The Node runtime imports the embedded @arcblock/did-connect-service and uses it at its authentication boundary. The resolver accepts trusted credentials, constructs caller information for AFS, and can add an instance membership role when the server supplies a trusted instance DID.
Runtime seam
| Piece | Role in ARC |
|---|---|
createEmbeddedAuthService | Boots connect-service against a local SQLite (or injected) auth database under the daemon home |
| HTTP handler | Serves /.well-known/service/* for connect endpoints the host exposes |
rpc.resolveIdentity | Turns JWT / access-key inputs into a connect-service identity DTO |
Shared resolveCallerFromCredentials | Maps that DTO to AFS CallerInfo for both Node and Cloudflare |
@aigne/afs-members | Optional read-only AFS view of instance memberships for the fixed instance DID |
Membership context is not client-selected. Only a server-resolved instance DID may enter membership resolution. A request cannot create a stronger relationship with an instance merely by naming one.
What to integrate against
Treat ARC's caller context as the handoff point for an AFS-aware Blocklet:
- Rely on the runtime to produce
CallerInfo. - Bind presentation to session facts if needed.
- Let provider and session policy authorize each operation after the handoff.
If you need DID Connect protocol, wallet flows, or SDK usage outside the ARC runtime seam, use DID Connect's own documentation and packages. Do not treat this page as a full DID Connect product manual.
What not to treat as the ARC product surface
| Material | How to treat it |
|---|---|
| Historical DID Connect admin / management UIs | Lineage or optional host UI — not the stable ARC extension contract for new apps |
| Standalone historical product marketing pages | Continuity references only; not proof of a complete migration into ARC |
arc did developer / provider / blocklet identity tools | Separate CLI identity workflow for entity manifests; not end-user session login |
arc did info and arc did check require an entity manifest in the current directory (blocklet.yaml, .aup/, and related layouts). Running them in an empty directory fails with:
ERROR: No entity manifest found in current directory (looked for blocklet.yaml, .aup/, index.html, index.{txt,md,ans}, package.json)That failure is expected for session-auth work; those commands are for package/provider identity, not for inspecting a logged-in end user.
Related
- Caller context — field-level
CallerInfocontract - Integrate identity — order of work for Blocklet authors
- Current contract boundaries — non-promises around trust and lifecycle