fix(clerk-js): pickFreshestJwt returns incoming on full tie

Two tokens with identical oiat+iat may still differ in other claims
(azp, org_id, etc.) added in a token-format rollout. The previous
'no churn on tie' rule suppressed legitimate updates and caused the
backend to read stale claim sets, redirecting to /sign-in. Only
suppress when existing is strictly fresher.

Author: nikosdouvlis

packages/clerk-js/src/core/__tests__/tokenFreshness.test.ts

@@ -46,10 +46,13 @@ describe('pickFreshestJwt', () => {
       expect(pickFreshestJwt(existing, incoming)).toBe(incoming);
     });
 
-    it('picks existing when oiat equal and iat equal (identical, no churn)', () => {
+    it('picks incoming when oiat equal and iat equal (other claims may differ)', () => {
+      // Two tokens with identical oiat+iat may still differ in other claims
+      // (azp, org_id, etc.) during a token-format rollout. Only suppress when
+      // existing is strictly fresher; on full ties, let incoming through.
       const existing = makeToken({ oiat: 100, iat: 150 });
       const incoming = makeToken({ oiat: 100, iat: 150 });
-      expect(pickFreshestJwt(existing, incoming)).toBe(existing);
+      expect(pickFreshestJwt(existing, incoming)).toBe(incoming);
     });
 
     it('picks existing when oiat equal and incoming iat missing (treated as 0)', () => {

packages/clerk-js/src/core/tokenFreshness.ts

@@ -42,7 +42,11 @@ export function pickFreshestJwt<T extends TokenResource | JWT>(existing: T, inco
     return incoming;
   }
 
+  // Equal oiat: tie-break by iat (more recent mint wins). On a full tie,
+  // return incoming: two tokens with identical oiat+iat may still differ
+  // in other claims (azp, org_id, etc.) added in a token-format rollout,
+  // so we only suppress when existing is strictly fresher.
   const existingIat = asJwt(existing)?.claims?.iat ?? 0;
   const incomingIat = asJwt(incoming)?.claims?.iat ?? 0;
-  return existingIat >= incomingIat ? existing : incoming;
+  return existingIat > incomingIat ? existing : incoming;
 }