Fix flow/meta in SSR SDKs + Nuxt SDK fixes

[brionmario]

Purpose

Bundles several related fixes found while working across the JavaScript SDKs on flow metadata and the embedded sign-in flow:

• GET /flow/meta required CORS in SSR frameworks. FlowMetaProvider fetched flow design config + i18n directly from the browser to the ThunderID server's baseUrl — a cross-origin request that required CORS to be configured server-side. @thunderid/nextjs and @thunderid/nuxt now fetch it server-side by default (a Server Action in Next.js, a Nitro route in Nuxt) and seed it via SSR, so the browser never talks to baseUrl directly. Fixes thunder-id/thunderid#5010.
• Nuxt/Vue embedded sign-in dropped the challenge token between steps. Unlike React/Next.js, the Vue and Nuxt SignIn components never tracked challengeToken across multi-step flows, so any step after the first failed server-side validation (ICS-1002 Invalid challenge token). Both now track and resupply it, matching the React implementation.
• signOut() blocked on access token revocation. requestAccessTokenRevocation() was awaited in signOut()'s critical path with a 10s timeout, so a slow or unreachable revocation endpoint stalled the entire sign-out flow. It's now fired without awaiting, with the access token snapshotted first so a concurrent clearSession can't race it out of storage.
• Password values could leak via native form submission. The embedded flow's rendered <form> had no submit handler guard, so pressing Enter (or a submit-type button) could trigger the browser's native form submission — a GET request with all field values, including passwords, as query params. Submission is now fully intercepted via preventDefault().
• Vue component CSS variables renamed from --thunderid-* to --thunder-* for consistency with the vendor-prefix convention used elsewhere in the SDK.
• Minor i18n additions (e.g. signin.images.app_logo.alt) and Nuxt/Next.js quickstart sample doc/env updates.

Approach

• FlowMetaProvider (in @thunderid/react and @thunderid/vue) gained an optional fetchMeta override and initialMeta seed prop. Both default to the existing direct-browser-fetch behavior when unset, so plain React/Vue apps are unaffected. @thunderid/nextjs and @thunderid/nuxt pass these by default — a Server Action (getFlowMetaAction) and a Nitro route (/api/auth/meta) respectively — so the fetch happens server-to-server.
• The Vue/Nuxt SignIn containers now hold a challengeToken ref, persist it via the storage manager's temporary data (so it survives OAuth redirects), and re-attach it on every flow step submission.

Related Issues

• Fixes flow/meta is sent directly from the browser in Next.js & Nuxt SDKs requiring CORS on the ThunderID server thunderid#5010

Related PRs

• N/A

Checklist

• Followed the contribution guidelines.
• Manual test round performed and verified.
• Documentation provided. (Add links if there are any)
• Tests provided. (Add links if there are any)
  • Unit Tests
  • Integration Tests
• Breaking changes. (Fill if applicable)
  • Breaking changes section filled.
  • breaking change label added.

Security checks

• Followed secure coding standards.
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.

[coderabbitai]

Important

Review available on request

• 🔍 Trigger review

Reviews should be triggered manually for repositories with fewer than 10 stars. Select Trigger review above or comment @coderabbitai review to review the latest changes. For a full review, comment @coderabbitai full review.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 7e76eb67-74e8-448f-9dec-c8312af1d007

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}