The project loader resolves relative imports, checks cycles and source limits, and records offsets for diagnostics in every file. Tokens retain byte spans. The parser constructs the AST; the name/type checker annotates expressions with checked types and resolved function/builtin targets. Apps establish private function/storage namespaces. Pure globals are shared across apps.
The backend emits Rust from the typed AST. Values use owned Rust types with copy semantics implemented through cloning. i64 operators use checked methods. Each generated function and loop has cooperative execution guards. Codegen embeds runtime sources and compiles a temporary Cargo project with the backend’s checked-in manifest and lockfile. Dependency artifacts are cached; distinct generated binary names avoid concurrent-build output collisions. The final executable is copied to the requested output; temporary projects are removed.
The frontend uses serde_json for language-server transport, TOML for project manifests and SHA-256 for local dependency integrity. The native backend uses serde_json/subtle for core builtins and enables optional Axum/Tokio/rusqlite/form_urlencoded dependencies for HTTP projects. SQLite is compiled from the bundled source through the C toolchain. This is a compiler frontend using Rust generation, not a direct LLVM emitter or interpreter.
HTTP dispatch uses a generated Axum router and method-to-handler table. The runtime admits requests through global and app semaphores, collects a bounded body, and moves synchronous language code to Tokio’s blocking pool. Each worker thread gets a request context for that invocation only. A handler returns Json, String or Response. Panics are caught and request context is cleared. The body and execution deadline are independent windows.
App storage declarations generate opaque internal keys. Startup opens separate databases under app directories, enables WAL/foreign keys and installs SQLite authorization/progress hooks. Bound parameters prevent values becoming SQL syntax. The language cannot construct storage keys or use another app’s handle. Queries enforce row/output limits. SQLite ATTACH/DETACH/PRAGMA/extension-loading escape paths are blocked; this does not constitute an OS filesystem sandbox.
The LSP uses the same lexer/parser/checker for full-text buffers. Imports are loaded through the project loader when a local file URI is available. Formatting is lexical and preserves literal spellings/comments. Editor completion, completion uses a lexical declaration index. Checked projects build a semantic reference index from resolved AST spans for hover, cross-file definitions/references, scoped rename and signature help, including unsaved imported buffers. Rename rechecks proposed project edits. Type annotation references, incomplete-source recovery and source-level debugging remain incomplete.
Default Tier 0 runs apps in one process. Windows --isolate selects Tier 1.
The supervisor launches one copy of the deployment executable per app,
assigns a Job Object memory-commit cap and one-process limit, and forwards only
that app’s requests over loopback using an OS-random private token. Workers
open only their own databases and inherit their declared environment secrets
plus required OS startup variables. IPC control headers are hidden from the
language request API. Worker logs are collected with bounded line buffers.
The parent polls worker exits and restarts failed workers with backoff. Job
handles use kill-on-close, so parent termination does not leave workers running.
/_ryft/health reports readiness, worker PIDs, configured caps and restart counts.
Unavailable workers return 503/502 during recovery; unrelated worker processes
continue serving. Forwarded responses are bounded at 16 MiB. The Windows smoke
test exceeds a worker cap, observes a new PID and verifies another app keeps
its PID and serves requests.
Tier 1 provides process separation, committed-memory enforcement and declared hard CPU rate caps. It does not provide filesystem privilege isolation, hostile-code sandboxing or audited production qualification. The default Tier 0 memory budget remains metadata. See Microsoft’s Job Object model.