@fractary/codex 0.1.0 → 0.1.2

package/dist/index.cjs

@@ -1,12 +1,18 @@
 'use strict';
 
+var path3 = require('path');
+var child_process = require('child_process');
+var micromatch2 = require('micromatch');
 var zod = require('zod');
 var yaml = require('js-yaml');
-var micromatch = require('micromatch');
+var fs2 = require('fs/promises');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
+var path3__default = /*#__PURE__*/_interopDefault(path3);
+var micromatch2__default = /*#__PURE__*/_interopDefault(micromatch2);
 var yaml__default = /*#__PURE__*/_interopDefault(yaml);
+var fs2__default = /*#__PURE__*/_interopDefault(fs2);
 
 // src/errors/CodexError.ts
 var CodexError = class _CodexError extends Error {
@@ -34,6 +40,664 @@ var ValidationError = class _ValidationError extends CodexError {
     Object.setPrototypeOf(this, _ValidationError.prototype);
   }
 };
+var FORBIDDEN_PATTERNS = [
+  /^\//,
+  // Absolute paths
+  /\.\./,
+  // Parent directory traversal
+  /^~/,
+  // Home directory expansion
+  /\0/
+  // Null bytes
+];
+var FORBIDDEN_PROTOCOLS = ["file:", "http:", "https:", "ftp:", "data:", "javascript:"];
+function validatePath(filePath) {
+  if (!filePath || filePath.trim() === "") {
+    return false;
+  }
+  for (const pattern of FORBIDDEN_PATTERNS) {
+    if (pattern.test(filePath)) {
+      return false;
+    }
+  }
+  const lowerPath = filePath.toLowerCase();
+  for (const protocol of FORBIDDEN_PROTOCOLS) {
+    if (lowerPath.startsWith(protocol)) {
+      return false;
+    }
+  }
+  const normalized = path3__default.default.normalize(filePath);
+  if (normalized.startsWith("..") || normalized.includes("/../") || normalized.includes("\\..\\")) {
+    return false;
+  }
+  return true;
+}
+function sanitizePath(filePath) {
+  if (!filePath) {
+    return "";
+  }
+  let sanitized = filePath;
+  for (const protocol of FORBIDDEN_PROTOCOLS) {
+    if (sanitized.toLowerCase().startsWith(protocol)) {
+      sanitized = sanitized.slice(protocol.length);
+    }
+  }
+  sanitized = sanitized.replace(/^\/+/, "");
+  sanitized = sanitized.replace(/^~\//, "");
+  sanitized = path3__default.default.normalize(sanitized);
+  sanitized = sanitized.replace(/\.\.\//g, "").replace(/\.\./g, "");
+  sanitized = sanitized.replace(/^\.\//, "");
+  sanitized = sanitized.replace(/\0/g, "");
+  return sanitized;
+}
+function validateOrg(org) {
+  if (!org || org.trim() === "") {
+    return false;
+  }
+  const orgPattern = /^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?$/;
+  return orgPattern.test(org) && org.length <= 39;
+}
+function validateProject(project) {
+  if (!project || project.trim() === "") {
+    return false;
+  }
+  const projectPattern = /^[a-zA-Z0-9._-]+$/;
+  return projectPattern.test(project) && project.length <= 100 && !project.includes("..");
+}
+function validateUri(uri) {
+  if (!uri || !uri.startsWith("codex://")) {
+    return false;
+  }
+  const pathPart = uri.slice("codex://".length);
+  const parts = pathPart.split("/");
+  if (parts.length < 2) {
+    return false;
+  }
+  const [org, project, ...rest] = parts;
+  if (!org || !validateOrg(org)) {
+    return false;
+  }
+  if (!project || !validateProject(project)) {
+    return false;
+  }
+  if (rest.length > 0) {
+    const filePath = rest.join("/");
+    if (!validatePath(filePath)) {
+      return false;
+    }
+  }
+  return true;
+}
+
+// src/references/parser.ts
+var CODEX_URI_PREFIX = "codex://";
+var LEGACY_REF_PREFIX = "@codex/";
+function isValidUri(uri) {
+  return validateUri(uri);
+}
+function isLegacyReference(ref) {
+  return ref.startsWith(LEGACY_REF_PREFIX);
+}
+function convertLegacyReference(ref, defaultOrg) {
+  if (!isLegacyReference(ref)) {
+    return null;
+  }
+  const pathPart = ref.slice(LEGACY_REF_PREFIX.length);
+  const parts = pathPart.split("/");
+  if (parts.length < 1 || !parts[0]) {
+    return null;
+  }
+  const project = parts[0];
+  const filePath = parts.slice(1).join("/");
+  if (filePath) {
+    return `${CODEX_URI_PREFIX}${defaultOrg}/${project}/${filePath}`;
+  }
+  return `${CODEX_URI_PREFIX}${defaultOrg}/${project}`;
+}
+function parseReference(uri, options = {}) {
+  const { sanitize = true, strict = true } = options;
+  if (!uri.startsWith(CODEX_URI_PREFIX)) {
+    return null;
+  }
+  if (strict && !validateUri(uri)) {
+    return null;
+  }
+  const pathPart = uri.slice(CODEX_URI_PREFIX.length);
+  const parts = pathPart.split("/");
+  if (parts.length < 2) {
+    return null;
+  }
+  const org = parts[0];
+  const project = parts[1];
+  let filePath = parts.slice(2).join("/");
+  if (!org || !project) {
+    return null;
+  }
+  if (sanitize && filePath) {
+    if (!validatePath(filePath)) {
+      filePath = sanitizePath(filePath);
+    }
+  }
+  return {
+    uri,
+    org,
+    project,
+    path: filePath
+  };
+}
+function buildUri(org, project, path5) {
+  const base = `${CODEX_URI_PREFIX}${org}/${project}`;
+  if (path5) {
+    const cleanPath = path5.startsWith("/") ? path5.slice(1) : path5;
+    return `${base}/${cleanPath}`;
+  }
+  return base;
+}
+function getExtension(uri) {
+  const parsed = parseReference(uri, { strict: false });
+  if (!parsed || !parsed.path) {
+    return "";
+  }
+  const lastDot = parsed.path.lastIndexOf(".");
+  if (lastDot === -1 || lastDot === parsed.path.length - 1) {
+    return "";
+  }
+  return parsed.path.slice(lastDot + 1).toLowerCase();
+}
+function getFilename(uri) {
+  const parsed = parseReference(uri, { strict: false });
+  if (!parsed || !parsed.path) {
+    return "";
+  }
+  const lastSlash = parsed.path.lastIndexOf("/");
+  if (lastSlash === -1) {
+    return parsed.path;
+  }
+  return parsed.path.slice(lastSlash + 1);
+}
+function getDirectory(uri) {
+  const parsed = parseReference(uri, { strict: false });
+  if (!parsed || !parsed.path) {
+    return "";
+  }
+  const lastSlash = parsed.path.lastIndexOf("/");
+  if (lastSlash === -1) {
+    return "";
+  }
+  return parsed.path.slice(0, lastSlash);
+}
+var DEFAULT_CACHE_DIR = ".fractary/plugins/codex/cache";
+function detectCurrentProject(cwd) {
+  try {
+    const options = cwd ? { cwd, encoding: "utf-8" } : { encoding: "utf-8" };
+    const stdout = child_process.execSync("git remote get-url origin", options);
+    const url = stdout.toString().trim();
+    const patterns = [
+      /github\.com[:/]([^/]+)\/([^/]+?)(?:\.git)?$/,
+      /gitlab\.com[:/]([^/]+)\/([^/]+?)(?:\.git)?$/,
+      /bitbucket\.org[:/]([^/]+)\/([^/]+?)(?:\.git)?$/
+    ];
+    for (const pattern of patterns) {
+      const match = url.match(pattern);
+      if (match && match[1] && match[2]) {
+        return { org: match[1], project: match[2] };
+      }
+    }
+  } catch {
+  }
+  return { org: null, project: null };
+}
+function getCurrentContext(options = {}) {
+  if (options.currentOrg && options.currentProject) {
+    return { org: options.currentOrg, project: options.currentProject };
+  }
+  const envOrg = process.env.CODEX_CURRENT_ORG;
+  const envProject = process.env.CODEX_CURRENT_PROJECT;
+  if (envOrg && envProject) {
+    return { org: envOrg, project: envProject };
+  }
+  return detectCurrentProject(options.cwd);
+}
+function calculateCachePath(org, project, filePath, cacheDir) {
+  return path3__default.default.join(cacheDir, org, project, filePath);
+}
+function resolveReference(uri, options = {}) {
+  const parsed = parseReference(uri);
+  if (!parsed) {
+    return null;
+  }
+  const cacheDir = options.cacheDir || DEFAULT_CACHE_DIR;
+  const currentContext = getCurrentContext(options);
+  const cachePath = parsed.path ? calculateCachePath(parsed.org, parsed.project, parsed.path, cacheDir) : path3__default.default.join(cacheDir, parsed.org, parsed.project);
+  const isCurrentProject = currentContext.org === parsed.org && currentContext.project === parsed.project;
+  const resolved = {
+    ...parsed,
+    cachePath,
+    isCurrentProject
+  };
+  if (isCurrentProject && parsed.path) {
+    resolved.localPath = parsed.path;
+  }
+  return resolved;
+}
+function resolveReferences(uris, options = {}) {
+  return uris.map((uri) => resolveReference(uri, options)).filter((r) => r !== null);
+}
+function isCurrentProjectUri(uri, options = {}) {
+  const resolved = resolveReference(uri, options);
+  return resolved?.isCurrentProject ?? false;
+}
+function getRelativeCachePath(uri) {
+  const parsed = parseReference(uri);
+  if (!parsed) {
+    return null;
+  }
+  if (parsed.path) {
+    return path3__default.default.join(parsed.org, parsed.project, parsed.path);
+  }
+  return path3__default.default.join(parsed.org, parsed.project);
+}
+
+// src/types/built-in.ts
+var TTL = {
+  ONE_HOUR: 3600,
+  ONE_DAY: 86400,
+  ONE_WEEK: 604800,
+  TWO_WEEKS: 1209600,
+  ONE_MONTH: 2592e3,
+  ONE_YEAR: 31536e3
+};
+var BUILT_IN_TYPES = {
+  docs: {
+    name: "docs",
+    description: "Documentation files",
+    patterns: ["docs/**", "README.md", "CLAUDE.md", "*.md"],
+    defaultTtl: TTL.ONE_WEEK,
+    archiveAfterDays: 365,
+    archiveStorage: "cloud"
+  },
+  specs: {
+    name: "specs",
+    description: "Technical specifications",
+    patterns: ["specs/**", "SPEC-*.md", "**/specs/**"],
+    defaultTtl: TTL.TWO_WEEKS,
+    archiveAfterDays: null,
+    // Never auto-archive specs
+    archiveStorage: null
+  },
+  logs: {
+    name: "logs",
+    description: "Session and workflow logs",
+    patterns: [".fractary/**/logs/**", "logs/**", "*.log"],
+    defaultTtl: TTL.ONE_DAY,
+    archiveAfterDays: 30,
+    archiveStorage: "cloud"
+  },
+  standards: {
+    name: "standards",
+    description: "Organization standards and guides",
+    patterns: ["standards/**", "guides/**", ".fractary/standards/**"],
+    defaultTtl: TTL.ONE_MONTH,
+    archiveAfterDays: null,
+    // Never auto-archive standards
+    archiveStorage: null
+  },
+  templates: {
+    name: "templates",
+    description: "Reusable templates",
+    patterns: ["templates/**", ".templates/**", ".fractary/templates/**"],
+    defaultTtl: TTL.TWO_WEEKS,
+    archiveAfterDays: 180,
+    archiveStorage: "cloud"
+  },
+  state: {
+    name: "state",
+    description: "Workflow state files",
+    patterns: [".fractary/**/state.json", ".fractary/**/state/**", "**/state.json"],
+    defaultTtl: TTL.ONE_HOUR,
+    archiveAfterDays: 7,
+    archiveStorage: "local"
+  },
+  config: {
+    name: "config",
+    description: "Configuration files",
+    patterns: [
+      ".fractary/**/*.json",
+      "*.config.js",
+      "*.config.ts",
+      "tsconfig.json",
+      "package.json"
+    ],
+    defaultTtl: TTL.ONE_DAY,
+    archiveAfterDays: null,
+    archiveStorage: null
+  },
+  systems: {
+    name: "systems",
+    description: "System definitions",
+    patterns: [".fractary/systems/**", "systems/**"],
+    defaultTtl: TTL.TWO_WEEKS,
+    archiveAfterDays: null,
+    archiveStorage: null
+  }
+};
+var DEFAULT_TYPE = {
+  name: "default",
+  description: "Default type for unmatched files",
+  patterns: ["**/*"],
+  defaultTtl: TTL.ONE_WEEK,
+  archiveAfterDays: 90,
+  archiveStorage: "cloud"
+};
+function getBuiltInType(name) {
+  return BUILT_IN_TYPES[name];
+}
+function getBuiltInTypeNames() {
+  return Object.keys(BUILT_IN_TYPES);
+}
+function isBuiltInType(name) {
+  return name in BUILT_IN_TYPES;
+}
+var TypeRegistry = class {
+  types = /* @__PURE__ */ new Map();
+  patternCache = /* @__PURE__ */ new Map();
+  constructor(options = {}) {
+    const { includeBuiltIn = true, customTypes = {} } = options;
+    if (includeBuiltIn) {
+      for (const [name, type] of Object.entries(BUILT_IN_TYPES)) {
+        this.types.set(name, type);
+      }
+    }
+    for (const [name, partialType] of Object.entries(customTypes)) {
+      this.register({
+        ...DEFAULT_TYPE,
+        ...partialType,
+        name
+      });
+    }
+  }
+  /**
+   * Get a type by name
+   *
+   * Custom types take precedence over built-in types with the same name.
+   *
+   * @param name - Type name
+   * @returns The type or undefined
+   */
+  get(name) {
+    return this.types.get(name);
+  }
+  /**
+   * Register a custom type
+   *
+   * @param type - The type to register
+   */
+  register(type) {
+    this.types.set(type.name, type);
+    this.patternCache.clear();
+  }
+  /**
+   * Unregister a type
+   *
+   * Note: Built-in types can be unregistered but this is not recommended.
+   *
+   * @param name - Type name to unregister
+   * @returns true if the type was removed
+   */
+  unregister(name) {
+    const result = this.types.delete(name);
+    if (result) {
+      this.patternCache.clear();
+    }
+    return result;
+  }
+  /**
+   * Check if a type exists
+   *
+   * @param name - Type name
+   * @returns true if the type exists
+   */
+  has(name) {
+    return this.types.has(name);
+  }
+  /**
+   * List all registered types
+   *
+   * @returns Array of all types
+   */
+  list() {
+    return Array.from(this.types.values());
+  }
+  /**
+   * List all type names
+   *
+   * @returns Array of type names
+   */
+  listNames() {
+    return Array.from(this.types.keys());
+  }
+  /**
+   * Detect the type of a file based on its path
+   *
+   * Types are checked in order of specificity (most specific patterns first).
+   * Returns 'default' if no type matches.
+   *
+   * @param filePath - File path to check
+   * @returns The detected type name
+   */
+  detectType(filePath) {
+    const cached = this.patternCache.get(filePath);
+    if (cached) {
+      return cached;
+    }
+    const normalizedPath = filePath.replace(/\\/g, "/");
+    const sortedTypes = this.list().sort((a, b) => {
+      const aMaxLen = Math.max(...a.patterns.map((p) => p.length));
+      const bMaxLen = Math.max(...b.patterns.map((p) => p.length));
+      return bMaxLen - aMaxLen;
+    });
+    for (const type of sortedTypes) {
+      if (type.name === "default") continue;
+      for (const pattern of type.patterns) {
+        if (micromatch2__default.default.isMatch(normalizedPath, pattern)) {
+          this.patternCache.set(filePath, type.name);
+          return type.name;
+        }
+      }
+    }
+    this.patternCache.set(filePath, "default");
+    return "default";
+  }
+  /**
+   * Get the TTL for a file based on its type
+   *
+   * @param filePath - File path
+   * @param override - Optional TTL override
+   * @returns TTL in seconds
+   */
+  getTtl(filePath, override) {
+    if (override !== void 0) {
+      return override;
+    }
+    const typeName = this.detectType(filePath);
+    const type = this.get(typeName) || DEFAULT_TYPE;
+    return type.defaultTtl;
+  }
+  /**
+   * Get archive configuration for a file
+   *
+   * @param filePath - File path
+   * @returns Archive configuration or null if archiving is disabled
+   */
+  getArchiveConfig(filePath) {
+    const typeName = this.detectType(filePath);
+    const type = this.get(typeName) || DEFAULT_TYPE;
+    if (type.archiveAfterDays === null || type.archiveStorage === null) {
+      return null;
+    }
+    return {
+      afterDays: type.archiveAfterDays,
+      storage: type.archiveStorage
+    };
+  }
+  /**
+   * Get all files that match a type's patterns
+   *
+   * @param typeName - Type name
+   * @param files - Array of file paths to filter
+   * @returns Filtered file paths
+   */
+  filterByType(typeName, files) {
+    const type = this.get(typeName);
+    if (!type) {
+      return [];
+    }
+    return files.filter((file) => {
+      const normalized = file.replace(/\\/g, "/");
+      return type.patterns.some((pattern) => micromatch2__default.default.isMatch(normalized, pattern));
+    });
+  }
+  /**
+   * Check if a type is a built-in type
+   *
+   * @param name - Type name
+   * @returns true if it's a built-in type
+   */
+  isBuiltIn(name) {
+    return isBuiltInType(name);
+  }
+  /**
+   * Get the number of registered types
+   */
+  get size() {
+    return this.types.size;
+  }
+  /**
+   * Clear pattern cache
+   *
+   * Call this if you need to force re-detection of types.
+   */
+  clearCache() {
+    this.patternCache.clear();
+  }
+};
+function createDefaultRegistry() {
+  return new TypeRegistry();
+}
+var CustomTypeSchema = zod.z.object({
+  description: zod.z.string().optional(),
+  patterns: zod.z.array(zod.z.string()).min(1),
+  defaultTtl: zod.z.number().positive().optional(),
+  archiveAfterDays: zod.z.number().positive().nullable().optional(),
+  archiveStorage: zod.z.enum(["local", "cloud", "drive"]).nullable().optional(),
+  syncPatterns: zod.z.array(zod.z.string()).optional(),
+  excludePatterns: zod.z.array(zod.z.string()).optional(),
+  permissions: zod.z.object({
+    include: zod.z.array(zod.z.string()),
+    exclude: zod.z.array(zod.z.string())
+  }).optional()
+});
+var TypesConfigSchema = zod.z.object({
+  custom: zod.z.record(zod.z.string(), CustomTypeSchema).optional()
+});
+function parseTtl(value) {
+  if (typeof value === "number") {
+    return value;
+  }
+  const match = value.match(/^(\d+)(s|m|h|d|w)$/);
+  if (!match || !match[1] || !match[2]) {
+    return TTL.ONE_WEEK;
+  }
+  const num = parseInt(match[1], 10);
+  const unit = match[2];
+  switch (unit) {
+    case "s":
+      return num;
+    case "m":
+      return num * 60;
+    case "h":
+      return num * 3600;
+    case "d":
+      return num * 86400;
+    case "w":
+      return num * 604800;
+    default:
+      return TTL.ONE_WEEK;
+  }
+}
+function validateCustomTypes(config) {
+  const result = {
+    valid: true,
+    errors: []
+  };
+  if (!config || typeof config !== "object") {
+    return result;
+  }
+  const typesConfig = config;
+  const customTypes = typesConfig.custom;
+  if (!customTypes) {
+    return result;
+  }
+  for (const [name, typeConfig] of Object.entries(customTypes)) {
+    if (!/^[a-z][a-z0-9_-]*$/.test(name)) {
+      result.valid = false;
+      result.errors.push({
+        name,
+        field: "name",
+        message: "Type name must start with a letter and contain only lowercase letters, numbers, hyphens, and underscores"
+      });
+    }
+    const parseResult = CustomTypeSchema.safeParse(typeConfig);
+    if (!parseResult.success) {
+      result.valid = false;
+      for (const issue of parseResult.error.issues) {
+        result.errors.push({
+          name,
+          field: issue.path.join("."),
+          message: issue.message
+        });
+      }
+    }
+  }
+  return result;
+}
+function loadCustomTypes(config) {
+  const types = /* @__PURE__ */ new Map();
+  if (!config.custom) {
+    return types;
+  }
+  for (const [name, typeConfig] of Object.entries(config.custom)) {
+    const type = {
+      name,
+      description: typeConfig.description || `Custom type: ${name}`,
+      patterns: typeConfig.patterns,
+      defaultTtl: typeConfig.defaultTtl ?? DEFAULT_TYPE.defaultTtl,
+      archiveAfterDays: typeConfig.archiveAfterDays ?? DEFAULT_TYPE.archiveAfterDays,
+      archiveStorage: typeConfig.archiveStorage ?? DEFAULT_TYPE.archiveStorage,
+      syncPatterns: typeConfig.syncPatterns,
+      excludePatterns: typeConfig.excludePatterns,
+      permissions: typeConfig.permissions
+    };
+    types.set(name, type);
+  }
+  return types;
+}
+function mergeTypes(builtIn, custom) {
+  const merged = /* @__PURE__ */ new Map();
+  for (const [name, type] of Object.entries(builtIn)) {
+    merged.set(name, type);
+  }
+  for (const [name, type] of custom) {
+    merged.set(name, type);
+  }
+  return merged;
+}
+function extendType(baseName, overrides) {
+  return {
+    ...overrides,
+    name: baseName
+  };
+}
 var MetadataSchema = zod.z.object({
   // Organizational
   org: zod.z.string().optional(),
@@ -41,6 +705,7 @@ var MetadataSchema = zod.z.object({
   // Sync rules
   codex_sync_include: zod.z.array(zod.z.string()).optional(),
   codex_sync_exclude: zod.z.array(zod.z.string()).optional(),
+  codex_sync_custom: zod.z.array(zod.z.string()).optional(),
   // Metadata
   title: zod.z.string().optional(),
   description: zod.z.string().optional(),
@@ -143,7 +808,7 @@ function extractRawFrontmatter(content) {
 }
 function matchPattern(pattern, value) {
   if (pattern === value) return true;
-  return micromatch.isMatch(value, pattern);
+  return micromatch2.isMatch(value, pattern);
 }
 function matchAnyPattern(patterns, value) {
   if (patterns.length === 1 && patterns[0] === "*") {
@@ -389,28 +1054,3317 @@ function getTargetRepos(options) {
   );
 }
 
+// src/core/custom/destinations.ts
+function parseCustomDestination(value) {
+  if (typeof value !== "string" || !value) {
+    throw new ValidationError("Custom destination must be a non-empty string");
+  }
+  const colonIndex = value.indexOf(":");
+  if (colonIndex === -1) {
+    throw new ValidationError(
+      `Invalid custom destination format: "${value}". Expected format: "repo:path"`
+    );
+  }
+  const repo = value.substring(0, colonIndex).trim();
+  const path5 = value.substring(colonIndex + 1).trim();
+  if (!repo) {
+    throw new ValidationError(
+      `Invalid custom destination: repository name cannot be empty in "${value}"`
+    );
+  }
+  if (!path5) {
+    throw new ValidationError(
+      `Invalid custom destination: path cannot be empty in "${value}"`
+    );
+  }
+  return { repo, path: path5 };
+}
+function getCustomSyncDestinations(metadata) {
+  const customDestinations = metadata.codex_sync_custom;
+  if (!customDestinations || !Array.isArray(customDestinations)) {
+    return [];
+  }
+  const results = [];
+  for (const destination of customDestinations) {
+    try {
+      const parsed = parseCustomDestination(destination);
+      results.push(parsed);
+    } catch (error) {
+      continue;
+    }
+  }
+  return results;
+}
+
+// src/storage/provider.ts
+var DEFAULT_FETCH_OPTIONS = {
+  timeout: 3e4,
+  // 30 seconds
+  maxRetries: 3,
+  token: "",
+  branch: "main",
+  followRedirects: true,
+  maxSize: 10 * 1024 * 1024
+  // 10MB
+};
+function mergeFetchOptions(options) {
+  return {
+    ...DEFAULT_FETCH_OPTIONS,
+    ...options
+  };
+}
+function detectContentType(path5) {
+  const ext = path5.split(".").pop()?.toLowerCase();
+  const mimeTypes = {
+    md: "text/markdown",
+    markdown: "text/markdown",
+    txt: "text/plain",
+    json: "application/json",
+    yaml: "application/x-yaml",
+    yml: "application/x-yaml",
+    xml: "application/xml",
+    html: "text/html",
+    htm: "text/html",
+    css: "text/css",
+    js: "application/javascript",
+    ts: "application/typescript",
+    py: "text/x-python",
+    rb: "text/x-ruby",
+    go: "text/x-go",
+    rs: "text/x-rust",
+    java: "text/x-java",
+    c: "text/x-c",
+    cpp: "text/x-c++",
+    h: "text/x-c",
+    hpp: "text/x-c++",
+    sh: "application/x-sh",
+    bash: "application/x-sh",
+    zsh: "application/x-sh",
+    pdf: "application/pdf",
+    png: "image/png",
+    jpg: "image/jpeg",
+    jpeg: "image/jpeg",
+    gif: "image/gif",
+    svg: "image/svg+xml",
+    webp: "image/webp"
+  };
+  return mimeTypes[ext || ""] || "application/octet-stream";
+}
+var LocalStorage = class {
+  name = "local";
+  type = "local";
+  baseDir;
+  constructor(options = {}) {
+    this.baseDir = options.baseDir || process.cwd();
+  }
+  /**
+   * Check if this provider can handle the reference
+   *
+   * Local provider handles references that are in the current project
+   * and have a local path.
+   */
+  canHandle(reference) {
+    return reference.isCurrentProject && !!reference.localPath;
+  }
+  /**
+   * Fetch content from local filesystem
+   */
+  async fetch(reference, options) {
+    const opts = mergeFetchOptions(options);
+    if (!reference.localPath) {
+      throw new Error(`No local path for reference: ${reference.uri}`);
+    }
+    const fullPath = path3__default.default.isAbsolute(reference.localPath) ? reference.localPath : path3__default.default.join(this.baseDir, reference.localPath);
+    try {
+      await fs2__default.default.access(fullPath);
+    } catch {
+      throw new Error(`File not found: ${fullPath}`);
+    }
+    const stats = await fs2__default.default.stat(fullPath);
+    if (stats.size > opts.maxSize) {
+      throw new Error(
+        `File too large: ${stats.size} bytes (max: ${opts.maxSize} bytes)`
+      );
+    }
+    const content = await fs2__default.default.readFile(fullPath);
+    return {
+      content,
+      contentType: detectContentType(reference.localPath),
+      size: content.length,
+      source: "local",
+      metadata: {
+        path: fullPath,
+        mtime: stats.mtime.toISOString()
+      }
+    };
+  }
+  /**
+   * Check if file exists locally
+   */
+  async exists(reference) {
+    if (!reference.localPath) {
+      return false;
+    }
+    const fullPath = path3__default.default.isAbsolute(reference.localPath) ? reference.localPath : path3__default.default.join(this.baseDir, reference.localPath);
+    try {
+      await fs2__default.default.access(fullPath);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  /**
+   * Read file content as string
+   */
+  async readText(filePath) {
+    const fullPath = path3__default.default.isAbsolute(filePath) ? filePath : path3__default.default.join(this.baseDir, filePath);
+    return fs2__default.default.readFile(fullPath, "utf-8");
+  }
+  /**
+   * Write content to file
+   */
+  async write(filePath, content) {
+    const fullPath = path3__default.default.isAbsolute(filePath) ? filePath : path3__default.default.join(this.baseDir, filePath);
+    await fs2__default.default.mkdir(path3__default.default.dirname(fullPath), { recursive: true });
+    await fs2__default.default.writeFile(fullPath, content);
+  }
+  /**
+   * Delete a file
+   */
+  async delete(filePath) {
+    const fullPath = path3__default.default.isAbsolute(filePath) ? filePath : path3__default.default.join(this.baseDir, filePath);
+    try {
+      await fs2__default.default.unlink(fullPath);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  /**
+   * List files in a directory
+   */
+  async list(dirPath) {
+    const fullPath = path3__default.default.isAbsolute(dirPath) ? dirPath : path3__default.default.join(this.baseDir, dirPath);
+    try {
+      const entries = await fs2__default.default.readdir(fullPath, { withFileTypes: true });
+      return entries.filter((e) => e.isFile()).map((e) => path3__default.default.join(dirPath, e.name));
+    } catch {
+      return [];
+    }
+  }
+};
+function createLocalStorage(options) {
+  return new LocalStorage(options);
+}
+
+// src/storage/github.ts
+var GitHubStorage = class {
+  name = "github";
+  type = "github";
+  apiBaseUrl;
+  rawBaseUrl;
+  defaultBranch;
+  token;
+  constructor(options = {}) {
+    this.apiBaseUrl = options.apiBaseUrl || "https://api.github.com";
+    this.rawBaseUrl = options.rawBaseUrl || "https://raw.githubusercontent.com";
+    this.defaultBranch = options.defaultBranch || "main";
+    this.token = options.token || (options.tokenEnv ? process.env[options.tokenEnv] : void 0);
+    if (!this.token) {
+      this.token = process.env.GITHUB_TOKEN || process.env.GH_TOKEN;
+    }
+  }
+  /**
+   * Check if this provider can handle the reference
+   *
+   * GitHub provider handles references that are NOT in the current project
+   * (those need to be fetched from GitHub).
+   */
+  canHandle(reference) {
+    return !reference.isCurrentProject;
+  }
+  /**
+   * Fetch content from GitHub
+   */
+  async fetch(reference, options) {
+    const opts = mergeFetchOptions(options);
+    const token = opts.token || this.token;
+    const branch = opts.branch || this.defaultBranch;
+    if (!reference.path) {
+      throw new Error(`No path specified for reference: ${reference.uri}`);
+    }
+    try {
+      return await this.fetchRaw(reference, branch, opts, token);
+    } catch (error) {
+      if (token) {
+        return await this.fetchApi(reference, branch, opts, token);
+      }
+      throw error;
+    }
+  }
+  /**
+   * Fetch using raw.githubusercontent.com
+   */
+  async fetchRaw(reference, branch, opts, token) {
+    const url = `${this.rawBaseUrl}/${reference.org}/${reference.project}/${branch}/${reference.path}`;
+    const headers = {
+      "User-Agent": "fractary-codex"
+    };
+    if (token) {
+      headers["Authorization"] = `token ${token}`;
+    }
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), opts.timeout);
+    try {
+      const response = await fetch(url, {
+        headers,
+        signal: controller.signal,
+        redirect: opts.followRedirects ? "follow" : "manual"
+      });
+      if (!response.ok) {
+        throw new Error(`GitHub raw fetch failed: ${response.status} ${response.statusText}`);
+      }
+      const arrayBuffer = await response.arrayBuffer();
+      const content = Buffer.from(arrayBuffer);
+      if (content.length > opts.maxSize) {
+        throw new Error(`Content too large: ${content.length} bytes (max: ${opts.maxSize} bytes)`);
+      }
+      return {
+        content,
+        contentType: response.headers.get("content-type") || detectContentType(reference.path),
+        size: content.length,
+        source: "github-raw",
+        metadata: {
+          url,
+          branch
+        }
+      };
+    } finally {
+      clearTimeout(timeoutId);
+    }
+  }
+  /**
+   * Fetch using GitHub API (for private repos)
+   */
+  async fetchApi(reference, branch, opts, token) {
+    const url = `${this.apiBaseUrl}/repos/${reference.org}/${reference.project}/contents/${reference.path}?ref=${branch}`;
+    const headers = {
+      "User-Agent": "fractary-codex",
+      Accept: "application/vnd.github.v3+json",
+      Authorization: `token ${token}`
+    };
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), opts.timeout);
+    try {
+      const response = await fetch(url, {
+        headers,
+        signal: controller.signal
+      });
+      if (!response.ok) {
+        throw new Error(`GitHub API fetch failed: ${response.status} ${response.statusText}`);
+      }
+      const data = await response.json();
+      if (data.type !== "file") {
+        throw new Error(`Reference is not a file: ${reference.uri}`);
+      }
+      let content;
+      if (data.content && data.encoding === "base64") {
+        content = Buffer.from(data.content, "base64");
+      } else if (data.download_url) {
+        const downloadResponse = await fetch(data.download_url, {
+          headers: { "User-Agent": "fractary-codex" },
+          signal: controller.signal
+        });
+        const arrayBuffer = await downloadResponse.arrayBuffer();
+        content = Buffer.from(arrayBuffer);
+      } else {
+        throw new Error(`No content available for: ${reference.uri}`);
+      }
+      if (content.length > opts.maxSize) {
+        throw new Error(`Content too large: ${content.length} bytes (max: ${opts.maxSize} bytes)`);
+      }
+      return {
+        content,
+        contentType: detectContentType(reference.path),
+        size: content.length,
+        source: "github-api",
+        metadata: {
+          sha: data.sha,
+          url,
+          branch
+        }
+      };
+    } finally {
+      clearTimeout(timeoutId);
+    }
+  }
+  /**
+   * Check if file exists on GitHub
+   */
+  async exists(reference, options) {
+    const opts = mergeFetchOptions(options);
+    const token = opts.token || this.token;
+    const branch = opts.branch || this.defaultBranch;
+    if (!reference.path) {
+      return false;
+    }
+    const url = `${this.rawBaseUrl}/${reference.org}/${reference.project}/${branch}/${reference.path}`;
+    const headers = {
+      "User-Agent": "fractary-codex"
+    };
+    if (token) {
+      headers["Authorization"] = `token ${token}`;
+    }
+    try {
+      const response = await fetch(url, {
+        method: "HEAD",
+        headers
+      });
+      return response.ok;
+    } catch {
+      return false;
+    }
+  }
+  /**
+   * Get repository metadata
+   */
+  async getRepoInfo(org, project) {
+    const url = `${this.apiBaseUrl}/repos/${org}/${project}`;
+    const headers = {
+      "User-Agent": "fractary-codex",
+      Accept: "application/vnd.github.v3+json"
+    };
+    if (this.token) {
+      headers["Authorization"] = `token ${this.token}`;
+    }
+    try {
+      const response = await fetch(url, { headers });
+      if (!response.ok) {
+        return null;
+      }
+      const data = await response.json();
+      return {
+        defaultBranch: data.default_branch,
+        private: data.private,
+        size: data.size
+      };
+    } catch {
+      return null;
+    }
+  }
+};
+function createGitHubStorage(options) {
+  return new GitHubStorage(options);
+}
+
+// src/storage/http.ts
+var HttpStorage = class {
+  name = "http";
+  type = "http";
+  defaultTimeout;
+  defaultMaxSize;
+  defaultHeaders;
+  constructor(options = {}) {
+    this.defaultTimeout = options.timeout || 3e4;
+    this.defaultMaxSize = options.maxSize || 10 * 1024 * 1024;
+    this.defaultHeaders = {
+      "User-Agent": options.userAgent || "fractary-codex",
+      ...options.headers
+    };
+  }
+  /**
+   * Check if this provider can handle the reference
+   *
+   * HTTP provider is a fallback - it can handle any reference
+   * but should have lower priority than specialized providers.
+   */
+  canHandle(_reference) {
+    return true;
+  }
+  /**
+   * Fetch content from HTTP URL
+   *
+   * This method constructs a URL from the reference and fetches it.
+   * The URL pattern is: https://raw.githubusercontent.com/{org}/{project}/{branch}/{path}
+   *
+   * For custom URL schemes, use the fetchUrl method directly.
+   */
+  async fetch(reference, options) {
+    const opts = mergeFetchOptions(options);
+    const branch = opts.branch || "main";
+    if (!reference.path) {
+      throw new Error(`No path specified for reference: ${reference.uri}`);
+    }
+    const url = `https://raw.githubusercontent.com/${reference.org}/${reference.project}/${branch}/${reference.path}`;
+    return this.fetchUrl(url, opts);
+  }
+  /**
+   * Fetch content from any URL
+   */
+  async fetchUrl(url, options) {
+    const opts = mergeFetchOptions(options);
+    const timeout = opts.timeout || this.defaultTimeout;
+    const maxSize = opts.maxSize || this.defaultMaxSize;
+    const headers = {
+      ...this.defaultHeaders
+    };
+    if (opts.token) {
+      headers["Authorization"] = `Bearer ${opts.token}`;
+    }
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), timeout);
+    try {
+      const response = await fetch(url, {
+        headers,
+        signal: controller.signal,
+        redirect: opts.followRedirects ? "follow" : "manual"
+      });
+      if (!response.ok) {
+        throw new Error(`HTTP fetch failed: ${response.status} ${response.statusText}`);
+      }
+      const contentLength = response.headers.get("content-length");
+      if (contentLength && parseInt(contentLength, 10) > maxSize) {
+        throw new Error(`Content too large: ${contentLength} bytes (max: ${maxSize} bytes)`);
+      }
+      const arrayBuffer = await response.arrayBuffer();
+      const content = Buffer.from(arrayBuffer);
+      if (content.length > maxSize) {
+        throw new Error(`Content too large: ${content.length} bytes (max: ${maxSize} bytes)`);
+      }
+      const pathname = new URL(url).pathname;
+      const filename = pathname.split("/").pop() || "";
+      return {
+        content,
+        contentType: response.headers.get("content-type") || detectContentType(filename),
+        size: content.length,
+        source: "http",
+        metadata: {
+          url,
+          status: response.status,
+          headers: Object.fromEntries(response.headers.entries())
+        }
+      };
+    } finally {
+      clearTimeout(timeoutId);
+    }
+  }
+  /**
+   * Check if URL exists (HEAD request)
+   */
+  async exists(reference, options) {
+    const opts = mergeFetchOptions(options);
+    const branch = opts.branch || "main";
+    if (!reference.path) {
+      return false;
+    }
+    const url = `https://raw.githubusercontent.com/${reference.org}/${reference.project}/${branch}/${reference.path}`;
+    return this.urlExists(url, opts);
+  }
+  /**
+   * Check if any URL exists
+   */
+  async urlExists(url, options) {
+    const opts = mergeFetchOptions(options);
+    const timeout = opts.timeout || this.defaultTimeout;
+    const headers = {
+      ...this.defaultHeaders
+    };
+    if (opts.token) {
+      headers["Authorization"] = `Bearer ${opts.token}`;
+    }
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), timeout);
+    try {
+      const response = await fetch(url, {
+        method: "HEAD",
+        headers,
+        signal: controller.signal,
+        redirect: "follow"
+      });
+      return response.ok;
+    } catch {
+      return false;
+    } finally {
+      clearTimeout(timeoutId);
+    }
+  }
+};
+function createHttpStorage(options) {
+  return new HttpStorage(options);
+}
+
+// src/storage/manager.ts
+var StorageManager = class {
+  providers = /* @__PURE__ */ new Map();
+  priority;
+  constructor(config = {}) {
+    this.providers.set("local", new LocalStorage(config.local));
+    this.providers.set("github", new GitHubStorage(config.github));
+    this.providers.set("http", new HttpStorage(config.http));
+    this.priority = config.priority || ["local", "github", "http"];
+  }
+  /**
+   * Register a custom storage provider
+   */
+  registerProvider(provider) {
+    this.providers.set(provider.type, provider);
+  }
+  /**
+   * Remove a storage provider
+   */
+  removeProvider(type) {
+    return this.providers.delete(type);
+  }
+  /**
+   * Get a provider by type
+   */
+  getProvider(type) {
+    return this.providers.get(type);
+  }
+  /**
+   * Get all registered providers
+   */
+  getProviders() {
+    return Array.from(this.providers.values());
+  }
+  /**
+   * Find the best provider for a reference
+   */
+  findProvider(reference) {
+    for (const type of this.priority) {
+      const provider = this.providers.get(type);
+      if (provider && provider.canHandle(reference)) {
+        return provider;
+      }
+    }
+    return null;
+  }
+  /**
+   * Fetch content for a reference
+   *
+   * Tries providers in priority order until one succeeds.
+   */
+  async fetch(reference, options) {
+    const errors = [];
+    for (const type of this.priority) {
+      const provider = this.providers.get(type);
+      if (!provider || !provider.canHandle(reference)) {
+        continue;
+      }
+      try {
+        return await provider.fetch(reference, options);
+      } catch (error) {
+        errors.push(error instanceof Error ? error : new Error(String(error)));
+      }
+    }
+    if (errors.length === 0) {
+      throw new Error(`No provider can handle reference: ${reference.uri}`);
+    }
+    const firstError = errors[0];
+    if (firstError) {
+      if (errors.length > 1) {
+        throw new Error(`All providers failed for ${reference.uri}. First error: ${firstError.message}`);
+      }
+      throw firstError;
+    }
+    throw new Error(`Unknown error fetching ${reference.uri}`);
+  }
+  /**
+   * Check if content exists for a reference
+   *
+   * Returns true if any provider reports the content exists.
+   */
+  async exists(reference, options) {
+    for (const type of this.priority) {
+      const provider = this.providers.get(type);
+      if (!provider || !provider.canHandle(reference)) {
+        continue;
+      }
+      try {
+        if (await provider.exists(reference, options)) {
+          return true;
+        }
+      } catch {
+      }
+    }
+    return false;
+  }
+  /**
+   * Fetch content using a specific provider
+   */
+  async fetchWith(type, reference, options) {
+    const provider = this.providers.get(type);
+    if (!provider) {
+      throw new Error(`Provider not found: ${type}`);
+    }
+    return provider.fetch(reference, options);
+  }
+  /**
+   * Fetch multiple references in parallel
+   */
+  async fetchMany(references, options) {
+    const results = /* @__PURE__ */ new Map();
+    const promises = references.map(async (ref) => {
+      try {
+        const result = await this.fetch(ref, options);
+        results.set(ref.uri, result);
+      } catch (error) {
+        results.set(ref.uri, error instanceof Error ? error : new Error(String(error)));
+      }
+    });
+    await Promise.all(promises);
+    return results;
+  }
+  /**
+   * Get provider status (for diagnostics)
+   */
+  getStatus() {
+    return this.priority.map((type, index) => {
+      const provider = this.providers.get(type);
+      return {
+        type,
+        name: provider?.name || type,
+        priority: index
+      };
+    });
+  }
+};
+function createStorageManager(config) {
+  return new StorageManager(config);
+}
+var defaultManager = null;
+function getDefaultStorageManager() {
+  if (!defaultManager) {
+    defaultManager = createStorageManager();
+  }
+  return defaultManager;
+}
+function setDefaultStorageManager(manager) {
+  defaultManager = manager;
+}
+
+// src/cache/entry.ts
+function calculateContentHash(content) {
+  let hash = 2166136261;
+  for (let i = 0; i < content.length; i++) {
+    hash ^= content[i] ?? 0;
+    hash = Math.imul(hash, 16777619);
+  }
+  return (hash >>> 0).toString(16).padStart(8, "0");
+}
+function createCacheEntry(uri, result, ttl) {
+  const now = Date.now();
+  const metadata = {
+    uri,
+    cachedAt: now,
+    expiresAt: now + ttl * 1e3,
+    ttl,
+    contentHash: calculateContentHash(result.content),
+    size: result.size,
+    contentType: result.contentType,
+    source: result.source,
+    accessCount: 1,
+    lastAccessedAt: now,
+    providerMetadata: result.metadata
+  };
+  if (result.metadata?.etag && typeof result.metadata.etag === "string") {
+    metadata.etag = result.metadata.etag;
+  }
+  if (result.metadata?.lastModified && typeof result.metadata.lastModified === "string") {
+    metadata.lastModified = result.metadata.lastModified;
+  }
+  return {
+    metadata,
+    content: result.content
+  };
+}
+function getCacheEntryStatus(entry) {
+  const now = Date.now();
+  if (now < entry.metadata.expiresAt) {
+    return "fresh";
+  }
+  const staleWindow = 5 * 60 * 1e3;
+  if (now < entry.metadata.expiresAt + staleWindow) {
+    return "stale";
+  }
+  return "expired";
+}
+function isCacheEntryValid(entry) {
+  const status = getCacheEntryStatus(entry);
+  return status === "fresh" || status === "stale";
+}
+function isCacheEntryFresh(entry) {
+  return getCacheEntryStatus(entry) === "fresh";
+}
+function touchCacheEntry(entry) {
+  entry.metadata.accessCount++;
+  entry.metadata.lastAccessedAt = Date.now();
+}
+function serializeCacheEntry(entry) {
+  return {
+    metadata: entry.metadata,
+    content: entry.content.toString("base64")
+  };
+}
+function deserializeCacheEntry(serialized) {
+  return {
+    metadata: serialized.metadata,
+    content: Buffer.from(serialized.content, "base64")
+  };
+}
+function getRemainingTtl(entry) {
+  const remaining = entry.metadata.expiresAt - Date.now();
+  return Math.max(0, Math.floor(remaining / 1e3));
+}
+function hasContentChanged(entry, newContent) {
+  return entry.metadata.contentHash !== calculateContentHash(newContent);
+}
+function getCacheEntryAge(entry) {
+  return Math.floor((Date.now() - entry.metadata.cachedAt) / 1e3);
+}
+var CachePersistence = class {
+  cacheDir;
+  extension;
+  atomicWrites;
+  constructor(options) {
+    this.cacheDir = options.cacheDir;
+    this.extension = options.extension || ".cache";
+    this.atomicWrites = options.atomicWrites ?? true;
+  }
+  /**
+   * Get the cache file path for a URI
+   */
+  getCachePath(uri) {
+    const match = uri.match(/^codex:\/\/([^/]+)\/([^/]+)(?:\/(.*))?$/);
+    if (!match || !match[1] || !match[2]) {
+      throw new Error(`Invalid codex URI: ${uri}`);
+    }
+    const [, org, project, filePath] = match;
+    const relativePath = filePath || "index";
+    return path3__default.default.join(this.cacheDir, org, project, relativePath + this.extension);
+  }
+  /**
+   * Get the metadata file path for a URI
+   */
+  getMetadataPath(uri) {
+    return this.getCachePath(uri).replace(this.extension, ".meta.json");
+  }
+  /**
+   * Read a cache entry from disk
+   */
+  async read(uri) {
+    const cachePath = this.getCachePath(uri);
+    const metadataPath = this.getMetadataPath(uri);
+    try {
+      const [metadataJson, content] = await Promise.all([
+        fs2__default.default.readFile(metadataPath, "utf-8"),
+        fs2__default.default.readFile(cachePath)
+      ]);
+      const metadata = JSON.parse(metadataJson);
+      return {
+        metadata,
+        content
+      };
+    } catch (error) {
+      if (error.code === "ENOENT") {
+        return null;
+      }
+      throw error;
+    }
+  }
+  /**
+   * Write a cache entry to disk
+   */
+  async write(entry) {
+    const cachePath = this.getCachePath(entry.metadata.uri);
+    const metadataPath = this.getMetadataPath(entry.metadata.uri);
+    await fs2__default.default.mkdir(path3__default.default.dirname(cachePath), { recursive: true });
+    if (this.atomicWrites) {
+      const tempCachePath = cachePath + ".tmp";
+      const tempMetadataPath = metadataPath + ".tmp";
+      try {
+        await Promise.all([
+          fs2__default.default.writeFile(tempCachePath, entry.content),
+          fs2__default.default.writeFile(tempMetadataPath, JSON.stringify(entry.metadata, null, 2))
+        ]);
+        await Promise.all([
+          fs2__default.default.rename(tempCachePath, cachePath),
+          fs2__default.default.rename(tempMetadataPath, metadataPath)
+        ]);
+      } catch (error) {
+        await Promise.all([
+          fs2__default.default.unlink(tempCachePath).catch(() => {
+          }),
+          fs2__default.default.unlink(tempMetadataPath).catch(() => {
+          })
+        ]);
+        throw error;
+      }
+    } else {
+      await Promise.all([
+        fs2__default.default.writeFile(cachePath, entry.content),
+        fs2__default.default.writeFile(metadataPath, JSON.stringify(entry.metadata, null, 2))
+      ]);
+    }
+  }
+  /**
+   * Delete a cache entry
+   */
+  async delete(uri) {
+    const cachePath = this.getCachePath(uri);
+    const metadataPath = this.getMetadataPath(uri);
+    try {
+      await Promise.all([fs2__default.default.unlink(cachePath), fs2__default.default.unlink(metadataPath)]);
+      return true;
+    } catch (error) {
+      if (error.code === "ENOENT") {
+        return false;
+      }
+      throw error;
+    }
+  }
+  /**
+   * Check if a cache entry exists
+   */
+  async exists(uri) {
+    const cachePath = this.getCachePath(uri);
+    try {
+      await fs2__default.default.access(cachePath);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  /**
+   * List all cached URIs
+   */
+  async list() {
+    const uris = [];
+    try {
+      const orgs = await fs2__default.default.readdir(this.cacheDir);
+      for (const org of orgs) {
+        const orgPath = path3__default.default.join(this.cacheDir, org);
+        const orgStat = await fs2__default.default.stat(orgPath);
+        if (!orgStat.isDirectory()) continue;
+        const projects = await fs2__default.default.readdir(orgPath);
+        for (const project of projects) {
+          const projectPath = path3__default.default.join(orgPath, project);
+          const projectStat = await fs2__default.default.stat(projectPath);
+          if (!projectStat.isDirectory()) continue;
+          const files = await this.listFilesRecursive(projectPath);
+          for (const file of files) {
+            if (file.endsWith(this.extension)) {
+              const relativePath = path3__default.default.relative(projectPath, file);
+              const filePath = relativePath.slice(0, -this.extension.length);
+              uris.push(`codex://${org}/${project}/${filePath}`);
+            }
+          }
+        }
+      }
+    } catch (error) {
+      if (error.code === "ENOENT") {
+        return [];
+      }
+      throw error;
+    }
+    return uris;
+  }
+  /**
+   * Recursively list files in a directory
+   */
+  async listFilesRecursive(dir) {
+    const files = [];
+    const entries = await fs2__default.default.readdir(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      const fullPath = path3__default.default.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        files.push(...await this.listFilesRecursive(fullPath));
+      } else if (entry.isFile()) {
+        files.push(fullPath);
+      }
+    }
+    return files;
+  }
+  /**
+   * Clear all cache entries
+   */
+  async clear() {
+    let count = 0;
+    try {
+      const orgs = await fs2__default.default.readdir(this.cacheDir);
+      for (const org of orgs) {
+        const orgPath = path3__default.default.join(this.cacheDir, org);
+        const stat = await fs2__default.default.stat(orgPath);
+        if (stat.isDirectory()) {
+          await fs2__default.default.rm(orgPath, { recursive: true });
+          count++;
+        }
+      }
+    } catch (error) {
+      if (error.code !== "ENOENT") {
+        throw error;
+      }
+    }
+    return count;
+  }
+  /**
+   * Clear expired entries
+   */
+  async clearExpired() {
+    const uris = await this.list();
+    let cleared = 0;
+    for (const uri of uris) {
+      const entry = await this.read(uri);
+      if (entry && entry.metadata.expiresAt < Date.now()) {
+        if (await this.delete(uri)) {
+          cleared++;
+        }
+      }
+    }
+    return cleared;
+  }
+  /**
+   * Get cache statistics
+   */
+  async getStats() {
+    const stats = {
+      entryCount: 0,
+      totalSize: 0,
+      freshCount: 0,
+      staleCount: 0,
+      expiredCount: 0
+    };
+    const uris = await this.list();
+    const now = Date.now();
+    const staleWindow = 5 * 60 * 1e3;
+    for (const uri of uris) {
+      const entry = await this.read(uri);
+      if (entry) {
+        stats.entryCount++;
+        stats.totalSize += entry.metadata.size;
+        if (now < entry.metadata.expiresAt) {
+          stats.freshCount++;
+        } else if (now < entry.metadata.expiresAt + staleWindow) {
+          stats.staleCount++;
+        } else {
+          stats.expiredCount++;
+        }
+      }
+    }
+    return stats;
+  }
+  /**
+   * Ensure cache directory exists
+   */
+  async ensureDir() {
+    await fs2__default.default.mkdir(this.cacheDir, { recursive: true });
+  }
+  /**
+   * Get cache directory path
+   */
+  getCacheDir() {
+    return this.cacheDir;
+  }
+};
+function createCachePersistence(options) {
+  return new CachePersistence(options);
+}
+
+// src/cache/manager.ts
+var CacheManager = class {
+  memoryCache = /* @__PURE__ */ new Map();
+  persistence;
+  storage = null;
+  config;
+  // LRU tracking
+  accessOrder = [];
+  // Background refresh tracking
+  refreshPromises = /* @__PURE__ */ new Map();
+  constructor(config) {
+    this.config = {
+      cacheDir: config.cacheDir,
+      defaultTtl: config.defaultTtl ?? 3600,
+      // 1 hour default
+      maxMemoryEntries: config.maxMemoryEntries ?? 1e3,
+      maxMemorySize: config.maxMemorySize ?? 50 * 1024 * 1024,
+      // 50MB
+      enablePersistence: config.enablePersistence ?? true,
+      staleWhileRevalidate: config.staleWhileRevalidate ?? true,
+      backgroundRefreshThreshold: config.backgroundRefreshThreshold ?? 60
+      // 1 minute
+    };
+    this.persistence = this.config.enablePersistence ? createCachePersistence({ cacheDir: this.config.cacheDir }) : null;
+  }
+  /**
+   * Set the storage manager for fetching
+   */
+  setStorageManager(storage) {
+    this.storage = storage;
+  }
+  /**
+   * Get content for a reference
+   *
+   * Implements cache-first strategy with stale-while-revalidate.
+   */
+  async get(reference, options) {
+    const ttl = options?.ttl ?? this.config.defaultTtl;
+    let entry = this.memoryCache.get(reference.uri);
+    if (!entry && this.persistence) {
+      entry = await this.persistence.read(reference.uri) ?? void 0;
+      if (entry) {
+        this.setMemoryEntry(reference.uri, entry);
+      }
+    }
+    if (entry) {
+      const status = getCacheEntryStatus(entry);
+      if (status === "fresh") {
+        touchCacheEntry(entry);
+        return this.entryToResult(entry);
+      }
+      if (status === "stale" && this.config.staleWhileRevalidate) {
+        touchCacheEntry(entry);
+        const result = this.entryToResult(entry);
+        this.backgroundRefresh(reference, ttl, options);
+        return result;
+      }
+    }
+    return this.fetchAndCache(reference, ttl, options);
+  }
+  /**
+   * Check if content is cached
+   */
+  async has(uri) {
+    if (this.memoryCache.has(uri)) {
+      return true;
+    }
+    if (this.persistence) {
+      return this.persistence.exists(uri);
+    }
+    return false;
+  }
+  /**
+   * Get cache entry without fetching
+   */
+  async lookup(uri) {
+    let entry = this.memoryCache.get(uri);
+    if (entry) {
+      return {
+        entry,
+        hit: true,
+        fresh: isCacheEntryFresh(entry),
+        source: "memory"
+      };
+    }
+    if (this.persistence) {
+      entry = await this.persistence.read(uri) ?? void 0;
+      if (entry) {
+        this.setMemoryEntry(uri, entry);
+        return {
+          entry,
+          hit: true,
+          fresh: isCacheEntryFresh(entry),
+          source: "disk"
+        };
+      }
+    }
+    return {
+      entry: null,
+      hit: false,
+      fresh: false,
+      source: "none"
+    };
+  }
+  /**
+   * Store content in cache
+   */
+  async set(uri, result, ttl) {
+    const actualTtl = ttl ?? this.config.defaultTtl;
+    const entry = createCacheEntry(uri, result, actualTtl);
+    this.setMemoryEntry(uri, entry);
+    if (this.persistence) {
+      await this.persistence.write(entry);
+    }
+    return entry;
+  }
+  /**
+   * Invalidate a cache entry
+   */
+  async invalidate(uri) {
+    let removed = false;
+    if (this.memoryCache.has(uri)) {
+      this.memoryCache.delete(uri);
+      this.removeFromAccessOrder(uri);
+      removed = true;
+    }
+    if (this.persistence) {
+      const diskRemoved = await this.persistence.delete(uri);
+      removed = removed || diskRemoved;
+    }
+    return removed;
+  }
+  /**
+   * Invalidate all entries matching a pattern
+   */
+  async invalidatePattern(pattern) {
+    let count = 0;
+    for (const uri of this.memoryCache.keys()) {
+      if (pattern.test(uri)) {
+        this.memoryCache.delete(uri);
+        this.removeFromAccessOrder(uri);
+        count++;
+      }
+    }
+    if (this.persistence) {
+      const uris = await this.persistence.list();
+      for (const uri of uris) {
+        if (pattern.test(uri)) {
+          await this.persistence.delete(uri);
+          count++;
+        }
+      }
+    }
+    return count;
+  }
+  /**
+   * Clear all cache entries
+   */
+  async clear() {
+    this.memoryCache.clear();
+    this.accessOrder = [];
+    if (this.persistence) {
+      await this.persistence.clear();
+    }
+  }
+  /**
+   * Clear expired entries
+   */
+  async clearExpired() {
+    let count = 0;
+    const now = Date.now();
+    for (const [uri, entry] of this.memoryCache) {
+      if (entry.metadata.expiresAt < now) {
+        this.memoryCache.delete(uri);
+        this.removeFromAccessOrder(uri);
+        count++;
+      }
+    }
+    if (this.persistence) {
+      count += await this.persistence.clearExpired();
+    }
+    return count;
+  }
+  /**
+   * Get cache statistics
+   */
+  async getStats() {
+    let diskStats = {
+      entryCount: 0,
+      totalSize: 0,
+      freshCount: 0,
+      staleCount: 0,
+      expiredCount: 0
+    };
+    if (this.persistence) {
+      diskStats = await this.persistence.getStats();
+    }
+    let memorySize = 0;
+    for (const entry of this.memoryCache.values()) {
+      memorySize += entry.metadata.size;
+    }
+    return {
+      ...diskStats,
+      memoryEntries: this.memoryCache.size,
+      memorySize
+    };
+  }
+  /**
+   * Preload content into cache
+   */
+  async preload(references, options) {
+    if (!this.storage) {
+      throw new Error("Storage manager not set");
+    }
+    await Promise.all(
+      references.map(async (ref) => {
+        try {
+          await this.get(ref, options);
+        } catch {
+        }
+      })
+    );
+  }
+  /**
+   * Get metadata for a cached entry
+   */
+  async getMetadata(uri) {
+    const result = await this.lookup(uri);
+    return result.entry?.metadata ?? null;
+  }
+  /**
+   * Get remaining TTL for an entry
+   */
+  async getTtl(uri) {
+    const result = await this.lookup(uri);
+    if (result.entry) {
+      return getRemainingTtl(result.entry);
+    }
+    return null;
+  }
+  /**
+   * Fetch content and store in cache
+   */
+  async fetchAndCache(reference, ttl, options) {
+    if (!this.storage) {
+      throw new Error("Storage manager not set");
+    }
+    const result = await this.storage.fetch(reference, options);
+    await this.set(reference.uri, result, ttl);
+    return result;
+  }
+  /**
+   * Background refresh for stale-while-revalidate
+   */
+  backgroundRefresh(reference, ttl, options) {
+    const uri = reference.uri;
+    if (this.refreshPromises.has(uri)) {
+      return;
+    }
+    const promise = this.fetchAndCache(reference, ttl, options).then(() => {
+      const entry = this.memoryCache.get(uri);
+      return entry ?? null;
+    }).catch(() => null).finally(() => {
+      this.refreshPromises.delete(uri);
+    });
+    this.refreshPromises.set(uri, promise);
+  }
+  /**
+   * Set entry in memory cache with LRU eviction
+   */
+  setMemoryEntry(uri, entry) {
+    this.removeFromAccessOrder(uri);
+    this.accessOrder.push(uri);
+    this.memoryCache.set(uri, entry);
+    this.evictIfNeeded();
+  }
+  /**
+   * Evict entries if over limits
+   */
+  evictIfNeeded() {
+    while (this.memoryCache.size > this.config.maxMemoryEntries) {
+      this.evictOldest();
+    }
+    let totalSize = 0;
+    for (const entry of this.memoryCache.values()) {
+      totalSize += entry.metadata.size;
+    }
+    while (totalSize > this.config.maxMemorySize && this.memoryCache.size > 0) {
+      const evicted = this.evictOldest();
+      if (evicted) {
+        totalSize -= evicted.metadata.size;
+      } else {
+        break;
+      }
+    }
+  }
+  /**
+   * Evict the oldest entry (LRU)
+   */
+  evictOldest() {
+    if (this.accessOrder.length === 0) {
+      return null;
+    }
+    const oldest = this.accessOrder.shift();
+    if (oldest) {
+      const entry = this.memoryCache.get(oldest);
+      this.memoryCache.delete(oldest);
+      return entry ?? null;
+    }
+    return null;
+  }
+  /**
+   * Remove URI from access order
+   */
+  removeFromAccessOrder(uri) {
+    const index = this.accessOrder.indexOf(uri);
+    if (index !== -1) {
+      this.accessOrder.splice(index, 1);
+    }
+  }
+  /**
+   * Convert cache entry to fetch result
+   */
+  entryToResult(entry) {
+    return {
+      content: entry.content,
+      contentType: entry.metadata.contentType,
+      size: entry.metadata.size,
+      source: entry.metadata.source,
+      metadata: entry.metadata.providerMetadata
+    };
+  }
+};
+function createCacheManager(config) {
+  return new CacheManager(config);
+}
+var defaultCacheManager = null;
+function getDefaultCacheManager() {
+  if (!defaultCacheManager) {
+    defaultCacheManager = createCacheManager({
+      cacheDir: ".fractary/plugins/codex/cache"
+    });
+  }
+  return defaultCacheManager;
+}
+function setDefaultCacheManager(manager) {
+  defaultCacheManager = manager;
+}
+
+// src/mcp/tools.ts
+var CODEX_TOOLS = [
+  {
+    name: "codex_fetch",
+    description: "Fetch a document from the Codex knowledge base by URI. Returns the document content.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        uri: {
+          type: "string",
+          description: "Codex URI in format: codex://org/project/path/to/file.md"
+        },
+        branch: {
+          type: "string",
+          description: "Git branch to fetch from (default: main)"
+        },
+        noCache: {
+          type: "boolean",
+          description: "Bypass cache and fetch fresh content"
+        }
+      },
+      required: ["uri"]
+    }
+  },
+  {
+    name: "codex_search",
+    description: "Search for documents in the Codex knowledge base.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        query: {
+          type: "string",
+          description: "Search query string"
+        },
+        org: {
+          type: "string",
+          description: "Filter by organization"
+        },
+        project: {
+          type: "string",
+          description: "Filter by project"
+        },
+        limit: {
+          type: "number",
+          description: "Maximum number of results (default: 10)"
+        },
+        type: {
+          type: "string",
+          description: "Filter by artifact type (e.g., docs, specs, logs)"
+        }
+      },
+      required: ["query"]
+    }
+  },
+  {
+    name: "codex_list",
+    description: "List documents in the Codex cache.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        org: {
+          type: "string",
+          description: "Filter by organization"
+        },
+        project: {
+          type: "string",
+          description: "Filter by project"
+        },
+        includeExpired: {
+          type: "boolean",
+          description: "Include expired cache entries"
+        }
+      }
+    }
+  },
+  {
+    name: "codex_invalidate",
+    description: "Invalidate cached documents matching a pattern.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        pattern: {
+          type: "string",
+          description: "URI pattern to invalidate (supports regex)"
+        }
+      },
+      required: ["pattern"]
+    }
+  }
+];
+function textResult(text, isError = false) {
+  return {
+    content: [{ type: "text", text }],
+    isError
+  };
+}
+function resourceResult(uri, content, mimeType) {
+  return {
+    content: [
+      {
+        type: "resource",
+        resource: {
+          uri,
+          mimeType,
+          text: content
+        }
+      }
+    ]
+  };
+}
+async function handleFetch(args, ctx) {
+  const { uri, branch, noCache } = args;
+  const ref = resolveReference(uri);
+  if (!ref) {
+    return textResult(`Invalid codex URI: ${uri}`, true);
+  }
+  try {
+    let result;
+    if (noCache) {
+      result = await ctx.storage.fetch(ref, { branch });
+      await ctx.cache.set(uri, result);
+    } else {
+      result = await ctx.cache.get(ref, { branch });
+    }
+    const content = result.content.toString("utf-8");
+    return resourceResult(uri, content, result.contentType);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return textResult(`Failed to fetch ${uri}: ${message}`, true);
+  }
+}
+async function handleSearch(args, ctx) {
+  const { query, org, project, limit = 10 } = args;
+  const stats = await ctx.cache.getStats();
+  if (stats.entryCount === 0) {
+    return textResult("No documents in cache. Use codex_fetch to load documents first.");
+  }
+  const message = `Search functionality requires a search index.
+Query: "${query}"
+Filters: org=${org || "any"}, project=${project || "any"}
+Limit: ${limit}
+
+To fetch documents, use codex_fetch with a specific URI like:
+codex://org/project/docs/file.md`;
+  return textResult(message);
+}
+async function handleList(args, ctx) {
+  const { org, project, includeExpired } = args;
+  const stats = await ctx.cache.getStats();
+  let message = `Cache Statistics:
+- Total entries: ${stats.entryCount}
+- Memory entries: ${stats.memoryEntries}
+- Memory size: ${formatBytes(stats.memorySize)}
+- Total size: ${formatBytes(stats.totalSize)}
+- Fresh: ${stats.freshCount}
+- Stale: ${stats.staleCount}
+- Expired: ${stats.expiredCount}`;
+  if (org) {
+    message += `
+
+Filtered by org: ${org}`;
+  }
+  if (project) {
+    message += `
+Filtered by project: ${project}`;
+  }
+  if (includeExpired) {
+    message += `
+Including expired entries`;
+  }
+  return textResult(message);
+}
+async function handleInvalidate(args, ctx) {
+  const { pattern } = args;
+  try {
+    const regex = new RegExp(pattern);
+    const count = await ctx.cache.invalidatePattern(regex);
+    return textResult(`Invalidated ${count} cache entries matching pattern: ${pattern}`);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return textResult(`Invalid pattern: ${message}`, true);
+  }
+}
+async function handleToolCall(name, args, ctx) {
+  switch (name) {
+    case "codex_fetch":
+      return handleFetch(args, ctx);
+    case "codex_search":
+      return handleSearch(args, ctx);
+    case "codex_list":
+      return handleList(args, ctx);
+    case "codex_invalidate":
+      return handleInvalidate(args, ctx);
+    default:
+      return textResult(`Unknown tool: ${name}`, true);
+  }
+}
+function formatBytes(bytes) {
+  if (bytes === 0) return "0 B";
+  const k = 1024;
+  const sizes = ["B", "KB", "MB", "GB"];
+  const i = Math.floor(Math.log(bytes) / Math.log(k));
+  return `${parseFloat((bytes / Math.pow(k, i)).toFixed(2))} ${sizes[i]}`;
+}
+
+// src/mcp/server.ts
+var McpServer = class {
+  config;
+  toolContext;
+  constructor(config) {
+    this.config = {
+      name: config.name ?? "codex",
+      version: config.version ?? "1.0.0",
+      cache: config.cache,
+      storage: config.storage
+    };
+    this.toolContext = {
+      cache: config.cache,
+      storage: config.storage
+    };
+  }
+  /**
+   * Get server info
+   */
+  getServerInfo() {
+    return {
+      name: this.config.name,
+      version: this.config.version,
+      capabilities: this.getCapabilities()
+    };
+  }
+  /**
+   * Get server capabilities
+   */
+  getCapabilities() {
+    return {
+      tools: {
+        listChanged: false
+      },
+      resources: {
+        subscribe: false,
+        listChanged: false
+      }
+    };
+  }
+  /**
+   * List available tools
+   */
+  listTools() {
+    return CODEX_TOOLS;
+  }
+  /**
+   * Call a tool
+   */
+  async callTool(name, args) {
+    return handleToolCall(name, args, this.toolContext);
+  }
+  /**
+   * List available resources
+   */
+  async listResources() {
+    const resources = [];
+    const stats = await this.config.cache.getStats();
+    resources.push({
+      uri: "codex://cache/summary",
+      name: "Cache Summary",
+      description: `${stats.entryCount} cached documents`,
+      mimeType: "text/plain"
+    });
+    return resources;
+  }
+  /**
+   * List resource templates
+   */
+  listResourceTemplates() {
+    return [
+      {
+        uriTemplate: "codex://{org}/{project}/{path}",
+        name: "Codex Document",
+        description: "Fetch a document from the Codex knowledge base",
+        mimeType: "text/markdown"
+      }
+    ];
+  }
+  /**
+   * Read a resource
+   */
+  async readResource(uri) {
+    if (uri === "codex://cache/summary") {
+      const stats = await this.config.cache.getStats();
+      return [
+        {
+          uri,
+          mimeType: "text/plain",
+          text: `Cache Statistics:
+- Total entries: ${stats.entryCount}
+- Memory entries: ${stats.memoryEntries}
+- Fresh: ${stats.freshCount}
+- Stale: ${stats.staleCount}
+- Expired: ${stats.expiredCount}`
+        }
+      ];
+    }
+    const ref = resolveReference(uri);
+    if (!ref) {
+      throw new Error(`Invalid codex URI: ${uri}`);
+    }
+    const result = await this.config.cache.get(ref);
+    return [
+      {
+        uri,
+        mimeType: result.contentType,
+        text: result.content.toString("utf-8")
+      }
+    ];
+  }
+  /**
+   * Handle JSON-RPC request
+   *
+   * This method handles the low-level MCP protocol messages.
+   */
+  async handleRequest(method, params) {
+    switch (method) {
+      case "initialize":
+        return {
+          protocolVersion: "2024-11-05",
+          serverInfo: this.getServerInfo(),
+          capabilities: this.getCapabilities()
+        };
+      case "tools/list":
+        return { tools: this.listTools() };
+      case "tools/call": {
+        const { name, arguments: args } = params;
+        return await this.callTool(name, args);
+      }
+      case "resources/list":
+        return { resources: await this.listResources() };
+      case "resources/templates/list":
+        return { resourceTemplates: this.listResourceTemplates() };
+      case "resources/read": {
+        const { uri } = params;
+        return { contents: await this.readResource(uri) };
+      }
+      case "prompts/list":
+        return { prompts: [] };
+      default:
+        throw new Error(`Unknown method: ${method}`);
+    }
+  }
+  /**
+   * Process a JSON-RPC message
+   */
+  async processMessage(message) {
+    let id = null;
+    try {
+      const request = JSON.parse(message);
+      id = request.id;
+      const { method, params } = request;
+      const result = await this.handleRequest(method, params);
+      return JSON.stringify({
+        jsonrpc: "2.0",
+        id,
+        result
+      });
+    } catch (error) {
+      const errorMessage = error instanceof Error ? error.message : String(error);
+      return JSON.stringify({
+        jsonrpc: "2.0",
+        id,
+        error: {
+          code: -32603,
+          message: errorMessage
+        }
+      });
+    }
+  }
+};
+function createMcpServer(config) {
+  return new McpServer(config);
+}
+
+// src/sync/types.ts
+var DEFAULT_SYNC_CONFIG = {
+  defaultDirection: "to-codex",
+  rules: [],
+  defaultExcludes: [
+    "**/node_modules/**",
+    "**/.git/**",
+    "**/.DS_Store",
+    "**/Thumbs.db",
+    "**/*.log",
+    "**/.env*",
+    "**/dist/**",
+    "**/build/**",
+    "**/coverage/**"
+  ],
+  deleteOrphans: false,
+  conflictStrategy: "newest"
+};
+function evaluatePath(path5, rules, direction, defaultExcludes = []) {
+  for (const pattern of defaultExcludes) {
+    if (micromatch2__default.default.isMatch(path5, pattern)) {
+      return {
+        path: path5,
+        shouldSync: false,
+        reason: `Excluded by default pattern: ${pattern}`
+      };
+    }
+  }
+  const sortedRules = [...rules].sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0));
+  for (const rule of sortedRules) {
+    if (rule.direction && rule.direction !== direction) {
+      continue;
+    }
+    if (micromatch2__default.default.isMatch(path5, rule.pattern)) {
+      return {
+        path: path5,
+        shouldSync: rule.include,
+        matchedRule: rule,
+        reason: rule.include ? `Included by rule: ${rule.pattern}` : `Excluded by rule: ${rule.pattern}`
+      };
+    }
+  }
+  return {
+    path: path5,
+    shouldSync: true,
+    reason: "No matching rule, included by default"
+  };
+}
+function evaluatePaths(paths, rules, direction, defaultExcludes = []) {
+  const results = /* @__PURE__ */ new Map();
+  for (const path5 of paths) {
+    results.set(path5, evaluatePath(path5, rules, direction, defaultExcludes));
+  }
+  return results;
+}
+function filterSyncablePaths(paths, rules, direction, defaultExcludes = []) {
+  return paths.filter(
+    (path5) => evaluatePath(path5, rules, direction, defaultExcludes).shouldSync
+  );
+}
+function createRulesFromPatterns(include = [], exclude = []) {
+  const rules = [];
+  for (const pattern of exclude) {
+    rules.push({
+      pattern,
+      include: false,
+      priority: 100
+    });
+  }
+  for (const pattern of include) {
+    rules.push({
+      pattern,
+      include: true,
+      priority: 50
+    });
+  }
+  return rules;
+}
+function mergeRules(...ruleSets) {
+  return ruleSets.flat();
+}
+function summarizeEvaluations(results) {
+  const summary = {
+    total: results.size,
+    included: 0,
+    excluded: 0,
+    byReason: {}
+  };
+  for (const result of results.values()) {
+    if (result.shouldSync) {
+      summary.included++;
+    } else {
+      summary.excluded++;
+    }
+    summary.byReason[result.reason] = (summary.byReason[result.reason] ?? 0) + 1;
+  }
+  return summary;
+}
+function validateRules(rules) {
+  const errors = [];
+  for (let i = 0; i < rules.length; i++) {
+    const rule = rules[i];
+    if (!rule) continue;
+    if (!rule.pattern || rule.pattern.trim() === "") {
+      errors.push(`Rule ${i}: pattern is empty`);
+      continue;
+    }
+    try {
+      micromatch2__default.default.isMatch("test", rule.pattern);
+    } catch {
+      errors.push(`Rule ${i}: invalid pattern "${rule.pattern}"`);
+    }
+    if (rule.direction && !["to-codex", "from-codex", "bidirectional"].includes(rule.direction)) {
+      errors.push(`Rule ${i}: invalid direction "${rule.direction}"`);
+    }
+  }
+  return errors;
+}
+
+// src/sync/planner.ts
+function createSyncPlan(sourceFiles, targetFiles, options, config) {
+  const direction = options.direction ?? config.defaultDirection;
+  const targetMap = new Map(targetFiles.map((f) => [f.path, f]));
+  const sourceMap = new Map(sourceFiles.map((f) => [f.path, f]));
+  const files = [];
+  const conflicts = [];
+  const skipped = [];
+  const rules = [
+    ...config.rules,
+    ...(options.include ?? []).map((p) => ({ pattern: p, include: true, priority: 200 })),
+    ...(options.exclude ?? []).map((p) => ({ pattern: p, include: false, priority: 200 }))
+  ];
+  const excludes = [...config.defaultExcludes];
+  for (const sourceFile of sourceFiles) {
+    const evaluation = evaluatePath(sourceFile.path, rules, direction, excludes);
+    if (!evaluation.shouldSync) {
+      skipped.push({
+        path: sourceFile.path,
+        operation: "skip",
+        size: sourceFile.size,
+        reason: evaluation.reason
+      });
+      continue;
+    }
+    const targetFile = targetMap.get(sourceFile.path);
+    if (!targetFile) {
+      files.push({
+        path: sourceFile.path,
+        operation: "create",
+        size: sourceFile.size,
+        mtime: sourceFile.mtime,
+        hash: sourceFile.hash
+      });
+    } else {
+      const isDifferent = sourceFile.hash !== targetFile.hash;
+      if (isDifferent) {
+        if (options.force) {
+          files.push({
+            path: sourceFile.path,
+            operation: "update",
+            size: sourceFile.size,
+            mtime: sourceFile.mtime,
+            hash: sourceFile.hash
+          });
+        } else if (targetFile.mtime > sourceFile.mtime) {
+          conflicts.push({
+            path: sourceFile.path,
+            operation: "conflict",
+            size: sourceFile.size,
+            mtime: sourceFile.mtime,
+            reason: "Target file is newer than source"
+          });
+        } else {
+          files.push({
+            path: sourceFile.path,
+            operation: "update",
+            size: sourceFile.size,
+            mtime: sourceFile.mtime,
+            hash: sourceFile.hash
+          });
+        }
+      } else {
+        skipped.push({
+          path: sourceFile.path,
+          operation: "skip",
+          size: sourceFile.size,
+          reason: "Files are identical"
+        });
+      }
+    }
+  }
+  if (options.delete) {
+    for (const targetFile of targetFiles) {
+      if (!sourceMap.has(targetFile.path)) {
+        const evaluation = evaluatePath(targetFile.path, rules, direction, excludes);
+        if (evaluation.shouldSync) {
+          files.push({
+            path: targetFile.path,
+            operation: "delete",
+            size: targetFile.size
+          });
+        }
+      }
+    }
+  }
+  let limitedFiles = files;
+  if (options.maxFiles && files.length > options.maxFiles) {
+    limitedFiles = files.slice(0, options.maxFiles);
+    for (const file of files.slice(options.maxFiles)) {
+      skipped.push({
+        ...file,
+        operation: "skip",
+        reason: "Exceeded max files limit"
+      });
+    }
+  }
+  const totalBytes = limitedFiles.reduce((sum, f) => sum + (f.size ?? 0), 0);
+  return {
+    direction,
+    source: direction === "from-codex" ? "codex" : "local",
+    target: direction === "from-codex" ? "local" : "codex",
+    files: limitedFiles,
+    totalFiles: limitedFiles.length,
+    totalBytes,
+    conflicts,
+    skipped
+  };
+}
+function estimateSyncTime(plan, bytesPerSecond = 1024 * 1024) {
+  const transferTime = plan.totalBytes / bytesPerSecond * 1e3;
+  const overheadPerFile = 50;
+  const overhead = plan.totalFiles * overheadPerFile;
+  return Math.ceil(transferTime + overhead);
+}
+function createEmptySyncPlan(direction = "to-codex") {
+  return {
+    direction,
+    source: direction === "from-codex" ? "codex" : "local",
+    target: direction === "from-codex" ? "local" : "codex",
+    files: [],
+    totalFiles: 0,
+    totalBytes: 0,
+    conflicts: [],
+    skipped: []
+  };
+}
+function filterPlanOperations(plan, operations) {
+  const filtered = plan.files.filter(
+    (f) => operations.includes(f.operation)
+  );
+  return {
+    ...plan,
+    files: filtered,
+    totalFiles: filtered.length,
+    totalBytes: filtered.reduce((sum, f) => sum + (f.size ?? 0), 0)
+  };
+}
+function getPlanStats(plan) {
+  return {
+    creates: plan.files.filter((f) => f.operation === "create").length,
+    updates: plan.files.filter((f) => f.operation === "update").length,
+    deletes: plan.files.filter((f) => f.operation === "delete").length,
+    skips: plan.skipped.length,
+    conflicts: plan.conflicts.length,
+    totalBytes: plan.totalBytes
+  };
+}
+function formatPlanSummary(plan) {
+  const stats = getPlanStats(plan);
+  const lines = [
+    `Sync Plan: ${plan.source} \u2192 ${plan.target}`,
+    `Direction: ${plan.direction}`,
+    "",
+    `Operations:`,
+    `  Create: ${stats.creates} files`,
+    `  Update: ${stats.updates} files`,
+    `  Delete: ${stats.deletes} files`,
+    `  Skip: ${stats.skips} files`,
+    ""
+  ];
+  if (stats.conflicts > 0) {
+    lines.push(`\u26A0\uFE0F Conflicts: ${stats.conflicts} files`);
+    lines.push("");
+  }
+  lines.push(`Total: ${plan.totalFiles} files (${formatBytes2(stats.totalBytes)})`);
+  return lines.join("\n");
+}
+function formatBytes2(bytes) {
+  if (bytes === 0) return "0 B";
+  const k = 1024;
+  const sizes = ["B", "KB", "MB", "GB"];
+  const i = Math.floor(Math.log(bytes) / Math.log(k));
+  return `${parseFloat((bytes / Math.pow(k, i)).toFixed(2))} ${sizes[i]}`;
+}
+
+// src/sync/manager.ts
+var SyncManager = class {
+  localStorage;
+  config;
+  manifestPath;
+  manifest = null;
+  constructor(options) {
+    this.localStorage = options.localStorage;
+    this.config = {
+      ...DEFAULT_SYNC_CONFIG,
+      ...options.config
+    };
+    this.manifestPath = options.manifestPath ?? ".fractary/codex-sync-manifest.json";
+  }
+  /**
+   * Load the sync manifest
+   */
+  async loadManifest() {
+    try {
+      const content = await this.localStorage.readText(this.manifestPath);
+      this.manifest = JSON.parse(content);
+      return this.manifest;
+    } catch {
+      return null;
+    }
+  }
+  /**
+   * Save the sync manifest
+   */
+  async saveManifest(manifest) {
+    this.manifest = manifest;
+    await this.localStorage.write(this.manifestPath, JSON.stringify(manifest, null, 2));
+  }
+  /**
+   * Get or create manifest
+   */
+  async getOrCreateManifest(org, project) {
+    let manifest = await this.loadManifest();
+    if (!manifest || manifest.org !== org || manifest.project !== project) {
+      manifest = {
+        version: 1,
+        org,
+        project,
+        lastSync: 0,
+        entries: {}
+      };
+    }
+    return manifest;
+  }
+  /**
+   * List local files
+   */
+  async listLocalFiles(directory) {
+    const files = await this.localStorage.list(directory);
+    const fileInfos = [];
+    for (const file of files) {
+      try {
+        const content = await this.localStorage.readText(file);
+        const buffer = Buffer.from(content);
+        fileInfos.push({
+          path: file,
+          size: buffer.length,
+          mtime: Date.now(),
+          // Would need fs.stat for real mtime
+          hash: calculateContentHash(buffer)
+        });
+      } catch {
+      }
+    }
+    return fileInfos;
+  }
+  /**
+   * Create a sync plan
+   *
+   * @param _org - Organization (reserved for future use)
+   * @param _project - Project (reserved for future use)
+   * @param sourceDir - Source directory to sync from
+   * @param targetFiles - Files currently in the target
+   * @param options - Sync options
+   */
+  async createPlan(_org, _project, sourceDir, targetFiles, options) {
+    const sourceFiles = await this.listLocalFiles(sourceDir);
+    const plan = createSyncPlan(
+      sourceFiles,
+      targetFiles,
+      options ?? {},
+      this.config
+    );
+    plan.estimatedTime = estimateSyncTime(plan);
+    return plan;
+  }
+  /**
+   * Execute a sync plan (dry run)
+   *
+   * In a real implementation, this would actually copy files.
+   * For the SDK, we provide the plan and let consumers execute.
+   */
+  async executePlan(plan, options) {
+    const startTime = Date.now();
+    const errors = [];
+    let synced = 0;
+    let failed = 0;
+    if (options?.dryRun) {
+      return {
+        success: true,
+        plan,
+        synced: plan.totalFiles,
+        failed: 0,
+        skipped: plan.skipped.length,
+        errors: [],
+        duration: Date.now() - startTime,
+        timestamp: Date.now()
+      };
+    }
+    for (let i = 0; i < plan.files.length; i++) {
+      const file = plan.files[i];
+      if (!file) continue;
+      try {
+        if (options?.onProgress) {
+          options.onProgress(i + 1, plan.totalFiles, file.path);
+        }
+        synced++;
+      } catch (error) {
+        failed++;
+        errors.push({
+          path: file.path,
+          error: error instanceof Error ? error.message : String(error)
+        });
+      }
+    }
+    return {
+      success: failed === 0,
+      plan,
+      synced,
+      failed,
+      skipped: plan.skipped.length,
+      errors,
+      duration: Date.now() - startTime,
+      timestamp: Date.now()
+    };
+  }
+  /**
+   * Update manifest after sync
+   */
+  async updateManifest(org, project, syncedFiles) {
+    const manifest = await this.getOrCreateManifest(org, project);
+    const now = Date.now();
+    for (const file of syncedFiles) {
+      if (file.operation === "delete") {
+        delete manifest.entries[file.path];
+      } else if (file.operation === "create" || file.operation === "update") {
+        manifest.entries[file.path] = {
+          path: file.path,
+          hash: file.hash ?? "",
+          size: file.size ?? 0,
+          syncedAt: now,
+          source: "local"
+        };
+      }
+    }
+    manifest.lastSync = now;
+    await this.saveManifest(manifest);
+  }
+  /**
+   * Get sync status for a file
+   */
+  async getFileStatus(path5) {
+    const manifest = await this.loadManifest();
+    return manifest?.entries[path5] ?? null;
+  }
+  /**
+   * Check if a file is synced
+   */
+  async isFileSynced(path5) {
+    const status = await this.getFileStatus(path5);
+    return status !== null;
+  }
+  /**
+   * Get last sync timestamp
+   */
+  async getLastSyncTime() {
+    const manifest = await this.loadManifest();
+    return manifest?.lastSync ?? null;
+  }
+  /**
+   * Clear sync manifest
+   */
+  async clearManifest() {
+    try {
+      await this.localStorage.delete(this.manifestPath);
+      this.manifest = null;
+    } catch {
+    }
+  }
+  /**
+   * Get sync configuration
+   */
+  getConfig() {
+    return { ...this.config };
+  }
+  /**
+   * Update sync configuration
+   */
+  updateConfig(updates) {
+    this.config = {
+      ...this.config,
+      ...updates
+    };
+  }
+};
+function createSyncManager(config) {
+  return new SyncManager(config);
+}
+
+// src/permissions/types.ts
+var DEFAULT_PERMISSION_CONFIG = {
+  defaultLevel: "read",
+  defaultAllow: true,
+  rules: [],
+  enforced: false
+};
+var PERMISSION_LEVEL_ORDER = ["none", "read", "write", "admin"];
+function levelGrants(granted, required) {
+  const grantedIndex = PERMISSION_LEVEL_ORDER.indexOf(granted);
+  const requiredIndex = PERMISSION_LEVEL_ORDER.indexOf(required);
+  return grantedIndex >= requiredIndex;
+}
+function maxLevel(a, b) {
+  const aIndex = PERMISSION_LEVEL_ORDER.indexOf(a);
+  const bIndex = PERMISSION_LEVEL_ORDER.indexOf(b);
+  return PERMISSION_LEVEL_ORDER[Math.max(aIndex, bIndex)] ?? "none";
+}
+function minLevel(a, b) {
+  const aIndex = PERMISSION_LEVEL_ORDER.indexOf(a);
+  const bIndex = PERMISSION_LEVEL_ORDER.indexOf(b);
+  return PERMISSION_LEVEL_ORDER[Math.min(aIndex, bIndex)] ?? "none";
+}
+function ruleMatchesContext(rule, context) {
+  if (rule.enabled === false) {
+    return false;
+  }
+  switch (rule.scope) {
+    case "org":
+      if (rule.org && context.org !== rule.org) {
+        return false;
+      }
+      break;
+    case "project":
+      if (rule.org && context.org !== rule.org) {
+        return false;
+      }
+      if (rule.project && context.project !== rule.project) {
+        return false;
+      }
+      break;
+  }
+  return true;
+}
+function ruleMatchesPath(rule, path5) {
+  return micromatch2__default.default.isMatch(path5, rule.pattern);
+}
+function ruleMatchesAction(rule, action) {
+  return rule.actions.includes(action);
+}
+function evaluatePermission(path5, action, context, config) {
+  const sortedRules = [...config.rules].sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0));
+  for (const rule of sortedRules) {
+    if (!ruleMatchesContext(rule, context)) {
+      continue;
+    }
+    if (!ruleMatchesPath(rule, path5)) {
+      continue;
+    }
+    if (!ruleMatchesAction(rule, action)) {
+      continue;
+    }
+    return {
+      allowed: rule.level !== "none",
+      level: rule.level,
+      matchedRule: rule,
+      reason: `Matched rule: ${rule.description ?? rule.pattern}`
+    };
+  }
+  return {
+    allowed: config.defaultAllow,
+    level: config.defaultLevel,
+    reason: config.defaultAllow ? "Allowed by default" : "Denied by default"
+  };
+}
+function isAllowed(path5, action, context, config) {
+  const result = evaluatePermission(path5, action, context, config);
+  return result.allowed;
+}
+function hasPermission(path5, action, requiredLevel, context, config) {
+  const result = evaluatePermission(path5, action, context, config);
+  return levelGrants(result.level, requiredLevel);
+}
+function evaluatePermissions(paths, action, context, config) {
+  const results = /* @__PURE__ */ new Map();
+  for (const path5 of paths) {
+    results.set(path5, evaluatePermission(path5, action, context, config));
+  }
+  return results;
+}
+function filterByPermission(paths, action, context, config, requiredLevel = "read") {
+  return paths.filter((path5) => {
+    const result = evaluatePermission(path5, action, context, config);
+    return levelGrants(result.level, requiredLevel);
+  });
+}
+function validateRules2(rules) {
+  const errors = [];
+  for (let i = 0; i < rules.length; i++) {
+    const rule = rules[i];
+    if (!rule) continue;
+    if (!rule.pattern || rule.pattern.trim() === "") {
+      errors.push(`Rule ${i}: pattern is empty`);
+      continue;
+    }
+    try {
+      micromatch2__default.default.isMatch("test", rule.pattern);
+    } catch {
+      errors.push(`Rule ${i}: invalid pattern "${rule.pattern}"`);
+    }
+    if (!rule.actions || rule.actions.length === 0) {
+      errors.push(`Rule ${i}: actions are empty`);
+    }
+    if (rule.scope === "org" && !rule.org) {
+      errors.push(`Rule ${i}: org scope requires org field`);
+    }
+    if (rule.scope === "project" && !rule.project) {
+      errors.push(`Rule ${i}: project scope requires project field`);
+    }
+  }
+  return errors;
+}
+function createRule(options) {
+  return {
+    pattern: options.pattern,
+    actions: options.actions,
+    level: options.level,
+    scope: options.scope ?? "global",
+    org: options.org,
+    project: options.project,
+    priority: options.priority ?? 0,
+    description: options.description,
+    enabled: true
+  };
+}
+var CommonRules = {
+  /** Allow all actions for docs */
+  allowDocs: () => createRule({
+    pattern: "docs/**",
+    actions: ["fetch", "cache", "sync"],
+    level: "read",
+    description: "Allow read access to docs"
+  }),
+  /** Deny access to private files */
+  denyPrivate: () => createRule({
+    pattern: "**/.private/**",
+    actions: ["fetch", "cache", "sync"],
+    level: "none",
+    priority: 100,
+    description: "Deny access to private files"
+  }),
+  /** Read-only access to specs */
+  readOnlySpecs: () => createRule({
+    pattern: "specs/**",
+    actions: ["fetch", "cache"],
+    level: "read",
+    description: "Read-only access to specs"
+  }),
+  /** Admin access for management */
+  adminManage: () => createRule({
+    pattern: "**",
+    actions: ["manage", "invalidate"],
+    level: "admin",
+    description: "Admin access for management operations"
+  })
+};
+
+// src/permissions/manager.ts
+var PermissionManager = class {
+  config;
+  defaultContext;
+  constructor(options = {}) {
+    this.config = {
+      ...DEFAULT_PERMISSION_CONFIG,
+      ...options.config,
+      // Create a new rules array to avoid shared state
+      rules: options.config?.rules ? [...options.config.rules] : []
+    };
+    this.defaultContext = options.defaultContext ?? {};
+  }
+  /**
+   * Check if an action is allowed for a path
+   */
+  isAllowed(path5, action, context) {
+    const result = this.evaluate(path5, action, context);
+    return result.allowed;
+  }
+  /**
+   * Check if a permission level is granted
+   */
+  hasPermission(path5, action, requiredLevel, context) {
+    const result = this.evaluate(path5, action, context);
+    return levelGrants(result.level, requiredLevel);
+  }
+  /**
+   * Evaluate permission for a path and action
+   */
+  evaluate(path5, action, context) {
+    const mergedContext = { ...this.defaultContext, ...context };
+    if (!this.config.enforced) {
+      return {
+        allowed: true,
+        level: "admin",
+        reason: "Permissions not enforced"
+      };
+    }
+    return evaluatePermission(path5, action, mergedContext, this.config);
+  }
+  /**
+   * Filter paths by permission
+   */
+  filterAllowed(paths, action, context, requiredLevel = "read") {
+    const mergedContext = { ...this.defaultContext, ...context };
+    if (!this.config.enforced) {
+      return paths;
+    }
+    return filterByPermission(paths, action, mergedContext, this.config, requiredLevel);
+  }
+  /**
+   * Add a permission rule
+   */
+  addRule(rule) {
+    const errors = validateRules2([rule]);
+    if (errors.length > 0) {
+      throw new Error(`Invalid rule: ${errors.join(", ")}`);
+    }
+    this.config.rules.push(rule);
+  }
+  /**
+   * Remove a permission rule by ID
+   */
+  removeRule(id) {
+    const index = this.config.rules.findIndex((r) => r.id === id);
+    if (index === -1) {
+      return false;
+    }
+    this.config.rules.splice(index, 1);
+    return true;
+  }
+  /**
+   * Get all rules
+   */
+  getRules() {
+    return [...this.config.rules];
+  }
+  /**
+   * Clear all rules
+   */
+  clearRules() {
+    this.config.rules = [];
+  }
+  /**
+   * Set rules (replace all)
+   */
+  setRules(rules) {
+    const errors = validateRules2(rules);
+    if (errors.length > 0) {
+      throw new Error(`Invalid rules: ${errors.join(", ")}`);
+    }
+    this.config.rules = [...rules];
+  }
+  /**
+   * Get configuration
+   */
+  getConfig() {
+    return { ...this.config, rules: [...this.config.rules] };
+  }
+  /**
+   * Update configuration
+   */
+  updateConfig(updates) {
+    this.config = {
+      ...this.config,
+      ...updates
+    };
+  }
+  /**
+   * Set default context
+   */
+  setDefaultContext(context) {
+    this.defaultContext = { ...context };
+  }
+  /**
+   * Get default context
+   */
+  getDefaultContext() {
+    return { ...this.defaultContext };
+  }
+  /**
+   * Enable permission enforcement
+   */
+  enable() {
+    this.config.enforced = true;
+  }
+  /**
+   * Disable permission enforcement
+   */
+  disable() {
+    this.config.enforced = false;
+  }
+  /**
+   * Check if permissions are enforced
+   */
+  isEnforced() {
+    return this.config.enforced;
+  }
+  /**
+   * Assert permission (throws if denied)
+   */
+  assertPermission(path5, action, requiredLevel = "read", context) {
+    const result = this.evaluate(path5, action, context);
+    if (!levelGrants(result.level, requiredLevel)) {
+      throw new PermissionDeniedError(
+        `Permission denied for ${action} on ${path5}: ${result.reason}`,
+        path5,
+        action,
+        result
+      );
+    }
+  }
+};
+var PermissionDeniedError = class extends Error {
+  constructor(message, path5, action, result) {
+    super(message);
+    this.path = path5;
+    this.action = action;
+    this.result = result;
+    this.name = "PermissionDeniedError";
+  }
+};
+function createPermissionManager(config) {
+  return new PermissionManager(config);
+}
+var defaultManager2 = null;
+function getDefaultPermissionManager() {
+  if (!defaultManager2) {
+    defaultManager2 = createPermissionManager();
+  }
+  return defaultManager2;
+}
+function setDefaultPermissionManager(manager) {
+  defaultManager2 = manager;
+}
+
+// src/migration/detector.ts
+function detectVersion(config) {
+  if (!config || typeof config !== "object") {
+    return {
+      version: "unknown",
+      confidence: "high",
+      reason: "Invalid configuration object"
+    };
+  }
+  const obj = config;
+  if (obj.version === "3.0") {
+    return {
+      version: "3.0",
+      confidence: "high",
+      reason: "Explicit version field found"
+    };
+  }
+  if (isModernConfig(config)) {
+    return {
+      version: "3.0",
+      confidence: "medium",
+      reason: "Modern structure detected (organization object, sync.patterns)"
+    };
+  }
+  if (isLegacyConfig(config)) {
+    return {
+      version: "2.x",
+      confidence: "high",
+      reason: "Legacy structure detected (org/defaultOrg/codexRepo at top level)"
+    };
+  }
+  const knownFields = [
+    "org",
+    "defaultOrg",
+    "codexRepo",
+    "autoSync",
+    "syncRules",
+    "organization",
+    "sync",
+    "cache"
+  ];
+  const hasKnownFields = knownFields.some((field) => field in obj);
+  if (hasKnownFields) {
+    return {
+      version: "2.x",
+      confidence: "low",
+      reason: "Some known fields found, assuming v2.x"
+    };
+  }
+  return {
+    version: "unknown",
+    confidence: "high",
+    reason: "No recognizable configuration structure"
+  };
+}
+function isModernConfig(config) {
+  if (!config || typeof config !== "object") {
+    return false;
+  }
+  const obj = config;
+  if (!obj.organization || typeof obj.organization !== "object") {
+    return false;
+  }
+  const org = obj.organization;
+  if (typeof org.name !== "string" || typeof org.codexRepo !== "string") {
+    return false;
+  }
+  if (!obj.sync || typeof obj.sync !== "object") {
+    return false;
+  }
+  const sync = obj.sync;
+  if (!Array.isArray(sync.patterns)) {
+    return false;
+  }
+  return true;
+}
+function isLegacyConfig(config) {
+  if (!config || typeof config !== "object") {
+    return false;
+  }
+  const obj = config;
+  const legacyMarkers = ["org", "defaultOrg", "codexRepo", "codexPath"];
+  const hasLegacyMarker = legacyMarkers.some(
+    (marker) => marker in obj && typeof obj[marker] === "string"
+  );
+  if (hasLegacyMarker) {
+    return true;
+  }
+  if (Array.isArray(obj.autoSync)) {
+    return true;
+  }
+  if (obj.syncRules && typeof obj.syncRules === "object") {
+    const syncRules = obj.syncRules;
+    if (Array.isArray(syncRules.include) || Array.isArray(syncRules.exclude)) {
+      return true;
+    }
+  }
+  return false;
+}
+function needsMigration(config) {
+  const detection = detectVersion(config);
+  return detection.version === "2.x";
+}
+function getMigrationRequirements(config) {
+  const requirements = [];
+  if (!config || typeof config !== "object") {
+    requirements.push("Valid configuration object required");
+    return requirements;
+  }
+  const obj = config;
+  if (!obj.org && !obj.defaultOrg) {
+    requirements.push("Organization name is required (org or defaultOrg)");
+  }
+  if (!obj.codexRepo && !obj.codexPath) {
+    requirements.push("Codex repository name is required (codexRepo or codexPath)");
+  }
+  return requirements;
+}
+
+// src/migration/migrator.ts
+var DEFAULT_MIGRATION_OPTIONS = {
+  preserveUnknown: false,
+  strict: false,
+  defaultOrg: "organization",
+  defaultCodexRepo: "codex"
+};
+function migrateConfig(config, options = {}) {
+  const mergedOptions = { ...DEFAULT_MIGRATION_OPTIONS, ...options };
+  const result = {
+    success: false,
+    warnings: [],
+    errors: [],
+    changes: []
+  };
+  const detection = detectVersion(config);
+  if (detection.version === "3.0") {
+    if (isModernConfig(config)) {
+      result.success = true;
+      result.config = config;
+      result.warnings.push("Configuration is already v3.0, no migration needed");
+      return result;
+    }
+  }
+  if (detection.version === "unknown") {
+    result.errors.push(`Cannot migrate: ${detection.reason}`);
+    return result;
+  }
+  if (!isLegacyConfig(config)) {
+    result.errors.push("Configuration does not match expected v2.x format");
+    return result;
+  }
+  try {
+    const migrated = performMigration(config, mergedOptions, result);
+    result.config = migrated;
+    result.success = true;
+  } catch (error) {
+    result.errors.push(
+      `Migration failed: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  return result;
+}
+function performMigration(legacy, options, result) {
+  const orgName = legacy.org || legacy.defaultOrg || options.defaultOrg;
+  if (legacy.org && legacy.defaultOrg && legacy.org !== legacy.defaultOrg) {
+    result.warnings.push(
+      `Both 'org' and 'defaultOrg' specified with different values. Using 'org': ${legacy.org}`
+    );
+  }
+  if (!legacy.org && !legacy.defaultOrg) {
+    result.changes.push({
+      type: "added",
+      path: "organization.name",
+      newValue: orgName,
+      description: `Added default organization name: ${orgName}`
+    });
+  } else {
+    const fieldUsed = legacy.org ? "org" : "defaultOrg";
+    result.changes.push({
+      type: "renamed",
+      path: "organization.name",
+      oldValue: fieldUsed,
+      newValue: "organization.name",
+      description: `Renamed '${fieldUsed}' to 'organization.name'`
+    });
+  }
+  const codexRepo = legacy.codexRepo || legacy.codexPath || options.defaultCodexRepo;
+  if (legacy.codexRepo && legacy.codexPath && legacy.codexRepo !== legacy.codexPath) {
+    result.warnings.push(
+      `Both 'codexRepo' and 'codexPath' specified with different values. Using 'codexRepo': ${legacy.codexRepo}`
+    );
+  }
+  if (!legacy.codexRepo && !legacy.codexPath) {
+    result.changes.push({
+      type: "added",
+      path: "organization.codexRepo",
+      newValue: codexRepo,
+      description: `Added default codex repository: ${codexRepo}`
+    });
+  } else {
+    const fieldUsed = legacy.codexRepo ? "codexRepo" : "codexPath";
+    result.changes.push({
+      type: "renamed",
+      path: "organization.codexRepo",
+      oldValue: fieldUsed,
+      newValue: "organization.codexRepo",
+      description: `Renamed '${fieldUsed}' to 'organization.codexRepo'`
+    });
+  }
+  const patterns = [];
+  if (legacy.autoSync && legacy.autoSync.length > 0) {
+    for (const legacyPattern of legacy.autoSync) {
+      const modernPattern = migrateSyncPattern(legacyPattern, result);
+      patterns.push(modernPattern);
+    }
+    result.changes.push({
+      type: "transformed",
+      path: "sync.patterns",
+      oldValue: "autoSync",
+      newValue: "sync.patterns",
+      description: `Converted ${legacy.autoSync.length} auto-sync pattern(s) to modern format`
+    });
+  }
+  const include = [];
+  const exclude = [];
+  if (legacy.syncRules) {
+    if (legacy.syncRules.include) {
+      include.push(...legacy.syncRules.include);
+      result.changes.push({
+        type: "renamed",
+        path: "sync.include",
+        oldValue: "syncRules.include",
+        newValue: "sync.include",
+        description: "Moved syncRules.include to sync.include"
+      });
+    }
+    if (legacy.syncRules.exclude) {
+      exclude.push(...legacy.syncRules.exclude);
+      result.changes.push({
+        type: "renamed",
+        path: "sync.exclude",
+        oldValue: "syncRules.exclude",
+        newValue: "sync.exclude",
+        description: "Moved syncRules.exclude to sync.exclude"
+      });
+    }
+  }
+  const modern = {
+    version: "3.0",
+    organization: {
+      name: orgName,
+      codexRepo
+    },
+    sync: {
+      patterns,
+      include,
+      exclude,
+      defaultDirection: "to-codex"
+    }
+  };
+  if (legacy.environments) {
+    modern.environments = {};
+    for (const [envName, envConfig] of Object.entries(legacy.environments)) {
+      const envResult = {
+        success: false,
+        warnings: [],
+        errors: [],
+        changes: []
+      };
+      try {
+        const migratedEnv = performMigration(
+          { ...legacy, ...envConfig },
+          { ...options },
+          envResult
+        );
+        modern.environments[envName] = {
+          organization: migratedEnv.organization,
+          sync: migratedEnv.sync
+        };
+        result.changes.push({
+          type: "transformed",
+          path: `environments.${envName}`,
+          description: `Migrated environment '${envName}'`
+        });
+        result.warnings.push(...envResult.warnings.map((w) => `[${envName}] ${w}`));
+      } catch {
+        result.warnings.push(`Failed to migrate environment '${envName}', skipping`);
+      }
+    }
+  }
+  result.changes.push({
+    type: "added",
+    path: "version",
+    newValue: "3.0",
+    description: "Added version field"
+  });
+  return modern;
+}
+function migrateSyncPattern(legacy, result) {
+  const modern = {
+    pattern: legacy.pattern
+  };
+  if (legacy.destination) {
+    modern.target = legacy.destination;
+  }
+  if (legacy.bidirectional) {
+    modern.direction = "bidirectional";
+  }
+  if (legacy.targets && legacy.targets.length > 0) {
+    result.warnings.push(
+      `Pattern '${legacy.pattern}' had multiple targets (${legacy.targets.join(", ")}). In v3.0, each target should be a separate pattern.`
+    );
+    if (!modern.target && legacy.targets[0]) {
+      modern.target = legacy.targets[0];
+    }
+  }
+  return modern;
+}
+function validateMigratedConfig(config) {
+  const errors = [];
+  if (config.version !== "3.0") {
+    errors.push(`Invalid version: ${config.version}, expected '3.0'`);
+  }
+  if (!config.organization) {
+    errors.push("Missing organization configuration");
+  } else {
+    if (!config.organization.name) {
+      errors.push("Missing organization.name");
+    }
+    if (!config.organization.codexRepo) {
+      errors.push("Missing organization.codexRepo");
+    }
+  }
+  if (!config.sync) {
+    errors.push("Missing sync configuration");
+  } else {
+    if (!Array.isArray(config.sync.patterns)) {
+      errors.push("sync.patterns must be an array");
+    }
+    if (!Array.isArray(config.sync.include)) {
+      errors.push("sync.include must be an array");
+    }
+    if (!Array.isArray(config.sync.exclude)) {
+      errors.push("sync.exclude must be an array");
+    }
+  }
+  return errors;
+}
+function generateMigrationReport(result) {
+  const lines = ["# Migration Report", ""];
+  if (result.success) {
+    lines.push("Status: SUCCESS");
+  } else {
+    lines.push("Status: FAILED");
+  }
+  lines.push("");
+  if (result.changes.length > 0) {
+    lines.push("## Changes", "");
+    for (const change of result.changes) {
+      lines.push(`- [${change.type.toUpperCase()}] ${change.path}: ${change.description}`);
+    }
+    lines.push("");
+  }
+  if (result.warnings.length > 0) {
+    lines.push("## Warnings", "");
+    for (const warning of result.warnings) {
+      lines.push(`- ${warning}`);
+    }
+    lines.push("");
+  }
+  if (result.errors.length > 0) {
+    lines.push("## Errors", "");
+    for (const error of result.errors) {
+      lines.push(`- ${error}`);
+    }
+    lines.push("");
+  }
+  return lines.join("\n");
+}
+function createEmptyModernConfig(org, codexRepo) {
+  return {
+    version: "3.0",
+    organization: {
+      name: org,
+      codexRepo
+    },
+    sync: {
+      patterns: [],
+      include: ["**/*.md", "CLAUDE.md"],
+      exclude: ["**/node_modules/**", "**/.git/**"],
+      defaultDirection: "to-codex"
+    }
+  };
+}
+
+// src/migration/references.ts
+var LEGACY_PATTERNS = {
+  /** @codex: style references */
+  CODEX_TAG: /@codex:\s*([^\s\]]+)/g,
+  /** [codex:...] style references */
+  CODEX_BRACKET: /\[codex:\s*([^\]]+)\]/g,
+  /** {{codex:...}} style references */
+  CODEX_MUSTACHE: /\{\{codex:\s*([^}]+)\}\}/g,
+  /** Simple path references in specific contexts */
+  SIMPLE_PATH: /codex\/([a-zA-Z0-9_-]+\/[a-zA-Z0-9_\-/.]+)/g
+};
+function convertLegacyReferences(text, options = {}) {
+  const result = {
+    original: text,
+    converted: text,
+    references: [],
+    modified: false
+  };
+  result.converted = processPattern(
+    result.converted,
+    LEGACY_PATTERNS.CODEX_TAG,
+    "codex-tag",
+    options,
+    result.references
+  );
+  result.converted = processPattern(
+    result.converted,
+    LEGACY_PATTERNS.CODEX_BRACKET,
+    "codex-bracket",
+    options,
+    result.references
+  );
+  result.converted = processPattern(
+    result.converted,
+    LEGACY_PATTERNS.CODEX_MUSTACHE,
+    "codex-mustache",
+    options,
+    result.references
+  );
+  result.converted = processPattern(
+    result.converted,
+    LEGACY_PATTERNS.SIMPLE_PATH,
+    "simple-path",
+    options,
+    result.references
+  );
+  result.modified = result.original !== result.converted;
+  return result;
+}
+function processPattern(text, pattern, format, options, references) {
+  pattern.lastIndex = 0;
+  return text.replace(pattern, (match, captured, offset) => {
+    const uri = convertToUri(captured.trim(), options);
+    references.push({
+      original: match,
+      uri,
+      position: offset,
+      format
+    });
+    if (options.preserveWrapper) {
+      switch (format) {
+        case "codex-tag":
+          return `@codex: ${uri}`;
+        case "codex-bracket":
+          return `[${uri}]`;
+        case "codex-mustache":
+          return `{{${uri}}}`;
+        case "simple-path":
+          return uri;
+      }
+    }
+    return uri;
+  });
+}
+function convertToUri(reference, options = {}) {
+  const trimmed = reference.trim();
+  if (trimmed.startsWith("codex://")) {
+    return trimmed;
+  }
+  const parts = parseReference2(trimmed);
+  const org = parts.org || options.defaultOrg || "_";
+  const project = parts.project || options.defaultProject || "_";
+  const path5 = parts.path;
+  return `codex://${org}/${project}/${path5}`;
+}
+function parseReference2(reference) {
+  const trimmed = reference.trim();
+  if (trimmed.startsWith("./") || trimmed.startsWith("../")) {
+    return { path: trimmed };
+  }
+  const parts = trimmed.split("/");
+  if (parts.length >= 3) {
+    const [org, project, ...rest] = parts;
+    return {
+      org: org || void 0,
+      project: project || void 0,
+      path: rest.join("/")
+    };
+  }
+  if (parts.length === 2) {
+    return { path: trimmed };
+  }
+  return { path: trimmed };
+}
+function findLegacyReferences(text) {
+  const references = [];
+  for (const [name, pattern] of Object.entries(LEGACY_PATTERNS)) {
+    pattern.lastIndex = 0;
+    let match;
+    while ((match = pattern.exec(text)) !== null) {
+      const format = name.toLowerCase().replace("_", "-");
+      references.push({
+        original: match[0],
+        uri: match[1] || "",
+        position: match.index,
+        format
+      });
+    }
+  }
+  references.sort((a, b) => a.position - b.position);
+  return references;
+}
+function hasLegacyReferences(text) {
+  for (const pattern of Object.values(LEGACY_PATTERNS)) {
+    pattern.lastIndex = 0;
+    if (pattern.test(text)) {
+      return true;
+    }
+  }
+  return false;
+}
+function migrateFileReferences(content, options = {}) {
+  return convertLegacyReferences(content, options);
+}
+function generateReferenceMigrationSummary(results) {
+  const lines = ["# Reference Migration Summary", ""];
+  let totalRefs = 0;
+  let modifiedFiles = 0;
+  for (const result of results) {
+    if (result.modified) {
+      modifiedFiles++;
+    }
+    totalRefs += result.references.length;
+  }
+  lines.push(`- Total files processed: ${results.length}`);
+  lines.push(`- Files with changes: ${modifiedFiles}`);
+  lines.push(`- Total references converted: ${totalRefs}`);
+  lines.push("");
+  const byFormat = /* @__PURE__ */ new Map();
+  for (const result of results) {
+    for (const ref of result.references) {
+      byFormat.set(ref.format, (byFormat.get(ref.format) || 0) + 1);
+    }
+  }
+  if (byFormat.size > 0) {
+    lines.push("## References by Format", "");
+    for (const [format, count] of byFormat.entries()) {
+      lines.push(`- ${format}: ${count}`);
+    }
+  }
+  return lines.join("\n");
+}
+
 exports.AutoSyncPatternSchema = AutoSyncPatternSchema;
+exports.BUILT_IN_TYPES = BUILT_IN_TYPES;
+exports.CODEX_TOOLS = CODEX_TOOLS;
+exports.CODEX_URI_PREFIX = CODEX_URI_PREFIX;
+exports.CacheManager = CacheManager;
+exports.CachePersistence = CachePersistence;
 exports.CodexConfigSchema = CodexConfigSchema;
 exports.CodexError = CodexError;
+exports.CommonRules = CommonRules;
 exports.ConfigurationError = ConfigurationError;
+exports.CustomTypeSchema = CustomTypeSchema;
+exports.DEFAULT_CACHE_DIR = DEFAULT_CACHE_DIR;
+exports.DEFAULT_FETCH_OPTIONS = DEFAULT_FETCH_OPTIONS;
+exports.DEFAULT_MIGRATION_OPTIONS = DEFAULT_MIGRATION_OPTIONS;
+exports.DEFAULT_PERMISSION_CONFIG = DEFAULT_PERMISSION_CONFIG;
+exports.DEFAULT_SYNC_CONFIG = DEFAULT_SYNC_CONFIG;
+exports.DEFAULT_TYPE = DEFAULT_TYPE;
+exports.GitHubStorage = GitHubStorage;
+exports.HttpStorage = HttpStorage;
+exports.LEGACY_PATTERNS = LEGACY_PATTERNS;
+exports.LEGACY_REF_PREFIX = LEGACY_REF_PREFIX;
+exports.LocalStorage = LocalStorage;
+exports.McpServer = McpServer;
 exports.MetadataSchema = MetadataSchema;
+exports.PERMISSION_LEVEL_ORDER = PERMISSION_LEVEL_ORDER;
+exports.PermissionDeniedError = PermissionDeniedError;
+exports.PermissionManager = PermissionManager;
+exports.StorageManager = StorageManager;
+exports.SyncManager = SyncManager;
 exports.SyncRulesSchema = SyncRulesSchema;
+exports.TTL = TTL;
+exports.TypeRegistry = TypeRegistry;
+exports.TypesConfigSchema = TypesConfigSchema;
 exports.ValidationError = ValidationError;
+exports.buildUri = buildUri;
+exports.calculateCachePath = calculateCachePath;
+exports.calculateContentHash = calculateContentHash;
+exports.convertLegacyReference = convertLegacyReference;
+exports.convertLegacyReferences = convertLegacyReferences;
+exports.convertToUri = convertToUri;
+exports.createCacheEntry = createCacheEntry;
+exports.createCacheManager = createCacheManager;
+exports.createCachePersistence = createCachePersistence;
+exports.createDefaultRegistry = createDefaultRegistry;
+exports.createEmptyModernConfig = createEmptyModernConfig;
+exports.createEmptySyncPlan = createEmptySyncPlan;
+exports.createGitHubStorage = createGitHubStorage;
+exports.createHttpStorage = createHttpStorage;
+exports.createLocalStorage = createLocalStorage;
+exports.createMcpServer = createMcpServer;
+exports.createPermissionManager = createPermissionManager;
+exports.createRule = createRule;
+exports.createRulesFromPatterns = createRulesFromPatterns;
+exports.createStorageManager = createStorageManager;
+exports.createSyncManager = createSyncManager;
+exports.createSyncPlan = createSyncPlan;
+exports.deserializeCacheEntry = deserializeCacheEntry;
+exports.detectContentType = detectContentType;
+exports.detectCurrentProject = detectCurrentProject;
+exports.detectVersion = detectVersion;
+exports.estimateSyncTime = estimateSyncTime;
+exports.evaluatePath = evaluatePath;
+exports.evaluatePaths = evaluatePaths;
 exports.evaluatePatterns = evaluatePatterns;
+exports.evaluatePermission = evaluatePermission;
+exports.evaluatePermissions = evaluatePermissions;
+exports.extendType = extendType;
 exports.extractOrgFromRepoName = extractOrgFromRepoName;
 exports.extractRawFrontmatter = extractRawFrontmatter;
 exports.filterByPatterns = filterByPatterns;
+exports.filterByPermission = filterByPermission;
+exports.filterPlanOperations = filterPlanOperations;
+exports.filterSyncablePaths = filterSyncablePaths;
+exports.findLegacyReferences = findLegacyReferences;
+exports.formatPlanSummary = formatPlanSummary;
+exports.generateMigrationReport = generateMigrationReport;
+exports.generateReferenceMigrationSummary = generateReferenceMigrationSummary;
+exports.getBuiltInType = getBuiltInType;
+exports.getBuiltInTypeNames = getBuiltInTypeNames;
+exports.getCacheEntryAge = getCacheEntryAge;
+exports.getCacheEntryStatus = getCacheEntryStatus;
+exports.getCurrentContext = getCurrentContext;
+exports.getCustomSyncDestinations = getCustomSyncDestinations;
+exports.getDefaultCacheManager = getDefaultCacheManager;
 exports.getDefaultConfig = getDefaultConfig;
 exports.getDefaultDirectories = getDefaultDirectories;
+exports.getDefaultPermissionManager = getDefaultPermissionManager;
 exports.getDefaultRules = getDefaultRules;
+exports.getDefaultStorageManager = getDefaultStorageManager;
+exports.getDirectory = getDirectory;
+exports.getExtension = getExtension;
+exports.getFilename = getFilename;
+exports.getMigrationRequirements = getMigrationRequirements;
+exports.getPlanStats = getPlanStats;
+exports.getRelativeCachePath = getRelativeCachePath;
+exports.getRemainingTtl = getRemainingTtl;
 exports.getTargetRepos = getTargetRepos;
+exports.handleFetch = handleFetch;
+exports.handleInvalidate = handleInvalidate;
+exports.handleList = handleList;
+exports.handleSearch = handleSearch;
+exports.handleToolCall = handleToolCall;
+exports.hasContentChanged = hasContentChanged;
 exports.hasFrontmatter = hasFrontmatter;
+exports.hasLegacyReferences = hasLegacyReferences;
+exports.hasPermissionLevel = hasPermission;
+exports.isBuiltInType = isBuiltInType;
+exports.isCacheEntryFresh = isCacheEntryFresh;
+exports.isCacheEntryValid = isCacheEntryValid;
+exports.isCurrentProjectUri = isCurrentProjectUri;
+exports.isLegacyConfig = isLegacyConfig;
+exports.isLegacyReference = isLegacyReference;
+exports.isModernConfig = isModernConfig;
+exports.isPermissionAllowed = isAllowed;
+exports.isValidUri = isValidUri;
+exports.levelGrants = levelGrants;
 exports.loadConfig = loadConfig;
+exports.loadCustomTypes = loadCustomTypes;
 exports.matchAnyPattern = matchAnyPattern;
 exports.matchPattern = matchPattern;
+exports.maxLevel = maxLevel;
+exports.mergeFetchOptions = mergeFetchOptions;
+exports.mergeRules = mergeRules;
+exports.mergeTypes = mergeTypes;
+exports.migrateConfig = migrateConfig;
+exports.migrateFileReferences = migrateFileReferences;
+exports.minLevel = minLevel;
+exports.needsMigration = needsMigration;
+exports.parseCustomDestination = parseCustomDestination;
 exports.parseMetadata = parseMetadata;
+exports.parseReference = parseReference;
+exports.parseTtl = parseTtl;
 exports.resolveOrganization = resolveOrganization;
+exports.resolveReference = resolveReference;
+exports.resolveReferences = resolveReferences;
+exports.ruleMatchesAction = ruleMatchesAction;
+exports.ruleMatchesContext = ruleMatchesContext;
+exports.ruleMatchesPath = ruleMatchesPath;
+exports.sanitizePath = sanitizePath;
+exports.serializeCacheEntry = serializeCacheEntry;
+exports.setDefaultCacheManager = setDefaultCacheManager;
+exports.setDefaultPermissionManager = setDefaultPermissionManager;
+exports.setDefaultStorageManager = setDefaultStorageManager;
 exports.shouldSyncToRepo = shouldSyncToRepo;
+exports.summarizeEvaluations = summarizeEvaluations;
+exports.touchCacheEntry = touchCacheEntry;
+exports.validateCustomTypes = validateCustomTypes;
 exports.validateMetadata = validateMetadata;
+exports.validateMigratedConfig = validateMigratedConfig;
+exports.validateOrg = validateOrg;
+exports.validatePath = validatePath;
+exports.validatePermissionRules = validateRules2;
+exports.validateProject = validateProject;
+exports.validateRules = validateRules;
+exports.validateUri = validateUri;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map