IC Auth Wire

Bounded IC Wire contracts for portable credentials, session admission, local session reads and logout. This package depends on passive Auth types and published IC Wire; it has no Candid, CDK, crypto, Canic, Toko or storage dependency.

Convert domain credentials with model::PortableCredential::try_from, then use CredentialEnvelope::encode_request for detached data. Conversion back retains the signed claim bytes and validates checked identifier syntax. It does not authenticate any proof. Admission still requires the complete Auth session engine against protected host authority, caller, clock and atomic storage.

The method IDs, Serde field/variant declaration order, bounded field types and explicit native traversal allowances are the transport contract. Consumers own actual endpoint names, ingress authentication, raw argument/reply allocation, dispatch, cancellation and retries. No endpoint is installed by linking this library. Response encoding failure after mutation must trap so local effects roll back. Never retry an unknown issuance as new work.

typescript enables the upstream host generator only. Canister dependencies should leave it disabled. Generated TypeScript and Rust use the same layouts and IC Wire's canonical bounded codec. Signed claims and session records retain their existing independent formats.

The earlier Auth 0.9 application-transport cut retired the old token-store reader after the maintainer confirmed no deployed records or unresolved issuance effects used that old format. There is no Candid fallback. Current portable logout journals retain unknown issuance and durable invalidation; this migration does not authorize discarding them.

Auth 0.15 exposes IC Wire 0.6 through wire. Earlier Auth 0.14 uses Wire 0.5. The finite Method trait, serializer derive and typed retained frames are removed. Use the contract's pure encode_request, decode_request, encode_response and decode_response functions. They bind the concrete DTO, method identity and limits to Wire's native codec and return ordinary owned bytes. Retain those bytes unchanged across uncertain effects. Generic native Testkit callers supply WireCallSpec; no replacement method trait is provided. typescript derives host-only Serde metadata for regeneration.

Admission keeps its name but changes its ID from 0x415554480002 to 0x415554480012. Serde uses zero-based refusal tags; the new ID prevents misinterpreting old tags. Update admission clients and receivers together. Credential, read and logout IDs and their frozen bytes remain unchanged, as do signed claims, session/replay records and browser logout journals. No fallback reader, implicit reissuance or storage reset is introduced.

Hosts project SessionError::admission_refusal() into model::AdmissionRefusal and retain detailed diagnostics locally. NotYetValid is a same-credential retry hint, never permission for early admission or extending the original deadline.