@oxy.so/core 1.18.1 → 3.0.0

package/src/__tests__/inSessionRefresh.test.ts

@@ -1,313 +0,0 @@
-/**
- * In-session access-token refresh plumbing.
- *
- * These guard the HttpService surface that `@oxy.so/services`' OxyContext now
- * drives via `setAuthRefreshHandler`: a 401 re-mints through the handler and
- * retries the ORIGINAL request with the fresh token; an unrecoverable refresh
- * clears tokens and notifies listeners (the reconcile signal that flips the RN
- * provider out of its zombie logged-in state); concurrent refreshes coalesce and
- * a failed refresh is cooldown-guarded (no refresh storm). Plus the new
- * `OxyServices.getAccessTokenExpiry()` helper the proactive scheduler reads.
- */
-import { HttpService } from '../HttpService';
-import { OxyServices } from '../OxyServices';
-
-interface FetchCall {
-  url: string;
-  init: RequestInit | undefined;
-}
-
-function createJwt(payload: Record<string, unknown>): string {
-  const encode = (value: unknown): string => Buffer.from(JSON.stringify(value)).toString('base64url');
-  return `${encode({ alg: 'HS256', typ: 'JWT' })}.${encode(payload)}.signature`;
-}
-
-function jsonResponse(data: unknown): Response {
-  return new Response(JSON.stringify({ data }), {
-    status: 200,
-    headers: { 'content-type': 'application/json' },
-  });
-}
-
-function unauthorized(): Response {
-  return new Response(JSON.stringify({ error: 'token expired' }), {
-    status: 401,
-    statusText: 'Unauthorized',
-    headers: { 'content-type': 'application/json' },
-  });
-}
-
-function readHeaders(init: RequestInit | undefined): Record<string, string> {
-  const headers = init?.headers;
-  if (!headers) return {};
-  if (headers instanceof Headers) return Object.fromEntries(headers.entries());
-  if (Array.isArray(headers)) return Object.fromEntries(headers);
-  return headers as Record<string, string>;
-}
-
-const farFutureExp = (): number => Math.floor(Date.now() / 1000) + 3600;
-
-describe('HttpService in-session refresh handler', () => {
-  const originalFetch = globalThis.fetch;
-
-  afterEach(() => {
-    globalThis.fetch = originalFetch;
-    jest.restoreAllMocks();
-  });
-
-  it('refreshes via the handler on a 401 and retries the original request with the fresh token', async () => {
-    const oldToken = createJwt({ userId: 'u', exp: farFutureExp(), jti: 'old' });
-    const newToken = createJwt({ userId: 'u', exp: farFutureExp(), jti: 'new' });
-    const calls: FetchCall[] = [];
-    let feedAttempts = 0;
-    globalThis.fetch = async (input, init) => {
-      const url = String(input);
-      calls.push({ url, init });
-      if (url.endsWith('/feed')) {
-        feedAttempts += 1;
-        if (feedAttempts === 1) return unauthorized();
-      }
-      return jsonResponse({ ok: true });
-    };
-
-    const http = new HttpService({ baseURL: 'https://api.mention.earth', enableRetry: false });
-    http.setTokens(oldToken);
-
-    let handlerCalls = 0;
-    const reasons: string[] = [];
-    http.setAuthRefreshHandler(async (reason) => {
-      handlerCalls += 1;
-      reasons.push(reason);
-      // Simulate a silent arm planting the rotated token internally.
-      http.setTokens(newToken);
-      return newToken;
-    });
-
-    const result = await http.post('/feed', { cursor: 0 }, { retry: false });
-
-    expect(result).toEqual({ ok: true });
-    expect(handlerCalls).toBe(1);
-    expect(reasons).toEqual(['response-401']);
-
-    const feedCalls = calls.filter((call) => call.url.endsWith('/feed'));
-    expect(feedCalls).toHaveLength(2);
-    // The original request is retried carrying the FRESH bearer.
-    expect(readHeaders(feedCalls[1].init).Authorization).toBe(`Bearer ${newToken}`);
-    expect(http.getAccessToken()).toBe(newToken);
-  });
-
-  it('clears tokens and notifies listeners when the handler cannot refresh on a 401 (reconcile signal)', async () => {
-    globalThis.fetch = async (input) => {
-      const url = String(input);
-      if (url.endsWith('/feed')) return unauthorized();
-      return jsonResponse({ ok: true });
-    };
-
-    const oxy = new OxyServices({ baseURL: 'https://api.mention.earth' });
-    oxy.setTokens(createJwt({ userId: 'u', exp: farFutureExp() }));
-
-    const tokenEvents: Array<string | null> = [];
-    oxy.onTokensChanged((token) => tokenEvents.push(token));
-
-    oxy.getClient().setAuthRefreshHandler(async () => null);
-
-    await expect(oxy.getClient().post('/feed', {}, { retry: false })).rejects.toBeDefined();
-
-    // The dead session reconciles: token cleared + a null change emitted (which
-    // OxyContext's `handleTokenChange(null)` turns into a local sign-out).
-    expect(oxy.getAccessToken()).toBeNull();
-    expect(tokenEvents).toContain(null);
-  });
-
-  it('coalesces concurrent refreshes into a single handler invocation', async () => {
-    globalThis.fetch = async () => jsonResponse({ ok: true });
-    const newToken = createJwt({ userId: 'u', exp: farFutureExp(), jti: 'fresh' });
-
-    const http = new HttpService({ baseURL: 'https://api.mention.earth', enableRetry: false });
-    http.setTokens(createJwt({ userId: 'u', exp: farFutureExp() }));
-
-    let handlerCalls = 0;
-    http.setAuthRefreshHandler(async () => {
-      handlerCalls += 1;
-      await new Promise((resolve) => setTimeout(resolve, 10));
-      http.setTokens(newToken);
-      return newToken;
-    });
-
-    const [a, b, c] = await Promise.all([
-      http.refreshAccessToken('preflight'),
-      http.refreshAccessToken('preflight'),
-      http.refreshAccessToken('preflight'),
-    ]);
-
-    expect(handlerCalls).toBe(1);
-    expect([a, b, c]).toEqual([newToken, newToken, newToken]);
-  });
-
-  it('cooldown-guards a failed refresh so it does not storm the handler', async () => {
-    globalThis.fetch = async () => jsonResponse({ ok: true });
-
-    const http = new HttpService({ baseURL: 'https://api.mention.earth', enableRetry: false });
-    http.setTokens(createJwt({ userId: 'u', exp: farFutureExp() }));
-
-    let handlerCalls = 0;
-    http.setAuthRefreshHandler(async () => {
-      handlerCalls += 1;
-      return null;
-    });
-
-    const first = await http.refreshAccessToken('preflight');
-    const second = await http.refreshAccessToken('preflight');
-
-    expect(first).toBeNull();
-    expect(second).toBeNull();
-    // The second call is inside the post-failure cooldown → handler not re-run.
-    expect(handlerCalls).toBe(1);
-  });
-
-  it('lets an EXPIRED token re-mint promptly instead of waiting out the long proactive cooldown', async () => {
-    // Regression: an ECS rolling-deploy blip briefly fails a mint; the 15s
-    // proactive cooldown then left the client forwarding/omitting a now-expired
-    // bearer for up to 15s after the endpoint recovered (Mention /privacy 401s).
-    // An already-expired token must recover on the short cooldown instead.
-    globalThis.fetch = async () => jsonResponse({ ok: true });
-    const nowSpy = jest.spyOn(Date, 'now');
-    const T0 = 1_000_000_000_000;
-    nowSpy.mockReturnValue(T0);
-
-    const http = new HttpService({ baseURL: 'https://api.mention.earth', enableRetry: false });
-    // Current token is already 10s past exp (exp is in SECONDS).
-    http.setTokens(createJwt({ userId: 'u', exp: Math.floor(T0 / 1000) - 10 }));
-
-    let handlerCalls = 0;
-    http.setAuthRefreshHandler(async () => {
-      handlerCalls += 1;
-      return null;
-    });
-
-    // First attempt fails → records the failure timestamp.
-    await http.refreshAccessToken('preflight');
-    expect(handlerCalls).toBe(1);
-
-    // 500ms later: still inside the SHORT expired cooldown → NOT re-run. This is
-    // the storm guard — an expired token does not fully bypass the cooldown.
-    nowSpy.mockReturnValue(T0 + 500);
-    await http.refreshAccessToken('preflight');
-    expect(handlerCalls).toBe(1);
-
-    // 1.5s later: past the short expired cooldown but WELL inside the 15s
-    // proactive cooldown → the expired token re-mints promptly.
-    nowSpy.mockReturnValue(T0 + 1500);
-    await http.refreshAccessToken('preflight');
-    expect(handlerCalls).toBe(2);
-
-    nowSpy.mockRestore();
-  });
-
-  it('keeps the full 15s cooldown for a still-valid (proactive) near-expiry refresh', async () => {
-    globalThis.fetch = async () => jsonResponse({ ok: true });
-    const nowSpy = jest.spyOn(Date, 'now');
-    const T0 = 1_000_000_000_000;
-    nowSpy.mockReturnValue(T0);
-
-    const http = new HttpService({ baseURL: 'https://api.mention.earth', enableRetry: false });
-    // Token is still valid for another hour — a proactive refresh, not expired.
-    http.setTokens(createJwt({ userId: 'u', exp: Math.floor(T0 / 1000) + 3600 }));
-
-    let handlerCalls = 0;
-    http.setAuthRefreshHandler(async () => {
-      handlerCalls += 1;
-      return null;
-    });
-
-    await http.refreshAccessToken('preflight');
-    expect(handlerCalls).toBe(1);
-
-    // 1.5s later: past the short expired cooldown, but the token is NOT expired,
-    // so the full proactive cooldown still applies → no re-run (no storm).
-    nowSpy.mockReturnValue(T0 + 1500);
-    await http.refreshAccessToken('preflight');
-    expect(handlerCalls).toBe(1);
-
-    nowSpy.mockRestore();
-  });
-});
-
-describe('HttpService.endSession — a sign-out outranks a refresh', () => {
-  it('plants nothing when the session ends while a re-mint is in flight', async () => {
-    const oldToken = createJwt({ userId: 'u', exp: farFutureExp(), jti: 'old' });
-    const lateToken = createJwt({ userId: 'u', exp: farFutureExp(), jti: 'late' });
-    const http = new HttpService({ baseURL: 'https://api.mention.earth', enableRetry: false });
-    http.setTokens(oldToken);
-
-    let finish!: (token: string | null) => void;
-    http.setAuthRefreshHandler(
-      () =>
-        new Promise((resolve) => {
-          finish = resolve;
-        }),
-    );
-    const seen: Array<string | null> = [];
-    http.addTokenChangeListener((token) => seen.push(token));
-
-    const pending = http.refreshAccessToken('preflight');
-    http.endSession();
-    finish(lateToken);
-
-    await expect(pending).resolves.toBeNull();
-    expect(http.getAccessToken()).toBeNull();
-    expect(seen).toEqual([null]);
-  });
-
-  it('abandons only what was in flight: a later re-mint (another tab signed in) still runs', async () => {
-    const http = new HttpService({ baseURL: 'https://api.mention.earth', enableRetry: false });
-    const fresh = createJwt({ userId: 'u', exp: farFutureExp(), jti: 'fresh' });
-    const handler = jest.fn(async () => fresh);
-    http.setAuthRefreshHandler(handler);
-
-    http.endSession();
-    expect(http.hasSessionEnded()).toBe(true);
-    await expect(http.refreshAccessToken('preflight')).resolves.toBe(fresh);
-    expect(http.getAccessToken()).toBe(fresh);
-    expect(http.hasSessionEnded()).toBe(false);
-  });
-
-  it('is what OxyServices.clearTokens does; a plain HttpService.clearTokens (a mirror) is not', () => {
-    const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
-    const before = oxy.httpService.getSessionEpoch();
-    oxy.clearTokens();
-    expect(oxy.httpService.getSessionEpoch()).toBe(before + 1);
-    expect(oxy.httpService.hasSessionEnded()).toBe(true);
-
-    const mirror = new HttpService({ baseURL: 'https://api.mention.earth', enableRetry: false });
-    mirror.clearTokens();
-    expect(mirror.getSessionEpoch()).toBe(0);
-    expect(mirror.hasSessionEnded()).toBe(false);
-  });
-});
-
-describe('OxyServices.getAccessTokenExpiry', () => {
-  it('returns the JWT exp (seconds) of the current access token', () => {
-    const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
-    const exp = Math.floor(Date.now() / 1000) + 1234;
-    oxy.setTokens(createJwt({ userId: 'u', exp }));
-    expect(oxy.getAccessTokenExpiry()).toBe(exp);
-  });
-
-  it('returns null when there is no access token', () => {
-    const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
-    expect(oxy.getAccessTokenExpiry()).toBeNull();
-  });
-
-  it('returns null for an opaque / non-JWT token', () => {
-    const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
-    oxy.setTokens('opaque-not-a-jwt');
-    expect(oxy.getAccessTokenExpiry()).toBeNull();
-  });
-
-  it('returns null for a JWT with no numeric exp claim', () => {
-    const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
-    oxy.setTokens(createJwt({ userId: 'u' }));
-    expect(oxy.getAccessTokenExpiry()).toBeNull();
-  });
-});

package/src/__tests__/linkedClient.test.ts

@@ -1,363 +0,0 @@
-import { OxyServices } from '../OxyServices';
-
-interface FetchCall {
-  url: string;
-  init: RequestInit | undefined;
-}
-
-function createServices(): OxyServices {
-  return new OxyServices({ baseURL: 'https://api.oxy.so' });
-}
-
-function createJwt(payload: Record<string, unknown>): string {
-  const encode = (value: unknown): string => Buffer.from(JSON.stringify(value)).toString('base64url');
-  return `${encode({ alg: 'HS256', typ: 'JWT' })}.${encode(payload)}.signature`;
-}
-
-function jsonResponse(data: unknown): Response {
-  return new Response(JSON.stringify({ data }), {
-    status: 200,
-    headers: { 'content-type': 'application/json' },
-  });
-}
-
-function readHeaders(init: RequestInit | undefined): Record<string, string> {
-  const headers = init?.headers;
-  if (!headers) {
-    return {};
-  }
-  if (headers instanceof Headers) {
-    return Object.fromEntries(headers.entries());
-  }
-  if (Array.isArray(headers)) {
-    return Object.fromEntries(headers);
-  }
-  return headers as Record<string, string>;
-}
-
-describe('OxyServices.createLinkedClient', () => {
-  const originalFetch = globalThis.fetch;
-
-  afterEach(() => {
-    globalThis.fetch = originalFetch;
-    jest.restoreAllMocks();
-  });
-
-  it('mirrors token changes from the session owner', () => {
-    const oxy = createServices();
-    const linked = oxy.createLinkedClient({ baseURL: 'https://api.syra.fm' });
-
-    expect(linked.client.getAccessToken()).toBeNull();
-
-    oxy.setTokens('access_1');
-    expect(linked.client.getAccessToken()).toBe('access_1');
-
-    oxy.setTokens('access_2');
-    expect(linked.client.getAccessToken()).toBe('access_2');
-
-    oxy.clearTokens();
-    expect(linked.client.getAccessToken()).toBeNull();
-
-    linked.dispose();
-  });
-
-  it('copies the current token when created after sign-in', () => {
-    const oxy = createServices();
-    oxy.setTokens('existing_access');
-
-    const linked = oxy.createLinkedClient({ baseURL: 'https://api.syra.fm' });
-
-    expect(linked.client.getAccessToken()).toBe('existing_access');
-
-    linked.dispose();
-  });
-
-  it('delegates token refresh to the session owner', async () => {
-    const oxy = createServices();
-    const linked = oxy.createLinkedClient({ baseURL: 'https://api.syra.fm' });
-
-    oxy.getClient().setAuthRefreshHandler(async () => 'refreshed_access');
-
-    const refreshed = await linked.client.refreshAccessToken('preflight');
-
-    expect(refreshed).toBe('refreshed_access');
-    expect(oxy.getAccessToken()).toBe('refreshed_access');
-    expect(linked.client.getAccessToken()).toBe('refreshed_access');
-
-    linked.dispose();
-  });
-
-  it('returns an unread authenticated streaming response', async () => {
-    const calls: FetchCall[] = [];
-    globalThis.fetch = async (input, init) => {
-      calls.push({ url: String(input), init });
-      return new Response('data: {"delta":"hello"}\n\n', {
-        status: 200,
-        headers: { 'content-type': 'text/event-stream' },
-      });
-    };
-
-    const oxy = createServices();
-    const accessToken = createJwt({
-      userId: 'user_1',
-      exp: Math.floor(Date.now() / 1000) + 3600,
-    });
-    oxy.setTokens(accessToken);
-    const linked = oxy.createLinkedClient({ baseURL: 'https://api.alia.onl/' });
-
-    const response = await linked.client.requestAuthenticatedResponse({
-      method: 'POST',
-      url: '/alia/chat',
-      body: JSON.stringify({ message: 'hello' }),
-      headers: {
-        Authorization: 'Bearer caller_supplied_token',
-        'Content-Type': 'application/json',
-      },
-    });
-
-    expect(response.bodyUsed).toBe(false);
-    expect(await response.text()).toBe('data: {"delta":"hello"}\n\n');
-    expect(calls).toHaveLength(1);
-    expect(calls[0]?.url).toBe('https://api.alia.onl/alia/chat');
-    expect(readHeaders(calls[0]?.init).authorization).toBe(`Bearer ${accessToken}`);
-
-    linked.dispose();
-  });
-
-  it('refreshes once after a streaming response 401 and keeps the final body unread', async () => {
-    const calls: FetchCall[] = [];
-    globalThis.fetch = async (input, init) => {
-      calls.push({ url: String(input), init });
-      if (calls.length === 1) {
-        return new Response('expired', { status: 401 });
-      }
-      return new Response('data: done\n\n', {
-        status: 200,
-        headers: { 'content-type': 'text/event-stream' },
-      });
-    };
-
-    const oxy = createServices();
-    const oldToken = createJwt({
-      userId: 'user_1',
-      exp: Math.floor(Date.now() / 1000) + 3600,
-    });
-    const refreshedToken = createJwt({
-      userId: 'user_1',
-      exp: Math.floor(Date.now() / 1000) + 7200,
-    });
-    oxy.setTokens(oldToken);
-    oxy.getClient().setAuthRefreshHandler(async () => refreshedToken);
-    const linked = oxy.createLinkedClient({ baseURL: 'https://api.alia.onl' });
-
-    const response = await linked.client.requestAuthenticatedResponse({
-      method: 'POST',
-      url: '/alia/chat',
-      body: '{}',
-      headers: { 'Content-Type': 'application/json' },
-    });
-
-    expect(calls).toHaveLength(2);
-    expect(readHeaders(calls[0]?.init).authorization).toBe(`Bearer ${oldToken}`);
-    expect(readHeaders(calls[1]?.init).authorization).toBe(`Bearer ${refreshedToken}`);
-    expect(oxy.getAccessToken()).toBe(refreshedToken);
-    expect(linked.client.getAccessToken()).toBe(refreshedToken);
-    expect(response.bodyUsed).toBe(false);
-    expect(await response.text()).toBe('data: done\n\n');
-
-    linked.dispose();
-  });
-
-  it('rejects an authenticated streaming request before fetch without a session', async () => {
-    const fetchMock = jest.fn();
-    globalThis.fetch = fetchMock as unknown as typeof globalThis.fetch;
-    const oxy = createServices();
-    const linked = oxy.createLinkedClient({ baseURL: 'https://api.alia.onl' });
-
-    await expect(linked.client.requestAuthenticatedResponse({
-      method: 'POST',
-      url: '/alia/chat',
-      body: '{}',
-    })).rejects.toMatchObject({
-      code: 'AUTH_REQUIRED',
-      status: 401,
-    });
-    expect(fetchMock).not.toHaveBeenCalled();
-
-    linked.dispose();
-  });
-
-  it('keeps the session owner intact when a linked response 401 cannot refresh', async () => {
-    const oxy = createServices();
-    oxy.setTokens('stale_access');
-    const linked = oxy.createLinkedClient({ baseURL: 'https://api.syra.fm' });
-
-    const refreshed = await linked.client.refreshAccessToken('response-401');
-
-    expect(refreshed).toBeNull();
-    expect(oxy.getAccessToken()).toBe('stale_access');
-    expect(linked.client.getAccessToken()).toBe('stale_access');
-
-    linked.dispose();
-  });
-
-  it('resynchronizes from the session owner after a linked app 401 clears the local token', async () => {
-    const calls: FetchCall[] = [];
-    let queueWriteAttempts = 0;
-    globalThis.fetch = async (input, init) => {
-      const url = String(input);
-      calls.push({ url, init });
-
-      if (url.endsWith('/api/queue/current')) {
-        queueWriteAttempts += 1;
-        if (queueWriteAttempts === 1) {
-          return new Response(JSON.stringify({ error: 'MISSING_TOKEN' }), {
-            status: 401,
-            statusText: 'Unauthorized',
-            headers: { 'content-type': 'application/json' },
-          });
-        }
-      }
-
-      return jsonResponse({ ok: true });
-    };
-
-    const oxy = createServices();
-    const accessToken = createJwt({
-      userId: 'user_1',
-      exp: Math.floor(Date.now() / 1000) + 3600,
-    });
-    oxy.setTokens(accessToken);
-    oxy.getClient().setAuthRefreshHandler(async () => null);
-    const linked = oxy.createLinkedClient({ baseURL: 'https://api.syra.fm' });
-
-    await expect(linked.client.put('/api/queue/current', { trackId: 'track_1' }, { retry: false })).rejects.toMatchObject({
-      message: 'MISSING_TOKEN',
-      status: 401,
-    });
-
-    expect(oxy.getAccessToken()).toBe(accessToken);
-    expect(linked.client.getAccessToken()).toBeNull();
-
-    await linked.client.put('/api/queue/current', { trackId: 'track_2' });
-
-    expect(calls.map((call) => call.url)).toEqual([
-      'https://api.syra.fm/api/queue/current',
-      'https://api.syra.fm/api/queue/current',
-    ]);
-    expect(linked.client.getAccessToken()).toBe(accessToken);
-
-    const firstHeaders = readHeaders(calls[0]?.init);
-    expect(firstHeaders.Authorization).toBe(`Bearer ${accessToken}`);
-    expect(firstHeaders['X-CSRF-Token']).toBeUndefined();
-
-    const secondHeaders = readHeaders(calls[1]?.init);
-    expect(secondHeaders.Authorization).toBe(`Bearer ${accessToken}`);
-    expect(secondHeaders['X-CSRF-Token']).toBeUndefined();
-
-    linked.dispose();
-  });
-
-  it('keeps the session owner intact when linked preflight refresh cannot refresh', async () => {
-    const oxy = createServices();
-    oxy.setTokens('existing_access');
-    const linked = oxy.createLinkedClient({ baseURL: 'https://api.syra.fm' });
-
-    const refreshed = await linked.client.refreshAccessToken('preflight');
-
-    expect(refreshed).toBeNull();
-    expect(oxy.getAccessToken()).toBe('existing_access');
-    expect(linked.client.getAccessToken()).toBe('existing_access');
-
-    linked.dispose();
-  });
-
-  it('stops mirroring after dispose', () => {
-    const oxy = createServices();
-    const linked = oxy.createLinkedClient({ baseURL: 'https://api.syra.fm' });
-
-    oxy.setTokens('before_dispose');
-    expect(linked.client.getAccessToken()).toBe('before_dispose');
-
-    linked.dispose();
-    oxy.setTokens('after_dispose');
-
-    expect(linked.client.getAccessToken()).toBeNull();
-  });
-
-  it('joins linked base URLs with relative paths that omit the leading slash', async () => {
-    const fetchMock = jest.fn(async () => jsonResponse({ ok: true }));
-    globalThis.fetch = fetchMock as unknown as typeof globalThis.fetch;
-
-    const oxy = createServices();
-    const linked = oxy.createLinkedClient({ baseURL: 'https://api.mention.earth' });
-
-    await linked.client.get('profile/settings/me');
-
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-    expect(String(fetchMock.mock.calls[0]?.[0])).toBe('https://api.mention.earth/profile/settings/me');
-
-    linked.dispose();
-  });
-
-  /**
-   * GET response caching is OFF by default for linked clients: the SDK cannot
-   * invalidate the consumer backend's resources, so a cached GET there would
-   * serve stale data after the app mutates its own data. The consumer's own
-   * layer (React Query / stores) owns caching. An explicit `enableCache: true`
-   * opts back in.
-   */
-  describe('linked client GET cache default', () => {
-    it('does NOT cache GETs by default — every read hits the network', async () => {
-      const fetchMock = jest.fn();
-      globalThis.fetch = fetchMock as unknown as typeof globalThis.fetch;
-
-      const oxy = createServices();
-      const accessToken = createJwt({
-        userId: 'user_1',
-        exp: Math.floor(Date.now() / 1000) + 3600,
-      });
-      oxy.setTokens(accessToken);
-      const linked = oxy.createLinkedClient({ baseURL: 'https://api.mention.earth' });
-
-      // Two identical GETs with cache:true — both MUST hit the network because
-      // the linked client's cache is disabled by default.
-      fetchMock.mockResolvedValueOnce(jsonResponse({ v: 1 }));
-      const first = await linked.client.get<{ v: number }>('/feed/mtn', { cache: true });
-      fetchMock.mockResolvedValueOnce(jsonResponse({ v: 2 }));
-      const second = await linked.client.get<{ v: number }>('/feed/mtn', { cache: true });
-
-      expect(first.v).toBe(1);
-      expect(second.v).toBe(2);
-      expect(fetchMock).toHaveBeenCalledTimes(2);
-
-      linked.dispose();
-    });
-
-    it('caches GETs when the caller explicitly opts in with enableCache: true', async () => {
-      const fetchMock = jest.fn();
-      globalThis.fetch = fetchMock as unknown as typeof globalThis.fetch;
-
-      const oxy = createServices();
-      const accessToken = createJwt({
-        userId: 'user_1',
-        exp: Math.floor(Date.now() / 1000) + 3600,
-      });
-      oxy.setTokens(accessToken);
-      const linked = oxy.createLinkedClient({
-        baseURL: 'https://api.mention.earth',
-        enableCache: true,
-      });
-
-      // Second identical GET is a warm cache hit — only one network call.
-      fetchMock.mockResolvedValueOnce(jsonResponse({ v: 1 }));
-      const first = await linked.client.get<{ v: number }>('/feed/mtn', { cache: true });
-      const second = await linked.client.get<{ v: number }>('/feed/mtn', { cache: true });
-
-      expect(first).toEqual(second);
-      expect(fetchMock).toHaveBeenCalledTimes(1);
-
-      linked.dispose();
-    });
-  });
-});