requestPermission's 10s approval timeout called resolve(undefined) but never
clearPending, and a single admin's response cleared only its own id. So every
timed-out approval, and (with multiple admin npubs) the non-responding admins'
entries, leaked permanently in transport.pending — each retaining its closure
over remotePubkey/keyName/method/the serialized sign_event payload, so growth
tracked signing traffic. Scope: the admin-DM auth path (only when no web baseUrl
is set).
- Collect every issued request id; a single `finish()` resolves once and clears
ALL of them, on both timeout and the first response.
- A `settled` latch makes late/duplicate responses no-ops — which also stops a
late 'always' approval from running allowAllRequestsFromKey after the request
already resolved (review AD-2).
- Guard nip19.decode so a malformed admin npub skips that admin instead of
throwing through the loop.
- Defense-in-depth: bound transport.pending at 1000 (evict oldest) so any other
un-cleared path can't grow it without limit.
tsc at baseline; daemon bundles; admin + nip46 suites green.
Refs: transport review AD-1/CS-2/AD-2; #42
