B.2: connect NIP-07 signer and emit Multikey verificationMethod

Adds a second section to the doctor: after diagnostics run, the user
can connect their Nostr signer (xlogin or any window.nostr provider)
and get back a copyable JSON snippet — verificationMethod plus
authentication / assertionMethod entries — to paste into their
profile.

Multikey encoding follows did:nostr's recipe:
  "f" + e701 (multicodec varint for secp256k1-pub)
      + parity byte (0x02 default)
      + 32-byte x-only Nostr pubkey
verified against the spec example.

No keys leave the browser; B.3 will close the loop with an in-app
PATCH via Solid-OIDC.

Closes #1.

Author: melvincarvalho

README.md

@@ -6,9 +6,9 @@ A diagnostic tool for [Solid](https://solidproject.org/) pods and the surroundin
 
 **Live:** https://jss.live/doctor/
 
-## What it checks today
+## What it does today
 
-**LWS / CID v1 profile shape** — drop in a WebID URL, get a green/red checklist of what's structurally there and what's missing for [LWS 1.0](https://www.w3.org/TR/2026/WD-lws10-authn-ssi-cid-20260423/) auth conformance:
+**1. LWS / CID v1 profile shape check** — drop in a WebID URL, get a green/red checklist of what's structurally there and what's missing for [LWS 1.0](https://www.w3.org/TR/2026/WD-lws10-authn-ssi-cid-20260423/) auth conformance:
 
 - Profile fetches as `application/ld+json`?
 - `@context` declares the CID v1 vocabulary (controller, verificationMethod, authentication, …)?
@@ -22,12 +22,14 @@ A diagnostic tool for [Solid](https://solidproject.org/) pods and the surroundin
 
 Read-only — no auth, no mutations, no server roundtrip beyond the GETs.
 
+**2. Nostr verification-method generator** — reads your Nostr pubkey from a [NIP-07](https://github.com/nostr-protocol/nips/blob/master/07.md) signer (e.g. [xlogin](https://xlogin.solid.social/)), encodes it per [did:nostr](https://nostrcg.github.io/did-nostr/)'s Multikey recipe, and emits a copyable JSON snippet to add to your profile. No keys leave your browser.
+
 ## Roadmap (rough)
 
-- **B.0** — Read-only LWS-CID profile validator (this commit)
+- ~~**B.0**~~ — Read-only LWS-CID profile validator ✅
+- ~~**B.2**~~ — Read pubkey from NIP-07 signer; emit Multikey verificationMethod snippet ✅
 - **B.1** — Bidirectional `alsoKnownAs` ↔ DID-doc check (resolve `did:nostr:…` and verify the DID points back at this WebID)
-- **B.2** — xlogin / NIP-07 sign-in to act as a WebID owner
-- **B.3** — PATCH `verificationMethod` (Multikey for Nostr secp256k1) into the signed-in user's profile
+- **B.3** — In-app PATCH of the snippet via Solid-OIDC sign-in (closes the loop end-to-end)
 - **B.4** — did:key + WebAuthn passkey verification methods
 - **B.5** — More diagnostics: ACL inheritance, type-index integrity, OIDC discovery, ActivityPub actor doc, …
 

doctor.css

@@ -184,3 +184,122 @@ footer a {
 }
 
 a { color: var(--accent); }
+
+/* --- B.2: add-key section ----------------------------------------- */
+
+.add-key {
+  background: var(--panel);
+  border: 1px solid var(--border);
+  border-radius: 12px;
+  padding: 24px;
+  box-shadow: 0 1px 3px rgba(15, 23, 42, 0.04);
+  margin-top: 20px;
+}
+.add-key h2 {
+  margin: 0 0 6px;
+  font-size: 18px;
+}
+.add-key > p {
+  margin: 0 0 18px;
+  color: var(--muted);
+  font-size: 13px;
+}
+.add-key code {
+  background: #eef2f7;
+  padding: 1px 5px;
+  border-radius: 4px;
+  font-size: 12px;
+}
+.add-key h3 {
+  margin: 18px 0 8px;
+  font-size: 14px;
+}
+.add-key p.hint {
+  font-size: 12px;
+  color: var(--muted);
+  margin: 0 0 8px;
+}
+.add-key p.hint.future {
+  font-style: italic;
+  margin-top: 16px;
+}
+
+.signer-status {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  font-size: 13px;
+  color: var(--muted);
+  margin-bottom: 12px;
+}
+.signer-status .dot {
+  width: 10px;
+  height: 10px;
+  border-radius: 50%;
+  background: var(--skip);
+  flex-shrink: 0;
+}
+.signer-status.ready .dot { background: var(--pass); }
+.signer-status.absent .dot { background: var(--fail); }
+.signer-status.error .dot { background: var(--fail); }
+
+.add-key button {
+  background: var(--accent);
+  color: #fff;
+  border: 0;
+  padding: 9px 16px;
+  border-radius: 8px;
+  font: inherit;
+  font-weight: 600;
+  cursor: pointer;
+}
+.add-key button:hover:not(:disabled) { background: #1d4ed8; }
+.add-key button:disabled {
+  opacity: 0.5;
+  cursor: not-allowed;
+}
+.add-key button#copy-snippet {
+  background: #475569;
+  margin-top: 8px;
+}
+.add-key button#copy-snippet:hover:not(:disabled) { background: #334155; }
+.add-key .copy-status {
+  margin-left: 10px;
+  font-size: 12px;
+  color: var(--pass);
+}
+
+.kv {
+  display: grid;
+  grid-template-columns: max-content 1fr;
+  gap: 4px 16px;
+  margin: 16px 0;
+  font-size: 13px;
+}
+.kv dt { font-weight: 600; }
+.kv dd {
+  margin: 0;
+  word-break: break-all;
+  font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, monospace;
+  font-size: 12px;
+}
+.kv dd code {
+  display: inline;
+  background: transparent;
+  padding: 0;
+}
+
+#snippet {
+  display: block;
+  background: #0f172a;
+  color: #cbd5e1;
+  padding: 14px;
+  border-radius: 8px;
+  font-size: 12px;
+  overflow-x: auto;
+  white-space: pre;
+  font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, monospace;
+}
+#snippet pre, .add-key pre {
+  margin: 0;
+}

doctor.js

@@ -9,6 +9,7 @@
  */
 
 import { runLwsCidChecks } from './lib/lws-cid.js';
+import { buildNostrVerificationMethod } from './lib/multikey.js';
 
 const form     = document.getElementById('check-form');
 const input    = document.getElementById('webid');
@@ -17,6 +18,19 @@ const results  = document.getElementById('results');
 const checksEl = document.getElementById('checks');
 const rawEl    = document.getElementById('raw-body');
 
+const addKeySection  = document.getElementById('add-key');
+const signerStatus   = document.getElementById('signer-status');
+const connectButton  = document.getElementById('connect-signer');
+const signerOutput   = document.getElementById('signer-output');
+const pubkeyHexEl    = document.getElementById('pubkey-hex');
+const pubkeyMbEl     = document.getElementById('pubkey-multibase');
+const snippetEl      = document.getElementById('snippet');
+const snippetTarget  = document.getElementById('snippet-target');
+const copyButton     = document.getElementById('copy-snippet');
+const copyStatus     = document.getElementById('copy-status');
+
+let lastWebId = null;
+
 // Allow ?webid=… in the URL to pre-fill (handy for sharing / bookmarks).
 const params = new URLSearchParams(window.location.search);
 if (params.has('webid')) {
@@ -41,6 +55,8 @@ form.addEventListener('submit', async (e) => {
   try {
     const checks = await runAll(url);
     renderChecks(checks);
+    lastWebId = url;
+    revealAddKeySection();
   } catch (err) {
     renderChecks([{
       status: 'fail',
@@ -133,6 +149,77 @@ async function runAll(webIdUrl) {
   return checks;
 }
 
+// --- B.2: connect Nostr signer & compute Multikey VM -----------------
+
+function revealAddKeySection() {
+  addKeySection.hidden = false;
+  detectSigner();
+}
+
+function detectSigner() {
+  if (typeof window.nostr?.getPublicKey === 'function') {
+    setSignerStatus('ready', 'NIP-07 signer detected (window.nostr).');
+    connectButton.disabled = false;
+  } else {
+    setSignerStatus('absent',
+      'No NIP-07 signer found. Install xlogin or another window.nostr provider, then reload.');
+    connectButton.disabled = true;
+  }
+}
+
+function setSignerStatus(state, text) {
+  signerStatus.className = `signer-status ${state}`;
+  signerStatus.querySelector('.text').textContent = text;
+}
+
+connectButton.addEventListener('click', async () => {
+  if (!lastWebId) return;
+  connectButton.disabled = true;
+  connectButton.textContent = 'Connecting…';
+  try {
+    const xOnlyHex = await window.nostr.getPublicKey();
+    if (!/^[0-9a-f]{64}$/i.test(xOnlyHex)) {
+      throw new Error(`Signer returned an unexpected pubkey: ${xOnlyHex}`);
+    }
+    renderSnippet(xOnlyHex, lastWebId);
+    signerOutput.hidden = false;
+    setSignerStatus('ready', 'Connected. The snippet below is ready to paste into your profile.');
+  } catch (err) {
+    setSignerStatus('error', `Could not read pubkey: ${err.message || err}`);
+  } finally {
+    connectButton.textContent = 'Reconnect signer';
+    connectButton.disabled = false;
+  }
+});
+
+function renderSnippet(xOnlyHex, webId) {
+  const vm = buildNostrVerificationMethod({ webId, xOnlyHex });
+  pubkeyHexEl.textContent = xOnlyHex;
+  pubkeyMbEl.textContent  = vm.publicKeyMultibase;
+  snippetTarget.textContent = vm.controller;
+
+  // Show the three additions a CID v1 profile needs together: the
+  // verificationMethod itself, plus authentication / assertionMethod
+  // arrays referencing it. JSON-LD doesn't have "patch" syntax, so we
+  // present it as a partial document the user can merge manually.
+  const partial = {
+    verificationMethod: [vm],
+    authentication: [vm.id],
+    assertionMethod: [vm.id],
+  };
+  snippetEl.textContent = JSON.stringify(partial, null, 2);
+}
+
+copyButton.addEventListener('click', async () => {
+  try {
+    await navigator.clipboard.writeText(snippetEl.textContent);
+    copyStatus.textContent = 'Copied.';
+  } catch (err) {
+    copyStatus.textContent = `Couldn't copy: ${err.message || err}`;
+  }
+  setTimeout(() => { copyStatus.textContent = ''; }, 2500);
+});
+
 function renderChecks(checks) {
   checksEl.innerHTML = '';
   for (const c of checks) {

index.html

@@ -39,6 +39,41 @@ <h3>Results</h3>
       </div>
     </section>
 
+    <section class="add-key" id="add-key" hidden>
+      <h2>Add a Nostr verification method</h2>
+      <p>Read your Nostr public key from a <a href="https://github.com/nostr-protocol/nips/blob/master/07.md" target="_blank" rel="noopener">NIP-07</a>
+        signer (e.g. <a href="https://xlogin.solid.social/" target="_blank" rel="noopener">xlogin</a>) and produce the
+        <code>verificationMethod</code> JSON to add to your profile. Encoding follows
+        <a href="https://nostrcg.github.io/did-nostr/" target="_blank" rel="noopener">did:nostr</a>'s Multikey recipe.
+        No keys are sent anywhere &mdash; this is a pure client-side computation.</p>
+
+      <div class="signer-status" id="signer-status">
+        <span class="dot"></span>
+        <span class="text">Checking for signer…</span>
+      </div>
+
+      <button type="button" id="connect-signer" disabled>Connect signer</button>
+
+      <div id="signer-output" hidden>
+        <dl class="kv">
+          <dt>Nostr pubkey (hex)</dt>
+          <dd><code id="pubkey-hex"></code></dd>
+          <dt>publicKeyMultibase</dt>
+          <dd><code id="pubkey-multibase"></code></dd>
+        </dl>
+
+        <h3>Patch to apply</h3>
+        <p class="hint">Add these triples to your <code id="snippet-target"></code>. Field
+          <code>id</code> uses the <code>#nostr-key-1</code> fragment by convention &mdash; pick another
+          if it collides.</p>
+        <pre><code id="snippet"></code></pre>
+        <button type="button" id="copy-snippet">Copy snippet</button>
+        <span class="copy-status" id="copy-status" aria-live="polite"></span>
+
+        <p class="hint future">B.3 will close the loop with an in-app PATCH so you don't need to copy/paste.</p>
+      </div>
+    </section>
+
     <footer>
       <p>
         <a href="https://github.com/JavaScriptSolidServer/doctor" target="_blank" rel="noopener">source</a>