# IC Auth Wire
Bounded IC Wire contracts for portable credentials, session admission, local
session reads and logout. This package depends on passive Auth types and published
IC Wire; it has no Candid, CDK, crypto, Canic, Toko or storage dependency.
Convert domain credentials with `model::PortableCredential::try_from`, then use
`CredentialEnvelope::encode_request` for detached data. Conversion back
retains the signed claim bytes and validates checked identifier syntax. It does
not authenticate any proof. Admission still requires the complete Auth session
engine against protected host authority, caller, clock and atomic storage.
The method IDs, Serde field/variant declaration order, bounded field types and
explicit native traversal allowances are the transport contract. Consumers own actual endpoint names, ingress authentication, raw
argument/reply allocation, dispatch, cancellation and retries. No endpoint is
installed by linking this library. Response encoding failure after mutation must
trap so local effects roll back. Never retry an unknown issuance as new work.
`typescript` enables the upstream host generator only. Canister dependencies
should leave it disabled. Generated TypeScript and Rust use the same layouts and
IC Wire's canonical bounded codec. Signed claims and session records retain their
existing independent formats.
The earlier Auth 0.9 application-transport cut retired the old token-store reader
after the maintainer confirmed no deployed records or unresolved issuance effects
used that old format. There is no Candid fallback. Current portable logout
journals retain unknown issuance and durable invalidation; this migration does
not authorize discarding them.
Auth 0.15 exposes IC Wire 0.6 through `wire`. Earlier
Auth 0.14 uses Wire 0.5. The finite `Method` trait, serializer derive and typed
retained frames are removed. Use the contract's pure `encode_request`,
`decode_request`, `encode_response` and `decode_response` functions. They bind
the concrete DTO, method identity and limits to Wire's native codec and return
ordinary owned bytes. Retain those bytes unchanged across uncertain effects.
Generic native Testkit callers supply `WireCallSpec`; no replacement method trait
is provided. `typescript` derives host-only Serde metadata for regeneration.
Admission keeps its name but changes its ID from `0x415554480002` to
`0x415554480012`. Serde uses zero-based refusal tags; the new ID prevents
misinterpreting old tags. Update admission clients and receivers together.
Credential, read and logout IDs and their frozen bytes remain unchanged, as do
signed claims, session/replay records and browser logout journals. No fallback
reader, implicit reissuance or storage reset is introduced.
Hosts project `SessionError::admission_refusal()` into `model::AdmissionRefusal`
and retain detailed diagnostics locally. `NotYetValid` is a same-credential retry
hint, never permission for early admission or extending the original deadline.