[ottonomy]

Stacked on #76 — review and merge that first.

Closes #65.

When a did:web issuer's DID document could not be fetched (a 404, or an unreachable host), proof.signature failed with INVALID_SIGNATURE, which is the same verdict a tampered credential gets. The README's error taxonomy already promised DID_WEB_UNRESOLVED for this case, and classifySignatureError already reports it for an HTTPError whose requestUrl is the issuer's DID document. The problem was that the did:web driver verifier-core wires (didWebDriverWithHttpGet) threw plain Errors, so that branch never fired.

What changed

• didWebDriverWithHttpGet now rejects with a DidDocumentFetchError, named HTTPError and carrying requestUrl (plus status for a non-2xx answer). It does this for a non-2xx status and for anything httpGetService.get throws (transport failure, timeout, size cap, URL-policy refusal). It keeps the fetcher's fixed message and attaches the original error as cause, so no network error text reaches a problem detail.
• The classifier is unchanged. A failed fetch for a key that is not the issuer's, or for a presentation's own proof, now reports HTTP_ERROR.

did:web DID document fetch	before	after
non-2xx (e.g. 404)	INVALID_SIGNATURE	DID_WEB_UNRESOLVED
fetcher throws (host down, timeout, …)	INVALID_SIGNATURE	DID_WEB_UNRESOLVED
fails for a key that is not the issuer's, or a presentation proof	INVALID_SIGNATURE	HTTP_ERROR
succeeds, signature broken	INVALID_SIGNATURE	unchanged

Tests

• Driver tests with a stubbed fetch: a 404, and a fetch that throws. The second asserts that the fixed message is kept, that no ENOTFOUND text appears, and that the cause chain is preserved.
• test/did-web-unresolved.spec.ts:
  • classifier cases for an issuer host, a path DID, another host, a did:key issuer, and no credential;
  • offline createVerifier cases with a real Ed25519Signature2020 signature (404 and fetch failure → DID_WEB_UNRESOLVED);
  • a control case: with the DID document served, the honest credential verifies and a tampered one still reports INVALID_SIGNATURE.
• The acceptance cases fail when the driver change is reverted.

Validation

• pnpm run build: passes.
• pnpm run test (lint + vitest): passes, with 1003 tests.
• tsc -p tsconfig.dev.json: the same 6 pre-existing errors as on the base branch, and none new.
• Manual check on the live network: vc-test-fixtures verifiableCredentials/v2/ed25519/didWeb/badDidWeb.json verified with createVerifier() defaults now gives DID_WEB_UNRESOLVED ("…could not be retrieved from https://digitalcredentials.github.io/dcc-did-web-bad/did.json").
• test:browser (Playwright) was not run.

Not in this PR

• A DID document that loads but has the wrong id, and an allow-list refusal, still report INVALID_SIGNATURE.
• A status list whose did:web issuer cannot be resolved still reports STATUS_LIST_SIGNATURE_ERROR.

🤖 Generated with Claude Code