Packages
Authentication, authorization, and composable primitives for modern stacks.
2 itemsView →
The Ecosystem
One modular ecosystem.
Everything composes. Every package is independently usable. Pick what you need, leave the rest.
SDKs
Type-safe client libraries for every service, with first-class TypeScript.
0 itemsView →
Tools
Develop, test, and ship — built for real workflows.
0 itemsView →
2 resources published across the ecosystem
Featured package
AU
package
@gablura/auth-core
@gablura/auth-core is a framework-agnostic authentication and authorization library for Node.js/Express backends.
Dual-token RS256 JWT architecture (access + refresh)Session binding with device fingerprinting and IP validationAtomic token rotation via Redis Lua scriptsTOTP-based two-factor authentication (via otplib)
Why We Build
Serious software deserves better primitives.
Most teams end up rebuilding the same scaffolding: auth, sessions, permissions, integrations. We build the pieces that should already exist — and keep them open, composable, and boring in the best way.
Latest Resources
Shipping real software.
Products, packages, and tools that started as internal utilities and became open.
01package
@gablura/auth-core
Production-ready authentication core for Express.js backends. Dual-token RS256 JWT architecture with session binding, token rotation, 2FA, account lockout, and audit logging.
v1.2.4 · package
02package
@gablura/auth-next
Production-ready Next.js authentication with NextAuth.js. Drop-in auth with credentials, Google OAuth, 2FA, email verification, and password reset.
v1.2.4 · package
Engineering Principles
How we build.
01Small APIs
A missing overload is better than a misleading one. We prefer shallow primitives you can build up over deep abstractions you have to reverse-engineer.
02Composition first
Packages should be independently useful. Imports are cheap, dependencies should earn their place, and nothing should fork your architecture.
03Type safety everywhere
If it compiles in our repo, it ships with types. Internal utilities, generated clients, docs examples — every layer gets the same standard.
04Open by default
Public APIs are public promises. We keep them stable, document them honestly, and do not hide useful behavior behind feature gates.
05Tested and boring
We prefer unglamorous reliability over clever runtime behavior. Failures should be obvious, recovery should be predictable, and surprises should be rare.