API

The Sloppy public API is exposed through a single import:

import { Sloppy, Results, sql, schema, data, ... } from "sloppy";

Most apps need only Sloppy and Results. Reach for the rest as you need configuration, services, validation, or data access.

Reference

• App — Sloppy.create(), the builder, modules, OpenAPI docs, freezing
• Routing — app.get/post/put/patch/delete, route patterns, groups, controllers
• Static files — app.staticFiles(...), app.spa(...), build-time asset routes
• Middleware — app.use(fn), group.use(fn), pipeline order
• CORS — app.useCors(policy), allowed origins, preflight
• Auth — experimental JWT bearer, API keys, route authorization, scopes, policies, ctx.user
• Sessions — signed cookie sessions and CSRF
• Security headers — first-party response security headers
• RateLimit — first-party route and WebSocket abuse protection
• Health checks — Health, app.health(), liveness/readiness/startup
• Metrics — counters, gauges, histograms, JSON snapshots, Prometheus output
• Cache — memory, distributed, hybrid, cache-aside, output cache, cache headers
• Management — opt-in actuator-style backend endpoints
• Errors — app.useErrors(...), typed mappings, safe logging
• ProblemDetails — problem response descriptor options
• Request IDs — request ID middleware and response header behavior
• Request logging — structured request completion logs
• TestHost — first-party app, artifact, package, and loopback API testing
• TestServices — Experimental — opt-in Docker-backed PostgreSQL and SQL Server test services
• App test host — in-memory app-host dispatch for tests
• Request context — what's on ctx inside a handler
• Results — every response helper
• Realtime — typed channels, groups, presence, TestHost helpers, SSE, and WebSocket framework APIs
• WebSockets — app-host WebSocket socket API, options, TestHost helpers, and runtime limits
• Network — TCP, local IPC (Unix sockets / named pipes), NetworkAddress
• HTTP Client — outbound HTTP/1.1 and explicit HTTP/2 requests
• Webhooks — durable outbox delivery, signatures, retries, inbound verification — Experimental
• Services — singleton/scoped/transient DI, disposal
• Config — addObject, typed getters, secrets, binding
• Logging — levels, sinks
• Capabilities — declaring database/provider capabilities
• Data — data.sqlite, data.postgres, data.sqlserver, SQL templates, and cursors
• ORM — Experimental — sloppy/orm tables, columns, schemas, CRUD, includes, and migrations
• Redis — first-party Redis client, pools, scripts, locks, diagnostics
• Cache — memory, provider-backed, Redis-backed, hybrid, and output caches
• Jobs — durable jobs, recurring schedules, worker leases, retries, and scheduler admin
• Workers — background services, work queues, cancellation
• Schema — value validation
• Filesystem — sloppy/fs files, directories, handles, watchers
• OS — sloppy/os system info, environment, subprocess, shutdown signals
• Time — sloppy/time delays, deadlines, intervals, cancellation, fake clock
• Crypto — sloppy/crypto random, hashing, HMAC, password, secrets
• Codec — sloppy/codec Base64, hex, UTF-8, binary I/O, gzip, CRC-32
• FFI — sloppy/ffi typed native interop

Stability

Surfaces are tagged Stable, Experimental, or Planned. Unmarked surfaces are the current public alpha shape, not a stable compatibility promise. APIs and artifact formats can still change before a stable release. See reference/stability.md for the current matrix.