Summary

Three small E2E reliability fixes uncovered while investigating consistent CI failures across multiple suites.

1. Strong random fake-user passwords

createFakeUser built passwords as ${email}${randomHash} (e.g. 76557538ea+clerk_test@clerkcookie.com76557538ea). FAPI's compromised-password check rejects these with form_password_compromised (HTTP 422), which broke any sign-in flow that wasn't intentionally testing the compromised-password path. Replaced with a fakerPassword() helper that emits a high-entropy base64url string with a fixed Aa1! prefix to satisfy default Clerk complexity rules (upper, lower, digit, symbol).

2. Defensive afterAll cleanup

When a test suite's beforeAll timed out or threw (BAPI hiccup, dev server slow to come up, etc.), afterAll would crash with a TypeError on the un-assigned fakeUser / fakeOrganization / network / fakeOAuth / fakeAPIKey, masking the real failure. Optional-chain the cleanup calls in:

• integration/tests/components.test.ts
• integration/testUtils/machineAuthHelpers.ts (apiKey, m2m, oauth describes)

3. Drop timer-dependent token-cache assertions

Two MemoryTokenCache cross-tab tests assumed JWT TTL = 60s and waited 50s of wall-clock time for the proactive-refresh setTimeout to fire. The dev test instance now issues 300s tokens, so the refresh fires at ~283s and the tests never reached it.

The BroadcastChannel-based deduplication these tests were checking is already covered elsewhere; the proactive-refresh timer scheduling itself is best validated by unit tests that mock setTimeout, not by real-time integration tests.

• Delete integration/tests/session-token-cache/single-session.test.ts "multi-tab scheduled refreshes are deduped to a single request". The same broadcast-dedup path is exercised by the existing line-49 test ("multi-tab token sharing works when clearing the cache") via getToken({ skipCache: true }).
• Rewrite integration/tests/session-token-cache/multi-session.test.ts:249 (now "cross-session token refreshes do not deduplicate") to manually trigger getToken({ skipCache: true }) on each tab. Different sessions have different tokenIds, so BroadcastChannel doesn't dedupe — each tab is expected to make its own request. Unique coverage the single-session test doesn't provide.

Scoped to integration/ only and doesn't affect any published package — empty changeset.

Test plan

• generic components-component-smoke — real beforeAll failure surfaces instead of TypeError: ... 'delete'
• machine tests-with-invalid-M2M-tokens / local-verification — real ClerkAPIResponseError surfaces instead of TypeError: ... 'cleanup'
• generic multi-tab token sharing works when clearing the cache — still green (covers the broadcast-dedup path the deleted timer test was duplicating)
• nextjs cross-session token refreshes do not deduplicate — green; runs in seconds and asserts the cross-session non-dedup case
• No regression in nextjs session-tasks-sign-in-reset-password (test still calls setPasswordCompromised on purpose)