client data flow

This view opens the client folder one level deeper. Each arrow shows the called operation and the data it returns to its caller. Calls inside a file stay in that file’s sequence view.

endpoints request flow

100%

Mermaid source

flowchart TD
    n0["HTTP requests"]
    n1["endpoints"]
    n2["logout"]
    n3["session"]
    n4["views"]
    n5["common"]
    n0 -->|"2 HTTP routes → Html response / UserInfo response"| n1
    n1 -->|"authenticate(token) → SessionClaims"| n3
    n1 -->|"LoginPage / Welcome(session) → Html"| n4
    n1 -->|"securityHeaders → Headers"| n5
    n3 -->|"SigningKeys.session / settings → RsaPrivateKey / Settings"| n5
    n4 -.->|"on submission: POST /logout(input, token, …)"| n2
    n4 -->|"Page(title, children) → Html"| n5

100%

Mermaid source

flowchart TD
    n0["HTTP requests"]
    n1["login"]
    n2["protocol"]
    n3["common"]
    n0 -->|"2 HTTP routes → Html response"| n1
    n1 -->|"discover / responseJson(response) + 1 more → Discovery / IdClaims + 1 more"| n2
    n1 -->|"SigningKeys.session / securityHeaders + 2 more → Headers / RsaPrivateKey + 1 more"| n3
    n2 -->|"settings → Settings"| n3

logout request flow

100%

Mermaid source

flowchart TD
    n0["HTTP requests"]
    n1["logout"]
    n2["session"]
    n3["common"]
    n0 -->|"POST /logout(input, token, …) → Html response"| n1
    n1 -->|"authenticate(token) → SessionClaims"| n2
    n1 -->|"securityHeaders / settings + 1 more → Headers / Settings"| n3
    n2 -->|"SigningKeys.session / settings → RsaPrivateKey / Settings"| n3

Package boundaries

100%

Mermaid source

flowchart LR
    n0["login"]
    n1["memory"]
    n2["web"]
    n3["crypto"]
    n4["time"]
    n0 -->|"ExpiringStore.put(key, value, …) / ExpiringStore.take(key, now) → optional LoginTransaction"| n1
    n0 -->|"HttpClient.request(method, url, …) / urlEncode(input) → Bytes response / string"| n2
    n0 -->|"Crypto.equal(left, right) / Crypto.random(size) + 2 more → Bytes / bool + 1 more"| n3
    n0 -->|"Clock.now → int"| n4

logout package calls

100%

Mermaid source

flowchart LR
    n0["logout"]
    n1["memory"]
    n2["crypto"]
    n3["time"]
    n0 -->|"ExpiringStore.take(key, now) → optional SessionClaims"| n1
    n0 -->|"Crypto.equal(left, right) → bool"| n2
    n0 -->|"Clock.now → int"| n3

protocol package calls

100%

Mermaid source

flowchart LR
    n0["protocol"]
    n1["json"]
    n2["web"]
    n3["crypto"]
    n0 -->|"parse(input) → Json"| n1
    n0 -->|"HttpClient.request(method, url, …) → Bytes response"| n2
    n0 -->|"Crypto.equal(left, right) / importJwk(jwk) + 1 more → Json / RsaPublicKey + 1 more"| n3

session package calls

100%

Mermaid source

flowchart LR
    n0["session"]
    n1["memory"]
    n2["crypto"]
    n3["time"]
    n0 -->|"ExpiringStore.get(key, now) → optional SessionClaims"| n1
    n0 -->|"Crypto.equal(left, right) / Crypto.publicRsa(key) + 1 more → Json / RsaPublicKey + 1 more"| n2
    n0 -->|"Clock.now → int"| n3

Follow the data

Each row opens the complete operations and call sites behind one pair of logical units. A grouped arrow records calls between those units; connected arrows need not belong to the same execution path.

From	To	Operations	Read
HTTP requests	endpoints	2	Inputs, results and call sites
HTTP requests	login	2	Inputs, results and call sites
HTTP requests	logout	1	Inputs, results and call sites
endpoints	session	1	Inputs, results and call sites
endpoints	views	2	Inputs, results and call sites
endpoints	common	1	Inputs, results and call sites
endpoints	provider	1	Inputs, results and call sites
login	contracts	3	Inputs, results and call sites
login	protocol	3	Inputs, results and call sites
login	common	4	Inputs, results and call sites
login	memory	3	Inputs, results and call sites
login	web	4	Inputs, results and call sites
login	crypto	4	Inputs, results and call sites
login	time	1	Inputs, results and call sites
logout	contracts	1	Inputs, results and call sites
logout	session	1	Inputs, results and call sites
logout	common	3	Inputs, results and call sites
logout	memory	1	Inputs, results and call sites
logout	crypto	1	Inputs, results and call sites
logout	time	1	Inputs, results and call sites
protocol	contracts	1	Inputs, results and call sites
protocol	common	1	Inputs, results and call sites
protocol	json	1	Inputs, results and call sites
protocol	web	1	Inputs, results and call sites
protocol	crypto	8	Inputs, results and call sites
protocol	provider	1	Inputs, results and call sites
session	contracts	1	Inputs, results and call sites
session	common	2	Inputs, results and call sites
session	memory	1	Inputs, results and call sites
session	crypto	3	Inputs, results and call sites
session	time	1	Inputs, results and call sites
views	logout	1	Inputs, results and call sites
views	common	1	Inputs, results and call sites

Data crossing these boundaries (63 contracts)

HTTP requests → endpoints

2 operations, 2 sites

GET / · HTTP endpoint

Inputs: token: optional string from cookie. Result: HttpResponse<Html>.

Caller or entry	Evidence
HTTP requests	Declaration · Caller explanation

GET /me · HTTP endpoint

Inputs: token: optional string from cookie. Result: HttpResponse<UserInfo>.

Caller or entry	Evidence
HTTP requests	Declaration · Caller explanation

HTTP requests → login

2 operations, 2 sites

GET /login/callback · HTTP endpoint

Inputs: code: string from query, state: string from query, browser: optional string from cookie. Result: HttpResponse<Html>.

Caller or entry	Evidence
HTTP requests	Declaration · Caller explanation

GET /login/start · HTTP endpoint

No caller-supplied inputs. Result: HttpResponse<Html>.

Caller or entry	Evidence
HTTP requests	Declaration · Caller explanation

HTTP requests → logout

1 operation, 1 site

POST /logout · HTTP endpoint

Inputs: input: LogoutForm from form, token: optional string from cookie, origin: optional string from header. Result: HttpResponse<Html>.

Caller or entry	Evidence
HTTP requests	Declaration · Caller explanation

endpoints → session

1 operation, 2 sites

authenticate

Inputs: token: optional string. Result: SessionClaims.

Caller or entry	Evidence
home	Call site · Caller explanation
me	Call site · Caller explanation

endpoints → views

2 operations, 2 sites

LoginPage

No caller-supplied inputs. Result: Html.

Caller or entry	Evidence
home	Call site · Caller explanation

Welcome

Inputs: session: SessionClaims. Result: Html.

Caller or entry	Evidence
home	Call site · Caller explanation

endpoints → common

1 operation, 3 sites

securityHeaders

No caller-supplied inputs. Result: Headers.

Caller or entry	Evidence
home	Call site · Caller explanation
home	Call site · Caller explanation
me	Call site · Caller explanation

endpoints → provider

1 operation, 1 site

UserInfo · value construction

Inputs: sub: string, name: string. Result: UserInfo.

Caller or entry	Evidence
me	Call site · Caller explanation

login → contracts

3 operations, 8 sites

LoginTransaction · value construction

Inputs: state: string, nonce: string, verifier: string, expires: int. Result: LoginTransaction.

Caller or entry	Evidence
startLogin	Call site · Caller explanation

SessionClaims · value construction

Inputs: iss: string, sub: string, aud: string, exp: int, iat: int, jti: string, csrf: string, name: string. Result: SessionClaims.

Caller or entry	Evidence
loginCallback	Call site · Caller explanation

SessionError · value construction

No caller-supplied inputs. Result: SessionError.

Caller or entry	Evidence
loginCallback	Call site · Caller explanation
loginCallback	Call site · Caller explanation
loginCallback	Call site · Caller explanation
loginCallback	Call site · Caller explanation
loginCallback	Call site · Caller explanation
loginCallback	Call site · Caller explanation

login → protocol

3 operations, 6 sites

discover

No caller-supplied inputs. Result: Discovery.

Caller or entry	Evidence
startLogin	Call site · Caller explanation
loginCallback	Call site · Caller explanation

responseJson

Inputs: response: HttpResponse<Bytes>. Result: Json.

Caller or entry	Evidence
loginCallback	Call site · Caller explanation
loginCallback	Call site · Caller explanation
loginCallback	Call site · Caller explanation

validateIdentity

Inputs: token: string, nonce: string, now: int, jwks: RsaJwks. Result: IdClaims.

Caller or entry	Evidence
loginCallback	Call site · Caller explanation

login → common

4 operations, 8 sites

SigningKeys.session · interface dispatch

No caller-supplied inputs. Result: RsaPrivateKey.

Caller or entry	Evidence
loginCallback	Call site · Caller explanation

securityHeaders

No caller-supplied inputs. Result: Headers.

Caller or entry	Evidence
startLogin	Call site · Caller explanation
loginCallback	Call site · Caller explanation

settings

No caller-supplied inputs. Result: Settings.

Caller or entry	Evidence
startLogin	Call site · Caller explanation
loginCallback	Call site · Caller explanation

withCookie

Inputs: headers: Headers, name: string, value: string, path: string, maxAge: int, secure: bool. Result: Headers.

Caller or entry	Evidence
startLogin	Call site · Caller explanation
loginCallback	Call site · Caller explanation
loginCallback	Call site · Caller explanation

login → memory

3 operations, 3 sites

ExpiringStore.put · interface dispatch

Inputs: key: string, value: LoginTransaction, expires: int, now: int. Result: void.

Caller or entry	Evidence
startLogin	Call site · Caller explanation

ExpiringStore.put · interface dispatch

Inputs: key: string, value: SessionClaims, expires: int, now: int. Result: void.

Caller or entry	Evidence
loginCallback	Call site · Caller explanation

ExpiringStore.take · interface dispatch

Inputs: key: string, now: int. Result: optional LoginTransaction.

Caller or entry	Evidence
loginCallback	Call site · Caller explanation

login → web

4 operations, 12 sites

HttpClient.request · interface dispatch

Inputs: method: string, url: string, headers: Headers, body: Bytes. Result: HttpResponse<Bytes>.

Caller or entry	Evidence
loginCallback	Call site · Caller explanation

HttpClient.request · interface dispatch

Inputs: method: string, url: string, headers: Headers, body: optional Bytes. Result: HttpResponse<Bytes>.

Caller or entry	Evidence
loginCallback	Call site · Caller explanation

HttpClient.request · interface dispatch

Inputs: method: string, url: string, headers: optional Headers, body: optional Bytes. Result: HttpResponse<Bytes>.

Caller or entry	Evidence
loginCallback	Call site · Caller explanation

urlEncode

Inputs: input: string. Result: string.

Caller or entry	Evidence
startLogin	Call site · Caller explanation
startLogin	Call site · Caller explanation
startLogin	Call site · Caller explanation
startLogin	Call site · Caller explanation
startLogin	Call site · Caller explanation
loginCallback	Call site · Caller explanation
loginCallback	Call site · Caller explanation
loginCallback	Call site · Caller explanation
loginCallback	Call site · Caller explanation

login → crypto

4 operations, 9 sites

Crypto.equal · interface dispatch

Inputs: left: Bytes, right: Bytes. Result: bool.

Caller or entry	Evidence
loginCallback	Call site · Caller explanation

Crypto.random · interface dispatch

Inputs: size: int. Result: Bytes.

Caller or entry	Evidence
startLogin	Call site · Caller explanation
startLogin	Call site · Caller explanation
startLogin	Call site · Caller explanation
startLogin	Call site · Caller explanation
loginCallback	Call site · Caller explanation
loginCallback	Call site · Caller explanation

Crypto.sha256 · interface dispatch

Inputs: input: Bytes. Result: Bytes.

Caller or entry	Evidence
startLogin	Call site · Caller explanation

signJwt

Inputs: key: RsaPrivateKey, claims: Json, kid: string, tokenType: string. Result: string.

Caller or entry	Evidence
loginCallback	Call site · Caller explanation

login → time

1 operation, 5 sites

Clock.now · interface dispatch

No caller-supplied inputs. Result: int.

Caller or entry	Evidence
startLogin	Call site · Caller explanation
startLogin	Call site · Caller explanation
loginCallback	Call site · Caller explanation
loginCallback	Call site · Caller explanation
loginCallback	Call site · Caller explanation

logout → contracts

1 operation, 2 sites

SessionError · value construction

No caller-supplied inputs. Result: SessionError.

Caller or entry	Evidence
logout	Call site · Caller explanation
logout	Call site · Caller explanation

logout → session

1 operation, 1 site

authenticate

Inputs: token: optional string. Result: SessionClaims.

Caller or entry	Evidence
logout	Call site · Caller explanation

logout → common

3 operations, 3 sites

securityHeaders

No caller-supplied inputs. Result: Headers.

Caller or entry	Evidence
logout	Call site · Caller explanation

settings

No caller-supplied inputs. Result: Settings.

Caller or entry	Evidence
logout	Call site · Caller explanation

withCookie

Inputs: headers: Headers, name: string, value: string, path: string, maxAge: int, secure: bool. Result: Headers.

Caller or entry	Evidence
logout	Call site · Caller explanation

logout → memory

1 operation, 1 site

ExpiringStore.take · interface dispatch

Inputs: key: string, now: int. Result: optional SessionClaims.

Caller or entry	Evidence
logout	Call site · Caller explanation

logout → crypto

1 operation, 1 site

Crypto.equal · interface dispatch

Inputs: left: Bytes, right: Bytes. Result: bool.

Caller or entry	Evidence
logout	Call site · Caller explanation

logout → time

1 operation, 1 site

Clock.now · interface dispatch

No caller-supplied inputs. Result: int.

Caller or entry	Evidence
logout	Call site · Caller explanation

protocol → contracts

1 operation, 16 sites

SessionError · value construction

No caller-supplied inputs. Result: SessionError.

Caller or entry	Evidence
responseJson	Call site · Caller explanation
responseJson	Call site · Caller explanation
responseJson	Call site · Caller explanation
responseJson	Call site · Caller explanation
responseJson	Call site · Caller explanation
discover	Call site · Caller explanation
discover	Call site · Caller explanation
validateIdentity	Call site · Caller explanation
validateIdentity	Call site · Caller explanation
validateIdentity	Call site · Caller explanation
validateIdentity	Call site · Caller explanation
validateIdentity	Call site · Caller explanation
validateIdentity	Call site · Caller explanation
validateIdentity	Call site · Caller explanation
validateIdentity	Call site · Caller explanation
validateIdentity	Call site · Caller explanation

protocol → common

1 operation, 3 sites

settings

No caller-supplied inputs. Result: Settings.

Caller or entry	Evidence
discover	Call site · Caller explanation
validateIdentity	Call site · Caller explanation
test validateIdentity	Call site · Caller explanation

protocol → json

1 operation, 1 site

parse

Inputs: input: string. Result: Json.

Caller or entry	Evidence
responseJson	Call site · Caller explanation

protocol → web

1 operation, 1 site

HttpClient.request · interface dispatch

Inputs: method: string, url: string, headers: optional Headers, body: optional Bytes. Result: HttpResponse<Bytes>.

Caller or entry	Evidence
discover	Call site · Caller explanation

protocol → crypto

8 operations, 10 sites

Crypto.equal · interface dispatch

Inputs: left: Bytes, right: Bytes. Result: bool.

Caller or entry	Evidence
validateIdentity	Call site · Caller explanation

Crypto.generateRsa · interface dispatch

No caller-supplied inputs. Result: RsaPrivateKey.

Caller or entry	Evidence
test validateIdentity	Call site · Caller explanation

Crypto.publicRsa · interface dispatch

Inputs: key: RsaPrivateKey. Result: RsaPublicKey.

Caller or entry	Evidence
test validateIdentity	Call site · Caller explanation

RsaJwks · value construction

Inputs: keys: List<RsaJwk>. Result: RsaJwks.

Caller or entry	Evidence
test validateIdentity	Call site · Caller explanation

importJwk

Inputs: jwk: RsaJwk. Result: RsaPublicKey.

Caller or entry	Evidence
validateIdentity	Call site · Caller explanation

rsaJwk

Inputs: publicKey: RsaPublicKey, kid: string. Result: RsaJwk.

Caller or entry	Evidence
test validateIdentity	Call site · Caller explanation

signJwt

Inputs: key: RsaPrivateKey, claims: Json, kid: string, tokenType: string. Result: string.

Caller or entry	Evidence
test validateIdentity	Call site · Caller explanation
test validateIdentity	Call site · Caller explanation
test validateIdentity	Call site · Caller explanation

verifyJwt

Inputs: token: string, publicKey: RsaPublicKey, kid: string, tokenType: string. Result: Json.

Caller or entry	Evidence
validateIdentity	Call site · Caller explanation

protocol → provider

1 operation, 3 sites

IdClaims · value construction

Inputs: iss: string, sub: string, aud: string, exp: int, iat: int, nonce: string, name: string. Result: IdClaims.

Caller or entry	Evidence
test validateIdentity	Call site · Caller explanation
test validateIdentity	Call site · Caller explanation
test validateIdentity	Call site · Caller explanation

session → contracts

1 operation, 8 sites

SessionError · value construction

No caller-supplied inputs. Result: SessionError.

Caller or entry	Evidence
authenticate	Call site · Caller explanation
authenticate	Call site · Caller explanation
authenticate	Call site · Caller explanation
authenticate	Call site · Caller explanation
authenticate	Call site · Caller explanation
authenticate	Call site · Caller explanation
authenticate	Call site · Caller explanation
authenticate	Call site · Caller explanation

session → common

2 operations, 2 sites

SigningKeys.session · interface dispatch

No caller-supplied inputs. Result: RsaPrivateKey.

Caller or entry	Evidence
authenticate	Call site · Caller explanation

settings

No caller-supplied inputs. Result: Settings.

Caller or entry	Evidence
authenticate	Call site · Caller explanation

session → memory

1 operation, 1 site

ExpiringStore.get · interface dispatch

Inputs: key: string, now: int. Result: optional SessionClaims.

Caller or entry	Evidence
authenticate	Call site · Caller explanation

session → crypto

3 operations, 3 sites

Crypto.equal · interface dispatch

Inputs: left: Bytes, right: Bytes. Result: bool.

Caller or entry	Evidence
authenticate	Call site · Caller explanation

Crypto.publicRsa · interface dispatch

Inputs: key: RsaPrivateKey. Result: RsaPublicKey.

Caller or entry	Evidence
authenticate	Call site · Caller explanation

verifyJwt

Inputs: token: string, publicKey: RsaPublicKey, kid: string, tokenType: string. Result: Json.

Caller or entry	Evidence
authenticate	Call site · Caller explanation

session → time

1 operation, 1 site

Clock.now · interface dispatch

No caller-supplied inputs. Result: int.

Caller or entry	Evidence
authenticate	Call site · Caller explanation

views → logout

1 operation, 1 site

on submission: POST /logout · deferred HTTP action

Inputs: input: LogoutForm, token: optional string, origin: optional string. Result: HttpResponse<Html>.

Caller or entry	Evidence
Welcome	Call site · Caller explanation

views → common

1 operation, 2 sites

Page

Inputs: title: string, children: List<Html>. Result: Html.

Caller or entry	Evidence
LoginPage	Call site · Caller explanation
Welcome	Call site · Caller explanation

What this folder exposes

Exports

Export the declaration LoginTransaction from contracts.aug. Export the declaration SessionClaims from contracts.aug. Export the declaration home from endpoints.aug. Export the declaration me from endpoints.aug.

Export the declaration logout from logout.aug. Export the declaration startLogin from login.aug. Export the declaration loginCallback from login.aug.

Files in this folder

Module	Read
client/contracts.aug	Flow and sequences · Explanation
client/endpoints.aug	Flow and sequences · Explanation
client/export.aug	Flow and sequences · Explanation
client/login.aug	Flow and sequences · Explanation
client/logout.aug	Flow and sequences · Explanation
client/protocol.aug	Flow and sequences · Explanation
client/session.aug	Flow and sequences · Explanation
client/views.aug	Flow and sequences · Explanation

client data flow ​

endpoints request flow ​

login request flow ​

logout request flow ​

Package boundaries ​

Follow the data ​

Data crossing these boundaries (63 contracts) ​

HTTP requests → endpoints ​

HTTP requests → login ​

HTTP requests → logout ​

endpoints → session ​

endpoints → views ​

endpoints → common ​

endpoints → provider ​

login → contracts ​

login → protocol ​

login → common ​

login → memory ​

login → web ​

login → crypto ​

login → time ​

logout → contracts ​

logout → session ​

logout → common ​

logout → memory ​

logout → crypto ​

logout → time ​

protocol → contracts ​

protocol → common ​

protocol → json ​

protocol → web ​

protocol → crypto ​

protocol → provider ​

session → contracts ​

session → common ​

session → memory ​

session → crypto ​

session → time ​

views → logout ​

views → common ​

What this folder exposes ​

Exports ​

Files in this folder ​

client data flow

endpoints request flow

login request flow

logout request flow

Package boundaries

Follow the data

Data crossing these boundaries (63 contracts)

HTTP requests → endpoints

HTTP requests → login

HTTP requests → logout

endpoints → session

endpoints → views

endpoints → common

endpoints → provider

login → contracts

login → protocol

login → common

login → memory

login → web

login → crypto

login → time

logout → contracts

logout → session

logout → common

logout → memory

logout → crypto

logout → time

protocol → contracts

protocol → common

protocol → json

protocol → web

protocol → crypto

protocol → provider

session → contracts

session → common

session → memory

session → crypto

session → time

views → logout

views → common

What this folder exposes

Exports

Files in this folder