Struct ModelDescriptor 

pub struct ModelDescriptor<M, PK> {

    pub schema_name: &'static str,
    pub table_name: &'static str,
    pub columns: &'static [ModelColumn],
    pub primary_key: &'static str,
    pub allowed_fields: &'static [&'static str],
    pub allowed_includes: &'static [&'static str],
    pub allowed_sorts: &'static [&'static str],
    pub read_allow_policies: &'static [ReadPolicy],
    pub read_deny_policies: &'static [ReadPolicy],
    pub detail_allow_policies: &'static [ReadPolicy],
    pub detail_deny_policies: &'static [ReadPolicy],
    pub create_allow_policies: &'static [ReadPolicy],
    pub create_deny_policies: &'static [ReadPolicy],
    pub update_allow_policies: &'static [ReadPolicy],
    pub update_deny_policies: &'static [ReadPolicy],
    pub delete_allow_policies: &'static [ReadPolicy],
    pub delete_deny_policies: &'static [ReadPolicy],
    pub create_defaults: &'static [CreateDefault],
    pub emitted_events: &'static [ModelEventKind],
    pub version_column: Option<&'static str>,
    pub audit_enabled: bool,
    pub pii_columns: &'static [&'static str],
    pub sensitive_columns: &'static [&'static str],
    pub soft_delete_column: Option<&'static str>,
    pub retention_days: Option<u32>,
    pub upsert_update_columns: &'static [&'static str],
    /* private fields */
}

Fields

schema_name: &'static str

table_name: &'static str

columns: &'static [ModelColumn]

primary_key: &'static str

allowed_fields: &'static [&'static str]

allowed_includes: &'static [&'static str]

allowed_sorts: &'static [&'static str]

read_allow_policies: &'static [ReadPolicy]

read_deny_policies: &'static [ReadPolicy]

detail_allow_policies: &'static [ReadPolicy]

detail_deny_policies: &'static [ReadPolicy]

create_allow_policies: &'static [ReadPolicy]

create_deny_policies: &'static [ReadPolicy]

update_allow_policies: &'static [ReadPolicy]

update_deny_policies: &'static [ReadPolicy]

delete_allow_policies: &'static [ReadPolicy]

delete_deny_policies: &'static [ReadPolicy]

create_defaults: &'static [CreateDefault]

emitted_events: &'static [ModelEventKind]

version_column: Option<&'static str>

Column name of the optimistic-locking version field, set when the model declares an @version field. None for non-versioned models, which keeps update semantics unchanged.

audit_enabled: bool

true when the model declared @@audit. Mutations on audit-enabled models capture before/after snapshots and persist them into cratestack_audit inside the same transaction.

pii_columns: &'static [&'static str]

SQL column names of fields declared @pii. The audit-log writer replaces these values with "[redacted-pii]" in the persisted JSON snapshots; a follow-up will extend the same redaction to error detail and tracing.

sensitive_columns: &'static [&'static str]

SQL column names of fields declared @sensitive. Redacted in audit snapshots as "[redacted-sensitive]".

soft_delete_column: Option<&'static str>

Column name for the soft-delete timestamp. When Some, DELETE operations become UPDATE-of-deleted_at and every SELECT through push_scoped_conditions filters out rows where the column is non-null. Defaults to Some("deleted_at") when @@soft_delete is declared.

retention_days: Option<u32>

Retention window in days for soft-deleted rows. The runtime does not auto-GC; banks run their own scheduled job that deletes rows where deleted_at < NOW() - retention. Surfaced here so the GC can read the policy from one place.

upsert_update_columns: &'static [&'static str]

Columns the upsert primitive is allowed to overwrite on conflict. Populated by the macro to be every scalar column except the primary key, created_at, and the @version column. Empty when the model has no eligible columns (e.g. PK-only); in that case the macro doesn’t emit an UpsertModelInput impl either, so this is just a belt-and-braces.

Implementations

impl<M, PK> ModelDescriptor<M, PK>

pub const fn new( schema_name: &'static str, table_name: &'static str, columns: &'static [ModelColumn], primary_key: &'static str, allowed_fields: &'static [&'static str], allowed_includes: &'static [&'static str], allowed_sorts: &'static [&'static str], read_allow_policies: &'static [ReadPolicy], read_deny_policies: &'static [ReadPolicy], detail_allow_policies: &'static [ReadPolicy], detail_deny_policies: &'static [ReadPolicy], create_allow_policies: &'static [ReadPolicy], create_deny_policies: &'static [ReadPolicy], update_allow_policies: &'static [ReadPolicy], update_deny_policies: &'static [ReadPolicy], delete_allow_policies: &'static [ReadPolicy], delete_deny_policies: &'static [ReadPolicy], create_defaults: &'static [CreateDefault], emitted_events: &'static [ModelEventKind], version_column: Option<&'static str>, audit_enabled: bool, pii_columns: &'static [&'static str], sensitive_columns: &'static [&'static str], soft_delete_column: Option<&'static str>, retention_days: Option<u32>, upsert_update_columns: &'static [&'static str], ) -> ModelDescriptor<M, PK>

pub fn emits(&self, operation: ModelEventKind) -> bool

pub fn select_projection(&self) -> String

pub fn select_projection_subset(&self, columns: &[&str]) -> String

Like Self::select_projection but emits only the named columns, in the order they appear in the model descriptor. Unknown column names are silently dropped — the caller is expected to have validated the request via FieldRef already (typed-builder path) or via schema validation (string-name path). When no columns survive the filter, the primary key is emitted as a fallback so the SQL still binds at least one column to the projection.

Trait Implementations

impl<M, PK> Clone for ModelDescriptor<M, PK>

where M: Clone, PK: Clone,

fn clone(&self) -> ModelDescriptor<M, PK>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<M, PK> Debug for ModelDescriptor<M, PK>

where M: Debug, PK: Debug,

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl<M, PK> ReadSource<M, PK> for ModelDescriptor<M, PK>

fn schema_name(&self) -> &'static str

Logical schema name the model / view lives under. Currently always the dataset schema declared in datasource db { ... }; kept on the trait so future per-source schemas (e.g. analytics views in a dedicated schema) are a non-breaking change.

fn table_name(&self) -> &'static str

SQL identifier of the table or view this source reads from. Both backends quote it verbatim when constructing FROM clauses.

fn columns(&self) -> &'static [ModelColumn]

All projectable columns, ordered as the descriptor declares them. The read builder relies on this order when binding row decoders.

fn primary_key(&self) -> &'static str

SQL column name of the primary key. For views declared with @@no_unique (ADR-0003 §“Schema surface”) this is the empty string — find_unique is not emitted on the delegate so the builder never reads this slot.

fn allowed_fields(&self) -> &'static [&'static str]

Names accepted in where = { <name>: <op> } filter payloads — the same allow-list the model uses for read-policy scoping.

fn allowed_includes(&self) -> &'static [&'static str]

Names accepted in include = { <name>: ... } payloads. Empty on views in v1 (relation-follow off a view is out of scope — see ADR-0003 “Deferred”).

fn allowed_sorts(&self) -> &'static [&'static str]

Names accepted in orderBy = [ <name>, ... ] payloads.

fn read_allow_policies(&self) -> &'static [ReadPolicy]

@@allow("read", ...) policy literals for the list / search shape (returns one row per matching record).

fn read_deny_policies(&self) -> &'static [ReadPolicy]

@@deny("read", ...) policy literals for the list shape.

fn detail_allow_policies(&self) -> &'static [ReadPolicy]

@@allow("read", ...) policy literals for the detail shape (find_unique — returns at most one record). Models can carry stricter detail policies than list ones; views inherit a single set declared via @@allow("read", ...) on the view itself.

fn detail_deny_policies(&self) -> &'static [ReadPolicy]

@@deny("read", ...) policy literals for the detail shape.

fn soft_delete_column(&self) -> Option<&'static str>

Soft-delete sentinel column name. None on views (and on models without @@soft_delete), in which case the read builder skips the <col> IS NULL predicate it would otherwise inject.

fn select_projection(&self) -> String

Returns the <col> AS "<alias>", ... projection list the builder splices into SELECT. The default impl delegates to Self::columns so any descriptor that just stores a column list gets a working projection for free.

fn select_projection_subset(&self, columns: &[&str]) -> String

Like Self::select_projection but emits only the named columns. Unknown names are silently dropped — same contract as super::ModelDescriptor::select_projection_subset.

impl<M, PK> WriteSource<M, PK> for ModelDescriptor<M, PK>

fn create_allow_policies(&self) -> &'static [ReadPolicy]

fn create_deny_policies(&self) -> &'static [ReadPolicy]

fn update_allow_policies(&self) -> &'static [ReadPolicy]

fn update_deny_policies(&self) -> &'static [ReadPolicy]

fn delete_allow_policies(&self) -> &'static [ReadPolicy]

fn delete_deny_policies(&self) -> &'static [ReadPolicy]

fn create_defaults(&self) -> &'static [CreateDefault]

fn emitted_events(&self) -> &'static [ModelEventKind]

fn version_column(&self) -> Option<&'static str>

Optimistic-locking version column (@version). None for non-versioned models.

fn audit_enabled(&self) -> bool

true when the model declared @@audit.

fn pii_columns(&self) -> &'static [&'static str]

fn sensitive_columns(&self) -> &'static [&'static str]

fn retention_days(&self) -> Option<u32>

Soft-delete retention window. Surfaced here (alongside the soft-delete column on ReadSource) so the operator’s GC job can read both pieces from one place.

fn upsert_update_columns(&self) -> &'static [&'static str]

Columns the upsert primitive is allowed to overwrite on conflict.

impl<M, PK> Copy for ModelDescriptor<M, PK>

where M: Copy, PK: Copy,