feat(mosaic): Wire up password section

[austincalvelage]

Description

Wire the Mosaic password section to Clerk so users can set or change their password, with validation, API errors, pending state, and the option to sign out other sessions. Changing an existing password requires the current password. Users with an active enterprise account cannot set or change a password, matching legacy behavior. Add a Swingset live page at /live/password.

Session reverification UI is deferred. Requests that require reverification surface the API error.

Checklist

• pnpm test runs as expected.
• pnpm build runs as expected.
• (If applicable) JSDoc comments have been added or updated for any package exports
• (If applicable) Documentation has been updated

Type of change

• 🐛 Bug fix
• 🌟 New feature
• 🔨 Breaking change
• 📖 Refactoring / dependency upgrade / documentation
• other:

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clerk-js-sandbox	Ready	Preview	Oct 1, 2026 9:57pm UTC
swingset	Ready	Preview	Oct 1, 2026 9:57pm UTC

[changeset-bot]

🦋 Changeset detected

Latest commit: e664a41

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 0 packages

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Team

Run ID: b0422d90-c708-49db-b613-bcefdc003fb0

📥 Commits

Reviewing files that changed from the base of the PR and between 4251d27 and 52e3837.

📒 Files selected for processing (4)

• packages/mosaic/src/features/user-profile/user-profile-password-section/user-profile-password-feedback.test.ts
• packages/mosaic/src/features/user-profile/user-profile-password-section/user-profile-password-feedback.ts
• packages/mosaic/src/features/user-profile/user-profile-password-section/user-profile-password-section.model.ts
• packages/mosaic/src/features/user-profile/user-profile-password-section/user-profile-password-section.tsx

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• clerk/clerk_go (manual)
• clerk/dashboard (manual)
• clerk/accounts (manual)
• clerk/backoffice (manual)
• clerk/clerk (manual)
• clerk/clerk-docs (manual)
• clerk/cloudflare-workers (manual)
• clerk/cli (auto-detected)
• clerk/clerk-ios (auto-detected)
• clerk/clerk-android (auto-detected)

Included review availability: This review used your included allowance. 9 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 10 reviews per hour.

---

📝 Walkthrough

Walkthrough

Adds password policy and validation to Mosaic, including password-strength feedback and localized error handling. Adds a password section with asynchronous validation and update handling, and supplies it to the security panel through a slot. Adds a live password page and navigation entry. Updates feature tests, test fixtures, and field feedback support.

Priority: ➖ Normal

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related PRs

• clerk/javascript#9750: Adds the Mosaic password-section UI, controller, dialog, public types, and stories that this PR connects to Clerk’s password model and update flow.

Merge Risk: ⚪ Minimal · up to 52e38

No new merge-blocking issue is established for these changes. Normal checks and confirmation of the previously reported password-validation concern remain appropriate before merging.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 2.86% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 35 functions across 31 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main change: wiring the Mosaic password section to Clerk.
Description check	✅ Passed	The description directly covers password setting and changing, validation, API errors, pending state, enterprise-account behavior, and the new live page.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

⚔️ Resolve merge conflicts 💡

• Resolve merge conflict in branch austin/password-section-wire-up

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

_{Comment @coderabbitai help to get the list of available commands.}

[austincalvelage]

Adds variant to mirror legacy:

Legacy:

Mosiac: