@tinycloud/sdk-services 3.8.0-beta.1 → 3.8.0-beta.18

package/dist/{scope-Cg00IaWk.d.ts → scope-BZr0QwxX.d.ts}

@@ -1,4 +1,4 @@
-import { i as RetryStats, h as Result, F as FetchFunction } from './types-DAOyIbXu.js';
+import { i as RetryStats, f as Result, F as FetchFunction } from './types-CSd0RYir.js';
 import { REPLICA_KV_STORES } from './kv/replication/contractConstants.js';
 import { ReplicaConsentAnchor, ReplicaGrantPolicy } from './kv/replication/grantPolicyTypes.js';
 
@@ -591,7 +591,9 @@ type ReplicaGateReason =
 /** Browser only: the `localStorage` logout marker is set. */
  | "logout_pending"
 /** The gate store itself could not be read; fail closed. */
- | "gate_unavailable";
+ | "gate_unavailable"
+/** Browser: replication is configured but no wallet provider can prove the connected account. */
+ | "wallet_provider_required";
 /** Shape of every gate refusal error: `Error & { code: "REPLICA_GATED"; gate }`. */
 interface ReplicaGatedError extends Error {
     code: "REPLICA_GATED";
@@ -877,6 +879,63 @@ interface ReplicaLifecycleGate {
     }): Promise<ReplicaEraseReport>;
     /** Outstanding intents; non-empty means status `purgePending: true`. */
     pendingPurge(): Promise<ReplicaPurgeIntent[]>;
+    /**
+     * Browser only. Under the gate lock, erases pending intents and deletes the whole origin
+     * database. Deletes only when nothing live is at stake: the gate is denied (null principal),
+     * the gate is behind the persisted deny tombstone, or the logout marker is set with a tombstone.
+     * A live or other-account gate is `refused` and left untouched. On a failed delete it sets the
+     * logout marker (when a tombstone exists) so `recover` finishes the erase on the next load.
+     * Never clears the deny tombstone.
+     */
+    eraseLocalCopy?(o: {
+        signal: AbortSignal;
+    }): Promise<ReplicaLocalEraseOutcome>;
+}
+/** Result of {@link ReplicaLifecycleGate.eraseLocalCopy}. */
+type ReplicaLocalEraseOutcome = 
+/** The database is gone and the logout marker (if any) is cleared. */
+{
+    status: "erased";
+}
+/** Delete blocked or storage error; a retry can succeed. `marker` is true when the next-load marker is set. */
+ | {
+    status: "failed";
+    code: string;
+    marker: boolean;
+}
+/** The gate does not authorize destruction; nothing was deleted. A retry cannot succeed until the gate is denied. */
+ | {
+    status: "refused";
+    code: string;
+};
+/** What triggered a local-copy erase. */
+type ReplicaPurgeTrigger = "sign_out" | "account_switch" | "purge_local_copy";
+/** Result of `replication.purgeLocalCopy()`. `retryNow` means a short bounded retry is meaningful. */
+type ReplicaPurgeLocalCopyResult = {
+    ok: true;
+} | {
+    ok: false;
+    retryNow: boolean;
+};
+/**
+ * Emitted (`on("replica.purge.failed", …)`) when the local copy could not be erased after the
+ * bounded retries. The SDK finishes the erase on the next load through the logout marker.
+ */
+interface ReplicaPurgeFailedEvent {
+    type: "replica.purge.failed";
+    trigger: ReplicaPurgeTrigger;
+    /** Typed reason: `logout_pending` (marker set, erase retried on next load) or `gate_unavailable`. */
+    reason: ReplicaGateReason;
+    /** Storage error code of the last attempt. */
+    code: string;
+    /** True when a short bounded retry is meaningful (delete blocked or storage error). */
+    retryNow: boolean;
+}
+/** Rejection of `signOut()` when the deny itself was `unguarded` and the erase did not complete. */
+interface ReplicaPurgeError extends Error {
+    code: "REPLICA_PURGE_FAILED";
+    reason: ReplicaGateReason;
+    retryNow: boolean;
 }
 /** Node/CLI profile-local fencing token, not a secret capability; the profile lock remains authoritative. */
 interface ProfileReplicaDeferredToken {
@@ -1401,6 +1460,8 @@ interface KVReplicaSpec {
     grantPolicy?: ReplicaGrantPolicy;
     /** Quota settings; absent means unbounded. */
     quota?: ReplicaQuotaSpec;
+    /** Value download policy for syncs of this handle; absent means `"eager"`. See `ReplicationOptions.contentFetch`. */
+    contentFetch?: "eager" | "lazy";
     /**
      * Called when another tab/process commits a sync for this partition (browser: the worker's
      * `committed` BroadcastChannel message). The controller emits `replication.sync` with
@@ -1764,6 +1825,15 @@ interface ReplicationControl {
      * and committed records remain. Exposed callers MUST show CLEAR_PENDING_WARNING first.
      */
     clearPending(): Promise<number>;
+    /**
+     * Browser: erases the whole local copy (the IndexedDB database) once the account has been
+     * denied by sign-out or account switch; `signOut()` and account switch already do this. Retries
+     * a few times when the delete is blocked. `{ ok: false, retryNow: true }`: the copy is still
+     * there and a short bounded retry is meaningful (the deny outcome kept the keys, or the delete
+     * is blocked); the SDK also finishes the erase on the next load. `retryNow: false`: nothing is
+     * erasable now (a session is live, or the storage has no browser database). Never rejects.
+     */
+    purgeLocalCopy(): Promise<ReplicaPurgeLocalCopyResult>;
     close(): Promise<void>;
 }
 interface ReplicationOptions {
@@ -1774,6 +1844,11 @@ interface ReplicationOptions {
     allowSecrets?: boolean;
     /** Sign-in asks for kv/sync on each declared prefix only and never widens to a root entry that covers them. */
     syncScope?: "prefixes";
+    /**
+     * `"eager"` (default) downloads each changed value while syncing. `"lazy"` syncs entry names
+     * without downloading values; a read of a value the replica does not hold goes to the network.
+     */
+    contentFetch?: "eager" | "lazy";
     /** Background interval; default 60 seconds. */
     syncIntervalMs?: number;
     maxStalenessMs?: number;
@@ -1972,4 +2047,4 @@ declare function replicationIdentityKey(id: ReplicationIdentity): string;
 /** Whether replicating this space/prefix can copy encrypted secret material to disk. */
 declare function requiresSecretsOptIn(space: string, prefix: string): boolean;
 
-export { type ReplicaGuardedStore as $, type AuthorityRefusal as A, type ReplicaBrowserGateAccess as B, CLEAR_PENDING_WARNING as C, type ReplicaBrowserGateSnapshot as D, type ReplicaBrowserGateTx as E, type ReplicaBrowserPageAdmission as F, type ReplicaClock as G, type ReplicaCoverage as H, type ReplicaDeliveryDecision as I, type ReplicaDenyInput as J, type KVReplicationDeps as K, type LocalGetResult as L, type ReplicaDenyOutcome as M, type ReplicaDevice as N, type ReplicaEraseReport as O, type PendingWriteStore as P, type ReplicaGateAccess as Q, type ReplicationIdentity as R, type ReplicaGateReason as S, type ReplicaGateScope as T, type ReplicaGateSnapshot as U, type ReplicaGateTx as V, type ReplicaGatedError as W, type ReplicaGatedHandle as X, type ReplicaGatedSpec as Y, type ReplicaGatedStorage as Z, type ReplicaGrantInfo as _, type KVReplicationController as a, type ReplicaInspectedStatus as a0, type ReplicaLifecycleGate as a1, type ReplicaPageAdmission as a2, type ReplicaPartitionEraser as a3, type ReplicaPartitionIndexEntry as a4, type ReplicaPeerCommit as a5, type ReplicaPrivateGateHash as a6, type ReplicaPurgeIntent as a7, type ReplicaQuotaLedger as a8, type ReplicaQuotaSpec as a9, type KVChangesResponse as aA, type KVCreateSignedReadUrlOptions as aB, type KVDeleteOptions as aC, type KVGetOptions as aD, type KVHeadOptions as aE, type KVListOptions as aF, type KVListResponse as aG, type KVPutOptions as aH, type KVResponse as aI, type KVResponseHeaders as aJ, type KVServiceConfig as aK, type KVSignedReadUrlResponse as aL, type ReplicaSessionStamp as aa, type ReplicaStampedReply as ab, type ReplicaState as ac, type ReplicaStatusEntry as ad, type ReplicationAuthority as ae, type ReplicationControl as af, type ReplicationEvent as ag, type ReplicationOptions as ah, type ReplicationPurgeReport as ai, type ReplicationReason as aj, type ReplicationScheduler as ak, type ResolvedReplicationOptions as al, type SaltedHash as am, canonicalReplicationIdentity as an, replicationIdentityKey as ao, requiresSecretsOptIn as ap, DEFAULT_SIGNED_READ_URL_EXPIRY_MS as aq, KVAction as ar, type KVActionType as as, type KVBatchPutItem as at, type KVBatchPutOptions as au, type KVBatchPutResponse as av, type KVBatchReadResponse as aw, type KVChange as ax, type KVChangesAuthority as ay, type KVChangesOptions as az, type KVListPage as b, type KVReadThrough as c, type KVReplicaHandle as d, type KVReplicaSpec as e, type KVReplicaStorage as f, type LocalListResult as g, type LocalReadMeta as h, type LocalReplicaStatus as i, type LocalSyncResult as j, type PendingWriteRecord as k, type PendingWriteState as l, type PinnedKey as m, type ProfileReplicaApprovalEntry as n, type ProfileReplicaDeferredDenyOutcome as o, type ProfileReplicaDeferredToken as p, type ProfileReplicaLogoutPending as q, type ProfileReplicaPreflight as r, type ProfileReplicaPurge as s, type ProfileReplicaRemoteLogoutState as t, type ProfileReplicaRootIdentity as u, type ProfileReplicaUnknownEntry as v, type PurgeTarget as w, type ReplicaAccountGate as x, type ReplicaAdmitHook as y, type ReplicaAuthorityState as z };
+export { type ReplicaGuardedStore as $, type AuthorityRefusal as A, type ReplicaBrowserGateAccess as B, CLEAR_PENDING_WARNING as C, type ReplicaBrowserGateSnapshot as D, type ReplicaBrowserGateTx as E, type ReplicaBrowserPageAdmission as F, type ReplicaClock as G, type ReplicaCoverage as H, type ReplicaDeliveryDecision as I, type ReplicaDenyInput as J, type KVReplicationDeps as K, type LocalGetResult as L, type ReplicaDenyOutcome as M, type ReplicaDevice as N, type ReplicaEraseReport as O, type PendingWriteStore as P, type ReplicaGateAccess as Q, type ReplicationIdentity as R, type ReplicaGateReason as S, type ReplicaGateScope as T, type ReplicaGateSnapshot as U, type ReplicaGateTx as V, type ReplicaGatedError as W, type ReplicaGatedHandle as X, type ReplicaGatedSpec as Y, type ReplicaGatedStorage as Z, type ReplicaGrantInfo as _, type KVReplicationController as a, type ReplicaInspectedStatus as a0, type ReplicaLifecycleGate as a1, type ReplicaLocalEraseOutcome as a2, type ReplicaPageAdmission as a3, type ReplicaPartitionEraser as a4, type ReplicaPartitionIndexEntry as a5, type ReplicaPeerCommit as a6, type ReplicaPrivateGateHash as a7, type ReplicaPurgeError as a8, type ReplicaPurgeFailedEvent as a9, type KVBatchPutResponse as aA, type KVBatchReadResponse as aB, type KVChange as aC, type KVChangesAuthority as aD, type KVChangesOptions as aE, type KVChangesResponse as aF, type KVCreateSignedReadUrlOptions as aG, type KVDeleteOptions as aH, type KVGetOptions as aI, type KVHeadOptions as aJ, type KVListOptions as aK, type KVListResponse as aL, type KVPutOptions as aM, type KVResponse as aN, type KVResponseHeaders as aO, type KVServiceConfig as aP, type KVSignedReadUrlResponse as aQ, type ReplicaPurgeIntent as aa, type ReplicaPurgeLocalCopyResult as ab, type ReplicaPurgeTrigger as ac, type ReplicaQuotaLedger as ad, type ReplicaQuotaSpec as ae, type ReplicaSessionStamp as af, type ReplicaStampedReply as ag, type ReplicaState as ah, type ReplicaStatusEntry as ai, type ReplicationAuthority as aj, type ReplicationControl as ak, type ReplicationEvent as al, type ReplicationOptions as am, type ReplicationPurgeReport as an, type ReplicationReason as ao, type ReplicationScheduler as ap, type ResolvedReplicationOptions as aq, type SaltedHash as ar, canonicalReplicationIdentity as as, replicationIdentityKey as at, requiresSecretsOptIn as au, DEFAULT_SIGNED_READ_URL_EXPIRY_MS as av, KVAction as aw, type KVActionType as ax, type KVBatchPutItem as ay, type KVBatchPutOptions as az, type KVListPage as b, type KVReadThrough as c, type KVReplicaHandle as d, type KVReplicaSpec as e, type KVReplicaStorage as f, type LocalListResult as g, type LocalReadMeta as h, type LocalReplicaStatus as i, type LocalSyncResult as j, type PendingWriteRecord as k, type PendingWriteState as l, type PinnedKey as m, type ProfileReplicaApprovalEntry as n, type ProfileReplicaDeferredDenyOutcome as o, type ProfileReplicaDeferredToken as p, type ProfileReplicaLogoutPending as q, type ProfileReplicaPreflight as r, type ProfileReplicaPurge as s, type ProfileReplicaRemoteLogoutState as t, type ProfileReplicaRootIdentity as u, type ProfileReplicaUnknownEntry as v, type PurgeTarget as w, type ReplicaAccountGate as x, type ReplicaAdmitHook as y, type ReplicaAuthorityState as z };

package/dist/{scope-Cjo4O0uO.d.cts → scope-DEgc9f-W.d.cts}

@@ -1,4 +1,4 @@
-import { i as RetryStats, h as Result, F as FetchFunction } from './types-DAOyIbXu.cjs';
+import { i as RetryStats, f as Result, F as FetchFunction } from './types-CSd0RYir.cjs';
 import { REPLICA_KV_STORES } from './kv/replication/contractConstants.cjs';
 import { ReplicaConsentAnchor, ReplicaGrantPolicy } from './kv/replication/grantPolicyTypes.cjs';
 
@@ -591,7 +591,9 @@ type ReplicaGateReason =
 /** Browser only: the `localStorage` logout marker is set. */
  | "logout_pending"
 /** The gate store itself could not be read; fail closed. */
- | "gate_unavailable";
+ | "gate_unavailable"
+/** Browser: replication is configured but no wallet provider can prove the connected account. */
+ | "wallet_provider_required";
 /** Shape of every gate refusal error: `Error & { code: "REPLICA_GATED"; gate }`. */
 interface ReplicaGatedError extends Error {
     code: "REPLICA_GATED";
@@ -877,6 +879,63 @@ interface ReplicaLifecycleGate {
     }): Promise<ReplicaEraseReport>;
     /** Outstanding intents; non-empty means status `purgePending: true`. */
     pendingPurge(): Promise<ReplicaPurgeIntent[]>;
+    /**
+     * Browser only. Under the gate lock, erases pending intents and deletes the whole origin
+     * database. Deletes only when nothing live is at stake: the gate is denied (null principal),
+     * the gate is behind the persisted deny tombstone, or the logout marker is set with a tombstone.
+     * A live or other-account gate is `refused` and left untouched. On a failed delete it sets the
+     * logout marker (when a tombstone exists) so `recover` finishes the erase on the next load.
+     * Never clears the deny tombstone.
+     */
+    eraseLocalCopy?(o: {
+        signal: AbortSignal;
+    }): Promise<ReplicaLocalEraseOutcome>;
+}
+/** Result of {@link ReplicaLifecycleGate.eraseLocalCopy}. */
+type ReplicaLocalEraseOutcome = 
+/** The database is gone and the logout marker (if any) is cleared. */
+{
+    status: "erased";
+}
+/** Delete blocked or storage error; a retry can succeed. `marker` is true when the next-load marker is set. */
+ | {
+    status: "failed";
+    code: string;
+    marker: boolean;
+}
+/** The gate does not authorize destruction; nothing was deleted. A retry cannot succeed until the gate is denied. */
+ | {
+    status: "refused";
+    code: string;
+};
+/** What triggered a local-copy erase. */
+type ReplicaPurgeTrigger = "sign_out" | "account_switch" | "purge_local_copy";
+/** Result of `replication.purgeLocalCopy()`. `retryNow` means a short bounded retry is meaningful. */
+type ReplicaPurgeLocalCopyResult = {
+    ok: true;
+} | {
+    ok: false;
+    retryNow: boolean;
+};
+/**
+ * Emitted (`on("replica.purge.failed", …)`) when the local copy could not be erased after the
+ * bounded retries. The SDK finishes the erase on the next load through the logout marker.
+ */
+interface ReplicaPurgeFailedEvent {
+    type: "replica.purge.failed";
+    trigger: ReplicaPurgeTrigger;
+    /** Typed reason: `logout_pending` (marker set, erase retried on next load) or `gate_unavailable`. */
+    reason: ReplicaGateReason;
+    /** Storage error code of the last attempt. */
+    code: string;
+    /** True when a short bounded retry is meaningful (delete blocked or storage error). */
+    retryNow: boolean;
+}
+/** Rejection of `signOut()` when the deny itself was `unguarded` and the erase did not complete. */
+interface ReplicaPurgeError extends Error {
+    code: "REPLICA_PURGE_FAILED";
+    reason: ReplicaGateReason;
+    retryNow: boolean;
 }
 /** Node/CLI profile-local fencing token, not a secret capability; the profile lock remains authoritative. */
 interface ProfileReplicaDeferredToken {
@@ -1401,6 +1460,8 @@ interface KVReplicaSpec {
     grantPolicy?: ReplicaGrantPolicy;
     /** Quota settings; absent means unbounded. */
     quota?: ReplicaQuotaSpec;
+    /** Value download policy for syncs of this handle; absent means `"eager"`. See `ReplicationOptions.contentFetch`. */
+    contentFetch?: "eager" | "lazy";
     /**
      * Called when another tab/process commits a sync for this partition (browser: the worker's
      * `committed` BroadcastChannel message). The controller emits `replication.sync` with
@@ -1764,6 +1825,15 @@ interface ReplicationControl {
      * and committed records remain. Exposed callers MUST show CLEAR_PENDING_WARNING first.
      */
     clearPending(): Promise<number>;
+    /**
+     * Browser: erases the whole local copy (the IndexedDB database) once the account has been
+     * denied by sign-out or account switch; `signOut()` and account switch already do this. Retries
+     * a few times when the delete is blocked. `{ ok: false, retryNow: true }`: the copy is still
+     * there and a short bounded retry is meaningful (the deny outcome kept the keys, or the delete
+     * is blocked); the SDK also finishes the erase on the next load. `retryNow: false`: nothing is
+     * erasable now (a session is live, or the storage has no browser database). Never rejects.
+     */
+    purgeLocalCopy(): Promise<ReplicaPurgeLocalCopyResult>;
     close(): Promise<void>;
 }
 interface ReplicationOptions {
@@ -1774,6 +1844,11 @@ interface ReplicationOptions {
     allowSecrets?: boolean;
     /** Sign-in asks for kv/sync on each declared prefix only and never widens to a root entry that covers them. */
     syncScope?: "prefixes";
+    /**
+     * `"eager"` (default) downloads each changed value while syncing. `"lazy"` syncs entry names
+     * without downloading values; a read of a value the replica does not hold goes to the network.
+     */
+    contentFetch?: "eager" | "lazy";
     /** Background interval; default 60 seconds. */
     syncIntervalMs?: number;
     maxStalenessMs?: number;
@@ -1972,4 +2047,4 @@ declare function replicationIdentityKey(id: ReplicationIdentity): string;
 /** Whether replicating this space/prefix can copy encrypted secret material to disk. */
 declare function requiresSecretsOptIn(space: string, prefix: string): boolean;
 
-export { type ReplicaGuardedStore as $, type AuthorityRefusal as A, type ReplicaBrowserGateAccess as B, CLEAR_PENDING_WARNING as C, type ReplicaBrowserGateSnapshot as D, type ReplicaBrowserGateTx as E, type ReplicaBrowserPageAdmission as F, type ReplicaClock as G, type ReplicaCoverage as H, type ReplicaDeliveryDecision as I, type ReplicaDenyInput as J, type KVReplicationDeps as K, type LocalGetResult as L, type ReplicaDenyOutcome as M, type ReplicaDevice as N, type ReplicaEraseReport as O, type PendingWriteStore as P, type ReplicaGateAccess as Q, type ReplicationIdentity as R, type ReplicaGateReason as S, type ReplicaGateScope as T, type ReplicaGateSnapshot as U, type ReplicaGateTx as V, type ReplicaGatedError as W, type ReplicaGatedHandle as X, type ReplicaGatedSpec as Y, type ReplicaGatedStorage as Z, type ReplicaGrantInfo as _, type KVReplicationController as a, type ReplicaInspectedStatus as a0, type ReplicaLifecycleGate as a1, type ReplicaPageAdmission as a2, type ReplicaPartitionEraser as a3, type ReplicaPartitionIndexEntry as a4, type ReplicaPeerCommit as a5, type ReplicaPrivateGateHash as a6, type ReplicaPurgeIntent as a7, type ReplicaQuotaLedger as a8, type ReplicaQuotaSpec as a9, type KVChangesResponse as aA, type KVCreateSignedReadUrlOptions as aB, type KVDeleteOptions as aC, type KVGetOptions as aD, type KVHeadOptions as aE, type KVListOptions as aF, type KVListResponse as aG, type KVPutOptions as aH, type KVResponse as aI, type KVResponseHeaders as aJ, type KVServiceConfig as aK, type KVSignedReadUrlResponse as aL, type ReplicaSessionStamp as aa, type ReplicaStampedReply as ab, type ReplicaState as ac, type ReplicaStatusEntry as ad, type ReplicationAuthority as ae, type ReplicationControl as af, type ReplicationEvent as ag, type ReplicationOptions as ah, type ReplicationPurgeReport as ai, type ReplicationReason as aj, type ReplicationScheduler as ak, type ResolvedReplicationOptions as al, type SaltedHash as am, canonicalReplicationIdentity as an, replicationIdentityKey as ao, requiresSecretsOptIn as ap, DEFAULT_SIGNED_READ_URL_EXPIRY_MS as aq, KVAction as ar, type KVActionType as as, type KVBatchPutItem as at, type KVBatchPutOptions as au, type KVBatchPutResponse as av, type KVBatchReadResponse as aw, type KVChange as ax, type KVChangesAuthority as ay, type KVChangesOptions as az, type KVListPage as b, type KVReadThrough as c, type KVReplicaHandle as d, type KVReplicaSpec as e, type KVReplicaStorage as f, type LocalListResult as g, type LocalReadMeta as h, type LocalReplicaStatus as i, type LocalSyncResult as j, type PendingWriteRecord as k, type PendingWriteState as l, type PinnedKey as m, type ProfileReplicaApprovalEntry as n, type ProfileReplicaDeferredDenyOutcome as o, type ProfileReplicaDeferredToken as p, type ProfileReplicaLogoutPending as q, type ProfileReplicaPreflight as r, type ProfileReplicaPurge as s, type ProfileReplicaRemoteLogoutState as t, type ProfileReplicaRootIdentity as u, type ProfileReplicaUnknownEntry as v, type PurgeTarget as w, type ReplicaAccountGate as x, type ReplicaAdmitHook as y, type ReplicaAuthorityState as z };
+export { type ReplicaGuardedStore as $, type AuthorityRefusal as A, type ReplicaBrowserGateAccess as B, CLEAR_PENDING_WARNING as C, type ReplicaBrowserGateSnapshot as D, type ReplicaBrowserGateTx as E, type ReplicaBrowserPageAdmission as F, type ReplicaClock as G, type ReplicaCoverage as H, type ReplicaDeliveryDecision as I, type ReplicaDenyInput as J, type KVReplicationDeps as K, type LocalGetResult as L, type ReplicaDenyOutcome as M, type ReplicaDevice as N, type ReplicaEraseReport as O, type PendingWriteStore as P, type ReplicaGateAccess as Q, type ReplicationIdentity as R, type ReplicaGateReason as S, type ReplicaGateScope as T, type ReplicaGateSnapshot as U, type ReplicaGateTx as V, type ReplicaGatedError as W, type ReplicaGatedHandle as X, type ReplicaGatedSpec as Y, type ReplicaGatedStorage as Z, type ReplicaGrantInfo as _, type KVReplicationController as a, type ReplicaInspectedStatus as a0, type ReplicaLifecycleGate as a1, type ReplicaLocalEraseOutcome as a2, type ReplicaPageAdmission as a3, type ReplicaPartitionEraser as a4, type ReplicaPartitionIndexEntry as a5, type ReplicaPeerCommit as a6, type ReplicaPrivateGateHash as a7, type ReplicaPurgeError as a8, type ReplicaPurgeFailedEvent as a9, type KVBatchPutResponse as aA, type KVBatchReadResponse as aB, type KVChange as aC, type KVChangesAuthority as aD, type KVChangesOptions as aE, type KVChangesResponse as aF, type KVCreateSignedReadUrlOptions as aG, type KVDeleteOptions as aH, type KVGetOptions as aI, type KVHeadOptions as aJ, type KVListOptions as aK, type KVListResponse as aL, type KVPutOptions as aM, type KVResponse as aN, type KVResponseHeaders as aO, type KVServiceConfig as aP, type KVSignedReadUrlResponse as aQ, type ReplicaPurgeIntent as aa, type ReplicaPurgeLocalCopyResult as ab, type ReplicaPurgeTrigger as ac, type ReplicaQuotaLedger as ad, type ReplicaQuotaSpec as ae, type ReplicaSessionStamp as af, type ReplicaStampedReply as ag, type ReplicaState as ah, type ReplicaStatusEntry as ai, type ReplicationAuthority as aj, type ReplicationControl as ak, type ReplicationEvent as al, type ReplicationOptions as am, type ReplicationPurgeReport as an, type ReplicationReason as ao, type ReplicationScheduler as ap, type ResolvedReplicationOptions as aq, type SaltedHash as ar, canonicalReplicationIdentity as as, replicationIdentityKey as at, requiresSecretsOptIn as au, DEFAULT_SIGNED_READ_URL_EXPIRY_MS as av, KVAction as aw, type KVActionType as ax, type KVBatchPutItem as ay, type KVBatchPutOptions as az, type KVListPage as b, type KVReadThrough as c, type KVReplicaHandle as d, type KVReplicaSpec as e, type KVReplicaStorage as f, type LocalListResult as g, type LocalReadMeta as h, type LocalReplicaStatus as i, type LocalSyncResult as j, type PendingWriteRecord as k, type PendingWriteState as l, type PinnedKey as m, type ProfileReplicaApprovalEntry as n, type ProfileReplicaDeferredDenyOutcome as o, type ProfileReplicaDeferredToken as p, type ProfileReplicaLogoutPending as q, type ProfileReplicaPreflight as r, type ProfileReplicaPurge as s, type ProfileReplicaRemoteLogoutState as t, type ProfileReplicaRootIdentity as u, type ProfileReplicaUnknownEntry as v, type PurgeTarget as w, type ReplicaAccountGate as x, type ReplicaAdmitHook as y, type ReplicaAuthorityState as z };

package/dist/sql/index.cjs

@@ -770,12 +770,13 @@ var SQLService = class extends BaseService {
           request.signal
         );
         if (!response.ok) {
-          return await this.handleErrorResponse(response, "query", dbName, [action]);
+          const failure = await this.handleErrorResponse(response, "query", dbName, [action]);
+          return this.redactFailure(failure, options?.redactErrors, response.status);
         }
         const data = await response.json();
         return ok(data);
       } catch (error) {
-        return err(wrapError("sql", error));
+        return this.redactFailure(err(wrapError("sql", error)), options?.redactErrors);
       } finally {
         request.dispose();
       }
@@ -810,12 +811,13 @@ var SQLService = class extends BaseService {
           request.signal
         );
         if (!response.ok) {
-          return await this.handleErrorResponse(response, "execute", dbName, requestedActions);
+          const failure = await this.handleErrorResponse(response, "execute", dbName, requestedActions);
+          return this.redactFailure(failure, options?.redactErrors, response.status);
         }
         const data = await response.json();
         return ok(data);
       } catch (error) {
-        return err(wrapError("sql", error));
+        return this.redactFailure(err(wrapError("sql", error)), options?.redactErrors);
       } finally {
         request.dispose();
       }
@@ -836,12 +838,13 @@ var SQLService = class extends BaseService {
           request.signal
         );
         if (!response.ok) {
-          return await this.handleErrorResponse(response, "batch", dbName, requestedActions);
+          const failure = await this.handleErrorResponse(response, "batch", dbName, requestedActions);
+          return this.redactFailure(failure, options?.redactErrors, response.status);
         }
         const data = await response.json();
         return ok(data);
       } catch (error) {
-        return err(wrapError("sql", error));
+        return this.redactFailure(err(wrapError("sql", error)), options?.redactErrors);
       } finally {
         request.dispose();
       }
@@ -1037,6 +1040,18 @@ var SQLService = class extends BaseService {
       }))
     );
   }
+  redactFailure(result, redactErrors, status) {
+    if (!redactErrors || result.ok) return result;
+    const candidate = result.error.code;
+    const code = typeof candidate === "string" && Object.prototype.hasOwnProperty.call(ErrorCodes, candidate) ? candidate : ErrorCodes.SQL_ERROR;
+    const safeStatus = typeof status === "number" && Number.isInteger(status) && status >= 400 && status <= 599 ? status : void 0;
+    return err(serviceError(
+      code,
+      "SQL operation failed",
+      "sql",
+      safeStatus === void 0 ? void 0 : { meta: { status: safeStatus } }
+    ));
+  }
   async handleErrorResponse(response, operation, dbName, requestedActions) {
     const errorText = await response.text();
     const meta = responseErrorMeta(response.status, response.statusText, errorText);