Where Plerino fits
Plerino is a general-purpose backend framework. Each use case below lists what the framework provides for it and the packages involved, all of which exist in the repository today.
Explore the ecosystemGet in touch
Plerino is pre-1.0. These pages describe what is implemented, not production references.
API backends
Services that expose JSON over HTTP and need predictable routing, strict input handling and clear error contracts.
- Routes are compiled into a static matcher, and overlapping routes fail the build.
- Typed input classes and attribute rules validate requests; failures are returned as RFC 9457 Problem Details.
- Session and bearer token guards, with hashed API tokens that carry scopes and can be revoked.
- Outbound calls go through a PSR-18 client with a server-side request forgery guard and retries.
Packages involved
SaaS and multi-service platforms
Products made of several services that share sign-in, localisation, monetary amounts and communication with customers.
- Sign-in with passkeys, TOTP and OAuth providers, and deny-by-default policies for RBAC, ABAC and ReBAC.
- Exact monetary amounts with ISO 4217 currencies, and ICU MessageFormat for localised text.
- Mail and notifications are handed off to queues, with per-recipient channel preferences.
- Typed configuration is compiled at build time and secrets are kept out of the compiled file.
Packages involved
Real-time applications
Live dashboards, collaboration features and status updates that must survive reconnects.
- Channels are declared with typed patterns and guarded by policies checked at build time.
- Presence rosters and a replay window let a reconnecting client resume where it stopped.
- WebSocket with a server-sent events fallback, and a typed TypeScript client.
- Redis Streams, Valkey and NATS JetStream backbones fan events out across processes.
Packages involved
Background jobs and workflows
Work that should not run inside a request: deliveries, imports, reports and long-running business processes.
- Queue drivers for Redis Streams, PostgreSQL and SQS with at-least-once delivery.
- Retries with backoff, unique jobs, idempotency keys and a dead-letter store.
- Durable workflows with an event log, compensation, timers and human approval.
- Schedules are compiled at build time, with time zones and locks across nodes.
Packages involved
Internal tools and back offices
Administrative applications where forms, permissions and an audit trail matter more than a heavy front end.
- Server-rendered Weft templates with components, slots and escaping by default.
- Attribute validation rules with translated messages.
- Policies with a two-person approval workflow and an audit trail of every decision.
- Uploads with inspection and antivirus scanning, and PDF documents rendered from templates.
Packages involved
Event-driven integrations
Systems that react to changes and exchange data with other services reliably.
- Typed events with listeners compiled at build time and asynchronous delivery.
- A transactional outbox, so an event is recorded in the same transaction as the change that caused it.
- MongoDB change streams delivered as events.
- Outbound HTTP with redirect control, retries and a server-side request forgery guard.
Packages involved
Regulated and security-sensitive environments
Teams that have to show how authentication, cryptography and logging behave, not only state it.
- The authentication package maps OWASP ASVS 4.0.3 Level 3 requirements to the tests that verify them. This is a self-assessment, not a certification.
- libsodium is the only cryptography provider, with key rings and key rotation.
- Field encryption with blind indexes and an audit trail in the data layer.
- Secrets are redacted from logs and telemetry, and kept out of the compiled configuration.
Packages involved
Follow the road to 1.0
Explore what exists today, or write to us if you want to talk about the project.