@ic-reactor/react 3.12.4 → 3.13.0

package/src/auth/createIdentityAttributeHooks.ts

@@ -1,4 +1,5 @@
 import { useCallback, useEffect, useRef, useState } from "react"
+import { Principal } from "@icp-sdk/core/principal"
 import type { IdentityAttributesManager } from "./identity-attributes-manager.js"
 import type {
   IdentityAttributeResult,
@@ -19,6 +20,9 @@ export interface UseIdentityAttributesReturn {
   clearAttributes: () => void
 }
 
+/** What `request()` reports as the principal of a signed-out session. */
+const ANONYMOUS_PRINCIPAL = Principal.anonymous().toText()
+
 export function createIdentityAttributeHooks(
   identityAttributes: IdentityAttributesManager
 ) {
@@ -40,30 +44,44 @@ export function createIdentityAttributeHooks(
      * A request started before a sign-out or an account switch resolves after
      * it, and publishing that result would put the previous user's decoded PII
      * back on screen with no further auth event to clear it again. So a result
-     * is committed only when it is the signed-in user's own: it carries the
-     * principal that is current when it resolves, or the session has not
-     * changed since it was asked for.
+     * is committed only when it is the current session's own: it carries the
+     * principal signed in when it resolves or, while nobody is, the anonymous
+     * principal that a `signIn: false` request made while signed out reports.
      *
-     * The first test is the one the default flow needs. With `signIn: true`
-     * the request itself signs the user in, so the principal seen before the
-     * request (none, for a first sign-in; the old account, for a switch made
-     * inside the provider window) is never the one the result belongs to.
-     * Comparing against the pre-request principal alone left the hook's
-     * `attributes` null after every successful first-time sign-in.
+     * With `signIn: true` the request itself signs the user in, so the
+     * principal seen before the request (none, for a first sign-in; the old
+     * account, for a switch made inside the provider window) is never the one
+     * the result belongs to. Comparing against it left `attributes` null after
+     * every successful first-time sign-in. Nor does "the same principal before
+     * and after" mean the session never changed: the request's own sign-in is
+     * published only when the whole request ends, so a user who signed in
+     * through it and signed out before it ended is nobody on both sides. Their
+     * name and email then went up on the signed-out screen.
      */
-    const isCurrent = useCallback(
-      (requestedFor: string | undefined) => requestedFor === currentPrincipal(),
+    const publishIfCurrent = useCallback(
+      (result: IdentityAttributeResult) => {
+        const session = currentPrincipal() ?? ANONYMOUS_PRINCIPAL
+        if (result.principal !== session) return false
+        setAttributes(result)
+        return true
+      },
       [currentPrincipal]
     )
 
-    const publishIfCurrent = useCallback(
-      (requestedFor: string | undefined, result: IdentityAttributeResult) => {
+    /**
+     * The failure counterpart of `publishIfCurrent`. A request that signs in
+     * can fail on its attribute side after its own sign-in went through, and
+     * the manager keeps that sign-in before it reports the failure, so the
+     * session is now the one this request opened and the failure is that
+     * user's to see. A failure that lands after a sign-out is still dropped.
+     */
+    const publishErrorIfCurrent = useCallback(
+      (requestedFor: string | undefined, signsIn: boolean, error: Error) => {
         const current = currentPrincipal()
-        if (result.principal !== current && requestedFor !== current) {
-          return false
+        if (requestedFor !== current && !(signsIn && current !== undefined)) {
+          return
         }
-        setAttributes(result)
-        return true
+        setAttributeError(error)
       },
       [currentPrincipal]
     )
@@ -75,10 +93,14 @@ export function createIdentityAttributeHooks(
         const requestedFor = currentPrincipal()
         try {
           const result = await identityAttributes.request(params)
-          publishIfCurrent(requestedFor, result)
+          publishIfCurrent(result)
           return result
         } catch (error) {
-          if (isCurrent(requestedFor)) setAttributeError(error as Error)
+          publishErrorIfCurrent(
+            requestedFor,
+            params.signIn !== false,
+            error as Error
+          )
           throw error
         } finally {
           setIsRequestingAttributes(false)
@@ -94,10 +116,14 @@ export function createIdentityAttributeHooks(
         const requestedFor = currentPrincipal()
         try {
           const result = await identityAttributes.requestOpenId(params)
-          publishIfCurrent(requestedFor, result)
+          publishIfCurrent(result)
           return result
         } catch (error) {
-          if (isCurrent(requestedFor)) setAttributeError(error as Error)
+          publishErrorIfCurrent(
+            requestedFor,
+            params.signIn !== false,
+            error as Error
+          )
           throw error
         } finally {
           setIsRequestingAttributes(false)

package/src/auth/identity-attributes-manager.ts

@@ -1,4 +1,6 @@
+import type { Identity } from "@icp-sdk/core/agent"
 import type {
+  AuthClientLike,
   IdentityAttributeNonce,
   IdentityAttributeResult,
   RequestIdentityAttributesParameters,
@@ -37,6 +39,7 @@ export class IdentityAttributesManager {
     nonce,
     signIn = true,
     maxTimeToLive,
+    maxTimeToIdle,
     targets,
     ...clientOptions
   }: RequestIdentityAttributesParameters): Promise<IdentityAttributeResult> => {
@@ -50,21 +53,29 @@ export class IdentityAttributesManager {
 
     if (!authClient) {
       throw new Error(
-        "Authentication module is missing or failed to initialize. To request identity attributes, please install @icp-sdk/auth v8, or provide a compatible authClient."
+        "Authentication module is missing or failed to initialize. To request identity attributes, please install @icp-sdk/auth (v8 or v10), or provide a compatible authClient."
       )
     }
 
     this.authentication.setAuthenticating()
+    // Replaced by anything else that changes auth state while this request
+    // runs; see where the result is committed.
+    const pendingState = this.authentication.authState
 
+    let signInPromise: Promise<Identity> | undefined
+    let committed = false
     try {
       // `signIn` first: it opens the transport channel synchronously, and the
       // attribute request then reuses that same channel and window.
-      const identityPromise = signIn
+      signInPromise = signIn
         ? this.authentication.signInOrRecoverIdentity({
             maxTimeToLive,
+            maxTimeToIdle,
             targets,
           })
-        : Promise.resolve(authClient.getIdentity())
+        : undefined
+      const identityPromise =
+        signInPromise ?? Promise.resolve(authClient.getIdentity())
       const requestPromise = authClient.requestAttributes({
         keys,
         nonce: toAuthClientNonce(nonce),
@@ -76,8 +87,39 @@ export class IdentityAttributesManager {
       ])
 
       const finalIdentity = identity ?? (await authClient.getIdentity())
-      const isAuthenticated = await authClient.isAuthenticated()
-      await this.authentication.commitIdentity(finalIdentity, isAuthenticated)
+      // A v8 client can say it is authenticated for a delegation that lapsed
+      // in this tab, or while it holds no session, once another tab has
+      // signed in; see `AuthenticationManager.vouchesFor`.
+      const isAuthenticated = this.authentication.vouchesFor(
+        finalIdentity,
+        await authClient.isAuthenticated()
+      )
+      committed = true
+      // A sign-out, or another account's sign-in, can finish while the
+      // attribute side is still pending: neither ends it. `finalIdentity` then
+      // belongs to a session the client has left, and committing it put the
+      // signed-out user's delegation back on the agent while the app showed
+      // them signed out. So commit only what the client still holds and
+      // vouches for, the rule `authenticate()` applies. Whatever moved the
+      // client through the manager has published its own state.
+      //
+      // When nothing has published since this request began, the session
+      // changed under the manager and this request is the first to find out.
+      // A client that vouches for no session any more has lost it, as when
+      // another tab signed out, while it still hands out the identity it held:
+      // the manager signs out too, or it goes on reporting the user signed in
+      // with their delegation on the agent. A client that still vouches for a
+      // session gives no grounds to sign anyone out, so only the
+      // `isAuthenticating` this request started is ended.
+      if (await clientHolds(authClient, finalIdentity, isAuthenticated)) {
+        await this.authentication.commitIdentity(finalIdentity, isAuthenticated)
+      } else if (this.authentication.authState === pendingState) {
+        if (isAuthenticated) {
+          this.authentication.settleAuthenticating()
+        } else {
+          this.authentication.commitSignedOut()
+        }
+      }
 
       const normalizedSignedAttributes =
         normalizeSignedIdentityAttributes(signedAttributes)
@@ -93,11 +135,47 @@ export class IdentityAttributesManager {
         completedAt: new Date().toISOString(),
       }
     } catch (error) {
+      // The sign-in and the attribute request share one provider window and
+      // can end differently. When the attribute side failed (the app's nonce
+      // call rejected, or the provider could not certify a key) but the user
+      // went on to finish signing in, the client held a session nothing had
+      // committed: the app showed the user signed out until a reload restored
+      // it. So a sign-in this request started is waited for, and kept when the
+      // client vouches for it, before the failure is reported.
+      if (signInPromise && !committed) {
+        await this.keepCompletedSignIn(signInPromise, authClient)
+      }
       this.authentication.setAuthenticationError(error as Error)
       throw error
     }
   }
 
+  private async keepCompletedSignIn(
+    signInPromise: Promise<Identity>,
+    authClient: AuthClientLike
+  ) {
+    const identity = await signInPromise.catch(() => undefined)
+    if (!identity) return
+    const isAuthenticated = await Promise.resolve()
+      .then(() => authClient.isAuthenticated())
+      .catch(() => false)
+    if (!isAuthenticated) return
+    // The session the client holds now must be the one this request opened.
+    // Another login can switch the shared client to a different account while
+    // the attribute side is still pending, and committing this identity then
+    // would put back the account the user switched away from.
+    const current = await Promise.resolve()
+      .then(() => authClient.getIdentity())
+      .catch(() => undefined)
+    if (current?.getPrincipal().toText() !== identity.getPrincipal().toText()) {
+      return
+    }
+    // The attribute failure is the one to report, so a failure here is not.
+    await this.authentication
+      .commitIdentity(identity, true)
+      .catch(() => undefined)
+  }
+
   public requestOpenId = ({
     keys,
     openIdProvider,
@@ -112,6 +190,23 @@ export class IdentityAttributesManager {
   }
 }
 
+/**
+ * Whether `identity` is the session `authClient` holds now, and one it still
+ * vouches for. The anonymous identity needs no vouching: it signs no one in.
+ */
+async function clientHolds(
+  authClient: AuthClientLike,
+  identity: Identity,
+  isAuthenticated: boolean
+): Promise<boolean> {
+  const held = await Promise.resolve()
+    .then(() => authClient.getIdentity())
+    .catch(() => undefined)
+  const principal = identity.getPrincipal()
+  if (held?.getPrincipal().toText() !== principal.toText()) return false
+  return isAuthenticated || principal.isAnonymous()
+}
+
 /**
  * Adapts our nonce input to the `@icp-sdk/auth` nonce contract.
  *

package/src/auth/identity-attributes.ts

@@ -65,6 +65,14 @@ export function decodeIdentityAttributeValues(
     {}
   )
 
+  // Internet Identity's own format, read by its type. Once a message is known
+  // to be one, a key it does not hold is absent: the text fallback below
+  // cannot add anything true, only a neighbouring value under the wrong name.
+  const icrc3Entries = decodeIcrc3AttributeMap(data)
+  if (icrc3Entries) {
+    return collectIcrc3TextValues(icrc3Entries, requestedKeyMap)
+  }
+
   const decodedValues = decodeCandidAttributeValues(data, requestedKeyMap)
   if (Object.keys(decodedValues).length > 0) {
     return decodedValues
@@ -73,6 +81,73 @@ export function decodeIdentityAttributeValues(
   return extractPrintableAttributeValues(data, requestedKeys)
 }
 
+/** The ICRC-3 `Value` an Internet Identity attribute message is encoded as. */
+type Icrc3Value =
+  | { Nat: bigint }
+  | { Int: bigint }
+  | { Blob: Uint8Array | number[] }
+  | { Text: string }
+  | { Array: Icrc3Value[] }
+  | { Map: Array<[string, Icrc3Value]> }
+
+/**
+ * The entries of an Internet Identity attribute message, or `undefined` when
+ * `data` is not one.
+ *
+ * The canister certifies `Encode!(&Icrc3Value::Map(..))`: the requested
+ * attributes under the keys they were requested by (bare, such as `email`, for
+ * an unscoped request), plus `implicit:nonce`, `implicit:origin` and
+ * `implicit:issued_at_timestamp_ns`. None of the shapes
+ * {@link decodeCandidAttributeValues} tries match it, so without this every
+ * real response was read by scraping printable text, which returned the
+ * neighbouring length byte as part of a value, cut names at the first
+ * non-ASCII character, and matched keys inside other values.
+ *
+ * @see https://github.com/dfinity/ICRC-1/blob/main/standards/ICRC-3/README.md
+ */
+function decodeIcrc3AttributeMap(
+  data: Uint8Array
+): Array<[string, Icrc3Value]> | undefined {
+  const value = IDL.Rec()
+  value.fill(
+    IDL.Variant({
+      Nat: IDL.Nat,
+      Int: IDL.Int,
+      Blob: IDL.Vec(IDL.Nat8),
+      Text: IDL.Text,
+      Array: IDL.Vec(value),
+      Map: IDL.Vec(IDL.Tuple(IDL.Text, value)),
+    })
+  )
+
+  try {
+    const [decoded] = IDL.decode([value], data) as [Icrc3Value]
+    return "Map" in decoded ? decoded.Map : undefined
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * The requested attributes in an ICRC-3 map, as certified.
+ *
+ * Only `Text` entries are attribute values; the `implicit:` entries are there
+ * for the verifier and are returned only if asked for by name.
+ */
+function collectIcrc3TextValues(
+  entries: Array<[string, Icrc3Value]>,
+  requestedKeyMap: Record<string, string>
+): IdentityAttributeValues {
+  const values: IdentityAttributeValues = {}
+  for (const [key, value] of entries) {
+    if (!Object.prototype.hasOwnProperty.call(requestedKeyMap, key)) continue
+    if ("Text" in value) {
+      values[requestedKeyMap[key]] = value.Text
+    }
+  }
+  return values
+}
+
 function decodeCandidAttributeValues(
   data: Uint8Array,
   requestedKeyMap: Record<string, string>

package/src/auth/local-ii-probe.ts

@@ -21,6 +21,7 @@
 
 import { Actor, type HttpAgent } from "@icp-sdk/core/agent"
 import { IDL } from "@icp-sdk/core/candid"
+import type { AuthClientFlavor } from "./auth-client-compat.js"
 
 /** The `http_request` query every asset-serving canister exposes. */
 const httpInterface: IDL.InterfaceFactory = ({ IDL }) => {
@@ -132,13 +133,38 @@ export async function probeLocalInternetIdentity(
 /**
  * The error a login gets when the installed build serves no sign-in UI, in
  * place of a 503 page inside a popup the app cannot see.
+ *
+ * The fix depends on the installed `@icp-sdk/auth` major. v8 signs in through
+ * the page the canister serves, so an older build that still serves one works.
+ * v10 signs in through `ii_session_delegation` and mints with
+ * `app_prepare_delegation`, which Internet Identity gained only after its
+ * frontend left the canister (#561). No build serves both, so a v10 app needs
+ * the frontend from somewhere else, and older builds cannot help it.
+ *
+ * @param flavor - The installed client's contract. Defaults to `legacy` (v8),
+ *   whose advice this error gave before it knew about v10.
  */
 export function localInternetIdentityUnavailableError(
-  canisterId: string
+  canisterId: string,
+  flavor: AuthClientFlavor = "legacy"
 ): Error {
-  return new Error(
+  const problem =
     `[ic-reactor] The Internet Identity canister ${canisterId} does not serve a sign-in UI: ` +
-      `neither /authorize nor / returned a page. Internet Identity builds from ` +
+    `neither /authorize nor / returned a page. `
+
+  if (flavor === "session") {
+    return new Error(
+      problem +
+        `With @icp-sdk/auth v10, local sign-in needs an Internet Identity frontend served ` +
+        `separately, because no Internet Identity canister build both serves /authorize and ` +
+        `supports v10 sessions. Set \`identityProvider\` to that frontend's authorize URL and ` +
+        `\`internetIdentityId\` to the local Internet Identity canister that mints its delegations.`
+    )
+  }
+
+  return new Error(
+    problem +
+      `Internet Identity builds from ` +
       `release-2026-03-23 onward moved their frontend out of the canister (the id.ai split) ` +
       `and cannot be used locally. Install internet_identity_dev.wasm from release-2026-03-16, ` +
       `the newest build that still self-serves /authorize, or point \`identityProvider\` at a ` +

package/src/auth/types.ts

@@ -12,7 +12,7 @@ export interface SignedIdentityAttributes {
  *
  * A function (or promise) lets the Internet Identity window open while the
  * nonce is still being fetched, so the popup is opened inside the user gesture
- * instead of after it. `@icp-sdk/auth` v8 requires the function form, and
+ * instead of after it. Every supported `@icp-sdk/auth` requires the function form, and
  * IC Reactor normalizes whichever of these you pass into that thunk.
  */
 export type IdentityAttributeNonce =
@@ -72,7 +72,10 @@ export interface AuthClientStorageLike {
   remove(key: string): Promise<void>
 }
 
-/** Idle-session configuration forwarded to the underlying AuthClient. */
+/**
+ * Idle-session configuration forwarded to the underlying AuthClient.
+ * `@icp-sdk/auth` v8 only; see {@link AuthenticationClientOptions.idleOptions}.
+ */
 export interface AuthClientIdleOptions {
   /** Called once the user has been idle for `idleTimeout` ms. */
   onIdle?: () => unknown
@@ -114,19 +117,31 @@ export interface AuthenticationClientOptions {
    * @see https://github.com/dfinity/internet-identity/blob/main/docs/internet-identity-spec.adoc
    */
   derivationOrigin?: string | URL
-  /** Persistent storage backend. @default IndexedDB */
+  /**
+   * Persistent storage backend. `@icp-sdk/auth` v8 only: v10 drops it with a
+   * one-time warning. @default IndexedDB
+   */
   storage?: AuthClientStorageLike
   /**
    * Session key algorithm. Use `"Ed25519"` when the storage backend cannot
-   * hold a `CryptoKey`. @default "ECDSA"
+   * hold a `CryptoKey`. `@icp-sdk/auth` v8 only: v10 drops it with a one-time
+   * warning. @default "ECDSA"
    */
   keyType?: AuthClientKeyType
   /**
    * Idle timeout configuration. Pass `{ disableIdle: true }` to opt out of the
    * default behaviour, which signs the user out and reloads after 10 minutes.
+   *
+   * `@icp-sdk/auth` v8 only. v10 has no equivalent, so IC Reactor drops it
+   * there with a one-time warning: on v10 the identity provider enforces the
+   * idle limit, so pass `maxTimeToIdle` to `login()` and set
+   * `disableBrowserActivity` instead.
    */
   idleOptions?: AuthClientIdleOptions
-  /** An existing identity to authenticate via delegation. */
+  /**
+   * An existing identity to authenticate via delegation. `@icp-sdk/auth` v8
+   * only: v10 drops it with a one-time warning.
+   */
   identity?: SignIdentity | PartialIdentity
   /**
    * How the client talks to the identity provider. `"redirect"` requires
@@ -134,10 +149,32 @@ export interface AuthenticationClientOptions {
    * @default "window"
    */
   transport?: "window" | "redirect"
+  /**
+   * Stops a v10 client from watching the page for signs of activity, so only
+   * requests keep the session in use.
+   *
+   * `@icp-sdk/auth` v10 only. v8 has no equivalent, so IC Reactor drops it
+   * there with a one-time warning. On v8, `idleOptions` controls idle handling.
+   * @default false
+   */
+  disableBrowserActivity?: boolean
 }
 
 export interface AuthClientSignInOptions {
+  /** The longest the delegation may last, in nanoseconds. */
   maxTimeToLive?: bigint
+  /**
+   * How long a signed-in user may be idle before the sign-in ends, in
+   * nanoseconds.
+   *
+   * `@icp-sdk/auth` v10 only. v8's sign-in has no idle limit, so IC Reactor
+   * drops it there with a one-time warning. On v8, set `idleOptions` instead.
+   */
+  maxTimeToIdle?: bigint
+  /**
+   * Canisters the delegation is restricted to. `@icp-sdk/auth` v8 only: v10
+   * ignores it, and IC Reactor warns when it is set for a v10 client.
+   */
   targets?: Principal[]
 }
 
@@ -156,6 +193,7 @@ export interface RequestIdentityAttributesParameters extends AuthenticationClien
    */
   signIn?: boolean
   maxTimeToLive?: bigint
+  maxTimeToIdle?: bigint
   targets?: Principal[]
 }
 
@@ -178,6 +216,11 @@ export interface RequestOpenIdIdentityAttributesParameters extends Omit<
 /**
  * Structural subset of `@icp-sdk/auth`'s `AuthClient` that IC Reactor relies
  * on. Declared locally so `@icp-sdk/auth` stays an optional peer dependency.
+ *
+ * Every method here is identical across the supported majors (v8 and v10) --
+ * only the option objects handed to the constructor and to `signIn` diverge,
+ * and `auth-client-compat.ts` translates those. That is what lets one interface
+ * describe both.
  */
 export interface AuthClientLike {
   getIdentity(): Promise<Identity> | Identity
@@ -186,7 +229,7 @@ export interface AuthClientLike {
   signOut(options?: { returnTo?: string }): Promise<void>
   requestAttributes(params: {
     keys: string[]
-    // `@icp-sdk/auth` v8 takes a thunk, so it can journal the value and replay
+    // Every supported `@icp-sdk/auth` takes a thunk, so it can journal the value and replay
     // the same bytes through a redirect flow.
     nonce: () => Promise<Uint8Array>
   }): Promise<SignedIdentityAttributes>

package/src/createActorHooks.ts

@@ -44,99 +44,107 @@ import {
   useActorMethod,
   UseActorMethodParameters,
 } from "./hooks/useActorMethod.js"
-import type { CallConfig } from "@icp-sdk/core/agent"
-import { InfiniteQueryConfig } from "./createInfiniteQuery.js"
+import { SkippableInfiniteQueryConfig } from "./createInfiniteQuery.js"
 import { SuspenseInfiniteQueryConfig } from "./createSuspenseInfiniteQuery.js"
-import { QueryConfig, SuspenseQueryConfig, MutationConfig } from "./types.js"
-
-/**
- * The bound query hooks forward their config to `useActorQuery` and
- * `useActorSuspenseQuery`, which take `callConfig`. `QueryConfig` is shared with
- * `createQuery`, which does not use it, so it is added here and not there.
- */
-type WithCallConfig<Config> = Config & {
-  /** Agent call configuration (canisterId override, effectiveCanisterId, etc.) */
-  callConfig?: CallConfig
-}
+import {
+  SkippableQueryConfig,
+  SuspenseQueryConfig,
+  MutationConfig,
+} from "./types.js"
 
 export type ActorHooks<Service, Transform extends TransformKey> = {
+  // `args` may be `skipToken` here, and not in the suspense hooks below.
   useActorQuery: {
     <Method extends FunctionName<Service>>(
-      config: WithCallConfig<
-        QueryConfig<
-          Service,
-          Method,
-          Transform,
-          ReactorQueryData<ReactorReturnOk<Service, Method, Transform>>
-        >
+      config: SkippableQueryConfig<
+        Service,
+        Method,
+        Transform,
+        ReactorQueryData<ReactorReturnOk<Service, Method, Transform>>
       >
     ): UseQueryResult<
       ReactorQueryData<ReactorReturnOk<Service, Method, Transform>>,
       ReactorReturnErr<Service, Method, Transform>
     >
     <Method extends FunctionName<Service>, TData>(
-      config: WithCallConfig<QueryConfig<Service, Method, Transform, TData>>
+      config: SkippableQueryConfig<Service, Method, Transform, TData>
     ): UseQueryResult<TData, ReactorReturnErr<Service, Method, Transform>>
   }
 
   useActorSuspenseQuery: {
     <Method extends FunctionName<Service>>(
-      config: WithCallConfig<
-        SuspenseQueryConfig<
-          Service,
-          Method,
-          Transform,
-          ReactorQueryData<ReactorReturnOk<Service, Method, Transform>>
-        >
+      config: SuspenseQueryConfig<
+        Service,
+        Method,
+        Transform,
+        ReactorQueryData<ReactorReturnOk<Service, Method, Transform>>
       >
     ): UseSuspenseQueryResult<
       ReactorQueryData<ReactorReturnOk<Service, Method, Transform>>,
       ReactorReturnErr<Service, Method, Transform>
     >
     <Method extends FunctionName<Service>, TData>(
-      config: WithCallConfig<
-        SuspenseQueryConfig<Service, Method, Transform, TData>
-      >
+      config: SuspenseQueryConfig<Service, Method, Transform, TData>
     ): UseSuspenseQueryResult<
       TData,
       ReactorReturnErr<Service, Method, Transform>
     >
   }
 
+  // `Selected` is what `select` returns, so `select` can reshape the pages the
+  // way `createInfiniteQuery` allows. Without `select` it stays `InfiniteData`.
   useActorInfiniteQuery: <
     Method extends FunctionName<Service>,
     TPageParam = unknown,
-  >(
-    config: InfiniteQueryConfig<Service, Method, Transform, TPageParam>
-  ) => UseInfiniteQueryResult<
-    InfiniteData<
+    Selected = InfiniteData<
       ReactorQueryData<ReactorReturnOk<Service, Method, Transform>>,
       TPageParam
     >,
+  >(
+    config: SkippableInfiniteQueryConfig<
+      Service,
+      Method,
+      Transform,
+      TPageParam,
+      Selected
+    >
+  ) => UseInfiniteQueryResult<
+    Selected,
     ReactorReturnErr<Service, Method, Transform>
   >
 
   useActorSuspenseInfiniteQuery: <
     Method extends FunctionName<Service>,
     TPageParam = unknown,
-  >(
-    config: SuspenseInfiniteQueryConfig<Service, Method, Transform, TPageParam>
-  ) => UseSuspenseInfiniteQueryResult<
-    InfiniteData<
+    Selected = InfiniteData<
       ReactorQueryData<ReactorReturnOk<Service, Method, Transform>>,
       TPageParam
     >,
+  >(
+    config: SuspenseInfiniteQueryConfig<
+      Service,
+      Method,
+      Transform,
+      TPageParam,
+      Selected
+    >
+  ) => UseSuspenseInfiniteQueryResult<
+    Selected,
     ReactorReturnErr<Service, Method, Transform>
   >
 
-  useActorMutation: <Method extends FunctionName<Service>>(
-    config: MutationConfig<Service, Method, Transform>
+  useActorMutation: <
+    Method extends FunctionName<Service>,
+    TOnMutateResult = unknown,
+  >(
+    config: MutationConfig<Service, Method, Transform, TOnMutateResult>
   ) => UseMutationResult<
     ReactorReturnOk<Service, Method, Transform>,
     ReactorReturnErr<Service, Method, Transform>,
     // Without this TVariables defaults to `unknown` and mutate/mutateAsync
     // accept anything; the standalone hook and createMutation both pass it.
-    ReactorArgs<Service, Method, Transform>
+    ReactorArgs<Service, Method, Transform>,
+    TOnMutateResult
   >
 
   useActorMethod: <Method extends FunctionName<Service>>(