javascript and typescript, as one wasm package for every runtime

WebAssembly rather than a native Node addon: one artifact serves Node,
Deno, Bun, a browser and anything built on them, where napi would have
meant a prebuilt binary per platform and a source build for whoever the
matrix missed. The engine is pure computation and the menologion is
already compiled in, so there is nothing for it to give up.

A day comes back as a plain object, not a handle. A wasm class would
have meant a .free() that every caller eventually forgets, and this way
JSON.stringify works and the thing spreads into state. Two serializer
defaults had to be overridden to keep the promise that it is the same
document --json emits: maps as objects, and an absent field as null
rather than undefined, which stringify would otherwise drop entirely.

The TypeScript is hand-written, because the generated types for a value
crossing as JsValue are `any`, and a binding that types its whole
return as `any` is a binding TypeScript cannot check. tsc --strict is a release
gate now, the way mypy --strict already is, and the check includes three
lines that must fail to compile.

The one place this differs from every other binding: no remembered
default jurisdiction, because a browser has nowhere to keep one. It is
called out in the README, in the types and in docs/versioning.md.

The test resolves typikon through a staged node_modules rather than a
relative path, so what it exercises is the exports map, and it compares
a year of days field by field against the command line for four
jurisdictions.

.forgejo/workflows/ci.yml

@@ -47,6 +47,8 @@ jobs:
           # run never looks at src/python.rs.
           cargo clippy --features python --all-targets -- -D warnings
           cargo clippy --features capi --all-targets -- -D warnings
+          rustup target add wasm32-unknown-unknown
+          cargo clippy --lib --features wasm --target wasm32-unknown-unknown -- -D warnings
 
       - name: Rust tests
         run: |
@@ -97,6 +99,22 @@ jobs:
           EOF
           /tmp/venv/bin/python -m mypy --strict /tmp/typecheck.py
 
+      # The npm package is the same engine again, so it has to agree with the
+      # command line again. The test compares a year of days field by field
+      # for four jurisdictions, and type-checks the published .d.ts the way the
+      # Python bindings are type-checked.
+      - name: JavaScript package
+        run: |
+          apt-get update && apt-get install -y --no-install-recommends nodejs npm
+          version=$(awk '/^name = "wasm-bindgen"$/{getline; gsub(/[",]/,""); print $3; exit}' Cargo.lock)
+          curl -sSfL "https://github.com/rustwasm/wasm-bindgen/releases/download/$version/wasm-bindgen-$version-x86_64-unknown-linux-musl.tar.gz" \
+            | tar xz -C /tmp
+          export PATH="/tmp/wasm-bindgen-$version-x86_64-unknown-linux-musl:$PATH"
+          npm install --global typescript@5
+          cargo build --release
+          npm/build.sh
+          node npm/test.mjs
+
       - name: README examples
         run: |
           cargo build --release

.forgejo/workflows/release.yml

@@ -59,6 +59,19 @@ jobs:
           maturin sdist --out dist
           ls -l dist
 
+      - name: Build the npm package
+        run: |
+          apt-get install -y --no-install-recommends nodejs npm
+          rustup target add wasm32-unknown-unknown
+          version=$(awk '/^name = "wasm-bindgen"$/{getline; gsub(/[",]/,""); print $3; exit}' Cargo.lock)
+          curl -sSfL "https://github.com/rustwasm/wasm-bindgen/releases/download/$version/wasm-bindgen-$version-x86_64-unknown-linux-musl.tar.gz" \
+            | tar xz -C /tmp
+          export PATH="/tmp/wasm-bindgen-$version-x86_64-unknown-linux-musl:$PATH"
+          npm install --global typescript@5
+          cargo build --release
+          npm/build.sh
+          node npm/test.mjs
+
       - name: Publish
         env:
           # A project-scoped token, not the account-wide one. PyPI's trusted
@@ -77,3 +90,23 @@ jobs:
           # instead of dying on the first file. A version cannot be reused,
           # so a half-published release would otherwise burn it.
           /tmp/venv/bin/twine upload --non-interactive --skip-existing dist/*
+
+      - name: Publish to npm
+        env:
+          # Scoped to this package, for the same reason the PyPI token is
+          # scoped to this project: npm has trusted publishing too, and it does
+          # not know this forge either.
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          if [ -z "$NPM_TOKEN" ]; then
+            echo "::warning::NPM_TOKEN is not set; skipping the npm publish"
+            exit 0
+          fi
+          echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" > ~/.npmrc
+          # A version cannot be reused on npm either, so a re-run after a
+          # partial release must not die on the version already being there.
+          npm publish --access public npm/dist || {
+            npm view "typikon@${GITHUB_REF_NAME#v}" version >/dev/null 2>&1 \
+              && echo "::notice::already published" \
+              || exit 1
+          }