@yuneta/gobj-js 7.25.8 → 7.25.9

package/dist/gobj-js.cjs.js

@@ -24,8 +24,8 @@ function vsprintf(fmt, argv) {
 	return sprintf.apply(null, [fmt].concat(argv || []));
 }
 function sprintf_format(parse_tree, argv) {
-	var cursor = 1, tree_length = parse_tree.length, arg, output = "", i, k, ph, pad, pad_character, pad_length, is_positive, sign;
-	for (i = 0; i < tree_length; i++) if (typeof parse_tree[i] === "string") output += parse_tree[i];
+	var cursor = 1, tree_length = parse_tree.length, arg, output = "", i = 0, k, ph, pad, pad_character, pad_length, is_positive, sign;
+	for (; i < tree_length; i++) if (typeof parse_tree[i] === "string") output += parse_tree[i];
 	else if (typeof parse_tree[i] === "object") {
 		ph = parse_tree[i];
 		if (ph.keys) {
@@ -1334,7 +1334,7 @@ function write_json_parameters(gobj, kw, jn_global) {
 	let new_kw = kw;
 	if (json2sdata(hs, new_kw, -1, gobj.gclass.gclass_flag & gclass_flag_t.gcflag_ignore_unknown_attrs ? 0 : print_attr_not_found, gobj) < 0) {
 		log_error(`${gobj_short_name(gobj)} json2data() FAILED`);
-		trace_json(new_kw);
+		trace_json_masked(new_kw);
 	}
 }
 /************************************************************
@@ -2549,7 +2549,7 @@ function gobj_send_event(dst, event, kw, src) {
 				else trace_machine(sprintf("🔃 mach(%s%s), st: %s, ev: %s, from(%s%s)", !dst.running ? "!!" : "", gobj_short_name(dst), state.state_name, event ? event : "", src && !src.running ? "!!" : "", gobj_short_name(src)));
 				if (kw) {
 					if (__trace_gobj_ev_kw__(dst)) {
-						if (json_object_size(kw)) trace_json(kw);
+						if (json_object_size(kw)) trace_json_masked(kw);
 					}
 				}
 			}
@@ -2569,7 +2569,7 @@ function gobj_send_event(dst, event, kw, src) {
 		}
 		if (kw) {
 			if (__trace_gobj_ev_kw__(dst)) {
-				if (json_object_size(kw)) trace_json(kw);
+				if (json_object_size(kw)) trace_json_masked(kw);
 			}
 		}
 	}
@@ -2583,9 +2583,25 @@ function gobj_send_event(dst, event, kw, src) {
 	return ret;
 }
 var subs_flag_t = Object.freeze({
-	__hard_subscription__: 1,
-	__own_event__: 2
+	__rename_event_name__: 1,
+	__hard_subscription__: 2,
+	__own_event__: 4
 });
+/***************************************************************************
+*  The event type of `event_name` in any registered gclass, null if none.
+*  The C kernel's gobj_find_event_type(): any case, gclasses only.
+***************************************************************************/
+function _find_event_type_in_gclasses(event_name) {
+	let lower = String(event_name).toLowerCase();
+	for (let gclass_name in _gclass_register) {
+		let dl = _gclass_register[gclass_name].dl_events;
+		for (let i = 0; i < dl.length; i++) {
+			let event_type = dl[i];
+			if (event_type.event_name && event_type.event_name.toLowerCase() === lower) return event_type;
+		}
+	}
+	return null;
+}
 var subscription_desc = [
 	SDATA(data_type_t.DTP_POINTER, "publisher", 0, null, "publisher gobj"),
 	SDATA(data_type_t.DTP_POINTER, "subscriber", 0, null, "subscriber gobj"),
@@ -2618,6 +2634,21 @@ function _create_subscription(publisher, event, kw, subscriber) {
 		if (json_size(__config__) > 0) {
 			let kw_clone = json_deep_copy(__config__);
 			json_object_set_new(subs, "__config__", kw_clone);
+			let renamed_event = kw_get_str(publisher, kw_clone, "__rename_event_name__", "");
+			if (!empty_string(renamed_event)) {
+				let event_type = _find_event_type_in_gclasses(renamed_event);
+				if (event_type) {
+					json_object_set_new(subs, "renamed_event", event_type.event_name);
+					delete kw_clone.__rename_event_name__;
+					subs_flag |= subs_flag_t.__rename_event_name__;
+					let kw_global = kw_get_dict(publisher, subs, "__global__", null);
+					if (!is_object(kw_global)) {
+						kw_global = {};
+						json_object_set_new(subs, "__global__", kw_global);
+					}
+					kw_global.__original_event_name__ = event;
+				} else log_error(`${gobj_short_name(publisher)}: EVENT NOT FOUND (__rename_event_name__: ${renamed_event})`);
+			}
 			if (kw_has_key(kw_clone, "__hard_subscription__")) {
 				let hard_subscription = kw_get_bool(publisher, kw_clone, "__hard_subscription__", false);
 				json_object_del(kw_clone, "__hard_subscription__");
@@ -2637,9 +2668,52 @@ function _create_subscription(publisher, event, kw, subscriber) {
 	return subs;
 }
 /***************************************************************************
+*  The kw to find the subscriptions a (un)subscription `kw` names: `kw` as
+*  _create_subscription() stores it, as the C kernel's
+*  _subscription_match_kw(). The three `__config__` keys the framework
+*  reads (__hard_subscription__, __own_event__, __rename_event_name__)
+*  become the subs_flag and are taken out of the stored `__config__`, and
+*  a renamed event adds `__original_event_name__` to the stored
+*  `__global__`: with `kw` as it came, the same kw matched no subscription,
+*  a repeat of it was made twice (the subscriber got each event twice) and
+*  its withdrawal found nothing. A known renamed event is returned in
+*  `renamed_event`, which _match_subscription() compares: a plain and a
+*  renamed subscription, or two renames of one event, are two. A rename
+*  that no gclass declares stays in the stored `__config__`, and in this
+*  one. Up to gobj-js 7.25.8 the kw was compared as it came, and
+*  `__rename_event_name__` always stayed in the stored `__config__`: a
+*  plain kw with the rest of that __config__ found no repeat (two
+*  subscriptions where C has one).
+*  Return {kw, renamed_event}; renamed_event is "" when kw does not rename.
+***************************************************************************/
+function _subscription_match_kw(kw, event) {
+	let __config__ = kw ? kw.__config__ : null;
+	if (!is_object(__config__) || !kw_has_key(__config__, "__hard_subscription__") && !kw_has_key(__config__, "__own_event__") && !kw_has_key(__config__, "__rename_event_name__")) return {
+		kw,
+		renamed_event: ""
+	};
+	let kw_match = Object.assign({}, kw);
+	let config_match = Object.assign({}, __config__);
+	kw_match.__config__ = config_match;
+	let renamed_event = "";
+	let rename = config_match.__rename_event_name__;
+	let event_type = typeof rename === "string" && !empty_string(rename) ? _find_event_type_in_gclasses(rename) : null;
+	if (event_type) {
+		renamed_event = event_type.event_name;
+		delete config_match.__rename_event_name__;
+		if (event && json_size(kw_match.__global__) > 0) kw_match.__global__ = Object.assign({}, kw_match.__global__, { __original_event_name__: event });
+	}
+	delete config_match.__hard_subscription__;
+	delete config_match.__own_event__;
+	return {
+		kw: kw_match,
+		renamed_event
+	};
+}
+/***************************************************************************
 *  Match subscription
 ***************************************************************************/
-function _match_subscription(subs, publisher, event, kw, subscriber) {
+function _match_subscription(subs, publisher, event, renamed_event, kw, subscriber) {
 	let __config__ = kw_get_dict(publisher, kw, "__config__", null);
 	let __global__ = kw_get_dict(publisher, kw, "__global__", null);
 	let __local__ = kw_get_dict(publisher, kw, "__local__", null);
@@ -2654,6 +2728,9 @@ function _match_subscription(subs, publisher, event, kw, subscriber) {
 	if (event) {
 		if (event !== kw_get_str(null, subs, "event", "")) match = false;
 	}
+	if (renamed_event) {
+		if (renamed_event !== kw_get_str(null, subs, "renamed_event", "")) match = false;
+	}
 	if (json_size(__config__) > 0) {
 		let kw_config = kw_get_dict(null, subs, "__config__", null);
 		if (json_size(kw_config) > 0) {
@@ -2688,26 +2765,29 @@ function _match_subscription(subs, publisher, event, kw, subscriber) {
 *      kw (__config__, __global__, __local__, __filter__),
 *      subscriber
 ***************************************************************************/
-function _find_subscriptions(dl_subs, publisher, event, kw, subscriber) {
+function _find_subscriptions(dl_subs, publisher, event, renamed_event, kw, subscriber) {
 	let iter = [];
 	for (let i = 0; i < dl_subs.length; i++) {
 		let subs = dl_subs[i];
-		if (_match_subscription(subs, publisher, event, kw, subscriber)) json_array_append(iter, subs);
+		if (_match_subscription(subs, publisher, event, renamed_event, kw, subscriber)) json_array_append(iter, subs);
 	}
 	return iter;
 }
 /***************************************************************************
-*  Find idx of subscription in dl_subs, -1 not found
+*  Find idx of the subscription `subs` itself in dl_subs, -1 not found.
+*  Up to gobj-js 7.25.8 it was the first entry whose fields matched `subs`:
+*  a subscription already removed took a live one that matched it (a plain
+*  one matches every other of its event and subscriber).
 ***************************************************************************/
-function _get_subs_idx(dl_subs, publisher, event, kw, subscriber) {
-	for (let i = 0; i < dl_subs.length; i++) {
-		let subs = dl_subs[i];
-		if (_match_subscription(subs, publisher, event, kw, subscriber)) return i;
-	}
-	return -1;
+function _get_subs_idx(dl_subs, subs) {
+	return dl_subs.indexOf(subs);
 }
 /***************************************************************************
-*  Delete subscription in publisher and subscriber
+*  Delete subscription in publisher and subscriber.
+*  Return 0 removed, -1 a hard one kept (only `force` removes it), 1 it
+*  was not there any more: already removed, as a stale reference is, or by
+*  the mt_subscription_deleted() of an earlier entry of the same list. The
+*  caller says which is an error. As in C.
 ***************************************************************************/
 function _delete_subscription(gobj, subs, force, not_inform) {
 	let publisher = kw_get_pointer(gobj, subs, "publisher", null, kw_flag_t.KW_REQUIRED);
@@ -2716,7 +2796,12 @@ function _delete_subscription(gobj, subs, force, not_inform) {
 	if (kw_get_int(gobj, subs, "subs_flag", null, kw_flag_t.KW_REQUIRED) & subs_flag_t.__hard_subscription__ ? 1 : 0) {
 		if (!force) return -1;
 	}
-	if (__trace_gobj_subscriptions__(subscriber) || __trace_gobj_subscriptions__(publisher)) {
+	let tracea = __trace_gobj_subscriptions__(subscriber) || __trace_gobj_subscriptions__(publisher);
+	if (_get_subs_idx(publisher.dl_subscriptions, subs) < 0) {
+		if (tracea) trace_machine(sprintf("💜💜👎 unsubscribing event '%s': publisher %s, subscriber'%s', ALREADY REMOVED", event ? event : "", gobj_short_name(publisher), gobj_short_name(subscriber)));
+		return 1;
+	}
+	if (tracea) {
 		trace_machine(sprintf("💜💜👎 unsubscribing event '%s': publisher %s, subscriber'%s'", event ? event : "", gobj_short_name(publisher), gobj_short_name(subscriber)));
 		trace_json(subs);
 	}
@@ -2725,13 +2810,13 @@ function _delete_subscription(gobj, subs, force, not_inform) {
 			if (publisher.gclass.gmt.mt_subscription_deleted) publisher.gclass.gmt.mt_subscription_deleted(publisher, subs);
 		}
 	}
-	let idx = _get_subs_idx(publisher.dl_subscriptions, publisher, event, subs, subscriber);
+	let idx = _get_subs_idx(publisher.dl_subscriptions, subs);
 	if (idx >= 0) json_array_remove(publisher.dl_subscriptions, idx);
 	else {
 		log_error(`${gobj_short_name(gobj)}: subscription in publisher not found`);
 		trace_json(subs);
 	}
-	idx = _get_subs_idx(subscriber.dl_subscribings, publisher, event, subs, subscriber);
+	idx = _get_subs_idx(subscriber.dl_subscribings, subs);
 	if (idx >= 0) json_array_remove(subscriber.dl_subscribings, idx);
 	else {
 		log_error(`${gobj_short_name(gobj)}: subscription in subscriber not found`);
@@ -2774,7 +2859,17 @@ function gobj_subscribe_event(publisher, event, kw, subscriber) {
 			}
 		}
 	} else event = "";
-	let dl_subs = _find_subscriptions(publisher.dl_subscriptions, publisher, event, kw, subscriber);
+	let match = _subscription_match_kw(kw, event);
+	let dl_subs = _find_subscriptions(publisher.dl_subscriptions, publisher, event, match.renamed_event, match.kw, subscriber);
+	let subs_hard = null;
+	for (let i = 0; i < dl_subs.length; i++) if (kw_get_int(publisher, dl_subs[i], "subs_flag", 0, kw_flag_t.KW_REQUIRED) & subs_flag_t.__hard_subscription__) {
+		subs_hard = dl_subs[i];
+		break;
+	}
+	if (subs_hard) {
+		log_warning(`${gobj_short_name(publisher)}: Hard subscription REPEATED, the one there is kept and returned (event: ${event}, subscriber: ${gobj_short_name(subscriber)})`);
+		return subs_hard;
+	}
 	if (json_array_size(dl_subs) > 0) {
 		log_error(`${gobj_short_name(publisher)}: ${json_array_size(dl_subs)} subscription(s) REPEATED, will be deleted and override`);
 		trace_json(dl_subs, "subscription REPEATED");
@@ -2789,7 +2884,7 @@ function gobj_subscribe_event(publisher, event, kw, subscriber) {
 	json_array_append(subscriber.dl_subscribings, subs);
 	if (__trace_gobj_subscriptions__(subscriber) || __trace_gobj_subscriptions__(publisher)) {
 		trace_machine(sprintf("💜💜👍 subscribing event '%s', publisher '%s', subscriber %s", event ? event : "", gobj_short_name(publisher), gobj_short_name(subscriber)));
-		if (kw && (__trace_gobj_ev_kw__(subscriber) || __trace_gobj_ev_kw__(publisher))) trace_json(kw);
+		if (kw && (__trace_gobj_ev_kw__(subscriber) || __trace_gobj_ev_kw__(publisher))) trace_json_masked(kw);
 	}
 	if (publisher.gclass.gmt.mt_subscription_added) {
 		let result = publisher.gclass.gmt.mt_subscription_added(publisher, subs);
@@ -2831,16 +2926,22 @@ function gobj_unsubscribe_event(publisher, event, kw, subscriber) {
 			}
 		}
 	} else event = "";
-	let dl_subs = _find_subscriptions(publisher.dl_subscriptions, publisher, event, kw, subscriber);
+	let match = _subscription_match_kw(kw, event);
+	let dl_subs = _find_subscriptions(publisher.dl_subscriptions, publisher, event, match.renamed_event, match.kw, subscriber);
 	let deleted = 0;
+	let kept_hard = 0;
+	let already_removed = 0;
 	for (let i = 0; i < dl_subs.length; i++) {
 		let subs = dl_subs[i];
-		_delete_subscription(publisher, subs, false, false);
-		deleted++;
+		let ret = _delete_subscription(publisher, subs, false, false);
+		if (ret === 0) deleted++;
+		else if (ret < 0) kept_hard++;
+		else already_removed++;
 	}
-	if (!deleted) {
+	if (kept_hard) log_warning(`${gobj_short_name(publisher)}: Hard subscription not removed, only gobj_unsubscribe_list() with force removes it (event: ${event}, hard: ${kept_hard})`);
+	else if (!deleted && !already_removed) {
 		log_warning(`${gobj_short_name(publisher)}: No subscription found`);
-		trace_json(kw, "No subscription found");
+		trace_json_masked(kw, "No subscription found");
 	}
 	return 0;
 }
@@ -2849,10 +2950,12 @@ function gobj_unsubscribe_event(publisher, event, kw, subscriber) {
 ***************************************************************************/
 function gobj_unsubscribe_list(gobj, dl_subs, force) {
 	let dl = [...dl_subs];
+	let already_removed = 0;
 	for (let i = 0; i < dl.length; i++) {
 		let subs = dl[i];
-		_delete_subscription(gobj, subs, force, false);
+		if (_delete_subscription(gobj, subs, force, false) > 0) already_removed++;
 	}
+	if (already_removed) log_warning(`${gobj_short_name(gobj)}: Subscription(s) already removed, nothing to remove (count: ${already_removed})`);
 	return 0;
 }
 /***************************************************************************
@@ -2864,7 +2967,7 @@ function gobj_unsubscribe_list(gobj, dl_subs, force) {
 ***************************************************************************/
 function gobj_find_subscriptions(publisher, event, kw, subscriber) {
 	if (kw == null) kw = {};
-	return _find_subscriptions(publisher.dl_subscriptions, publisher, event, kw, subscriber);
+	return _find_subscriptions(publisher.dl_subscriptions, publisher, event, null, kw, subscriber);
 }
 /***************************************************************************
 *
@@ -2903,7 +3006,7 @@ function gobj_list_subscriptions(gobj2view) {
 *      subscriber
 ***************************************************************************/
 function gobj_find_subscribings(subscriber, event, kw, publisher) {
-	return _find_subscriptions(subscriber.dl_subscribings, publisher, event, kw, subscriber);
+	return _find_subscriptions(subscriber.dl_subscribings, publisher, event, null, kw, subscriber);
 }
 /***************************************************************************
 *  Return the sum of returns of gobj_send_event
@@ -2929,7 +3032,7 @@ function gobj_publish_event(publisher, event, kw) {
 	if (tracea) {
 		if (__trace_machine_format__ === 1) trace_machine(sprintf("🔝🔝 %s %s%s %s", event ? event : "", !publisher.running ? "!!" : "", gobj_short_name(publisher), publisher.current_state.state_name));
 		else trace_machine(sprintf("🔝🔝 mach(%s%s^%s), st: %s, ev: %s%s%s", !publisher.running ? "!!" : "", gobj_gclass_name(publisher), gobj_name(publisher), publisher.current_state.state_name, "", event ? event : "", ""));
-		if (__trace_gobj_ev_kw__(publisher) && json_object_size(kw)) trace_json(kw);
+		if (__trace_gobj_ev_kw__(publisher) && json_object_size(kw)) trace_json_masked(kw);
 	}
 	if (publisher.gclass.gmt.mt_publish_event) {
 		let topublish = publisher.gclass.gmt.mt_publish_event(publisher, event, kw);
@@ -2954,6 +3057,8 @@ function gobj_publish_event(publisher, event, kw) {
 			let __global__ = kw_get_dict(publisher, subs, "__global__", null, 0);
 			let __local__ = kw_get_dict(publisher, subs, "__local__", null, 0);
 			let __filter__ = kw_get_dict_value(publisher, subs, "__filter__", null, 0);
+			let event_name = subs.renamed_event;
+			if (empty_string(event_name)) event_name = event;
 			let topublish = 1;
 			if (publisher.gclass.gmt.mt_publication_filter) topublish = publisher.gclass.gmt.mt_publication_filter(publisher, event, kw, subscriber);
 			else if (json_size(__filter__) > 0) {
@@ -2977,11 +3082,11 @@ function gobj_publish_event(publisher, event, kw) {
 			if (__config__) {}
 			if (json_size(__global__) > 0) json_object_update(kw2publish, json_deep_copy(__global__));
 			if (tracea) {
-				if (__trace_machine_format__ === 1) trace_machine(sprintf("🔝🔄 %s (%s) %s%s", event ? event : "", event ? event : "", !subscriber.running ? "!!" : "", gobj_short_name(subscriber)));
-				else trace_machine(sprintf("🔝🔄 mach(%s%s), st: %s, ev: %s, from(%s%s)", !subscriber.running ? "!!" : "", gobj_short_name(subscriber), gobj_current_state(subscriber), event ? event : "", publisher && !publisher.running ? "!!" : "", gobj_short_name(publisher)));
-				if (__trace_gobj_ev_kw__(publisher) && json_object_size(kw2publish)) trace_json(kw2publish);
+				if (__trace_machine_format__ === 1) trace_machine(sprintf("🔝🔄 %s (%s) %s%s", event ? event : "", event_name ? event_name : "", !subscriber.running ? "!!" : "", gobj_short_name(subscriber)));
+				else trace_machine(sprintf("🔝🔄 mach(%s%s), st: %s, ev: %s (%s), from(%s%s)", !subscriber.running ? "!!" : "", gobj_short_name(subscriber), gobj_current_state(subscriber), event ? event : "", event_name ? event_name : "", publisher && !publisher.running ? "!!" : "", gobj_short_name(publisher)));
+				if (__trace_gobj_ev_kw__(publisher) && json_object_size(kw2publish)) trace_json_masked(kw2publish);
 			}
-			let ret_ = gobj_send_event(subscriber, event, kw2publish, publisher);
+			let ret_ = gobj_send_event(subscriber, event_name, kw2publish, publisher);
 			if (ret_ < 0 && subs_flag & subs_flag_t.__own_event__) {
 				sent_count = -1;
 				break;
@@ -3005,8 +3110,9 @@ function gobj_command(gobj, command, kw, src) {
 		return -1;
 	}
 	if (is_commands_tracing(gobj) || is_machine_tracing(gobj, null) && !is_machine_not_tracing(src, null)) {
-		trace_machine(sprintf("🌀🌀 mach(%s%s), cmd: %s, src: %s", !gobj_is_running(gobj) ? "!!" : "", gobj_short_name(gobj), command, gobj_short_name(src)));
-		if (__trace_gobj_ev_kw__(gobj)) trace_json(kw);
+		let command_shown = mask_secrets_inline(command);
+		trace_machine(sprintf("🌀🌀 mach(%s%s), cmd: %s, src: %s", !gobj_is_running(gobj) ? "!!" : "", gobj_short_name(gobj), command_shown !== null ? command_shown : command, gobj_short_name(src)));
+		if (__trace_gobj_ev_kw__(gobj)) trace_json_masked(kw);
 	}
 	if (gobj.gclass.gmt.mt_command_parser) return gobj.gclass.gmt.mt_command_parser(gobj, command, kw, src);
 	if (gobj.gclass.command_table) {
@@ -3222,6 +3328,268 @@ function trace_json(jn, msg) {
 	emit_log_callback("json", jn, current_timestamp());
 }
 /************************************************************
+*  The names of the secrets (is_secret_name()). The same lists
+*  as the C kernel's helpers.c: a name that holds one of these
+*  (any case) is a secret.
+************************************************************/
+var SECRET_NAME_PARTS = [
+	"passw",
+	"pwd",
+	"passphrase",
+	"secret",
+	"token",
+	"jwt",
+	"bearer",
+	"authorization",
+	"cookie",
+	"credential",
+	"salt"
+];
+var SECRET_NAME_JOINED = [
+	"apikey",
+	"sessionid",
+	"sessionkey",
+	"authdata"
+];
+var NOT_SECRET_SEGMENTS = /* @__PURE__ */ new Set([
+	"endpoint",
+	"url",
+	"uri",
+	"domain",
+	"path",
+	"file",
+	"public",
+	"pub",
+	"count",
+	"counts",
+	"type",
+	"name",
+	"len",
+	"length",
+	"size",
+	"max",
+	"min",
+	"ttl",
+	"timeout",
+	"expiry",
+	"expires",
+	"mode"
+]);
+/************************************************************
+*  TRUE if `name` is the name of a secret: a password, a token,
+*  a key... Any case. As the C kernel's is_secret_name().
+************************************************************/
+function is_secret_name(name) {
+	if (typeof name !== "string" || name.length < 3) return false;
+	let lower = name.toLowerCase();
+	let hit = false;
+	for (const part of SECRET_NAME_PARTS) if (lower.indexOf(part) >= 0) {
+		hit = true;
+		break;
+	}
+	if (!hit) {
+		let joined = lower.replace(/[_\-. \t]/g, "");
+		for (const part of SECRET_NAME_JOINED) if (joined.indexOf(part) >= 0) {
+			hit = true;
+			break;
+		}
+	}
+	if (!hit) hit = lower.indexOf("priv") >= 0 && lower.indexOf("key") >= 0;
+	if (!hit) return false;
+	for (const segment of lower.split(/[_\-. \t]/)) if (NOT_SECRET_SEGMENTS.has(segment)) return false;
+	return true;
+}
+/************************************************************
+*  Where an unquoted secret value that begins at `p` ends: at
+*  the end, at the quote that closes an outer quoted value, or
+*  before the next "word=" -- a plain word after a blank is still
+*  part of it ("password=correct horse battery", "password=
+*  hunter2"). As the C kernel's inline_secret_value_end().
+************************************************************/
+function inline_secret_value_end(str, p, outer) {
+	const blank = (c) => c === " " || c === "	";
+	const closes_outer = (i) => outer && str[i] === outer && (i + 1 >= str.length || blank(str[i + 1]));
+	let end = p;
+	while (true) {
+		while (end < str.length && !blank(str[end])) {
+			if (closes_outer(end)) return end;
+			end++;
+		}
+		if (end >= str.length) return end;
+		let w = end;
+		while (w < str.length && blank(str[w])) w++;
+		if (w >= str.length || closes_outer(w)) return end;
+		for (let e = w; e < str.length && !blank(str[e]) && !closes_outer(e); e++) if (str[e] === "=" && e > w) return end;
+		end = w;
+	}
+}
+/************************************************************
+*  A text (a command line) with the value of every "name=value"
+*  whose name is a secret's written as "********", quoted or not
+*  (and the "value" of a write-attr whose attribute names a
+*  secret). The rest as it is. Return null when there was nothing
+*  to mask. As the C kernel's mask_secrets_inline().
+************************************************************/
+var MASK_MAX_NAME = 128;
+var MASK_MAX_BYTES = 4194304;
+var MASK_TOO_LARGE = "<not shown: too large to mask>";
+function mask_secrets_inline(str) {
+	if (typeof str !== "string" || str.indexOf("=") < 0) return null;
+	if (str.length > MASK_MAX_BYTES) return MASK_TOO_LARGE;
+	let value_is_secret = false;
+	let re_attr = /(^|[ \t])attribute=["']?([^ \t"']*)/g;
+	let m;
+	while ((m = re_attr.exec(str)) !== null) if (is_secret_name(m[2].slice(-128))) value_is_secret = true;
+	let parts = [];
+	let copied = 0;
+	let changed = false;
+	let outer = "";
+	let word = 0;
+	let p = 0;
+	const is_blank_or_end = (i) => i >= str.length || str[i] === " " || str[i] === "	";
+	while (p < str.length) {
+		let c = str[p];
+		if (c === " " || c === "	") {
+			p++;
+			word = p;
+			continue;
+		}
+		if (c === "\"" || c === "'") {
+			if (!outer && (p === 0 || str[p - 1] === " " || str[p - 1] === "	" || str[p - 1] === "=")) outer = c;
+			else if (c === outer && is_blank_or_end(p + 1)) outer = "";
+		}
+		if (c !== "=") {
+			p++;
+			continue;
+		}
+		let name = str.substring(Math.max(word, p - MASK_MAX_NAME), p);
+		word = p + 1;
+		if (!(is_secret_name(name) || value_is_secret && name.toLowerCase() === "value")) {
+			p++;
+			continue;
+		}
+		p++;
+		let quote = str[p] === "\"" || str[p] === "'" ? str[p] : "";
+		let end;
+		if (quote) {
+			end = p + 1;
+			while (end < str.length && str[end] !== quote) end++;
+			if (str[end] === quote) end++;
+		} else end = inline_secret_value_end(str, p, outer);
+		if (end > p) {
+			parts.push(str.substring(copied, p));
+			parts.push("********");
+			copied = end;
+			changed = true;
+		}
+		p = end;
+		word = p;
+	}
+	if (!changed) return null;
+	parts.push(str.substring(copied));
+	return parts.join("");
+}
+/************************************************************
+*  A json as a log or a trace may show it: at any depth, the
+*  value of a key with a secret's name is "********", whatever
+*  its type (not an absent one, a null or an empty string); so is
+*  the "value" of a dict whose "attribute" names a secret; and a
+*  string is masked as mask_secrets_inline(). Return a masked
+*  copy, or `jn` itself when there was nothing to mask. As the C
+*  kernel's json_mask_secrets().
+*
+*  Only JSON is walked: plain objects (their prototype is
+*  Object.prototype or null) and arrays. Anything else -- a gobj,
+*  a DOM node, a class instance, a typed array, a function -- is
+*  passed as it is, never walked, as trace_json() always showed it
+*  (a kw may carry a gobj: its parent and children make a cycle).
+*  A plain object met twice is masked once, the same everywhere; a
+*  cycle back to one is "<cycle>"; below MASK_MAX_DEPTH levels
+*  (64, as in C) nothing is shown.
+*  It never throws: a failure is the placeholder below.
+************************************************************/
+var MASK_MAX_DEPTH = 64;
+var MASK_FAILED = "<not shown: the masking failed>";
+function is_plain_object(value) {
+	if (value === null || typeof value !== "object") return false;
+	let proto = Object.getPrototypeOf(value);
+	return proto === Object.prototype || proto === null;
+}
+var MASK_IN_PROGRESS = Symbol("mask-in-progress");
+function _json_mask_secrets(jn, memo, depth, budget) {
+	if (typeof jn === "string") {
+		if (jn.length > budget.left) {
+			budget.left = 0;
+			return MASK_TOO_LARGE;
+		}
+		budget.left -= jn.length;
+		let masked = mask_secrets_inline(jn);
+		return masked !== null ? masked : jn;
+	}
+	let is_array = Array.isArray(jn);
+	if (!is_array && !is_plain_object(jn)) return jn;
+	if (budget.left <= 0) return MASK_TOO_LARGE;
+	if (memo.has(jn)) {
+		let seen = memo.get(jn);
+		return seen === MASK_IN_PROGRESS ? "<cycle>" : seen;
+	}
+	if (depth >= MASK_MAX_DEPTH) return "<deeper not shown>";
+	budget.left -= 1;
+	memo.set(jn, MASK_IN_PROGRESS);
+	let changed = false;
+	let truncated = false;
+	let result;
+	if (is_array) {
+		result = [];
+		for (let i = 0; i < jn.length; i++) {
+			if (budget.left <= 0) {
+				truncated = true;
+				break;
+			}
+			budget.left -= 1;
+			let shown = _json_mask_secrets(jn[i], memo, depth + 1, budget);
+			if (shown !== jn[i]) changed = true;
+			result.push(shown);
+		}
+		if (truncated) result.push(MASK_TOO_LARGE);
+	} else {
+		result = Object.create(Object.getPrototypeOf(jn));
+		let value_is_secret = typeof jn.attribute === "string" && is_secret_name(jn.attribute.slice(-128));
+		for (const key in jn) {
+			if (!Object.prototype.hasOwnProperty.call(jn, key)) continue;
+			if (budget.left <= 0) {
+				truncated = true;
+				break;
+			}
+			budget.left -= 1 + key.length;
+			let value = jn[key];
+			let shown;
+			if ((is_secret_name(key.slice(-128)) || value_is_secret && key === "value") && value !== void 0 && value !== null && value !== "") shown = "********";
+			else shown = _json_mask_secrets(value, memo, depth + 1, budget);
+			if (shown !== value) changed = true;
+			result[key] = shown;
+		}
+		if (truncated) result["<more>"] = MASK_TOO_LARGE;
+	}
+	if (!changed && !truncated) result = jn;
+	memo.set(jn, result);
+	return result;
+}
+function json_mask_secrets(jn) {
+	try {
+		return _json_mask_secrets(jn, /* @__PURE__ */ new WeakMap(), 0, { left: MASK_MAX_BYTES });
+	} catch (e) {
+		return MASK_FAILED;
+	}
+}
+/************************************************************
+*  trace_json() of a json that can hold a credential: what
+*  json_mask_secrets() masks is shown masked
+************************************************************/
+function trace_json_masked(jn, msg) {
+	trace_json(json_mask_secrets(jn), msg);
+}
+/************************************************************
 *  Duplicate an object (new references)
 *  using the modern structuredClone (Deep copy of a single object)
 ************************************************************/
@@ -3523,8 +3891,8 @@ function strstr(haystack, needle, bool) {
 ***************************************************************************/
 function is_metadata_key(key) {
 	if (!is_string(key)) return false;
-	let i;
-	for (i = 0; i < key.length; i++) {
+	let i = 0;
+	for (; i < key.length; i++) {
 		if (key[i] !== "_") break;
 		if (i > 2) break;
 	}
@@ -3535,8 +3903,8 @@ function is_metadata_key(key) {
 ***************************************************************************/
 function is_private_key(key) {
 	if (!is_string(key)) return false;
-	let i;
-	for (i = 0; i < key.length; i++) {
+	let i = 0;
+	for (; i < key.length; i++) {
 		if (key[i] !== "_") break;
 		if (i > 2) break;
 	}
@@ -3647,7 +4015,7 @@ function kw_get_bool(gobj, kw, path, default_value, flag) {
 			return v;
 		} else if (required) {
 			log_error(`path not found: '${path}'`);
-			trace_json(kw);
+			trace_json_masked(kw);
 		}
 		return Boolean(default_value);
 	}
@@ -3661,11 +4029,11 @@ function kw_get_bool(gobj, kw, path, default_value, flag) {
 	} else if (wild && b === null) value = false;
 	else if (wild) {
 		log_error(`${gobj ? gobj_short_name(gobj) + ": " : ""}path MUST BE a simple json element: '${path}'`);
-		trace_json(kw);
+		trace_json_masked(kw);
 		return false;
 	} else {
 		log_error(`${gobj ? gobj_short_name(gobj) + ": " : ""}path MUST BE a json boolean: '${path}'`);
-		trace_json(kw);
+		trace_json_masked(kw);
 		return Boolean(default_value);
 	}
 	if (extract) kw_delete(gobj, kw, path);
@@ -3715,7 +4083,7 @@ function kw_get_int(gobj, kw, path, default_value, flag) {
 			return v;
 		} else if (required) {
 			log_error(`path not found: '${path}'`);
-			trace_json(kw);
+			trace_json_masked(kw);
 		}
 		return parseInt(default_value);
 	}
@@ -3723,14 +4091,14 @@ function kw_get_int(gobj, kw, path, default_value, flag) {
 	if (is_number(v)) value = Math.trunc(v);
 	else if (!wild) {
 		log_error(`${gobj ? gobj_short_name(gobj) + ": " : ""}path MUST BE a json integer: '${path}'`);
-		trace_json(kw);
+		trace_json_masked(kw);
 		return parseInt(default_value);
 	} else if (is_boolean(v)) value = v ? 1 : 0;
 	else if (is_string(v)) value = strtoll_base0(v);
 	else if (v === null) value = 0;
 	else {
 		log_error(`${gobj ? gobj_short_name(gobj) + ": " : ""}path MUST BE a simple json element: '${path}'`);
-		trace_json(kw);
+		trace_json_masked(kw);
 		return 0;
 	}
 	if (extract) kw_delete(gobj, kw, path);
@@ -3762,7 +4130,7 @@ function kw_get_real(gobj, kw, path, default_value, flag) {
 			return v;
 		} else if (required) {
 			log_error(`path not found: '${path}'`);
-			trace_json(kw);
+			trace_json_masked(kw);
 		}
 		return Number(default_value);
 	}
@@ -3770,7 +4138,7 @@ function kw_get_real(gobj, kw, path, default_value, flag) {
 	if (is_number(v)) value = v;
 	else if (!wild) {
 		log_error(`${gobj ? gobj_short_name(gobj) + ": " : ""}path MUST BE a json real: '${path}'`);
-		trace_json(kw);
+		trace_json_masked(kw);
 		return Number(default_value);
 	} else if (is_boolean(v)) value = v ? 1 : 0;
 	else if (is_string(v)) {
@@ -3779,7 +4147,7 @@ function kw_get_real(gobj, kw, path, default_value, flag) {
 	} else if (v === null) value = 0;
 	else {
 		log_error(`${gobj ? gobj_short_name(gobj) + ": " : ""}path MUST BE a simple json element: '${path}'`);
-		trace_json(kw);
+		trace_json_masked(kw);
 		return 0;
 	}
 	if (extract) kw_delete(gobj, kw, path);
@@ -3831,14 +4199,14 @@ function kw_get_str(gobj, kw, path, default_value, flag) {
 			return default_value;
 		} else if (required && !kw_path_holds_key(kw, path)) {
 			log_error(`path not found: '${path}'`);
-			trace_json(kw);
+			trace_json_masked(kw);
 		}
 		return default_value;
 	}
 	if (!is_string(v)) {
 		if (v !== null) {
 			log_error(`${gobj ? gobj_short_name(gobj) + ": " : ""}path MUST BE a json str: '${path}'`);
-			trace_json(kw);
+			trace_json_masked(kw);
 		}
 		return default_value;
 	}
@@ -3861,7 +4229,7 @@ function kw_get_pointer(gobj, kw, path, default_value, flag) {
 			return v;
 		} else if (required) {
 			log_error(`path not found: '${path}'`);
-			trace_json(kw);
+			trace_json_masked(kw);
 		}
 		return default_value;
 	}
@@ -3888,14 +4256,14 @@ function kw_get_dict(gobj, kw, path, default_value, flag) {
 		}
 		if (required) {
 			log_error(`path not found: '${path}'`);
-			trace_json(kw);
+			trace_json_masked(kw);
 		}
 		return default_value;
 	}
 	if (!is_object(v)) {
 		if (required) {
 			log_error(`${gobj ? gobj_short_name(gobj) + ": " : ""}path MUST BE a json dict: '${path}'`);
-			trace_json(kw);
+			trace_json_masked(kw);
 		}
 		return default_value;
 	}
@@ -3918,7 +4286,7 @@ function kw_get_dict_value(gobj, kw, path, default_value, flag) {
 			return v;
 		} else if (required) {
 			log_error(`path not found: '${path}'`);
-			trace_json(kw);
+			trace_json_masked(kw);
 		}
 		return default_value;
 	}
@@ -3946,14 +4314,14 @@ function kw_get_list(gobj, kw, path, default_value, flag) {
 		}
 		if (required) {
 			log_error(`path not found: '${path}'`);
-			trace_json(kw);
+			trace_json_masked(kw);
 		}
 		return default_value;
 	}
 	if (!is_array(v)) {
 		if (required) {
 			log_error(`${gobj ? gobj_short_name(gobj) + ": " : ""}path MUST BE a json list: '${path}'`);
-			trace_json(kw);
+			trace_json_masked(kw);
 		}
 		return default_value;
 	}
@@ -6815,7 +7183,7 @@ function trace_inter_event(gobj, prefix, iev) {
 	let hora = current_timestamp();
 	try {
 		log_debug("\n" + hora + " " + prefix + "\n");
-		trace_json(iev);
+		trace_json_masked(iev);
 	} catch (e) {
 		log_debug("ERROR in trace_inter_event: " + e);
 	}
@@ -7497,6 +7865,7 @@ exports.is_number = is_number;
 exports.is_object = is_object;
 exports.is_private_key = is_private_key;
 exports.is_pure_number = is_pure_number;
+exports.is_secret_name = is_secret_name;
 exports.is_string = is_string;
 exports.jdb_delete = jdb_delete;
 exports.jdb_get = jdb_get;
@@ -7512,6 +7881,7 @@ exports.json_array_remove = json_array_remove;
 exports.json_array_size = json_array_size;
 exports.json_deep_copy = json_deep_copy;
 exports.json_is_identical = json_is_identical;
+exports.json_mask_secrets = json_mask_secrets;
 exports.json_object_del = json_object_del;
 exports.json_object_get = json_object_get;
 exports.json_object_set = json_object_set;
@@ -7559,6 +7929,7 @@ exports.log_debug = log_debug;
 exports.log_error = log_error;
 exports.log_info = log_info;
 exports.log_warning = log_warning;
+exports.mask_secrets_inline = mask_secrets_inline;
 exports.msg_iev_get_msg_type = msg_iev_get_msg_type;
 exports.msg_iev_get_stack = msg_iev_get_stack;
 exports.msg_iev_push_stack = msg_iev_push_stack;
@@ -7592,6 +7963,7 @@ exports.strstr = strstr;
 exports.template_get_field_desc = template_get_field_desc;
 exports.timeTracker = timeTracker;
 exports.trace_json = trace_json;
+exports.trace_json_masked = trace_json_masked;
 exports.trace_level_t = trace_level_t;
 exports.trace_msg = trace_msg;
 exports.treedb_decoder_fkey = treedb_decoder_fkey;