Add ThunderID provider helper for Generic OAuth plugin

packages/better-auth/.editorconfig

@@ -0,0 +1 @@
+../../.editorconfig

packages/better-auth/.gitignore

@@ -0,0 +1,141 @@
+# Logs
+logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+lerna-debug.log*
+
+# Diagnostic reports (https://nodejs.org/api/report.html)
+report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json
+
+# Runtime data
+pids
+*.pid
+*.seed
+*.pid.lock
+
+# Directory for instrumented libs generated by jscoverage/JSCover
+lib-cov
+
+# Coverage directory used by tools like istanbul
+coverage
+*.lcov
+
+# nyc test coverage
+.nyc_output
+
+# Grunt intermediate storage (https://gruntjs.com/creating-plugins#storing-task-files)
+.grunt
+
+# Bower dependency directory (https://bower.io/)
+bower_components
+
+# node-waf configuration
+.lock-wscript
+
+# Compiled binary addons (https://nodejs.org/api/addons.html)
+build/Release
+
+# Dependency directories
+node_modules/
+jspm_packages/
+
+# Snowpack dependency directory (https://snowpack.dev/)
+web_modules/
+
+# TypeScript cache
+*.tsbuildinfo
+
+# Optional npm cache directory
+.npm
+
+# Optional eslint cache
+.eslintcache
+
+# Optional stylelint cache
+.stylelintcache
+
+# Optional REPL history
+.node_repl_history
+
+# Output of 'npm pack'
+*.tgz
+
+# Yarn Integrity file
+.yarn-integrity
+
+# dotenv environment variable files
+.env
+.env.*
+!.env.example
+
+# parcel-bundler cache (https://parceljs.org/)
+.cache
+.parcel-cache
+
+# Next.js build output
+.next
+out
+
+# Nuxt.js build / generate output
+.nuxt
+dist
+.output
+
+# Gatsby files
+.cache/
+# Comment in the public line in if your project uses Gatsby and not Next.js
+# https://nextjs.org/blog/next-9-1#public-directory-support
+# public
+
+# vuepress build output
+.vuepress/dist
+
+# vuepress v2.x temp and cache directory
+.temp
+.cache
+
+# Sveltekit cache directory
+.svelte-kit/
+
+# vitepress build output
+**/.vitepress/dist
+
+# vitepress cache directory
+**/.vitepress/cache
+
+# Docusaurus cache and generated files
+.docusaurus
+
+# Serverless directories
+.serverless/
+
+# FuseBox cache
+.fusebox/
+
+# DynamoDB Local files
+.dynamodb/
+
+# Firebase cache directory
+.firebase/
+
+# TernJS port file
+.tern-port
+
+# Stores VSCode versions used for testing VSCode extensions
+.vscode-test
+
+# yarn v3
+.pnp.*
+.yarn/*
+!.yarn/patches
+!.yarn/plugins
+!.yarn/releases
+!.yarn/sdks
+!.yarn/versions
+
+# Vite files
+vite.config.js.timestamp-*
+vite.config.ts.timestamp-*
+.vite/

packages/better-auth/.prettierignore

@@ -0,0 +1,4 @@
+/dist
+/build
+/node_modules
+/coverage

packages/better-auth/README.md

@@ -0,0 +1,93 @@
+# @thunderid/better-auth
+
+ThunderID provider helper for the [Better Auth](https://better-auth.com)
+[Generic OAuth plugin](https://better-auth.com/docs/plugins/generic-oauth).
+
+This is a
+[community provider helper](https://better-auth.com/docs/authentication/other-social-providers#community-provider-helpers):
+it returns a typed `GenericOAuthConfig` for a ThunderID issuer. All OAuth 2.0 / OIDC handling is performed by Better
+Auth itself — this package only supplies configuration, so there is no ThunderID SDK dependency and no protocol logic to
+keep in sync.
+
+## Installation
+
+```bash
+npm install @thunderid/better-auth
+```
+
+Requires `better-auth` >= 1.7.0 as a peer dependency.
+
+## Usage
+
+```ts
+import {thunderid} from '@thunderid/better-auth';
+import {betterAuth} from 'better-auth';
+import {genericOAuth} from 'better-auth/plugins';
+
+export const auth = betterAuth({
+  plugins: [
+    genericOAuth({
+      config: [
+        thunderid({
+          clientId: process.env.THUNDERID_CLIENT_ID!,
+          clientSecret: process.env.THUNDERID_CLIENT_SECRET!,
+          issuer: process.env.THUNDERID_ISSUER!,
+        }),
+      ],
+    }),
+  ],
+});
+```
+
+Sign in from the client with the `thunderid` provider ID:
+
+```ts
+await authClient.signIn.social({
+  provider: 'thunderid',
+  callbackURL: '/dashboard',
+});
+```
+
+## Callback URL
+
+Register this redirect URI on your ThunderID application:
+
+```
+{baseURL}/api/auth/callback/thunderid
+```
+
+For example, `http://localhost:3000/api/auth/callback/thunderid` in development.
+
+## Options
+
+| Option                  | Type       | Default                          | Description                                                                                                                                                                                                                                 |
+| ----------------------- | ---------- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `issuer`                | `string`   | —                                | **Required.** ThunderID issuer URL, e.g. `https://thunderid.example.com`. A trailing slash is trimmed. The OIDC discovery URL is derived as `{issuer}/.well-known/openid-configuration`, so all endpoints come from the discovery document. |
+| `clientId`              | `string`   | —                                | **Required.** OAuth client ID.                                                                                                                                                                                                              |
+| `clientSecret`          | `string`   | —                                | OAuth client secret. Omit for public clients using `tokenEndpointAuth: {method: 'none'}`.                                                                                                                                                   |
+| `scopes`                | `string[]` | `['openid', 'profile', 'email']` | Requested scopes.                                                                                                                                                                                                                           |
+| `tokenEndpointAuth`     | `object`   | provider default                 | Token endpoint authentication method, e.g. `{method: 'client_secret_post'}`.                                                                                                                                                                |
+| `pkce`                  | `boolean`  | discovery default                | Force PKCE on or off.                                                                                                                                                                                                                       |
+| `redirectURI`           | `string`   | Better Auth default              | Override the callback URL.                                                                                                                                                                                                                  |
+| `endSessionEndpoint`    | `string`   | discovery default                | RP-initiated logout endpoint.                                                                                                                                                                                                               |
+| `postLogoutRedirectURI` | `string`   | —                                | Where ThunderID returns the user after logout.                                                                                                                                                                                              |
+| `disableProviderLogout` | `boolean`  | `false`                          | Skip provider logout on sign-out.                                                                                                                                                                                                           |
+| `disableImplicitSignUp` | `boolean`  | `false`                          | Require an explicit sign-up request before creating a user.                                                                                                                                                                                 |
+| `disableSignUp`         | `boolean`  | `false`                          | Reject sign-in for users who do not already exist.                                                                                                                                                                                          |
+| `overrideUserInfo`      | `boolean`  | `false`                          | Refresh the stored user profile from ThunderID on every sign-in.                                                                                                                                                                            |
+
+Every option other than `issuer` is passed through from Better Auth's
+[`BaseOAuthProviderOptions`](https://better-auth.com/docs/authentication/other-social-providers#built-in-provider-helpers)
+and behaves exactly as it does for the built-in provider helpers.
+
+## Development
+
+```bash
+pnpm --filter @thunderid/better-auth run build
+pnpm --filter @thunderid/better-auth run test
+pnpm --filter @thunderid/better-auth run typecheck
+```
+
+## License
+
+Apache-2.0. See [LICENSE](../../LICENSE).

packages/better-auth/eslint.config.js

@@ -0,0 +1,12 @@
+// Copyright 2026 The ThunderID Authors
+// SPDX-License-Identifier: Apache-2.0
+
+import thunderIdPlugin from '@thunderid/eslint-plugin';
+
+export default [
+  {
+    ignores: ['dist/**', 'build/**', 'node_modules/**', 'coverage/**'],
+  },
+  ...thunderIdPlugin.configs.typescript,
+  ...thunderIdPlugin.configs.vitest,
+];

packages/better-auth/package.json

@@ -0,0 +1,67 @@
+{
+  "name": "@thunderid/better-auth",
+  "version": "0.0.0",
+  "description": "ThunderID provider helper for the Better Auth Generic OAuth plugin",
+  "keywords": [
+    "thunderid",
+    "better-auth",
+    "oauth",
+    "oidc",
+    "generic-oauth"
+  ],
+  "homepage": "https://github.com/thunder-id/javascript-sdks/tree/main/packages/better-auth#readme",
+  "bugs": {
+    "url": "https://github.com/thunder-id/thunderid/issues"
+  },
+  "author": "The ThunderID Authors",
+  "license": "Apache-2.0",
+  "type": "module",
+  "main": "dist/index.js",
+  "module": "dist/index.js",
+  "commonjs": "dist/cjs/index.cjs",
+  "exports": {
+    "import": "./dist/index.js",
+    "require": "./dist/cjs/index.cjs"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "types": "dist/index.d.ts",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/thunder-id/javascript-sdks",
+    "directory": "packages/better-auth"
+  },
+  "scripts": {
+    "build": "pnpm clean:dist &&  rolldown -c rolldown.config.js && tsc -p tsconfig.lib.json --emitDeclarationOnly --outDir dist",
+    "clean": "pnpm clean:node_modules && pnpm clean:dist",
+    "clean:dist": "rimraf dist",
+    "clean:node_modules": "rimraf node_modules",
+    "format:check": "prettier --check --cache .",
+    "format:fix": "prettier --write --cache .",
+    "lint": "eslint . --ext .js,.jsx,.ts,.tsx,.cjs,.mjs",
+    "lint:fix": "eslint . --fix --ext .js,.jsx,.ts,.tsx,.cjs,.mjs",
+    "test": "vitest",
+    "typecheck": "tsc -p tsconfig.lib.json"
+  },
+  "devDependencies": {
+    "@thunderid/eslint-plugin": "catalog:",
+    "@thunderid/prettier-config": "catalog:",
+    "@types/node": "catalog:",
+    "better-auth": "^1.7.2",
+    "eslint": "catalog:",
+    "prettier": "catalog:",
+    "rimraf": "catalog:",
+    "rolldown": "catalog:",
+    "typescript": "catalog:",
+    "vitest": "catalog:"
+  },
+  "peerDependencies": {
+    "better-auth": ">=1.7.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

packages/better-auth/prettier.config.js

@@ -0,0 +1,6 @@
+// Copyright 2026 The ThunderID Authors
+// SPDX-License-Identifier: Apache-2.0
+
+import config from '@thunderid/prettier-config';
+
+export default config;

packages/better-auth/rolldown.config.js

@@ -0,0 +1,41 @@
+// Copyright 2026 The ThunderID Authors
+// SPDX-License-Identifier: Apache-2.0
+
+import {readFileSync} from 'fs';
+import {join} from 'path';
+import {defineConfig} from 'rolldown';
+
+const pkg = JSON.parse(readFileSync('./package.json', 'utf8'));
+
+const external = [...Object.keys(pkg.dependencies || {}), ...Object.keys(pkg.peerDependencies || {}), /^better-auth\//];
+
+const commonOptions = {
+  input: [join('src', 'index.ts')],
+  preserveModules: true,
+  external,
+  platform: 'neutral',
+  target: 'es2020',
+  sourcemap: true,
+};
+
+export default defineConfig([
+  // ESM build
+  {
+    ...commonOptions,
+    output: {
+      dir: 'dist',
+      format: 'esm',
+      preserveModulesRoot: 'src',
+    },
+  },
+  // CommonJS build
+  {
+    ...commonOptions,
+    output: {
+      dir: join('dist', 'cjs'),
+      entryFileNames: '[name].cjs',
+      format: 'cjs',
+      preserveModulesRoot: 'src',
+    },
+  },
+]);