@ic-reactor/mcp 0.0.0-stage → 0.0.0

package/CHANGELOG.md

@@ -0,0 +1,3268 @@
+# Changelog
+
+Notable changes to the published `@ic-reactor/*` packages. ic-reactor 4
+releases from `main` in one lane, `@ic-reactor/core`, `@ic-reactor/react`,
+`@ic-reactor/vite-plugin` and `@ic-reactor/mcp` at one version: stable
+versions under npm's `latest` dist-tag, prereleases under `beta`. The 3.x
+line, on the `v3` branch since the 4.0 GA flip, releases in three lanes, each
+with its own version:
+
+- runtime: `@ic-reactor/core`, `@ic-reactor/react`, `@ic-reactor/candid`
+- codegen: `@ic-reactor/codegen`, `@ic-reactor/cli`, `@ic-reactor/vite-plugin`
+- parser: `@ic-reactor/parser`
+
+The GitHub release of each tag also lists every pull request it contains.
+What a 4.x release may change, from 4.0.0 on, is in
+[Versioning and support](docs/src/content/docs/versioning.mdx).
+Issue numbers below refer to https://github.com/B3Pay/ic-reactor/issues.
+
+## Unreleased
+
+### New: @ic-reactor/mcp
+
+`@ic-reactor/mcp` is an MCP server that gives an AI agent any Internet
+Computer canister's methods as tools. Each canister named with
+`--canister <name>=<id>` gets one tool per method, with an input schema built
+from the canister's certified `candid:service` metadata, and `list_methods`,
+`describe_method` and `query` read any canister. An update is sent only to a
+listed canister, signed with the key given as `--identity`, after the person
+approves the exact call in the MCP client's form (MCP form elicitation): the
+form shows the canister, method, caller, network, the arguments as Candid text
+and the sha256 of the encoded bytes, and the canister's module hash is
+confirmed before the form and again before the call is sent. A certified read
+goes out as the anonymous principal, never with the key, and is read with the
+interface of the module installed now. Input schemas, `tools/list`, method
+names in the form and each call's wait are bounded, so a hostile interface
+cannot exhaust the server's memory or crowd the form.
+
+It releases with core, react and vite-plugin, at their version, and installs
+one command: `npm install --global @ic-reactor/mcp`, then
+`ic-reactor-mcp --help`. Its page,
+[@ic-reactor/mcp](https://ic-reactor.b3pay.net/v4/packages/mcp/), has the
+tools, the approval rules and the limits, and `packages/mcp/README.md` the
+JSON forms of Candid values too.
+
+## core, react, vite-plugin 4.1.1
+
+Prepared on 2026-11-06. 4.1.1 moves `@ic-reactor/vite-plugin` to
+`@meantjs/cli` 0.5.1, Meant's patch with the corrected source nesting count.
+`@ic-reactor/core` and `@ic-reactor/react` change only their version: the
+schema peer stays `@meantjs/schema` 0.6.0. The release adds or removes no
+`@ic-reactor/*` export (core 13, `@ic-reactor/core/testing` 2, react 4,
+vite-plugin 2), and committed modules do not change.
+
+The plugin pins the CLI exactly, so an app on 4.1.0 moves the CLI with it:
+
+```sh
+npm install --save-exact @ic-reactor/core@4.1.1 @ic-reactor/react@4.1.1
+npm install --save-dev --save-exact @ic-reactor/vite-plugin@4.1.1 @meantjs/cli@0.5.1
+```
+
+Name only the packages the app has.
+
+### @ic-reactor/vite-plugin
+
+#### Changed
+
+- Peer `@meantjs/cli` at exactly `0.5.1`, where it was exactly `0.5.0`, and
+  the install hints name `@meantjs/cli@0.5.1`. Meant's 0.5.1 is 0.5.0 with
+  one compiler fix, a hardening: the source nesting limit counts every `opt`
+  and `vec` until its operand ends, so a `.did` nested past the limit is
+  refused before parsing with `resource_limit_exceeded`, where 0.5.0 could
+  run out of stack on it and fail that canister with `internal_error`. A type
+  nested exactly to the type depth limit whose innermost `record {}`,
+  `variant {}` or `func () -> ()` is empty now compiles, where 0.5.0 refused
+  it. For a `.did` both accept, the module and the envelope are the same, so
+  committed modules do not change. Move the CLI with the plugin, both exact.
+
+### Examples (not published)
+
+- `node-agent-tool` no longer prints text from a ledger raw. Without
+  `--json`, a token's name or symbol and an error message are printed with
+  each control character and bidirectional formatting character spelled out
+  (`\u{1b}`), so a ledger can't move the cursor, rewrite earlier lines, add a
+  line that looks like the CLI's own or reverse an amount. With `--json`,
+  DEL, the C1 controls and those formatting characters are `\u` escapes, as
+  the C0 controls already were.
+
+### CI (not published)
+
+- A release's run of the published-examples check waits until npm serves
+  each package's tarball, not only until the dist-tag and the integrity name
+  the release (`waitForPublished` in `scripts/test-examples-published.mjs`).
+  On 4.1.0's release run, npm answered 404 for core's tarball for about five
+  minutes after its dist-tag named 4.1.0, and every example's install failed
+  on it.
+
+## core, react, vite-plugin 4.1.0
+
+Prepared on 2026-11-02. 4.1.0 moves ic-reactor 4 onto Meant, the new name of
+the candid-core pair, and changes two things `@ic-reactor/core` does at run
+time: what the client keeps after the caller changes, and what it believes an
+`ic_env` cookie for. Each of those entries, under `@ic-reactor/core` below,
+says what an app does about it. Both packages of the pair are pinned exactly,
+where 4.0.0 required `@candid-core/schema` `0.4.0` and `@candid-core/cli`
+`0.3.0`:
+
+- `@ic-reactor/core`: peer `@meantjs/schema` at exactly `0.6.0`;
+- `@ic-reactor/vite-plugin`: peer `@meantjs/cli` at exactly `0.5.0`, the
+  version its install hints name.
+
+`@meantjs/schema` 0.6.0 is `@candid-core/schema` 0.5.0 under the new name,
+and `@meantjs/cli` 0.5.0 is `@candid-core/cli` 0.4.0 under the new name, with
+one command, `meant`, where it had `candid-core-cli`. The `@candid-core/*`
+packages get no new version. Meant's release notes say what each of the four
+versions changed; what reaches an app through ic-reactor is below.
+
+The repin adds or removes no `@ic-reactor/*` export (core 13,
+`@ic-reactor/core/testing` 2, react 4, vite-plugin 2), and changes no call,
+key or error at run time.
+
+What an app on 4.0.0 does for the repin:
+
+1. Bump the three `@ic-reactor/*` packages and move to the new pair, then
+   remove the old one. The new names are new packages to npm, so each goes in
+   the section of `package.json` its install command names:
+
+   ```sh
+   npm install --save-exact @ic-reactor/core@4.1.0 @ic-reactor/react@4.1.0 @meantjs/schema@0.6.0
+   npm install --save-dev --save-exact @ic-reactor/vite-plugin@4.1.0 @meantjs/cli@0.5.0
+   npm uninstall @candid-core/schema @candid-core/cli
+   ```
+
+   Name only the packages the app has.
+
+2. Replace `candid-core-cli` with `meant` in the scripts that call the
+   generator: `"gen": "meant gen icrc1.did -o src/canisters"`. A one-off
+   command is `npx @meantjs/cli@0.5.0 gen …`: where `@meantjs/cli` is not
+   installed, `npx meant` fetches and runs another package, the one named
+   `meant` on npm.
+
+3. Regenerate every committed module with `meant gen` (the Vite plugin does
+   it when it starts). Each module's first two lines change, to
+   `// Generated by Meant from a Meant Contract. Do not edit.` and
+   `import * as $ from "@meantjs/schema";`, and every envelope beside one
+   names `meant` 0.1.0 as its producer. Until then `meant gen --check`
+   reports them `drifted` and exits 1. A module also changes where a declared
+   `blob`, `record {}` or `variant {}` is used: each use is written as the
+   shape itself (`Uint8Array`, `Record<string, never>`, `never`), where it
+   was written as the first alias of that shape. `memo: Subaccount | null`
+   becomes `memo: Uint8Array | null`, the same type, so code that imports
+   the generated names compiles unchanged.
+
+4. Replace `@candid-core/schema` with `@meantjs/schema` in every import of
+   your own code; the subpaths keep their names (`@meantjs/schema/codec`,
+   `/validate`, `/contract`). Keep one copy of the schema. Each package
+   declares its own brands, so a `Principal` typed by `@candid-core/schema`
+   passed where core expects one of `@meantjs/schema` fails with `TS2322` or
+   `TS2345`.
+
+5. Where your own code calls `decode` or `decodeArgs` from
+   `@meantjs/schema/codec`, the value is now the schema's own type, not
+   `unknown`, so a cast to a type the schema does not describe fails to
+   compile: drop the cast, or decode with the schema that describes the
+   type.
+
+### @ic-reactor/core
+
+#### Changed
+
+- Peer `@meantjs/schema` at exactly `0.6.0`, where it was
+  `@candid-core/schema` at exactly `0.4.0`. The package imports the schema
+  runtime under that name, in its JavaScript and its types.
+- The README and `llms.txt` name the new pair and `meant gen`.
+- A sign-out, an expired session or a switch of account now removes the
+  previous principal's reads from the client's `QueryClient`, before any
+  listener, or any component, hears of the change. Their keys already kept
+  them from the new caller's reads. Now they also leave memory, where
+  devtools, a read by key prefix (`getQueriesData({ queryKey: ["ic-reactor"] })`)
+  or a persister that saves the cache could still reach them in a shared
+  browser. The anonymous reads and the app's own queries stay. Migration:
+  none for an app that builds its options from `useClient()`. Switching back
+  to an account reads its data again instead of showing a cached copy.
+- On a canister's own `<id>.icp0.io` page, where the client believes the
+  `ic_env` cookie for canister ids without `allowEnvConfig`, it now takes
+  canister ids from it and nothing else. The `auth` factory is no longer
+  handed the cookie's `INTERNET_IDENTITY_PROVIDER` and
+  `PUBLIC_CANISTER_ID:internet_identity` there, so
+  `new AuthClient(network)` signs in with mainnet's Internet Identity.
+  Migration: an app on `icp0.io` that signs in with its own Internet Identity
+  names it in the factory,
+  `(network) => new AuthClient({ ...network, identityProvider: { authorizeUrl, canisterId } })`,
+  or writes `allowEnvConfig: true`.
+- Off a local page, when a page receives more than one `ic_env` cookie and
+  they differ, the client believes none of them: a `{ name }` target is
+  refused with the reason `untrusted_host` (a call on it rejects
+  `canister_id_unresolved`), and neither their root key nor their Internet
+  Identity is taken. Copies that are the same are believed, and a local page
+  reads the first, as before. Migration: none for an app that bakes its
+  canister ids into the build, as a mainnet app should. An app that names
+  canisters on `icp0.io` can be refused after a deploy that changes the
+  cookie, on a page whose browser still holds the previous copy for another
+  directory, until a page in that directory is loaded again.
+
+### @ic-reactor/vite-plugin
+
+#### Changed
+
+- Peer `@meantjs/cli` at exactly `0.5.0`, where it was `@candid-core/cli` at
+  exactly `0.3.0`. The plugin resolves `@meantjs/cli` from the app and runs
+  its `meant` bin for `gen`, `project` and `check`. In an app that has only
+  the old CLI, each canister fails to generate with
+  `cannot find @meantjs/cli from <root>` and the install line, a generation
+  failure that follows `failOnError`. The plugin's messages name the command
+  `meant`, and its install hints `@meantjs/cli@0.5.0`.
+
+### Docs
+
+- Every page, the README of each package and the skill name `@meantjs/schema`,
+  `@meantjs/cli` and `meant gen` where they named the candid-core pair and
+  `candid-core-cli gen`. The home page, its library card and the library
+  switcher call the library Meant.
+- The auth guide's "Data" note says what a sign-out removes from the cache,
+  and how to keep a persister from restoring a signed-in principal's reads on
+  a shared page. The consumer guide (`packages/core/llms.txt`) says the same.
+- The client guide says what the cookie is believed for on `<id>.icp0.io`,
+  and what copies of it that differ are believed for, and tells a mainnet app
+  to bake its canister ids into the build. The auth guide's identity-provider
+  rules, the Vite plugin guide and `packages/core/llms.txt` say the same.
+- The reads guide says what to certify: a read whose value decides where
+  value goes or what a person approves (a recipient, a deposit address, an
+  allowance, the details someone confirms), through a canister made with
+  `certified: true`, and the rest plainly. It says what a certified read
+  costs (as long as an update call, and cycles from the canister), and how
+  two canister objects of one canister keep the two apart. The consumer
+  guide (`packages/core/llms.txt`), its "Do not" list and the `ic-reactor`
+  skill say the same.
+- A "Deploy to a frontend canister" guide: the response headers to serve the
+  app with from DFINITY's asset canister (`.ic-assets.json5`) or from icp-cli's
+  static-site recipe (`_headers`), and what each one does. A
+  Content-Security-Policy that lets the page run its own files only and call
+  its own origin and `https://icp-api.io`, a `Cross-Origin-Opener-Policy` of
+  `same-origin-allow-popups` (`same-origin` cuts off the Internet Identity
+  window, and the sign-in never completes), the asset canister's `hardened`
+  policy, and `allow_raw_access: false`. It says what the HTTP gateway checks
+  on `<id>.icp0.io` and not on `<id>.raw.icp0.io`, why a raw origin must not
+  be an Internet Identity alternative origin, and how to let a copy button
+  write to the clipboard. The consumer guide (`packages/core/llms.txt`) gives
+  the same `.ic-assets.json5`.
+- The three package READMEs, which npm shows, link the 4.x docs: Getting
+  started and the package's own page (the Vite plugin guide for the plugin).
+  They linked only the 3.x docs before. Core's README installs the generator
+  too and shows a first read, and its npm description says what the package
+  is ("IC Reactor Core Library" before).
+- Getting started, the root README and the core and Vite plugin READMEs say
+  to install the CLI at the version they name: without a version, npm installs
+  the newest CLI, and when that one pairs with another schema, the install
+  stops with `ERESOLVE` in an app on `@ic-reactor/core`.
+- The docs' overview page lists the three build guides and the "Deploy to a
+  frontend canister" guide, and says that the CHANGELOG's "Unreleased"
+  section lists what `main` has and npm does not. Getting started's "Next"
+  list and the root README link the deploy guide, and the examples index and
+  the root README say the Vite wallet deploys itself with security headers.
+  The root README names b3pay.net/docs/ic-reactor as the docs site.
+- The agent tools guide no longer announces a library as "coming next": it
+  names Meant's `@meantjs/tools`, which generates tools of the same shape
+  from a profile, and links its guide.
+- The repository's issue forms offer `@ic-reactor/vite-plugin` in place of the
+  3.x parser for a feature request, suggest Node 22.12.0, the floor, in a bug
+  report, and link the private security report and the docs (not published).
+
+### Examples (not published)
+
+- The five examples move with the repin: they depend on the new pair, their
+  `gen` scripts run `meant gen`, and their modules are regenerated. Canister
+  Studio imports the compiler library from `@meantjs/cli`. Installed from
+  npm (`pnpm test:examples:published`), they wait for this release.
+- The Vite wallet reads its address book certified, through a second
+  canister object of the backend made with `certified: true`: a contact
+  decides where a payment goes. Its optimistic adds and removes find the
+  list by that read's key, and a test checks the list is read as a
+  replicated call.
+- `vite-wallet` deploys the app itself too: `pnpm icp:deploy` builds it and
+  uploads it to an asset canister, `frontend`, served at
+  http://frontend.local.localhost:8000 with the guide's headers
+  (`public/.ic-assets.json5`, scenario 10).
+
+### CI (not published)
+
+- The e2e suite deploys the guide's headers to both asset canisters, with the
+  recipe versions the guide names, and checks what they serve through the
+  local HTTP gateway (`e2e/src/frontend-headers.test.ts`, seven more cases):
+  every header, certified; the asset canister's raw host redirected with its
+  path and query; and the guide's copy of `.ic-assets.json5` and its
+  `_headers` the same as what was deployed.
+- The docs also publish to b3pay.net, as `b3pay-module.json` describes: the
+  pages, the API reference and `packages/core/llms.txt`, served at
+  `/docs/ic-reactor/` once b3pay.net's registry reads this repository's
+  `b3pay-site` branch. The new `Docs on b3pay.net` workflow builds and checks
+  the module with b3pay.net's reusable workflow on pull requests that touch
+  the docs, and on `main` commits it to that branch. The `/v4/` site and its
+  deploy are unchanged. `pnpm -C docs run api` writes the API reference alone,
+  and its files are now named in lowercase, as their routes are; no address
+  changes.
+- `Docs on b3pay.net` runs b3pay.net's reusable workflow from that site's
+  `main` (67911ef), and checks the module with the site's tools from `main`,
+  now that the folder items its sidebar lists are there.
+- ic-reactor.b3pay.net keeps the 3.x and 2.x docs, and sends readers of the
+  4.x docs and of Candid Core's pages to b3pay.net: each page under `/v4/`
+  and `/candid-core/` moves to the same page at
+  `https://b3pay.net/docs/ic-reactor/` or `https://b3pay.net/docs/meant/`,
+  with its query and fragment, and `/` goes to
+  `https://b3pay.net/docs/ic-reactor/`. The 4.x build's Markdown copies and
+  `llms.txt` stay under `/v4/`, and `/llms.txt` is still the 4.x guide.
+  `scripts/assemble-docs-site.mjs` takes `--v4-moved-to` and
+  `--candid-core-moved-to`, and the deploy stops before it publishes when
+  b3pay.net does not serve IC Reactor's docs, with the API reference, or
+  Meant's.
+- The `v4` branch, where 4 was developed until the 4.0 GA flip, is retired.
+  CI, e2e, CodeQL, the dependency review and the two published-package checks
+  run on `main` only, and `verify-test-fails` takes its default base from
+  `main` alone.
+- `stack.json` names the Meant release this branch is tested against,
+  `@meantjs/schema` 0.6.0 and `@meantjs/cli` 0.5.0, in one place.
+  `pnpm check:stack`, a new step of the Lint & Type Check job, fails when a
+  Meant pin in a tracked `package.json`, an `@meantjs/<name>@<version>` in a
+  `package.json` value or the docs, a docs peer-table row or one of the two
+  pins in code names another version or a range, outside the changelogs and
+  the manifest's `frozen` paths (`evals/`). A repin changes `stack.json` and
+  runs `pnpm sync:stack`, which rewrites them in place, the examples
+  included (CONTRIBUTING.md, "The Meant pins"). Dependabot no longer opens
+  `@meantjs/*` bumps, and the vite plugin's tests read the CLI version they
+  expect from `MEANT_CLI_VERSION`.
+
+## core, react, vite-plugin 4.0.0
+
+Prepared on 2026-10-25. 4.0.0 is the first stable release of the ic-reactor
+4 line (milestone 1, #790). It is published from `main` after the 4.0 GA
+flip, under npm's `latest` dist-tag, so a plain
+`npm install @ic-reactor/core` installs 4. The 3.x line gets security fixes
+only, until 90 days after this release.
+
+Changes since 4.0.0-beta.8: the version only. No export, type, peer or
+behaviour changed (core 13, `@ic-reactor/core/testing` 2, react 4,
+vite-plugin 2).
+
+It requires the candid-core pair that beta.5 moved to, both pinned exactly:
+
+- `@ic-reactor/core`: peer `@candid-core/schema` at exactly `0.4.0`;
+- `@ic-reactor/vite-plugin`: peer `@candid-core/cli` at exactly `0.3.0`.
+
+### Upgrading from a beta
+
+An app on beta.8 bumps all three packages to `4.0.0`. A module generated for
+beta.8 need not be regenerated.
+
+An app on an earlier beta also reads each section below, from the one after
+its version up to beta.8. What changes code on the way:
+
+- **From beta.7** (4.0.0-beta.8). Nothing changes code. Restart the dev
+  server after a local network restarts: once the network the Vite plugin
+  detected stops, `{ name }` canisters reject `canister_id_unresolved` until
+  the server restarts (#881). On Windows, the plugin's messages write a path
+  with `/` (#905).
+- **From beta.6** (4.0.0-beta.7). A re-send that `client.resendOf()` offered
+  and that did not run rejects `outcome_unknown` with `mayHaveExecuted: true`
+  (#960). **Breaking:** a Vitest run that loads the Vite plugin fails at
+  startup when a canister fails to generate and `failOnError` is omitted
+  (#967). Every network host needs its scheme, and `createClient` throws on
+  an app shell's page with `network: "env"` (#974). On localtunnel and VS
+  Code dev tunnel pages `allowEnvConfig: true` throws (#961, #962), and with
+  `network: "env"` a dev page opened over Tailscale, a dev tunnel or a LAN name
+  with no dot calls its own origin, never mainnet (#962). The beta.7 section
+  lists the smaller changes.
+- **From beta.5** (4.0.0-beta.6). **Breaking:** Node 22.12 or newer (#896);
+  `createClient` refuses a value its types forbid with a `TypeError` (#895);
+  `useClient()` returns a new object for each caller, so list it in the
+  dependencies of what is built from it (#894). A first send refused with
+  `caller_changed` ran nothing (#893). An object of the `Client` type written
+  by hand needs `time`, `encode` and `canisterId`. The beta.6 section lists the
+  smaller changes (#900 to #903, #911, #912).
+- **From beta.4 or earlier** (4.0.0-beta.5). The candid-core pair moves to
+  schema `0.4.0` and CLI `0.3.0`. npm does not resolve a partial upgrade of
+  the five packages cleanly, so move them in one command, naming only the
+  packages the app has, and keep one copy of the schema:
+
+  ```sh
+  npm install --save-exact @ic-reactor/core@4.0.0 @ic-reactor/react@4.0.0 @ic-reactor/vite-plugin@4.0.0 @candid-core/schema@0.4.0 @candid-core/cli@0.3.0
+  ```
+
+  Then regenerate every committed module with `candid-core-cli gen` (the Vite
+  plugin does it when it starts). `client.queryOptions` no longer compiles
+  for an update or a oneway method of a generated `Actor` (#851): a write
+  goes through `client.mutationOptions`, and an update that answers the same
+  however often it runs takes `{ update: "idempotent" }`. The Vite plugin
+  refuses a key that is no option and a value an option does not take, where
+  beta.4 read them without a word.
+
+- **From beta.3 or earlier** (4.0.0-beta.4). Nothing breaks, except an object
+  of the `Client` type written by hand, such as a fake: the type gains
+  `resendOf`. New: `isReactorError(error, canister, method)` types a direct
+  call's `err` as that method's `Err` arm (#849), and `client.resendOf` sends
+  a write again exactly as it was sent after a failure that left its outcome
+  unknown, for a method the app says deduplicates (#850). The Vite plugin
+  writes a missing `didFile` from the live canister's certified interface
+  when the entry names a `canisterId`.
+- **From beta.2 or earlier** (4.0.0-beta.3). **Breaking:** `network: "local"`
+  is icp-cli's `http://127.0.0.1:8000`; an app on a dfx replica names it as
+  `network: { host: "http://127.0.0.1:4943" }`. The `auth` factory is handed
+  the client's network: `auth: (network) => new AuthClient(network)`.
+- **From beta.1** (4.0.0-beta.2). The candid-core pair moved to its first
+  stable releases. TanStack Query's `useSuspenseQuery` and
+  `useSuspenseQueries` take `client.queryOptions()` without a cast (#828);
+  the beta.2 section lists the few type-level uses that stop compiling.
+
+The guide (`llms.txt`) and the skill now say they apply to 4.0.0, and the
+five examples pin `^4.0.0`. With the GA flip (#836), the packages' READMEs
+and the skill install 4 from `latest` (bare), not `@beta`, and the READMEs
+drop the prerelease note.
+
+For the whole change from 3.x, read the 4.0.0-beta.8 to 4.0.0-beta.1 sections
+below, and
+[Migrating from 3.x](https://ic-reactor.b3pay.net/v4/migrating-from-3/),
+with the table of every removed 3.x name and what replaces it.
+
+### GA exit criteria
+
+- The four examples (#788), the 4 docs and the "Removed in 4.0" table
+  (#789), and the runtime-trap suite with the real-replica e2e rewrite
+  (#787) are done.
+- The GA eval, Addendum 4 of
+  [`evals/PREREGISTRATION.md`](./evals/PREREGISTRATION.md), ran on the
+  published 4.0.0-beta.1. GA ships on the result of Addendum 4, stated as
+  recorded: rule 1 was not met as written, because the leak audit flagged
+  react-wallet/`v4`#14's read of its own persisted tool output; all 80 runs
+  were safe, and the pooled bound held in both analyses (−0.0897 main,
+  −0.0876 intent-to-treat, against −0.10). The result and the owner's
+  decision are recorded there, under "Result of Addendum 4" and "Decision on
+  the result of Addendum 4" (#844).
+
+## core, react, vite-plugin 4.0.0-beta.8
+
+Prepared on 2026-10-25. It goes out under npm's `beta` dist-tag, as
+`@ic-reactor/core@beta`; `latest` stays 3.x until 4.0 GA. Changes since
+4.0.0-beta.7.
+
+This release carries the two Vite plugin fixes that landed after beta.7, the
+watch on a local network that stopped (#881) and the Windows paths (#905), so
+that 4.0.0 ships no code a prerelease did not carry first. core and react
+change no code: core's only changes are the JSDoc of `ReactorError.expiresAt`
+(#924) and a reworded sentence of its guide, `llms.txt`.
+
+No export is added or removed (core 13, `@ic-reactor/core/testing` 2, react 4,
+vite-plugin 2), no public type changes, and the candid-core pair is unchanged:
+core peers `@candid-core/schema` at exactly `0.4.0` and the Vite plugin
+`@candid-core/cli` at exactly `0.3.0`, so a module generated for beta.7 need
+not be regenerated.
+
+What an app on beta.7 does:
+
+1. Bump all three `@ic-reactor/*` packages to `4.0.0-beta.8` in one
+   `npm install`. react 4.0.0-beta.8 peers core at exactly `4.0.0-beta.8`, so
+   they move together. The command keeps each package in the section of
+   `package.json` it is in:
+
+   ```sh
+   npm install --save-exact @ic-reactor/core@4.0.0-beta.8 @ic-reactor/react@4.0.0-beta.8 @ic-reactor/vite-plugin@4.0.0-beta.8
+   ```
+
+   Name only the packages the app has.
+
+2. Restart the dev server after a local network restarts (#881). When the
+   network the plugin detected stops, `vite dev` and `vite preview` warn
+   once, and page loads get the `ic_env` cookie without the detected canister
+   IDs and root key (with canisters configured, no cookie at all, and the
+   browser's copy is cleared), so `{ name }` canisters reject
+   `canister_id_unresolved` until the server restarts. `vite dev` reloads the
+   pages it has open; under `vite preview`, reload them yourself. The cookie
+   used to keep naming the old canister IDs, which a restarted network can
+   give to other canisters.
+3. On Windows, match the plugin's messages on a path written with `/`, such
+   as `did/ledger.did`, where they said `did\ledger.did` (#905).
+
+The guide (`llms.txt`) and the skill now say they apply to 4.0.0-beta.8, and
+the five examples pin `^4.0.0-beta.8`.
+
+### @ic-reactor/vite-plugin
+
+#### Fixed
+
+- The dev server and the preview server stop vouching for a local network that
+  stopped (#881). While serving, the plugin holds a connection to the detected
+  network. When the network stops, it warns once, page loads get the
+  `ic_env` cookie without the detected canister IDs and root key (with
+  canisters configured, no cookie at all) until the server restarts, and
+  `vite dev` reloads the pages it has open. Detection had
+  stopped running once it was complete, so after `icp network stop`, `start`
+  and `icp deploy` the cookie kept naming the old canister IDs under the same
+  root key, and a restarted icp-cli network can give those IDs to other
+  canisters: a page could call a different canister than the one it named.
+  `{ name }` canisters now reject `canister_id_unresolved` instead. Nothing
+  detects the network again; restarting the dev server does.
+- A page load with no cookie to send, while no network is detected, clears an
+  `ic_env` cookie the browser kept from an earlier dev server, which
+  `network: "env"` believed (#881).
+- On Windows, the plugin's messages name a path relative to the project with
+  `/`, as the config writes it (`did/ledger.did`), where they named
+  `did\ledger.did` (#905). The plugin's whole test suite now runs on Windows
+  in CI, where only the tests of how it starts `icp` ran.
+
+### Docs
+
+- `SECURITY.md` describes ic-reactor 4 (#909). Its threat model covers core
+  and react (cache scoping, root keys, the `ic_env` cookie's canister IDs, a
+  write misreported as not executed) and the Vite plugin (the
+  `candid-core-cli` child process, live interfaces and `verify: "live"`, the
+  cookie and the `/api` proxy, generated files). It says that
+  `@ic-reactor/core/testing` is not for production and sends Candid decoding
+  bugs to candid-core. The 3.x threat model stays on the `v3` branch.
+
+- A Versioning and support page (#897). It says what a 4.x patch, minor and
+  major may change. It names the unions that may grow in a minor
+  (`ReactorErrorKind`, `ReactorError.code`, `AuthState.status`) and the
+  interfaces to consume rather than implement (`Client`, `Canister`, `Resend`,
+  `ReactorError`; `AuthLike` gains only optional members). It says how
+  candid-core releases reach an app while the pins stay exact, what a
+  dehydrated cache from a newer version does, and the oldest Node,
+  TypeScript, React, TanStack Query, Vite and `@icp-sdk/core` supported.
+
+- The errors page and `ReactorError.expiresAt`'s JSDoc cite the IC interface
+  specification for what the expiry proves (#924): the IC neither accepts a
+  call nor moves it from `received` to `processing` once its `ingress_expiry`
+  is past, so no send of the write can start after it. They also say why that
+  settles only a method that commits without awaiting another canister: the
+  expiry does not stop a send that started before it.
+
+### Examples (not published)
+
+- `canister-studio` requires zod `^4.6.6`, past the high advisory
+  GHSA-mrhx-c7xc-m3w5, and resolves 4.6.7 (#1015).
+
+### CI (not published)
+
+- `release.yml` publishes what it tested, and only after CI passed on the
+  tagged commit (#909):
+  - Preflight packs core, react and vite-plugin from the build it tested and
+    uploads the tarballs. The publish job publishes those three back to back,
+    with no install, build or test between them, so a failing test can no
+    longer stop a release after core is out and before react is.
+  - A new job waits for the push runs of `ci.yml` and `e2e.yml` on the
+    tagged commit and fails unless both succeeded, so lint, the export
+    budget, the trap and fault checks, the snippets, the peer floors, the
+    examples and the e2e suite gate the publish too. The approval is asked
+    for only after it passes.
+  - The publish job holds `id-token: write` and nothing else. It has no
+    checkout, install, cache or build, and installs npm 11.21.0 exactly,
+    where it installed `npm@^11.5.1`. A re-run skips a package npm already
+    has from the same tarball, so a release that stopped half-way can be
+    finished.
+  - The GitHub release is made by a job of its own, the only one with
+    `contents: write`, once all three packages are out.
+- The Audit check passes again (#1015). The root `pnpm.overrides` lift undici
+  past the high advisory GHSA-xjj6-f33q-929c in the docs site's tree (7.30.1
+  under astro, 8.12.3 under linkinator) and happy-dom past GHSA-834v-8h66-3h79;
+  happy-dom, an optional peer of Vitest that no suite uses, is no longer
+  installed.
+- `release.yml`'s publish job names each tarball `./tarballs/<file>.tgz`.
+  npm read `tarballs/<file>.tgz` as a GitHub repository, so the first run for
+  the `v4.0.0-beta.8` tag failed on `git ls-remote` with nothing published.
+  `scripts/release-workflow.test.mjs` checks every path the job publishes.
+
+## core, react, vite-plugin 4.0.0-beta.7
+
+Prepared on 2026-10-22. It goes out under npm's `beta` dist-tag, as
+`@ic-reactor/core@beta`; `latest` stays 3.x until 4.0 GA. Changes since
+4.0.0-beta.6.
+
+This release carries the fixes of the audit of beta.6 (#960 to #980), the
+`client.time` fix under jsdom (#949), the redirect sign-in fix (#913) and the
+Internet Identity guide (#914), so that 4.0.0 ships no code a prerelease did
+not carry first. One change is marked breaking (the Vite plugin under Vitest),
+and several more change what an app sees; the steps below list them.
+
+No export is added or removed (core 13, `@ic-reactor/core/testing` 2, react 4,
+vite-plugin 2), no public type changes, and the candid-core pair is unchanged:
+core peers `@candid-core/schema` at exactly `0.4.0` and the Vite plugin
+`@candid-core/cli` at exactly `0.3.0`, so a module generated for beta.6 need
+not be regenerated.
+
+What an app on beta.6 does:
+
+1. Bump all three `@ic-reactor/*` packages to `4.0.0-beta.7` in one
+   `npm install`. react 4.0.0-beta.7 peers core at exactly `4.0.0-beta.7`, so
+   they move together. The command keeps each package in the section of
+   `package.json` it is in:
+
+   ```sh
+   npm install --save-exact @ic-reactor/core@4.0.0-beta.7 @ic-reactor/react@4.0.0-beta.7 @ic-reactor/vite-plugin@4.0.0-beta.7
+   ```
+
+   Name only the packages the app has.
+
+2. Treat a re-send that `client.resendOf()` offered and that did not run as
+   any other `outcome_unknown` (#960). Refused before it went out, or turned
+   away with an HTTP 4xx or reject code 1 to 3, it used to reject
+   `cancelled`, `invalid_args`, `not_delivered` or `rejected`; it now rejects
+   `outcome_unknown` with `mayHaveExecuted: true`, since the write it re-sends
+   may have run. `client.resendOf()` offers the write again, and a mutation
+   invalidates its reads. Read `kind` and `mayHaveExecuted` first, and read
+   the state back. The error keeps the re-send's `code`, which says only why
+   the re-send did not go out: unlike a first send's (#893), its
+   `caller_changed` does not mean nothing ran, so do not call `mutate()`
+   again on it.
+3. Check a Vitest run that loads the Vite plugin (breaking, #967). A canister
+   that fails to generate now fails the run at startup when `failOnError` is
+   omitted. Fix the failure, set `IC_REACTOR_VERIFY=0` to skip the live check
+   (`verify: "live"`) in an offline run, or set `failOnError: false`.
+4. Write the scheme in every network host (#974):
+   `{ host: "http://localhost:4943" }`, `ICP_HOST=http://localhost:8000`. On
+   an app shell's page, such as `capacitor://localhost`, pass
+   `network: { host }` in place of `"env"`. Such a client used to be built
+   and then fail on every call; `createClient` now throws.
+5. Check where pages run:
+   - on a localtunnel page (`*.loca.lt`) or a VS Code dev tunnel page
+     (`*.devtunnels.ms`), `allowEnvConfig: true` now throws, whatever the
+     network; name canisters with `{ id }` there (#961, #962);
+   - with `network: "env"`, a dev page opened over Tailscale, by a dev tunnel
+     or by a LAN name with no dot now calls its own origin, never mainnet; a
+     production app served from such a name needs `network: "ic"` or a
+     `{ host, rootKey }` network (#962);
+   - a page or host whose name ends with a dot now counts as the name without
+     it, except that `<id>.icp0.io.` does not believe the cookie's canister
+     ids by default (#975).
+6. Smaller changes, each with its migration in the entries below: an `auth`
+   factory returns the auth itself, synchronously, and an async one's
+   `TypeError` now comes from `signIn()` (#972); a signer that declines a
+   first send, such as a user who closes a passkey prompt, now rejects
+   `not_delivered` with `mayHaveExecuted: false`, not `outcome_unknown`,
+   while a declined re-send stays `outcome_unknown` (#963); and
+   `client.time(canister)` now stops waiting at the canister object's
+   `timeoutMs` (#973).
+
+The guide (`llms.txt`) and the skill now say they apply to 4.0.0-beta.7, and
+the five examples pin `^4.0.0-beta.7`.
+
+### @ic-reactor/core
+
+#### Changed
+
+- A re-send of a write `client.resendOf()` offered that did not run now
+  rejects `outcome_unknown` with `mayHaveExecuted: true`, and
+  `client.resendOf()` offers the write it re-sends again (#960). That covers a
+  re-send refused before it went out (code `caller_changed`, `target_changed`,
+  `arg_changed`, `client_disposed`, or any other refusal before sending,
+  including the one of a mutation built from a pinned `useClient()` view), and
+  one turned away when sent (an HTTP 4xx such as 429, or reject code 1 to 3). Each proves only that the re-send
+  did not run, while the earlier attempt may have: the error used to say
+  `cancelled`, `invalid_args`, `not_delivered` or `rejected` with `mayHaveExecuted: false`,
+  so `resendOf` offered nothing after it, a mutation did not invalidate its
+  reads, and an app could tell the user the transfer had not happened. The
+  error keeps the re-send's `code`, `httpStatus` and `rejectCode`, has the
+  re-send's own error as its `cause`, and carries the latest `expiresAt` of
+  the write's sends. A timeout before the re-send went out already worked
+  this way; it now also carries `expiresAt`. A re-send the canister answers (`canister_err`, such as
+  `Duplicate`) and the same failures of a first send are unchanged.
+  Migration: an app that branched on `kind` for a refused re-send reads its
+  `code`, `httpStatus` or `rejectCode` instead, and treats it as any other `outcome_unknown`: read the
+  state back. That `code` says only why the re-send did not go out: unlike a
+  first send's (#893), its `caller_changed` does not mean nothing ran.
+- `createClient` now also throws a `TypeError` for `allowEnvConfig: true` on
+  a localtunnel page (`*.loca.lt`) or a VS Code dev tunnel page
+  (`*.devtunnels.ms`) (#961). Neither parent is a public suffix, so any other
+  tunnel can set the `ic_env` cookie these pages read, as on the `ic0.app`,
+  Codespaces and Gitpod pages #900 refuses. The client used to believe that
+  cookie's canister ids and Internet Identity URL there, and with
+  `network: "env"` on `*.loca.lt` its root key too. Migration: as for #900,
+  name the canisters with `{ id }` and a replica that is not mainnet with
+  `{ host, rootKey }`.
+- A signed-in render of `useClient()` converts the caller's principal to text
+  once, where it did three times (#977). The client now hands back a view it
+  already made without reading who is signed in, and drops the views it no
+  longer needs only when it makes a new one. So the view of a user who signed
+  out, or whose session expired, is kept until the next view is made, and
+  that user signing in again before then gets the same object back. Measured
+  in the React tests with React's production build; its development build
+  reads `useSyncExternalStore`'s snapshot twice per render, so there the count
+  goes from 4 to 2.
+
+#### Fixed
+
+- A write whose signer fails, such as a user who declines a passkey or
+  hardware-wallet prompt, now rejects `not_delivered` with
+  `mayHaveExecuted: false` (#963). Nothing was sent, but the agent signs
+  outside its own error handling, so the failure used to read as
+  `outcome_unknown` with `mayHaveExecuted: true`: `client.resendOf()`
+  offered it, a mutation invalidated its reads, and an app could tell the
+  user the payment may have gone through. The client now hands the agent an
+  identity that marks its signing failures, and the error's `cause` is the
+  signer's own error. A signer that fails on a `read_state` poll of an update
+  the IC already took still rejects `outcome_unknown`, and says the call was
+  sent. A read whose signer declines the `read_state` for the subnet's keys
+  rejects `not_delivered` and is no longer retried, which asked the signer
+  again on every attempt. A re-send that `client.resendOf()` offered and the
+  signer declines stays `outcome_unknown` and offered, as on v4: the write
+  it re-sends may have run. An `AbortError` from the signer is still
+  `cancelled`, as every abort is.
+- `network: "env"` no longer falls back to mainnet on a dev page opened over
+  Tailscale (a 100.64/10 address or a `*.ts.net` name), by a VS Code dev
+  tunnel (`*.devtunnels.ms`) or by a LAN name with no dot
+  (`http://devbox:5173`) (#962). An app that names its canisters with
+  `{ id }` from its build-time env sent its local ids to mainnet there. Such
+  a page now routes through its own origin, as #902 made LAN addresses and
+  the other tunnels do: the cookie is not believed and no root key is taken
+  or fetched, so certified calls fail verification instead of reaching
+  mainnet. A name with no dot counts only on an `http:` or `https:` page, so
+  a browser extension's or a desktop app's page falls back as before.
+  `allowEnvConfig: true` is refused with a `TypeError` on a dev tunnel page,
+  as on Codespaces: `devtunnels.ms` is not a public suffix, so any other
+  tunnel could set the cookie whose root key the page would take. Migration:
+  a production app served from such a name now calls its own origin; give it
+  `network: "ic"` or a `{ host, rootKey }` network.
+- A page or agent host whose name ends with a trailing dot
+  (`https://victim.ic0.app./`) now counts as the name without it (#975). The
+  URL parser keeps the dot, so such a page got past the rule that refuses
+  `allowEnvConfig: true` under `ic0.app`, `github.dev` and `gitpod.io`, and
+  the client believed the cookie's canister ids and Internet Identity URL
+  there. Such a page is now refused the opt-in and routes as the name without
+  the dot does, and a mainnet host written that way still never takes the
+  cookie's root key. A `localhost.` page or host is local, as `localhost` is:
+  the cookie is believed there and the replica's root key fetched. One rule
+  stays closed: unlike `<id>.icp0.io`, `<id>.icp0.io.` does not believe the
+  cookie's canister ids by default.
+- An auth factory that returns something other than an auth, such as a
+  Promise, is called once (#972). An `async` factory returns a Promise, and so
+  does `auth: () => AuthClient.create()` with `@icp-sdk/auth` 5 or earlier.
+  Its result was checked after the step that records a factory's
+  failure, so the client built a new auth on every `caller()`,
+  `authState()`, `subscribe()` and render, threw a `TypeError` from each,
+  and leaked every auth it built. It now fails as a factory that throws
+  does: the client calls anonymously, so public reads still work, logs the
+  error once in development, and `signIn()` and `signOut()` reject with the
+  `TypeError`, which names what the result lacks. Migration: catch the
+  `TypeError` from `signIn()`, not from the first read, and return the auth
+  itself, synchronously, with `AuthClient` from `@icp-sdk/auth` 10:
+  `auth: (network) => new AuthClient(network)`.
+- `client.time(canister)` now stops waiting once the canister object's
+  `timeoutMs` passes, as a call through that object does (#973). It awaited
+  its `read_state` with no bound, so a node that never answered left it
+  pending forever, and with it any flow that awaits `client.time(ledger)`
+  before a transfer. It now rejects `cancelled`, code `"timeout"`, with
+  `mayHaveExecuted: false`, so such a flow fails before it sends anything,
+  and a `read_state` not yet sent when the bound passes is never sent.
+  Without `timeoutMs` it waits as before, as long as the `fetch` in use does.
+- `createClient` throws a `TypeError` for a network host the agent cannot
+  call over `http:` or `https:` (#974). It accepted any host the URL parser
+  read: `{ host: "localhost:4943" }` and `ICP_HOST=localhost:8000` on a server
+  read as the scheme `localhost:`, and `ftp:`, `javascript:` and `data:` URLs
+  passed too, so the client was built and every call then failed. The message
+  names the scheme it read. Under `network: "env"` it also says that the host
+  came from the page's origin or from `ICP_HOST` or `IC_HOST`, since an app
+  shell's page, such as `capacitor://localhost`, now throws there too.
+  Migration: write the scheme, `{ host: "http://localhost:4943" }` or
+  `ICP_HOST=http://localhost:8000`, and on an app shell's page pass
+  `network: { host }` in place of `"env"`.
+- A page with an element whose id is `Deno`, or a frame named `Deno`, no
+  longer counts as a server (#976). The client knew Deno by a `Deno` global,
+  which in a browser such an element is (`window.Deno`), and user content
+  that a sanitizer such as DOMPurify keeps can carry the id. On such a page
+  the auth was never built, `signIn()` rejected as on a server, the `ic_env`
+  cookie was not read, so `{ name }` targets were refused as `no_browser`,
+  and reads were not retried. Deno is now known by its `Deno.version.deno`,
+  and a page where reading it throws (a cross-origin frame named `Deno`) is
+  a page too.
+- `client.time(canister)` resolves under a test's jsdom environment, where the
+  fake replica refused a signed-in client's signature (#949). There
+  `TextEncoder` hands out Node's bytes, which are not the global (jsdom's)
+  `Uint8Array`, and the agent's CBOR encoder sent the `time` label built from
+  them as a map, so the request the replica received was not the one the
+  agent signed. The label is now copied into the global `Uint8Array`. In a
+  browser, `TextEncoder` and the agent share one realm, so an app there is
+  not expected to have been affected.
+- Two `client.signIn()` calls with the same options in one synchronous run are
+  now one sign-in: the second returns the first one's promise, and the auth is
+  asked once (#913). `StrictMode` makes such a pair in development when an
+  effect calls `signIn()`, as a sign-in route does for Internet Identity's
+  `transport: "redirect"`. There, the two calls put two requests in one
+  redirect, and both sign-ins failed on the load Internet Identity returned
+  to. Options are the same when they are the same value, or objects with the
+  same keys and values (`Object.is`, one level deep). A call in a later run,
+  or with other options, signs in again, and a call after `dispose()`
+  rejects, as before. `useAuth().signIn` goes through the client, so it joins
+  the same way. The auth guide has a new "Redirect
+  sign-in" section: the route for Vite, Next.js and TanStack Start, entered
+  with a full page load, the `/.well-known/ii-auth-callbacks` file, and
+  `memoize`.
+
+### @ic-reactor/react
+
+#### Fixed
+
+- A `ReactorProvider` handed the view an outer provider's `useClient()`
+  returned (`client={() => view}`, as the README and the SSR guide describe)
+  no longer removes the outer client from the registry that disposes the
+  clients of renders React throws away (#965). Both providers render in the
+  same pass, so in development every first mount logged the "lazily shared"
+  warning for correct code, and when a Suspense boundary above the outer
+  provider threw that render away, the outer client and the auth listening
+  to the window were never disposed.
+
+### @ic-reactor/vite-plugin
+
+#### Changed
+
+- **Breaking for a Vitest run that loads the plugin and whose generation
+  fails:** under Vitest (mode `test`), a canister that fails to generate now
+  fails the run at startup when `failOnError` is omitted, as under
+  `vite build` (#967). Vitest runs the plugin as a dev server, so the failure
+  used to be only logged, and the tests ran against the modules left over
+  from the last good run: a `.did` that no longer parsed still reported its
+  tests passing. Every failure counts: a `.did` that does not parse, a fetch
+  that fails, a missing `@candid-core/cli`, refused canister options, an
+  `onGenerated` that throws, and a live check (`verify: "live"`,
+  `IC_REACTOR_VERIFY`) that fails or cannot reach the network. Migration: fix
+  the failure; set `IC_REACTOR_VERIFY=0` for an offline test run with the
+  live check on; or set `failOnError: false` to log the failure and run the
+  tests anyway. A Vitest config that does not load the plugin (a
+  `vitest.config.ts` without it, as in the examples) is not affected.
+- The package no longer publishes its TypeScript source (#978). It shipped
+  `src` beside `dist` with no source map or declaration map pointing at it,
+  and nothing in `dist` refers to it. Measured with `npm pack`: 17 files and
+  487,020 B unpacked before, 7 files and 268,245 B now.
+
+#### Fixed
+
+- `vite build --watch` generates a canister again when its module or envelope
+  was deleted, though its `.did` is unchanged (#980). A rebuild skipped a
+  canister whose `.did` text had not changed without looking for the files,
+  so after the module was deleted every rebuild failed until the `.did`
+  changed.
+- On Linux and macOS, an `icp` that does not answer within 10 seconds is
+  killed together with the native binary it started (#980). npm's `icp` is a
+  Node script that starts that binary, and the timeout killed only the
+  script, so while detection was incomplete each page load could leave one
+  more `icp` running. `icp` now runs in a session and process group of its
+  own there, and the timeout kills the group. So the terminal's Ctrl-C no
+  longer reaches an `icp` that is running when the dev server is stopped: it
+  ends on its own, or, if it hangs, keeps running, as every timed-out one did
+  before.
+- `icp` is no longer asked for the ID of a canister whose `canisterId` is
+  configured, which wins over what `icp` says anyway: one `icp` process fewer
+  per page load while detection is incomplete (#980). `internet_identity` is
+  still asked for, since what `icp` reports for it decides whether the cookie
+  also names icp-cli's built-in Internet Identity.
+
+### Docs
+
+- The auth guide's "Identity attributes" shows the flow DFINITY's
+  `identity-attributes` library (Motoko and Rust) expects, end to end: the
+  attributes reach the canister as the finish call's `sender_info`, not as
+  arguments. The nonce goes through a second client built with
+  `new AnonymousIdentity()`, `signIn()` and `requestAttributes()` start
+  together, and the finish call goes through a client built with an
+  `AttributesIdentity`, on the same network and with the signer the factory is
+  handed. It says to trust `verified_email`, what a refusal and an untrusted
+  signer reject as, and what the canister must check. The consumer guide
+  (`packages/core/llms.txt`) states the same, and the migration guide's recipe
+  points at it (#914).
+- The auth guide has a table of what Internet Identity offers beyond a plain
+  sign-in, 2.0's features among them, and the `AuthClient` option for each:
+  one-click OpenID and organization SSO, session length,
+  `disableBrowserActivity`, `namespace`, `derivationOrigin`, a sign-in shared
+  by sibling subdomains, and redirect sign-in (#914).
+- The auth guide installs `@icp-sdk/auth@^10`, since npm's newest is 11, and
+  says that on dfx the client hands the factory icp-cli's built-in Internet
+  Identity, which dfx does not serve (#914).
+- `signIn()` rejects with the auth's own errors, never a `ReactorError`, as
+  the auth guide's "useAuth" and the consumer guide now say; the consumer
+  guide's example catches it (#914).
+
+### Examples (not published)
+
+- `canister-studio`'s Safety lab now says what a re-send refused as another
+  sender rejects with, and checks it: `outcome_unknown` / `caller_changed`,
+  with `mayHaveExecuted: true`. The texts of the error kinds now say that a
+  held re-send that did not run is `outcome_unknown`, no longer
+  `invalid_args` or `cancelled` (#960).
+
+### CI (not published)
+
+- `pnpm verify:test-fails` compares with where the branch left v4: the
+  merge-base with `v4` or `origin/v4`, whichever HEAD left last, instead of
+  `main`, the 3.x line, whose sources cannot load v4's tests (#968). With
+  neither ref, it asks for `--base`. A test with no result on the base,
+  because its file did not load there, a hook failed there or the test was
+  skipped there, is listed on its own as no evidence, with the file's error,
+  and makes the run exit 2; it used to count as passing either way, and
+  `main` made every v4 test look like a guard.
+- `pnpm check:ai-context` holds every skill under `skill-packages/` to the
+  rules for a skill an app installs, with or without a plugin marketplace:
+  its `SKILL.md` lists `@ic-reactor/react`'s version, and any other package's
+  it lists, at the current version, and it names no path that exists only in
+  this repository. They ran only on the skills of
+  `.claude-plugin/marketplace.json`, which v4 does not have, so
+  `skill-packages/ic-reactor/SKILL.md` could drop its version lines or point
+  at `packages/core/src/` and pass. The summary line now counts them as
+  "consumer skill(s)". `skill-packages/ic-reactor/SKILL.md` passes both as it
+  stands (#970).
+- `pnpm verify:traps` finds a `@ts-ignore` or `@ts-expect-error` wherever
+  TypeScript reads one, found with TypeScript's own parser (#971): after code
+  on its line (`ok() // @ts-ignore`), on a block comment's last line, and
+  spelled `@ts-ignored`, as well as a `@ts-nocheck` TypeScript obeys after a
+  block comment on the first line. It found only a directive that started its
+  line, so a trailing `// @ts-ignore` hid an error that no trap proves, and
+  the gate still passed. A tag's `@ts-expect-error` must still start the line
+  under it.
+- The scripts keep one copy of each helper they shared by hand, in
+  `scripts/lib/`: the fence rule for Markdown code blocks (`check-snippets`
+  and both readers of `check-ai-context`), the list of a package's public
+  subpaths (`check-exports`, `verify-package-artifacts` and
+  `verify-typescript-floor`), and `run`, `readJson` and `writeJson` (the two
+  floor scripts). `check-ai-context` now reads a docs page's heading ids by
+  CommonMark's rule, as `check-snippets` does: a fence line with an info
+  string, such as ` ```ts `, no longer ends a block, so a heading in
+  the code after it is not taken for one of the page's.
+  `verify-package-artifacts` and `verify-typescript-floor` now read
+  `exports` as `check-exports` does: a subpath mapped to `null` is left out,
+  and a string or a set of conditions is the root entry. No package of the
+  repository uses either form, so no run changes (#979).
+- `pnpm check:snippets` checks a code block that is never closed, which runs
+  to the end of the file as CommonMark has it, instead of dropping it and
+  passing (#980).
+- `pnpm verify:peer-floors` fails when one of its pnpm filters matches no
+  package (`--fail-if-no-match`), where pnpm exited 0 having run nothing, and
+  its TypeScript floor compiles the Vite plugin's declarations as well as
+  core's and react's, in a program of their own so that the Node types Vite's
+  declarations bring in do not reach core's and react's (#980).
+- `pnpm release <version>` stops at the release commit and prints the rest
+  of the release: the `CHANGELOG.md` section, the `release/v<version>` branch
+  and its pull request into `v4`, and the tag on that pull request's merge
+  commit, which `release.yml` publishes from (#969). It no longer tags the
+  commit, and it refuses `--dry-run` and `--publish` before changing
+  anything: `--dry-run` made a real commit and tag, and `--publish` published
+  from the machine it ran on, outside `release.yml`'s preflight, approval and
+  provenance. Its step for a root `llms.txt`, which `v4` does not have and
+  which failed on every run, is gone.
+- react's StrictMode tests check the disposals of the client in use, where
+  they counted those of every client the factory built (#966). The registry
+  disposes the client React's development render throws away whenever a
+  collection runs, so a collection during the test failed it, as in
+  4.0.0-beta.6's release run. The double-mount test now runs real
+  collections where `gc()` is exposed.
+- A core test fails if an update the IC accepted is no longer recorded as
+  accepted (#964). Without that record, a poll answered HTTP 429 reads as the
+  IC turning the update away, and the update is sent again.
+- The size limits rose by the measured amount of each fix that grew the
+  bundles, each in a commit that states the measurement: core's from
+  18.17 kB to 19.1 kB, and the size app's two checks from 93.1 kB to
+  94.07 kB and from 94.39 kB to 95.38 kB.
+
+## core, react, vite-plugin 4.0.0-beta.6
+
+Prepared on 2026-10-21. It goes out under npm's `beta` dist-tag, as
+`@ic-reactor/core@beta`; `latest` stays 3.x until 4.0 GA. Changes since
+4.0.0-beta.5.
+
+This release carries the fixes of the pre-GA audit of beta.5 (#893 to #912)
+and the ten fixes and features filed just before it (#873 to #882), so that
+4.0.0 ships no code a prerelease did not carry first. Three changes are marked
+breaking (the Node floor, `createClient`'s option checks and `useClient()`),
+and several more change what an app sees; the steps below list them.
+
+No export is added or removed (core 13, `@ic-reactor/core/testing` 2, react 4,
+vite-plugin 2), and the candid-core pair is unchanged: core peers
+`@candid-core/schema` at exactly `0.4.0` and the Vite plugin
+`@candid-core/cli` at exactly `0.3.0`, so a module generated for beta.5 need
+not be regenerated. What is new comes as members and options, as the entries
+below say:
+
+- on the client: `client.time(canister)`, `client.canisterId(target)` and
+  `client.encode(canister, method, vars)`;
+- on what the client gives back: `ReactorError.expiresAt`, `Resend.bytes` and
+  `AuthState.expiresAt`;
+- options: `timeoutMs` on a canister and on a mutation, `maxElements` on
+  `createClient` and `createTestClient`, and the Vite plugin's `onGenerated`;
+- in `@ic-reactor/core/testing`: `dropNextReply({ method, canister, times })`.
+
+Code that writes its own object of the `Client` type, such as a hand-made
+fake, no longer compiles until it has `time`, `encode` and `canisterId` (a
+client from `createClient` or `createTestClient` has them).
+
+What an app on beta.5 does:
+
+1. Run Node 22.12 or newer. All three packages now say so in `engines`
+   (#896).
+2. Bump all three `@ic-reactor/*` packages to `4.0.0-beta.6` in one
+   `npm install`. react 4.0.0-beta.6 peers core at exactly `4.0.0-beta.6`, so
+   they move together. The command keeps each package in the section of
+   `package.json` it is in:
+
+   ```sh
+   npm install --save-exact @ic-reactor/core@4.0.0-beta.6 @ic-reactor/react@4.0.0-beta.6 @ic-reactor/vite-plugin@4.0.0-beta.6
+   ```
+
+   Name only the packages the app has.
+
+3. Check what the app passes `createClient` (breaking, #895). A value the
+   types forbid now fails closed with a `TypeError`: compare environment text
+   (`allowEnvConfig: import.meta.env.VITE_ALLOW_ENV === "true"`), move a
+   top-level `host` into `network: { host }`, decode a hex `rootKey` to its
+   bytes, and drop or correct the key an error names.
+4. Build options from the current `useClient()` value (breaking, #894). It is
+   a new object for each caller, so list it in `useMemo` and effect
+   dependencies, compare two clients by `client.queryClient`, and keep a
+   write's outcome in the app's own state when it must stay on screen across
+   an account switch.
+5. Treat `caller_changed` from a write as the same error from a read: nothing
+   ran (#893). A write TanStack Query held back (offline, behind a mutation
+   `scope`, or retried) is refused, with nothing sent, when someone else is
+   signed in by the time it would go out, and a write restored from a
+   persister is always refused. Call `mutate()` again as the new caller.
+6. Check where pages run with `network: "env"`:
+   - on `ic0.app`, Codespaces or Gitpod, `allowEnvConfig: true` now throws;
+     name canisters with `{ id }` there (#900);
+   - a dev page opened by a LAN address, a `*.local` name or a tunnel now
+     calls its own origin, never mainnet (#902);
+   - on a canister's own `icp0.io` page, `{ name }` targets now resolve from
+     the cookie's canister ids, with mainnet's root key (#901).
+7. Smaller changes, each with its migration in the entries below: a `switch`
+   over `AuthLike`'s `getStatus().state` needs a `default` (#911); an app's
+   own queries on `client.queryClient` now retry as a plain `QueryClient`'s do
+   (#903); two copies of `@tanstack/query-core` now throw instead of
+   misbehaving (#873); with the method typed `any`, pass `arg`, not `[arg]`
+   (#874); and an auth factory's error now comes from `signIn()`, not from the
+   first read (#912).
+
+The guide (`llms.txt`) and the skill now say they apply to 4.0.0-beta.6, and
+the five examples pin `^4.0.0-beta.6`.
+
+### @ic-reactor/core, @ic-reactor/react, @ic-reactor/vite-plugin
+
+#### Changed
+
+- **Breaking for Node below 22.12:** all three packages now declare
+  `"engines": { "node": ">=22.12.0" }`; core and react said `>=18` and the
+  Vite plugin said nothing. None of them worked on Node 18 (no global
+  `crypto` in an ES module for `createTestClient`, and a `candid-core-cli gen`
+  the plugin runs that needs a newer `readdir`), and `require()` of core and
+  react, which are ES-only, needs Node 22.12 (or 20.19, which reached end of life on
+  2026-04-30). A floor can fall in a 4.x minor but not rise, so it starts at
+  the first Node 22 that works. CI now runs the package tests and a
+  `candid-core-cli gen` on Node 22.12.0 itself. Migration: run Node 22.12 or
+  newer (#896).
+
+#### Fixed
+
+- The tarball now ships the MIT `LICENSE` the manifest names; the repository
+  has a root `LICENSE` again, and `pnpm verify:packages` fails a tarball that
+  has none or one that is not a copy of the root file (#898).
+
+### @ic-reactor/core
+
+#### Added
+
+- `timeoutMs` bounds how long a call waits for its answer (#875). On the
+  canister target, `client.canister(actor, { id, timeoutMs })`, it bounds every
+  direct call, `queryOptions` read and mutation made through that canister
+  object; in `client.mutationOptions()`' third argument, `{ timeoutMs }`, it
+  bounds that mutation's runs instead. When it passes, the call rejects with
+  `code: "timeout"`: `cancelled` with `mayHaveExecuted: false` for a read and
+  for a write that had not gone out, and `outcome_unknown` with
+  `mayHaveExecuted: true` for a write whose request went out (an
+  `{ update: "idempotent" }` read's included) and for a re-send of a write
+  `client.resendOf()` offered, at any point, which `client.resendOf()` offers
+  like any other unknown outcome when given the canister object the write went
+  through (another `timeoutMs` is another object). Such a write is to be
+  reconciled, never sent again blindly. A timed-out write that went out
+  carries `expiresAt`; a re-send that timed out before it went out has none,
+  and the earlier error's still holds. Nothing is re-sent for a timeout, and
+  the request is not torn down. Canister objects that differ only in
+  `timeoutMs` share query keys. Without `timeoutMs`, nothing changes, except
+  for the next entry.
+- A read aborted while it waits for its caller's identity now rejects
+  `cancelled` at once, with no code, and sends nothing. It used to wait for the
+  identity, then reject `caller_changed`, `client_disposed` or
+  `unauthenticated` (`identity_unavailable`) when one of those applied, and
+  otherwise send the read nobody waited for. The abort now comes first.
+- Core's size limit is raised to 16.32 kB for `timeoutMs` (16,269 B, +381 B),
+  and the app checks with the peers included to 91.34 kB (91,291 B, +394 B)
+  and 92.61 kB (92,561 B, +399 B).
+- `client.time(canister)`: the IC's time in nanoseconds since the epoch, as a
+  `bigint`, the unit of an ICRC-1 `created_at_time` (#876). It reads the
+  `time` path with a `read_state` routed by the canister's subnet and verifies
+  the certificate against the network's root key, as every reply is; a
+  certificate that does not verify rejects `not_delivered`. The certificate's
+  age is not compared with the host's clock, the clock this member replaces.
+  It needs no signed-in caller. The management canister `aaaaa-aa` routes no
+  `read_state`, so it is refused `invalid_args` (`management_canister`) with
+  nothing sent. It is a `Client` member: the export budget is unchanged.
+- `client.encode(canister, method, vars)`: the Candid bytes a call of
+  `method` with `vars` sends, as a `Uint8Array`, for an ICRC-21 consent
+  request's `arg` or an audit log (#877). It uses the call path's own encoder
+  and variables rule, and variables that do not encode throw `invalid_args`
+  with the `issues` a call of them rejects with. It sends
+  nothing and needs no canister id.
+- `Resend.bytes`, on what `client.resendOf()` offers: the bytes the attempt
+  sent, which `send()` sends again; a copy on every read (#877).
+- `ReactorError.expiresAt`: on a write that got no answer (`outcome_unknown`,
+  or `cancelled` with `mayHaveExecuted: true`), the latest ingress expiry its
+  sends were signed with, in nanoseconds since the epoch on the IC's clock
+  (#878). It is read from each call request as the agent builds it, before
+  it is signed, so a signal that aborts while the answer is awaited keeps it.
+  A call request whose signal aborted before it was signed is not sent. A
+  write the client sent again carries the latest of its sends' expiries, and
+  a `resendOf` re-send its own. Answered or refused writes and reads carry
+  none. It is not enumerable, so `JSON.stringify(error)` keeps working. A
+  field of an existing type: the export budget is unchanged.
+- `client.canisterId(target)` gives what a target resolves to now, from the
+  resolver the calls use, without a call: `{ ok: true, id }`, or
+  `{ ok: false, reason, message }` with `reason` `"no_browser"`,
+  `"untrusted_host"` or `"absent"`, and the resolver's reason text, which a
+  call on that target includes in its error. It reads the `ic_env` cookie on each call. A `Client`
+  member, so the export budget is unchanged (#881).
+- `AuthState.expiresAt`: when the session ends, in milliseconds since the
+  epoch, while signed in through an auth whose `getStatus()` carries
+  `expiresAtMs` (`AuthClient` 10 does), so an app can show "signed in until".
+  `AuthLike`'s `getStatus()` may carry that optional `expiresAtMs` (#912).
+- `createTestClient().dropNextReply({ method, canister, times })`
+  (`@ic-reactor/core/testing`): loses the replies of the next `times` call
+  requests that name `method` and are addressed to `canister`, with
+  `refuseNext`'s matching rules and checks, and lets every other request
+  through (#882). A test can aim a lost reply at its write while a certified
+  read or an ICRC-21 consent read before it is answered. `dropNextReply()`
+  with no argument is unchanged: it loses the reply of whatever call request
+  comes next, certified reads included, as its JSDoc and the testing page now
+  say. No new export.
+
+#### Changed
+
+- `network: "env"` on a canister's own `<id>.icp0.io` or `<id>.raw.icp0.io`
+  page, with a mainnet agent host, believes the `ic_env` cookie's canister
+  ids by default (#901). Both parents are on the Public Suffix List, so the
+  cookie is the asset canister's own, and `{ name }` targets now resolve
+  after `icp deploy -e ic` with no `allowEnvConfig`. Its root key is never
+  taken there (the agent keeps mainnet's), and its Internet Identity URL
+  only over `https:`. `ic0.app` and custom domains are unchanged. Migration:
+  an app that relied on `{ name }` failing on icp0.io needs nothing; to
+  refuse the cookie there, pass `allowEnvConfig: false`.
+- `AuthLike`'s `getStatus().state` takes any string beside the four states
+  of `@icp-sdk/auth` 10, so an `@icp-sdk/auth` release that adds a session
+  state does not stop `auth: (network) => new AuthClient(network)` compiling.
+  The client already called anonymously in such a state; `authState()` reads
+  it as `"anonymous"`. A weekly CI job type-checks core and runs the core and
+  react tests against `@icp-sdk/auth@latest`. Code that switches over
+  `getStatus().state` exhaustively needs a `default` (#911).
+- `allowEnvConfig: true` trusts less of the `ic_env` cookie (#900). The
+  cookie's root key is never taken for a mainnet host (a mainnet boundary
+  domain, or the `https://icp-api.io` fallback a custom-domain page uses):
+  the agent keeps mainnet's own key. Its `INTERNET_IDENTITY_PROVIDER` is
+  taken over `http:` only on a local page. And on a page under `ic0.app`,
+  `*.app.github.dev` (Codespaces) or `*.gitpod.io`, none of which is a public
+  suffix, so any sibling site can set the cookie, `createClient` throws a
+  `TypeError` for `allowEnvConfig: true`. Migration: on those pages, name the
+  canisters with `{ id }` (build-time env) and a replica that is not mainnet
+  with `{ host, rootKey }`; on mainnet, drop any reliance on a cookie root
+  key; serve a deployed Internet Identity URL over `https:`.
+- A view of a client pinned to a principal (what `useClient()` returns)
+  writes only as that principal: its `mutationOptions` reject `cancelled`
+  (`caller_changed`, `mayHaveExecuted: false`) and send nothing while someone
+  else is the caller. Their `mutationKey` ends with the principal
+  (`[..., method, caller]`, still found by a filter on the shorter key), so
+  TanStack never hands a run pressed before a switch the later render's
+  options, on any version and with any `QueryClient`; after a switch the
+  mutation a component shows starts over, idle, and the stale run reports its
+  refusal to the options it was pressed with. An app that shows an outcome
+  across a switch (an unknown one, to read back as its sender) keeps it in
+  its own state, from the promise `mutateAsync` returns. Its `authState()` is the client's own
+  while its principal is the live caller, so an expired session reads as
+  expired (#894). The client's own `mutationOptions`, a canister's direct
+  calls and `func` still sign as the caller current when they run.
+
+#### Fixed
+
+- **BREAKING:** `createClient` checks every option, so a value the types
+  forbid but untyped code can pass (an `import.meta.env` value, a spread,
+  plain JavaScript) fails closed with a `TypeError` naming the option and
+  what it got (#895). Before, `allowEnvConfig: "false"` was truthy and
+  believed the `ic_env` cookie on any page, `fetchRootKey: "false"` fetched
+  the root key from a remote host, a hex `rootKey` made every call fail, and
+  an unknown key was ignored (`host` beside `network`, the 3.x habit, talked
+  to port 8000). It now refuses an option it does not have, in the options
+  and in a network object, listing those it has; an `allowEnvConfig` or
+  `fetchRootKey` that is not `true` or `false`; a `rootKey` that is not 133
+  bytes in a `Uint8Array` (`null` included); and a `fetch` that is not a
+  function. `createTestClient` checks the network and `allowEnvConfig` it
+  forwards the same way, and refuses a `signedIn` that is not a boolean. `parseUnits` and `formatUnits` refuse
+  options that are not an object or have a key they do not take (Intl's
+  `maximumFractionDigits`, a misspelt `signd`), and `parseUnits` a `signed`
+  that is not a boolean. Migration: compare environment text,
+  `allowEnvConfig: import.meta.env.VITE_ALLOW_ENV === "true"`; move `host`
+  into `network: { host }`; decode a hex root key to its bytes; drop or
+  correct the key the error names.
+- A write from `client.mutationOptions()` goes out as the caller current when
+  `mutate()` was called, or not at all (#893). The client's `queryClient`
+  reads the caller of each mutation run in its `MutationCache` when the run
+  starts, so an `onMutate` of the app's that replaces the client's keeps the
+  rule; on another `QueryClient`, the client's `onMutate` reads it (before
+  TanStack Query 5.89, which passes no run context, by the options object
+  TanStack calls it on; the runs of one observer share that object, so
+  before 5.89 a write whose observer has another run pending that started
+  as someone else is refused). It reads no caller for a mutation of the app's. When
+  TanStack Query held the write back (paused offline, queued behind another
+  mutation of its `scope`, or retried by an app's `retry`) and someone else is
+  current by the time it is sent, it rejects with `kind: "cancelled"`,
+  `code: "caller_changed"`, `mayHaveExecuted: false`, and nothing is sent; it
+  was sent as whoever was signed in then. A mutation restored from a
+  persister is now always refused that way, since who started it is not
+  known. Migration: treat `caller_changed` from a write like the same error
+  from a read (nothing ran), and call `mutate()` again as the new caller if
+  that is what the user wants; resume a persisted write by calling `mutate()`
+  again, not with `resumePausedMutations()`.
+- `network: "env"` no longer falls back to mainnet on a dev page opened by a
+  LAN address (RFC 1918, link-local, IPv6 ULA or link-local), a `*.local`,
+  `*.test` or `*.internal` name (`host.docker.internal`), or a tunnel
+  (`*.ngrok-free.app`, `*.ngrok-free.dev`, `*.ngrok.app`, `*.ngrok.io`,
+  `*.trycloudflare.com`, `*.loca.lt`) (#902). Such a page routes through its
+  own origin, the dev server's proxy, as a Codespaces page does: the cookie
+  is not believed and no root key is taken or fetched, so certified calls
+  fail verification instead of reaching mainnet. A dev wallet opened from a
+  phone showed, and after a mainnet sign-in sent, real ICP. Migration: a
+  production app served from such a name now calls its own origin; give it
+  `network: "ic"` or a `{ host, rootKey }` network.
+- An app's own queries on `client.queryClient`, such as REST calls under
+  `ReactorProvider`, keep TanStack Query's retries: the default `retry`
+  applies the client's rule only to a `ReactorError`, and retries any other
+  error up to 3 times in a browser, as a plain `QueryClient` does (never on a
+  server). The client's own reads set `retry` themselves and are unchanged.
+  An app that turned retries off through this default sets `retry: false` on
+  its queries instead (#903).
+- A write from `client.mutationOptions` invalidates the reads on the
+  `QueryClient` it ran on, which TanStack Query 5.89 and later hands it, as
+  well as on `client.queryClient`: an app that nests its own
+  `QueryClientProvider` inside `ReactorProvider` now sees its reads refresh
+  after a write (#903).
+- A reply over about a million bytes decodes. candid-core charges a blob one
+  element per byte against its 1,000,000-element budget, so an SNS wasm from
+  SNS-W's `get_wasm`, the ICPSwap factory's `getActiveWasm` or a large asset
+  chunk rejected `invalid_reply` (`value_elements limit 1000000 exceeded`), and
+  an update with such a reply rejected after it ran. A reply may now hold one
+  value per byte plus the budget, which bounds only values that take no
+  bytes, such as a long `vec null`, however large a blob beside them. A new `maxElements` option of
+  `createClient` and `createTestClient` sets that budget, and a mock decodes
+  its arguments the same way, so a test can upload a large chunk (#899).
+- `client.queryOptions()` and `client.queryKey()` refuse a symbol given as
+  the variables that is not core's `skipToken`, with a `TypeError` that says
+  two copies of `@tanstack/query-core` are installed and how to get one
+  (#873). Such a symbol is the other copy's `skipToken`; it used to be
+  encoded as the argument, so a read meant to wait ran and rejected
+  `invalid_args`. A method whose one argument is Candid `reserved` still
+  takes any value, a symbol included. This check runs in production too: an
+  app with two copies gets a thrown `TypeError` where it got a rejected read.
+  Migration: install `@tanstack/query-core` at the exact version your
+  `@tanstack/react-query` depends on, so that `npm ls @tanstack/query-core`
+  shows one copy.
+- A read made with `queryOptions` stops waiting for the HTTP answer to its
+  request, and to each `read_state` that polls for it, once its query
+  function's signal aborts, and rejects `cancelled` (part of #875). Its signal
+  used to reach only the check before sending and the waits between polls:
+  neither the client nor the agent bounds an HTTP request, so a request that
+  got no answer kept the read waiting after TanStack cancelled it. The request
+  itself is not torn down. `mayHaveExecuted` is `false`, except for an update
+  read with `{ update: "idempotent" }` whose call request went out.
+- With the method given as `any` (`client.queryOptions<A, any>(canister,
+method, vars)` for a method named by data), the variables of
+  `queryOptions`, `queryKey`, `mutationOptions` (its `mutationFn`) and
+  `resendOf` (its `dedupedBy` and `arg`) follow the run-time rule: the value
+  for a one-argument method, a tuple for several, `undefined` or `[]` for
+  none (#874). They were typed `unknown[]`, so a one-argument call compiled
+  only as `[arg]`, the shape the client refuses with `invalid_args`. They are
+  now any value but a symbol, so a read with a real value keeps
+  `CanisterQueryOptions<unknown, never, never>`. `[arg]` still compiles (an
+  array is a value too) and the client still refuses it with `invalid_args`.
+  Migration: code that wrote `[arg]` (or cast `arg as never`) on this path
+  writes `arg`; a `dedupedBy` that read `arg[0]` reads `arg`. Inside a
+  function generic over the `Actor`, only `queryOptions` gets the wider type;
+  `mutationOptions`, `queryKey` and `resendOf` still need a cast there.
+- A session that ends by the clock is announced: the client sets a timer for
+  the auth's `expiresAtMs` and tells its listeners, so `useAuth()` renders
+  `"expired"` at the session's end with no user activity, where it kept
+  saying `"signed-in"` while calls went out anonymous. A read of `caller()`
+  or `authState()` that sees a change no notification announced also tells
+  the listeners, in a microtask. A sign-in that ends at another time than the
+  last one now notifies too, since `expiresAt` changed (#912).
+- An auth factory that throws (`new AuthClient()` reads `localStorage`,
+  which throws where site data is blocked) no longer breaks every read: it is
+  called once, the client calls anonymously so public reads still work, the
+  error is logged once in development, and `signIn()` and `signOut()` reject
+  with what the factory threw. It was called again on every read and render,
+  and its error escaped from `caller()`, `authState()`, `subscribe()`,
+  `queryOptions()` and direct calls. Migration: catch the factory's error
+  from `signIn()`, not from the first read; build a new client to try the
+  factory again (#912).
+- The test auth of `createTestClient()` expires by the clock, as
+  `AuthClient` does: past its `expiresAtMs` (eight hours after a sign-in) its
+  status reads `"expired"` without telling anyone. `auth.expire()` is still
+  the explicit form, which does tell them (#912).
+
+### @ic-reactor/react
+
+#### Changed
+
+- **BREAKING:** `useClient()` returns a view of the client for the caller
+  the render shows every time, not the provider's client object once the
+  live caller renders (#894). The view is a new object after a sign-in, a
+  switch or a sign-out and the same one across renders for one caller, so a
+  `useMemo`, an effect or React Compiler's cache keyed on it builds the new
+  caller's options, where they kept the previous caller's key (and showed
+  that caller's data) before. A write built from it is refused rather than
+  signed by a caller the render did not show. Migration: build options from
+  the current `useClient()` value and list it in the dependencies; compare
+  two clients by `client.queryClient`, not by identity; read who signs now
+  from the client you created, since the view's `caller()` is its render's.
+  A handler that does `await client.signIn()` and then `mutation.mutate(arg)`
+  presses with the last committed render's options: it is refused
+  (`caller_changed`) when the signed-in render has not committed yet (one
+  that suspends on the user's data); let the next render press, or use a
+  direct canister call, which signs as the caller current.
+- `useAuth()` returns `expiresAt` while signed in, and renders again when it
+  changes and when a session ends by the clock (#912).
+
+#### Fixed
+
+- In development, `ReactorProvider` throws when the client's `QueryClient`
+  is not an instance of `@tanstack/react-query`'s `QueryClient`: two copies
+  of `@tanstack/query-core` are loaded (#873). Production builds do not
+  check. Migration: install `@tanstack/query-core` at the exact version your
+  `@tanstack/react-query` depends on; `npm ls @tanstack/query-core` must show
+  one copy.
+
+### @ic-reactor/vite-plugin
+
+#### Added
+
+- `onGenerated`, an option called once for each module a run generated, in
+  `vite build` and `vite dev`, with the module's canister `names`, the
+  absolute `didFile`, `module` and `envelope` paths, its `status`
+  (`"written"` or `"unchanged"`) and a `signal` that the run's close aborts.
+  It runs inside the plugin's queue of runs, so `buildStart` waits for it,
+  and a close stops waiting. A throw fails the module's canisters as a
+  failed generation does, and the next run calls it again. Not called for a
+  canister that failed, nor for a run that does not generate the module
+  again. An option, not an export (#880).
+- Under `vite dev` and `vite preview`, a warning, once per server, when a
+  page is loaded by a `Host` that is not loopback, saying that `"env"` is for
+  `localhost` pages (#902).
+
+#### Fixed
+
+- On Windows, local network detection works with icp-cli installed from npm
+  (`@icp-sdk/icp-cli`). npm links it as `icp.cmd`, which the plugin could not
+  start, so detection always failed while the network was running. On
+  Windows the plugin now runs the `icp.exe` that package installs, from the
+  app's own install first, then a global npm install (`%APPDATA%\npm`), so a
+  command that hangs is killed after its timeout; it runs the package's bin
+  script with Node when that `icp.exe` is missing, and falls back to an
+  `icp.exe` on `PATH`. When no `icp` can be started at all, the
+  warning says so and how to make one runnable on that platform, instead of
+  asking whether the network is running. CI runs the tests of how
+  the plugin starts `icp` on Windows (#905).
+
+### Docs
+
+- The README and the Vite plugin guide say that any local network restart
+  needs a dev server restart, even when the root key stays the same: the
+  plugin keeps sending the ids it detected first (#881).
+- The client guide has a "Deploy to mainnet" section: `icp deploy -e ic`,
+  what `"env"` resolves to on `icp0.io`, `ic0.app` and a custom domain,
+  `{ id }` from build-time env with the local and the mainnet id, and when
+  `allowEnvConfig: true` is safe; `llms.txt` states the rule (#901).
+- The consumer guide (`packages/core/llms.txt`) and the Reads, Writes, Values
+  and Client pages say five things that already worked (#879): a read with
+  `{ update: "idempotent" }` is still an update, refused for a signed-out or
+  `"anonymous"` client, and an ICRC-21 consent message is read as the caller
+  who will send the write; after a `canister_err` the canister calls
+  temporary, send the same argument object again; `parseUnits` accepts
+  trailing zeros, `"5."` and `".5"`, and refuses only significant excess
+  fraction digits; a kept `resendOf` offer is typed
+  `NonNullable<ReturnType<typeof client.resendOf<A, "method">>>`; and a client
+  made outside a provider, or kept across its unmount, is the app's to release
+  with `client.dispose()`.
+- The guide and the Writes page say how to get the bytes a write sends
+  (#877).
+- The guide and the Errors page say when a read-back after an unknown write
+  outcome is final: once the IC's time is past `error.expiresAt` (#878).
+- The guide, Writes and Errors stamp `created_at_time` from
+  `client.time(ledger)` instead of `Date.now()` (#876).
+- The guide, the auth and client pages and `AuthLike`'s JSDoc no longer say a
+  wallet fits with a small adapter. What fits is a sign-in that hands over an
+  `Identity` (a delegation or a key); a wallet that signs each call itself
+  (ICRC-25 and ICRC-49: OISY, Plug, NFID accounts) does not. The auth page
+  shows such a wallet's writes through `SignerAgent` beside an anonymous
+  client, with the reads invalidated by hand (#904).
+- The client guide has a section for a local network without the Vite plugin
+  (Next.js, Rsbuild, webpack, esbuild): `network: "local"` with `{ id }` from
+  a build-time variable written by `icp canister status -e local -i`, or a
+  Next.js rewrite of `/api/v2` and `/api/v3` to keep `"env"`. Core's guide
+  states the rule in a few lines (#906).
+- Getting started has a step 0 that creates the project (Vite's `react-ts`
+  template, or `npm init -y` and `npm pkg set type=module` for Node), so its
+  top-level `await` scripts run under `npx tsx` on the first try. It, core's
+  package page and core's guide now say that core and react are ES modules
+  only and what CommonJS code can do, and show the `.js` import form
+  `moduleResolution: "nodenext"` needs (#907).
+- The guide's Errors section says how long a call waits: unless the call has
+  a `timeoutMs`, an HTTP request has no timeout in the client or the agent, an accepted update polls for about
+  five minutes (a deadline checked when a poll is answered) before `outcome_unknown`, and
+  a cancelled read stops waiting (part of #875).
+- The guide's Setup, both READMEs, the core and react package pages and
+  Getting started say to install `@tanstack/query-core` at the version
+  `@tanstack/react-query` depends on, and to check that
+  `npm ls @tanstack/query-core` shows one copy (#873).
+- The auth guide says that a `"signed-in"` session may be read-only:
+  Internet Identity can scope one to queries, and `@icp-sdk/auth` does not
+  expose that scope yet (#912).
+- The docs site has three guides that build a whole app step by step: an
+  ICRC-1 wallet with Internet Identity sign-in, a Next.js server page for
+  one user, and an MCP server that gives an AI agent a ledger's tools
+  (#948, #953, #954). It now has B3Pay's look and the core mark, and one
+  home for the three libraries with a library switcher (#943, #944, #945,
+  #947, #955).
+
+### Examples (not published)
+
+- `icrc-ledger`'s Sandbox tab finds its sandbox by the client's
+  `QueryClient`, and reads who signs now from the sandbox's client, since
+  `useClient()` returns a view per caller (#894).
+- `canister-studio`'s write runner shows the confirm step again, with the
+  new sender, when a write is refused because the caller changed before the
+  page caught up (#894).
+- An outcome stays on screen across an account switch: `canister-studio`'s
+  write runner and wallet Send panel, `icrc-ledger`'s Sandbox transfer, and
+  `vite-wallet`'s Send and Pay forms (through one `useTransfer` hook), keep
+  the outcome of the write they sent in their own state, since the mutation
+  the new caller's render shows starts over idle; `vite-wallet` reads
+  `client.resendOf`'s offer from that kept outcome (#894).
+- `node-agent-tool` no longer tells you to export an identity's key into the
+  project. Its README and docs page say to give the tool, and an agent running
+  it, an identity of its own that controls nothing, with its key outside the
+  project and readable by you alone, and that the agent can read the seed
+  variable.
+  The example's `.gitignore` and the root one now ignore `*.pem` (#910).
+- A fifth example, `canister-studio`: a TanStack Start app, rendered on the
+  server, that gives every method of any mainnet canister an automatic form
+  and calls it with ic-reactor's rules in view. The ICP, ckBTC and ckETH
+  ledgers and the ckBTC minter are typed by three generated modules; any
+  other canister's interface is read from its certified `candid:service`
+  metadata, compiled on the server by `@candid-core/cli` and rebuilt in the
+  browser with `schemaFromContract`, and an interface from the uncertified
+  fallback query is labelled so. It shows one client per request and per
+  tab, reads hydrated without a refetch, shared query links rendered on the
+  server, writes confirmed with their sender and exact bytes, `resendOf`
+  after an unknown outcome, certified reads, an idempotent update read as a
+  query (ckBTC's `get_btc_address`), a Safety lab of ten scenarios over
+  `createTestClient()` in the browser, and a playground that compiles a
+  pasted `.did` in the browser. Its tests run offline; its `smoke` script
+  checks its `.did` files and reads against mainnet. It pins
+  `^4.0.0-beta.6`, `@candid-core/schema` `0.4.0` and `@candid-core/cli`
+  `0.3.0`, a runtime dependency here, and has a page in the examples docs.
+  The root README, the docs' home page and Getting started now say five
+  examples.
+
+## core, react, vite-plugin 4.0.0-beta.5
+
+Prepared on 2026-10-11. It goes out under npm's `beta` dist-tag, as
+`@ic-reactor/core@beta`; `latest` stays 3.x until 4.0 GA. Changes since
+4.0.0-beta.4.
+
+This release moves ic-reactor 4 onto the candid-core pair published on
+2026-10-10. Both are pinned exactly, where beta.4 required `0.3.0` and
+`0.2.0`:
+
+- `@ic-reactor/core`: peer `@candid-core/schema` at exactly `0.4.0`;
+- `@ic-reactor/vite-plugin`: peer `@candid-core/cli` at exactly `0.3.0`, the
+  version its install hints now name.
+
+Three things are new, as core's and the Vite plugin's entries below say:
+
+- `client.queryOptions` reads the mode each method of a generated `Actor`
+  now carries, and an update or a oneway method does not compile there
+  (#851).
+- The Vite plugin's `methods` on a canister entry: a fetched `didFile` is
+  written as the projection of the live interface to the methods the app
+  calls, so the generated module has only them (#852, phase 2).
+- The Vite plugin's live check: `verify: "live"` on an entry, or
+  `IC_REACTOR_VERIFY`, checks a `didFile` on disk against the live canister's
+  certified interface when a build or dev server starts.
+
+No `@ic-reactor/*` export is added or removed (core 13,
+`@ic-reactor/core/testing` 2, react 4, vite-plugin 2). The pair itself changes
+no call, key or error at run time: what it adds, each method's mode in the
+generated `Actor`, is read by `client.queryOptions` at compile time only.
+Schema 0.4.0's JavaScript is 0.3.0's but for one header comment, so an app's
+bundle does not change.
+
+What an app on beta.4 does:
+
+1. Bump all three `@ic-reactor/*` packages to `4.0.0-beta.5` and the pair to
+   `0.4.0` and `0.3.0`, in one `npm install`. npm does not resolve a partial
+   upgrade cleanly: core 4.0.0-beta.5 peers schema exactly
+   `0.4.0` and core 4.0.0-beta.4 exactly `0.3.0`; the Vite plugin
+   4.0.0-beta.5 peers CLI exactly `0.3.0` and 4.0.0-beta.4 exactly `0.2.0`;
+   and CLI 0.3.0 peers schema exactly `0.4.0`, CLI 0.2.0 exactly `0.3.0`. So
+   a command that moves only some of them meets the others' peers: with npm
+   11, the CLI alone fails with `ERESOLVE`, and the schema alone installs
+   with an `ERESOLVE overriding peer dependency` warning, leaving core's peer
+   unmet. One command moves them all, and keeps each package in the section
+   of `package.json` it is in (`dependencies` or `devDependencies`):
+
+   ```sh
+   npm install --save-exact @ic-reactor/core@4.0.0-beta.5 @ic-reactor/react@4.0.0-beta.5 @ic-reactor/vite-plugin@4.0.0-beta.5 @candid-core/schema@0.4.0 @candid-core/cli@0.3.0
+   ```
+
+   Name only the packages the app has. Keep one copy of the schema. A second
+   one left at `0.3.0`, beside core's `0.4.0`, makes its `Principal` another
+   type than core's, and passing one for the other fails with `TS2322` or
+   `TS2345` ("Property '[principalBrand]' is missing").
+
+2. Regenerate every committed module with `candid-core-cli gen` (the Vite
+   plugin does it when it starts). Until then `gen --check` reports each
+   module CLI 0.2.0 wrote as `drifted` and exits 1; the `.envelope.json`
+   beside it does not change. A module CLI 0.2.0 wrote still compiles against
+   schema 0.4.0, but a module CLI 0.3.0 writes does not compile against
+   `0.3.0` (`TS2694`, "has no exported member 'WithMode'", once per method).
+
+3. Code that imports the generated names compiles unchanged, but for the
+   `queryOptions` calls of step 4. Two things in the module change what the
+   compiler shows:
+   - Each type is declared under its Candid name, `export type Account = …`,
+     so a type error names `Account` where it named `$Account`. A name that
+     cannot be a type keeps the `$`: the globals `Array`, `Promise`, `Record`
+     and `Uint8Array`, and words TypeScript refuses as a type's name, such as
+     `delete` or `string`.
+   - Each method of `type Actor` is its call signature intersected with
+     `$.WithMode<"query" | "composite_query" | "update" | "oneway">`.
+     `Parameters<>`, `ReturnType<>`, `keyof Actor` and a plain async function
+     that implements a method are unchanged, and so is what
+     `client.canister<Actor>()` returns. A type test that compares a method
+     type of `Actor` for exact equality with its bare signature now fails.
+
+4. Expect the compile errors of `client.queryOptions` listed under
+   `@ic-reactor/core` below: `TS2769` ("No overload matches this call") for
+   an update or a oneway method of a generated `Actor`, and for some calls
+   that ran without a `TypeError` on beta.4: an update's fourth argument whose
+   type may be `undefined`, and a method TypeScript cannot tell is a read (a
+   type parameter, a union that may name an update, any method of a generic
+   `Actor`). A write goes through `client.mutationOptions`; an update that
+   answers the same however often it runs takes `{ update: "idempotent" }`;
+   and a generic wrapper gives the type arguments,
+   `client.queryOptions<A, any>(…)`. Nothing changes at run time.
+
+5. Check the Vite plugin's options. It now refuses what beta.4 read without a
+   word, as its entries below say: a key that is no option (a misspelled
+   `didfile` or `canisterID`), a value given that is not one (`null`
+   included), a `failOnError` or `injectEnvironment` other than `true` or
+   `false`, and options, `canisters` or an entry that is not a plain object.
+   A key or value of a canister entry fails that canister, under
+   `failOnError`; one of the options themselves throws when the config loads.
+   Each message names the option or quotes the value.
+
+### @ic-reactor/core
+
+#### Changed
+
+- Its peer `@candid-core/schema` is exactly `0.4.0`, where it was `0.3.0`
+  (#866). Core's types read its `ModeOf` for the check below; core's
+  JavaScript does not change but for its version string.
+
+#### `queryOptions` refuses an update or a oneway method at compile time (#851)
+
+`client.queryOptions(canister, method, …)` reads the mode each method of a
+generated `Actor` carries (`$.WithMode<mode>`, from `candid-core-cli gen`
+0.3.0), and its `method` takes only a method a read may be built from:
+
+| The method's mode in the `Actor`  | Without the fourth argument | With `{ update: "idempotent" }` |
+| --------------------------------- | --------------------------- | ------------------------------- |
+| `query`, `composite_query`        | compiles                    | compiles                        |
+| `update`                          | **does not compile**        | compiles                        |
+| `oneway`                          | **does not compile**        | **does not compile**            |
+| none (an `Actor` written by hand) | compiles                    | compiles                        |
+
+This is a compile-time break for code that names an update method of a
+generated `Actor` without a fourth argument whose type is
+`{ update: "idempotent" }`, or that names a oneway method with or without it.
+The error is `TS2769` ("No overload matches this call"), saying that the
+method `is not assignable to parameter of type 'ReadMethod<Actor>'`, or
+`'OptInMethod<Actor>'` for a oneway with the opt-in. Use
+`client.mutationOptions` for a write, or call it directly; pass
+`{ update: "idempotent" }` only for an update that answers the same however
+often it runs.
+
+Such a call with the method's name written out compiled on beta.4 and threw a
+`TypeError` when it ran. Two kinds of call compiled on beta.4, could run
+without a `TypeError`, and no longer compile:
+
+- **A fourth argument that may be `undefined`.** Its type, such as that of an
+  optional options parameter a wrapper passes on, does not say it is the
+  opt-in, so for an update method the call does not compile, though it
+  ran whenever the value was defined. Pass `{ update: "idempotent" }`, or a
+  value typed `{ readonly update: "idempotent" }` (the type is not
+  exported). For a query it compiles as before.
+- **A method whose type is not one name the `Actor` marks as a read.** The
+  call compiles only when TypeScript can tell that the method is a
+  `ReadMethod<A>`. It cannot for three kinds of method, each of which compiled
+  on beta.4 and is valid at run time whenever the value names a query:
+  - a type parameter: in
+    `function read<A, M extends keyof A & string>(c: Canister<A>, method: M, vars: …)`,
+    `client.queryOptions(c, method, vars)`;
+  - a union that may name an update, such as a method picker typed
+    `keyof Actor & string` or `"icrc1_name" | "icrc1_transfer"` (a union of
+    queries compiles);
+  - any method of a canister whose `Actor` type is generic: in
+    `function fee<A extends { icrc1_fee: () => Promise<bigint> }>(c: Canister<A>)`,
+    `client.queryOptions(c, "icrc1_fee", …)`, with or without the opt-in.
+
+  `ReadMethod` is not exported for a function to constrain its types with.
+  The escape is explicit type arguments,
+  `client.queryOptions<A, any>(c, method, vars)`: it compiles, the run-time
+  check still refuses an update or a oneway, and the options' data is
+  `unknown`, for the caller to state. (A wrapper that passed `...args: any[]`,
+  or no variables, did not compile on beta.4 either.)
+
+An `Actor` written by hand is unchanged: its methods say no mode, every one of
+them compiles as before, and the run-time check refuses an update or a oneway
+as before.
+
+Nothing changes at run time: every check `queryOptions` made, it still
+makes, and it is the only check for an `Actor` written by hand and for a
+composite query of a certified canister (the type of a canister object does
+not say it is certified). A call that compiled and did not throw builds the
+same options, with the same types. No export is added (`ReadMethod` and
+`OptInMethod` are named in compiler messages, not exported), and the bundle
+does not change. The reads guide, the writes guide and the guide
+(`llms.txt`) say so.
+
+### @ic-reactor/react
+
+- No change but the version. Its peer `@ic-reactor/core` is packed as
+  exactly `4.0.0-beta.5`, so the two move together.
+
+### @ic-reactor/vite-plugin
+
+#### Changed
+
+- Its peer `@candid-core/cli` is exactly `0.3.0`, where it was `0.2.0`
+  (#866), and the install hints the plugin prints name it. The plugin
+  generates with it as before; `methods` and the live check also run its
+  `project` and `check` commands, which 0.3.0 adds.
+- Its optional peer `@icp-sdk/core` is loaded for the live check too, as for
+  a fetch.
+
+#### Added
+
+- `methods` on a canister entry (#852, phase 2): a `didFile` fetched from its
+  `canisterId` is written as the projection of the live interface to those
+  methods and every type they reach (`candid-core-cli project`), so the
+  generated module has only them. A name the canister does not have fails the
+  canister, naming it and listing the canister's methods, and nothing is
+  written. A `didFile` on disk is never fetched for a change of `methods`: it
+  is compared with the list, with no network access, and a name the file
+  does not hold fails the canister, while a method the file holds that the
+  list does not name is a warning. Both say to fetch it again with
+  `IC_REACTOR_FETCH`. A file whose methods cannot be listed fails the
+  canister. Canisters that name one `didFile` share its fetch only
+  when they name one list, entries with no `canisterId` included (no
+  `methods` is the whole interface): with different lists, or a list that
+  cannot be projected to, nothing is fetched, before any request. A shared
+  `didFile` on disk is read by them all and compared with each list.
+- The live check: `verify: "live"` on an entry, or `IC_REACTOR_VERIFY=1` (or
+  `true`, `all`, or canister names separated by commas) for every entry with a
+  `canisterId`; `IC_REACTOR_VERIFY=0` (or `false`) turns it off for a run,
+  `verify: "live"` included. When a build or dev server starts, the plugin fetches the
+  certified interface and checks the `didFile` on disk against it
+  (`candid-core-cli check`). A method that is missing (`method_missing`),
+  changed mode (`mode_changed`) or is no longer compatible
+  (`method_incompatible`, with the path into its type) fails the canister,
+  naming the canister and each method, under `failOnError`. A compatible
+  change is a warning: `special_opt_rule` findings, and a change to the types
+  of the file's methods, told by the identities of the two projections to
+  them. A check that cannot be made fails the canister, and says to build
+  with `IC_REACTOR_VERIFY=0`. Under `vite dev` a failed check stands after a
+  save, whatever it changed, until a restart checks it again and it passes,
+  fetches the file again, or runs with the check off. A pass is reused only
+  within one build or dev server (a rebuild, another Vite environment), and
+  only until a check of that canister fails or cannot be made, or a fetch of
+  its file fails or reads another interface: a restart, or the next build of
+  the same plugin object, checks every canister again. `verify` takes only `"live"`, and any other
+  value fails the canister.
+- A run (the start of a build or dev server, or a save's regeneration) reads
+  each `didFile` once, and again after each step that runs `candid-core-cli`
+  on it (listing its methods, the live check, generation), since each reads
+  the file itself. A file written before the run is done with it, even saved
+  back, is not taken, and the run reports nothing its steps found of it.
+  `vite build` fails the canister for that reason alone
+  (`changed during the build`) and puts back a module the generator wrote
+  meanwhile; `vite dev` queues the file again, as a save, and says nothing of
+  the canister until that run does. A check of a file written before the
+  check was done, passed or failed, records no pass and neither sets nor
+  clears a failed check.
+- Every option value given is checked when the plugin is made, on every
+  canister, one without a `didFile` included, and whether or not a build
+  would use it: only an omitted one counts as not given. A canister whose
+  entry is not a plain object, or whose value is not one (`null`, `false`,
+  `0` or `""` from a JavaScript config, a `didFile` or `outDir` that is not a
+  path, a `canisterId` that is not the text of a principal, a `network`,
+  `methods` or `verify` that is none of their values, `verify: "live"` with
+  no `canisterId`, a getter that throws) fails, quoted as given whatever its
+  kind (a bigint, a symbol, an object that holds itself), before the plugin
+  fetches, writes, runs or requests anything to generate it or a `didFile` it
+  shares; the other canisters build. So does a canister whose module a
+  canister before it writes (two `.did` files of one name in one `outDir`), at
+  the start of each run, and a canister `IC_REACTOR_FETCH` or
+  `IC_REACTOR_VERIFY` names with no `canisterId`. Under `vite dev` a save of
+  the file of any of these, or its deletion, leaves the canister failed for
+  the same reason and runs nothing for it: a save neither generates it, over
+  another's module or not, nor takes it for fixed. Each is still named in the
+  `ic_env` cookie, but one whose name the cookie cannot carry (below); a
+  `canisterId` that is not one is left out of it, with a warning.
+  `failOnError` and `injectEnvironment` take `true` or `false`, and
+  `canisters` a plain object: any other value, `null` included, throws when
+  the config loads, instead of being read by truthiness or taken for none.
+  Every default is taken for an omitted option alone. Every key is checked
+  too, whatever its value: a key of an entry that is none of its fields (a
+  misspelled `didfile` or `canisterID`), or of a `network` of `{ host }`
+  other than `host`, fails the canister, and a key of the options that is
+  none of `canisters`, `injectEnvironment` and `failOnError` throws when the
+  config loads; the message names the option the key may misspell.
+- A dev server restarted with the same plugin object (an inline config, as
+  `server.restart()` keeps it) has runs of its own: the old server's close,
+  which Vite runs after the new server started, stops only the old server's.
+  The new server's overlay starts as the old one's, and a failed live check
+  still stands through the restart until a check of it passes.
+- Both run the app's `candid-core-cli` in a child process, as `gen` does, and
+  never the library in the Vite process. No export is added; the two fields
+  are new keys of `IcReactorPluginOptions["canisters"]`.
+
+#### Fixed
+
+- A canister's name is kept as given. One named `__proto__` (from a JSON
+  config, or a computed key) with no `canisterId` of its own lost the ID `icp`
+  reported for it to `Object.prototype`'s setter, so the `ic_env` cookie
+  carried none; and one named after a member of `Object.prototype`
+  (`__proto__`, `constructor`, `toString`, `hasOwnProperty`) with no ID found
+  that member and was never missing: no warning, no page load asked `icp`
+  again, and the cookie never carried its ID. A name that begins with `-`,
+  which `icp` allows, was handed to `icp canister status` where `icp` reads a
+  flag: it refused `-x`, and for `--help` printed its help, which the cookie
+  carried as the canister's ID. A name that holds `&` or `=`, which no name
+  `icp` gives a canister does, is left out of the cookie, with a warning: the
+  cookie joins its entries with them, so it was read back as other keys, one
+  of which could take the root key's place, and the app read no environment.
+- The options, `canisters`, each entry and a `network` of `{ host }` are read
+  only as plain objects. A `Map` or a `Promise` of canisters (a loader that
+  was not awaited) was read for its own keys, none, so the plugin started
+  with no canister without a word, and an entry given so was taken for a
+  canister only named in the cookie. Each is now refused, as any value that
+  is not one, and so is an instance of a class, which was read through its
+  class, or an object that inherits from another.
+- A key that is no option was never read, without a word. A misspelled
+  `canisters` started the plugin with no canister; a misspelled `didFile`
+  took its canister for one only named in the cookie, so nothing was
+  generated and the module of the last run stayed; a misspelled `canisterId`
+  generated it without its ID; and a `rootKey` beside a network's `host` was
+  read as nothing. Each is now refused, naming the option the key may
+  misspell: a key of the options throws when the config loads, and a key of
+  an entry or of its network fails the canister.
+- The generator names its module and envelope after the `.did`'s file name
+  with a final `.did` cut off, and nothing else, and reads only a file whose
+  name ends in `.did`. The plugin's check of two canisters writing one module
+  cut any extension, so a `didFile` such as `a/api.candid`, which the
+  generator cannot read, claimed `api.ts`, and a canister after it on
+  `c/api.did` was refused. The plugin now names these files by the
+  generator's rule, which a test compares with what the CLI reports.
+
+### Docs
+
+- The guide (`llms.txt`), react's guide and the skill say they apply to
+  4.0.0-beta.5 (#866).
+- Every install line and peer table names `@candid-core/schema` `0.4.0` and
+  `@candid-core/cli` `0.3.0`: getting started, the Vite plugin guide, the
+  core, react and Vite plugin pages, and the root and package READMEs.
+  Getting started says that each method of `type Actor` is its call
+  signature marked with its mode (`& $.WithMode<"query">`) (#866).
+- The reads guide's "Update methods" shows that `queryOptions` with an update
+  method of a generated `Actor` does not compile, says what `ReadMethod<Actor>`
+  is, that an `Actor` written by hand is checked at run time, which methods
+  TypeScript cannot tell are reads and the escape `queryOptions<A, any>`, and
+  that `{ update: "idempotent" }` opts in an update only, after the variables.
+  It also says that a composite query of a certified canister is refused at
+  run time only. The writes guide says `queryOptions` does not compile for an
+  update of a generated `Actor`, and the guide (`llms.txt`) says the same in
+  its reads section (#851).
+- The Vite plugin guide has four new sections, "Only the methods the app
+  calls", "The live check", "How the plugin runs candid-core" and "A .did
+  saved while the plugin reads it", and its options section says which values
+  and keys are refused, that the options are plain objects, and that a
+  canister's name is kept as given. The plugin's README has the first two
+  sections and the same options text.
+  Getting started points at `methods` (#852, phase 2).
+
+### Examples (not published)
+
+- The four examples pin `^4.0.0-beta.5`, `@candid-core/schema` `0.4.0` and
+  `@candid-core/cli` `0.3.0`, and their seven generated modules are
+  regenerated with CLI 0.3.0. They moved in #866, ahead of this release: an
+  example on schema `0.4.0` cannot install beta.4, whose core peers `0.3.0`.
+  Until this release is on npm, their check against the published packages
+  waits for it.
+- `icrc-ledger`'s Sandbox test marks
+  `client.queryOptions(minter, "get_btc_address", ownAddress)` with
+  `@ts-expect-error`, since that call no longer compiles, and still expects
+  its `TypeError` at run time. The README says the call does not compile
+  (#851).
+- `icrc-ledger`'s `icp_ledger.did` and `ckbtc_minter.did`, and `vite-wallet`'s
+  `ledger.did`, were trimmed by hand. Each is now the projection the plugin
+  wrote from the mainnet canister, and its entry names the `canisterId` and
+  `methods` it came from. The files stay committed, so the examples build
+  offline, and `IC_REACTOR_VERIFY=1` checks them against mainnet. The ICP
+  ledger's projection names its transfer error `Icrc1TransferError`, so
+  `vite-wallet` imports it by that name. `icp_ledger.envelope.json` does not
+  change; the minter's argument record is inline, as the canister declares it.
+
+### CI (not published)
+
+- Every module this repository generates (core's test fixtures, the e2e
+  `hello_actor`, the snippet checker's modules) is regenerated with CLI 0.3.0,
+  and core's type tests compile against them unchanged. React's type tests
+  write their own stand-in for a generated `Actor`; it now marks each method
+  with `WithMode`, as CLI 0.3.0 does, and compiles. The root, `e2e/`,
+  `scripts/size-app/` and the export budget's schema pin move to the new pair
+  (#866).
+- `pnpm verify:traps` has two new traps, `query-options-refuses-update` and
+  `query-options-refuses-oneway`, which weaken `ReadMethod` and `OptInMethod`
+  and show that the `@ts-expect-error` lines of `traps.test-d.ts` that refuse
+  an update and a oneway then stop biting; `options-method-unknown` follows
+  the new signatures. Core's type tests add the calls that compiled on beta.4
+  and no longer do (#851).
+- `scripts/faults.json` grows from 298 to 417 entries, for the Vite plugin's
+  new tests (#852, phase 2).
+- No size limit moves: core 14.96 kB of 15 kB, react 1.28 kB of 1.28 kB, and
+  the app checks 89.95 kB of 90 kB and 91.16 kB of 91.2 kB, as at beta.4.
+
+## core, react, vite-plugin 4.0.0-beta.4
+
+Prepared on 2026-10-10. It goes out under npm's `beta` dist-tag, as
+`@ic-reactor/core@beta`; `latest` stays 3.x until 4.0 GA. Changes since
+4.0.0-beta.3.
+
+An app on beta.3 upgrades by bumping all three packages to `4.0.0-beta.4`.
+Nothing in this release breaks code written for beta.3: no export is added or
+removed (core 13, `@ic-reactor/core/testing` 2, react 4, vite-plugin 2), no
+error kind or code is removed, no required peer changed, and a module
+generated for beta.3 need not be regenerated. The one exception is code that
+writes its own object of the `Client` type, such as a hand-made fake: the type
+gains `resendOf`, so that object no longer compiles until it has one (a client
+from `createClient` or `createTestClient` has it). Three things are new, as
+core's and the Vite plugin's entries below say:
+
+- `isReactorError(error, canister, method)` narrows a direct call's error to
+  that method's `Err` arm, so `err` is typed after `kind === "canister_err"`
+  without a cast. The one-argument form is unchanged.
+- `client.resendOf(error, canister, method, { dedupedBy })` offers to send a
+  write again exactly as it was sent, after a failure that left its outcome
+  unknown, and only for a method the app says deduplicates (an ICRC-1
+  transfer with `created_at_time`).
+- The Vite plugin writes a canister's missing `didFile` from the live
+  canister's certified `candid:service`, when the entry names a `canisterId`.
+  The entry's new `network` field says where the canister is, and
+  `IC_REACTOR_FETCH` fetches a file on disk again.
+
+Two of these change what some setups see:
+
+- The Vite plugin lists `@icp-sdk/core` `^6.1.0` as an optional peer. An app
+  on `@ic-reactor/core` has it already, at the range core asks for, and npm
+  installs nothing for an optional peer. A project that installs the plugin
+  next to an `@icp-sdk/core` outside `^6.1.0` gets a peer conflict from its
+  package manager.
+- A canister entry with a `canisterId` whose `didFile` is not on disk is
+  fetched from `network` (mainnet by default) and the file is written, where
+  beta.3 failed that canister's generation for want of the file. A project
+  that writes such a `.did` in another step (a local canister's build, say)
+  writes it before Vite starts, or gives that entry `network: "local"` so
+  the fetch reads the deployed local canister.
+
+The guide (`llms.txt`) and the skill now say they apply to 4.0.0-beta.4, use
+`isReactorError(error, canister, method)` after a direct call, and teach
+`client.resendOf` as the one safe re-send. The four examples pin
+`^4.0.0-beta.4`, and `vite-wallet` offers its re-send through
+`client.resendOf`. The size limits are tighter in CI only, which affects
+pull requests to this repository, not apps.
+
+It requires the stable candid-core pair, both pinned exactly, as in beta.3:
+
+- `@ic-reactor/core`: peer `@candid-core/schema` at exactly `0.3.0`;
+- `@ic-reactor/vite-plugin`: peer `@candid-core/cli` at exactly `0.2.0`.
+
+```sh
+npm install --save-exact @candid-core/schema@0.3.0
+npm install --save-dev --save-exact @candid-core/cli@0.2.0
+```
+
+### @ic-reactor/core
+
+#### Added
+
+- `isReactorError(error, canister, method)` narrows a direct call's error to
+  `ReactorError<E>`, where `E` is that method's `Err` arm, so `err` is typed
+  after `kind === "canister_err"` without a cast; for a method without an `Err`
+  arm, `err` stays `undefined` (#849). The guard checks at run time: every
+  error a call rejects with (a direct call, a query function or a mutation
+  function built from the canister) carries the canister object it was made
+  on, under an internal symbol, and the guard is `true` only for an error of
+  that method on that canister object. An error of another method, of another
+  canister object (the `certified: true` one, or the same canister of another
+  client) or of a `client.func` call is `false`, and a `false` result leaves
+  every `kind` possible. The one-argument form is unchanged, including
+  point-free use: `errors.filter(isReactorError)` is still typed
+  `ReactorError<unknown>[]`, because the one-argument signature is listed last.
+  It is an overload of an existing export: core still has 13 names.
+- `client.resendOf(error, canister, method, { dedupedBy })` offers to send a
+  write again exactly as it was sent, after a failure that left its outcome
+  unknown, and only for a method the app says deduplicates (#850). It returns
+  `undefined` unless `error` is a write of that method on that canister with
+  `mayHaveExecuted: true`, its argument is an object in which `dedupedBy`
+  finds a key (`(arg) => arg.created_at_time` for an ICRC-1 transfer; `null`
+  or `undefined` offers nothing), and the principal that sent it is the
+  caller now: nothing after a sign-out or a sign-in as another account, the
+  offer again once the sender signs back in, and on a view pinned to a
+  principal (hydration) the live caller decides. It also offers nothing once
+  the argument object was changed since it was sent, or once the canister
+  object resolves to another canister id than the write went to (a `{ name }`
+  the `ic_env` cookie maps elsewhere). The offer's `arg` is the attempt's own
+  argument, and goes out only as the same write. `send()` sends the bytes
+  the attempt sent, to the canister id it went to (a management call routed
+  by the effective canister id it went out with). `mutate(arg)`, on any
+  mutation of this client, sends it only to that method and canister id, and
+  only while it encodes to those bytes. Each refusal sends nothing: `cancelled`
+  (`caller_changed`) once someone else is the caller, `cancelled`
+  (`target_changed`) for another method or canister id, and `invalid_args`
+  (`arg_changed`) for an argument changed since. Once offered, that object
+  stays held to that write, so a new write needs a new argument object. The
+  client cannot check that a canister deduplicates: a method without such a
+  key has no safe re-send. It is a method of `Client`, not a new export: core
+  still has 13 names. Core's size limit is raised to 15 kB (14,957 B
+  measured, +508 B for `resendOf`), and the app checks to 90 kB (89,949 B,
+  +465 B) and 91.2 kB (91,155 B, +463 B). React's own code is unchanged.
+
+### @ic-reactor/react
+
+- No change but the version. Its peer `@ic-reactor/core` is packed as
+  exactly `4.0.0-beta.4`, so the two move together.
+
+### @ic-reactor/vite-plugin
+
+#### Added
+
+- A canister entry with a `canisterId` has its `didFile` fetched from the live
+  canister when the file is not on disk (#852, phase 1). The plugin reads
+  `candid:service` from certified state with `HttpAgent.readState`, checked
+  against the network's root key, writes it to `didFile`, and generates the
+  module from it; the file is committed with the app. A `didFile` on disk
+  costs no network request, under `vite build` and `vite dev`, and is fetched
+  again only on request: `IC_REACTOR_FETCH=<name>` (names separated by
+  commas, or `all`). The new `network` field says where the canister is:
+  `"ic"` (mainnet's root key, the default), `"local"` (icp-cli's
+  `http://127.0.0.1:8000`, its root key fetched) or `{ host }` (its root key
+  fetched only when the host is local, as `createClient` decides). An
+  unreachable network, a refused read (private metadata), absent metadata, a
+  canister that does not exist, a certificate that does not verify (naming
+  the root key it was checked against) and no answer within 30 seconds each
+  fail with their own message, naming the canister and what to do next, under
+  `failOnError` as generation does. A `didFile` that cannot be written fails
+  only the canisters that name it.
+  No export is added.
+- `@icp-sdk/core` `^6.1.0` is an optional peer, loaded only for a fetch.
+  Every app on `@ic-reactor/core` has it already.
+
+### Docs
+
+- Getting started's "Get a canister's .did" leads with the plugin's
+  `canisterId`, and keeps the script for an app without Vite. The Vite plugin
+  guide has a section on the fetch: when it happens, `network` and its root
+  keys, `IC_REACTOR_FETCH`, and its four failures.
+- The errors guide shows `isReactorError(error, canister, method)` and what it
+  checks; its duplicate-transfer recipe and the writes guide's direct
+  transfer read the typed `err` instead of casting it. The consumer guide
+  (`llms.txt`) and the skill say to use it after a direct call.
+- The writes guide has a section, "Sending the same write again", on
+  `client.resendOf` (#850): when a re-send is safe, what `dedupedBy` states,
+  that the offer goes out only as its sender, and the refusals
+  `caller_changed`, `target_changed` and `arg_changed`, each of which leaves
+  the write's outcome unknown. The errors guide lists the two new codes,
+  `target_changed` under `cancelled` and `arg_changed` under `invalid_args`,
+  says not to ignore a refused re-send as another `cancelled`, and its
+  duplicate-transfer recipe offers the re-send with `client.resendOf`. The
+  core reference page shows the three-argument `isReactorError` signature and
+  `resendOf` on `Client`, and the Vite plugin reference page lists the
+  optional `@icp-sdk/core` peer and when it is loaded.
+- Getting started has a section on keeping the IC stack (the client,
+  `AuthClient` and the generated module) out of an app's first load with
+  `React.lazy`, with no change to the library (#855). Measured on the Vite
+  wallet with Vite 8.3.0, the first load drops from 622.46 kB (193.56 kB
+  gzipped) to 222.30 kB (69.90 kB gzipped), and 401.79 kB (126.21 kB gzipped)
+  moves to chunks loaded asynchronously. It says what a route guard sees meanwhile:
+  `AuthState.status` keeps its four members, with none for "not loaded yet",
+  so a guard lives inside the lazy tree and the `Suspense` fallback stands for
+  "not known yet". It also says that the boundaries for `useSuspenseQuery`
+  reads and lazy routes go below the `ReactorProvider`: with only the entry's
+  boundary above it, a suspending read rebuilds the client on every attempt
+  and never renders. The Auth guide links to it.
+
+### CI (not published)
+
+- Core's size limit was set to 14.4 kB gzipped, just above its measured 14,347 B,
+  where it was 50 kB, as react's 1.28 kB already sits at its size. Two new
+  checks measure what an app pays with the peers included, which the
+  packages' own checks never see: `{ createClient }` (89,363 B against
+  89.5 kB) and `createClient` with `ReactorProvider` and `useClient`, React
+  itself left out (90,566 B against 90.7 kB). They run in `pnpm size`, CI's
+  "Check package sizes" step, from `scripts/size-app/`. A pull request that
+  moves a size states the delta and raises its limit deliberately
+  (CONTRIBUTING.md, "Size budget"). Core's config moved from its
+  `package.json` to `packages/core/.size-limit.js`, which is not published.
+- Core's size limit is raised to 14.5 kB: the guard's canister check adds
+  102 B (14,449 B measured). The app checks measure 89,484 B (+121 B) and
+  90,692 B (+126 B), still under their limits.
+
+### Examples (not published)
+
+- The four examples pin `^4.0.0-beta.4`.
+- `vite-wallet`'s "Send the same transfer again" is `client.resendOf`'s offer,
+  in `SendIcp.tsx` and `SendToContact.tsx`, in place of the attempt and its
+  sender the page tracked by hand. The offer is made only while the account
+  that sent the transfer is the caller, and a new test checks it is withdrawn
+  on a sign-out and made again once the same account signs back in. Its
+  `vite.config.ts` says when the plugin would fetch `ledger.did`: never while
+  the trimmed, committed file is on disk, unless `IC_REACTOR_FETCH=ledger`
+  asks. These edits waited for this release because each example installs
+  the published packages, which carry `resendOf` and the fetch from
+  4.0.0-beta.4 on.
+
+## core, react, vite-plugin 4.0.0-beta.3
+
+Prepared on 2026-10-07. It goes out under npm's `beta` dist-tag, as
+`@ic-reactor/core@beta`; `latest` stays 3.x until 4.0 GA. Changes since
+4.0.0-beta.2.
+
+An app on beta.2 upgrades by bumping all three packages to `4.0.0-beta.3`. An
+app on `network: "local"` against a dfx replica names it instead:
+`network: { host: "http://127.0.0.1:4943" }`.
+
+No export is added or removed (core 13, `@ic-reactor/core/testing` 2, react 4,
+vite-plugin 2), no peer changed, and a module generated for beta.2 need not be
+regenerated. Two things changed, as core's and the Vite plugin's entries
+below say:
+
+- The `auth` factory is handed the client's network, so
+  `auth: (network) => new AuthClient(network)` signs users in on the network
+  the client calls. Code that compiled against beta.2 compiles unchanged,
+  unless it calls a function typed `ClientOptions["auth"]` with no argument,
+  uses one where a function of no argument is expected, or passes as `auth` a
+  factory whose optional first parameter is not the network.
+- **BREAKING:** `network: "local"` is icp-cli's local network,
+  `http://127.0.0.1:8000`, not dfx's `http://127.0.0.1:4943`. The test
+  client's default host (where its fake replica answers) and the Vite
+  plugin's fallback `/api` proxy moved with it. `"env"` on a server with
+  dfx's `DFX_NETWORK=local` and no `ICP_NETWORK` keeps 4943.
+
+The guide (`llms.txt`) and the skill now say they apply to 4.0.0-beta.3, and
+the guide teaches the factory's argument. The four examples pin
+`^4.0.0-beta.3`, and the two that sign in (`next-ssr`, `vite-wallet`) pass
+the network to `AuthClient`.
+
+It requires the stable candid-core pair, both pinned exactly, as in beta.2:
+
+- `@ic-reactor/core`: peer `@candid-core/schema` at exactly `0.3.0`;
+- `@ic-reactor/vite-plugin`: peer `@candid-core/cli` at exactly `0.2.0`.
+
+```sh
+npm install --save-exact @candid-core/schema@0.3.0
+npm install --save-dev --save-exact @candid-core/cli@0.2.0
+```
+
+### @ic-reactor/core
+
+#### Added
+
+- The `auth` factory of `createClient` is called with one argument, the
+  client's network, under `@icp-sdk/auth` 10's own option names, so
+  `auth: (network) => new AuthClient(network)` signs users in on the network
+  the client calls (#790). `() => new AuthClient()` and every other factory
+  that takes no argument work as before, which for `AuthClient` means on
+  mainnet only, since such a factory ignores the network. No export is added:
+  the argument's type is written inline in `ClientOptions`.
+  - `network.agentOptions` is the host, root key and `shouldFetchRootKey` of
+    the client's own agents, and the client's `fetch` when one was given,
+    which `AuthClient` makes its mint and revoke calls with.
+  - `network.identityProvider` is, in order: the `ic_env` cookie's
+    `INTERNET_IDENTITY_PROVIDER` where the client trusts the cookie, with the
+    cookie's `PUBLIC_CANISTER_ID:internet_identity` or
+    `rdmx6-jaaaa-aaaaa-aaadq-cai`; for `"local"` or a network object whose
+    host is local, icp-cli's built-in Internet Identity,
+    `http://id.ai.localhost:<port of the host>/authorize` with
+    `rdmx6-jaaaa-aaaaa-aaadq-cai`; and otherwise absent, which `AuthClient`
+    reads as mainnet's Internet Identity.
+  - A replica that is not mainnet rejects every delegation mainnet's Internet
+    Identity mints. Where no provider can be named on a network that does not
+    verify against mainnet's root key (a trusted cookie that names an
+    `internet_identity` canister but no URL, `"env"` on a local page whose
+    cookie names no provider, or a replica with a root key of its own, given
+    or fetched), the client warns once, in development, when the factory
+    reads `network.identityProvider`, as `new AuthClient(network)` does, that
+    sign-in cannot work there, with the line that names a provider:
+    `(network) => new AuthClient({ ...network, identityProvider: { authorizeUrl, canisterId } })`.
+    A factory that names its own provider, as that line does, or builds an
+    auth that is not Internet Identity never sees it, and neither does a
+    spread that adds other options and names no provider, such as
+    `{ ...network, derivationOrigin }`, which must name one there. `"ic"` and
+    `"env"` on a mainnet page never warn, and neither does the test client of
+    `@ic-reactor/core/testing`, whose factory ignores the network.
+
+  Code that compiled against 4.0.0-beta.2 and stops compiling: a call of a
+  function typed `ClientOptions["auth"]` with no argument, or its use as a
+  `() => AuthLike`. Pass it the network, or type the function
+  `() => AuthLike`. A factory whose optional first parameter is not the
+  network, such as `(x?: string) => ...`, stops compiling too.
+
+#### Changed
+
+- **BREAKING:** `network: "local"` is icp-cli's local network,
+  `http://127.0.0.1:8000`, rather than dfx's replica on
+  `http://127.0.0.1:4943` (#790). 8000 is icp-cli's default gateway port
+  ([`gateway.port`](https://github.com/dfinity/icp-cli/blob/ffcb2235515bc5623e6c98ba0b9d24a303aaac36/docs/reference/configuration.md#L294),
+  [the `local` network](https://github.com/dfinity/icp-cli/blob/ffcb2235515bc5623e6c98ba0b9d24a303aaac36/docs/reference/configuration.md#L513),
+  [environments](https://github.com/dfinity/icp-cli/blob/ffcb2235515bc5623e6c98ba0b9d24a303aaac36/docs/concepts/environments.md#L73)).
+  For a dfx replica, name it: `network: { host: "http://127.0.0.1:4943" }`.
+  The same holds for:
+  - `"env"` on a server with `ICP_NETWORK=local` and no `ICP_HOST` or
+    `IC_HOST`, which now falls back to `http://127.0.0.1:8000`. With dfx's
+    `DFX_NETWORK=local` and no `ICP_NETWORK` (which overrides it), the
+    fallback stays dfx's `http://127.0.0.1:4943`, since that variable says
+    the project runs dfx.
+  - The Internet Identity the `auth` factory is handed for `"local"`, which
+    is `http://id.ai.localhost:8000/authorize`, the Vite plugin's default.
+  - `createTestClient` of `@ic-reactor/core/testing`, whose default host is
+    `"local"`'s. With no `network`, outside a page, it now answers at
+    `http://127.0.0.1:8000`, and its query keys carry that host as their
+    network segment. A test that asserted `http://127.0.0.1:4943` there
+    passes `network: { host: "http://127.0.0.1:4943" }` to keep it.
+
+### @ic-reactor/react
+
+#### Documentation
+
+- The README and `ReactorProviderProps`' doc comments build the client with
+  `auth: (network) => new AuthClient(network)`. The code is unchanged.
+
+### @ic-reactor/vite-plugin
+
+#### Changed
+
+- **BREAKING:** When detection fails, `/api` goes to icp-cli's local network,
+  `http://127.0.0.1:8000`, rather than `http://127.0.0.1:4943` (#790), as
+  `"local"` does in core and as the cookie's fallback Internet Identity,
+  `http://id.ai.localhost:8000/authorize`, already did. A project on a dfx
+  replica proxies `/api` itself (`server.proxy["/api"]`), which the plugin
+  leaves in place.
+
+### Docs
+
+- Every `auth` factory in the docs, the guide (`llms.txt`) and the READMEs
+  is `(network) => new AuthClient(network)`. The Auth guide's 25-line local
+  Internet Identity setup is that one line, with the rules above and the
+  override for a project that deploys its own `internet_identity`.
+- Getting started says where `icrc1.did` comes from, runs the first read
+  with `npx tsx`, says to change the default `App` import of Vite's
+  template, builds the transfer's argument in place, says to commit the
+  `.did` and the generated module (Vite's `react-ts` template type-checks
+  before the plugin generates), and names `injectEnvironment: false` for an
+  app that only talks to mainnet. A new section, "Get a canister's .did",
+  adds a script that saves a live canister's `.did` from certified state,
+  with the `icp canister metadata` command that does the same.
+
+### Examples (not published)
+
+- The four examples pin `^4.0.0-beta.3`. The two that sign in pass the
+  network to `AuthClient`: `next-ssr`'s provider and `vite-wallet`'s client
+  build it with
+  `(network) => new AuthClient(network)`. `vite-wallet`'s hand-built local
+  Internet Identity (`src/auth/internet-identity.ts` and its test) is gone: on
+  a local page the client hands its factory the cookie's provider and the
+  local network, and on a deployed page no provider, which `AuthClient` reads
+  as mainnet's. Its `isLocalPage` tests, which decide where the dev account is
+  offered, moved to `src/auth/local-page.test.ts`. These edits waited for this
+  release because each example installs the published packages, which carry
+  the factory's argument from 4.0.0-beta.3 on.
+- `node-agent-tool`'s network comment says `local` is icp-cli's
+  `http://127.0.0.1:8000`.
+
+## core, react, vite-plugin 4.0.0-beta.2
+
+Prepared on 2026-10-06. It goes out under npm's `beta` dist-tag, as
+`@ic-reactor/core@beta`; `latest` stays 3.x until 4.0 GA. Changes since
+4.0.0-beta.1.
+
+An app on beta.1 upgrades by bumping all three packages to `4.0.0-beta.2`, and
+the candid-core pair to its stable releases, both exact:
+
+```sh
+npm install --save-exact @candid-core/schema@0.3.0
+npm install --save-dev --save-exact @candid-core/cli@0.2.0
+```
+
+No export is added or removed (core 13, `@ic-reactor/core/testing` 2, react 4,
+vite-plugin 2), and a module generated for beta.1 need not be regenerated.
+Code that compiled against beta.1 compiles unchanged, unless it does one of
+the four things core's Changed entry on `queryOptions` lists, or switches
+exhaustively over candid-core's `ContractIssueCode`. What is new is
+one error code a missing canister now carries, an aimed form of the test
+client's `refuseNext`, and read options that TanStack Query's suspense hooks
+take without a cast.
+
+The 4 docs are at https://ic-reactor.b3pay.net/v4/: getting started, guides to
+the client, reads, writes, errors, auth, SSR, testing, values and the Vite
+plugin, a page per package, and "Migrating from 3.x" with the table of every
+removed 3.x name and what replaces it (#789). Each package's `homepage` now
+points at its page there.
+
+### @ic-reactor/core
+
+#### Added
+
+- `ReactorError.code` is `"canister_not_found"` when the IC answers that the
+  canister a call was routed to does not exist (#821), on a read or a write.
+  The IC says it in two ways, and both get the code: a boundary node's HTTP
+  400 whose body's error line is `canister_not_found`, for a canister id
+  outside every subnet's range, and a replica's reject code 3 with the IC
+  error code `IC0301`, for an id inside a subnet's range that holds no
+  canister. Mainnet answers both ways, and the fake replica of
+  `@ic-reactor/core/testing` answers the second. `kind` and `mayHaveExecuted`
+  are unchanged from the classification table. Any other HTTP 400 and any
+  other reject still has no `code`.
+- `refuseNext(status, { method?, canister?, times? })` on the object
+  `createTestClient()` returns (`@ic-reactor/core/testing`): a refusal aimed
+  at the queries and calls that name `method` and are addressed to
+  `canister`, each when it is given, so a test can throttle `icrc1_transfer`
+  while the reads around it are answered (#822). A query and a replicated
+  call of the same method both match; `canister` is the canister a request
+  names, and need not be mocked; `times` (default 1) counts matching
+  requests, each send of a call the client re-sends included. The status and
+  `read_state` requests an agent makes on its own never match. A request that
+  several refusals match is refused by the one armed first. An option it does
+  not have, an empty `method` or a `canister` that is not a canister id
+  throws a `TypeError`. `refuseNext(status, times?)` is unchanged: it refuses
+  the next `times` queries or calls, whatever they are for. No export is
+  added.
+
+#### Changed
+
+- `client.queryOptions(...)` built from variables that cannot be `skipToken`
+  (a method without arguments called without them or with `undefined`, or
+  variables of a type `skipToken` is not assignable to) returns options whose
+  `queryFn` type excludes `SkipToken`, so TanStack Query's `useSuspenseQuery`
+  and `useSuspenseQueries` take them without a cast (#828). Variables typed
+  `V | SkipToken`, or `skipToken` itself, keep `SkipToken` in `queryFn`'s
+  type, and the suspense hooks still refuse them. `queryOptions` has a second
+  signature for that case, and `CanisterQueryOptions` a third type parameter
+  that defaults to today's type. The options' `retry` also takes an error
+  typed `unknown`, as `useQueries` and `useSuspenseQueries` type it, so those
+  hooks take the options too; `useQuery` and a `QueryObserver` still type the
+  query's error `ReactorError<E>`. Variables of a type `skipToken` is
+  assignable to cannot be told from it: the options of such a method keep
+  `SkipToken` whatever the variables: read it with `useQuery`, or cast its
+  `queryFn` for a suspense read. Of what `candid-core-cli gen` writes, that is only a method whose one
+  argument is Candid `reserved` (typed `unknown`): it writes `record {}` as
+  `Record<string, never>`, which a suspense read takes. A type written by
+  hand that `skipToken` fits, such as `{}`, is another. Types only: nothing
+  changes at run time, and no export is added. Code that compiled against
+  4.0.0-beta.1 and stops compiling:
+  - `queryFn === skipToken` on options built from variables that cannot be
+    `skipToken` is now TS2367 ("no overlap"). Such a check was always false,
+    so remove it.
+  - A function typed `Client["queryOptions"]` (one function cannot satisfy
+    both signatures), and a call that spreads
+    `Parameters<Client["queryOptions"]>` back into `client.queryOptions`
+    (`Parameters` takes the last signature only). Call `client.queryOptions`
+    with the canister and method, and spread its result to add options:
+    `{ ...options, staleTime: 1 }`. `ReturnType<Client["queryOptions"]>`
+    still compiles.
+  - A `retry` written into the options' type with its error parameter
+    annotated, such as `retry: (n: number, e: ReactorError<E>) => ...` in a
+    value typed by the options: the options' `retry` must now also take an
+    error typed `unknown`. Annotate it `unknown`, or leave the parameter to
+    the context. Passing such a `retry` to `useQuery({ ...options, retry })`
+    still compiles.
+  - A variable inferred from the options of a read that cannot be skipped,
+    given the options of one that can: `let o = client.queryOptions(c, m, v)`
+    then `o = client.queryOptions(c, m, skipToken)` is now TS2322, and so is
+    the same through a `useState` setter, a `push` onto an inferred array or
+    a parameter typed `typeof o`. The two options are different types now.
+    Build both in one expression,
+    `ready ? client.queryOptions(c, m, v) : client.queryOptions(c, m, skipToken)`,
+    whose union `useQuery` takes, or type the variables `V | SkipToken` so
+    that both reads give the options that keep `SkipToken`.
+
+  Wrong variables or an unknown method name are now reported as TS2769 ("No
+  overload matches this call", listing both signatures), where they were
+  TS2345.
+
+- Peer dependency: `@candid-core/schema` at exactly `0.3.0`, the stable
+  release of the 0.3 line, where beta.1 pinned `0.3.0-beta.1`. The other peers
+  are unchanged. Migration: `npm install --save-exact @candid-core/schema@0.3.0`,
+  with the plugin's `@candid-core/cli@0.2.0` below. What an app meets, from
+  candid-core's [0.3.0 release notes](https://github.com/b3hr4d/candid-core/blob/acabe0fcfbd8019d14e2c2550c5e6cd872a3529a/.github/release-notes/npm/schema/0.3.0.md):
+  - A `rec` hop is no longer charged against the decode limits, so the
+    client's `maxDepth` (default 256) counts a reply's Candid nesting alone. A
+    recursive reply, such as an ICRC-3 block's `Value`, may nest deeper at the
+    same `maxDepth` than before; through a `schemaFromContract()` actor, about
+    128 levels used to reach the default, and now 256 do.
+  - Replies refused that were accepted, only at a limit: the `null` a reply
+    gets for a field its message omits (`opt`, `null` or `reserved`) is now
+    charged one depth level, at the field's own level, and one element. So
+    such a field at exactly the client's `maxDepth` rejects `invalid_reply`
+    with a `value_depth` issue, and a large reply whose records omit such
+    fields can pass the decoder's 1,000,000-element bound, which the client
+    does not change: 500,000 records that each omit one field now cost
+    1,000,001 elements and reject `invalid_reply` with a `value_elements`
+    issue. A test client checks its mocks' replies at its `maxDepth` too,
+    where a tag-only variant (`{ tag }`) at exactly `maxDepth` is now
+    refused. At the default `maxDepth`, only a reply 256 levels deep reaches
+    the depth refusals.
+  - `schemaFromContract()` refuses a Contract document with a key the format
+    does not define, a type node nothing reaches, or type nodes and no root,
+    as candid-core's own loader does. Every document `candid-core compile`
+    writes still loads. Its `ContractIssueCode` gains `unknown_key`,
+    `orphan_type_node` and `rootless_type_arena`.
+
+#### Documentation
+
+- The guide (`llms.txt`) said the `invalidates` option of
+  `client.mutationOptions()` names other reads. The list replaces the
+  default (every read of the canister written to): it now says so, and to
+  name the written canister too if its reads change (#829). The code is
+  unchanged.
+
+### @ic-reactor/react
+
+#### Documentation
+
+- The README, `llms.txt` and `useClient()`'s doc comment told an app to
+  ignore kind `"cancelled"` (code `"caller_changed"`) in a `QueryCache`
+  `onError`, which no app can set: the client owns its `QueryClient` and
+  takes no `QueryCache`. They now name the route an app has, a listener of
+  `client.queryClient.getQueryCache().subscribe()`, whose `"updated"` event
+  with `action.type` `"error"` carries the cancellation (#829). The code is
+  unchanged.
+
+### @ic-reactor/vite-plugin
+
+CI now runs its typecheck and tests at the floor of each Vite major its `vite`
+peer range accepts, 4.2.0, 5.0.0, 6.0.0, 7.0.0 and 8.0.0, where before it ran
+on the newest Vite only (#823). The range is unchanged.
+
+#### Changed
+
+- Peer dependency: `@candid-core/cli` at exactly `0.2.0`, the stable generator
+  that pairs with `@candid-core/schema` `0.3.0`, where beta.1 pinned
+  `0.2.0-beta.1`. The plugin's install hints name it; nothing else in the
+  plugin changed. Migration:
+  `npm install --save-dev --save-exact @candid-core/cli@0.2.0`. It writes the
+  same module as 0.2.0-beta.1 for every `.did` both accept, and refuses two
+  that 0.2.0-beta.1 did not: a type on a cycle through `opt` alone
+  (`type T = opt T;`, `did_type_check_error`) and a run of more than 256
+  consecutive comments (`resource_limit_exceeded`). The plugin reports either
+  as that canister's generation failure. See candid-core's
+  [0.2.0 release notes](https://github.com/b3hr4d/candid-core/blob/acabe0fcfbd8019d14e2c2550c5e6cd872a3529a/.github/release-notes/npm/cli/0.2.0.md).
+
+### Examples, e2e and evals (not published)
+
+- The four examples pin `^4.0.0-beta.2`, and three use what it adds:
+  `node-agent-tool`'s mock ledger throttles exactly `icrc1_transfer` with the
+  aimed `refuseNext` instead of counting the reads before it, the
+  `icrc-ledger` sandbox's HTTP 429 faults hit only the transfer, and
+  `next-ssr`'s balance route answers a missing canister with a 502 that
+  carries `code: "canister_not_found"` (#821, #822).
+- A new script and workflow run each example the way someone who copies it
+  out of the repository does, and as StackBlitz does: a plain `npm install`
+  of the `@ic-reactor/*` beta published on npm, then its typecheck, tests,
+  build and StackBlitz start command. The release workflow runs it once the
+  packages are published (#788). Each example has a `.stackblitzrc`, and
+  `jsdom` is pinned to `30.0.1`.
+- `vite-wallet`'s and `icrc-ledger`'s transfers carry a memo of each
+  transfer's own, kept for its re-send, so two transfers of the same amount
+  in the same millisecond are never taken for each other's `Duplicate`; their
+  test ledgers deduplicate on the whole argument, memo included (#833, #838).
+- The e2e suite is rewritten for 4: twelve cases on an icp-cli 1.2.0 local
+  network, over a `hello_actor` module generated by `candid-core-cli gen`
+  (#787).
+- The examples and the e2e suite pin `@candid-core/schema` `0.3.0` and
+  `@candid-core/cli` `0.2.0`. Every module the examples, core's tests and the e2e
+  suite generate is byte-identical under 0.2.0.
+- The eval harness can build the `v4` condition from the published
+  4.0.0-beta.1 tarballs, and the GA eval (Addendum 4 of
+  `evals/PREREGISTRATION.md`) ran on the published 4.0.0-beta.1 (#790). GA
+  ships on the result of Addendum 4, stated as recorded: rule 1 was not met as
+  written, because the leak audit flagged react-wallet/`v4`#14's read of its
+  own persisted tool output; all 80 runs were safe, and the pooled bound held
+  in both analyses (−0.0897 main, −0.0876 intent-to-treat, against −0.10).
+
+## core, react, vite-plugin 4.0.0-beta.1
+
+The first prerelease of ic-reactor 4 (milestone 1, #790), published under
+npm's `beta` dist-tag: install it as `@ic-reactor/core@beta`. `latest` stays
+3.x until 4.0 GA. Changes since core and react 3.13.0 and vite-plugin 0.15.1.
+
+ic-reactor 4 is a breaking rewrite, not an upgrade of 3.x. It is a thin layer
+over the module `candid-core-cli gen` writes from a `.did` file, plus one
+guide, `node_modules/@ic-reactor/core/llms.txt`, shipped in core's tarball.
+An app calls canisters through a client from `createClient` and reads and
+writes them with TanStack Query's own hooks and the options the client
+builds. There are no reactors, hook factories or generated hooks. The three
+packages release together, at one version.
+
+3.x stays on `main` (security fixes only until 4.0 GA) and is documented at
+https://ic-reactor.b3pay.net/v3/. Migration: there is no in-place upgrade;
+generate each canister's module with `candid-core-cli gen` and port the calls
+to the client by the guide. The table of every removed name and what replaces
+it comes with the 4 docs (#789).
+
+### @ic-reactor/core
+
+#### Added
+
+- `createClient(options)`: one client per browser tab, or per request on a
+  server. It takes a `network` and exactly one caller: `identity` (an
+  `Identity`, or `"anonymous"` for a read-only client) or `auth` (a factory
+  of an `AuthLike`, such as `() => new AuthClient()` from `@icp-sdk/auth` 10,
+  called once and only in a browser). `allowEnvConfig`, `fetch` and
+  `maxDepth` (default 256) are optional. The client owns a TanStack
+  `QueryClient` (`client.queryClient`) that dehydrates and hydrates `bigint`,
+  `Uint8Array` and non-finite floats without loss.
+- `network`: `"ic"` (mainnet and its built-in root key), `"local"`
+  (`http://127.0.0.1:4943`, root key fetched), `"env"` (the page's network,
+  with canisters named `{ name }` through the `ic_env` cookie), or
+  `{ host, rootKey?, name?, fetchRootKey? }`. A given `rootKey` is used and
+  never fetched; without one, a root key is fetched only from a loopback or
+  `localhost` host, unless `fetchRootKey: true` is written out.
+- `client.canister<Actor>(actor, { id } | { name })`: a frozen object of plain
+  async methods, one per Candid method, typed from the generated `Actor` and
+  memoized, so it can be called in render. A method whose result is
+  `variant { Ok; Err }` resolves with the `Ok` value and rejects the `Err` as
+  kind `canister_err`. `{ id, certified: true }` sends `query` methods through
+  the certified path. A call to the management canister (`aaaaa-aa`) takes
+  its effective canister id from its arguments.
+- `client.queryOptions(canister, method, args | skipToken)`,
+  `client.mutationOptions(canister, method, { invalidates? })` and
+  `client.queryKey(canister, method?, args?)`, the options and keys for
+  TanStack Query. `queryOptions` throws for an update method unless its
+  fourth argument is `{ update: "idempotent" }`.
+- `client.func<F>(funcSchema, ref)` calls a func reference a reply carried,
+  such as an ICRC ledger's archive callback.
+- `client.caller()`, `client.authState()`, `client.subscribe(fn)`,
+  `client.signIn()`, `client.signOut()` and `client.dispose()`. Every call
+  made after `dispose()`, writes included, rejects `cancelled` with code
+  `client_disposed` and sends nothing (#818).
+- `isReactorError(error)` and the types `ReactorError` and
+  `ReactorErrorKind`. Every rejection of a client call is a `ReactorError`
+  with one of eight kinds (`invalid_args`, `unauthenticated`,
+  `not_delivered`, `outcome_unknown`, `rejected`, `invalid_reply`,
+  `canister_err`, `cancelled`) and a `mayHaveExecuted` boolean, which a
+  classifier sets from the reject code, the HTTP status and whether the call
+  was an update. On the management canister, reject codes 1 to 3 do not prove
+  that a write had no effect.
+- `parseUnits(text, decimals, { signed? })` and
+  `formatUnits(value, decimals, { maxFractionDigits?, minFractionDigits? })`
+  convert token amounts exactly, in `bigint`. `parseUnits` throws for text
+  that is not a plain decimal, for a negative unless `signed`, and for excess
+  fraction digits.
+- The types `Client`, `ClientOptions`, `Network`, `AuthLike`, `AuthState`,
+  `Canister` and `CanisterTarget`. With the names above, the entry exports 13.
+- `@ic-reactor/core/testing` exports `createTestClient` and `TestHandlers`: a
+  real client over an in-memory replica that signs and verifies as a replica
+  does, passed in through the client's `fetch` (nothing global is stubbed),
+  with canisters written as functions of Candid values and a sign-in the test
+  controls.
+
+#### Changed
+
+- The client keeps one immutable agent per principal and never replaces an
+  agent's identity. A call goes out as the principal current when it was
+  made. A read made for one caller that settles after a sign-in, sign-out or
+  switch rejects `cancelled` instead of landing in the new caller's cache.
+- Query keys name the caller:
+  `["ic-reactor", network, caller, canisterId, method, args]`, so one
+  principal's cached answer is never served to another. Build keys with
+  `client.queryKey`, never by hand.
+- An update is sent again only on proof that the canister never received it
+  (reject code 2 or HTTP 429), at most twice, inside the call; any other
+  failure is final. A read retries at most 3 times, only a `not_delivered`
+  failure, and never on a server.
+- A mutation is never retried: `mutationOptions` returns `retry: false`. By
+  default it invalidates its canister's reads, for every caller, after a
+  success, a `canister_err`, or a failure that may have executed.
+- A write is refused before it is sent (`unauthenticated`) while nobody is
+  signed in, and always on a client built with `identity: "anonymous"`.
+- Values are candid-core's: a principal is branded text (`principal()` and
+  `isPrincipal()` from `@candid-core/schema`), `opt T` is `T | null`, a
+  variant is `{ tag, value }` and every `blob` is a `Uint8Array`.
+- Peer dependencies: `@candid-core/schema` at exactly `0.3.0-beta.1` (new:
+  install it with `--save-exact`), `@tanstack/query-core` `^5.62.0` (no longer
+  optional), `@icp-sdk/core` `^6.1.0`, and `@noble/curves` `^2.2.0`, still
+  optional and used only by `./testing`. `zod` is no longer a dependency.
+  Migration: `npm install --save-exact @candid-core/schema@0.3.0-beta.1`.
+
+#### Removed
+
+- The 3.x runtime: `ClientManager`, `Reactor`, `DisplayReactor`, the display
+  codecs and zod validation, the 3.x errors (`CanisterError`, `CallError`), the key and
+  retry helpers (`generateKey`, `reactorRetry`), `formatTokenAmount`,
+  `parseTokenAmount` and `isPrincipalText`, and the 3.x test helpers
+  (`installFakeReplica`, `createTestCanister`). They stay on the 3.x line.
+
+### @ic-reactor/react
+
+#### Added
+
+- `ReactorProvider({ client: () => Client, children })` calls its factory
+  once per mounted tree, renders TanStack Query's `QueryClientProvider` with
+  the client's `QueryClient`, and disposes a client its factory created when
+  it unmounts (`StrictMode`-safe). A client the app owns, passed as
+  `client={() => client}`, is borrowed and never disposed.
+- `useClient()` returns the nearest provider's client, and throws outside one.
+  Its component renders again whenever the caller's principal changes, and
+  the keys it builds are the caller's that the render shows: on a server and
+  while a page hydrates, the anonymous caller's. So a tab that holds a
+  session hydrates from the keys the server prefetched, with no mismatch and
+  nothing read again, then reads the session's keys (#813).
+- `useAuth()` returns `{ status, principal, signIn, signOut }`. `status` is
+  `"anonymous"`, `"signed-in"`, `"expired"` or `"signed-in-elsewhere"`; it is
+  `"anonymous"` on a server and in a hydrating page's first render.
+- Known limits of a signed-in reload, described in the README's "Keys follow
+  the caller a render shows": a Suspense boundary still hydrating below a
+  component that renders with the caller is rendered on the client when that
+  component moves to the session (pass such a boundary as `children`), and a
+  component that reads with `useSuspenseQuery` needs a Suspense boundary
+  above it.
+- The type `ReactorProviderProps`. The entry exports these 4 names and never
+  re-exports `@ic-reactor/core`.
+
+#### Changed
+
+- `@ic-reactor/core` is a peer dependency at exactly this package's version
+  (it was a dependency). The other peers are `@tanstack/react-query`
+  `^5.90.2` and `react` `>=18.0.0`; `@icp-sdk/auth`, `@icp-sdk/core`,
+  `@noble/curves` and `react-dom` are no longer peers.
+
+#### Removed
+
+- Every 3.x hook and factory: `defineReactor`, `createActorHooks`,
+  `createReactorProvider`, `createQuery`, `createMutation`, the suspense and
+  infinite variants, `createAuthHooks`, the identity-attribute hooks and the
+  re-exported `skipToken`; and the auth classes behind them,
+  `AuthenticationManager` and `IdentityAttributesManager`. Sign in with an
+  `AuthLike` passed to `createClient` and `useAuth()`. Read and write with TanStack Query's `useQuery`
+  and `useMutation` over `client.queryOptions` and `client.mutationOptions`.
+- The `react-server` entry and `@ic-reactor/react/testing`.
+
+### @ic-reactor/vite-plugin
+
+The plugin joins the lane of core and react, at their version.
+
+#### Changed
+
+- Generation runs `candid-core-cli gen` from the app's own `@candid-core/cli`,
+  in a child process per `.did` file, so a generator failure stops that
+  process and not the dev server. It writes candid-core's module (named after
+  the `.did` file, exporting `actor` and the type `Actor`) and its
+  `.envelope.json` into `outDir`, by default `src/canisters`, and nothing
+  else.
+- `canisters` is a record keyed by canister name,
+  `{ didFile?, outDir?, canisterId? }`, instead of an array of entries.
+  `injectEnvironment` and `failOnError` work as before. The first line the
+  plugin logs names `node_modules/@ic-reactor/core/llms.txt`. Migration:
+  `canisters: [{ name: "ledger", didFile }]` becomes
+  `canisters: { ledger: { didFile } }`.
+- `@candid-core/cli` is a peer dependency at exactly `0.2.0-beta.1`, the
+  generator that pairs with `@candid-core/schema` `0.3.0-beta.1`. The `vite`
+  range is unchanged. Migration:
+  `npm install --save-dev --save-exact @candid-core/cli@0.2.0-beta.1`.
+
+#### Removed
+
+- Generation through `@ic-reactor/codegen`, which is no longer a dependency:
+  the generated reactor and hook files (`index.generated.ts`,
+  `index.factories.generated.ts`, `index.ts`) and the options that shaped
+  them (the top-level `outDir`, `clientManagerPath` and `target`, and each
+  entry's `name`, `mode`, `target` and `factories`).
+
+## core, react, candid 3.13.0
+
+Changes since core, react and candid 3.12.5.
+
+### @ic-reactor/core
+
+#### Added
+
+- `reactor.forCanister(canisterId)` returns a memoized sibling reactor for
+  another canister of the same interface. It has the same class, `ClientManager`
+  and validators, and its calls and query keys use its own canister. Use it
+  instead of `setCanisterId` or one hand-built reactor per canister. A
+  subclass's constructor must build on the `canisterId` it is given;
+  `forCanister` throws when the new reactor lands on another canister.
+- `ServiceOf`, `TransformOf`, `ReactorArgsOf`, `ReactorDataOf` and
+  `ReactorErrorOf` read a method's types off `typeof reactor`.
+- `formatTokenAmount(value, decimals, options?)` and
+  `parseTokenAmount(text, decimals)` convert ledger base units exactly.
+  `isPrincipalText(text)` validates typed principal text.
+- `clientManager.fetchAcrossIdentitySwitch(fetch)` runs a hand-written
+  `queryClient.fetchQuery` / `fetchInfiniteQuery` again when a sign-in or
+  sign-out switches the principal while it runs (#647).
+- `clientManager.explicitRootKey` reports a root key the app passed as
+  `agentOptions.rootKey` (#713).
+- `isRetryableUpdateError` and `reactorUpdateRetry` retry an update call only
+  after a `SysTransient` rejection, and `Reactor.getQueryRetry()` gives the
+  retry a query of a method falls back to (#622).
+- `Reactor.fetchQuery(params, options?)` takes a second argument of TanStack
+  Query fetch options (`retry`, `retryDelay`, `networkMode`, `meta`, ...); the
+  key and query function still come from `params`. The query factories pass
+  their config's options through it, so a subclass that overrides `fetchQuery`
+  still sees their fetches (#502).
+- `fromZodSchema(schema, { async: true })` accepts zod schemas with async
+  refinements (#593).
+- `createPollingStrategy({ timeoutMs })`, 5 minutes per request by default
+  (#563).
+- `@ic-reactor/core/testing` exports `installFakeReplica` and
+  `createTestCanister`. The fake replica signs certificates and checks request
+  signatures, so tests run the real `Reactor` and hooks. `@noble/curves` is a
+  new optional peer dependency, used only by this entry.
+
+#### Changed
+
+- `Reactor.invalidateQueries()` returns TanStack Query's `Promise<void>`, which
+  resolves once the active matches have refetched. Migration: `await` it, or
+  prefix a call you do not wait for with `void`.
+- `reactorRetry` no longer retries an HTTP 4xx other than 408 and 429, such as
+  an expired delegation's 400 (#646). Migration: none; these errors now show
+  after the agent's own attempts instead of about 20 seconds later.
+- A query of an update method that sets no `retry` retries only a
+  `SysTransient` rejection, within the QueryClient's retry default (#622).
+  Migration: call state-changing methods through a mutation.
+- `Reactor.fetchQuery()`, and so every query factory's `fetch()`, fetches again
+  as the new principal when a sign-in or sign-out cancels it, instead of
+  rejecting with TanStack's `CancelledError` (#647). When the first run and
+  three runs again are each overtaken by a switch, it rejects with a
+  `CallError`. Migration: remove `CancelledError` handling from loaders.
+- `ClientManager.updateAgent()` keeps the cache when the new identity has the
+  principal already installed, as a renewed delegation or a repeated sign-in
+  does. Only entries that failed, or whose fetch in flight then fails, refetch
+  (#719). Migration: after installing an identity that changes what canisters
+  see under the same principal, such as an `AttributesIdentity`, invalidate the
+  affected queries yourself.
+- Codespaces (`*.github.dev`) and Gitpod (`*.gitpod.io`) pages without an
+  `agentOptions.host` route through their own origin with network `"remote"`
+  instead of `https://ic0.app`, and their `ic_env` cookie is no longer trusted
+  (#643). Migration: pass `allowEnvConfig: true` to read the cookie on those
+  hosts.
+- In a development build, `ClientManager` skips query signature verification by
+  default only for a local replica or a Codespaces or Gitpod tunnel to one. A
+  dev page whose agent points at any other host, such as mainnet's
+  `https://icp-api.io`, now verifies signatures, as a production build does,
+  and a web worker follows the same default as its page. Migration: none; an
+  explicit `verifyQuerySignatures` still wins.
+- On a local host, `initialize()` keeps a root key passed as
+  `agentOptions.rootKey` instead of replacing it with the replica's (#713).
+  Migration: pass the replica's key, or no key.
+- The args segment of a query key is no longer `JSON.stringify(args)`.
+  `generateKey` sorts plain-object keys and writes `NaN`, `±Infinity` and `-0`
+  behind a U+0000 tag. `generateQueryKey` also writes a blob as tagged hex,
+  gives a `DisplayReactor` value one form whichever form was passed, and tags an
+  argument the reactor would refuse (#515, #761, #762, #765). A query sent
+  through `callConfig.agent`, when that is not the manager's own agent, is keyed
+  with an `{ agent: n }` segment (#642). Migration: build keys with
+  `reactor.generateQueryKey(...)` (or `generateKey`), never by hand or with
+  `JSON.stringify`.
+- A validator that throws or rejects is reported as a `CallError`
+  ("Failed to validate the arguments of <method>") with the thrown value as
+  `cause`, from `callMethod`, `callMethodWithValidation` and `validate` alike.
+  A thrown `ValidationError` passes through unchanged (#593). Migration: read
+  `error.cause` where code caught the raw error.
+- `CanisterError.details` is typed as the error value's own `details` field
+  (`CanisterErrorDetails<E>`), e.g. `[] | [Array<[string, string]>]` from a
+  `Reactor`, instead of `Map<string, string>`, which Candid decoding never
+  returns; runtime values are unchanged (#685). `CanisterError` reads an
+  `opt text` message of an API-shaped error. `ApiError`'s `message` and
+  `details` are type parameters that default to `unknown`, and
+  `CanisterError.isApiError()` narrows them to `unknown` (#690). Migration: read
+  `details` in the shape the canister returns it, not as a `Map`, and name the
+  payload types, e.g. `ApiError<[] | [string], [] | [Array<[string, string]>]>`.
+- `createPollingStrategy` keeps its attempt count, clock and timeout per
+  request, so one instance can serve a whole reactor, and gives up after
+  `timeoutMs` (#563). Migration: `timeoutMs: Infinity` restores polling without
+  a limit.
+- `DisplayReactor` sends `NaN`, `±Infinity` and `-0` floats back as it read
+  them, instead of refusing a non-finite float (#632). Migration: none; text
+  from a form must still spell a finite number.
+- `DisplayReactor` displays `opt opt T`'s `some(none)` as `null` and none as
+  `undefined`, so a cleared value differs from one never set, as Internet
+  Identity's and Orbit's config types need (#486). Encoding is unchanged: `null`
+  and `undefined` both send none, and `[null]` sends `some(none)`. Migration: to
+  tell none from `some(none)`, check `=== undefined` and `=== null`; `== null`
+  still covers both.
+- `hexToUint8Array`, and so a `DisplayReactor` blob argument, refuses hex with
+  an odd number of digits instead of padding it with a leading zero. Padding
+  shifted every byte, so a subaccount or memo that lost its last digit was sent
+  as different, valid-looking bytes. Migration: pass two hex digits per byte.
+- `jsonToString` writes a `Principal` as its text and a `Uint8Array` as hex,
+  instead of `{"__principal__": ...}` and an object keyed by index. Migration:
+  drop a custom replacer that did this, and update code that parsed the old
+  output.
+
+#### Fixed
+
+- Update calls: a v4 response whose certificate has no status for the request
+  now falls back to polling. It used to fail with a `CallError` for a call that
+  could still commit, which invited a retry that ran a transfer twice (#508). An
+  anonymous call submitted before the first sign-in keeps polling as anonymous,
+  so a sign-in during its polling no longer reports a committed call as failed.
+  `pollingOptions.blsVerify` now also checks synchronous (v4) responses, not
+  only polled ones.
+- On a local replica with no root key supplied, the agent fetches the replica's
+  key before its first request. A call made before `initialize()` finished no
+  longer fails certificate verification, including an update call that had
+  already run on the replica when it was reported as failed.
+- `ClientManager` host detection: every loopback address (`127.0.0.0/8`,
+  `[::1]`) counts as local (#512). A host without a scheme, such as
+  `127.0.0.1:4943`, is read the way `HttpAgent` reads it instead of as mainnet.
+  A web worker routes like the page that started it instead of falling back to
+  `https://ic0.app`. Construction no longer throws in React Native or on a page
+  with an opaque origin such as `file://` or `about:blank` (#510).
+- `ClientManager` resolves `agentOptions` into a copy. A frozen options object
+  no longer throws. One options object shared by two managers no longer carries
+  the first manager's resolved settings, such as a root key from the `ic_env`
+  cookie, into the second (#516).
+- `ClientManager` subscriptions: calling the unsubscribe of a callback
+  registered twice removes only that registration (#513). A subscriber that
+  throws no longer stops later subscribers from being notified. A change made
+  from inside a callback is no longer followed by the older value.
+- `initializeAgent()` recovers when an agent-state subscriber throws. The failed
+  attempt clears `isInitializing` and `isInitialized`, so the next call starts a
+  fresh attempt instead of returning the old rejection or staying in error for
+  the rest of the session. A subscriber that calls `initializeAgent()` on the
+  `initializing` notification now waits for that attempt (#514).
+- A sign-in or sign-out sweeps the query cache once instead of once per
+  registered canister. With 1,000 canisters the sweep takes 0.7 ms instead of
+  166 ms.
+- Query keys follow the Candid value a call sends, so one call is no longer
+  answered from another's cache entry:
+  - records with the same fields in any order share a key, while `NaN`,
+    `±Infinity` and `-0` no longer share one (#515);
+  - a blob has one key whether it is passed as a `Uint8Array`, a `number[]` or
+    hex text, and a 1 MB blob's key segment shrinks from 13.1 MB to 2.1 MB;
+  - a `DisplayReactor` map object, bare or wrapped `opt`, or variant with or
+    without `_type` is keyed by what it sends (#761, #762), and so is a record
+    or variant given as a class instance or with a non-enumerable field (#768);
+  - an argument the reactor refuses, such as `undefined` for `null` or a bigint
+    for `text`, fails instead of returning a valid call's cached result (#765).
+- A query sent through `callConfig.agent` (another identity or network) gets a
+  cache entry of its own. It used to share the entry of the same query through
+  the manager's agent, so whichever ran first answered both, such as a
+  `whoami` for the wrong principal (#642).
+- After `setCanisterId`, a retry or refetch of an existing query fetches the
+  canister its key names. It used to cache the new canister's answer under the
+  old canister's key (#509).
+- `invalidateQueries()` without a `functionName` targets `callConfig.canisterId`
+  when one is given. With params but no method, it now matches the canister's
+  queries instead of none (#511).
+- Only a Result variant is unwrapped. A record with an `ok` or `err` field, or
+  with its own `_type` field beside one, is returned whole instead of resolving
+  to that field or throwing a `CanisterError` on success. `OkResult` and
+  `ErrResult` type it the same way (#517).
+- `JSON.stringify` of a `CanisterError`, `CallError` or `ValidationError` that
+  holds BigInts, such as any ICRC-1 transfer error, no longer throws. Each class
+  has a `toJSON` that writes BigInts as decimal strings and hands a replacer the
+  error's own values (#518).
+- `isCanisterError`, `isCallError` and `isValidationError` recognise errors
+  thrown by another copy of `@ic-reactor/core` loaded in the same app, so a
+  mutation's `onCanisterError` runs and `reactorRetry` retries their transport
+  failures. Such a `ValidationError` or `CanisterError` also keeps its type
+  through `callMethod`, `callMethodWithValidation` and `validate` (#593).
+- Validation: a validator for a method that takes no arguments now runs when
+  `args` is omitted. When `callMethod()` refuses an async validator, it no
+  longer leaves an unhandled rejection. `ValidationError.getIssuesForPath` and
+  `hasErrorForPath` find whole-argument issues under `""` and accept a numeric
+  array index, matching `1` and `"1"` alike (#592).
+- Methods typed by a recursive func alias (`type f = func (f) -> (f)`) work.
+  `callMethod`, `fetchQuery` and `isQueryMethod` no longer fail on them (#608).
+  `DisplayReactor` builds their codecs instead of dropping the codecs of that
+  method and every method after it (#557).
+- The display types of a type that contains itself through `opt`, `vec`, a tuple
+  or a map, such as Motoko's `List`, now resolve. They used to fail with TS2589
+  in every hook and call on that method (#566).
+- `DisplayReactor` arguments:
+  - a one-element `opt` value is no longer mistaken for the `[value]` wrapper,
+    so a value the codec decoded encodes back. This fixes the cycles ledger's
+    `opt vec record { Account; nat }` with one balance, `opt vec vec T`,
+    `opt vec blob` given `[bytes]`, `opt opt vec text`, and a text-keyed map
+    passed in wrapper form (#484);
+  - a record field or variant arm named like an `Object.prototype` member
+    (`constructor`, `toString`, ...) is treated as absent when it is left out,
+    even for a value from another realm, instead of sending the inherited
+    function. `getVariantValue` and `getVariantKeyValue` no longer return the
+    inherited function either (#483);
+  - a `Map` given for a `vec record { text; T }` is sent with its entries
+    instead of as an empty vector (#767).
+- `DisplayReactor` on large recursive values: a recursive type's codec is built
+  once instead of for every node, so 1,000 ICRC-3 blocks display in about 16 ms
+  instead of 470 ms (#485). Long lists such as a Motoko `List` display and
+  encode up to 1,875 elements. They used to fail past about 586 elements and
+  return the raw Candid value.
+- Under Deno, `reactorRetry` retries nothing, as on any other server and as
+  TanStack Query's own default does. Deno can define `window`, so a failed
+  call during Deno server rendering was retried three times with backoff.
+  `reactorUpdateRetry` and an update method's query retry follow the same
+  rule.
+- Docs corrected to match the package. `Reactor.fetchQuery()` is cache-first and
+  returns a stale or invalidated entry as is (#595). An empty `opt` displays as
+  `undefined` (#589). The packages need TypeScript 5.7 or later, which their
+  declarations already required (#591).
+
+### @ic-reactor/react
+
+#### Added
+
+- `defineDisplayReactor(options)` takes `defineReactor`'s options and builds a
+  `DisplayReactor` (#746).
+- `createReactorProvider(factory, options?)` returns
+  `{ ReactorProvider, useReactor }`. It builds the reactors once per mounted
+  provider, so once per request on a server, and disposes the
+  `AuthenticationManager`s built for its value on unmount (#745). When the
+  value holds one `QueryClient`, it also renders a `QueryClientProvider` for
+  it; `queryClientProvider: false` opts out.
+- A `react-server` export condition. React Server Components, server actions
+  and route handlers import the core runtime (`Reactor`, `DisplayReactor`,
+  `ClientManager`, the token helpers) from `@ic-reactor/react`; hooks and
+  factories are missing exports there (#679).
+- `skipToken`, re-exported from TanStack Query, in place of args in
+  `useActorQuery`, `useActorInfiniteQuery` (`getArgs`) and `createQueryFactory`.
+- `invalidateQueries` on `createMutation`, `.useMutation()`,
+  `useActorMutation` and `useActorMethod` takes query objects, query factories
+  and typed `{ functionName, args? }` descriptors. Query factory functions gain
+  `getQueryKey()` and `invalidate()`. New types: `InvalidationTarget`,
+  `QueryKeySource`, `QueryDescriptor`, `QueryFactoryFn`, `QueryFactoryMethods`.
+- Query objects, those of the infinite factories included, gain `cancel()`,
+  `reset()` and `optimisticUpdate(updater)`, which resolves with
+  `{ rollback() }`.
+- `callConfig` in `createQuery`, `createSuspenseQuery` and their factories.
+- `AuthenticationManager.dispose()` releases the auth client the manager built
+  (#745).
+- Support for `@icp-sdk/auth` v10 alongside v8. The peer range is
+  `^8.0.0 || ^10.0.0` (v9 is excluded), so npm installs the set without an
+  `overrides` block. `identityProvider` is still a URL. On v10 a custom provider
+  also needs `internetIdentityId`, the canister that mints its delegations, or
+  `login()` throws an error that names the option. Off mainnet, v10's minting
+  agent is given the app's replica host and root key, so local sign-in works.
+- Two options that only v10 uses: `maxTimeToIdle` for `login()` and
+  `IdentityAttributesManager.request()`, and `disableBrowserActivity` for the
+  auth client. v8 drops both with a one-time warning. On v10, `storage`,
+  `keyType`, `idleOptions` and `identity` are dropped with a one-time warning,
+  and `login({ targets })` warns on every sign-in because v10 ignores `targets`
+  and returns a broader delegation.
+- `@ic-reactor/react/testing` re-exports `@ic-reactor/core/testing`.
+  `@noble/curves` is a new optional peer dependency here too, used only by
+  this entry.
+
+#### Changed
+
+- The `@tanstack/react-query` peer is now `^5.90.2` (was `^5.0.0`); older
+  releases fail to compile against the package or fail its tests (#475).
+  Migration: upgrade `@tanstack/react-query` to 5.90.2 or later.
+- Every query and mutation hook (raw, bound and factory-made) mounts its
+  reactor's `QueryClient` while it is mounted, as `QueryClientProvider` does,
+  and a suspense hook also while it is suspended. Without a provider,
+  `refetchOnWindowFocus` and `refetchOnReconnect` now fire, and a query or
+  mutation paused while offline resumes when the connection returns (#498).
+  Migration: if the app relied on no refetch on focus or reconnect, set
+  `refetchOnWindowFocus` / `refetchOnReconnect` to `false` on the query or in
+  the QueryClient's defaults.
+- `useAuth()` and `useUserPrincipal()` report `isAuthenticating: true` until
+  the first session restore settles, in server renders too (#621). Migration:
+  check `isAuthenticating` before redirecting on `!isAuthenticated`.
+- `createMutation(...).execute()` runs in the QueryClient's MutationCache: the
+  cache's global callbacks, `useIsMutating`, the factory's `retry`,
+  `networkMode`, `onMutate` and `onSettled`, and the QueryClient's mutation
+  defaults now apply to it (#564). Migration: a `mutations.retry` default now
+  retries `execute()` too; use `reactorUpdateRetry` for update methods.
+- `useActorMethod` awaits `invalidateQueries` before `onSuccess`, and `call()`
+  resolves after the invalidated queries have refetched (#564). Migration:
+  none; `onSuccess` now reads fresh data.
+- `useActorMethod` applies its `retry`, `retryDelay`, `networkMode` and `meta`
+  to `call()`, for an update method as for a query method's `call(args)` (#564).
+  Migration: replace a numeric `retry` on a hook that calls an update method
+  with `reactorUpdateRetry`.
+- A query method's `call()` and `refetch()` from `useActorMethod` fetch again
+  for the new principal when a sign-in or sign-out lands mid-call, and resolve
+  with that answer instead of the previous principal's cached data or
+  TanStack's `CancelledError`. When their fetch fails they resolve `undefined`
+  (and report the error to `onError`) instead of the entry's last answer.
+  Migration: treat an `undefined` result as a failed call.
+- A query object's `prefetch()` fetches again for the new principal when a
+  sign-in or sign-out overtakes it, so the cache never keeps the previous
+  principal's answer. Migration: none.
+- On `@icp-sdk/auth` v10, `AuthenticationManager` follows sign-outs and account
+  switches made in other tabs and updates the agent (#754). Migration: none;
+  expect `useAuth()` to change when another tab signs out.
+- `authentication.logout()` on a manager with no client builds one instead of
+  throwing "Authentication module is missing". Migration: remove a `catch`
+  for that error.
+
+#### Deprecated
+
+- `defineReactor({ display: true })`, its overload and
+  `DefineDisplayReactorParameters`. Use `defineDisplayReactor(...)`. They will
+  be removed at the next major. Plain `defineReactor` is not deprecated.
+
+#### Fixed
+
+- `useActorMethod`:
+  - `call`, `refetch` and `reset` keep one identity for the component's
+    lifetime. An effect that lists `call` no longer runs again after every
+    render, which could call an update method endlessly. They also run with the
+    last committed render's method, args and callbacks (#497);
+  - `call(args)` with the hook's own args runs `onSuccess` / `onError` once
+    instead of twice. A call that settles in the same millisecond as the
+    previous result is still reported (#497);
+  - `onSuccess` no longer runs for `placeholderData`, such as `keepPreviousData`
+    (#501), or for `initialData` that no call returned (#564);
+  - an `undefined` entry of `invalidateQueries` is skipped, as the mutation
+    hooks skip it, instead of invalidating every query in the client.
+- Hooks and factories:
+  - `useActorInfiniteQuery` and `useActorSuspenseInfiniteQuery` apply
+    `getKeyArgs` as the factories do. An `initialPageParam` that changes on
+    every render, such as `Date.now()`, no longer refetches the first page
+    endlessly (#499);
+  - infinite queries, both hooks and factories, fetch their pages from the
+    canister their key names. Before, a later `setCanisterId` redirected the
+    fetch (#558);
+  - a query object's `fetch()` and `prefetch()`, and the infinite factories'
+    `fetch()`, use the config's `networkMode`, `retry`, `retryDelay` and `meta`,
+    as `useQuery()` does (#502);
+  - `useActorMutation` keys its mutations like `createMutation` and
+    `useActorMethod`, so `useIsMutating({ mutationKey })`, `useMutationState`
+    and `setMutationDefaults` now match them (#564).
+- Validation helpers: `mapValidationErrors`, `extractValidationErrors` and
+  `handleValidationError` keep issues on fields named `constructor`, `toString`
+  or `__proto__`. Before, those issues were dropped, and with
+  `{ multiple: true }` the call threw. `mapValidationErrors` now also accepts
+  any `{ multiple?: boolean }` value, `{}` or `undefined`, and `getFieldError` /
+  `getFieldErrors` find an issue about the whole argument under `""` (#592).
+- `AuthenticationManager`:
+  - several `useAuth()` consumers that mount together share one auth client
+    instead of building one each (#479), and the v10 clients a call replaces
+    when its options differ are disposed (#729). On v8 an idle period runs
+    `idleOptions.onIdle` once instead of once per client built;
+  - the session restore runs once per manager instead of once per `useAuth()`,
+    so mounting a consumer no longer flips `isAuthenticating`, and a component
+    that hides consumers while authenticating no longer loops. A restore reads
+    the identity from the client the manager still uses, and a restore of a
+    manager disposed before it finished builds no client (#745);
+  - when `logout()` fails after the client has already dropped the session, as a
+    v10 revoke does while offline, the manager signs out locally: the agent gets
+    the anonymous identity and the signed-out state is published. `logout()`
+    still rejects with the error (#478);
+  - a failed `login()` records its error and clears `isAuthenticating` before
+    `onError` runs, so an `onError` that throws no longer leaves
+    `isAuthenticating: true` (#480);
+  - an `ic_env` cookie that is not valid percent-encoding is ignored. Before, it
+    made `new AuthenticationManager()`, and so `useAuth()`, throw `URIError`
+    (#482);
+  - the unsubscribe that `subscribeAuthState` returns removes only its own
+    registration. A subscriber that throws no longer stops later subscribers,
+    including `useAuth()`, from hearing the change; the first error is rethrown
+    after all of them have run;
+  - when the local Internet Identity canister serves no sign-in page, the error
+    tells a v10 app to serve an II frontend and set `identityProvider` and
+    `internetIdentityId`. Before, it pointed to an II build that only v8 can use
+    (#561).
+- `useAuth`, `useUserPrincipal` and `useAgentState` render a fixed server
+  snapshot, so a component that hydrates after the session restore no longer
+  causes a hydration mismatch. Each consumer also subscribes once when it
+  mounts, not on every render.
+- Lapsed and multi-tab sessions no longer leave an identity on the agent that
+  the auth client does not vouch for:
+  - a manager built over a caller's `authClient` whose session has lapsed puts
+    the anonymous identity on the agent;
+  - on v10, a lapsed session is ended in this tab only, without calling the
+    client's `signOut()`, which acts on the whole origin and could end or
+    revoke a sign-in made in another tab;
+  - on v8, a tab whose own delegation has lapsed signs out even after another
+    tab signs in again (#755). A signed-out tab no longer reports signed in as
+    the anonymous principal once another tab signs in.
+- Identity attributes:
+  - Internet Identity's attribute message is decoded as the ICRC-3 map it is.
+    Emails and names no longer come back with stray length characters, cut short
+    at the first non-ASCII character, or read from the wrong key (#477);
+  - when an attribute request fails but its sign-in completes, the sign-in is
+    kept, and `useIdentityAttributes` shows the error (#481);
+  - a sign-out or account switch made while an attribute request is pending is
+    no longer undone when the request resolves. If the client's session ended
+    meanwhile, for example because another tab signed out, the request signs the
+    manager out. `useIdentityAttributes` no longer shows the attributes after
+    such a sign-out.
+
+### @ic-reactor/candid
+
+#### Added
+
+- `forCanister(canisterId)` on `CandidReactor`, `CandidDisplayReactor`,
+  `MetadataReactor` and `MetadataDisplayReactor`; the sibling shares the
+  Candid source and adapter.
+- A `defaultArgs` option (`"display"` or `"candid"`) on `ResultFieldVisitor`.
+
+#### Changed
+
+- `MetadataReactor` gives func-record `defaultArgs` in Candid form, so
+  `callMethod({ args: defaultArgs })` on a reactor built from the node's
+  `funcClass` works (#611). `MetadataDisplayReactor` keeps display defaults.
+  Migration: use `MetadataDisplayReactor` where the code expects display
+  defaults.
+- `CandidFormVisitor` and `FieldVisitor` accept `""` for a `text` field. A text
+  field with a format, a number and a func reference's method name are still
+  required (#611). Migration: none.
+- `isPrincipalId` calls `isPrincipalText`, so it refuses a principal longer
+  than 29 bytes and the `{"__principal__": ...}` JSON form. Migration: pass
+  principal text.
+
+#### Deprecated
+
+- `CandidAdapter.unsubscribe` is a no-op; remove the call (#644).
+
+#### Fixed
+
+- `registerMethod`, and `callDynamic`, `queryDynamic` and `fetchQueryDynamic`,
+  which call it, now accept Candid they used to reject: type declarations that
+  do not each start a line, as in the documented indented example (#540); a
+  whole service definition written `service: {…}`, with a line break before the
+  colon, or named (`service greeter : {…}`) (#545); a quoted name that ends in
+  an escaped backslash (#576); and a method name holding a quote, backslash or
+  control character, which is now escaped instead of breaking the service or
+  naming another method (#635). Rejecting an unclosed quoted name now takes
+  milliseconds instead of seconds, and `MetadataReactor.buildForValueType` reads
+  a type that ends in a `//` comment.
+- The argument forms (`FieldVisitor`, `CandidFormVisitor`) now accept only what
+  the call can send. A func reference inside an argument is a
+  `[principal, method name]` field (`candidType: "func"`) and a service
+  reference is a principal field (`candidType: "service"`); before,
+  `initialize()` threw or the schema refused every valid value (#539). A blob
+  field takes only hex text with two digits per byte (optional `0x`), integers
+  from 0 to 255 or a `Uint8Array`, so odd-length hex is refused instead of being
+  sent shifted by one digit (#543). A float field refuses blank text, non-finite
+  numbers and a float32 overflow (#542). An `empty` field refuses every value,
+  and a variant no longer defaults to an option that holds `empty` (#544). A
+  text field labelled as a URL also accepts a request path starting with `/`,
+  such as `http_request`'s `url`.
+- A service with a method typed by a recursive func alias
+  (`type f = func (f) -> (f)`) now works. `CandidDisplayReactor.initialize()` no
+  longer fails for the whole service, and a method whose display codec cannot be
+  built is skipped with an error naming it. `MetadataReactor` and
+  `MetadataDisplayReactor` no longer throw "Cannot read properties of undefined
+  (reading 'includes')", and they describe, hydrate and offer candidates for
+  that method (#557).
+- Names from `Object.prototype`: `getInputMeta` and `getOutputMeta` return
+  `undefined` for a name such as `"toString"`, `"constructor"` or `"__proto__"`
+  that the service does not declare. A method, record field or variant tag named
+  `__proto__` is now kept in the metadata, defaults, schema, result tree and
+  hydration. A left-out field named like an inherited member resolves as
+  missing, and resolving a variant tag that the type does not have throws
+  `Option "<tag>" not found` (#610, #659).
+- A result node's `resolve()` accepts values already in display form: an `opt`
+  whose display value is an array (`opt vec text` as `["a", "b"]`) and a
+  `vec record { text; V }` shown as an object. A null variant arm now resolves
+  to `null` instead of `undefined` (#546).
+- `buildMethodVariableCandidates` now opens a recursive result, so an ICRC-3
+  ledger's `icrc3_get_blocks` offers `.log_length`, `.blocks` and
+  `.archived_blocks`. It names a func reference's members by index
+  (`$get_callback.0`, `$get_callback.1`), which the value resolves by, instead
+  of `.canisterId` and `.methodName`, which resolved to `undefined`.
+- `MetadataReactor` and `MetadataDisplayReactor` now use far less memory and
+  time: a dropped reactor's service types are freed (about 42 KB each were kept
+  before); `registerMethod` describes only the method it adds, and a repeat
+  registration, which every `callDynamic`, `queryDynamic`, `fetchQueryDynamic`
+  and `callDynamicWithMeta` makes, changes nothing (600 registrations went from
+  11.7 s to 148 ms); and resolving a recursive value builds one result node per
+  type and label instead of one per value (a 2,000-element Motoko List kept 7.6
+  MB).
+- Candid reactors no longer leave an identity subscription on their
+  `ClientManager` for good, and an assigned `adapter.didjsCanisterId` survives
+  identity changes (#644).
+- Loading Candid: "Failed to retrieve Candid source by any method" now says why
+  each attempt failed (#541). A rejected query from the tmp-hack fetch or the
+  didjs compile reports "Query failed (reject code N, error code ICnnnn):
+  <message>" instead of "Do not know how to serialize a BigInt". A parse that
+  starts while the parser is still loading now waits for it instead of sending
+  the Candid to the didjs canister, which failed offline and on a local replica.
+  `importCandidDefinition` (used by `CandidReactor` and `CandidDisplayReactor`)
+  no longer rewrites a Candid name that contains `export const` or
+  `export function`, which sent that field under another hash.
+
+## codegen, cli, vite-plugin 0.15.1
+
+Changes since codegen, cli and vite-plugin 0.14.0. Version 0.15.0 was tagged
+but never published: its release job stopped before publishing, because
+codegen's tests needed packages that job did not build. 0.15.1 is the first
+release with these changes.
+
+### @ic-reactor/codegen
+
+#### Added
+
+- `factories: true` on a canister config (with `target: "react"`) writes a
+  managed `index.factories.generated.ts`: `<method>Query` (`createQuery`, or
+  `createQueryFactory` when the method takes args) per query method and
+  `<method>Mutation` (`createMutation`) per update or oneway method, each call
+  marked `/* @__PURE__ */`. Exports `getFactoryExportNames`,
+  `generateFactoriesFile` and `FACTORIES_FILE_NAME`.
+- `PipelineResult.warnings`, for problems a successful run could not fix, such
+  as an edited `index.ts` that does not re-export the factories.
+- `findSharedOutDirs` and `sharedOutDirMessage`, moved here from the CLI.
+
+#### Changed
+
+- `index.generated.ts`, and the `index.ts` wrapper that generation creates, are
+  formatted with the project's Prettier and config, like the declarations.
+  `prettier --check` passes right after generation, and a formatted file is no
+  longer rewritten on the next run. Migration: none; commit the reformatted
+  `index.generated.ts` that the next run writes.
+- The `index.ts` that generation creates once now points agents at the
+  `ic-reactor` Agent Skill published from this repository
+  (`/plugin install ic-reactor@ic-reactor` in Claude Code after
+  `/plugin marketplace add B3Pay/ic-reactor`, or
+  `npx skills add B3Pay/ic-reactor --skill ic-reactor`) instead of the
+  contributor skill in `B3Pay/ic-reactor-skills`. Migration: none; an existing
+  `index.ts` is never rewritten, so edit its comment by hand if you want the
+  new pointer.
+- A `didFile` inside `<outDir>/declarations` (the generated declarations
+  directory) is refused with an error before anything is written. Before, the
+  first run deleted a `.did` kept in a folder there, and every later run failed
+  with "DID file not found". Migration: move the `.did` out of
+  `<outDir>/declarations` and point `didFile` at it;
+  `src/declarations/<canister>/<canister>.did` still works.
+
+#### Fixed
+
+- With `mode` set to `CandidReactor`, `CandidDisplayReactor` or
+  `MetadataDisplayReactor`, the generated `index.generated.ts` now passes
+  `createActorHooks` its type arguments. A service with a recursive type
+  (Motoko's `List`) or one as large as Internet Identity's no longer fails `tsc`
+  with TS2589. The hooks' types are unchanged (#503).
+- A run now leaves alone every generated file whose bytes are unchanged,
+  `declarations/` included. `tsc --watch`, bundlers and editors no longer wake
+  on a regeneration that changed nothing (#666).
+- A `.did` saved with a UTF-8 byte order mark (PowerShell, or "UTF-8 with BOM"
+  editors) now generates instead of failing with `Unknown token <U+FEFF>`. The
+  `declarations/` copy keeps the file's bytes.
+
+### @ic-reactor/cli
+
+#### Added
+
+- `"factories"` per canister in `ic-reactor.json` and `schema.json`. A value
+  that is not a boolean is rejected. `generate` prints codegen's warnings.
+
+#### Fixed
+
+- An `ic-reactor.json` saved with a UTF-8 byte order mark (such as PowerShell's
+  `Set-Content -Encoding UTF8` writes) now loads instead of failing every
+  command with "not valid JSON" (#665).
+- `generate --clean` no longer deletes the output of a configured canister whose
+  `outDir` reaches the global `outDir` through a symlink, or differs from it
+  only in case on a case-insensitive volume. That output includes the
+  hand-written `index.ts` (#505).
+- `init -y` with an `--out-dir` that is not directly inside `src/` now writes
+  the `clientManagerPath` that reaches `src/clients.ts`, so the first `generate`
+  output compiles instead of failing with TS2307 (#559).
+- `generate --canister toString` (or `constructor`, `hasOwnProperty`,
+  `__proto__`) now reports "Canister <name> not found in config." instead of an
+  unrelated error. The `--bindgen-only` help now names the files it writes
+  instead of a `.did.d.ts` that is never written (#666).
+
+### @ic-reactor/vite-plugin
+
+#### Added
+
+- `factories` per canister entry. The plugin prints codegen's warnings to the
+  terminal without failing the build.
+
+#### Changed
+
+- An entry that shares its output directory with an earlier one (same `name`
+  and `outDir`) fails, as it does in the CLI; under `vite build` that fails the
+  build (#565). Migration: give each entry its own `outDir`.
+- `injectEnvironment` sets the `ic_env` cookie on each response. While `icp`
+  reports no network or a configured canister has no id, each page load asks
+  `icp` again, so deploying after `vite dev` started needs only a reload
+  (#664). The `/api` proxy follows the detected network unless the Vite config
+  or another plugin sets its own `/api` proxy. `vite preview` gets the same
+  cookie. Migration: none.
+
+#### Fixed
+
+- Under `vite dev`, the plugin now regenerates from the dev server's file
+  watcher. A `.did` created after startup now regenerates, and so does one
+  deleted and written again by a build tool or `git checkout`. Saves with
+  `server.hmr: false` also regenerate now.
+- Under `vite build --watch`, saving a `.did` now rebuilds with the new
+  bindings, and editing another file no longer starts rebuilds that never end. A
+  watch rebuild regenerates only the entries whose `.did` changed, and it
+  retries an entry that failed.
+- Two entries with the same canister `name` (for example one `DisplayReactor`
+  and one `Reactor` output in different `outDir`s) now both regenerate when
+  their `.did` is saved. The second entry's failure is still shown to browsers
+  that connect later (#504).
+
+## parser 0.6.0
+
+Changes since parser 0.5.0.
+
+### @ic-reactor/parser
+
+#### Added
+
+- The package ships `llms.txt`, a usage guide for coding agents, as the other
+  packages do (`node_modules/@ic-reactor/parser/llms.txt`).
+
+#### Changed
+
+- `didToJs` and `didToTs` key a record field or variant tag whose name looks
+  like a numeric id (`_0_`) by the hash of its name (`_4735054_`), and
+  `parseDid` names it the same way, matching what a canister expects (#631).
+  Migration: a hand-written `.did` that spells a Motoko numeric field `_0_`
+  must write `0`.
+- A Candid type named `_SERVICE`, like a TypeScript type keyword (`string`,
+  `number`, `bigint`, ...) or like a type operator (`keyof`, `readonly`,
+  `unique`, `infer`) is renamed with `_` appended, e.g. `string_` (#737).
+  Migration: import the renamed type.
+
+#### Fixed
+
+- `didToJs` and `didToTs` output now loads and compiles in more cases. A field,
+  variant tag or method named `__proto__` is kept, printed as `['__proto__']`
+  (#560). U+0000 in a name prints as `\x00` instead of `\0`, which read as an
+  octal escape: it failed in strict mode or changed the field's hash. A type
+  named `IDL`, `Principal`, `ActorMethod`, `Array` or a typed array no longer
+  clashes with the binding's own names. A service whose actor type is named like
+  a JavaScript keyword (`type class = service {…}; service : class`) now refers
+  to the printed `class_` (#738).
+- `parseDid` returns `service: null`, as its type says, instead of `undefined`
+  for Candid that declares no service (#506). Code that checks `=== undefined`
+  must check `null` instead; `== null` works either way.
+- Docs: the README now says `validateIDL` returns `true` or throws the parser's
+  error as a string. It never returned `false` as the README had said; use
+  `CandidAdapter.validateCandid` for a boolean.