CPANscan

Termbox::PP is a compact, pure-Perl implementation of the Termbox terminal UI library that makes it easy to build text-mode interfaces without XS or external C libraries. It gives you a simple, cell-based back buffer for drawing text and attributes, functions to initialize and restore the terminal, helpers to print formatted UTF-8 text, and event objects for keyboard, mouse and resize handling so you can write a single-threaded render loop that responds to user input. The module aims to mirror the termbox2 API while staying small and portable, works out of the box on Unix with core Perl and can be used on Windows with the usual console support libraries, and it exposes utility routines for Unicode handling, color modes and low-level raw output when needed. The project is still evolving so expect occasional API tweaks, and recent updates have restored Windows Virtual Terminal support, improved Unicode width handling and performance, and fixed a few export and initialization edge cases.

TOML::XS is a fast, XS-backed TOML parser for Perl that embeds the tomlc17 C library so you do not need to install any external C dependency. It takes a raw byte string containing a TOML document and returns a Document object that can be converted into Perl structures or queried for individual values with get, with strings returned as decoded character strings, booleans represented by library constants, and timestamps exposed as Timestamp objects. The module is parser-only and does not provide serialization back to TOML. Recent updates switched the embedded engine to tomlc17 to address CVE-2026-16634, fixed several memory leaks, renamed the primary accessors to get and added microsecond-level timestamp accessors, all while preserving dramatically higher throughput compared with pure-Perl TOML libraries.

CGI::Info is a Perl helper for CGI scripts that collects and exposes runtime details so you do not need to hard-code script paths, host names, document root, temporary directories, or protocol information. It parses input parameters from real CGI requests or from the command line or stdin for local testing, supports file uploads with configurable size limits, and lets you declare an allow-list of permitted parameters using regexes, validation rules, or callbacks for contextual checks. The module includes convenience methods for cookies, a simple web-application-firewall style filtering to reduce common injection and traversal attacks, and client classification helpers such as is_mobile, is_tablet, is_robot, is_search_engine, is_ai and browser_type so you can tailor responses to phones, bots or known AI crawlers. CGI::Info is configurable at runtime from files or environment variables, accepts custom loggers and optional caching for IP lookups, and is intended as an extra layer of safety and convenience rather than a full security solution. Note that tablet detection is currently limited and params() returns a hash reference that callers should copy before mutating.

nup is a command line utility that displays files or the output of commands in an n-up, multi-column paged layout so you can read multiple pages or files side by side. It auto-detects whether an argument is a file or an executable and you can force command mode with -e. You control the grid, number of columns and rows, page height and pane width and pick border, line and color styles or one of several board color schemes. nup can run commands, define aliases, show filename headers, switch between paged and non-paged modes, enable parallel columns for side‑by‑side viewing, and use App::optex::textconv to convert common binary formats like PDF and Office files into text before display. It is handy as a MANPAGER or for comparing multiple outputs in one terminal. Note that stdout and stderr are merged into the paged output and the executed command’s exit status is not preserved.

Sys::OsRelease::Lite is a lightweight Perl helper that reads the standard /etc/os-release file and exposes the operating system and distribution metadata to your scripts in a simple, consistent way. It provides a singleton interface with ready-made accessors for common fields like id, id_like, version_id and pretty_name, plus generic methods to list, check and fetch any discovered attributes, and a platform helper that maps common ID_LIKE values to familiar platform names. The module keeps dependencies minimal so it is suitable for use in system scripts, installers and containers and it will fall back to Perl's native osname if no os-release file is found. Recent changes added a Sys::OsRelease::Lite packaging variant to maintain compatibility with older Perls before 5.22 and adjusted the Lite delivery for CPAN, making the same functionality available on legacy systems.

Sys::OsRelease is a lightweight Perl helper for reading the standard /etc/os-release file used by Linux and BSD to identify the operating system and distribution. It provides a singleton-based interface with convenient read-only accessors like id(), id_like(), name() and many more, plus generic methods such as get(), has_attr(), found_attrs() and platform() to return a normalized platform name. The module keeps minimal dependencies and supports both class-style and object-style usage so scripts can easily detect OS type for configuration, packaging or installation logic. It requires Perl 5.22 or newer and a repackaged Sys::OsRelease::Lite exists for older Perl versions.

Data::HierTimingWheel::Shared implements a shared-memory, multi-level timing wheel for Perl that lets multiple processes schedule and cancel timers in constant time no matter how far in the future they fire. It follows the Varghese-Lauck design used by the Linux kernel and systems like Kafka so far-future timers are parked in coarse levels and only redistributed as their firing time approaches, making scheduling and cancellation O(1) while using a fixed, predictable amount of memory. Timers carry an arbitrary 64-bit integer payload and are returned in fire order when a process advances the shared tick counter, and the wheel can be backed by a file, an anonymous mapping inherited across fork, or a memfd for cross-process sharing. The module is Linux-only and requires 64-bit Perl, enforces a fixed capacity and maximum delay based on the wheel geometry, and uses a futex-based writer-preferring lock with dead-process recovery; the author notes two narrow caveats, PID reuse is not detected and more than 1024 concurrent reader processes can create a rare edge condition that may block writers.

Data::Heap::Shared provides a lightweight, high-performance binary min-heap that lives in shared memory on Linux so multiple processes can push and pop integer (priority, value) pairs as a cross-process priority queue. You can create a fixed-capacity heap backed by a file, an anonymous MAP_SHARED mapping inherited by forked children, or a memfd-backed mapping whose file descriptor can be handed to another process for attachment. The API is simple: push, pop, peek, blocking pop with futex-based waits, and optional eventfd notifications for integration with event loops, plus methods to inspect stats, sync to disk, and remove the backing file. It uses mutexes with PID-based stale-lock recovery to handle crashed holders, but the author warns that crash recovery can leave the heap partially sifted so critical users should clear and rebuild after a recovery. This module is Linux-only and requires 64-bit Perl, making it a good choice when you need a compact, concurrent priority queue shared between processes.

Data::HashMap::Shared provides extremely fast, type-specialized hash maps that live in file-backed or memfd-backed shared memory so multiple Perl processes can read and write the same table with minimal overhead. It offers lock-free read paths, futex-based writer locks, atomic integer counters, compare-and-swap, optional LRU eviction and per-key TTLs, and an arena for storing strings, so it doubles as a high-performance cross-process cache and counter store. Multiple variants cover integer-to-integer and string-to-string use cases and you can shard a map across files for parallel writes and higher total capacity. The module is Linux-only and requires 64-bit Perl, integer variants silently wrap to their fixed bit widths so pick an appropriate variant, and PID-based crash recovery assumes a shared PID namespace (so cross-container sharing is not supported). Backing files are created owner-only by default for security and a recent release changed the on-disk format, so existing files must be migrated with the bundled hashmap-shared-upgrade tool or the upgrade_file API when upgrading to the latest version.

Data::Graph::Shared provides a fast, Linux-only shared-memory directed weighted graph you can attach to from multiple processes to read and mutate a single in-memory graph. It supports file-backed, memfd and anonymous mappings and exposes simple operations to add and remove nodes and edges, read node data and neighbors, and query counts and degrees, with optional eventfd integration to signal updates to an event loop. Mutations are serialized by a process-shared futex mutex and the module includes crash-recovery logic that can reclaim the lock if a writer dies, but a process that crashes mid-write may leave partially applied changes so callers should treat writers as trusted. The design favors O(1) node removal of outgoing edges only to stay fast; use remove_node_full when you need incoming edges spliced out as well. It requires 64-bit Perl and is optimized for throughput, with benchmarks showing millions of simple ops per second, and recent releases tightened security by making backing files 0600 by default and fixed a use-after-free bug in add_edge along with other robustness improvements.

Data::Fenwick::Shared implements a Linux-only, shared-memory Fenwick tree (binary indexed tree) that stores a fixed number of signed 64-bit integers and lets multiple processes perform O(log n) point updates and prefix-sum queries concurrently. It is designed for cumulative frequency tables, running ranks, weighted random sampling and similar tasks, and offers a find operation to locate the smallest index whose prefix reaches a target so you can do weighted draws or order-statistic lookups. The module supports an optional range-update mode that uses the two-BIT trick to apply an O(log n) add to every element in an interval at the cost of doubling memory and sacrificing find and merge. Mappings can be anonymous and inherited across fork, backed by a file for cross-process sharing, or created as a memfd and passed to other processes, and mutation is guarded by a futex-based write-preferring rwlock with dead-process recovery so readers and writers can coexist safely in normal use. Values are native signed 64-bit integers and wrap on overflow, the implementation requires 64-bit Perl, and the on-disk format changed in 0.02 so older files from 0.01 are incompatible. The interface also provides atomic set, clear, element-wise merge for point-mode trees, and sync/unlink helpers, and although the lock recovers from crashed owners there is a very unlikely corner case if more than 1024 concurrent reader processes crash while holding the read lock.

Data::DisjointSet::Shared provides a fast, Linux-only union-find (disjoint-set) data structure that lives in shared memory so multiple processes can collaboratively maintain a partition of a fixed universe of integer elements. You create it over a backing file, an inheritable anonymous mapping, or a transfer-capable memfd and then use familiar operations like union, find, connected, set_size, num_sets and capacity, plus a union_many batch operation for atomic multi-pair merges. The implementation uses path compression and union by size for near-constant amortized performance and stores a compact 8*N byte payload, while a futex-based write-preferring rwlock with dead-process recovery serializes mutations so concurrent processes get a consistent final partition. Be aware that find and connected perform path compression and therefore acquire the write lock, so they are not read-only, and that the library requires 64-bit Perl and runs only on Linux. Backing files default to owner-only mode 0600 but you can request different permissions when creating the file, and the module offers crash safety up to the last completed union with two documented limitations to keep in mind, PID reuse not being detected and a 1024-entry reader-slot table that can make writer recovery unlikely but rarely problematic in practice. This module is a good fit when you need a simple, efficient shared-memory disjoint-set for cross-process algorithms such as parallel connectivity, clustering, or union-find based bookkeeping.

Concierge is an extensible service-layer orchestrator that centralizes authentication, session management, and user records behind a single, consistent API so applications can manage identity and related operational resources without wiring components together themselves. It ships with an Argon2-based Auth component, pluggable Sessions storage and Users stores, and high-level lifecycle calls for visitors, guests and logged-in users while still exposing raw component objects when you need lower-level access. Configuration for an application lives in a "desk" directory created by the setup helper and open_desk either returns a fully initialized Concierge or a structured failure, and nearly every runtime method returns a consistent { success => 0|1, message => ... } result so your app never dies unexpectedly. Extra components may be added or substituted by following the documented contract and selected component methods can be promoted onto the concierge object for convenience. Important recent change in v0.11.0: Sessions and Users now follow the same backend_class resolution convention as Auth and their backend selection is required, so desks built before this release will not open and must be rebuilt with the original configuration.

Concierge::Users is a user data management component that implements a two-phase workflow where a one-time setup selects a storage backend, defines the field schema and writes config files, and a runtime mode loads that config and exposes CRUD operations for users. It supports multiple backends including SQLite, a CSV/TSV flat file and per-user YAML so you can choose a storage model that fits your scale and operational needs. Field structure is configured at setup time with required core fields, optional standard fields, protected system timestamps and application-specific fields, and data is validated on create and update using a variety of validator types such as email, phone, date, enum and moniker. List operations include a compact filter DSL for targeted queries and running setup against existing data automatically archives the previous store to avoid accidental loss. All public methods return hashrefs with a success flag and message, and the module can be used standalone or alongside other Concierge components like Concierge::Auth and Concierge::Sessions.

Concierge::Sessions is a modern Perl session manager that uses a factory pattern to create and manage session objects with pluggable storage backends, letting your app store any JSON-serializable data and perform common lifecycle actions like create, retrieve, delete, and periodic cleanup. It enforces one active session per user, supports sliding window expiration that is extended when a session is saved, and can create indefinite application-wide sessions when needed. Backends are selected by passing a fully qualified class name at construction, with a SQLite backend recommended for production and a simple JSON file backend available for testing and small deployments. All operations follow a service-layer style and return consistent hashrefs with success flags and descriptive messages or session objects, and the module targets modern Perl environments.

Concierge::Auth is a tiny factory that converts a fully qualified backend class name into a ready-to-use authentication backend instance. You call new with backend_class => 'Concierge::Auth::Pwd' and any backend-specific arguments and it requires the module and returns the backend object directly rather than wrapping or delegating. The returned object already implements the Concierge::Auth::Base API so you can call authenticate, enroll, is_id_known, change_credentials and revoke immediately. Concierge::Auth makes no guesses about short names or defaults so callers must supply a resolved class name and any required backend settings. It will croak if backend_class is missing or if the backend module fails to load or construct, and it is useful when you need a simple, dependency-free way to instantiate auth backends or when backend resolution is handled elsewhere such as by Concierge::Desk::Setup.

OpenSearch::Client::Hash is a compact helper for generating password hashes that are directly compatible with the OpenSearch security plugin, offering BCrypt, Argon2 and PBKDF2 output formats. It exposes simple methods to derive a hash from a plaintext password and lets you adjust parameters so the output matches your OpenSearch configuration, for example bcrypt minor/version and rounds, Argon2 type, memory, iterations and key length, and PBKDF2 function, length and iterations. Use it when you need to create hashed passwords to store in OpenSearch user records instead of keeping plaintext credentials. Be aware that generated hashes must match your cluster's security settings to be accepted, for example bcrypt passwords are limited to 72 characters and cannot include null bytes, and Argon2 or PBKDF2 hashes require the corresponding algorithm and version settings. This initial release adds support for all three hashing schemes.

Map::Tube::Plugin::FuzzyFind is a small add-on for Map::Tube that makes it easy to locate tube stations or lines even when the user types partial, misspelled, or phonetically similar names. It installs as a Moo role into Map::Tube::* classes and exposes a fuzzy_find method that accepts a search pattern and options to target lines or stations, pick matching strategies and limit results. Multiple matching algorithms are supported, from simple exact, starts-with and substring tests to regexes, phonetic encodings (Soundex, Metaphone, Koeln, Daitch‑Motokoff), trigram comparisons and edit distances like Levenshtein and Jaro‑Winkler, and results are returned as Map::Tube Line or Node objects ordered by similarity when applicable. You can control how loose the match should be, cap the number of results, and use scalar or list context to get one or many matches. If you build search features or user interfaces around Map::Tube and need tolerant, user-friendly name lookup, this module is a direct, drop-in solution. A recent update added a list_fuzzy_matchers method to show available algorithms and made minor documentation improvements.

EV::ClickHouse is an asynchronous ClickHouse client for Perl that plugs into the EV event loop and implements both the HTTP and native TCP protocols in XS so you do not need an external ClickHouse client library. It gives you TLS, gzip and LZ4 compression, parameterized queries, external in-memory tables, streaming result blocks and safe inserts including nested types on the native wire, plus convenience helpers for idempotent, async and batched inserts and an insert_streamer optimized for ETL. The client offers URI-based connections, auto-reconnect with exponential backoff, multi-host failover, keepalive pings, per-query and connection-level settings, progress and query-complete hooks, and a built-in connection pool with hedged and fan-out query modes for lower tail latency. It decodes a wide range of ClickHouse types with opt-in decoding for DateTime, Decimal and Enum and supports named-row mode, a synchronous-feeling iterate pull over streaming results, health probes, schema introspection and mutation waiting helpers. Requires Perl 5.14+, EV and zlib, with optional OpenSSL and liblz4, and notes that DNS resolution is blocking unless EV::cares is installed, making this a strong choice for high-throughput, evented ClickHouse access from Perl for ingestion, exports, dashboards and ETL.

File::ContentStore provides a content-addressable file store that saves space by turning files with identical contents into hard links named by their content digest, making it easy to deduplicate large collections such as photos or backups. You create a store pointing at an existing directory and then call link_file or link_dir to have files hashed and hard linked into the store; duplicates are made to share the same inode so disk usage is reduced and changes to one aliased file affect all aliases. The module uses a configurable digest algorithm, splits digest names into subdirectories for scalability, and defaults to checking for collisions and making content files read only to avoid accidental modification. It only links files on the same filesystem and offers a file_callback hook for progress reporting and an fsck method to find empty dirs, orphaned content, corrupted files and symlinks. If you only need a one-time dedupe you can remove the store after linking, or keep it for incremental deduplication over time.

GraphQL::Houtou is an XS-backed GraphQL parser and high-performance execution toolkit for Perl that gives you a canonical Perl AST and a native VM for running compiled query programs. It is designed for real web apps and makes batching simple with a bundled DataLoader and an on_stall hook that collapses N+1 database lookups while still returning a synchronous response to callers. You can render responses directly as UTF-8 JSON bytes inside the XS lane to avoid building Perl data structures, expose a one-line PSGI endpoint with optional GraphiQL, and create persisted artifacts for maximum throughput either as fixed native bundles or as compiled programs for variable-bearing queries. Runtimes can be built for async promise-based resolvers or for a strict synchronous fast lane and include configurable cost limits and program caching for production safety. The module focuses on throughput and efficiency and reports large benchmark gains over pure Perl implementations. Current limitations in the 0.01 profile include no subscription execution or streaming transports, only POST for the PSGI adapter, recognition of only Promise::XS promises, fixed native bundles not supporting GraphQL variables, and no support for Perl ithreads, so use process-based concurrency for parallelism.

Tstregex is a compact Perl module and command-line utility for debugging regular expressions by finding the longest partial match and pinpointing the exact token and character where a pattern stops matching. It pre-parses common regex delimiters and modifiers, then uses a "nibbling" strategy to decompose your pattern and iteratively test sub-patterns so it can display the matching portion, the failing token, and a visual marker aligned with the regex. The CLI offers a diagnostic mode that highlights the rejected substring and reports execution time to help spot pathological backtracking or ReDoS issues, while the library API (tstregex_init_desc, tstregex, and accessors for match length and fail token) makes it easy to integrate into scripts or test harnesses. The module is cross-platform and was cleaned up for production use; recent updates removed an internal debug helper in favor of a separate Devel::perlXdb extension. Licensed under Artistic 2, Tstregex is useful for developers who want a lightweight, automated way to understand why a Perl regex fails without stepping through the engine by hand.

EV::Nats is an asynchronous, high-performance NATS client for Perl that hooks into the EV event loop and implements the protocol in XS with no external C library dependency. It provides the full NATS feature set including publish and headered publish, subscribe with wildcards and queue groups, request/reply with automatic inboxes, automatic reconnect with state restoration, TCP and Unix sockets, optional TLS and NKey/JWT auth when built with OpenSSL, and helpers for batching, graceful drain, and per-connection stats. The implementation focuses on throughput and low overhead with write coalescing and allocation-free publish paths, and higher-level integrations are available for JetStream, Key-Value and ObjectStore. Note the module uses blocking DNS resolution via getaddrinfo for name lookups and you must not let the EV::Nats object be destroyed while a callback is still running. If you want a fast, event-driven NATS client in Perl for high-throughput or low-latency messaging, EV::Nats is a strong choice.

Data::Deque::Shared provides a high-performance, lock-free double-ended queue implemented in shared memory for Linux and designed for multi-producer, multi-consumer workloads. It comes in two concrete flavors: an Int variant for 64-bit integers and a Str variant that stores fixed-size byte/UTF-8 slots, and supports anonymous, file-backed or memfd-backed mappings so different processes can attach to the same queue. Operations include non-blocking push/pop at both ends plus blocking variants with timeouts, and the implementation uses futexes and atomic CAS updates to avoid heavyweight locks while still offering safe concurrency and real-world robustness. The module exposes size and capacity, per-queue statistics, eventfd notification, and a concurrency-safe drain method that can recover slots left by crashed producers; recent fixes addressed hangs when peers are killed and further hardened recovery behavior. It requires 64-bit Perl and capacities are limited to 2^31 slots or less, with string slots using a fixed maximum length so you should choose sizes carefully. Backing files are created with secure permissions by default and constructors croak on failure so misuse is unlikely to silently corrupt data.

Data::DDSketch::Shared is a shared-memory implementation of DDSketch that compactly records a stream of numeric observations and gives any quantile estimate to within a configurable relative error (default 1%). It is aimed at long-tailed, wide-dynamic-range metrics such as request latencies where relative accuracy matters across the entire range. The sketch places values into logarithmic buckets so percentiles are guaranteed to be within alpha of the true value while using a fixed amount of memory. It supports negative values and exact zeros, tracks exact count, min and max, and keeps a running sum and mean. Multiple processes can feed and read a single sketch via a backing file, an anonymous mapping inherited across fork, or a memfd, and two sketches with the same parameters can be merged. You control accuracy and memory via alpha and num_buckets (defaults 0.01 and 2048) and can add single values or batches, query quantiles, median, mean, count and stats, and manage the backing store. The implementation uses a futex-based write-preferring rwlock with dead-process recovery for crash safety but has known caveats described by the author: a crash can leave scalar aggregates ahead of bucket updates so quantile(1.0) may temporarily return undef until the next update, and extreme concurrent reader counts above 1024 can prevent writer recovery in rare crash scenarios. Linux-only and requires 64-bit Perl. Initial release 0.01 (2026-07-22).

Data::CountingBloomFilter::Shared provides a Linux-only, 64-bit-Perl shared-memory counting Bloom filter so multiple processes can efficiently track approximate set membership, delete entries, and read an occurrence estimate without storing the items themselves. It uses 4-bit counters instead of bits so you can add, remove, and call count_of to get a 0..15 estimate, with counters saturating at 15 which caps counts and can prevent full removal of heavily added items. Membership queries are one-sided so items you have added will never be missed but false positives are possible at a tunable rate, and the module derives optimal hash and table sizes from your requested capacity and false-positive target. The table can be an anonymous mapping inherited across fork, a file-backed mapping for cross-process sharing, or a memfd passed between processes, and mutations are protected by a futex-based write-preferring lock with dead-process recovery. The API is simple: constructors (including new_memfd and new_from_fd), add, add_many, contains, count_of, remove, merge, clear, and various introspection and lifecycle helpers. Note that items are treated as bytes so wide characters must be encoded first and that removing items you did not add can cause false negatives for others due to shared counters. The initial release also fixes a use-after-free bug in merge when passed tied or magic arguments.

Data::CountMinSketch::Shared provides a compact, fixed-size Count-Min sketch that multiple Linux processes can share via a backing file, memfd, or an inherited anonymous mapping so you can track approximate frequencies across producers and consumers without storing keys. You add items or batches and query estimated counts that never fall below the true count and exceed it by at most epsilon times the grand total with probability at most delta, which makes it useful for finding heavy hitters or approximate tallies in streams too large to count exactly. The sketch stores only a small matrix of 64-bit counters driven by XXH3 hashes, supports merging two sketches with identical geometry, and uses a futex-based lock with dead-process recovery to remain robust across crashes. Note that it is Linux-only and requires 64-bit Perl, you must pass byte strings (wide characters croak), and individual counters wrap at 2^64 on add while merge saturates at the max value. Recent releases tightened on-disk security by defaulting newly created backing files to mode 0600 and moved to a new on-disk format that refuses older files, and a merge-related bug was fixed.

Data::Buffer::Shared provides fast, file-backed shared-memory buffers on Linux for 64-bit Perl, letting multiple processes efficiently share typed arrays of integers, floats or fixed-length strings with a fixed capacity and predictable memory layout. It offers lock-free atomic single-element get/set and a full suite of atomic integer operations for counters, seqlock-guarded bulk reads and write-locked bulk writes, a futex-based read/write lock that recovers from crashed holders, optional eventfd-based cross-process notifications, and constructors for file-backed, anonymous and memfd-backed mappings. The module is presized and does not grow, exposes raw pointers and zero-copy scalar views for FFI or high-performance use, and includes explicit locking primitives for batch updates; the documentation also calls out a rare reader-slot exhaustion edge case if you mount more than 1024 concurrent reader processes. Recent releases include robustness and security hardening and an on-disk format change in 0.06 that is incompatible with 0.05 files, so existing mappings must be recreated after upgrading.

Data::BloomFilter::Shared is a Linux-only, 64-bit-Perl module that provides a compact, shared-memory Bloom filter so multiple processes can record and test membership with a tunable false-positive rate (default 1%). It stores only a bit array and supports anonymous mappings inherited across fork, file-backed mappings, and memfd descriptors so unrelated processes can share the same filter; common uses are cross-process deduplication and fast "have I seen this before" checks. The API is simple: add items (including bulk adds), test membership, merge two filters of identical geometry into the union, clear the filter, and read estimates and stats. Writes are coordinated with a futex-based rwlock that includes dead-process recovery and backing files are created owner-only by default for safety. Note that the module croaks on wide-character strings so you must encode non-byte data first. Also be aware that the 0.04 release changed the on-disk format to v2 and will refuse older 0.03 files, so recreate any existing filters when upgrading.

Lemonldap::NG::Portal is the authentication and portal component of the Lemonldap::NG Web‑SSO system that makes it easy to add single sign‑on, authentication, authorization and accounting headers to protect web applications with minimal changes. It runs as a PSGI/Plack application and is built around a modular plugin system that loads authentication, user database and ancillary modules at initialization so you can use LDAP, CAS, remote or custom backends without changing your apps. Incoming requests are routed through a small processing pipeline that handles Ajax responses, redirects and template rendering while exposing a stable request object and read‑only configuration API for plugin authors. Recent improvements added multi and remote auth and userDB drivers, a pluggable password module, a notification subsystem and a double session mechanism to increase flexibility and security.