chore(clerk-js): Remove CHIPS build variant, use environment flag for partitioned cookies

[brkalow]

Summary

• Remove the separate clerk.chips.browser.js build variant from rspack config, dev scripts, and bundlewatch
• Add partitioned_cookies field to the Environment API response (EnvironmentJSON / EnvironmentResource), following the client_debug_mode pattern
• Replace the build-time __BUILD_VARIANT_CHIPS__ constant with a runtime usePartitionedCookies getter that reads from Environment.getInstance().partitionedCookies
• Thread the flag through all three cookie handlers: session, client UAT, and dev browser

Test plan

• All existing cookie tests pass (session, clientUat, devBrowser)
• New test cases verify partitioned cookie behavior when usePartitionedCookies returns true
• Verify with a FAPI response that includes partitioned_cookies: true in the environment payload
• Confirm cookies are set with SameSite=None; Secure; Partitioned in a cross-origin iframe context

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores

  • Removed the legacy CHIPS build variant, its build/config entries, dev script, and bundlewatch entry.
  • Removed build-time cookie flag from tool configs.

• New Features

  • Added a runtime partitioned-cookies flag persisted in environment snapshots and configs.
  • Dev tooling exposes a refreshCookies action to reapply cookie state in development.

• Tests

  • Updated and added tests to validate partitioned-cookie behavior driven by the new runtime flag.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Ready	Preview, Comment	Feb 25, 2026 4:06am

[changeset-bot]

🦋 Changeset detected

Latest commit: 4d1a4a9

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 20 packages

Name	Type
@clerk/clerk-js	Patch
@clerk/shared	Patch
@clerk/chrome-extension	Patch
@clerk/expo	Patch
@clerk/agent-toolkit	Patch
@clerk/astro	Patch
@clerk/backend	Patch
@clerk/expo-passkeys	Patch
@clerk/express	Patch
@clerk/fastify	Patch
@clerk/localizations	Patch
@clerk/msw	Patch
@clerk/nextjs	Patch
@clerk/nuxt	Patch
@clerk/react-router	Patch
@clerk/react	Patch
@clerk/tanstack-react-start	Patch
@clerk/testing	Patch
@clerk/ui	Patch
@clerk/vue	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@clerk/agent-toolkit

npm i https://pkg.pr.new/@clerk/agent-toolkit@7916

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@7916

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@7916

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@7916

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@7916

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@7916

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@7916

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@7916

@clerk/express

npm i https://pkg.pr.new/@clerk/express@7916

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@7916

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@7916

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@7916

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@7916

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@7916

@clerk/react

npm i https://pkg.pr.new/@clerk/react@7916

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@7916

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@7916

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@7916

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@7916

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@7916

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@7916

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@7916

commit: 4d1a4a9

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The changes remove the CHIPS build variant and its compile-time flag from bundlewatch, build, and test configs, and delete the related dev script. Runtime control for partitioned cookies is introduced: Environment gains a partitionedCookies flag (serialized as partitioned_cookies), new cookie option types and callbacks (usePartitionedCookies) are added, and dev/session cookie creation and devBrowser APIs are updated to accept and act on these runtime cookie options. Tests and coverage configs were updated accordingly.

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically summarizes the main changes: removing the CHIPS build variant and replacing it with a runtime environment flag for partitioned cookies.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.changeset/remove-chips-build-variant.md:
- Around line 2-3: The changes add new exported API surface (partitionedCookies
on EnvironmentJSON/EnvironmentResource in `@clerk/shared` and partitionedCookies
plus cookieOptions parameters threading through cookie handlers on Environment
in `@clerk/clerk-js`); update the changeset bump from "patch" to "minor" for both
"@clerk/shared" and "@clerk/clerk-js" or, if you intentionally treat these
additions as internal, add an explicit rationale in the changeset explaining why
they remain "patch" (refer to the symbols EnvironmentJSON, EnvironmentResource,
Environment, partitionedCookies, and cookieOptions when documenting your
decision).

---

ℹ️ Review info

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between 73247c1 and 2e4d38c.

📒 Files selected for processing (1)

• .changeset/remove-chips-build-variant.md

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Consider whether minor bump is warranted for new public API surface.

Both packages are bumped as patch, but the changes introduce new public API surface:

• @clerk/shared adds partitionedCookies to the exported EnvironmentJSON / EnvironmentResource types.
• @clerk/clerk-js adds a partitionedCookies property to Environment and new cookieOptions parameters threading through cookie handlers.

Under standard SemVer, additive changes to a public API should be a minor bump. If your project's SemVer policy treats all non-breaking additions as patch (e.g., because these are considered internal/implementation details), this is fine to keep as-is — but it's worth a conscious call.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.
In @.changeset/remove-chips-build-variant.md around lines 2 - 3, The changes add
new exported API surface (partitionedCookies on
EnvironmentJSON/EnvironmentResource in `@clerk/shared` and partitionedCookies plus
cookieOptions parameters threading through cookie handlers on Environment in
`@clerk/clerk-js`); update the changeset bump from "patch" to "minor" for both
"@clerk/shared" and "@clerk/clerk-js" or, if you intentionally treat these
additions as internal, add an explicit rationale in the changeset explaining why
they remain "patch" (refer to the symbols EnvironmentJSON, EnvironmentResource,
Environment, partitionedCookies, and cookieOptions when documenting your
decision).

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@packages/clerk-js/src/core/auth/cookies/session.ts`:
- Around line 38-42: The remove() function only deletes cookies using the
current partitioned attributes, leaving non-partitioned __session cookies
behind; update remove() in session.ts to also explicitly remove the
non-partitioned variants by calling sessionCookie.remove(...) and
suffixedSessionCookie.remove(...) with both getCookieAttributes(options) and
getCookieAttributes({ ...options, partitioned: false }) (or otherwise obtain
both partitioned and non-partitioned attribute sets) so both cookie flavors are
deleted, and apply the same dual-attribute removal change to the analogous
remove logic in devBrowser.ts.

---

ℹ️ Review info

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between f4dd805 and ba2a15b.

📒 Files selected for processing (4)

• packages/clerk-js/src/core/auth/AuthCookieService.ts
• packages/clerk-js/src/core/auth/cookies/devBrowser.ts
• packages/clerk-js/src/core/auth/cookies/session.ts
• packages/clerk-js/src/core/auth/devBrowser.ts

🚧 Files skipped from review as they are similar to previous changes (2)

• packages/clerk-js/src/core/auth/devBrowser.ts
• packages/clerk-js/src/core/auth/AuthCookieService.ts

[coderabbitai]

⚠️ Potential issue | 🟠 Major

remove() doesn't clean up non-partitioned cookie variants when transitioning to partitioned mode.

set() (lines 52-55) correctly removes the old non-partitioned cookies before writing partitioned ones, but remove() only deletes cookies matching the current (partitioned) attributes. Because the browser treats partitioned and non-partitioned cookies with the same name as distinct, a sign-out that hits remove() without a prior set() in the same page lifecycle will leave stale non-partitioned __session cookies behind. The same gap exists in devBrowser.ts.

Proposed fix

 const remove = () => {
const attributes = getCookieAttributes(options);
+ // When partitioned, also remove leftover non-partitioned variants+ // (browser treats them as separate cookies).+ if (attributes.partitioned) {+ sessionCookie.remove();+ suffixedSessionCookie.remove();+ }
sessionCookie.remove(attributes);
suffixedSessionCookie.remove(attributes);
};

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.
In `@packages/clerk-js/src/core/auth/cookies/session.ts` around lines 38 - 42, The
remove() function only deletes cookies using the current partitioned attributes,
leaving non-partitioned __session cookies behind; update remove() in session.ts
to also explicitly remove the non-partitioned variants by calling
sessionCookie.remove(...) and suffixedSessionCookie.remove(...) with both
getCookieAttributes(options) and getCookieAttributes({ ...options, partitioned:
false }) (or otherwise obtain both partitioned and non-partitioned attribute
sets) so both cookie flavors are deleted, and apply the same dual-attribute
removal change to the analogous remove logic in devBrowser.ts.

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

packages/clerk-js/src/core/auth/cookies/clientUat.ts (1)

62-67: ⚠️ Potential issue | 🟠 Major

Partitioned mode does not clear domain-scoped non-partitioned __client_uat cookies

set() only removes host-only variants before writing, but writes with domain. If partitioned mode is turned on, stale domain-scoped non-partitioned cookies can remain and conflict with auth-state reads.

Proposed fix

 // Removes any existing cookies without a domain specified to ensure the change doesn't break existing sessions.
suffixedClientUatCookie.remove();
clientUatCookie.remove();
++ // When partitioned is enabled, also remove previously written domain-scoped+ // non-partitioned variants (partitioned/non-partitioned are distinct cookies).+ if (partitioned && domain) {+ suffixedClientUatCookie.remove({ domain, sameSite, secure });+ clientUatCookie.remove({ domain, sameSite, secure });+ }
suffixedClientUatCookie.set(val, { domain, expires, partitioned, sameSite, secure });
clientUatCookie.set(val, { domain, expires, partitioned, sameSite, secure });

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.
In `@packages/clerk-js/src/core/auth/cookies/clientUat.ts` around lines 62 - 67,
When partitioned mode is enabled the current logic calls
suffixedClientUatCookie.remove() and clientUatCookie.remove() (host-only
removals) then calls set(..., { domain, ... }) which writes domain-scoped
cookies but does not clear existing domain-scoped non-partitioned __client_uat
cookies; update the code so that before writing in partitioned mode you
explicitly remove any domain-scoped variants as well (e.g., call remove with the
domain option or enhance set() to first clear domain-scoped cookies) for both
suffixedClientUatCookie and clientUatCookie to prevent stale domain-scoped
cookies from conflicting with auth reads.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In `@packages/clerk-js/src/core/auth/cookies/clientUat.ts`:
- Around line 62-67: When partitioned mode is enabled the current logic calls
suffixedClientUatCookie.remove() and clientUatCookie.remove() (host-only
removals) then calls set(..., { domain, ... }) which writes domain-scoped
cookies but does not clear existing domain-scoped non-partitioned __client_uat
cookies; update the code so that before writing in partitioned mode you
explicitly remove any domain-scoped variants as well (e.g., call remove with the
domain option or enhance set() to first clear domain-scoped cookies) for both
suffixedClientUatCookie and clientUatCookie to prevent stale domain-scoped
cookies from conflicting with auth reads.

---

ℹ️ Review info

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between ba2a15b and 4d1a4a9.

📒 Files selected for processing (3)

• packages/clerk-js/src/core/auth/cookies/clientUat.ts
• packages/clerk-js/src/core/auth/cookies/devBrowser.ts
• packages/clerk-js/src/core/auth/cookies/session.ts

[jacekradko]

Sweet!

[brkalow]

Summary

• Remove the separate clerk.chips.browser.js build variant from rspack config, dev scripts, and bundlewatch
• Add partitioned_cookies field to the Environment API response (EnvironmentJSON / EnvironmentResource), following the client_debug_mode pattern
• Replace the build-time __BUILD_VARIANT_CHIPS__ constant with a runtime usePartitionedCookies getter that reads from Environment.getInstance().partitionedCookies
• Thread the flag through all three cookie handlers: session, client UAT, and dev browser

Test plan

• All existing cookie tests pass (session, clientUat, devBrowser)
• New test cases verify partitioned cookie behavior when usePartitionedCookies returns true
• Verify with a FAPI response that includes partitioned_cookies: true in the environment payload
• Confirm cookies are set with SameSite=None; Secure; Partitioned in a cross-origin iframe context

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores

  • Removed the legacy CHIPS build variant, its build/config entries, dev script, and bundlewatch entry.
  • Removed build-time cookie flag from tool configs.

• New Features

  • Added a runtime partitioned-cookies flag persisted in environment snapshots and configs.
  • Dev tooling exposes a refreshCookies action to reapply cookie state in development.

• Tests

  • Updated and added tests to validate partitioned-cookie behavior driven by the new runtime flag.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Ready	Preview, Comment	Feb 25, 2026 4:06am

[changeset-bot]

🦋 Changeset detected

Latest commit: 4d1a4a9

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 20 packages

Name	Type
@clerk/clerk-js	Patch
@clerk/shared	Patch
@clerk/chrome-extension	Patch
@clerk/expo	Patch
@clerk/agent-toolkit	Patch
@clerk/astro	Patch
@clerk/backend	Patch
@clerk/expo-passkeys	Patch
@clerk/express	Patch
@clerk/fastify	Patch
@clerk/localizations	Patch
@clerk/msw	Patch
@clerk/nextjs	Patch
@clerk/nuxt	Patch
@clerk/react-router	Patch
@clerk/react	Patch
@clerk/tanstack-react-start	Patch
@clerk/testing	Patch
@clerk/ui	Patch
@clerk/vue	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@clerk/agent-toolkit

npm i https://pkg.pr.new/@clerk/agent-toolkit@7916

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@7916

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@7916

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@7916

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@7916

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@7916

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@7916

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@7916

@clerk/express

npm i https://pkg.pr.new/@clerk/express@7916

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@7916

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@7916

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@7916

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@7916

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@7916

@clerk/react

npm i https://pkg.pr.new/@clerk/react@7916

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@7916

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@7916

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@7916

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@7916

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@7916

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@7916

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@7916

commit: 4d1a4a9

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The changes remove the CHIPS build variant and its compile-time flag from bundlewatch, build, and test configs, and delete the related dev script. Runtime control for partitioned cookies is introduced: Environment gains a partitionedCookies flag (serialized as partitioned_cookies), new cookie option types and callbacks (usePartitionedCookies) are added, and dev/session cookie creation and devBrowser APIs are updated to accept and act on these runtime cookie options. Tests and coverage configs were updated accordingly.

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically summarizes the main changes: removing the CHIPS build variant and replacing it with a runtime environment flag for partitioned cookies.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.changeset/remove-chips-build-variant.md:
- Around line 2-3: The changes add new exported API surface (partitionedCookies
on EnvironmentJSON/EnvironmentResource in `@clerk/shared` and partitionedCookies
plus cookieOptions parameters threading through cookie handlers on Environment
in `@clerk/clerk-js`); update the changeset bump from "patch" to "minor" for both
"@clerk/shared" and "@clerk/clerk-js" or, if you intentionally treat these
additions as internal, add an explicit rationale in the changeset explaining why
they remain "patch" (refer to the symbols EnvironmentJSON, EnvironmentResource,
Environment, partitionedCookies, and cookieOptions when documenting your
decision).

---

ℹ️ Review info

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between 73247c1 and 2e4d38c.

📒 Files selected for processing (1)

• .changeset/remove-chips-build-variant.md

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Consider whether minor bump is warranted for new public API surface.

Both packages are bumped as patch, but the changes introduce new public API surface:

• @clerk/shared adds partitionedCookies to the exported EnvironmentJSON / EnvironmentResource types.
• @clerk/clerk-js adds a partitionedCookies property to Environment and new cookieOptions parameters threading through cookie handlers.

Under standard SemVer, additive changes to a public API should be a minor bump. If your project's SemVer policy treats all non-breaking additions as patch (e.g., because these are considered internal/implementation details), this is fine to keep as-is — but it's worth a conscious call.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.
In @.changeset/remove-chips-build-variant.md around lines 2 - 3, The changes add
new exported API surface (partitionedCookies on
EnvironmentJSON/EnvironmentResource in `@clerk/shared` and partitionedCookies plus
cookieOptions parameters threading through cookie handlers on Environment in
`@clerk/clerk-js`); update the changeset bump from "patch" to "minor" for both
"@clerk/shared" and "@clerk/clerk-js" or, if you intentionally treat these
additions as internal, add an explicit rationale in the changeset explaining why
they remain "patch" (refer to the symbols EnvironmentJSON, EnvironmentResource,
Environment, partitionedCookies, and cookieOptions when documenting your
decision).

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@packages/clerk-js/src/core/auth/cookies/session.ts`:
- Around line 38-42: The remove() function only deletes cookies using the
current partitioned attributes, leaving non-partitioned __session cookies
behind; update remove() in session.ts to also explicitly remove the
non-partitioned variants by calling sessionCookie.remove(...) and
suffixedSessionCookie.remove(...) with both getCookieAttributes(options) and
getCookieAttributes({ ...options, partitioned: false }) (or otherwise obtain
both partitioned and non-partitioned attribute sets) so both cookie flavors are
deleted, and apply the same dual-attribute removal change to the analogous
remove logic in devBrowser.ts.

---

ℹ️ Review info

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between f4dd805 and ba2a15b.

📒 Files selected for processing (4)

• packages/clerk-js/src/core/auth/AuthCookieService.ts
• packages/clerk-js/src/core/auth/cookies/devBrowser.ts
• packages/clerk-js/src/core/auth/cookies/session.ts
• packages/clerk-js/src/core/auth/devBrowser.ts

🚧 Files skipped from review as they are similar to previous changes (2)

• packages/clerk-js/src/core/auth/devBrowser.ts
• packages/clerk-js/src/core/auth/AuthCookieService.ts

[coderabbitai]

⚠️ Potential issue | 🟠 Major

remove() doesn't clean up non-partitioned cookie variants when transitioning to partitioned mode.

set() (lines 52-55) correctly removes the old non-partitioned cookies before writing partitioned ones, but remove() only deletes cookies matching the current (partitioned) attributes. Because the browser treats partitioned and non-partitioned cookies with the same name as distinct, a sign-out that hits remove() without a prior set() in the same page lifecycle will leave stale non-partitioned __session cookies behind. The same gap exists in devBrowser.ts.

Proposed fix

 const remove = () => {
const attributes = getCookieAttributes(options);
+ // When partitioned, also remove leftover non-partitioned variants+ // (browser treats them as separate cookies).+ if (attributes.partitioned) {+ sessionCookie.remove();+ suffixedSessionCookie.remove();+ }
sessionCookie.remove(attributes);
suffixedSessionCookie.remove(attributes);
};

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.
In `@packages/clerk-js/src/core/auth/cookies/session.ts` around lines 38 - 42, The
remove() function only deletes cookies using the current partitioned attributes,
leaving non-partitioned __session cookies behind; update remove() in session.ts
to also explicitly remove the non-partitioned variants by calling
sessionCookie.remove(...) and suffixedSessionCookie.remove(...) with both
getCookieAttributes(options) and getCookieAttributes({ ...options, partitioned:
false }) (or otherwise obtain both partitioned and non-partitioned attribute
sets) so both cookie flavors are deleted, and apply the same dual-attribute
removal change to the analogous remove logic in devBrowser.ts.

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

packages/clerk-js/src/core/auth/cookies/clientUat.ts (1)

62-67: ⚠️ Potential issue | 🟠 Major

Partitioned mode does not clear domain-scoped non-partitioned __client_uat cookies

set() only removes host-only variants before writing, but writes with domain. If partitioned mode is turned on, stale domain-scoped non-partitioned cookies can remain and conflict with auth-state reads.

Proposed fix

 // Removes any existing cookies without a domain specified to ensure the change doesn't break existing sessions.
suffixedClientUatCookie.remove();
clientUatCookie.remove();
++ // When partitioned is enabled, also remove previously written domain-scoped+ // non-partitioned variants (partitioned/non-partitioned are distinct cookies).+ if (partitioned && domain) {+ suffixedClientUatCookie.remove({ domain, sameSite, secure });+ clientUatCookie.remove({ domain, sameSite, secure });+ }
suffixedClientUatCookie.set(val, { domain, expires, partitioned, sameSite, secure });
clientUatCookie.set(val, { domain, expires, partitioned, sameSite, secure });

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.
In `@packages/clerk-js/src/core/auth/cookies/clientUat.ts` around lines 62 - 67,
When partitioned mode is enabled the current logic calls
suffixedClientUatCookie.remove() and clientUatCookie.remove() (host-only
removals) then calls set(..., { domain, ... }) which writes domain-scoped
cookies but does not clear existing domain-scoped non-partitioned __client_uat
cookies; update the code so that before writing in partitioned mode you
explicitly remove any domain-scoped variants as well (e.g., call remove with the
domain option or enhance set() to first clear domain-scoped cookies) for both
suffixedClientUatCookie and clientUatCookie to prevent stale domain-scoped
cookies from conflicting with auth reads.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In `@packages/clerk-js/src/core/auth/cookies/clientUat.ts`:
- Around line 62-67: When partitioned mode is enabled the current logic calls
suffixedClientUatCookie.remove() and clientUatCookie.remove() (host-only
removals) then calls set(..., { domain, ... }) which writes domain-scoped
cookies but does not clear existing domain-scoped non-partitioned __client_uat
cookies; update the code so that before writing in partitioned mode you
explicitly remove any domain-scoped variants as well (e.g., call remove with the
domain option or enhance set() to first clear domain-scoped cookies) for both
suffixedClientUatCookie and clientUatCookie to prevent stale domain-scoped
cookies from conflicting with auth reads.

---

ℹ️ Review info

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between ba2a15b and 4d1a4a9.

📒 Files selected for processing (3)

• packages/clerk-js/src/core/auth/cookies/clientUat.ts
• packages/clerk-js/src/core/auth/cookies/devBrowser.ts
• packages/clerk-js/src/core/auth/cookies/session.ts

[jacekradko]

Sweet!

[brkalow]

Summary

• Remove the separate clerk.chips.browser.js build variant from rspack config, dev scripts, and bundlewatch
• Add partitioned_cookies field to the Environment API response (EnvironmentJSON / EnvironmentResource), following the client_debug_mode pattern
• Replace the build-time __BUILD_VARIANT_CHIPS__ constant with a runtime usePartitionedCookies getter that reads from Environment.getInstance().partitionedCookies
• Thread the flag through all three cookie handlers: session, client UAT, and dev browser

Test plan

• All existing cookie tests pass (session, clientUat, devBrowser)
• New test cases verify partitioned cookie behavior when usePartitionedCookies returns true
• Verify with a FAPI response that includes partitioned_cookies: true in the environment payload
• Confirm cookies are set with SameSite=None; Secure; Partitioned in a cross-origin iframe context

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores

  • Removed the legacy CHIPS build variant, its build/config entries, dev script, and bundlewatch entry.
  • Removed build-time cookie flag from tool configs.

• New Features

  • Added a runtime partitioned-cookies flag persisted in environment snapshots and configs.
  • Dev tooling exposes a refreshCookies action to reapply cookie state in development.

• Tests

  • Updated and added tests to validate partitioned-cookie behavior driven by the new runtime flag.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Ready	Preview, Comment	Feb 25, 2026 4:06am

[changeset-bot]

🦋 Changeset detected

Latest commit: 4d1a4a9

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 20 packages

Name	Type
@clerk/clerk-js	Patch
@clerk/shared	Patch
@clerk/chrome-extension	Patch
@clerk/expo	Patch
@clerk/agent-toolkit	Patch
@clerk/astro	Patch
@clerk/backend	Patch
@clerk/expo-passkeys	Patch
@clerk/express	Patch
@clerk/fastify	Patch
@clerk/localizations	Patch
@clerk/msw	Patch
@clerk/nextjs	Patch
@clerk/nuxt	Patch
@clerk/react-router	Patch
@clerk/react	Patch
@clerk/tanstack-react-start	Patch
@clerk/testing	Patch
@clerk/ui	Patch
@clerk/vue	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@clerk/agent-toolkit

npm i https://pkg.pr.new/@clerk/agent-toolkit@7916

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@7916

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@7916

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@7916

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@7916

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@7916

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@7916

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@7916

@clerk/express

npm i https://pkg.pr.new/@clerk/express@7916

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@7916

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@7916

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@7916

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@7916

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@7916

@clerk/react

npm i https://pkg.pr.new/@clerk/react@7916

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@7916

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@7916

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@7916

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@7916

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@7916

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@7916

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@7916

commit: 4d1a4a9

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The changes remove the CHIPS build variant and its compile-time flag from bundlewatch, build, and test configs, and delete the related dev script. Runtime control for partitioned cookies is introduced: Environment gains a partitionedCookies flag (serialized as partitioned_cookies), new cookie option types and callbacks (usePartitionedCookies) are added, and dev/session cookie creation and devBrowser APIs are updated to accept and act on these runtime cookie options. Tests and coverage configs were updated accordingly.

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically summarizes the main changes: removing the CHIPS build variant and replacing it with a runtime environment flag for partitioned cookies.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.changeset/remove-chips-build-variant.md:
- Around line 2-3: The changes add new exported API surface (partitionedCookies
on EnvironmentJSON/EnvironmentResource in `@clerk/shared` and partitionedCookies
plus cookieOptions parameters threading through cookie handlers on Environment
in `@clerk/clerk-js`); update the changeset bump from "patch" to "minor" for both
"@clerk/shared" and "@clerk/clerk-js" or, if you intentionally treat these
additions as internal, add an explicit rationale in the changeset explaining why
they remain "patch" (refer to the symbols EnvironmentJSON, EnvironmentResource,
Environment, partitionedCookies, and cookieOptions when documenting your
decision).

---

ℹ️ Review info

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between 73247c1 and 2e4d38c.

📒 Files selected for processing (1)

• .changeset/remove-chips-build-variant.md

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Consider whether minor bump is warranted for new public API surface.

Both packages are bumped as patch, but the changes introduce new public API surface:

• @clerk/shared adds partitionedCookies to the exported EnvironmentJSON / EnvironmentResource types.
• @clerk/clerk-js adds a partitionedCookies property to Environment and new cookieOptions parameters threading through cookie handlers.

Under standard SemVer, additive changes to a public API should be a minor bump. If your project's SemVer policy treats all non-breaking additions as patch (e.g., because these are considered internal/implementation details), this is fine to keep as-is — but it's worth a conscious call.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.
In @.changeset/remove-chips-build-variant.md around lines 2 - 3, The changes add
new exported API surface (partitionedCookies on
EnvironmentJSON/EnvironmentResource in `@clerk/shared` and partitionedCookies plus
cookieOptions parameters threading through cookie handlers on Environment in
`@clerk/clerk-js`); update the changeset bump from "patch" to "minor" for both
"@clerk/shared" and "@clerk/clerk-js" or, if you intentionally treat these
additions as internal, add an explicit rationale in the changeset explaining why
they remain "patch" (refer to the symbols EnvironmentJSON, EnvironmentResource,
Environment, partitionedCookies, and cookieOptions when documenting your
decision).

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@packages/clerk-js/src/core/auth/cookies/session.ts`:
- Around line 38-42: The remove() function only deletes cookies using the
current partitioned attributes, leaving non-partitioned __session cookies
behind; update remove() in session.ts to also explicitly remove the
non-partitioned variants by calling sessionCookie.remove(...) and
suffixedSessionCookie.remove(...) with both getCookieAttributes(options) and
getCookieAttributes({ ...options, partitioned: false }) (or otherwise obtain
both partitioned and non-partitioned attribute sets) so both cookie flavors are
deleted, and apply the same dual-attribute removal change to the analogous
remove logic in devBrowser.ts.

---

ℹ️ Review info

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between f4dd805 and ba2a15b.

📒 Files selected for processing (4)

• packages/clerk-js/src/core/auth/AuthCookieService.ts
• packages/clerk-js/src/core/auth/cookies/devBrowser.ts
• packages/clerk-js/src/core/auth/cookies/session.ts
• packages/clerk-js/src/core/auth/devBrowser.ts

🚧 Files skipped from review as they are similar to previous changes (2)

• packages/clerk-js/src/core/auth/devBrowser.ts
• packages/clerk-js/src/core/auth/AuthCookieService.ts

[coderabbitai]

⚠️ Potential issue | 🟠 Major

remove() doesn't clean up non-partitioned cookie variants when transitioning to partitioned mode.

set() (lines 52-55) correctly removes the old non-partitioned cookies before writing partitioned ones, but remove() only deletes cookies matching the current (partitioned) attributes. Because the browser treats partitioned and non-partitioned cookies with the same name as distinct, a sign-out that hits remove() without a prior set() in the same page lifecycle will leave stale non-partitioned __session cookies behind. The same gap exists in devBrowser.ts.

Proposed fix

 const remove = () => {
const attributes = getCookieAttributes(options);
+ // When partitioned, also remove leftover non-partitioned variants+ // (browser treats them as separate cookies).+ if (attributes.partitioned) {+ sessionCookie.remove();+ suffixedSessionCookie.remove();+ }
sessionCookie.remove(attributes);
suffixedSessionCookie.remove(attributes);
};

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.
In `@packages/clerk-js/src/core/auth/cookies/session.ts` around lines 38 - 42, The
remove() function only deletes cookies using the current partitioned attributes,
leaving non-partitioned __session cookies behind; update remove() in session.ts
to also explicitly remove the non-partitioned variants by calling
sessionCookie.remove(...) and suffixedSessionCookie.remove(...) with both
getCookieAttributes(options) and getCookieAttributes({ ...options, partitioned:
false }) (or otherwise obtain both partitioned and non-partitioned attribute
sets) so both cookie flavors are deleted, and apply the same dual-attribute
removal change to the analogous remove logic in devBrowser.ts.

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

packages/clerk-js/src/core/auth/cookies/clientUat.ts (1)

62-67: ⚠️ Potential issue | 🟠 Major

Partitioned mode does not clear domain-scoped non-partitioned __client_uat cookies

set() only removes host-only variants before writing, but writes with domain. If partitioned mode is turned on, stale domain-scoped non-partitioned cookies can remain and conflict with auth-state reads.

Proposed fix

 // Removes any existing cookies without a domain specified to ensure the change doesn't break existing sessions.
suffixedClientUatCookie.remove();
clientUatCookie.remove();
++ // When partitioned is enabled, also remove previously written domain-scoped+ // non-partitioned variants (partitioned/non-partitioned are distinct cookies).+ if (partitioned && domain) {+ suffixedClientUatCookie.remove({ domain, sameSite, secure });+ clientUatCookie.remove({ domain, sameSite, secure });+ }
suffixedClientUatCookie.set(val, { domain, expires, partitioned, sameSite, secure });
clientUatCookie.set(val, { domain, expires, partitioned, sameSite, secure });

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.
In `@packages/clerk-js/src/core/auth/cookies/clientUat.ts` around lines 62 - 67,
When partitioned mode is enabled the current logic calls
suffixedClientUatCookie.remove() and clientUatCookie.remove() (host-only
removals) then calls set(..., { domain, ... }) which writes domain-scoped
cookies but does not clear existing domain-scoped non-partitioned __client_uat
cookies; update the code so that before writing in partitioned mode you
explicitly remove any domain-scoped variants as well (e.g., call remove with the
domain option or enhance set() to first clear domain-scoped cookies) for both
suffixedClientUatCookie and clientUatCookie to prevent stale domain-scoped
cookies from conflicting with auth reads.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In `@packages/clerk-js/src/core/auth/cookies/clientUat.ts`:
- Around line 62-67: When partitioned mode is enabled the current logic calls
suffixedClientUatCookie.remove() and clientUatCookie.remove() (host-only
removals) then calls set(..., { domain, ... }) which writes domain-scoped
cookies but does not clear existing domain-scoped non-partitioned __client_uat
cookies; update the code so that before writing in partitioned mode you
explicitly remove any domain-scoped variants as well (e.g., call remove with the
domain option or enhance set() to first clear domain-scoped cookies) for both
suffixedClientUatCookie and clientUatCookie to prevent stale domain-scoped
cookies from conflicting with auth reads.

---

ℹ️ Review info

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between ba2a15b and 4d1a4a9.

📒 Files selected for processing (3)

• packages/clerk-js/src/core/auth/cookies/clientUat.ts
• packages/clerk-js/src/core/auth/cookies/devBrowser.ts
• packages/clerk-js/src/core/auth/cookies/session.ts

[jacekradko]

Sweet!

[brkalow]

Summary

• Remove the separate clerk.chips.browser.js build variant from rspack config, dev scripts, and bundlewatch
• Add partitioned_cookies field to the Environment API response (EnvironmentJSON / EnvironmentResource), following the client_debug_mode pattern
• Replace the build-time __BUILD_VARIANT_CHIPS__ constant with a runtime usePartitionedCookies getter that reads from Environment.getInstance().partitionedCookies
• Thread the flag through all three cookie handlers: session, client UAT, and dev browser

Test plan

• All existing cookie tests pass (session, clientUat, devBrowser)
• New test cases verify partitioned cookie behavior when usePartitionedCookies returns true
• Verify with a FAPI response that includes partitioned_cookies: true in the environment payload
• Confirm cookies are set with SameSite=None; Secure; Partitioned in a cross-origin iframe context

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores

  • Removed the legacy CHIPS build variant, its build/config entries, dev script, and bundlewatch entry.
  • Removed build-time cookie flag from tool configs.

• New Features

  • Added a runtime partitioned-cookies flag persisted in environment snapshots and configs.
  • Dev tooling exposes a refreshCookies action to reapply cookie state in development.

• Tests

  • Updated and added tests to validate partitioned-cookie behavior driven by the new runtime flag.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Ready	Preview, Comment	Feb 25, 2026 4:06am

[changeset-bot]

🦋 Changeset detected

Latest commit: 4d1a4a9

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 20 packages

Name	Type
@clerk/clerk-js	Patch
@clerk/shared	Patch
@clerk/chrome-extension	Patch
@clerk/expo	Patch
@clerk/agent-toolkit	Patch
@clerk/astro	Patch
@clerk/backend	Patch
@clerk/expo-passkeys	Patch
@clerk/express	Patch
@clerk/fastify	Patch
@clerk/localizations	Patch
@clerk/msw	Patch
@clerk/nextjs	Patch
@clerk/nuxt	Patch
@clerk/react-router	Patch
@clerk/react	Patch
@clerk/tanstack-react-start	Patch
@clerk/testing	Patch
@clerk/ui	Patch
@clerk/vue	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@clerk/agent-toolkit

npm i https://pkg.pr.new/@clerk/agent-toolkit@7916

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@7916

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@7916

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@7916

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@7916

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@7916

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@7916

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@7916

@clerk/express

npm i https://pkg.pr.new/@clerk/express@7916

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@7916

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@7916

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@7916

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@7916

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@7916

@clerk/react

npm i https://pkg.pr.new/@clerk/react@7916

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@7916

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@7916

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@7916

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@7916

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@7916

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@7916

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@7916

commit: 4d1a4a9

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The changes remove the CHIPS build variant and its compile-time flag from bundlewatch, build, and test configs, and delete the related dev script. Runtime control for partitioned cookies is introduced: Environment gains a partitionedCookies flag (serialized as partitioned_cookies), new cookie option types and callbacks (usePartitionedCookies) are added, and dev/session cookie creation and devBrowser APIs are updated to accept and act on these runtime cookie options. Tests and coverage configs were updated accordingly.

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically summarizes the main changes: removing the CHIPS build variant and replacing it with a runtime environment flag for partitioned cookies.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.changeset/remove-chips-build-variant.md:
- Around line 2-3: The changes add new exported API surface (partitionedCookies
on EnvironmentJSON/EnvironmentResource in `@clerk/shared` and partitionedCookies
plus cookieOptions parameters threading through cookie handlers on Environment
in `@clerk/clerk-js`); update the changeset bump from "patch" to "minor" for both
"@clerk/shared" and "@clerk/clerk-js" or, if you intentionally treat these
additions as internal, add an explicit rationale in the changeset explaining why
they remain "patch" (refer to the symbols EnvironmentJSON, EnvironmentResource,
Environment, partitionedCookies, and cookieOptions when documenting your
decision).

---

ℹ️ Review info

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between 73247c1 and 2e4d38c.

📒 Files selected for processing (1)

• .changeset/remove-chips-build-variant.md

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Consider whether minor bump is warranted for new public API surface.

Both packages are bumped as patch, but the changes introduce new public API surface:

• @clerk/shared adds partitionedCookies to the exported EnvironmentJSON / EnvironmentResource types.
• @clerk/clerk-js adds a partitionedCookies property to Environment and new cookieOptions parameters threading through cookie handlers.

Under standard SemVer, additive changes to a public API should be a minor bump. If your project's SemVer policy treats all non-breaking additions as patch (e.g., because these are considered internal/implementation details), this is fine to keep as-is — but it's worth a conscious call.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.
In @.changeset/remove-chips-build-variant.md around lines 2 - 3, The changes add
new exported API surface (partitionedCookies on
EnvironmentJSON/EnvironmentResource in `@clerk/shared` and partitionedCookies plus
cookieOptions parameters threading through cookie handlers on Environment in
`@clerk/clerk-js`); update the changeset bump from "patch" to "minor" for both
"@clerk/shared" and "@clerk/clerk-js" or, if you intentionally treat these
additions as internal, add an explicit rationale in the changeset explaining why
they remain "patch" (refer to the symbols EnvironmentJSON, EnvironmentResource,
Environment, partitionedCookies, and cookieOptions when documenting your
decision).

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@packages/clerk-js/src/core/auth/cookies/session.ts`:
- Around line 38-42: The remove() function only deletes cookies using the
current partitioned attributes, leaving non-partitioned __session cookies
behind; update remove() in session.ts to also explicitly remove the
non-partitioned variants by calling sessionCookie.remove(...) and
suffixedSessionCookie.remove(...) with both getCookieAttributes(options) and
getCookieAttributes({ ...options, partitioned: false }) (or otherwise obtain
both partitioned and non-partitioned attribute sets) so both cookie flavors are
deleted, and apply the same dual-attribute removal change to the analogous
remove logic in devBrowser.ts.

---

ℹ️ Review info

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between f4dd805 and ba2a15b.

📒 Files selected for processing (4)

• packages/clerk-js/src/core/auth/AuthCookieService.ts
• packages/clerk-js/src/core/auth/cookies/devBrowser.ts
• packages/clerk-js/src/core/auth/cookies/session.ts
• packages/clerk-js/src/core/auth/devBrowser.ts

🚧 Files skipped from review as they are similar to previous changes (2)

• packages/clerk-js/src/core/auth/devBrowser.ts
• packages/clerk-js/src/core/auth/AuthCookieService.ts

[coderabbitai]

⚠️ Potential issue | 🟠 Major

remove() doesn't clean up non-partitioned cookie variants when transitioning to partitioned mode.

set() (lines 52-55) correctly removes the old non-partitioned cookies before writing partitioned ones, but remove() only deletes cookies matching the current (partitioned) attributes. Because the browser treats partitioned and non-partitioned cookies with the same name as distinct, a sign-out that hits remove() without a prior set() in the same page lifecycle will leave stale non-partitioned __session cookies behind. The same gap exists in devBrowser.ts.

Proposed fix

 const remove = () => {
const attributes = getCookieAttributes(options);
+ // When partitioned, also remove leftover non-partitioned variants+ // (browser treats them as separate cookies).+ if (attributes.partitioned) {+ sessionCookie.remove();+ suffixedSessionCookie.remove();+ }
sessionCookie.remove(attributes);
suffixedSessionCookie.remove(attributes);
};

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.
In `@packages/clerk-js/src/core/auth/cookies/session.ts` around lines 38 - 42, The
remove() function only deletes cookies using the current partitioned attributes,
leaving non-partitioned __session cookies behind; update remove() in session.ts
to also explicitly remove the non-partitioned variants by calling
sessionCookie.remove(...) and suffixedSessionCookie.remove(...) with both
getCookieAttributes(options) and getCookieAttributes({ ...options, partitioned:
false }) (or otherwise obtain both partitioned and non-partitioned attribute
sets) so both cookie flavors are deleted, and apply the same dual-attribute
removal change to the analogous remove logic in devBrowser.ts.

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

packages/clerk-js/src/core/auth/cookies/clientUat.ts (1)

62-67: ⚠️ Potential issue | 🟠 Major

Partitioned mode does not clear domain-scoped non-partitioned __client_uat cookies

set() only removes host-only variants before writing, but writes with domain. If partitioned mode is turned on, stale domain-scoped non-partitioned cookies can remain and conflict with auth-state reads.

Proposed fix

 // Removes any existing cookies without a domain specified to ensure the change doesn't break existing sessions.
suffixedClientUatCookie.remove();
clientUatCookie.remove();
++ // When partitioned is enabled, also remove previously written domain-scoped+ // non-partitioned variants (partitioned/non-partitioned are distinct cookies).+ if (partitioned && domain) {+ suffixedClientUatCookie.remove({ domain, sameSite, secure });+ clientUatCookie.remove({ domain, sameSite, secure });+ }
suffixedClientUatCookie.set(val, { domain, expires, partitioned, sameSite, secure });
clientUatCookie.set(val, { domain, expires, partitioned, sameSite, secure });

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.
In `@packages/clerk-js/src/core/auth/cookies/clientUat.ts` around lines 62 - 67,
When partitioned mode is enabled the current logic calls
suffixedClientUatCookie.remove() and clientUatCookie.remove() (host-only
removals) then calls set(..., { domain, ... }) which writes domain-scoped
cookies but does not clear existing domain-scoped non-partitioned __client_uat
cookies; update the code so that before writing in partitioned mode you
explicitly remove any domain-scoped variants as well (e.g., call remove with the
domain option or enhance set() to first clear domain-scoped cookies) for both
suffixedClientUatCookie and clientUatCookie to prevent stale domain-scoped
cookies from conflicting with auth reads.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In `@packages/clerk-js/src/core/auth/cookies/clientUat.ts`:
- Around line 62-67: When partitioned mode is enabled the current logic calls
suffixedClientUatCookie.remove() and clientUatCookie.remove() (host-only
removals) then calls set(..., { domain, ... }) which writes domain-scoped
cookies but does not clear existing domain-scoped non-partitioned __client_uat
cookies; update the code so that before writing in partitioned mode you
explicitly remove any domain-scoped variants as well (e.g., call remove with the
domain option or enhance set() to first clear domain-scoped cookies) for both
suffixedClientUatCookie and clientUatCookie to prevent stale domain-scoped
cookies from conflicting with auth reads.

---

ℹ️ Review info

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between ba2a15b and 4d1a4a9.

📒 Files selected for processing (3)

• packages/clerk-js/src/core/auth/cookies/clientUat.ts
• packages/clerk-js/src/core/auth/cookies/devBrowser.ts
• packages/clerk-js/src/core/auth/cookies/session.ts

[jacekradko]

Sweet!

[brkalow]

Summary

• Remove the separate clerk.chips.browser.js build variant from rspack config, dev scripts, and bundlewatch
• Add partitioned_cookies field to the Environment API response (EnvironmentJSON / EnvironmentResource), following the client_debug_mode pattern
• Replace the build-time __BUILD_VARIANT_CHIPS__ constant with a runtime usePartitionedCookies getter that reads from Environment.getInstance().partitionedCookies
• Thread the flag through all three cookie handlers: session, client UAT, and dev browser

Test plan

• All existing cookie tests pass (session, clientUat, devBrowser)
• New test cases verify partitioned cookie behavior when usePartitionedCookies returns true
• Verify with a FAPI response that includes partitioned_cookies: true in the environment payload
• Confirm cookies are set with SameSite=None; Secure; Partitioned in a cross-origin iframe context

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores

  • Removed the legacy CHIPS build variant, its build/config entries, dev script, and bundlewatch entry.
  • Removed build-time cookie flag from tool configs.

• New Features

  • Added a runtime partitioned-cookies flag persisted in environment snapshots and configs.
  • Dev tooling exposes a refreshCookies action to reapply cookie state in development.

• Tests

  • Updated and added tests to validate partitioned-cookie behavior driven by the new runtime flag.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Ready	Preview, Comment	Feb 25, 2026 4:06am

[changeset-bot]

🦋 Changeset detected

Latest commit: 4d1a4a9

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 20 packages

Name	Type
@clerk/clerk-js	Patch
@clerk/shared	Patch
@clerk/chrome-extension	Patch
@clerk/expo	Patch
@clerk/agent-toolkit	Patch
@clerk/astro	Patch
@clerk/backend	Patch
@clerk/expo-passkeys	Patch
@clerk/express	Patch
@clerk/fastify	Patch
@clerk/localizations	Patch
@clerk/msw	Patch
@clerk/nextjs	Patch
@clerk/nuxt	Patch
@clerk/react-router	Patch
@clerk/react	Patch
@clerk/tanstack-react-start	Patch
@clerk/testing	Patch
@clerk/ui	Patch
@clerk/vue	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@clerk/agent-toolkit

npm i https://pkg.pr.new/@clerk/agent-toolkit@7916

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@7916

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@7916

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@7916

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@7916

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@7916

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@7916

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@7916

@clerk/express

npm i https://pkg.pr.new/@clerk/express@7916

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@7916

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@7916

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@7916

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@7916

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@7916

@clerk/react

npm i https://pkg.pr.new/@clerk/react@7916

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@7916

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@7916

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@7916

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@7916

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@7916

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@7916

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@7916

commit: 4d1a4a9

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The changes remove the CHIPS build variant and its compile-time flag from bundlewatch, build, and test configs, and delete the related dev script. Runtime control for partitioned cookies is introduced: Environment gains a partitionedCookies flag (serialized as partitioned_cookies), new cookie option types and callbacks (usePartitionedCookies) are added, and dev/session cookie creation and devBrowser APIs are updated to accept and act on these runtime cookie options. Tests and coverage configs were updated accordingly.

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically summarizes the main changes: removing the CHIPS build variant and replacing it with a runtime environment flag for partitioned cookies.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.changeset/remove-chips-build-variant.md:
- Around line 2-3: The changes add new exported API surface (partitionedCookies
on EnvironmentJSON/EnvironmentResource in `@clerk/shared` and partitionedCookies
plus cookieOptions parameters threading through cookie handlers on Environment
in `@clerk/clerk-js`); update the changeset bump from "patch" to "minor" for both
"@clerk/shared" and "@clerk/clerk-js" or, if you intentionally treat these
additions as internal, add an explicit rationale in the changeset explaining why
they remain "patch" (refer to the symbols EnvironmentJSON, EnvironmentResource,
Environment, partitionedCookies, and cookieOptions when documenting your
decision).

---

ℹ️ Review info

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between 73247c1 and 2e4d38c.

📒 Files selected for processing (1)

• .changeset/remove-chips-build-variant.md

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Consider whether minor bump is warranted for new public API surface.

Both packages are bumped as patch, but the changes introduce new public API surface:

• @clerk/shared adds partitionedCookies to the exported EnvironmentJSON / EnvironmentResource types.
• @clerk/clerk-js adds a partitionedCookies property to Environment and new cookieOptions parameters threading through cookie handlers.

Under standard SemVer, additive changes to a public API should be a minor bump. If your project's SemVer policy treats all non-breaking additions as patch (e.g., because these are considered internal/implementation details), this is fine to keep as-is — but it's worth a conscious call.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.
In @.changeset/remove-chips-build-variant.md around lines 2 - 3, The changes add
new exported API surface (partitionedCookies on
EnvironmentJSON/EnvironmentResource in `@clerk/shared` and partitionedCookies plus
cookieOptions parameters threading through cookie handlers on Environment in
`@clerk/clerk-js`); update the changeset bump from "patch" to "minor" for both
"@clerk/shared" and "@clerk/clerk-js" or, if you intentionally treat these
additions as internal, add an explicit rationale in the changeset explaining why
they remain "patch" (refer to the symbols EnvironmentJSON, EnvironmentResource,
Environment, partitionedCookies, and cookieOptions when documenting your
decision).

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@packages/clerk-js/src/core/auth/cookies/session.ts`:
- Around line 38-42: The remove() function only deletes cookies using the
current partitioned attributes, leaving non-partitioned __session cookies
behind; update remove() in session.ts to also explicitly remove the
non-partitioned variants by calling sessionCookie.remove(...) and
suffixedSessionCookie.remove(...) with both getCookieAttributes(options) and
getCookieAttributes({ ...options, partitioned: false }) (or otherwise obtain
both partitioned and non-partitioned attribute sets) so both cookie flavors are
deleted, and apply the same dual-attribute removal change to the analogous
remove logic in devBrowser.ts.

---

ℹ️ Review info

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between f4dd805 and ba2a15b.

📒 Files selected for processing (4)

• packages/clerk-js/src/core/auth/AuthCookieService.ts
• packages/clerk-js/src/core/auth/cookies/devBrowser.ts
• packages/clerk-js/src/core/auth/cookies/session.ts
• packages/clerk-js/src/core/auth/devBrowser.ts

🚧 Files skipped from review as they are similar to previous changes (2)

• packages/clerk-js/src/core/auth/devBrowser.ts
• packages/clerk-js/src/core/auth/AuthCookieService.ts

[coderabbitai]

⚠️ Potential issue | 🟠 Major

remove() doesn't clean up non-partitioned cookie variants when transitioning to partitioned mode.

set() (lines 52-55) correctly removes the old non-partitioned cookies before writing partitioned ones, but remove() only deletes cookies matching the current (partitioned) attributes. Because the browser treats partitioned and non-partitioned cookies with the same name as distinct, a sign-out that hits remove() without a prior set() in the same page lifecycle will leave stale non-partitioned __session cookies behind. The same gap exists in devBrowser.ts.

Proposed fix

 const remove = () => {
const attributes = getCookieAttributes(options);
+ // When partitioned, also remove leftover non-partitioned variants+ // (browser treats them as separate cookies).+ if (attributes.partitioned) {+ sessionCookie.remove();+ suffixedSessionCookie.remove();+ }
sessionCookie.remove(attributes);
suffixedSessionCookie.remove(attributes);
};

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.
In `@packages/clerk-js/src/core/auth/cookies/session.ts` around lines 38 - 42, The
remove() function only deletes cookies using the current partitioned attributes,
leaving non-partitioned __session cookies behind; update remove() in session.ts
to also explicitly remove the non-partitioned variants by calling
sessionCookie.remove(...) and suffixedSessionCookie.remove(...) with both
getCookieAttributes(options) and getCookieAttributes({ ...options, partitioned:
false }) (or otherwise obtain both partitioned and non-partitioned attribute
sets) so both cookie flavors are deleted, and apply the same dual-attribute
removal change to the analogous remove logic in devBrowser.ts.

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

packages/clerk-js/src/core/auth/cookies/clientUat.ts (1)

62-67: ⚠️ Potential issue | 🟠 Major

Partitioned mode does not clear domain-scoped non-partitioned __client_uat cookies

set() only removes host-only variants before writing, but writes with domain. If partitioned mode is turned on, stale domain-scoped non-partitioned cookies can remain and conflict with auth-state reads.

Proposed fix

 // Removes any existing cookies without a domain specified to ensure the change doesn't break existing sessions.
suffixedClientUatCookie.remove();
clientUatCookie.remove();
++ // When partitioned is enabled, also remove previously written domain-scoped+ // non-partitioned variants (partitioned/non-partitioned are distinct cookies).+ if (partitioned && domain) {+ suffixedClientUatCookie.remove({ domain, sameSite, secure });+ clientUatCookie.remove({ domain, sameSite, secure });+ }
suffixedClientUatCookie.set(val, { domain, expires, partitioned, sameSite, secure });
clientUatCookie.set(val, { domain, expires, partitioned, sameSite, secure });

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.
In `@packages/clerk-js/src/core/auth/cookies/clientUat.ts` around lines 62 - 67,
When partitioned mode is enabled the current logic calls
suffixedClientUatCookie.remove() and clientUatCookie.remove() (host-only
removals) then calls set(..., { domain, ... }) which writes domain-scoped
cookies but does not clear existing domain-scoped non-partitioned __client_uat
cookies; update the code so that before writing in partitioned mode you
explicitly remove any domain-scoped variants as well (e.g., call remove with the
domain option or enhance set() to first clear domain-scoped cookies) for both
suffixedClientUatCookie and clientUatCookie to prevent stale domain-scoped
cookies from conflicting with auth reads.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In `@packages/clerk-js/src/core/auth/cookies/clientUat.ts`:
- Around line 62-67: When partitioned mode is enabled the current logic calls
suffixedClientUatCookie.remove() and clientUatCookie.remove() (host-only
removals) then calls set(..., { domain, ... }) which writes domain-scoped
cookies but does not clear existing domain-scoped non-partitioned __client_uat
cookies; update the code so that before writing in partitioned mode you
explicitly remove any domain-scoped variants as well (e.g., call remove with the
domain option or enhance set() to first clear domain-scoped cookies) for both
suffixedClientUatCookie and clientUatCookie to prevent stale domain-scoped
cookies from conflicting with auth reads.

---

ℹ️ Review info

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between ba2a15b and 4d1a4a9.

📒 Files selected for processing (3)

• packages/clerk-js/src/core/auth/cookies/clientUat.ts
• packages/clerk-js/src/core/auth/cookies/devBrowser.ts
• packages/clerk-js/src/core/auth/cookies/session.ts

[jacekradko]

Sweet!

[brkalow]

Summary

• Remove the separate clerk.chips.browser.js build variant from rspack config, dev scripts, and bundlewatch
• Add partitioned_cookies field to the Environment API response (EnvironmentJSON / EnvironmentResource), following the client_debug_mode pattern
• Replace the build-time __BUILD_VARIANT_CHIPS__ constant with a runtime usePartitionedCookies getter that reads from Environment.getInstance().partitionedCookies
• Thread the flag through all three cookie handlers: session, client UAT, and dev browser

Test plan

• All existing cookie tests pass (session, clientUat, devBrowser)
• New test cases verify partitioned cookie behavior when usePartitionedCookies returns true
• Verify with a FAPI response that includes partitioned_cookies: true in the environment payload
• Confirm cookies are set with SameSite=None; Secure; Partitioned in a cross-origin iframe context

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores

  • Removed the legacy CHIPS build variant, its build/config entries, dev script, and bundlewatch entry.
  • Removed build-time cookie flag from tool configs.

• New Features

  • Added a runtime partitioned-cookies flag persisted in environment snapshots and configs.
  • Dev tooling exposes a refreshCookies action to reapply cookie state in development.

• Tests

  • Updated and added tests to validate partitioned-cookie behavior driven by the new runtime flag.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Ready	Preview, Comment	Feb 25, 2026 4:06am

[changeset-bot]

🦋 Changeset detected

Latest commit: 4d1a4a9

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 20 packages

Name	Type
@clerk/clerk-js	Patch
@clerk/shared	Patch
@clerk/chrome-extension	Patch
@clerk/expo	Patch
@clerk/agent-toolkit	Patch
@clerk/astro	Patch
@clerk/backend	Patch
@clerk/expo-passkeys	Patch
@clerk/express	Patch
@clerk/fastify	Patch
@clerk/localizations	Patch
@clerk/msw	Patch
@clerk/nextjs	Patch
@clerk/nuxt	Patch
@clerk/react-router	Patch
@clerk/react	Patch
@clerk/tanstack-react-start	Patch
@clerk/testing	Patch
@clerk/ui	Patch
@clerk/vue	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@clerk/agent-toolkit

npm i https://pkg.pr.new/@clerk/agent-toolkit@7916

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@7916

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@7916

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@7916

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@7916

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@7916

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@7916

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@7916

@clerk/express

npm i https://pkg.pr.new/@clerk/express@7916

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@7916

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@7916

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@7916

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@7916

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@7916

@clerk/react

npm i https://pkg.pr.new/@clerk/react@7916

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@7916

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@7916

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@7916

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@7916

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@7916

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@7916

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@7916

commit: 4d1a4a9

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The changes remove the CHIPS build variant and its compile-time flag from bundlewatch, build, and test configs, and delete the related dev script. Runtime control for partitioned cookies is introduced: Environment gains a partitionedCookies flag (serialized as partitioned_cookies), new cookie option types and callbacks (usePartitionedCookies) are added, and dev/session cookie creation and devBrowser APIs are updated to accept and act on these runtime cookie options. Tests and coverage configs were updated accordingly.

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically summarizes the main changes: removing the CHIPS build variant and replacing it with a runtime environment flag for partitioned cookies.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.changeset/remove-chips-build-variant.md:
- Around line 2-3: The changes add new exported API surface (partitionedCookies
on EnvironmentJSON/EnvironmentResource in `@clerk/shared` and partitionedCookies
plus cookieOptions parameters threading through cookie handlers on Environment
in `@clerk/clerk-js`); update the changeset bump from "patch" to "minor" for both
"@clerk/shared" and "@clerk/clerk-js" or, if you intentionally treat these
additions as internal, add an explicit rationale in the changeset explaining why
they remain "patch" (refer to the symbols EnvironmentJSON, EnvironmentResource,
Environment, partitionedCookies, and cookieOptions when documenting your
decision).

---

ℹ️ Review info

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between 73247c1 and 2e4d38c.

📒 Files selected for processing (1)

• .changeset/remove-chips-build-variant.md

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Consider whether minor bump is warranted for new public API surface.

Both packages are bumped as patch, but the changes introduce new public API surface:

• @clerk/shared adds partitionedCookies to the exported EnvironmentJSON / EnvironmentResource types.
• @clerk/clerk-js adds a partitionedCookies property to Environment and new cookieOptions parameters threading through cookie handlers.

Under standard SemVer, additive changes to a public API should be a minor bump. If your project's SemVer policy treats all non-breaking additions as patch (e.g., because these are considered internal/implementation details), this is fine to keep as-is — but it's worth a conscious call.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.
In @.changeset/remove-chips-build-variant.md around lines 2 - 3, The changes add
new exported API surface (partitionedCookies on
EnvironmentJSON/EnvironmentResource in `@clerk/shared` and partitionedCookies plus
cookieOptions parameters threading through cookie handlers on Environment in
`@clerk/clerk-js`); update the changeset bump from "patch" to "minor" for both
"@clerk/shared" and "@clerk/clerk-js" or, if you intentionally treat these
additions as internal, add an explicit rationale in the changeset explaining why
they remain "patch" (refer to the symbols EnvironmentJSON, EnvironmentResource,
Environment, partitionedCookies, and cookieOptions when documenting your
decision).

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@packages/clerk-js/src/core/auth/cookies/session.ts`:
- Around line 38-42: The remove() function only deletes cookies using the
current partitioned attributes, leaving non-partitioned __session cookies
behind; update remove() in session.ts to also explicitly remove the
non-partitioned variants by calling sessionCookie.remove(...) and
suffixedSessionCookie.remove(...) with both getCookieAttributes(options) and
getCookieAttributes({ ...options, partitioned: false }) (or otherwise obtain
both partitioned and non-partitioned attribute sets) so both cookie flavors are
deleted, and apply the same dual-attribute removal change to the analogous
remove logic in devBrowser.ts.

---

ℹ️ Review info

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between f4dd805 and ba2a15b.

📒 Files selected for processing (4)

• packages/clerk-js/src/core/auth/AuthCookieService.ts
• packages/clerk-js/src/core/auth/cookies/devBrowser.ts
• packages/clerk-js/src/core/auth/cookies/session.ts
• packages/clerk-js/src/core/auth/devBrowser.ts

🚧 Files skipped from review as they are similar to previous changes (2)

• packages/clerk-js/src/core/auth/devBrowser.ts
• packages/clerk-js/src/core/auth/AuthCookieService.ts

[coderabbitai]

⚠️ Potential issue | 🟠 Major

remove() doesn't clean up non-partitioned cookie variants when transitioning to partitioned mode.

set() (lines 52-55) correctly removes the old non-partitioned cookies before writing partitioned ones, but remove() only deletes cookies matching the current (partitioned) attributes. Because the browser treats partitioned and non-partitioned cookies with the same name as distinct, a sign-out that hits remove() without a prior set() in the same page lifecycle will leave stale non-partitioned __session cookies behind. The same gap exists in devBrowser.ts.

Proposed fix

 const remove = () => {
const attributes = getCookieAttributes(options);
+ // When partitioned, also remove leftover non-partitioned variants+ // (browser treats them as separate cookies).+ if (attributes.partitioned) {+ sessionCookie.remove();+ suffixedSessionCookie.remove();+ }
sessionCookie.remove(attributes);
suffixedSessionCookie.remove(attributes);
};

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.
In `@packages/clerk-js/src/core/auth/cookies/session.ts` around lines 38 - 42, The
remove() function only deletes cookies using the current partitioned attributes,
leaving non-partitioned __session cookies behind; update remove() in session.ts
to also explicitly remove the non-partitioned variants by calling
sessionCookie.remove(...) and suffixedSessionCookie.remove(...) with both
getCookieAttributes(options) and getCookieAttributes({ ...options, partitioned:
false }) (or otherwise obtain both partitioned and non-partitioned attribute
sets) so both cookie flavors are deleted, and apply the same dual-attribute
removal change to the analogous remove logic in devBrowser.ts.

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

packages/clerk-js/src/core/auth/cookies/clientUat.ts (1)

62-67: ⚠️ Potential issue | 🟠 Major

Partitioned mode does not clear domain-scoped non-partitioned __client_uat cookies

set() only removes host-only variants before writing, but writes with domain. If partitioned mode is turned on, stale domain-scoped non-partitioned cookies can remain and conflict with auth-state reads.

Proposed fix

 // Removes any existing cookies without a domain specified to ensure the change doesn't break existing sessions.
suffixedClientUatCookie.remove();
clientUatCookie.remove();
++ // When partitioned is enabled, also remove previously written domain-scoped+ // non-partitioned variants (partitioned/non-partitioned are distinct cookies).+ if (partitioned && domain) {+ suffixedClientUatCookie.remove({ domain, sameSite, secure });+ clientUatCookie.remove({ domain, sameSite, secure });+ }
suffixedClientUatCookie.set(val, { domain, expires, partitioned, sameSite, secure });
clientUatCookie.set(val, { domain, expires, partitioned, sameSite, secure });

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.
In `@packages/clerk-js/src/core/auth/cookies/clientUat.ts` around lines 62 - 67,
When partitioned mode is enabled the current logic calls
suffixedClientUatCookie.remove() and clientUatCookie.remove() (host-only
removals) then calls set(..., { domain, ... }) which writes domain-scoped
cookies but does not clear existing domain-scoped non-partitioned __client_uat
cookies; update the code so that before writing in partitioned mode you
explicitly remove any domain-scoped variants as well (e.g., call remove with the
domain option or enhance set() to first clear domain-scoped cookies) for both
suffixedClientUatCookie and clientUatCookie to prevent stale domain-scoped
cookies from conflicting with auth reads.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In `@packages/clerk-js/src/core/auth/cookies/clientUat.ts`:
- Around line 62-67: When partitioned mode is enabled the current logic calls
suffixedClientUatCookie.remove() and clientUatCookie.remove() (host-only
removals) then calls set(..., { domain, ... }) which writes domain-scoped
cookies but does not clear existing domain-scoped non-partitioned __client_uat
cookies; update the code so that before writing in partitioned mode you
explicitly remove any domain-scoped variants as well (e.g., call remove with the
domain option or enhance set() to first clear domain-scoped cookies) for both
suffixedClientUatCookie and clientUatCookie to prevent stale domain-scoped
cookies from conflicting with auth reads.

---

ℹ️ Review info

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between ba2a15b and 4d1a4a9.

📒 Files selected for processing (3)

• packages/clerk-js/src/core/auth/cookies/clientUat.ts
• packages/clerk-js/src/core/auth/cookies/devBrowser.ts
• packages/clerk-js/src/core/auth/cookies/session.ts

[jacekradko]

Sweet!

[brkalow]

Summary

• Remove the separate clerk.chips.browser.js build variant from rspack config, dev scripts, and bundlewatch
• Add partitioned_cookies field to the Environment API response (EnvironmentJSON / EnvironmentResource), following the client_debug_mode pattern
• Replace the build-time __BUILD_VARIANT_CHIPS__ constant with a runtime usePartitionedCookies getter that reads from Environment.getInstance().partitionedCookies
• Thread the flag through all three cookie handlers: session, client UAT, and dev browser

Test plan

• All existing cookie tests pass (session, clientUat, devBrowser)
• New test cases verify partitioned cookie behavior when usePartitionedCookies returns true
• Verify with a FAPI response that includes partitioned_cookies: true in the environment payload
• Confirm cookies are set with SameSite=None; Secure; Partitioned in a cross-origin iframe context

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores

  • Removed the legacy CHIPS build variant, its build/config entries, dev script, and bundlewatch entry.
  • Removed build-time cookie flag from tool configs.

• New Features

  • Added a runtime partitioned-cookies flag persisted in environment snapshots and configs.
  • Dev tooling exposes a refreshCookies action to reapply cookie state in development.

• Tests

  • Updated and added tests to validate partitioned-cookie behavior driven by the new runtime flag.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Ready	Preview, Comment	Feb 25, 2026 4:06am

[changeset-bot]

🦋 Changeset detected

Latest commit: 4d1a4a9

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 20 packages

Name	Type
@clerk/clerk-js	Patch
@clerk/shared	Patch
@clerk/chrome-extension	Patch
@clerk/expo	Patch
@clerk/agent-toolkit	Patch
@clerk/astro	Patch
@clerk/backend	Patch
@clerk/expo-passkeys	Patch
@clerk/express	Patch
@clerk/fastify	Patch
@clerk/localizations	Patch
@clerk/msw	Patch
@clerk/nextjs	Patch
@clerk/nuxt	Patch
@clerk/react-router	Patch
@clerk/react	Patch
@clerk/tanstack-react-start	Patch
@clerk/testing	Patch
@clerk/ui	Patch
@clerk/vue	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@clerk/agent-toolkit

npm i https://pkg.pr.new/@clerk/agent-toolkit@7916

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@7916

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@7916

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@7916

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@7916

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@7916

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@7916

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@7916

@clerk/express

npm i https://pkg.pr.new/@clerk/express@7916

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@7916

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@7916

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@7916

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@7916

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@7916

@clerk/react

npm i https://pkg.pr.new/@clerk/react@7916

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@7916

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@7916

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@7916

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@7916

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@7916

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@7916

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@7916

commit: 4d1a4a9

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The changes remove the CHIPS build variant and its compile-time flag from bundlewatch, build, and test configs, and delete the related dev script. Runtime control for partitioned cookies is introduced: Environment gains a partitionedCookies flag (serialized as partitioned_cookies), new cookie option types and callbacks (usePartitionedCookies) are added, and dev/session cookie creation and devBrowser APIs are updated to accept and act on these runtime cookie options. Tests and coverage configs were updated accordingly.

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically summarizes the main changes: removing the CHIPS build variant and replacing it with a runtime environment flag for partitioned cookies.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.changeset/remove-chips-build-variant.md:
- Around line 2-3: The changes add new exported API surface (partitionedCookies
on EnvironmentJSON/EnvironmentResource in `@clerk/shared` and partitionedCookies
plus cookieOptions parameters threading through cookie handlers on Environment
in `@clerk/clerk-js`); update the changeset bump from "patch" to "minor" for both
"@clerk/shared" and "@clerk/clerk-js" or, if you intentionally treat these
additions as internal, add an explicit rationale in the changeset explaining why
they remain "patch" (refer to the symbols EnvironmentJSON, EnvironmentResource,
Environment, partitionedCookies, and cookieOptions when documenting your
decision).

---

ℹ️ Review info

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between 73247c1 and 2e4d38c.

📒 Files selected for processing (1)

• .changeset/remove-chips-build-variant.md

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Consider whether minor bump is warranted for new public API surface.

Both packages are bumped as patch, but the changes introduce new public API surface:

• @clerk/shared adds partitionedCookies to the exported EnvironmentJSON / EnvironmentResource types.
• @clerk/clerk-js adds a partitionedCookies property to Environment and new cookieOptions parameters threading through cookie handlers.

Under standard SemVer, additive changes to a public API should be a minor bump. If your project's SemVer policy treats all non-breaking additions as patch (e.g., because these are considered internal/implementation details), this is fine to keep as-is — but it's worth a conscious call.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.
In @.changeset/remove-chips-build-variant.md around lines 2 - 3, The changes add
new exported API surface (partitionedCookies on
EnvironmentJSON/EnvironmentResource in `@clerk/shared` and partitionedCookies plus
cookieOptions parameters threading through cookie handlers on Environment in
`@clerk/clerk-js`); update the changeset bump from "patch" to "minor" for both
"@clerk/shared" and "@clerk/clerk-js" or, if you intentionally treat these
additions as internal, add an explicit rationale in the changeset explaining why
they remain "patch" (refer to the symbols EnvironmentJSON, EnvironmentResource,
Environment, partitionedCookies, and cookieOptions when documenting your
decision).

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@packages/clerk-js/src/core/auth/cookies/session.ts`:
- Around line 38-42: The remove() function only deletes cookies using the
current partitioned attributes, leaving non-partitioned __session cookies
behind; update remove() in session.ts to also explicitly remove the
non-partitioned variants by calling sessionCookie.remove(...) and
suffixedSessionCookie.remove(...) with both getCookieAttributes(options) and
getCookieAttributes({ ...options, partitioned: false }) (or otherwise obtain
both partitioned and non-partitioned attribute sets) so both cookie flavors are
deleted, and apply the same dual-attribute removal change to the analogous
remove logic in devBrowser.ts.

---

ℹ️ Review info

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between f4dd805 and ba2a15b.

📒 Files selected for processing (4)

• packages/clerk-js/src/core/auth/AuthCookieService.ts
• packages/clerk-js/src/core/auth/cookies/devBrowser.ts
• packages/clerk-js/src/core/auth/cookies/session.ts
• packages/clerk-js/src/core/auth/devBrowser.ts

🚧 Files skipped from review as they are similar to previous changes (2)

• packages/clerk-js/src/core/auth/devBrowser.ts
• packages/clerk-js/src/core/auth/AuthCookieService.ts

[coderabbitai]

⚠️ Potential issue | 🟠 Major

remove() doesn't clean up non-partitioned cookie variants when transitioning to partitioned mode.

set() (lines 52-55) correctly removes the old non-partitioned cookies before writing partitioned ones, but remove() only deletes cookies matching the current (partitioned) attributes. Because the browser treats partitioned and non-partitioned cookies with the same name as distinct, a sign-out that hits remove() without a prior set() in the same page lifecycle will leave stale non-partitioned __session cookies behind. The same gap exists in devBrowser.ts.

Proposed fix

 const remove = () => {
const attributes = getCookieAttributes(options);
+ // When partitioned, also remove leftover non-partitioned variants+ // (browser treats them as separate cookies).+ if (attributes.partitioned) {+ sessionCookie.remove();+ suffixedSessionCookie.remove();+ }
sessionCookie.remove(attributes);
suffixedSessionCookie.remove(attributes);
};

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.
In `@packages/clerk-js/src/core/auth/cookies/session.ts` around lines 38 - 42, The
remove() function only deletes cookies using the current partitioned attributes,
leaving non-partitioned __session cookies behind; update remove() in session.ts
to also explicitly remove the non-partitioned variants by calling
sessionCookie.remove(...) and suffixedSessionCookie.remove(...) with both
getCookieAttributes(options) and getCookieAttributes({ ...options, partitioned:
false }) (or otherwise obtain both partitioned and non-partitioned attribute
sets) so both cookie flavors are deleted, and apply the same dual-attribute
removal change to the analogous remove logic in devBrowser.ts.

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

packages/clerk-js/src/core/auth/cookies/clientUat.ts (1)

62-67: ⚠️ Potential issue | 🟠 Major

Partitioned mode does not clear domain-scoped non-partitioned __client_uat cookies

set() only removes host-only variants before writing, but writes with domain. If partitioned mode is turned on, stale domain-scoped non-partitioned cookies can remain and conflict with auth-state reads.

Proposed fix

 // Removes any existing cookies without a domain specified to ensure the change doesn't break existing sessions.
suffixedClientUatCookie.remove();
clientUatCookie.remove();
++ // When partitioned is enabled, also remove previously written domain-scoped+ // non-partitioned variants (partitioned/non-partitioned are distinct cookies).+ if (partitioned && domain) {+ suffixedClientUatCookie.remove({ domain, sameSite, secure });+ clientUatCookie.remove({ domain, sameSite, secure });+ }
suffixedClientUatCookie.set(val, { domain, expires, partitioned, sameSite, secure });
clientUatCookie.set(val, { domain, expires, partitioned, sameSite, secure });

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.
In `@packages/clerk-js/src/core/auth/cookies/clientUat.ts` around lines 62 - 67,
When partitioned mode is enabled the current logic calls
suffixedClientUatCookie.remove() and clientUatCookie.remove() (host-only
removals) then calls set(..., { domain, ... }) which writes domain-scoped
cookies but does not clear existing domain-scoped non-partitioned __client_uat
cookies; update the code so that before writing in partitioned mode you
explicitly remove any domain-scoped variants as well (e.g., call remove with the
domain option or enhance set() to first clear domain-scoped cookies) for both
suffixedClientUatCookie and clientUatCookie to prevent stale domain-scoped
cookies from conflicting with auth reads.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In `@packages/clerk-js/src/core/auth/cookies/clientUat.ts`:
- Around line 62-67: When partitioned mode is enabled the current logic calls
suffixedClientUatCookie.remove() and clientUatCookie.remove() (host-only
removals) then calls set(..., { domain, ... }) which writes domain-scoped
cookies but does not clear existing domain-scoped non-partitioned __client_uat
cookies; update the code so that before writing in partitioned mode you
explicitly remove any domain-scoped variants as well (e.g., call remove with the
domain option or enhance set() to first clear domain-scoped cookies) for both
suffixedClientUatCookie and clientUatCookie to prevent stale domain-scoped
cookies from conflicting with auth reads.

---

ℹ️ Review info

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between ba2a15b and 4d1a4a9.

📒 Files selected for processing (3)

• packages/clerk-js/src/core/auth/cookies/clientUat.ts
• packages/clerk-js/src/core/auth/cookies/devBrowser.ts
• packages/clerk-js/src/core/auth/cookies/session.ts

[jacekradko]

Sweet!

[brkalow]

Summary

• Remove the separate clerk.chips.browser.js build variant from rspack config, dev scripts, and bundlewatch
• Add partitioned_cookies field to the Environment API response (EnvironmentJSON / EnvironmentResource), following the client_debug_mode pattern
• Replace the build-time __BUILD_VARIANT_CHIPS__ constant with a runtime usePartitionedCookies getter that reads from Environment.getInstance().partitionedCookies
• Thread the flag through all three cookie handlers: session, client UAT, and dev browser

Test plan

• All existing cookie tests pass (session, clientUat, devBrowser)
• New test cases verify partitioned cookie behavior when usePartitionedCookies returns true
• Verify with a FAPI response that includes partitioned_cookies: true in the environment payload
• Confirm cookies are set with SameSite=None; Secure; Partitioned in a cross-origin iframe context

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores

  • Removed the legacy CHIPS build variant, its build/config entries, dev script, and bundlewatch entry.
  • Removed build-time cookie flag from tool configs.

• New Features

  • Added a runtime partitioned-cookies flag persisted in environment snapshots and configs.
  • Dev tooling exposes a refreshCookies action to reapply cookie state in development.

• Tests

  • Updated and added tests to validate partitioned-cookie behavior driven by the new runtime flag.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Ready	Preview, Comment	Feb 25, 2026 4:06am

[changeset-bot]

🦋 Changeset detected

Latest commit: 4d1a4a9

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 20 packages

Name	Type
@clerk/clerk-js	Patch
@clerk/shared	Patch
@clerk/chrome-extension	Patch
@clerk/expo	Patch
@clerk/agent-toolkit	Patch
@clerk/astro	Patch
@clerk/backend	Patch
@clerk/expo-passkeys	Patch
@clerk/express	Patch
@clerk/fastify	Patch
@clerk/localizations	Patch
@clerk/msw	Patch
@clerk/nextjs	Patch
@clerk/nuxt	Patch
@clerk/react-router	Patch
@clerk/react	Patch
@clerk/tanstack-react-start	Patch
@clerk/testing	Patch
@clerk/ui	Patch
@clerk/vue	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@clerk/agent-toolkit

npm i https://pkg.pr.new/@clerk/agent-toolkit@7916

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@7916

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@7916

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@7916

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@7916

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@7916

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@7916

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@7916

@clerk/express

npm i https://pkg.pr.new/@clerk/express@7916

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@7916

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@7916

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@7916

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@7916

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@7916

@clerk/react

npm i https://pkg.pr.new/@clerk/react@7916

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@7916

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@7916

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@7916

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@7916

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@7916

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@7916

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@7916

commit: 4d1a4a9

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The changes remove the CHIPS build variant and its compile-time flag from bundlewatch, build, and test configs, and delete the related dev script. Runtime control for partitioned cookies is introduced: Environment gains a partitionedCookies flag (serialized as partitioned_cookies), new cookie option types and callbacks (usePartitionedCookies) are added, and dev/session cookie creation and devBrowser APIs are updated to accept and act on these runtime cookie options. Tests and coverage configs were updated accordingly.

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically summarizes the main changes: removing the CHIPS build variant and replacing it with a runtime environment flag for partitioned cookies.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.changeset/remove-chips-build-variant.md:
- Around line 2-3: The changes add new exported API surface (partitionedCookies
on EnvironmentJSON/EnvironmentResource in `@clerk/shared` and partitionedCookies
plus cookieOptions parameters threading through cookie handlers on Environment
in `@clerk/clerk-js`); update the changeset bump from "patch" to "minor" for both
"@clerk/shared" and "@clerk/clerk-js" or, if you intentionally treat these
additions as internal, add an explicit rationale in the changeset explaining why
they remain "patch" (refer to the symbols EnvironmentJSON, EnvironmentResource,
Environment, partitionedCookies, and cookieOptions when documenting your
decision).

---

ℹ️ Review info

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between 73247c1 and 2e4d38c.

📒 Files selected for processing (1)

• .changeset/remove-chips-build-variant.md

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Consider whether minor bump is warranted for new public API surface.

Both packages are bumped as patch, but the changes introduce new public API surface:

• @clerk/shared adds partitionedCookies to the exported EnvironmentJSON / EnvironmentResource types.
• @clerk/clerk-js adds a partitionedCookies property to Environment and new cookieOptions parameters threading through cookie handlers.

Under standard SemVer, additive changes to a public API should be a minor bump. If your project's SemVer policy treats all non-breaking additions as patch (e.g., because these are considered internal/implementation details), this is fine to keep as-is — but it's worth a conscious call.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.
In @.changeset/remove-chips-build-variant.md around lines 2 - 3, The changes add
new exported API surface (partitionedCookies on
EnvironmentJSON/EnvironmentResource in `@clerk/shared` and partitionedCookies plus
cookieOptions parameters threading through cookie handlers on Environment in
`@clerk/clerk-js`); update the changeset bump from "patch" to "minor" for both
"@clerk/shared" and "@clerk/clerk-js" or, if you intentionally treat these
additions as internal, add an explicit rationale in the changeset explaining why
they remain "patch" (refer to the symbols EnvironmentJSON, EnvironmentResource,
Environment, partitionedCookies, and cookieOptions when documenting your
decision).

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@packages/clerk-js/src/core/auth/cookies/session.ts`:
- Around line 38-42: The remove() function only deletes cookies using the
current partitioned attributes, leaving non-partitioned __session cookies
behind; update remove() in session.ts to also explicitly remove the
non-partitioned variants by calling sessionCookie.remove(...) and
suffixedSessionCookie.remove(...) with both getCookieAttributes(options) and
getCookieAttributes({ ...options, partitioned: false }) (or otherwise obtain
both partitioned and non-partitioned attribute sets) so both cookie flavors are
deleted, and apply the same dual-attribute removal change to the analogous
remove logic in devBrowser.ts.

---

ℹ️ Review info

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between f4dd805 and ba2a15b.

📒 Files selected for processing (4)

• packages/clerk-js/src/core/auth/AuthCookieService.ts
• packages/clerk-js/src/core/auth/cookies/devBrowser.ts
• packages/clerk-js/src/core/auth/cookies/session.ts
• packages/clerk-js/src/core/auth/devBrowser.ts

🚧 Files skipped from review as they are similar to previous changes (2)

• packages/clerk-js/src/core/auth/devBrowser.ts
• packages/clerk-js/src/core/auth/AuthCookieService.ts

[coderabbitai]

⚠️ Potential issue | 🟠 Major

remove() doesn't clean up non-partitioned cookie variants when transitioning to partitioned mode.

set() (lines 52-55) correctly removes the old non-partitioned cookies before writing partitioned ones, but remove() only deletes cookies matching the current (partitioned) attributes. Because the browser treats partitioned and non-partitioned cookies with the same name as distinct, a sign-out that hits remove() without a prior set() in the same page lifecycle will leave stale non-partitioned __session cookies behind. The same gap exists in devBrowser.ts.

Proposed fix

 const remove = () => {
const attributes = getCookieAttributes(options);
+ // When partitioned, also remove leftover non-partitioned variants+ // (browser treats them as separate cookies).+ if (attributes.partitioned) {+ sessionCookie.remove();+ suffixedSessionCookie.remove();+ }
sessionCookie.remove(attributes);
suffixedSessionCookie.remove(attributes);
};

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.
In `@packages/clerk-js/src/core/auth/cookies/session.ts` around lines 38 - 42, The
remove() function only deletes cookies using the current partitioned attributes,
leaving non-partitioned __session cookies behind; update remove() in session.ts
to also explicitly remove the non-partitioned variants by calling
sessionCookie.remove(...) and suffixedSessionCookie.remove(...) with both
getCookieAttributes(options) and getCookieAttributes({ ...options, partitioned:
false }) (or otherwise obtain both partitioned and non-partitioned attribute
sets) so both cookie flavors are deleted, and apply the same dual-attribute
removal change to the analogous remove logic in devBrowser.ts.

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

packages/clerk-js/src/core/auth/cookies/clientUat.ts (1)

62-67: ⚠️ Potential issue | 🟠 Major

Partitioned mode does not clear domain-scoped non-partitioned __client_uat cookies

set() only removes host-only variants before writing, but writes with domain. If partitioned mode is turned on, stale domain-scoped non-partitioned cookies can remain and conflict with auth-state reads.

Proposed fix

 // Removes any existing cookies without a domain specified to ensure the change doesn't break existing sessions.
suffixedClientUatCookie.remove();
clientUatCookie.remove();
++ // When partitioned is enabled, also remove previously written domain-scoped+ // non-partitioned variants (partitioned/non-partitioned are distinct cookies).+ if (partitioned && domain) {+ suffixedClientUatCookie.remove({ domain, sameSite, secure });+ clientUatCookie.remove({ domain, sameSite, secure });+ }
suffixedClientUatCookie.set(val, { domain, expires, partitioned, sameSite, secure });
clientUatCookie.set(val, { domain, expires, partitioned, sameSite, secure });

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.
In `@packages/clerk-js/src/core/auth/cookies/clientUat.ts` around lines 62 - 67,
When partitioned mode is enabled the current logic calls
suffixedClientUatCookie.remove() and clientUatCookie.remove() (host-only
removals) then calls set(..., { domain, ... }) which writes domain-scoped
cookies but does not clear existing domain-scoped non-partitioned __client_uat
cookies; update the code so that before writing in partitioned mode you
explicitly remove any domain-scoped variants as well (e.g., call remove with the
domain option or enhance set() to first clear domain-scoped cookies) for both
suffixedClientUatCookie and clientUatCookie to prevent stale domain-scoped
cookies from conflicting with auth reads.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In `@packages/clerk-js/src/core/auth/cookies/clientUat.ts`:
- Around line 62-67: When partitioned mode is enabled the current logic calls
suffixedClientUatCookie.remove() and clientUatCookie.remove() (host-only
removals) then calls set(..., { domain, ... }) which writes domain-scoped
cookies but does not clear existing domain-scoped non-partitioned __client_uat
cookies; update the code so that before writing in partitioned mode you
explicitly remove any domain-scoped variants as well (e.g., call remove with the
domain option or enhance set() to first clear domain-scoped cookies) for both
suffixedClientUatCookie and clientUatCookie to prevent stale domain-scoped
cookies from conflicting with auth reads.

---

ℹ️ Review info

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between ba2a15b and 4d1a4a9.

📒 Files selected for processing (3)

• packages/clerk-js/src/core/auth/cookies/clientUat.ts
• packages/clerk-js/src/core/auth/cookies/devBrowser.ts
• packages/clerk-js/src/core/auth/cookies/session.ts

[jacekradko]

Sweet!