@webtypen/webframez-core 0.3.75 → 0.3.77

package/README.md

@@ -925,3 +925,16 @@ the text representation; their separate `icon` property controls navigation icon
 ## DataBuilder model forms
 
 DataBuilder supports `@Field()`, parameterized `@Validates()`, server-side `ModelForm` classes and `Route.databuilder()` while retaining the v1 request protocol and legacy controller registrations. See [DataBuilder documentation](docs/databuilder.md).
+
+## Routing and lifecycle performance
+
+Route and domain patterns are compiled at registration and reused while matching.
+`Router.init()` resets their caches; runtime registration and legacy direct route
+stores still work. Exact-route precedence, domain ordering, parameters and wildcards
+retain their existing behavior. Public regex builders still produce fresh regexes.
+
+Lifecycle hooks skip event normalization when no listeners are registered. Use
+`WebframezHooks.hasListeners(eventName)` before constructing an expensive payload.
+Registered handlers retain their ordered, awaited execution and snapshot behavior.
+The router applies this check before building telemetry payloads. Middleware keeps
+its existing `next`/`reject` callback contract.

package/auth-client.js

@@ -28,17 +28,30 @@ exports.createAuthFetch = function createAuthFetch(options = {}, originalFetch =
             || ![401, 403].includes(response.status)) return response;
         const failure = await response.clone().json().catch(() => null);
         if (!["unauthorized", "invalid_csrf"].includes(failure?.code)) return response;
-        if (!refreshing) {
+        const performRefresh = () => {
             const refreshHeaders = new Headers();
             const csrf = csrfCookie(options.cookieName);
             if (csrf) refreshHeaders.set("X-CSRF-Token", csrf);
-            refreshing = originalFetch(`${base}/refresh`, { method: "POST", credentials: "same-origin", headers: refreshHeaders })
-                .then(result => result.ok, () => false).finally(() => { refreshing = undefined; });
+            return originalFetch(`${base}/refresh`, { method: "POST", credentials: "same-origin", headers: refreshHeaders });
+        };
+        const retry = () => {
+            const nextCsrf = csrfCookie(options.cookieName);
+            if (nextCsrf) headers.set("X-CSRF-Token", nextCsrf);
+            return originalFetch(retryInput, { ...init, headers });
+        };
+        if (typeof navigator !== "undefined" && navigator.locks) {
+            // Hold the shared tab lock through the retry so another refresh cannot invalidate it.
+            return navigator.locks.request(`webframez-auth:${base}`, async () => {
+                const renewed = await performRefresh().then(result => result.ok, () => false);
+                return renewed ? retry() : response;
+            });
+        }
+        if (!refreshing) {
+            refreshing = performRefresh().then(result => result.ok, () => false)
+                .finally(() => { refreshing = undefined; });
         }
         if (!await refreshing) return response;
-        const nextCsrf = csrfCookie(options.cookieName);
-        if (nextCsrf) headers.set("X-CSRF-Token", nextCsrf);
-        return originalFetch(retryInput, { ...init, headers });
+        return retry();
     };
 };
 

package/dist/Auth/SessionAuth.d.ts

@@ -65,6 +65,8 @@ export declare class SessionAuth {
     verifyCsrf(token: string, csrf: string, kind?: "access" | "refresh"): Promise<boolean>;
     /** One winner under concurrency. A previously consumed refresh token revokes its device session. */
     refresh(token: string): Promise<SessionTokenPair | null>;
+    /** Trusted server refresh-secret lookup; never expose as a public endpoint. */
+    inspectRefresh(token: string): Promise<AuthSession | null>;
     /** Trusted browser GET resumption: renew access without consuming or replaying refresh rotation. */
     renewAccess(token: string): Promise<SessionTokenPair | null>;
     /** Browser login metadata; arbitrary request data and token hashes are never exposed. */

package/dist/Auth/SessionAuth.js

@@ -144,6 +144,15 @@ class SessionAuth {
             return this.pair(next, access, refresh);
         });
     }
+    /** Trusted server refresh-secret lookup; never expose as a public endpoint. */
+    inspectRefresh(token) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const id = tokenSessionId(token);
+            if (!id)
+                return null;
+            return this.allowed(yield (yield this.rows()).findOne(Object.assign(Object.assign(Object.assign({ _id: this.sessionId(id) }, this.scope), { refreshHash: (0, AuthSecurity_1.hashAuthToken)(token) }), this.liveFilter())));
+        });
+    }
     /** Trusted browser GET resumption: renew access without consuming or replaying refresh rotation. */
     renewAccess(token) {
         return __awaiter(this, void 0, void 0, function* () {
@@ -151,7 +160,7 @@ class SessionAuth {
             if (!id)
                 return null;
             const rows = yield this.rows();
-            const filter = Object.assign(Object.assign(Object.assign({ _id: this.sessionId(id) }, this.scope), { refreshHash: (0, AuthSecurity_1.hashAuthToken)(token) }), this.liveFilter());
+            const filter = Object.assign(Object.assign(Object.assign(Object.assign({ _id: this.sessionId(id) }, this.scope), { refreshHash: (0, AuthSecurity_1.hashAuthToken)(token) }), this.liveFilter()), { accessExpiresAt: { $lte: Date.now() } });
             const row = yield rows.findOne(filter);
             if (!row || !(yield this.allowed(row)))
                 return null;

package/dist/Auth/WebAuth.js

@@ -96,7 +96,7 @@ class WebAuth {
                 return null;
             const pair = yield this.sessions.renewAccess(token);
             if (!pair)
-                return null;
+                return this.sessions.inspectRefresh(token);
             this.writePair(res, pair);
             const name = this.cookies.prefix + "access";
             const cookies = (0, AuthSecurity_1.authHeader)(req, "cookie").split(";").map(value => value.trim()).filter(value => value && !value.startsWith(`${name}=`));

package/dist/Hooks/WebframezHooks.d.ts

@@ -32,6 +32,7 @@ declare class WebframezHooksFacade {
     on<TEventName extends WebframezHookEventName>(eventName: TEventName, handler: WebframezHookHandler<TEventName>): () => this;
     off<TEventName extends WebframezHookEventName>(eventName: TEventName, handler: WebframezHookHandler<TEventName>): this;
     clear(eventName?: WebframezHookEventName): this;
+    hasListeners(eventName: WebframezHookEventName): boolean;
     emit<TEventName extends WebframezHookEventName>(eventName: TEventName, context: Omit<Partial<WebframezOperationContext>, "operation" | "phase"> & {
         operationId: string;
     }): Promise<void>;

package/dist/Hooks/WebframezHooks.js

@@ -56,8 +56,16 @@ class WebframezHooksFacade {
         this.handlers = {};
         return this;
     }
+    hasListeners(eventName) {
+        var _a;
+        return (((_a = this.handlers[eventName]) === null || _a === void 0 ? void 0 : _a.size) || 0) > 0;
+    }
     emit(eventName, context) {
         return __awaiter(this, void 0, void 0, function* () {
+            const handlers = this.handlers[eventName];
+            if (!handlers || handlers.size < 1) {
+                return;
+            }
             const parsed = parseEventName(eventName);
             const attributes = Object.assign({}, (context.attributes || {}));
             if (context.error && attributes["error.type"] === undefined) {
@@ -67,10 +75,6 @@ class WebframezHooksFacade {
                 type: eventName,
                 context: Object.assign(Object.assign({}, context), { operation: parsed.operation, phase: parsed.phase, timestamp: context.timestamp || new Date(), attributes }),
             };
-            const handlers = this.handlers[eventName];
-            if (!handlers || handlers.size < 1) {
-                return;
-            }
             for (const handler of Array.from(handlers)) {
                 try {
                     yield handler(event);

package/dist/Router/Router.d.ts

@@ -65,6 +65,8 @@ declare class RouterFacade {
     routesDELETE: {
         [key: string]: RouteObject[];
     };
+    private routeRegexCache;
+    private domainRegexCache;
     /**
      * Load the application-routes
      */
@@ -103,6 +105,8 @@ declare class RouterFacade {
     extractParams(path: string, match: any): any;
     escapeRegexPart(value: string): string;
     buildRouteRegex(path: string): RegExp;
+    private getRouteRegex;
+    private getDomainRegex;
     normalizeDomainString(value: string): string | null;
     getRequestHostCandidates(request?: Request): string[];
     getRouteDomainFilters(routeObj: RouteObject): string[];

package/dist/Router/Router.js

@@ -69,6 +69,8 @@ class RouterFacade {
          * DELETE Route Store
          */
         this.routesDELETE = {};
+        this.routeRegexCache = new Map();
+        this.domainRegexCache = new Map();
     }
     /**
      * Load the application-routes
@@ -88,6 +90,8 @@ class RouterFacade {
         this.routesPUT = {};
         this.routesPATCH = {};
         this.routesDELETE = {};
+        this.routeRegexCache.clear();
+        this.domainRegexCache.clear();
         // Load routes
         if (options.routesFunction) {
             options.routesFunction();
@@ -139,6 +143,10 @@ class RouterFacade {
         else {
             routeConf.component = component;
         }
+        this.getRouteRegex(path);
+        for (const domain of this.getRouteDomainFilters(routeConf)) {
+            this.getDomainRegex(domain);
+        }
         if (type === "GET") {
             if (!this.routesGET[path]) {
                 this.routesGET[path] = [];
@@ -273,6 +281,22 @@ class RouterFacade {
         const regexString = "^" + escaped.replace(/__WFZ_TOKEN_(\d+)__/g, (all, tokenIndex) => placeholders[tokenIndex]) + "$";
         return new RegExp(regexString);
     }
+    getRouteRegex(path) {
+        let regex = this.routeRegexCache.get(path);
+        if (!regex) {
+            regex = this.buildRouteRegex(path);
+            this.routeRegexCache.set(path, regex);
+        }
+        return regex;
+    }
+    getDomainRegex(domain) {
+        let regex = this.domainRegexCache.get(domain);
+        if (!regex) {
+            regex = this.buildDomainRegex(domain);
+            this.domainRegexCache.set(domain, regex);
+        }
+        return regex;
+    }
     normalizeDomainString(value) {
         if (!value || value.trim() === "") {
             return null;
@@ -342,7 +366,7 @@ class RouterFacade {
         return new RegExp("^" + regexBody + "$", "i");
     }
     matchDomainFilter(hostname, domainFilter) {
-        const regex = this.buildDomainRegex(domainFilter);
+        const regex = this.getDomainRegex(domainFilter);
         const match = hostname.match(regex);
         if (!match) {
             return { matches: false, matchedDomain: null, wildcard: null };
@@ -411,7 +435,7 @@ class RouterFacade {
                 continue;
             }
             for (const routeObj of routeCandidates) {
-                const match = url.match(this.buildRouteRegex(routeObj.path));
+                const match = url.match(this.getRouteRegex(routeObj.path));
                 if (!match) {
                     continue;
                 }
@@ -442,14 +466,16 @@ class RouterFacade {
                 : this.mode === "aws-lambda" && options && options.event && options.event.requestContext && options.event.requestContext.http
                     ? options.event.requestContext.http.method
                     : null;
-            yield WebframezHooks_1.WebframezHooks.emit("http.request.start", {
-                operationId: httpOperationId,
-                name: initialMethod || (this.mode === "aws-lambda" ? "lambda" : "request"),
-                attributes: {
-                    "http.request.method": initialMethod,
-                    "webframez.mode": this.mode,
-                },
-            });
+            if (WebframezHooks_1.WebframezHooks.hasListeners("http.request.start")) {
+                yield WebframezHooks_1.WebframezHooks.emit("http.request.start", {
+                    operationId: httpOperationId,
+                    name: initialMethod || (this.mode === "aws-lambda" ? "lambda" : "request"),
+                    attributes: {
+                        "http.request.method": initialMethod,
+                        "webframez.mode": this.mode,
+                    },
+                });
+            }
             let request;
             let routeOperationId = null;
             try {
@@ -478,15 +504,17 @@ class RouterFacade {
                     },
                 });
                 const errorResult = this.handleError(fallbackRequest, response, statusCode, e);
-                yield WebframezHooks_1.WebframezHooks.emit("http.request.error", {
-                    operationId: httpOperationId,
-                    name: `${fallbackRequest.method || "HTTP"} unmatched`,
-                    status: "error",
-                    error: e,
-                    request: fallbackRequest,
-                    response,
-                    attributes: Object.assign(Object.assign({ "http.request.method": fallbackRequest.method || null, "http.response.status_code": statusCode }, requestTelemetryAttributes(fallbackRequest)), { "webframez.mode": this.mode }),
-                });
+                if (WebframezHooks_1.WebframezHooks.hasListeners("http.request.error")) {
+                    yield WebframezHooks_1.WebframezHooks.emit("http.request.error", {
+                        operationId: httpOperationId,
+                        name: `${fallbackRequest.method || "HTTP"} unmatched`,
+                        status: "error",
+                        error: e,
+                        request: fallbackRequest,
+                        response,
+                        attributes: Object.assign(Object.assign({ "http.request.method": fallbackRequest.method || null, "http.response.status_code": statusCode }, requestTelemetryAttributes(fallbackRequest)), { "webframez.mode": this.mode }),
+                    });
+                }
                 return errorResult;
             }
             const route = this.dissolve(request);
@@ -496,83 +524,95 @@ class RouterFacade {
             }
             if (!route) {
                 const notFoundResult = this.handleError(request, response, 404, "Not found '" + request.url + "' ...");
-                yield WebframezHooks_1.WebframezHooks.emit("http.request.end", {
-                    operationId: httpOperationId,
-                    name: `${request.method} unmatched`,
-                    status: "ok",
-                    request,
-                    response,
-                    attributes: Object.assign(Object.assign({ "http.request.method": request.method, "http.response.status_code": 404 }, requestTelemetryAttributes(request)), { "webframez.mode": this.mode }),
-                });
+                if (WebframezHooks_1.WebframezHooks.hasListeners("http.request.end")) {
+                    yield WebframezHooks_1.WebframezHooks.emit("http.request.end", {
+                        operationId: httpOperationId,
+                        name: `${request.method} unmatched`,
+                        status: "ok",
+                        request,
+                        response,
+                        attributes: Object.assign(Object.assign({ "http.request.method": request.method, "http.response.status_code": 404 }, requestTelemetryAttributes(request)), { "webframez.mode": this.mode }),
+                    });
+                }
                 return notFoundResult;
             }
             if (!(route.component && typeof route.component === "function") && !(route.controller && route.method_name)) {
                 const missingRouteResult = this.handleError(request, response, 404, "Missing route function ...");
-                yield WebframezHooks_1.WebframezHooks.emit("http.request.end", {
-                    operationId: httpOperationId,
-                    name: `${request.method} ${route.path}`,
-                    status: "ok",
-                    request,
-                    response,
-                    attributes: Object.assign(Object.assign({ "http.request.method": request.method, "http.response.status_code": 404, "url.template": route.path, "webframez.route": route.path }, requestTelemetryAttributes(request)), { "webframez.mode": this.mode }),
-                });
-                return missingRouteResult;
-            }
-            try {
-                yield this.handleMiddleware(route, request, response);
-                if (request.method === "OPTIONS" && !request.skipOptionsForward) {
-                    const optionsResult = this.handleReturn(request, response, "");
+                if (WebframezHooks_1.WebframezHooks.hasListeners("http.request.end")) {
                     yield WebframezHooks_1.WebframezHooks.emit("http.request.end", {
                         operationId: httpOperationId,
                         name: `${request.method} ${route.path}`,
                         status: "ok",
                         request,
                         response,
-                        attributes: Object.assign(Object.assign({ "http.request.method": request.method, "http.response.status_code": response.statusCode || 200, "url.template": route.path, "webframez.route": route.path }, requestTelemetryAttributes(request)), { "webframez.mode": this.mode }),
+                        attributes: Object.assign(Object.assign({ "http.request.method": request.method, "http.response.status_code": 404, "url.template": route.path, "webframez.route": route.path }, requestTelemetryAttributes(request)), { "webframez.mode": this.mode }),
                     });
-                    return optionsResult;
                 }
-                let result = null;
-                routeOperationId = WebframezHooks_1.WebframezHooks.createOperationId("route");
-                yield WebframezHooks_1.WebframezHooks.emit("route.handler.start", {
-                    operationId: routeOperationId,
-                    parentOperationId: httpOperationId,
-                    name: `${request.method} ${route.path}`,
-                    attributes: {
-                        "http.request.method": request.method,
-                        "url.template": route.path,
-                        "webframez.route": route.path,
-                        "webframez.route.handler": route.controller && route.method_name
-                            ? `${route.controller.name || "Controller"}@${route.method_name}`
-                            : "component",
-                    },
-                });
-                if (route.controller && route.method_name) {
-                    const controllerInstance = new route.controller();
-                    if (!controllerInstance[route.method_name]) {
-                        const unknownMethodResult = this.handleError(request, response, 404, "Unknown method '" + route.method_name + "'.");
-                        yield WebframezHooks_1.WebframezHooks.emit("route.handler.error", {
-                            operationId: routeOperationId,
-                            parentOperationId: httpOperationId,
-                            name: `${request.method} ${route.path}`,
-                            status: "error",
-                            error: new Error("Unknown route method"),
-                            attributes: {
-                                "http.request.method": request.method,
-                                "http.response.status_code": 404,
-                                "url.template": route.path,
-                                "webframez.route": route.path,
-                                "webframez.route.handler": `${route.controller.name || "Controller"}@${route.method_name}`,
-                            },
-                        });
+                return missingRouteResult;
+            }
+            try {
+                yield this.handleMiddleware(route, request, response);
+                if (request.method === "OPTIONS" && !request.skipOptionsForward) {
+                    const optionsResult = this.handleReturn(request, response, "");
+                    if (WebframezHooks_1.WebframezHooks.hasListeners("http.request.end")) {
                         yield WebframezHooks_1.WebframezHooks.emit("http.request.end", {
                             operationId: httpOperationId,
                             name: `${request.method} ${route.path}`,
                             status: "ok",
                             request,
                             response,
-                            attributes: Object.assign(Object.assign({ "http.request.method": request.method, "http.response.status_code": 404, "url.template": route.path, "webframez.route": route.path }, requestTelemetryAttributes(request)), { "webframez.mode": this.mode }),
+                            attributes: Object.assign(Object.assign({ "http.request.method": request.method, "http.response.status_code": response.statusCode || 200, "url.template": route.path, "webframez.route": route.path }, requestTelemetryAttributes(request)), { "webframez.mode": this.mode }),
                         });
+                    }
+                    return optionsResult;
+                }
+                let result = null;
+                routeOperationId = WebframezHooks_1.WebframezHooks.createOperationId("route");
+                if (WebframezHooks_1.WebframezHooks.hasListeners("route.handler.start")) {
+                    yield WebframezHooks_1.WebframezHooks.emit("route.handler.start", {
+                        operationId: routeOperationId,
+                        parentOperationId: httpOperationId,
+                        name: `${request.method} ${route.path}`,
+                        attributes: {
+                            "http.request.method": request.method,
+                            "url.template": route.path,
+                            "webframez.route": route.path,
+                            "webframez.route.handler": route.controller && route.method_name
+                                ? `${route.controller.name || "Controller"}@${route.method_name}`
+                                : "component",
+                        },
+                    });
+                }
+                if (route.controller && route.method_name) {
+                    const controllerInstance = new route.controller();
+                    if (!controllerInstance[route.method_name]) {
+                        const unknownMethodResult = this.handleError(request, response, 404, "Unknown method '" + route.method_name + "'.");
+                        if (WebframezHooks_1.WebframezHooks.hasListeners("route.handler.error")) {
+                            yield WebframezHooks_1.WebframezHooks.emit("route.handler.error", {
+                                operationId: routeOperationId,
+                                parentOperationId: httpOperationId,
+                                name: `${request.method} ${route.path}`,
+                                status: "error",
+                                error: new Error("Unknown route method"),
+                                attributes: {
+                                    "http.request.method": request.method,
+                                    "http.response.status_code": 404,
+                                    "url.template": route.path,
+                                    "webframez.route": route.path,
+                                    "webframez.route.handler": `${route.controller.name || "Controller"}@${route.method_name}`,
+                                },
+                            });
+                        }
+                        if (WebframezHooks_1.WebframezHooks.hasListeners("http.request.end")) {
+                            yield WebframezHooks_1.WebframezHooks.emit("http.request.end", {
+                                operationId: httpOperationId,
+                                name: `${request.method} ${route.path}`,
+                                status: "ok",
+                                request,
+                                response,
+                                attributes: Object.assign(Object.assign({ "http.request.method": request.method, "http.response.status_code": 404, "url.template": route.path, "webframez.route": route.path }, requestTelemetryAttributes(request)), { "webframez.mode": this.mode }),
+                            });
+                        }
                         return unknownMethodResult;
                     }
                     result = yield controllerInstance[route.method_name].bind(controllerInstance)(request, response);
@@ -581,40 +621,46 @@ class RouterFacade {
                     result = yield route.component(request, response);
                 }
                 const returnResult = this.handleReturn(request, response, result);
-                yield WebframezHooks_1.WebframezHooks.emit("route.handler.end", {
-                    operationId: routeOperationId,
-                    parentOperationId: httpOperationId,
-                    name: `${request.method} ${route.path}`,
-                    status: "ok",
-                    attributes: {
-                        "http.request.method": request.method,
-                        "http.response.status_code": response.statusCode || 200,
-                        "url.template": route.path,
-                        "webframez.route": route.path,
-                    },
-                });
-                yield WebframezHooks_1.WebframezHooks.emit("http.request.end", {
-                    operationId: httpOperationId,
-                    name: `${request.method} ${route.path}`,
-                    status: "ok",
-                    request,
-                    response,
-                    attributes: Object.assign(Object.assign({ "http.request.method": request.method, "http.response.status_code": response.statusCode || 200, "url.template": route.path, "webframez.route": route.path }, requestTelemetryAttributes(request)), { "webframez.mode": this.mode }),
-                });
-                return returnResult;
-            }
-            catch (e) {
-                if (this.isMiddlewareRejectSignal(e)) {
-                    const middlewareErrorResult = this.handleError(request, response, 500, e.reason);
-                    yield WebframezHooks_1.WebframezHooks.emit("http.request.error", {
+                if (WebframezHooks_1.WebframezHooks.hasListeners("route.handler.end")) {
+                    yield WebframezHooks_1.WebframezHooks.emit("route.handler.end", {
+                        operationId: routeOperationId,
+                        parentOperationId: httpOperationId,
+                        name: `${request.method} ${route.path}`,
+                        status: "ok",
+                        attributes: {
+                            "http.request.method": request.method,
+                            "http.response.status_code": response.statusCode || 200,
+                            "url.template": route.path,
+                            "webframez.route": route.path,
+                        },
+                    });
+                }
+                if (WebframezHooks_1.WebframezHooks.hasListeners("http.request.end")) {
+                    yield WebframezHooks_1.WebframezHooks.emit("http.request.end", {
                         operationId: httpOperationId,
                         name: `${request.method} ${route.path}`,
-                        status: "error",
-                        error: e.reason || e,
+                        status: "ok",
                         request,
                         response,
-                        attributes: Object.assign(Object.assign({ "http.request.method": request.method, "http.response.status_code": 500, "url.template": route.path, "webframez.route": route.path }, requestTelemetryAttributes(request)), { "webframez.mode": this.mode }),
+                        attributes: Object.assign(Object.assign({ "http.request.method": request.method, "http.response.status_code": response.statusCode || 200, "url.template": route.path, "webframez.route": route.path }, requestTelemetryAttributes(request)), { "webframez.mode": this.mode }),
                     });
+                }
+                return returnResult;
+            }
+            catch (e) {
+                if (this.isMiddlewareRejectSignal(e)) {
+                    const middlewareErrorResult = this.handleError(request, response, 500, e.reason);
+                    if (WebframezHooks_1.WebframezHooks.hasListeners("http.request.error")) {
+                        yield WebframezHooks_1.WebframezHooks.emit("http.request.error", {
+                            operationId: httpOperationId,
+                            name: `${request.method} ${route.path}`,
+                            status: "error",
+                            error: e.reason || e,
+                            request,
+                            response,
+                            attributes: Object.assign(Object.assign({ "http.request.method": request.method, "http.response.status_code": 500, "url.template": route.path, "webframez.route": route.path }, requestTelemetryAttributes(request)), { "webframez.mode": this.mode }),
+                        });
+                    }
                     return middlewareErrorResult;
                 }
                 yield ErrorHandler_1.ErrorHandler.report(e, {
@@ -632,29 +678,33 @@ class RouterFacade {
                 });
                 const errorResult = this.handleError(request, response, 500, e);
                 if (routeOperationId) {
-                    yield WebframezHooks_1.WebframezHooks.emit("route.handler.error", {
-                        operationId: routeOperationId,
-                        parentOperationId: httpOperationId,
+                    if (WebframezHooks_1.WebframezHooks.hasListeners("route.handler.error")) {
+                        yield WebframezHooks_1.WebframezHooks.emit("route.handler.error", {
+                            operationId: routeOperationId,
+                            parentOperationId: httpOperationId,
+                            name: `${request.method} ${route.path}`,
+                            status: "error",
+                            error: e,
+                            attributes: {
+                                "http.request.method": request.method,
+                                "http.response.status_code": 500,
+                                "url.template": route.path,
+                                "webframez.route": route.path,
+                            },
+                        });
+                    }
+                }
+                if (WebframezHooks_1.WebframezHooks.hasListeners("http.request.error")) {
+                    yield WebframezHooks_1.WebframezHooks.emit("http.request.error", {
+                        operationId: httpOperationId,
                         name: `${request.method} ${route.path}`,
                         status: "error",
                         error: e,
-                        attributes: {
-                            "http.request.method": request.method,
-                            "http.response.status_code": 500,
-                            "url.template": route.path,
-                            "webframez.route": route.path,
-                        },
+                        request,
+                        response,
+                        attributes: Object.assign(Object.assign({ "http.request.method": request.method, "http.response.status_code": 500, "url.template": route.path, "webframez.route": route.path }, requestTelemetryAttributes(request)), { "webframez.mode": this.mode }),
                     });
                 }
-                yield WebframezHooks_1.WebframezHooks.emit("http.request.error", {
-                    operationId: httpOperationId,
-                    name: `${request.method} ${route.path}`,
-                    status: "error",
-                    error: e,
-                    request,
-                    response,
-                    attributes: Object.assign(Object.assign({ "http.request.method": request.method, "http.response.status_code": 500, "url.template": route.path, "webframez.route": route.path }, requestTelemetryAttributes(request)), { "webframez.mode": this.mode }),
-                });
                 return errorResult;
             }
         });

package/docs/authentication.md

@@ -475,7 +475,9 @@ unsafe requests, revive expired sessions, or extend absolute expiry. Explicit
 POST refresh rotates both secrets and retains replay protection. Middleware uses
 this resumption automatically when a response is available. Browser `createAuthFetch`
 refreshes rejected authentication/CSRF requests once, then repeats the rejected
-request once; login failures and permission errors are never retried.
+request once; login failures and permission errors are never retried. Web Locks
+serialize refresh calls across tabs in browsers supporting that API; a per-window
+single-flight promise remains the fallback.
 
 Reset tokens have 256-bit random secrets; only a SHA-256 digest bound to the scope
 and current password is stored. Per-account request cooldown is an atomic conditional

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@webtypen/webframez-core",
-    "version": "0.3.75",
+    "version": "0.3.77",
     "description": "The core package of the typescript based webframez (web-framework) by webtypen.de",
     "homepage": "https://webtypen.de/",
     "license": "MIT",