v4.0.0

ic-reactor 4.0.0

The first stable release of ic-reactor 4. A plain npm install @ic-reactor/core now installs 4.x. The 3.x line stays installable under the v3-latest dist-tag (v0-latest for @ic-reactor/vite-plugin 0.x) and gets security fixes only, until 90 days after this release.

• What changed, and upgrading from a beta: CHANGELOG, 4.0.0
• Coming from 3.x: Migrating from 3.x
• Docs: https://ic-reactor.b3pay.net/v4/, and Versioning and support

Packages: @ic-reactor/core, @ic-reactor/react and @ic-reactor/vite-plugin, all 4.0.0, published with provenance. Core's peer @candid-core/schema is pinned at exactly 0.4.0, and the plugin's peer @candid-core/cli at exactly 0.3.0.

What's Changed

• Production hardening round: #686 decisions, DX APIs, and consumer AI guides by @b3hr4d in #769
• Fix the tools release job and release tools 0.15.1 by @b3hr4d in #771
• docs: gate the docs-site code snippets (499 failing → 0) and reject hooks outside components by @b3hr4d in #773
• IR8: open the v4 line — delete parser, codegen, cli and candid, rewire CI and docs, version 4.0.0-alpha.0 by @b3hr4d in #791
• chore(v4): remove the v3 runtime from core, react and e2e (IR0) by @b3hr4d in #795
• feat(core): network resolution, the root-key rule and the ic_env resolver (IR1c) by @b3hr4d in #797
• feat(core): fake replica injected through fetch, fault hooks and a test auth (IR4a) by @b3hr4d in #799
• feat(core): ReactorError with 8 kinds and the may-have-executed classifier (IR3) by @b3hr4d in #796
• feat(core): strict parseUnits and formatUnits (IR5) by @b3hr4d in #798
• feat(core): createClient, one immutable agent per principal (IR1) by @b3hr4d in #802
• chore(evals): bring the eval harness to v4 and add the v4 condition's plumbing (DX5, phase A) by @b3hr4d in #801
• ci: the export budget, trap types, fault-proof tests and single-guide AI context (DX4 framework) by @b3hr4d in #803
• feat(vite-plugin): generate candid-core modules in a child process (IR7) by @b3hr4d in #800
• feat(core): client.canister(), caller-scoped keys and the query and mutation builders (IR2t) by @b3hr4d in #804
• feat(react): ReactorProvider, useClient and useAuth (IR6) by @b3hr4d in #805
• feat(core): createTestClient and typed TestHandlers (IR4b) by @b3hr4d in #806
• docs(core): the v4 guide (llms.txt) and the one consumer skill (DX3) by @b3hr4d in #808
• test(evals): v4 references, ported faulty solutions and the gate on the real packages (DX5, phase B) by @b3hr4d in #807
• docs(evals): the 4.0.0-beta.1 gate passes: v4 safe in 5 of 5 on both tasks (DX5) by @b3hr4d in #809
• test(core): the runtime-trap suite and the maxDepth measurement (IR9) by @b3hr4d in #810
• examples: icrc-ledger on ic-reactor 4: mainnet reads and a fault-injection sandbox (DX1, 1 of 4) by @b3hr4d in #811
• ci: ignore two unpatched high advisories reachable only from the docs build by @b3hr4d in #817
• examples: node-agent-tool, a CLI for people and agents: identities, certified reads, deduplicated re-sends, --json (DX1, 4 of 4) by @b3hr4d in #816
• examples: vite-wallet on an icp-cli local backend: env network, II and a dev account, optimistic writes (DX1, 2 of 4) by @b3hr4d in #814
• examples: next-ssr, Next.js App Router over mainnet ledgers: per-request client, lossless hydration, streaming (DX1, 3 of 4) by @b3hr4d in #815
• fix(core): cancel every call on a disposed client, writes included (#818) by @b3hr4d in #819
• fix(core,react): build query keys for the caller a render shows, so a signed-in reload hydrates (#813) by @b3hr4d in #820
• chore: release v4.0.0-beta.1 by @b3hr4d in #812
• feat(core): aim createTestClient().refuseNext() at a method or canister by @b3hr4d in #824
• test(e2e): rewrite the e2e suite for ic-reactor 4 on an icp-cli 1.2.0 network (IR9b) by @b3hr4d in #825
• core: give a missing canister ReactorError code canister_not_found by @b3hr4d in #826
• docs: say invalidates replaces the default, and name the QueryCache listener an app can use by @b3hr4d in #831
• ci: check the vite plugin at the floor of each Vite major in verify:peer-floors by @b3hr4d in #832
• docs: the ic-reactor 4 docs site, and the "Removed in 4.0" table (DX2) by @b3hr4d in #827
• evals: build v4 from the published 4.0.0-beta.1 and draft Addendum 4 (the GA gate) by @b3hr4d in #830
• test(examples): run the four examples against the published beta from npm, and say what StackBlitz runs by @b3hr4d in #834
• fix(examples): give each vite-wallet transfer its own memo by @b3hr4d in #837
• fix(examples): give each icrc-ledger transfer a memo of its own by @b3hr4d in #839
• docs(evals): freeze Addendum 4, the GA gate (alternative A, pooled) by @b3hr4d in #841
• docs(evals): record the GA gate: every run safe, rule 1 not met on a flagged v4 run by @b3hr4d in #843
• feat(core): useSuspenseQuery takes client.queryOptions() without a cast by @b3hr4d in #835
• chore(deps): patch source-map-js and compression in the docs build by @b3hr4d in #845
• docs(evals): record the owner's decision on the GA gate result by @b3hr4d in #844
• docs(evals): Addendum 5, the leak audit and the CLI's persisted tool output by @b3hr4d in #846
• chore(deps): patch sharp in the docs build by @b3hr4d in #848
• chore: release v4.0.0-beta.2 by @b3hr4d in #840
• feat(core): hand the auth factory the client's network by @b3hr4d in #856
• fix(core)!: "local" is icp-cli's 127.0.0.1:8000 by @b3hr4d in #857
• chore(release): 4.0.0-beta.3 by @b3hr4d in #858
• ci(size): set core's limit at its size and measure core with its peers by @b3hr4d in #859
• feat(vite-plugin): fetch a missing didFile from the live canister (#852, phase 1) by @b3hr4d in #860
• feat(core): isReactorError(error, canister, method) narrows a direct call's error to the method's Err by @b3hr4d in #862
• docs: show React.lazy keeping the IC stack out of the first load by @b3hr4d in #863
• feat(core): offer a deduplicated write again with client.resendOf by @b3hr4d in #864
• chore(release): 4.0.0-beta.4 by @b3hr4d in #865
• chore: pin candid-core schema 0.4.0 and cli 0.3.0, and move v4 to 4.0.0-beta.5 by @b3hr4d in #866
• feat(core): refuse update and oneway methods in queryOptions at compile time by @b3hr4d in #868
• feat(vite-plugin): methods projection and the live check (#852, phase 2) by @b3hr4d in #867
• chore(release): 4.0.0-beta.5 by @b3hr4d in #869
• feat(examples): add canister-studio: auto forms, safe calls, SSR by @b3hr4d in #870
• fix(release): ship the MIT LICENSE in every package and at the root by @b3hr4d in #925
• docs(examples): node-agent-tool keeps identity keys out of the project by @b3hr4d in #926
• fix(release): set the Node floor to 22.12.0 and test on it in CI by @b3hr4d in #928
• docs: a step 0 that creates the project, and "ES modules only" by @b3hr4d in #929
• docs: a local network without the Vite plugin by @b3hr4d in #931
• fix(core): type a method given as any by its value, not a list (#874) by @b3hr4d in #884
• fix(core): a cancelled read stops waiting for its HTTP answers (part of #875) by @b3hr4d in #886
• feat(core/testing): aim dropNextReply at a method or canister by @b3hr4d in #889
• docs: five guide gaps (consent reads, retryable Err, parseUnits, Resend, dispose) by @b3hr4d in #891
• docs: use the core, IC Reactor's new mark, for the logo and favicon by @b3pay-design in #943
• feat(vite-plugin): onGenerated, called after each generated module by @b3hr4d in #892
• fix(core, react): fail loudly on two copies of @tanstack/query-core by @b3hr4d in #883
• docs: give the v4 docs the B3Pay look by @b3pay-design in #944
• feat(core): client.time(canister), the IC's certified time (#876) by @b3hr4d in #885
• feat(core): ReactorError.expiresAt on a write that got no answer (#878) by @b3hr4d in #888
• docs: add a share image for links to the docs by @b3pay-design in #945
• feat(core): client.encode() and Resend.bytes, the bytes a call sends (#877) by @b3hr4d in #887
• feat(core): client.canisterId says what a target resolves to by @b3hr4d in #890
• fix(core): a reply over a million bytes decodes; add maxElements by @b3hr4d in #932
• docs: ICRC-49 wallets are not an AuthLike; writes through SignerAgent beside the client by @b3hr4d in #930
• fix(core): AuthLike accepts a session state a later @icp-sdk/auth adds by @b3hr4d in #934
• fix(vite-plugin): detect the local network on Windows with icp-cli from npm by @b3hr4d in #933
• feat(core): timeoutMs on call options; a timed-out write is outcome_unknown (#875) by @b3hr4d in #927
• fix(core)!: refuse unknown and non-boolean createClient options by @b3hr4d in #938
• fix(core): keep TanStack retries for an app's queries, and invalidate the QueryClient a write ran on by @b3hr4d in #937
• fix(core): send a held-back write as the caller of its mutate(), or not at all by @b3hr4d in #936
• fix(react)!: useClient() returns a view per caller, and a view writes only as its caller by @b3hr4d in #935
• fix(core, react): announce a session that ends, and survive a failing auth factory by @b3hr4d in #939
• fix(core): narrow what allowEnvConfig: true believes of the ic_env cookie by @b3hr4d in #940
• fix(core): route "env" dev pages off localhost through their own origin by @b3hr4d in #941
• feat(core): believe an icp0.io canister page's cookie for canister ids by @b3hr4d in #942
• docs: one docs home for the three libraries, with a library switcher by @b3pay-design in #947
• docs: build an ICRC-1 wallet, step by step by @b3pay-design in #948
• docs: render a server page for one user, step by step by @b3pay-design in #953
• docs: give an agent a canister's tools, step by step by @b3pay-design in #954
• docs: light the landing page's core, and its share image by @b3hr4d in #955
• vite-plugin: make the symlinked two-saves test wait on order, not time by @b3hr4d in #946
• chore(deps): patch vite, markdown-it, fast-uri and smol-toml by @b3hr4d in #959
• chore(release): 4.0.0-beta.6 by @b3hr4d in #958
• fix(core): keep a write's outcome unknown when its re-send did not run by @b3hr4d in #982
• test(react): assert strict-mode disposals on the client in use, not the factory total by @b3hr4d in #981
• fix(core): a signer that declines rejects not_delivered, not outcome_unknown by @b3hr4d in #983
• test(core): an update answered 202 whose polls are throttled is not sent again by @b3hr4d in #984
• fix(react): a nested provider handed a view leaves the outer client registered by @b3hr4d in #985
• fix(vite-plugin): a failed generation fails a Vitest run by default by @b3hr4d in #986
• fix(core): refuse allowEnvConfig on loca.lt and devtunnels.ms pages by @b3hr4d in #987
• fix(core): route Tailscale, dev tunnel and dotless LAN pages through the page's origin by @b3hr4d in #988
• fix(core): drop a trailing dot from page and agent hostnames (#975) by @b3hr4d in #993
• fix(scripts): compare verify-test-fails with v4, and count no result as no evidence by @b3hr4d in #994
• fix(scripts): hold every skill-packages skill to the consumer-skill rules by @b3hr4d in #995
• fix(scripts): verify:traps finds a @ts- directive wherever TypeScript reads one by @b3hr4d in #996
• fix(core): call an auth factory that returns no auth only once by @b3hr4d in #997
• fix(core): bound client.time() by the canister object's timeoutMs by @b3hr4d in #998
• fix(core): refuse a network host the agent cannot call over http or https by @b3hr4d in #989
• fix(core): know Deno by Deno.version.deno, not a page element named Deno by @b3hr4d in #990
• perf(core): read the live caller only when a view is made (#977) by @b3hr4d in #991
• fix(core): copy client.time()'s path into the global Uint8Array by @b3hr4d in #1000
• chore: delete dead code and stop publishing vite-plugin's src (#978) by @b3hr4d in #992
• refactor: keep one copy of each helper that had to change together by @b3hr4d in #1001
• fix(vite-plugin): regenerate deleted modules, kill a hung icp's group, close gate gaps by @b3hr4d in #999
• fix(core): join same-run signIn() calls, and document redirect sign-in by @b3hr4d in #1002
• docs(auth): bring the Internet Identity guide up to II 2.0 by @b3hr4d in #1003
• fix(scripts): release.js stops at the release commit and prints the release-PR steps by @b3hr4d in #1004
• chore(release): 4.0.0-beta.7 by @b3hr4d in #1005
• docs(core): cite the IC interface specification for what expiresAt proves by @b3hr4d in #1006
• docs(core): keep an eval literal out of the consumer guide by @b3hr4d in #1007
• docs: Versioning and support page for 4.x by @b3hr4d in #1010
• ci(vite-plugin): run the whole plugin suite on Windows by @b3hr4d in #1009
• ci(release): publish the tested tarballs, after CI passed on the tag by @b3hr4d in #1011
• docs(security): describe ic-reactor 4's threat model by @b3hr4d in #1013
• fix(vite-plugin): stop vouching for a local network that stopped by @b3hr4d in #1008
• chore(deps): lift zod, happy-dom and undici past new high advisories by @b3hr4d in #1015
• chore: release v4.0.0-beta.8 by @b3hr4d in #1016
• fix(release): publish each tarball by a ./ path by @b3hr4d in #1017
• ci: prepare the 4.0 GA flip (main becomes the 4.x line) by @b3hr4d in #836
• chore: release v4.0.0 by @b3hr4d in #847

New Contributors

• @b3pay-design made their first contribution in #943

Full Changelog: v3.13.0...v4.0.0