@yuneta/gobj-js 7.25.8 → 7.25.9

package/dist/gobj-js.umd.js

@@ -27,8 +27,8 @@
 		return sprintf.apply(null, [fmt].concat(argv || []));
 	}
 	function sprintf_format(parse_tree, argv) {
-		var cursor = 1, tree_length = parse_tree.length, arg, output = "", i, k, ph, pad, pad_character, pad_length, is_positive, sign;
-		for (i = 0; i < tree_length; i++) if (typeof parse_tree[i] === "string") output += parse_tree[i];
+		var cursor = 1, tree_length = parse_tree.length, arg, output = "", i = 0, k, ph, pad, pad_character, pad_length, is_positive, sign;
+		for (; i < tree_length; i++) if (typeof parse_tree[i] === "string") output += parse_tree[i];
 		else if (typeof parse_tree[i] === "object") {
 			ph = parse_tree[i];
 			if (ph.keys) {
@@ -1337,7 +1337,7 @@
 		let new_kw = kw;
 		if (json2sdata(hs, new_kw, -1, gobj.gclass.gclass_flag & gclass_flag_t.gcflag_ignore_unknown_attrs ? 0 : print_attr_not_found, gobj) < 0) {
 			log_error(`${gobj_short_name(gobj)} json2data() FAILED`);
-			trace_json(new_kw);
+			trace_json_masked(new_kw);
 		}
 	}
 	/************************************************************
@@ -2552,7 +2552,7 @@
 					else trace_machine(sprintf("🔃 mach(%s%s), st: %s, ev: %s, from(%s%s)", !dst.running ? "!!" : "", gobj_short_name(dst), state.state_name, event ? event : "", src && !src.running ? "!!" : "", gobj_short_name(src)));
 					if (kw) {
 						if (__trace_gobj_ev_kw__(dst)) {
-							if (json_object_size(kw)) trace_json(kw);
+							if (json_object_size(kw)) trace_json_masked(kw);
 						}
 					}
 				}
@@ -2572,7 +2572,7 @@
 			}
 			if (kw) {
 				if (__trace_gobj_ev_kw__(dst)) {
-					if (json_object_size(kw)) trace_json(kw);
+					if (json_object_size(kw)) trace_json_masked(kw);
 				}
 			}
 		}
@@ -2586,9 +2586,25 @@
 		return ret;
 	}
 	var subs_flag_t = Object.freeze({
-		__hard_subscription__: 1,
-		__own_event__: 2
+		__rename_event_name__: 1,
+		__hard_subscription__: 2,
+		__own_event__: 4
 	});
+	/***************************************************************************
+	*  The event type of `event_name` in any registered gclass, null if none.
+	*  The C kernel's gobj_find_event_type(): any case, gclasses only.
+	***************************************************************************/
+	function _find_event_type_in_gclasses(event_name) {
+		let lower = String(event_name).toLowerCase();
+		for (let gclass_name in _gclass_register) {
+			let dl = _gclass_register[gclass_name].dl_events;
+			for (let i = 0; i < dl.length; i++) {
+				let event_type = dl[i];
+				if (event_type.event_name && event_type.event_name.toLowerCase() === lower) return event_type;
+			}
+		}
+		return null;
+	}
 	var subscription_desc = [
 		SDATA(data_type_t.DTP_POINTER, "publisher", 0, null, "publisher gobj"),
 		SDATA(data_type_t.DTP_POINTER, "subscriber", 0, null, "subscriber gobj"),
@@ -2621,6 +2637,21 @@
 			if (json_size(__config__) > 0) {
 				let kw_clone = json_deep_copy(__config__);
 				json_object_set_new(subs, "__config__", kw_clone);
+				let renamed_event = kw_get_str(publisher, kw_clone, "__rename_event_name__", "");
+				if (!empty_string(renamed_event)) {
+					let event_type = _find_event_type_in_gclasses(renamed_event);
+					if (event_type) {
+						json_object_set_new(subs, "renamed_event", event_type.event_name);
+						delete kw_clone.__rename_event_name__;
+						subs_flag |= subs_flag_t.__rename_event_name__;
+						let kw_global = kw_get_dict(publisher, subs, "__global__", null);
+						if (!is_object(kw_global)) {
+							kw_global = {};
+							json_object_set_new(subs, "__global__", kw_global);
+						}
+						kw_global.__original_event_name__ = event;
+					} else log_error(`${gobj_short_name(publisher)}: EVENT NOT FOUND (__rename_event_name__: ${renamed_event})`);
+				}
 				if (kw_has_key(kw_clone, "__hard_subscription__")) {
 					let hard_subscription = kw_get_bool(publisher, kw_clone, "__hard_subscription__", false);
 					json_object_del(kw_clone, "__hard_subscription__");
@@ -2640,9 +2671,52 @@
 		return subs;
 	}
 	/***************************************************************************
+	*  The kw to find the subscriptions a (un)subscription `kw` names: `kw` as
+	*  _create_subscription() stores it, as the C kernel's
+	*  _subscription_match_kw(). The three `__config__` keys the framework
+	*  reads (__hard_subscription__, __own_event__, __rename_event_name__)
+	*  become the subs_flag and are taken out of the stored `__config__`, and
+	*  a renamed event adds `__original_event_name__` to the stored
+	*  `__global__`: with `kw` as it came, the same kw matched no subscription,
+	*  a repeat of it was made twice (the subscriber got each event twice) and
+	*  its withdrawal found nothing. A known renamed event is returned in
+	*  `renamed_event`, which _match_subscription() compares: a plain and a
+	*  renamed subscription, or two renames of one event, are two. A rename
+	*  that no gclass declares stays in the stored `__config__`, and in this
+	*  one. Up to gobj-js 7.25.8 the kw was compared as it came, and
+	*  `__rename_event_name__` always stayed in the stored `__config__`: a
+	*  plain kw with the rest of that __config__ found no repeat (two
+	*  subscriptions where C has one).
+	*  Return {kw, renamed_event}; renamed_event is "" when kw does not rename.
+	***************************************************************************/
+	function _subscription_match_kw(kw, event) {
+		let __config__ = kw ? kw.__config__ : null;
+		if (!is_object(__config__) || !kw_has_key(__config__, "__hard_subscription__") && !kw_has_key(__config__, "__own_event__") && !kw_has_key(__config__, "__rename_event_name__")) return {
+			kw,
+			renamed_event: ""
+		};
+		let kw_match = Object.assign({}, kw);
+		let config_match = Object.assign({}, __config__);
+		kw_match.__config__ = config_match;
+		let renamed_event = "";
+		let rename = config_match.__rename_event_name__;
+		let event_type = typeof rename === "string" && !empty_string(rename) ? _find_event_type_in_gclasses(rename) : null;
+		if (event_type) {
+			renamed_event = event_type.event_name;
+			delete config_match.__rename_event_name__;
+			if (event && json_size(kw_match.__global__) > 0) kw_match.__global__ = Object.assign({}, kw_match.__global__, { __original_event_name__: event });
+		}
+		delete config_match.__hard_subscription__;
+		delete config_match.__own_event__;
+		return {
+			kw: kw_match,
+			renamed_event
+		};
+	}
+	/***************************************************************************
 	*  Match subscription
 	***************************************************************************/
-	function _match_subscription(subs, publisher, event, kw, subscriber) {
+	function _match_subscription(subs, publisher, event, renamed_event, kw, subscriber) {
 		let __config__ = kw_get_dict(publisher, kw, "__config__", null);
 		let __global__ = kw_get_dict(publisher, kw, "__global__", null);
 		let __local__ = kw_get_dict(publisher, kw, "__local__", null);
@@ -2657,6 +2731,9 @@
 		if (event) {
 			if (event !== kw_get_str(null, subs, "event", "")) match = false;
 		}
+		if (renamed_event) {
+			if (renamed_event !== kw_get_str(null, subs, "renamed_event", "")) match = false;
+		}
 		if (json_size(__config__) > 0) {
 			let kw_config = kw_get_dict(null, subs, "__config__", null);
 			if (json_size(kw_config) > 0) {
@@ -2691,26 +2768,29 @@
 	*      kw (__config__, __global__, __local__, __filter__),
 	*      subscriber
 	***************************************************************************/
-	function _find_subscriptions(dl_subs, publisher, event, kw, subscriber) {
+	function _find_subscriptions(dl_subs, publisher, event, renamed_event, kw, subscriber) {
 		let iter = [];
 		for (let i = 0; i < dl_subs.length; i++) {
 			let subs = dl_subs[i];
-			if (_match_subscription(subs, publisher, event, kw, subscriber)) json_array_append(iter, subs);
+			if (_match_subscription(subs, publisher, event, renamed_event, kw, subscriber)) json_array_append(iter, subs);
 		}
 		return iter;
 	}
 	/***************************************************************************
-	*  Find idx of subscription in dl_subs, -1 not found
+	*  Find idx of the subscription `subs` itself in dl_subs, -1 not found.
+	*  Up to gobj-js 7.25.8 it was the first entry whose fields matched `subs`:
+	*  a subscription already removed took a live one that matched it (a plain
+	*  one matches every other of its event and subscriber).
 	***************************************************************************/
-	function _get_subs_idx(dl_subs, publisher, event, kw, subscriber) {
-		for (let i = 0; i < dl_subs.length; i++) {
-			let subs = dl_subs[i];
-			if (_match_subscription(subs, publisher, event, kw, subscriber)) return i;
-		}
-		return -1;
+	function _get_subs_idx(dl_subs, subs) {
+		return dl_subs.indexOf(subs);
 	}
 	/***************************************************************************
-	*  Delete subscription in publisher and subscriber
+	*  Delete subscription in publisher and subscriber.
+	*  Return 0 removed, -1 a hard one kept (only `force` removes it), 1 it
+	*  was not there any more: already removed, as a stale reference is, or by
+	*  the mt_subscription_deleted() of an earlier entry of the same list. The
+	*  caller says which is an error. As in C.
 	***************************************************************************/
 	function _delete_subscription(gobj, subs, force, not_inform) {
 		let publisher = kw_get_pointer(gobj, subs, "publisher", null, kw_flag_t.KW_REQUIRED);
@@ -2719,7 +2799,12 @@
 		if (kw_get_int(gobj, subs, "subs_flag", null, kw_flag_t.KW_REQUIRED) & subs_flag_t.__hard_subscription__ ? 1 : 0) {
 			if (!force) return -1;
 		}
-		if (__trace_gobj_subscriptions__(subscriber) || __trace_gobj_subscriptions__(publisher)) {
+		let tracea = __trace_gobj_subscriptions__(subscriber) || __trace_gobj_subscriptions__(publisher);
+		if (_get_subs_idx(publisher.dl_subscriptions, subs) < 0) {
+			if (tracea) trace_machine(sprintf("💜💜👎 unsubscribing event '%s': publisher %s, subscriber'%s', ALREADY REMOVED", event ? event : "", gobj_short_name(publisher), gobj_short_name(subscriber)));
+			return 1;
+		}
+		if (tracea) {
 			trace_machine(sprintf("💜💜👎 unsubscribing event '%s': publisher %s, subscriber'%s'", event ? event : "", gobj_short_name(publisher), gobj_short_name(subscriber)));
 			trace_json(subs);
 		}
@@ -2728,13 +2813,13 @@
 				if (publisher.gclass.gmt.mt_subscription_deleted) publisher.gclass.gmt.mt_subscription_deleted(publisher, subs);
 			}
 		}
-		let idx = _get_subs_idx(publisher.dl_subscriptions, publisher, event, subs, subscriber);
+		let idx = _get_subs_idx(publisher.dl_subscriptions, subs);
 		if (idx >= 0) json_array_remove(publisher.dl_subscriptions, idx);
 		else {
 			log_error(`${gobj_short_name(gobj)}: subscription in publisher not found`);
 			trace_json(subs);
 		}
-		idx = _get_subs_idx(subscriber.dl_subscribings, publisher, event, subs, subscriber);
+		idx = _get_subs_idx(subscriber.dl_subscribings, subs);
 		if (idx >= 0) json_array_remove(subscriber.dl_subscribings, idx);
 		else {
 			log_error(`${gobj_short_name(gobj)}: subscription in subscriber not found`);
@@ -2777,7 +2862,17 @@
 				}
 			}
 		} else event = "";
-		let dl_subs = _find_subscriptions(publisher.dl_subscriptions, publisher, event, kw, subscriber);
+		let match = _subscription_match_kw(kw, event);
+		let dl_subs = _find_subscriptions(publisher.dl_subscriptions, publisher, event, match.renamed_event, match.kw, subscriber);
+		let subs_hard = null;
+		for (let i = 0; i < dl_subs.length; i++) if (kw_get_int(publisher, dl_subs[i], "subs_flag", 0, kw_flag_t.KW_REQUIRED) & subs_flag_t.__hard_subscription__) {
+			subs_hard = dl_subs[i];
+			break;
+		}
+		if (subs_hard) {
+			log_warning(`${gobj_short_name(publisher)}: Hard subscription REPEATED, the one there is kept and returned (event: ${event}, subscriber: ${gobj_short_name(subscriber)})`);
+			return subs_hard;
+		}
 		if (json_array_size(dl_subs) > 0) {
 			log_error(`${gobj_short_name(publisher)}: ${json_array_size(dl_subs)} subscription(s) REPEATED, will be deleted and override`);
 			trace_json(dl_subs, "subscription REPEATED");
@@ -2792,7 +2887,7 @@
 		json_array_append(subscriber.dl_subscribings, subs);
 		if (__trace_gobj_subscriptions__(subscriber) || __trace_gobj_subscriptions__(publisher)) {
 			trace_machine(sprintf("💜💜👍 subscribing event '%s', publisher '%s', subscriber %s", event ? event : "", gobj_short_name(publisher), gobj_short_name(subscriber)));
-			if (kw && (__trace_gobj_ev_kw__(subscriber) || __trace_gobj_ev_kw__(publisher))) trace_json(kw);
+			if (kw && (__trace_gobj_ev_kw__(subscriber) || __trace_gobj_ev_kw__(publisher))) trace_json_masked(kw);
 		}
 		if (publisher.gclass.gmt.mt_subscription_added) {
 			let result = publisher.gclass.gmt.mt_subscription_added(publisher, subs);
@@ -2834,16 +2929,22 @@
 				}
 			}
 		} else event = "";
-		let dl_subs = _find_subscriptions(publisher.dl_subscriptions, publisher, event, kw, subscriber);
+		let match = _subscription_match_kw(kw, event);
+		let dl_subs = _find_subscriptions(publisher.dl_subscriptions, publisher, event, match.renamed_event, match.kw, subscriber);
 		let deleted = 0;
+		let kept_hard = 0;
+		let already_removed = 0;
 		for (let i = 0; i < dl_subs.length; i++) {
 			let subs = dl_subs[i];
-			_delete_subscription(publisher, subs, false, false);
-			deleted++;
+			let ret = _delete_subscription(publisher, subs, false, false);
+			if (ret === 0) deleted++;
+			else if (ret < 0) kept_hard++;
+			else already_removed++;
 		}
-		if (!deleted) {
+		if (kept_hard) log_warning(`${gobj_short_name(publisher)}: Hard subscription not removed, only gobj_unsubscribe_list() with force removes it (event: ${event}, hard: ${kept_hard})`);
+		else if (!deleted && !already_removed) {
 			log_warning(`${gobj_short_name(publisher)}: No subscription found`);
-			trace_json(kw, "No subscription found");
+			trace_json_masked(kw, "No subscription found");
 		}
 		return 0;
 	}
@@ -2852,10 +2953,12 @@
 	***************************************************************************/
 	function gobj_unsubscribe_list(gobj, dl_subs, force) {
 		let dl = [...dl_subs];
+		let already_removed = 0;
 		for (let i = 0; i < dl.length; i++) {
 			let subs = dl[i];
-			_delete_subscription(gobj, subs, force, false);
+			if (_delete_subscription(gobj, subs, force, false) > 0) already_removed++;
 		}
+		if (already_removed) log_warning(`${gobj_short_name(gobj)}: Subscription(s) already removed, nothing to remove (count: ${already_removed})`);
 		return 0;
 	}
 	/***************************************************************************
@@ -2867,7 +2970,7 @@
 	***************************************************************************/
 	function gobj_find_subscriptions(publisher, event, kw, subscriber) {
 		if (kw == null) kw = {};
-		return _find_subscriptions(publisher.dl_subscriptions, publisher, event, kw, subscriber);
+		return _find_subscriptions(publisher.dl_subscriptions, publisher, event, null, kw, subscriber);
 	}
 	/***************************************************************************
 	*
@@ -2906,7 +3009,7 @@
 	*      subscriber
 	***************************************************************************/
 	function gobj_find_subscribings(subscriber, event, kw, publisher) {
-		return _find_subscriptions(subscriber.dl_subscribings, publisher, event, kw, subscriber);
+		return _find_subscriptions(subscriber.dl_subscribings, publisher, event, null, kw, subscriber);
 	}
 	/***************************************************************************
 	*  Return the sum of returns of gobj_send_event
@@ -2932,7 +3035,7 @@
 		if (tracea) {
 			if (__trace_machine_format__ === 1) trace_machine(sprintf("🔝🔝 %s %s%s %s", event ? event : "", !publisher.running ? "!!" : "", gobj_short_name(publisher), publisher.current_state.state_name));
 			else trace_machine(sprintf("🔝🔝 mach(%s%s^%s), st: %s, ev: %s%s%s", !publisher.running ? "!!" : "", gobj_gclass_name(publisher), gobj_name(publisher), publisher.current_state.state_name, "", event ? event : "", ""));
-			if (__trace_gobj_ev_kw__(publisher) && json_object_size(kw)) trace_json(kw);
+			if (__trace_gobj_ev_kw__(publisher) && json_object_size(kw)) trace_json_masked(kw);
 		}
 		if (publisher.gclass.gmt.mt_publish_event) {
 			let topublish = publisher.gclass.gmt.mt_publish_event(publisher, event, kw);
@@ -2957,6 +3060,8 @@
 				let __global__ = kw_get_dict(publisher, subs, "__global__", null, 0);
 				let __local__ = kw_get_dict(publisher, subs, "__local__", null, 0);
 				let __filter__ = kw_get_dict_value(publisher, subs, "__filter__", null, 0);
+				let event_name = subs.renamed_event;
+				if (empty_string(event_name)) event_name = event;
 				let topublish = 1;
 				if (publisher.gclass.gmt.mt_publication_filter) topublish = publisher.gclass.gmt.mt_publication_filter(publisher, event, kw, subscriber);
 				else if (json_size(__filter__) > 0) {
@@ -2980,11 +3085,11 @@
 				if (__config__) {}
 				if (json_size(__global__) > 0) json_object_update(kw2publish, json_deep_copy(__global__));
 				if (tracea) {
-					if (__trace_machine_format__ === 1) trace_machine(sprintf("🔝🔄 %s (%s) %s%s", event ? event : "", event ? event : "", !subscriber.running ? "!!" : "", gobj_short_name(subscriber)));
-					else trace_machine(sprintf("🔝🔄 mach(%s%s), st: %s, ev: %s, from(%s%s)", !subscriber.running ? "!!" : "", gobj_short_name(subscriber), gobj_current_state(subscriber), event ? event : "", publisher && !publisher.running ? "!!" : "", gobj_short_name(publisher)));
-					if (__trace_gobj_ev_kw__(publisher) && json_object_size(kw2publish)) trace_json(kw2publish);
+					if (__trace_machine_format__ === 1) trace_machine(sprintf("🔝🔄 %s (%s) %s%s", event ? event : "", event_name ? event_name : "", !subscriber.running ? "!!" : "", gobj_short_name(subscriber)));
+					else trace_machine(sprintf("🔝🔄 mach(%s%s), st: %s, ev: %s (%s), from(%s%s)", !subscriber.running ? "!!" : "", gobj_short_name(subscriber), gobj_current_state(subscriber), event ? event : "", event_name ? event_name : "", publisher && !publisher.running ? "!!" : "", gobj_short_name(publisher)));
+					if (__trace_gobj_ev_kw__(publisher) && json_object_size(kw2publish)) trace_json_masked(kw2publish);
 				}
-				let ret_ = gobj_send_event(subscriber, event, kw2publish, publisher);
+				let ret_ = gobj_send_event(subscriber, event_name, kw2publish, publisher);
 				if (ret_ < 0 && subs_flag & subs_flag_t.__own_event__) {
 					sent_count = -1;
 					break;
@@ -3008,8 +3113,9 @@
 			return -1;
 		}
 		if (is_commands_tracing(gobj) || is_machine_tracing(gobj, null) && !is_machine_not_tracing(src, null)) {
-			trace_machine(sprintf("🌀🌀 mach(%s%s), cmd: %s, src: %s", !gobj_is_running(gobj) ? "!!" : "", gobj_short_name(gobj), command, gobj_short_name(src)));
-			if (__trace_gobj_ev_kw__(gobj)) trace_json(kw);
+			let command_shown = mask_secrets_inline(command);
+			trace_machine(sprintf("🌀🌀 mach(%s%s), cmd: %s, src: %s", !gobj_is_running(gobj) ? "!!" : "", gobj_short_name(gobj), command_shown !== null ? command_shown : command, gobj_short_name(src)));
+			if (__trace_gobj_ev_kw__(gobj)) trace_json_masked(kw);
 		}
 		if (gobj.gclass.gmt.mt_command_parser) return gobj.gclass.gmt.mt_command_parser(gobj, command, kw, src);
 		if (gobj.gclass.command_table) {
@@ -3225,6 +3331,268 @@
 		emit_log_callback("json", jn, current_timestamp());
 	}
 	/************************************************************
+	*  The names of the secrets (is_secret_name()). The same lists
+	*  as the C kernel's helpers.c: a name that holds one of these
+	*  (any case) is a secret.
+	************************************************************/
+	var SECRET_NAME_PARTS = [
+		"passw",
+		"pwd",
+		"passphrase",
+		"secret",
+		"token",
+		"jwt",
+		"bearer",
+		"authorization",
+		"cookie",
+		"credential",
+		"salt"
+	];
+	var SECRET_NAME_JOINED = [
+		"apikey",
+		"sessionid",
+		"sessionkey",
+		"authdata"
+	];
+	var NOT_SECRET_SEGMENTS = /* @__PURE__ */ new Set([
+		"endpoint",
+		"url",
+		"uri",
+		"domain",
+		"path",
+		"file",
+		"public",
+		"pub",
+		"count",
+		"counts",
+		"type",
+		"name",
+		"len",
+		"length",
+		"size",
+		"max",
+		"min",
+		"ttl",
+		"timeout",
+		"expiry",
+		"expires",
+		"mode"
+	]);
+	/************************************************************
+	*  TRUE if `name` is the name of a secret: a password, a token,
+	*  a key... Any case. As the C kernel's is_secret_name().
+	************************************************************/
+	function is_secret_name(name) {
+		if (typeof name !== "string" || name.length < 3) return false;
+		let lower = name.toLowerCase();
+		let hit = false;
+		for (const part of SECRET_NAME_PARTS) if (lower.indexOf(part) >= 0) {
+			hit = true;
+			break;
+		}
+		if (!hit) {
+			let joined = lower.replace(/[_\-. \t]/g, "");
+			for (const part of SECRET_NAME_JOINED) if (joined.indexOf(part) >= 0) {
+				hit = true;
+				break;
+			}
+		}
+		if (!hit) hit = lower.indexOf("priv") >= 0 && lower.indexOf("key") >= 0;
+		if (!hit) return false;
+		for (const segment of lower.split(/[_\-. \t]/)) if (NOT_SECRET_SEGMENTS.has(segment)) return false;
+		return true;
+	}
+	/************************************************************
+	*  Where an unquoted secret value that begins at `p` ends: at
+	*  the end, at the quote that closes an outer quoted value, or
+	*  before the next "word=" -- a plain word after a blank is still
+	*  part of it ("password=correct horse battery", "password=
+	*  hunter2"). As the C kernel's inline_secret_value_end().
+	************************************************************/
+	function inline_secret_value_end(str, p, outer) {
+		const blank = (c) => c === " " || c === "	";
+		const closes_outer = (i) => outer && str[i] === outer && (i + 1 >= str.length || blank(str[i + 1]));
+		let end = p;
+		while (true) {
+			while (end < str.length && !blank(str[end])) {
+				if (closes_outer(end)) return end;
+				end++;
+			}
+			if (end >= str.length) return end;
+			let w = end;
+			while (w < str.length && blank(str[w])) w++;
+			if (w >= str.length || closes_outer(w)) return end;
+			for (let e = w; e < str.length && !blank(str[e]) && !closes_outer(e); e++) if (str[e] === "=" && e > w) return end;
+			end = w;
+		}
+	}
+	/************************************************************
+	*  A text (a command line) with the value of every "name=value"
+	*  whose name is a secret's written as "********", quoted or not
+	*  (and the "value" of a write-attr whose attribute names a
+	*  secret). The rest as it is. Return null when there was nothing
+	*  to mask. As the C kernel's mask_secrets_inline().
+	************************************************************/
+	var MASK_MAX_NAME = 128;
+	var MASK_MAX_BYTES = 4194304;
+	var MASK_TOO_LARGE = "<not shown: too large to mask>";
+	function mask_secrets_inline(str) {
+		if (typeof str !== "string" || str.indexOf("=") < 0) return null;
+		if (str.length > MASK_MAX_BYTES) return MASK_TOO_LARGE;
+		let value_is_secret = false;
+		let re_attr = /(^|[ \t])attribute=["']?([^ \t"']*)/g;
+		let m;
+		while ((m = re_attr.exec(str)) !== null) if (is_secret_name(m[2].slice(-128))) value_is_secret = true;
+		let parts = [];
+		let copied = 0;
+		let changed = false;
+		let outer = "";
+		let word = 0;
+		let p = 0;
+		const is_blank_or_end = (i) => i >= str.length || str[i] === " " || str[i] === "	";
+		while (p < str.length) {
+			let c = str[p];
+			if (c === " " || c === "	") {
+				p++;
+				word = p;
+				continue;
+			}
+			if (c === "\"" || c === "'") {
+				if (!outer && (p === 0 || str[p - 1] === " " || str[p - 1] === "	" || str[p - 1] === "=")) outer = c;
+				else if (c === outer && is_blank_or_end(p + 1)) outer = "";
+			}
+			if (c !== "=") {
+				p++;
+				continue;
+			}
+			let name = str.substring(Math.max(word, p - MASK_MAX_NAME), p);
+			word = p + 1;
+			if (!(is_secret_name(name) || value_is_secret && name.toLowerCase() === "value")) {
+				p++;
+				continue;
+			}
+			p++;
+			let quote = str[p] === "\"" || str[p] === "'" ? str[p] : "";
+			let end;
+			if (quote) {
+				end = p + 1;
+				while (end < str.length && str[end] !== quote) end++;
+				if (str[end] === quote) end++;
+			} else end = inline_secret_value_end(str, p, outer);
+			if (end > p) {
+				parts.push(str.substring(copied, p));
+				parts.push("********");
+				copied = end;
+				changed = true;
+			}
+			p = end;
+			word = p;
+		}
+		if (!changed) return null;
+		parts.push(str.substring(copied));
+		return parts.join("");
+	}
+	/************************************************************
+	*  A json as a log or a trace may show it: at any depth, the
+	*  value of a key with a secret's name is "********", whatever
+	*  its type (not an absent one, a null or an empty string); so is
+	*  the "value" of a dict whose "attribute" names a secret; and a
+	*  string is masked as mask_secrets_inline(). Return a masked
+	*  copy, or `jn` itself when there was nothing to mask. As the C
+	*  kernel's json_mask_secrets().
+	*
+	*  Only JSON is walked: plain objects (their prototype is
+	*  Object.prototype or null) and arrays. Anything else -- a gobj,
+	*  a DOM node, a class instance, a typed array, a function -- is
+	*  passed as it is, never walked, as trace_json() always showed it
+	*  (a kw may carry a gobj: its parent and children make a cycle).
+	*  A plain object met twice is masked once, the same everywhere; a
+	*  cycle back to one is "<cycle>"; below MASK_MAX_DEPTH levels
+	*  (64, as in C) nothing is shown.
+	*  It never throws: a failure is the placeholder below.
+	************************************************************/
+	var MASK_MAX_DEPTH = 64;
+	var MASK_FAILED = "<not shown: the masking failed>";
+	function is_plain_object(value) {
+		if (value === null || typeof value !== "object") return false;
+		let proto = Object.getPrototypeOf(value);
+		return proto === Object.prototype || proto === null;
+	}
+	var MASK_IN_PROGRESS = Symbol("mask-in-progress");
+	function _json_mask_secrets(jn, memo, depth, budget) {
+		if (typeof jn === "string") {
+			if (jn.length > budget.left) {
+				budget.left = 0;
+				return MASK_TOO_LARGE;
+			}
+			budget.left -= jn.length;
+			let masked = mask_secrets_inline(jn);
+			return masked !== null ? masked : jn;
+		}
+		let is_array = Array.isArray(jn);
+		if (!is_array && !is_plain_object(jn)) return jn;
+		if (budget.left <= 0) return MASK_TOO_LARGE;
+		if (memo.has(jn)) {
+			let seen = memo.get(jn);
+			return seen === MASK_IN_PROGRESS ? "<cycle>" : seen;
+		}
+		if (depth >= MASK_MAX_DEPTH) return "<deeper not shown>";
+		budget.left -= 1;
+		memo.set(jn, MASK_IN_PROGRESS);
+		let changed = false;
+		let truncated = false;
+		let result;
+		if (is_array) {
+			result = [];
+			for (let i = 0; i < jn.length; i++) {
+				if (budget.left <= 0) {
+					truncated = true;
+					break;
+				}
+				budget.left -= 1;
+				let shown = _json_mask_secrets(jn[i], memo, depth + 1, budget);
+				if (shown !== jn[i]) changed = true;
+				result.push(shown);
+			}
+			if (truncated) result.push(MASK_TOO_LARGE);
+		} else {
+			result = Object.create(Object.getPrototypeOf(jn));
+			let value_is_secret = typeof jn.attribute === "string" && is_secret_name(jn.attribute.slice(-128));
+			for (const key in jn) {
+				if (!Object.prototype.hasOwnProperty.call(jn, key)) continue;
+				if (budget.left <= 0) {
+					truncated = true;
+					break;
+				}
+				budget.left -= 1 + key.length;
+				let value = jn[key];
+				let shown;
+				if ((is_secret_name(key.slice(-128)) || value_is_secret && key === "value") && value !== void 0 && value !== null && value !== "") shown = "********";
+				else shown = _json_mask_secrets(value, memo, depth + 1, budget);
+				if (shown !== value) changed = true;
+				result[key] = shown;
+			}
+			if (truncated) result["<more>"] = MASK_TOO_LARGE;
+		}
+		if (!changed && !truncated) result = jn;
+		memo.set(jn, result);
+		return result;
+	}
+	function json_mask_secrets(jn) {
+		try {
+			return _json_mask_secrets(jn, /* @__PURE__ */ new WeakMap(), 0, { left: MASK_MAX_BYTES });
+		} catch (e) {
+			return MASK_FAILED;
+		}
+	}
+	/************************************************************
+	*  trace_json() of a json that can hold a credential: what
+	*  json_mask_secrets() masks is shown masked
+	************************************************************/
+	function trace_json_masked(jn, msg) {
+		trace_json(json_mask_secrets(jn), msg);
+	}
+	/************************************************************
 	*  Duplicate an object (new references)
 	*  using the modern structuredClone (Deep copy of a single object)
 	************************************************************/
@@ -3526,8 +3894,8 @@
 	***************************************************************************/
 	function is_metadata_key(key) {
 		if (!is_string(key)) return false;
-		let i;
-		for (i = 0; i < key.length; i++) {
+		let i = 0;
+		for (; i < key.length; i++) {
 			if (key[i] !== "_") break;
 			if (i > 2) break;
 		}
@@ -3538,8 +3906,8 @@
 	***************************************************************************/
 	function is_private_key(key) {
 		if (!is_string(key)) return false;
-		let i;
-		for (i = 0; i < key.length; i++) {
+		let i = 0;
+		for (; i < key.length; i++) {
 			if (key[i] !== "_") break;
 			if (i > 2) break;
 		}
@@ -3650,7 +4018,7 @@
 				return v;
 			} else if (required) {
 				log_error(`path not found: '${path}'`);
-				trace_json(kw);
+				trace_json_masked(kw);
 			}
 			return Boolean(default_value);
 		}
@@ -3664,11 +4032,11 @@
 		} else if (wild && b === null) value = false;
 		else if (wild) {
 			log_error(`${gobj ? gobj_short_name(gobj) + ": " : ""}path MUST BE a simple json element: '${path}'`);
-			trace_json(kw);
+			trace_json_masked(kw);
 			return false;
 		} else {
 			log_error(`${gobj ? gobj_short_name(gobj) + ": " : ""}path MUST BE a json boolean: '${path}'`);
-			trace_json(kw);
+			trace_json_masked(kw);
 			return Boolean(default_value);
 		}
 		if (extract) kw_delete(gobj, kw, path);
@@ -3718,7 +4086,7 @@
 				return v;
 			} else if (required) {
 				log_error(`path not found: '${path}'`);
-				trace_json(kw);
+				trace_json_masked(kw);
 			}
 			return parseInt(default_value);
 		}
@@ -3726,14 +4094,14 @@
 		if (is_number(v)) value = Math.trunc(v);
 		else if (!wild) {
 			log_error(`${gobj ? gobj_short_name(gobj) + ": " : ""}path MUST BE a json integer: '${path}'`);
-			trace_json(kw);
+			trace_json_masked(kw);
 			return parseInt(default_value);
 		} else if (is_boolean(v)) value = v ? 1 : 0;
 		else if (is_string(v)) value = strtoll_base0(v);
 		else if (v === null) value = 0;
 		else {
 			log_error(`${gobj ? gobj_short_name(gobj) + ": " : ""}path MUST BE a simple json element: '${path}'`);
-			trace_json(kw);
+			trace_json_masked(kw);
 			return 0;
 		}
 		if (extract) kw_delete(gobj, kw, path);
@@ -3765,7 +4133,7 @@
 				return v;
 			} else if (required) {
 				log_error(`path not found: '${path}'`);
-				trace_json(kw);
+				trace_json_masked(kw);
 			}
 			return Number(default_value);
 		}
@@ -3773,7 +4141,7 @@
 		if (is_number(v)) value = v;
 		else if (!wild) {
 			log_error(`${gobj ? gobj_short_name(gobj) + ": " : ""}path MUST BE a json real: '${path}'`);
-			trace_json(kw);
+			trace_json_masked(kw);
 			return Number(default_value);
 		} else if (is_boolean(v)) value = v ? 1 : 0;
 		else if (is_string(v)) {
@@ -3782,7 +4150,7 @@
 		} else if (v === null) value = 0;
 		else {
 			log_error(`${gobj ? gobj_short_name(gobj) + ": " : ""}path MUST BE a simple json element: '${path}'`);
-			trace_json(kw);
+			trace_json_masked(kw);
 			return 0;
 		}
 		if (extract) kw_delete(gobj, kw, path);
@@ -3834,14 +4202,14 @@
 				return default_value;
 			} else if (required && !kw_path_holds_key(kw, path)) {
 				log_error(`path not found: '${path}'`);
-				trace_json(kw);
+				trace_json_masked(kw);
 			}
 			return default_value;
 		}
 		if (!is_string(v)) {
 			if (v !== null) {
 				log_error(`${gobj ? gobj_short_name(gobj) + ": " : ""}path MUST BE a json str: '${path}'`);
-				trace_json(kw);
+				trace_json_masked(kw);
 			}
 			return default_value;
 		}
@@ -3864,7 +4232,7 @@
 				return v;
 			} else if (required) {
 				log_error(`path not found: '${path}'`);
-				trace_json(kw);
+				trace_json_masked(kw);
 			}
 			return default_value;
 		}
@@ -3891,14 +4259,14 @@
 			}
 			if (required) {
 				log_error(`path not found: '${path}'`);
-				trace_json(kw);
+				trace_json_masked(kw);
 			}
 			return default_value;
 		}
 		if (!is_object(v)) {
 			if (required) {
 				log_error(`${gobj ? gobj_short_name(gobj) + ": " : ""}path MUST BE a json dict: '${path}'`);
-				trace_json(kw);
+				trace_json_masked(kw);
 			}
 			return default_value;
 		}
@@ -3921,7 +4289,7 @@
 				return v;
 			} else if (required) {
 				log_error(`path not found: '${path}'`);
-				trace_json(kw);
+				trace_json_masked(kw);
 			}
 			return default_value;
 		}
@@ -3949,14 +4317,14 @@
 			}
 			if (required) {
 				log_error(`path not found: '${path}'`);
-				trace_json(kw);
+				trace_json_masked(kw);
 			}
 			return default_value;
 		}
 		if (!is_array(v)) {
 			if (required) {
 				log_error(`${gobj ? gobj_short_name(gobj) + ": " : ""}path MUST BE a json list: '${path}'`);
-				trace_json(kw);
+				trace_json_masked(kw);
 			}
 			return default_value;
 		}
@@ -6818,7 +7186,7 @@
 		let hora = current_timestamp();
 		try {
 			log_debug("\n" + hora + " " + prefix + "\n");
-			trace_json(iev);
+			trace_json_masked(iev);
 		} catch (e) {
 			log_debug("ERROR in trace_inter_event: " + e);
 		}
@@ -7500,6 +7868,7 @@
 	exports.is_object = is_object;
 	exports.is_private_key = is_private_key;
 	exports.is_pure_number = is_pure_number;
+	exports.is_secret_name = is_secret_name;
 	exports.is_string = is_string;
 	exports.jdb_delete = jdb_delete;
 	exports.jdb_get = jdb_get;
@@ -7515,6 +7884,7 @@
 	exports.json_array_size = json_array_size;
 	exports.json_deep_copy = json_deep_copy;
 	exports.json_is_identical = json_is_identical;
+	exports.json_mask_secrets = json_mask_secrets;
 	exports.json_object_del = json_object_del;
 	exports.json_object_get = json_object_get;
 	exports.json_object_set = json_object_set;
@@ -7562,6 +7932,7 @@
 	exports.log_error = log_error;
 	exports.log_info = log_info;
 	exports.log_warning = log_warning;
+	exports.mask_secrets_inline = mask_secrets_inline;
 	exports.msg_iev_get_msg_type = msg_iev_get_msg_type;
 	exports.msg_iev_get_stack = msg_iev_get_stack;
 	exports.msg_iev_push_stack = msg_iev_push_stack;
@@ -7595,6 +7966,7 @@
 	exports.template_get_field_desc = template_get_field_desc;
 	exports.timeTracker = timeTracker;
 	exports.trace_json = trace_json;
+	exports.trace_json_masked = trace_json_masked;
 	exports.trace_level_t = trace_level_t;
 	exports.trace_msg = trace_msg;
 	exports.treedb_decoder_fkey = treedb_decoder_fkey;