Address copilot pass 11 on #2

- doctor.js: bail with a clean fail-check when JSON.parse returns
  null, a primitive, or an array. Previously these would crash
  downstream on profile['@id'] / profile.controller access and
  surface as a generic "Diagnostics crashed".
- lib/multikey.js: validate that webId is a non-empty string at the
  buildNostrVerificationMethod entry point. Also harden stripHash to
  not throw on non-string input — defensive since the helper is
  exported for standalone use.

Author: melvincarvalho

doctor.js

@@ -153,6 +153,17 @@ async function runAll(webIdUrl) {
     });
     return result;
   }
+  // JSON.parse accepts null, primitives, and arrays — none of which are
+  // a usable JSON-LD profile document. Bail out before downstream code
+  // tries to read `@id`/`controller` and throws.
+  if (profile === null || typeof profile !== 'object' || Array.isArray(profile)) {
+    checks.push({
+      status: 'fail',
+      label: 'Profile parses as JSON',
+      detail: `Top-level value is ${profile === null ? 'null' : Array.isArray(profile) ? 'an array' : typeof profile}; expected a JSON object.`,
+    });
+    return result;
+  }
   checks.push({ status: 'pass', label: 'Profile parses as JSON' });
 
   // Profile was fetched and parsed — safe to root a snippet against this URL.

lib/multikey.js

@@ -89,6 +89,9 @@ export function buildNostrVerificationMethod({
   fragment = 'nostr-key-1',
   parity = 0x02,
 }) {
+  if (typeof webId !== 'string' || webId.length === 0) {
+    throw new Error('webId must be a non-empty string');
+  }
   const mb = nostrPubkeyToMultikey(xOnlyHex, { parity });
   // The VM id is a fragment URI rooted at the WebID's document. We strip
   // any existing fragment so paths like ".../card.jsonld#me" yield
@@ -108,6 +111,7 @@ function normalizeHex(s) {
 }
 
 function stripHash(u) {
+  if (typeof u !== 'string') return u;
   try {
     const url = new URL(u);
     url.hash = '';