JavaScript SDKs

The JavaScript SDKs live in javascript-sdks, a pnpm workspace managed with Turborepo. Every package publishes under the @thunderid scope.

Packages

Package	Purpose
@thunderid/javascript	Framework-agnostic core: auth flows, token management, i18n, utilities
@thunderid/browser	Browser runtime: storage, session sync, WebAuthn
@thunderid/node	Node runtime: cookies, server sessions
@thunderid/react	React SDK
@thunderid/vue	Vue SDK
@thunderid/nextjs	Next.js SDK
@thunderid/nuxt	Nuxt module
@thunderid/express	Express SDK
@thunderid/react-router	React Router integration
@thunderid/tanstack-router	TanStack Router integration
@thunderid/better-auth	Better Auth provider helper

@thunderid/better-auth stands apart from the rest: it has no dependency on @thunderid/javascript and no protocol logic of its own, it only returns a typed OAuth config for Better Auth's Generic OAuth plugin. The other packages build on each other rather than standing alone. Each arrow points from a package to the ones built on top of it:

Put a shared helper as close to the root as it can go. A utility used by both React and Vue belongs in browser, or in javascript if it needs nothing from the browser, rather than being duplicated in each.

Commands

Run these from the repository root:

bash

pnpm install
pnpm build
pnpm test
pnpm lint          # pnpm lint:fix to apply
pnpm typecheck
pnpm format:check  # pnpm format:fix to apply

Scope any of them to one package with a filter:

bash

pnpm --filter @thunderid/react run build

Two other commands are worth knowing: pnpm symlink links packages for local development against another project, and pnpm clean clears build output.

Playgrounds

Each SDK has a playground under playgrounds/<framework> that uses the workspace package, so it always runs your changes:

Playground	Port	Covers
react	5173	Capability checks, a component explorer, hooks and tokens
vue	5174	Capability checks, a component explorer, composables and tokens
browser	5175	Capability checks against ThunderIDBrowserClient, the UI helpers, and tokens
express	3000	An API explorer for the SDK's handlers and example protected routes, with an SDK trace
nextjs	3001	Client and server checks, a component explorer, a server page and tokens
nuxt	3002	Client and server checks, a component explorer, composables and a server page
node	3003	An operations explorer for every ThunderIDNodeClient method, with an SDK trace

Copy the playground's .env.example to .env, fill in your server URL and application, build the packages with pnpm build, then start one with pnpm --filter @thunderid/playground-<framework> dev. The pull request builder builds and lints them, so keep their checks and stories in step when you change a capability or a component.

Conventions

• Dependency versions are centralized. pnpm-workspace.yaml holds a catalog: of pinned versions plus an overrides block of security pins. Add or bump a shared dependency there rather than in an individual package.
• Every source file carries a copyright header, enforced by the @thunderid/copyright-header ESLint rule. Files under samples/ are exempt.
• Do not hardcode the vendor name in runtime keys such as storage keys or log tags. Resolve it with getVendorPrefix(vendor) so a consumer's vendor override applies.
• Formatting comes from @thunderid/prettier-config. Run pnpm format:fix rather than hand-formatting.