feat(mosaic): wire up user profile MFA

[austincalvelage]

Description

Wire the Mosaic MFA section to Clerk so users can enroll an authenticator or SMS phone, change the default SMS factor, remove a factor, and generate backup codes. Support session reverification for protected actions and prevent removal of the last required factor. SMS setup reuses an existing unreserved phone when retrying after an error, including after editing and restoring its number.

Let users copy, download, or print server-issued backup codes. Reset the flow when the active user or session changes. Compose the connected section through the security panel's mfaSlot and add a live Swingset page at /live/mfa.

Full UserProfile assembly is outside this PR. This is a draft for continued review.

Checklist

• pnpm test runs as expected.
• pnpm build runs as expected.
• (If applicable) JSDoc comments have been added or updated for any package exports
• (If applicable) Documentation has been updated

Type of change

• 🐛 Bug fix
• 🌟 New feature
• 🔨 Breaking change
• 📖 Refactoring / dependency upgrade / documentation
• other:

[changeset-bot]

🦋 Changeset detected

Latest commit: 3bfbbca

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
@clerk/mosaic	Patch
@clerk/swingset	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clerk-js-sandbox	Ready	Preview	Oct 5, 2026 8:46pm UTC
swingset	Ready	Preview	Oct 5, 2026 8:46pm UTC

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@10054

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@10054

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@10054

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@10054

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@10054

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@10054

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@10054

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@10054

@clerk/expo-biometrics

npm i https://pkg.pr.new/@clerk/expo-biometrics@10054

@clerk/expo-google-signin

npm i https://pkg.pr.new/@clerk/expo-google-signin@10054

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@10054

@clerk/express

npm i https://pkg.pr.new/@clerk/express@10054

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@10054

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@10054

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@10054

@clerk/mosaic

npm i https://pkg.pr.new/@clerk/mosaic@10054

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@10054

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@10054

@clerk/react

npm i https://pkg.pr.new/@clerk/react@10054

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@10054

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@10054

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@10054

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@10054

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@10054

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@10054

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@10054

commit: 3bfbbca