fix: serialize configured fields without Bun array binding

.changeset/calm-ravens-store.md

@@ -0,0 +1,5 @@
+---
+'@ankhorage/supabase-vault': patch
+---
+
+Serialize configured secret field names through JSON before reconstructing PostgreSQL text arrays, avoiding Bun malformed-array binding failures during secret creation and replacement.

README.md

@@ -3,7 +3,7 @@
 
 # SUPABASE-VAULT
 
-![license: MIT](././docs/badges/license.svg) ![npm: v0.2.0](././docs/badges/npm.svg) ![runtime: bun](././docs/badges/runtime.svg) ![typescript: strict](././docs/badges/typescript.svg) ![eslint: checked](././docs/badges/eslint.svg) ![prettier: checked](././docs/badges/prettier.svg) ![build: checked](././docs/badges/build.svg) ![tests: checked](././docs/badges/tests.svg) ![docs: paradox](././docs/badges/docs.svg)
+![license: MIT](././docs/badges/license.svg) ![npm: v0.2.2](././docs/badges/npm.svg) ![runtime: bun](././docs/badges/runtime.svg) ![typescript: strict](././docs/badges/typescript.svg) ![eslint: checked](././docs/badges/eslint.svg) ![prettier: checked](././docs/badges/prettier.svg) ![build: checked](././docs/badges/build.svg) ![tests: checked](././docs/badges/tests.svg) ![docs: paradox](././docs/badges/docs.svg)
 
 Server-only Supabase Vault secret-store adapter for Ankhorage.
 

docs/index.html

@@ -198,7 +198,7 @@ <h1>SUPABASE-VAULT</h1>
             <li>
               <button class="nav-button" type="button" data-target="src/adapter.ts">
                 src/adapter.ts
-                <small>11 functions</small>
+                <small>12 functions</small>
               </button>
             </li>
           </ul>
@@ -704,52 +704,57 @@ <h3>createSupabaseVaultAdapter</h3>
             </article>
             <article class="item" data-search="normalizeLookup src/adapter.ts ">
               <h3>normalizeLookup</h3>
-              <p class="muted"><code>src/adapter.ts:247:1</code></p>
+              <p class="muted"><code>src/adapter.ts:253:1</code></p>
               <p class="empty">No description available.</p>
             </article>
             <article class="item" data-search="normalizeWrite src/adapter.ts ">
               <h3>normalizeWrite</h3>
-              <p class="muted"><code>src/adapter.ts:255:1</code></p>
+              <p class="muted"><code>src/adapter.ts:261:1</code></p>
               <p class="empty">No description available.</p>
             </article>
             <article class="item" data-search="selectMetadata src/adapter.ts ">
               <h3>selectMetadata</h3>
-              <p class="muted"><code>src/adapter.ts:263:1</code></p>
+              <p class="muted"><code>src/adapter.ts:269:1</code></p>
               <p class="empty">No description available.</p>
             </article>
             <article class="item" data-search="selectInternalMetadata src/adapter.ts ">
               <h3>selectInternalMetadata</h3>
-              <p class="muted"><code>src/adapter.ts:278:1</code></p>
+              <p class="muted"><code>src/adapter.ts:284:1</code></p>
               <p class="empty">No description available.</p>
             </article>
             <article class="item" data-search="toMetadata src/adapter.ts ">
               <h3>toMetadata</h3>
-              <p class="muted"><code>src/adapter.ts:293:1</code></p>
+              <p class="muted"><code>src/adapter.ts:299:1</code></p>
+              <p class="empty">No description available.</p>
+            </article>
+            <article class="item" data-search="serializeConfiguredFields src/adapter.ts ">
+              <h3>serializeConfiguredFields</h3>
+              <p class="muted"><code>src/adapter.ts:311:1</code></p>
               <p class="empty">No description available.</p>
             </article>
             <article class="item" data-search="buildInternalName src/adapter.ts ">
               <h3>buildInternalName</h3>
-              <p class="muted"><code>src/adapter.ts:305:1</code></p>
+              <p class="muted"><code>src/adapter.ts:315:1</code></p>
               <p class="empty">No description available.</p>
             </article>
             <article class="item" data-search="parsePayload src/adapter.ts ">
               <h3>parsePayload</h3>
-              <p class="muted"><code>src/adapter.ts:309:1</code></p>
+              <p class="muted"><code>src/adapter.ts:319:1</code></p>
               <p class="empty">No description available.</p>
             </article>
             <article class="item" data-search="notFound src/adapter.ts ">
               <h3>notFound</h3>
-              <p class="muted"><code>src/adapter.ts:321:1</code></p>
+              <p class="muted"><code>src/adapter.ts:331:1</code></p>
               <p class="empty">No description available.</p>
             </article>
             <article class="item" data-search="conflict src/adapter.ts ">
               <h3>conflict</h3>
-              <p class="muted"><code>src/adapter.ts:328:1</code></p>
+              <p class="muted"><code>src/adapter.ts:338:1</code></p>
               <p class="empty">No description available.</p>
             </article>
             <article class="item" data-search="providerFailure src/adapter.ts ">
               <h3>providerFailure</h3>
-              <p class="muted"><code>src/adapter.ts:335:1</code></p>
+              <p class="muted"><code>src/adapter.ts:345:1</code></p>
               <p class="empty">No description available.</p>
             </article>
           </section>

docs/paradox.json

@@ -12,7 +12,7 @@
     {
       "id": "npm",
       "label": "npm",
-      "value": "v0.2.0",
+      "value": "v0.2.2",
       "color": "cb3837"
     },
     {
@@ -361,7 +361,7 @@
       "description": null,
       "sourceLocation": {
         "filePath": "src/adapter.ts",
-        "line": 247,
+        "line": 253,
         "column": 1
       }
     },
@@ -370,7 +370,7 @@
       "description": null,
       "sourceLocation": {
         "filePath": "src/adapter.ts",
-        "line": 255,
+        "line": 261,
         "column": 1
       }
     },
@@ -379,7 +379,7 @@
       "description": null,
       "sourceLocation": {
         "filePath": "src/adapter.ts",
-        "line": 263,
+        "line": 269,
         "column": 1
       }
     },
@@ -388,7 +388,7 @@
       "description": null,
       "sourceLocation": {
         "filePath": "src/adapter.ts",
-        "line": 278,
+        "line": 284,
         "column": 1
       }
     },
@@ -397,7 +397,16 @@
       "description": null,
       "sourceLocation": {
         "filePath": "src/adapter.ts",
-        "line": 293,
+        "line": 299,
+        "column": 1
+      }
+    },
+    {
+      "name": "serializeConfiguredFields",
+      "description": null,
+      "sourceLocation": {
+        "filePath": "src/adapter.ts",
+        "line": 311,
         "column": 1
       }
     },
@@ -406,7 +415,7 @@
       "description": null,
       "sourceLocation": {
         "filePath": "src/adapter.ts",
-        "line": 305,
+        "line": 315,
         "column": 1
       }
     },
@@ -415,7 +424,7 @@
       "description": null,
       "sourceLocation": {
         "filePath": "src/adapter.ts",
-        "line": 309,
+        "line": 319,
         "column": 1
       }
     },
@@ -424,7 +433,7 @@
       "description": null,
       "sourceLocation": {
         "filePath": "src/adapter.ts",
-        "line": 321,
+        "line": 331,
         "column": 1
       }
     },
@@ -433,7 +442,7 @@
       "description": null,
       "sourceLocation": {
         "filePath": "src/adapter.ts",
-        "line": 328,
+        "line": 338,
         "column": 1
       }
     },
@@ -442,7 +451,7 @@
       "description": null,
       "sourceLocation": {
         "filePath": "src/adapter.ts",
-        "line": 335,
+        "line": 345,
         "column": 1
       }
     }
@@ -576,6 +585,12 @@
         "callExpression": "providerFailure",
         "sourcePath": "src/adapter.ts"
       },
+      {
+        "fromSymbol": "src/adapter.ts",
+        "toSymbol": "serializeConfiguredFields",
+        "callExpression": "serializeConfiguredFields",
+        "sourcePath": "src/adapter.ts"
+      },
       {
         "fromSymbol": "src/adapter.ts",
         "toSymbol": "toMetadata",

src/adapter.test.ts

@@ -50,7 +50,7 @@ describe('createSupabaseVaultAdapter', () => {
       ref: 'auth/oauth/google',
       kind: 'oauth',
       provider: 'google',
-      payload: { clientId: 'public-id', clientSecret: 'SENTINEL_SECRET' },
+      payload: { clientSecret: 'SENTINEL_SECRET', clientId: 'public-id' },
     });
 
     expect(result).toEqual({
@@ -67,6 +67,11 @@ describe('createSupabaseVaultAdapter', () => {
     });
     expect(JSON.stringify(result)).not.toContain('SENTINEL_SECRET');
     expect(JSON.stringify(result)).not.toContain('vault-id');
+
+    const [, , insertCall] = client.calls;
+    expect(insertCall?.sql).toContain('array(select jsonb_array_elements_text($7::jsonb))');
+    expect(insertCall?.parameters[6]).toBe('["clientId","clientSecret"]');
+    expect(Array.isArray(insertCall?.parameters[6])).toBe(false);
   });
 
   test('scopes every lookup by project and environment', async () => {
@@ -97,6 +102,11 @@ describe('createSupabaseVaultAdapter', () => {
     expect(result.ok).toBe(true);
     expect(client.calls.some((call) => call.sql.includes('decrypted_secrets'))).toBe(false);
     expect(JSON.stringify(result)).not.toContain('ROTATED_SECRET');
+
+    const [, , updateCall] = client.calls;
+    expect(updateCall?.sql).toContain('select jsonb_array_elements_text($4::jsonb)');
+    expect(updateCall?.parameters[3]).toBe('["clientSecret"]');
+    expect(Array.isArray(updateCall?.parameters[3])).toBe(false);
   });
 
   test('resolves payload only through the trusted resolve operation', async () => {

src/adapter.ts

@@ -120,7 +120,10 @@ export function createSupabaseVaultAdapter(
           const inserted = await executor.query<MetadataRow>(
             `insert into ${metadataTable}
               (project_id, environment, secret_ref, vault_secret_id, kind, provider, configured_fields)
-             values ($1, $2, $3, $4::uuid, $5, $6, $7::text[])
+             values (
+               $1, $2, $3, $4::uuid, $5, $6,
+               array(select jsonb_array_elements_text($7::jsonb))
+             )
              returning project_id, environment, secret_ref, kind, provider, configured_fields,
                        created_at::text, updated_at::text`,
             [
@@ -130,7 +133,7 @@ export function createSupabaseVaultAdapter(
               vaultId,
               input.kind,
               input.provider ?? null,
-              Object.keys(normalized.data.payload).sort(),
+              serializeConfiguredFields(normalized.data.payload),
             ],
           );
 
@@ -164,15 +167,18 @@ export function createSupabaseVaultAdapter(
 
           const updated = await executor.query<MetadataRow>(
             `update ${metadataTable}
-                set configured_fields = $4::text[], updated_at = now()
+                set configured_fields = array(
+                      select jsonb_array_elements_text($4::jsonb)
+                    ),
+                    updated_at = now()
               where project_id = $1 and environment = $2 and secret_ref = $3
               returning project_id, environment, secret_ref, kind, provider, configured_fields,
                         created_at::text, updated_at::text`,
             [
               normalized.data.scope.projectId,
               normalized.data.scope.environment,
               normalized.data.ref,
-              Object.keys(normalized.data.payload).sort(),
+              serializeConfiguredFields(normalized.data.payload),
             ],
           );
 
@@ -302,6 +308,10 @@ function toMetadata(row: MetadataRow): SecretMetadata {
   };
 }
 
+function serializeConfiguredFields(payload: SecretPayload): string {
+  return JSON.stringify(Object.keys(payload).sort());
+}
+
 function buildInternalName(projectId: string, environment: string, ref: string): string {
   return `ankhorage/${encodeURIComponent(projectId)}/${encodeURIComponent(environment)}/${ref}`;
 }