@slopware/sloppy-darwin-x64 0.1.0-alpha.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for describing the origin of the Work and
+      reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Support. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or support.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within any third-party works.
+
+   Copyright 2026 The Sloppy Authors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+   implied. See the License for the specific language governing permissions
+   and limitations under the License.

package/README.md

@@ -0,0 +1,5 @@
+# Sloppy Local Package
+
+This is an experimental development artifact for local validation. It does not install
+anything, fetch dependencies, bundle a V8 SDK, provide package-manager behavior, or change
+production readiness status.

package/docs/KNOWN_LIMITATIONS.md

@@ -0,0 +1,16 @@
+# Known Limitations
+
+This package is an experimental pre-alpha development artifact.
+
+- Publishing uses a separate release step.
+- Production readiness is tracked separately.
+- Full Node, Bun, and Deno compatibility, package-manager installs, and runtime
+  node_modules discovery are separate tracks.
+- V8 execution, live provider readiness, TLS hardening, and release readiness use their own
+  lanes.
+- V8 SDK headers, import libraries, and source/build trees are intentionally excluded.
+- V8 runtime support is included only in packages built with a matching Sloppy-owned SDK
+  and validated by the V8 package smoke lane.
+- PostgreSQL and SQL Server live-provider behavior requires separate opt-in evidence.
+- Signing, notarization, installers, auto-update, and package-manager distribution are not
+  included.

package/docs/LICENSES.md

@@ -0,0 +1,6 @@
+# Licenses
+
+This experimental package includes Sloppy source-license text in the repository root
+LICENSE file and may include runtime dependencies provided by the host build environment.
+
+Complete third-party license review remains required before publishing.

package/docs/NOTICE.md

@@ -0,0 +1,8 @@
+# Notice
+
+This experimental local package may include runtime dependencies provided by the
+host build environment. It does not include V8 SDK headers/import libraries,
+database drivers, package manager metadata, installers, or signed release metadata.
+
+Dependency license review and a complete release notice file are still required
+before publishing.

package/examples/README.md

@@ -0,0 +1,140 @@
+# Sloppy Examples
+
+Examples are split by confidence level. Runnable examples are useful to try by
+hand during the public alpha, pre-production period. Fixture examples are small
+source shapes kept stable by tests.
+
+Run commands from the repository root unless a row says otherwise. `sloppy run`
+handler execution requires a V8-enabled build.
+
+For a new app, use the packaged templates instead of copying an example:
+
+```powershell
+sloppy create my-api --template minimal-api
+sloppy create my-tool --template program
+```
+
+## Example Inventory
+
+| Example | Status | Command | What it covers | Requirements / expected result |
+| --- | --- | --- | --- | --- |
+| `compiler-hello` | runnable with `sloppy run --once` | `ctest -R conformance.hello.*run_once` | Compiler artifact execution | V8 lane returns `Hello from Sloppy`. |
+| `program-hello` | runnable Program Mode source | `sloppy run examples/program-hello/main.ts -- Ada` | Route-free program Plan, relative module import, args/context, and console stdout | V8 lane prints `hello from sloppy program mode Ada`; non-V8 builds can still compile and inspect `kind: program` artifacts. |
+| `program-fs-process` | runnable Program Mode source | `sloppy run` from `examples/program-fs-process` | Program stdlib imports for filesystem and OS/process APIs, package run shape | V8 lane writes under `./tmp`, runs `git --version`, and exits with the child exit code. |
+| `package-zod-like` | package graph fixture | `npm install && sloppy build && sloppy deps .sloppy` from the example directory | Local fixture package resolution from `node_modules`, package `exports`, Program Mode dependency graph | Uses a local `file:` dependency; no registry access required. Runtime execution requires V8. |
+| `dependency-graph` | package graph fixture | `npm install && sloppy build && sloppy deps .sloppy --format json` from the example directory | Installed fixture package, `node:path` compatibility shim, `assetInclude`, dependency graph inspection | Uses a local `file:` dependency; no registry access required. |
+| `node-compat-path-events` | compile-only / tooling fixture | `sloppy build && sloppy deps .sloppy` from the example directory | Supported `node:path` and `node:events` compatibility shims | Shows explicit shim imports; does not claim full Node runtime behavior. |
+| `dynamic-module-include` | compile-only / tooling fixture | `sloppy build && sloppy deps .sloppy` from the example directory | Computed dynamic imports over `moduleInclude` plus asset metadata | Runtime dynamic import succeeds only for modules sealed into the graph. |
+| `hello-minimal` | runnable with source input | `sloppy run examples/hello-minimal/src/main.ts --once GET /hello/Ada` | Smallest project/source-input app | V8 lane writes a full HTTP response with `{"hello":"Ada"}` body. |
+| `web-dynamic-routes` | runnable with source input | `sloppyc build examples/web-dynamic-routes/app.ts --out .sloppy` | Static and dynamic web route registration with partial Plan metadata | Static route metadata remains complete; dynamic routes emit findings and require V8 for handler execution. |
+| `prealpha-control-plane` | contributor/internal app-host and source-input run | `ctest -R "bootstrap.stdlib.prealpha_control_plane_dogfood\|conformance.prealpha_control_plane"` | Multi-file app, modules, CORS, request IDs/logging, ProblemDetails, SQLite-shaped provider, services, health | App-host test passes; V8 source-input lane returns `Compiler Platform`. |
+| `testhost-basic` | documentation example | Read `examples/testhost-basic/README.md` | `TestHost.create(app)` fluent request/response assertions | Plain JavaScript example; covered by bootstrap TestHost tests. |
+| `testhost-db` | documentation example | Read `examples/testhost-db/README.md` | Test data helper shape for SQLite-backed tests | SQLite execution depends on the active native bridge lane. |
+| `testservices-postgres` | documentation example | Read `examples/testservices-postgres/README.md` | Experimental Docker-backed PostgreSQL service with migrations, seed, reset, and TestHost | Requires Docker, the opt-in TestServices gate, and the PostgreSQL provider bridge. |
+| `testservices-sqlserver` | documentation example | Read `examples/testservices-sqlserver/README.md` | Experimental Docker-backed SQL Server service with migrations, seed, reset, and TestHost | Requires Docker, the opt-in TestServices gate, SQL Server provider bridge, and ODBC driver. |
+| `cache-basic` | API-shape fixture | Read `examples/cache-basic/README.md` | Memory cache, cache-aside, schema validation, tag invalidation | App-host shape; covered by bootstrap cache tests. |
+| `cache-output-api` | API-shape fixture | Read `examples/cache-output-api/README.md` | OutputCache and HTTP cache headers | App-host shape; covered by bootstrap cache tests. |
+| `cache-hybrid-postgres` | live-provider example | Configure PostgreSQL, then run through the app host | Hybrid cache with PostgreSQL distributed backend | Requires PostgreSQL provider support and a live service; default lanes skip external provider requirements. |
+| `request-context` | runnable with `sloppy run --once` | `ctest -R conformance.request_context.*run_once` | Route params, query, method, path, raw target | V8 lane returns JSON request context fields. |
+| `static-files-basic` | compile-only / tooling fixture | `sloppy build examples/static-files-basic/app.js --out .sloppy-static-basic` | `app.staticFiles` public directory shape | Static assets are a build-time snapshot; handler execution requires V8. |
+| `static-files-spa` | compile-only / tooling fixture | `sloppy build examples/static-files-spa/app.js --out .sloppy-static-spa` | `app.spa` fallback and asset route shape | API routes win before SPA fallback; runtime handler execution requires V8. |
+| `static-files-precompressed` | compile-only / tooling fixture | `sloppy build examples/static-files-precompressed/app.js --out .sloppy-static-precompressed` | Precompressed static variant metadata | Placeholder `.br` and `.gz` files demonstrate selection metadata only. |
+| `static-files-package` | package graph fixture | `sloppy package examples/static-files-package/app.js --out .sloppy-static-package` | Static assets copied into package artifacts | Package path is local alpha packaging, not a release archive. |
+| `static-files-testhost` | documentation example | `node examples/static-files-testhost/test.mjs` | In-process static file TestHost behavior | Exercises route precedence, `HEAD`, precompressed selection, and traversal rejection. |
+| `redis-basic` | live-provider example | Read `examples/redis-basic/README.md` | First-party Redis client shape | Optional provider fixture. Requires Redis and the Sloppy network bridge; default lanes use fake bridge protocol tests only. |
+| `redis-cache` | live-provider example | Read `examples/redis-cache/README.md` | Redis-backed cache provider with tags and service registration | Optional provider fixture. Requires Redis and the Sloppy network bridge. |
+| `redis-locks` | live-provider example | Read `examples/redis-locks/README.md` | Redis single-key lease shape | Optional provider fixture. Requires Redis and the Sloppy network bridge; no cluster or Redlock claim. |
+| `testservices-redis` | documentation example | Read `examples/testservices-redis/README.md` | Experimental Docker-backed Redis service with client, env, flush, reset, and TestHost | Requires Docker, the opt-in TestServices gate, and the Sloppy network bridge. |
+| `auth-api` | compile-only / tooling fixture | `sloppy build && sloppy routes .sloppy && sloppy openapi .sloppy` from the example directory | JWT/API-key/session auth setup, route requirements, roles, policies, OpenAPI security metadata | Uses placeholder secrets; protected-route manual execution needs a request path that can supply headers or cookies. |
+| `realtime-dashboard` | compile-only / tooling fixture | `sloppy build examples/realtime-dashboard/app.js --out .sloppy && sloppy routes .sloppy && sloppy openapi .sloppy` | SSE route metadata, WebSocket route intent, and in-process hub shape | SSE uses bounded `Results.stream`; WebSocket route execution requires HTTP/1.1 Upgrade in native `sloppy run`. |
+| `websocket-echo` | documentation example | Read `examples/websocket-echo/README.md` | App-host WebSocket text/JSON echo, origin policy, subprotocols, heartbeat, idle timeout, and limits | TestHost covers the full app-host API; native `sloppy run` covers text/binary HTTP Upgrade sessions. |
+| `websocket-auth` | documentation example | Read `examples/websocket-auth/README.md` | JWT-protected WebSocket route with required scope | Use with TestHost `.withJwt(...)`; protected native WebSocket routes fail closed until auth principals are materialized on upgraded connections. |
+| `websocket-json-schema` | documentation example | Read `examples/websocket-json-schema/README.md` | Schema-validated JSON WebSocket messages | App-host TestHost behavior only. |
+| `websocket-testhost` | documentation example | `node examples/websocket-testhost/test.mjs` | First-party WebSocket TestHost client helpers | Plain JavaScript app-host test; no external WebSocket package required. |
+| `users-api-sqlite` | runnable with `sloppy run --once` | `ctest -R conformance.users_api_sqlite.*run_once` | SQLite source-input conformance app | V8/SQLite lane returns seeded users. |
+| `framework-hello` | runnable with source input | `ctest -R conformance.framework_hello` | Typed route binding and request context | V8 lane returns `{"hello":"Ada"}`. |
+| `framework-di-services` | runnable with source input | `ctest -R conformance.framework_di_services_example.run_once` | Singleton/scoped/transient service injection | V8 lane returns deterministic service values. |
+| `framework-sqlite-crud` | runnable with source input | `ctest -R conformance.framework_sqlite_crud` | Typed SQLite provider injection and CRUD shape | V8/SQLite lane returns seeded SQLite users. |
+| `configured-api` | compile-only / tooling fixture | `ctest -R "conformance.configured_api\|examples.configured_api"` | Project config and Plan inspection | Emits artifacts and CLI metadata; no positive handler execution claim. |
+| `modules-api` | compile-only / tooling fixture | `ctest -R "conformance.modules_api\|examples.modules_api"` | Function module source-input workflow | Emits artifacts and CLI metadata. |
+| `validation-errors` | compile-only / tooling fixture | `ctest -R "conformance.validation_errors\|examples.validation_errors"` | Plan validation metadata and OpenAPI/doctor output | Emits artifacts and CLI metadata. |
+| `framework-explicit-binding` | compile-only / tooling fixture | `ctest -R conformance.framework_explicit_binding` | `Route`, `Query`, `Body`, `Header`, `RequestContext` binding metadata | Emits artifacts and CLI metadata. |
+| `framework-validation-errors` | compile-only / tooling fixture | `ctest -R conformance.framework_validation_errors` | Schema-backed body binding diagnostics | Emits artifacts and CLI metadata. |
+| `framework-postgres-crud` | live-provider example | `.\tools\windows\test-live-postgres.ps1` | Typed PostgreSQL provider shape | Optional provider example. Requires V8, PostgreSQL client support, connection-string config, and live PostgreSQL service; default lane skips/unavailable when missing. |
+| `framework-sqlserver-crud` | live-provider example | `.\tools\windows\test-live-sqlserver.ps1` | Typed SQL Server provider shape | Optional provider example. Requires V8, Microsoft ODBC Driver 17 or 18, connection-string config, and live SQL Server service; default lane skips/unavailable when missing. |
+| `postgres-basic` | live-provider fixture | `.\tools\windows\test-live-postgres.ps1` | PostgreSQL runtime provider bridge | Optional provider fixture. Requires PostgreSQL client support and live PostgreSQL setup. |
+| `sqlserver-basic` | live-provider fixture | `.\tools\windows\test-live-sqlserver.ps1` | SQL Server runtime provider bridge | Optional provider fixture. Requires live SQL Server setup and Microsoft ODBC Driver 17 or 18. |
+| `codec-base64-hex` | API-shape fixture | `ctest -R examples.codec.api_shape` | Base64/Base64Url/Hex helpers | Static example check only. |
+| `codec-checksums` | API-shape fixture | `ctest -R examples.codec.api_shape` | CRC/checksum helper boundary | Static example check only; not authentication. |
+| `codec-compression` | API-shape fixture | `ctest -R examples.codec.api_shape` | gzip/gunzip helper shape | Static example check only. |
+| `codec-streaming-compression` | API-shape fixture | `ctest -R examples.codec.api_shape` | streaming compression shape | Static example check only. |
+| `codec-text-binary` | API-shape fixture | `ctest -R examples.codec.api_shape` | Text and binary reader/writer helpers | Static example check only. |
+| `config-basic` | compile-only / tooling fixture | `ctest -R examples.config.api_shape` | Config binding and defaults | Source build and static example checks; no positive handler execution claim. |
+| `config-secrets-redaction` | compile-only / tooling fixture | `ctest -R examples.config.api_shape` | Secret wrapper/redaction boundary | Source build and static example checks; `doctor` reports missing required secret config until configured. |
+| `config-strict-mode` | compile-only / tooling fixture | `ctest -R examples.config.api_shape` | Strict config reads | Source build and static example checks; no positive handler execution claim. |
+| `core-config-secrets` | core integration fixture | `ctest -R examples.core_integration.api_shape` | Core config/secret policy shape | Static example check only. |
+| `core-fs-time-codec` | core integration fixture | `ctest -R examples.core_integration.api_shape` | Combined filesystem/time/codec API shape | Static example check only. |
+| `core-network-time-codec` | core integration fixture | `ctest -R examples.core_integration.api_shape` | Combined network/time/codec API shape | Static example check only. |
+| `core-policy-audit` | core integration fixture | `ctest -R examples.core_integration.api_shape` | Capability/audit policy shape | Static example check only. |
+| `core-process-time-codec` | core integration fixture | `ctest -R examples.core_integration.api_shape` | Process/time/codec API shape | Static example check only. |
+| `core-worker-time` | core integration fixture | `ctest -R examples.core_integration.api_shape` | Worker/time API shape | Static example check only. |
+| `crypto-hash-hmac` | API-shape fixture | `ctest -R examples.crypto.api_shape` | Hash/HMAC/Secret helpers | Static example check only. |
+| `crypto-password` | API-shape fixture | `ctest -R examples.crypto.api_shape` | Async password hashing helpers | Static example check only. |
+| `crypto-random-token` | API-shape fixture | `ctest -R examples.crypto.api_shape` | Random token helpers | Static example check only. |
+| `crypto-secret-constant-time` | API-shape fixture | `ctest -R examples.crypto.api_shape` | Secret cleanup and constant-time compare shape | Static example check only. |
+| `data-foundation` | API-shape fixture | `ctest -R examples.data_foundation.api_shape` | Provider/capability descriptors | Static example check only. |
+| `orm-basic` | documentation example | Read `examples/orm-basic/README.md` | First-party `sloppy/orm` model, schema, CRUD, relation include, and migration script shape | Handler execution needs `ctx.db` to be supplied by an active Sloppy database provider. |
+| `orm-relations-includes` | documentation example | Read `examples/orm-relations-includes/README.md` | ORM one-join and collection split-query includes | Handler execution needs `ctx.db` to be supplied by an active Sloppy database provider. |
+| `orm-cursor-export` | documentation example | Read `examples/orm-cursor-export/README.md` | ORM cursor metadata and NDJSON adapter with the bounded `Results.stream` descriptor | Handler execution needs `ctx.db` to be supplied by an active Sloppy database provider. |
+| `orm-migrations` | compile-only / tooling fixture | `sloppy build && sloppy orm migration script .sloppy --provider main` from the example directory | Compiler-emitted ORM Plan metadata and CLI migration draft/status/apply commands | Produces reviewable SQL from static table metadata; `status` and `apply` use the configured provider database and migration history. |
+| `orm-testservices` | documentation example | Read `examples/orm-testservices/README.md` | ORM app-host test shape with `TestServices.postgres/sqlServer` skip semantics | Live execution requires environment-provided database services and native provider support; missing prerequisites report `SKIPPED`. |
+| `dogfood` | contributor/internal machine-readable catalog | `.\tools\windows\dogfood.ps1 -StatusOnly -Json` | Scenario vocabulary and lane expectations | Catalog validation; not an app by itself. |
+| `ergonomics` | API-shape fixture | `ctest -R examples.ergonomics.api_shape` | Route groups, Results helpers, config/log/services shape | Static example check only. |
+| `framework-controller` | API-shape fixture | `ctest -R examples.framework.api_shape` | Controller mapper and DI shape | App-host fixture; compiler source input covers the static controller mapping subset in compiler fixtures. |
+| `fs-basic` | API-shape fixture | `ctest -R examples.fs.api_shape` | Directory/File helpers and deadline option | Static example check only. |
+| `fs-roots-policy` | API-shape fixture | `ctest -R examples.fs.api_shape` | Logical root path shape | Static example check only. |
+| `fs-streams` | API-shape fixture | `ctest -R examples.fs.api_shape` | File stream/line iteration shape | Static example check only. |
+| `fs-watch` | API-shape fixture | `ctest -R examples.fs.api_shape` | Directory watch shape | Static example check only. |
+| `hello` | hello fixture | `ctest -R examples.hello.api_shape` | Smallest app-host hello shape | Static example check only. |
+| `http-client-basic` | API-shape fixture | `ctest -R bootstrap.stdlib.http_client` | Outbound `HttpClient` helper shape | Bootstrap test uses local test bridge; runtime bridge lanes are separate. |
+| `http-client-typed` | documentation example | Read `examples/http-client-typed/README.md` | Typed outbound client registered through services | App-host shape is covered by `tests/bootstrap/test_http_client_factory.mjs`. |
+| `http-client-generated` | documentation example | Read `examples/http-client-generated/README.md` | OpenAPI-to-`Http.typedClient` generated client shape | Generator behavior is covered by `tests/bootstrap/test_http_client_factory.mjs`. |
+| `http-client-resilience` | documentation example | Read `examples/http-client-resilience/README.md` | Retry, circuit-breaker, bulkhead, and pool options | API shape is covered by `tests/bootstrap/test_http_client_factory.mjs`. |
+| `http-client-testhost` | documentation example | Read `examples/http-client-testhost/README.md` | `TestHttp.mock()` with `TestHost` outbound overrides | App-host mock path is covered by `tests/bootstrap/test_http_client_factory.mjs`. |
+| `http-client-testhost-package-mock` | documentation example | Read `examples/http-client-testhost-package-mock/README.md` | Artifact/package TestHost outbound mock injection | Process-host harness is covered by `tests/bootstrap/test_testhost_process_modes.mjs`; positive handler execution requires a V8-enabled CLI. |
+| `http-client-runtime-loopback` | documentation example | Read `examples/http-client-runtime-loopback/README.md` | Native-backed outbound loopback client path | Low-level loopback coverage is in `tests/bootstrap/test_http_client.mjs`; artifact/package runtime execution requires V8. |
+| `modules-basic` | API-shape fixture | `ctest -R examples.modules_basic.api_shape` | Module phases and route contribution shape | Static example check only. |
+| `net-deadline-cancel` | API-shape fixture | `ctest -R examples.net.api_shape` | Network cancellation shape | Static example check only. |
+| `net-local-ipc` | API-shape fixture | `ctest -R examples.net.api_shape` | Local IPC shape | Static example check only. |
+| `net-policy-strict` | API-shape fixture | `ctest -R examples.net.api_shape` | Network policy shape | Static example check only. |
+| `net-tcp-client` | API-shape fixture | `ctest -R examples.net.api_shape` | TCP client shape | Static example check only. |
+| `net-tcp-echo` | API-shape fixture | `ctest -R examples.net.api_shape` | TCP echo shape | Static example check only. |
+| `net-tcp-server` | API-shape fixture | `ctest -R examples.net.api_shape` | TCP server shape | Static example check only. |
+| `os-runtime-api` | API-shape fixture | `ctest -R examples.os.api_shape` | OS/environment/process/signal API shape | Static example check only. |
+| `sqlite-basic` | provider fixture | `ctest -R examples.sqlite_basic.api_shape` | SQLite provider API shape | Static example check; runtime SQLite lanes are separate. |
+| `time-basic` | API-shape fixture | `ctest -R examples.time.api_shape` | Clock/time helpers | Static example check only. |
+| `time-deadline-cancellation` | API-shape fixture | `ctest -R examples.time.api_shape` | Deadline/cancellation shape | Static example check only. |
+| `time-fake-clock` | API-shape fixture | `ctest -R examples.time.api_shape` | Fake clock shape | Static example check only. |
+| `time-interval-schedule` | API-shape fixture | `ctest -R examples.time.api_shape` | Interval/schedule shape | Static example check only. |
+| `workers-background-service` | curated worker fixture | `ctest -R examples.workers.api_shape` | Background service shape | Static example check only. |
+| `workers-js-isolate` | API-shape fixture | `ctest -R examples.workers.api_shape` | Worker isolate shape | Static example check only. |
+| `workers-shutdown` | API-shape fixture | `ctest -R examples.workers.api_shape` | Worker shutdown shape | Static example check only. |
+| `workers-workerpool` | curated worker fixture | `ctest -R examples.workers.api_shape` | Worker pool shape | Static example check only. |
+| `workers-workqueue` | API-shape fixture | `ctest -R examples.workers.api_shape` | Work queue shape | Static example check only. |
+
+## Status Meanings
+
+- `runnable with sloppy run --once`: the example is expected to execute through
+  generated artifacts and V8 in a configured V8 build.
+- `compile-only / tooling fixture`: the example is expected to compile and feed
+  Plan-backed CLI tools, but no positive handler execution is claimed.
+- `package graph fixture`: the example demonstrates package/dependency graph
+  behavior. Local `file:` dependencies avoid internet access.
+- `documentation example`: the example is reader-facing documentation for an
+  API shape already covered by focused tests. It is not a standalone execution
+  lane.
+- `live-provider example`: the example needs an external database and matching
+  optional provider dependency. Default Sloppy apps do not need PostgreSQL, SQL
+  Server, Redis, libpq, or ODBC.
+- `API-shape fixture`: static checks keep the example honest about imports,
+  APIs, and documentation boundaries.

package/examples/auth-api/README.md

@@ -0,0 +1,20 @@
+# Auth API
+
+Small source-input example for Sloppy JWT bearer, rotating memory-backed session
+cookies, API keys, roles, policies, and Plan/OpenAPI auth metadata.
+
+Build from this directory:
+
+```sh
+sloppy build
+sloppy routes .sloppy
+sloppy openapi .sloppy --output openapi.json
+```
+
+`appsettings.json` declares sample JWT, session, and API-key secret keys for
+local builds. Provide deployment values through environment-specific
+configuration. Do not commit real auth secrets.
+
+Runtime handler execution requires a V8-enabled Sloppy build. `sloppy run
+--once` is useful for public routes, but it does not provide a convenient
+manual header input path for protected-route testing.

package/examples/auth-api/app.js

@@ -0,0 +1,61 @@
+import { Sloppy, Results, Auth, Config } from "sloppy";
+
+const app = Sloppy.create();
+
+app.use(Auth.jwtBearer({
+    issuer: "sloppy.local",
+    audience: "api",
+    secret: Config.required("Auth:JwtSecret"),
+}));
+
+app.use(Auth.cookieSession({
+    name: "sloppy.session",
+    secret: Config.required("Auth:SessionSecret"),
+    store: Auth.sessionStore.memory({ maxEntries: 128 }),
+    idleTimeoutMs: 1800000,
+    absoluteTimeoutMs: 86400000,
+    rotation: true,
+    csrf: true,
+}));
+
+app.get("/public", () => Results.ok({ ok: true }));
+
+app.post("/login", (ctx) => Auth.signIn(ctx, {
+    sub: "user-1",
+    roles: ["user"],
+    claims: { email: "ada@example.com" },
+}));
+
+app.post("/logout", (ctx) => Auth.signOut(ctx));
+
+app.get("/me", (ctx) => Results.ok({
+    subject: ctx.user.sub,
+    roles: ctx.user.roles,
+    scheme: ctx.user.scheme,
+})).requireAuth();
+
+app.get("/admin", () => Results.ok({ ok: true }))
+    .requireAuth({ role: "admin" });
+
+app.use(Auth.apiKey({
+    header: "x-api-key",
+    validate: (key) => key === Config.required("Auth:ApiKey"),
+}));
+
+app.get("/internal/status", () => Results.ok({ ok: true }))
+    .requireAuth("apiKeyAuth");
+
+app.auth.addPolicy("admin-or-ops", (user) =>
+    user.roles.includes("admin") || user.claims.department === "ops",
+);
+app.auth.addPolicy("users-read", Auth.policy((policy) =>
+    policy.requireAuthenticated().requireScope("users:read"),
+));
+
+app.get("/ops", () => Results.ok({ ok: true }))
+    .requireAuth({ policy: "admin-or-ops" });
+
+app.get("/users", () => Results.ok({ ok: true }))
+    .requireAuth({ policy: "users-read" });
+
+export default app;

package/examples/auth-api/appsettings.json

@@ -0,0 +1,7 @@
+{
+  "Auth": {
+    "JwtSecret": "replace-with-local-test-secret",
+    "SessionSecret": "replace-with-local-session-secret",
+    "ApiKey": "replace-with-local-test-key"
+  }
+}

package/examples/auth-api/sloppy.json

@@ -0,0 +1,5 @@
+{
+  "entry": "app.js",
+  "outDir": ".sloppy",
+  "environment": "Development"
+}

package/examples/cache-basic/README.md

@@ -0,0 +1,9 @@
+# Cache Basic Example
+
+This example uses `Cache.memory(...)` for cache-aside reads and tag invalidation.
+
+- `GET /users/42` uses `getOrCreate(...)` with a schema and tags.
+- `POST /users/42/invalidate` invalidates the user and list tags.
+
+Memory cache is per process. Use `Cache.sqlite`, `Cache.postgres`, or
+`Cache.sqlServer` when multiple app instances must share entries.

package/examples/cache-basic/app.js

@@ -0,0 +1,32 @@
+import { Cache, Results, Schema, Sloppy } from "sloppy";
+
+const app = Sloppy.create();
+const cache = Cache.memory("main", { maxEntries: 1000, ttlMs: 30000 });
+const UserDto = Schema.object({
+    id: Schema.integer(),
+    name: Schema.string(),
+});
+
+app.services.addCache(cache);
+app.services.addSingleton("users", () => ({
+    async findById(id) {
+        return id === "42" ? { id: 42, name: "Ada Lovelace" } : null;
+    },
+}));
+
+app.get("/users/{id}", async (ctx) => {
+    const user = await cache.getOrCreate(`users:${ctx.route.id}`, {
+        ttlMs: 30000,
+        tags: [`user:${ctx.route.id}`, "users"],
+        schema: UserDto,
+    }, async () => ctx.services.get("users").findById(ctx.route.id));
+
+    return user === null ? Results.notFound() : Results.json(user);
+});
+
+app.post("/users/{id}/invalidate", async (ctx) => {
+    await cache.invalidateTags([`user:${ctx.route.id}`, "users"]);
+    return Results.noContent();
+});
+
+export default app;

package/examples/cache-hybrid-postgres/README.md

@@ -0,0 +1,10 @@
+# Cache Hybrid PostgreSQL Example
+
+This example shows the app-host shape for a hybrid cache:
+
+- memory cache handles hot in-process hits;
+- PostgreSQL distributed cache shares entries across app instances;
+- `getOrCreate(...)` coalesces same-process misses.
+
+It requires PostgreSQL provider support, a configured connection string, and a
+live PostgreSQL service. Default Sloppy lanes do not require PostgreSQL.

package/examples/cache-hybrid-postgres/app.js

@@ -0,0 +1,27 @@
+import { Cache, Results, Sloppy, data } from "sloppy";
+
+const app = Sloppy.create();
+
+app.services.addSingleton("data.main", () => data.postgres.open({
+    connectionString: app.config.require("Sloppy:Providers:postgres:main:connectionString"),
+}));
+
+app.services.addSingleton("cache.main", (scope) => Cache.hybrid("main", {
+    memory: Cache.memory({ maxEntries: 10000, ttlMs: 10000 }),
+    distributed: Cache.postgres(scope.get("data.main"), {
+        namespace: "products",
+        ttlMs: 60000,
+    }),
+}));
+
+app.get("/products/{id}", async (ctx) => {
+    const cache = ctx.services.get("cache.main");
+    const product = await cache.getOrCreate(`products:${ctx.route.id}`, {
+        ttlMs: 30000,
+        tags: [`product:${ctx.route.id}`, "products"],
+    }, async () => ({ id: ctx.route.id, source: "postgres" }));
+
+    return Results.json(product);
+});
+
+export default app;

package/examples/cache-output-api/README.md

@@ -0,0 +1,10 @@
+# Cache Output API Example
+
+This example separates server-side OutputCache from HTTP cache headers.
+
+- `GET /products?category=books&page=1` is cached by Sloppy on the server.
+- `GET /assets/config.json` emits `Cache-Control`, `Vary`, and `ETag` headers
+  for clients and proxies, but does not use server-side output cache.
+
+OutputCache keys use the route pattern and configured vary fields, not raw URLs
+or secret headers.

package/examples/cache-output-api/app.js

@@ -0,0 +1,35 @@
+import { Cache, Results, Sloppy } from "sloppy";
+
+const app = Sloppy.create();
+
+function createOutputCache() {
+    return Cache.memory("default", { maxEntries: 1000, ttlMs: 30000 });
+}
+
+app.services.addSingleton("cache.default", () => createOutputCache());
+
+let productCalls = 0;
+app.get("/products", (ctx) => {
+    productCalls += 1;
+    const calls = productCalls;
+    const category = ctx.query.category ?? "all";
+    const page = Number(ctx.query.page ?? 1);
+    return Results.json({
+        category,
+        page,
+        calls,
+    });
+}).outputCache({
+    ttlMs: 30000,
+    varyByQuery: ["category", "page"],
+    tags: ["products"],
+});
+
+app.get("/assets/config.json", () => Results.json({ version: 1 }))
+    .cacheHeaders({
+        cacheControl: "public, max-age=60",
+        vary: ["Accept-Encoding"],
+        etag: true,
+    });
+
+export default app;