@veducio/keja 0.3.0 → 0.5.0

package/src/project/config.test.ts

@@ -100,12 +100,46 @@ describe("defineConfig", () => {
       token: "s.token",
       namespace: "apps",
       mount: "kv",
-      transit_key: null,
-      transit_mount: "transit",
-      grant_max_exp: 900,
     });
     expect(defineConfig().vault).toEqual({ enabled: false });
   });
+
+  it("reads grants and batch settings from config", () => {
+    expect(
+      defineConfig({
+        grants: {
+          enabled: true,
+          mode: "transit",
+          transit_key: "keja-grants",
+        },
+      }).grants,
+    ).toEqual({
+      enabled: true,
+      mode: "transit",
+      max_exp: 900,
+      transit_key: "keja-grants",
+      transit_mount: "transit",
+    });
+    expect(
+      defineConfig({
+        grants: {
+          enabled: true,
+          mode: "secret",
+          secret: "test-secret",
+        },
+      }).grants,
+    ).toEqual({
+      enabled: true,
+      mode: "secret",
+      max_exp: 900,
+      secret: "test-secret",
+      secret_vault: null,
+      secret_field: "secret",
+    });
+    expect(defineConfig({ batch: false }).batch).toEqual({ enabled: false });
+    expect(defineConfig().grants).toEqual({ enabled: false });
+    expect(defineConfig().batch).toEqual({ enabled: true });
+  });
 });
 
 describe("loadConfig", () => {
@@ -117,6 +151,8 @@ describe("loadConfig", () => {
       argus: { enabled: false },
       database: { enabled: false },
       vault: { enabled: false },
+      grants: { enabled: false },
+      batch: { enabled: true },
       versioning: path.resolve(root, "keja.versioning.ts"),
       public: path.resolve(root, "src/public"),
       service: path.resolve(root, "src/service"),

package/src/project/config.ts

@@ -49,9 +49,6 @@ export type VaultSettings = {
   token: string;
   namespace: string | null;
   mount: string;
-  transit_key: string | null;
-  transit_mount: string;
-  grant_max_exp: number;
 };
 
 export type VaultConfigInput = {
@@ -60,15 +57,45 @@ export type VaultConfigInput = {
   token?: string;
   namespace?: string;
   mount?: string;
-  transit_key?: string;
-  transit_mount?: string;
-  grant_max_exp?: number;
 };
 
 export type VaultConfig =
   | { enabled: false }
   | ({ enabled: true } & VaultSettings);
 
+export type GrantsConfigInput = {
+  enabled: boolean;
+  mode?: "transit" | "secret";
+  max_exp?: number;
+  transit_key?: string;
+  transit_mount?: string;
+  secret?: string;
+  secret_vault?: string;
+  secret_field?: string;
+};
+
+export type GrantsConfig =
+  | { enabled: false }
+  | {
+      enabled: true;
+      mode: "transit";
+      max_exp: number;
+      transit_key: string;
+      transit_mount: string;
+    }
+  | {
+      enabled: true;
+      mode: "secret";
+      max_exp: number;
+      secret: string | null;
+      secret_vault: string | null;
+      secret_field: string;
+    };
+
+export type BatchConfigInput = boolean | { enabled: boolean };
+
+export type BatchConfig = { enabled: boolean };
+
 export type KejaConfigInput = {
   name?: string;
   versioning?: string;
@@ -77,6 +104,8 @@ export type KejaConfigInput = {
   argus?: ArgusConfigInput;
   db?: DatabaseConfigInput;
   vault?: VaultConfigInput;
+  grants?: GrantsConfigInput;
+  batch?: BatchConfigInput;
 };
 
 export type KejaConfig = {
@@ -87,6 +116,8 @@ export type KejaConfig = {
   argus: ArgusConfig;
   database: DatabaseConfig;
   vault: VaultConfig;
+  grants: GrantsConfig;
+  batch: BatchConfig;
 };
 
 export function defineConfig(input: KejaConfigInput = {}) {
@@ -110,6 +141,8 @@ export function defineConfig(input: KejaConfigInput = {}) {
     argus: configArgus(input.argus),
     database: configDatabase(input.db),
     vault: configVault(input.vault),
+    grants: configGrants(input.grants),
+    batch: configBatch(input.batch),
   };
   return Object.assign(config, { [configBrand]: true as const });
 }
@@ -126,7 +159,9 @@ export function isConfig(value: unknown): value is KejaConfig {
     hasName(value) &&
     hasArgus(value) &&
     hasDatabase(value) &&
-    hasVault(value)
+    hasVault(value) &&
+    hasGrants(value) &&
+    hasBatch(value)
   );
 }
 
@@ -142,6 +177,8 @@ export type LoadedConfig = ProjectPaths & {
   argus: ArgusConfig;
   database: DatabaseConfig;
   vault: VaultConfig;
+  grants: GrantsConfig;
+  batch: BatchConfig;
 };
 
 export function resolveProjectPaths(root: string, config: KejaConfig) {
@@ -198,6 +235,8 @@ function loadedConfig(
     argus: config.argus,
     database: resolvedDatabase(root, config.database),
     vault: config.vault,
+    grants: config.grants,
+    batch: config.batch,
   };
 }
 
@@ -295,18 +334,90 @@ function configVault(value: VaultConfigInput | undefined): VaultConfig {
     ),
     namespace: optionalText(namespace, "vault.namespace", "namespace"),
     mount: vaultMount(value.mount ?? configEnv("VAULT_KV_MOUNT") ?? "secret"),
-    transit_key:
-      value.transit_key === undefined
-        ? null
-        : vaultName(value.transit_key, "vault.transit_key"),
-    transit_mount: vaultName(
-      value.transit_mount ?? "transit",
-      "vault.transit_mount",
+  };
+}
+
+function configGrants(value: GrantsConfigInput | undefined): GrantsConfig {
+  if (value === undefined) {
+    return { enabled: false };
+  }
+  if (!isEnabledObject(value)) {
+    throw projectError(
+      "invalidConfigFile",
+      "keja.config.ts grants must be an object with enabled",
+    );
+  }
+  if (!value.enabled) {
+    return { enabled: false };
+  }
+  const mode = value.mode ?? "transit";
+  if (mode !== "transit" && mode !== "secret") {
+    throw projectError(
+      "invalidConfigFile",
+      "keja.config.ts grants.mode must be transit or secret",
+    );
+  }
+  const max_exp = grantMaxExp(value.max_exp);
+  if (mode === "transit") {
+    return {
+      enabled: true,
+      mode: "transit",
+      max_exp,
+      transit_key: vaultName(
+        requiredText(value.transit_key, "grants.transit_key", "key name"),
+        "grants.transit_key",
+      ),
+      transit_mount: vaultName(
+        value.transit_mount ?? "transit",
+        "grants.transit_mount",
+      ),
+    };
+  }
+  const secret =
+    value.secret === undefined
+      ? (configEnv("GRANT_SECRET") ?? null)
+      : requiredText(value.secret, "grants.secret", "secret");
+  const secret_vault =
+    value.secret_vault === undefined
+      ? null
+      : secretVaultPath(
+          requiredText(value.secret_vault, "grants.secret_vault", "path"),
+        );
+  if (secret === null && secret_vault === null) {
+    throw projectError(
+      "invalidConfigFile",
+      "keja.config.ts grants.secret, GRANT_SECRET, or grants.secret_vault is required",
+    );
+  }
+  return {
+    enabled: true,
+    mode: "secret",
+    max_exp,
+    secret,
+    secret_vault,
+    secret_field: vaultName(
+      value.secret_field ?? "secret",
+      "grants.secret_field",
     ),
-    grant_max_exp: grantMaxExp(value.grant_max_exp),
   };
 }
 
+function configBatch(value: BatchConfigInput | undefined): BatchConfig {
+  if (value === undefined) {
+    return { enabled: true };
+  }
+  if (typeof value === "boolean") {
+    return { enabled: value };
+  }
+  if (!isEnabledObject(value)) {
+    throw projectError(
+      "invalidConfigFile",
+      "keja.config.ts batch must be a boolean or an object with enabled",
+    );
+  }
+  return { enabled: value.enabled };
+}
+
 function isEnabledObject(value: unknown): value is { enabled: boolean } {
   return (
     typeof value === "object" &&
@@ -354,6 +465,21 @@ function vaultName(value: string, field: string) {
   return name;
 }
 
+function secretVaultPath(value: string) {
+  const cleaned = value.trim().replace(/^\/+|\/+$/g, "");
+  const parts = cleaned.split("/");
+  if (
+    !cleaned ||
+    parts.some((part) => part.length === 0 || part === "." || part === "..")
+  ) {
+    throw projectError(
+      "invalidConfigFile",
+      "keja.config.ts grants.secret_vault must be a Vault secret path",
+    );
+  }
+  return cleaned;
+}
+
 function grantMaxExp(value: number | undefined) {
   if (value === undefined) {
     return 900;
@@ -366,7 +492,7 @@ function grantMaxExp(value: number | undefined) {
   ) {
     throw projectError(
       "invalidConfigFile",
-      "keja.config.ts vault.grant_max_exp must be a whole number of seconds from 1 to 86400",
+      "keja.config.ts grants.max_exp must be a whole number of seconds from 1 to 86400",
     );
   }
   return value;
@@ -435,6 +561,27 @@ function hasVault(value: object) {
   );
 }
 
+function hasGrants(value: object) {
+  const grants = (value as KejaConfig).grants;
+  return (
+    typeof grants === "object" &&
+    grants !== null &&
+    (grants.enabled === false ||
+      (grants.enabled === true &&
+        (grants.mode === "transit" || grants.mode === "secret") &&
+        typeof grants.max_exp === "number"))
+  );
+}
+
+function hasBatch(value: object) {
+  const batch = (value as KejaConfig).batch;
+  return (
+    typeof batch === "object" &&
+    batch !== null &&
+    typeof batch.enabled === "boolean"
+  );
+}
+
 function hasDatabase(value: object) {
   const database = (value as KejaConfig).database;
   return (

package/src/project/load.ts

@@ -11,7 +11,9 @@ import {
 import { isVersions, type VersionDefinition } from "../versioning/define.ts";
 import {
   type ArgusConfig,
+  type BatchConfig,
   type DatabaseConfig,
+  type GrantsConfig,
   loadConfig,
   type ProjectPaths,
   type VaultConfig,
@@ -23,6 +25,8 @@ export type LoadedProject = {
   name: string | null;
   argus: ArgusConfig;
   vault: VaultConfig;
+  grants: GrantsConfig;
+  batch: BatchConfig;
   database: DatabaseConfig;
   versions: VersionDefinition[];
   publicRoutes: RouteDefinition[];
@@ -58,6 +62,8 @@ export async function loadProject(
     name: loaded.name,
     argus: loaded.argus,
     vault: loaded.vault,
+    grants: loaded.grants,
+    batch: loaded.batch,
     database: loaded.database,
     versions: versioning.default.versions,
     publicRoutes: await loadRoutes(publicDirectory, generation),

package/src/repository/generate.test.ts

@@ -55,4 +55,20 @@ describe("renderRepositories", () => {
     );
     expect(source).toContain('list: { filters: ["name"], limit: 20 },');
   });
+
+  it("writes enum columns with their values", () => {
+    const tables = readTables([
+      {
+        file: "0001_example.sql",
+        sql: `
+          create type post_status as enum ('draft', 'published');
+          create table posts (${owned}, status post_status not null);
+        `,
+      },
+    ]);
+    const source = renderRepositories(tables, new Map());
+    expect(source).toContain(
+      'status: { type: "enum", values: ["draft", "published"], nullable: false },',
+    );
+  });
 });

package/src/repository/generate.ts

@@ -82,10 +82,7 @@ function renderRepository(
   flags: { list: ResolvedList; get: boolean } | undefined,
 ) {
   const columns = table.columns
-    .map(
-      (column) =>
-        `    ${column.name}: { type: "${column.type}", nullable: ${column.nullable} },`,
-    )
+    .map((column) => renderColumn(column))
     .join("\n");
   const options = [
     renderList(flags?.list),
@@ -115,3 +112,13 @@ function renderList(list: ResolvedList | undefined) {
   ].filter((part) => part !== "");
   return `  list: { ${parts.join(", ")} },`;
 }
+
+function renderColumn(column: TableSchema["columns"][number]) {
+  if (column.type === "enum") {
+    const values = column.values
+      .map((value) => JSON.stringify(value))
+      .join(", ");
+    return `    ${column.name}: { type: "enum", values: [${values}], nullable: ${column.nullable} },`;
+  }
+  return `    ${column.name}: { type: "${column.type}", nullable: ${column.nullable} },`;
+}

package/src/repository/query.ts

@@ -245,6 +245,11 @@ function parseValue(column: DomainColumn, value: string) {
     }
     return value;
   }
+  if (column.type === "enum" && !column.values.includes(value)) {
+    throw new Error(
+      `${column.name} filter must be ${column.values.join(", ")}`,
+    );
+  }
   return value;
 }
 

package/src/repository/runtime.test.ts

@@ -29,6 +29,23 @@ describe("repository", () => {
     }
   });
 
+  it("validates enum columns against declared values", () => {
+    const posts = repository({
+      table: "posts",
+      columns: {
+        status: {
+          type: "enum",
+          values: ["draft", "published"],
+          nullable: false,
+        },
+      },
+    });
+    expect(posts.schema.parse({ status: "draft" })).toEqual({
+      status: "draft",
+    });
+    expect(() => posts.schema.parse({ status: "archived" })).toThrow();
+  });
+
   it("exposes a row schema with and without meta", () => {
     const users = repository({ table: "users", columns });
     const at = new Date("2026-01-15T00:00:00.000Z");
@@ -38,6 +55,7 @@ describe("repository", () => {
       name: "Ada",
       email: "ada@example.com",
     });
+
     expect(
       users.meta.parse({
         ...row("users_a", "Ada"),

package/src/repository/runtime.ts

@@ -10,31 +10,42 @@ import {
 } from "./query.ts";
 import type { ColumnType, DomainColumn } from "./sql.ts";
 
-export type ColumnSpec = {
-  readonly type: ColumnType;
-  readonly nullable: boolean;
-};
+export type ColumnSpec =
+  | {
+      readonly type: Exclude<ColumnType, "enum">;
+      readonly nullable: boolean;
+    }
+  | {
+      readonly type: "enum";
+      readonly values: readonly [string, ...string[]];
+      readonly nullable: boolean;
+    };
 
-type TsValue<Type extends ColumnType> = Type extends "text"
-  ? string
-  : Type extends "boolean"
-    ? boolean
-    : Type extends "timestamptz"
-      ? Date
-      : Type extends "integer"
-        ? number
-        : Type extends "bigint"
-          ? string
-          : Type extends "numeric"
+type SpecValue<Spec extends ColumnSpec> = Spec extends {
+  type: "enum";
+  values: readonly (infer Value)[];
+}
+  ? Value
+  : Spec["type"] extends "text"
+    ? string
+    : Spec["type"] extends "boolean"
+      ? boolean
+      : Spec["type"] extends "timestamptz"
+        ? Date
+        : Spec["type"] extends "integer"
+          ? number
+          : Spec["type"] extends "bigint"
             ? string
-            : Type extends "jsonb"
-              ? unknown
-              : never;
+            : Spec["type"] extends "numeric"
+              ? string
+              : Spec["type"] extends "jsonb"
+                ? unknown
+                : never;
 
 export type DomainRow<Columns extends Record<string, ColumnSpec>> = {
   [Key in keyof Columns]: Columns[Key]["nullable"] extends true
-    ? TsValue<Columns[Key]["type"]> | null
-    : TsValue<Columns[Key]["type"]>;
+    ? SpecValue<Columns[Key]> | null
+    : SpecValue<Columns[Key]>;
 };
 
 export type RepositoryRow<Columns extends Record<string, ColumnSpec>> = {
@@ -133,11 +144,21 @@ export function repository<
 }): Repository<Columns> &
   (List extends false ? object : { list: ListProcessor<Columns, List> }) &
   (Get extends true ? { get: GetProcessor<Columns> } : object) {
-  const columns = Object.entries(input.columns).map(([name, column]) => ({
-    name,
-    type: column.type,
-    nullable: column.nullable,
-  }));
+  const columns = Object.entries(input.columns).map(
+    ([name, column]): DomainColumn =>
+      column.type === "enum"
+        ? {
+            name,
+            type: "enum",
+            nullable: column.nullable,
+            values: column.values,
+          }
+        : {
+            name,
+            type: column.type,
+            nullable: column.nullable,
+          },
+  );
   const shape = rowSchemas(columns);
   const base: Repository<Columns> = {
     table: input.table,
@@ -240,7 +261,7 @@ function listFilters(
 function rowSchemas(columns: readonly DomainColumn[]) {
   const domain: Record<string, z.ZodType> = {};
   for (const column of columns) {
-    domain[column.name] = columnSchema(column.type, column.nullable);
+    domain[column.name] = columnSchema(column);
   }
   return {
     schema: z.object(domain),
@@ -256,20 +277,22 @@ function rowSchemas(columns: readonly DomainColumn[]) {
   };
 }
 
-function columnSchema(type: ColumnType, nullable: boolean) {
+function columnSchema(column: DomainColumn) {
   const schema =
-    type === "boolean"
+    column.type === "boolean"
       ? z.boolean()
-      : type === "timestamptz"
+      : column.type === "timestamptz"
         ? z.date()
-        : type === "integer"
+        : column.type === "integer"
           ? z.number().int()
-          : type === "bigint" || type === "numeric"
+          : column.type === "bigint" || column.type === "numeric"
             ? z.string()
-            : type === "jsonb"
+            : column.type === "jsonb"
               ? z.unknown()
-              : z.string();
-  return nullable ? schema.nullable() : schema;
+              : column.type === "enum"
+                ? z.enum(column.values)
+                : z.string();
+  return column.nullable ? schema.nullable() : schema;
 }
 
 function builtQuerySort(sort: string | undefined) {

package/src/repository/sql.test.ts

@@ -75,4 +75,37 @@ describe("readTables", () => {
       ]),
     ).toThrow("users.photo has no TypeScript type");
   });
+
+  it("reads create type enums and columns that use them", () => {
+    const tables = readTables([
+      {
+        file: "0001_status.sql",
+        sql: `
+          create type post_status as enum ('draft', 'published');
+          create table posts (${owned}, status post_status not null);
+          alter type post_status add value 'archived';
+          alter table posts add column visibility post_status;
+        `,
+      },
+    ]);
+    expect(tables).toEqual([
+      {
+        name: "posts",
+        columns: [
+          {
+            name: "status",
+            type: "enum",
+            nullable: false,
+            values: ["draft", "published", "archived"],
+          },
+          {
+            name: "visibility",
+            type: "enum",
+            nullable: true,
+            values: ["draft", "published", "archived"],
+          },
+        ],
+      },
+    ]);
+  });
 });