Shared core package
Reuse only pays off if there is one copy of each part. Otherwise "reused" means copied into the next project and left to drift apart, and a fix made in one build never reaches the others.
Under the hood
So the reusable parts live in @gravixar-sv/core, a private versioned package: a repo consumes a module by depending on a version, and a check flags any repo still on an old one. The registry behind this page catalogues 24 modules, 18 at production status, and 11 shared through the package.
Auth is the clearest case. TOTP, WebAuthn passkeys, single-use recovery codes and step-up verification are one parity-tested engine, not a security-critical flow copied per repo. The consuming app injects its issuer and its routes, and its call sites don't change when the engine does.
The honest half is what stays out. Where two apps genuinely disagree on a contract the module stays local, because false uniformity costs more than drift does. Of the 13 counted as reused on the homepage, 9 are shared through the package and 4 are extraction verdicts, modules judged worth pulling out but not pulled out yet. Nothing here is sold or installed by a client. What a client gets is a build that starts further along, and a fix that lands in one place with a version on it.