@oxyhq/core 3.8.2 → 3.9.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (13) hide show
  1. package/README.md +10 -0
  2. package/dist/cjs/.tsbuildinfo +1 -1
  3. package/dist/cjs/OxyServices.base.js +15 -1
  4. package/dist/esm/.tsbuildinfo +1 -1
  5. package/dist/esm/OxyServices.base.js +15 -1
  6. package/dist/types/.tsbuildinfo +1 -1
  7. package/dist/types/OxyServices.base.d.ts +12 -0
  8. package/package.json +1 -1
  9. package/src/OxyServices.base.ts +15 -1
  10. package/src/__tests__/linkedClient.test.ts +61 -0
  11. package/dist/cjs/mixins/OxyServices.popup.js +0 -263
  12. package/dist/esm/mixins/OxyServices.popup.js +0 -261
  13. package/dist/types/mixins/OxyServices.popup.d.ts +0 -170
package/README.md CHANGED
@@ -93,6 +93,16 @@ Linked clients send the current Oxy bearer token for authenticated requests.
93
93
  State-changing bearer requests do not fetch app-local CSRF tokens; cookie-only
94
94
  writes still use CSRF.
95
95
 
96
+ **GET response caching is OFF by default for linked clients** (since 3.9.0). The
97
+ SDK's per-instance GET cache is only safe on the canonical `OxyServices` client,
98
+ where every mutation (`updateProfile`, `followUser`, `blockUser`, …) busts the
99
+ matching cached GET. A linked client targets the consuming app's own backend,
100
+ whose resources and write endpoints the SDK cannot know or invalidate — so a
101
+ cached GET there would serve stale data after the app mutates its own data.
102
+ Caching is left to the consumer's own layer (React Query / stores). Pass
103
+ `oxy.createLinkedClient({ baseURL, enableCache: true })` to opt back in when the
104
+ consumer accepts responsibility for invalidation.
105
+
96
106
  ## Backend Auth Middleware
97
107
 
98
108
  Backends should use the SDK server helpers instead of local auth request types