@theokit/agents 13.0.0 → 13.2.0

package/dist/config.d.ts

@@ -1,8 +1,8 @@
 import { TheokitAgentError } from '@theokit/sdk/errors';
 import { z } from 'zod';
-import { TrustPosture, LayerValues } from '@theokit/sdk';
-export { DeclaredLayer, LayerValues } from '@theokit/sdk';
-import { R as ResolvedCompatSource } from './setting-sources-gate-DFu51i50.js';
+import { TrustPosture, LayerValues, PermissionRule } from '@theokit/sdk';
+export { DeclaredLayer, LayerValues, PermissionAction, PermissionRule } from '@theokit/sdk';
+import { R as ResolvedCompatSource } from './setting-sources-gate-BXdZmY78.js';
 export { resolveEffectiveContextWindow as effectiveContextWindow } from '@theokit/sdk/compaction';
 
 /**
@@ -683,6 +683,156 @@ declare function layerPrecedence(layer: SettingsLayer): number;
  */
 declare function settingsLayerChain(values: Partial<Record<SettingsLayer, Readonly<Record<string, unknown>>>>): LayerValues[];
 
+/**
+ * A style was named and could not be read.
+ *
+ * Typed, and carrying the directories it searched, because the whole point of the refusal is that
+ * the author learns WHICH lookup failed. `error-handling.md` § 2: fail fast, fail clear.
+ */
+declare class OutputStyleError extends TheokitAgentError {
+    readonly name = "OutputStyleError";
+    constructor(message: string);
+}
+interface OutputStyle {
+    /** The filename without `.md` — what `outputStyle` in settings refers to. */
+    readonly name: string;
+    /** The body, which becomes a section of the system prompt. */
+    readonly content: string;
+    /** The `description` frontmatter key, when present. */
+    readonly description?: string;
+    /**
+     * `keep-coding-instructions: true` in frontmatter.
+     *
+     * The field with teeth. A style REPLACES the built-in software-engineering instructions by
+     * default, so a consumer who does not know that loses them without being told. Carried here so
+     * the decision belongs to the caller rather than to whoever wrote the style file.
+     */
+    readonly keepCodingInstructions: boolean;
+}
+interface LoadOutputStyleInput {
+    /** The style to load, from `settings.json`'s `outputStyle`. `undefined` means none was asked for. */
+    readonly name: string | undefined;
+    /** Project root. Its `.claude/output-styles/` wins over the home directory's. */
+    readonly cwd: string;
+    /** Home directory, for styles that apply across every project. Omit to search the project only. */
+    readonly homeDir?: string;
+}
+/**
+ * The named style, or `undefined` when none was requested.
+ *
+ * @throws OutputStyleError when a style IS named and no file backs it, listing the directories that
+ * were searched.
+ */
+declare function loadOutputStyle(input: LoadOutputStyleInput): OutputStyle | undefined;
+/**
+ * The style the project's settings name, read from the project's style files.
+ *
+ * The two halves of the documented mechanism, joined. `loadSettings` reads the `outputStyle` key and
+ * {@link loadOutputStyle} reads the file; until this existed nothing connected them, so a consumer
+ * had to find both modules and know that one feeds the other. Two halves each individually correct
+ * and jointly unreachable is the same defect as a capability with no caller — it just takes two
+ * files to make.
+ *
+ * Deliberately does NOT soften the loader: a style named in settings with no file behind it still
+ * throws {@link OutputStyleError}. Returning `undefined` there would restore the exact silence this
+ * work removed — configured, not applied, and no way to tell which.
+ *
+ * @throws OutputStyleError when settings name a style and no file backs it.
+ */
+declare function resolveOutputStyle(input: {
+    readonly cwd: string;
+    readonly homeDir?: string;
+    readonly onWarn?: (message: string) => void;
+}): OutputStyle | undefined;
+
+/**
+ * Translate a settings `permissions` block into rules the SDK's engine evaluates.
+ *
+ * The SDK ships `PermissionEngine(rules, { defaultAction })` and it is a CODE surface: you construct
+ * it with `PermissionRule[]`. What was missing was the path from the FILE to those rules. Measured
+ * 2026-09-11: `permissions` appears in 13 SDK files, and the SDK reads `settings.json` in three, of
+ * which two are sourcemaps and the third describes the hooks shape. An operator writing
+ * `{ "permissions": { "deny": ["Bash(curl:*)"] } }` got a file nothing translated.
+ *
+ * ## Partial fidelity would be worse than absence
+ *
+ * A `deny` that silently fails to match is a control the operator believes is in force — strictly
+ * more dangerous than no rule, because without one they would have written the guard themselves. So
+ * every entry this module cannot render faithfully is RETURNED as unsupported, with a reason, and
+ * excluded from the rules. Nothing is quietly turned into a matcher that does not bite.
+ *
+ * ## What it deliberately does not attempt
+ *
+ * The reference's specifier language is larger than this: path globs with `~` expansion, per-tool
+ * argument names, and matching semantics that differ by tool. Implementing a lookalike would produce
+ * rules that match *almost* the right calls, which is the failure above. Two forms are translated —
+ * a bare tool name, and `Tool(prefix:*)` / `Tool(exact)` — and everything else is reported.
+ */
+
+/** An entry that was understood well enough to refuse, but not well enough to translate. */
+interface UnsupportedPermissionEntry {
+    /** The entry as written, so the operator can find it in their file. */
+    readonly entry: string;
+    /** Why it was not translated. */
+    readonly reason: string;
+}
+interface PermissionTranslation {
+    readonly rules: readonly PermissionRule[];
+    readonly unsupported: readonly UnsupportedPermissionEntry[];
+}
+/** The `permissions` block as a settings file may carry it. */
+interface PermissionsBlock {
+    readonly allow?: readonly string[];
+    readonly deny?: readonly string[];
+    readonly ask?: readonly string[];
+}
+/**
+ * The rules a `permissions` block means, and the entries that could not be rendered.
+ *
+ * An absent or empty block yields nothing and reports nothing: most projects declare no permissions,
+ * and a translator that warned there would be noise in every one of them.
+ */
+declare function permissionRulesFromSettings(block: PermissionsBlock | undefined): PermissionTranslation;
+
+/**
+ * The keys this layer can act on today, plus everything else untouched.
+ *
+ * Typed narrowly on purpose: a key is listed here when something in this package reads it, not
+ * because the reference documents it. Declaring a field the code ignores would publish a control
+ * that does nothing, which is the shape every item in this batch had.
+ */
+declare const SETTINGS_SCHEMA: z.ZodObject<{
+    outputStyle: z.ZodOptional<z.ZodString>;
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    permissions: z.ZodOptional<z.ZodObject<{
+        allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        ask: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$loose>>;
+}, z.core.$loose>;
+type Settings = z.infer<typeof SETTINGS_SCHEMA>;
+interface LoadSettingsInput {
+    /** Project root. Its `.claude/settings.json` and `.claude/settings.local.json` are read. */
+    readonly cwd: string;
+    /** Home directory, for the user-level file. Omit to read the project only. */
+    readonly homeDir?: string;
+    /** Where a file that exists and cannot be parsed is reported. */
+    readonly onWarn?: (message: string) => void;
+}
+interface LoadSettingsResult {
+    readonly values: Settings;
+    /** Which layer each resolved key came from. */
+    readonly provenancePerKey: Readonly<Record<string, string>>;
+    /** Which declared layers contributed nothing — a file nobody is reading is named, not hidden. */
+    readonly precedenceReport: PrecedenceReport;
+}
+/**
+ * The settings as the declared layers resolve them.
+ *
+ * Never throws for a missing or malformed file; see {@link readLayer}.
+ */
+declare function loadSettings(input: LoadSettingsInput): LoadSettingsResult;
+
 /**
  * Split a markdown file into frontmatter lines and body.
  *
@@ -772,4 +922,4 @@ declare class ContextPressureThresholdError extends TheokitAgentError {
  */
 declare function contextPressure(usedTokens: number, effectiveWindow: number, thresholds?: ContextPressureThresholds): ContextPressure;
 
-export { type ComposeInstructionsOptions, type ComposedInstructions, type ConfigLayer, type ContextPressure, ContextPressureThresholdError, type ContextPressureThresholds, type CustomCommand, type CustomCommandsResult, DEFAULT_CONTEXT_PRESSURE_THRESHOLDS, type ExpandImportsInput, FILE_INLINE_CAP, type InstructionBlock, type InstructionSource, type InstructionTree, type InstructionTreeBudget, LAYERS_ARE_POSITIONED, LayerOutOfOrderError, LayeredConfig, type LayeredConfigInput, type LayeredConfigResult, type LoadCustomCommandsInput, type LoadInstructionTreeInput, type ParsedFrontmatter, type PrecedenceReport, type ProvenancePerKey, SETTINGS_LAYERS, type SettingsLayer, type ShellResult, type TemplateDeps, type TrustRecord, TrustStore, TrustStorePermissionsError, blockAppliesTo, composeInstructions, contextPressure, expandCommandTemplate, expandInstructionImports, frontmatterValue, layerPrecedence, loadCustomCommands, loadInstructionTree, settingsLayerChain, splitFrontmatter, templateHints };
+export { type ComposeInstructionsOptions, type ComposedInstructions, type ConfigLayer, type ContextPressure, ContextPressureThresholdError, type ContextPressureThresholds, type CustomCommand, type CustomCommandsResult, DEFAULT_CONTEXT_PRESSURE_THRESHOLDS, type ExpandImportsInput, FILE_INLINE_CAP, type InstructionBlock, type InstructionSource, type InstructionTree, type InstructionTreeBudget, LAYERS_ARE_POSITIONED, LayerOutOfOrderError, LayeredConfig, type LayeredConfigInput, type LayeredConfigResult, type LoadCustomCommandsInput, type LoadInstructionTreeInput, type LoadOutputStyleInput, type LoadSettingsInput, type LoadSettingsResult, type OutputStyle, OutputStyleError, type ParsedFrontmatter, type PermissionTranslation, type PermissionsBlock, type PrecedenceReport, type ProvenancePerKey, SETTINGS_LAYERS, type Settings, type SettingsLayer, type ShellResult, type TemplateDeps, type TrustRecord, TrustStore, TrustStorePermissionsError, type UnsupportedPermissionEntry, blockAppliesTo, composeInstructions, contextPressure, expandCommandTemplate, expandInstructionImports, frontmatterValue, layerPrecedence, loadCustomCommands, loadInstructionTree, loadOutputStyle, loadSettings, permissionRulesFromSettings, resolveOutputStyle, settingsLayerChain, splitFrontmatter, templateHints };

package/dist/config.js

@@ -1,12 +1,12 @@
 import {
   ensureSecureDir
 } from "./chunk-D2EFYZBV.js";
-import {
-  currentOperatorPolicy
-} from "./chunk-HGVT4VCE.js";
 import {
   ConfigurationError
 } from "./chunk-U72XTMYB.js";
+import {
+  currentOperatorPolicy
+} from "./chunk-2SP5BB6U.js";
 import {
   __name
 } from "./chunk-Z4QWC7IK.js";
@@ -564,23 +564,61 @@ function composeInstructions(base, sources, options) {
 __name(composeInstructions, "composeInstructions");
 
 // src/config/custom-commands.ts
-import { readFileSync as readFileSync4, readdirSync as readdirSync2, statSync as statSync3 } from "fs";
-import { extname, join as join2, relative as relative2 } from "path";
-var COMMANDS_DIR = join2(".theokit", "commands");
-var COMPAT_COMMANDS_DIR = join2(".claude", "commands");
+import { readFileSync as readFileSync4, readdirSync as readdirSync3, statSync as statSync3 } from "fs";
+import { extname, join as join3, relative as relative2 } from "path";
+
+// src/bridge/unloaded-surfaces.ts
+import { existsSync as existsSync3, readdirSync as readdirSync2 } from "fs";
+import { join as join2 } from "path";
+var WORKFLOWS_DIR = join2(".claude", "workflows");
+var SCRIPT_SUFFIXES = [
+  ".js",
+  ".mjs",
+  ".cjs"
+];
+function reportUnloadedSurfaces(input) {
+  const dir = join2(input.cwd, WORKFLOWS_DIR);
+  if (!existsSync3(dir)) return;
+  let scripts;
+  try {
+    scripts = readdirSync2(dir).filter((f) => SCRIPT_SUFFIXES.some((s) => f.endsWith(s)));
+  } catch {
+    return;
+  }
+  if (scripts.length === 0) return;
+  input.onWarn(`${WORKFLOWS_DIR}: found ${String(scripts.length)} workflow script(s) \u2014 ${[
+    ...scripts
+  ].sort((a, b) => a.localeCompare(b)).join(", ")} \u2014 which this runtime does NOT execute. Every configuration surface it loads is data (commands, hooks, plugins, skills, subagents); a workflow file is code, and executing JavaScript found under a caller-supplied directory is a trust decision that belongs to you rather than to this library. The orchestration itself is supported: build the same pipeline with Workflow / agentStep / createSquad from @theokit/sdk, which you import explicitly.`);
+}
+__name(reportUnloadedSurfaces, "reportUnloadedSurfaces");
+
+// src/config/custom-commands.ts
+var COMMANDS_DIR = join3(".theokit", "commands");
+var COMPAT_COMMANDS_DIR = join3(".claude", "commands");
 var CLAUDE_CODE_SOURCE = "claude-code";
 var IGNORE_WARNING3 = /* @__PURE__ */ __name(() => void 0, "IGNORE_WARNING");
 function declaresCommands(sources) {
   return sources?.some((source) => typeof source === "string" ? source === CLAUDE_CODE_SOURCE : source.import.includes("commands")) === true;
 }
 __name(declaresCommands, "declaresCommands");
+function declaresClaudeCode(sources) {
+  return sources?.some((source) => (
+    // The narrowed form IS a declaration of this dialect by construction — its `kind` is the one
+    // literal, which is why `declaresCommands` does not re-check it either and why the
+    // `NarrowedCompatSource` docblock says a second dialect must revisit both. Comparing it here
+    // would be a runtime check the type already makes, and `no-unnecessary-condition` is right
+    // about that: the type is not lying, there is exactly one dialect.
+    typeof source !== "string" || source === CLAUDE_CODE_SOURCE
+  )) === true;
+}
+__name(declaresClaudeCode, "declaresClaudeCode");
 function projectCommandDirs(input) {
   if (input.projectDir === void 0) return [];
   const dirs = [];
   if (declaresCommands(input.compatSources)) {
-    dirs.push(join2(input.projectDir, COMPAT_COMMANDS_DIR));
+    dirs.push(join3(input.projectDir, COMPAT_COMMANDS_DIR));
   }
-  dirs.push(join2(input.projectDir, COMMANDS_DIR));
+  dirs.push(join3(input.projectDir, COMMANDS_DIR));
   return dirs;
 }
 __name(projectCommandDirs, "projectCommandDirs");
@@ -606,8 +644,14 @@ __name(mergeProjectCommands, "mergeProjectCommands");
 function loadCustomCommands(input) {
   const warn = input.onWarn ?? IGNORE_WARNING3;
   const loaded = /* @__PURE__ */ new Map();
+  if (input.projectDir !== void 0 && declaresClaudeCode(input.compatSources)) {
+    reportUnloadedSurfaces({
+      cwd: input.projectDir,
+      onWarn: warn
+    });
+  }
   if (input.homeDir !== void 0) {
-    for (const command of readCommandsDir(join2(input.homeDir, COMMANDS_DIR), "user", warn)) {
+    for (const command of readCommandsDir(join3(input.homeDir, COMMANDS_DIR), "user", warn)) {
       loaded.set(command.name, command);
     }
   }
@@ -636,14 +680,14 @@ __name(byProjectThenName, "byProjectThenName");
 function readCommandsDir(dir, source, warn, root = dir) {
   let entries;
   try {
-    entries = readdirSync2(dir);
+    entries = readdirSync3(dir);
   } catch {
     return [];
   }
   entries.sort((a, b) => a.localeCompare(b));
   const commands = [];
   for (const entry of entries) {
-    const path = join2(dir, entry);
+    const path = join3(dir, entry);
     let stats;
     try {
       stats = statSync3(path);
@@ -824,14 +868,263 @@ function settingsLayerChain(values) {
 }
 __name(settingsLayerChain, "settingsLayerChain");
 
+// src/config/output-styles.ts
+import { existsSync as existsSync5, readFileSync as readFileSync6 } from "fs";
+import { join as join5 } from "path";
+import { TheokitAgentError as TheokitAgentError3 } from "@theokit/sdk/errors";
+
+// src/config/settings-file.ts
+import { existsSync as existsSync4, readFileSync as readFileSync5 } from "fs";
+import { join as join4 } from "path";
+import { z } from "zod";
+var SETTINGS_SCHEMA = z.looseObject({
+  /** Selects a file under `.claude/output-styles/`. Consumed by `loadOutputStyle`. */
+  outputStyle: z.string().optional(),
+  /** Environment variables for the session. */
+  env: z.record(z.string(), z.string()).optional(),
+  /**
+  * Tool permissions, as `settings-permissions.ts` translates them into `PermissionRule[]`.
+  *
+  * Typed here rather than left to the passthrough because the passthrough yields `unknown`, and a
+  * consumer would have to cast to reach it — a cast is where a wrong shape stops being checked. The
+  * SAFETY of this key depends on the translator seeing what the operator actually wrote.
+  */
+  permissions: z.object({
+    allow: z.array(z.string()).optional(),
+    deny: z.array(z.string()).optional(),
+    ask: z.array(z.string()).optional()
+  }).loose().optional()
+});
+var IGNORE_WARNING4 = /* @__PURE__ */ __name(() => void 0, "IGNORE_WARNING");
+var FILE_LAYERS = [
+  {
+    layer: "user",
+    dir: "home",
+    file: "settings.json"
+  },
+  {
+    layer: "project-shared",
+    dir: "cwd",
+    file: "settings.json"
+  },
+  {
+    layer: "project-local",
+    dir: "cwd",
+    file: "settings.local.json"
+  }
+];
+function readLayer(path, warn) {
+  if (!existsSync4(path)) return {};
+  try {
+    const parsed = JSON.parse(readFileSync5(path, "utf8"));
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+      warn(`${path} is not a JSON object \u2014 it is NOT being applied.`);
+      return {};
+    }
+    return parsed;
+  } catch (error) {
+    warn(`${path} could not be parsed (${error.message}) \u2014 it is NOT being applied.`);
+    return {};
+  }
+}
+__name(readLayer, "readLayer");
+function loadSettings(input) {
+  const warn = input.onWarn ?? IGNORE_WARNING4;
+  const layers = FILE_LAYERS.flatMap((entry) => {
+    const root = entry.dir === "home" ? input.homeDir : input.cwd;
+    if (root === void 0) return [];
+    const declared = SETTINGS_LAYERS.find((l) => l.layer === entry.layer);
+    if (declared === void 0) return [];
+    return [
+      {
+        layer: entry.layer,
+        precedence: declared.precedence,
+        values: readLayer(join4(root, ".claude", entry.file), warn)
+      }
+    ];
+  });
+  const ordered = [
+    ...layers
+  ].sort((a, b) => (a.precedence ?? 0) - (b.precedence ?? 0));
+  const resolved = LayeredConfig.resolve({
+    layers: ordered,
+    schema: SETTINGS_SCHEMA
+  });
+  return {
+    values: resolved.value,
+    provenancePerKey: resolved.provenancePerKey,
+    precedenceReport: resolved.precedenceReport
+  };
+}
+__name(loadSettings, "loadSettings");
+
+// src/config/output-styles.ts
+var OUTPUT_STYLES_DIR = join5(".claude", "output-styles");
+var OutputStyleError = class extends TheokitAgentError3 {
+  static {
+    __name(this, "OutputStyleError");
+  }
+  name = "OutputStyleError";
+  constructor(message) {
+    super(`[@theokit/agents] ${message}`, {
+      code: "output_style_not_found",
+      isRetryable: false
+    });
+  }
+};
+function loadOutputStyle(input) {
+  if (input.name === void 0) return void 0;
+  const searched = [
+    join5(input.cwd, OUTPUT_STYLES_DIR),
+    ...input.homeDir === void 0 ? [] : [
+      join5(input.homeDir, OUTPUT_STYLES_DIR)
+    ]
+  ];
+  for (const dir of searched) {
+    const path = join5(dir, `${input.name}.md`);
+    if (!existsSync5(path)) continue;
+    const raw = readFileSync6(path, "utf8");
+    const parsed = splitFrontmatter(raw);
+    const body = parsed === void 0 ? raw : parsed.body;
+    const description = parsed === void 0 ? void 0 : frontmatterValue(parsed.frontmatter, "description");
+    return {
+      name: input.name,
+      content: body.trim(),
+      ...description === void 0 ? {} : {
+        description
+      },
+      keepCodingInstructions: parsed !== void 0 && frontmatterValue(parsed.frontmatter, "keep-coding-instructions") === "true"
+    };
+  }
+  throw new OutputStyleError(`output style "${input.name}" is configured and no file backs it. Looked for ${input.name}.md in: ${searched.join(", ")}. A style that cannot be read is not applied, and a silent fallback would be indistinguishable from a style that had no effect.`);
+}
+__name(loadOutputStyle, "loadOutputStyle");
+function resolveOutputStyle(input) {
+  const settings = loadSettings(input);
+  return loadOutputStyle({
+    ...input,
+    name: settings.values.outputStyle
+  });
+}
+__name(resolveOutputStyle, "resolveOutputStyle");
+
+// src/config/settings-permissions.ts
+var ACTIONS = [
+  "deny",
+  "ask",
+  "allow"
+];
+var MAX_TOOL = 64;
+var MAX_SPEC = 512;
+function splitEntry(entry) {
+  const open = entry.indexOf("(");
+  if (open === -1) return isToolName(entry) ? {
+    tool: entry
+  } : void 0;
+  if (!entry.endsWith(")")) return void 0;
+  const tool = entry.slice(0, open);
+  const spec = entry.slice(open + 1, -1);
+  if (!isToolName(tool) || spec.length > MAX_SPEC || spec.includes(")")) return void 0;
+  return {
+    tool,
+    spec
+  };
+}
+__name(splitEntry, "splitEntry");
+function isToolName(value) {
+  if (value.length === 0 || value.length > MAX_TOOL) return false;
+  return /^[A-Za-z_][\w-]*$/.test(value);
+}
+__name(isToolName, "isToolName");
+var UNTRANSLATABLE = /[*?[\]{}~]/;
+function escapeRegExp(literal) {
+  return literal.replaceAll(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`);
+}
+__name(escapeRegExp, "escapeRegExp");
+function translate(entry, action) {
+  const parsed = splitEntry(entry.trim());
+  if (parsed === void 0) {
+    return {
+      entry,
+      reason: "not of the form `Tool` or `Tool(specifier)`."
+    };
+  }
+  const { tool, spec } = parsed;
+  if (spec === void 0) return {
+    tool,
+    action
+  };
+  if (spec.length === 0) {
+    return {
+      entry,
+      reason: "has an empty specifier \u2014 write `Tool` if you meant the whole tool."
+    };
+  }
+  const prefix = spec.endsWith(":*") ? spec.slice(0, -2) : void 0;
+  const literal = prefix ?? spec;
+  if (UNTRANSLATABLE.test(literal)) {
+    return {
+      entry,
+      reason: "uses glob or path syntax this runtime does not translate. It is NOT being applied \u2014 a rule that matched almost the right calls would be worse than none, because you would believe a control is in force. Express it in code with `PermissionRule` instead."
+    };
+  }
+  return {
+    tool,
+    // Anchored at the start either way: unanchored, `Bash(ls)` would also deny `please ls`. The
+    // prefix form stays open at the end, which is what `:*` means; the exact form closes with `$`
+    // so `Bash(ls)` does not deny `ls-everything`.
+    args: {
+      // Built from the operator's own specifier, and escaped before it gets here so no metacharacter
+      // of theirs survives into the pattern. `splitEntry` has already bounded its length, so the compiled
+      // pattern is linear in a value this module controls the size of.
+      // eslint-disable-next-line security/detect-non-literal-regexp -- the literal is escaped by `escapeRegExp` and length-bounded by `splitEntry`; the whole point of the module is to turn operator text into a matcher
+      command: new RegExp(`^${escapeRegExp(literal)}${prefix === void 0 ? "$" : ""}`)
+    },
+    action
+  };
+}
+__name(translate, "translate");
+function isRule(value) {
+  return "tool" in value;
+}
+__name(isRule, "isRule");
+function permissionRulesFromSettings(block) {
+  if (block === void 0) return {
+    rules: [],
+    unsupported: []
+  };
+  const rules = [];
+  const unsupported = [];
+  for (const key of Object.keys(block)) {
+    if (!ACTIONS.includes(key)) {
+      unsupported.push({
+        entry: key,
+        reason: `is not a permission action. Expected one of: ${ACTIONS.join(", ")}.`
+      });
+    }
+  }
+  for (const action of ACTIONS) {
+    for (const entry of block[action] ?? []) {
+      const translated = translate(entry, action);
+      if (isRule(translated)) rules.push(translated);
+      else unsupported.push(translated);
+    }
+  }
+  return {
+    rules,
+    unsupported
+  };
+}
+__name(permissionRulesFromSettings, "permissionRulesFromSettings");
+
 // src/config/context-pressure.ts
 import { resolveEffectiveContextWindow } from "@theokit/sdk/compaction";
-import { TheokitAgentError as TheokitAgentError3 } from "@theokit/sdk/errors";
+import { TheokitAgentError as TheokitAgentError4 } from "@theokit/sdk/errors";
 var DEFAULT_CONTEXT_PRESSURE_THRESHOLDS = {
   warn: 0.75,
   critical: 0.9
 };
-var ContextPressureThresholdError = class extends TheokitAgentError3 {
+var ContextPressureThresholdError = class extends TheokitAgentError4 {
   static {
     __name(this, "ContextPressureThresholdError");
   }
@@ -862,6 +1155,7 @@ export {
   LAYERS_ARE_POSITIONED,
   LayerOutOfOrderError,
   LayeredConfig,
+  OutputStyleError,
   SETTINGS_LAYERS,
   TrustStore,
   TrustStorePermissionsError,
@@ -875,6 +1169,10 @@ export {
   layerPrecedence,
   loadCustomCommands,
   loadInstructionTree,
+  loadOutputStyle,
+  loadSettings,
+  permissionRulesFromSettings,
+  resolveOutputStyle,
   settingsLayerChain,
   splitFrontmatter,
   templateHints