@greenpandastudios/aug-cli 0.19.0

package/docs/examples/oidc-login/dependencies/august/0.19.0/crypto/jose.md

@@ -0,0 +1,434 @@
+---
+title: "august/0.19.0/crypto/jose.aug · OpenID Connect login application"
+generated: true
+source: "examples/oidc-login/.aug-spec/august/0.19.0/crypto/jose.aug"
+editLink: false
+prev: false
+next: false
+outline: [2, 3]
+search: false
+pageClass: aug-example-page
+---
+
+# `august/0.19.0/crypto/jose.aug`
+
+[OpenID Connect login application](../../../../index.md) · Dependency source and specification
+
+This is the exact dependency version used by this example.
+
+::::: example-compare
+
+:::: example-code
+
+## Code {#code}
+
+::: code-group
+
+```aug [Indentation]
+import Crypto from contracts
+import parse from august.json
+/** A failed JOSE validation reveals no unverified claims. */
+JwtError() implements Error:
+    pass
+/** This profile accepts only RS256, a configured key id, and an explicit token type. */
+record JwtHeader(string alg, string kid, string typ)
+/** Public signing-key metadata in RFC 7517 / RFC 7518 form. */
+record RsaJwk(string kty, string kid, string alg, string use, string n, string e)
+record RsaJwks(List<RsaJwk> keys)
+/** Export public parameters. Private key material never enters the JSON document. */
+rsaJwk(RsaPublicKey publicKey, string kid, resolve Crypto crypto) returns RsaJwk uses crypto.exportRsa unless CryptoError:
+    (modulus, exponent) = crypto.exportRsa(publicKey)
+    return RsaJwk(kty="RSA", kid=kid, alg="RS256", use="sig", n=modulus.base64url(), e=exponent.base64url())
+/** Import only an RSA signing key for RS256. The transport caller selects the trusted JWKS URL. */
+importJwk(RsaJwk jwk, resolve Crypto crypto) returns RsaPublicKey uses crypto.decodeBase64url and crypto.importRsa unless JwtError:
+    if jwk.kty != "RSA" or jwk.alg != "RS256" or jwk.use != "sig":
+        throw JwtError()
+    try:
+        modulus = crypto.decodeBase64url(input=jwk.n)
+        exponent = crypto.decodeBase64url(input=jwk.e)
+        return crypto.importRsa(modulus, exponent)
+    catch CryptoError error:
+        throw JwtError()
+/** Sign immutable JSON with an explicit key id and token type. Claims are validated by the protocol that consumes the token. */
+signJwt(RsaPrivateKey key, Json claims, string kid, string tokenType, resolve Crypto crypto) returns string uses crypto.signRsa unless JwtError:
+    try:
+        header = Json(value=JwtHeader(alg="RS256", kid=kid, typ=tokenType)).stringify()
+        payload = claims.stringify()
+        signing = header.bytes().base64url() + "." + payload.bytes().base64url()
+        signature = crypto.signRsa(key=key, input=signing.bytes())
+        return signing + "." + signature.base64url()
+    catch CryptoError error:
+        throw JwtError()
+    catch JsonError error:
+        throw JwtError()
+/** Verify the signature and configured algorithm, key id, and type before exposing the JSON payload. Never follows token-supplied URLs. */
+verifyJwt(string token, RsaPublicKey publicKey, string kid, string tokenType, resolve Crypto crypto) returns Json uses crypto.decodeBase64url and crypto.verifyRsa unless JwtError:
+    if token.length() > 16384:
+        throw JwtError()
+    parts = token.split(separator=".")
+    if parts.length() != 3:
+        throw JwtError()
+    try:
+        first = parts.get(index=0)
+        second = parts.get(index=1)
+        third = parts.get(index=2)
+        header = parse(input=crypto.decodeBase64url(input=first).text()).decode<JwtHeader>()
+        if header.alg != "RS256" or header.kid != kid or header.typ != tokenType:
+            throw JwtError()
+        signature = crypto.decodeBase64url(input=third)
+        if not crypto.verifyRsa(publicKey=publicKey, input=(first + "." + second).bytes(), signature=signature):
+            throw JwtError()
+        return parse(input=crypto.decodeBase64url(input=second).text())
+    catch CryptoError error:
+        throw JwtError()
+    catch ConversionError error:
+        throw JwtError()
+    catch JsonError error:
+        throw JwtError()
+    catch IndexError error:
+        throw JwtError()
+```
+
+```aug [Braces]
+import Crypto from contracts
+import parse from august.json
+/** A failed JOSE validation reveals no unverified claims. */
+JwtError() implements Error {
+    pass
+}
+/** This profile accepts only RS256, a configured key id, and an explicit token type. */
+record JwtHeader(string alg, string kid, string typ)
+/** Public signing-key metadata in RFC 7517 / RFC 7518 form. */
+record RsaJwk(string kty, string kid, string alg, string use, string n, string e)
+record RsaJwks(List<RsaJwk> keys)
+/** Export public parameters. Private key material never enters the JSON document. */
+rsaJwk(RsaPublicKey publicKey, string kid, resolve Crypto crypto) returns RsaJwk uses crypto.exportRsa unless CryptoError {
+    (modulus, exponent) = crypto.exportRsa(publicKey)
+    return RsaJwk(kty="RSA", kid=kid, alg="RS256", use="sig", n=modulus.base64url(), e=exponent.base64url())
+}
+/** Import only an RSA signing key for RS256. The transport caller selects the trusted JWKS URL. */
+importJwk(RsaJwk jwk, resolve Crypto crypto) returns RsaPublicKey uses crypto.decodeBase64url and crypto.importRsa unless JwtError {
+    if jwk.kty != "RSA" or jwk.alg != "RS256" or jwk.use != "sig" {
+        throw JwtError()
+    }
+    try {
+        modulus = crypto.decodeBase64url(input=jwk.n)
+        exponent = crypto.decodeBase64url(input=jwk.e)
+        return crypto.importRsa(modulus, exponent)
+    }
+    catch CryptoError error {
+        throw JwtError()
+    }
+}
+/** Sign immutable JSON with an explicit key id and token type. Claims are validated by the protocol that consumes the token. */
+signJwt(RsaPrivateKey key, Json claims, string kid, string tokenType, resolve Crypto crypto) returns string uses crypto.signRsa unless JwtError {
+    try {
+        header = Json(value=JwtHeader(alg="RS256", kid=kid, typ=tokenType)).stringify()
+        payload = claims.stringify()
+        signing = header.bytes().base64url() + "." + payload.bytes().base64url()
+        signature = crypto.signRsa(key=key, input=signing.bytes())
+        return signing + "." + signature.base64url()
+    }
+    catch CryptoError error {
+        throw JwtError()
+    }
+    catch JsonError error {
+        throw JwtError()
+    }
+}
+/** Verify the signature and configured algorithm, key id, and type before exposing the JSON payload. Never follows token-supplied URLs. */
+verifyJwt(string token, RsaPublicKey publicKey, string kid, string tokenType, resolve Crypto crypto) returns Json uses crypto.decodeBase64url and crypto.verifyRsa unless JwtError {
+    if token.length() > 16384 {
+        throw JwtError()
+    }
+    parts = token.split(separator=".")
+    if parts.length() != 3 {
+        throw JwtError()
+    }
+    try {
+        first = parts.get(index=0)
+        second = parts.get(index=1)
+        third = parts.get(index=2)
+        header = parse(input=crypto.decodeBase64url(input=first).text()).decode<JwtHeader>()
+        if header.alg != "RS256" or header.kid != kid or header.typ != tokenType {
+            throw JwtError()
+        }
+        signature = crypto.decodeBase64url(input=third)
+        if not crypto.verifyRsa(publicKey=publicKey, input=(first + "." + second).bytes(), signature=signature) {
+            throw JwtError()
+        }
+        return parse(input=crypto.decodeBase64url(input=second).text())
+    }
+    catch CryptoError error {
+        throw JwtError()
+    }
+    catch ConversionError error {
+        throw JwtError()
+    }
+    catch JsonError error {
+        throw JwtError()
+    }
+    catch IndexError error {
+        throw JwtError()
+    }
+}
+```
+
+:::
+
+::::
+
+:::: example-spec
+
+## Compiled specification {#specification}
+
+August 0.19.0. This document is compiled from checked code with deterministic wording guided by Simplified Technical English.
+
+### In this file
+
+- [`JwtError`](jose.md#symbol-JwtError) is a class implementing `Error`.
+- [`JwtHeader`](jose.md#symbol-JwtHeader) is an immutable record.
+- [`RsaJwk`](jose.md#symbol-RsaJwk) is an immutable record.
+- [`RsaJwks`](jose.md#symbol-RsaJwks) is an immutable record.
+- [`rsaJwk`](jose.md#symbol-rsaJwk) is a function returning `RsaJwk`.
+- [`importJwk`](jose.md#symbol-importJwk) is a function returning `RsaPublicKey`.
+- [`signJwt`](jose.md#symbol-signJwt) is a function returning `string`.
+- [`verifyJwt`](jose.md#symbol-verifyJwt) is a function returning `Json`.
+
+### `JwtError` {#symbol-JwtError}
+
+[source](jose.md#code)
+
+Behavioral class.
+
+Satisfies `Error`.
+
+**Author documentation**
+
+A failed JOSE validation reveals no unverified claims.
+
+### `JwtHeader` {#symbol-JwtHeader}
+
+[source](jose.md#code)
+
+Immutable record.
+
+**Author documentation**
+
+This profile accepts only RS256, a configured key id, and an explicit token type.
+
+**Inputs**
+
+- `alg` (`string`) — required labeled input — stored as `alg` and read-only after initialization.
+- `kid` (`string`) — required labeled input — stored as `kid` and read-only after initialization.
+- `typ` (`string`) — required labeled input — stored as `typ` and read-only after initialization.
+
+### `RsaJwk` {#symbol-RsaJwk}
+
+[source](jose.md#code)
+
+Immutable record.
+
+**Author documentation**
+
+Public signing-key metadata in RFC 7517 / RFC 7518 form.
+
+**Inputs**
+
+- `kty` (`string`) — required labeled input — stored as `kty` and read-only after initialization.
+- `kid` (`string`) — required labeled input — stored as `kid` and read-only after initialization.
+- `alg` (`string`) — required labeled input — stored as `alg` and read-only after initialization.
+- `use` (`string`) — required labeled input — stored as `use` and read-only after initialization.
+- `n` (`string`) — required labeled input — stored as `n` and read-only after initialization.
+- `e` (`string`) — required labeled input — stored as `e` and read-only after initialization.
+
+### `RsaJwks` {#symbol-RsaJwks}
+
+[source](jose.md#code)
+
+Immutable record.
+
+**Inputs**
+
+- `keys` (`List<RsaJwk>`) — required labeled input — stored as `keys` and read-only after initialization.
+
+### `rsaJwk` {#symbol-rsaJwk}
+
+[source](jose.md#code)
+
+**Inputs**
+
+- `publicKey` (`RsaPublicKey`) — required labeled input.
+- `kid` (`string`) — required labeled input.
+- `crypto` ([`Crypto`](contracts.md#symbol-Crypto)) — injected; callers omit it.
+
+Returns: [`RsaJwk`](jose.md#symbol-RsaJwk).
+
+Capabilities: [`crypto.exportRsa`](contracts.md#symbol-Crypto.exportRsa).
+
+Can fail with `CryptoError`. Callers must catch or propagate these errors.
+
+**What it does**
+
+- Split call [`Crypto.exportRsa`](contracts.md#symbol-Crypto.exportRsa) on `crypto` with `publicKey` = `publicKey` into `modulus`, `exponent`, in that order.
+- Return call [`RsaJwk`](jose.md#symbol-RsaJwk) with `kty` = `"RSA"`; `kid` = `kid`; `alg` = `"RS256"`; `use` = `"sig"`; `n` = call `base64url` on `modulus`; `e` = call `base64url` on `exponent`.
+
+**Author documentation**
+
+Export public parameters. Private key material never enters the JSON document.
+
+### `importJwk` {#symbol-importJwk}
+
+[source](jose.md#code)
+
+**Inputs**
+
+- `jwk` ([`RsaJwk`](jose.md#symbol-RsaJwk)) — required labeled input.
+- `crypto` ([`Crypto`](contracts.md#symbol-Crypto)) — injected; callers omit it.
+
+Returns: `RsaPublicKey`.
+
+Capabilities: [`crypto.decodeBase64url`](contracts.md#symbol-Crypto.decodeBase64url), [`crypto.importRsa`](contracts.md#symbol-Crypto.importRsa).
+
+Can fail with `JwtError`. Callers must catch or propagate these errors.
+
+**What it does**
+
+- If ((`kty` of `jwk` does not equal `"RSA"`) or (`alg` of `jwk` does not equal `"RS256"`)) or (`use` of `jwk` does not equal `"sig"`):
+  - Fail with call [`JwtError`](jose.md#symbol-JwtError). Transfer control to a matching catch or propagate the failure.
+- Try these operations:
+  - Set `modulus` to call [`Crypto.decodeBase64url`](contracts.md#symbol-Crypto.decodeBase64url) on `crypto` with `input` = `n` of `jwk`.
+  - Set `exponent` to call [`Crypto.decodeBase64url`](contracts.md#symbol-Crypto.decodeBase64url) on `crypto` with `input` = `e` of `jwk`.
+  - Return call [`Crypto.importRsa`](contracts.md#symbol-Crypto.importRsa) on `crypto` with `modulus` = `modulus`; `exponent` = `exponent`.
+- If they fail with `CryptoError`, name the failure `error` and recover:
+  - Fail with call [`JwtError`](jose.md#symbol-JwtError). Transfer control to a matching catch or propagate the failure.
+
+**Author documentation**
+
+Import only an RSA signing key for RS256. The transport caller selects the trusted JWKS URL.
+
+### `signJwt` {#symbol-signJwt}
+
+[source](jose.md#code)
+
+**Inputs**
+
+- `key` (`RsaPrivateKey`) — required labeled input.
+- `claims` (`Json`) — required labeled input.
+- `kid` (`string`) — required labeled input.
+- `tokenType` (`string`) — required labeled input.
+- `crypto` ([`Crypto`](contracts.md#symbol-Crypto)) — injected; callers omit it.
+
+Returns: `string`.
+
+Capabilities: [`crypto.signRsa`](contracts.md#symbol-Crypto.signRsa).
+
+Can fail with `JwtError`. Callers must catch or propagate these errors.
+
+**What it does**
+
+- Try these operations:
+  - Set `header` to call `stringify` on call `Json` with `value` = call [`JwtHeader`](jose.md#symbol-JwtHeader) with `alg` = `"RS256"`; `kid` = `kid`; `typ` = `tokenType`.
+  - Set `payload` to call `stringify` on `claims`.
+  - Set `signing` to text formed by joining call `base64url` on call `bytes` on `header`, `"."`, call `base64url` on call `bytes` on `payload` in order.
+  - Set `signature` to call [`Crypto.signRsa`](contracts.md#symbol-Crypto.signRsa) on `crypto` with `key` = `key`; `input` = call `bytes` on `signing`.
+  - Return text formed by joining `signing`, `"."`, call `base64url` on `signature` in order.
+- If they fail with `CryptoError`, name the failure `error` and recover:
+  - Fail with call [`JwtError`](jose.md#symbol-JwtError). Transfer control to a matching catch or propagate the failure.
+- If they fail with `JsonError`, name the failure `error` and recover:
+  - Fail with call [`JwtError`](jose.md#symbol-JwtError). Transfer control to a matching catch or propagate the failure.
+
+**Author documentation**
+
+Sign immutable JSON with an explicit key id and token type. Claims are validated by the protocol that consumes the token.
+
+### `verifyJwt` {#symbol-verifyJwt}
+
+[source](jose.md#code)
+
+**Inputs**
+
+- `token` (`string`) — required labeled input.
+- `publicKey` (`RsaPublicKey`) — required labeled input.
+- `kid` (`string`) — required labeled input.
+- `tokenType` (`string`) — required labeled input.
+- `crypto` ([`Crypto`](contracts.md#symbol-Crypto)) — injected; callers omit it.
+
+Returns: `Json`.
+
+Capabilities: [`crypto.decodeBase64url`](contracts.md#symbol-Crypto.decodeBase64url), [`crypto.verifyRsa`](contracts.md#symbol-Crypto.verifyRsa).
+
+Can fail with `JwtError`. Callers must catch or propagate these errors.
+
+**What it does**
+
+- If call `length` on `token` is greater than `16384`:
+  - Fail with call [`JwtError`](jose.md#symbol-JwtError). Transfer control to a matching catch or propagate the failure.
+- Set `parts` to call `split` on `token` with `separator` = `"."`.
+- If call `length` on `parts` does not equal `3`:
+  - Fail with call [`JwtError`](jose.md#symbol-JwtError). Transfer control to a matching catch or propagate the failure.
+- Try these operations:
+  - Set `first` to call `get` on `parts` with `index` = `0`.
+  - Set `second` to call `get` on `parts` with `index` = `1`.
+  - Set `third` to call `get` on `parts` with `index` = `2`.
+  - Set `header` to call `decode` on call [`parse`](../json/contracts.md#symbol-parse) with `input` = call `text` on call [`Crypto.decodeBase64url`](contracts.md#symbol-Crypto.decodeBase64url) on `crypto` with `input` = `first` with type arguments [`JwtHeader`](jose.md#symbol-JwtHeader).
+  - If ((`alg` of `header` does not equal `"RS256"`) or (`kid` of `header` does not equal `kid`)) or (`typ` of `header` does not equal `tokenType`):
+    - Fail with call [`JwtError`](jose.md#symbol-JwtError). Transfer control to a matching catch or propagate the failure.
+  - Set `signature` to call [`Crypto.decodeBase64url`](contracts.md#symbol-Crypto.decodeBase64url) on `crypto` with `input` = `third`.
+  - If not (call [`Crypto.verifyRsa`](contracts.md#symbol-Crypto.verifyRsa) on `crypto` with `publicKey` = `publicKey`; `input` = call `bytes` on text formed by joining `first`, `"."`, `second` in order; `signature` = `signature`):
+    - Fail with call [`JwtError`](jose.md#symbol-JwtError). Transfer control to a matching catch or propagate the failure.
+  - Return call [`parse`](../json/contracts.md#symbol-parse) with `input` = call `text` on call [`Crypto.decodeBase64url`](contracts.md#symbol-Crypto.decodeBase64url) on `crypto` with `input` = `second`.
+- If they fail with `CryptoError`, name the failure `error` and recover:
+  - Fail with call [`JwtError`](jose.md#symbol-JwtError). Transfer control to a matching catch or propagate the failure.
+- If they fail with `ConversionError`, name the failure `error` and recover:
+  - Fail with call [`JwtError`](jose.md#symbol-JwtError). Transfer control to a matching catch or propagate the failure.
+- If they fail with `JsonError`, name the failure `error` and recover:
+  - Fail with call [`JwtError`](jose.md#symbol-JwtError). Transfer control to a matching catch or propagate the failure.
+- If they fail with `IndexError`, name the failure `error` and recover:
+  - Fail with call [`JwtError`](jose.md#symbol-JwtError). Transfer control to a matching catch or propagate the failure.
+
+**Author documentation**
+
+Verify the signature and configured algorithm, key id, and type before exposing the JSON payload. Never follows token-supplied URLs.
+
+### Dependencies used by this file
+
+Only referenced types and operations appear here. Each name links to its complete specification.
+
+#### [`Crypto`](contracts.md#symbol-Crypto)
+
+Capability interface from `contracts`.
+
+- [`Crypto.decodeBase64url`](contracts.md#symbol-Crypto.decodeBase64url) (`input`: `string`) → `Bytes`; can fail with `CryptoError`.
+- [`Crypto.exportRsa`](contracts.md#symbol-Crypto.exportRsa) (`publicKey`: `RsaPublicKey`) → `Tuple<Bytes,Bytes>`; can fail with `CryptoError`.
+- [`Crypto.importRsa`](contracts.md#symbol-Crypto.importRsa) (`modulus`: `Bytes`, `exponent`: `Bytes`) → `RsaPublicKey`; can fail with `CryptoError`.
+- [`Crypto.signRsa`](contracts.md#symbol-Crypto.signRsa) (`key`: `RsaPrivateKey`, `input`: `Bytes`) → `Bytes`; can fail with `CryptoError`.
+- [`Crypto.verifyRsa`](contracts.md#symbol-Crypto.verifyRsa) (`publicKey`: `RsaPublicKey`, `input`: `Bytes`, `signature`: `Bytes`) → `bool`; can fail with `CryptoError`.
+
+#### [`parse`](../json/contracts.md#symbol-parse)
+
+Function from `august.json`.
+
+- [`parse`](../json/contracts.md#symbol-parse) (`input`: `string`) → `Json`; can fail with `JsonError`.
+
+### Built-in operations used by this file
+
+- `Bytes.base64url` (no inputs) → `string`: Encode immutable bytes as unpadded RFC 4648 URL-safe base64.
+- `Bytes.text` (no inputs) → `string`: Decode UTF-8 strictly. Invalid input raises ConversionError; embedded NUL is preserved. Can fail with `ConversionError`.
+- `Json.decode` (no inputs) → `JwtHeader`: Decode a checked record or data type: json.decode<Profile>(). Unknown fields, type mismatches, and validation errors are rejected. Can fail with `JsonError`.
+- `Json.stringify` (no inputs) → `string`: Serialize this JSON value with checked UTF-8 escaping and exact int64 values. Can fail with `JsonError`.
+- `List<string>.get` (`index`: `int`) → `string`: Read a zero-based position. An invalid index raises checked IndexError. Reference results grant reading. Can fail with `IndexError`.
+- `List<string>.length` (no inputs) → `int`: Read the number of elements.
+- `string.bytes` (no inputs) → `Bytes`: Encode this string as immutable UTF-8 bytes.
+- `string.length` (no inputs) → `int`: Read the number of UTF-8 bytes. Unicode text is preserved losslessly.
+- `string.split` (`separator`: `string`) → `List<string>`: Split at an exact separator, preserving empty parts.
+
+[Full built-in reference](https://greenpandastudios.github.io/augscript/language-constructs).
+
+### Shared language rules
+
+See the [language reference](https://greenpandastudios.github.io/augscript/reference) for numeric, equality, ownership, and task rules.
+
+::::
+
+:::::

package/docs/examples/oidc-login/dependencies/august/0.19.0/json/contracts.md

@@ -0,0 +1,103 @@
+---
+title: "august/0.19.0/json/contracts.aug · OpenID Connect login application"
+generated: true
+source: "examples/oidc-login/.aug-spec/august/0.19.0/json/contracts.aug"
+editLink: false
+prev: false
+next: false
+outline: [2, 3]
+search: false
+pageClass: aug-example-page
+---
+
+# `august/0.19.0/json/contracts.aug`
+
+[OpenID Connect login application](../../../../index.md) · Dependency source and specification
+
+This is the exact dependency version used by this example.
+
+::::: example-compare
+
+:::: example-code
+
+## Code {#code}
+
+::: code-group
+
+```aug [Indentation]
+extern C value pure _aug_json_parse(string input) returns Json unless JsonError
+/** Parse strict UTF-8 JSON. Duplicate keys, invalid Unicode, oversized integers, and nesting beyond 64 levels raise JsonError. */
+parse(string input) returns Json unless JsonError:
+    unsafe:
+        return _aug_json_parse(input)
+```
+
+```aug [Braces]
+extern C value pure _aug_json_parse(string input) returns Json unless JsonError
+/** Parse strict UTF-8 JSON. Duplicate keys, invalid Unicode, oversized integers, and nesting beyond 64 levels raise JsonError. */
+parse(string input) returns Json unless JsonError {
+    unsafe {
+        return _aug_json_parse(input)
+    }
+}
+```
+
+:::
+
+::::
+
+:::: example-spec
+
+## Compiled specification {#specification}
+
+August 0.19.0. This document is compiled from checked code with deterministic wording guided by Simplified Technical English.
+
+### In this file
+
+- [`_aug_json_parse`](contracts.md#symbol-_aug_json_parse) is a function returning `Json`.
+- [`parse`](contracts.md#symbol-parse) is a function returning `Json`.
+
+### `parse` {#symbol-parse}
+
+[source](contracts.md#code)
+
+**Inputs**
+
+- `input` (`string`) — required labeled input.
+
+Returns: `Json`.
+
+Can fail with `JsonError`. Callers must catch or propagate these errors.
+
+**What it does**
+
+- Enter an unsafe boundary. Native calls use their declared contracts; their foreign implementation is outside this specification:
+  - Return call [`_aug_json_parse`](contracts.md#symbol-_aug_json_parse) with `input` = `input`.
+
+**Author documentation**
+
+Parse strict UTF-8 JSON. Duplicate keys, invalid Unicode, oversized integers, and nesting beyond 64 levels raise JsonError.
+
+### `_aug_json_parse` {#symbol-_aug_json_parse}
+
+[source](contracts.md#code)
+
+Private to its defining scope.
+
+**Inputs**
+
+- `input` (`string`) — required labeled input.
+
+Returns: `Json`.
+
+Can fail with `JsonError`. Callers must catch or propagate these errors.
+
+Native C operation. Its declared inputs, result, effects, and errors are the visible contract. The C implementation is outside this specification.
+
+### Shared language rules
+
+See the [language reference](https://greenpandastudios.github.io/augscript/reference) for numeric, equality, ownership, and task rules.
+
+::::
+
+:::::