feat(mosaic): add reverification to password updates

[austincalvelage]

Description

Adds session reverification to the Mosaic password section. When reverification is enabled, the current-password field is hidden to match legacy. A verification challenge appears inside the password dialog, and successful verification retries the save.

• Password uses useReverificationFlow directly. The model keeps password-specific error mapping and passes reverification errors through. The existing save() helper maps errors from the wrapped action for the form.
• Closing verification cancels the submission without an error. If the retry requires verification again, the shared wrapper rejects it and the form retains its draft with an error.
• Password, confirmation, and device-details dialogs share ReverificationFlow. Password uses useFlowAutoFocus when returning to the form, and the verification error card closes the host dialog.

Based on #10214, with the shared fixes from #10215 and #10216 integrated. #10215 and #10216 target main directly. #10214 is still stacked on Fredrik's branch. Their changes remain in this diff until they land in main.

Checklist

• Once chore(mosaic): export isReverificationError #10214, fix(mosaic): treat a cancelled reverification as no form error #10215, and fix(mosaic): reject a repeated reverification hint #10216 land in main, update this branch from main and retarget the PR to main.
• pnpm test runs as expected.
• pnpm build runs as expected.
• (If applicable) JSDoc comments have been added or updated for any package exports
• (If applicable) Documentation has been updated

Type of change

• 🐛 Bug fix
• 🌟 New feature
• 🔨 Breaking change
• 📖 Refactoring / dependency upgrade / documentation
• other:

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clerk-js-sandbox	Ready	Preview	Oct 13, 2026 7:12pm UTC
swingset	Ready	Preview	Oct 13, 2026 7:12pm UTC

[changeset-bot]

🦋 Changeset detected

Latest commit: 64040fc

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 4 packages

Name	Type
@clerk/ui	Patch
@clerk/nextjs	Patch
@clerk/chrome-extension	Patch
@clerk/swingset	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Team
• Run ID: c35018a8-c511-48bc-81f8-d6b50151e701

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@10194

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@10194

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@10194

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@10194

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@10194

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@10194

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@10194

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@10194

@clerk/expo-biometrics

npm i https://pkg.pr.new/@clerk/expo-biometrics@10194

@clerk/expo-google-signin

npm i https://pkg.pr.new/@clerk/expo-google-signin@10194

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@10194

@clerk/express

npm i https://pkg.pr.new/@clerk/express@10194

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@10194

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@10194

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@10194

@clerk/mosaic

npm i https://pkg.pr.new/@clerk/mosaic@10194

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@10194

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@10194

@clerk/react

npm i https://pkg.pr.new/@clerk/react@10194

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@10194

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@10194

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@10194

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@10194

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@10194

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@10194

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@10194

commit: 6423c9d

[alexcarpenter]

Section wiring matches Fredrik's stack. Below that, the PR rebuilds useConfirmController by hand because password is a form, and adds pieces nothing else in Mosaic has. The real gap is that useForm doesn't know about reverification. I'd block on the formatError and controller try/catch comments; the rest follow from them.