@stndrds/schema 1.0.0-alpha.191 → 1.0.0-alpha.192

package/dist/index.d.mts

@@ -765,7 +765,7 @@ type Action = "read" | "create" | "update" | "delete" | "manage" | "observe";
  * - `workspace`: Tenant settings and workspace-level configuration
  * - `architect`: Architect settings, templates, and configurations
  */
-type SystemResource = "people" | "workspace" | "architect" | "feature-flags" | "files" | "views" | "forms" | "documents" | "audit" | "api-keys" | "session";
+type SystemResource = "people" | "workspace" | "architect" | "feature-flags" | "files" | "views" | "forms" | "documents" | "audit" | "api-keys" | "env-vars" | "session";
 /**
  * Preset access levels for simplified permission configuration.
  * - `full`: All CRUD actions
@@ -1033,6 +1033,27 @@ interface CreateApiKeyInput {
     actorMetadata?: Record<string, unknown>;
 }
 
+/** Scope of an env var — consumer type + ID (e.g. agent definition). */
+interface EnvVarScope {
+    type: string;
+    id: string;
+}
+/**
+ * Returned by list endpoints.
+ * The encrypted value is NEVER included — only metadata.
+ * `isSet: true` is the only indicator that a value exists.
+ */
+interface EnvVarEntry {
+    id: string;
+    key: string;
+    isSensitive: boolean;
+    isSet: true;
+    scopeType: string;
+    scopeId: string | null;
+    createdAt: string;
+    updatedAt: string;
+}
+
 /**
  * Type of mentionable entity
  */
@@ -1235,6 +1256,22 @@ interface AuditServiceOptions {
      */
     flushIntervalMs?: number;
 }
+/**
+ * A single field-level history entry, derived from an audit log change.
+ * Client-safe — no tenant or internal IDs.
+ */
+interface FieldHistoryEntry {
+    id: string;
+    field: string;
+    oldValue: unknown;
+    newValue: unknown;
+    oldLabel?: string;
+    newLabel?: string;
+    oldLabels?: string[];
+    newLabels?: string[];
+    actorEmail?: string;
+    createdAt: Date;
+}
 
 type AgentRunStatus = "pending" | "running" | "completed" | "failed" | "cancelled" | "paused";
 type AgentSessionStatus = "active" | "idle" | "completed" | "failed" | "cancelled" | "waiting_human" | "timeout" | "expired";
@@ -3367,6 +3404,8 @@ declare const SYSTEM_RESOURCES: {
     readonly AUDIT: "audit";
     /** Programmatic access keys */
     readonly API_KEYS: "api-keys";
+    /** Environment variables for agents */
+    readonly ENV_VARS: "env-vars";
     /** Agent session visibility — required for an agent actor to read its own sessions */
     readonly SESSION: "session";
 };
@@ -6679,4 +6718,4 @@ interface QualifiedRuleValidationContext {
 }
 declare function validateQualifiedRule(rule: FilterRule, context: QualifiedRuleValidationContext): void;
 
-export { type AIAvailableModel, type AIBatchQuestion, type AIBatchQuestionAnswer, type AIBatchQuestionOption, type AIChatMessage, type AIChatMessagePart, type AIChatMessagePartType, type AICompactionSummary, type AIMemoryEntry, type AIMemoryType, type AIMessageRole, type AIProviderMetrics, type AIQuestion, type AIQuestionAnswer, type AIQuestionOption, type AIQuestionType, type AITodoItem, type AITodoList, type AITodoStatus, type AIToolCall, type AIToolCallStatus, type AIUsageMetrics, ALLOWED_PROPERTY_TYPES, ALL_ACTIONS, ALL_SYSTEM_RESOURCES, type AccessAction, type AccessActionList, AccessDeniedError, type AccessLevel, type AccessPolicy, type AccessPolicyPreset, type AccessResourceType, type Action, ActivityTabConfig, type Actor, type ActorRoleAssignment, type ActorStatus, type ActorType, type AddAttributeInput, type AgentConfig, type AgentContextEntry, type AgentDashboard, type AgentDefinition, type AgentEvent, type AgentExecutionConfig, type AgentExecutionPolicy, type AgentMessageAttachment, type AgentMessagePart, type AgentQuestion, type AgentRun, type AgentRunStatus, type AgentSchedule, type AgentSession, type AgentSessionMessage, type AgentSessionMode, type AgentSessionStatus, type AgentToolCall, type AgentTriggerDefinition, type AgentTriggerType, type ApiKey, type ApiKeyAuthContext, type ApiKeyPermission, type ApiKeyWithSecret, type AssignActorRoleInput, type AssignRoleInput, Attribute, AttributeGroupField, AttributeInUseError, AttributeNotFoundError, AttributeType, type AttributeUsage, type AuditAction, type AuditActorType, type AuditChange, type AuditListOptions, type AuditLogEntry, type AuditResourceType, type AuditServiceOptions, type AuditSortField, BEHAVIOR_PROPERTIES, BilateralConfig, type BoundingBox, type BuilderConfig, ChangeTypeNotSupportedError, CheckboxAttribute, CompletionStatus, ConcurrentModificationError, ConfigOverrides, type CountMode, type CreateActorInput, type CreateApiKeyInput, type CreateAuditLogInput, type CreateCustomObjectInput, type CreateDBAttribute, type CreateDBForm, type CreateDBFormSubmission, type CreateDBObject, type CreateDBView, type CreateDBViewOverlay, type CreateFile, CreateMode, type CreateObjectRecord, type CreatePermissionInput, type CreateRoleInput, type CreateSandboxExecution, type CreateUserProfile, type CreateViewInput, type CriticConfig, Currency, CurrencyAttribute, type CustomAttributeValue, CustomTabConfig, type DBAttribute, type DBForm, type DBFormSubmission, type DBObject, type DBView, type DBViewOverlay, DB_COLUMN_FIELDS, DEFAULT_ROLES, DEFAULT_ROLE_DESCRIPTIONS, DEFAULT_ROLE_LABELS, DEFAULT_ROLE_PERMISSIONS, DOCUMENT_SYSTEM_ATTRIBUTES, DateAttribute, type DefaultRoleName, type DeletedMode, DestructiveSyncNotAllowedError, DetailViewBuilder, DetailViewConfig, DetailViewDefinition, DetailViewLayout, DocumentAttribute, DocumentLayout, DocumentSlotConfig, DocumentSlotValidationError, DocumentsTabConfig, type DomainEvent, DuplicateError, EMPTY_VALUE_PLACEHOLDER, type EffectivePermissions, type EventDataMap, type EventType, type ExtractRecord, type ExtractRecordInput, type ExtractRecordInputStrict, type ExtractRecordStrict, type ExtractRecordUpdate, type ExtractRecordUpdateStrict, FORM_FORBIDDEN_ATTRIBUTE_TYPES, FeatureFlagDefinition, FeatureFlagsRepository, FeatureGate, Field, FieldGroup, type File, FileAttribute, type FileListOptions, type FileVisibility, FilterOperator, FilterRule, FilterState, FilterValue, FlagLevel, FlagRegistry, FlagService, FlagValueType, ForbiddenError, FormBuilder, type FormDefinition, type FormFieldRef, type FormFieldsRow, type FormFreeFieldRef, type FormHeadingRow, FormRegistry, type FormRow, FormRowBuilder, type FormSeparatorRow, type FormSlot, type FormSlotFieldRef, type FormStatus, type FormStep, FormStepBuilder, type FormSubmission, type FormSubmissionStatus, type FormSubmittedAgentEvent, type FormTextRow, FormulaAttribute, type FormulaResult, FormulaReturnType, type GeocodingAdapter, type GeocodingAutocompleteParams, type GeocodingParams, type GeocodingSuggestion, type GlobalSearchGroupedOptions, type GlobalSearchGroupedResult, type GlobalSearchOptions, type GlobalSearchResultItem, type GrantResourceAccessInput, Group, GroupBuilder, IDENTITY_PROPERTIES, type InferAttributeValue, type InferQualifiedProps, InvalidPathError, type InviteUserInput, type ListOptions, ListViewBuilder, ListViewConfig, ListViewDefinition, ListViewTab, ListViewTabConfigBuilder, Location, LocationAttribute, LocationGranularity, MaxDepthExceededError, MemoryNotFoundError, type MentionEntityType, type MentionReference, type MentionedContext, type MentionedEntityContext, MigrationDefinition, MigrationTimeoutError, type ModelDefinition, MultiRelationAttribute, MultiselectAttribute, NoopGeocodingAdapter, NotFoundError, NotImplementedError, NumberAttribute, OPERATOR_SPECS, ObjectBuilder, ObjectDefinition, ObjectNotFoundError, type ObjectPermissions, ObjectReferencedError, type OcrAdapter, type OcrInput, type OcrOptions, type OcrPage, type OcrResult, type OcrTextBlock, type OperatorSpec, Option, OrphanSystemAttributeError, PRESENTATION_PROPERTIES, type PageInfo, type PageOptions, type PageResponse, type ParsedAttribute, type PathCardinality, type PathSegment, type PathSegmentType, type Permission, type PermissionScope, Phone, PhoneAttribute, type PrincipalType, PropertySchema, ProtectedResourceError, ProtectedRoleError, type ProviderName, QUALIFIED_SEPARATOR, type QualifiedDocumentBrand, type QuestionResponse, type QuestionStatus, RatingAttribute, type ReasoningPartData, type RecordAgentEvent, type RecordMetadata, RecordNotFoundError, type RecordReference, RecordReferencedError, RelationAttribute, RelationGroup, RelationGroupBuilder, type RelationOption, type RelationOptionsResponse, RelationTarget, RepositoryError, type RepositoryOperation, ResolvedFlag, type ResourceAccess, type ResourceRef, type RetryPolicy, type ReverseGeocodingParams, RichtextAttribute, RichtextFeature, RichtextTabConfig, type Role, RoleNotFoundError, RollupAttribute, RollupFunction, STANDARD_SCHEMA_VENDOR, SYSTEM_ATTRIBUTES, SYSTEM_ATTRIBUTE_I18N_KEYS, SYSTEM_RESOURCES, SYSTEM_RESOURCE_LABELS, type SandboxExecution, type SandboxExecutionInput, type SandboxExecutionResult, type SandboxExecutionStatus, type SandboxMode, type SandboxTrigger, SchemaError, SchemaErrorCode, SchemaOperation, type SchemaResolver, type SearchOptions, SelectAttribute, SidePanelConfig, type SidebarExtraItem, SingleRelationAttribute, type SlotMode, SortRule, type SpecificAccessAction, type StandardSchemaIssue, type StandardSchemaResult, StaticFlagDefault, StatusAttribute, StorageError, type StorageOperation, type StorageProvider, type StreamEventCompactionEnd, type StreamEventCompactionFailed, type StreamEventCompactionStart, type StreamEventMessagePersisted, SyncCascadeError, SyncConflictError, SyncError, type SystemAttribute, type SystemAttributeI18nKey, SystemEntityImmutableError, type SystemFields, type SystemPermissions, type SystemResource, Tab, TabBuilder, TableTab, TableTabConfig, TenantId, TextAreaAttribute, TextAttribute, type TextPartData, type ThinkingPartData, type TimeoutPolicy, Timestamps, type ToolPartData, type ToolPartState, type TriggerEventType, USER_STATUSES, type UpdateActorInput, type UpdateDBAttribute, type UpdateDBForm, type UpdateDBFormSubmission, type UpdateDBObject, type UpdateDBView, type UpdateDBViewOverlay, type UpdateFile, type UpdateObjectInput, type UpdateRoleInput, type UpdateUserProfile, type UpdateViewInput, type UpsertAccessPolicyInput, type UpsertDBAttribute, type UpsertDBObject, type UpsertDBView, UserAttribute, type UserProfile, type UserRoleAssignment, type UserStatus, Uuid, ValidationError, type ValidationErrorDetail, ViewConfig, ViewDefinition, ViewType, type WithCustomAttributes$1 as WithCustomAttributes, accessLevelToActions, actionsToAccessLevel, applyPipes, booleanFlag, buildPropertySchema, buildQualifiedAttribute, checkbox, createFlagRegistry, createFlagService, createStandardSchemaProps, currency, date, detailView, document, evaluateFilterState, evaluateFormula, evaluateFormulaAttribute, evaluateFormulaWithResult, extractAttributeNames, extractFormulaVariables, extractRelationNames, extractRelationReferences, file, flagRegistry, flattenRelationsForEval, form, formRegistry, formatAttributeValue, formatFormulaResult, formula, generateDefaultDetailView, generateDefaultListView, getActiveTab, getErrorMessage, getOperatorPolarity, getPathDepth, getRelationPath, getSystemAttributeI18nKey, getSystemAttributeList, getTargetAttributeName, group, hasRelationReferences, isAttributeInUseError, isDefaultRole, isDocumentAttribute, isEmptyObject, isFormDefinition, isFormFieldsRow, isFormFreeFieldRef, isFormHeadingRow, isFormSeparatorRow, isFormSlotFieldRef, isFormTextRow, isLabelExpression, isNotEmpty, isNotFoundError, isObjectReferencedError, isProtectedResourceError, isRecordReferencedError, isSchemaError, isStandardSchema, isValidationError, jsonFlag, listView, location, matchesMime, multiselect, normaliseDocumentSlots, normalizeForEdgeRpc, number, numberFlag, object, parsePath, parseQualifiedAttribute, pathHasManyCardinality, phone, rating, registry, relation, relationGroup, renderLabelExpression, resetViewToDefault, richtext, rollup, select, status, stringFlag, text, textarea, toUndefinedIfEmpty, user, validateAttributeName, validateFormulaExpression, validatePath, validateQualifiedRule, validateSlotAgainstConfig, viewRegistry };
+export { type AIAvailableModel, type AIBatchQuestion, type AIBatchQuestionAnswer, type AIBatchQuestionOption, type AIChatMessage, type AIChatMessagePart, type AIChatMessagePartType, type AICompactionSummary, type AIMemoryEntry, type AIMemoryType, type AIMessageRole, type AIProviderMetrics, type AIQuestion, type AIQuestionAnswer, type AIQuestionOption, type AIQuestionType, type AITodoItem, type AITodoList, type AITodoStatus, type AIToolCall, type AIToolCallStatus, type AIUsageMetrics, ALLOWED_PROPERTY_TYPES, ALL_ACTIONS, ALL_SYSTEM_RESOURCES, type AccessAction, type AccessActionList, AccessDeniedError, type AccessLevel, type AccessPolicy, type AccessPolicyPreset, type AccessResourceType, type Action, ActivityTabConfig, type Actor, type ActorRoleAssignment, type ActorStatus, type ActorType, type AddAttributeInput, type AgentConfig, type AgentContextEntry, type AgentDashboard, type AgentDefinition, type AgentEvent, type AgentExecutionConfig, type AgentExecutionPolicy, type AgentMessageAttachment, type AgentMessagePart, type AgentQuestion, type AgentRun, type AgentRunStatus, type AgentSchedule, type AgentSession, type AgentSessionMessage, type AgentSessionMode, type AgentSessionStatus, type AgentToolCall, type AgentTriggerDefinition, type AgentTriggerType, type ApiKey, type ApiKeyAuthContext, type ApiKeyPermission, type ApiKeyWithSecret, type AssignActorRoleInput, type AssignRoleInput, Attribute, AttributeGroupField, AttributeInUseError, AttributeNotFoundError, AttributeType, type AttributeUsage, type AuditAction, type AuditActorType, type AuditChange, type AuditListOptions, type AuditLogEntry, type AuditResourceType, type AuditServiceOptions, type AuditSortField, BEHAVIOR_PROPERTIES, BilateralConfig, type BoundingBox, type BuilderConfig, ChangeTypeNotSupportedError, CheckboxAttribute, CompletionStatus, ConcurrentModificationError, ConfigOverrides, type CountMode, type CreateActorInput, type CreateApiKeyInput, type CreateAuditLogInput, type CreateCustomObjectInput, type CreateDBAttribute, type CreateDBForm, type CreateDBFormSubmission, type CreateDBObject, type CreateDBView, type CreateDBViewOverlay, type CreateFile, CreateMode, type CreateObjectRecord, type CreatePermissionInput, type CreateRoleInput, type CreateSandboxExecution, type CreateUserProfile, type CreateViewInput, type CriticConfig, Currency, CurrencyAttribute, type CustomAttributeValue, CustomTabConfig, type DBAttribute, type DBForm, type DBFormSubmission, type DBObject, type DBView, type DBViewOverlay, DB_COLUMN_FIELDS, DEFAULT_ROLES, DEFAULT_ROLE_DESCRIPTIONS, DEFAULT_ROLE_LABELS, DEFAULT_ROLE_PERMISSIONS, DOCUMENT_SYSTEM_ATTRIBUTES, DateAttribute, type DefaultRoleName, type DeletedMode, DestructiveSyncNotAllowedError, DetailViewBuilder, DetailViewConfig, DetailViewDefinition, DetailViewLayout, DocumentAttribute, DocumentLayout, DocumentSlotConfig, DocumentSlotValidationError, DocumentsTabConfig, type DomainEvent, DuplicateError, EMPTY_VALUE_PLACEHOLDER, type EffectivePermissions, type EnvVarEntry, type EnvVarScope, type EventDataMap, type EventType, type ExtractRecord, type ExtractRecordInput, type ExtractRecordInputStrict, type ExtractRecordStrict, type ExtractRecordUpdate, type ExtractRecordUpdateStrict, FORM_FORBIDDEN_ATTRIBUTE_TYPES, FeatureFlagDefinition, FeatureFlagsRepository, FeatureGate, Field, FieldGroup, type FieldHistoryEntry, type File, FileAttribute, type FileListOptions, type FileVisibility, FilterOperator, FilterRule, FilterState, FilterValue, FlagLevel, FlagRegistry, FlagService, FlagValueType, ForbiddenError, FormBuilder, type FormDefinition, type FormFieldRef, type FormFieldsRow, type FormFreeFieldRef, type FormHeadingRow, FormRegistry, type FormRow, FormRowBuilder, type FormSeparatorRow, type FormSlot, type FormSlotFieldRef, type FormStatus, type FormStep, FormStepBuilder, type FormSubmission, type FormSubmissionStatus, type FormSubmittedAgentEvent, type FormTextRow, FormulaAttribute, type FormulaResult, FormulaReturnType, type GeocodingAdapter, type GeocodingAutocompleteParams, type GeocodingParams, type GeocodingSuggestion, type GlobalSearchGroupedOptions, type GlobalSearchGroupedResult, type GlobalSearchOptions, type GlobalSearchResultItem, type GrantResourceAccessInput, Group, GroupBuilder, IDENTITY_PROPERTIES, type InferAttributeValue, type InferQualifiedProps, InvalidPathError, type InviteUserInput, type ListOptions, ListViewBuilder, ListViewConfig, ListViewDefinition, ListViewTab, ListViewTabConfigBuilder, Location, LocationAttribute, LocationGranularity, MaxDepthExceededError, MemoryNotFoundError, type MentionEntityType, type MentionReference, type MentionedContext, type MentionedEntityContext, MigrationDefinition, MigrationTimeoutError, type ModelDefinition, MultiRelationAttribute, MultiselectAttribute, NoopGeocodingAdapter, NotFoundError, NotImplementedError, NumberAttribute, OPERATOR_SPECS, ObjectBuilder, ObjectDefinition, ObjectNotFoundError, type ObjectPermissions, ObjectReferencedError, type OcrAdapter, type OcrInput, type OcrOptions, type OcrPage, type OcrResult, type OcrTextBlock, type OperatorSpec, Option, OrphanSystemAttributeError, PRESENTATION_PROPERTIES, type PageInfo, type PageOptions, type PageResponse, type ParsedAttribute, type PathCardinality, type PathSegment, type PathSegmentType, type Permission, type PermissionScope, Phone, PhoneAttribute, type PrincipalType, PropertySchema, ProtectedResourceError, ProtectedRoleError, type ProviderName, QUALIFIED_SEPARATOR, type QualifiedDocumentBrand, type QuestionResponse, type QuestionStatus, RatingAttribute, type ReasoningPartData, type RecordAgentEvent, type RecordMetadata, RecordNotFoundError, type RecordReference, RecordReferencedError, RelationAttribute, RelationGroup, RelationGroupBuilder, type RelationOption, type RelationOptionsResponse, RelationTarget, RepositoryError, type RepositoryOperation, ResolvedFlag, type ResourceAccess, type ResourceRef, type RetryPolicy, type ReverseGeocodingParams, RichtextAttribute, RichtextFeature, RichtextTabConfig, type Role, RoleNotFoundError, RollupAttribute, RollupFunction, STANDARD_SCHEMA_VENDOR, SYSTEM_ATTRIBUTES, SYSTEM_ATTRIBUTE_I18N_KEYS, SYSTEM_RESOURCES, SYSTEM_RESOURCE_LABELS, type SandboxExecution, type SandboxExecutionInput, type SandboxExecutionResult, type SandboxExecutionStatus, type SandboxMode, type SandboxTrigger, SchemaError, SchemaErrorCode, SchemaOperation, type SchemaResolver, type SearchOptions, SelectAttribute, SidePanelConfig, type SidebarExtraItem, SingleRelationAttribute, type SlotMode, SortRule, type SpecificAccessAction, type StandardSchemaIssue, type StandardSchemaResult, StaticFlagDefault, StatusAttribute, StorageError, type StorageOperation, type StorageProvider, type StreamEventCompactionEnd, type StreamEventCompactionFailed, type StreamEventCompactionStart, type StreamEventMessagePersisted, SyncCascadeError, SyncConflictError, SyncError, type SystemAttribute, type SystemAttributeI18nKey, SystemEntityImmutableError, type SystemFields, type SystemPermissions, type SystemResource, Tab, TabBuilder, TableTab, TableTabConfig, TenantId, TextAreaAttribute, TextAttribute, type TextPartData, type ThinkingPartData, type TimeoutPolicy, Timestamps, type ToolPartData, type ToolPartState, type TriggerEventType, USER_STATUSES, type UpdateActorInput, type UpdateDBAttribute, type UpdateDBForm, type UpdateDBFormSubmission, type UpdateDBObject, type UpdateDBView, type UpdateDBViewOverlay, type UpdateFile, type UpdateObjectInput, type UpdateRoleInput, type UpdateUserProfile, type UpdateViewInput, type UpsertAccessPolicyInput, type UpsertDBAttribute, type UpsertDBObject, type UpsertDBView, UserAttribute, type UserProfile, type UserRoleAssignment, type UserStatus, Uuid, ValidationError, type ValidationErrorDetail, ViewConfig, ViewDefinition, ViewType, type WithCustomAttributes$1 as WithCustomAttributes, accessLevelToActions, actionsToAccessLevel, applyPipes, booleanFlag, buildPropertySchema, buildQualifiedAttribute, checkbox, createFlagRegistry, createFlagService, createStandardSchemaProps, currency, date, detailView, document, evaluateFilterState, evaluateFormula, evaluateFormulaAttribute, evaluateFormulaWithResult, extractAttributeNames, extractFormulaVariables, extractRelationNames, extractRelationReferences, file, flagRegistry, flattenRelationsForEval, form, formRegistry, formatAttributeValue, formatFormulaResult, formula, generateDefaultDetailView, generateDefaultListView, getActiveTab, getErrorMessage, getOperatorPolarity, getPathDepth, getRelationPath, getSystemAttributeI18nKey, getSystemAttributeList, getTargetAttributeName, group, hasRelationReferences, isAttributeInUseError, isDefaultRole, isDocumentAttribute, isEmptyObject, isFormDefinition, isFormFieldsRow, isFormFreeFieldRef, isFormHeadingRow, isFormSeparatorRow, isFormSlotFieldRef, isFormTextRow, isLabelExpression, isNotEmpty, isNotFoundError, isObjectReferencedError, isProtectedResourceError, isRecordReferencedError, isSchemaError, isStandardSchema, isValidationError, jsonFlag, listView, location, matchesMime, multiselect, normaliseDocumentSlots, normalizeForEdgeRpc, number, numberFlag, object, parsePath, parseQualifiedAttribute, pathHasManyCardinality, phone, rating, registry, relation, relationGroup, renderLabelExpression, resetViewToDefault, richtext, rollup, select, status, stringFlag, text, textarea, toUndefinedIfEmpty, user, validateAttributeName, validateFormulaExpression, validatePath, validateQualifiedRule, validateSlotAgainstConfig, viewRegistry };

package/dist/index.d.ts

@@ -765,7 +765,7 @@ type Action = "read" | "create" | "update" | "delete" | "manage" | "observe";
  * - `workspace`: Tenant settings and workspace-level configuration
  * - `architect`: Architect settings, templates, and configurations
  */
-type SystemResource = "people" | "workspace" | "architect" | "feature-flags" | "files" | "views" | "forms" | "documents" | "audit" | "api-keys" | "session";
+type SystemResource = "people" | "workspace" | "architect" | "feature-flags" | "files" | "views" | "forms" | "documents" | "audit" | "api-keys" | "env-vars" | "session";
 /**
  * Preset access levels for simplified permission configuration.
  * - `full`: All CRUD actions
@@ -1033,6 +1033,27 @@ interface CreateApiKeyInput {
     actorMetadata?: Record<string, unknown>;
 }
 
+/** Scope of an env var — consumer type + ID (e.g. agent definition). */
+interface EnvVarScope {
+    type: string;
+    id: string;
+}
+/**
+ * Returned by list endpoints.
+ * The encrypted value is NEVER included — only metadata.
+ * `isSet: true` is the only indicator that a value exists.
+ */
+interface EnvVarEntry {
+    id: string;
+    key: string;
+    isSensitive: boolean;
+    isSet: true;
+    scopeType: string;
+    scopeId: string | null;
+    createdAt: string;
+    updatedAt: string;
+}
+
 /**
  * Type of mentionable entity
  */
@@ -1235,6 +1256,22 @@ interface AuditServiceOptions {
      */
     flushIntervalMs?: number;
 }
+/**
+ * A single field-level history entry, derived from an audit log change.
+ * Client-safe — no tenant or internal IDs.
+ */
+interface FieldHistoryEntry {
+    id: string;
+    field: string;
+    oldValue: unknown;
+    newValue: unknown;
+    oldLabel?: string;
+    newLabel?: string;
+    oldLabels?: string[];
+    newLabels?: string[];
+    actorEmail?: string;
+    createdAt: Date;
+}
 
 type AgentRunStatus = "pending" | "running" | "completed" | "failed" | "cancelled" | "paused";
 type AgentSessionStatus = "active" | "idle" | "completed" | "failed" | "cancelled" | "waiting_human" | "timeout" | "expired";
@@ -3367,6 +3404,8 @@ declare const SYSTEM_RESOURCES: {
     readonly AUDIT: "audit";
     /** Programmatic access keys */
     readonly API_KEYS: "api-keys";
+    /** Environment variables for agents */
+    readonly ENV_VARS: "env-vars";
     /** Agent session visibility — required for an agent actor to read its own sessions */
     readonly SESSION: "session";
 };
@@ -6679,4 +6718,4 @@ interface QualifiedRuleValidationContext {
 }
 declare function validateQualifiedRule(rule: FilterRule, context: QualifiedRuleValidationContext): void;
 
-export { type AIAvailableModel, type AIBatchQuestion, type AIBatchQuestionAnswer, type AIBatchQuestionOption, type AIChatMessage, type AIChatMessagePart, type AIChatMessagePartType, type AICompactionSummary, type AIMemoryEntry, type AIMemoryType, type AIMessageRole, type AIProviderMetrics, type AIQuestion, type AIQuestionAnswer, type AIQuestionOption, type AIQuestionType, type AITodoItem, type AITodoList, type AITodoStatus, type AIToolCall, type AIToolCallStatus, type AIUsageMetrics, ALLOWED_PROPERTY_TYPES, ALL_ACTIONS, ALL_SYSTEM_RESOURCES, type AccessAction, type AccessActionList, AccessDeniedError, type AccessLevel, type AccessPolicy, type AccessPolicyPreset, type AccessResourceType, type Action, ActivityTabConfig, type Actor, type ActorRoleAssignment, type ActorStatus, type ActorType, type AddAttributeInput, type AgentConfig, type AgentContextEntry, type AgentDashboard, type AgentDefinition, type AgentEvent, type AgentExecutionConfig, type AgentExecutionPolicy, type AgentMessageAttachment, type AgentMessagePart, type AgentQuestion, type AgentRun, type AgentRunStatus, type AgentSchedule, type AgentSession, type AgentSessionMessage, type AgentSessionMode, type AgentSessionStatus, type AgentToolCall, type AgentTriggerDefinition, type AgentTriggerType, type ApiKey, type ApiKeyAuthContext, type ApiKeyPermission, type ApiKeyWithSecret, type AssignActorRoleInput, type AssignRoleInput, Attribute, AttributeGroupField, AttributeInUseError, AttributeNotFoundError, AttributeType, type AttributeUsage, type AuditAction, type AuditActorType, type AuditChange, type AuditListOptions, type AuditLogEntry, type AuditResourceType, type AuditServiceOptions, type AuditSortField, BEHAVIOR_PROPERTIES, BilateralConfig, type BoundingBox, type BuilderConfig, ChangeTypeNotSupportedError, CheckboxAttribute, CompletionStatus, ConcurrentModificationError, ConfigOverrides, type CountMode, type CreateActorInput, type CreateApiKeyInput, type CreateAuditLogInput, type CreateCustomObjectInput, type CreateDBAttribute, type CreateDBForm, type CreateDBFormSubmission, type CreateDBObject, type CreateDBView, type CreateDBViewOverlay, type CreateFile, CreateMode, type CreateObjectRecord, type CreatePermissionInput, type CreateRoleInput, type CreateSandboxExecution, type CreateUserProfile, type CreateViewInput, type CriticConfig, Currency, CurrencyAttribute, type CustomAttributeValue, CustomTabConfig, type DBAttribute, type DBForm, type DBFormSubmission, type DBObject, type DBView, type DBViewOverlay, DB_COLUMN_FIELDS, DEFAULT_ROLES, DEFAULT_ROLE_DESCRIPTIONS, DEFAULT_ROLE_LABELS, DEFAULT_ROLE_PERMISSIONS, DOCUMENT_SYSTEM_ATTRIBUTES, DateAttribute, type DefaultRoleName, type DeletedMode, DestructiveSyncNotAllowedError, DetailViewBuilder, DetailViewConfig, DetailViewDefinition, DetailViewLayout, DocumentAttribute, DocumentLayout, DocumentSlotConfig, DocumentSlotValidationError, DocumentsTabConfig, type DomainEvent, DuplicateError, EMPTY_VALUE_PLACEHOLDER, type EffectivePermissions, type EventDataMap, type EventType, type ExtractRecord, type ExtractRecordInput, type ExtractRecordInputStrict, type ExtractRecordStrict, type ExtractRecordUpdate, type ExtractRecordUpdateStrict, FORM_FORBIDDEN_ATTRIBUTE_TYPES, FeatureFlagDefinition, FeatureFlagsRepository, FeatureGate, Field, FieldGroup, type File, FileAttribute, type FileListOptions, type FileVisibility, FilterOperator, FilterRule, FilterState, FilterValue, FlagLevel, FlagRegistry, FlagService, FlagValueType, ForbiddenError, FormBuilder, type FormDefinition, type FormFieldRef, type FormFieldsRow, type FormFreeFieldRef, type FormHeadingRow, FormRegistry, type FormRow, FormRowBuilder, type FormSeparatorRow, type FormSlot, type FormSlotFieldRef, type FormStatus, type FormStep, FormStepBuilder, type FormSubmission, type FormSubmissionStatus, type FormSubmittedAgentEvent, type FormTextRow, FormulaAttribute, type FormulaResult, FormulaReturnType, type GeocodingAdapter, type GeocodingAutocompleteParams, type GeocodingParams, type GeocodingSuggestion, type GlobalSearchGroupedOptions, type GlobalSearchGroupedResult, type GlobalSearchOptions, type GlobalSearchResultItem, type GrantResourceAccessInput, Group, GroupBuilder, IDENTITY_PROPERTIES, type InferAttributeValue, type InferQualifiedProps, InvalidPathError, type InviteUserInput, type ListOptions, ListViewBuilder, ListViewConfig, ListViewDefinition, ListViewTab, ListViewTabConfigBuilder, Location, LocationAttribute, LocationGranularity, MaxDepthExceededError, MemoryNotFoundError, type MentionEntityType, type MentionReference, type MentionedContext, type MentionedEntityContext, MigrationDefinition, MigrationTimeoutError, type ModelDefinition, MultiRelationAttribute, MultiselectAttribute, NoopGeocodingAdapter, NotFoundError, NotImplementedError, NumberAttribute, OPERATOR_SPECS, ObjectBuilder, ObjectDefinition, ObjectNotFoundError, type ObjectPermissions, ObjectReferencedError, type OcrAdapter, type OcrInput, type OcrOptions, type OcrPage, type OcrResult, type OcrTextBlock, type OperatorSpec, Option, OrphanSystemAttributeError, PRESENTATION_PROPERTIES, type PageInfo, type PageOptions, type PageResponse, type ParsedAttribute, type PathCardinality, type PathSegment, type PathSegmentType, type Permission, type PermissionScope, Phone, PhoneAttribute, type PrincipalType, PropertySchema, ProtectedResourceError, ProtectedRoleError, type ProviderName, QUALIFIED_SEPARATOR, type QualifiedDocumentBrand, type QuestionResponse, type QuestionStatus, RatingAttribute, type ReasoningPartData, type RecordAgentEvent, type RecordMetadata, RecordNotFoundError, type RecordReference, RecordReferencedError, RelationAttribute, RelationGroup, RelationGroupBuilder, type RelationOption, type RelationOptionsResponse, RelationTarget, RepositoryError, type RepositoryOperation, ResolvedFlag, type ResourceAccess, type ResourceRef, type RetryPolicy, type ReverseGeocodingParams, RichtextAttribute, RichtextFeature, RichtextTabConfig, type Role, RoleNotFoundError, RollupAttribute, RollupFunction, STANDARD_SCHEMA_VENDOR, SYSTEM_ATTRIBUTES, SYSTEM_ATTRIBUTE_I18N_KEYS, SYSTEM_RESOURCES, SYSTEM_RESOURCE_LABELS, type SandboxExecution, type SandboxExecutionInput, type SandboxExecutionResult, type SandboxExecutionStatus, type SandboxMode, type SandboxTrigger, SchemaError, SchemaErrorCode, SchemaOperation, type SchemaResolver, type SearchOptions, SelectAttribute, SidePanelConfig, type SidebarExtraItem, SingleRelationAttribute, type SlotMode, SortRule, type SpecificAccessAction, type StandardSchemaIssue, type StandardSchemaResult, StaticFlagDefault, StatusAttribute, StorageError, type StorageOperation, type StorageProvider, type StreamEventCompactionEnd, type StreamEventCompactionFailed, type StreamEventCompactionStart, type StreamEventMessagePersisted, SyncCascadeError, SyncConflictError, SyncError, type SystemAttribute, type SystemAttributeI18nKey, SystemEntityImmutableError, type SystemFields, type SystemPermissions, type SystemResource, Tab, TabBuilder, TableTab, TableTabConfig, TenantId, TextAreaAttribute, TextAttribute, type TextPartData, type ThinkingPartData, type TimeoutPolicy, Timestamps, type ToolPartData, type ToolPartState, type TriggerEventType, USER_STATUSES, type UpdateActorInput, type UpdateDBAttribute, type UpdateDBForm, type UpdateDBFormSubmission, type UpdateDBObject, type UpdateDBView, type UpdateDBViewOverlay, type UpdateFile, type UpdateObjectInput, type UpdateRoleInput, type UpdateUserProfile, type UpdateViewInput, type UpsertAccessPolicyInput, type UpsertDBAttribute, type UpsertDBObject, type UpsertDBView, UserAttribute, type UserProfile, type UserRoleAssignment, type UserStatus, Uuid, ValidationError, type ValidationErrorDetail, ViewConfig, ViewDefinition, ViewType, type WithCustomAttributes$1 as WithCustomAttributes, accessLevelToActions, actionsToAccessLevel, applyPipes, booleanFlag, buildPropertySchema, buildQualifiedAttribute, checkbox, createFlagRegistry, createFlagService, createStandardSchemaProps, currency, date, detailView, document, evaluateFilterState, evaluateFormula, evaluateFormulaAttribute, evaluateFormulaWithResult, extractAttributeNames, extractFormulaVariables, extractRelationNames, extractRelationReferences, file, flagRegistry, flattenRelationsForEval, form, formRegistry, formatAttributeValue, formatFormulaResult, formula, generateDefaultDetailView, generateDefaultListView, getActiveTab, getErrorMessage, getOperatorPolarity, getPathDepth, getRelationPath, getSystemAttributeI18nKey, getSystemAttributeList, getTargetAttributeName, group, hasRelationReferences, isAttributeInUseError, isDefaultRole, isDocumentAttribute, isEmptyObject, isFormDefinition, isFormFieldsRow, isFormFreeFieldRef, isFormHeadingRow, isFormSeparatorRow, isFormSlotFieldRef, isFormTextRow, isLabelExpression, isNotEmpty, isNotFoundError, isObjectReferencedError, isProtectedResourceError, isRecordReferencedError, isSchemaError, isStandardSchema, isValidationError, jsonFlag, listView, location, matchesMime, multiselect, normaliseDocumentSlots, normalizeForEdgeRpc, number, numberFlag, object, parsePath, parseQualifiedAttribute, pathHasManyCardinality, phone, rating, registry, relation, relationGroup, renderLabelExpression, resetViewToDefault, richtext, rollup, select, status, stringFlag, text, textarea, toUndefinedIfEmpty, user, validateAttributeName, validateFormulaExpression, validatePath, validateQualifiedRule, validateSlotAgainstConfig, viewRegistry };
+export { type AIAvailableModel, type AIBatchQuestion, type AIBatchQuestionAnswer, type AIBatchQuestionOption, type AIChatMessage, type AIChatMessagePart, type AIChatMessagePartType, type AICompactionSummary, type AIMemoryEntry, type AIMemoryType, type AIMessageRole, type AIProviderMetrics, type AIQuestion, type AIQuestionAnswer, type AIQuestionOption, type AIQuestionType, type AITodoItem, type AITodoList, type AITodoStatus, type AIToolCall, type AIToolCallStatus, type AIUsageMetrics, ALLOWED_PROPERTY_TYPES, ALL_ACTIONS, ALL_SYSTEM_RESOURCES, type AccessAction, type AccessActionList, AccessDeniedError, type AccessLevel, type AccessPolicy, type AccessPolicyPreset, type AccessResourceType, type Action, ActivityTabConfig, type Actor, type ActorRoleAssignment, type ActorStatus, type ActorType, type AddAttributeInput, type AgentConfig, type AgentContextEntry, type AgentDashboard, type AgentDefinition, type AgentEvent, type AgentExecutionConfig, type AgentExecutionPolicy, type AgentMessageAttachment, type AgentMessagePart, type AgentQuestion, type AgentRun, type AgentRunStatus, type AgentSchedule, type AgentSession, type AgentSessionMessage, type AgentSessionMode, type AgentSessionStatus, type AgentToolCall, type AgentTriggerDefinition, type AgentTriggerType, type ApiKey, type ApiKeyAuthContext, type ApiKeyPermission, type ApiKeyWithSecret, type AssignActorRoleInput, type AssignRoleInput, Attribute, AttributeGroupField, AttributeInUseError, AttributeNotFoundError, AttributeType, type AttributeUsage, type AuditAction, type AuditActorType, type AuditChange, type AuditListOptions, type AuditLogEntry, type AuditResourceType, type AuditServiceOptions, type AuditSortField, BEHAVIOR_PROPERTIES, BilateralConfig, type BoundingBox, type BuilderConfig, ChangeTypeNotSupportedError, CheckboxAttribute, CompletionStatus, ConcurrentModificationError, ConfigOverrides, type CountMode, type CreateActorInput, type CreateApiKeyInput, type CreateAuditLogInput, type CreateCustomObjectInput, type CreateDBAttribute, type CreateDBForm, type CreateDBFormSubmission, type CreateDBObject, type CreateDBView, type CreateDBViewOverlay, type CreateFile, CreateMode, type CreateObjectRecord, type CreatePermissionInput, type CreateRoleInput, type CreateSandboxExecution, type CreateUserProfile, type CreateViewInput, type CriticConfig, Currency, CurrencyAttribute, type CustomAttributeValue, CustomTabConfig, type DBAttribute, type DBForm, type DBFormSubmission, type DBObject, type DBView, type DBViewOverlay, DB_COLUMN_FIELDS, DEFAULT_ROLES, DEFAULT_ROLE_DESCRIPTIONS, DEFAULT_ROLE_LABELS, DEFAULT_ROLE_PERMISSIONS, DOCUMENT_SYSTEM_ATTRIBUTES, DateAttribute, type DefaultRoleName, type DeletedMode, DestructiveSyncNotAllowedError, DetailViewBuilder, DetailViewConfig, DetailViewDefinition, DetailViewLayout, DocumentAttribute, DocumentLayout, DocumentSlotConfig, DocumentSlotValidationError, DocumentsTabConfig, type DomainEvent, DuplicateError, EMPTY_VALUE_PLACEHOLDER, type EffectivePermissions, type EnvVarEntry, type EnvVarScope, type EventDataMap, type EventType, type ExtractRecord, type ExtractRecordInput, type ExtractRecordInputStrict, type ExtractRecordStrict, type ExtractRecordUpdate, type ExtractRecordUpdateStrict, FORM_FORBIDDEN_ATTRIBUTE_TYPES, FeatureFlagDefinition, FeatureFlagsRepository, FeatureGate, Field, FieldGroup, type FieldHistoryEntry, type File, FileAttribute, type FileListOptions, type FileVisibility, FilterOperator, FilterRule, FilterState, FilterValue, FlagLevel, FlagRegistry, FlagService, FlagValueType, ForbiddenError, FormBuilder, type FormDefinition, type FormFieldRef, type FormFieldsRow, type FormFreeFieldRef, type FormHeadingRow, FormRegistry, type FormRow, FormRowBuilder, type FormSeparatorRow, type FormSlot, type FormSlotFieldRef, type FormStatus, type FormStep, FormStepBuilder, type FormSubmission, type FormSubmissionStatus, type FormSubmittedAgentEvent, type FormTextRow, FormulaAttribute, type FormulaResult, FormulaReturnType, type GeocodingAdapter, type GeocodingAutocompleteParams, type GeocodingParams, type GeocodingSuggestion, type GlobalSearchGroupedOptions, type GlobalSearchGroupedResult, type GlobalSearchOptions, type GlobalSearchResultItem, type GrantResourceAccessInput, Group, GroupBuilder, IDENTITY_PROPERTIES, type InferAttributeValue, type InferQualifiedProps, InvalidPathError, type InviteUserInput, type ListOptions, ListViewBuilder, ListViewConfig, ListViewDefinition, ListViewTab, ListViewTabConfigBuilder, Location, LocationAttribute, LocationGranularity, MaxDepthExceededError, MemoryNotFoundError, type MentionEntityType, type MentionReference, type MentionedContext, type MentionedEntityContext, MigrationDefinition, MigrationTimeoutError, type ModelDefinition, MultiRelationAttribute, MultiselectAttribute, NoopGeocodingAdapter, NotFoundError, NotImplementedError, NumberAttribute, OPERATOR_SPECS, ObjectBuilder, ObjectDefinition, ObjectNotFoundError, type ObjectPermissions, ObjectReferencedError, type OcrAdapter, type OcrInput, type OcrOptions, type OcrPage, type OcrResult, type OcrTextBlock, type OperatorSpec, Option, OrphanSystemAttributeError, PRESENTATION_PROPERTIES, type PageInfo, type PageOptions, type PageResponse, type ParsedAttribute, type PathCardinality, type PathSegment, type PathSegmentType, type Permission, type PermissionScope, Phone, PhoneAttribute, type PrincipalType, PropertySchema, ProtectedResourceError, ProtectedRoleError, type ProviderName, QUALIFIED_SEPARATOR, type QualifiedDocumentBrand, type QuestionResponse, type QuestionStatus, RatingAttribute, type ReasoningPartData, type RecordAgentEvent, type RecordMetadata, RecordNotFoundError, type RecordReference, RecordReferencedError, RelationAttribute, RelationGroup, RelationGroupBuilder, type RelationOption, type RelationOptionsResponse, RelationTarget, RepositoryError, type RepositoryOperation, ResolvedFlag, type ResourceAccess, type ResourceRef, type RetryPolicy, type ReverseGeocodingParams, RichtextAttribute, RichtextFeature, RichtextTabConfig, type Role, RoleNotFoundError, RollupAttribute, RollupFunction, STANDARD_SCHEMA_VENDOR, SYSTEM_ATTRIBUTES, SYSTEM_ATTRIBUTE_I18N_KEYS, SYSTEM_RESOURCES, SYSTEM_RESOURCE_LABELS, type SandboxExecution, type SandboxExecutionInput, type SandboxExecutionResult, type SandboxExecutionStatus, type SandboxMode, type SandboxTrigger, SchemaError, SchemaErrorCode, SchemaOperation, type SchemaResolver, type SearchOptions, SelectAttribute, SidePanelConfig, type SidebarExtraItem, SingleRelationAttribute, type SlotMode, SortRule, type SpecificAccessAction, type StandardSchemaIssue, type StandardSchemaResult, StaticFlagDefault, StatusAttribute, StorageError, type StorageOperation, type StorageProvider, type StreamEventCompactionEnd, type StreamEventCompactionFailed, type StreamEventCompactionStart, type StreamEventMessagePersisted, SyncCascadeError, SyncConflictError, SyncError, type SystemAttribute, type SystemAttributeI18nKey, SystemEntityImmutableError, type SystemFields, type SystemPermissions, type SystemResource, Tab, TabBuilder, TableTab, TableTabConfig, TenantId, TextAreaAttribute, TextAttribute, type TextPartData, type ThinkingPartData, type TimeoutPolicy, Timestamps, type ToolPartData, type ToolPartState, type TriggerEventType, USER_STATUSES, type UpdateActorInput, type UpdateDBAttribute, type UpdateDBForm, type UpdateDBFormSubmission, type UpdateDBObject, type UpdateDBView, type UpdateDBViewOverlay, type UpdateFile, type UpdateObjectInput, type UpdateRoleInput, type UpdateUserProfile, type UpdateViewInput, type UpsertAccessPolicyInput, type UpsertDBAttribute, type UpsertDBObject, type UpsertDBView, UserAttribute, type UserProfile, type UserRoleAssignment, type UserStatus, Uuid, ValidationError, type ValidationErrorDetail, ViewConfig, ViewDefinition, ViewType, type WithCustomAttributes$1 as WithCustomAttributes, accessLevelToActions, actionsToAccessLevel, applyPipes, booleanFlag, buildPropertySchema, buildQualifiedAttribute, checkbox, createFlagRegistry, createFlagService, createStandardSchemaProps, currency, date, detailView, document, evaluateFilterState, evaluateFormula, evaluateFormulaAttribute, evaluateFormulaWithResult, extractAttributeNames, extractFormulaVariables, extractRelationNames, extractRelationReferences, file, flagRegistry, flattenRelationsForEval, form, formRegistry, formatAttributeValue, formatFormulaResult, formula, generateDefaultDetailView, generateDefaultListView, getActiveTab, getErrorMessage, getOperatorPolarity, getPathDepth, getRelationPath, getSystemAttributeI18nKey, getSystemAttributeList, getTargetAttributeName, group, hasRelationReferences, isAttributeInUseError, isDefaultRole, isDocumentAttribute, isEmptyObject, isFormDefinition, isFormFieldsRow, isFormFreeFieldRef, isFormHeadingRow, isFormSeparatorRow, isFormSlotFieldRef, isFormTextRow, isLabelExpression, isNotEmpty, isNotFoundError, isObjectReferencedError, isProtectedResourceError, isRecordReferencedError, isSchemaError, isStandardSchema, isValidationError, jsonFlag, listView, location, matchesMime, multiselect, normaliseDocumentSlots, normalizeForEdgeRpc, number, numberFlag, object, parsePath, parseQualifiedAttribute, pathHasManyCardinality, phone, rating, registry, relation, relationGroup, renderLabelExpression, resetViewToDefault, richtext, rollup, select, status, stringFlag, text, textarea, toUndefinedIfEmpty, user, validateAttributeName, validateFormulaExpression, validatePath, validateQualifiedRule, validateSlotAgainstConfig, viewRegistry };

package/dist/index.js

@@ -839,6 +839,8 @@ var SYSTEM_RESOURCES = {
   AUDIT: "audit",
   /** Programmatic access keys */
   API_KEYS: "api-keys",
+  /** Environment variables for agents */
+  ENV_VARS: "env-vars",
   /** Agent session visibility — required for an agent actor to read its own sessions */
   SESSION: "session"
 };
@@ -853,6 +855,7 @@ var ALL_SYSTEM_RESOURCES = [
   SYSTEM_RESOURCES.DOCUMENTS,
   SYSTEM_RESOURCES.AUDIT,
   SYSTEM_RESOURCES.API_KEYS,
+  SYSTEM_RESOURCES.ENV_VARS,
   SYSTEM_RESOURCES.SESSION
 ];
 var SYSTEM_RESOURCE_LABELS = {
@@ -866,6 +869,7 @@ var SYSTEM_RESOURCE_LABELS = {
   documents: "Documents",
   audit: "Audit",
   "api-keys": "API keys",
+  "env-vars": "Environment variables",
   session: "Agent sessions"
 };
 var DEFAULT_ROLES = {
@@ -903,6 +907,7 @@ var DEFAULT_ROLE_PERMISSIONS = {
     system: [
       { target: "documents", actions: ["read", "create", "update"] },
       { target: "files", actions: ["read", "create", "update"] },
+      { target: "env-vars", actions: ["read"] },
       // Required so the agent actor can read its own sessions when the worker
       // resumes a queued job under the agent's identity (runAsAgentActor).
       { target: "session", actions: ["observe"] }

package/dist/index.mjs

@@ -835,6 +835,8 @@ var SYSTEM_RESOURCES = {
   AUDIT: "audit",
   /** Programmatic access keys */
   API_KEYS: "api-keys",
+  /** Environment variables for agents */
+  ENV_VARS: "env-vars",
   /** Agent session visibility — required for an agent actor to read its own sessions */
   SESSION: "session"
 };
@@ -849,6 +851,7 @@ var ALL_SYSTEM_RESOURCES = [
   SYSTEM_RESOURCES.DOCUMENTS,
   SYSTEM_RESOURCES.AUDIT,
   SYSTEM_RESOURCES.API_KEYS,
+  SYSTEM_RESOURCES.ENV_VARS,
   SYSTEM_RESOURCES.SESSION
 ];
 var SYSTEM_RESOURCE_LABELS = {
@@ -862,6 +865,7 @@ var SYSTEM_RESOURCE_LABELS = {
   documents: "Documents",
   audit: "Audit",
   "api-keys": "API keys",
+  "env-vars": "Environment variables",
   session: "Agent sessions"
 };
 var DEFAULT_ROLES = {
@@ -899,6 +903,7 @@ var DEFAULT_ROLE_PERMISSIONS = {
     system: [
       { target: "documents", actions: ["read", "create", "update"] },
       { target: "files", actions: ["read", "create", "update"] },
+      { target: "env-vars", actions: ["read"] },
       // Required so the agent actor can read its own sessions when the worker
       // resumes a queued job under the agent's identity (runAsAgentActor).
       { target: "session", actions: ["observe"] }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stndrds/schema",
-  "version": "1.0.0-alpha.191",
+  "version": "1.0.0-alpha.192",
   "description": "Standard schema definitions and utilities",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
@@ -131,7 +131,7 @@
     "expr-eval": "^2.0.2",
     "libphonenumber-js": "^1.12.31",
     "zod": "^4.2.1",
-    "@stndrds/constants": "1.0.0-alpha.191"
+    "@stndrds/constants": "1.0.0-alpha.192"
   },
   "devDependencies": {
     "@types/node": "^25.0.3",