index.html

<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="UTF-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>doctor — connect your Nostr key to your Solid pod</title>
  <meta name="description" content="One step: sign in to your pod and it learns your Nostr key. After that, Nostr apps can write to your pod as you.">
  <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src https: http://localhost:* http://127.0.0.1:*; form-action 'none'; object-src 'none'; base-uri 'none'">
  <meta name="referrer" content="no-referrer">
  <link rel="stylesheet" href="doctor.css">
</head>
<body>
  <main>
    <header>
      <h1>doctor</h1>
      <p class="tagline">Connect your Nostr key to your Solid pod.</p>
    </header>

    <section class="card" id="link">
      <p class="lead">Sign in to your pod once, and it learns your Nostr key. From then on Nostr apps such as
        <a href="https://solid-chat.com/v2/" target="_blank" rel="noopener">Solid Chat</a> can write to your pod as you,
        with no further sign-in. Nothing secret leaves your browser: the pod only ever sees your public key.</p>

      <form id="link-form">
        <label for="pod">Your pod or WebID</label>
        <input id="pod" name="pod" type="url" required autocomplete="url" spellcheck="false"
               placeholder="https://alice.example.org/">
        <div class="signer" id="signer" role="status" aria-live="polite">
          <span class="dot" aria-hidden="true"></span><span class="text">Looking for a Nostr signer…</span>
        </div>
        <p class="hint">You will be sent to your pod to sign in and brought straight back. If the key is already in your profile, there is nothing to sign in for.</p>
        <button type="submit" id="go">Connect my key</button>
      </form>

      <ol id="steps" class="steps" hidden></ol>

      <div id="done" class="done" hidden>
        <h2>Done</h2>
        <p>Your pod now recognises <code id="done-did"></code> as <code id="done-webid"></code>.</p>
        <p class="actions">
          <a class="button" id="open-chat" href="https://solid-chat.com/v2/" target="_blank" rel="noopener">Open Solid Chat</a>
          <button type="button" id="again" class="secondary">Check again</button>
        </p>
      </div>
    </section>

    <details class="card advanced" id="advanced">
      <summary>Advanced</summary>

      <section>
        <h2>Profile shape (LWS / CID v1)</h2>
        <p>What the profile at the address above declares, checked against the
          <a href="https://www.w3.org/TR/cid-1.0/" target="_blank" rel="noopener">Controlled Identifiers v1.0</a> shape that
          <a href="https://www.w3.org/TR/2026/WD-lws10-authn-ssi-cid-20260423/" target="_blank" rel="noopener">LWS 1.0 auth</a> expects.</p>
        <button type="button" id="check">Check profile</button>
        <ol id="checks" class="steps" hidden></ol>
        <details id="raw" hidden><summary>Raw profile JSON</summary><pre id="raw-body"></pre></details>
      </section>

      <section>
        <h2>Strict LWS10-CID auth (ES256K JWT)</h2>
        <p>For testing a pod's LWS10-CID verifier: after signing in above, paste a secp256k1 private key as 64 hex characters
          (the raw bytes behind an <code>nsec1…</code>; it stays in this tab's memory only), add it to your profile as a
          <code>JsonWebKey</code> method and sign a JWT with it.</p>
        <label for="privkey">Private key (64 hex)</label>
        <input id="privkey" type="password" autocomplete="off" spellcheck="false" placeholder="64 hex characters">
        <p class="actions">
          <button type="button" id="jwt-add">Add JWK method</button>
          <button type="button" id="jwt-test" class="secondary">Sign a test JWT</button>
        </p>
        <pre id="jwt-out" hidden></pre>
      </section>

      <section id="keys">
        <h2>Nostr keys in this profile</h2>
        <p>Every key the pod accepts as you. Remove one you have lost or replaced; the pod then stops treating it as you.</p>
        <button type="button" id="keys-refresh">Show keys</button>
        <ol id="keys-list" class="steps"></ol>
        <p class="hint" id="keys-note"></p>
      </section>

      <section>
        <p class="hint">Signed in via Solid-OIDC as <code id="session-webid">nobody</code>.
          <button type="button" id="signout" class="link" hidden>Sign out</button></p>
      </section>
    </details>

    <footer>
      <p><a href="https://github.com/JavaScriptSolidServer/doctor" target="_blank" rel="noopener">source</a>
        · <a href="https://github.com/JavaScriptSolidServer/doctor/issues" target="_blank" rel="noopener">issues</a>
        · no key ever leaves your browser</p>
    </footer>
  </main>
  <script type="module" src="doctor.js"></script>
</body>
</html>