@tinycloud/sdk-services 3.8.0-beta.16 → 3.8.0-beta.18

package/dist/internal/decrypt-transport-response-error.d.cts

@@ -1,4 +1,4 @@
-import { P as PermissionHint } from '../types-DAOyIbXu.cjs';
+import { P as PermissionHint } from '../types-CSd0RYir.cjs';
 
 /** A reachable node returned an HTTP failure for a decrypt request. */
 declare class DecryptTransportResponseError extends Error {

package/dist/internal/decrypt-transport-response-error.d.ts

@@ -1,4 +1,4 @@
-import { P as PermissionHint } from '../types-DAOyIbXu.js';
+import { P as PermissionHint } from '../types-CSd0RYir.js';
 
 /** A reachable node returned an HTTP failure for a decrypt request. */
 declare class DecryptTransportResponseError extends Error {

package/dist/kv/index.d.cts

@@ -1,7 +1,7 @@
-import { B as BaseService } from '../BaseService-D-29xShG.cjs';
-import { h as Result, c as IService } from '../types-DAOyIbXu.cjs';
-import { aI as KVGetOptions, aN as KVResponse, aB as KVBatchReadResponse, aM as KVPutOptions, ay as KVBatchPutItem, az as KVBatchPutOptions, aA as KVBatchPutResponse, aK as KVListOptions, aL as KVListResponse, aE as KVChangesOptions, aF as KVChangesResponse, aH as KVDeleteOptions, aJ as KVHeadOptions, aG as KVCreateSignedReadUrlOptions, aQ as KVSignedReadUrlResponse, aP as KVServiceConfig, c as KVReadThrough } from '../scope-Dv3IAXMr.cjs';
-export { A as AuthorityRefusal, C as CLEAR_PENDING_WARNING, av as DEFAULT_SIGNED_READ_URL_EXPIRY_MS, aw as KVAction, ax as KVActionType, aC as KVChange, aD as KVChangesAuthority, b as KVListPage, d as KVReplicaHandle, e as KVReplicaSpec, f as KVReplicaStorage, a as KVReplicationController, K as KVReplicationDeps, aO as KVResponseHeaders, L as LocalGetResult, g as LocalListResult, h as LocalReadMeta, i as LocalReplicaStatus, j as LocalSyncResult, k as PendingWriteRecord, l as PendingWriteState, P as PendingWriteStore, m as PinnedKey, w as PurgeTarget, z as ReplicaAuthorityState, H as ReplicaCoverage, N as ReplicaDevice, X as ReplicaGatedHandle, _ as ReplicaGrantInfo, a0 as ReplicaInspectedStatus, ah as ReplicaState, ai as ReplicaStatusEntry, aj as ReplicationAuthority, ak as ReplicationControl, al as ReplicationEvent, R as ReplicationIdentity, am as ReplicationOptions, an as ReplicationPurgeReport, ao as ReplicationReason, ap as ReplicationScheduler, aq as ResolvedReplicationOptions, as as canonicalReplicationIdentity, at as replicationIdentityKey, au as requiresSecretsOptIn } from '../scope-Dv3IAXMr.cjs';
+import { B as BaseService } from '../BaseService-O0iyuFLk.cjs';
+import { f as Result, c as IService } from '../types-CSd0RYir.cjs';
+import { aI as KVGetOptions, aN as KVResponse, aB as KVBatchReadResponse, aM as KVPutOptions, ay as KVBatchPutItem, az as KVBatchPutOptions, aA as KVBatchPutResponse, aK as KVListOptions, aL as KVListResponse, aE as KVChangesOptions, aF as KVChangesResponse, aH as KVDeleteOptions, aJ as KVHeadOptions, aG as KVCreateSignedReadUrlOptions, aQ as KVSignedReadUrlResponse, aP as KVServiceConfig, c as KVReadThrough } from '../scope-DEgc9f-W.cjs';
+export { A as AuthorityRefusal, C as CLEAR_PENDING_WARNING, av as DEFAULT_SIGNED_READ_URL_EXPIRY_MS, aw as KVAction, ax as KVActionType, aC as KVChange, aD as KVChangesAuthority, b as KVListPage, d as KVReplicaHandle, e as KVReplicaSpec, f as KVReplicaStorage, a as KVReplicationController, K as KVReplicationDeps, aO as KVResponseHeaders, L as LocalGetResult, g as LocalListResult, h as LocalReadMeta, i as LocalReplicaStatus, j as LocalSyncResult, k as PendingWriteRecord, l as PendingWriteState, P as PendingWriteStore, m as PinnedKey, w as PurgeTarget, z as ReplicaAuthorityState, H as ReplicaCoverage, N as ReplicaDevice, X as ReplicaGatedHandle, _ as ReplicaGrantInfo, a0 as ReplicaInspectedStatus, ah as ReplicaState, ai as ReplicaStatusEntry, aj as ReplicationAuthority, ak as ReplicationControl, al as ReplicationEvent, R as ReplicationIdentity, am as ReplicationOptions, an as ReplicationPurgeReport, ao as ReplicationReason, ap as ReplicationScheduler, aq as ResolvedReplicationOptions, as as canonicalReplicationIdentity, at as replicationIdentityKey, au as requiresSecretsOptIn } from '../scope-DEgc9f-W.cjs';
 export { kvPrefixCovers } from './replication/prefix.cjs';
 import './replication/contractConstants.cjs';
 import './replication/grantPolicyConstants.cjs';

package/dist/kv/index.d.ts

@@ -1,7 +1,7 @@
-import { B as BaseService } from '../BaseService-DO7vZ67k.js';
-import { h as Result, c as IService } from '../types-DAOyIbXu.js';
-import { aI as KVGetOptions, aN as KVResponse, aB as KVBatchReadResponse, aM as KVPutOptions, ay as KVBatchPutItem, az as KVBatchPutOptions, aA as KVBatchPutResponse, aK as KVListOptions, aL as KVListResponse, aE as KVChangesOptions, aF as KVChangesResponse, aH as KVDeleteOptions, aJ as KVHeadOptions, aG as KVCreateSignedReadUrlOptions, aQ as KVSignedReadUrlResponse, aP as KVServiceConfig, c as KVReadThrough } from '../scope-1-8skVDk.js';
-export { A as AuthorityRefusal, C as CLEAR_PENDING_WARNING, av as DEFAULT_SIGNED_READ_URL_EXPIRY_MS, aw as KVAction, ax as KVActionType, aC as KVChange, aD as KVChangesAuthority, b as KVListPage, d as KVReplicaHandle, e as KVReplicaSpec, f as KVReplicaStorage, a as KVReplicationController, K as KVReplicationDeps, aO as KVResponseHeaders, L as LocalGetResult, g as LocalListResult, h as LocalReadMeta, i as LocalReplicaStatus, j as LocalSyncResult, k as PendingWriteRecord, l as PendingWriteState, P as PendingWriteStore, m as PinnedKey, w as PurgeTarget, z as ReplicaAuthorityState, H as ReplicaCoverage, N as ReplicaDevice, X as ReplicaGatedHandle, _ as ReplicaGrantInfo, a0 as ReplicaInspectedStatus, ah as ReplicaState, ai as ReplicaStatusEntry, aj as ReplicationAuthority, ak as ReplicationControl, al as ReplicationEvent, R as ReplicationIdentity, am as ReplicationOptions, an as ReplicationPurgeReport, ao as ReplicationReason, ap as ReplicationScheduler, aq as ResolvedReplicationOptions, as as canonicalReplicationIdentity, at as replicationIdentityKey, au as requiresSecretsOptIn } from '../scope-1-8skVDk.js';
+import { B as BaseService } from '../BaseService-Ma2MwJAd.js';
+import { f as Result, c as IService } from '../types-CSd0RYir.js';
+import { aI as KVGetOptions, aN as KVResponse, aB as KVBatchReadResponse, aM as KVPutOptions, ay as KVBatchPutItem, az as KVBatchPutOptions, aA as KVBatchPutResponse, aK as KVListOptions, aL as KVListResponse, aE as KVChangesOptions, aF as KVChangesResponse, aH as KVDeleteOptions, aJ as KVHeadOptions, aG as KVCreateSignedReadUrlOptions, aQ as KVSignedReadUrlResponse, aP as KVServiceConfig, c as KVReadThrough } from '../scope-BZr0QwxX.js';
+export { A as AuthorityRefusal, C as CLEAR_PENDING_WARNING, av as DEFAULT_SIGNED_READ_URL_EXPIRY_MS, aw as KVAction, ax as KVActionType, aC as KVChange, aD as KVChangesAuthority, b as KVListPage, d as KVReplicaHandle, e as KVReplicaSpec, f as KVReplicaStorage, a as KVReplicationController, K as KVReplicationDeps, aO as KVResponseHeaders, L as LocalGetResult, g as LocalListResult, h as LocalReadMeta, i as LocalReplicaStatus, j as LocalSyncResult, k as PendingWriteRecord, l as PendingWriteState, P as PendingWriteStore, m as PinnedKey, w as PurgeTarget, z as ReplicaAuthorityState, H as ReplicaCoverage, N as ReplicaDevice, X as ReplicaGatedHandle, _ as ReplicaGrantInfo, a0 as ReplicaInspectedStatus, ah as ReplicaState, ai as ReplicaStatusEntry, aj as ReplicationAuthority, ak as ReplicationControl, al as ReplicationEvent, R as ReplicationIdentity, am as ReplicationOptions, an as ReplicationPurgeReport, ao as ReplicationReason, ap as ReplicationScheduler, aq as ResolvedReplicationOptions, as as canonicalReplicationIdentity, at as replicationIdentityKey, au as requiresSecretsOptIn } from '../scope-BZr0QwxX.js';
 export { kvPrefixCovers } from './replication/prefix.js';
 import './replication/contractConstants.js';
 import './replication/grantPolicyConstants.js';

package/dist/kv/replication/index.d.cts

@@ -1,8 +1,8 @@
-import { K as KVReplicationDeps, a as KVReplicationController, R as ReplicationIdentity, P as PendingWriteStore } from '../../scope-Dv3IAXMr.cjs';
-export { A as AuthorityRefusal, C as CLEAR_PENDING_WARNING, b as KVListPage, c as KVReadThrough, d as KVReplicaHandle, e as KVReplicaSpec, f as KVReplicaStorage, L as LocalGetResult, g as LocalListResult, h as LocalReadMeta, i as LocalReplicaStatus, j as LocalSyncResult, k as PendingWriteRecord, l as PendingWriteState, m as PinnedKey, n as ProfileReplicaApprovalEntry, o as ProfileReplicaDeferredDenyOutcome, p as ProfileReplicaDeferredToken, q as ProfileReplicaLogoutPending, r as ProfileReplicaPreflight, s as ProfileReplicaPurge, t as ProfileReplicaRemoteLogoutState, u as ProfileReplicaRootIdentity, v as ProfileReplicaUnknownEntry, w as PurgeTarget, x as ReplicaAccountGate, y as ReplicaAdmitHook, z as ReplicaAuthorityState, B as ReplicaBrowserGateAccess, D as ReplicaBrowserGateSnapshot, E as ReplicaBrowserGateTx, F as ReplicaBrowserPageAdmission, G as ReplicaClock, H as ReplicaCoverage, I as ReplicaDeliveryDecision, J as ReplicaDenyInput, M as ReplicaDenyOutcome, N as ReplicaDevice, O as ReplicaEraseReport, Q as ReplicaGateAccess, S as ReplicaGateReason, T as ReplicaGateScope, U as ReplicaGateSnapshot, V as ReplicaGateTx, W as ReplicaGatedError, X as ReplicaGatedHandle, Y as ReplicaGatedSpec, Z as ReplicaGatedStorage, _ as ReplicaGrantInfo, $ as ReplicaGuardedStore, a0 as ReplicaInspectedStatus, a1 as ReplicaLifecycleGate, a2 as ReplicaLocalEraseOutcome, a3 as ReplicaPageAdmission, a4 as ReplicaPartitionEraser, a5 as ReplicaPartitionIndexEntry, a6 as ReplicaPeerCommit, a7 as ReplicaPrivateGateHash, a8 as ReplicaPurgeError, a9 as ReplicaPurgeFailedEvent, aa as ReplicaPurgeIntent, ab as ReplicaPurgeLocalCopyResult, ac as ReplicaPurgeTrigger, ad as ReplicaQuotaLedger, ae as ReplicaQuotaSpec, af as ReplicaSessionStamp, ag as ReplicaStampedReply, ah as ReplicaState, ai as ReplicaStatusEntry, aj as ReplicationAuthority, ak as ReplicationControl, al as ReplicationEvent, am as ReplicationOptions, an as ReplicationPurgeReport, ao as ReplicationReason, ap as ReplicationScheduler, aq as ResolvedReplicationOptions, ar as SaltedHash, as as canonicalReplicationIdentity, at as replicationIdentityKey, au as requiresSecretsOptIn } from '../../scope-Dv3IAXMr.cjs';
+import { K as KVReplicationDeps, a as KVReplicationController, R as ReplicationIdentity, P as PendingWriteStore } from '../../scope-DEgc9f-W.cjs';
+export { A as AuthorityRefusal, C as CLEAR_PENDING_WARNING, b as KVListPage, c as KVReadThrough, d as KVReplicaHandle, e as KVReplicaSpec, f as KVReplicaStorage, L as LocalGetResult, g as LocalListResult, h as LocalReadMeta, i as LocalReplicaStatus, j as LocalSyncResult, k as PendingWriteRecord, l as PendingWriteState, m as PinnedKey, n as ProfileReplicaApprovalEntry, o as ProfileReplicaDeferredDenyOutcome, p as ProfileReplicaDeferredToken, q as ProfileReplicaLogoutPending, r as ProfileReplicaPreflight, s as ProfileReplicaPurge, t as ProfileReplicaRemoteLogoutState, u as ProfileReplicaRootIdentity, v as ProfileReplicaUnknownEntry, w as PurgeTarget, x as ReplicaAccountGate, y as ReplicaAdmitHook, z as ReplicaAuthorityState, B as ReplicaBrowserGateAccess, D as ReplicaBrowserGateSnapshot, E as ReplicaBrowserGateTx, F as ReplicaBrowserPageAdmission, G as ReplicaClock, H as ReplicaCoverage, I as ReplicaDeliveryDecision, J as ReplicaDenyInput, M as ReplicaDenyOutcome, N as ReplicaDevice, O as ReplicaEraseReport, Q as ReplicaGateAccess, S as ReplicaGateReason, T as ReplicaGateScope, U as ReplicaGateSnapshot, V as ReplicaGateTx, W as ReplicaGatedError, X as ReplicaGatedHandle, Y as ReplicaGatedSpec, Z as ReplicaGatedStorage, _ as ReplicaGrantInfo, $ as ReplicaGuardedStore, a0 as ReplicaInspectedStatus, a1 as ReplicaLifecycleGate, a2 as ReplicaLocalEraseOutcome, a3 as ReplicaPageAdmission, a4 as ReplicaPartitionEraser, a5 as ReplicaPartitionIndexEntry, a6 as ReplicaPeerCommit, a7 as ReplicaPrivateGateHash, a8 as ReplicaPurgeError, a9 as ReplicaPurgeFailedEvent, aa as ReplicaPurgeIntent, ab as ReplicaPurgeLocalCopyResult, ac as ReplicaPurgeTrigger, ad as ReplicaQuotaLedger, ae as ReplicaQuotaSpec, af as ReplicaSessionStamp, ag as ReplicaStampedReply, ah as ReplicaState, ai as ReplicaStatusEntry, aj as ReplicationAuthority, ak as ReplicationControl, al as ReplicationEvent, am as ReplicationOptions, an as ReplicationPurgeReport, ao as ReplicationReason, ap as ReplicationScheduler, aq as ResolvedReplicationOptions, ar as SaltedHash, as as canonicalReplicationIdentity, at as replicationIdentityKey, au as requiresSecretsOptIn } from '../../scope-DEgc9f-W.cjs';
 export { ClampConsentAnchor, ConsentDeadlineMs, EffectiveGrantExpiry, EffectiveGrantExpiryInput, MintRemainingMs, NeedsSilentRenewal, ReplicaConsentAnchor, ReplicaConsentSource, ReplicaGrantPolicy } from './grantPolicyTypes.cjs';
 export { kvPrefixCovers } from './prefix.cjs';
-import '../../types-DAOyIbXu.cjs';
+import '../../types-CSd0RYir.cjs';
 import './contractConstants.cjs';
 import './grantPolicyConstants.cjs';
 

package/dist/kv/replication/index.d.ts

@@ -1,8 +1,8 @@
-import { K as KVReplicationDeps, a as KVReplicationController, R as ReplicationIdentity, P as PendingWriteStore } from '../../scope-1-8skVDk.js';
-export { A as AuthorityRefusal, C as CLEAR_PENDING_WARNING, b as KVListPage, c as KVReadThrough, d as KVReplicaHandle, e as KVReplicaSpec, f as KVReplicaStorage, L as LocalGetResult, g as LocalListResult, h as LocalReadMeta, i as LocalReplicaStatus, j as LocalSyncResult, k as PendingWriteRecord, l as PendingWriteState, m as PinnedKey, n as ProfileReplicaApprovalEntry, o as ProfileReplicaDeferredDenyOutcome, p as ProfileReplicaDeferredToken, q as ProfileReplicaLogoutPending, r as ProfileReplicaPreflight, s as ProfileReplicaPurge, t as ProfileReplicaRemoteLogoutState, u as ProfileReplicaRootIdentity, v as ProfileReplicaUnknownEntry, w as PurgeTarget, x as ReplicaAccountGate, y as ReplicaAdmitHook, z as ReplicaAuthorityState, B as ReplicaBrowserGateAccess, D as ReplicaBrowserGateSnapshot, E as ReplicaBrowserGateTx, F as ReplicaBrowserPageAdmission, G as ReplicaClock, H as ReplicaCoverage, I as ReplicaDeliveryDecision, J as ReplicaDenyInput, M as ReplicaDenyOutcome, N as ReplicaDevice, O as ReplicaEraseReport, Q as ReplicaGateAccess, S as ReplicaGateReason, T as ReplicaGateScope, U as ReplicaGateSnapshot, V as ReplicaGateTx, W as ReplicaGatedError, X as ReplicaGatedHandle, Y as ReplicaGatedSpec, Z as ReplicaGatedStorage, _ as ReplicaGrantInfo, $ as ReplicaGuardedStore, a0 as ReplicaInspectedStatus, a1 as ReplicaLifecycleGate, a2 as ReplicaLocalEraseOutcome, a3 as ReplicaPageAdmission, a4 as ReplicaPartitionEraser, a5 as ReplicaPartitionIndexEntry, a6 as ReplicaPeerCommit, a7 as ReplicaPrivateGateHash, a8 as ReplicaPurgeError, a9 as ReplicaPurgeFailedEvent, aa as ReplicaPurgeIntent, ab as ReplicaPurgeLocalCopyResult, ac as ReplicaPurgeTrigger, ad as ReplicaQuotaLedger, ae as ReplicaQuotaSpec, af as ReplicaSessionStamp, ag as ReplicaStampedReply, ah as ReplicaState, ai as ReplicaStatusEntry, aj as ReplicationAuthority, ak as ReplicationControl, al as ReplicationEvent, am as ReplicationOptions, an as ReplicationPurgeReport, ao as ReplicationReason, ap as ReplicationScheduler, aq as ResolvedReplicationOptions, ar as SaltedHash, as as canonicalReplicationIdentity, at as replicationIdentityKey, au as requiresSecretsOptIn } from '../../scope-1-8skVDk.js';
+import { K as KVReplicationDeps, a as KVReplicationController, R as ReplicationIdentity, P as PendingWriteStore } from '../../scope-BZr0QwxX.js';
+export { A as AuthorityRefusal, C as CLEAR_PENDING_WARNING, b as KVListPage, c as KVReadThrough, d as KVReplicaHandle, e as KVReplicaSpec, f as KVReplicaStorage, L as LocalGetResult, g as LocalListResult, h as LocalReadMeta, i as LocalReplicaStatus, j as LocalSyncResult, k as PendingWriteRecord, l as PendingWriteState, m as PinnedKey, n as ProfileReplicaApprovalEntry, o as ProfileReplicaDeferredDenyOutcome, p as ProfileReplicaDeferredToken, q as ProfileReplicaLogoutPending, r as ProfileReplicaPreflight, s as ProfileReplicaPurge, t as ProfileReplicaRemoteLogoutState, u as ProfileReplicaRootIdentity, v as ProfileReplicaUnknownEntry, w as PurgeTarget, x as ReplicaAccountGate, y as ReplicaAdmitHook, z as ReplicaAuthorityState, B as ReplicaBrowserGateAccess, D as ReplicaBrowserGateSnapshot, E as ReplicaBrowserGateTx, F as ReplicaBrowserPageAdmission, G as ReplicaClock, H as ReplicaCoverage, I as ReplicaDeliveryDecision, J as ReplicaDenyInput, M as ReplicaDenyOutcome, N as ReplicaDevice, O as ReplicaEraseReport, Q as ReplicaGateAccess, S as ReplicaGateReason, T as ReplicaGateScope, U as ReplicaGateSnapshot, V as ReplicaGateTx, W as ReplicaGatedError, X as ReplicaGatedHandle, Y as ReplicaGatedSpec, Z as ReplicaGatedStorage, _ as ReplicaGrantInfo, $ as ReplicaGuardedStore, a0 as ReplicaInspectedStatus, a1 as ReplicaLifecycleGate, a2 as ReplicaLocalEraseOutcome, a3 as ReplicaPageAdmission, a4 as ReplicaPartitionEraser, a5 as ReplicaPartitionIndexEntry, a6 as ReplicaPeerCommit, a7 as ReplicaPrivateGateHash, a8 as ReplicaPurgeError, a9 as ReplicaPurgeFailedEvent, aa as ReplicaPurgeIntent, ab as ReplicaPurgeLocalCopyResult, ac as ReplicaPurgeTrigger, ad as ReplicaQuotaLedger, ae as ReplicaQuotaSpec, af as ReplicaSessionStamp, ag as ReplicaStampedReply, ah as ReplicaState, ai as ReplicaStatusEntry, aj as ReplicationAuthority, ak as ReplicationControl, al as ReplicationEvent, am as ReplicationOptions, an as ReplicationPurgeReport, ao as ReplicationReason, ap as ReplicationScheduler, aq as ResolvedReplicationOptions, ar as SaltedHash, as as canonicalReplicationIdentity, at as replicationIdentityKey, au as requiresSecretsOptIn } from '../../scope-BZr0QwxX.js';
 export { ClampConsentAnchor, ConsentDeadlineMs, EffectiveGrantExpiry, EffectiveGrantExpiryInput, MintRemainingMs, NeedsSilentRenewal, ReplicaConsentAnchor, ReplicaConsentSource, ReplicaGrantPolicy } from './grantPolicyTypes.js';
 export { kvPrefixCovers } from './prefix.js';
-import '../../types-DAOyIbXu.js';
+import '../../types-CSd0RYir.js';
 import './contractConstants.js';
 import './grantPolicyConstants.js';
 

package/dist/{scope-1-8skVDk.d.ts → scope-BZr0QwxX.d.ts}

@@ -1,4 +1,4 @@
-import { i as RetryStats, h as Result, F as FetchFunction } from './types-DAOyIbXu.js';
+import { i as RetryStats, f as Result, F as FetchFunction } from './types-CSd0RYir.js';
 import { REPLICA_KV_STORES } from './kv/replication/contractConstants.js';
 import { ReplicaConsentAnchor, ReplicaGrantPolicy } from './kv/replication/grantPolicyTypes.js';
 

package/dist/{scope-Dv3IAXMr.d.cts → scope-DEgc9f-W.d.cts}

@@ -1,4 +1,4 @@
-import { i as RetryStats, h as Result, F as FetchFunction } from './types-DAOyIbXu.cjs';
+import { i as RetryStats, f as Result, F as FetchFunction } from './types-CSd0RYir.cjs';
 import { REPLICA_KV_STORES } from './kv/replication/contractConstants.cjs';
 import { ReplicaConsentAnchor, ReplicaGrantPolicy } from './kv/replication/grantPolicyTypes.cjs';
 

package/dist/sql/index.cjs

@@ -770,12 +770,13 @@ var SQLService = class extends BaseService {
           request.signal
         );
         if (!response.ok) {
-          return await this.handleErrorResponse(response, "query", dbName, [action]);
+          const failure = await this.handleErrorResponse(response, "query", dbName, [action]);
+          return this.redactFailure(failure, options?.redactErrors, response.status);
         }
         const data = await response.json();
         return ok(data);
       } catch (error) {
-        return err(wrapError("sql", error));
+        return this.redactFailure(err(wrapError("sql", error)), options?.redactErrors);
       } finally {
         request.dispose();
       }
@@ -810,12 +811,13 @@ var SQLService = class extends BaseService {
           request.signal
         );
         if (!response.ok) {
-          return await this.handleErrorResponse(response, "execute", dbName, requestedActions);
+          const failure = await this.handleErrorResponse(response, "execute", dbName, requestedActions);
+          return this.redactFailure(failure, options?.redactErrors, response.status);
         }
         const data = await response.json();
         return ok(data);
       } catch (error) {
-        return err(wrapError("sql", error));
+        return this.redactFailure(err(wrapError("sql", error)), options?.redactErrors);
       } finally {
         request.dispose();
       }
@@ -836,12 +838,13 @@ var SQLService = class extends BaseService {
           request.signal
         );
         if (!response.ok) {
-          return await this.handleErrorResponse(response, "batch", dbName, requestedActions);
+          const failure = await this.handleErrorResponse(response, "batch", dbName, requestedActions);
+          return this.redactFailure(failure, options?.redactErrors, response.status);
         }
         const data = await response.json();
         return ok(data);
       } catch (error) {
-        return err(wrapError("sql", error));
+        return this.redactFailure(err(wrapError("sql", error)), options?.redactErrors);
       } finally {
         request.dispose();
       }
@@ -1037,6 +1040,18 @@ var SQLService = class extends BaseService {
       }))
     );
   }
+  redactFailure(result, redactErrors, status) {
+    if (!redactErrors || result.ok) return result;
+    const candidate = result.error.code;
+    const code = typeof candidate === "string" && Object.prototype.hasOwnProperty.call(ErrorCodes, candidate) ? candidate : ErrorCodes.SQL_ERROR;
+    const safeStatus = typeof status === "number" && Number.isInteger(status) && status >= 400 && status <= 599 ? status : void 0;
+    return err(serviceError(
+      code,
+      "SQL operation failed",
+      "sql",
+      safeStatus === void 0 ? void 0 : { meta: { status: safeStatus } }
+    ));
+  }
   async handleErrorResponse(response, operation, dbName, requestedActions) {
     const errorText = await response.text();
     const meta = responseErrorMeta(response.status, response.statusText, errorText);