Module schema 

Schema IR — the parsed shape of a .cstack file. Every IR node carries source-span back-pointers so consumers can map errors to positions in the original text.

Modules

attribute_text

Lexical scanning of .cstack attribute text: where string literals are, where a trailing // comment starts, and where one attribute ends and the next begins.

authn_attribute

The procedure attribute @authn(maxAge: 300, amr: ["hwk"], acr: ["aal2"]) (ADR 0022, cratestack#1244): how recently and how strongly the caller must have authenticated.

composite_key

Parsing for the model-level @@id([...]) composite-primary-key attribute (Prisma’s spelling). Mirrors crate::events::parse_emit_attribute’s shape: syntax parsing lives here in cratestack-core so both the parser’s semantic checker and any other consumer share one implementation. The bracketed-field-list syntax itself lives in [super::field_list] — @@id([...]) is that module’s only caller now that @@unique([...])/@@index([...]) parse their own bracket- plus-keyword-arguments shape via [super::attribute_syntax] instead (cratestack#156/#742’s where:/using:/opclass: arguments; see [super::field_list]’s module doc for why).

composite_unique

Parsing for the model-level @@unique([...], where: "...") composite unique attribute (Prisma’s spelling for the field list, extended with a partial-index predicate by cratestack#742). Its bracketed field-list syntax is shared with @@index([...])/@@id([...]) only via [super::field_list::is_valid_field_name] (the identifier rule) — the split/keyword-argument parsing itself is shared with @@index([...], where: "...") (cratestack#156) through [super::attribute_syntax] instead, since unlike @@id([...]) this attribute also takes a trailing where: keyword argument. What differs from @@id([...])’s plain form is the semantics — a composite unique constraint, not the primary key — and the error text pointing at the single-field alternative.

computed_attribute

Parsing for the @computed(params: <Type>?) field attribute’s parenthesized argument. Bare @computed needs no parsing; this module only handles the parameterized form. Mirrors super::composite_key’s shape: syntax parsing lives here in cratestack-core so cratestack-parser’s semantic checker and any other consumer (codegen, later) share one implementation.

default_functions

Which functions a @default(...) may call (cratestack#1209).

default_literal

What a literal @default(...) means for its field (cratestack#1234).

default_markers

The @default(...) marker functions — spellings that are not real database functions and must never reach a DEFAULT clause verbatim.

enum_ordinal

Explicit enum ordinals (Pending = 1, @@reserved(4)), the IR half of docs/design/enum-ordinals.md. The parser fills these in and checks rules R1–R5; the macros, cratestack-migrate and the client generators read them back through EnumDecl::is_ordinal.

index_attribute

Parsing for the model-level @@index([...], using: ..., opclass: "...", where: "...") attribute (cratestack#156, cratestack#742) — a general secondary index, optionally naming a non-default Postgres access method (e.g. ivfflat/hnsw for pgvector approximate-nearest-neighbor search), operator class, and a partial-index predicate.

internal_attribute

Parsing for the model-level @@internal("action") attribute (cratestack#743, implementing the accepted design in docs/design/route-suppression.md) — an author declaration that a model action must never be reachable from the wire: no REST route, no RPC dispatch arm, no client stub, on any surface. Shares its action vocabulary with @@allow/@@deny (cratestack-macros/src/policy/model.rs’s parse_rule_action), but unlike those this attribute takes exactly one action per declaration and carries no policy expression — it is purely a generation-time routing decision (design doc §2.2: “this must never be reachable from the wire, independent of whether some future policy edit would make it satisfiable”).

mcp

Typed IR for a schema’s MCP operator surface (ADR 0002, cratestack#1033 phase 1, cratestack#1036).

model

Model / mixin / type / enum / field IR nodes parsed out of a .cstack file. Every IR node carries SourceSpan back-pointers so consumers (parser, LSP, generators) can map errors to source positions.

positions

Source positions are the one part of a Schema that differs between a schema split across files and the single file it is equivalent to.

procedure

Procedure / query-mutation IR nodes parsed out of a .cstack file.

query

query IR — the declarative, parameterized custom-SQL read block (cratestack#867; accepted design docs/design/declarative-custom-query.md, adopted by epic cratestack#488’s 2026-09-02 decision comment).

rename_attribute

The argument of a rename marker, @@rename(from = "<old_table>") on a model and @rename(from = "<old_column>") on a field.

selection

Field selection / include shape used by the column-projection path.

spatial

The PostGIS geometry vocabulary shared by the parser (which validates what a schema may write) and the migrate emitter (which renders the Postgres type modifier). Keeping the closed set here rather than in either crate means the two can never drift into accepting and emitting different spellings.

topic

topic IR node (docs/design/subscriptions-websocket.md §3.4, slice S4): a typed, keyed, cross-replica publish/subscribe channel, declared once as topic RoomMessage(roomId: String): ChatMessage.

view

View IR — the view <Name> from <Model>, ... { ... } block.

Structs

Attribute

AuthBlock

ConfigBlock

ConfigEntry

Datasource

EnumDecl

EnumVariant

Field

McpConfig

The top-level mcp { } block.

McpName

The name = "..." entry of the mcp { } block.

MixinDecl

Model

ModelMcpExposure

@@mcp(resource: "...") on a model: expose it as a read-only MCP resource.

OwnedSchemaSummary

ParsedAuthn

What an @authn attribute requires.

ParsedCompositeUnique

The parsed shape of an @@unique([...], where: "...") attribute.

ParsedIndexAttribute

The parsed shape of an @@index([...], using: ..., opclass: "...", where: "...") attribute.

Procedure

ProcedureArg

ProcedureMcpExposure

@mcp(tool ...) on a procedure: expose it as an MCP tool.

Query

ReservedOrdinals

An enum’s @@reserved(n, …) line: ordinals no variant may use, ever.

Schema

SchemaSummary

SelectionQuery

SourceSpan

Topic

TypeDecl

TypeRef

View

ViewSource

Enums

ComputedParamsArg

The parenthesized argument of a @computed(...) attribute, however it parses.

ExtensionKind

An opt-in framework/database capability a schema announces via a top-level extension <name> { } block (cratestack#153). Declaring an extension only unlocks schema-visible syntax for that capability (e.g. @no_rate_limit, the Vector(n) scalar type) — it never gates codegen or runtime behavior by itself; that’s a separate, same-named Cargo feature per consuming crate (cratestack#161, out of scope here).

ProcedureKind

TransportStyle

Wire-shape the schema generates for. Picked once per schema (via the top-level transport rest|rpc directive) so generated servers and clients only carry one binding’s worth of surface.

TypeArity

Constants

AUTHN_ATTRIBUTE

The attribute’s name.

AUTHN_KEYS

The keys @authn takes, in the order its error messages list them.

AUTHN_MAX_AGE_LIMIT

The largest maxAge: one year, in seconds.

ENUM_ORDINAL_MAX

The largest ordinal a variant may carry: the column is a SMALLINT.

ENUM_RESERVED_ATTRIBUTE

The block attribute that retires ordinals, so a removed variant’s number can never be handed to a new one.

INTERNAL_ACTIONS

Action names @@internal(...) accepts — identical to @@allow’s vocabulary (list/detail/read/create/update/delete/ all; see cratestack-macros/src/policy/model.rs’s parse_rule_action and model/descriptor.rs’s action groupings) so an author never has to learn a second action vocabulary to suppress what @@allow already describes.

MCP_MAX_PAGE_SIZE

Hard ceiling on a collection resource’s page size (ADR 0002 Q3). A model may lower its own maximum with max_page_size:, never raise it past this; a larger value is a validation error, not a clamp.

PRIMARY_KEY_ATTRIBUTE

The one spelling that marks a field as its model’s (or view’s) primary key.

QUERY_SQL_ATTRIBUTE

The attribute a query block’s SQL body is written in.

RENAME_ARGUMENT_FORM

The one argument shape a rename marker takes, for error messages.

Functions

authn_attribute

The @authn among attributes, if any (the first, when a schema repeats it; the parser refuses a repeat).

canonical_geometry_subtype

Normalises a schema-written geometry subtype to its canonical PostGIS casing, or None if it isn’t a recognised subtype.

computed_params_type_name

The params type name off a field’s @computed(params: <Type>?) attribute, or None for a bare @computed field (or a field with no @computed attribute at all). Assumes the attribute is already well-formed — per-declaration validation (e.g. cratestack-parser’s validate_computed_field_attribute) must run first and reject anything else. Callers that still need to validate the argument form should parse the raw attribute text with parse_computed_params_arg instead.

field_attribute_name

The bare name of a field-level attribute, with the @ sigil and any (...) argument list removed: @length(min: 1) -> Some("length"). None for model-level @@... text or text without the sigil.

geometry_subtype_names

Every accepted subtype spelling, for building “expected one of: …” diagnostics. Ordered base-major so the common 2D names lead.

is_computed_attribute

True when a single attribute’s raw text is either spelling of @computed — bare @computed or the parameterized @computed(...) form (whatever its argument, valid or not; argument-shape validation is a separate concern — see cratestack-parser’s validate_computed_field_attribute). Anchored with starts_with("@computed(") rather than the looser starts_with("@computed") deliberately: the latter would also match a hypothetical unrelated attribute merely prefixed with the same characters (e.g. @computedSomethingElse).

is_computed_field

True for a field carrying either spelling of @computed — bare or @computed(params: <Type>?). See is_computed_attribute for why this must be the only place the string comparison is written.

is_primary_key_attribute

Whether attribute marks its field as the primary key. Exact match on PRIMARY_KEY_ATTRIBUTE: @identity, @idx and @id_foo are other (unknown) attributes, not a primary key.

is_relation_attribute

Whether attribute is a @relation / @relation(...) declaration — by name, so a bare @relation counts too. @relationship does not.

model_internal_actions

The single shared source of truth every surface consults exactly once: the set of wire verbs ("list", "get", "create", "update", "delete") a model’s @@internal(...) attributes suppress. Assumes every attribute already parsed successfully via parse_internal_attribute — per-declaration validation (cratestack-parser’s validate_internal_attribute) must run first and reject anything else, mirroring computed_params_type_name’s same assume-validated contract. Malformed or unrecognized attributes are silently skipped here rather than panicking: a caller reaching this function after a failed parse would already have surfaced the error at schema validation time, and this function must stay infallible so every codegen surface can call it without threading a Result through unrelated emission code.

parse_authn_attribute

Reads a whole @authn(...) attribute.

parse_composite_id_attribute

Parses @@id([field1, field2, ...]) into its ordered list of local field names. Callers are responsible for checking that each name resolves to a real scalar field on the model.

parse_composite_unique_attribute

Parses @@unique([field1, field2, ...], where: "...") into its ordered list of local field names plus an optional partial-index predicate. Callers are responsible for checking that each name resolves to a real scalar field on the model.

parse_computed_params_arg

Parses the text between (but not including) the parens of a @computed(...) attribute into its recognized shape. Whitespace-tolerant around the : and before the trailing ?.

parse_index_attribute

Parses @@index([field1, field2, ...]), optionally followed by using: <method>, opclass: "<name>", and/or where: "<predicate>". Callers are responsible for checking that each field name resolves to a real scalar field on the model.

parse_internal_attribute

Parses one @@internal("action") attribute’s action name and validates it against INTERNAL_ACTIONS. Returns Err naming the model and the bad action for anything else — the compile-error case the design’s acceptance criteria requires (“@@internal naming an action that is not a valid action verb ⇒ compile error naming the model and the bad action”).

parse_rename_from

The old name in arguments, the text inside a rename marker’s parentheses: from, =, then one double-quoted, non-empty name with no " or \ in it, whitespace allowed around each part. None for anything else.

rename_marker_from

The old name in a whole rename marker raw, as cratestack-migrate reads it: marker ("@rename" or "@@rename"), directly its (, arguments parse_rename_from takes, and a ) that ends the text. None for anything else — which the migrator treats as no marker.

scan_sql_placeholders

Every distinct N in a $N token appearing in sql as an actual parameter reference, ascending.

without_source_positions

schema with every SourceSpan zeroed.