Summary
waitForAuthResponse has no way for a caller to cancel it. Once called, it keeps its relay subscription open until it resolves, rejects, or hits its internal timeout — there's no AbortSignal or cancel callback in WaitForAuthOptions.
Impact
Consumers that show a "Sign in with Signet" QR/relay flow and let the user cancel or go back cannot stop the underlying subscription. It stays live for the remainder of the (caller-configurable, up to several minutes) timeout. Repeated cancel/retry cycles accumulate concurrent live subscriptions until each one's timeout elapses. It's a resource leak rather than a correctness bug, but it's not something the consumer can mitigate from their side today.
Seen while reviewing signet-login's modal flow: cancelling the QR screen resolves the local UI promise, but there's no hook to tear down the waitForAuthResponse subscription. signet-login currently guards against a late result mutating torn-down UI, but the subscription itself can only be closed from inside signet-verify.
Proposed change
Add an optional abortSignal?: AbortSignal (and/or a returned cancel handle) to WaitForAuthOptions, and close the relay subscription when it fires. Backward compatible — existing callers pass nothing and behave as today.
Summary
waitForAuthResponsehas no way for a caller to cancel it. Once called, it keeps its relay subscription open until it resolves, rejects, or hits its internaltimeout— there's noAbortSignalor cancel callback inWaitForAuthOptions.Impact
Consumers that show a "Sign in with Signet" QR/relay flow and let the user cancel or go back cannot stop the underlying subscription. It stays live for the remainder of the (caller-configurable, up to several minutes) timeout. Repeated cancel/retry cycles accumulate concurrent live subscriptions until each one's timeout elapses. It's a resource leak rather than a correctness bug, but it's not something the consumer can mitigate from their side today.
Seen while reviewing
signet-login's modal flow: cancelling the QR screen resolves the local UI promise, but there's no hook to tear down thewaitForAuthResponsesubscription.signet-logincurrently guards against a late result mutating torn-down UI, but the subscription itself can only be closed from insidesignet-verify.Proposed change
Add an optional
abortSignal?: AbortSignal(and/or a returned cancel handle) toWaitForAuthOptions, and close the relay subscription when it fires. Backward compatible — existing callers pass nothing and behave as today.