feat(clerk-js,shared): add experimental trusted device resources

[mikepitre]

Description

Foundational, additive resource support for trusted devices (called biometric credentials in native SDKs), so clerk-js can talk to FAPI directly for Expo biometric sign-in. Device key creation, signing, and sign-in/enrollment orchestration will come in follow-up PRs.

@clerk/shared types:

• trusted_device strategy (TrustedDeviceStrategy) added to SignInStrategy, to SignInCreateParams (with trustedDeviceId), and to AttemptFirstFactorParams (TrustedDeviceAttempt: trustedDeviceId, clientData, signature, algorithm: 'ES256'). SignInFirstFactor/SignInSecondFactor are unchanged, since FAPI does not list trusted_device in sign-in supported factors and sign-in attempt_second_factor does not accept it.
• TrustedDeviceChallengeJSON / TrustedDeviceChallengeResource, exposed as an optional trustedDeviceChallenge on VerificationResource.
• NativeSettingsJSON / NativeSettingsResource, exposed as nativeSettings on AuthConfigResource.
• BiometricCredentialJSON / BiometricCredentialResource, plus PrepareBiometricCredentialParams / AttemptBiometricCredentialParams.

@clerk/clerk-js:

• Verification parses trusted_device_challenge (FAPI's expires_at there is in seconds) and includes it in the snapshot when present.
• AuthConfig parses native_settings and includes it in its snapshot.
• New BiometricCredential resource, plus User.__experimental_getBiometricCredentials(), __experimental_prepareBiometricCredential(), __experimental_attemptBiometricCredential() and __experimental_revokeBiometricCredential(id) for /v1/me/biometric_credentials. publicKeyJwk accepts a JWK object or its JSON string.
• signIn.create / signIn.attemptFirstFactor already forward params as-is, so trusted_device requests serialize to trusted_device_id, client_data, signature, algorithm with no runtime changes.

All new surface is additive and marked @experimental. Nothing on the Clerk class changes.

Bundlewatch: clerk.native.js goes from 79.94KB to 80.63KB gzip, so its maxSize goes from 80KB to 82KB. Other entries grew by about 0.7KB and remain under their limits.

Checklist

• pnpm test runs as expected.
• pnpm build runs as expected.
• (If applicable) JSDoc comments have been added or updated for any package exports
• (If applicable) Documentation has been updated

Type of change

• 🐛 Bug fix
• 🌟 New feature
• 🔨 Breaking change
• 📖 Refactoring / dependency upgrade / documentation
• other:

🤖 Generated with Claude Code

[changeset-bot]

🦋 Changeset detected

Latest commit: f9b9404

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 24 packages

Name	Type
@clerk/clerk-js	Minor
@clerk/shared	Minor
@clerk/chrome-extension	Patch
@clerk/electron	Patch
@clerk/expo	Patch
@clerk/astro	Patch
@clerk/backend	Patch
@clerk/expo-passkeys	Patch
@clerk/express	Patch
@clerk/fastify	Patch
@clerk/hono	Patch
@clerk/localizations	Patch
@clerk/mosaic	Patch
@clerk/msw	Patch
@clerk/nextjs	Patch
@clerk/nuxt	Patch
@clerk/react-router	Patch
@clerk/react	Patch
@clerk/swingset	Patch
@clerk/tanstack-react-start	Patch
@clerk/testing	Patch
@clerk/ui	Patch
@clerk/vue	Patch
@clerk/expo-native-components	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clerk-js-sandbox	Ready	Preview	Sep 28, 2026 8:26pm UTC
swingset	Ready	Preview	Sep 28, 2026 8:26pm UTC

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}

[mikepitre]

Combined into #9989, which ships biometrics on today's native client sync. The sync redesign stack (#9955 onward) now sits on top of it.