fix(stack): preserve non-Error rejection detail on the wasm-inline entry

`withResult`'s default `ensureError` REPLACES any non-Error throw with
`new Error('Something went wrong')`, discarding the original value
(@byteslice/result@0.2.0, dist/result.js:27). But that is only the
FALLBACK — the library prefers an `onException` hook:

    const error = hooks?.onException?.(ex) ?? ensureError(ex)

Nothing in this repo passes it. On the native entry that rarely bites,
because the FFI throws real `ProtectError` instances. On WASM it is a
live hazard: wasm-bindgen rejects with the raw `JsValue` the Rust side
produced (`throw takeFromExternrefTable0(...)` in the generated glue),
and the WASM build exports no `ProtectError` class at all — so a genuine
FFI failure can arrive as a bare string or object.

That made the Result conversion in the previous commit a partial
REGRESSION: the old throwing behaviour at least propagated the raw value
to the caller, whereas `withResult` was silently swallowing it. Fixed by
supplying `onException`.

The six call sites now go through one `wasmResult()` seam that binds both
the failure shape and the hook, so a method added later cannot omit
either — an omission would not fail a build, it would just quietly
degrade failure messages, which is the whole bug.

`toError` preserves strings as-is, JSON-serializes objects (so
`{code, detail}` survives rather than becoming "[object Object]"), and
falls back to `String()` for cycles and other unserializable values.

+2 tests covering string and object preservation, plus the cyclic
fallback. 833 pass; 0 biome errors; zero new tsc errors (diffed against
main's error set, not counted).

Author: coderdan

packages/stack/__tests__/wasm-inline-result-contract.test.ts

@@ -120,16 +120,43 @@ describe('wasm-inline Result contract — failure path', () => {
     })
   })
 
-  // A non-Error throw still produces a well-formed `{ failure }`, but its
-  // message is LOST: `withResult`'s `ensureError` replaces any non-Error with
-  // `new Error('Something went wrong')` before `onError` ever sees it
-  // (@byteslice/result@0.2.0, `dist/result.js:27`). That is a library-wide
-  // characteristic — the native entry's `(error as Error).message` has it too
-  // — not something this entry can fix locally. Pinned so the behaviour is
-  // documented rather than surprising, and so the #532 bump to 0.5.0 shows up
-  // here as a failing test if the library starts passing the value through.
-  it('still returns a well-formed failure for a non-Error throw', async () => {
-    ffi.encrypt.mockRejectedValueOnce('just a string')
+  // Non-Error rejections must keep their detail. `withResult`'s default
+  // `ensureError` would replace them with `new Error('Something went wrong')`,
+  // discarding the value (@byteslice/result@0.2.0, `dist/result.js:27`) — so
+  // this entry passes the `onException` hook, which takes precedence.
+  //
+  // This is not hypothetical on WASM: wasm-bindgen rejects with the raw
+  // `JsValue` from Rust (`throw takeFromExternrefTable0(...)`), and the WASM
+  // build exports no `ProtectError` class, so a real FFI failure can arrive as
+  // a bare string or object. Losing it would be worse than the throwing
+  // behaviour this entry had before, which propagated the raw value.
+  it.each([
+    ['a string', 'boom from rust', 'boom from rust'],
+    [
+      'an object',
+      { code: 'EQL_X', detail: 'bad domain' },
+      '{"code":"EQL_X","detail":"bad domain"}',
+    ],
+  ])('preserves the detail of %s rejection', async (_label, thrown, expected) => {
+    ffi.encrypt.mockRejectedValueOnce(thrown)
+
+    const c = await client()
+    const result = await c.encrypt('a@b.com', {
+      table: users,
+      column: users.email,
+    })
+
+    expect(result.failure?.type).toBe('EncryptionError')
+    expect(result.failure?.message).toBe(expected)
+    expect(result.failure?.message).not.toBe('Something went wrong')
+  })
+
+  it('falls back to String() for a value JSON cannot serialize', async () => {
+    // A cycle makes JSON.stringify throw; the catch must still yield a
+    // well-formed failure rather than propagating a second error.
+    const cyclic: Record<string, unknown> = { a: 1 }
+    cyclic.self = cyclic
+    ffi.encrypt.mockRejectedValueOnce(cyclic)
 
     const c = await client()
     const result = await c.encrypt('a@b.com', {
@@ -138,6 +165,6 @@ describe('wasm-inline Result contract — failure path', () => {
     })
 
     expect(result.failure?.type).toBe('EncryptionError')
-    expect(result.failure?.message).toBe('Something went wrong')
+    expect(result.failure?.message).toBe('[object Object]')
   })
 })

packages/stack/src/wasm-inline.ts

@@ -350,16 +350,59 @@ function toFailure(
 ): (error: unknown) => EncryptionError {
   return (error: unknown) => ({
     type,
-    // In practice always an `Error`: `withResult`'s `ensureError` replaces any
-    // non-Error throw with `new Error('Something went wrong')` before this
-    // runs, discarding the original value (@byteslice/result@0.2.0). The
-    // narrowing is kept anyway — it is correct on its own terms, and the #532
-    // bump to 0.5.0 may start passing the raw value through.
     message: error instanceof Error ? error.message : String(error),
     code: getErrorCode(error),
   })
 }
 
+/**
+ * Coerce a rejection into an `Error` WITHOUT losing what it said.
+ *
+ * `withResult`'s built-in `ensureError` replaces any non-`Error` throw with
+ * `new Error('Something went wrong')`, discarding the original value entirely
+ * (@byteslice/result@0.2.0, `dist/result.js:27`). It is only the fallback,
+ * though — `withResult` prefers the `onException` hook:
+ *
+ * ```js
+ * const error = hooks?.onException?.(ex) ?? ensureError(ex)
+ * ```
+ *
+ * Supplying it matters more here than on the native entry. wasm-bindgen
+ * rejects with the raw `JsValue` the Rust side produced (`throw
+ * takeFromExternrefTable0(...)` in the generated glue), and the WASM build
+ * exports no `ProtectError` class, so a genuine FFI failure can arrive as a
+ * plain string or object rather than an `Error`. Without this hook its message
+ * would be replaced by boilerplate — strictly worse than the throwing
+ * behaviour this entry had before, which at least propagated the raw value.
+ */
+function toError(ex: unknown): Error {
+  if (ex instanceof Error) return ex
+  if (typeof ex === 'string') return new Error(ex)
+  try {
+    // Objects are the other shape wasm-bindgen hands back, so serialize rather
+    // than settle for "[object Object]". `JSON.stringify` returns undefined for
+    // a symbol/function and throws on a cycle — `String` covers both.
+    return new Error(JSON.stringify(ex) ?? String(ex))
+  } catch {
+    return new Error(String(ex))
+  }
+}
+
+/**
+ * `withResult` bound to this entry's conventions: the repo-wide failure shape
+ * ({@link toFailure}) plus the {@link toError} hook.
+ *
+ * One seam, so a method added later cannot silently omit either. Omitting them
+ * would not fail a build — it would quietly degrade failure messages, which is
+ * precisely the bug this helper exists to prevent.
+ */
+function wasmResult<T>(
+  operation: () => Promise<T>,
+  type: EncryptionError['type'],
+): Promise<Result<T, EncryptionError>> {
+  return withResult(operation, toFailure(type), { onException: toError })
+}
+
 /**
  * Guard the positional contract the bulk methods rely on.
  *
@@ -448,7 +491,7 @@ export class WasmEncryptionClient {
     plaintext: WasmPlaintext,
     opts: EncryptOptions,
   ): Promise<Result<Encrypted, EncryptionError>> {
-    return withResult(async () => {
+    return wasmResult(async () => {
       const ffiOpts = {
         plaintext,
         table: opts.table.tableName,
@@ -460,21 +503,21 @@ export class WasmEncryptionClient {
         // biome-ignore lint/plugin: the opts cross the serde boundary, whose shape protect-ffi types as `any`
         ffiOpts as never,
       )) as Encrypted
-    }, toFailure(EncryptionErrorTypes.EncryptionError))
+    }, EncryptionErrorTypes.EncryptionError)
   }
 
   async decrypt(
     encrypted: Encrypted,
   ): Promise<Result<WasmPlaintext, EncryptionError>> {
-    return withResult(
+    return wasmResult(
       async () =>
         (await wasmDecrypt(
           // biome-ignore lint/plugin: the FFI handle is an opaque wasm-bindgen pointer with no JS-side type
           this.client as never,
           // biome-ignore lint/plugin: the opts cross the serde boundary, whose shape protect-ffi types as `any`
           { ciphertext: encrypted } as never,
         )) as WasmPlaintext,
-      toFailure(EncryptionErrorTypes.DecryptionError),
+      EncryptionErrorTypes.DecryptionError,
     )
   }
 
@@ -557,15 +600,15 @@ export class WasmEncryptionClient {
     plaintext: WasmPlaintext,
     opts: WasmEncryptQueryOptions,
   ): Promise<Result<EncryptedQuery | null, EncryptionError>> {
-    return withResult(async () => {
+    return wasmResult(async () => {
       if (plaintext === null || plaintext === undefined) return null
       return (await wasmEncryptQuery(
         // biome-ignore lint/plugin: the FFI handle is an opaque wasm-bindgen pointer with no JS-side type
         this.client as never,
         // biome-ignore lint/plugin: the term crosses the serde boundary, whose shape protect-ffi types as `any`
         toFfiQueryTerm(plaintext, opts) as never,
       )) as EncryptedQuery
-    }, toFailure(EncryptionErrorTypes.EncryptionError))
+    }, EncryptionErrorTypes.EncryptionError)
   }
 
   /**
@@ -598,7 +641,7 @@ export class WasmEncryptionClient {
   async encryptQueryBulk(
     terms: readonly WasmQueryTerm[],
   ): Promise<Result<Array<EncryptedQuery | null>, EncryptionError>> {
-    return withResult(async () => {
+    return wasmResult(async () => {
       const live: Array<{ term: WasmQueryTerm; at: number }> = []
       terms.forEach((term, at) => {
         if (term.value !== null && term.value !== undefined)
@@ -626,7 +669,7 @@ export class WasmEncryptionClient {
         if (slot) out[slot.at] = value
       })
       return out
-    }, toFailure(EncryptionErrorTypes.EncryptionError))
+    }, EncryptionErrorTypes.EncryptionError)
   }
 
   /**
@@ -676,7 +719,7 @@ export class WasmEncryptionClient {
   async bulkEncrypt(
     items: readonly WasmBulkPlaintext[],
   ): Promise<Result<Array<Encrypted | null>, EncryptionError>> {
-    return withResult(async () => {
+    return wasmResult(async () => {
       const live: Array<{ item: WasmBulkPlaintext; at: number }> = []
       items.forEach((item, at) => {
         if (item.plaintext !== null && item.plaintext !== undefined)
@@ -710,7 +753,7 @@ export class WasmEncryptionClient {
         if (slot) out[slot.at] = value
       })
       return out
-    }, toFailure(EncryptionErrorTypes.EncryptionError))
+    }, EncryptionErrorTypes.EncryptionError)
   }
 
   /**
@@ -753,7 +796,7 @@ export class WasmEncryptionClient {
   async bulkDecrypt(
     ciphertexts: readonly (Encrypted | null | undefined)[],
   ): Promise<Result<Array<WasmPlaintext | null>, EncryptionError>> {
-    return withResult(async () => {
+    return wasmResult(async () => {
       const live: Array<{ ciphertext: Encrypted; at: number }> = []
       ciphertexts.forEach((ciphertext, at) => {
         if (ciphertext !== null && ciphertext !== undefined)
@@ -795,7 +838,7 @@ export class WasmEncryptionClient {
         )
       }
       return out
-    }, toFailure(EncryptionErrorTypes.DecryptionError))
+    }, EncryptionErrorTypes.DecryptionError)
   }
 }