@slopware/sloppy-linux-x64 0.1.0-alpha.0

package/examples/configured-api/appsettings.Development.json

@@ -0,0 +1,5 @@
+{
+  "App": {
+    "Greeting": "hello from Development"
+  }
+}

package/examples/configured-api/appsettings.json

@@ -0,0 +1,6 @@
+{
+  "App": {
+    "Name": "configured-api",
+    "Greeting": "hello"
+  }
+}

package/examples/configured-api/sloppy.json

@@ -0,0 +1,5 @@
+{
+  "entry": "app.js",
+  "outDir": ".sloppy",
+  "environment": "Development"
+}

package/examples/core-config-secrets/README.md

@@ -0,0 +1,10 @@
+# Core Config Secrets Example
+
+This example shows Config secret
+values moving into response metadata only through the shared redacted string shape.
+
+## Limitations
+
+This example is limited to config and secret-redaction API shape. Placeholder
+configuration values must remain placeholder-only; real tokens do not belong in
+examples or goldens.

package/examples/core-config-secrets/app.js

@@ -0,0 +1,15 @@
+import { Results, Sloppy } from "sloppy";
+
+const app = Sloppy.create();
+
+app.get("/config-status", () => {
+    const endpoint = app.config.getString("Provider:Endpoint", "runtime:/provider.sock");
+    const providerCredential = app.config.getSecret("Provider:Token");
+
+    return Results.json({
+        endpoint,
+        credential: String(providerCredential),
+    });
+});
+
+export default app;

package/examples/core-fs-time-codec/README.md

@@ -0,0 +1,9 @@
+# Core FS Time Codec Example
+
+This example shows filesystem bytes,
+an operation deadline, and the shared Codec UTF-8 decoder used together.
+
+## Limitations
+
+This example is limited to the combined filesystem, deadline, and codec API
+shape shown above.

package/examples/core-fs-time-codec/app.js

@@ -0,0 +1,8 @@
+import { Text } from "sloppy/codec";
+import { File } from "sloppy/fs";
+import { Deadline } from "sloppy/time";
+
+const deadline = Deadline.after(500);
+const bytes = await File.readBytes("data:/message.txt", { timeoutMs: 250, deadline });
+
+export const message = Text.utf8.decode(bytes, { fatal: true });

package/examples/core-network-time-codec/README.md

@@ -0,0 +1,11 @@
+# Core Network Time Codec Example
+
+This example uses LocalEndpoint
+operation options, a shared Deadline, and Codec UTF-8 helpers for byte ownership at the
+network boundary.
+
+## Limitations
+
+This example is limited to the local endpoint, deadline, and codec API shape
+shown above. Broader network policy and sandbox behavior are separate runtime
+docs.

package/examples/core-network-time-codec/app.js

@@ -0,0 +1,20 @@
+import { Text } from "sloppy/codec";
+import { LocalEndpoint } from "sloppy/net";
+import { Deadline } from "sloppy/time";
+
+export async function readLocalStatus(signal) {
+    const deadline = Deadline.after(1000);
+    const endpoint = await LocalEndpoint.connect({
+        path: "runtime:/status.sock",
+        deadline,
+        signal,
+    });
+
+    try {
+        await endpoint.write(Text.utf8.encode("status\n"), { deadline, signal });
+        const bytes = await endpoint.read({ maxBytes: 4096, deadline, signal });
+        return Text.utf8.decode(bytes, { fatal: true });
+    } finally {
+        await endpoint.close();
+    }
+}

package/examples/core-policy-audit/README.md

@@ -0,0 +1,7 @@
+# Core Policy Audit Example
+
+This example keeps capability and
+strict-policy metadata explicit so doctor/audit output can describe implemented and deferred
+policy behavior honestly.
+
+The policy object is example metadata, not an OS sandbox or package manifest.

package/examples/core-policy-audit/app.js

@@ -0,0 +1,22 @@
+import { Sloppy } from "sloppy";
+
+const PolicyModule = Sloppy.module("core-policy").capabilities((capabilities) => {
+    capabilities.addDatabase("data.main", {
+        provider: "sqlite",
+        access: "readwrite",
+        metadata: { strict: true },
+    });
+});
+
+// Audit-only fixture metadata; current app construction does not enforce this object.
+export const policyMetadata = Object.freeze({
+    filesystem: { mode: "strict", roots: ["data:/"] },
+    network: { mode: "strict", connect: ["127.0.0.1:9000"] },
+    process: { mode: "strict", run: ["status-tool"] },
+});
+
+const app = Sloppy.createBuilder()
+    .addModule(PolicyModule)
+    .build();
+
+export default app;

package/examples/core-process-time-codec/README.md

@@ -0,0 +1,8 @@
+# Core Process Time Codec Example
+
+This example reads process output
+as owned bytes or text, applies a shared Deadline, and decodes bytes with Codec UTF-8.
+
+## Limitations
+
+This example is limited to the process, time, and codec API shape shown above.

package/examples/core-process-time-codec/app.js

@@ -0,0 +1,28 @@
+import { Text } from "sloppy/codec";
+import { Process } from "sloppy/os";
+import { Deadline } from "sloppy/time";
+
+let statusText = "";
+
+async function refreshStatusText() {
+    let process = null;
+    try {
+        process = await Process.start("status-tool", ["--format=text"], {
+            stdout: "pipe",
+            deadline: Deadline.after(1000),
+        });
+        const output = await process.stdout.read(4096);
+        statusText = typeof output === "string"
+            ? output
+            : Text.utf8.decode(output, { fatal: true });
+    } catch {
+        statusText = "";
+    } finally {
+        if (process !== null) {
+            await process.dispose();
+        }
+    }
+    return statusText;
+}
+
+export { refreshStatusText, statusText };

package/examples/core-worker-time/README.md

@@ -0,0 +1,8 @@
+# Core Worker Time Example
+
+This example shows WorkQueue job
+ownership with a shared Deadline and explicit backpressure behavior.
+
+## Limitations
+
+This example is limited to the worker and time API shape shown above.

package/examples/core-worker-time/app.js

@@ -0,0 +1,17 @@
+import { WorkQueue } from "sloppy/workers";
+import { Deadline } from "sloppy/time";
+
+const queue = WorkQueue.create("core-worker-time", {
+    maxQueued: 8,
+    concurrency: 2,
+    overflow: "backpressure",
+});
+
+queue.process(async (job, ctx) => {
+    ctx.signal.throwIfCancelled();
+    return { id: job.data.id, attempt: job.attempt };
+});
+
+export const scheduled = queue.enqueue({ id: "daily-summary" }, {
+    deadline: Deadline.after(500),
+});

package/examples/crypto-hash-hmac/README.md

@@ -0,0 +1,17 @@
+# Crypto Hash And HMAC Example
+
+This example documents SHA-256 digest helpers,
+incremental hashing, SHA-512 HMAC signing, HMAC verification, and `Secret` ownership around a
+configuration-supplied key.
+
+```js
+import { Hash, Hmac, Secret } from "sloppy/crypto";
+
+const digest = await Hash.sha256Hex(payload);
+const signature = await Hmac.sha512(signingKey, payload);
+const ok = await Hmac.verifySha512(signingKey, payload, signature);
+```
+
+HMAC verification uses the constant-time comparison path. The example keeps the
+non-cryptographic hash namespace out of security-shaped code and does not define
+a custom crypto algorithm.

package/examples/crypto-hash-hmac/app.js

@@ -0,0 +1,29 @@
+import { Hash, Hmac, Secret } from "sloppy/crypto";
+
+function readSigningKeyFromConfig(config) {
+    return config.hmacKey;
+}
+
+export async function describePayload(payload, config) {
+    const signingKey = Secret.fromUtf8(readSigningKeyFromConfig(config));
+    try {
+        const sha256Hex = await Hash.sha256Hex(payload);
+        const sha256Base64 = await Hash.sha256Base64(payload);
+        const hasher = Hash.create("sha256");
+        hasher.update("event:");
+        hasher.update(payload);
+        const incrementalHex = await hasher.digest("hex");
+        const signature = await Hmac.sha512(signingKey, payload);
+        const signatureOk = await Hmac.verifySha512(signingKey, payload, signature);
+
+        return {
+            sha256Hex,
+            sha256Base64,
+            incrementalHex,
+            signatureBytes: signature.byteLength,
+            signatureOk,
+        };
+    } finally {
+        signingKey.dispose();
+    }
+}

package/examples/crypto-password/README.md

@@ -0,0 +1,21 @@
+# Crypto Password Example
+
+This example documents the async password
+hashing, verification, and rehash policy shape.
+
+```js
+import { Password } from "sloppy/crypto";
+
+const encodedHash = await Password.hash(password);
+const ok = await Password.verify(password, encodedHash);
+const shouldUpgrade = await Password.needsRehash(encodedHash);
+```
+
+Password hashing is async in the public API and offloaded from the V8 owner thread in the
+V8-enabled runtime. Password values must not be logged, printed, placed in diagnostics, or committed to
+goldens.
+
+## Limitations
+
+This example uses Sloppy's password API as provided. It does not define a custom
+password hashing algorithm.

package/examples/crypto-password/app.js

@@ -0,0 +1,12 @@
+import { Password } from "sloppy/crypto";
+
+export async function createPasswordRecord(password) {
+    const encodedHash = await Password.hash(password);
+    return { encodedHash };
+}
+
+export async function verifyPasswordRecord(password, encodedHash) {
+    const ok = await Password.verify(password, encodedHash);
+    const shouldUpgrade = await Password.needsRehash(encodedHash);
+    return { ok, shouldUpgrade };
+}

package/examples/crypto-random-token/README.md

@@ -0,0 +1,16 @@
+# Crypto Random Token Example
+
+This example documents the intended
+`sloppy/crypto` random helper shape for UUIDs, random bytes, URL-safe tokens, hex text, and
+numeric codes.
+
+```js
+import { Random } from "sloppy/crypto";
+
+const resetToken = Random.token(32);
+const recoveryCode = Random.numericCode(6);
+```
+
+Random helpers use OS CSPRNG backends only. The example does not print generated
+tokens or describe randomness quality from deterministic tests. There is no
+`Math.random` fallback.

package/examples/crypto-random-token/app.js

@@ -0,0 +1,12 @@
+import { Random } from "sloppy/crypto";
+
+const resetToken = Random.token(32);
+const recoveryCode = Random.numericCode(6);
+
+export default {
+    requestId: Random.uuid(),
+    randomBytesLength: Random.bytes(32).byteLength,
+    resetTokenLength: resetToken.length,
+    randomHexLength: Random.hex(32).length,
+    recoveryCodeLength: recoveryCode.length,
+};

package/examples/crypto-secret-constant-time/README.md

@@ -0,0 +1,21 @@
+# Crypto Secret And Constant-Time Example
+
+This example documents `Secret` ownership,
+cleanup-once disposal, HMAC verification, and constant-time byte comparison.
+
+```js
+import { ConstantTime, Hmac, Secret } from "sloppy/crypto";
+
+const key = Secret.fromUtf8(configuredKeyText);
+try {
+    const expected = await Hmac.sha256(key, body);
+    return ConstantTime.equals(expected, providedSignature);
+} finally {
+    key.dispose();
+}
+```
+
+`Secret.dispose()` is best-effort cleanup of Sloppy-owned buffers. Prior JavaScript string
+copies, engine internals, OS paging, or crash dumps may still contain data. The example
+avoids printing secret material. Deterministic tests verify API behavior, not side-channel
+resistance.

package/examples/crypto-secret-constant-time/app.js

@@ -0,0 +1,15 @@
+import { ConstantTime, Hmac, Secret } from "sloppy/crypto";
+
+export async function verifyWebhook(body, providedSignature, configuredKeyText) {
+    const key = Secret.fromUtf8(configuredKeyText);
+    try {
+        const expectedSignature = await Hmac.sha256(key, body);
+        return ConstantTime.equals(expectedSignature, providedSignature);
+    } finally {
+        key.dispose();
+    }
+}
+
+export function verifyOpaqueBytes(left, right) {
+    return ConstantTime.equals(left, right);
+}

package/examples/data-foundation/README.md

@@ -0,0 +1,39 @@
+# Data Foundation Example
+
+Bootstrap data/capabilities foundation example.
+This example shows the current JavaScript-only shape for database capability metadata,
+query template lowering, a fake data provider service, and transaction callback semantics.
+
+What works today:
+
+- `Sloppy.module("data").capabilities(...)` declares a database capability token.
+- `caps.addDatabase("data.main", { provider: "sqlite", access: "readwrite" })` stores
+  metadata only.
+- `data.createFakeProvider(...)` creates a test/example provider with `query`, `queryOne`,
+  `exec`, and `transaction`.
+- tagged query templates keep SQL text and parameter values separate.
+- `sql` and provider methods lower placeholders to `?` by default.
+- fake transactions record begin/commit/rollback behavior for tests.
+
+Current product state:
+
+- This source-stdlib example is a checked-in API-shape fixture.
+- `sloppy run --artifacts` currently runs emitted artifacts such as
+  `examples/compiler-hello`.
+- `sloppyc` compilation and `app.plan.json` emission for this data shape are future
+  source-extraction work.
+- The bounded `sloppy run` path currently loads generated artifacts, not this
+  source-stdlib data example.
+- The real SQLite provider is covered by native C tests. This example uses a fake
+  JavaScript provider so the metadata and callback shape stay inspectable.
+- PostgreSQL and SQL Server have separate provider examples. This example stays on the
+  fake JavaScript provider.
+- The fake provider records calls only; it opens no database connection and executes no SQL.
+- Filesystem and network capability enforcement belong to their provider/runtime lanes.
+- Migrations and ORM behavior are separate application-framework features.
+- Native SQL execution, pooling, and true-async external providers are covered by
+  provider-specific SQLite/PostgreSQL/SQL Server examples and tests.
+- Bare `"sloppy"` imports are the current source shape for this example.
+
+See `examples/sqlite-basic/`, `examples/postgres-basic/`, and `examples/sqlserver-basic/`
+for provider registration shapes.

package/examples/data-foundation/app.js

@@ -0,0 +1,63 @@
+import { Sloppy, data, sql } from "sloppy";
+
+export const DataModule = Sloppy.module("data")
+    .capabilities((caps) => {
+        caps.addDatabase("data.main", {
+            provider: "sqlite",
+            access: "readwrite",
+        });
+    })
+    .services((services) => {
+        services.addSingleton("data.main", () => data.createFakeProvider({
+            query(lowered) {
+                return [{
+                    id: lowered.parameters[0] ?? "demo",
+                    loweredText: lowered.text,
+                }];
+            },
+            exec(lowered) {
+                return {
+                    affectedRows: 1,
+                    loweredText: lowered.text,
+                };
+            },
+        }));
+    });
+
+export const UsersModule = Sloppy.module("users")
+    .dependsOn("data")
+    .routes((app) => {
+        app.mapGroup("/users")
+            .withTags("Users")
+            .mapGet("/{id:int}", async ({ route, services }) => {
+                const db = services.get("data.main");
+                const user = await db.queryOne`
+                    select id, name
+                    from users
+                    where id = ${route.id ?? "demo"}
+                `;
+
+                await db.transaction(async (tx) => {
+                    await tx.exec`
+                        insert into audit_log (user_id)
+                        values (${route.id ?? "demo"})
+                    `;
+                });
+
+                return user;
+            })
+            .withName("Users.Get");
+    });
+
+const lowered = sql`select id from users where id = ${1}`;
+
+const builder = Sloppy.createBuilder();
+
+builder
+    .addModule(UsersModule)
+    .addModule(DataModule);
+
+const app = builder.build();
+
+export { lowered };
+export default app;

package/examples/dependency-graph/README.md

@@ -0,0 +1,19 @@
+# Dependency Graph
+
+This example shows a small dependency graph with:
+
+- one local fixture package installed through `file:`;
+- one Node compatibility shim (`node:path`);
+- one asset included by `assetInclude`;
+- a graph that can be inspected with `sloppy deps`.
+
+## Setup
+
+```sh
+npm install
+sloppy build
+sloppy deps .sloppy
+sloppy deps .sloppy --format json
+```
+
+The package is local to this example and does not require a registry call.

package/examples/dependency-graph/fixtures/graph-helper/index.js

@@ -0,0 +1,3 @@
+export function describe(path) {
+    return `graph-helper saw ${path}`;
+}

package/examples/dependency-graph/fixtures/graph-helper/package.json

@@ -0,0 +1,6 @@
+{
+  "name": "graph-helper",
+  "version": "0.0.0-fixture",
+  "type": "module",
+  "main": "./index.js"
+}

package/examples/dependency-graph/package.json

@@ -0,0 +1,7 @@
+{
+  "private": true,
+  "type": "module",
+  "dependencies": {
+    "graph-helper": "file:./fixtures/graph-helper"
+  }
+}

package/examples/dependency-graph/public/message.txt

@@ -0,0 +1 @@
+This asset is included by assetInclude.

package/examples/dependency-graph/sloppy.json

@@ -0,0 +1,9 @@
+{
+  "kind": "program",
+  "entry": "src/main.ts",
+  "outDir": ".sloppy",
+  "environment": "Development",
+  "assetInclude": [
+    "public/**/*"
+  ]
+}

package/examples/dependency-graph/src/main.ts

@@ -0,0 +1,8 @@
+import path from "node:path";
+import { describe } from "graph-helper";
+
+export function main() {
+    const assetPath = path.join("public", "message.txt");
+    console.log(describe(assetPath));
+    return 0;
+}

package/examples/dogfood/README.md

@@ -0,0 +1,23 @@
+# Contributor/Internal Evidence Catalog
+
+This contributor/internal directory is a machine-readable catalog of current
+runtime evidence targets. The source is `dogfood.json`.
+
+Current runnable or diagnosable targets:
+
+- `hello-artifact`: uses `examples/compiler-hello/app.js` and the checked-in generated
+  artifact fixture under `compiler/tests/fixtures/hello-mapget/expected`.
+- `hello-source-input`: uses `examples/hello-minimal/src/main.ts` through the source-input
+  fixture harness.
+- `prealpha-control-plane`: uses `examples/prealpha-control-plane/` through project-mode
+  source input and the app test host coverage suite.
+- `package-hello-artifact`: uses the package outside-checkout smoke fixture when a package
+  archive is provided.
+
+Feature app targets for HTTP, HTTPS/TLS, SQLite, PostgreSQL, SQL Server, and the typed
+framework surface are listed with their current blocked or gated status until the required
+runtime support is available.
+
+Default non-V8 runs validate clear diagnostics for V8-required examples.
+Positive execution of the hello handlers and control-plane example requires a
+V8-enabled build.