@greenpandastudios/aug-cli 0.19.0

package/examples/oidc-login/.aug-spec/august/0.19.0/crypto/contracts.aug.md

@@ -0,0 +1,791 @@
+<!-- Generated by aug spec. Edit the August source, then regenerate. -->
+
+# `contracts.aug` specification
+
+August 0.19.0. This document is compiled from checked code with deterministic wording guided by Simplified Technical English.
+
+## In this file
+
+- [`Crypto`](contracts.aug.md#symbol-Crypto) is a capability interface.
+- [`_aug_crypto_random`](contracts.aug.md#symbol-_aug_crypto_random) is a function returning `Bytes`.
+- [`_aug_crypto_sha256`](contracts.aug.md#symbol-_aug_crypto_sha256) is a function returning `Bytes`.
+- [`_aug_crypto_generate_rsa`](contracts.aug.md#symbol-_aug_crypto_generate_rsa) is a function returning `RsaPrivateKey`.
+- [`_aug_crypto_public_rsa`](contracts.aug.md#symbol-_aug_crypto_public_rsa) is a function returning `RsaPublicKey`.
+- [`_aug_crypto_sign_rsa`](contracts.aug.md#symbol-_aug_crypto_sign_rsa) is a function returning `Bytes`.
+- [`_aug_crypto_verify_rsa`](contracts.aug.md#symbol-_aug_crypto_verify_rsa) is a function returning `bool`.
+- [`_aug_crypto_decode_base64url`](contracts.aug.md#symbol-_aug_crypto_decode_base64url) is a function returning `Bytes`.
+- [`_aug_crypto_equal`](contracts.aug.md#symbol-_aug_crypto_equal) is a function returning `bool`.
+- [`_aug_crypto_export_rsa`](contracts.aug.md#symbol-_aug_crypto_export_rsa) is a function returning `Tuple<Bytes,Bytes>`.
+- [`_aug_crypto_import_rsa`](contracts.aug.md#symbol-_aug_crypto_import_rsa) is a function returning `RsaPublicKey`.
+- [`_aug_crypto_password_hash`](contracts.aug.md#symbol-_aug_crypto_password_hash) is a function returning `Bytes`.
+- [`GnuTlsCrypto`](contracts.aug.md#symbol-GnuTlsCrypto) is a class implementing `Crypto`.
+
+<a id="symbol-Crypto"></a>
+
+## `Crypto`
+
+[source](contracts.aug#L3)
+
+Capability interface.
+
+**Author documentation**
+
+Explicit permission for native cryptographic operations. Keys and bytes are immutable.
+
+<a id="symbol-Crypto.random"></a>
+
+### `Crypto.random`
+
+[source](contracts.aug#L5)
+
+**Inputs**
+
+- `size` (`int`) — required labeled input.
+
+Returns: `Bytes`.
+
+Capabilities: [`Crypto.random`](contracts.aug.md#symbol-Crypto.random).
+
+Can fail with `CryptoError`. Callers must catch or propagate these errors.
+
+Interface contract. A selected implementation supplies the behavior.
+
+**Author documentation**
+
+Generate unpredictable bytes with the operating-system-backed GnuTLS RNG.
+
+<a id="symbol-Crypto.sha256"></a>
+
+### `Crypto.sha256`
+
+[source](contracts.aug#L7)
+
+**Inputs**
+
+- `input` (`Bytes`) — required labeled input.
+
+Returns: `Bytes`.
+
+Capabilities: [`Crypto.sha256`](contracts.aug.md#symbol-Crypto.sha256).
+
+Can fail with `CryptoError`. Callers must catch or propagate these errors.
+
+Interface contract. A selected implementation supplies the behavior.
+
+**Author documentation**
+
+Hash the complete input using SHA-256.
+
+<a id="symbol-Crypto.generateRsa"></a>
+
+### `Crypto.generateRsa`
+
+[source](contracts.aug#L9)
+
+Returns: `RsaPrivateKey`.
+
+Capabilities: [`Crypto.generateRsa`](contracts.aug.md#symbol-Crypto.generateRsa).
+
+Can fail with `CryptoError`. Callers must catch or propagate these errors.
+
+Interface contract. A selected implementation supplies the behavior.
+
+**Author documentation**
+
+Create a fresh 3072-bit RSA private key. Private material is opaque and scrubbed on reclamation.
+
+<a id="symbol-Crypto.publicRsa"></a>
+
+### `Crypto.publicRsa`
+
+[source](contracts.aug#L11)
+
+**Inputs**
+
+- `key` (`RsaPrivateKey`) — required labeled input.
+
+Returns: `RsaPublicKey`.
+
+Capabilities: [`Crypto.publicRsa`](contracts.aug.md#symbol-Crypto.publicRsa).
+
+Can fail with `CryptoError`. Callers must catch or propagate these errors.
+
+Interface contract. A selected implementation supplies the behavior.
+
+**Author documentation**
+
+Export the corresponding public key as an opaque immutable value.
+
+<a id="symbol-Crypto.signRsa"></a>
+
+### `Crypto.signRsa`
+
+[source](contracts.aug#L13)
+
+**Inputs**
+
+- `key` (`RsaPrivateKey`) — required labeled input.
+- `input` (`Bytes`) — required labeled input.
+
+Returns: `Bytes`.
+
+Capabilities: [`Crypto.signRsa`](contracts.aug.md#symbol-Crypto.signRsa).
+
+Can fail with `CryptoError`. Callers must catch or propagate these errors.
+
+Interface contract. A selected implementation supplies the behavior.
+
+**Author documentation**
+
+Sign bytes using RSASSA-PKCS1-v1_5 with SHA-256 (JOSE RS256).
+
+<a id="symbol-Crypto.verifyRsa"></a>
+
+### `Crypto.verifyRsa`
+
+[source](contracts.aug#L15)
+
+**Inputs**
+
+- `publicKey` (`RsaPublicKey`) — required labeled input.
+- `input` (`Bytes`) — required labeled input.
+- `signature` (`Bytes`) — required labeled input.
+
+Returns: `bool`.
+
+Capabilities: [`Crypto.verifyRsa`](contracts.aug.md#symbol-Crypto.verifyRsa).
+
+Can fail with `CryptoError`. Callers must catch or propagate these errors.
+
+Interface contract. A selected implementation supplies the behavior.
+
+**Author documentation**
+
+Verify only RS256. Invalid signatures return false; invalid keys raise CryptoError.
+
+<a id="symbol-Crypto.decodeBase64url"></a>
+
+### `Crypto.decodeBase64url`
+
+[source](contracts.aug#L17)
+
+**Inputs**
+
+- `input` (`string`) — required labeled input.
+
+Returns: `Bytes`.
+
+Capabilities: [`Crypto.decodeBase64url`](contracts.aug.md#symbol-Crypto.decodeBase64url).
+
+Can fail with `CryptoError`. Callers must catch or propagate these errors.
+
+Interface contract. A selected implementation supplies the behavior.
+
+**Author documentation**
+
+Decode canonical unpadded URL-safe base64, rejecting invalid characters and unused bits.
+
+<a id="symbol-Crypto.equal"></a>
+
+### `Crypto.equal`
+
+[source](contracts.aug#L19)
+
+**Inputs**
+
+- `left` (`Bytes`) — required labeled input.
+- `right` (`Bytes`) — required labeled input.
+
+Returns: `bool`.
+
+Capabilities: [`Crypto.equal`](contracts.aug.md#symbol-Crypto.equal).
+
+Interface contract. A selected implementation supplies the behavior.
+
+**Author documentation**
+
+Compare bytes without early exit on their contents. Length remains observable.
+
+<a id="symbol-Crypto.exportRsa"></a>
+
+### `Crypto.exportRsa`
+
+[source](contracts.aug#L21)
+
+**Inputs**
+
+- `publicKey` (`RsaPublicKey`) — required labeled input.
+
+Returns: `Tuple<Bytes,Bytes>`.
+
+Capabilities: [`Crypto.exportRsa`](contracts.aug.md#symbol-Crypto.exportRsa).
+
+Can fail with `CryptoError`. Callers must catch or propagate these errors.
+
+Interface contract. A selected implementation supplies the behavior.
+
+**Author documentation**
+
+Export unsigned big-endian modulus and exponent for an RSA JWK.
+
+<a id="symbol-Crypto.importRsa"></a>
+
+### `Crypto.importRsa`
+
+[source](contracts.aug#L23)
+
+**Inputs**
+
+- `modulus` (`Bytes`) — required labeled input.
+- `exponent` (`Bytes`) — required labeled input.
+
+Returns: `RsaPublicKey`.
+
+Capabilities: [`Crypto.importRsa`](contracts.aug.md#symbol-Crypto.importRsa).
+
+Can fail with `CryptoError`. Callers must catch or propagate these errors.
+
+Interface contract. A selected implementation supplies the behavior.
+
+**Author documentation**
+
+Import canonical public RSA parameters. Keys must have 2048 to 8192 bits.
+
+<a id="symbol-Crypto.passwordHash"></a>
+
+### `Crypto.passwordHash`
+
+[source](contracts.aug#L25)
+
+**Inputs**
+
+- `password` (`Bytes`) — required labeled input.
+- `salt` (`Bytes`) — required labeled input.
+- `iterations` (`int`) — required labeled input.
+
+Returns: `Bytes`.
+
+Capabilities: [`Crypto.passwordHash`](contracts.aug.md#symbol-Crypto.passwordHash).
+
+Can fail with `CryptoError`. Callers must catch or propagate these errors.
+
+Interface contract. A selected implementation supplies the behavior.
+
+**Author documentation**
+
+PBKDF2-HMAC-SHA256, producing 32 bytes. Use a unique 16–64 byte salt; supported work factors are 100,000–2,000,000.
+
+<a id="symbol-GnuTlsCrypto"></a>
+
+## `GnuTlsCrypto`
+
+[source](contracts.aug#L40)
+
+Behavioral class.
+
+Satisfies [`Crypto`](contracts.aug.md#symbol-Crypto).
+
+**Author documentation**
+
+GnuTLS-backed capability adapter. Its constructor performs no I/O or key generation.
+
+<a id="symbol-GnuTlsCrypto.random"></a>
+
+### `GnuTlsCrypto.random`
+
+[source](contracts.aug#L41)
+
+**Inputs**
+
+- `size` (`int`) — required labeled input.
+
+Returns: `Bytes`.
+
+Capabilities: [`Crypto.random`](contracts.aug.md#symbol-Crypto.random).
+
+Can fail with `CryptoError`. Callers must catch or propagate these errors.
+
+**What it does**
+
+- Enter an unsafe boundary. Native calls use their declared contracts; their foreign implementation is outside this specification:
+  - Return call [`_aug_crypto_random`](contracts.aug.md#symbol-_aug_crypto_random) with `size` = `size`.
+
+**Author documentation**
+
+Generate unpredictable bytes with the operating-system-backed GnuTLS RNG.
+
+<a id="symbol-GnuTlsCrypto.sha256"></a>
+
+### `GnuTlsCrypto.sha256`
+
+[source](contracts.aug#L44)
+
+**Inputs**
+
+- `input` (`Bytes`) — required labeled input.
+
+Returns: `Bytes`.
+
+Capabilities: [`Crypto.sha256`](contracts.aug.md#symbol-Crypto.sha256).
+
+Can fail with `CryptoError`. Callers must catch or propagate these errors.
+
+**What it does**
+
+- Enter an unsafe boundary. Native calls use their declared contracts; their foreign implementation is outside this specification:
+  - Return call [`_aug_crypto_sha256`](contracts.aug.md#symbol-_aug_crypto_sha256) with `input` = `input`.
+
+**Author documentation**
+
+Hash the complete input using SHA-256.
+
+<a id="symbol-GnuTlsCrypto.generateRsa"></a>
+
+### `GnuTlsCrypto.generateRsa`
+
+[source](contracts.aug#L47)
+
+Returns: `RsaPrivateKey`.
+
+Capabilities: [`Crypto.generateRsa`](contracts.aug.md#symbol-Crypto.generateRsa).
+
+Can fail with `CryptoError`. Callers must catch or propagate these errors.
+
+**What it does**
+
+- Enter an unsafe boundary. Native calls use their declared contracts; their foreign implementation is outside this specification:
+  - Return call [`_aug_crypto_generate_rsa`](contracts.aug.md#symbol-_aug_crypto_generate_rsa).
+
+**Author documentation**
+
+Create a fresh 3072-bit RSA private key. Private material is opaque and scrubbed on reclamation.
+
+<a id="symbol-GnuTlsCrypto.publicRsa"></a>
+
+### `GnuTlsCrypto.publicRsa`
+
+[source](contracts.aug#L50)
+
+**Inputs**
+
+- `key` (`RsaPrivateKey`) — required labeled input.
+
+Returns: `RsaPublicKey`.
+
+Capabilities: [`Crypto.publicRsa`](contracts.aug.md#symbol-Crypto.publicRsa).
+
+Can fail with `CryptoError`. Callers must catch or propagate these errors.
+
+**What it does**
+
+- Enter an unsafe boundary. Native calls use their declared contracts; their foreign implementation is outside this specification:
+  - Return call [`_aug_crypto_public_rsa`](contracts.aug.md#symbol-_aug_crypto_public_rsa) with `key` = `key`.
+
+**Author documentation**
+
+Export the corresponding public key as an opaque immutable value.
+
+<a id="symbol-GnuTlsCrypto.signRsa"></a>
+
+### `GnuTlsCrypto.signRsa`
+
+[source](contracts.aug#L53)
+
+**Inputs**
+
+- `key` (`RsaPrivateKey`) — required labeled input.
+- `input` (`Bytes`) — required labeled input.
+
+Returns: `Bytes`.
+
+Capabilities: [`Crypto.signRsa`](contracts.aug.md#symbol-Crypto.signRsa).
+
+Can fail with `CryptoError`. Callers must catch or propagate these errors.
+
+**What it does**
+
+- Enter an unsafe boundary. Native calls use their declared contracts; their foreign implementation is outside this specification:
+  - Return call [`_aug_crypto_sign_rsa`](contracts.aug.md#symbol-_aug_crypto_sign_rsa) with `key` = `key`; `input` = `input`.
+
+**Author documentation**
+
+Sign bytes using RSASSA-PKCS1-v1_5 with SHA-256 (JOSE RS256).
+
+<a id="symbol-GnuTlsCrypto.verifyRsa"></a>
+
+### `GnuTlsCrypto.verifyRsa`
+
+[source](contracts.aug#L56)
+
+**Inputs**
+
+- `publicKey` (`RsaPublicKey`) — required labeled input.
+- `input` (`Bytes`) — required labeled input.
+- `signature` (`Bytes`) — required labeled input.
+
+Returns: `bool`.
+
+Capabilities: [`Crypto.verifyRsa`](contracts.aug.md#symbol-Crypto.verifyRsa).
+
+Can fail with `CryptoError`. Callers must catch or propagate these errors.
+
+**What it does**
+
+- Enter an unsafe boundary. Native calls use their declared contracts; their foreign implementation is outside this specification:
+  - Return call [`_aug_crypto_verify_rsa`](contracts.aug.md#symbol-_aug_crypto_verify_rsa) with `publicKey` = `publicKey`; `input` = `input`; `signature` = `signature`.
+
+**Author documentation**
+
+Verify only RS256. Invalid signatures return false; invalid keys raise CryptoError.
+
+<a id="symbol-GnuTlsCrypto.decodeBase64url"></a>
+
+### `GnuTlsCrypto.decodeBase64url`
+
+[source](contracts.aug#L59)
+
+**Inputs**
+
+- `input` (`string`) — required labeled input.
+
+Returns: `Bytes`.
+
+Capabilities: [`Crypto.decodeBase64url`](contracts.aug.md#symbol-Crypto.decodeBase64url).
+
+Can fail with `CryptoError`. Callers must catch or propagate these errors.
+
+**What it does**
+
+- Enter an unsafe boundary. Native calls use their declared contracts; their foreign implementation is outside this specification:
+  - Return call [`_aug_crypto_decode_base64url`](contracts.aug.md#symbol-_aug_crypto_decode_base64url) with `input` = `input`.
+
+**Author documentation**
+
+Decode canonical unpadded URL-safe base64, rejecting invalid characters and unused bits.
+
+<a id="symbol-GnuTlsCrypto.equal"></a>
+
+### `GnuTlsCrypto.equal`
+
+[source](contracts.aug#L62)
+
+**Inputs**
+
+- `left` (`Bytes`) — required labeled input.
+- `right` (`Bytes`) — required labeled input.
+
+Returns: `bool`.
+
+Capabilities: [`Crypto.equal`](contracts.aug.md#symbol-Crypto.equal).
+
+**What it does**
+
+- Enter an unsafe boundary. Native calls use their declared contracts; their foreign implementation is outside this specification:
+  - Return call [`_aug_crypto_equal`](contracts.aug.md#symbol-_aug_crypto_equal) with `left` = `left`; `right` = `right`.
+
+**Author documentation**
+
+Compare bytes without early exit on their contents. Length remains observable.
+
+<a id="symbol-GnuTlsCrypto.exportRsa"></a>
+
+### `GnuTlsCrypto.exportRsa`
+
+[source](contracts.aug#L65)
+
+**Inputs**
+
+- `publicKey` (`RsaPublicKey`) — required labeled input.
+
+Returns: `Tuple<Bytes,Bytes>`.
+
+Capabilities: [`Crypto.exportRsa`](contracts.aug.md#symbol-Crypto.exportRsa).
+
+Can fail with `CryptoError`. Callers must catch or propagate these errors.
+
+**What it does**
+
+- Enter an unsafe boundary. Native calls use their declared contracts; their foreign implementation is outside this specification:
+  - Return call [`_aug_crypto_export_rsa`](contracts.aug.md#symbol-_aug_crypto_export_rsa) with `publicKey` = `publicKey`.
+
+**Author documentation**
+
+Export unsigned big-endian modulus and exponent for an RSA JWK.
+
+<a id="symbol-GnuTlsCrypto.importRsa"></a>
+
+### `GnuTlsCrypto.importRsa`
+
+[source](contracts.aug#L68)
+
+**Inputs**
+
+- `modulus` (`Bytes`) — required labeled input.
+- `exponent` (`Bytes`) — required labeled input.
+
+Returns: `RsaPublicKey`.
+
+Capabilities: [`Crypto.importRsa`](contracts.aug.md#symbol-Crypto.importRsa).
+
+Can fail with `CryptoError`. Callers must catch or propagate these errors.
+
+**What it does**
+
+- Enter an unsafe boundary. Native calls use their declared contracts; their foreign implementation is outside this specification:
+  - Return call [`_aug_crypto_import_rsa`](contracts.aug.md#symbol-_aug_crypto_import_rsa) with `modulus` = `modulus`; `exponent` = `exponent`.
+
+**Author documentation**
+
+Import canonical public RSA parameters. Keys must have 2048 to 8192 bits.
+
+<a id="symbol-GnuTlsCrypto.passwordHash"></a>
+
+### `GnuTlsCrypto.passwordHash`
+
+[source](contracts.aug#L71)
+
+**Inputs**
+
+- `password` (`Bytes`) — required labeled input.
+- `salt` (`Bytes`) — required labeled input.
+- `iterations` (`int`) — required labeled input.
+
+Returns: `Bytes`.
+
+Capabilities: [`Crypto.passwordHash`](contracts.aug.md#symbol-Crypto.passwordHash).
+
+Can fail with `CryptoError`. Callers must catch or propagate these errors.
+
+**What it does**
+
+- Enter an unsafe boundary. Native calls use their declared contracts; their foreign implementation is outside this specification:
+  - Return call [`_aug_crypto_password_hash`](contracts.aug.md#symbol-_aug_crypto_password_hash) with `password` = `password`; `salt` = `salt`; `iterations` = `iterations`.
+
+**Author documentation**
+
+PBKDF2-HMAC-SHA256, producing 32 bytes. Use a unique 16–64 byte salt; supported work factors are 100,000–2,000,000.
+
+<a id="symbol-_aug_crypto_random"></a>
+
+## `_aug_crypto_random`
+
+[source](contracts.aug#L27)
+
+Private to its defining scope.
+
+**Inputs**
+
+- `size` (`int`) — required labeled input.
+
+Returns: `Bytes`.
+
+Capabilities: [`Crypto.random`](contracts.aug.md#symbol-Crypto.random).
+
+Can fail with `CryptoError`. Callers must catch or propagate these errors.
+
+Native C operation. Its declared inputs, result, effects, and errors are the visible contract. The C implementation is outside this specification.
+
+<a id="symbol-_aug_crypto_sha256"></a>
+
+## `_aug_crypto_sha256`
+
+[source](contracts.aug#L28)
+
+Private to its defining scope.
+
+**Inputs**
+
+- `input` (`Bytes`) — required labeled input.
+
+Returns: `Bytes`.
+
+Capabilities: [`Crypto.sha256`](contracts.aug.md#symbol-Crypto.sha256).
+
+Can fail with `CryptoError`. Callers must catch or propagate these errors.
+
+Native C operation. Its declared inputs, result, effects, and errors are the visible contract. The C implementation is outside this specification.
+
+<a id="symbol-_aug_crypto_generate_rsa"></a>
+
+## `_aug_crypto_generate_rsa`
+
+[source](contracts.aug#L29)
+
+Private to its defining scope.
+
+Returns: `RsaPrivateKey`.
+
+Capabilities: [`Crypto.generateRsa`](contracts.aug.md#symbol-Crypto.generateRsa).
+
+Can fail with `CryptoError`. Callers must catch or propagate these errors.
+
+Native C operation. Its declared inputs, result, effects, and errors are the visible contract. The C implementation is outside this specification.
+
+<a id="symbol-_aug_crypto_public_rsa"></a>
+
+## `_aug_crypto_public_rsa`
+
+[source](contracts.aug#L30)
+
+Private to its defining scope.
+
+**Inputs**
+
+- `key` (`RsaPrivateKey`) — required labeled input.
+
+Returns: `RsaPublicKey`.
+
+Capabilities: [`Crypto.publicRsa`](contracts.aug.md#symbol-Crypto.publicRsa).
+
+Can fail with `CryptoError`. Callers must catch or propagate these errors.
+
+Native C operation. Its declared inputs, result, effects, and errors are the visible contract. The C implementation is outside this specification.
+
+<a id="symbol-_aug_crypto_sign_rsa"></a>
+
+## `_aug_crypto_sign_rsa`
+
+[source](contracts.aug#L31)
+
+Private to its defining scope.
+
+**Inputs**
+
+- `key` (`RsaPrivateKey`) — required labeled input.
+- `input` (`Bytes`) — required labeled input.
+
+Returns: `Bytes`.
+
+Capabilities: [`Crypto.signRsa`](contracts.aug.md#symbol-Crypto.signRsa).
+
+Can fail with `CryptoError`. Callers must catch or propagate these errors.
+
+Native C operation. Its declared inputs, result, effects, and errors are the visible contract. The C implementation is outside this specification.
+
+<a id="symbol-_aug_crypto_verify_rsa"></a>
+
+## `_aug_crypto_verify_rsa`
+
+[source](contracts.aug#L32)
+
+Private to its defining scope.
+
+**Inputs**
+
+- `publicKey` (`RsaPublicKey`) — required labeled input.
+- `input` (`Bytes`) — required labeled input.
+- `signature` (`Bytes`) — required labeled input.
+
+Returns: `bool`.
+
+Capabilities: [`Crypto.verifyRsa`](contracts.aug.md#symbol-Crypto.verifyRsa).
+
+Can fail with `CryptoError`. Callers must catch or propagate these errors.
+
+Native C operation. Its declared inputs, result, effects, and errors are the visible contract. The C implementation is outside this specification.
+
+<a id="symbol-_aug_crypto_decode_base64url"></a>
+
+## `_aug_crypto_decode_base64url`
+
+[source](contracts.aug#L33)
+
+Private to its defining scope.
+
+**Inputs**
+
+- `input` (`string`) — required labeled input.
+
+Returns: `Bytes`.
+
+Capabilities: [`Crypto.decodeBase64url`](contracts.aug.md#symbol-Crypto.decodeBase64url).
+
+Can fail with `CryptoError`. Callers must catch or propagate these errors.
+
+Native C operation. Its declared inputs, result, effects, and errors are the visible contract. The C implementation is outside this specification.
+
+<a id="symbol-_aug_crypto_equal"></a>
+
+## `_aug_crypto_equal`
+
+[source](contracts.aug#L34)
+
+Private to its defining scope.
+
+**Inputs**
+
+- `left` (`Bytes`) — required labeled input.
+- `right` (`Bytes`) — required labeled input.
+
+Returns: `bool`.
+
+Capabilities: [`Crypto.equal`](contracts.aug.md#symbol-Crypto.equal).
+
+Native C operation. Its declared inputs, result, effects, and errors are the visible contract. The C implementation is outside this specification.
+
+<a id="symbol-_aug_crypto_export_rsa"></a>
+
+## `_aug_crypto_export_rsa`
+
+[source](contracts.aug#L35)
+
+Private to its defining scope.
+
+**Inputs**
+
+- `publicKey` (`RsaPublicKey`) — required labeled input.
+
+Returns: `Tuple<Bytes,Bytes>`.
+
+Capabilities: [`Crypto.exportRsa`](contracts.aug.md#symbol-Crypto.exportRsa).
+
+Can fail with `CryptoError`. Callers must catch or propagate these errors.
+
+Native C operation. Its declared inputs, result, effects, and errors are the visible contract. The C implementation is outside this specification.
+
+<a id="symbol-_aug_crypto_import_rsa"></a>
+
+## `_aug_crypto_import_rsa`
+
+[source](contracts.aug#L36)
+
+Private to its defining scope.
+
+**Inputs**
+
+- `modulus` (`Bytes`) — required labeled input.
+- `exponent` (`Bytes`) — required labeled input.
+
+Returns: `RsaPublicKey`.
+
+Capabilities: [`Crypto.importRsa`](contracts.aug.md#symbol-Crypto.importRsa).
+
+Can fail with `CryptoError`. Callers must catch or propagate these errors.
+
+Native C operation. Its declared inputs, result, effects, and errors are the visible contract. The C implementation is outside this specification.
+
+<a id="symbol-_aug_crypto_password_hash"></a>
+
+## `_aug_crypto_password_hash`
+
+[source](contracts.aug#L37)
+
+Private to its defining scope.
+
+**Inputs**
+
+- `password` (`Bytes`) — required labeled input.
+- `salt` (`Bytes`) — required labeled input.
+- `iterations` (`int`) — required labeled input.
+
+Returns: `Bytes`.
+
+Capabilities: [`Crypto.passwordHash`](contracts.aug.md#symbol-Crypto.passwordHash).
+
+Can fail with `CryptoError`. Callers must catch or propagate these errors.
+
+Native C operation. Its declared inputs, result, effects, and errors are the visible contract. The C implementation is outside this specification.
+
+## Shared language rules
+
+See the [language reference](https://greenpandastudios.github.io/augscript/reference) for numeric, equality, ownership, and task rules.