@voxgig/sdkgen 4.9.0 → 4.11.0

package/project/.sdk/tm/lua/feature/secrets/plugin/types.lua

@@ -0,0 +1,275 @@
+-- VENDORED: @voxgig/plugin sdk-20260908-1556-0 (lua/src/plugin/types.lua)
+-- Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+-- License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+-- Shared types and the value helpers every module reads data through.
+--
+-- Deliberately small: the design's section 19 budget says the library owns
+-- naming, configuration, lifecycle, ordering, binding and teardown, and
+-- nothing else.
+--
+-- LUA HAS ONE COMPOSITE TYPE AND NO NULL, and both are corpus-visible:
+--
+--   * A TABLE IS BOTH A MAP AND A LIST. `{}` is neither and both, so the
+--     parser TAGS every table it builds with a metatable and this file
+--     builds every table through `map()` or `list()`. An untagged table
+--     would read as whichever the first test happened to ask about.
+--
+--   * `t[k] = nil` DELETES the key, so a JSON `null` cannot be stored as
+--     one. `NULL` is a unique sentinel: `t[k] == nil` is ABSENT and
+--     `t[k] == NULL` is a present null, which is exactly the distinction
+--     `__UNDEF__` and `__NULL__` assert.
+
+local M = {}
+
+-- Section 5.1's seven statuses, and no more. A port that adds an eighth is
+-- diverging. `loading` and `closing` are observable only from inside a
+-- callback or from another thread.
+M.STATUSES = { 'declared', 'loaded', 'pending', 'live', 'failed',
+               'loading', 'closing' }
+
+-- Section 12's detail fields, IN THIS FIXED ORDER.
+--
+-- The order is part of the contract, not a formatting preference. An
+-- earlier draft named six fields while other sections promised diagnostics
+-- that had nowhere to go, which would have left each port inventing its
+-- own order and breaking message parity.
+M.DETAIL_ORDER = {
+  'host', 'ref', 'name', 'tag', 'point', 'key', 'capability',
+  'range', 'version', 'match', 'candidates', 'cycle', 'holders',
+  'refs', 'path', 'cause',
+}
+
+-- The present-null sentinel. A table rather than a string, so nothing a
+-- document could contain can be mistaken for it.
+M.NULL = setmetatable({}, { __tostring = function() return 'null' end })
+
+M.MAP_MT = { __jsontype = 'map' }
+M.LIST_MT = { __jsontype = 'list' }
+
+function M.map(t)
+  return setmetatable(t or {}, M.MAP_MT)
+end
+
+function M.list(t)
+  return setmetatable(t or {}, M.LIST_MT)
+end
+
+function M.ismap(v)
+  return 'table' == type(v) and getmetatable(v) == M.MAP_MT
+end
+
+function M.islist(v)
+  return 'table' == type(v) and getmetatable(v) == M.LIST_MT
+end
+
+function M.isnull(v)
+  return v == M.NULL
+end
+
+-- Ruby's truthiness, which is not lua's: `nil` and `false` are false here
+-- too, but a PRESENT NULL must also be false, and `0` and `''` must be
+-- true (lua already agrees about those two).
+function M.truthy(v)
+  return nil ~= v and false ~= v and M.NULL ~= v
+end
+
+-- The value at a key: nil when absent, NULL when present-and-null.
+function M.get(t, k)
+  if not M.ismap(t) then return nil end
+  return t[k]
+end
+
+-- PRESENCE, which is what distinguishes an authored null from absence.
+function M.has(t, k)
+  if not M.ismap(t) then return false end
+  return nil ~= t[k]
+end
+
+-- The value at a key with NULL flattened to nil, for the callers that
+-- genuinely do not care which they got.
+function M.getv(t, k)
+  local v = M.get(t, k)
+  if M.NULL == v then return nil end
+  return v
+end
+
+function M.at(l, i)
+  if not M.islist(l) then return nil end
+  return l[i]
+end
+
+function M.len(l)
+  if not M.islist(l) then return 0 end
+  return #l
+end
+
+-- The keys of a map, SORTED. `pairs` has no defined order in lua, so every
+-- walk of a map in this port goes through here.
+function M.keys(t)
+  local out = {}
+  if not M.ismap(t) then return out end
+  for k in pairs(t) do out[#out + 1] = k end
+  table.sort(out)
+  return out
+end
+
+function M.sortstrings(l)
+  local out = {}
+  for i = 1, #l do out[i] = l[i] end
+  table.sort(out)
+  return out
+end
+
+-- STABLE sort by a comparator. `table.sort` is NOT stable and the
+-- canonical's comparators fall through to a `pos` or ref tie-break, so
+-- every sort in this port decorates with the original index and uses it as
+-- the last tier.
+function M.stable_sort(l, less)
+  local decorated = {}
+  for i = 1, #l do decorated[i] = { item = l[i], at = i } end
+  table.sort(decorated, function(a, b)
+    if less(a.item, b.item) then return true end
+    if less(b.item, a.item) then return false end
+    return a.at < b.at
+  end)
+  local out = {}
+  for i = 1, #decorated do out[i] = decorated[i].item end
+  return out
+end
+
+function M.copy(v)
+  if M.islist(v) then
+    local out = {}
+    for i = 1, #v do out[i] = M.copy(v[i]) end
+    return M.list(out)
+  end
+  if M.ismap(v) then
+    local out = {}
+    for k, x in pairs(v) do out[k] = M.copy(x) end
+    return M.map(out)
+  end
+  return v
+end
+
+-- JSON equality: same type, then same value.
+--
+-- `true == 1` and `1 == '1'` are BOTH FALSE in lua, which is what
+-- `capability/match` needs and what php, perl and lua were each expected
+-- to get wrong. Lua gets it right for the same reason ruby does: no
+-- coercion across types in `==`.
+function M.same(a, b)
+  if M.ismap(a) or M.ismap(b) then
+    if not (M.ismap(a) and M.ismap(b)) then return false end
+    local ka, kb = M.keys(a), M.keys(b)
+    if #ka ~= #kb then return false end
+    for i = 1, #ka do
+      if ka[i] ~= kb[i] then return false end
+      if not M.same(a[ka[i]], b[ka[i]]) then return false end
+    end
+    return true
+  end
+  if M.islist(a) or M.islist(b) then
+    if not (M.islist(a) and M.islist(b)) then return false end
+    if #a ~= #b then return false end
+    for i = 1, #a do
+      if not M.same(a[i], b[i]) then return false end
+    end
+    return true
+  end
+  return a == b
+end
+
+-- The error type. Every error carries a section 12 code; ports compare by
+-- CODE and never by message, because wording is a port's own business and
+-- pinning the words would make every translation a corpus change.
+local Error = {}
+Error.__index = Error
+Error.__tostring = function(e) return e.message end
+M.Error = Error
+
+-- `plugin/<code>: <text> [<key>=<value> ...]`
+--
+-- Values render as COMPACT JSON, so a value containing a space or a
+-- bracket cannot break the parse, and a list renders as a JSON array. The
+-- bracket is absent entirely when no field applies.
+function M.formaterror(code, text, details)
+  local parts = {}
+  for _, k in ipairs(M.DETAIL_ORDER) do
+    if M.has(details, k) then
+      parts[#parts + 1] = k .. '=' .. M.encode(details[k])
+    end
+  end
+  local tail = 0 == #parts and '' or (' [' .. table.concat(parts, ' ') .. ']')
+  return 'plugin/' .. code .. ': ' .. text .. tail
+end
+
+function M.fail(code, text, details)
+  error(setmetatable({
+    code = code,
+    text = text,
+    details = details,
+    message = M.formaterror(code, text, details),
+  }, Error), 0)
+end
+
+-- The section 12 code of an error, or '' for one this library did not
+-- raise. The corpus compares by code, so the driver needs one place that
+-- knows how to read it.
+function M.codeof(err)
+  if 'table' == type(err) and getmetatable(err) == Error then
+    return err.code
+  end
+  return ''
+end
+
+function M.message(err)
+  if 'table' == type(err) and getmetatable(err) == Error then
+    return err.message
+  end
+  return tostring(err)
+end
+
+-- A detail map, spelled once rather than at forty call sites.
+function M.details(pairs_)
+  return M.map(pairs_)
+end
+
+-- Compact JSON. Set here rather than in json.lua so that `formaterror` -
+-- which every module reaches - does not pull the parser in behind it.
+function M.encode(v)
+  if nil == v or M.NULL == v then return 'null' end
+  local t = type(v)
+  if 'boolean' == t then return v and 'true' or 'false' end
+  if 'number' == t then
+    if math.type(v) == 'integer' then return tostring(v) end
+    -- An integral float prints without a fractional part, so a `pos` of 3
+    -- renders as `3` and not `3.0` - JSON has one number type and the
+    -- corpus writes them as it means them.
+    if v == math.floor(v) and math.abs(v) < 1e15 then
+      return string.format('%d', v)
+    end
+    return tostring(v)
+  end
+  if 'string' == t then
+    local out = v:gsub('[\\"]', '\\%0'):gsub('\n', '\\n'):gsub('\r', '\\r')
+        :gsub('\t', '\\t')
+    return '"' .. out .. '"'
+  end
+  if M.islist(v) then
+    local parts = {}
+    for i = 1, #v do parts[i] = M.encode(v[i]) end
+    return '[' .. table.concat(parts, ',') .. ']'
+  end
+  if M.ismap(v) then
+    local parts = {}
+    for _, k in ipairs(M.keys(v)) do
+      parts[#parts + 1] = M.encode(k) .. ':' .. M.encode(v[k])
+    end
+    return '{' .. table.concat(parts, ',') .. '}'
+  end
+  -- A host object published through `exports` (section 11) - the library
+  -- never inspects one and nothing in the corpus compares one.
+  return '"(opaque)"'
+end
+
+return M

package/project/.sdk/tm/lua/feature/secrets/plugin/version.lua

@@ -0,0 +1,131 @@
+-- VENDORED: @voxgig/plugin sdk-20260908-1556-0 (lua/src/plugin/version.lua)
+-- Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+-- License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+-- Versions and ranges (section 11.2).
+--
+-- TWO FIELDS AND ONE PREDICATE. A capability declares `version`, a
+-- concrete version. A requirement declares `range`. A requirement is
+-- satisfied when the names match, the `match` passes, and the provider's
+-- `version` falls inside the requirement's `range`.
+--
+-- That is the whole rule. There is no third field and no second comparison
+-- - an earlier draft added a provider-side `compat` range, which left
+-- three values and no statement of how they combine, and three defensible
+-- readings of one declaration is worse than the ambiguity it was
+-- introduced to fix.
+
+local T = require 'feature.secrets.plugin.types'
+
+local M = {}
+
+-- A COMPONENT IS BOUNDED, and the bound is the model's, not the host
+-- language's. Lua 5.4 integers are 64-bit and JavaScript's numbers stop
+-- being exact past 2**53, so a twenty-digit component parsed to one value
+-- here and a rounded one there. 2**31-1 is the smallest bound every target
+-- language holds exactly, which makes it the model's.
+M.COMPONENT_MAX = 2147483647
+
+local function component(digits, whole, field)
+  -- `tonumber` on twenty digits gives a FLOAT, not an error, and a float
+  -- above the bound still compares above it - so the check fires on the
+  -- imprecise value exactly as it does on an exact one.
+  local value = tonumber(digits)
+  if nil == value or M.COMPONENT_MAX < value then
+    T.fail('plugin_bad_range',
+           'version component out of range in ' .. whole .. ': ' .. digits,
+           T.map { [field] = whole })
+  end
+  return math.tointeger(value) or value
+end
+
+-- `1`, `1.2` or `1.2.3`, fully anchored.
+local function parts(text, whole, field)
+  local pieces = {}
+  for piece in (text .. '.'):gmatch('([^.]*)%.') do
+    pieces[#pieces + 1] = piece
+  end
+  if 0 == #pieces or 3 < #pieces then return nil end
+  local out = { 0, 0, 0 }
+  for i, piece in ipairs(pieces) do
+    if '' == piece or nil ~= piece:find('[^0-9]') then return nil end
+    out[i] = component(piece, whole, field)
+  end
+  return out
+end
+
+-- Two forms and no more (section 11.2):
+--
+--   '2.1'    >= 2.1.0 and < 3.0.0
+--   '~2.1'   >= 2.1.0 and < 2.2.0
+function M.parse_range(range)
+  if 'string' ~= type(range) or '' == range then
+    T.fail('plugin_bad_range', 'invalid range: ' .. T.encode(range),
+           T.map { range = range })
+  end
+
+  local tilde = '~' == range:sub(1, 1)
+  local body = tilde and range:sub(2) or range
+  local got = parts(body, range, 'range')
+  if nil == got then
+    T.fail('plugin_bad_range', 'invalid range: ' .. range,
+           T.map { range = range })
+  end
+
+  local hi
+  if tilde then
+    hi = T.list { got[1], got[2] + 1, 0 }
+  else
+    hi = T.list { got[1] + 1, 0, 0 }
+  end
+  return T.map { lo = T.list { got[1], got[2], got[3] }, hi = hi }
+end
+
+function M.parse_version(version)
+  if 'string' ~= type(version) then
+    T.fail('plugin_bad_range', 'invalid version: ' .. T.encode(version),
+           T.map { version = version })
+  end
+  local got = parts(version, version, 'version')
+  if nil == got then
+    T.fail('plugin_bad_range', 'invalid version: ' .. version,
+           T.map { version = version })
+  end
+  return got
+end
+
+local function cmp(a, b)
+  for i = 1, 3 do
+    local x = a[i] or 0
+    local y = b[i] or 0
+    if x ~= y then return x < y and -1 or 1 end
+  end
+  return 0
+end
+
+-- The one satisfaction predicate: lo <= version < hi.
+function M.satisfies(version, range)
+  local v = M.parse_version(version)
+  local r = M.parse_range(range)
+  return 0 <= cmp(v, r.lo) and 0 > cmp(v, r.hi)
+end
+
+-- satisfies for the internal callers that treat an unparseable version or
+-- range as "does not satisfy" - Capability and Graph, both of which run
+-- over data the corpus has already admitted.
+function M.satisfiesq(version, range)
+  local ok, out = pcall(M.satisfies, version, range)
+  return ok and out or false
+end
+
+-- The version triple as a comparable key, for the capability rank.
+function M.version_parts(text)
+  local out = {}
+  for piece in (tostring(text) .. '.'):gmatch('([^.]*)%.') do
+    out[#out + 1] = tonumber(piece) or 0
+  end
+  return out
+end
+
+M.version_cmp = cmp
+
+return M

package/project/.sdk/tm/lua/feature/secrets/plugin.lua

@@ -0,0 +1,76 @@
+-- VENDORED: @voxgig/plugin sdk-20260908-1556-0 (lua/src/plugin.lua)
+-- Source: https://github.com/voxgig/plugin @ 48392f5e2b6d1434ee9b1a4a9a11f4480aaeb46a  [tag: sdk-20260908-1556-0]
+-- License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+-- The canonical surface `make parity` checks (AGENTS.md section 4). Small
+-- on purpose (section 19): everything else is methods on the host and
+-- instance types, because a library that grows a second public entry point
+-- per feature is a library twenty ports pay for twice.
+--
+--   make_host  make_catalog
+--   parse_ref  format_ref  check_name  check_tag
+--   normalize_config  resolve_options  resolve_order  resolve_candidates
+--   apply_env
+--
+-- This module FORWARDS rather than implements: the surface is visible in
+-- one place, and a name that stops existing stops existing here loudly.
+
+local types = require 'feature.secrets.plugin.types'
+local json = require 'feature.secrets.plugin.json'
+local ref = require 'feature.secrets.plugin.ref'
+local version = require 'feature.secrets.plugin.version'
+local capability = require 'feature.secrets.plugin.capability'
+local resolve = require 'feature.secrets.plugin.resolve'
+local graph = require 'feature.secrets.plugin.graph'
+local order = require 'feature.secrets.plugin.order'
+local config = require 'feature.secrets.plugin.config'
+local env = require 'feature.secrets.plugin.env'
+local export = require 'feature.secrets.plugin.export'
+local point = require 'feature.secrets.plugin.point'
+local catalog = require 'feature.secrets.plugin.catalog'
+local depend = require 'feature.secrets.plugin.depend'
+local host = require 'feature.secrets.plugin.host'
+
+local M = {
+  types = types,
+  json = json,
+
+  make_host = host.make_host,
+  make_catalog = catalog.make_catalog,
+
+  parse_ref = ref.parse_ref,
+  format_ref = ref.format_ref,
+  check_name = ref.check_name,
+  check_tag = ref.check_tag,
+  canon_ref = ref.canon_ref,
+
+  normalize_config = config.normalize_config,
+  resolve_options = config.resolve_options,
+  resolve_order = order.resolve_order,
+  resolve_candidates = resolve.resolve_candidates,
+  resolve_from = resolve.resolve_from,
+  resolve_capability = capability.resolve_capability,
+  resolve_graph = graph.resolve_graph,
+  apply_env = env.apply_env,
+  parse_range = version.parse_range,
+  satisfies = version.satisfies,
+
+  codeof = types.codeof,
+  NULL = types.NULL,
+}
+
+-- The modules themselves, for the driver and for a host that needs one.
+M.ref = ref
+M.version = version
+M.capability = capability
+M.resolve = resolve
+M.graph = graph
+M.order = order
+M.config = config
+M.env = env
+M.export = export
+M.point = point
+M.catalog = catalog
+M.depend = depend
+M.host = host
+
+return M

package/project/.sdk/tm/lua/feature/secrets/sekreto/addr.lua

@@ -0,0 +1,124 @@
+-- VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (lua/src/sekreto/addr.lua)
+-- Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+-- License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+-- Address checking: core, never a plugin.
+--
+-- Every network provider routes its configured address through
+-- `checkaddr` before a socket is opened, and every refusal names the
+-- address through `safeaddr`.
+--
+-- The address is read by hand, in the same handful of steps in every
+-- port, rather than by each platform's URL parser. That is deliberate.
+-- Twelve parsers disagree about malformed input - where userinfo ends,
+-- whether `0177.0.0.1` is loopback, what an unclosed bracket means - and
+-- a check that answers differently in different ports is not a check.
+--
+-- The rule this parse obeys, and the reason it can be trusted: it is
+-- never more permissive than the transport that will dial the address.
+-- It ends the authority at `/`, `?` or `#` only, so a client that also
+-- breaks on `\` can only ever see a SHORTER host than this does. It
+-- refuses userinfo outright rather than locating its end. It compares the
+-- host literally, so a numeric form no parser here agrees on is refused
+-- rather than guessed at.
+
+local err = require('feature.secrets.sekreto.err')
+
+local M = {}
+
+local function lowerascii(text)
+  return (text:gsub('[A-Z]', function(ch) return string.char(ch:byte() + 32) end))
+end
+
+--- An address with any userinfo replaced by `[redacted]`, for messages.
+---
+--- Every refusal below names the address it refused, and one of them
+--- fires precisely because the address carries a credential - so printing
+--- it verbatim would write the password to stderr and into the logs. It
+--- cannot be cleaned up afterwards either: that password was never
+--- resolved as a secret, so `redact()` has never seen it and never will.
+function M.safeaddr(addr)
+  local mark = addr:find('://', 1, true)
+  if not mark then
+    return addr
+  end
+
+  local rest = addr:sub(mark + 3)
+  local stop = rest:find('[/?#]')
+  local authority = stop and rest:sub(1, stop - 1) or rest
+
+  local at = authority:find('@[^@]*$')
+  if not at then
+    return addr
+  end
+
+  return addr:sub(1, mark + 2) .. '[redacted]' .. addr:sub(mark + 3 + at - 1)
+end
+
+--- Refuse to send a secret-bearing credential in the clear.
+---
+--- A vault API is HTTPS in any real deployment; plaintext is a dev-mode
+--- convenience. Loopback stays allowed: that is `vault server -dev`,
+--- `boru vault serve`, and this repository's own test harness.
+function M.checkaddr(addr)
+  local scheme
+
+  if 'https://' == addr:sub(1, 8) then
+    scheme = 'https://'
+  elseif 'http://' == addr:sub(1, 7) then
+    scheme = 'http://'
+  else
+    err.fail('sekreto: not an http(s) address: ' .. M.safeaddr(addr))
+  end
+
+  local rest = addr:sub(#scheme + 1)
+  local stop = rest:find('[/?#]')
+  local authority = stop and rest:sub(1, stop - 1) or rest
+
+  -- Userinfo is refused outright rather than parsed around, and on https
+  -- as well as http. No store this library speaks authenticates by
+  -- userinfo - they take a token or a signature - so an address carrying
+  -- one is a mistake at best. At worst it is the attack this whole
+  -- function exists to stop: `http://localhost:8200@evil.example.com/` is
+  -- a request to evil.example.com that reads, to anything that splits the
+  -- authority on ':', as loopback.
+  if nil ~= authority:find('@', 1, true) then
+    err.fail('sekreto: refusing an address with embedded credentials: ' .. M.safeaddr(addr))
+  end
+
+  -- An opening bracket with no closing one is not an address at all.
+  if '[' == authority:sub(1, 1) and nil == authority:find(']', 1, true) then
+    err.fail('sekreto: not a valid http(s) address: ' .. M.safeaddr(addr))
+  end
+
+  if 'https://' == scheme then
+    return
+  end
+
+  -- A bracketed IPv6 literal keeps its brackets: splitting the authority
+  -- on the first colon would yield '[', which could never match.
+  local host
+  if '[' == authority:sub(1, 1) then
+    host = authority:sub(1, authority:find(']', 1, true))
+  else
+    local colon = authority:find(':', 1, true)
+    host = colon and authority:sub(1, colon - 1) or authority
+  end
+  host = lowerascii(host)
+
+  -- Four literals, and nothing is normalised: `0177.0.0.1`, `2130706433`,
+  -- `127.0.0.2` and `[::ffff:127.0.0.1]` are all refused.
+  if 'localhost' == host or '127.0.0.1' == host or '::1' == host or '[::1]' == host then
+    return
+  end
+
+  err.fail('sekreto: refusing to send a token in plaintext to ' ..
+    M.safeaddr(addr) .. ' (use https)')
+end
+
+--- A URL without its query string, for a message that must not leak one.
+function M.bare(url)
+  local mark = url:find('?', 1, true)
+  return mark and url:sub(1, mark - 1) or url
+end
+
+return M

package/project/.sdk/tm/lua/feature/secrets/sekreto/err.lua

@@ -0,0 +1,47 @@
+-- VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (lua/src/sekreto/err.lua)
+-- Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+-- License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+-- Anything sekreto refuses to do: a bad name, a missing secret, a
+-- provider that could not be reached.
+--
+-- Lua has no exception type, so an error is a table carrying a message
+-- and nothing else - no code, no fields, no cause. The message IS the
+-- contract: spec/sekreto.json pins every one of them byte for byte.
+--
+-- Raised with `error(value, 0)` so that Lua does not prepend a source
+-- position: `sekreto: invalid name: a b` must arrive exactly as written.
+
+local M = {}
+
+local ERRMT = {
+  __tostring = function(err) return err.message end,
+  __name = 'SekretoError',
+}
+
+--- A SekretoError value.
+function M.SekretoError(message)
+  return setmetatable(
+    { sekreto = true, name = 'SekretoError', message = message },
+    ERRMT
+  )
+end
+
+--- Is this a SekretoError?
+function M.issekretoerror(err)
+  return 'table' == type(err) and true == err.sekreto
+end
+
+--- Raise a SekretoError.
+function M.fail(message)
+  error(M.SekretoError(message), 0)
+end
+
+--- The message of anything raised, SekretoError or not.
+function M.message(err)
+  if 'table' == type(err) and nil ~= err.message then
+    return tostring(err.message)
+  end
+  return tostring(err)
+end
+
+return M