config |
KEY=VALUE file + XVII_<SERVICE>_<KEY> env overrides, typed fields, validation |
server |
HTTP server: graceful shutdown, request ids, slog access log, recover, timeouts, /healthz |
httpx |
JSON responses, the error shape, pagination, request decoding with limits |
auth |
OIDC client for panels (login, callback, session cookie), JWT verification through JWKS, API token introspection with cache, same-origin check for cookie requests, principal with roles |
rbac |
role checks on the hierarchy (ADR 0005): Can(principal, action, resource) helpers |
db |
pgx pool, embedded migrations applied on start, transactions helper |
dbtest |
throwaway PostgreSQL databases for tests |
audit |
audit events written in the caller's transaction |
events |
outbox in the caller's transaction (Emit), Sender to notify's /api/v1/events with back-off; dropped after 3 days without notify |
ttl |
12h, 3d, 2w, never (from pages) |
archive |
safe tar.gz / tar / zip extraction with limits (from pages) |
mcp |
MCP (2025-06-18) over HTTP at /mcp and over stdio: tools with JSON Schemas, a client for bridges |
limits |
ADR 0013 for services: declare limits, read effective values from id, check, report usage |
release |
release index, checksums and signature verification (CLI self-update and xvii-node) |
cli |
the command framework from pages' CLI: registry, help, examples, completions (bash, zsh, fish), typo suggestions, colored output, progress, QR codes, contexts and token storage, device-flow login |
client |
base API client: auth, retries, error decoding, used by every service's client/ |
ids |
random ids, prefixed ids, DNS label validation, reserved names |