v0.7.1

Managed-only decoupling release (core contract v15, FXServer artifact 31689 unchanged).

Overridable command reply sink (Flash.Sdk): Commands.SetReplySink / Commands.ReplyTo route command replies to ox_lib / a custom NUI chat instead of the standard chat:addMessage. Default is byte-identical; auto-cleared when the setting resource stops.

Swappable spawn adapter (flash-core, framework layer): flash-core no longer hard-dependencys spawnmanager or performs the spawn itself — it owns the server-authoritative position persistence + a neutral flashfw:requestSpawn/flashfw:spawnAt contract, with the spawnmanager glue in an optional, swappable default adapter (setr flash_spawn_adapter).

See CHANGELOG.md for details.

0.7.0 — Inventory feature & hardening batch

Inventory feature & hardening release closing the #213–#245 batch

Security & reliability (core contract v14)

• Item registry & native hash filter (#242/#245): once a server registers its item
  catalog (items.json), the core rejects any unregistered item hash before allocating —
  killing cheat-spawned items and hash-spam memory exhaustion at the native boundary. Opt-in:
  without a catalog the previous behaviour is unchanged.
• Atomic weight/slot limits (#213) enforced under the same lock as the mutation (no
  check-then-act race), plus busy/locked container flags (#240/#224) with a 30 s crash
  failsafe.
• Persistence hardening (#240/#244): per-container serialization + a busy flag around
  every load/save closes the item-loss window in the async gap; each save runs in one SQL
  transaction.
• Quantity sanity cap (#243): a negative int cast to uint is rejected instead of
  minting ~4 billion items. Rejections now surface a reason (InvResult); the classic
  bool/void APIs stay source-compatible.

Inventory features (core contract v15)

• Atomic batch primitive (#233): one all-or-nothing takes+gives transaction — the
  foundation for crafting (#223), atomic trades (#225) and the InventoryTransaction
  unit-of-work scope.
• Unique item instances + metadata (#214): weapons/keys/bags as server-generated u64
  instances (the id doubles as the serial), with an inventory_instances table; the core
  owns the atomic location truth, metadata lives in C#/DB.
• Category filters (#218), change events (#220), and nested containers (#216).

Gameplay & security layer (flash-core)

• Container access pipeline (#224/#238/#239): session → rate-limit → distance → ACL/keys
  for every player-driven interaction, blocking remote-looting and macro-spam; violations
  raise flashfw:invViolation (flag-and-log, no auto-ban).
• Audit logging (#227), loot tables (#228), ground drops in a memory-only band
  (#221/#219), duplication alerts (#241), and opt-in state-bag sync (#215).
• Lazy item decay (#222) for unique items, container sessions (#236, server half),
  and DX helpers: rejection messages (#235), snapshot queries (#231), a fluent container
  builder (#230), category [ItemHandler]s with metadata injection (#232), and a
  /dumpitems constants generator (#234).

Not applicable: #226 (no slot/stack model to consolidate), #229 (a split is already the
atomic move).

---

Compatibility: Core contract v15 · FXServer artifact 31689 (Windows) · Flash.Sdk 0.7.0 (NuGet).

Install: download flash-payload-0.7.0.zip, then ./install-flash.ps1 -ServerDir <FXServer> -PayloadDir <extracted>. Resource devs: dotnet add package Flash.Sdk --version 0.7.0.

Full details in CHANGELOG.md.

Flash-Engine 0.6.0

Large feature release closing the actionable server-side backlog — and the first core contract bump (v12 → v13). This is a payload release: it ships a rebuilt citizen-scripting-flash.dll + core, so update the payload (not just the NuGet SDK). The FXServer artifact pin (31689) is unchanged.

Highlights

Player identity

• ServerPlayer.SessionKey (crypto per-connection token) + Players.GetBySession; ServerPlayer.AccountId (persistent fixed user ID) + Players.GetByAccountId; command router resolves account IDs; flash-admin offline moderation by account ID.

Gameplay (flash-core)

• Server-authoritative vitals (hunger/thirst decay, thresholds, HUD state bags) + combat-log guard; vehicle garage (server-authoritative persistence/spawn, ownership keys); vehicle reconnect (seat restore after a crash).

Security / anti-cheat

• HWID ban hardening + optional identity gates (Discord/Steam/Cfx, anti-VPN); server-side entity/damage/physics integrity (mass-spawn, weapon-damage, speed/noclip) with a Flash.Security exception API.

Core / anti-dupe (contract v13)

• Zig-backed transactional inventory (#46): item counts live in the unmanaged core, every check-and-decrement is atomic — item duplication is mathematically impossible even under real cross-thread concurrency. Proven by 800 concurrent off-thread moves on 200 items resolving to exactly 200 winners.

DX / QoL

• Auto chat suggestions for [Command]; [ItemHandler] item action registry; Flash.Audit structured non-blocking trail; [PreserveState] across hot-reloads; VirtualInstance managed world instances.

Pre-release review

• 17 findings (#194–211) across the above batches fixed and re-verified (anti-cheat event parsing, false-positive exclusions, inventory persistence/truncation, script-thread assertions, and more).

Everything is covered by sample-resource/flash-core/flash-admin selftests, green in the real release FXServer.

Install/update: unzip the payload asset and run tools/install-flash.ps1. A v13 SDK requires the v13 core — update both together.

🤖 Generated with Claude Code

Flash-Engine 0.5.1

Bugfix release: eight verified findings from the post-0.5.0 security/reliability/tooling audits — all confirmed against the source, fixed, and verified in a real release FXServer (full selftest suites green).

SDK (Flash.Sdk)

• StateWatcher: [FromSource] parameters with unsupported types are now rejected at registration (fail fast, like the event router), and dispatch catches reflection-layer exceptions — a bad watcher signature can no longer crash the script thread. Registries are additionally serialized under a lock against off-thread change-callback races.
• Exports: Exports.Register/Exports.Call assert the script thread and fail fast off-thread (consistent with Rpc.Client and the DB layer) instead of racing the registry.
• Attribute routers: RegisterAll(typeof(X)) now works for static/utility classes across all four routers (Commands/Events/Exports/StateWatchers) instead of silently registering nothing; annotated instance methods without an instance are rejected with a clear error.

Native core / component (new payload)

• Spatial grid: empty cells are fully torn down on removal — fixes unbounded empty-cell accumulation (slow memory creep) on long-running servers.
• Object-return native invoke: argument counts outside 0..32 are rejected up front instead of reading past a 32-slot stack buffer (out-of-bounds stack read).
• Runtime lifecycle: the active runtime handle is reset on resource destroy, so the core is never left pointing at a freed runtime (use-after-free).

Tooling (Flash.LuaDefGen)

• ValueTask/ValueTask<T> returns are documented like Task/Task<T> instead of table; generic methods get correct compiler doc-IDs so overloaded generic exports keep their XML docs; the assembly resolver no longer crashes under single-file publish.

Compatibility: Flash.Sdk 0.5.1 (NuGet) · core contract v12 · FXServer artifact pin 31689 — unchanged. The payload zip contains the rebuilt component + host; install/update via tools/install-flash.ps1.

🤖 Generated with Claude Code

Flash-Engine 0.5.0

Feature release: the modern DX attribute family plus the highest-priority backlog items. Managed-only — the native core, the core contract (v12) and the FXServer artifact pin (31689) are unchanged; a 0.5.0 SDK runs on the 0.4.x payload.

Highlights

Attribute routing family — write resources declaratively:

• [EventHandler("name")] + [FromSource] — typed event handlers with automatic argument deserialization (Events.RegisterAll(this)).
• [StateWatcher("key")] — reactive state-bag bindings with (newValue, oldValue) and the bag owner injected.
• [FlashExport("name")] — declarative C# exports (Exports.RegisterAll(this)).
• [AuthorizeFaction] / [AuthorizeAdmin] — declarative, fail-closed authorization enforced on commands and events (method- and class-level).

Lua autocomplete for C# exports — every resource build now emits <resource>.d.lua (EmmyLua) generated from your [FlashExport] methods, including hover docs from your C# /// comments. Lua scripts calling exports.<resource>:... get autocomplete + type checking in VS Code (sumneko Lua Language Server). Ships inside the Flash.Sdk NuGet — zero configuration.

More SDK

• Typed DB mapping: Db.Query<T> / Db.QueryAsync<T> / Db.QuerySingleAsync<T> (Dapper-style, snake_case→PascalCase, numeric-safe).
• Standard HttpClient via FlashHttpMessageHandler — continuations resume on the script thread; unlocks Refit/Discord.Net/System.Net.Http.Json.
• Graceful async shutdown: IAsyncStoppable.OnStopAsync(ct) with a bounded grace window (flash_stop_grace_ms) — flush your DB saves safely on stop/restart.
• Anti-XSS input sanitization: Flash.Security (HtmlEncode, allow-list IsMatch) + Args.StrRegex.
• StateBag.Get<T> now coerces wire-widened numerics (int/long/double/nullables).

All new code went through a verification pass before release — the bugs found (class-level authorization bypass, off-thread HttpClient/RPC crashes, DB NULL mapping, and more) are fixed in this release. Full details in the CHANGELOG.

Install

Download flash-payload-0.5.0.zip, unpack, then:

.\install-flash.ps1 -ServerDir "C:\FXServer\server" -PayloadDir .

Flash release	Flash.Sdk (NuGet)	Core contract	FXServer artifact (Windows)
0.5.0	0.5.0	v12	31689 (06d4d348c)

Flash-Engine 0.4.1

Bug-fix release from a review of seven reported issues (#147–#153), each verified against the code and covered by a build + targeted test.

Managed-only — the native core is unchanged, so the core contract (v12) and the FXServer artifact pin (31689) stay the same. A newer SDK on the 0.4.0 payload is fine. To get the runtime fixes, install flash-payload-0.4.1.zip (the host bundles the updated Flash.Sdk.dll); the native citizen-scripting-flash.dll is byte-identical to 0.4.0.

Security / reliability

• #147 Disconnect cleanup checked the wrong source prefix (net: vs the core's internal-net:) → it never ran on a real drop, and a client-forged net: drop could reset its own rate-limiter (flood-evasion). Now gated on internal-net: + parses the NetID after the last colon.
• #148 State.OnChange dispatch is thread-safe (lock + snapshot; the change trampoline can fire off-thread).
• #152 StateBag.Get guards the msgpack decode — a malformed client-replicated bag can no longer crash the reading resource.

Memory / lifecycle

• #149 Async.Delay(ms, token) disposes its CancellationTokenRegistration — a long-lived DropToken no longer roots the task/state machine.
• #150 Resource unload completes pending delay timers, so their state machines release instead of pinning the collectible ALC on hot-reload.

DX

• #151 The command router binds nullable primitive parameters (int?/bool?/…).
• #153 Args.To<T> coerces nullable primitives (Args.To<int?>(5L) → 5; a null input maps to null).

Full details in the CHANGELOG.

Flash-Engine 0.4.0

Security, reliability & economy-integrity release. Verified in the real server on SQLite and MySQL/MariaDB, plus Zig core unit tests. The native core is rebuilt this release (state-store fix + native-invoker bounds), but the core contract (v12) and the FXServer artifact pin (31689) are unchanged.

Highlights

• Crash-atomic society↔player transactions; new Db.ExecuteGuardedBatchAsync for conditional multi-row invariants.
• Auto-save stale-session guard + transfer deadlock retry (no more lost money_log rows).
• Scheduler hardening: bounded per-frame drain (no watchdog crash from runaway await loops) and dead-context drop (no ALC leak on restart).
• State-store use-after-free fix (string/byte getters copy under lock).
• Lifecycle-event forgery guard: Events.IsFromCore rejects client-forged playerJoining/playerDropped.
• Msgpack/RefBridge payload caps, Args uint fix, threading-model docs.
• SDK comments/messages translated to English.

Install: download flash-payload-0.4.0.zip, then run install-flash.ps1 -ServerDir <FXServer> -PayloadDir <folder>. See CHANGELOG.md for the full list and the compatibility matrix.