refactor(mosaic): extract the debounced password check into useDebouncedAsync

[alexcarpenter]

Description

Follow-up to #9930 (comment): the debounce, cancellation and stale-result handling for the new password hint move out of a useEffect in the edit password controller and into a reusable useDebouncedAsync hook. The password field behaves the same as before.

The hint stays outside useForm on purpose. It never blocks submit, so it isn't validation; TanStack Form and React Hook Form both keep non-blocking hints out of their validators too.

useDebouncedAsync(value, run, { delayMs, enabled }) returns { data, error, isPending }:

• Runs run(value, { signal }) once value has stopped changing for delayMs.
• Keeps the previous result while the next one is pending.
• A new value, disabling or unmounting aborts the signal and ignores late results.
• A reject or throw lands on error.
• Disabling clears the result.

Checklist

• pnpm test runs as expected.
• pnpm build runs as expected.
• (If applicable) JSDoc comments have been added or updated for any package exports
• (If applicable) Documentation has been updated

Type of change

• 🐛 Bug fix
• 🌟 New feature
• 🔨 Breaking change
• 📖 Refactoring / dependency upgrade / documentation
• other:

[changeset-bot]

🦋 Changeset detected

Latest commit: eca67cb

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 0 packages

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clerk-js-sandbox	Ready	Preview	Oct 5, 2026 4:38pm UTC
swingset	Ready	Preview	Oct 5, 2026 4:38pm UTC

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Team
• Run ID: 75b5b738-6ece-4495-8759-fce1f924fea9

📥 Commits

Reviewing files that changed from the base of the PR and between b4b50fe and eca67cb.

📒 Files selected for processing (3)

• packages/mosaic/src/features/user-profile/user-profile-password-section/user-profile-edit-password.controller.ts
• packages/mosaic/src/hooks/__tests__/use-debounced-async.test.ts
• packages/mosaic/src/hooks/use-debounced-async.ts

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• clerk/clerk_go (manual)
• clerk/dashboard (manual)
• clerk/accounts (manual)
• clerk/backoffice (manual)
• clerk/clerk (manual)
• clerk/clerk-docs (manual)
• clerk/cloudflare-workers (manual)
• clerk/clerk-ios (auto-detected)
• clerk/clerk-android (auto-detected)
• clerk/cli (auto-detected)

Included review availability: This review used your included allowance. 7 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 8 reviews per hour.

---

📝 Walkthrough

Walkthrough

The change adds useDebouncedAsync to run asynchronous callbacks after a value remains unchanged for a specified delay. The hook returns data, errors, and pending status, and aborts work when its value or enabled state changes or when it unmounts. Password editing uses the hook for validation feedback. Tests cover debounce behavior, cancellation, and error handling.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to eca67

This refactor moves the password hint's debounce and cancellation into a reusable hook while keeping the behavior the same. No actionable merge-blocking risk was found. Run the test and build checks before merging.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 6.25% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 16 functions across 9 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly describes the main change: extracting the debounced password check into the reusable useDebouncedAsync hook.
Description check	✅ Passed	The description explains the extraction of debounce, cancellation, and stale-result handling into useDebouncedAsync, which matches the changeset.

• Fix all pre-merge checks with AI

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@10065

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@10065

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@10065

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@10065

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@10065

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@10065

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@10065

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@10065

@clerk/expo-biometrics

npm i https://pkg.pr.new/@clerk/expo-biometrics@10065

@clerk/expo-google-signin

npm i https://pkg.pr.new/@clerk/expo-google-signin@10065

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@10065

@clerk/express

npm i https://pkg.pr.new/@clerk/express@10065

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@10065

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@10065

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@10065

@clerk/mosaic

npm i https://pkg.pr.new/@clerk/mosaic@10065

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@10065

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@10065

@clerk/react

npm i https://pkg.pr.new/@clerk/react@10065

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@10065

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@10065

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@10065

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@10065

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@10065

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@10065

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@10065

commit: eca67cb