\n\n---\n\nEvery TypeScript auth library makes you choose framework lock-in (NextAuth, Auth.js), a hosted control plane (Clerk, WorkOS, Stytch), or DIY-on-Lucia + passport + your own glue. `@gentleduck/auth` is the third option, but unified: framework-agnostic core, batteries-included adapters, no hosted plane. Wire it into Express, Hono, Next.js, Fastify, Koa, NestJS, Elysia, gRPC, or your own router with one adapter import.\n\nZero hosted dependencies. Tree-shakeable subpath exports. Lazy peer deps for the heavy bits (argon2, simplewebauthn, the AWS KMS client, the database drivers).\n\n## Install\n\n```bash\nnpm install @gentleduck/auth\n# or\nbun add @gentleduck/auth\n```\n\nInstall only what you wire:\n\n| Package | When you need it |\n|---|---|\n| `@node-rs/argon2` | Argon2id password hashing (FIPS / HIPAA presets) |\n| `@simplewebauthn/server` | Passkey / WebAuthn-MFA |\n| `@aws-sdk/client-kms` | AWS KMS envelope encryption at rest |\n| `drizzle-orm` + `pg`, `mysql2` or `better-sqlite3` | Drizzle adapter (pg / mysql / sqlite) |\n| `ioredis` or `@upstash/redis` | Redis-backed session / idempotency / limiter / events / DPoP-nonce stores |\n| `@node-saml/node-saml` | SAML 2.0 SP |\n| `@nestjs/common` | NestJS adapter |\n\n## Quick start\n\n```typescript\nimport { createAuth } from '@gentleduck/auth/core'\nimport { MemoryAdapter } from '@gentleduck/auth/adapters/memory'\nimport { MemoryLimiter } from '@gentleduck/auth/limiters/memory'\nimport { Argon2idHasher, passwords } from '@gentleduck/auth/providers/passwords'\n\nconst storage = new MemoryAdapter()\n\nexport const auth = createAuth({\n baseUrl: 'http://localhost:3000',\n stores: storage,\n limiter: new MemoryLimiter({ max: 5, windowMs: 60_000 }),\n providers: [passwords({ hasher: new Argon2idHasher() })],\n})\n\nconst identity = await auth.identities.create({ profile: { username: 'a', email: 'a@x.com' } })\nawait auth.passwords.set(identity.id, 'correct-horse-battery', auth.cfg.stores.credentials)\n\nconst result = await auth.flows.signIn({\n providerId: 'password',\n input: { email: 'a@x.com', password: 'correct-horse-battery' },\n})\n// result.session, result.sid, result.intents[]\n```\n\n`createAuth` is the factory that wires the facets, picks sane defaults (a `CookieTransport` named `duck-sid`, `InMemoryEvents`), and registers the providers you pass. `passwords()` hashes with `Argon2idHasher` unless you pass `hasher`, so install `@node-rs/argon2` or pass `ScryptHasher`. For full control, instantiate `AuthEngine` directly - both APIs accept the same primitives.\n\n## Architecture\n\n`AuthEngine` is the root: every state-changing operation lives behind one named facet so adapters, transports, and providers compose without back-channel coupling.\n\n| Facet | Owns |\n|---|---|\n| `identities` | profile CRUD, link/unlink, soft-delete + grace-period restore, GDPR export, bulk import |\n| `sessions` | rotateOrCreate (single privilege-changing API), getBySid, revoke, revokeAllForIdentity, gc |\n| `credentials` | password / api-key / oauth / passkey / recovery / totp / webauthn-mfa rows; CAS rotation |\n| `passwords` | strength + cap validation, constant-time verify, needsRehash + auto-rehash, common-list reject |\n| `passkeys` | list / revoke / revokeAll, scoped to the identity that holds them |\n| `mfa` | TOTP enrollment + verify, backup-code mint/verify, WebAuthn-MFA |\n| `apiKeys` | mint / list / rotate / revoke / revokeAll / verify + scope checks, tenant-bound issuance |\n| `flows` | signIn / signOut / signUp (multi-stage) / password-reset / email-verification / account-deletion / linkProvider / unlinkProvider / impersonate / step-up / step-down |\n| `csrf` | double-submit + origin-only + sec-fetch-site gates, `__Host-` cookie |\n| `webhooks` | HMAC + timestamp + tolerance, retry w/ backoff, dead-letter, SSRF-guarded URLs |\n| `events` | typed bus, lockout / signin.success / signin.failed / suspicious / session.revoked / mfa.removed |\n| `hijack` | IP / UA drift detection + step-up / rotate / revoke reaction policy |\n| `anomaly` | pluggable detectors (impossible-travel, device-fingerprint), composition + decision ladder |\n| `orgs` | org + membership CRUD, role sanitisation, multi-tenant guard |\n\nPlus `m2m` (`client_credentials` OAuth2 grant), `compliance` (GDPR / HIPAA / SOC2 / FIPS presets), `plugin` (named install + facet extension), and `audit` (admin-mutation hook with redaction).\n\n## Providers\n\n| Path | What |\n|---|---|\n| `@gentleduck/auth/providers/passwords` | Email + password |\n| `@gentleduck/auth/providers/magic-link` | Passwordless one-time link |\n| `@gentleduck/auth/providers/passkey` | WebAuthn passkey (lazy peerDep on `@simplewebauthn/server`) |\n| `@gentleduck/auth/providers/api-key` | Long-lived bearer keys via `ApiKeysFacet` |\n| `@gentleduck/auth/providers/oauth/google` | Google OAuth (PKCE + nonce) |\n| `@gentleduck/auth/providers/oauth/github` | GitHub OAuth (PKCE + state) |\n| `@gentleduck/auth/providers/oauth/microsoft` | Microsoft / Entra ID OAuth |\n| `@gentleduck/auth/providers/oauth/discord` | Discord OAuth |\n| `@gentleduck/auth/providers/oauth/linkedin` | LinkedIn OAuth |\n| `@gentleduck/auth/providers/oauth/apple` | Sign in with Apple |\n| `@gentleduck/auth/providers/oauth/core` | Any other OAuth 2.0 / OIDC IdP: `oProvider` over an `OAuthClient` |\n| `@gentleduck/auth/providers/saml` | Wrapper over a `@node-saml/node-saml` client you build: SP-initiated + IdP-initiated SSO, SP metadata XML generation, Single Logout (SP- and IdP-initiated) |\n\n## Transports\n\n```typescript\nimport {\n CookieTransport, // __Host- prefix + HttpOnly + SameSite=Lax (default)\n BearerTransport, // opaque tokens in Authorization header\n JwtTransport, // HS256 / RS256 / ES256 / EdDSA + JWKS rotation\n CompositeTransport, // chain multiple transports\n} from '@gentleduck/auth/core/transport'\n\nimport {\n DPoPVerifier,\n MemoryDPoPNonceStore,\n computeJwkThumbprint,\n bindPayloadToDPoP,\n} from '@gentleduck/auth/core/transport' // RFC 9449\n```\n\n## Storage adapters\n\n```typescript\nimport { MemoryAdapter } from '@gentleduck/auth/adapters/memory'\nimport { DrizzlePgAdapter } from '@gentleduck/auth/adapters/drizzle/pg'\nimport { DrizzleMysqlAdapter } from '@gentleduck/auth/adapters/drizzle/mysql'\nimport { DrizzleSqliteAdapter } from '@gentleduck/auth/adapters/drizzle/sqlite'\nimport {\n RedisSessionImpl,\n RedisEvents,\n RedisDPoPNonceStore,\n} from '@gentleduck/auth/adapters/redis'\nimport { RedisLimiter } from '@gentleduck/auth/limiters/redis'\nimport { FakeRedis } from '@gentleduck/auth/test' // in-tree, for tests\n\n// One class per dialect, implementing the three store contracts. The constructor takes a\n// connection string, a driver pool, or a drizzle handle you already have.\nconst storage = new DrizzlePgAdapter('postgres://localhost/app')\nconst { identities, credentials, sessions } = storage\n```\n\n### What a call costs\n\np50 at the adapter boundary - drizzle building the SQL, the driver, the round trip and the row mapping -\nover 50k identities and 100k logins on every backend, on one laptop under everyday load:\n\n| call | Memory | SQLite | Postgres | MySQL |\n| --- | --- | --- | --- | --- |\n| `find({ id })` | 3 µs | 0.089 ms | 0.280 ms | 0.255 ms |\n| `find({ email })` | 7 µs | 0.090 ms | 0.299 ms | 0.259 ms |\n| `find({ providerId, providerSub })` | 8 µs | 0.112 ms | 0.383 ms | 0.282 ms |\n| `create (2 logins)` | 2.125 ms | 0.632 ms | 0.650 ms | 1.184 ms |\n| `erase` | 3 µs | 0.543 ms | 0.499 ms | 1.348 ms |\n| `link` | 0.630 ms | 0.454 ms | 0.549 ms | 1.404 ms |\n| `patchMetadata` | 4 µs | 0.282 ms | 0.271 ms | 0.906 ms |\n\nReads are index-driven on every dialect and the driver round trip costs ~5x the query it carries. Writes\nare one statement on Postgres (`create` and `erase` are each a single CTE) and a transaction on the\nothers, which have no `RETURNING` or no DML inside a `WITH`. Memory's `create` and `link` are the\noutliers: both check a login against every row the adapter holds, which is a test double being one, not a\nstore to run 50k accounts through.\n\nRun it yourself with `bun run bench:adapters` - it starts and removes its own containers. The plans, the\np95s, the method behind these and what is deliberately left unoptimised are in\n[`src/adapters/README.md`](./src/adapters/README.md).\n\n## Transactions\n\nEvery SQL-backed write and read can run on a transaction you own. `withTransaction(tx)`\nreturns a view of the engine bound to your transaction handle; the handle is opaque to\nduck-auth and is handed straight back to your adapter.\n\n```typescript\nconst pending = await db.transaction(async (tx) => {\n const auth = engine.withTransaction(tx)\n await auth.identities.softDelete(identityId)\n await auth.sessions.revokeAllForIdentity(identityId)\n await tx.delete(users).where(eq(users.id, identityId))\n return auth.pending\n})\nawait pending.flush() // publish the events only once the commit landed\n```\n\nNested calls inherit it: `auth.flows.completeAccountDeletion()` reaches\n`identities.softDelete`, `sessions.revokeAllForIdentity` and `credentials.delete`, and all\nthree land on your transaction. Reads are bound too, so a read inside the transaction sees\nthat transaction's own uncommitted writes.\n\n**Events do not fire inside a transaction.** They buffer in `pending` and publish when you\ncall `flush()`. A rolled-back delete therefore never appears in the audit trail as a\ncompleted one. Call `flush()` after your commit; call `pending.discard()` if you rolled\nback deliberately and want the buffer dropped. `pending.peek()` inspects the buffer without\ndraining it.\n\n### What is and isn't transactional\n\n| Surface | In a transaction? | On rollback |\n|---|---|---|\n| `identities`, `sessions`, `credentials` - writes and reads | yes | undone |\n| `flows.*`, including nested facet calls | yes | undone |\n| `mfa`, `apiKeys`, `passwords` credential writes | yes | undone |\n| `orgs` | interface ready; no shipped SQL adapter | n/a |\n| events | buffered in `pending` | never published |\n| `deliver` calls (verification / reset mail) | **no - sent immediately** | mail already delivered |\n| `limiter` counters | **no** | token stays consumed |\n| `hijack` / `anomaly` scoring | **no** | scores stand |\n\nThe last two rows are guards: they decide *whether* to do the work, they write nothing to SQL,\nand they are not reachable on the bound view at all - use `engine.limiter`,\n`engine.hijack` and `engine.anomaly` outside the transaction. A flow that sends mail should be\ncalled outside a transaction, or split so the send happens after the commit; no rollback\ncan retract a delivered email.\n\n**An engine with no transaction supplied behaves exactly as before:** writes go to its own\nconnection and events publish immediately.\n\n### Adapter support\n\n`withTransaction` needs the adapter you passed as `stores` to implement `withClient` - one\ncall rebinds every facet, since they share its connection. The drizzle pg, mysql and sqlite\nadapters do. Memory, redis and valkey do not - they cannot join a SQL transaction - and nor\ncan a bag you assembled facet by facet, so `withTransaction` throws `AUTH_MISCONFIGURED`\nrather than silently leaving those writes outside your transaction.\n\n### Every mutating call answers with what it did\n\nA write that returns `void` cannot be told apart from one that matched nothing, and forces a\nsecond read for something the statement already had. Every mutating call returns the row,\nthe rows, or the count it touched. A single-row call that matched nothing rejects, and `.orNull()`\nreads that as `null`; a bulk one answers `[]` or `0`. Where the\ndialect has `RETURNING` this is the same round trip.\n\n```typescript\nconst identity = await auth.identities.softDelete(id)\n// `deletedAt` is when the grace window CLOSES, so the deadline you show the user\n// comes off the write itself rather than a second reading of the clock.\nidentity.deletedAt // Date | null\nidentity.emailVerified // false - the address is free to be claimed meanwhile\n\nconst erased = await auth.identities.erase(id, { reason: 'gdpr' })\n// The row as it was: after the delete there is nothing left to read.\n\nconst ended = await auth.sessions.revokeAllForIdentity(id)\nconst notice = `Signed out of ${ended.length} devices` // no second query; already read to emit events\n```\n\n| Surface | Calls | Answers with |\n|---|---|---|\n| `identities` | `softDelete`, `restore`, `erase`, `link`, `unlink` | the row |\n| `sessions` | `revoke`, `revokeByHash` | the session ended |\n| `sessions` | `revokeAllForIdentity` | the sessions ended |\n| `cfg.stores.credentials` | `revoke` / `revokeByKind`, `delete` / `deleteByKind` | the row / the rows |\n| `apiKeys` | `revoke` / `revokeAll` | the key / the keys revoked |\n| `passkeys` | `revoke` / `revokeAll` | the passkey / the passkeys revoked, without the secret |\n| `mfa` | `removeTotp`, `removeWebauthnMfa`, `removeBackupCodes` | `{ removed }` - the count, not the rows, which carry the secret |\n| `orgs` | `removeMember`, `setRoles` | the membership, with the **sanitized** role set actually stored |\n| `flows` | `completeAccountDeletion`, `cancelAccountDeletion`, `completeEmailVerification`, `linkProvider`, `unlinkProvider` | `identity`, alongside the fields they already returned |\n| `webhooks` | `deliverOne` | one `Delivery` per eligible endpoint |\n| `pending` | `flush`, `discard` | `{ published }` / `{ discarded }` |\n| `anomaly` | `unregister` | whether it removed anything |\n\nAssertions (`apiKeys.requireScopes`), `hijack.applyReaction`, registrations (`anomaly.register`, `providers.register`) and\n`plugins.dispose` stay `void`: they throw or they do not, and a return value would be noise.\n\n### Batch writes\n\nBatch forms take a list and answer the rows they wrote:\n\n```typescript\nconst written = await auth.identities.updateProfileMany([\n { id: a, patch: { displayName: 'A' }, expectedVersion: 3 },\n { id: b, patch: { displayName: 'B' }, expectedVersion: 7 },\n])\nwritten.map((row) => row.id) // [a] when b lost its version race\n```\n\nAvailable on `identities` (`softDeleteMany`, `restoreMany`, `eraseMany`, `updateProfileMany`,\n`linkMany`, `unlinkMany`) and `sessions` (`revokeAllForIdentities`, `revokeByHashes`). Each collapses to one\nstatement per table where the adapter can express it and loops otherwise, so every adapter\nsupports every batch form.\n\nA **hard** failure - a constraint violation - throws and aborts your transaction, so one\nbad row rolls the whole batch back. A **soft** failure - a lost optimistic-lock race, a\nmissing row - leaves that row out of the answer and does not throw.\n\n## Events\n\nEach handler picks where it runs. An `origin` handler runs once, on the server that emitted, inside\nthat request's async context. A `fleet` handler, the default, runs on every server; on the others it\ngets a copy of the payload and no request context.\n\n```typescript\nimport { redisEvents } from '@gentleduck/auth/adapters/redis'\n\nconst auth = createAuth({ events: redisEvents({ redis }) /* ... */ })\n\n// A write that must happen once: origin.\nauth.events.on('session.revoked', (e) => auditLog.write(e), { delivery: 'origin' })\n\n// State every server keeps: fleet.\nauth.events.on('authz.revoked', ({ identityId }) => decisionCache.drop(identityId))\n```\n\n`fleet` handlers need `redisEvents` once there is more than one server, since the in-process default\nruns them on one. `strict({ env: 'production' })` refuses the in-process bus while it holds a `fleet`\nhandler, and passes it when every handler is `origin`. It sees only the handlers registered before it\nruns, so call it after every `on()` and `use()`. Webhooks go out as `origin`, once per emit.\n\n## Server adapters\n\nduck-auth ships no routes and no client. Your app writes its own routes over `auth.flows.*` and calls them\nwith its own `fetch`. Each adapter carries only the glue: a CSRF guard, the caller's address and user agent,\nan intents writer, the actor context and the error mapping.\n\n```typescript\nimport { AuthError } from '@gentleduck/auth/core'\nimport { applyIntents, expressCaller, expressCsrf, toHeaders } from '@gentleduck/auth/server/express'\nimport { errorToHttp } from '@gentleduck/auth/server/generic'\n\napp.use('/auth', expressCsrf(auth))\n\napp.post('/auth/signin', async (req, res) => {\n const { providerId, input } = req.body ?? {}\n if (typeof providerId !== 'string') throw new AuthError('AUTH_INVALID_PARAMETERS')\n const headers = toHeaders(req.headers)\n const { intents } = await auth.flows.signIn({\n input,\n providerId,\n ...expressCaller(req),\n previousSid: auth.transport.extract({ headers }) ?? undefined,\n })\n applyIntents(intents, res)\n})\n\napp.post('/auth/signout', async (req, res) => {\n const sid = auth.transport.extract({ headers: toHeaders(req.headers) })\n applyIntents(sid ? (await auth.flows.signOut(sid)).intents : auth.transport.revoke(), res)\n})\n\n// A refusal throws an AuthError; `errorToHttp` maps it to the status and body\napp.use((err, _req, res, _next) => {\n const { status, body } = errorToHttp(err)\n res.status(status).json(body)\n})\n```\n\n| Framework | Import | Glue |\n|---|---|---|\n| Express | `@gentleduck/auth/server/express` | `expressCsrf`, `expressCaller`, `applyIntents`, `expressActorContext` |\n| Hono | `@gentleduck/auth/server/hono` | `honoCsrf`, `honoCaller`, `honoActorContext` |\n| Fastify | `@gentleduck/auth/server/fastify` | `fastifyCsrf`, `fastifyCaller`, `fastifyWithActor` |\n| Koa | `@gentleduck/auth/server/koa` | `koaCsrf`, `koaCaller`, `koaApplyIntents`, `koaActorContext` |\n| NestJS | `@gentleduck/auth/server/nestjs` | `makeCsrfGuard`, `makeGuard`, `nestCaller`, `NestExceptionFilter`, `CurrentSession` |\n| Elysia | `@gentleduck/auth/server/elysia` | `elysiaCsrf`, `elysiaCaller`, `elysiaWithActor` |\n| Next.js | `@gentleduck/auth/server/next` | `withNextCsrf`, `nextCaller`, `nextWithActor` |\n| gRPC | `@gentleduck/auth/server/grpc` | `withGrpc` |\n| Web Fetch | `@gentleduck/auth/server/generic` | `executeIntents`, `jsonResponse`, `errorResponse`, `errorToHttp`, `readBodyJson` |\n\nWhat your routes now own:\n\n- **CSRF** on sign-in, sign-out, provider begin and every other mutation.\n- **The OAuth callback stays unguarded.** Apple posts it cross-site by design and the signed state is the\n proof. Read the query on a GET, the urlencoded body on a POST, and pass `cookieHeader` and `previousSid`.\n- **`csrfHash` out of any session you answer with.** It is server-side state; the browser holds the plaintext.\n- **A step-up before destroying a factor.** Check `auth.flows.checkStepUp(session, { aal: 2 })` before\n removing TOTP or regenerating backup codes, and rate-limit TOTP verification on `stepup:${identityId}`.\n- **The session's tenant** passed to `auth.mfa.*`, which reads unscoped without one.\n\n`examples/duck-auth` has the full route set for all eight frameworks.\n\n## Delivery\n\nEvery outbound token - magic link, email verification, password reset, account deletion and its undo\nlink - goes to one `deliver` callback on the engine config. The library signs the URL and hands over the\nrecipient's identity, the template vars and the tenant; the host picks the transport and writes the\ntemplate. Every message's `vars` has the signed `url` and its lifetime `ttlMin`; switching on `kind` narrows\nthem further (`requiresMfa` on a password reset, `restorableUntil` on the undo link). Throw from it to report a failure: the flow answers the caller the same either way and reports\nthe refusal as a `signin.failed` event, never the thrown text.\n\n```typescript\nconst auth = createAuth({\n baseUrl: 'https://app.example.com',\n deliver: async ({ identity, kind, vars }) => {\n if (kind === 'magic-link') return mailer.send(identity.profile.email, signInTemplate(vars.url))\n await mailer.send(identity.profile.email, genericTemplate(kind, vars))\n },\n // ...\n})\n```\n\n## Captcha verifiers\n\n```typescript\nimport {\n authTurnstileVerifier,\n authHCaptchaVerifier,\n authRecaptchaV3Verifier,\n} from '@gentleduck/auth/core'\n```\n\n## Tooling\n\n| Path | What |\n|---|---|\n| `@gentleduck/auth/oidc` | OIDC discovery-doc + JWKS helper |\n| `@gentleduck/auth/oidc/op` | Full OAuth2/OIDC OP: `/authorize` (code + S256 PKCE), `/token` (auth_code + refresh, family-rotated), `/userinfo`, `/introspect`, `/revoke`, `/register` (RFC 7591 Dynamic Client Registration) |\n| `@gentleduck/auth/oidc/op/drizzle/pg` | Postgres Drizzle stores for the OIDC OP (5 tables, GC helper) |\n| `@gentleduck/auth/oidc/op/drizzle/sqlite` | SQLite Drizzle stores for the OIDC OP |\n| `@gentleduck/auth/oidc/op/drizzle/mysql` | MySQL Drizzle stores for the OIDC OP |\n\n## Production primitives\n\n- **`AuthEngine.strict({ env: 'production' })`** - boot-time validation: rejects `secure: false` cookie transport, `NoopLimiter`, memory stores, missing `lockout` listener, non-HTTPS `baseUrl`\n- **`JwtTransport.rotateSignKey()` + `retireVerifyKey(kid)`** - zero-downtime JWKS rotation with overlap window\n- **`applyCompliancePreset(cfg, 'gdpr' | 'hipaa' | 'soc2' | 'fips')`** - a free function over the config, not an engine method: it ratchets the three session TTLs down to the named floor. The password, MFA and api-key floors are provider-level - pass the same preset to `passwords({ compliance })` and its siblings - and `strict()` enforces the rest, including data-at-rest\n- **`WebhookDeliverer`** - HMAC body + timestamp + freshness tolerance, exponential backoff, dead-letter sink, SSRF guard on endpoint URLs, `redirect: 'error'` on dispatch\n- **`auth.hijack` + `auth.anomaly`** - drift detection, decision ladder (allow / step-up / deny), pluggable signals\n- **`redisIdempotency` / `valkeyIdempotency`** - per-(identity, key) tombstone + poll for the host's replay-safe mutating routes; the host holds it, the engine does not\n- **DPoP** (RFC 9449) - proof-of-possession on bearer tokens with `ath` binding and server nonce\n- **Tenant boundary**: every adapter respects `ctx.tenantId`; M2M + api-key providers refuse cross-tenant identification\n\n## Security posture\n\n`AuthEngine.strict()` runs every production-grade gate before boot.\n\nSee [`SECURITY.md`](./SECURITY.md) for the STRIDE / OWASP ASVS mapping of every threat the library mitigates and every threat the host app must own.\n\n## Module sizes (gzipped)\n\n| Module | Size |\n|--------|------|\n| Core `AuthEngine` (typical import) | ~22 KB |\n| Each transport | 2 - 6 KB |\n| Each provider | 1.5 - 8 KB |\n| Each adapter | 2 - 9 KB |\n| Each server middleware | 2 - 4 KB |\n\nReal deployments importing only what they wire end up at 25 - 60 KB total. The \"import everything\" worst case (`import * from '@gentleduck/auth'`) is not the intended usage.\n\n## Docs\n\n- Site: [gentleduck.org/duck-auth](https://gentleduck.org/duck-auth)\n- Reference app: [`apps/duck-auth-demo`](https://github.com/gentleeduck/duck-iam/tree/main/apps/duck-auth-demo) - every flow exercised end-to-end\n- Sibling repos: [`@gentleduck/iam`](https://www.npmjs.com/package/@gentleduck/iam), [`@gentleduck/ui`](https://github.com/gentleeduck/duck-ui), [`@gentleduck/upload`](https://github.com/gentleeduck/duck-upload), [`@gentleduck/md`](https://github.com/gentleeduck/duck-md)\n\n## Contributing\n\nPR checklist + style notes in the repo's [`CONTRIBUTING.md`](https://github.com/gentleeduck/duck-iam/blob/main/CONTRIBUTING.md).\nSecurity disclosures: [`SECURITY.md`](./SECURITY.md).\n\n## License\n\nMIT. See [`LICENSE`](./LICENSE).\n","readmeFilename":"README.md"}
![\"@gentleduck/auth\"](\"./public/logo-dark.svg\"){kind=logo}
\n![\"npm\"/](\"https://img.shields.io/npm/v/@gentleduck/auth.svg\")
\n ![\"downloads\"/](\"https://img.shields.io/npm/dm/@gentleduck/auth.svg\")
\n ![\"MIT\"/](\"https://img.shields.io/npm/l/@gentleduck/auth.svg\")
\n