fix(js): keep a Device Intelligence result that arrives after the deadline

[mwickett]

Description

ClerkJS waits a limited time for the Device Intelligence result (the Protect session token) before it sends a sign-in or sign-up. A result that arrived after that deadline was discarded. A failed attempt also isn't retried for 30 seconds, so a user who clicked again inside that window sent the request without a result again, even though the token was already in the page. In production, most sign-ups that timed out were sent 10–30 seconds after the script request reached the server, so this is the usual shape of a timeout.

This PR keeps a result that arrives after the deadline and writes it to the shared token store, where the next sign-in or sign-up picks it up. It covers both ways a result can be late:

• the loader script finishes loading after the deadline (the common case on slow connections);
• the script loads in time, but its ready promise settles after the deadline. The late read has no second deadline, so the result is kept however late it arrives.

What stays the same:

• The request that timed out still reports timeout, and no request waits any longer than before.
• A late token goes through the same checks as an on-time one: minted for this page's correlation id, well-formed, unexpired, under the size limit.
• The server still decides whether a token is valid; when it reached the browser isn't part of that check.
• A late token is saved under the same cross-tab lock as an on-time one. It doesn't replace a stored token that is at least as good: one stamped with a newer invalidation cutoff, or one that expires later.
• Instances using the optional token_url mint are unchanged.

When a late token is stored, the failure backoff resets, since the attempt did produce a token.

The clerk.no-rhc.js bundlewatch limit goes from 322.25KB to 322.5KB; this change lands about 40 bytes over the old one.

This is independent of #10275, which raises the default wait to 10 seconds; each helps on its own.

Ref: PROT-1231

Checklist

• pnpm test runs as expected.
• pnpm build runs as expected.
• (If applicable) JSDoc comments have been added or updated for any package exports
• (If applicable) Documentation has been updated

Type of change

• 🐛 Bug fix
• 🌟 New feature
• 🔨 Breaking change
• 📖 Refactoring / dependency upgrade / documentation
• other:

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clerk-js-sandbox	Ready	Preview	Oct 16, 2026 1:25pm UTC
swingset	Ready	Preview	Oct 16, 2026 1:25pm UTC

[changeset-bot]

🦋 Changeset detected

Latest commit: b5f04ea

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 4 packages

Name	Type
@clerk/clerk-js	Patch
@clerk/chrome-extension	Patch
@clerk/electron	Patch
@clerk/expo	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@10276

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@10276

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@10276

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@10276

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@10276

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@10276

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@10276

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@10276

@clerk/expo-biometrics

npm i https://pkg.pr.new/@clerk/expo-biometrics@10276

@clerk/expo-google-signin

npm i https://pkg.pr.new/@clerk/expo-google-signin@10276

@clerk/expo-native-components

npm i https://pkg.pr.new/@clerk/expo-native-components@10276

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@10276

@clerk/express

npm i https://pkg.pr.new/@clerk/express@10276

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@10276

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@10276

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@10276

@clerk/mosaic

npm i https://pkg.pr.new/@clerk/mosaic@10276

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@10276

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@10276

@clerk/react

npm i https://pkg.pr.new/@clerk/react@10276

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@10276

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@10276

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@10276

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@10276

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@10276

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@10276

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@10276

commit: b5f04ea