fix(expo): ignore session activity in the native sync fingerprint

Session updatedAt can move on session activity and token refresh, which
would refresh the native client on every token refresh. Profile edits
still reach native through the active user's updatedAt.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: mikepitre

packages/expo/src/provider/__tests__/nativeClientSyncBehavior/fakeClerk.ts

@@ -6,6 +6,7 @@ import type { FakeClerkServer, FakeServerClientJSON, FapiResponse } from './fake
 export type FakeSessionResource = {
   id: string;
   status: 'active';
+  activityVersion: number;
   updatedAt: Date;
   user: { id: string; profileVersion: number; updatedAt: Date };
 };
@@ -19,12 +20,12 @@ type ListenerCallback = (resources: { client: FakeClientResource; session: FakeS
 type StatusListener = (status: string) => void;
 
 function toSessionResource(session: FakeServerClientJSON['sessions'][number]): FakeSessionResource {
-  const updatedAt = new Date(session.profileVersion);
   return {
     id: session.id,
     status: 'active',
-    updatedAt,
-    user: { id: session.userId, profileVersion: session.profileVersion, updatedAt },
+    activityVersion: session.activityVersion,
+    updatedAt: new Date(session.profileVersion + session.activityVersion),
+    user: { id: session.userId, profileVersion: session.profileVersion, updatedAt: new Date(session.profileVersion) },
   };
 }
 
@@ -63,6 +64,7 @@ export class FakeClientResource {
         id: session.id,
         userId: session.user.id,
         profileVersion: session.user.profileVersion,
+        activityVersion: session.activityVersion,
       })),
     };
   }
@@ -238,6 +240,7 @@ export class FakeClerk {
       await this.handleUnauthenticated();
       return false;
     }
+    this.#applyPiggybackedClient(response);
     return true;
   }
 

packages/expo/src/provider/__tests__/nativeClientSyncBehavior/fakeServer.ts

@@ -2,6 +2,8 @@ export type FakeServerSessionJSON = {
   id: string;
   userId: string;
   profileVersion: number;
+  /** Bumped by session activity such as minting a session token. */
+  activityVersion: number;
 };
 
 export type FakeServerClientJSON = {
@@ -95,7 +97,7 @@ export class FakeClerkServer {
     const { client, token } = this.#createClient();
     const sessionIds: Record<string, string> = {};
     for (const userId of users) {
-      const session = { id: this.#nextId('sess'), userId, profileVersion: 0 };
+      const session = { id: this.#nextId('sess'), userId, profileVersion: 0, activityVersion: 0 };
       client.sessions.push(session);
       sessionIds[userId] = session.id;
     }
@@ -151,7 +153,7 @@ export class FakeClerkServer {
       client = created.client;
       responseToken = created.token;
     }
-    const session = { id: this.#nextId('sess'), userId, profileVersion: 0 };
+    const session = { id: this.#nextId('sess'), userId, profileVersion: 0, activityVersion: 0 };
     client.sessions.push(session);
     client.lastActiveSessionId = session.id;
     return { ...this.#respond(responseToken, client), sessionId: session.id };
@@ -193,8 +195,11 @@ export class FakeClerkServer {
   async createSessionToken(caller: FapiCaller, token: string | null, sessionId: string): Promise<FapiResponse> {
     await this.#request(caller, 'POST /client/sessions/:id/tokens', token);
     const client = this.#clientFor(token);
-    const status = client?.sessions.some(session => session.id === sessionId) ? 200 : 401;
-    return this.#respond(token, client, status);
+    const session = client?.sessions.find(candidate => candidate.id === sessionId);
+    if (session) {
+      session.activityVersion += 1;
+    }
+    return this.#respond(token, client, session ? 200 : 401);
   }
 
   async updateUser(caller: FapiCaller, token: string | null, sessionId: string): Promise<FapiResponse> {

packages/expo/src/provider/__tests__/nativeClientSyncBehavior/nativeClientSync.behavior.test.tsx

@@ -289,6 +289,26 @@ describe('native client sync behavior', () => {
       await expectConverged(h);
     });
 
+    it('refreshes native for a profile update but not for session activity that only bumps the session', async () => {
+      const { server, token, sessionIds } = seedDevice(['user_1']);
+      const h = await start({ server, jsDeviceToken: token, nativeDeviceToken: token });
+      const refreshesBefore = h.native.clientRefreshCount;
+      const updatedAtBefore = h.js.session?.updatedAt.getTime();
+
+      await h.run(() => Promise.all([h.js.getSessionToken(), h.js.getSessionToken()]));
+      await h.settle();
+
+      expect(h.js.session?.updatedAt.getTime()).toBeGreaterThan(updatedAtBefore ?? Infinity);
+      expect(h.native.clientRefreshCount - refreshesBefore).toBe(0);
+
+      await h.run(() => h.js.updateProfile());
+      await h.settle();
+
+      expect(h.native.clientRefreshCount - refreshesBefore).toBe(1);
+      expect(h.native.client?.sessions.find(session => session.id === sessionIds.user_1)?.profileVersion).toBe(1);
+      await expectConverged(h);
+    });
+
     it('settles a JS change without an echo loop', async () => {
       const { server, token, sessionIds } = seedDevice(['user_1', 'user_2'], 'user_1');
       const h = await start({ server, jsDeviceToken: token, nativeDeviceToken: token });

packages/expo/src/provider/nativeClientSync.ts

@@ -97,7 +97,7 @@ function fingerprint(clerk: SyncableClerk): string {
   return JSON.stringify([
     client?.id ?? null,
     client?.lastActiveSessionId ?? null,
-    client?.signedInSessions.map(session => [session.id, session.status, +session.updatedAt]) ?? [],
+    client?.signedInSessions.map(session => [session.id, session.status]) ?? [],
     user?.id ?? null,
     +(user?.updatedAt ?? 0),
   ]);