } >> "$GITHUB_ENV"
+    - name: Set up the pinned Node.js
+      if: steps.configure.outputs.has-typescript == 'true'
+      uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+      with:
+        node-version: ${{ steps.configure.outputs.typescript-version }}
+        cache: npm
+        cache-dependency-path: tooling/extension-bindings/emitters/typescript/package-lock.json
+    - name: Build the TypeScript emitter from its pinned dependencies
+      if: steps.configure.outputs.has-typescript == 'true'
+      shell: bash
+      working-directory: tooling/extension-bindings/emitters/typescript
+      run: npm ci --ignore-scripts && npm run build
     - name: Build shared generator
       shell: bash
       run: go -C tooling/extension-bindings/orchestrator build -trimpath -buildvcs=false -o "$RUNNER_TEMP/binding-tools/rc" ./cmd/rc

.github/workflows/binding-generate.yml

@@ -1,4 +1,4 @@
-name: Generate and commit Go and Python bindings
+name: Generate and commit Go, Python and TypeScript bindings
 
 on:
   push:
@@ -10,18 +10,20 @@ on:
       - 'catalog/**'
       - 'bindings/**/go/**'
       - 'bindings/**/python/**'
+      - 'bindings/**/typescript/**'
       - 'tooling/extension-bindings/packages.yaml'
       - 'tooling/extension-bindings/toolchain.lock.yaml'
       - 'tooling/extension-bindings/model/**'
       - 'tooling/extension-bindings/normalizer/**'
       - 'tooling/extension-bindings/emitters/go/**'
       - 'tooling/extension-bindings/emitters/python/**'
+      - 'tooling/extension-bindings/emitters/typescript/**'
       - 'tooling/extension-bindings/orchestrator/**'
       - 'tooling/extension-bindings/ci/**'
   workflow_dispatch:
     inputs:
       targets:
-        description: 'Comma-separated package-key:go or package-key:python targets, or all; empty uses automatic targets'
+        description: 'Comma-separated package-key:go, package-key:python, or package-key:typescript targets, or all; empty uses automatic targets'
         type: string
         default: ''
 
@@ -40,7 +42,7 @@ jobs:
     permissions:
       contents: write
     env:
-      INPUT_TARGETS: ${{ inputs.targets || vars.BINDING_GENERATION_TARGETS || 'common-integrations:go,env-configuration:go,common-integrations:python,env-configuration:python' }}
+      INPUT_TARGETS: ${{ inputs.targets || vars.BINDING_GENERATION_TARGETS || 'common-integrations:go,env-configuration:go,common-integrations:python,env-configuration:python,common-integrations:typescript,env-configuration:typescript' }}
       GOTOOLCHAIN: local
     steps:
       - name: Check out current main
@@ -59,6 +61,7 @@ jobs:
         shell: bash
         env:
           HAS_PYTHON: ${{ steps.tools.outputs.has-python }}
+          HAS_TYPESCRIPT: ${{ steps.tools.outputs.has-typescript }}
         run: |
           set -euo pipefail
           python -m unittest discover -s tooling/extension-bindings/ci -p 'test_*.py'
@@ -71,6 +74,9 @@ jobs:
               tooling/extension-bindings/emitters/python/tests \
               --ignore=tooling/extension-bindings/emitters/python/tests/test_packages.py
           fi
+          if [[ "$HAS_TYPESCRIPT" == true ]]; then
+            npm --prefix tooling/extension-bindings/emitters/typescript test
+          fi
 
       - name: Generate and verify bindings
         env:
@@ -81,6 +87,8 @@ jobs:
             --rc "$RC" --core-schema "$CORE_SCHEMA"
           python tooling/extension-bindings/ci/generate-python.py update --targets "$INPUT_TARGETS" \
             --rc "$RC" --core-schema "$CORE_SCHEMA"
+          python tooling/extension-bindings/ci/generate-typescript.py update --targets "$INPUT_TARGETS" \
+            --rc "$RC" --core-schema "$CORE_SCHEMA"
 
       - name: Commit verified generated source to main
         env:

.github/workflows/binding-publish-npm.yml

@@ -1,4 +1,4 @@
-name: Publish TypeScript bindings (placeholder, publishes nothing)
+name: Publish TypeScript bindings
 
 on:
   workflow_dispatch:
@@ -8,7 +8,7 @@ on:
         type: string
         default: ''
       dry_run:
-        description: 'Must stay true: the workflow is a placeholder and verifies and publishes nothing'
+        description: 'Build and check the packages without publishing them to npm'
         type: boolean
         default: true
 
@@ -23,26 +23,49 @@ jobs:
   publish:
     if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-24.04
-    timeout-minutes: 15
+    timeout-minutes: 20
+    permissions:
+      contents: read
+      # Trusted publishing: npm accepts this workflow's OIDC identity, so no npm token is stored.
+      id-token: write
+    env:
+      INPUT_TARGETS: ${{ inputs.targets }}
+      EXECUTE: ${{ !inputs.dry_run }}
 
     steps:
-      - name: Reject real publication
-        if: ${{ !inputs.dry_run }}
-        run: |
-          echo "::error::npm publication is not implemented. Run with dry_run enabled; nothing was published."
-          exit 1
-      - name: Record that nothing was verified or published
-        env:
-          TARGETS: ${{ inputs.targets }}
-          DRY_RUN: ${{ inputs.dry_run }}
+      - name: Check out repository
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
+
+      - name: Set up Python for the publication helper
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        with:
+          python-version: '3.12.10'
+
+      - name: Install the helper dependency
+        run: python -m pip install --disable-pip-version-check PyYAML==6.0.3
+
+      - name: Set up Node.js for npm trusted publishing
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        with:
+          node-version: '24.11.0'
+          registry-url: 'https://registry.npmjs.org'
+          package-manager-cache: false
+
+      - name: Install the pinned emitter dependencies, which provide the TypeScript compiler
+        working-directory: tooling/extension-bindings/emitters/typescript
+        run: npm ci --ignore-scripts
+
+      - name: Test the publication helper
+        run: python -m unittest discover -s tooling/extension-bindings/ci -p 'test_publish_npm.py'
+
+      - name: Build and check the committed packages, then publish them
+        shell: bash
         run: |
           set -euo pipefail
-          {
-            echo "## Placeholder: nothing was verified or published"
-            echo
-            echo "npm publication is not implemented. This run did not verify, build, or publish any package."
-            echo
-            echo "- targets: \`${TARGETS:-<none>}\`"
-            echo "- dry_run: \`${DRY_RUN}\`"
-          } >> "$GITHUB_STEP_SUMMARY"
-          echo "::notice::Placeholder only. No package was verified or published."
+          args=()
+          if [[ "$EXECUTE" == true ]]; then
+            args+=(--execute)
+          fi
+          python tooling/extension-bindings/ci/publish-npm.py --targets "$INPUT_TARGETS" "${args[@]}"