fix(clerk-js): backport monotonic session token guard for Core 2

[nikosdouvlis]

Why
Core 2 is still loaded into production apps, and it has the same bug #9030 fixed on main: a stale edge-minted session token (lower JWT oiat) can overwrite a fresher one on the same tab, clobbering the __session cookie or the in-memory lastActiveToken.

What changed
Ports the two write-site guards from #9030: the cookie-write guard in AuthCookieService and the lastActiveToken guard in Session, plus the tokenFreshness helpers they use. Freshness is ranked by the JWT oiat header, then iat; tokens without oiat pass through untouched. The tokenCache rework from #9030 (baseline/resolvedToken chaining, background-refresh timers) is left out on purpose: Core 2 predates that cache substrate, and the two guards deliver the guarantee on their own without pulling in unrelated features.

Blockers / related
Backports #9030.

[changeset-bot]

🦋 Changeset detected

Latest commit: 48ab952

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@clerk/clerk-js	Patch
@clerk/chrome-extension	Patch
@clerk/clerk-expo	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Ready	Preview, Comment	Jul 6, 2026 2:10pm
swingset	Error		Jul 6, 2026 2:10pm

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: d0a1f940-dc3f-46e3-b979-8fc3bae783f0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch backport/9030-monotonic-session-token-core-2

---

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

Open in StackBlitz

@clerk/agent-toolkit

npm i https://pkg.pr.new/@clerk/agent-toolkit@9090

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@9090

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@9090

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@9090

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@9090

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@9090

@clerk/elements

npm i https://pkg.pr.new/@clerk/elements@9090

@clerk/clerk-expo

npm i https://pkg.pr.new/@clerk/clerk-expo@9090

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@9090

@clerk/express

npm i https://pkg.pr.new/@clerk/express@9090

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@9090

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@9090

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@9090

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@9090

@clerk/clerk-react

npm i https://pkg.pr.new/@clerk/clerk-react@9090

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@9090

@clerk/remix

npm i https://pkg.pr.new/@clerk/remix@9090

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@9090

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@9090

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@9090

@clerk/themes

npm i https://pkg.pr.new/@clerk/themes@9090

@clerk/types

npm i https://pkg.pr.new/@clerk/types@9090

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@9090

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@9090

commit: 48ab952