@greenpandastudios/aug-cli 0.19.0

package/docs/examples/oidc-login/provider/contracts.md

@@ -0,0 +1,267 @@
+---
+title: "provider/contracts.aug · OpenID Connect login application"
+generated: true
+source: "examples/oidc-login/provider/contracts.aug"
+editLink: false
+prev: false
+next: false
+outline: [2, 3]
+pageClass: aug-example-page
+---
+
+# `provider/contracts.aug`
+
+[OpenID Connect login application](../index.md) · Source and specification
+
+::: details Files in this project
+
+- [`main.aug`](../main.md)
+- [`client/contracts.aug`](../client/contracts.md)
+- [`client/endpoints.aug`](../client/endpoints.md)
+- [`client/export.aug`](../client/export.md)
+- [`client/login.aug`](../client/login.md)
+- [`client/logout.aug`](../client/logout.md)
+- [`client/protocol.aug`](../client/protocol.md)
+- [`client/session.aug`](../client/session.md)
+- [`client/views.aug`](../client/views.md)
+- [`common/export.aug`](../common/export.md)
+- [`common/headers.aug`](../common/headers.md)
+- [`common/keys.aug`](../common/keys.md)
+- [`common/settings.aug`](../common/settings.md)
+- [`common/views.aug`](../common/views.md)
+- [`provider/authorization.aug`](authorization.md)
+- [`provider/contracts.aug`](contracts.md)
+- [`provider/credentials.aug`](credentials.md)
+- [`provider/discovery.aug`](discovery.md)
+- [`provider/export.aug`](export.md)
+- [`provider/token.aug`](token.md)
+- [`provider/userinfo.aug`](userinfo.md)
+- [`provider/views.aug`](views.md)
+
+:::
+
+::::: example-compare
+
+:::: example-code
+
+## Code {#code}
+
+::: code-group
+
+```aug [Indentation]
+/** A provider request is bound to a browser cookie, a form CSRF token, and a registered client. */
+record AuthorizationRequest(string clientId, string redirectUri, string state, string nonce, string challenge, string browser, string csrf, int expires)
+/** Codes are short-lived, single-use and bound to a redirect URI and S256 challenge. */
+record AuthorizationCode(string clientId, string redirectUri, string challenge, string nonce, string subject, string name, int expires)
+record IdClaims(string iss, string sub, string aud, int exp, int iat, string nonce, string name)
+record AccessGrant(string subject, string name, int expires)
+record TokenResponse(string token_type, string access_token, string id_token, int expires_in, string scope)
+record OAuthError(string error, string error_description)
+record TokenForm(string grant_type, string code, string redirect_uri, string client_id, string code_verifier)
+record LoginForm(string request_id, string csrf, string username, string password)
+record UserInfo(string sub, string name)
+LoginError() implements Error:
+    pass
+CodeError() implements Error:
+    pass
+```
+
+```aug [Braces]
+/** A provider request is bound to a browser cookie, a form CSRF token, and a registered client. */
+record AuthorizationRequest(string clientId, string redirectUri, string state, string nonce, string challenge, string browser, string csrf, int expires)
+/** Codes are short-lived, single-use and bound to a redirect URI and S256 challenge. */
+record AuthorizationCode(string clientId, string redirectUri, string challenge, string nonce, string subject, string name, int expires)
+record IdClaims(string iss, string sub, string aud, int exp, int iat, string nonce, string name)
+record AccessGrant(string subject, string name, int expires)
+record TokenResponse(string token_type, string access_token, string id_token, int expires_in, string scope)
+record OAuthError(string error, string error_description)
+record TokenForm(string grant_type, string code, string redirect_uri, string client_id, string code_verifier)
+record LoginForm(string request_id, string csrf, string username, string password)
+record UserInfo(string sub, string name)
+LoginError() implements Error {
+    pass
+}
+CodeError() implements Error {
+    pass
+}
+```
+
+:::
+
+::::
+
+:::: example-spec
+
+## Compiled specification {#specification}
+
+August 0.19.0. This document is compiled from checked code with deterministic wording guided by Simplified Technical English.
+
+### In this file
+
+- [`AuthorizationRequest`](contracts.md#symbol-AuthorizationRequest) is an immutable record.
+- [`AuthorizationCode`](contracts.md#symbol-AuthorizationCode) is an immutable record.
+- [`IdClaims`](contracts.md#symbol-IdClaims) is an immutable record.
+- [`AccessGrant`](contracts.md#symbol-AccessGrant) is an immutable record.
+- [`TokenResponse`](contracts.md#symbol-TokenResponse) is an immutable record.
+- [`OAuthError`](contracts.md#symbol-OAuthError) is an immutable record.
+- [`TokenForm`](contracts.md#symbol-TokenForm) is an immutable record.
+- [`LoginForm`](contracts.md#symbol-LoginForm) is an immutable record.
+- [`UserInfo`](contracts.md#symbol-UserInfo) is an immutable record.
+- [`LoginError`](contracts.md#symbol-LoginError) is a class implementing `Error`.
+- [`CodeError`](contracts.md#symbol-CodeError) is a class implementing `Error`.
+
+### `AuthorizationRequest` {#symbol-AuthorizationRequest}
+
+[source](contracts.md#code)
+
+Immutable record.
+
+**Author documentation**
+
+A provider request is bound to a browser cookie, a form CSRF token, and a registered client.
+
+**Inputs**
+
+- `clientId` (`string`) — required labeled input — stored as `clientId` and read-only after initialization.
+- `redirectUri` (`string`) — required labeled input — stored as `redirectUri` and read-only after initialization.
+- `state` (`string`) — required labeled input — stored as `state` and read-only after initialization.
+- `nonce` (`string`) — required labeled input — stored as `nonce` and read-only after initialization.
+- `challenge` (`string`) — required labeled input — stored as `challenge` and read-only after initialization.
+- `browser` (`string`) — required labeled input — stored as `browser` and read-only after initialization.
+- `csrf` (`string`) — required labeled input — stored as `csrf` and read-only after initialization.
+- `expires` (`int`) — required labeled input — stored as `expires` and read-only after initialization.
+
+### `AuthorizationCode` {#symbol-AuthorizationCode}
+
+[source](contracts.md#code)
+
+Immutable record.
+
+**Author documentation**
+
+Codes are short-lived, single-use and bound to a redirect URI and S256 challenge.
+
+**Inputs**
+
+- `clientId` (`string`) — required labeled input — stored as `clientId` and read-only after initialization.
+- `redirectUri` (`string`) — required labeled input — stored as `redirectUri` and read-only after initialization.
+- `challenge` (`string`) — required labeled input — stored as `challenge` and read-only after initialization.
+- `nonce` (`string`) — required labeled input — stored as `nonce` and read-only after initialization.
+- `subject` (`string`) — required labeled input — stored as `subject` and read-only after initialization.
+- `name` (`string`) — required labeled input — stored as `name` and read-only after initialization.
+- `expires` (`int`) — required labeled input — stored as `expires` and read-only after initialization.
+
+### `IdClaims` {#symbol-IdClaims}
+
+[source](contracts.md#code)
+
+Immutable record.
+
+**Inputs**
+
+- `iss` (`string`) — required labeled input — stored as `iss` and read-only after initialization.
+- `sub` (`string`) — required labeled input — stored as `sub` and read-only after initialization.
+- `aud` (`string`) — required labeled input — stored as `aud` and read-only after initialization.
+- `exp` (`int`) — required labeled input — stored as `exp` and read-only after initialization.
+- `iat` (`int`) — required labeled input — stored as `iat` and read-only after initialization.
+- `nonce` (`string`) — required labeled input — stored as `nonce` and read-only after initialization.
+- `name` (`string`) — required labeled input — stored as `name` and read-only after initialization.
+
+### `AccessGrant` {#symbol-AccessGrant}
+
+[source](contracts.md#code)
+
+Immutable record.
+
+**Inputs**
+
+- `subject` (`string`) — required labeled input — stored as `subject` and read-only after initialization.
+- `name` (`string`) — required labeled input — stored as `name` and read-only after initialization.
+- `expires` (`int`) — required labeled input — stored as `expires` and read-only after initialization.
+
+### `TokenResponse` {#symbol-TokenResponse}
+
+[source](contracts.md#code)
+
+Immutable record.
+
+**Inputs**
+
+- `token_type` (`string`) — required labeled input — stored as `token_type` and read-only after initialization.
+- `access_token` (`string`) — required labeled input — stored as `access_token` and read-only after initialization.
+- `id_token` (`string`) — required labeled input — stored as `id_token` and read-only after initialization.
+- `expires_in` (`int`) — required labeled input — stored as `expires_in` and read-only after initialization.
+- `scope` (`string`) — required labeled input — stored as `scope` and read-only after initialization.
+
+### `OAuthError` {#symbol-OAuthError}
+
+[source](contracts.md#code)
+
+Immutable record.
+
+**Inputs**
+
+- `error` (`string`) — required labeled input — stored as `error` and read-only after initialization.
+- `error_description` (`string`) — required labeled input — stored as `error_description` and read-only after initialization.
+
+### `TokenForm` {#symbol-TokenForm}
+
+[source](contracts.md#code)
+
+Immutable record.
+
+**Inputs**
+
+- `grant_type` (`string`) — required labeled input — stored as `grant_type` and read-only after initialization.
+- `code` (`string`) — required labeled input — stored as `code` and read-only after initialization.
+- `redirect_uri` (`string`) — required labeled input — stored as `redirect_uri` and read-only after initialization.
+- `client_id` (`string`) — required labeled input — stored as `client_id` and read-only after initialization.
+- `code_verifier` (`string`) — required labeled input — stored as `code_verifier` and read-only after initialization.
+
+### `LoginForm` {#symbol-LoginForm}
+
+[source](contracts.md#code)
+
+Immutable record.
+
+**Inputs**
+
+- `request_id` (`string`) — required labeled input — stored as `request_id` and read-only after initialization.
+- `csrf` (`string`) — required labeled input — stored as `csrf` and read-only after initialization.
+- `username` (`string`) — required labeled input — stored as `username` and read-only after initialization.
+- `password` (`string`) — required labeled input — stored as `password` and read-only after initialization.
+
+### `UserInfo` {#symbol-UserInfo}
+
+[source](contracts.md#code)
+
+Immutable record.
+
+**Inputs**
+
+- `sub` (`string`) — required labeled input — stored as `sub` and read-only after initialization.
+- `name` (`string`) — required labeled input — stored as `name` and read-only after initialization.
+
+### `LoginError` {#symbol-LoginError}
+
+[source](contracts.md#code)
+
+Behavioral class.
+
+Satisfies `Error`.
+
+### `CodeError` {#symbol-CodeError}
+
+[source](contracts.md#code)
+
+Behavioral class.
+
+Satisfies `Error`.
+
+### Shared language rules
+
+See the [language reference](https://greenpandastudios.github.io/augscript/reference) for numeric, equality, ownership, and task rules.
+
+::::
+
+:::::

package/docs/examples/oidc-login/provider/credentials.md

@@ -0,0 +1,148 @@
+---
+title: "provider/credentials.aug · OpenID Connect login application"
+generated: true
+source: "examples/oidc-login/provider/credentials.aug"
+editLink: false
+prev: false
+next: false
+outline: [2, 3]
+pageClass: aug-example-page
+---
+
+# `provider/credentials.aug`
+
+[OpenID Connect login application](../index.md) · Source and specification
+
+::: details Files in this project
+
+- [`main.aug`](../main.md)
+- [`client/contracts.aug`](../client/contracts.md)
+- [`client/endpoints.aug`](../client/endpoints.md)
+- [`client/export.aug`](../client/export.md)
+- [`client/login.aug`](../client/login.md)
+- [`client/logout.aug`](../client/logout.md)
+- [`client/protocol.aug`](../client/protocol.md)
+- [`client/session.aug`](../client/session.md)
+- [`client/views.aug`](../client/views.md)
+- [`common/export.aug`](../common/export.md)
+- [`common/headers.aug`](../common/headers.md)
+- [`common/keys.aug`](../common/keys.md)
+- [`common/settings.aug`](../common/settings.md)
+- [`common/views.aug`](../common/views.md)
+- [`provider/authorization.aug`](authorization.md)
+- [`provider/contracts.aug`](contracts.md)
+- [`provider/credentials.aug`](credentials.md)
+- [`provider/discovery.aug`](discovery.md)
+- [`provider/export.aug`](export.md)
+- [`provider/token.aug`](token.md)
+- [`provider/userinfo.aug`](userinfo.md)
+- [`provider/views.aug`](views.md)
+
+:::
+
+::::: example-compare
+
+:::: example-code
+
+## Code {#code}
+
+::: code-group
+
+```aug [Indentation]
+import Crypto from august.crypto
+/** One development account with a PBKDF2-HMAC-SHA256 verifier. Production account storage is deliberately a separate capability. */
+verifyCredentials(string username, string password, resolve Crypto crypto) returns bool uses crypto.passwordHash and crypto.decodeBase64url and crypto.equal unless CryptoError:
+    if username.length() > 64 or password.length() > 256:
+        return false
+    actual = crypto.passwordHash(password=password.bytes(), salt="August demo salt v1".bytes(), iterations=600000)
+    expected = crypto.decodeBase64url(input="s70USYF6WohPz2f7VLA9haS_ZgEtenviSf_HG0o7B_A")
+    userMatches = crypto.equal(left=username.bytes(), right="ada".bytes())
+    passwordMatches = crypto.equal(left=actual, right=expected)
+    return userMatches and passwordMatches
+```
+
+```aug [Braces]
+import Crypto from august.crypto
+/** One development account with a PBKDF2-HMAC-SHA256 verifier. Production account storage is deliberately a separate capability. */
+verifyCredentials(string username, string password, resolve Crypto crypto) returns bool uses crypto.passwordHash and crypto.decodeBase64url and crypto.equal unless CryptoError {
+    if username.length() > 64 or password.length() > 256 {
+        return false
+    }
+    actual = crypto.passwordHash(password=password.bytes(), salt="August demo salt v1".bytes(), iterations=600000)
+    expected = crypto.decodeBase64url(input="s70USYF6WohPz2f7VLA9haS_ZgEtenviSf_HG0o7B_A")
+    userMatches = crypto.equal(left=username.bytes(), right="ada".bytes())
+    passwordMatches = crypto.equal(left=actual, right=expected)
+    return userMatches and passwordMatches
+}
+```
+
+:::
+
+::::
+
+:::: example-spec
+
+## Compiled specification {#specification}
+
+August 0.19.0. This document is compiled from checked code with deterministic wording guided by Simplified Technical English.
+
+### In this file
+
+- [`verifyCredentials`](credentials.md#symbol-verifyCredentials) is a function returning `bool`.
+
+### `verifyCredentials` {#symbol-verifyCredentials}
+
+[source](credentials.md#code)
+
+**Inputs**
+
+- `username` (`string`) — required labeled input.
+- `password` (`string`) — required labeled input.
+- `crypto` ([`Crypto`](../dependencies/august/0.19.0/crypto/contracts.md#symbol-Crypto)) — injected; callers omit it.
+
+Returns: `bool`.
+
+Capabilities: [`crypto.passwordHash`](../dependencies/august/0.19.0/crypto/contracts.md#symbol-Crypto.passwordHash), [`crypto.decodeBase64url`](../dependencies/august/0.19.0/crypto/contracts.md#symbol-Crypto.decodeBase64url), [`crypto.equal`](../dependencies/august/0.19.0/crypto/contracts.md#symbol-Crypto.equal).
+
+Can fail with `CryptoError`. Callers must catch or propagate these errors.
+
+**What it does**
+
+- If (call `length` on `username` is greater than `64`) or (call `length` on `password` is greater than `256`):
+  - Return `false`.
+- Set `actual` to call [`Crypto.passwordHash`](../dependencies/august/0.19.0/crypto/contracts.md#symbol-Crypto.passwordHash) on `crypto` with `password` = call `bytes` on `password`; `salt` = call `bytes` on `"August demo salt v1"`; `iterations` = `600000`.
+- Set `expected` to call [`Crypto.decodeBase64url`](../dependencies/august/0.19.0/crypto/contracts.md#symbol-Crypto.decodeBase64url) on `crypto` with `input` = `"s70USYF6WohPz2f7VLA9haS_ZgEtenviSf_HG0o7B_A"`.
+- Set `userMatches` to call [`Crypto.equal`](../dependencies/august/0.19.0/crypto/contracts.md#symbol-Crypto.equal) on `crypto` with `left` = call `bytes` on `username`; `right` = call `bytes` on `"ada"`.
+- Set `passwordMatches` to call [`Crypto.equal`](../dependencies/august/0.19.0/crypto/contracts.md#symbol-Crypto.equal) on `crypto` with `left` = `actual`; `right` = `expected`.
+- Return `userMatches` and `passwordMatches`.
+
+**Author documentation**
+
+One development account with a PBKDF2-HMAC-SHA256 verifier. Production account storage is deliberately a separate capability.
+
+### Dependencies used by this file
+
+Only referenced types and operations appear here. Each name links to its complete specification.
+
+#### [`Crypto`](../dependencies/august/0.19.0/crypto/contracts.md#symbol-Crypto)
+
+Capability interface from `august.crypto`.
+
+- [`Crypto.decodeBase64url`](../dependencies/august/0.19.0/crypto/contracts.md#symbol-Crypto.decodeBase64url) (`input`: `string`) → `Bytes`; can fail with `CryptoError`.
+- [`Crypto.equal`](../dependencies/august/0.19.0/crypto/contracts.md#symbol-Crypto.equal) (`left`: `Bytes`, `right`: `Bytes`) → `bool`.
+- [`Crypto.passwordHash`](../dependencies/august/0.19.0/crypto/contracts.md#symbol-Crypto.passwordHash) (`password`: `Bytes`, `salt`: `Bytes`, `iterations`: `int`) → `Bytes`; can fail with `CryptoError`.
+
+### Built-in operations used by this file
+
+- `string.bytes` (no inputs) → `Bytes`: Encode this string as immutable UTF-8 bytes.
+- `string.length` (no inputs) → `int`: Read the number of UTF-8 bytes. Unicode text is preserved losslessly.
+
+[Full built-in reference](https://greenpandastudios.github.io/augscript/language-constructs).
+
+### Shared language rules
+
+See the [language reference](https://greenpandastudios.github.io/augscript/reference) for numeric, equality, ownership, and task rules.
+
+::::
+
+:::::

package/docs/examples/oidc-login/provider/discovery.md

@@ -0,0 +1,215 @@
+---
+title: "provider/discovery.aug · OpenID Connect login application"
+generated: true
+source: "examples/oidc-login/provider/discovery.aug"
+editLink: false
+prev: false
+next: false
+outline: [2, 3]
+pageClass: aug-example-page
+---
+
+# `provider/discovery.aug`
+
+[OpenID Connect login application](../index.md) · Source and specification
+
+::: details Files in this project
+
+- [`main.aug`](../main.md)
+- [`client/contracts.aug`](../client/contracts.md)
+- [`client/endpoints.aug`](../client/endpoints.md)
+- [`client/export.aug`](../client/export.md)
+- [`client/login.aug`](../client/login.md)
+- [`client/logout.aug`](../client/logout.md)
+- [`client/protocol.aug`](../client/protocol.md)
+- [`client/session.aug`](../client/session.md)
+- [`client/views.aug`](../client/views.md)
+- [`common/export.aug`](../common/export.md)
+- [`common/headers.aug`](../common/headers.md)
+- [`common/keys.aug`](../common/keys.md)
+- [`common/settings.aug`](../common/settings.md)
+- [`common/views.aug`](../common/views.md)
+- [`provider/authorization.aug`](authorization.md)
+- [`provider/contracts.aug`](contracts.md)
+- [`provider/credentials.aug`](credentials.md)
+- [`provider/discovery.aug`](discovery.md)
+- [`provider/export.aug`](export.md)
+- [`provider/token.aug`](token.md)
+- [`provider/userinfo.aug`](userinfo.md)
+- [`provider/views.aug`](views.md)
+
+:::
+
+::::: example-compare
+
+:::: example-code
+
+## Code {#code}
+
+::: code-group
+
+```aug [Indentation]
+import settings and SigningKeys and KeyError from common
+import Crypto and RsaJwks and rsaJwk from august.crypto
+/** Discovery advertises exactly this provider's supported authorization-code profile. */
+record Discovery(string issuer, string authorization_endpoint, string token_endpoint, string userinfo_endpoint, string jwks_uri, List<string> response_types_supported, List<string> grant_types_supported, List<string> subject_types_supported, List<string> id_token_signing_alg_values_supported, List<string> token_endpoint_auth_methods_supported, List<string> scopes_supported, List<string> claims_supported, List<string> code_challenge_methods_supported)
+endpoint GET "/provider/.well-known/openid-configuration" as discovery() returns Discovery:
+    config = settings()
+    return Discovery(issuer=config.issuer, authorization_endpoint=config.issuer + "/authorize", token_endpoint=config.issuer + "/token", userinfo_endpoint=config.issuer + "/userinfo", jwks_uri=config.issuer + "/jwks", response_types_supported=["code"], grant_types_supported=["authorization_code"], subject_types_supported=["public"], id_token_signing_alg_values_supported=["RS256"], token_endpoint_auth_methods_supported=["none"], scopes_supported=["openid", "profile"], claims_supported=["iss", "sub", "aud", "exp", "iat", "nonce", "name"], code_challenge_methods_supported=["S256"])
+/** Only the provider's public signing key is published. Session keys never enter this JWKS. */
+endpoint GET "/provider/jwks" as jwks(resolve Crypto crypto, resolve SigningKeys keys) returns RsaJwks uses keys.provider and crypto.publicRsa and crypto.exportRsa unless KeyError and CryptoError:
+    publicKey = crypto.publicRsa(key=keys.provider())
+    return RsaJwks(keys=[rsaJwk(publicKey=publicKey, kid="provider-1")])
+```
+
+```aug [Braces]
+import settings and SigningKeys and KeyError from common
+import Crypto and RsaJwks and rsaJwk from august.crypto
+/** Discovery advertises exactly this provider's supported authorization-code profile. */
+record Discovery(string issuer, string authorization_endpoint, string token_endpoint, string userinfo_endpoint, string jwks_uri, List<string> response_types_supported, List<string> grant_types_supported, List<string> subject_types_supported, List<string> id_token_signing_alg_values_supported, List<string> token_endpoint_auth_methods_supported, List<string> scopes_supported, List<string> claims_supported, List<string> code_challenge_methods_supported)
+endpoint GET "/provider/.well-known/openid-configuration" as discovery() returns Discovery {
+    config = settings()
+    return Discovery(issuer=config.issuer, authorization_endpoint=config.issuer + "/authorize", token_endpoint=config.issuer + "/token", userinfo_endpoint=config.issuer + "/userinfo", jwks_uri=config.issuer + "/jwks", response_types_supported=["code"], grant_types_supported=["authorization_code"], subject_types_supported=["public"], id_token_signing_alg_values_supported=["RS256"], token_endpoint_auth_methods_supported=["none"], scopes_supported=["openid", "profile"], claims_supported=["iss", "sub", "aud", "exp", "iat", "nonce", "name"], code_challenge_methods_supported=["S256"])
+}
+/** Only the provider's public signing key is published. Session keys never enter this JWKS. */
+endpoint GET "/provider/jwks" as jwks(resolve Crypto crypto, resolve SigningKeys keys) returns RsaJwks uses keys.provider and crypto.publicRsa and crypto.exportRsa unless KeyError and CryptoError {
+    publicKey = crypto.publicRsa(key=keys.provider())
+    return RsaJwks(keys=[rsaJwk(publicKey=publicKey, kid="provider-1")])
+}
+```
+
+:::
+
+::::
+
+:::: example-spec
+
+## Compiled specification {#specification}
+
+August 0.19.0. This document is compiled from checked code with deterministic wording guided by Simplified Technical English.
+
+### In this file
+
+- [`Discovery`](discovery.md#symbol-Discovery) is an immutable record.
+- [`discovery`](discovery.md#symbol-discovery) handles `GET` `/provider/.well-known/openid-configuration` returning `Discovery`.
+- [`jwks`](discovery.md#symbol-jwks) handles `GET` `/provider/jwks` returning `RsaJwks`.
+
+### `Discovery` {#symbol-Discovery}
+
+[source](discovery.md#code)
+
+Immutable record.
+
+**Author documentation**
+
+Discovery advertises exactly this provider's supported authorization-code profile.
+
+**Inputs**
+
+- `issuer` (`string`) — required labeled input — stored as `issuer` and read-only after initialization.
+- `authorization_endpoint` (`string`) — required labeled input — stored as `authorization_endpoint` and read-only after initialization.
+- `token_endpoint` (`string`) — required labeled input — stored as `token_endpoint` and read-only after initialization.
+- `userinfo_endpoint` (`string`) — required labeled input — stored as `userinfo_endpoint` and read-only after initialization.
+- `jwks_uri` (`string`) — required labeled input — stored as `jwks_uri` and read-only after initialization.
+- `response_types_supported` (`List<string>`) — required labeled input — stored as `response_types_supported` and read-only after initialization.
+- `grant_types_supported` (`List<string>`) — required labeled input — stored as `grant_types_supported` and read-only after initialization.
+- `subject_types_supported` (`List<string>`) — required labeled input — stored as `subject_types_supported` and read-only after initialization.
+- `id_token_signing_alg_values_supported` (`List<string>`) — required labeled input — stored as `id_token_signing_alg_values_supported` and read-only after initialization.
+- `token_endpoint_auth_methods_supported` (`List<string>`) — required labeled input — stored as `token_endpoint_auth_methods_supported` and read-only after initialization.
+- `scopes_supported` (`List<string>`) — required labeled input — stored as `scopes_supported` and read-only after initialization.
+- `claims_supported` (`List<string>`) — required labeled input — stored as `claims_supported` and read-only after initialization.
+- `code_challenge_methods_supported` (`List<string>`) — required labeled input — stored as `code_challenge_methods_supported` and read-only after initialization.
+
+### `discovery` {#symbol-discovery}
+
+[source](discovery.md#code)
+
+Returns: [`Discovery`](discovery.md#symbol-Discovery).
+
+HTTP route: `GET` `/provider/.well-known/openid-configuration`. Use status 200 when the handler returns a body; a returned HttpResponse can set its own status. An unhandled request failure returns status 500 and cancels its request tasks.
+
+**What it does**
+
+- Set `config` to call [`settings`](../common/settings.md#symbol-settings).
+- Return call [`Discovery`](discovery.md#symbol-Discovery) with `issuer` = `issuer` of `config`; `authorization_endpoint` = (`issuer` of `config` plus `"/authorize"`); `token_endpoint` = (`issuer` of `config` plus `"/token"`); `userinfo_endpoint` = (`issuer` of `config` plus `"/userinfo"`); `jwks_uri` = (`issuer` of `config` plus `"/jwks"`); `response_types_supported` = a list containing `"code"`; `grant_types_supported` = a list containing `"authorization_code"`; `subject_types_supported` = a list containing `"public"`; `id_token_signing_alg_values_supported` = a list containing `"RS256"`; `token_endpoint_auth_methods_supported` = a list containing `"none"`; `scopes_supported` = a list containing `"openid"`, `"profile"`; `claims_supported` = a list containing `"iss"`, `"sub"`, `"aud"`, `"exp"`, `"iat"`, `"nonce"`, `"name"`; `code_challenge_methods_supported` = a list containing `"S256"`.
+
+### `jwks` {#symbol-jwks}
+
+[source](discovery.md#code)
+
+**Inputs**
+
+- `crypto` ([`Crypto`](../dependencies/august/0.19.0/crypto/contracts.md#symbol-Crypto)) — injected; callers omit it.
+- `keys` ([`SigningKeys`](../common/keys.md#symbol-SigningKeys)) — injected; callers omit it.
+
+Returns: [`RsaJwks`](../dependencies/august/0.19.0/crypto/jose.md#symbol-RsaJwks).
+
+Capabilities: [`keys.provider`](../common/keys.md#symbol-SigningKeys.provider), [`crypto.publicRsa`](../dependencies/august/0.19.0/crypto/contracts.md#symbol-Crypto.publicRsa), [`crypto.exportRsa`](../dependencies/august/0.19.0/crypto/contracts.md#symbol-Crypto.exportRsa).
+
+Can fail with `KeyError`, `CryptoError`. Callers must catch or propagate these errors.
+
+HTTP route: `GET` `/provider/jwks`. Use status 200 when the handler returns a body; a returned HttpResponse can set its own status. An unhandled request failure returns status 500 and cancels its request tasks.
+
+**What it does**
+
+- Set `publicKey` to call [`Crypto.publicRsa`](../dependencies/august/0.19.0/crypto/contracts.md#symbol-Crypto.publicRsa) on `crypto` with `key` = call [`SigningKeys.provider`](../common/keys.md#symbol-SigningKeys.provider) on `keys`.
+- Return call [`RsaJwks`](../dependencies/august/0.19.0/crypto/jose.md#symbol-RsaJwks) with `keys` = a list containing call [`rsaJwk`](../dependencies/august/0.19.0/crypto/jose.md#symbol-rsaJwk) with `publicKey` = `publicKey`; `kid` = `"provider-1"`; inject `crypto` from `crypto`.
+
+**Author documentation**
+
+Only the provider's public signing key is published. Session keys never enter this JWKS.
+
+### Dependencies used by this file
+
+Only referenced types and operations appear here. Each name links to its complete specification.
+
+#### [`Crypto`](../dependencies/august/0.19.0/crypto/contracts.md#symbol-Crypto)
+
+Capability interface from `august.crypto`.
+
+- [`Crypto.exportRsa`](../dependencies/august/0.19.0/crypto/contracts.md#symbol-Crypto.exportRsa) (`publicKey`: `RsaPublicKey`) → `Tuple<Bytes,Bytes>`; can fail with `CryptoError`.
+- [`Crypto.publicRsa`](../dependencies/august/0.19.0/crypto/contracts.md#symbol-Crypto.publicRsa) (`key`: `RsaPrivateKey`) → `RsaPublicKey`; can fail with `CryptoError`.
+
+#### [`RsaJwks`](../dependencies/august/0.19.0/crypto/jose.md#symbol-RsaJwks)
+
+Record from `august.crypto`.
+
+- Construct with `keys`: `List<RsaJwk>` → [`RsaJwks`](../dependencies/august/0.19.0/crypto/jose.md#symbol-RsaJwks).
+
+#### [`rsaJwk`](../dependencies/august/0.19.0/crypto/jose.md#symbol-rsaJwk)
+
+Function from `august.crypto`.
+
+- [`rsaJwk`](../dependencies/august/0.19.0/crypto/jose.md#symbol-rsaJwk) (`publicKey`: `RsaPublicKey`, `kid`: `string`) → [`RsaJwk`](../dependencies/august/0.19.0/crypto/jose.md#symbol-RsaJwk); inject `crypto`: [`Crypto`](../dependencies/august/0.19.0/crypto/contracts.md#symbol-Crypto); uses [`crypto.exportRsa`](../dependencies/august/0.19.0/crypto/contracts.md#symbol-Crypto.exportRsa); can fail with `CryptoError`.
+
+#### [`KeyError`](../common/keys.md#symbol-KeyError)
+
+Class from `common`.
+
+Used as a type or provider.
+
+#### [`SigningKeys`](../common/keys.md#symbol-SigningKeys)
+
+Capability interface from `common`.
+
+- [`SigningKeys.provider`](../common/keys.md#symbol-SigningKeys.provider) (no caller inputs) → `RsaPrivateKey`; can fail with `KeyError`.
+
+#### [`Settings`](../common/settings.md#symbol-Settings)
+
+Record.
+
+- Read `issuer` (`string`).
+
+#### [`settings`](../common/settings.md#symbol-settings)
+
+Function from `common`.
+
+- [`settings`](../common/settings.md#symbol-settings) (no caller inputs) → [`Settings`](../common/settings.md#symbol-Settings).
+
+### Shared language rules
+
+See the [language reference](https://greenpandastudios.github.io/augscript/reference) for numeric, equality, ownership, and task rules.
+
+::::
+
+:::::