env


Panel and API	`https://env.xvii.network` (`/api/v1`)
Delivery	`GET /api/v1/resolve?project=&environment=`
CLI	`xvii env ls \| set \| unset \| run \| pull \| export`
MCP	names and metadata, never values

What it does

Sets: one per project environment, plus team-wide shared sets.
Kinds: var, file (delivered at a path, mode 600), ssh (an Ed25519 pair made here).
References: ${{ shared.NAME }}, ${{ project:<slug>.<env>.NAME }}, resolved at read time.
Encryption: an XChaCha20-Poly1305 data key per set, sealed with the instance's master key.
Versions of the whole set; any version restores.
Access by role; reveals and resolves are logged with the names read.
CI reads with its own OIDC token through a trust rule.

Limits env.sets, env.vars. Event env.changed (names only).