klua 0.2.0

klua 0.2.0

Android support and a proper sandbox for untrusted Lua.

Android

• New artifact pw.binom:klua-android — a com.android.library AAR (minSdk 24) that ships prebuilt libklua.so for arm64-v8a and x86_64 and loads it via System.loadLibrary("klua"). 32-bit ABIs are not packaged.
• New Kotlin/Native targets androidNativeArm64 / androidNativeX64 (removed androidNativeArm32 / androidNativeX86).
• The JNI Kotlin now lives in a shared jvmSharedMain source set used by both jvmMain (desktop jar loader) and androidMain; the platform seam is expect fun loadNativeLibrary().

Sandboxing

• LuaEngine(libraries: Set<LuaLibrary> = emptySet(), ...) — per-library standard-library selection (LuaLibrary.ALL, LuaLibrary.SAFE). A fresh engine is still bare (no os/io/package/debug).
• Binary chunks are rejected by default (allowBinaryChunks = false): eval compiles text-only and the same restriction is applied to Lua's load / loadstring / loadfile / dofile.
• Execution limits (LuaLimits(maxInstructions, timeout, maxMemoryBytes)): instruction cap, wall-clock deadline and memory cap, enforced by a shared C core (custom lua_Alloc + LUA_MASKCOUNT hook) used by both the JNI and Kotlin/Native backends. Violations throw LuaLimitException(kind); pcall cannot swallow them.
• LuaEngine.cancel() cooperatively aborts a long-running eval from another thread (LuaLimitKind.CANCELLED).

Fixes / build

• Replaced java.lang.ref.Cleaner (API 33+) with a PhantomReference-based cleaner plus deferred, owner-thread unref, fixing a cross-thread race and keeping minSdk 24.
• Untracked build/ and .gradle/ outputs.
• CI: release workflow now installs the Android SDK, packages the AAR, runs a bionic/glibc ABI gate (readelf), and checks that build outputs are not tracked.

Tests

• jvmTest 61/61, linuxX64Test 50/50 (library selection, binary-chunk rejection, execution limits).