@yuneta/gobj-js 7.26.25 → 7.26.27

package/dist/gobj-js.es.js

@@ -978,11 +978,14 @@ function value_has_shape(type, value) {
 	if (DTP_IS_NUMBER(type)) return typeof value === "number" || typeof value === "boolean";
 	return true;
 }
+function is_int64_number(value) {
+	return value >= -0x8000000000000000 && value < 0x8000000000000000;
+}
 function shape_of_value(value) {
 	if (is_array(value)) return "an array";
 	if (is_object(value)) return "an object";
 	if (is_string(value)) return REFUSED_TEXT;
-	if (typeof value === "number") return Number.isInteger(value) && Math.abs(value) <= 0x8000000000000000 ? "an integer" : "a real";
+	if (typeof value === "number") return Number.isInteger(value) && is_int64_number(value) ? "an integer" : "a real";
 	if (typeof value === "boolean") return "a boolean";
 	return "null";
 }
@@ -1003,7 +1006,7 @@ function number_as_type(type, value) {
 		value: value ? 1 : 0,
 		refused: null
 	};
-	if (!(value >= -0x8000000000000000 && value <= 0x8000000000000000)) return {
+	if (!is_int64_number(value)) return {
 		value: void 0,
 		refused: "a number out of its range"
 	};
@@ -1068,8 +1071,13 @@ function text2parameter(type, s, from_kw) {
 			value: n !== 0n,
 			refused: null
 		};
+		const v = Number(n);
+		if (!is_int64_number(v)) return {
+			value: void 0,
+			refused: "a number out of its range"
+		};
 		return {
-			value: Number(n),
+			value: v,
 			refused: null
 		};
 	}
@@ -1128,6 +1136,16 @@ function command_parameter_from_text(type, text) {
 *  undefined, or an empty text given to a number).
 ***************************************************************************/
 function command_parameter_from_json(type, value) {
+	try {
+		return parameter_from_json(type, value);
+	} catch (e) {
+		return {
+			value: void 0,
+			refused: NO_JSON_TEXT
+		};
+	}
+}
+function parameter_from_json(type, value) {
 	if (value === void 0 || value === null) {
 		if (DTP_IS_JSON(type) && value === null) return {
 			value: null,
@@ -1186,31 +1204,63 @@ var TYPES_READ = [
 	data_type_t.DTP_LIST,
 	data_type_t.DTP_DICT
 ];
-var LEAVE_NODE = Symbol("leave");
-function is_json_value(value) {
-	const on_path = /* @__PURE__ */ new Set();
-	const stack = [value];
-	while (stack.length) {
-		const v = stack.pop();
-		if (v === LEAVE_NODE) {
-			on_path.delete(stack.pop());
-			continue;
+function is_plain_object$1(v) {
+	const proto = Object.getPrototypeOf(v);
+	if (proto === Object.prototype || proto === null) return true;
+	if (Object.getPrototypeOf(proto) !== null || !Object.prototype.hasOwnProperty.call(proto, "constructor")) return false;
+	const ctor = proto.constructor;
+	return typeof ctor === "function" && ctor.name === "Object";
+}
+function json_scalar_or_container(v) {
+	switch (typeof v) {
+		case "string":
+		case "boolean": return true;
+		case "number": return Number.isFinite(v);
+		case "object": return v === null ? true : null;
+		default: return false;
+	}
+}
+function is_json_node(value) {
+	const top = json_scalar_or_container(value);
+	if (top !== null) return top;
+	const values = [value];
+	const levels = [1];
+	while (values.length) {
+		const v = values.pop();
+		const level = levels.pop() + 1;
+		let children;
+		if (Array.isArray(v)) {
+			if (typeof v.toJSON === "function") return false;
+			children = v;
+		} else {
+			if (!is_plain_object$1(v) || typeof v.toJSON === "function") return false;
+			children = [];
+			for (const key of Object.keys(v)) {
+				const x = v[key];
+				if (x === void 0 || typeof x === "function" || typeof x === "symbol") continue;
+				children.push(x);
+			}
 		}
-		if (typeof v === "bigint") return false;
-		if (v === null || typeof v !== "object") continue;
-		if (on_path.has(v)) return false;
-		const array = Array.isArray(v);
-		if (!array) {
-			const proto = Object.getPrototypeOf(v);
-			if (proto !== Object.prototype && proto !== null) return false;
+		if (children.length > 0 && level > JSON_MAX_DEPTH) return false;
+		for (let i = 0; i < children.length; i++) {
+			const x = children[i];
+			const r = json_scalar_or_container(x);
+			if (r === false) return false;
+			if (r === null) {
+				values.push(x);
+				levels.push(level);
+			}
 		}
-		on_path.add(v);
-		stack.push(v, LEAVE_NODE);
-		if (array) for (let i = 0; i < v.length; i++) stack.push(v[i]);
-		else for (const key of Object.keys(v)) stack.push(v[key]);
 	}
 	return true;
 }
+function is_json_value(value) {
+	try {
+		return is_json_node(value);
+	} catch (e) {
+		return false;
+	}
+}
 var NO_JSON_TEXT = "a value with no json text";
 function json_text_of(value) {
 	if (!is_json_value(value)) return;
@@ -2341,11 +2391,13 @@ function rc_walk_by_list(iter_, walk_type, cb_walking, user_data, user_data2) {
 	let child;
 	if (walk_type & walk_type_t.WALK_LAST2FIRST) for (let i = iter.length; i > 0; i--) {
 		child = iter[i - 1];
+		if (gobj_is_destroying(child)) continue;
 		let ret = walk_ret(cb_walking(child, user_data, user_data2));
 		if (ret < 0) return ret;
 	}
 	else for (let i = 0; i < iter.length; i++) {
 		child = iter[i];
+		if (gobj_is_destroying(child)) continue;
 		let ret = walk_ret(cb_walking(child, user_data, user_data2));
 		if (ret < 0) return ret;
 	}
@@ -2360,18 +2412,21 @@ function rc_walk_by_list(iter_, walk_type, cb_walking, user_data, user_data2) {
 *          or
 *          WALK_LAST2FIRST
 ***************************************************************/
-function rc_walk_by_level(iter, walk_type, cb_walking, user_data, user_data2) {
+function rc_walk_by_level(iter_, walk_type, cb_walking, user_data, user_data2) {
+	let iter = [...iter_];
 	let ret = rc_walk_by_list(iter, walk_type, cb_walking, user_data, user_data2);
 	if (ret < 0) return ret;
 	let child;
 	if (walk_type & walk_type_t.WALK_LAST2FIRST) for (let i = iter.length; i > 0; i--) {
 		child = iter[i - 1];
-		ret = rc_walk_by_level([...child.dl_children], walk_type, cb_walking, user_data, user_data2);
+		if (gobj_is_destroying(child)) continue;
+		ret = rc_walk_by_level(child.dl_children, walk_type, cb_walking, user_data, user_data2);
 		if (ret < 0) return ret;
 	}
 	else for (let i = 0; i < iter.length; i++) {
 		child = iter[i];
-		ret = rc_walk_by_level([...child.dl_children], walk_type, cb_walking, user_data, user_data2);
+		if (gobj_is_destroying(child)) continue;
+		ret = rc_walk_by_level(child.dl_children, walk_type, cb_walking, user_data, user_data2);
 		if (ret < 0) return ret;
 	}
 	return ret;
@@ -2391,23 +2446,27 @@ function rc_walk_by_level(iter, walk_type, cb_walking, user_data, user_data2) {
 *          or
 *          WALK_LAST2FIRST
 ***************************************************************/
-function rc_walk_by_tree(iter, walk_type, cb_walking, user_data, user_data2) {
-	if (walk_type & walk_type_t.WALK_BYLEVEL) return rc_walk_by_level(iter, walk_type, cb_walking, user_data, user_data2);
+function rc_walk_by_tree(iter_, walk_type, cb_walking, user_data, user_data2) {
+	if (walk_type & walk_type_t.WALK_BYLEVEL) return rc_walk_by_level(iter_, walk_type, cb_walking, user_data, user_data2);
+	let iter = [...iter_];
 	let ret;
 	let child;
 	if (walk_type & walk_type_t.WALK_BOTTOM2TOP) for (let i = iter.length; i > 0; i--) {
 		child = iter[i - 1];
-		ret = rc_walk_by_tree([...child.dl_children], walk_type, cb_walking, user_data, user_data2);
+		if (gobj_is_destroying(child)) continue;
+		ret = rc_walk_by_tree(child.dl_children, walk_type, cb_walking, user_data, user_data2);
 		if (ret < 0) return ret;
+		if (gobj_is_destroying(child)) continue;
 		ret = walk_ret(cb_walking(child, user_data, user_data2));
 		if (ret < 0) return ret;
 	}
 	else for (let i = 0; i < iter.length; i++) {
 		child = iter[i];
+		if (gobj_is_destroying(child)) continue;
 		ret = walk_ret(cb_walking(child, user_data, user_data2));
 		if (ret < 0) return ret;
-		else if (ret === 0) {
-			ret = rc_walk_by_tree([...child.dl_children], walk_type, cb_walking, user_data, user_data2);
+		else if (ret === 0 && !gobj_is_destroying(child)) {
+			ret = rc_walk_by_tree(child.dl_children, walk_type, cb_walking, user_data, user_data2);
 			if (ret < 0) return ret;
 		}
 	}
@@ -4724,6 +4783,7 @@ function mark_inline_rules_of_now(str, marks) {
 	mark_labels(str, marks);
 }
 var MASK_MAX_DECODINGS = 2;
+var VIEW_CHUNK = 8192;
 function encoded_ascii_at(str, p) {
 	if (p + 3 > str.length || str.charCodeAt(p) !== 37) return -1;
 	const hi = hex_digit_value(str.charCodeAt(p + 1));
@@ -4734,28 +4794,30 @@ function encoded_ascii_at(str, p) {
 }
 function mark_decoded_view(str, marks, decodings) {
 	if (decodings >= MASK_MAX_DECODINGS) return;
-	const pieces = [];
-	let last = 0;
-	let p = str.indexOf("%");
-	while (p >= 0) {
-		const c = encoded_ascii_at(str, p);
+	let first = str.indexOf("%");
+	while (first >= 0 && encoded_ascii_at(str, first) < 0) first = str.indexOf("%", first + 1);
+	if (first < 0) return;
+	const codes = new Uint16Array(str.length - first);
+	let n = 0;
+	for (let p = first; p < str.length; p++) {
+		const code = str.charCodeAt(p);
+		const c = code === 37 ? encoded_ascii_at(str, p) : -1;
 		if (c >= 0) {
-			pieces.push(str.substring(last, p), String.fromCharCode(c));
-			last = p + 3;
-			p = str.indexOf("%", last);
-		} else p = str.indexOf("%", p + 1);
-	}
-	if (pieces.length === 0) return;
-	pieces.push(str.substring(last));
-	const view = pieces.join("");
+			codes[n++] = c;
+			p += 2;
+		} else codes[n++] = code;
+	}
+	const chunks = [str.substring(0, first)];
+	for (let k = 0; k < n; k += VIEW_CHUNK) chunks.push(String.fromCharCode.apply(null, codes.subarray(k, Math.min(n, k + VIEW_CHUNK))));
+	const view = chunks.join("");
 	const view_marks = new Uint8Array(view.length);
 	mark_inline_rules_of_now(view, view_marks);
 	mark_decoded_view(view, view_marks, decodings + 1);
 	let q = 0;
 	for (let i = 0; i < view.length; i++) {
-		const n = encoded_ascii_at(str, q) >= 0 ? 3 : 1;
-		if (view_marks[i]) mark_range(marks, q, q + n);
-		q += n;
+		const n_from = encoded_ascii_at(str, q) >= 0 ? 3 : 1;
+		if (view_marks[i]) mark_range(marks, q, q + n_from);
+		q += n_from;
 	}
 }
 function mark_inline_secrets(str, marks) {
@@ -5989,21 +6051,88 @@ function kw_clone_by_not_keys(gobj, kw, keys, verbose) {
 	return kw_clone;
 }
 /********************************************
+*  The browser's localStorage, or null when there is none (outside a
+*  browser).
+*
+*  With the site's data blocked (Chrome with cookies blocked, a sandboxed
+*  iframe), READING the window.localStorage property already throws a
+*  SecurityError, not only its getItem(): every app reads its locale at
+*  start, so the app did not start. Such a store is answered as one whose
+*  every call throws that error, so each helper fails as it fails for any
+*  store that refuses it: a read gives the default, a write -1.
+********************************************/
+function local_store() {
+	if (typeof window === "undefined") return null;
+	let store;
+	try {
+		store = window.localStorage;
+	} catch (e) {
+		const refuse = () => {
+			throw e;
+		};
+		return {
+			getItem: refuse,
+			setItem: refuse,
+			removeItem: refuse
+		};
+	}
+	return store || null;
+}
+/********************************************
+*  A failure of the store that would repeat on every read is warned
+*  once per key, until a read of the key goes well again.
+********************************************/
+var local_storage_warned = /* @__PURE__ */ new Set();
+function warn_local_storage_once(key, msg) {
+	if (local_storage_warned.has(key)) return;
+	local_storage_warned.add(key);
+	log_warning(msg);
+}
+/********************************************
 *  Get a local attribute
+*
+*  The json the entry holds, or `default_value` when there is none
+*  (written there too with `create`). A json null is no value, as
+*  json_absent() in C: the default. An entry that is not json (a
+*  corrupt or foreign write) is a WARNING and is REMOVED, so the
+*  next read finds no entry: it used to console.warn on every read,
+*  for ever; a new corrupt entry is a new WARNING. Its text is never
+*  shown (JSON.parse() quotes it in its error, and an entry can hold a
+*  token). A store that cannot be read (blocked) is warned once per
+*  key, and the default is NOT written there. Outside a browser: the
+*  default.
 ********************************************/
 function kw_get_local_storage_value(key, default_value, create = false) {
-	if (typeof window === "undefined" || !window.localStorage) return;
+	const store = local_store();
+	if (!store) return default_value;
+	const where = `kw_get_local_storage_value(): localStorage key "${key}"`;
+	let text;
 	try {
-		let value = window.localStorage.getItem(key);
-		if (value === null) {
-			if (create) kw_set_local_storage_value(key, default_value);
-			return default_value;
-		}
-		return JSON.parse(value);
+		text = store.getItem(key);
 	} catch (e) {
-		window.console.warn(`Error reading localStorage key "${key}":`, e);
+		warn_local_storage_once(key, `${where} cannot be read (storage blocked?): the default is used`);
 		return default_value;
 	}
+	let value = null;
+	if (text !== null) try {
+		value = JSON.parse(text);
+	} catch (e) {
+		value = null;
+		try {
+			store.removeItem(key);
+			log_warning(`${where} does not hold json: removed, the default is used`);
+			local_storage_warned.delete(key);
+		} catch (e2) {
+			warn_local_storage_once(key, `${where} does not hold json and cannot be removed: the default is used`);
+		}
+		text = void 0;
+	}
+	if (text !== void 0) local_storage_warned.delete(key);
+	if (value === null) {
+		if (create) kw_set_local_storage_value(key, default_value);
+		return default_value;
+	}
+	return value;
 }
 /********************************************
 *  Save a local attribute
@@ -6014,15 +6143,26 @@ function kw_get_local_storage_value(key, default_value, create = false) {
 *  reported success on a store that had rejected the write: a full or blocked
 *  localStorage (quota, private mode) silently discarded the change while the
 *  UI showed it as saved.
+*
+*  A value with no json text is refused with an ERROR, as a typed writer
+*  refuses it (json_text_of()): a function was stored as the text
+*  "undefined", and a NaN, a Date or a Map as a text that reads back as
+*  another value. Checked in Node.js too, where there is no store.
 ********************************************/
 function kw_set_local_storage_value(key, value) {
-	if (typeof window === "undefined" || !window.localStorage) return 0;
-	if (!key || value === void 0) {
-		log_error(`kw_set_local_storage_value(): invalid key or value: key=${key}`);
+	if (!key) {
+		log_error(`kw_set_local_storage_value(): invalid key: key=${key}`);
 		return -1;
 	}
+	const text = json_text_of(value);
+	if (text === void 0) {
+		log_error(`kw_set_local_storage_value(): cannot save "${key}": a value with no json text`);
+		return -1;
+	}
+	const store = local_store();
+	if (!store) return 0;
 	try {
-		window.localStorage.setItem(key, JSON.stringify(value));
+		store.setItem(key, text);
 		return 0;
 	} catch (e) {
 		log_error(`kw_set_local_storage_value(): cannot save "${key}" (storage full or blocked?): ${e && e.message ? e.message : e}`);
@@ -6033,15 +6173,16 @@ function kw_set_local_storage_value(key, value) {
 *  Remove local attribute
 ********************************************/
 function kw_remove_local_storage_value(key) {
-	if (typeof window === "undefined" || !window.localStorage) return;
+	const store = local_store();
+	if (!store) return;
 	if (!key) {
-		window.console.warn(`Invalid key for localStorage removal: ${key}`);
+		log_error(`kw_remove_local_storage_value(): invalid key: key=${key}`);
 		return;
 	}
 	try {
-		window.localStorage.removeItem(key);
+		store.removeItem(key);
 	} catch (e) {
-		window.console.warn(`Error removing localStorage key "${key}":`, e);
+		log_warning(`kw_remove_local_storage_value(): cannot remove "${key}" (storage blocked?): ${e && e.message ? e.message : e}`);
 	}
 }
 /*************************************************************
@@ -7234,11 +7375,21 @@ function index_in_list(list, elm) {
 ************************************************************/
 function node_uuid() {
 	let uuid = "";
-	if (typeof window !== "undefined" && window.localStorage) {
-		uuid = window.localStorage.getItem("host_uuid");
+	const store = local_store();
+	if (store) {
+		try {
+			uuid = store.getItem("host_uuid");
+		} catch (e) {
+			uuid = null;
+			warn_local_storage_once("host_uuid", "node_uuid(): localStorage cannot be read (storage blocked?): a uuid of this page only");
+		}
 		if (!uuid && window.crypto?.randomUUID) {
 			uuid = window.crypto.randomUUID();
-			window.localStorage.setItem("host_uuid", uuid);
+			try {
+				store.setItem("host_uuid", uuid);
+			} catch (e) {
+				warn_local_storage_once("host_uuid", "node_uuid(): localStorage cannot be written (storage full or blocked?): a uuid of this page only");
+			}
 		}
 	} else if (typeof globalThis !== "undefined" && globalThis.crypto?.randomUUID) uuid = globalThis.crypto.randomUUID();
 	else uuid = "00000000-0000-0000-0000-000000000000";
@@ -8527,7 +8678,7 @@ var attrs_table = [
 	SDATA(data_type_t.DTP_STRING, "cert_pem", sdata_flag_t.SDF_PERSIST, "", "SSL server certification, PEM str format"),
 	SDATA(data_type_t.DTP_JSON, "extra_info", sdata_flag_t.SDF_RD, "{}", "dict data set by user, added to the identity card msg."),
 	SDATA(data_type_t.DTP_LIST, "required_services", sdata_flag_t.SDF_RD, "[]", "Services this LINK requires (identity card). Empty = the yuno's `required_services`, as before. A yuno with several links to DIFFERENT backends must set it per link: the yuno-wide list is the union, so every backend is told the service names of all the others."),
-	SDATA(data_type_t.DTP_INTEGER, "timeout_retry", sdata_flag_t.SDF_RD, "5000", "First reconnect delay (ms). It BACKS OFF from here, doubling up to timeout_retry_max, and resets when a session is reached"),
+	SDATA(data_type_t.DTP_INTEGER, "timeout_retry", sdata_flag_t.SDF_RD, "5000", "First reconnect delay (ms), at least 1000. It BACKS OFF from here, doubling up to timeout_retry_max, and resets when a session is reached"),
 	SDATA(data_type_t.DTP_INTEGER, "timeout_retry_max", sdata_flag_t.SDF_RD, "60000", "Cap of the reconnect backoff (ms). Set it equal to timeout_retry for the old fixed-interval behaviour"),
 	SDATA(data_type_t.DTP_INTEGER, "timeout_idack", sdata_flag_t.SDF_RD, "5000", "timeout waiting idAck"),
 	SDATA(data_type_t.DTP_POINTER, "subscriber", 0, 0, "subscriber of output-events. If null then subscriber is the parent"),
@@ -8551,7 +8702,9 @@ var PRIVATE_DATA = {
 	websocket: null,
 	inside_on_open: false,
 	retry_ms: 0,
-	retry_ms_before_session: 0
+	retry_ms_before_session: 0,
+	session_since: 0,
+	retry_floor_warned: false
 };
 var __gclass__ = null;
 /******************************
@@ -8810,15 +8963,22 @@ function close_websocket(gobj, code = 1e3, reason = "") {
 *  protocol error, throws there), so it is 4002 -- and the server
 *  echoes it, so EV_ON_CLOSE carries it.
 *
-*  And a session the server broke was not a session reached: the
-*  backoff the ack reset is put back, or a server that breaks every
+*  And a session the server broke at once was not a session reached:
+*  the backoff the ack reset is put back, or a server that breaks every
 *  session is reconnected at the first delay for ever, with an
-*  EV_ON_OPEN and an EV_ON_CLOSE in the app per round.
+*  EV_ON_OPEN and an EV_ON_CLOSE in the app per round. A session that
+*  outlived the longest delay of the backoff (`timeout_retry_max`) was
+*  served: its fault starts the backoff over, as a clean end does, or
+*  one foreign message hours later is waited for with a delay escalated
+*  by failures long gone.
 ***************************************************************/
 var CLOSE_PEER_FAULT = 4002;
 function close_for_peer_fault(gobj, reason) {
 	let priv = gobj.priv;
-	if (gobj_current_state(gobj) === "ST_SESSION") priv.retry_ms = priv.retry_ms_before_session;
+	if (gobj_current_state(gobj) === "ST_SESSION") {
+		if (performance.now() - priv.session_since < retry_bounds(gobj).max) priv.retry_ms = priv.retry_ms_before_session;
+		priv.retry_ms_before_session = 0;
+	}
 	close_websocket(gobj, CLOSE_PEER_FAULT, reason);
 }
 /***************************************************************
@@ -9088,6 +9248,32 @@ function ac_on_close(gobj, event, kw, src) {
 	return 0;
 }
 /***************************************************************
+*  The first delay of the backoff and its cap.
+*
+*  A first delay below RETRY_FLOOR_MS is raised to it, with a WARNING
+*  once: `timeout_retry` 0 never left 0 (0 doubled is 0), so a server
+*  that closed before the ack was reconnected in a loop with no wait,
+*  hundreds of connections a second.
+***************************************************************/
+var RETRY_FLOOR_MS = 1e3;
+function retry_bounds(gobj) {
+	let priv = gobj.priv;
+	let base = gobj_read_integer_attr(gobj, "timeout_retry");
+	let max = gobj_read_integer_attr(gobj, "timeout_retry_max");
+	if (!(base >= RETRY_FLOOR_MS)) {
+		if (!priv.retry_floor_warned) {
+			priv.retry_floor_warned = true;
+			log_warning(`${gobj_short_name(gobj)}: timeout_retry ${base} ms is below ${RETRY_FLOOR_MS} ms: ${RETRY_FLOOR_MS} ms is used`);
+		}
+		base = RETRY_FLOOR_MS;
+	}
+	if (!(max >= base)) max = base;
+	return {
+		base,
+		max
+	};
+}
+/***************************************************************
 *  How long to wait before the next reconnect attempt.
 *
 *  The delay used to be a constant (`timeout_retry`, 5s), for ever. A
@@ -9108,9 +9294,7 @@ function ac_on_close(gobj, event, kw, src) {
 ***************************************************************/
 function next_retry(gobj) {
 	let priv = gobj.priv;
-	let base = gobj_read_integer_attr(gobj, "timeout_retry");
-	let max = gobj_read_integer_attr(gobj, "timeout_retry_max");
-	if (max < base) max = base;
+	const { base, max } = retry_bounds(gobj);
 	priv.retry_ms = priv.retry_ms ? Math.min(priv.retry_ms * 2, max) : base;
 	let jitter = priv.retry_ms * .2;
 	let ms = priv.retry_ms - jitter + Math.random() * 2 * jitter;
@@ -9156,6 +9340,7 @@ function ac_identity_card_ack(gobj, event, kw, src) {
 		priv.inside_on_open = true;
 		priv.retry_ms_before_session = priv.retry_ms;
 		priv.retry_ms = 0;
+		priv.session_since = performance.now();
 		if (!priv.inform_on_close) {
 			priv.inform_on_close = true;
 			gobj_publish_event(gobj, "EV_ON_OPEN", {
@@ -9253,16 +9438,30 @@ function ac_on_message(gobj, event, kw, src) {
 	return 0;
 }
 /***************************************************************************
+*  The server asking this client for stats or a command. The C client
+*  serves them (gobj_stats() / gobj_command() of the service named, and
+*  an answer); a browser client does not run what its server asks, so it
+*  is refused: a WARNING naming what was asked, masked (a command line
+*  can carry a secret), and nothing else -- the protocol allows the ask,
+*  so the session goes on. Up to 7.26.25 it was dropped without a trace.
+***************************************************************************/
+function refuse_asked_by_server(gobj, event, kw, key) {
+	const asked = kw && typeof kw[key] === "string" ? kw[key] : "";
+	const service = kw && typeof kw.service === "string" ? kw.service : "";
+	log_warning(`${gobj_short_name(gobj)}: ${event} not served by this client, DROPPED: ${key.replace(/_/g, "")} '${peer_text_shown(asked, PEER_NAME_SHOWN)}', service '${peer_text_shown(service, PEER_NAME_SHOWN)}'`);
+	return -1;
+}
+/***************************************************************************
 *  remote asking for stats
 ***************************************************************************/
 function ac_mt_stats(gobj, event, kw, src) {
-	return 0;
+	return refuse_asked_by_server(gobj, event, kw, "__stats__");
 }
 /***************************************************************************
 *  remote asking for command
 ***************************************************************************/
 function ac_mt_command(gobj, event, kw, src) {
-	return 0;
+	return refuse_asked_by_server(gobj, event, kw, "__command__");
 }
 /***************************
 *          FSM
@@ -9388,6 +9587,6 @@ function register_c_ievent_cli() {
 	return create_gclass(GCLASS_NAME);
 }
 //#endregion
-export { GObj, SDATA, SDATAAUTHZ, SDATACM, SDATACM2, SDATADF, SDATAPM, SDATAPM0, SDATA_END, SDataDesc, YUNETA_VERSION, __yuno__, build_command_response, build_path, build_stats_response, clean_name, clear_timeout, cmp_two_simple_json, command_parameter_from_json, command_parameter_from_text, command_parser, createElement2, createOneHtml, create_json_record, create_template_record, current_timestamp, data_type_t, db_list_persistent_attrs, db_load_persistent_attrs, db_remove_persistent_attrs, db_save_persistent_attrs, debounce, delete_from_list, duplicate_objects, empty_json, empty_string, escapeHtml, event_flag_t, flat2json, flat_apply, flat_diff, flat_key_join, flat_key_split, gclass_add_ev_action, gclass_add_event_type, gclass_add_state, gclass_check_fsm, gclass_create, gclass_event_type, gclass_find_by_name, gclass_flag_t, gclass_unregister, getPositionRelativeToBody, get_function_name, get_now, gobj_bottom_gobj, gobj_change_parent, gobj_change_state, gobj_command, gobj_create, gobj_create2, gobj_create_default_service, gobj_create_pure_child, gobj_create_service, gobj_create_volatil, gobj_create_yuno, gobj_current_state, gobj_default_service, gobj_deliver_posted_events, gobj_destroy, gobj_find_child, gobj_find_event_type, gobj_find_gobj, gobj_find_service, gobj_find_subscribings, gobj_find_subscriptions, gobj_flag_t, gobj_full_name, gobj_gclass_name, gobj_get_gclass_trace_level, gobj_get_gclass_trace_level2, gobj_get_gclass_trace_no_level, gobj_get_global_trace_level, gobj_get_global_trace_no_level, gobj_global_trace_level, gobj_global_trace_no_level, gobj_has_attr, gobj_has_event, gobj_has_output_event, gobj_hsdata, gobj_is_destroying, gobj_is_playing, gobj_is_pure_child, gobj_is_running, gobj_is_service, gobj_is_volatil, gobj_list_persistent_attrs, gobj_list_subscriptions, gobj_load_persistent_attrs, gobj_match_children, gobj_match_children_tree, gobj_match_gobj, gobj_name, gobj_parent, gobj_pause, gobj_play, gobj_post_event, gobj_posted_events_size, gobj_publish_event, gobj_read_attr, gobj_read_attrs, gobj_read_bool_attr, gobj_read_integer_attr, gobj_read_pointer_attr, gobj_read_str_attr, gobj_remove_persistent_attrs, gobj_repr_global_trace_levels, gobj_reset_volatil_attrs, gobj_save_persistent_attrs, gobj_search_path, gobj_send_event, gobj_services, gobj_set_bottom_gobj, gobj_set_deep_trace, gobj_set_gclass_no_trace, gobj_set_gclass_trace, gobj_set_global_no_trace, gobj_set_global_no_trace2, gobj_set_global_trace, gobj_set_global_trace2, gobj_set_gobj_no_trace, gobj_set_gobj_trace, gobj_set_trace_machine_format, gobj_short_name, gobj_start, gobj_start_children, gobj_start_tree, gobj_start_up, gobj_stats, gobj_stop, gobj_stop_children, gobj_stop_tree, gobj_subscribe_event, gobj_trace_level, gobj_trace_machine_format, gobj_trace_no_level, gobj_unsubscribe_event, gobj_unsubscribe_list, gobj_walk_gobj_children, gobj_walk_gobj_children_tree, gobj_write_attr, gobj_write_attrs, gobj_write_bool_attr, gobj_write_integer_attr, gobj_write_str_attr, gobj_yuno, gobj_yuno_id, gobj_yuno_name, gobj_yuno_role, html_markup, id_index_in_obj_list, index_in_list, is_array, is_boolean, is_date, is_function, is_gobj, is_html_markup, is_metadata_key, is_null, is_number, is_object, is_private_key, is_pure_number, is_secret_name, is_string, jdb_delete, jdb_get, jdb_get_by_idx, jdb_get_topic, jdb_init, jdb_update, json2flat, json_array_append, json_array_append_new, json_array_extend, json_array_remove, json_array_size, json_deep_copy, json_is_identical, json_mask_secrets, json_object_del, json_object_get, json_object_set, json_object_set_new, json_object_size, json_object_update, json_object_update_existing, json_object_update_missing, json_size, jwt2json, jwtDecode, kw_clone_by_keys, kw_clone_by_not_keys, kw_collect, kw_delete, kw_find_json_in_list, kw_find_path, kw_flag_t, kw_get_bool, kw_get_dict, kw_get_dict_value, kw_get_int, kw_get_list, kw_get_local_storage_value, kw_get_pointer, kw_get_real, kw_get_str, kw_has_key, kw_match_simple, kw_pop, kw_remove_local_storage_value, kw_select, kw_set_dict_value, kw_set_local_storage_value, kw_set_subdict_value, kwid_collect, kwid_find_one_record, kwid_get_ids, kwid_match_id, kwid_new_dict, kwid_new_list, list2options, load_json_file, log_debug, log_error, log_info, log_warning, mask_secrets_inline, msg_iev_get_msg_type, msg_iev_get_stack, msg_iev_push_stack, msg_iev_read_key, msg_iev_set_msg_type, msg_iev_write_key, node_uuid, parseBoolean, parseSVG, refresh_language, register_c_ievent_cli, register_c_timer, register_c_yuno, safeSrc, sdata_flag_t, send_http_json_post, set_console_log_enabled, set_console_log_filter, set_log_callback, set_remote_log_functions, set_strings_are_text, set_timeout, set_timeout_periodic, sprintf, stats_parser, str_in_list, strcasecmp, strcmp, strings_are_text, strncmp, strs_in_list, strstr, template_get_field_desc, timeTracker, trace_json, trace_json_masked, trace_level_t, trace_msg, treedb_decoder_fkey, treedb_decoder_hook, treedb_encoder_fkey, treedb_get_field_desc, treedb_hook_data_size, vsprintf, walk_type_t };
+export { GObj, SDATA, SDATAAUTHZ, SDATACM, SDATACM2, SDATADF, SDATAPM, SDATAPM0, SDATA_END, SDataDesc, YUNETA_VERSION, __yuno__, build_command_response, build_path, build_stats_response, clean_name, clear_timeout, cmp_two_simple_json, command_parameter_from_json, command_parameter_from_text, command_parser, createElement2, createOneHtml, create_json_record, create_template_record, current_timestamp, data_type_t, db_list_persistent_attrs, db_load_persistent_attrs, db_remove_persistent_attrs, db_save_persistent_attrs, debounce, delete_from_list, duplicate_objects, empty_json, empty_string, escapeHtml, event_flag_t, flat2json, flat_apply, flat_diff, flat_key_join, flat_key_split, gclass_add_ev_action, gclass_add_event_type, gclass_add_state, gclass_check_fsm, gclass_create, gclass_event_type, gclass_find_by_name, gclass_flag_t, gclass_unregister, getPositionRelativeToBody, get_function_name, get_now, gobj_bottom_gobj, gobj_change_parent, gobj_change_state, gobj_command, gobj_create, gobj_create2, gobj_create_default_service, gobj_create_pure_child, gobj_create_service, gobj_create_volatil, gobj_create_yuno, gobj_current_state, gobj_default_service, gobj_deliver_posted_events, gobj_destroy, gobj_find_child, gobj_find_event_type, gobj_find_gobj, gobj_find_service, gobj_find_subscribings, gobj_find_subscriptions, gobj_flag_t, gobj_full_name, gobj_gclass_name, gobj_get_gclass_trace_level, gobj_get_gclass_trace_level2, gobj_get_gclass_trace_no_level, gobj_get_global_trace_level, gobj_get_global_trace_no_level, gobj_global_trace_level, gobj_global_trace_no_level, gobj_has_attr, gobj_has_event, gobj_has_output_event, gobj_hsdata, gobj_is_destroying, gobj_is_playing, gobj_is_pure_child, gobj_is_running, gobj_is_service, gobj_is_volatil, gobj_list_persistent_attrs, gobj_list_subscriptions, gobj_load_persistent_attrs, gobj_match_children, gobj_match_children_tree, gobj_match_gobj, gobj_name, gobj_parent, gobj_pause, gobj_play, gobj_post_event, gobj_posted_events_size, gobj_publish_event, gobj_read_attr, gobj_read_attrs, gobj_read_bool_attr, gobj_read_integer_attr, gobj_read_pointer_attr, gobj_read_str_attr, gobj_remove_persistent_attrs, gobj_repr_global_trace_levels, gobj_reset_volatil_attrs, gobj_save_persistent_attrs, gobj_search_path, gobj_send_event, gobj_services, gobj_set_bottom_gobj, gobj_set_deep_trace, gobj_set_gclass_no_trace, gobj_set_gclass_trace, gobj_set_global_no_trace, gobj_set_global_no_trace2, gobj_set_global_trace, gobj_set_global_trace2, gobj_set_gobj_no_trace, gobj_set_gobj_trace, gobj_set_trace_machine_format, gobj_short_name, gobj_start, gobj_start_children, gobj_start_tree, gobj_start_up, gobj_stats, gobj_stop, gobj_stop_children, gobj_stop_tree, gobj_subscribe_event, gobj_trace_level, gobj_trace_machine_format, gobj_trace_no_level, gobj_unsubscribe_event, gobj_unsubscribe_list, gobj_walk_gobj_children, gobj_walk_gobj_children_tree, gobj_write_attr, gobj_write_attrs, gobj_write_bool_attr, gobj_write_integer_attr, gobj_write_str_attr, gobj_yuno, gobj_yuno_id, gobj_yuno_name, gobj_yuno_role, html_markup, id_index_in_obj_list, index_in_list, is_array, is_boolean, is_date, is_function, is_gobj, is_html_markup, is_metadata_key, is_null, is_number, is_object, is_private_key, is_pure_number, is_secret_name, is_string, jdb_delete, jdb_get, jdb_get_by_idx, jdb_get_topic, jdb_init, jdb_update, json2flat, json_array_append, json_array_append_new, json_array_extend, json_array_remove, json_array_size, json_deep_copy, json_is_identical, json_mask_secrets, json_object_del, json_object_get, json_object_set, json_object_set_new, json_object_size, json_object_update, json_object_update_existing, json_object_update_missing, json_size, json_text_of, jwt2json, jwtDecode, kw_clone_by_keys, kw_clone_by_not_keys, kw_collect, kw_delete, kw_find_json_in_list, kw_find_path, kw_flag_t, kw_get_bool, kw_get_dict, kw_get_dict_value, kw_get_int, kw_get_list, kw_get_local_storage_value, kw_get_pointer, kw_get_real, kw_get_str, kw_has_key, kw_match_simple, kw_pop, kw_remove_local_storage_value, kw_select, kw_set_dict_value, kw_set_local_storage_value, kw_set_subdict_value, kwid_collect, kwid_find_one_record, kwid_get_ids, kwid_match_id, kwid_new_dict, kwid_new_list, list2options, load_json_file, log_debug, log_error, log_info, log_warning, mask_secrets_inline, msg_iev_get_msg_type, msg_iev_get_stack, msg_iev_push_stack, msg_iev_read_key, msg_iev_set_msg_type, msg_iev_write_key, node_uuid, parseBoolean, parseSVG, refresh_language, register_c_ievent_cli, register_c_timer, register_c_yuno, safeSrc, sdata_flag_t, send_http_json_post, set_console_log_enabled, set_console_log_filter, set_log_callback, set_remote_log_functions, set_strings_are_text, set_timeout, set_timeout_periodic, sprintf, stats_parser, str_in_list, strcasecmp, strcmp, strings_are_text, strncmp, strs_in_list, strstr, template_get_field_desc, timeTracker, trace_json, trace_json_masked, trace_level_t, trace_msg, treedb_decoder_fkey, treedb_decoder_hook, treedb_encoder_fkey, treedb_get_field_desc, treedb_hook_data_size, vsprintf, walk_type_t };
 
 //# sourceMappingURL=gobj-js.es.js.map