Address copilot pass 10 on #2

The generator was hard-coding VM controller to the WebID, but the
validator (in pass 4) was already comparing each VM controller
against the profile's declared `controller` (with @id fallback).
For delegated-control profiles those differ, so the snippet would
fail my own VM-controller check.

- lib/multikey.js: buildNostrVerificationMethod accepts an explicit
  `controller` arg, defaulting to webId. Self-control behavior is
  unchanged; delegated-control callers can now pass the profile's
  declared controller through.
- lib/lws-cid.js: export normalizeControllers so callers outside the
  validator can derive a canonical controller IRI from JSON-LD's
  string/object/array shapes.
- doctor.js: capture the profile's controller during runAll using
  normalizeControllers (first IRI, fallback to canonical WebID),
  thread it through state and into buildNostrVerificationMethod.

Verified end-to-end: in both self-controlled and delegated-controlled
profiles, the generated VM is accepted by runLwsCidChecks when
merged back into the source profile.

Author: melvincarvalho

doctor.js

@@ -8,7 +8,7 @@
  * no auth — just a read. The output is a green/yellow/red checklist.
  */
 
-import { runLwsCidChecks } from './lib/lws-cid.js';
+import { runLwsCidChecks, normalizeControllers } from './lib/lws-cid.js';
 import { buildNostrVerificationMethod } from './lib/multikey.js';
 
 const form     = document.getElementById('check-form');
@@ -31,6 +31,7 @@ const copyStatus     = document.getElementById('copy-status');
 
 let lastWebId = null;
 let lastDocUrl = null;
+let lastController = null;
 
 // Allow ?webid=… in the URL to pre-fill (handy for sharing / bookmarks).
 const params = new URLSearchParams(window.location.search);
@@ -58,11 +59,12 @@ form.addEventListener('submit', async (e) => {
   hideAddKeySection();
 
   try {
-    const { checks, profileFetched, webId, docUrl } = await runAll(url);
+    const { checks, profileFetched, webId, docUrl, controller } = await runAll(url);
     renderChecks(checks);
     if (profileFetched && webId) {
       lastWebId = webId;
       lastDocUrl = docUrl;
+      lastController = controller;
       revealAddKeySection();
     } else {
       hideAddKeySection();
@@ -82,7 +84,7 @@ form.addEventListener('submit', async (e) => {
 
 async function runAll(webIdUrl) {
   const checks = [];
-  const result = { checks, profileFetched: false, docUrl: null, webId: null };
+  const result = { checks, profileFetched: false, docUrl: null, webId: null, controller: null };
 
   // 1. Resolve the document URL — strip the fragment.
   let docUrl;
@@ -174,9 +176,18 @@ async function runAll(webIdUrl) {
       // malformed @id; fall through to user-supplied URL
     }
   }
+  // Derive the controller IRI from the profile's declared `controller`
+  // (handling all four JSON-LD shapes), falling back to the canonical
+  // WebID when controller is absent. Generated VMs use this so that on
+  // delegated-control profiles the snippet matches the profile's own
+  // controller predicate (and passes the validator).
+  const declaredCtrls = normalizeControllers(profile.controller, docUrl.toString());
+  const controllerIri = declaredCtrls[0] ?? canonicalWebId;
+
   result.profileFetched = true;
   result.docUrl = docUrl.toString();
   result.webId = canonicalWebId;
+  result.controller = controllerIri;
 
   // 4. Run LWS-CID structural checks.
   for (const c of runLwsCidChecks(profile, { webIdUrl })) {
@@ -202,6 +213,7 @@ function hideAddKeySection() {
   clearSignerOutput();
   lastWebId = null;
   lastDocUrl = null;
+  lastController = null;
 }
 
 function clearSignerOutput() {
@@ -250,7 +262,7 @@ connectButton.addEventListener('click', async () => {
     if (!/^[0-9a-f]{64}$/i.test(xOnlyHex)) {
       throw new Error(`Signer returned an unexpected pubkey: ${xOnlyHex}`);
     }
-    renderSnippet(xOnlyHex, lastWebId, lastDocUrl);
+    renderSnippet(xOnlyHex, lastWebId, lastDocUrl, lastController);
     signerOutput.hidden = false;
     setSignerStatus('ready', 'Connected. The snippet below is ready to paste into your profile.');
     connectButton.textContent = 'Reconnect signer';
@@ -262,8 +274,8 @@ connectButton.addEventListener('click', async () => {
   }
 });
 
-function renderSnippet(xOnlyHex, webId, docUrl) {
-  const vm = buildNostrVerificationMethod({ webId, xOnlyHex });
+function renderSnippet(xOnlyHex, webId, docUrl, controller) {
+  const vm = buildNostrVerificationMethod({ webId, xOnlyHex, controller });
   pubkeyHexEl.textContent = xOnlyHex;
   pubkeyMbEl.textContent  = vm.publicKeyMultibase;
   // Write target is the document URL (no fragment) — you can't PUT/PATCH

lib/lws-cid.js

@@ -364,7 +364,7 @@ function validateVerificationMethod(vm, baseUrl, expectedCtrls) {
  * Normalize a JSON-LD controller value (string | { '@id' | 'id': string }
  * | array of either) to a list of absolutized IRI strings.
  */
-function normalizeControllers(value, baseUrl) {
+export function normalizeControllers(value, baseUrl) {
   if (value === undefined || value === null) return [];
   const list = Array.isArray(value) ? value : [value];
   const out = [];

lib/multikey.js

@@ -68,28 +68,36 @@ export function multikeyToNostrPubkey(mb) {
 }
 
 /**
- * Build a CID-v1 verificationMethod entry for a Nostr key controlled by
- * the given WebID.
+ * Build a CID-v1 verificationMethod entry for a Nostr key.
  *
  * @param {object} args
- * @param {string} args.webId - The full WebID URI (with or without #me)
+ * @param {string} args.webId - The full WebID URI (with or without #me).
+ *   Used to derive the VM `id` (fragment URI rooted at the document).
  * @param {string} args.xOnlyHex - 32-byte x-only Nostr pubkey, hex
+ * @param {string} [args.controller=webId] - The CID document that
+ *   controls this verificationMethod. Defaults to the WebID itself
+ *   (the common self-controlled case). For delegated-control profiles,
+ *   pass the profile's declared `controller` so the VM agrees with the
+ *   outer controller predicate.
  * @param {string} [args.fragment='nostr-key-1'] - Fragment id for the VM
  * @param {0x02|0x03} [args.parity=0x02]
  */
-export function buildNostrVerificationMethod({ webId, xOnlyHex, fragment = 'nostr-key-1', parity = 0x02 }) {
+export function buildNostrVerificationMethod({
+  webId,
+  xOnlyHex,
+  controller,
+  fragment = 'nostr-key-1',
+  parity = 0x02,
+}) {
   const mb = nostrPubkeyToMultikey(xOnlyHex, { parity });
   // The VM id is a fragment URI rooted at the WebID's document. We strip
   // any existing fragment so paths like ".../card.jsonld#me" yield
   // ".../card.jsonld#nostr-key-1".
-  // The controller is the WebID itself (with its fragment) — this matches
-  // CID v1 self-control where the profile's outer controller is also the
-  // WebID, so all controller predicates inside the document agree.
   const docUrl = stripHash(webId);
   return {
     id: `${docUrl}#${fragment}`,
     type: 'Multikey',
-    controller: webId,
+    controller: controller ?? webId,
     publicKeyMultibase: mb,
   };
 }