Auth we actually
run in production.
This is the open-source side of Factiii. Two packages are maintained and shipping. One is not. All three are here so you can tell which is which before you install anything.
@factiii/auth
v0.20.4Drop-in authentication for tRPC. JWT sessions, OAuth, and 2FA, all type-safe against your Prisma schema.
Source on GitHub@factiii/runner
v0.15.0A headless daemon that runs Factiii's Board AI agents on a machine you control. The web and mobile clients reach it over WebRTC.
Package on npm@factiii/stack
v0.20.4The configless deploy CLI. Published versions still install, but the package is not developed further. See the project status below.
Source on GitHubRunning in production
We ship these packages because we depend on them. Two live products, two different schemas, one auth layer.
What @factiii/auth gives you
It is the authentication layer behind factiii.com, extracted and published under MIT. We upgrade it because we depend on it.
Prisma models, generated
Run `npx @factiii/auth init` and the User, session, and verification models land in your schema.prisma. `doctor` tells you what is still wrong.
A typed tRPC router
createAuthRouter returns a router, an authProcedure, and a createContext. Protected routes read ctx.userId. No boilerplate wiring.
OAuth and 2FA
Google and Apple sign-in, TOTP two-factor, and email verification are config flags, not forks. Turn on what you need in the features object.
Sessions that survive
JWT sessions with configurable cookie settings, including an explicit cookie domain for apps served across a proxy and an API subdomain.
Three steps to a session
The whole quickstart. There is no hidden configuration step.
Install and init
Add the package, generate the Prisma models, then verify the setup before you write any code.
npm install @factiii/auth @prisma/client
npx @factiii/auth init
npx prisma generate && npx prisma db push
npx @factiii/auth doctorCreate the auth router
One call returns the router, the protected-procedure helper, and the context factory.
import { createAuthRouter } from '@factiii/auth';
import { prisma } from './prisma';
export const { router, authProcedure, createContext } =
createAuthRouter({
prisma,
secrets: { jwt: process.env.JWT_SECRET! },
});Protect your routes
authProcedure resolves the session and puts the user id on the context. Anything unauthenticated never reaches your handler.
const protectedRouter = router({
getProfile: authProcedure.query(({ ctx }) => {
return { userId: ctx.userId };
}),
});@factiii/runner
The daemon behind Board AI agents on factiii.com. Install it on a workstation, dev box, or VM, pair it to your account, and the clients hand it the work.
npx @factiii/runner setup # check the host toolchain, pair this runner
factiii-runner start # run the daemonNeeds Node 20+, plus git, tmux and redis-server on PATH, and the agent CLIs you plan to use.
Runs on your machine
Agents execute on the host you install it on, so they can drive whatever that host can: simulators, native builds, platform toolchains.
Clients connect over WebRTC
The Factiii web and mobile clients reach the daemon directly and offload AI work to it. Your code never has to leave the machine.
Credentials encrypted at rest
Tokens and OAuth files in ~/.factiii-runner/ are AES-256-GCM encrypted at 0600. There is no plaintext fallback — no usable keychain means it stores nothing.
What happened to @factiii/stack
@factiii/stack was a plugin framework for deploying full-stack apps. We replaced it with plain deploy scripts and AI agent skills kept in each repo that uses them. That turned out simpler and easier to adapt than a framework that had to anticipate every project.
The published versions stay on npm and still install. The package is no longer developed, and issues and pull requests are not triaged. If you are starting something new, do not build on it.
You will see a version number on npm newer than July 2026 (0.20.4 today). That is the release pipeline for the repository it shares with @factiii/auth, not new work on the CLI. A rising version here does not mean the package came back.
@factiii/auth is a separate package in the same repository, and it is still maintained. We run it in production, so it keeps getting fixes.