YLSpec 0.1.2 — Verified registry identities and Trusted Publishing

YLSpec 0.1.2

This patch aligns distribution identities with the configured registry accounts
and enables GitHub OIDC Trusted Publishing for the VS Code extension. Document
format 0.1, frame 0.1, and the C/Python/JavaScript/Java/Kotlin value APIs remain
unchanged.

Distribution changes

Distribution	Identity
Python	ylspec
JavaScript and TypeScript	@younglionorganization/ylspec
Maven Central	xyz.younglion:ylspec, ylspec-kotlin, ylspec-natives, ylspec-android
Visual Studio Marketplace	ylvsmp.ylspec, publisher YoungLion

Registry identities are recorded in release/registries.json. The build checks
public manifests against that configuration. Registry upload workflows verify
both the release asset's SHA-256 and the package's embedded identity/version
before sending any artifact to a registry. Maven bundles must contain all four
publications under the configured group.

The Marketplace workflow uses vsce publish --oidc; only its publishing job has
id-token: write. It does not require a stored Marketplace PAT and does not
fall back to PAT authentication when the trusted-policy exchange fails.
PyPI continues to use PYPI_API_TOKEN. npm and Central retain their dedicated
token/signing setup.

Migration

Release 0.1.1's downloadable Maven files used
io.github.younglionorganization. Replace that dependency group with
xyz.younglion and use version 0.1.2. Java and Kotlin imports remain under
io.github.younglionorganization.ylspec; JNI class names and binary entry points
are preserved.

The 0.1.1 VSIX used YoungLionOrganization.ylspec. The extension now uses the
configured Marketplace publisher, ylvsmp.ylspec. Users of the earlier manual
VSIX should disable or uninstall the earlier extension before installing this
one to avoid registering duplicate language providers. If a default formatter
was configured explicitly, set it to ylvsmp.ylspec. Semantic formatting still
requires opt-in because it removes comments and changes layout.

Published 0.1.1 artifacts and tags keep their original contents. Registry uploads
cannot relabel those old files as the new publisher or Maven namespace.

Installation and assets

After registry publication:

python -m pip install ylspec==0.1.2
npm install @younglionorganization/ylspec@0.1.2
code --install-extension ylvsmp.ylspec

The GitHub Release also provides native C archives, Python wheels and source
distribution, the npm tarball with native Node targets and browser WebAssembly,
the Maven-layout ZIP and individual JAR/AAR files, and ylspec-0.1.2.vsix.
SHA256SUMS and build-manifest.json record the verified asset hashes and source
commit. Registry availability is determined by each upload workflow's result;
a GitHub Release alone does not assert that all registries accepted publication.

Verification and limitations

GitHub Actions runs the complete native, Python ABI/typing, JavaScript/TypeScript,
browser/React, JVM, Android ABI/emulator, VS Code, conformance, sanitizer, fuzzing,
and documentation verification. Additional automation regressions reject old
publishers, wrong versions, old Maven groups, and incomplete Maven bundles.
These are distribution changes, not an independent parser implementation or a
change to future host-container formats.

Copyright 2026 Cavanşir Qurbanzadə. Original project material is Apache-2.0.
Bundled dependency licenses and original notices are preserved.

YLSpec 0.1.1 — Native language libraries and VS Code tooling

YLSpec 0.1.1

This patch keeps document format 0.1 and frame 0.1 unchanged while adding
C-backed language adapters and correcting post-mutation validation.

Changes

Area	Result
Node.js	Stable Node-API C addon, ESM/CommonJS initialization, packaged platform binaries
Browsers and React	The same C core compiled to WebAssembly, async initialization, real-browser verification
TypeScript	Typed document, temporal, limits, profile, error, and reader contracts
Java and Kotlin	JNI-backed Java API and Kotlin extensions, exact Long and temporal values
Android	API 26+ JNI-only AAR for armeabi-v7a, arm64-v8a, x86, and x86_64
Core correctness	Revalidate configured depth after mutation; tolerate null capability entries
Distribution	npm tarball, Maven-layout bundle, JARs, AAR, checksums, and registry publishing workflows
VS Code	.ylspec highlighting, snippets, metadata completions, hover help, C-backed worker diagnostics, and opt-in semantic formatting

JavaScript integers use bigint. Java integers use Long. Neither adapter silently
converts exact temporal literals to lower-precision platform date/time values.
All parsers remain the C reference implementation. Browser WebAssembly is a
different build target, not a separate JavaScript parser.

Verification and compatibility

GitHub verification includes the existing Python/C suite, native Node and JNI
execution, TypeScript consumers, React in Chromium, Android cross-compilation,
and an API 26 emulator smoke test. Published workflow results are the source of
truth for completed checks. Runtime code does not download binaries during npm
installation. Core source distributions retain dependency notices.

Registry uploads for npm and Maven Central have separate manual workflows and
require the corresponding account setup. The GitHub/PyPI release pipeline
includes their built distributions as downloadable assets regardless of registry
availability. Existing Python signatures and YLSpec framing stay compatible.

The universal ylspec-0.1.1.vsix adds standalone document editing in VS Code
1.95+ desktop/remote extension hosts. Install through Install from VSIX….
Unknown custom profiles are warnings; invalid syntax and unsupported mandatory
features are errors. Formatting is disabled by default because it removes
comments. Browser-only vscode.dev and binary host-container editing remain
outside the editor's scope. Marketplace publication requires its own publisher
credential and separate workflow.

Install Python with python -m pip install ylspec==0.1.1 after PyPI publication.
Native C archives contain static/shared libraries, headers, CLI binaries, CMake
exports, and notices. The npm tarball contains all verified Node targets and
browser WebAssembly. The JVM ZIP preserves Maven repository layout; individual
Java/Kotlin/native JARs and the Android AAR are also attached. SHA256SUMS and
build-manifest.json record the asset hashes and source commit.

Copyright 2026 Cavanşir Qurbanzadə. Original project material is Apache-2.0;
the vendored tomlc17 parser remains MIT-licensed with its original notices.