fix: serialize configured fields without Bun array binding - #9

Summary

• serialize configured secret field names as a JSON scalar instead of binding JavaScript arrays directly to PostgreSQL text[] placeholders
• reconstruct the sorted text[] inside PostgreSQL with jsonb_array_elements_text
• apply the transport-safe conversion to both secret creation and replacement
• add regression assertions for SQL conversion and exact parameter shapes
• add a patch changeset

Root cause

The adapter previously passed:

Object.keys(payload).sort()

to placeholders cast as text[].

Bun's PostgreSQL client serializes that JavaScript array as:

clientId,clientSecret

rather than a PostgreSQL array literal such as:

{clientId,clientSecret}

PostgreSQL therefore rejects the write with SQLSTATE 22P02:

malformed array literal: "clientId,clientSecret"

The exception was caught by the provider boundary and surfaced to Studio as provider_error: Could not create the secret.

Fix

Configured field names are now sorted and serialized as JSON:

JSON.stringify(Object.keys(payload).sort())

PostgreSQL reconstructs the array in the statement:

array(select jsonb_array_elements_text($n::jsonb))

This keeps the adapter independent of Bun-specific SQL helpers, safely supports field names requiring escaping, and preserves the existing metadata schema and public result shape.

Evidence

The failure was reproduced directly against PostgreSQL 17.6 with Bun SQL:

await sql.unsafe(
  'select $1::text[] as configured_fields',
  [['clientId', 'clientSecret']],
);

which returns:

PostgresError: malformed array literal: "clientId,clientSecret"
DETAIL: Array value must start with "{" or dimension information.
SQLSTATE: 22P02

The same local Minikube database was independently verified to support:

• vault.create_secret(text,text,text)
• inserts into ankh_secret_store.secret_metadata
• the complete Vault-create plus metadata-insert transaction

Validation

Regression tests were added for:

• create uses a JSON string parameter, not a JavaScript array
• replace uses a JSON string parameter, not a JavaScript array
• configured fields remain sorted
• PostgreSQL reconstructs the text[] in SQL

Local lint, format, typecheck, build, and test commands are pending maintainer execution.

Closes #8