Polish pass: sync README with 0.0.2 code, small UX fixes

README had drifted from the code after the OIDC dance was dropped
in cb0c996:

- Configuration documents the real `resolver` param (not `idp`),
  with nostr.social noted as the did-nostr.com source fallback
- drop the localStorage-persistence claim (that's roadmap 0.0.6)
- diagram shows the DID-doc fetch + ?webid= handoff, not Solid-OIDC
- remove "open index.html directly" (module scripts need http)
- Status: 0.0.2 phase 1; roadmap renumbered so 0.0.2 is the
  identity handoff, later items shift to 0.0.3-0.0.8

login.js:
- fallback-resolver link preserves ?next= (was dropped on click)
- success message names the WebID and actual destination
- aria-busy on the button while the flow runs

index.html:
- #status is a div (help() injects a <ul>; invalid inside <p>)
- inline SVG favicon (kills the /favicon.ico 404)

Author: melvincarvalho

README.md

@@ -15,7 +15,8 @@ with the smallest possible UI surface — one big button.
 1. User clicks **Sign in**
 2. `window.nostr.getPublicKey()` — signer extension hands us the pubkey
 3. `fetch <resolver>/.well-known/did/nostr/<pubkey>.json` — DID document with `alsoKnownAs`
-4. Redirect to the WebID's pod root
+4. Redirect to the WebID's pod root with `?webid=did:nostr:<pubkey>`
+   attached, so the pod's auth widget knows who just arrived
 
 **Failure path** — at every step, if something's not set up, the
 page shows a precise diagnosis + the user's next concrete action
@@ -24,10 +25,12 @@ resolver, etc.). PoC philosophy: assume everything works; gracefully
 degrade with guidance when it doesn't.
 
 **Trade-off**: the user lands at their pod *without* an
-authenticated Solid-OIDC session. They can browse public content;
-anything WAC-protected prompts for a real session via whatever app
-needs it. For the "magic SSO landing" promise that's enough — the
-full OIDC + DPoP session is on the v0.2 roadmap.
+authenticated session. They can browse public content; anything
+WAC-protected prompts for a real session via whatever app needs it.
+The `?webid=` handoff is plain text for now — unsigned, unverified.
+For the "magic SSO landing" promise that's enough — the signed
+handoff (NIP-98) is 0.0.2 phase 2, and the full authenticated
+session is 0.0.7 on the roadmap.
 
 No username box. No IdP picker. No "what app are you logging in from?"
 question. Click → resolve → arrive.
@@ -41,7 +44,7 @@ question. Click → resolve → arrive.
 │   │   Sign in to Solid   │  ← only UI  │
 │   └──────────────────────┘             │
 └────────────────┬───────────────────────┘
-                 │ Solid-OIDC redirect to configured IdP
+                 │ fetch /.well-known/did/nostr/<pubkey>.json
                  ▼
 ┌────────────────────────────────────────┐
 │  JSS resolver chain (already shipped)  │
@@ -55,6 +58,7 @@ question. Click → resolve → arrive.
                  ▼
 ┌────────────────────────────────────────┐
 │  Redirect to pod root                  │
+│  + ?webid=did:nostr:<pubkey>           │
 └────────────────────────────────────────┘
 ```
 
@@ -71,24 +75,31 @@ npx serve .         # any port
 python3 -m http.server 8080
 ```
 
-Or open `index.html` directly (CDN imports resolve over the network).
+(A server is required — `login.js` is an ES module, and browsers
+block module scripts on `file://` URLs.)
 
 ## Configuration
 
-URL params (also persisted to `localStorage` so post-redirect navigation
-finds them):
+URL params:
 
 | Param | Default | Purpose |
 |-------|---------|---------|
-| `idp` | `https://solid.social` | OIDC issuer to authenticate against |
+| `resolver` | `https://solid.social` | Host serving `/.well-known/did/nostr/<pubkey>.json` |
 | `next` | pod root derived from WebID | Where to land after sign-in |
 
-Example: a Solid app wants users to authenticate and come back —
+[`https://nostr.social`](https://nostr.social) serves as the
+[did-nostr.com](https://did-nostr.com) source fallback when a key
+isn't linked at the default resolver.
+
+Example: a Solid app wants users identified and sent back —
 
 ```
-https://sso.solid.social/?idp=https://solid.social&next=https://myapp.example/
+https://sso.solid.social/?resolver=https://nostr.social&next=https://myapp.example/
 ```
 
+(Resolver memory in `localStorage` — so return visits skip straight
+to the right host — is 0.0.6 on the roadmap.)
+
 ## Hosting
 
 Three sensible deployment targets:
@@ -101,10 +112,11 @@ Three sensible deployment targets:
 
 ## Status
 
-**0.0.1 — proof of concept**. Demonstrates the one-button UX
-end-to-end against `solid.social` as the resolver. Users registered
-with solid.social land at their pod in one click. Resolution uses
-the JSS resolver chain shipped in
+**0.0.2 phase 1 — identity handoff**. The one-button UX works
+end-to-end against `solid.social` as the resolver, and the redirect
+now carries `?webid=did:nostr:<pubkey>` so the pod's auth widget can
+pick up the arriving identity (unsigned for now; phase 2 signs it
+with NIP-98). Resolution uses the JSS resolver chain shipped in
 [#408](https://github.com/JavaScriptSolidServer/JavaScriptSolidServer/pull/408)
 through
 [#418](https://github.com/JavaScriptSolidServer/JavaScriptSolidServer/pull/418).
@@ -115,21 +127,26 @@ Following JSS's own 0.0.x versioning (small, frequent bumps, each
 adding one capability).
 
 - **0.0.1** — One-button flow against a single hardcoded resolver. ✅
-- **0.0.2** — Step-by-step coaching UI: checklist that ticks each
+- **0.0.2** — Identity handoff to the pod. Phase 1: append
+  `?webid=did:nostr:<pubkey>` to the redirect (plain text). ✅
+  Phase 2: sign it (NIP-98 in the URL fragment) so the pod can
+  verify the arriving identity.
+- **0.0.3** — Step-by-step coaching UI: checklist that ticks each
   step (extension detected, pubkey resolved, DID doc found, WebID
   extracted, redirect) instead of a one-shot status line.
-- **0.0.3** — Multi-resolver fallback: try a configurable list of
-  resolvers in order before giving up.
-- **0.0.4** — Direct Nostr-relay resolution. Sits on top of
+- **0.0.4** — Multi-resolver fallback: try a configurable list of
+  resolvers in order (`solid.social`, then `nostr.social` as the
+  did-nostr.com source fallback) before giving up.
+- **0.0.5** — Direct Nostr-relay resolution. Sits on top of
   [JSS#414](https://github.com/JavaScriptSolidServer/JavaScriptSolidServer/issues/414).
   Removes the hardcoded-resolver dependency entirely.
-- **0.0.5** — User-preferred resolver memory: first successful
+- **0.0.6** — User-preferred resolver memory: first successful
   resolution is cached in `localStorage` so subsequent visits skip
   straight to the right host.
-- **0.0.6** — Authenticated session: optional NIP-98 → DPoP
+- **0.0.7** — Authenticated session: optional NIP-98 → DPoP
   exchange against the IdP, so the user lands at their pod
   already signed in (not just navigated there).
-- **0.0.7** — Passkey-only fallback. Sign in without a Nostr
+- **0.0.8** — Passkey-only fallback. Sign in without a Nostr
   extension via WebAuthn.
 
 ## Why a separate repo?

index.html

@@ -5,6 +5,7 @@
   <title>Sign in to Solid</title>
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <meta name="description" content="Universal one-click sign-in for Solid pods. Click the button — you're at your pod.">
+  <link rel="icon" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'%3E%3Ccircle cx='50' cy='50' r='45' fill='%236839e6'/%3E%3C/svg%3E">
 
   <!-- Open Graph -->
   <meta property="og:title" content="JSS SSO — one click, you're at your pod">
@@ -79,7 +80,7 @@
     <h1>Sign in to Solid</h1>
     <p class="tagline">One click. We resolve your Nostr / WebID. You land at your pod.</p>
     <button id="signin">Sign in</button>
-    <p id="status" aria-live="polite"></p>
+    <div id="status" aria-live="polite"></div>
     <footer>
       <a href="https://github.com/JavaScriptSolidServer/sso">source</a>
       &nbsp;·&nbsp;

login.js

@@ -114,11 +114,16 @@ async function flow() {
       headers: { Accept: 'application/did+json, application/json' },
     });
     if (res.status === 404) {
+      // Fallback resolver: nostr.social serves the did-nostr.com
+      // source. Preserve the caller's other params (e.g. ?next=)
+      // when offering the switch.
+      const alt = new URLSearchParams(location.search);
+      alt.set('resolver', 'https://nostr.social');
       setStatus(help(
         ['Your Nostr key isn’t linked to a Solid pod at ', resolver, '. '],
         [
           { label: 'How to link your Nostr key to a Solid pod', href: 'https://jss.live/docs/' },
-          { label: 'Try a different resolver', href: '?resolver=https://nostr.social' },
+          { label: 'Try the fallback resolver (nostr.social)', href: `?${alt}` },
         ],
       ), 'error');
       return false;
@@ -164,7 +169,7 @@ async function flow() {
     setStatus(`Could not build redirect URL from: ${base}`, 'error');
     return false;
   }
-  setStatus(`Found your pod: ${webId}. Taking you there now…`);
+  setStatus(`Found your WebID: ${webId}. Taking you to ${base}…`);
   setTimeout(() => { location.href = dest; }, 800);
   return true;
 }
@@ -174,8 +179,12 @@ function wire() {
   if (!button) return;
   button.addEventListener('click', async () => {
     button.disabled = true;
+    button.setAttribute('aria-busy', 'true');
     const ok = await flow();
-    if (!ok) button.disabled = false;
+    if (!ok) {
+      button.disabled = false;
+      button.removeAttribute('aria-busy');
+    }
   });
 }