fix(cli): stop leaking a mutated Error.prepareStackTrace from config loading

loadMetaobjectsConfig permanently mutated the process-global
Error.prepareStackTrace. When Bun's native import of a config fails (a config
whose module body throws, say), jiti falls back to its bundled Babel
transformer, whose rewrite-stack-trace installs a prepareStackTrace wrapper
delegating to whatever it captured — and never restores it. On Node the
captured value is undefined, so Babel's lenient fallback runs and nothing is
harmed. On Bun it is Bun's NATIVE default, which throws
`TypeError: First argument must be an Error object` for any target that is not
a real ErrorInstance.

Once leaked, every later legacy-constructor error in the process throws that
TypeError WHILE BEING CONSTRUCTED, destroying its real message. libsql's
SqliteError is exactly that shape (ES5 constructor + Error.captureStackTrace),
so a genuine "CHECK constraint failed: …" surfaced as "First argument must be
an Error object". The loader now snapshots and restores the hook (and
stackTraceLimit); restoring is safe because Babel's installer self-neuters
after its first call.

How it hid is the more useful part: the damage is cross-package, and every CI
lane runs `bun test` PER PACKAGE, so cli and migrate-ts never shared a process.
Only a workspace-wide `bun test` — the run the contributor docs invite — showed
it, as four migrate-ts real-engine gates failing on their error-MESSAGE
assertions while the migrate engine behaved correctly. No migration-correctness
defect was masked: the constraints fired and every apply → introspect →
re-diff-EMPTY loop completed.

Also hardens three assertions in sqlite-uuid-pk-kitchen-sink that were not
merely weak but VACUOUS: `expect(p).rejects.toThrow()` without `await` returns
a promise and never gates the test, so three "VALUE SEMANTICS" checks asserted
nothing and passed throughout the pollution. Now awaited and matched on /CHECK/i.

The workspace-wide suite is green for the first time: 5763 pass, 24 skip,
0 fail across 652 files (was 4 fail). Fix and regression test are
mutation-verified — both tests fail with the restore removed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KTGT5ksntpcJDZVJ5VyXHS

Author: dmealing

CHANGELOG.md

@@ -7,6 +7,39 @@ this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 
 ## [Unreleased]
 
+### Fixed — loading a `metaobjects.config.ts` could permanently corrupt error reporting for the rest of the process (npm)
+
+`loadMetaobjectsConfig` leaked a mutation of the process-global `Error.prepareStackTrace`.
+When Bun's native import of the config fails — a config whose module body throws, for
+instance — jiti falls back to its bundled Babel transformer, whose `rewrite-stack-trace`
+**permanently** installs a `prepareStackTrace` wrapper delegating to whatever value it
+captured. On Node that value is `undefined`, so Babel's own lenient fallback runs and
+nothing is harmed. On Bun it is Bun's **native default**, which throws
+`TypeError: First argument must be an Error object` for any target that is not a real
+`ErrorInstance`.
+
+Once that wrapper leaks, every subsequent *legacy-constructor* error in the process throws
+that `TypeError` **while being constructed**, destroying its real message. libsql's
+`SqliteError` is exactly that shape (an ES5-style constructor calling
+`Error.captureStackTrace`), so a genuine `CHECK constraint failed: …` surfaced as
+`First argument must be an Error object` instead.
+
+The loader now snapshots and restores `Error.prepareStackTrace` (and `stackTraceLimit`)
+around the jiti call. Restoring is safe — Babel's installer self-neuters after its first
+call, so dropping the wrapper costs only cosmetic frame-hiding in later Babel diagnostics.
+
+**How it stayed hidden, which is the more useful part:** the damage is cross-package, and
+every CI lane runs `bun test` **per package** (`scripts/ci-local.sh`, `conformance.yml`,
+`integration-tests.yml`), so `cli` and `migrate-ts` never shared a process. In a
+workspace-wide `bun test` — the run the contributor docs invite — four `migrate-ts`
+real-engine gates failed on their error-*message* assertions while the migrate engine was
+behaving correctly. Sibling tests using a bare, pattern-less `rejects.toThrow()` passed
+throughout, because the substituted `TypeError` still satisfies them.
+
+No migration-correctness defect was masked: in every case the constraint fired and the
+apply → introspect → re-diff-EMPTY loop completed. Gated by a loader-seam regression test
+that pins both the hook identity and the end-to-end consequence.
+
 ## [0.21.3] — npm `0.21.3` · PyPI `0.21.3` · NuGet `0.21.3` · Maven `7.21.3`
 
 Coordinated PATCH. **Changed product code: Maven and npm.** PyPI and NuGet are version-parity

server/typescript/packages/cli/src/lib/load-metaobjects-config.ts

@@ -209,6 +209,19 @@ export async function loadMetaobjectsConfig(projectRoot: string): Promise<Metaob
     alias: aliasMap,
   });
 
+  // Global-hooks hygiene. When Bun's native import of the config fails (e.g. a config
+  // whose module body throws), jiti falls back to its bundled Babel transformer, whose
+  // rewrite-stack-trace PERMANENTLY replaces `Error.prepareStackTrace` with a wrapper
+  // delegating to whatever it captured. On Node that captured value is `undefined`, so
+  // Babel's own lenient fallback runs and nothing is harmed. On Bun it is Bun's NATIVE
+  // default, which throws `TypeError: First argument must be an Error object` for any
+  // target that is not a real ErrorInstance — so once the wrapper leaks, every later
+  // legacy-constructor error in the process (libsql's `SqliteError` is one:
+  // an ES5-style constructor calling `Error.captureStackTrace`) throws that TypeError
+  // *while being constructed*, replacing its real message. Snapshot and restore so
+  // loading a config can never mutate the process's error hooks.
+  const prepareStackTraceBefore = Error.prepareStackTrace;
+  const stackTraceLimitBefore = Error.stackTraceLimit;
   try {
     const raw = (await jiti.import(loadPath)) as MetaobjectsGenConfig | { default: MetaobjectsGenConfig };
     // jiti's interopDefault doesn't always unwrap the default export when accessed
@@ -221,6 +234,14 @@ export async function loadMetaobjectsConfig(projectRoot: string): Promise<Metaob
     }
     return cfg;
   } finally {
+    // Restoring is safe: Babel's installer self-neuters after the first call, so
+    // dropping its wrapper only costs cosmetic frame-hiding in later Babel diagnostics.
+    if (Error.prepareStackTrace !== prepareStackTraceBefore) {
+      Error.prepareStackTrace = prepareStackTraceBefore;
+    }
+    if (Error.stackTraceLimit !== stackTraceLimitBefore) {
+      Error.stackTraceLimit = stackTraceLimitBefore;
+    }
     if (tempCreated) {
       try { unlinkSync(loadPath); } catch { /* best-effort cleanup */ }
     }

server/typescript/packages/cli/test/unit/load-config-global-hygiene.test.ts

@@ -0,0 +1,60 @@
+// Global-state hygiene at the config-loader seam.
+//
+// Loading a `metaobjects.config.ts` must not mutate `Error.prepareStackTrace`.
+// Under Bun, when native import of the config fails, jiti falls back to its bundled
+// Babel transformer, whose rewrite-stack-trace permanently installs a
+// `prepareStackTrace` wrapper delegating to the value it captured. On Node that value
+// is `undefined` (harmless); on Bun it is Bun's NATIVE default, which throws
+// `TypeError: First argument must be an Error object` for anything that is not a real
+// ErrorInstance. Once leaked, every later legacy-constructor error in the process
+// throws that TypeError *while being constructed* — libsql's `SqliteError` is exactly
+// that shape, so a real "CHECK constraint failed" became the TypeError instead.
+//
+// The observable damage: in any workspace-wide `bun test`, four migrate-ts real-engine
+// gates failed on their error-MESSAGE assertions while the engine was working
+// correctly. Every CI lane runs `bun test` per package, so `cli` and `migrate-ts` never
+// shared a process and the leak was invisible.
+
+import { describe, test, expect } from "bun:test";
+import { mkdtempSync, writeFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { loadMetaobjectsConfig } from "../../src/lib/load-metaobjects-config.js";
+
+describe("loadMetaobjectsConfig — global hooks hygiene", () => {
+  test("a throwing config surfaces its error AND leaves Error.prepareStackTrace untouched", async () => {
+    const before = Error.prepareStackTrace;
+    const dir = mkdtempSync(join(tmpdir(), "meta-config-hygiene-"));
+    try {
+      writeFileSync(join(dir, "metaobjects.config.ts"), "throw new Error('broken config boom');\n");
+      // The failure must still be reported — the fix restores a hook, it does not swallow.
+      await expect(loadMetaobjectsConfig(dir)).rejects.toThrow(/broken config boom/);
+      expect(Error.prepareStackTrace).toBe(before);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  test("a legacy-constructor error still carries its own message after a failed config load", async () => {
+    // The end-to-end consequence, independent of the hook identity above: this is the
+    // exact shape of libsql's SqliteError (ES5 constructor + Error.captureStackTrace).
+    const dir = mkdtempSync(join(tmpdir(), "meta-config-hygiene-legacy-"));
+    try {
+      writeFileSync(join(dir, "metaobjects.config.ts"), "throw new Error('broken config boom');\n");
+      await expect(loadMetaobjectsConfig(dir)).rejects.toThrow(/broken config boom/);
+
+      function LegacyError(this: Record<string, unknown>, msg: string) {
+        this["message"] = msg;
+        Error.captureStackTrace(this, LegacyError);
+      }
+      LegacyError.prototype = Object.create(Error.prototype);
+
+      const constructed = new (LegacyError as unknown as new (m: string) => { message: string })(
+        "CHECK constraint failed: things",
+      );
+      expect(constructed.message).toMatch(/CHECK constraint failed/);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});

server/typescript/packages/migrate-ts/test/integration/sqlite-uuid-pk-kitchen-sink.test.ts

@@ -221,7 +221,7 @@ describe("uuid-PK kitchen sink — SQLite/libsql", () => {
   test("VALUE SEMANTICS: the enum CHECK actually rejects a value outside @values", async () => {
     await migrate(original());
     await insertTakingDefaults("ok", "IMAGE");
-    expect(insertTakingDefaults("bad", "DOCUMENT")).rejects.toThrow();
+    await expect(insertTakingDefaults("bad", "DOCUMENT")).rejects.toThrow(/CHECK/i);
   });
 
   test("VALUE SEMANTICS: the partial UNIQUE index stays PARTIAL (its WHERE is not dropped)", async () => {
@@ -250,7 +250,7 @@ describe("uuid-PK kitchen sink — SQLite/libsql", () => {
     await migrate(original());
     await insertTakingDefaults("a", "IMAGE");
     // Before the change the CHECK must reject DOCUMENT.
-    expect(insertTakingDefaults("pre", "DOCUMENT")).rejects.toThrow();
+    await expect(insertTakingDefaults("pre", "DOCUMENT")).rejects.toThrow(/CHECK/i);
 
     // Widen @values on MediaAsset.kind.
     const json = JSON.parse(original());
@@ -282,7 +282,7 @@ describe("uuid-PK kitchen sink — SQLite/libsql", () => {
     expect(Number(n["c"])).toBe(1);
 
     // …a value still outside @values is STILL rejected (the CHECK was migrated, not dropped)…
-    expect(insertTakingDefaults("nope", "SPREADSHEET")).rejects.toThrow();
+    await expect(insertTakingDefaults("nope", "SPREADSHEET")).rejects.toThrow(/CHECK/i);
 
     // …and the schema converged.
     await assertConverged(expected, allow);