Module internal_attribute 

Parsing for the model-level @@internal("action") attribute (cratestack#743, implementing the accepted design in docs/design/route-suppression.md) — an author declaration that a model action must never be reachable from the wire: no REST route, no RPC dispatch arm, no client stub, on any surface. Shares its action vocabulary with @@allow/@@deny (cratestack-macros/src/policy/model.rs’s parse_rule_action), but unlike those this attribute takes exactly one action per declaration and carries no policy expression — it is purely a generation-time routing decision (design doc §2.2: “this must never be reachable from the wire, independent of whether some future policy edit would make it satisfiable”).

Exactly one action per declaration is enforced, not just documented (cratestack#743 post-merge review, Finding B): parse_internal_attribute rejects @@internal("create", "update") as malformed — pinned by this module’s own rejects_two_quoted_actions_in_one_declaration test and cratestack-parser’s rejects_two_actions_in_one_internal_declaration. Suppressing more than one action means writing more than one @@internal("action") line, the same repeated-declaration shape @@allow/@@deny already use for multiple rules on one model — docs/design/ route-suppression.md’s @@internal("action", ...) notation cites PR #485’s original wording verbatim and is not describing a multi-argument call; see that document’s 2026-08-26 correction note.

model_internal_actions is the single shared source of truth every surface (REST route assembly, RPC dispatch-arm collection, and every client’s per-action stub emission) consults exactly once — see the design doc §3.1 for why routing everything through one function, rather than each surface re-scanning attribute.raw independently, is load-bearing rather than merely tidy.

Constants

INTERNAL_ACTIONS

Action names @@internal(...) accepts — identical to @@allow’s vocabulary (list/detail/read/create/update/delete/ all; see cratestack-macros/src/policy/model.rs’s parse_rule_action and model/descriptor.rs’s action groupings) so an author never has to learn a second action vocabulary to suppress what @@allow already describes.

Functions

model_internal_actions

The single shared source of truth every surface consults exactly once: the set of wire verbs ("list", "get", "create", "update", "delete") a model’s @@internal(...) attributes suppress. Assumes every attribute already parsed successfully via parse_internal_attribute — per-declaration validation (cratestack-parser’s validate_internal_attribute) must run first and reject anything else, mirroring computed_params_type_name’s same assume-validated contract. Malformed or unrecognized attributes are silently skipped here rather than panicking: a caller reaching this function after a failed parse would already have surfaced the error at schema validation time, and this function must stay infallible so every codegen surface can call it without threading a Result through unrelated emission code.

parse_internal_attribute

Parses one @@internal("action") attribute’s action name and validates it against INTERNAL_ACTIONS. Returns Err naming the model and the bad action for anything else — the compile-error case the design’s acceptance criteria requires (“@@internal naming an action that is not a valid action verb ⇒ compile error naming the model and the bad action”).