@greenpandastudios/aug-cli 0.19.0 → 0.20.1

package/examples/oidc-login/provider/credentials.aug.md

@@ -1,64 +1,20 @@
 <!-- Generated by aug spec. Edit the August source, then regenerate. -->
 
-# `credentials.aug` specification
-
-August 0.19.0. This document is compiled from checked code with deterministic wording guided by Simplified Technical English.
-
-## In this file
-
-- [`verifyCredentials`](credentials.aug.md#symbol-verifyCredentials) is a function returning `bool`.
+# `credentials.aug`
 
 <a id="symbol-verifyCredentials"></a>
+## `verifyCredentials` · [source](credentials.aug#L4)
 
-## `verifyCredentials`
-
-[source](credentials.aug#L3)
-
-**Inputs**
-
-- `username` (`string`) — required labeled input.
-- `password` (`string`) — required labeled input.
-- `crypto` ([`Crypto`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto)) — injected; callers omit it.
-
-Returns: `bool`.
-
-Capabilities: [`crypto.passwordHash`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.passwordHash), [`crypto.decodeBase64url`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.decodeBase64url), [`crypto.equal`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.equal).
-
-Can fail with `CryptoError`. Callers must catch or propagate these errors.
-
-**What it does**
-
-- If (call `length` on `username` is greater than `64`) or (call `length` on `password` is greater than `256`):
-  - Return `false`.
-- Set `actual` to call [`Crypto.passwordHash`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.passwordHash) on `crypto` with `password` = call `bytes` on `password`; `salt` = call `bytes` on `"August demo salt v1"`; `iterations` = `600000`.
-- Set `expected` to call [`Crypto.decodeBase64url`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.decodeBase64url) on `crypto` with `input` = `"s70USYF6WohPz2f7VLA9haS_ZgEtenviSf_HG0o7B_A"`.
-- Set `userMatches` to call [`Crypto.equal`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.equal) on `crypto` with `left` = call `bytes` on `username`; `right` = call `bytes` on `"ada"`.
-- Set `passwordMatches` to call [`Crypto.equal`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.equal) on `crypto` with `left` = `actual`; `right` = `expected`.
-- Return `userMatches` and `passwordMatches`.
-
-**Author documentation**
-
-One development account with a PBKDF2-HMAC-SHA256 verifier. Production account storage is deliberately a separate capability.
-
-## Dependencies used by this file
-
-Only referenced types and operations appear here. Each name links to its complete specification.
-
-### [`Crypto`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto)
-
-Capability interface from `august.crypto`.
+One development account with a PBKDF2-HMAC-SHA256 verifier. Production account storage is deliberately a separate capability. It takes `username` and `password` as strings. It gets `crypto` ([`Crypto`](../.aug-spec/packages/%40git/url_9ef654c66d34ab8f5527/0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/contracts.aug.md#symbol-Crypto)) from dependency injection.
 
-- [`Crypto.decodeBase64url`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.decodeBase64url) (`input`: `string`) → `Bytes`; can fail with `CryptoError`.
-- [`Crypto.equal`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.equal) (`left`: `Bytes`, `right`: `Bytes`) → `bool`.
-- [`Crypto.passwordHash`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.passwordHash) (`password`: `Bytes`, `salt`: `Bytes`, `iterations`: `int`) → `Bytes`; can fail with `CryptoError`.
+Failures can raise `CryptoError`.
 
-## Built-in operations used by this file
+If the byte length of `username` is greater than `64` or the byte length of `password` is greater than `256`, it returns `false`. It sets `actual` to [`crypto.passwordHash`](../.aug-spec/packages/%40git/url_9ef654c66d34ab8f5527/0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/contracts.aug.md#symbol-Crypto.passwordHash) with `password` from the UTF-8 bytes of `password`, `salt` from the UTF-8 bytes of `"August demo salt v1"`, and `iterations` `600000`. It sets `expected` to [`crypto.decodeBase64url`](../.aug-spec/packages/%40git/url_9ef654c66d34ab8f5527/0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/contracts.aug.md#symbol-Crypto.decodeBase64url) with `input` `"s70USYF6WohPz2f7VLA9haS_ZgEtenviSf_HG0o7B_A"`. It sets `userMatches` to [`crypto.equal`](../.aug-spec/packages/%40git/url_9ef654c66d34ab8f5527/0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/contracts.aug.md#symbol-Crypto.equal) with `left` from the UTF-8 bytes of `username` and `right` from the UTF-8 bytes of `"ada"`.
 
-- `string.bytes` (no inputs) → `Bytes`: Encode this string as immutable UTF-8 bytes.
-- `string.length` (no inputs) → `int`: Read the number of UTF-8 bytes. Unicode text is preserved losslessly.
+It sets `passwordMatches` to [`crypto.equal`](../.aug-spec/packages/%40git/url_9ef654c66d34ab8f5527/0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/contracts.aug.md#symbol-Crypto.equal) with `left` from `actual` and `right` from `expected`. It returns `userMatches` and `passwordMatches`.
 
-[Full built-in reference](https://greenpandastudios.github.io/augscript/language-constructs).
+## Dependencies
 
-## Shared language rules
+It uses [`Crypto`](../.aug-spec/packages/%40git/url_9ef654c66d34ab8f5527/0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/contracts.aug.md#symbol-Crypto) ([`decodeBase64url`](../.aug-spec/packages/%40git/url_9ef654c66d34ab8f5527/0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/contracts.aug.md#symbol-Crypto.decodeBase64url), [`equal`](../.aug-spec/packages/%40git/url_9ef654c66d34ab8f5527/0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/contracts.aug.md#symbol-Crypto.equal), and [`passwordHash`](../.aug-spec/packages/%40git/url_9ef654c66d34ab8f5527/0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/contracts.aug.md#symbol-Crypto.passwordHash)) from `crypto`.
 
-See the [language reference](https://greenpandastudios.github.io/augscript/reference) for numeric, equality, ownership, and task rules.
+Built-in operations follow the [language reference](https://greenpandastudios.github.io/augscript/language-constructs).

package/examples/oidc-login/provider/discovery.aug

@@ -1,13 +1,14 @@
+// aug-spec: "discovery.aug.md" explains this file. Read it before changes; refresh with aug spec.
 import settings and SigningKeys and KeyError from common
-import Crypto and RsaJwks and rsaJwk from august.crypto
+import Crypto and RsaJwks and rsaJwk from crypto
 
 /** Discovery advertises exactly this provider's supported authorization-code profile. */
 record Discovery(string issuer, string authorization_endpoint, string token_endpoint, string userinfo_endpoint, string jwks_uri, List<string> response_types_supported, List<string> grant_types_supported, List<string> subject_types_supported, List<string> id_token_signing_alg_values_supported, List<string> token_endpoint_auth_methods_supported, List<string> scopes_supported, List<string> claims_supported, List<string> code_challenge_methods_supported)
-endpoint GET "/provider/.well-known/openid-configuration" as discovery() returns Discovery:
+endpoint GET "/provider/.well-known/openid-configuration" as discovery() :
     config = settings()
     return Discovery(issuer=config.issuer, authorization_endpoint=config.issuer + "/authorize", token_endpoint=config.issuer + "/token", userinfo_endpoint=config.issuer + "/userinfo", jwks_uri=config.issuer + "/jwks", response_types_supported=["code"], grant_types_supported=["authorization_code"], subject_types_supported=["public"], id_token_signing_alg_values_supported=["RS256"], token_endpoint_auth_methods_supported=["none"], scopes_supported=["openid", "profile"], claims_supported=["iss", "sub", "aud", "exp", "iat", "nonce", "name"], code_challenge_methods_supported=["S256"])
 
 /** Only the provider's public signing key is published. Session keys never enter this JWKS. */
-endpoint GET "/provider/jwks" as jwks(resolve Crypto crypto, resolve SigningKeys keys) returns RsaJwks uses keys.provider and crypto.publicRsa and crypto.exportRsa unless KeyError and CryptoError:
+endpoint GET "/provider/jwks" as jwks(resolve Crypto crypto, resolve SigningKeys keys) :
     publicKey = crypto.publicRsa(key=keys.provider())
     return RsaJwks(keys=[rsaJwk(publicKey=publicKey, kid="provider-1")])

package/examples/oidc-login/provider/discovery.aug.md

@@ -1,133 +1,26 @@
 <!-- Generated by aug spec. Edit the August source, then regenerate. -->
 
-# `discovery.aug` specification
+# `discovery.aug`
 
-August 0.19.0. This document is compiled from checked code with deterministic wording guided by Simplified Technical English.
-
-## In this file
-
-- [`Discovery`](discovery.aug.md#symbol-Discovery) is an immutable record.
-- [`discovery`](discovery.aug.md#symbol-discovery) handles `GET` `/provider/.well-known/openid-configuration` returning `Discovery`.
-- [`jwks`](discovery.aug.md#symbol-jwks) handles `GET` `/provider/jwks` returning `RsaJwks`.
+Plain handler results default to HTTP 200 unless another status is declared. HttpResponse values choose their own status. Unhandled request failures return HTTP 500 and cancel the request tasks.
 
 <a id="symbol-Discovery"></a>
+## `Discovery` · immutable record · [source](discovery.aug#L6)
 
-## `Discovery`
-
-[source](discovery.aug#L5)
-
-Immutable record.
-
-**Author documentation**
-
-Discovery advertises exactly this provider's supported authorization-code profile.
-
-**Inputs**
-
-- `issuer` (`string`) — required labeled input — stored as `issuer` and read-only after initialization.
-- `authorization_endpoint` (`string`) — required labeled input — stored as `authorization_endpoint` and read-only after initialization.
-- `token_endpoint` (`string`) — required labeled input — stored as `token_endpoint` and read-only after initialization.
-- `userinfo_endpoint` (`string`) — required labeled input — stored as `userinfo_endpoint` and read-only after initialization.
-- `jwks_uri` (`string`) — required labeled input — stored as `jwks_uri` and read-only after initialization.
-- `response_types_supported` (`List<string>`) — required labeled input — stored as `response_types_supported` and read-only after initialization.
-- `grant_types_supported` (`List<string>`) — required labeled input — stored as `grant_types_supported` and read-only after initialization.
-- `subject_types_supported` (`List<string>`) — required labeled input — stored as `subject_types_supported` and read-only after initialization.
-- `id_token_signing_alg_values_supported` (`List<string>`) — required labeled input — stored as `id_token_signing_alg_values_supported` and read-only after initialization.
-- `token_endpoint_auth_methods_supported` (`List<string>`) — required labeled input — stored as `token_endpoint_auth_methods_supported` and read-only after initialization.
-- `scopes_supported` (`List<string>`) — required labeled input — stored as `scopes_supported` and read-only after initialization.
-- `claims_supported` (`List<string>`) — required labeled input — stored as `claims_supported` and read-only after initialization.
-- `code_challenge_methods_supported` (`List<string>`) — required labeled input — stored as `code_challenge_methods_supported` and read-only after initialization.
+Discovery advertises exactly this provider's supported authorization-code profile. It takes `issuer`, `authorization_endpoint`, `token_endpoint`, `userinfo_endpoint`, and `jwks_uri` as strings, kept read-only and `response_types_supported`, `grant_types_supported`, `subject_types_supported`, `id_token_signing_alg_values_supported`, `token_endpoint_auth_methods_supported`, `scopes_supported`, `claims_supported`, and `code_challenge_methods_supported` as `List<string>`, kept read-only.
 
 <a id="symbol-discovery"></a>
+## `discovery` · [source](discovery.aug#L7)
 
-## `discovery`
-
-[source](discovery.aug#L6)
-
-Returns: [`Discovery`](discovery.aug.md#symbol-Discovery).
-
-HTTP route: `GET` `/provider/.well-known/openid-configuration`. Use status 200 when the handler returns a body; a returned HttpResponse can set its own status. An unhandled request failure returns status 500 and cancels its request tasks.
-
-**What it does**
-
-- Set `config` to call [`settings`](../common/settings.aug.md#symbol-settings).
-- Return call [`Discovery`](discovery.aug.md#symbol-Discovery) with `issuer` = `issuer` of `config`; `authorization_endpoint` = (`issuer` of `config` plus `"/authorize"`); `token_endpoint` = (`issuer` of `config` plus `"/token"`); `userinfo_endpoint` = (`issuer` of `config` plus `"/userinfo"`); `jwks_uri` = (`issuer` of `config` plus `"/jwks"`); `response_types_supported` = a list containing `"code"`; `grant_types_supported` = a list containing `"authorization_code"`; `subject_types_supported` = a list containing `"public"`; `id_token_signing_alg_values_supported` = a list containing `"RS256"`; `token_endpoint_auth_methods_supported` = a list containing `"none"`; `scopes_supported` = a list containing `"openid"`, `"profile"`; `claims_supported` = a list containing `"iss"`, `"sub"`, `"aud"`, `"exp"`, `"iat"`, `"nonce"`, `"name"`; `code_challenge_methods_supported` = a list containing `"S256"`.
+`discovery` handles `GET /provider/.well-known/openid-configuration`. It gets `config` from [`settings`](../common/settings.aug.md#symbol-settings). It returns a [`Discovery`](discovery.aug.md#symbol-Discovery) with `config.issuer`, `authorization_endpoint` from the text `{config.issuer}/authorize`, `token_endpoint` from the text `{config.issuer}/token`, `userinfo_endpoint` from the text `{config.issuer}/userinfo`, `jwks_uri` from the text `{config.issuer}/jwks`, `response_types_supported` from a list containing `"code"`, `grant_types_supported` from a list containing `"authorization_code"`, `subject_types_supported` from a list containing `"public"`, `id_token_signing_alg_values_supported` from a list containing `"RS256"`, `token_endpoint_auth_methods_supported` from a list containing `"none"`, `scopes_supported` from a list containing `"openid"`, `"profile"`, `claims_supported` from a list containing `"iss"`, `"sub"`, `"aud"`, `"exp"`, `"iat"`, `"nonce"`, `"name"`, and `code_challenge_methods_supported` from a list containing `"S256"`.
 
 <a id="symbol-jwks"></a>
+## `jwks` · [source](discovery.aug#L12)
 
-## `jwks`
-
-[source](discovery.aug#L11)
-
-**Inputs**
-
-- `crypto` ([`Crypto`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto)) — injected; callers omit it.
-- `keys` ([`SigningKeys`](../common/keys.aug.md#symbol-SigningKeys)) — injected; callers omit it.
-
-Returns: [`RsaJwks`](../.aug-spec/august/0.19.0/crypto/jose.aug.md#symbol-RsaJwks).
-
-Capabilities: [`keys.provider`](../common/keys.aug.md#symbol-SigningKeys.provider), [`crypto.publicRsa`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.publicRsa), [`crypto.exportRsa`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.exportRsa).
-
-Can fail with `KeyError`, `CryptoError`. Callers must catch or propagate these errors.
-
-HTTP route: `GET` `/provider/jwks`. Use status 200 when the handler returns a body; a returned HttpResponse can set its own status. An unhandled request failure returns status 500 and cancels its request tasks.
-
-**What it does**
-
-- Set `publicKey` to call [`Crypto.publicRsa`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.publicRsa) on `crypto` with `key` = call [`SigningKeys.provider`](../common/keys.aug.md#symbol-SigningKeys.provider) on `keys`.
-- Return call [`RsaJwks`](../.aug-spec/august/0.19.0/crypto/jose.aug.md#symbol-RsaJwks) with `keys` = a list containing call [`rsaJwk`](../.aug-spec/august/0.19.0/crypto/jose.aug.md#symbol-rsaJwk) with `publicKey` = `publicKey`; `kid` = `"provider-1"`; inject `crypto` from `crypto`.
-
-**Author documentation**
-
-Only the provider's public signing key is published. Session keys never enter this JWKS.
-
-## Dependencies used by this file
-
-Only referenced types and operations appear here. Each name links to its complete specification.
-
-### [`Crypto`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto)
-
-Capability interface from `august.crypto`.
-
-- [`Crypto.exportRsa`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.exportRsa) (`publicKey`: `RsaPublicKey`) → `Tuple<Bytes,Bytes>`; can fail with `CryptoError`.
-- [`Crypto.publicRsa`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.publicRsa) (`key`: `RsaPrivateKey`) → `RsaPublicKey`; can fail with `CryptoError`.
-
-### [`RsaJwks`](../.aug-spec/august/0.19.0/crypto/jose.aug.md#symbol-RsaJwks)
-
-Record from `august.crypto`.
-
-- Construct with `keys`: `List<RsaJwk>` → [`RsaJwks`](../.aug-spec/august/0.19.0/crypto/jose.aug.md#symbol-RsaJwks).
-
-### [`rsaJwk`](../.aug-spec/august/0.19.0/crypto/jose.aug.md#symbol-rsaJwk)
-
-Function from `august.crypto`.
-
-- [`rsaJwk`](../.aug-spec/august/0.19.0/crypto/jose.aug.md#symbol-rsaJwk) (`publicKey`: `RsaPublicKey`, `kid`: `string`) → [`RsaJwk`](../.aug-spec/august/0.19.0/crypto/jose.aug.md#symbol-RsaJwk); inject `crypto`: [`Crypto`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto); uses [`crypto.exportRsa`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.exportRsa); can fail with `CryptoError`.
-
-### [`KeyError`](../common/keys.aug.md#symbol-KeyError)
-
-Class from `common`.
-
-Used as a type or provider.
-
-### [`SigningKeys`](../common/keys.aug.md#symbol-SigningKeys)
-
-Capability interface from `common`.
-
-- [`SigningKeys.provider`](../common/keys.aug.md#symbol-SigningKeys.provider) (no caller inputs) → `RsaPrivateKey`; can fail with `KeyError`.
-
-### [`Settings`](../common/settings.aug.md#symbol-Settings)
-
-Record.
-
-- Read `issuer` (`string`).
-
-### [`settings`](../common/settings.aug.md#symbol-settings)
-
-Function from `common`.
+`jwks` handles `GET /provider/jwks`. Only the provider's public signing key is published. Session keys never enter this JWKS. It gets `crypto` ([`Crypto`](../.aug-spec/packages/%40git/url_9ef654c66d34ab8f5527/0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/contracts.aug.md#symbol-Crypto)) and `keys` ([`SigningKeys`](../common/keys.aug.md#symbol-SigningKeys)) from dependency injection.
 
-- [`settings`](../common/settings.aug.md#symbol-settings) (no caller inputs) → [`Settings`](../common/settings.aug.md#symbol-Settings).
+It can also raise `CryptoError` and `KeyError`. It sets `publicKey` to [`crypto.publicRsa`](../.aug-spec/packages/%40git/url_9ef654c66d34ab8f5527/0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/contracts.aug.md#symbol-Crypto.publicRsa) with `key` from [`keys.provider`](../common/keys.aug.md#symbol-SigningKeys.provider). It returns a [`RsaJwks`](../.aug-spec/packages/%40git/url_9ef654c66d34ab8f5527/0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/jose.aug.md#symbol-RsaJwks) with `keys` from a list containing [`rsaJwk`](../.aug-spec/packages/%40git/url_9ef654c66d34ab8f5527/0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/jose.aug.md#symbol-rsaJwk) with `publicKey` and `kid` `"provider-1"` using injected `crypto`.
 
-## Shared language rules
+## Dependencies
 
-See the [language reference](https://greenpandastudios.github.io/augscript/reference) for numeric, equality, ownership, and task rules.
+It uses [`Crypto`](../.aug-spec/packages/%40git/url_9ef654c66d34ab8f5527/0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/contracts.aug.md#symbol-Crypto) ([`exportRsa`](../.aug-spec/packages/%40git/url_9ef654c66d34ab8f5527/0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/contracts.aug.md#symbol-Crypto.exportRsa) and [`publicRsa`](../.aug-spec/packages/%40git/url_9ef654c66d34ab8f5527/0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/contracts.aug.md#symbol-Crypto.publicRsa)), [`RsaJwks`](../.aug-spec/packages/%40git/url_9ef654c66d34ab8f5527/0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/jose.aug.md#symbol-RsaJwks), and [`rsaJwk`](../.aug-spec/packages/%40git/url_9ef654c66d34ab8f5527/0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/jose.aug.md#symbol-rsaJwk) from `crypto`. It uses [`KeyError`](../common/keys.aug.md#symbol-KeyError), [`SigningKeys`](../common/keys.aug.md#symbol-SigningKeys) ([`provider`](../common/keys.aug.md#symbol-SigningKeys.provider)), and [`settings`](../common/settings.aug.md#symbol-settings) from `common`. It uses [`Settings`](../common/settings.aug.md#symbol-Settings) (`issuer`).

package/examples/oidc-login/provider/export.aug

@@ -1,3 +1,4 @@
+// aug-spec: "export.aug.md" explains this file. Read it before changes; refresh with aug spec.
 export AuthorizationRequest from contracts
 export AuthorizationCode from contracts
 export AccessGrant from contracts

package/examples/oidc-login/provider/export.aug.md

@@ -1,41 +1,13 @@
 <!-- Generated by aug spec. Edit the August source, then regenerate. -->
 
-# `export.aug` specification
+# `export.aug`
 
-August 0.19.0. This document is compiled from checked code with deterministic wording guided by Simplified Technical English.
+## Exports
 
-## In this file
+Export the declaration `AuthorizationRequest` from [`contracts.aug`](contracts.aug.md#symbol-AuthorizationRequest). Export the declaration `AuthorizationCode` from [`contracts.aug`](contracts.aug.md#symbol-AuthorizationCode). Export the declaration `AccessGrant` from [`contracts.aug`](contracts.aug.md#symbol-AccessGrant). Export the declaration `IdClaims` from [`contracts.aug`](contracts.aug.md#symbol-IdClaims).
 
-- Export `AuthorizationRequest` from this folder.
-- Export `AuthorizationCode` from this folder.
-- Export `AccessGrant` from this folder.
-- Export `IdClaims` from this folder.
-- Export `TokenResponse` from this folder.
-- Export `UserInfo` from this folder.
-- Export `Discovery` from this folder.
-- Export `discovery` from this folder.
-- Export `jwks` from this folder.
-- Export `authorize` from this folder.
-- Export `providerLogin` from this folder.
-- Export `token` from this folder.
-- Export `userinfo` from this folder.
+Export the declaration `TokenResponse` from [`contracts.aug`](contracts.aug.md#symbol-TokenResponse). Export the declaration `UserInfo` from [`contracts.aug`](contracts.aug.md#symbol-UserInfo). Export the declaration `Discovery` from [`discovery.aug`](discovery.aug.md#symbol-Discovery). Export the declaration `discovery` from [`discovery.aug`](discovery.aug.md#symbol-discovery).
 
-## Folder exports
+Export the declaration `jwks` from [`discovery.aug`](discovery.aug.md#symbol-jwks). Export the declaration `authorize` from [`authorization.aug`](authorization.aug.md#symbol-authorize). Export the declaration `providerLogin` from [`authorization.aug`](authorization.aug.md#symbol-providerLogin). Export the declaration `token` from [`token.aug`](token.aug.md#symbol-token).
 
-- Export the declaration `AuthorizationRequest` from [`contracts.aug`](contracts.aug.md#symbol-AuthorizationRequest).
-- Export the declaration `AuthorizationCode` from [`contracts.aug`](contracts.aug.md#symbol-AuthorizationCode).
-- Export the declaration `AccessGrant` from [`contracts.aug`](contracts.aug.md#symbol-AccessGrant).
-- Export the declaration `IdClaims` from [`contracts.aug`](contracts.aug.md#symbol-IdClaims).
-- Export the declaration `TokenResponse` from [`contracts.aug`](contracts.aug.md#symbol-TokenResponse).
-- Export the declaration `UserInfo` from [`contracts.aug`](contracts.aug.md#symbol-UserInfo).
-- Export the declaration `Discovery` from [`discovery.aug`](discovery.aug.md#symbol-Discovery).
-- Export the declaration `discovery` from [`discovery.aug`](discovery.aug.md#symbol-discovery).
-- Export the declaration `jwks` from [`discovery.aug`](discovery.aug.md#symbol-jwks).
-- Export the declaration `authorize` from [`authorization.aug`](authorization.aug.md#symbol-authorize).
-- Export the declaration `providerLogin` from [`authorization.aug`](authorization.aug.md#symbol-providerLogin).
-- Export the declaration `token` from [`token.aug`](token.aug.md#symbol-token).
-- Export the declaration `userinfo` from [`userinfo.aug`](userinfo.aug.md#symbol-userinfo).
-
-## Shared language rules
-
-See the [language reference](https://greenpandastudios.github.io/augscript/reference) for numeric, equality, ownership, and task rules.
+Export the declaration `userinfo` from [`userinfo.aug`](userinfo.aug.md#symbol-userinfo).

package/examples/oidc-login/provider/token.aug

@@ -1,14 +1,15 @@
+// aug-spec: "token.aug.md" explains this file. Read it before changes; refresh with aug spec.
 import AuthorizationCode and AccessGrant and TokenForm and TokenResponse and OAuthError and IdClaims from contracts
 import settings and SigningKeys and KeyError and securityHeaders from common
-import Crypto and signJwt and JwtError from august.crypto
-import Clock from august.time
-import ExpiringStore and StoreFull from august.memory
+import Crypto and signJwt and JwtError from crypto
+import Clock from time
+import ExpiringStore and StoreFull from memory
 
-_oauthError(string code, string description) returns HttpResponse<Json> unless HttpError:
+_oauthError(string code, string description) :
     return HttpResponse(body=Json(value=OAuthError(error=code, error_description=description)), status=400, headers=securityHeaders())
 
 /** A real OAuth token endpoint. Exact client/redirect binding, S256 PKCE, expiry and one-use codes are enforced. Errors use OAuth JSON. */
-endpoint POST "/provider/token" as token(HttpRequest http from request, resolve Crypto crypto, resolve Clock clock, resolve SigningKeys keys, resolve ExpiringStore<AuthorizationCode> codes, resolve ExpiringStore<AccessGrant> access) returns HttpResponse<Json> uses crypto.sha256 and crypto.equal and crypto.random and crypto.signRsa and clock.now and keys.provider and codes.take and access.put unless CryptoError with status 503 and TimeError with status 503 and KeyError and JwtError and StoreFull with status 503 and HttpError:
+endpoint POST "/provider/token" as token(HttpRequest http from request, resolve Crypto crypto, resolve Clock clock, resolve SigningKeys keys, resolve ExpiringStore<AuthorizationCode> codes, resolve ExpiringStore<AccessGrant> access) unless CryptoError with status 503 and TimeError with status 503 and KeyError and JwtError and StoreFull with status 503 and HttpError:
     config = settings()
     try:
         form = http.form<TokenForm>()

package/examples/oidc-login/provider/token.aug.md

@@ -1,223 +1,35 @@
 <!-- Generated by aug spec. Edit the August source, then regenerate. -->
 
-# `token.aug` specification
+# `token.aug`
 
-August 0.19.0. This document is compiled from checked code with deterministic wording guided by Simplified Technical English.
-
-## In this file
-
-- [`_oauthError`](token.aug.md#symbol-_oauthError) is a function returning `HttpResponse<Json>`.
-- [`token`](token.aug.md#symbol-token) handles `POST` `/provider/token` returning `HttpResponse<Json>`.
+Plain handler results default to HTTP 200 unless another status is declared. HttpResponse values choose their own status. Unhandled request failures return HTTP 500 and cancel the request tasks.
 
 <a id="symbol-token"></a>
+## `token` · [source](token.aug#L12)
 
-## `token`
-
-[source](token.aug#L11)
-
-**Inputs**
-
-- `http` (`HttpRequest`) — read from the HTTP request.
-- `crypto` ([`Crypto`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto)) — injected; callers omit it.
-- `clock` ([`Clock`](../.aug-spec/august/0.19.0/time/contracts.aug.md#symbol-Clock)) — injected; callers omit it.
-- `keys` ([`SigningKeys`](../common/keys.aug.md#symbol-SigningKeys)) — injected; callers omit it.
-- `codes` ([`ExpiringStore<AuthorizationCode>`](../.aug-spec/august/0.19.0/memory/store.aug.md#symbol-ExpiringStore)) — injected; callers omit it.
-- `access` ([`ExpiringStore<AccessGrant>`](../.aug-spec/august/0.19.0/memory/store.aug.md#symbol-ExpiringStore)) — injected; callers omit it.
+`token` handles `POST /provider/token`. A real OAuth token endpoint. Exact client/redirect binding, S256 PKCE, expiry and one-use codes are enforced. Errors use OAuth JSON.
 
-Returns: `HttpResponse<Json>`.
+It takes `http` as `HttpRequest` from the HTTP request. It gets `crypto` ([`Crypto`](../.aug-spec/packages/%40git/url_9ef654c66d34ab8f5527/0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/contracts.aug.md#symbol-Crypto)), `clock` ([`Clock`](../.aug-spec/packages/%40git/url_c092cd151499c4e1d8a1/0.0.0-git.a39fc582565d4fca40be4f75fa304d71adc69301/contracts.aug.md#symbol-Clock)), `keys` ([`SigningKeys`](../common/keys.aug.md#symbol-SigningKeys)), `codes` ([`ExpiringStore<AuthorizationCode>`](../.aug-spec/packages/%40git/url_0eb7c89453c87681ed15/0.0.0-git.a39fc582565d4fca40be4f75fa304d71adc69301/store.aug.md#symbol-ExpiringStore)), and `access` ([`ExpiringStore<AccessGrant>`](../.aug-spec/packages/%40git/url_0eb7c89453c87681ed15/0.0.0-git.a39fc582565d4fca40be4f75fa304d71adc69301/store.aug.md#symbol-ExpiringStore)) from dependency injection. The handler responds with HTTP 503 for `CryptoError`, HTTP 503 for `TimeError`, and HTTP 503 for [`StoreFull`](../.aug-spec/packages/%40git/url_0eb7c89453c87681ed15/0.0.0-git.a39fc582565d4fca40be4f75fa304d71adc69301/store.aug.md#symbol-StoreFull). It can also raise `HttpError`, `JwtError`, and `KeyError`.
 
-Capabilities: [`crypto.sha256`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.sha256), [`crypto.equal`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.equal), [`crypto.random`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.random), [`crypto.signRsa`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.signRsa), [`clock.now`](../.aug-spec/august/0.19.0/time/contracts.aug.md#symbol-Clock.now), [`keys.provider`](../common/keys.aug.md#symbol-SigningKeys.provider), [`codes.take`](../.aug-spec/august/0.19.0/memory/store.aug.md#symbol-ExpiringStore.take), [`access.put`](../.aug-spec/august/0.19.0/memory/store.aug.md#symbol-ExpiringStore.put).
+It gets `config` from [`settings`](../common/settings.aug.md#symbol-settings). It sets `form` to `http.form` for [`TokenForm`](contracts.aug.md#symbol-TokenForm). If `form.grant_type` does not equal `"authorization_code"`, it returns [`_oauthError`](token.aug.md#symbol-_oauthError) with `code` `"unsupported_grant_type"` and `description` `"Only authorization_code is supported."`. If `form.client_id` does not equal `config.clientId`, it returns [`_oauthError`](token.aug.md#symbol-_oauthError) with `code` `"invalid_client"` and `description` `"The registered client is required."`.
 
-Can fail with `CryptoError`, `TimeError`, `KeyError`, `JwtError`, `StoreFull`, `HttpError`. Callers must catch or propagate these errors.
+If `form.code` is not a URL-safe ASCII token with `43` to `43` characters or `form.code_verifier` is not a URL-safe ASCII token with `43` to `128` characters, it returns [`_oauthError`](token.aug.md#symbol-_oauthError) with `code` `"invalid_grant"` and `description` `"The authorization grant is invalid."`. It sets `now` to [`clock.now`](../.aug-spec/packages/%40git/url_c092cd151499c4e1d8a1/0.0.0-git.a39fc582565d4fca40be4f75fa304d71adc69301/contracts.aug.md#symbol-Clock.now). It obtains [`codes.take`](../.aug-spec/packages/%40git/url_0eb7c89453c87681ed15/0.0.0-git.a39fc582565d4fca40be4f75fa304d71adc69301/store.aug.md#symbol-ExpiringStore.take) with `key` from `form.code` and `now`. If no value is found, it returns [`_oauthError`](token.aug.md#symbol-_oauthError) with `code` `"invalid_grant"` and `description` `"The authorization grant is invalid."`.
 
-HTTP route: `POST` `/provider/token`. Use status 200 when the handler returns a body; a returned HttpResponse can set its own status. An unhandled request failure returns status 500 and cancels its request tasks.
+The non-null result becomes `grant`. It sets `challenge` to the URL-safe base64 encoding of [`crypto.sha256`](../.aug-spec/packages/%40git/url_9ef654c66d34ab8f5527/0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/contracts.aug.md#symbol-Crypto.sha256) with `input` from the UTF-8 bytes of `form.code_verifier`. If `grant.clientId` does not equal `form.client_id` or `grant.redirectUri` does not equal `form.redirect_uri` or [`crypto.equal`](../.aug-spec/packages/%40git/url_9ef654c66d34ab8f5527/0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/contracts.aug.md#symbol-Crypto.equal) with `left` from the UTF-8 bytes of `challenge` and `right` from the UTF-8 bytes of `grant.challenge` returns false, it returns [`_oauthError`](token.aug.md#symbol-_oauthError) with `code` `"invalid_grant"` and `description` `"The authorization grant is invalid."`. It sets `claims` to an [`IdClaims`](contracts.aug.md#symbol-IdClaims) with `iss` from `config.issuer`, `sub` from `grant.subject`, `aud` from `grant.clientId`, `exp` from `now` plus `300`, `iat` from `now`, `grant.nonce`, and `grant.name`.
 
-Declared HTTP failures: `CryptoError` returns status 503; `TimeError` returns status 503; [`StoreFull`](../.aug-spec/august/0.19.0/memory/store.aug.md#symbol-StoreFull) returns status 503.
+It sets `idToken` to [`signJwt`](../.aug-spec/packages/%40git/url_9ef654c66d34ab8f5527/0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/jose.aug.md#symbol-signJwt) with `key` from [`keys.provider`](../common/keys.aug.md#symbol-SigningKeys.provider), `claims` from a `Json` with `value` from `claims`, `kid` `"provider-1"`, and `tokenType` `"JWT"` using injected `crypto`. It sets `accessToken` to the URL-safe base64 encoding of [`crypto.random`](../.aug-spec/packages/%40git/url_9ef654c66d34ab8f5527/0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/contracts.aug.md#symbol-Crypto.random) with `size` `32`. It sets `value` to an [`AccessGrant`](contracts.aug.md#symbol-AccessGrant) with `grant.subject`, `grant.name`, and `expires` from `now` plus `300`. It calls [`access.put`](../.aug-spec/packages/%40git/url_0eb7c89453c87681ed15/0.0.0-git.a39fc582565d4fca40be4f75fa304d71adc69301/store.aug.md#symbol-ExpiringStore.put) with `key` from `accessToken`, `value`, `value.expires`, and `now`.
 
-**What it does**
-
-- Set `config` to call [`settings`](../common/settings.aug.md#symbol-settings).
-- Try these operations:
-  - Set `form` to call `form` on `http` with type arguments [`TokenForm`](contracts.aug.md#symbol-TokenForm).
-  - If `grant_type` of `form` does not equal `"authorization_code"`:
-    - Return call [`_oauthError`](token.aug.md#symbol-_oauthError) with `code` = `"unsupported_grant_type"`; `description` = `"Only authorization_code is supported."`.
-  - If `client_id` of `form` does not equal `clientId` of `config`:
-    - Return call [`_oauthError`](token.aug.md#symbol-_oauthError) with `code` = `"invalid_client"`; `description` = `"The registered client is required."`.
-  - If not (call `isToken` on `code` of `form` with `min` = `43`; `max` = `43`) or not (call `isToken` on `code_verifier` of `form` with `min` = `43`; `max` = `128`):
-    - Return call [`_oauthError`](token.aug.md#symbol-_oauthError) with `code` = `"invalid_grant"`; `description` = `"The authorization grant is invalid."`.
-  - Set `now` to call [`Clock.now`](../.aug-spec/august/0.19.0/time/contracts.aug.md#symbol-Clock.now) on `clock`.
-  - Select the matching case for call [`ExpiringStore.take`](../.aug-spec/august/0.19.0/memory/store.aug.md#symbol-ExpiringStore.take) on `codes` with `key` = `code` of `form`; `now` = `now`:
-    - A null value, including omitted optional input:
-      - Return call [`_oauthError`](token.aug.md#symbol-_oauthError) with `code` = `"invalid_grant"`; `description` = `"The authorization grant is invalid."`.
-    - A present, non-null value, named `grant`:
-      - Set `challenge` to call `base64url` on call [`Crypto.sha256`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.sha256) on `crypto` with `input` = call `bytes` on `code_verifier` of `form`.
-      - If ((`clientId` of `grant` does not equal `client_id` of `form`) or (`redirectUri` of `grant` does not equal `redirect_uri` of `form`)) or not (call [`Crypto.equal`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.equal) on `crypto` with `left` = call `bytes` on `challenge`; `right` = call `bytes` on `challenge` of `grant`):
-        - Return call [`_oauthError`](token.aug.md#symbol-_oauthError) with `code` = `"invalid_grant"`; `description` = `"The authorization grant is invalid."`.
-      - Set `claims` to call [`IdClaims`](contracts.aug.md#symbol-IdClaims) with `iss` = `issuer` of `config`; `sub` = `subject` of `grant`; `aud` = `clientId` of `grant`; `exp` = (`now` plus `300`); `iat` = `now`; `nonce` = `nonce` of `grant`; `name` = `name` of `grant`.
-      - Set `idToken` to call [`signJwt`](../.aug-spec/august/0.19.0/crypto/jose.aug.md#symbol-signJwt) with `key` = call [`SigningKeys.provider`](../common/keys.aug.md#symbol-SigningKeys.provider) on `keys`; `claims` = call `Json` with `value` = `claims`; `kid` = `"provider-1"`; `tokenType` = `"JWT"`; inject `crypto` from `crypto`.
-      - Set `accessToken` to call `base64url` on call [`Crypto.random`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.random) on `crypto` with `size` = `32`.
-      - Set `value` to call [`AccessGrant`](contracts.aug.md#symbol-AccessGrant) with `subject` = `subject` of `grant`; `name` = `name` of `grant`; `expires` = (`now` plus `300`).
-      - Call [`ExpiringStore.put`](../.aug-spec/august/0.19.0/memory/store.aug.md#symbol-ExpiringStore.put) on `access` with `key` = `accessToken`; `value` = `value`; `expires` = `expires` of `value`; `now` = `now`.
-      - Set `body` to call [`TokenResponse`](contracts.aug.md#symbol-TokenResponse) with `token_type` = `"Bearer"`; `access_token` = `accessToken`; `id_token` = `idToken`; `expires_in` = `300`; `scope` = `"openid profile"`.
-      - Return call `HttpResponse` with `body` = call `Json` with `value` = `body`; `headers` = call [`securityHeaders`](../common/headers.aug.md#symbol-securityHeaders).
-- If they fail with `HttpError`, name the failure `error` and recover:
-  - Return call [`_oauthError`](token.aug.md#symbol-_oauthError) with `code` = `"invalid_request"`; `description` = `"Submit the required URL-encoded token fields once each."`.
-
-**Author documentation**
-
-A real OAuth token endpoint. Exact client/redirect binding, S256 PKCE, expiry and one-use codes are enforced. Errors use OAuth JSON.
+It sets `body` to a [`TokenResponse`](contracts.aug.md#symbol-TokenResponse) with `token_type` `"Bearer"`, `access_token` from `accessToken`, `id_token` from `idToken`, `expires_in` `300`, and `scope` `"openid profile"`. It returns HTTP 200 with a `Json` with `value` from `body` and [`securityHeaders`](../common/headers.aug.md#symbol-securityHeaders) headers. If this work raises `HttpError`, it returns [`_oauthError`](token.aug.md#symbol-_oauthError) with `code` `"invalid_request"` and `description` `"Submit the required URL-encoded token fields once each."`.
 
 <a id="symbol-_oauthError"></a>
+## `_oauthError` · [source](token.aug#L8)
 
-## `_oauthError`
-
-[source](token.aug#L7)
-
-Private to its defining scope.
-
-**Inputs**
-
-- `code` (`string`) — required labeled input.
-- `description` (`string`) — required labeled input.
-
-Returns: `HttpResponse<Json>`.
-
-Can fail with `HttpError`. Callers must catch or propagate these errors.
-
-**What it does**
-
-- Return call `HttpResponse` with `body` = call `Json` with `value` = call [`OAuthError`](contracts.aug.md#symbol-OAuthError) with `error` = `code`; `error_description` = `description`; `status` = `400`; `headers` = call [`securityHeaders`](../common/headers.aug.md#symbol-securityHeaders).
-
-## Dependencies used by this file
-
-Only referenced types and operations appear here. Each name links to its complete specification.
-
-### [`Crypto`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto)
-
-Capability interface from `august.crypto`.
-
-- [`Crypto.equal`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.equal) (`left`: `Bytes`, `right`: `Bytes`) → `bool`.
-- [`Crypto.random`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.random) (`size`: `int`) → `Bytes`; can fail with `CryptoError`.
-- [`Crypto.sha256`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.sha256) (`input`: `Bytes`) → `Bytes`; can fail with `CryptoError`.
-- [`Crypto.signRsa`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.signRsa) (`key`: `RsaPrivateKey`, `input`: `Bytes`) → `Bytes`; can fail with `CryptoError`.
-
-### [`JwtError`](../.aug-spec/august/0.19.0/crypto/jose.aug.md#symbol-JwtError)
-
-Class from `august.crypto`.
-
-Used as a type or provider.
-
-### [`signJwt`](../.aug-spec/august/0.19.0/crypto/jose.aug.md#symbol-signJwt)
-
-Function from `august.crypto`.
-
-- [`signJwt`](../.aug-spec/august/0.19.0/crypto/jose.aug.md#symbol-signJwt) (`key`: `RsaPrivateKey`, `claims`: `Json`, `kid`: `string`, `tokenType`: `string`) → `string`; inject `crypto`: [`Crypto`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto); uses [`crypto.signRsa`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.signRsa); can fail with `JwtError`.
-
-### [`ExpiringStore`](../.aug-spec/august/0.19.0/memory/store.aug.md#symbol-ExpiringStore)
-
-Capability interface from `august.memory`.
-
-- [`ExpiringStore.put`](../.aug-spec/august/0.19.0/memory/store.aug.md#symbol-ExpiringStore.put) (`key`: `string`, `value`: `T`, `expires`: `int`, `now`: `int`) → `void`; can fail with `StoreFull`.
-- [`ExpiringStore.take`](../.aug-spec/august/0.19.0/memory/store.aug.md#symbol-ExpiringStore.take) (`key`: `string`, `now`: `int`) → `optional T`.
-
-### [`StoreFull`](../.aug-spec/august/0.19.0/memory/store.aug.md#symbol-StoreFull)
-
-Class from `august.memory`.
-
-Used as a type or provider.
-
-### [`Clock`](../.aug-spec/august/0.19.0/time/contracts.aug.md#symbol-Clock)
-
-Capability interface from `august.time`.
-
-- [`Clock.now`](../.aug-spec/august/0.19.0/time/contracts.aug.md#symbol-Clock.now) (no caller inputs) → `int`; can fail with `TimeError`.
-
-### [`securityHeaders`](../common/headers.aug.md#symbol-securityHeaders)
-
-Function from `common`.
-
-- [`securityHeaders`](../common/headers.aug.md#symbol-securityHeaders) (no caller inputs) → `Headers`; can fail with `HttpError`.
-
-### [`KeyError`](../common/keys.aug.md#symbol-KeyError)
-
-Class from `common`.
-
-Used as a type or provider.
-
-### [`SigningKeys`](../common/keys.aug.md#symbol-SigningKeys)
-
-Capability interface from `common`.
-
-- [`SigningKeys.provider`](../common/keys.aug.md#symbol-SigningKeys.provider) (no caller inputs) → `RsaPrivateKey`; can fail with `KeyError`.
-
-### [`Settings`](../common/settings.aug.md#symbol-Settings)
-
-Record.
-
-- Read `clientId` (`string`).
-- Read `issuer` (`string`).
-
-### [`settings`](../common/settings.aug.md#symbol-settings)
-
-Function from `common`.
-
-- [`settings`](../common/settings.aug.md#symbol-settings) (no caller inputs) → [`Settings`](../common/settings.aug.md#symbol-Settings).
-
-### [`AccessGrant`](contracts.aug.md#symbol-AccessGrant)
-
-Record from `contracts`.
-
-- Construct with `subject`: `string`, `name`: `string`, `expires`: `int` → [`AccessGrant`](contracts.aug.md#symbol-AccessGrant).
-- Read `expires` (`int`).
-
-### [`AuthorizationCode`](contracts.aug.md#symbol-AuthorizationCode)
-
-Record from `contracts`.
-
-- Read `challenge` (`string`).
-- Read `clientId` (`string`).
-- Read `name` (`string`).
-- Read `nonce` (`string`).
-- Read `redirectUri` (`string`).
-- Read `subject` (`string`).
-
-### [`IdClaims`](contracts.aug.md#symbol-IdClaims)
-
-Record from `contracts`.
-
-- Construct with `iss`: `string`, `sub`: `string`, `aud`: `string`, `exp`: `int`, `iat`: `int`, `nonce`: `string`, `name`: `string` → [`IdClaims`](contracts.aug.md#symbol-IdClaims).
-
-### [`OAuthError`](contracts.aug.md#symbol-OAuthError)
-
-Record from `contracts`.
-
-- Construct with `error`: `string`, `error_description`: `string` → [`OAuthError`](contracts.aug.md#symbol-OAuthError).
-
-### [`TokenForm`](contracts.aug.md#symbol-TokenForm)
-
-Record from `contracts`.
-
-- Read `client_id` (`string`).
-- Read `code` (`string`).
-- Read `code_verifier` (`string`).
-- Read `grant_type` (`string`).
-- Read `redirect_uri` (`string`).
-
-### [`TokenResponse`](contracts.aug.md#symbol-TokenResponse)
-
-Record from `contracts`.
-
-- Construct with `token_type`: `string`, `access_token`: `string`, `id_token`: `string`, `expires_in`: `int`, `scope`: `string` → [`TokenResponse`](contracts.aug.md#symbol-TokenResponse).
-
-## Built-in operations used by this file
+It is private to its defining scope. It takes `code` and `description` as strings. Failures can raise `HttpError`. It returns HTTP 400 with a `Json` with `value` from an [`OAuthError`](contracts.aug.md#symbol-OAuthError) with `error` from `code` and `error_description` from `description` and [`securityHeaders`](../common/headers.aug.md#symbol-securityHeaders) headers.
 
-- `Bytes.base64url` (no inputs) → `string`: Encode immutable bytes as unpadded RFC 4648 URL-safe base64.
-- `HttpRequest.form` (no inputs) → `TokenForm`: Decode a form record inside a handler so protocol-specific error responses can be returned. Can fail with `HttpError`.
-- `string.bytes` (no inputs) → `Bytes`: Encode this string as immutable UTF-8 bytes.
-- `string.isToken` (`min`: `int`, `max`: `int`) → `bool`: Require an ASCII RFC 3986 unreserved token with a bounded length.
+## Dependencies
 
-[Full built-in reference](https://greenpandastudios.github.io/augscript/language-constructs).
+It uses [`ExpiringStore`](../.aug-spec/packages/%40git/url_0eb7c89453c87681ed15/0.0.0-git.a39fc582565d4fca40be4f75fa304d71adc69301/store.aug.md#symbol-ExpiringStore) ([`put`](../.aug-spec/packages/%40git/url_0eb7c89453c87681ed15/0.0.0-git.a39fc582565d4fca40be4f75fa304d71adc69301/store.aug.md#symbol-ExpiringStore.put) and [`take`](../.aug-spec/packages/%40git/url_0eb7c89453c87681ed15/0.0.0-git.a39fc582565d4fca40be4f75fa304d71adc69301/store.aug.md#symbol-ExpiringStore.take)) and [`StoreFull`](../.aug-spec/packages/%40git/url_0eb7c89453c87681ed15/0.0.0-git.a39fc582565d4fca40be4f75fa304d71adc69301/store.aug.md#symbol-StoreFull) from `memory`. It uses [`Crypto`](../.aug-spec/packages/%40git/url_9ef654c66d34ab8f5527/0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/contracts.aug.md#symbol-Crypto) ([`equal`](../.aug-spec/packages/%40git/url_9ef654c66d34ab8f5527/0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/contracts.aug.md#symbol-Crypto.equal), [`random`](../.aug-spec/packages/%40git/url_9ef654c66d34ab8f5527/0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/contracts.aug.md#symbol-Crypto.random), [`sha256`](../.aug-spec/packages/%40git/url_9ef654c66d34ab8f5527/0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/contracts.aug.md#symbol-Crypto.sha256), and [`signRsa`](../.aug-spec/packages/%40git/url_9ef654c66d34ab8f5527/0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/contracts.aug.md#symbol-Crypto.signRsa)), [`JwtError`](../.aug-spec/packages/%40git/url_9ef654c66d34ab8f5527/0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/jose.aug.md#symbol-JwtError), and [`signJwt`](../.aug-spec/packages/%40git/url_9ef654c66d34ab8f5527/0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/jose.aug.md#symbol-signJwt) from `crypto`. It uses [`Clock`](../.aug-spec/packages/%40git/url_c092cd151499c4e1d8a1/0.0.0-git.a39fc582565d4fca40be4f75fa304d71adc69301/contracts.aug.md#symbol-Clock) ([`now`](../.aug-spec/packages/%40git/url_c092cd151499c4e1d8a1/0.0.0-git.a39fc582565d4fca40be4f75fa304d71adc69301/contracts.aug.md#symbol-Clock.now)) from `time`. It uses [`securityHeaders`](../common/headers.aug.md#symbol-securityHeaders), [`KeyError`](../common/keys.aug.md#symbol-KeyError), [`SigningKeys`](../common/keys.aug.md#symbol-SigningKeys) ([`provider`](../common/keys.aug.md#symbol-SigningKeys.provider)), and [`settings`](../common/settings.aug.md#symbol-settings) from `common`.
 
-## Shared language rules
+It uses [`Settings`](../common/settings.aug.md#symbol-Settings) (`clientId` and `issuer`). It uses [`AccessGrant`](contracts.aug.md#symbol-AccessGrant) (`expires`), [`AuthorizationCode`](contracts.aug.md#symbol-AuthorizationCode) (`challenge`, `clientId`, `name`, `nonce`, `redirectUri`, and `subject`), [`IdClaims`](contracts.aug.md#symbol-IdClaims), [`OAuthError`](contracts.aug.md#symbol-OAuthError), [`TokenForm`](contracts.aug.md#symbol-TokenForm) (`client_id`, `code`, `code_verifier`, `grant_type`, and `redirect_uri`), and [`TokenResponse`](contracts.aug.md#symbol-TokenResponse) from `contracts`.
 
-See the [language reference](https://greenpandastudios.github.io/augscript/reference) for numeric, equality, ownership, and task rules.
+Built-in operations follow the [language reference](https://greenpandastudios.github.io/augscript/language-constructs).

package/examples/oidc-login/provider/userinfo.aug

@@ -1,10 +1,11 @@
+// aug-spec: "userinfo.aug.md" explains this file. Read it before changes; refresh with aug spec.
 import UserInfo and AccessGrant from contracts
 import securityHeaders from common
-import Clock from august.time
-import ExpiringStore from august.memory
+import Clock from time
+import ExpiringStore from memory
 
 /** The opaque access token is valid only at this provider. Missing, expired and malformed credentials receive the same response. */
-endpoint GET "/provider/userinfo" as userinfo(optional string authorization from header, resolve Clock clock, resolve ExpiringStore<AccessGrant> access) returns HttpResponse<Json> uses clock.now and access.get unless TimeError and HttpError:
+endpoint GET "/provider/userinfo" as userinfo(optional string authorization from header, resolve Clock clock, resolve ExpiringStore<AccessGrant> access) :
     match authorization:
         when null:
             pass