signet

Two ways in: vortex verbs, or OpenID Connect.

Vortex verbs
Fetch the verify key once, then check tokens offline.
```
do
  audience "wiki"
  signet "ws://127.0.0.1:7420"
```
The whole of it →

OpenID Connect

Declare a client; any relying party that speaks OpenID Connect signs in.

client
  (signedWith EdDSA
    (publicClient "notes"
      ["https://notes.example.org/callback"]
      ["openid", "profile"]))

The whole of it →

Hooking in

Vortex verbs

A site that speaks vortex names its audience and the signet it trusts:

do
  audience "wiki"
  signet "ws://127.0.0.1:7420"

It fetches verifyKey and the revocations, then checks each token offline. A token for any other audience is refused.

signet login ws://127.0.0.1:7420 alice@estate wiki examples/keys/alice > wiki.token
signet site examples/wiki.vx "$(cat wiki.token)"        # accepted: alice@estate for wiki
signet site examples/forge-site.vx "$(cat wiki.token)"  # token: not for audience forge