kit

Shared Go packages for every service and the CLI. Module go.xvii.network/kit. Stage 1. Extracted from pages where pages already has the code; written fresh where it does not.

Tagged: v0.1.1 has cli, config, release, archive, ttl. The rest is written in stage 2 with id.

Package	What
`config`	`KEY=VALUE` file + `XVII_<SERVICE>_<KEY>` env overrides, typed fields, validation
`server`	HTTP server: graceful shutdown, request ids, `slog` access log, recover, timeouts, `/healthz`
`httpx`	JSON responses, the error shape, pagination, request decoding with limits
`auth`	OIDC client for panels (login, callback, session cookie), JWT verification through JWKS, API token introspection with cache, same-origin check for cookie requests, principal with roles
`rbac`	role checks on the hierarchy (ADR 0005): `Can(principal, action, resource)` helpers
`db`	`pgx` pool, embedded migrations applied on start, transactions helper
`dbtest`	throwaway PostgreSQL databases for tests
`audit`	audit events written in the caller's transaction
`events`	outbox in the caller's transaction (`Emit`), `Sender` to notify's `/api/v1/events` with back-off; dropped after 3 days without notify
`ttl`	`12h`, `3d`, `2w`, `never` (from pages)
`archive`	safe tar.gz / tar / zip extraction with limits (from pages)
`mcp`	MCP (2025-06-18) over HTTP at `/mcp` and over stdio: tools with JSON Schemas, a client for bridges
`api`	API contracts (ADR 0027, 0028; wave 1): typed operations, the router (access, scope, validation, encoding, the approvals gate, streams), OpenAPI 3.1 documents with `x-xvii-*`, contract tests (`api/apitest`), MCP tools from operations, Go client calls; `cmd/apigen` emits TypeScript, Kotlin and a Swift client copy and diffs documents
`limits`	ADR 0013 for services: declare limits, read effective values from id, check, report usage
`release`	release index, checksums and signature verification (CLI self-update and `xvii-node`)
`cli`	the command framework from pages' CLI: registry, help, examples, completions (bash, zsh, fish), typo suggestions, colored output, progress, QR codes, contexts and token storage, device-flow login
`metrics`	counters, gauges, histograms; delta snapshots, Prometheus text out (`/metrics`, loopback only) and in (`ParseText`), Go runtime gauges; `server` counts requests and `db` its pool
`telemetry`	ships metrics, logs (a slog handler in `server.Logger`) and spans to analytics every 15 s when `TELEMETRY_URL` / `TELEMETRY_TOKEN` are set; W3C traceparent in `server.Wrap` and out of `client`
`client`	base API client: auth, retries, error decoding, used by every service's `client/`
`ids`	random ids, prefixed ids, DNS label validation, reserved names

Rules: no service-specific code; every package documented and tested; breaking changes bump the minor version until 1.0 and are applied across repos in the same sitting.