core/.trellis/spec/backend/directory-structure.md

Directory Structure

• crates/dever-core/src/lib.rs: separate syntax parse and semantic check entry points.
• source.rs: UTF-8 original-source ownership, sorted .dever/.dever.md loading, the single main/component/domain/role/topic classifier and byte-to-line/column conversion.
• markdown.rs: CommonMark top-level literal dever and typescript dever fence extraction, explicit closure and complete-declaration validation.
• markdown/contract/: .dever.md heading/list model, one-section-per-declaration mapping and checked package/type/function documentation contracts.
• diagnostic.rs: source-located errors, related labels and rendering.
• lexer.rs and token.rs: lexical rules and preserved numeric spellings.
• syntax.rs: spanned syntax structures and operator precedence.
• parser.rs: declarations, types, patterns and linear statements.
• parser/expression.rs: expressions, postfix operations and collection construction, sharing the same parser cursor.
• check.rs and check/: register all declarations before bodies; check/layout.rs owns application layout validation, check/symbols.rs owns logical App aliases and role access, and check/api.rs validates HTTP routes after signatures resolve. Names, types, linear flow, expressions/operators/value construction, collection handlers and symbolic clause coverage retain separate owners. Cycle checks include nested expressions, handler calls and type references, collapsing physical files in one domain for dependency-cycle purposes.
• types.rs and hir.rs: nominal types, opaque Stream values, static handler signatures/targets, concrete typed expressions, normalized value-only clause domains and local slots. Only checking constructs executable HIR.
• wire.rs: shared checked wire schema, policy identity and interned concrete type graph. native/wire.rs and llvm/wire.rs emit concrete backend-specific encoders/decoders; runtime wire.rs owns bounded duplicate-aware JSON parsing and exact raw JSON output. API dispatch, Adapter settings and Job codecs consume this owner, never maintain independent allowed-type registries.
• specialize.rs: the single function-plus-handler specialization graph used by checking and native emission. It resolves forwarded handlers and rejects recursion after substitution.
• llvm.rs and llvm/: typed HIR function/coroutine kernels with shared ownership/fault helpers. network.rs, concurrency.rs and parallel.rs own streams/TCP, task composition and worker packs. http*.rs lower protocol capabilities; system.rs owns system intrinsics and render.rs terminal faults. application.rs owns compiler-generated CMD/HTTP/Job roots; api.rs static route/auth/permission callbacks; api_context.rs auth/request/Cookie/Upload capabilities; rest.rs generated Model REST; application_commands.rs typed tenant management/CMD normalization. jobs.rs owns typed payload dispatch, enqueue, binding and clock adapters; testing.rs links case-local checked programs into one suite with indexed fault ownership. wire.rs owns concrete checked codecs, ports.rs selected Dever Adapter dispatch and Setting lifetime. database*.rs, orm*.rs and transaction.rs own persistence codecs, shared SQL/DDL and hidden transactions. Runtime application::Session owns config/lifecycle/database/tenant/migration/Job resources and closes after Scope drain within the same runtime. external.rs owns checked Worker calls and embedded resources; process_entry.rs wraps callable roots in process main. Private and managed Linux CLI compilation are connected; formal six-target delivery remains unfinished.
• contracts.rs and contracts/: post-HIR facts/domain proofs, failure obligations, transitive effects/dependencies and structural suggestions. api.rs owns public snapshots and application exposure analysis; CLI api.rs owns explicit baseline file I/O.
• intrinsic.rs: the single name-to-operation mapping for system primitives; checker and emitter exhaustively match this enum. Official result choice shapes are checked before emission and variants resolve by name, not declaration index.
• native.rs and native/: concrete record/choice generation, direct functions and collection loops, source-located failures, generated API/CMD/Job application roots and owned temporary build artifacts. native/build.rs owns native compilation and the single shared Cargo runtime target; native/build/cache.rs owns exact immutable inputs and executable cache identity; native/build/cleanup.rs owns marker-protected temporary directories and bounded local cleanup. CLI code must not reproduce those filesystem rules. native/api.rs emits checked static route dispatch, auth scope and response conversion. No generic runtime Value or interpreter dispatch.
• check/jobs.rs owns Job declarations, App payload contracts and static enqueue checking. native/jobs.rs owns concrete payload dispatch and queue initialization, reusing the shared wire and database owners. specialize::execution_reachable adds Job handlers as independent execution roots without adding synchronous call edges.
• crates/dever-runtime/src/: shared Decimal128/checked Int rules, ordered copy-on-write collections, Bytes, resource handles, pull-based Stream ownership, rendering and stdout. Native programs link this same runtime library; generated Rust is not a duplicate runtime implementation.
• crates/dever-backend-bridge/: private LLVM/LLD object/link owner. Its safe API uses explicit six-target selection; only private ffi.rs may contain authorized unsafe calls. LLD calls are serialized; failed crash recovery terminates the private compiler worker before any cleanup/re-entry. Outputs are exclusively claimed before linking. The opt-in embedded authoring build requires a private LLVM 18 SDK; independent runtime-abi exports the canonical C runtime boundary without that SDK. HIR lowering remains in core, and neither build mode is a formal released compiler/target pack.
• Runtime async_stream.rs owns the shared async producer/cursor and closure; net.rs owns Tokio Socket/Listener, duplex I/O, deadlines and resource cancellation. task.rs owns the single runtime, structured tasks/Group and bounded async stream dispatch. File resources remain in resource.rs.
• Runtime job.rs owns transactional enqueue and trusted execution/component checks, job/store.rs owns private queue/cursor schema and fenced state changes, and job/worker.rs owns bounded production/test dispatch. job/resources.rs owns invocation-local bindings, clock, initialization and tenant queue migrations. auth::authorize_permission binds the checked permission after authorization for both backends. cron.rs supplies the shared UTC parser. lifecycle.rs owns service-mode gating and signal-driven stop/drain; all work remains under the existing structured task owner.
• Runtime component.rs owns external Adapter resolution, bounded admission, Worker protocol, restart and shutdown. component/command.rs reuses that owner for one ordinary process per call, with binary I/O and caller-scope completion; dever.process.Output is its checked result, never an OS process handle. check/ports.rs synthesizes external implementations from the existing Port owner; native/ports.rs emits concrete codecs and dispatch. Do not add per-language runtime supervisors or expose protocol JSON to App code. CLI workers/command.rs packages domain-owned ELF/resources and reuses workers/elf.rs with native Python library validation.
• Runtime external.rs owns verified embedded external-resource extraction below the executable's private data/cache/lib/<digest> root. It is a packager primitive, not a registry client or shared-cache writer.
• Runtime http/ owns Hyper HTTP/1, bounded messages, streaming reply/session ownership and connection deadlines. Runtime api.rs adapts typed inputs/JSON envelopes and reuses HTTP serving. sse.rs owns event encoding; websocket.rs reuses tokio-tungstenite. TCP and WebSocket share private endpoint.rs for close/wakeup ownership. Native http.rs converts checked source records and statically bound handlers; no application business code belongs in the runtime.
• Runtime http/client.rs owns fixed-origin pooled requests and leases; client_driver.rs owns physical/request capacity, idle expiry and the one structured pool driver; client_body.rs owns pull-driven upload/download. tls.rs owns shared rustls configurations; the private transport.rs enum delegates TCP/TLS I/O for HTTP and WebSocket.
• library/**/*.dever: bundled official packages processed by the same parser/checker as user source. Compiler-assigned source origins, not filenames, authorize reserved namespaces; SourceMap::files() remains user-only while get() also resolves bundled diagnostic spans.
• format.rs and format/: shared AST-driven declaration layout, preserved per-block comment attachment and syntax-only canonical formatting. Markdown replaces only program-block interiors.
• reference.rs and reference/: opt-in HIR semantic evaluator and differential output/fault representation. Never link into production native programs.
• native/liveness.rs and native/updates.rs: clause-local last-use analysis, safe record alias coalescing and scalar snapshots before aggregate consumption. types.rs caches nominal comparison/move/transfer properties after cycle validation.
• native/sequences.rs: conservative total-handler proof and eligible collection fusion; collection emission shares lazy Text splitting with the runtime.
• contracts/dependencies.rs: shared dependency order and reverse-caller work scheduling for contract summaries.
• check/cache.rs: per-thread last-result cache with complete source identity; bundled AST caching belongs to lib.rs/source.rs.
• native/build/cache.rs: native artifact identity, integrity validation and atomic publication. native/build.rs owns current runtime freshness, snapshots and isolated executable lifetimes.
• crates/dever-cli/src/main.rs and format.rs: argument parsing, source loading, direct execution of the owned native program, local clean command adaptation and prepared/atomic source formatting writes. test_runner.rs is the single owner of application-test ordering, isolated native processes, captured output and temporary project cleanup.
• CLI binary-private compile.rs owns LLVM/object/LLD orchestration; worker.rs is the service-owned source compiler. Shared toolchain/runtime_pack.rs validates packs/snapshots without bridge imports; compilation.rs owns canonical input and staging validation, while service/ owns authenticated transport and child supervision. Reuse core native::compile_artifact for private builds and NativeProgram for caller-owned received executables. toolchain/packaging.rs owns deterministic native release assembly/signing from explicit author inputs; sdk/native-release.rs only adapts its private author CLI. Root runtime-pack profile owns the four-archive build settings. test/dever-cli-tests/support/llvm_inputs.rs holds explicit fixture SDK inputs, and support/daemon.rs holds the shared owned-daemon lifecycle; neither is a production input discovery mechanism.
• library/dever/json/: ordinary Dever JSON algorithm. library/dever/http.dever, sse.dever, websocket.dever and tls.dever: public protocol types/helpers and the native bridge; no duplicate source protocol stack. task.dever exposes runtime configuration, sleep and periodic streams.
• examples/cms/dever/ and examples/cms/md/: maintained CMS projects with equal declarations, schema, settings, business behavior and application tests. Generated API/CMD roots replace module/main.dever; api/admin/** and api/front/** are assigned by sites.<key>.path. Both projects keep matching test/<component>/<domain>/<topic> cases and config/setting.json.
• examples/old/: archived pre-role-layout language and regression material. It is not a current application root and must not be presented as a directory or visibility template. Formal tests remain under root test/.
• examples/README.md: current CMS commands and the archive boundary. Historical rejection fixtures keep their original diagnostics only when invoked by dedicated compiler-level tests, not as current application projects.
• test/dever-tests/tests/: permanent focused tests. Parser, checker and formatter share test/dever-tests/fixtures/core/complete_package.dever; public tests do not depend on private task records.

Core foundations, formatting, optional reference evaluation, official library follow-through and the SQLite/PostgreSQL static ORM have concrete implementations. Compiler distribution and self-hosting remain unshipped; validation evidence belongs to the active task, not this directory map. Compiler phase APIs are bootstrap internals, not an alternative program source format.

Use one owning implementation for each language rule. Do not introduce a generic parser framework, service layer or backend registry for a single concrete implementation.