[brionmario]

Purpose

Removes the Better Auth Next.js integration sample now that it lives in thunder-id/samples, as integrations/better-auth-nextjs, moved in thunder-id/samples#11 (thunder-id/thunderid#5904). It was the last sample left here after #126 moved the quickstarts, so samples/ is now empty.

Approach

• Removed samples/integrations/better-auth/nextjs.
• Workspace: pnpm-workspace.yaml no longer includes samples/integrations/*/*, and the lockfile drops its importer. The sharp override's justification now names the packages that still reach it (packages/nextjs and packages/better-auth via next).
• Lint and PR builder: the ESLint copyright-header exemption for samples/** is gone, and the PR builder's lint and test steps drop their !./samples/** filters.
• Release: @thunderid/better-auth releases no longer attach a sample zip, since the samples repository releases the sample now. The pack-sample action, which only that step used, is removed.
• AGENTS.md: describes the samples living in thunder-id/samples.
• Playground headers: React and Express show the full ThunderID logo, a divider, then the technology logo and " Playground" instead of an SDK switcher. The React overview's "Server SDKs" link and VITE_PLAYGROUND_EXPRESS_URL go too, since the playgrounds are independent.
• Security Audit fix (GHSA-587h-7wmj-h5pm, launch-editor's fs.existsSync() check bypassable on Windows): this advisory currently fails the Security Audit job on main too. vite 6.4.4 and 7.3.7 and launch-editor 2.14.2 come in through a lockfile refresh, and the React playground's vite floor moves to ^6.4.4. The vite 8 line, which pnpm auto-installs for vitest's peer range and keeps at the locked 8.2.1 through pnpm update and pnpm dedupe, is pinned to vite@8: 8.2.4 in pnpm-workspace.yaml with a justification. Beyond these packages, the only lockfile version changes are rolldown 1.2.14 and @oxc-project/types, which vite 8.2.4 requires. This replaces Update vite and launch-editor for the launch-editor advisory #128.

Verified locally: pnpm install --frozen-lockfile, pnpm audit --audit-level=high (only the advisories the workspace already ignores remain), pnpm build (13/13), pnpm format:check, and lint and test for every non-package workspace. Both edited workflows parse.

SDK fixes

The playgrounds surfaced bugs across the packages. Each fix has a unit test that fails without it.

• @thunderid/javascript:
  • Authorization state: generated from random bytes, stored per sign-in, and checked once on the code exchange.
  • Discovered issuer: checked against endpoints.issuer or the base URL, tolerating a trailing slash. A mismatch fails with JS-AUTH_CORE-GOPMD-IV03.
  • Discovery getters: getDiscoveryResponse() and getOpenIDProviderEndpoints() load discovery on demand.
  • OAuth errors: messages are built from error and error_description instead of [object Object].
  • No session: getUser() and getDecodedIdToken() fail with documented codes instead of crashing, and exchangeToken() only decodes the ID token when its template needs it.
  • Types and runtime: getConfiguration() is typed as a Promise, and the SDK no longer touches localStorage under Node.
  • jose: imported by subpath, so Next.js middleware no longer bundles its JWE code.
• @thunderid/node and @thunderid/express:
  • Session expiry: counted in seconds, not minutes.
  • Refresh in protect(): expired sessions with a refresh token are refreshed (one refresh in flight per session), and are cleared otherwise.
  • handleSignIn(): no longer calls next() after redirecting.
  • Logging: unauthenticated requests log at debug.
• @thunderid/browser:
  • on() hooks: on() keeps every subscriber, the HTTP request hooks work when registered before initialize(), and http-request-finish fires on success too.
  • Config typing: storage in the config type-checks without an explicit generic.
  • Media-query listener: createMediaQueryListener() returns a disconnect().
  • getUserProfile(): implemented on top of the existing /users/me helper.
• @thunderid/react: form fields associate their label and description (htmlFor, aria-describedby). <SignIn /> without an application ID reports through onError instead of an unhandled rejection. ThemeProvider removes its media-query listener. recover and getStorageManager are typed.
• @thunderid/vue:
  • Route guard: createThunderIDGuard() finds the context under Vue Router.
  • Discovery: loads on mount.
  • <SignIn>: no unhandled rejection.
  • ThemeProvider: removes its listener.
• @thunderid/nextjs:
  • createRouteMatcher: the documented (.*) patterns match.
  • getFlowMetaAction: returns an error result instead of throwing.
• @thunderid/nuxt:
  • Middleware: requireScopes and requireOrganization read the session's scopes and organization.
  • Config: an array scopes replaces the default instead of being appended, and baseUrl is optional in the config type when the environment supplies it.
  • Vite pre-bundling: the dependencies resolve through the module.
  • <SignIn>: no unhandled rejection.

Missing capabilities the playgrounds found remain listed as gaps in their READMEs. These include an organizations API, event subscriptions, server-side ID token access, and fully typed user/signIn/signUp/signOut in useThunderID(), which needs @thunderid/nextjs's context types reworked first. Adding them needs a specification change and work in every SDK, so they are not part of this PR.

Playgrounds

Adds playgrounds/vue, playgrounds/nextjs, playgrounds/nuxt, playgrounds/browser and playgrounds/node next to react and express, so every JavaScript SDK can be exercised from source (thunder-id/thunderid#5919). Each one uses its SDK through workspace:* and follows the playground designs:

Playground	Port	What it covers
vue	5174	26 capability checks (including the route guard and callback route), an explorer for 28 @thunderid/vue components with Vue SFC snippets, composables and tokens
nextjs	3001	25 client and server checks (thunderIDProxy, protectRoute, route handlers, server actions, back-channel logout), a component explorer, a Server page with an API explorer, and tokens
nuxt	3002	30 client and server checks (module routes, useServerSession, requireServerSession, route and server middleware), a component explorer, composables, and a Server page with the SSR context and an API explorer
browser	5175	26 checks driven by ThunderIDBrowserClient with a live on() hook log, an explorer for the package's UI helpers (it ships no components), and tokens
node	3003	An operations explorer for every ThunderIDNodeClient method, with each HTTP exchange and an SDK trace

Every header reads: ThunderID logo, the technology's logo, then " Playground", with no switcher. The PR builder already covers the playgrounds through pnpm build, pnpm format:check, and lint and test for non-package workspaces. The only new tooling dependency is vue-tsc, which type-checks .vue files for the Vue and Nuxt playgrounds. Each playground's README lists the SDK gaps it surfaced, such as createThunderIDGuard failing to find its context under Vue Router, and createRouteMatcher not matching (.*) patterns. Nothing in this PR has been run with a signed-in session yet, since no application is configured on the local server they were checked against.

Screenshots

Vue: component explorer	Next.js: Server page
Nuxt: capability checks	Browser: capability checks
Node.js: operations explorer

Related Issues

• Move the SDK quickstart samples to the thunder-id/samples repository thunderid#5904

Related PRs

• Add the Better Auth sample and fix sample releases and the vite advisory samples#11 (adds the sample there, merged)
• Move the samples to the samples repository and add playgrounds #126 (moved the quickstarts, merged)
• Point the docs at the samples repository and document the SDK playgrounds thunderid#5910 (points the Better Auth docs entry at the new location)
• Supersedes Update vite and launch-editor for the launch-editor advisory #128 (the advisory fix)

Checklist

• Followed the contribution guidelines.
• Manual test round performed and verified.
• Documentation provided. (Add links if there are any)
• Tests provided. (Add links if there are any)
  • Unit Tests
  • Integration Tests
• Breaking changes. (Fill if applicable)
  • Breaking changes section filled.
  • breaking change label added.
• Cross-SDK parity. Exactly one of parity/prs-raised or parity/prs-not-needed added.
  • If parity/prs-raised, the port links are posted as a reply on the parity check's comment.

Security checks

• Followed secure coding standards.
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Repository: thunder-id/javascript-sdks/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 9b829ee5-e2c9-4f75-8529-52b686547ebb

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔀 Cross-SDK feature parity, no ports needed

This pull request is labelled parity/prs-not-needed: nothing here has to ship in the other ThunderID SDKs. If that changes, swap the label for parity/prs-raised.