YLSpec 0.1.2 — Verified registry identities and Trusted Publishing

YLSpec 0.1.2

This patch aligns distribution identities with the configured registry accounts
and enables GitHub OIDC Trusted Publishing for the VS Code extension. Document
format 0.1, frame 0.1, and the C/Python/JavaScript/Java/Kotlin value APIs remain
unchanged.

Distribution changes

Distribution	Identity
Python	ylspec
JavaScript and TypeScript	@younglionorganization/ylspec
Maven Central	xyz.younglion:ylspec, ylspec-kotlin, ylspec-natives, ylspec-android
Visual Studio Marketplace	ylvsmp.ylspec, publisher YoungLion

Registry identities are recorded in release/registries.json. The build checks
public manifests against that configuration. Registry upload workflows verify
both the release asset's SHA-256 and the package's embedded identity/version
before sending any artifact to a registry. Maven bundles must contain all four
publications under the configured group.

The Marketplace workflow uses vsce publish --oidc; only its publishing job has
id-token: write. It does not require a stored Marketplace PAT and does not
fall back to PAT authentication when the trusted-policy exchange fails.
PyPI continues to use PYPI_API_TOKEN. npm and Central retain their dedicated
token/signing setup.

Migration

Release 0.1.1's downloadable Maven files used
io.github.younglionorganization. Replace that dependency group with
xyz.younglion and use version 0.1.2. Java and Kotlin imports remain under
io.github.younglionorganization.ylspec; JNI class names and binary entry points
are preserved.

The 0.1.1 VSIX used YoungLionOrganization.ylspec. The extension now uses the
configured Marketplace publisher, ylvsmp.ylspec. Users of the earlier manual
VSIX should disable or uninstall the earlier extension before installing this
one to avoid registering duplicate language providers. If a default formatter
was configured explicitly, set it to ylvsmp.ylspec. Semantic formatting still
requires opt-in because it removes comments and changes layout.

Published 0.1.1 artifacts and tags keep their original contents. Registry uploads
cannot relabel those old files as the new publisher or Maven namespace.

Installation and assets

After registry publication:

python -m pip install ylspec==0.1.2
npm install @younglionorganization/ylspec@0.1.2
code --install-extension ylvsmp.ylspec

The GitHub Release also provides native C archives, Python wheels and source
distribution, the npm tarball with native Node targets and browser WebAssembly,
the Maven-layout ZIP and individual JAR/AAR files, and ylspec-0.1.2.vsix.
SHA256SUMS and build-manifest.json record the verified asset hashes and source
commit. Registry availability is determined by each upload workflow's result;
a GitHub Release alone does not assert that all registries accepted publication.

Verification and limitations

GitHub Actions runs the complete native, Python ABI/typing, JavaScript/TypeScript,
browser/React, JVM, Android ABI/emulator, VS Code, conformance, sanitizer, fuzzing,
and documentation verification. Additional automation regressions reject old
publishers, wrong versions, old Maven groups, and incomplete Maven bundles.
These are distribution changes, not an independent parser implementation or a
change to future host-container formats.

Copyright 2026 Cavanşir Qurbanzadə. Original project material is Apache-2.0.
Bundled dependency licenses and original notices are preserved.