@palbase/backend 14.1.0 → 14.3.0

package/dist/index.d.cts

@@ -1,8 +1,8 @@
-import { C as CacheClient, b as PalbaseDocsClient, c as PalbaseFlagsClient, L as Logger, d as PalbaseNotificationsClient, e as PalbaseRealtimeClient, D as DBClient, f as PalbaseStorageClient, A as AuthSpec, R as RateLimitConfig, H as HttpError } from './endpoint-D2yR2RD1.cjs';
-export { g as AuthConfig, B as BadRequest, h as ClientInfo, i as Conflict, j as DBOps, E as ErrorDef, k as ErrorMap, l as ErrorThrowers, F as FileContext, m as Forbidden, n as HttpMethod, M as Materialized, o as Middleware, p as MiddlewareContext, q as MiddlewareHandler, N as NotFound, P as PBRequest, r as PalError, s as PalbaseAnalyticsClient, t as PalbaseAnalyticsManagementNamespace, u as PalbaseAnalyticsProperties, v as PalbaseAnalyticsQueryNamespace, w as PalbaseAttestAndroidParams, x as PalbaseAttestAndroidResult, y as PalbaseAttestiOSParams, z as PalbaseAttestiOSResult, G as PalbaseAuthClient, I as PalbaseBatchOverrideOperation, J as PalbaseBatchSetOverridesResult, K as PalbaseBindDeviceParams, O as PalbaseBucketClient, Q as PalbaseClearAllOverridesResult, S as PalbaseClearOverrideResult, T as PalbaseCohortQueryInput, V as PalbaseCohortResult, W as PalbaseCollectionRef, X as PalbaseCountQueryInput, Y as PalbaseCountResult, Z as PalbaseCreateLinkParams, _ as PalbaseDeviceInfo, $ as PalbaseDeviceTokenView, a0 as PalbaseDocumentRef, a1 as PalbaseDocumentSnapshot, a2 as PalbaseEmailClient, a3 as PalbaseEmailSendParams, a4 as PalbaseEmailSendResponse, a5 as PalbaseEventNamesResult, a6 as PalbaseEventsQueryInput, a7 as PalbaseEventsResult, a8 as PalbaseFileObject, a9 as PalbaseFlag, aa as PalbaseFlagContext, ab as PalbaseFlagSource, ac as PalbaseFlagValue, ad as PalbaseFlagVariant, ae as PalbaseFlagsServiceClient, af as PalbaseFunctionsClient, ag as PalbaseFunnelQueryInput, ah as PalbaseFunnelResult, ai as PalbaseIdentifyTraits, aj as PalbaseInboxClient, ak as PalbaseInboxListOptions, al as PalbaseInboxListResult, am as PalbaseInboxMessage, an as PalbaseInboxSendParams, ao as PalbaseInboxSendResponse, ap as PalbaseInitialLink, aq as PalbaseInvokeOptions, ar as PalbaseLink, as as PalbaseLinkAnalytics, at as PalbaseLinkDetails, au as PalbaseLinksClient, av as PalbaseListLinksOptions, aw as PalbaseListLinksResult, ax as PalbaseListOptions, ay as PalbaseMatchParams, az as PalbaseMultiChannelResponse, aA as PalbaseOverviewResult, aB as PalbasePreferences, aC as PalbasePreferencesClient, aD as PalbasePublicUrlResponse, aE as PalbasePushClient, aF as PalbasePushSendParams, aG as PalbasePushSendResponse, aH as PalbaseQrCodeOptions, aI as PalbaseQuerySnapshot, aJ as PalbaseRegisterDeviceParams, aK as PalbaseResult, aL as PalbaseRetentionQueryInput, aM as PalbaseRetentionResult, aN as PalbaseSession, aO as PalbaseSetOverrideResult, aP as PalbaseSetOverridesResult, aQ as PalbaseSignedUrlResponse, aR as PalbaseSmsClient, aS as PalbaseSmsSendParams, aT as PalbaseSmsSendResponse, aU as PalbaseTransformOptions, aV as PalbaseUpdateLinkParams, aW as PalbaseUploadOptions, aX as PalbaseUser, aY as PalbaseUserDetailResult, aZ as PalbaseUsersQueryInput, a_ as PalbaseUsersResult, a$ as PalbaseVerifyRequestSignatureParams, b0 as PalbaseWhereOperator, b1 as Ref, b2 as TooManyRequests, b3 as TxColumnExpr, b4 as TxInsertShape, b5 as TxInsertValue, b6 as TxNow, b7 as TxPlanBody, b8 as TxPlanError, b9 as TxPlanHandle, ba as TxPlanOpResult, bb as TxPlanRejection, bc as TxPlanResponse, bd as TxRefError, be as TxRow, bf as TxRows, bg as TxSelectOptions, bh as TxSetShape, bi as TxSetValue, bj as TxTable, bk as TxWhere, bl as TxWireExpr, bm as TxWireGuard, bn as TxWireOp, bo as TxWireRef, bp as TxWireValue, bq as Unauthorized, U as UserT, br as VerifiedDevice, bs as dec, bt as defineMiddleware, bu as inc, bv as now } from './endpoint-D2yR2RD1.cjs';
+import { C as CacheClient, b as PalbaseDocsClient, c as PalbaseFlagsClient, L as Logger, d as PalbaseNotificationsClient, e as PalbaseRealtimeClient, D as DBClient, f as PalbaseStorageClient, A as AuthSpec, R as RateLimitConfig, H as HttpError } from './endpoint-BG-JVUPL.cjs';
+export { g as AuthConfig, B as BadRequest, h as ClientInfo, i as Conflict, j as DBOps, E as ErrorDef, k as ErrorMap, l as ErrorThrowers, F as FileContext, m as Forbidden, n as HttpMethod, M as Materialized, o as Middleware, p as MiddlewareContext, q as MiddlewareHandler, N as NotFound, P as PBRequest, r as PalError, s as PalbaseAnalyticsClient, t as PalbaseAnalyticsManagementNamespace, u as PalbaseAnalyticsProperties, v as PalbaseAnalyticsQueryNamespace, w as PalbaseAttestAndroidParams, x as PalbaseAttestAndroidResult, y as PalbaseAttestiOSParams, z as PalbaseAttestiOSResult, G as PalbaseAuthClient, I as PalbaseBatchOverrideOperation, J as PalbaseBatchSetOverridesResult, K as PalbaseBindDeviceParams, O as PalbaseBucketClient, Q as PalbaseClearAllOverridesResult, S as PalbaseClearOverrideResult, T as PalbaseCohortQueryInput, V as PalbaseCohortResult, W as PalbaseCollectionRef, X as PalbaseCountQueryInput, Y as PalbaseCountResult, Z as PalbaseCreateLinkParams, _ as PalbaseDeviceInfo, $ as PalbaseDeviceTokenView, a0 as PalbaseDocumentRef, a1 as PalbaseDocumentSnapshot, a2 as PalbaseEmailClient, a3 as PalbaseEmailSendParams, a4 as PalbaseEmailSendResponse, a5 as PalbaseEventNamesResult, a6 as PalbaseEventsQueryInput, a7 as PalbaseEventsResult, a8 as PalbaseFileObject, a9 as PalbaseFlag, aa as PalbaseFlagContext, ab as PalbaseFlagSource, ac as PalbaseFlagValue, ad as PalbaseFlagVariant, ae as PalbaseFlagsServiceClient, af as PalbaseFunctionsClient, ag as PalbaseFunnelQueryInput, ah as PalbaseFunnelResult, ai as PalbaseIdentifyTraits, aj as PalbaseInboxClient, ak as PalbaseInboxListOptions, al as PalbaseInboxListResult, am as PalbaseInboxMessage, an as PalbaseInboxSendParams, ao as PalbaseInboxSendResponse, ap as PalbaseInitialLink, aq as PalbaseInvokeOptions, ar as PalbaseLink, as as PalbaseLinkAnalytics, at as PalbaseLinkDetails, au as PalbaseLinksClient, av as PalbaseListLinksOptions, aw as PalbaseListLinksResult, ax as PalbaseListOptions, ay as PalbaseMatchParams, az as PalbaseMultiChannelResponse, aA as PalbaseOverviewResult, aB as PalbasePreferences, aC as PalbasePreferencesClient, aD as PalbasePublicUrlResponse, aE as PalbasePushClient, aF as PalbasePushSendParams, aG as PalbasePushSendResponse, aH as PalbaseQrCodeOptions, aI as PalbaseQuerySnapshot, aJ as PalbaseRegisterDeviceParams, aK as PalbaseResult, aL as PalbaseRetentionQueryInput, aM as PalbaseRetentionResult, aN as PalbaseSession, aO as PalbaseSetOverrideResult, aP as PalbaseSetOverridesResult, aQ as PalbaseSignedUrlResponse, aR as PalbaseSmsClient, aS as PalbaseSmsSendParams, aT as PalbaseSmsSendResponse, aU as PalbaseTransformOptions, aV as PalbaseUpdateLinkParams, aW as PalbaseUploadOptions, aX as PalbaseUser, aY as PalbaseUserDetailResult, aZ as PalbaseUsersQueryInput, a_ as PalbaseUsersResult, a$ as PalbaseVerifyRequestSignatureParams, b0 as PalbaseWhereOperator, b1 as Ref, b2 as TooManyRequests, b3 as TxColumnExpr, b4 as TxInsertShape, b5 as TxInsertValue, b6 as TxNow, b7 as TxPlanBody, b8 as TxPlanError, b9 as TxPlanHandle, ba as TxPlanOpResult, bb as TxPlanRejection, bc as TxPlanResponse, bd as TxRefError, be as TxRow, bf as TxRows, bg as TxSelectOptions, bh as TxSetShape, bi as TxSetValue, bj as TxTable, bk as TxWhere, bl as TxWireExpr, bm as TxWireGuard, bn as TxWireOp, bo as TxWireRef, bp as TxWireValue, bq as Unauthorized, U as UserT, br as VerifiedDevice, bs as dec, bt as defineMiddleware, bu as inc, bv as now } from './endpoint-BG-JVUPL.cjs';
 import { AsyncLocalStorage } from 'node:async_hooks';
-import { E as EnvTypedDatabase, S as SchemaDef } from './index-BcA7wqur.cjs';
-export { C as ColumnBuilder, a as ColumnDef, b as ColumnMap, c as ColumnType, d as EXTENSION_DEPENDENCIES, e as EnvServiceDatabase, f as EnvTables, g as EnvTypedTable, I as InsertShape, O as OnDeleteAction, P as PALBASE_EXTENSIONS, h as PalbaseExtension, i as PolicyBuilder, j as PolicyCommand, k as PolicyDef, l as PolicyMode, R as RawConstraintDef, m as RowShape, n as SchemaInput, T as TableDef, o as TableInput, p as TxPlan, q as TxTables, r as TypedDB, s as TypedTable, t as TypedTx, u as bigint, v as boolean, w as defineSchema, x as enumType, y as integer, z as isPalbaseExtension, A as jsonb, B as makeTypedDB, D as numeric, F as policy, G as raw, H as text, J as timestamp, K as uuid } from './index-BcA7wqur.cjs';
+import { E as EnvTypedDatabase, S as SchemaDef } from './index-j3ZZS_VS.cjs';
+export { C as ColumnBuilder, a as ColumnDef, b as ColumnMap, c as ColumnType, d as EXTENSION_DEPENDENCIES, e as EnvServiceDatabase, f as EnvTables, g as EnvTypedTable, I as InsertShape, O as OnDeleteAction, P as PALBASE_EXTENSIONS, h as PalbaseExtension, i as PolicyBuilder, j as PolicyCommand, k as PolicyDef, l as PolicyMode, R as RawConstraintDef, m as RowShape, n as SchemaInput, T as TableDef, o as TableInput, p as TxPlan, q as TxTables, r as TypedDB, s as TypedTable, t as TypedTx, u as bigint, v as boolean, w as defineSchema, x as enumType, y as integer, z as isPalbaseExtension, A as jsonb, B as makeTypedDB, D as numeric, F as policy, G as raw, H as text, J as timestamp, K as uuid } from './index-j3ZZS_VS.cjs';
 import { EntitlementKey, LimitKey } from './purchases/keys.cjs';
 import { TableTypes, Tables } from './db/env.cjs';
 import { ZodTypeAny, z } from 'zod';
@@ -747,6 +747,92 @@ interface TwilioOptions {
 /** The union of every provider's author-facing options. `buildProvider` accepts
  * this so each provider's typed options pass without a cast. */
 type ProviderOptions = ApnsOptions | FcmOptions | SendgridOptions | SesOptions | SmtpOptions | AcsOptions | TwilioOptions;
+/** The default locale a template row lands on when the author names none. Must
+ * match PalNotify's `model.DefaultLocale`. */
+declare const DEFAULT_TEMPLATE_LOCALE: "en";
+/** One locale's email content. */
+interface EmailTemplateContent {
+    /** Subject line. Handlebars placeholders (`{{name}}`) are rendered at send. */
+    subject: string;
+    /** HTML body. */
+    html: string;
+    /** Plain-text body. Omit and the server derives one from `html` at render. */
+    text?: string;
+    /**
+     * Variables the sender MUST supply. Omit and they are DERIVED from the
+     * `{{placeholders}}` in this locale's content — see {@link extractVariables}.
+     * Supply explicitly to make a placeholder optional (leave it out of the list)
+     * or to require something a conditional references.
+     */
+    variables?: readonly string[];
+}
+/** An email template: base content, plus optional per-locale overrides. */
+interface EmailTemplateOptions extends EmailTemplateContent {
+    /** Locale of the base content. Defaults to `"en"`. */
+    locale?: string;
+    /** Additional locales, keyed by BCP47 short tag (`tr`, `de`, …). */
+    locales?: Record<string, EmailTemplateContent>;
+}
+/** One locale's SMS content. */
+interface SmsTemplateContent {
+    /** Message body. Handlebars placeholders are rendered at send. */
+    body: string;
+    /** Variables the sender must supply. Derived from `body` when omitted. */
+    variables?: readonly string[];
+}
+/** An SMS template: base content, plus optional per-locale overrides. */
+interface SmsTemplateOptions extends SmsTemplateContent {
+    /** Locale of the base content. Defaults to `"en"`. */
+    locale?: string;
+    /** Additional locales, keyed by BCP47 short tag. */
+    locales?: Record<string, SmsTemplateContent>;
+}
+/** Author-facing templates block: slug → template. */
+interface TemplatesInput {
+    email?: Record<string, EmailTemplateOptions>;
+    sms?: Record<string, SmsTemplateOptions>;
+}
+/** A compiled email-template row — one (slug, locale) pair, in the snake_case
+ * wire shape PalNotify's templates API takes. */
+interface EmailTemplateDef {
+    slug: string;
+    locale: string;
+    subject: string;
+    html_body: string;
+    text_body?: string;
+    variables: string[];
+}
+/** A compiled SMS-template row — one (slug, locale) pair. */
+interface SmsTemplateDef {
+    slug: string;
+    locale: string;
+    body: string;
+    variables: string[];
+}
+/** The compiled templates block: flat, per-channel row lists. Flat rows (rather
+ * than a nested locale map) are what the apply step iterates — one row is one
+ * upsert against the (slug, locale) unique key. */
+interface TemplatesConfig {
+    email: EmailTemplateDef[];
+    sms: SmsTemplateDef[];
+}
+/**
+ * Pull the variable names out of Handlebars content.
+ *
+ * Only PLAIN mustaches count: `{{name}}` and `{{{name}}}`. Deliberately skipped:
+ * - block/section/partial/comment tokens (`{{#if}}`, `{{/if}}`, `{{else}}`,
+ *   `{{> partial}}`, `{{! comment}}`) — structure, not data the sender passes;
+ * - helper calls (`{{formatDate at}}`) — the first token is a helper name;
+ * - `this` and `@index`-style frame references.
+ *
+ * A dotted path contributes its ROOT (`{{user.name}}` → `user`), because that is
+ * what the sender actually has to hand over.
+ *
+ * The list is what the server ENFORCES as required at render time, so keeping it
+ * to the unambiguous cases is the point: an over-eager derivation would turn an
+ * optional conditional into a mandatory argument and 400 real sends.
+ */
+declare function extractVariables(...sources: (string | undefined)[]): string[];
 /** The author-facing input to `defineNotifications`. Every provider + every
  * channel is optional — declare only what you use. */
 interface NotificationsInput {
@@ -763,6 +849,8 @@ interface NotificationsInput {
     sms?: {
         twilio?: TwilioOptions;
     };
+    /** Email + SMS templates, keyed by slug. Applied on every deploy. */
+    templates?: TemplatesInput;
 }
 /** A compiled provider def. `enabled` is always present; the remaining keys are
  * the provider's non-secret fields (verbatim from the catalog). A disabled
@@ -778,6 +866,7 @@ interface NotificationsConfig {
     push: Record<string, ProviderDef>;
     email: Record<string, ProviderDef>;
     sms: Record<string, ProviderDef>;
+    templates: TemplatesConfig;
 }
 /**
  * Compile + validate one provider's author options into a {@link ProviderDef}.
@@ -1086,23 +1175,100 @@ type FlagOptions = {
     type: "boolean";
     default: boolean;
     variants?: never;
+    conditions?: FlagCondition<boolean>[];
     description?: string;
 } | {
     type: "number";
     default: number;
     variants?: never;
+    conditions?: FlagCondition<number>[];
     description?: string;
 } | {
     type: "string";
     default: string;
     variants?: string[];
+    conditions?: FlagCondition<string>[];
     description?: string;
 } | {
     type: "json";
     default: FlagJsonObject;
     variants?: never;
+    conditions?: FlagCondition<FlagJsonObject>[];
     description?: string;
 };
+/**
+ * One targeting branch: the value this flag resolves to when `when` matches the
+ * caller's client context. Branch ORDER is priority — the first match wins, and
+ * a flag with no matching branch falls back to its `default`.
+ *
+ * `when` is a small expression over what the client declares about itself:
+ *
+ * ```
+ * client.platform == 'ios' && client.app_version >= '2.0.0'
+ * client.locale startsWith 'tr'
+ * client.platform in ['ios', 'android']
+ * ```
+ *
+ * Those are CLAIMS, not proof — the server treats them as attacker-controlled.
+ * They select WHICH value a caller sees, never WHETHER they may see it, so a
+ * condition must not be the thing standing between a user and something paid.
+ */
+/**
+ * The variables the server exposes. Mirrors `declaredVars` in
+ * `modules/user-flags/internal/conditions/conditions.go`; the server rejects
+ * anything it does not know, so the worst a stale copy here does is offer too
+ * little.
+ *
+ * `client.*` is what the SDK reports about the caller. `percentile` and
+ * `server.now` are DERIVED server-side and cannot be moved by a lying client,
+ * which is what makes a rollout or a time window mean anything.
+ */
+type StringVar = "client.platform" | "client.locale";
+type SemverVar = "client.app_version" | "client.os_version";
+type EqualityOp = "==" | "!=";
+/** Ordering only where order exists — a platform string has none. */
+type OrderedOp = EqualityOp | "<" | "<=" | ">" | ">=";
+type TextOp = EqualityOp | "startsWith" | "endsWith" | "contains";
+/** A single-quoted literal. Quoting is the mistake people make most. */
+type Quoted = `'${string}'`;
+type Comparison = `${StringVar} ${TextOp} ${Quoted}` | `${StringVar} in [${string}]` | `${SemverVar} ${OrderedOp} ${Quoted}` | `percentile ${OrderedOp} ${number}` | `server.now ${OrderedOp} ${Quoted}`;
+/**
+ * One expression: a comparison, optionally chained with `&&` / `||`, or a
+ * parenthesised group.
+ *
+ * ONE level, and the limit is TypeScript's, not a preference. Unrolling a second
+ * level produced `TS2590: union type too complex`, and the failure mode there is
+ * the worst possible one: the checker gives up and the type silently degrades to
+ * `string`, so NOTHING is checked while the code still compiles. Measured, not
+ * assumed — the two-level version accepted `client.app_verison` without
+ * complaint.
+ *
+ * So the FIRST term is fully checked and the rest of a chain is not. That is
+ * where the mistakes are: a rule is usually one comparison, and a typo in the
+ * first one is the common case. A typo after an `&&` still reaches the server,
+ * which parses the real grammar and rejects it.
+ *
+ * A group's contents go unchecked for the same reason.
+ */
+type FlagConditionExpression = Comparison | `${Comparison} && ${string}` | `${Comparison} || ${string}` | `(${string})`;
+interface FlagCondition<V> {
+    when: FlagConditionExpression;
+    value: V;
+}
+/**
+ * The COMPILED shape of a condition — the JSON actually emitted and parsed by
+ * the Go apply step.
+ *
+ * `when` widens back to `string` here on purpose. The narrow type is an
+ * authoring aid; once the expression has been trimmed and serialised it is just
+ * text on the wire, and keeping the template-literal type would force a cast on
+ * every string operation without checking anything the author had not already
+ * been checked on.
+ */
+interface CompiledFlagCondition<V> {
+    when: string;
+    value: V;
+}
 /**
  * The compiled, serializable flag definition — the EXACT shape emitted to JSON
  * and consumed by the Go apply step.
@@ -1117,6 +1283,8 @@ interface FlagDef {
     type: FlagType;
     default: FlagValue;
     variants: string[] | null;
+    /** Ordered targeting branches, or `null` when the flag is unconditional. */
+    conditions: CompiledFlagCondition<FlagValue>[] | null;
     description: string | null;
 }
 /** A flags config definition: the discriminant + a map of flag key →
@@ -1715,4 +1883,4 @@ declare const documents: {
     onDocumentDeleted(handler: HookHandler<DocumentDeletedEvent>): ResolvedHook<DocumentDeletedEvent>;
 };
 
-export { type AcsOptions, type ApnsOptions, Body, type BucketDef, type BucketOptions, Cache, CacheClient, Client, Controller, type ControllerOptions, DBClient, Database, type DefinedError, type DefinedErrorWithData, Delete, type DocumentCreatedEvent, type DocumentDeletedEvent, type DocumentUpdatedEvent, Documents, EGRESS_CONFIG_KIND, EGRESS_TIMEOUT_DEFAULT_MS, EGRESS_TIMEOUT_MAX_MS, EGRESS_TIMEOUT_MIN_MS, type EgressConfig, type EgressInput, EntitlementKey, EnvTypedDatabase, FLAGS_CONFIG_KIND, type FcmOptions, type FileDeletedEvent, type FileUploadedEvent, type FlagDef, type FlagJsonObject, type FlagJsonValue, type FlagOptions, type FlagType, type FlagValue, Flags, type FlagsConfig, type FlagsInput, Get, Headers, type HookHandler, type HookMeta, HttpError, type HttpMethodUpper, Job, type JobMeta, type JobOptions, LimitKey, type LimitState, Log, Logger, NOTIFICATIONS_CONFIG_KIND, Notifications, type NotificationsConfig, type NotificationsInput, On, OptionalUser, type OwnedTablesOf, PROVIDER_CATALOG, PalbaseDocsClient, PalbaseFlagsClient, PalbaseNotificationsClient, PalbaseRealtimeClient, PalbaseStorageClient, Param, type ParamKind, type ParamMeta, type PasswordResetEvent, Patch, Post, type ProviderCatalogEntry, type ProviderDef, type ProviderName, type ProviderOptions, Purchases, type PurchasesManifest, type PurchasesService, Put, Query, QueryParams, RESERVED_SECRET_PREFIX, RateLimitConfig, Realtime, type RegisteredError, Req, RequestId, type RequestStore, RequireEntitlement, type ResolvedHook, type ResolvedJob, type ResolvedWebhook, Resource, type ResourceEnv, type RouteMeta, type RouteOptions, type RuntimeServices, STORAGE_CONFIG_KIND, SchemaDef, type Seed, type SeedFor, type SeedJson, type SeedRowFor, type SendgridOptions, type SesOptions, type SignInEvent, type SignOutEvent, type SignatureSpec, type SmtpOptions, Spend, type SpendMeta, type SpendOptions, Storage, type StorageConfig, type StorageInput, type StoreEnv, TEST_USERS_CONFIG_KIND, type TableGraph, TableTypes, Tables, type TestUserDef, type TestUserOptions, type TestUsersConfig, type TestUsersInput, type ThrowDescriptor, TraceId, type TwilioOptions, Upload, type UploadConfig, UploadedObject, User, type UserCreatedEvent, Webhook, type WebhookEventHandler, type WebhookMeta, type WebhookOptions, type WebhookProvider, type WebhookRequest, __getRuntime, __registerResource, __requestALS, __runResourceBoot, __runWithRuntime, __setRuntime, __shutdownResources, auth, bucket, buildProvider, defineEgress, defineError, defineFlags, defineNotifications, defineStorage, defineTestUsers, documents, entitlementFor, flag, getErrorRegistry, getJobConfig, getRoutes, getWebhookConfig, makeEnvDts, makePurchasesDts, parseFileSizeLimit, recordThrows, reservedSecretKey, spendFor, storage, testUser, validateUploadAgainstStorage };
+export { type AcsOptions, type ApnsOptions, Body, type BucketDef, type BucketOptions, Cache, CacheClient, Client, Controller, type ControllerOptions, DBClient, DEFAULT_TEMPLATE_LOCALE, Database, type DefinedError, type DefinedErrorWithData, Delete, type DocumentCreatedEvent, type DocumentDeletedEvent, type DocumentUpdatedEvent, Documents, EGRESS_CONFIG_KIND, EGRESS_TIMEOUT_DEFAULT_MS, EGRESS_TIMEOUT_MAX_MS, EGRESS_TIMEOUT_MIN_MS, type EgressConfig, type EgressInput, type EmailTemplateContent, type EmailTemplateDef, type EmailTemplateOptions, EntitlementKey, EnvTypedDatabase, FLAGS_CONFIG_KIND, type FcmOptions, type FileDeletedEvent, type FileUploadedEvent, type FlagDef, type FlagJsonObject, type FlagJsonValue, type FlagOptions, type FlagType, type FlagValue, Flags, type FlagsConfig, type FlagsInput, Get, Headers, type HookHandler, type HookMeta, HttpError, type HttpMethodUpper, Job, type JobMeta, type JobOptions, LimitKey, type LimitState, Log, Logger, NOTIFICATIONS_CONFIG_KIND, Notifications, type NotificationsConfig, type NotificationsInput, On, OptionalUser, type OwnedTablesOf, PROVIDER_CATALOG, PalbaseDocsClient, PalbaseFlagsClient, PalbaseNotificationsClient, PalbaseRealtimeClient, PalbaseStorageClient, Param, type ParamKind, type ParamMeta, type PasswordResetEvent, Patch, Post, type ProviderCatalogEntry, type ProviderDef, type ProviderName, type ProviderOptions, Purchases, type PurchasesManifest, type PurchasesService, Put, Query, QueryParams, RESERVED_SECRET_PREFIX, RateLimitConfig, Realtime, type RegisteredError, Req, RequestId, type RequestStore, RequireEntitlement, type ResolvedHook, type ResolvedJob, type ResolvedWebhook, Resource, type ResourceEnv, type RouteMeta, type RouteOptions, type RuntimeServices, STORAGE_CONFIG_KIND, SchemaDef, type Seed, type SeedFor, type SeedJson, type SeedRowFor, type SendgridOptions, type SesOptions, type SignInEvent, type SignOutEvent, type SignatureSpec, type SmsTemplateContent, type SmsTemplateDef, type SmsTemplateOptions, type SmtpOptions, Spend, type SpendMeta, type SpendOptions, Storage, type StorageConfig, type StorageInput, type StoreEnv, TEST_USERS_CONFIG_KIND, type TableGraph, TableTypes, Tables, type TemplatesConfig, type TemplatesInput, type TestUserDef, type TestUserOptions, type TestUsersConfig, type TestUsersInput, type ThrowDescriptor, TraceId, type TwilioOptions, Upload, type UploadConfig, UploadedObject, User, type UserCreatedEvent, Webhook, type WebhookEventHandler, type WebhookMeta, type WebhookOptions, type WebhookProvider, type WebhookRequest, __getRuntime, __registerResource, __requestALS, __runResourceBoot, __runWithRuntime, __setRuntime, __shutdownResources, auth, bucket, buildProvider, defineEgress, defineError, defineFlags, defineNotifications, defineStorage, defineTestUsers, documents, entitlementFor, extractVariables, flag, getErrorRegistry, getJobConfig, getRoutes, getWebhookConfig, makeEnvDts, makePurchasesDts, parseFileSizeLimit, recordThrows, reservedSecretKey, spendFor, storage, testUser, validateUploadAgainstStorage };

package/dist/index.d.ts

@@ -1,8 +1,8 @@
-import { C as CacheClient, b as PalbaseDocsClient, c as PalbaseFlagsClient, L as Logger, d as PalbaseNotificationsClient, e as PalbaseRealtimeClient, D as DBClient, f as PalbaseStorageClient, A as AuthSpec, R as RateLimitConfig, H as HttpError } from './endpoint-D2yR2RD1.js';
-export { g as AuthConfig, B as BadRequest, h as ClientInfo, i as Conflict, j as DBOps, E as ErrorDef, k as ErrorMap, l as ErrorThrowers, F as FileContext, m as Forbidden, n as HttpMethod, M as Materialized, o as Middleware, p as MiddlewareContext, q as MiddlewareHandler, N as NotFound, P as PBRequest, r as PalError, s as PalbaseAnalyticsClient, t as PalbaseAnalyticsManagementNamespace, u as PalbaseAnalyticsProperties, v as PalbaseAnalyticsQueryNamespace, w as PalbaseAttestAndroidParams, x as PalbaseAttestAndroidResult, y as PalbaseAttestiOSParams, z as PalbaseAttestiOSResult, G as PalbaseAuthClient, I as PalbaseBatchOverrideOperation, J as PalbaseBatchSetOverridesResult, K as PalbaseBindDeviceParams, O as PalbaseBucketClient, Q as PalbaseClearAllOverridesResult, S as PalbaseClearOverrideResult, T as PalbaseCohortQueryInput, V as PalbaseCohortResult, W as PalbaseCollectionRef, X as PalbaseCountQueryInput, Y as PalbaseCountResult, Z as PalbaseCreateLinkParams, _ as PalbaseDeviceInfo, $ as PalbaseDeviceTokenView, a0 as PalbaseDocumentRef, a1 as PalbaseDocumentSnapshot, a2 as PalbaseEmailClient, a3 as PalbaseEmailSendParams, a4 as PalbaseEmailSendResponse, a5 as PalbaseEventNamesResult, a6 as PalbaseEventsQueryInput, a7 as PalbaseEventsResult, a8 as PalbaseFileObject, a9 as PalbaseFlag, aa as PalbaseFlagContext, ab as PalbaseFlagSource, ac as PalbaseFlagValue, ad as PalbaseFlagVariant, ae as PalbaseFlagsServiceClient, af as PalbaseFunctionsClient, ag as PalbaseFunnelQueryInput, ah as PalbaseFunnelResult, ai as PalbaseIdentifyTraits, aj as PalbaseInboxClient, ak as PalbaseInboxListOptions, al as PalbaseInboxListResult, am as PalbaseInboxMessage, an as PalbaseInboxSendParams, ao as PalbaseInboxSendResponse, ap as PalbaseInitialLink, aq as PalbaseInvokeOptions, ar as PalbaseLink, as as PalbaseLinkAnalytics, at as PalbaseLinkDetails, au as PalbaseLinksClient, av as PalbaseListLinksOptions, aw as PalbaseListLinksResult, ax as PalbaseListOptions, ay as PalbaseMatchParams, az as PalbaseMultiChannelResponse, aA as PalbaseOverviewResult, aB as PalbasePreferences, aC as PalbasePreferencesClient, aD as PalbasePublicUrlResponse, aE as PalbasePushClient, aF as PalbasePushSendParams, aG as PalbasePushSendResponse, aH as PalbaseQrCodeOptions, aI as PalbaseQuerySnapshot, aJ as PalbaseRegisterDeviceParams, aK as PalbaseResult, aL as PalbaseRetentionQueryInput, aM as PalbaseRetentionResult, aN as PalbaseSession, aO as PalbaseSetOverrideResult, aP as PalbaseSetOverridesResult, aQ as PalbaseSignedUrlResponse, aR as PalbaseSmsClient, aS as PalbaseSmsSendParams, aT as PalbaseSmsSendResponse, aU as PalbaseTransformOptions, aV as PalbaseUpdateLinkParams, aW as PalbaseUploadOptions, aX as PalbaseUser, aY as PalbaseUserDetailResult, aZ as PalbaseUsersQueryInput, a_ as PalbaseUsersResult, a$ as PalbaseVerifyRequestSignatureParams, b0 as PalbaseWhereOperator, b1 as Ref, b2 as TooManyRequests, b3 as TxColumnExpr, b4 as TxInsertShape, b5 as TxInsertValue, b6 as TxNow, b7 as TxPlanBody, b8 as TxPlanError, b9 as TxPlanHandle, ba as TxPlanOpResult, bb as TxPlanRejection, bc as TxPlanResponse, bd as TxRefError, be as TxRow, bf as TxRows, bg as TxSelectOptions, bh as TxSetShape, bi as TxSetValue, bj as TxTable, bk as TxWhere, bl as TxWireExpr, bm as TxWireGuard, bn as TxWireOp, bo as TxWireRef, bp as TxWireValue, bq as Unauthorized, U as UserT, br as VerifiedDevice, bs as dec, bt as defineMiddleware, bu as inc, bv as now } from './endpoint-D2yR2RD1.js';
+import { C as CacheClient, b as PalbaseDocsClient, c as PalbaseFlagsClient, L as Logger, d as PalbaseNotificationsClient, e as PalbaseRealtimeClient, D as DBClient, f as PalbaseStorageClient, A as AuthSpec, R as RateLimitConfig, H as HttpError } from './endpoint-BG-JVUPL.js';
+export { g as AuthConfig, B as BadRequest, h as ClientInfo, i as Conflict, j as DBOps, E as ErrorDef, k as ErrorMap, l as ErrorThrowers, F as FileContext, m as Forbidden, n as HttpMethod, M as Materialized, o as Middleware, p as MiddlewareContext, q as MiddlewareHandler, N as NotFound, P as PBRequest, r as PalError, s as PalbaseAnalyticsClient, t as PalbaseAnalyticsManagementNamespace, u as PalbaseAnalyticsProperties, v as PalbaseAnalyticsQueryNamespace, w as PalbaseAttestAndroidParams, x as PalbaseAttestAndroidResult, y as PalbaseAttestiOSParams, z as PalbaseAttestiOSResult, G as PalbaseAuthClient, I as PalbaseBatchOverrideOperation, J as PalbaseBatchSetOverridesResult, K as PalbaseBindDeviceParams, O as PalbaseBucketClient, Q as PalbaseClearAllOverridesResult, S as PalbaseClearOverrideResult, T as PalbaseCohortQueryInput, V as PalbaseCohortResult, W as PalbaseCollectionRef, X as PalbaseCountQueryInput, Y as PalbaseCountResult, Z as PalbaseCreateLinkParams, _ as PalbaseDeviceInfo, $ as PalbaseDeviceTokenView, a0 as PalbaseDocumentRef, a1 as PalbaseDocumentSnapshot, a2 as PalbaseEmailClient, a3 as PalbaseEmailSendParams, a4 as PalbaseEmailSendResponse, a5 as PalbaseEventNamesResult, a6 as PalbaseEventsQueryInput, a7 as PalbaseEventsResult, a8 as PalbaseFileObject, a9 as PalbaseFlag, aa as PalbaseFlagContext, ab as PalbaseFlagSource, ac as PalbaseFlagValue, ad as PalbaseFlagVariant, ae as PalbaseFlagsServiceClient, af as PalbaseFunctionsClient, ag as PalbaseFunnelQueryInput, ah as PalbaseFunnelResult, ai as PalbaseIdentifyTraits, aj as PalbaseInboxClient, ak as PalbaseInboxListOptions, al as PalbaseInboxListResult, am as PalbaseInboxMessage, an as PalbaseInboxSendParams, ao as PalbaseInboxSendResponse, ap as PalbaseInitialLink, aq as PalbaseInvokeOptions, ar as PalbaseLink, as as PalbaseLinkAnalytics, at as PalbaseLinkDetails, au as PalbaseLinksClient, av as PalbaseListLinksOptions, aw as PalbaseListLinksResult, ax as PalbaseListOptions, ay as PalbaseMatchParams, az as PalbaseMultiChannelResponse, aA as PalbaseOverviewResult, aB as PalbasePreferences, aC as PalbasePreferencesClient, aD as PalbasePublicUrlResponse, aE as PalbasePushClient, aF as PalbasePushSendParams, aG as PalbasePushSendResponse, aH as PalbaseQrCodeOptions, aI as PalbaseQuerySnapshot, aJ as PalbaseRegisterDeviceParams, aK as PalbaseResult, aL as PalbaseRetentionQueryInput, aM as PalbaseRetentionResult, aN as PalbaseSession, aO as PalbaseSetOverrideResult, aP as PalbaseSetOverridesResult, aQ as PalbaseSignedUrlResponse, aR as PalbaseSmsClient, aS as PalbaseSmsSendParams, aT as PalbaseSmsSendResponse, aU as PalbaseTransformOptions, aV as PalbaseUpdateLinkParams, aW as PalbaseUploadOptions, aX as PalbaseUser, aY as PalbaseUserDetailResult, aZ as PalbaseUsersQueryInput, a_ as PalbaseUsersResult, a$ as PalbaseVerifyRequestSignatureParams, b0 as PalbaseWhereOperator, b1 as Ref, b2 as TooManyRequests, b3 as TxColumnExpr, b4 as TxInsertShape, b5 as TxInsertValue, b6 as TxNow, b7 as TxPlanBody, b8 as TxPlanError, b9 as TxPlanHandle, ba as TxPlanOpResult, bb as TxPlanRejection, bc as TxPlanResponse, bd as TxRefError, be as TxRow, bf as TxRows, bg as TxSelectOptions, bh as TxSetShape, bi as TxSetValue, bj as TxTable, bk as TxWhere, bl as TxWireExpr, bm as TxWireGuard, bn as TxWireOp, bo as TxWireRef, bp as TxWireValue, bq as Unauthorized, U as UserT, br as VerifiedDevice, bs as dec, bt as defineMiddleware, bu as inc, bv as now } from './endpoint-BG-JVUPL.js';
 import { AsyncLocalStorage } from 'node:async_hooks';
-import { E as EnvTypedDatabase, S as SchemaDef } from './index-CB8TARW4.js';
-export { C as ColumnBuilder, a as ColumnDef, b as ColumnMap, c as ColumnType, d as EXTENSION_DEPENDENCIES, e as EnvServiceDatabase, f as EnvTables, g as EnvTypedTable, I as InsertShape, O as OnDeleteAction, P as PALBASE_EXTENSIONS, h as PalbaseExtension, i as PolicyBuilder, j as PolicyCommand, k as PolicyDef, l as PolicyMode, R as RawConstraintDef, m as RowShape, n as SchemaInput, T as TableDef, o as TableInput, p as TxPlan, q as TxTables, r as TypedDB, s as TypedTable, t as TypedTx, u as bigint, v as boolean, w as defineSchema, x as enumType, y as integer, z as isPalbaseExtension, A as jsonb, B as makeTypedDB, D as numeric, F as policy, G as raw, H as text, J as timestamp, K as uuid } from './index-CB8TARW4.js';
+import { E as EnvTypedDatabase, S as SchemaDef } from './index-QQ2byWrv.js';
+export { C as ColumnBuilder, a as ColumnDef, b as ColumnMap, c as ColumnType, d as EXTENSION_DEPENDENCIES, e as EnvServiceDatabase, f as EnvTables, g as EnvTypedTable, I as InsertShape, O as OnDeleteAction, P as PALBASE_EXTENSIONS, h as PalbaseExtension, i as PolicyBuilder, j as PolicyCommand, k as PolicyDef, l as PolicyMode, R as RawConstraintDef, m as RowShape, n as SchemaInput, T as TableDef, o as TableInput, p as TxPlan, q as TxTables, r as TypedDB, s as TypedTable, t as TypedTx, u as bigint, v as boolean, w as defineSchema, x as enumType, y as integer, z as isPalbaseExtension, A as jsonb, B as makeTypedDB, D as numeric, F as policy, G as raw, H as text, J as timestamp, K as uuid } from './index-QQ2byWrv.js';
 import { EntitlementKey, LimitKey } from './purchases/keys.js';
 import { TableTypes, Tables } from './db/env.js';
 import { ZodTypeAny, z } from 'zod';
@@ -747,6 +747,92 @@ interface TwilioOptions {
 /** The union of every provider's author-facing options. `buildProvider` accepts
  * this so each provider's typed options pass without a cast. */
 type ProviderOptions = ApnsOptions | FcmOptions | SendgridOptions | SesOptions | SmtpOptions | AcsOptions | TwilioOptions;
+/** The default locale a template row lands on when the author names none. Must
+ * match PalNotify's `model.DefaultLocale`. */
+declare const DEFAULT_TEMPLATE_LOCALE: "en";
+/** One locale's email content. */
+interface EmailTemplateContent {
+    /** Subject line. Handlebars placeholders (`{{name}}`) are rendered at send. */
+    subject: string;
+    /** HTML body. */
+    html: string;
+    /** Plain-text body. Omit and the server derives one from `html` at render. */
+    text?: string;
+    /**
+     * Variables the sender MUST supply. Omit and they are DERIVED from the
+     * `{{placeholders}}` in this locale's content — see {@link extractVariables}.
+     * Supply explicitly to make a placeholder optional (leave it out of the list)
+     * or to require something a conditional references.
+     */
+    variables?: readonly string[];
+}
+/** An email template: base content, plus optional per-locale overrides. */
+interface EmailTemplateOptions extends EmailTemplateContent {
+    /** Locale of the base content. Defaults to `"en"`. */
+    locale?: string;
+    /** Additional locales, keyed by BCP47 short tag (`tr`, `de`, …). */
+    locales?: Record<string, EmailTemplateContent>;
+}
+/** One locale's SMS content. */
+interface SmsTemplateContent {
+    /** Message body. Handlebars placeholders are rendered at send. */
+    body: string;
+    /** Variables the sender must supply. Derived from `body` when omitted. */
+    variables?: readonly string[];
+}
+/** An SMS template: base content, plus optional per-locale overrides. */
+interface SmsTemplateOptions extends SmsTemplateContent {
+    /** Locale of the base content. Defaults to `"en"`. */
+    locale?: string;
+    /** Additional locales, keyed by BCP47 short tag. */
+    locales?: Record<string, SmsTemplateContent>;
+}
+/** Author-facing templates block: slug → template. */
+interface TemplatesInput {
+    email?: Record<string, EmailTemplateOptions>;
+    sms?: Record<string, SmsTemplateOptions>;
+}
+/** A compiled email-template row — one (slug, locale) pair, in the snake_case
+ * wire shape PalNotify's templates API takes. */
+interface EmailTemplateDef {
+    slug: string;
+    locale: string;
+    subject: string;
+    html_body: string;
+    text_body?: string;
+    variables: string[];
+}
+/** A compiled SMS-template row — one (slug, locale) pair. */
+interface SmsTemplateDef {
+    slug: string;
+    locale: string;
+    body: string;
+    variables: string[];
+}
+/** The compiled templates block: flat, per-channel row lists. Flat rows (rather
+ * than a nested locale map) are what the apply step iterates — one row is one
+ * upsert against the (slug, locale) unique key. */
+interface TemplatesConfig {
+    email: EmailTemplateDef[];
+    sms: SmsTemplateDef[];
+}
+/**
+ * Pull the variable names out of Handlebars content.
+ *
+ * Only PLAIN mustaches count: `{{name}}` and `{{{name}}}`. Deliberately skipped:
+ * - block/section/partial/comment tokens (`{{#if}}`, `{{/if}}`, `{{else}}`,
+ *   `{{> partial}}`, `{{! comment}}`) — structure, not data the sender passes;
+ * - helper calls (`{{formatDate at}}`) — the first token is a helper name;
+ * - `this` and `@index`-style frame references.
+ *
+ * A dotted path contributes its ROOT (`{{user.name}}` → `user`), because that is
+ * what the sender actually has to hand over.
+ *
+ * The list is what the server ENFORCES as required at render time, so keeping it
+ * to the unambiguous cases is the point: an over-eager derivation would turn an
+ * optional conditional into a mandatory argument and 400 real sends.
+ */
+declare function extractVariables(...sources: (string | undefined)[]): string[];
 /** The author-facing input to `defineNotifications`. Every provider + every
  * channel is optional — declare only what you use. */
 interface NotificationsInput {
@@ -763,6 +849,8 @@ interface NotificationsInput {
     sms?: {
         twilio?: TwilioOptions;
     };
+    /** Email + SMS templates, keyed by slug. Applied on every deploy. */
+    templates?: TemplatesInput;
 }
 /** A compiled provider def. `enabled` is always present; the remaining keys are
  * the provider's non-secret fields (verbatim from the catalog). A disabled
@@ -778,6 +866,7 @@ interface NotificationsConfig {
     push: Record<string, ProviderDef>;
     email: Record<string, ProviderDef>;
     sms: Record<string, ProviderDef>;
+    templates: TemplatesConfig;
 }
 /**
  * Compile + validate one provider's author options into a {@link ProviderDef}.
@@ -1086,23 +1175,100 @@ type FlagOptions = {
     type: "boolean";
     default: boolean;
     variants?: never;
+    conditions?: FlagCondition<boolean>[];
     description?: string;
 } | {
     type: "number";
     default: number;
     variants?: never;
+    conditions?: FlagCondition<number>[];
     description?: string;
 } | {
     type: "string";
     default: string;
     variants?: string[];
+    conditions?: FlagCondition<string>[];
     description?: string;
 } | {
     type: "json";
     default: FlagJsonObject;
     variants?: never;
+    conditions?: FlagCondition<FlagJsonObject>[];
     description?: string;
 };
+/**
+ * One targeting branch: the value this flag resolves to when `when` matches the
+ * caller's client context. Branch ORDER is priority — the first match wins, and
+ * a flag with no matching branch falls back to its `default`.
+ *
+ * `when` is a small expression over what the client declares about itself:
+ *
+ * ```
+ * client.platform == 'ios' && client.app_version >= '2.0.0'
+ * client.locale startsWith 'tr'
+ * client.platform in ['ios', 'android']
+ * ```
+ *
+ * Those are CLAIMS, not proof — the server treats them as attacker-controlled.
+ * They select WHICH value a caller sees, never WHETHER they may see it, so a
+ * condition must not be the thing standing between a user and something paid.
+ */
+/**
+ * The variables the server exposes. Mirrors `declaredVars` in
+ * `modules/user-flags/internal/conditions/conditions.go`; the server rejects
+ * anything it does not know, so the worst a stale copy here does is offer too
+ * little.
+ *
+ * `client.*` is what the SDK reports about the caller. `percentile` and
+ * `server.now` are DERIVED server-side and cannot be moved by a lying client,
+ * which is what makes a rollout or a time window mean anything.
+ */
+type StringVar = "client.platform" | "client.locale";
+type SemverVar = "client.app_version" | "client.os_version";
+type EqualityOp = "==" | "!=";
+/** Ordering only where order exists — a platform string has none. */
+type OrderedOp = EqualityOp | "<" | "<=" | ">" | ">=";
+type TextOp = EqualityOp | "startsWith" | "endsWith" | "contains";
+/** A single-quoted literal. Quoting is the mistake people make most. */
+type Quoted = `'${string}'`;
+type Comparison = `${StringVar} ${TextOp} ${Quoted}` | `${StringVar} in [${string}]` | `${SemverVar} ${OrderedOp} ${Quoted}` | `percentile ${OrderedOp} ${number}` | `server.now ${OrderedOp} ${Quoted}`;
+/**
+ * One expression: a comparison, optionally chained with `&&` / `||`, or a
+ * parenthesised group.
+ *
+ * ONE level, and the limit is TypeScript's, not a preference. Unrolling a second
+ * level produced `TS2590: union type too complex`, and the failure mode there is
+ * the worst possible one: the checker gives up and the type silently degrades to
+ * `string`, so NOTHING is checked while the code still compiles. Measured, not
+ * assumed — the two-level version accepted `client.app_verison` without
+ * complaint.
+ *
+ * So the FIRST term is fully checked and the rest of a chain is not. That is
+ * where the mistakes are: a rule is usually one comparison, and a typo in the
+ * first one is the common case. A typo after an `&&` still reaches the server,
+ * which parses the real grammar and rejects it.
+ *
+ * A group's contents go unchecked for the same reason.
+ */
+type FlagConditionExpression = Comparison | `${Comparison} && ${string}` | `${Comparison} || ${string}` | `(${string})`;
+interface FlagCondition<V> {
+    when: FlagConditionExpression;
+    value: V;
+}
+/**
+ * The COMPILED shape of a condition — the JSON actually emitted and parsed by
+ * the Go apply step.
+ *
+ * `when` widens back to `string` here on purpose. The narrow type is an
+ * authoring aid; once the expression has been trimmed and serialised it is just
+ * text on the wire, and keeping the template-literal type would force a cast on
+ * every string operation without checking anything the author had not already
+ * been checked on.
+ */
+interface CompiledFlagCondition<V> {
+    when: string;
+    value: V;
+}
 /**
  * The compiled, serializable flag definition — the EXACT shape emitted to JSON
  * and consumed by the Go apply step.
@@ -1117,6 +1283,8 @@ interface FlagDef {
     type: FlagType;
     default: FlagValue;
     variants: string[] | null;
+    /** Ordered targeting branches, or `null` when the flag is unconditional. */
+    conditions: CompiledFlagCondition<FlagValue>[] | null;
     description: string | null;
 }
 /** A flags config definition: the discriminant + a map of flag key →
@@ -1715,4 +1883,4 @@ declare const documents: {
     onDocumentDeleted(handler: HookHandler<DocumentDeletedEvent>): ResolvedHook<DocumentDeletedEvent>;
 };
 
-export { type AcsOptions, type ApnsOptions, Body, type BucketDef, type BucketOptions, Cache, CacheClient, Client, Controller, type ControllerOptions, DBClient, Database, type DefinedError, type DefinedErrorWithData, Delete, type DocumentCreatedEvent, type DocumentDeletedEvent, type DocumentUpdatedEvent, Documents, EGRESS_CONFIG_KIND, EGRESS_TIMEOUT_DEFAULT_MS, EGRESS_TIMEOUT_MAX_MS, EGRESS_TIMEOUT_MIN_MS, type EgressConfig, type EgressInput, EntitlementKey, EnvTypedDatabase, FLAGS_CONFIG_KIND, type FcmOptions, type FileDeletedEvent, type FileUploadedEvent, type FlagDef, type FlagJsonObject, type FlagJsonValue, type FlagOptions, type FlagType, type FlagValue, Flags, type FlagsConfig, type FlagsInput, Get, Headers, type HookHandler, type HookMeta, HttpError, type HttpMethodUpper, Job, type JobMeta, type JobOptions, LimitKey, type LimitState, Log, Logger, NOTIFICATIONS_CONFIG_KIND, Notifications, type NotificationsConfig, type NotificationsInput, On, OptionalUser, type OwnedTablesOf, PROVIDER_CATALOG, PalbaseDocsClient, PalbaseFlagsClient, PalbaseNotificationsClient, PalbaseRealtimeClient, PalbaseStorageClient, Param, type ParamKind, type ParamMeta, type PasswordResetEvent, Patch, Post, type ProviderCatalogEntry, type ProviderDef, type ProviderName, type ProviderOptions, Purchases, type PurchasesManifest, type PurchasesService, Put, Query, QueryParams, RESERVED_SECRET_PREFIX, RateLimitConfig, Realtime, type RegisteredError, Req, RequestId, type RequestStore, RequireEntitlement, type ResolvedHook, type ResolvedJob, type ResolvedWebhook, Resource, type ResourceEnv, type RouteMeta, type RouteOptions, type RuntimeServices, STORAGE_CONFIG_KIND, SchemaDef, type Seed, type SeedFor, type SeedJson, type SeedRowFor, type SendgridOptions, type SesOptions, type SignInEvent, type SignOutEvent, type SignatureSpec, type SmtpOptions, Spend, type SpendMeta, type SpendOptions, Storage, type StorageConfig, type StorageInput, type StoreEnv, TEST_USERS_CONFIG_KIND, type TableGraph, TableTypes, Tables, type TestUserDef, type TestUserOptions, type TestUsersConfig, type TestUsersInput, type ThrowDescriptor, TraceId, type TwilioOptions, Upload, type UploadConfig, UploadedObject, User, type UserCreatedEvent, Webhook, type WebhookEventHandler, type WebhookMeta, type WebhookOptions, type WebhookProvider, type WebhookRequest, __getRuntime, __registerResource, __requestALS, __runResourceBoot, __runWithRuntime, __setRuntime, __shutdownResources, auth, bucket, buildProvider, defineEgress, defineError, defineFlags, defineNotifications, defineStorage, defineTestUsers, documents, entitlementFor, flag, getErrorRegistry, getJobConfig, getRoutes, getWebhookConfig, makeEnvDts, makePurchasesDts, parseFileSizeLimit, recordThrows, reservedSecretKey, spendFor, storage, testUser, validateUploadAgainstStorage };
+export { type AcsOptions, type ApnsOptions, Body, type BucketDef, type BucketOptions, Cache, CacheClient, Client, Controller, type ControllerOptions, DBClient, DEFAULT_TEMPLATE_LOCALE, Database, type DefinedError, type DefinedErrorWithData, Delete, type DocumentCreatedEvent, type DocumentDeletedEvent, type DocumentUpdatedEvent, Documents, EGRESS_CONFIG_KIND, EGRESS_TIMEOUT_DEFAULT_MS, EGRESS_TIMEOUT_MAX_MS, EGRESS_TIMEOUT_MIN_MS, type EgressConfig, type EgressInput, type EmailTemplateContent, type EmailTemplateDef, type EmailTemplateOptions, EntitlementKey, EnvTypedDatabase, FLAGS_CONFIG_KIND, type FcmOptions, type FileDeletedEvent, type FileUploadedEvent, type FlagDef, type FlagJsonObject, type FlagJsonValue, type FlagOptions, type FlagType, type FlagValue, Flags, type FlagsConfig, type FlagsInput, Get, Headers, type HookHandler, type HookMeta, HttpError, type HttpMethodUpper, Job, type JobMeta, type JobOptions, LimitKey, type LimitState, Log, Logger, NOTIFICATIONS_CONFIG_KIND, Notifications, type NotificationsConfig, type NotificationsInput, On, OptionalUser, type OwnedTablesOf, PROVIDER_CATALOG, PalbaseDocsClient, PalbaseFlagsClient, PalbaseNotificationsClient, PalbaseRealtimeClient, PalbaseStorageClient, Param, type ParamKind, type ParamMeta, type PasswordResetEvent, Patch, Post, type ProviderCatalogEntry, type ProviderDef, type ProviderName, type ProviderOptions, Purchases, type PurchasesManifest, type PurchasesService, Put, Query, QueryParams, RESERVED_SECRET_PREFIX, RateLimitConfig, Realtime, type RegisteredError, Req, RequestId, type RequestStore, RequireEntitlement, type ResolvedHook, type ResolvedJob, type ResolvedWebhook, Resource, type ResourceEnv, type RouteMeta, type RouteOptions, type RuntimeServices, STORAGE_CONFIG_KIND, SchemaDef, type Seed, type SeedFor, type SeedJson, type SeedRowFor, type SendgridOptions, type SesOptions, type SignInEvent, type SignOutEvent, type SignatureSpec, type SmsTemplateContent, type SmsTemplateDef, type SmsTemplateOptions, type SmtpOptions, Spend, type SpendMeta, type SpendOptions, Storage, type StorageConfig, type StorageInput, type StoreEnv, TEST_USERS_CONFIG_KIND, type TableGraph, TableTypes, Tables, type TemplatesConfig, type TemplatesInput, type TestUserDef, type TestUserOptions, type TestUsersConfig, type TestUsersInput, type ThrowDescriptor, TraceId, type TwilioOptions, Upload, type UploadConfig, UploadedObject, User, type UserCreatedEvent, Webhook, type WebhookEventHandler, type WebhookMeta, type WebhookOptions, type WebhookProvider, type WebhookRequest, __getRuntime, __registerResource, __requestALS, __runResourceBoot, __runWithRuntime, __setRuntime, __shutdownResources, auth, bucket, buildProvider, defineEgress, defineError, defineFlags, defineNotifications, defineStorage, defineTestUsers, documents, entitlementFor, extractVariables, flag, getErrorRegistry, getJobConfig, getRoutes, getWebhookConfig, makeEnvDts, makePurchasesDts, parseFileSizeLimit, recordThrows, reservedSecretKey, spendFor, storage, testUser, validateUploadAgainstStorage };