@greenpandastudios/aug-cli 0.19.0 → 0.21.0

package/README.md

@@ -1,13 +1,16 @@
 # August CLI
 
-`@greenpandastudios/aug-cli` installs `aug` and `aug-cli` (compiler, project starter, native builds, tests and language server) and `aug-native` (explicit native dependency bootstrap).
-
-Requires Node.js 24+ and a C11 compiler. The CLI installs matching standard, web and crypto packages. Source imports remain `august.io`, `august.web`, and `august.crypto`.
+Install the compiler with Node.js 24 or later and npm:
 
 ```sh
-npx @greenpandastudios/aug-cli@next init hello-august
+npm install --global @greenpandastudios/aug-cli@next
+aug init my-app
+cd my-app
+aug run
 ```
 
-The starter refuses a nonempty directory. It includes `main.aug`, an interface and implementation with a same-file test, and a README. Early npm releases use `@next`; publication status is tracked in the installation guide. Native builds support macOS and Linux.
+The starter includes an interface, implementation, same-file test, and AGENTS.md. `aug run` installs source dependencies, checks the project, prepares its verified LLVM/runtime pack, compiles it, and starts it. Supported hosts are macOS 14+ ARM64 and GNU/Linux x64/ARM64 with glibc 2.36+. Consumers need no separate native compiler, LLVM installation, or SDK. `--backend c` retains the migration reference for contributor comparisons.
+
+Use `aug init weather --template weather` for the simulated weather API, or `aug package init arithmetic` for a library. Add public Git sources with `aug add URL --as NAME`, or import a quoted URL directly. Optional JSON, web, and crypto libraries use this package system; core I/O remains under `august.io`.
 
-See [installation](https://github.com/GreenPandaStudios/augscript/blob/main/docs/packages.md), [the language wiki](https://GreenPandaStudios.github.io/augscript/) and [the repository](https://github.com/GreenPandaStudios/augscript). Guides and examples are included in this package.
+The package supplies `aug`, `aug-cli`, and `aug-native`. Pin a release for reproducible builds and commit aug.lock.json. Read [the book](https://greenpandastudios.github.io/augscript/learn/), [packages](https://greenpandastudios.github.io/augscript/packages), and [the weather guide](https://greenpandastudios.github.io/augscript/weather-api). August is experimental; check [readiness](https://greenpandastudios.github.io/augscript/production-readiness) before deploying it.

package/THIRD_PARTY_NOTICES.md

@@ -16,3 +16,7 @@ August's compiler/runtime code is MIT licensed. Native dependencies are download
 | zlib | Host system library; [zlib](https://zlib.net/zlib_license.html) |
 
 Applications built using web/crypto link native libraries from the selected dependency prefix. Redistributors of compiled applications must preserve the notices and satisfy the licenses of the libraries they include. The release process currently distributes compiler/library source packages and VSIX rather than prebuilt native dependency bundles.
+
+## JavaScript archive dependencies
+
+The CLI depends on `tar` 7.5.22; the VS Code bundle includes it and its runtime dependencies (`chownr`, `yallist`, `minipass`, `minizlib`, and `@isaacs/fs-minipass`). Their package license files are retained in the extension. Exact versions and license declarations are recorded in `package-lock.json`. See the upstream [node-tar source](https://github.com/isaacs/node-tar) for archive behavior and security reports. Native library terms above are separate from these JavaScript packages.

package/bin/aug.mjs

@@ -1,3 +1,13 @@
 #!/usr/bin/env node
-import { main } from '../src/cli.js';
-process.exitCode = await main(process.argv.slice(2));
+if (Number(process.versions.node.split('.')[0]) < 24) {
+  process.stderr.write(`August needs Node.js 24 or newer; this is Node.js ${process.versions.node}.\nInstall a supported Node version, then retry aug run.\n`);
+  process.exitCode = 1;
+} else {
+  try {
+    const { main } = await import('../src/cli.js');
+    process.exitCode = await main(process.argv.slice(2));
+  } catch (error) {
+    process.stderr.write(`August could not finish: ${error.message}\nRun aug --help for usage. If this persists, report the command and error at https://github.com/GreenPandaStudios/augscript/issues.\n`);
+    process.exitCode = 1;
+  }
+}

package/docs/about.md

@@ -0,0 +1,27 @@
+# Why August exists
+
+Software gets harder to change when its behavior depends on knowledge scattered across a large codebase. A function looks small, yet it reaches a global service, changes shared state, or fails in a way its caller did not expect. A new teammate has to reconstruct those relationships. A coding agent faces the same problem with a limited view of the project.
+
+August's two tenets are **simplicity** and **developer scalability**. A reader should be able to understand a module from its source and a few nearby, linked contracts. The language makes dependencies and behavior visible so a team can review a change without first learning every implementation detail in the application.
+
+## What that means in code
+
+Calls use labels, such as `total(price=7, quantity=3)`. You can read the role of each input at the call site. Files import the names they use, and folders expose their public surface through `export.aug`. An underscore keeps a name private to its scope.
+
+Interfaces state the operations that callers can use. Application startup selects their implementations, and `resolve` inputs show which dependencies construction or a call requires. Capability contracts describe I/O. The checker infers mutation and checked failures from executable bodies; editor hints and compiled specs display them. Bodyless contracts use `changes` and `unless` to state those limits. Read access can share an object; mutation requires permission expressed in code.
+
+Tests live with the declaration they describe. `aug spec` produces a neighboring Markdown explanation from checked code and links to the exact dependency surfaces. It includes comments when they are present. The explanation supports review; tests and compiler checks still have their own jobs.
+
+The [book](learn/index.md) introduces these choices in runnable programs. The [module review guide](guides/change-a-module.md) shows how to use them when you arrive in an unfamiliar project.
+
+## Who should try it
+
+August is for developers exploring how language design can make modular applications easier to understand and maintain. Teams working with coding agents can try its explicit contracts, bounded context tools, and compiled specs in a small project. Hobbyists can start with the same tools and a short application.
+
+The project does not yet have evidence that August makes every team or coding agent more productive than another language. Demonstrations show how the tools work. Compiler tests show particular rules being checked. Benchmarks measure particular programs. Broader claims need reproducible studies and experience with real projects.
+
+## Where it stands
+
+The compiler is written in TypeScript. It emits C11 and uses a native managed runtime. The repository also contains the CLI, VS Code extension, standard library, web and crypto libraries, tests, and this documentation. [Packages](packages.md) explains how to install a matching set and create your own source libraries.
+
+August is a public preview. It has cooperative tasks, explicit ownership operations, checked errors, HTTP endpoints, and source packages, but no stable 1.0 compatibility promise. Read the [readiness review](production-readiness.md), [library gaps](web-library-gaps.md), and [1.0 roadmap](roadmap.md) for the limits that matter to your project.

package/docs/api/crypto.md

@@ -6,17 +6,9 @@ editLink: false
 
 # august.crypto
 
-Public declarations exported by this module. Import names explicitly from `august.crypto`. Built-in wire/value types are described in [language constructs](../language-constructs.md).
-
-- [Crypto](#api-Crypto)
-- [GnuTlsCrypto](#api-GnuTlsCrypto)
-- [JwtError](#api-JwtError)
-- [RsaJwk](#api-RsaJwk)
-- [RsaJwks](#api-RsaJwks)
-- [rsaJwk](#api-rsaJwk)
-- [importJwk](#api-importJwk)
-- [signJwt](#api-signJwt)
-- [verifyJwt](#api-verifyJwt)
+Install this source library with `aug add https://github.com/GreenPandaStudios/augscript/src/stdlib/crypto --as crypto`, then import its public names from `crypto`.
+
+The signatures below include checked results and failures, including those inferred from a body. See [packages](../packages.md) for revision pinning and [language constructs](../language-constructs.md) for built-in value types.
 
 ## Crypto {#api-Crypto}
 
@@ -26,117 +18,139 @@ capability Crypto
 
 Explicit permission for native cryptographic operations. Keys and bytes are immutable.
 
-[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L2)
+[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L3)
 
 ### Crypto.random
 
 ```text
-random(int size) returns Bytes uses Crypto.random unless CryptoError
+random(int size) returns Bytes unless CryptoError
 ```
 
 Generate unpredictable bytes with the operating-system-backed GnuTLS RNG.
 
-[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L4)
+Requires `Crypto.random`.
+
+[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L5)
 
 ### Crypto.sha256
 
 ```text
-sha256(Bytes input) returns Bytes uses Crypto.sha256 unless CryptoError
+sha256(Bytes input) returns Bytes unless CryptoError
 ```
 
 Hash the complete input using SHA-256.
 
-[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L6)
+Requires `Crypto.sha256`.
+
+[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L7)
 
 ### Crypto.generateRsa
 
 ```text
-generateRsa() returns RsaPrivateKey uses Crypto.generateRsa unless CryptoError
+generateRsa() returns RsaPrivateKey unless CryptoError
 ```
 
 Create a fresh 3072-bit RSA private key. Private material is opaque and scrubbed on reclamation.
 
-[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L8)
+Requires `Crypto.generateRsa`.
+
+[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L9)
 
 ### Crypto.publicRsa
 
 ```text
-publicRsa(RsaPrivateKey key) returns RsaPublicKey uses Crypto.publicRsa unless CryptoError
+publicRsa(RsaPrivateKey key) returns RsaPublicKey unless CryptoError
 ```
 
 Export the corresponding public key as an opaque immutable value.
 
-[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L10)
+Requires `Crypto.publicRsa`.
+
+[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L11)
 
 ### Crypto.signRsa
 
 ```text
-signRsa(RsaPrivateKey key, Bytes input) returns Bytes uses Crypto.signRsa unless CryptoError
+signRsa(RsaPrivateKey key, Bytes input) returns Bytes unless CryptoError
 ```
 
 Sign bytes using RSASSA-PKCS1-v1_5 with SHA-256 (JOSE RS256).
 
-[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L12)
+Requires `Crypto.signRsa`.
+
+[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L13)
 
 ### Crypto.verifyRsa
 
 ```text
-verifyRsa(RsaPublicKey publicKey, Bytes input, Bytes signature) returns bool uses Crypto.verifyRsa unless CryptoError
+verifyRsa(RsaPublicKey publicKey, Bytes input, Bytes signature) returns bool unless CryptoError
 ```
 
 Verify only RS256. Invalid signatures return false; invalid keys raise CryptoError.
 
-[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L14)
+Requires `Crypto.verifyRsa`.
+
+[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L15)
 
 ### Crypto.decodeBase64url
 
 ```text
-decodeBase64url(string input) returns Bytes uses Crypto.decodeBase64url unless CryptoError
+decodeBase64url(string input) returns Bytes unless CryptoError
 ```
 
 Decode canonical unpadded URL-safe base64, rejecting invalid characters and unused bits.
 
-[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L16)
+Requires `Crypto.decodeBase64url`.
+
+[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L17)
 
 ### Crypto.equal
 
 ```text
-equal(Bytes left, Bytes right) returns bool uses Crypto.equal
+equal(Bytes left, Bytes right) returns bool
 ```
 
 Compare bytes without early exit on their contents. Length remains observable.
 
-[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L18)
+Requires `Crypto.equal`.
+
+[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L19)
 
 ### Crypto.exportRsa
 
 ```text
-exportRsa(RsaPublicKey publicKey) returns Tuple<Bytes, Bytes> uses Crypto.exportRsa unless CryptoError
+exportRsa(RsaPublicKey publicKey) returns Tuple<Bytes, Bytes> unless CryptoError
 ```
 
 Export unsigned big-endian modulus and exponent for an RSA JWK.
 
-[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L20)
+Requires `Crypto.exportRsa`.
+
+[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L21)
 
 ### Crypto.importRsa
 
 ```text
-importRsa(Bytes modulus, Bytes exponent) returns RsaPublicKey uses Crypto.importRsa unless CryptoError
+importRsa(Bytes modulus, Bytes exponent) returns RsaPublicKey unless CryptoError
 ```
 
 Import canonical public RSA parameters. Keys must have 2048 to 8192 bits.
 
-[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L22)
+Requires `Crypto.importRsa`.
+
+[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L23)
 
 ### Crypto.passwordHash
 
 ```text
-passwordHash(Bytes password, Bytes salt, int iterations) returns Bytes uses Crypto.passwordHash unless CryptoError
+passwordHash(Bytes password, Bytes salt, int iterations) returns Bytes unless CryptoError
 ```
 
 PBKDF2-HMAC-SHA256, producing 32 bytes. Use a unique 16–64 byte salt; supported work factors are 100,000–2,000,000.
 
-[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L24)
+Requires `Crypto.passwordHash`.
+
+[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L25)
 
 ## GnuTlsCrypto {#api-GnuTlsCrypto}
 
@@ -146,7 +160,7 @@ GnuTlsCrypto() implements Crypto
 
 GnuTLS-backed capability adapter. Its constructor performs no I/O or key generation.
 
-[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L39)
+[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L40)
 
 ### GnuTlsCrypto.random
 
@@ -156,9 +170,9 @@ random(int size) returns Bytes unless CryptoError
 
 Generate unpredictable bytes with the operating-system-backed GnuTLS RNG.
 
-Inferred capabilities: `Crypto.random`.
+Requires `Crypto.random`.
 
-[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L40)
+[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L41)
 
 ### GnuTlsCrypto.sha256
 
@@ -168,9 +182,9 @@ sha256(Bytes input) returns Bytes unless CryptoError
 
 Hash the complete input using SHA-256.
 
-Inferred capabilities: `Crypto.sha256`.
+Requires `Crypto.sha256`.
 
-[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L43)
+[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L44)
 
 ### GnuTlsCrypto.generateRsa
 
@@ -180,9 +194,9 @@ generateRsa() returns RsaPrivateKey unless CryptoError
 
 Create a fresh 3072-bit RSA private key. Private material is opaque and scrubbed on reclamation.
 
-Inferred capabilities: `Crypto.generateRsa`.
+Requires `Crypto.generateRsa`.
 
-[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L46)
+[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L47)
 
 ### GnuTlsCrypto.publicRsa
 
@@ -192,9 +206,9 @@ publicRsa(RsaPrivateKey key) returns RsaPublicKey unless CryptoError
 
 Export the corresponding public key as an opaque immutable value.
 
-Inferred capabilities: `Crypto.publicRsa`.
+Requires `Crypto.publicRsa`.
 
-[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L49)
+[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L50)
 
 ### GnuTlsCrypto.signRsa
 
@@ -204,9 +218,9 @@ signRsa(RsaPrivateKey key, Bytes input) returns Bytes unless CryptoError
 
 Sign bytes using RSASSA-PKCS1-v1_5 with SHA-256 (JOSE RS256).
 
-Inferred capabilities: `Crypto.signRsa`.
+Requires `Crypto.signRsa`.
 
-[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L52)
+[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L53)
 
 ### GnuTlsCrypto.verifyRsa
 
@@ -216,9 +230,9 @@ verifyRsa(RsaPublicKey publicKey, Bytes input, Bytes signature) returns bool unl
 
 Verify only RS256. Invalid signatures return false; invalid keys raise CryptoError.
 
-Inferred capabilities: `Crypto.verifyRsa`.
+Requires `Crypto.verifyRsa`.
 
-[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L55)
+[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L56)
 
 ### GnuTlsCrypto.decodeBase64url
 
@@ -228,9 +242,9 @@ decodeBase64url(string input) returns Bytes unless CryptoError
 
 Decode canonical unpadded URL-safe base64, rejecting invalid characters and unused bits.
 
-Inferred capabilities: `Crypto.decodeBase64url`.
+Requires `Crypto.decodeBase64url`.
 
-[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L58)
+[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L59)
 
 ### GnuTlsCrypto.equal
 
@@ -240,9 +254,9 @@ equal(Bytes left, Bytes right) returns bool
 
 Compare bytes without early exit on their contents. Length remains observable.
 
-Inferred capabilities: `Crypto.equal`.
+Requires `Crypto.equal`.
 
-[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L61)
+[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L62)
 
 ### GnuTlsCrypto.exportRsa
 
@@ -252,9 +266,9 @@ exportRsa(RsaPublicKey publicKey) returns Tuple<Bytes, Bytes> unless CryptoError
 
 Export unsigned big-endian modulus and exponent for an RSA JWK.
 
-Inferred capabilities: `Crypto.exportRsa`.
+Requires `Crypto.exportRsa`.
 
-[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L64)
+[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L65)
 
 ### GnuTlsCrypto.importRsa
 
@@ -264,9 +278,9 @@ importRsa(Bytes modulus, Bytes exponent) returns RsaPublicKey unless CryptoError
 
 Import canonical public RSA parameters. Keys must have 2048 to 8192 bits.
 
-Inferred capabilities: `Crypto.importRsa`.
+Requires `Crypto.importRsa`.
 
-[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L67)
+[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L68)
 
 ### GnuTlsCrypto.passwordHash
 
@@ -276,9 +290,9 @@ passwordHash(Bytes password, Bytes salt, int iterations) returns Bytes unless Cr
 
 PBKDF2-HMAC-SHA256, producing 32 bytes. Use a unique 16–64 byte salt; supported work factors are 100,000–2,000,000.
 
-Inferred capabilities: `Crypto.passwordHash`.
+Requires `Crypto.passwordHash`.
 
-[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L70)
+[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/contracts.aug#L71)
 
 ## JwtError {#api-JwtError}
 
@@ -288,7 +302,7 @@ JwtError() implements Error
 
 A failed JOSE validation reveals no unverified claims.
 
-[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/jose.aug#L5)
+[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/jose.aug#L6)
 
 ## RsaJwk {#api-RsaJwk}
 
@@ -298,7 +312,7 @@ record RsaJwk(string kty, string kid, string alg, string use, string n, string e
 
 Public signing-key metadata in RFC 7517 / RFC 7518 form.
 
-[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/jose.aug#L10)
+[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/jose.aug#L11)
 
 ## RsaJwks {#api-RsaJwks}
 
@@ -306,46 +320,66 @@ Public signing-key metadata in RFC 7517 / RFC 7518 form.
 record RsaJwks(List<RsaJwk> keys)
 ```
 
-The signature defines this public contract.
 
-[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/jose.aug#L11)
+
+[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/jose.aug#L12)
 
 ## rsaJwk {#api-rsaJwk}
 
 ```text
-rsaJwk(RsaPublicKey publicKey, string kid, resolve Crypto crypto) returns RsaJwk uses crypto.exportRsa unless CryptoError
+rsaJwk(RsaPublicKey publicKey, string kid, resolve Crypto crypto) returns RsaJwk unless CryptoError
 ```
 
 Export public parameters. Private key material never enters the JSON document.
 
-[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/jose.aug#L14)
+Requires `Crypto.exportRsa`.
+
+[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/jose.aug#L15)
 
 ## importJwk {#api-importJwk}
 
 ```text
-importJwk(RsaJwk jwk, resolve Crypto crypto) returns RsaPublicKey uses crypto.decodeBase64url and crypto.importRsa unless JwtError
+importJwk(RsaJwk jwk, resolve Crypto crypto) returns RsaPublicKey unless JwtError
 ```
 
 Import only an RSA signing key for RS256. The transport caller selects the trusted JWKS URL.
 
-[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/jose.aug#L19)
+Requires `Crypto.decodeBase64url` and `Crypto.importRsa`.
+
+[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/jose.aug#L20)
 
 ## signJwt {#api-signJwt}
 
 ```text
-signJwt(RsaPrivateKey key, Json claims, string kid, string tokenType, resolve Crypto crypto) returns string uses crypto.signRsa unless JwtError
+signJwt(
+    RsaPrivateKey key,
+    Json claims,
+    string kid,
+    string tokenType,
+    resolve Crypto crypto
+) returns string unless JwtError
 ```
 
 Sign immutable JSON with an explicit key id and token type. Claims are validated by the protocol that consumes the token.
 
-[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/jose.aug#L30)
+Requires `Crypto.signRsa`.
+
+[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/jose.aug#L31)
 
 ## verifyJwt {#api-verifyJwt}
 
 ```text
-verifyJwt(string token, RsaPublicKey publicKey, string kid, string tokenType, resolve Crypto crypto) returns Json uses crypto.decodeBase64url and crypto.verifyRsa unless JwtError
+verifyJwt(
+    string token,
+    RsaPublicKey publicKey,
+    string kid,
+    string tokenType,
+    resolve Crypto crypto
+) returns Json unless JwtError
 ```
 
 Verify the signature and configured algorithm, key id, and type before exposing the JSON payload. Never follows token-supplied URLs.
 
-[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/jose.aug#L43)
+Requires `Crypto.decodeBase64url` and `Crypto.verifyRsa`.
+
+[Source](https://github.com/GreenPandaStudios/augscript/blob/main/src/stdlib/crypto/jose.aug#L44)