fix: bound every outbound fetch with a timeout (R1.2)

[stormer78]

Second of the audit findings. CLAUDE.md names handleApiGet/handleApiPost as the unbounded fetch that hangs a page against a blackholed VTA. That one was fixed in #88 and is now the single compliant call site in the repo. Nine others never were.

Why they were missed

A literal grep "fetch(" finds one call site repo-wide and would report R1.2 as satisfied. This package injects fetch for testability:

const f = opts.fetch ?? fetch.bind(globalThis);

so the real calls are spelled f(...), fetchFn(...), this.fetchImpl(...) — and none of the six files containing them mentioned signal, AbortSignal, or timeout.

An unbounded fetch against a wedged peer doesn't fail slowly, it doesn't fail at all: the page waits on a promise that never settles, and in MV3 the unresolved await also pins the service worker awake and stacks later requests behind it. Nothing surfaces an error, so nothing reports it.

Sites bounded

file	what
vault/transport.ts ×2	/auth/challenge + /auth/ — the bearer handshake
vta/rest-channel.ts	the Trust-Task REST dispatcher
vta/client.ts	PWA passkey enrolment
rp-login/step-up.ts ×2	VTA step-up start/finish
siop/login-client.ts ×2	SIOP challenge/authenticate
device/register-gateway.ts	push registration

Approach

withFetchTimeout is applied at each injection point, not each call site. That is what makes coverage complete, and it matters most for getVtaBearer — it runs before every REST request and is reached only indirectly through VtaAuthInputs, so leaving it unbounded would have defeated a timeout added anywhere downstream.

A caller-supplied signal is combined with the deadline, not replaced — silently disabling a caller's cancellation would be a worse bug than the one being fixed. Where AbortSignal.any is unavailable the timeout survives: losing the combination is recoverable, losing the deadline is the defect.

Adds e.client.timeout so "the VTA never answered" is distinguishable from "the connection failed" via a stable code rather than message text (R3.7). isFetchTimeout matches DOMException.name — the platform's own machine-readable discriminant.

Verification

10 new tests: deadline fires on a blackholed peer, fast responses untouched, caller's abort still wins and isn't mistaken for a timeout, deadline survives a non-aborting caller signal, init fields preserved, global-fetch fallback bounded — plus a wiring test asserting a real exported path (registerPushChannel) actually hands a signal to its injected fetch. The helper being correct is not the same as it being applied.

Mutation-tested: with the timeout removed the suite hangs rather than failing — which is exactly the production symptom, and the clearest possible demonstration that the tests bind the behaviour.

Full suite 190/190 (was 180), clean build and lint.

Not verified: no run against a real wedged VTA in a loaded extension. The 20s default matches the extension proxy but has not been tuned against real VTA latency — if legitimate slow operations exist that exceed it, this converts a hang into a spurious failure. Worth a look before merge.

Remaining audit findings

1. register-gateway.ts:71-75 throws on status before reading the body, on a consent-capable endpoint (R3.7)
2. rest-channel.ts:98 consumes the body, so errorFromResponse re-reads a used stream and always loses the server's code — proven with a repro (R3.7)
3. Persist-before-ack violated structurally in vti-didcomm-js — cross-repo (R1.6/R4.1)

Pre-merge checklist

• All clients have finite timeouts (R1.2) — this is the fix; every injection point now wrapped
• No lock held across a network await (R1.3) — n/a
• No local state committed before its remote effect (R2.1) — n/a
• Every retry bounded + backed off (R1.4) — the rest-channel 401 retry is unchanged and now bounded on both attempts
• Accept/poll/listen loops survive transient errors (R1.5) — n/a
• Acks/deletes only after durable handoff (R1.6) — untouched; see remaining finding 3
• New/changed wire types (R3.*) — e.client.timeout is a client-side code, not a wire type; no consumer switches exhaustively on the union
• Config absence = most restrictive (R5.*) — no injected fetch still yields a bounded one; the default applies unless overridden
• Logs/status claim only what was verified (R6.*) — a timeout now reports as a timeout instead of hanging silently
• "Process dies on the next line" answered (R2.1) — no mutation semantics changed
• Deviations flagged with rule numbers — none