@riverbankcms/sdk 0.101.0 → 0.103.0

package/README.md

@@ -3464,16 +3464,24 @@ Add a signed revalidation route so CMS publish events can refresh affected ISR p
 ```ts
 // src/app/api/revalidate/route.ts
 import { createRevalidateHandler } from '@riverbankcms/sdk/next/revalidate';
+import { getRiverbankClient } from '@/lib/riverbank-client';
 
-export const POST = createRevalidateHandler();
+export const POST = createRevalidateHandler({
+  getClient: getRiverbankClient,
+});
 ```
 
-Set `RIVERBANK_WEBHOOK_SECRET` in the deployed site and configure the matching Riverbank webhook endpoint to post to `/api/revalidate`. Revalidation requests are signed with `X-Riverbank-Signature: sha256=<hex HMAC-SHA256 digest>` over the raw JSON body. The SDK handler rejects missing prefixes, malformed digests, bad signatures, and invalid payloads; valid payloads can revalidate one or more top-level `paths` and `tags`, with malformed path entries skipped and reported in the response metadata.
+Set `RIVERBANK_WEBHOOK_SECRET` in the deployed SDK site and configure the matching Riverbank webhook endpoint to post to `/api/revalidate`. Revalidation requests are signed with `X-Riverbank-Signature: sha256=<hex HMAC-SHA256 digest>` over the raw JSON body. The SDK handler rejects missing prefixes, malformed digests, bad signatures, and invalid payloads; valid payloads can revalidate one or more top-level `paths` and `tags`, clear the current process's SDK client response cache when `getClient` is provided, and skip malformed path entries while reporting them in the response metadata.
+
+The SDK client cache clear is process-local and best-effort. It helps single-process deployments, `next dev`, `next start`, and any runtime where the revalidation route and render path share the same module instance. Serverless platforms such as Vercel can compile `/api/revalidate` and page rendering into separate functions and can run many warm containers; in those deployments, the webhook may clear only the webhook function's local client instance while other render instances keep their SDK response cache until TTL expiry. Use Next tag/path revalidation as the authoritative cross-instance invalidation layer, and disable or shorten SDK response caching for force-dynamic deployments that require immediate freshness across serverless instances.
+
+Existing SDK sites should update their revalidation route to pass `getClient: getRiverbankClient`, then redeploy after adding or changing the deployed site's `RIVERBANK_WEBHOOK_SECRET`. The dashboard/CMS environment separately needs `WEBHOOK_SIGNING_SECRET_KEYRING_JSON` configured so Riverbank can create and store endpoint signing secrets; do not put that dashboard keyring in the SDK site.
 
 The CMS includes a `dispatchId` in signed payloads and sends matching `X-Riverbank-Dispatch-Id` / `X-Riverbank-Correlation-Id` headers. Use the optional callback metadata to join CMS delivery logs with consumer deployment logs without logging secrets:
 
 ```ts
 export const POST = createRevalidateHandler({
+  getClient: getRiverbankClient,
   onRevalidate: (_payload, _items, metadata) => {
     console.info('Riverbank ISR revalidated', metadata);
   },