Open source

My projects share a family of packages I've extracted from them, so a fix to auth, deploys, or backups lands once instead of drifting between repos. All of it is public on GitHub.

Auth & access

Who a request is, and what it is allowed to do.

auth-kit

Authentication primitives shared across custom-JWT backends: password hashing, single-use opaque tokens, refresh-token session rotation, and provider-neutral OAuth identity binding.

TypeScript
Updated Sep 2026

Used in bewks

authz-kit

Pure authorization primitives: fail-closed role ladders, typed action policy with authorize(), two-tier scope inheritance, allowlist admin bootstrap. ORM- and framework-agnostic.

TypeScript
Updated Sep 2026

Used in bewks

api-access-kit

Pure, transport-neutral opaque API credential and scope primitives.

TypeScript
Updated Aug 2026

Security

Server-side hardening for requests going out and coming in.

express-security-kit

Dependency-light Express security library (helmet, rate-limit, api-key auth, HMAC signing, audit) — machinery in, policy injected

TypeScript
Updated Aug 2026

SSRF guard for server-side fetches of user-supplied URLs: blocks non-http(s)/credentialed/disallowed-port URLs, localhost + internal-suffix hosts, and IP literals or DNS resolutions in private/reserved ranges (IPv4 + rigorous IPv6).

TypeScript
Updated Aug 2026

webhook-kit

Framework-agnostic outbound webhook delivery with signed delivery IDs, replay-store verification, fire-time SSRF re-check, per-attempt timeout, and redirect: manual.

TypeScript
Updated Aug 2026

Ops & delivery

Getting code and data onto a box and keeping it there.

deploy-kit

Hook-driven SSH/local deploy pipeline + remote PM2 ops CLI + Cloudflare tunnel launcher

TypeScript
Updated Sep 2026

Used in bewks

db-backup

Reusable database backup manager (SQLite raw/gzip + Postgres pg_dump) with age-tier retention

TypeScript
Updated Aug 2026

release-kit

Reusable release/patch-note toolkit (versioning, fragments, one-command cut, hygiene). Zero deps.

TypeScript
Updated Aug 2026

alert-kit

Transport-pluggable alert primitive with a built-in Discord webhook transport: rich embeds, per-severity routing, bounded timeout, 429 retry, graceful-degradation send.

TypeScript
Updated Sep 2026

lane-broker

Machine-wide test-lane coordination for concurrent agents: serialize conflicting lanes, cap heavy runs, gate on load

JavaScript
Updated Sep 2026

App primitives

Small pieces of application plumbing reused across apps.

admin-kit

Router-neutral, capability-driven React admin UI primitives for user management, feature flags, API keys, and custom administration sections.

TypeScript
Updated Sep 2026

Used in bewks

feature-flags-kit

Pluggable feature-flag primitive: code-defined registry with defaults, store->env->default precedence, fail-open with health, atomic seed-without-clobber, immutable snapshots. Sync + async stores.

TypeScript
Updated Aug 2026

fetch-client-kit

Framework-agnostic browser fetch client: single-flight 401-refresh-retry with pluggable auth (cookie/bearer/csrf).

TypeScript
Updated Aug 2026

mailer-kit

The single outbound-mail transport primitive: nodemailer over SMTP configured from env, with html + attachments, injectable logging, graceful-degradation send, and a test seam. Content/templates stay app-specific.

TypeScript
Updated Aug 2026

Used in bewks

prisma-tools

Reusable Prisma environment, schema, and command wrapper utilities

TypeScript
Updated Aug 2026

Tooling

Development tooling shared across repos.

eslint-config

Composable ESLint flat-config presets shared across personal projects: TypeScript, React, Node, and test rule sets, plus architecture-boundary helpers.

JavaScript
Updated Sep 2026