thunder-id · brionmario · Sep 4, 2026
diff --git a/package.json b/package.json
@@ -31,19 +31,19 @@
     "typecheck": "turbo run typecheck"
   },
   "devDependencies": {
-    "turbo": "2.10.2",
     "@thunderid/eslint-plugin": "catalog:",
     "@thunderid/prettier-config": "catalog:",
     "eslint": "catalog:",
     "prettier": "catalog:",
     "rimraf": "catalog:",
     "tslib": "catalog:",
+    "turbo": "2.10.2",
     "typescript": "catalog:"
   },
   "devEngines": {
     "packageManager": {
       "name": "pnpm",
-      "version": "11.9.0"
+      "version": "11.25.0"
     }
   }
 }
diff --git a/packages/better-auth/.editorconfig b/packages/better-auth/.editorconfig
@@ -0,0 +1 @@
+../../.editorconfig
diff --git a/packages/better-auth/.gitignore b/packages/better-auth/.gitignore
@@ -0,0 +1,141 @@
+# Logs
+logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+lerna-debug.log*
+
+# Diagnostic reports (https://nodejs.org/api/report.html)
+report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json
+
+# Runtime data
+pids
+*.pid
+*.seed
+*.pid.lock
+
+# Directory for instrumented libs generated by jscoverage/JSCover
+lib-cov
+
+# Coverage directory used by tools like istanbul
+coverage
+*.lcov
+
+# nyc test coverage
+.nyc_output
+
+# Grunt intermediate storage (https://gruntjs.com/creating-plugins#storing-task-files)
+.grunt
+
+# Bower dependency directory (https://bower.io/)
+bower_components
+
+# node-waf configuration
+.lock-wscript
+
+# Compiled binary addons (https://nodejs.org/api/addons.html)
+build/Release
+
+# Dependency directories
+node_modules/
+jspm_packages/
+
+# Snowpack dependency directory (https://snowpack.dev/)
+web_modules/
+
+# TypeScript cache
+*.tsbuildinfo
+
+# Optional npm cache directory
+.npm
+
+# Optional eslint cache
+.eslintcache
+
+# Optional stylelint cache
+.stylelintcache
+
+# Optional REPL history
+.node_repl_history
+
+# Output of 'npm pack'
+*.tgz
+
+# Yarn Integrity file
+.yarn-integrity
+
+# dotenv environment variable files
+.env
+.env.*
+!.env.example
+
+# parcel-bundler cache (https://parceljs.org/)
+.cache
+.parcel-cache
+
+# Next.js build output
+.next
+out
+
+# Nuxt.js build / generate output
+.nuxt
+dist
+.output
+
+# Gatsby files
+.cache/
+# Comment in the public line in if your project uses Gatsby and not Next.js
+# https://nextjs.org/blog/next-9-1#public-directory-support
+# public
+
+# vuepress build output
+.vuepress/dist
+
+# vuepress v2.x temp and cache directory
+.temp
+.cache
+
+# Sveltekit cache directory
+.svelte-kit/
+
+# vitepress build output
+**/.vitepress/dist
+
+# vitepress cache directory
+**/.vitepress/cache
+
+# Docusaurus cache and generated files
+.docusaurus
+
+# Serverless directories
+.serverless/
+
+# FuseBox cache
+.fusebox/
+
+# DynamoDB Local files
+.dynamodb/
+
+# Firebase cache directory
+.firebase/
+
+# TernJS port file
+.tern-port
+
+# Stores VSCode versions used for testing VSCode extensions
+.vscode-test
+
+# yarn v3
+.pnp.*
+.yarn/*
+!.yarn/patches
+!.yarn/plugins
+!.yarn/releases
+!.yarn/sdks
+!.yarn/versions
+
+# Vite files
+vite.config.js.timestamp-*
+vite.config.ts.timestamp-*
+.vite/
diff --git a/packages/better-auth/.prettierignore b/packages/better-auth/.prettierignore
@@ -0,0 +1,4 @@
+/dist
+/build
+/node_modules
+/coverage
diff --git a/packages/better-auth/README.md b/packages/better-auth/README.md
@@ -0,0 +1,97 @@
+![ThunderID Browser SDK](https://raw.githubusercontent.com/thunder-id/thunderid/refs/heads/main/docs/static/assets/images/readme/repo-banner-better-auth.png)
+
+ThunderID provider helper for the [Better Auth](https://better-auth.com)
+[Generic OAuth plugin](https://better-auth.com/docs/plugins/generic-oauth).
+
+This is a
+[community provider helper](https://better-auth.com/docs/authentication/other-social-providers#community-provider-helpers):
+it returns a typed `GenericOAuthConfig` for a ThunderID issuer. All OAuth 2.0 / OIDC handling is performed by Better
+Auth itself — this package only supplies configuration, so there is no ThunderID SDK dependency and no protocol logic to
+keep in sync.
+
+## Pre-requisites
+
+- Requires `better-auth` >= 1.7.0 as a peer dependency.
+- A running ThunderID instance with an OAuth 2.0 / OIDC application registered. See the [ThunderID documentation](https://thunderid.dev/) for details.
+
+## Installation
+
+```bash
+npm install @thunderid/better-auth
+```
+
+## Usage
+
+```ts
+import {thunderid} from '@thunderid/better-auth';
+import {betterAuth} from 'better-auth';
+import {genericOAuth} from 'better-auth/plugins';
+
+export const auth = betterAuth({
+  plugins: [
+    genericOAuth({
+      config: [
+        thunderid({
+          clientId: process.env.THUNDERID_CLIENT_ID!,
+          clientSecret: process.env.THUNDERID_CLIENT_SECRET!,
+          issuer: process.env.THUNDERID_ISSUER!,
+        }),
+      ],
+    }),
+  ],
+});
+```
+
+Use your existing Better Auth client, or create one. No client plugin is required, since the generic OAuth
+plugin exposes sign-in through the standard social-provider API:
+
+```ts
+import {createAuthClient} from 'better-auth/react';
+
+export const authClient = createAuthClient();
+```
+
+Sign in from the client with the `thunderid` provider ID:
+
+```ts
+await authClient.signIn.social({
+  provider: 'thunderid',
+  callbackURL: '/dashboard',
+});
+```
+
+## Callback URL
+
+Register this redirect URI on your ThunderID application:
+
+```
+{baseURL}/api/auth/callback/thunderid
+```
+
+For example, `http://localhost:3000/api/auth/callback/thunderid` in development.
+
+## Options
+
+| Option                  | Type       | Default                          | Description                                                                                                                                                                                                                                 |
+| ----------------------- | ---------- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `issuer`                | `string`   | —                                | **Required.** ThunderID issuer URL, e.g. `https://thunderid.example.com`. A trailing slash is trimmed. The OIDC discovery URL is derived as `{issuer}/.well-known/openid-configuration`, so all endpoints come from the discovery document. |
+| `clientId`              | `string`   | —                                | **Required.** OAuth client ID.                                                                                                                                                                                                              |
+| `clientSecret`          | `string`   | —                                | OAuth client secret. Omit for public clients using `tokenEndpointAuth: {method: 'none'}`.                                                                                                                                                   |
+| `scopes`                | `string[]` | `['openid', 'profile', 'email']` | Requested scopes.                                                                                                                                                                                                                           |
+| `tokenEndpointAuth`     | `object`   | provider default                 | Token endpoint authentication method, e.g. `{method: 'client_secret_post'}`.                                                                                                                                                                |
+| `pkce`                  | `boolean`  | discovery default                | Force PKCE on or off.                                                                                                                                                                                                                       |
+| `redirectURI`           | `string`   | Better Auth default              | Override the callback URL.                                                                                                                                                                                                                  |
+| `endSessionEndpoint`    | `string`   | discovery default                | RP-initiated logout endpoint.                                                                                                                                                                                                               |
+| `postLogoutRedirectURI` | `string`   | —                                | Where ThunderID returns the user after logout.                                                                                                                                                                                              |
+| `disableProviderLogout` | `boolean`  | `false`                          | Skip provider logout on sign-out.                                                                                                                                                                                                           |
+| `disableImplicitSignUp` | `boolean`  | `false`                          | Require an explicit sign-up request before creating a user.                                                                                                                                                                                 |
+| `disableSignUp`         | `boolean`  | `false`                          | Reject sign-in for users who do not already exist.                                                                                                                                                                                          |
+| `overrideUserInfo`      | `boolean`  | `false`                          | Refresh the stored user profile from ThunderID on every sign-in.                                                                                                                                                                            |
+
+Every option other than `issuer` is passed through from Better Auth's
+[`BaseOAuthProviderOptions`](https://better-auth.com/docs/authentication/other-social-providers#built-in-provider-helpers)
+and behaves exactly as it does for the built-in provider helpers.
+
+## License
+
+This project is licensed under the [Apache License 2.0](https://github.com/thunder-id/thunderid/blob/main/LICENSE).
diff --git a/packages/better-auth/eslint.config.js b/packages/better-auth/eslint.config.js
@@ -0,0 +1,12 @@
+// Copyright 2026 The ThunderID Authors
+// SPDX-License-Identifier: Apache-2.0
+
+import thunderIdPlugin from '@thunderid/eslint-plugin';
+
+export default [
+  {
+    ignores: ['dist/**', 'build/**', 'node_modules/**', 'coverage/**'],
+  },
+  ...thunderIdPlugin.configs.typescript,
+  ...thunderIdPlugin.configs.vitest,
+];
diff --git a/packages/better-auth/package.json b/packages/better-auth/package.json
@@ -0,0 +1,68 @@
+{
+  "name": "@thunderid/better-auth",
+  "version": "0.0.0",
+  "description": "ThunderID for Better Auth",
+  "keywords": [
+    "thunderid",
+    "better-auth",
+    "oauth",
+    "oidc",
+    "generic-oauth",
+    "helper"
+  ],
+  "homepage": "https://github.com/thunder-id/javascript-sdks/tree/main/packages/better-auth#readme",
+  "bugs": {
+    "url": "https://github.com/thunder-id/thunderid/issues"
+  },
+  "author": "The ThunderID Authors",
+  "license": "Apache-2.0",
+  "type": "module",
+  "main": "dist/index.js",
+  "module": "dist/index.js",
+  "commonjs": "dist/cjs/index.cjs",
+  "exports": {
+    "import": "./dist/index.js",
+    "require": "./dist/cjs/index.cjs"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "types": "dist/index.d.ts",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/thunder-id/javascript-sdks",
+    "directory": "packages/better-auth"
+  },
+  "scripts": {
+    "build": "pnpm clean:dist &&  rolldown -c rolldown.config.js && tsc -p tsconfig.lib.json --emitDeclarationOnly --outDir dist",
+    "clean": "pnpm clean:node_modules && pnpm clean:dist",
+    "clean:dist": "rimraf dist",
+    "clean:node_modules": "rimraf node_modules",
+    "format:check": "prettier --check --cache .",
+    "format:fix": "prettier --write --cache .",
+    "lint": "eslint . --ext .js,.jsx,.ts,.tsx,.cjs,.mjs",
+    "lint:fix": "eslint . --fix --ext .js,.jsx,.ts,.tsx,.cjs,.mjs",
+    "test": "vitest",
+    "typecheck": "tsc -p tsconfig.lib.json"
+  },
+  "devDependencies": {
+    "@thunderid/eslint-plugin": "catalog:",
+    "@thunderid/prettier-config": "catalog:",
+    "@types/node": "catalog:",
+    "better-auth": "^1.7.2",
+    "eslint": "catalog:",
+    "prettier": "catalog:",
+    "rimraf": "catalog:",
+    "rolldown": "catalog:",
+    "typescript": "catalog:",
+    "vitest": "catalog:"
+  },
+  "peerDependencies": {
+    "better-auth": ">=1.7.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}
diff --git a/packages/better-auth/prettier.config.js b/packages/better-auth/prettier.config.js
@@ -0,0 +1,6 @@
+// Copyright 2026 The ThunderID Authors
+// SPDX-License-Identifier: Apache-2.0
+
+import config from '@thunderid/prettier-config';
+
+export default config;