Releases · ANcpLua/ANcpLua.Roslyn.Utilities

Consumers referencing `ANcpLua.Roslyn.Utilities.Testing` saw `TUXU0001` ("xUnit code can be converted to TUnit code") fire on every xUnit-using source file. The warning came from `TUnit.Analyzers.dll`, which TUnit.Core 1.34.5 bundles in its `analyzers/` asset slot.

Fix

The `TUnit.Core` `PackageReference` in `ANcpLua.Roslyn.Utilities.Testing.csproj` now carries `PrivateAssets="analyzers"`, so the TUnit migration analyzer no longer flows transitively to downstream consumers. Compile + runtime assets still flow so TUnit-based `IntegrationTestBase`/`KestrelTestBase` helpers under `WebTesting/TUnit/` keep working.

The pre-existing `_RemoveTUnitAnalyzers` target stays as belt-and-suspenders for the Testing project's own xUnit-using files.

Migration

None — pure fix, no API change.

Verification

`dotnet build -c Release` green across all projects, 0 warnings, 0 errors.

Assets 2

21 Apr 05:29

ANcpLua

v1.56.0

9cb8768

v1.56.0 — Ids/ShortId + Security/Pkce

Closes the Wave 2 utilities from the qyl mega-swarm audit. Composes the primitives shipped in v1.55.0.

New utilities

`Ids/ShortId`

NewHex32() — canonical 32-char lowercase hex id (replaces 22+ Guid.NewGuid().ToString(\"N\") sites).
NewHex(hexChars) — truncated 1–32 hex chars for correlation / log-enricher ids.
NewPrefixedSortable(prefix, randomHexChars = 24) — {prefix}-{hex} with an enforced 80-bit entropy floor.
NewUrlSafeRandom(byteLength) — thin delegate over Base64Url.NewRandom.

Entropy-floor rationale: the prior hand-rolled pattern \$\"ws-{Guid.CreateVersion7():N}\"[..24] kept only ~36 random bits after truncation (half was UUIDv7 timestamp), making DB primary-key collisions realistic at scale. NewPrefixedSortable forbids that shape by requiring an explicit post-prefix entropy count ≥ 20 hex chars.

`Security/Pkce`

GenerateVerifier(byteLength = 32) — RFC 7636 verifier (256-bit default).
ComputeS256Challenge(verifier) — SHA-256 + Base64Url.
ValidateS256(verifier, storedChallenge) — constant-time compare via CryptoCompare.FixedTimeEqualsUtf8.

Full RFC 7636 S256 flow with zero additional dependencies — composes Base64Url + CryptoCompare shipped in v1.55.0.

Verification

dotnet build -c Release green across all projects, 0 warnings, 0 errors. No new package dependencies. Layer 1 charter intact: netstandard2.0, BCL-only.

TryDeserialize<T> routing decision (v1.55 deferral) will land in ANcpLua.Agents v0.4.0 where System.Text.Json is already a dependency. After that, qyl consumer migration via exodia:hades.

Assets 2

21 Apr 05:23

ANcpLua

v1.55.0

f693b42

v1.55.0 — Base64Url, CryptoCompare, SqlLikeEscape + extensions

Layer 1 utility consolidation informed by a mega-swarm audit of the qyl consumer repo.

New utilities

Encoding/Base64Url — Encode, TryDecode (tolerant of padded/unpadded input; catches both FormatException and ArgumentException), NewRandom(byteLength), Sha256Challenge (RFC 7636 PKCE S256).
Security/CryptoCompare — FixedTimeEqualsUtf8 pre-hashes inputs with SHA-256 before constant-time compare, eliminating the length-oracle that exists when callers feed raw UTF-8 into CryptographicOperations.FixedTimeEquals (CWE-208). Plus byte-span overload.
Data/SqlLikeEscape — single-pass LIKE-pattern escaper via ValueStringBuilder; zero-alloc fast path when no meta characters present.

Extensions

StringExtensions.ToSnakeCase — mirror of ToKebabCase.
StringExtensions.ToShortHash(input, hexChars, lowercase) — parameterized overload; existing parameterless version unchanged.
ConvertExtensions.ToHexLowerOrEmpty — span + array overloads.
TimeConversions.NanosAgo(DateTimeOffset now, TimeSpan ago) — cutoff helper.
TimeConversions.Iso8601 nested: Format, TryParse.
TryExtensions.TryParseBase64Url — null-returning overload.

Non-breaking

No API removals. Existing ToShortHash() byte-identical to prior behavior. No new package dependencies. Layer 1 charter intact: netstandard2.0, BCL-only.

Deferred

TryExtensions.TryDeserialize<T> — requires System.Text.Json (Layer 1 charter violation); separate decision for v1.56.0.
Ids.ShortId (UUIDv7 polyfill) — 27 qyl call sites, planned v1.56.0.
Security.Pkce — composes Base64Url + CryptoCompare; planned v1.56.0.