Shared core package
The reused parts are a private, versioned npm package, not a folder someone copies. One source for the shared modules, auth and 2FA the flagship among them, propagated by a dependency bump rather than a copy.
in production, no sandbox here
This one runs in Broomstick Hub and Gravixar HQ and gravixar.com. It has no sandbox on this site, because the pattern only means anything against a real database, real roles, and real money. Rebuilding that as a toy would demonstrate the toy.
The write-up covers how it works and where it is deployed.