@fractary/codex 0.1.0 → 0.1.2

package/dist/index.js

@@ -1,6 +1,9 @@
+import path3 from 'path';
+import { execSync } from 'child_process';
+import micromatch2, { isMatch } from 'micromatch';
 import { z } from 'zod';
 import yaml from 'js-yaml';
-import { isMatch } from 'micromatch';
+import fs2 from 'fs/promises';
 
 // src/errors/CodexError.ts
 var CodexError = class _CodexError extends Error {
@@ -28,6 +31,664 @@ var ValidationError = class _ValidationError extends CodexError {
     Object.setPrototypeOf(this, _ValidationError.prototype);
   }
 };
+var FORBIDDEN_PATTERNS = [
+  /^\//,
+  // Absolute paths
+  /\.\./,
+  // Parent directory traversal
+  /^~/,
+  // Home directory expansion
+  /\0/
+  // Null bytes
+];
+var FORBIDDEN_PROTOCOLS = ["file:", "http:", "https:", "ftp:", "data:", "javascript:"];
+function validatePath(filePath) {
+  if (!filePath || filePath.trim() === "") {
+    return false;
+  }
+  for (const pattern of FORBIDDEN_PATTERNS) {
+    if (pattern.test(filePath)) {
+      return false;
+    }
+  }
+  const lowerPath = filePath.toLowerCase();
+  for (const protocol of FORBIDDEN_PROTOCOLS) {
+    if (lowerPath.startsWith(protocol)) {
+      return false;
+    }
+  }
+  const normalized = path3.normalize(filePath);
+  if (normalized.startsWith("..") || normalized.includes("/../") || normalized.includes("\\..\\")) {
+    return false;
+  }
+  return true;
+}
+function sanitizePath(filePath) {
+  if (!filePath) {
+    return "";
+  }
+  let sanitized = filePath;
+  for (const protocol of FORBIDDEN_PROTOCOLS) {
+    if (sanitized.toLowerCase().startsWith(protocol)) {
+      sanitized = sanitized.slice(protocol.length);
+    }
+  }
+  sanitized = sanitized.replace(/^\/+/, "");
+  sanitized = sanitized.replace(/^~\//, "");
+  sanitized = path3.normalize(sanitized);
+  sanitized = sanitized.replace(/\.\.\//g, "").replace(/\.\./g, "");
+  sanitized = sanitized.replace(/^\.\//, "");
+  sanitized = sanitized.replace(/\0/g, "");
+  return sanitized;
+}
+function validateOrg(org) {
+  if (!org || org.trim() === "") {
+    return false;
+  }
+  const orgPattern = /^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?$/;
+  return orgPattern.test(org) && org.length <= 39;
+}
+function validateProject(project) {
+  if (!project || project.trim() === "") {
+    return false;
+  }
+  const projectPattern = /^[a-zA-Z0-9._-]+$/;
+  return projectPattern.test(project) && project.length <= 100 && !project.includes("..");
+}
+function validateUri(uri) {
+  if (!uri || !uri.startsWith("codex://")) {
+    return false;
+  }
+  const pathPart = uri.slice("codex://".length);
+  const parts = pathPart.split("/");
+  if (parts.length < 2) {
+    return false;
+  }
+  const [org, project, ...rest] = parts;
+  if (!org || !validateOrg(org)) {
+    return false;
+  }
+  if (!project || !validateProject(project)) {
+    return false;
+  }
+  if (rest.length > 0) {
+    const filePath = rest.join("/");
+    if (!validatePath(filePath)) {
+      return false;
+    }
+  }
+  return true;
+}
+
+// src/references/parser.ts
+var CODEX_URI_PREFIX = "codex://";
+var LEGACY_REF_PREFIX = "@codex/";
+function isValidUri(uri) {
+  return validateUri(uri);
+}
+function isLegacyReference(ref) {
+  return ref.startsWith(LEGACY_REF_PREFIX);
+}
+function convertLegacyReference(ref, defaultOrg) {
+  if (!isLegacyReference(ref)) {
+    return null;
+  }
+  const pathPart = ref.slice(LEGACY_REF_PREFIX.length);
+  const parts = pathPart.split("/");
+  if (parts.length < 1 || !parts[0]) {
+    return null;
+  }
+  const project = parts[0];
+  const filePath = parts.slice(1).join("/");
+  if (filePath) {
+    return `${CODEX_URI_PREFIX}${defaultOrg}/${project}/${filePath}`;
+  }
+  return `${CODEX_URI_PREFIX}${defaultOrg}/${project}`;
+}
+function parseReference(uri, options = {}) {
+  const { sanitize = true, strict = true } = options;
+  if (!uri.startsWith(CODEX_URI_PREFIX)) {
+    return null;
+  }
+  if (strict && !validateUri(uri)) {
+    return null;
+  }
+  const pathPart = uri.slice(CODEX_URI_PREFIX.length);
+  const parts = pathPart.split("/");
+  if (parts.length < 2) {
+    return null;
+  }
+  const org = parts[0];
+  const project = parts[1];
+  let filePath = parts.slice(2).join("/");
+  if (!org || !project) {
+    return null;
+  }
+  if (sanitize && filePath) {
+    if (!validatePath(filePath)) {
+      filePath = sanitizePath(filePath);
+    }
+  }
+  return {
+    uri,
+    org,
+    project,
+    path: filePath
+  };
+}
+function buildUri(org, project, path5) {
+  const base = `${CODEX_URI_PREFIX}${org}/${project}`;
+  if (path5) {
+    const cleanPath = path5.startsWith("/") ? path5.slice(1) : path5;
+    return `${base}/${cleanPath}`;
+  }
+  return base;
+}
+function getExtension(uri) {
+  const parsed = parseReference(uri, { strict: false });
+  if (!parsed || !parsed.path) {
+    return "";
+  }
+  const lastDot = parsed.path.lastIndexOf(".");
+  if (lastDot === -1 || lastDot === parsed.path.length - 1) {
+    return "";
+  }
+  return parsed.path.slice(lastDot + 1).toLowerCase();
+}
+function getFilename(uri) {
+  const parsed = parseReference(uri, { strict: false });
+  if (!parsed || !parsed.path) {
+    return "";
+  }
+  const lastSlash = parsed.path.lastIndexOf("/");
+  if (lastSlash === -1) {
+    return parsed.path;
+  }
+  return parsed.path.slice(lastSlash + 1);
+}
+function getDirectory(uri) {
+  const parsed = parseReference(uri, { strict: false });
+  if (!parsed || !parsed.path) {
+    return "";
+  }
+  const lastSlash = parsed.path.lastIndexOf("/");
+  if (lastSlash === -1) {
+    return "";
+  }
+  return parsed.path.slice(0, lastSlash);
+}
+var DEFAULT_CACHE_DIR = ".fractary/plugins/codex/cache";
+function detectCurrentProject(cwd) {
+  try {
+    const options = cwd ? { cwd, encoding: "utf-8" } : { encoding: "utf-8" };
+    const stdout = execSync("git remote get-url origin", options);
+    const url = stdout.toString().trim();
+    const patterns = [
+      /github\.com[:/]([^/]+)\/([^/]+?)(?:\.git)?$/,
+      /gitlab\.com[:/]([^/]+)\/([^/]+?)(?:\.git)?$/,
+      /bitbucket\.org[:/]([^/]+)\/([^/]+?)(?:\.git)?$/
+    ];
+    for (const pattern of patterns) {
+      const match = url.match(pattern);
+      if (match && match[1] && match[2]) {
+        return { org: match[1], project: match[2] };
+      }
+    }
+  } catch {
+  }
+  return { org: null, project: null };
+}
+function getCurrentContext(options = {}) {
+  if (options.currentOrg && options.currentProject) {
+    return { org: options.currentOrg, project: options.currentProject };
+  }
+  const envOrg = process.env.CODEX_CURRENT_ORG;
+  const envProject = process.env.CODEX_CURRENT_PROJECT;
+  if (envOrg && envProject) {
+    return { org: envOrg, project: envProject };
+  }
+  return detectCurrentProject(options.cwd);
+}
+function calculateCachePath(org, project, filePath, cacheDir) {
+  return path3.join(cacheDir, org, project, filePath);
+}
+function resolveReference(uri, options = {}) {
+  const parsed = parseReference(uri);
+  if (!parsed) {
+    return null;
+  }
+  const cacheDir = options.cacheDir || DEFAULT_CACHE_DIR;
+  const currentContext = getCurrentContext(options);
+  const cachePath = parsed.path ? calculateCachePath(parsed.org, parsed.project, parsed.path, cacheDir) : path3.join(cacheDir, parsed.org, parsed.project);
+  const isCurrentProject = currentContext.org === parsed.org && currentContext.project === parsed.project;
+  const resolved = {
+    ...parsed,
+    cachePath,
+    isCurrentProject
+  };
+  if (isCurrentProject && parsed.path) {
+    resolved.localPath = parsed.path;
+  }
+  return resolved;
+}
+function resolveReferences(uris, options = {}) {
+  return uris.map((uri) => resolveReference(uri, options)).filter((r) => r !== null);
+}
+function isCurrentProjectUri(uri, options = {}) {
+  const resolved = resolveReference(uri, options);
+  return resolved?.isCurrentProject ?? false;
+}
+function getRelativeCachePath(uri) {
+  const parsed = parseReference(uri);
+  if (!parsed) {
+    return null;
+  }
+  if (parsed.path) {
+    return path3.join(parsed.org, parsed.project, parsed.path);
+  }
+  return path3.join(parsed.org, parsed.project);
+}
+
+// src/types/built-in.ts
+var TTL = {
+  ONE_HOUR: 3600,
+  ONE_DAY: 86400,
+  ONE_WEEK: 604800,
+  TWO_WEEKS: 1209600,
+  ONE_MONTH: 2592e3,
+  ONE_YEAR: 31536e3
+};
+var BUILT_IN_TYPES = {
+  docs: {
+    name: "docs",
+    description: "Documentation files",
+    patterns: ["docs/**", "README.md", "CLAUDE.md", "*.md"],
+    defaultTtl: TTL.ONE_WEEK,
+    archiveAfterDays: 365,
+    archiveStorage: "cloud"
+  },
+  specs: {
+    name: "specs",
+    description: "Technical specifications",
+    patterns: ["specs/**", "SPEC-*.md", "**/specs/**"],
+    defaultTtl: TTL.TWO_WEEKS,
+    archiveAfterDays: null,
+    // Never auto-archive specs
+    archiveStorage: null
+  },
+  logs: {
+    name: "logs",
+    description: "Session and workflow logs",
+    patterns: [".fractary/**/logs/**", "logs/**", "*.log"],
+    defaultTtl: TTL.ONE_DAY,
+    archiveAfterDays: 30,
+    archiveStorage: "cloud"
+  },
+  standards: {
+    name: "standards",
+    description: "Organization standards and guides",
+    patterns: ["standards/**", "guides/**", ".fractary/standards/**"],
+    defaultTtl: TTL.ONE_MONTH,
+    archiveAfterDays: null,
+    // Never auto-archive standards
+    archiveStorage: null
+  },
+  templates: {
+    name: "templates",
+    description: "Reusable templates",
+    patterns: ["templates/**", ".templates/**", ".fractary/templates/**"],
+    defaultTtl: TTL.TWO_WEEKS,
+    archiveAfterDays: 180,
+    archiveStorage: "cloud"
+  },
+  state: {
+    name: "state",
+    description: "Workflow state files",
+    patterns: [".fractary/**/state.json", ".fractary/**/state/**", "**/state.json"],
+    defaultTtl: TTL.ONE_HOUR,
+    archiveAfterDays: 7,
+    archiveStorage: "local"
+  },
+  config: {
+    name: "config",
+    description: "Configuration files",
+    patterns: [
+      ".fractary/**/*.json",
+      "*.config.js",
+      "*.config.ts",
+      "tsconfig.json",
+      "package.json"
+    ],
+    defaultTtl: TTL.ONE_DAY,
+    archiveAfterDays: null,
+    archiveStorage: null
+  },
+  systems: {
+    name: "systems",
+    description: "System definitions",
+    patterns: [".fractary/systems/**", "systems/**"],
+    defaultTtl: TTL.TWO_WEEKS,
+    archiveAfterDays: null,
+    archiveStorage: null
+  }
+};
+var DEFAULT_TYPE = {
+  name: "default",
+  description: "Default type for unmatched files",
+  patterns: ["**/*"],
+  defaultTtl: TTL.ONE_WEEK,
+  archiveAfterDays: 90,
+  archiveStorage: "cloud"
+};
+function getBuiltInType(name) {
+  return BUILT_IN_TYPES[name];
+}
+function getBuiltInTypeNames() {
+  return Object.keys(BUILT_IN_TYPES);
+}
+function isBuiltInType(name) {
+  return name in BUILT_IN_TYPES;
+}
+var TypeRegistry = class {
+  types = /* @__PURE__ */ new Map();
+  patternCache = /* @__PURE__ */ new Map();
+  constructor(options = {}) {
+    const { includeBuiltIn = true, customTypes = {} } = options;
+    if (includeBuiltIn) {
+      for (const [name, type] of Object.entries(BUILT_IN_TYPES)) {
+        this.types.set(name, type);
+      }
+    }
+    for (const [name, partialType] of Object.entries(customTypes)) {
+      this.register({
+        ...DEFAULT_TYPE,
+        ...partialType,
+        name
+      });
+    }
+  }
+  /**
+   * Get a type by name
+   *
+   * Custom types take precedence over built-in types with the same name.
+   *
+   * @param name - Type name
+   * @returns The type or undefined
+   */
+  get(name) {
+    return this.types.get(name);
+  }
+  /**
+   * Register a custom type
+   *
+   * @param type - The type to register
+   */
+  register(type) {
+    this.types.set(type.name, type);
+    this.patternCache.clear();
+  }
+  /**
+   * Unregister a type
+   *
+   * Note: Built-in types can be unregistered but this is not recommended.
+   *
+   * @param name - Type name to unregister
+   * @returns true if the type was removed
+   */
+  unregister(name) {
+    const result = this.types.delete(name);
+    if (result) {
+      this.patternCache.clear();
+    }
+    return result;
+  }
+  /**
+   * Check if a type exists
+   *
+   * @param name - Type name
+   * @returns true if the type exists
+   */
+  has(name) {
+    return this.types.has(name);
+  }
+  /**
+   * List all registered types
+   *
+   * @returns Array of all types
+   */
+  list() {
+    return Array.from(this.types.values());
+  }
+  /**
+   * List all type names
+   *
+   * @returns Array of type names
+   */
+  listNames() {
+    return Array.from(this.types.keys());
+  }
+  /**
+   * Detect the type of a file based on its path
+   *
+   * Types are checked in order of specificity (most specific patterns first).
+   * Returns 'default' if no type matches.
+   *
+   * @param filePath - File path to check
+   * @returns The detected type name
+   */
+  detectType(filePath) {
+    const cached = this.patternCache.get(filePath);
+    if (cached) {
+      return cached;
+    }
+    const normalizedPath = filePath.replace(/\\/g, "/");
+    const sortedTypes = this.list().sort((a, b) => {
+      const aMaxLen = Math.max(...a.patterns.map((p) => p.length));
+      const bMaxLen = Math.max(...b.patterns.map((p) => p.length));
+      return bMaxLen - aMaxLen;
+    });
+    for (const type of sortedTypes) {
+      if (type.name === "default") continue;
+      for (const pattern of type.patterns) {
+        if (micromatch2.isMatch(normalizedPath, pattern)) {
+          this.patternCache.set(filePath, type.name);
+          return type.name;
+        }
+      }
+    }
+    this.patternCache.set(filePath, "default");
+    return "default";
+  }
+  /**
+   * Get the TTL for a file based on its type
+   *
+   * @param filePath - File path
+   * @param override - Optional TTL override
+   * @returns TTL in seconds
+   */
+  getTtl(filePath, override) {
+    if (override !== void 0) {
+      return override;
+    }
+    const typeName = this.detectType(filePath);
+    const type = this.get(typeName) || DEFAULT_TYPE;
+    return type.defaultTtl;
+  }
+  /**
+   * Get archive configuration for a file
+   *
+   * @param filePath - File path
+   * @returns Archive configuration or null if archiving is disabled
+   */
+  getArchiveConfig(filePath) {
+    const typeName = this.detectType(filePath);
+    const type = this.get(typeName) || DEFAULT_TYPE;
+    if (type.archiveAfterDays === null || type.archiveStorage === null) {
+      return null;
+    }
+    return {
+      afterDays: type.archiveAfterDays,
+      storage: type.archiveStorage
+    };
+  }
+  /**
+   * Get all files that match a type's patterns
+   *
+   * @param typeName - Type name
+   * @param files - Array of file paths to filter
+   * @returns Filtered file paths
+   */
+  filterByType(typeName, files) {
+    const type = this.get(typeName);
+    if (!type) {
+      return [];
+    }
+    return files.filter((file) => {
+      const normalized = file.replace(/\\/g, "/");
+      return type.patterns.some((pattern) => micromatch2.isMatch(normalized, pattern));
+    });
+  }
+  /**
+   * Check if a type is a built-in type
+   *
+   * @param name - Type name
+   * @returns true if it's a built-in type
+   */
+  isBuiltIn(name) {
+    return isBuiltInType(name);
+  }
+  /**
+   * Get the number of registered types
+   */
+  get size() {
+    return this.types.size;
+  }
+  /**
+   * Clear pattern cache
+   *
+   * Call this if you need to force re-detection of types.
+   */
+  clearCache() {
+    this.patternCache.clear();
+  }
+};
+function createDefaultRegistry() {
+  return new TypeRegistry();
+}
+var CustomTypeSchema = z.object({
+  description: z.string().optional(),
+  patterns: z.array(z.string()).min(1),
+  defaultTtl: z.number().positive().optional(),
+  archiveAfterDays: z.number().positive().nullable().optional(),
+  archiveStorage: z.enum(["local", "cloud", "drive"]).nullable().optional(),
+  syncPatterns: z.array(z.string()).optional(),
+  excludePatterns: z.array(z.string()).optional(),
+  permissions: z.object({
+    include: z.array(z.string()),
+    exclude: z.array(z.string())
+  }).optional()
+});
+var TypesConfigSchema = z.object({
+  custom: z.record(z.string(), CustomTypeSchema).optional()
+});
+function parseTtl(value) {
+  if (typeof value === "number") {
+    return value;
+  }
+  const match = value.match(/^(\d+)(s|m|h|d|w)$/);
+  if (!match || !match[1] || !match[2]) {
+    return TTL.ONE_WEEK;
+  }
+  const num = parseInt(match[1], 10);
+  const unit = match[2];
+  switch (unit) {
+    case "s":
+      return num;
+    case "m":
+      return num * 60;
+    case "h":
+      return num * 3600;
+    case "d":
+      return num * 86400;
+    case "w":
+      return num * 604800;
+    default:
+      return TTL.ONE_WEEK;
+  }
+}
+function validateCustomTypes(config) {
+  const result = {
+    valid: true,
+    errors: []
+  };
+  if (!config || typeof config !== "object") {
+    return result;
+  }
+  const typesConfig = config;
+  const customTypes = typesConfig.custom;
+  if (!customTypes) {
+    return result;
+  }
+  for (const [name, typeConfig] of Object.entries(customTypes)) {
+    if (!/^[a-z][a-z0-9_-]*$/.test(name)) {
+      result.valid = false;
+      result.errors.push({
+        name,
+        field: "name",
+        message: "Type name must start with a letter and contain only lowercase letters, numbers, hyphens, and underscores"
+      });
+    }
+    const parseResult = CustomTypeSchema.safeParse(typeConfig);
+    if (!parseResult.success) {
+      result.valid = false;
+      for (const issue of parseResult.error.issues) {
+        result.errors.push({
+          name,
+          field: issue.path.join("."),
+          message: issue.message
+        });
+      }
+    }
+  }
+  return result;
+}
+function loadCustomTypes(config) {
+  const types = /* @__PURE__ */ new Map();
+  if (!config.custom) {
+    return types;
+  }
+  for (const [name, typeConfig] of Object.entries(config.custom)) {
+    const type = {
+      name,
+      description: typeConfig.description || `Custom type: ${name}`,
+      patterns: typeConfig.patterns,
+      defaultTtl: typeConfig.defaultTtl ?? DEFAULT_TYPE.defaultTtl,
+      archiveAfterDays: typeConfig.archiveAfterDays ?? DEFAULT_TYPE.archiveAfterDays,
+      archiveStorage: typeConfig.archiveStorage ?? DEFAULT_TYPE.archiveStorage,
+      syncPatterns: typeConfig.syncPatterns,
+      excludePatterns: typeConfig.excludePatterns,
+      permissions: typeConfig.permissions
+    };
+    types.set(name, type);
+  }
+  return types;
+}
+function mergeTypes(builtIn, custom) {
+  const merged = /* @__PURE__ */ new Map();
+  for (const [name, type] of Object.entries(builtIn)) {
+    merged.set(name, type);
+  }
+  for (const [name, type] of custom) {
+    merged.set(name, type);
+  }
+  return merged;
+}
+function extendType(baseName, overrides) {
+  return {
+    ...overrides,
+    name: baseName
+  };
+}
 var MetadataSchema = z.object({
   // Organizational
   org: z.string().optional(),
@@ -35,6 +696,7 @@ var MetadataSchema = z.object({
   // Sync rules
   codex_sync_include: z.array(z.string()).optional(),
   codex_sync_exclude: z.array(z.string()).optional(),
+  codex_sync_custom: z.array(z.string()).optional(),
   // Metadata
   title: z.string().optional(),
   description: z.string().optional(),
@@ -383,6 +1045,3163 @@ function getTargetRepos(options) {
   );
 }
 
-export { AutoSyncPatternSchema, CodexConfigSchema, CodexError, ConfigurationError, MetadataSchema, SyncRulesSchema, ValidationError, evaluatePatterns, extractOrgFromRepoName, extractRawFrontmatter, filterByPatterns, getDefaultConfig, getDefaultDirectories, getDefaultRules, getTargetRepos, hasFrontmatter, loadConfig, matchAnyPattern, matchPattern, parseMetadata, resolveOrganization, shouldSyncToRepo, validateMetadata };
+// src/core/custom/destinations.ts
+function parseCustomDestination(value) {
+  if (typeof value !== "string" || !value) {
+    throw new ValidationError("Custom destination must be a non-empty string");
+  }
+  const colonIndex = value.indexOf(":");
+  if (colonIndex === -1) {
+    throw new ValidationError(
+      `Invalid custom destination format: "${value}". Expected format: "repo:path"`
+    );
+  }
+  const repo = value.substring(0, colonIndex).trim();
+  const path5 = value.substring(colonIndex + 1).trim();
+  if (!repo) {
+    throw new ValidationError(
+      `Invalid custom destination: repository name cannot be empty in "${value}"`
+    );
+  }
+  if (!path5) {
+    throw new ValidationError(
+      `Invalid custom destination: path cannot be empty in "${value}"`
+    );
+  }
+  return { repo, path: path5 };
+}
+function getCustomSyncDestinations(metadata) {
+  const customDestinations = metadata.codex_sync_custom;
+  if (!customDestinations || !Array.isArray(customDestinations)) {
+    return [];
+  }
+  const results = [];
+  for (const destination of customDestinations) {
+    try {
+      const parsed = parseCustomDestination(destination);
+      results.push(parsed);
+    } catch (error) {
+      continue;
+    }
+  }
+  return results;
+}
+
+// src/storage/provider.ts
+var DEFAULT_FETCH_OPTIONS = {
+  timeout: 3e4,
+  // 30 seconds
+  maxRetries: 3,
+  token: "",
+  branch: "main",
+  followRedirects: true,
+  maxSize: 10 * 1024 * 1024
+  // 10MB
+};
+function mergeFetchOptions(options) {
+  return {
+    ...DEFAULT_FETCH_OPTIONS,
+    ...options
+  };
+}
+function detectContentType(path5) {
+  const ext = path5.split(".").pop()?.toLowerCase();
+  const mimeTypes = {
+    md: "text/markdown",
+    markdown: "text/markdown",
+    txt: "text/plain",
+    json: "application/json",
+    yaml: "application/x-yaml",
+    yml: "application/x-yaml",
+    xml: "application/xml",
+    html: "text/html",
+    htm: "text/html",
+    css: "text/css",
+    js: "application/javascript",
+    ts: "application/typescript",
+    py: "text/x-python",
+    rb: "text/x-ruby",
+    go: "text/x-go",
+    rs: "text/x-rust",
+    java: "text/x-java",
+    c: "text/x-c",
+    cpp: "text/x-c++",
+    h: "text/x-c",
+    hpp: "text/x-c++",
+    sh: "application/x-sh",
+    bash: "application/x-sh",
+    zsh: "application/x-sh",
+    pdf: "application/pdf",
+    png: "image/png",
+    jpg: "image/jpeg",
+    jpeg: "image/jpeg",
+    gif: "image/gif",
+    svg: "image/svg+xml",
+    webp: "image/webp"
+  };
+  return mimeTypes[ext || ""] || "application/octet-stream";
+}
+var LocalStorage = class {
+  name = "local";
+  type = "local";
+  baseDir;
+  constructor(options = {}) {
+    this.baseDir = options.baseDir || process.cwd();
+  }
+  /**
+   * Check if this provider can handle the reference
+   *
+   * Local provider handles references that are in the current project
+   * and have a local path.
+   */
+  canHandle(reference) {
+    return reference.isCurrentProject && !!reference.localPath;
+  }
+  /**
+   * Fetch content from local filesystem
+   */
+  async fetch(reference, options) {
+    const opts = mergeFetchOptions(options);
+    if (!reference.localPath) {
+      throw new Error(`No local path for reference: ${reference.uri}`);
+    }
+    const fullPath = path3.isAbsolute(reference.localPath) ? reference.localPath : path3.join(this.baseDir, reference.localPath);
+    try {
+      await fs2.access(fullPath);
+    } catch {
+      throw new Error(`File not found: ${fullPath}`);
+    }
+    const stats = await fs2.stat(fullPath);
+    if (stats.size > opts.maxSize) {
+      throw new Error(
+        `File too large: ${stats.size} bytes (max: ${opts.maxSize} bytes)`
+      );
+    }
+    const content = await fs2.readFile(fullPath);
+    return {
+      content,
+      contentType: detectContentType(reference.localPath),
+      size: content.length,
+      source: "local",
+      metadata: {
+        path: fullPath,
+        mtime: stats.mtime.toISOString()
+      }
+    };
+  }
+  /**
+   * Check if file exists locally
+   */
+  async exists(reference) {
+    if (!reference.localPath) {
+      return false;
+    }
+    const fullPath = path3.isAbsolute(reference.localPath) ? reference.localPath : path3.join(this.baseDir, reference.localPath);
+    try {
+      await fs2.access(fullPath);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  /**
+   * Read file content as string
+   */
+  async readText(filePath) {
+    const fullPath = path3.isAbsolute(filePath) ? filePath : path3.join(this.baseDir, filePath);
+    return fs2.readFile(fullPath, "utf-8");
+  }
+  /**
+   * Write content to file
+   */
+  async write(filePath, content) {
+    const fullPath = path3.isAbsolute(filePath) ? filePath : path3.join(this.baseDir, filePath);
+    await fs2.mkdir(path3.dirname(fullPath), { recursive: true });
+    await fs2.writeFile(fullPath, content);
+  }
+  /**
+   * Delete a file
+   */
+  async delete(filePath) {
+    const fullPath = path3.isAbsolute(filePath) ? filePath : path3.join(this.baseDir, filePath);
+    try {
+      await fs2.unlink(fullPath);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  /**
+   * List files in a directory
+   */
+  async list(dirPath) {
+    const fullPath = path3.isAbsolute(dirPath) ? dirPath : path3.join(this.baseDir, dirPath);
+    try {
+      const entries = await fs2.readdir(fullPath, { withFileTypes: true });
+      return entries.filter((e) => e.isFile()).map((e) => path3.join(dirPath, e.name));
+    } catch {
+      return [];
+    }
+  }
+};
+function createLocalStorage(options) {
+  return new LocalStorage(options);
+}
+
+// src/storage/github.ts
+var GitHubStorage = class {
+  name = "github";
+  type = "github";
+  apiBaseUrl;
+  rawBaseUrl;
+  defaultBranch;
+  token;
+  constructor(options = {}) {
+    this.apiBaseUrl = options.apiBaseUrl || "https://api.github.com";
+    this.rawBaseUrl = options.rawBaseUrl || "https://raw.githubusercontent.com";
+    this.defaultBranch = options.defaultBranch || "main";
+    this.token = options.token || (options.tokenEnv ? process.env[options.tokenEnv] : void 0);
+    if (!this.token) {
+      this.token = process.env.GITHUB_TOKEN || process.env.GH_TOKEN;
+    }
+  }
+  /**
+   * Check if this provider can handle the reference
+   *
+   * GitHub provider handles references that are NOT in the current project
+   * (those need to be fetched from GitHub).
+   */
+  canHandle(reference) {
+    return !reference.isCurrentProject;
+  }
+  /**
+   * Fetch content from GitHub
+   */
+  async fetch(reference, options) {
+    const opts = mergeFetchOptions(options);
+    const token = opts.token || this.token;
+    const branch = opts.branch || this.defaultBranch;
+    if (!reference.path) {
+      throw new Error(`No path specified for reference: ${reference.uri}`);
+    }
+    try {
+      return await this.fetchRaw(reference, branch, opts, token);
+    } catch (error) {
+      if (token) {
+        return await this.fetchApi(reference, branch, opts, token);
+      }
+      throw error;
+    }
+  }
+  /**
+   * Fetch using raw.githubusercontent.com
+   */
+  async fetchRaw(reference, branch, opts, token) {
+    const url = `${this.rawBaseUrl}/${reference.org}/${reference.project}/${branch}/${reference.path}`;
+    const headers = {
+      "User-Agent": "fractary-codex"
+    };
+    if (token) {
+      headers["Authorization"] = `token ${token}`;
+    }
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), opts.timeout);
+    try {
+      const response = await fetch(url, {
+        headers,
+        signal: controller.signal,
+        redirect: opts.followRedirects ? "follow" : "manual"
+      });
+      if (!response.ok) {
+        throw new Error(`GitHub raw fetch failed: ${response.status} ${response.statusText}`);
+      }
+      const arrayBuffer = await response.arrayBuffer();
+      const content = Buffer.from(arrayBuffer);
+      if (content.length > opts.maxSize) {
+        throw new Error(`Content too large: ${content.length} bytes (max: ${opts.maxSize} bytes)`);
+      }
+      return {
+        content,
+        contentType: response.headers.get("content-type") || detectContentType(reference.path),
+        size: content.length,
+        source: "github-raw",
+        metadata: {
+          url,
+          branch
+        }
+      };
+    } finally {
+      clearTimeout(timeoutId);
+    }
+  }
+  /**
+   * Fetch using GitHub API (for private repos)
+   */
+  async fetchApi(reference, branch, opts, token) {
+    const url = `${this.apiBaseUrl}/repos/${reference.org}/${reference.project}/contents/${reference.path}?ref=${branch}`;
+    const headers = {
+      "User-Agent": "fractary-codex",
+      Accept: "application/vnd.github.v3+json",
+      Authorization: `token ${token}`
+    };
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), opts.timeout);
+    try {
+      const response = await fetch(url, {
+        headers,
+        signal: controller.signal
+      });
+      if (!response.ok) {
+        throw new Error(`GitHub API fetch failed: ${response.status} ${response.statusText}`);
+      }
+      const data = await response.json();
+      if (data.type !== "file") {
+        throw new Error(`Reference is not a file: ${reference.uri}`);
+      }
+      let content;
+      if (data.content && data.encoding === "base64") {
+        content = Buffer.from(data.content, "base64");
+      } else if (data.download_url) {
+        const downloadResponse = await fetch(data.download_url, {
+          headers: { "User-Agent": "fractary-codex" },
+          signal: controller.signal
+        });
+        const arrayBuffer = await downloadResponse.arrayBuffer();
+        content = Buffer.from(arrayBuffer);
+      } else {
+        throw new Error(`No content available for: ${reference.uri}`);
+      }
+      if (content.length > opts.maxSize) {
+        throw new Error(`Content too large: ${content.length} bytes (max: ${opts.maxSize} bytes)`);
+      }
+      return {
+        content,
+        contentType: detectContentType(reference.path),
+        size: content.length,
+        source: "github-api",
+        metadata: {
+          sha: data.sha,
+          url,
+          branch
+        }
+      };
+    } finally {
+      clearTimeout(timeoutId);
+    }
+  }
+  /**
+   * Check if file exists on GitHub
+   */
+  async exists(reference, options) {
+    const opts = mergeFetchOptions(options);
+    const token = opts.token || this.token;
+    const branch = opts.branch || this.defaultBranch;
+    if (!reference.path) {
+      return false;
+    }
+    const url = `${this.rawBaseUrl}/${reference.org}/${reference.project}/${branch}/${reference.path}`;
+    const headers = {
+      "User-Agent": "fractary-codex"
+    };
+    if (token) {
+      headers["Authorization"] = `token ${token}`;
+    }
+    try {
+      const response = await fetch(url, {
+        method: "HEAD",
+        headers
+      });
+      return response.ok;
+    } catch {
+      return false;
+    }
+  }
+  /**
+   * Get repository metadata
+   */
+  async getRepoInfo(org, project) {
+    const url = `${this.apiBaseUrl}/repos/${org}/${project}`;
+    const headers = {
+      "User-Agent": "fractary-codex",
+      Accept: "application/vnd.github.v3+json"
+    };
+    if (this.token) {
+      headers["Authorization"] = `token ${this.token}`;
+    }
+    try {
+      const response = await fetch(url, { headers });
+      if (!response.ok) {
+        return null;
+      }
+      const data = await response.json();
+      return {
+        defaultBranch: data.default_branch,
+        private: data.private,
+        size: data.size
+      };
+    } catch {
+      return null;
+    }
+  }
+};
+function createGitHubStorage(options) {
+  return new GitHubStorage(options);
+}
+
+// src/storage/http.ts
+var HttpStorage = class {
+  name = "http";
+  type = "http";
+  defaultTimeout;
+  defaultMaxSize;
+  defaultHeaders;
+  constructor(options = {}) {
+    this.defaultTimeout = options.timeout || 3e4;
+    this.defaultMaxSize = options.maxSize || 10 * 1024 * 1024;
+    this.defaultHeaders = {
+      "User-Agent": options.userAgent || "fractary-codex",
+      ...options.headers
+    };
+  }
+  /**
+   * Check if this provider can handle the reference
+   *
+   * HTTP provider is a fallback - it can handle any reference
+   * but should have lower priority than specialized providers.
+   */
+  canHandle(_reference) {
+    return true;
+  }
+  /**
+   * Fetch content from HTTP URL
+   *
+   * This method constructs a URL from the reference and fetches it.
+   * The URL pattern is: https://raw.githubusercontent.com/{org}/{project}/{branch}/{path}
+   *
+   * For custom URL schemes, use the fetchUrl method directly.
+   */
+  async fetch(reference, options) {
+    const opts = mergeFetchOptions(options);
+    const branch = opts.branch || "main";
+    if (!reference.path) {
+      throw new Error(`No path specified for reference: ${reference.uri}`);
+    }
+    const url = `https://raw.githubusercontent.com/${reference.org}/${reference.project}/${branch}/${reference.path}`;
+    return this.fetchUrl(url, opts);
+  }
+  /**
+   * Fetch content from any URL
+   */
+  async fetchUrl(url, options) {
+    const opts = mergeFetchOptions(options);
+    const timeout = opts.timeout || this.defaultTimeout;
+    const maxSize = opts.maxSize || this.defaultMaxSize;
+    const headers = {
+      ...this.defaultHeaders
+    };
+    if (opts.token) {
+      headers["Authorization"] = `Bearer ${opts.token}`;
+    }
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), timeout);
+    try {
+      const response = await fetch(url, {
+        headers,
+        signal: controller.signal,
+        redirect: opts.followRedirects ? "follow" : "manual"
+      });
+      if (!response.ok) {
+        throw new Error(`HTTP fetch failed: ${response.status} ${response.statusText}`);
+      }
+      const contentLength = response.headers.get("content-length");
+      if (contentLength && parseInt(contentLength, 10) > maxSize) {
+        throw new Error(`Content too large: ${contentLength} bytes (max: ${maxSize} bytes)`);
+      }
+      const arrayBuffer = await response.arrayBuffer();
+      const content = Buffer.from(arrayBuffer);
+      if (content.length > maxSize) {
+        throw new Error(`Content too large: ${content.length} bytes (max: ${maxSize} bytes)`);
+      }
+      const pathname = new URL(url).pathname;
+      const filename = pathname.split("/").pop() || "";
+      return {
+        content,
+        contentType: response.headers.get("content-type") || detectContentType(filename),
+        size: content.length,
+        source: "http",
+        metadata: {
+          url,
+          status: response.status,
+          headers: Object.fromEntries(response.headers.entries())
+        }
+      };
+    } finally {
+      clearTimeout(timeoutId);
+    }
+  }
+  /**
+   * Check if URL exists (HEAD request)
+   */
+  async exists(reference, options) {
+    const opts = mergeFetchOptions(options);
+    const branch = opts.branch || "main";
+    if (!reference.path) {
+      return false;
+    }
+    const url = `https://raw.githubusercontent.com/${reference.org}/${reference.project}/${branch}/${reference.path}`;
+    return this.urlExists(url, opts);
+  }
+  /**
+   * Check if any URL exists
+   */
+  async urlExists(url, options) {
+    const opts = mergeFetchOptions(options);
+    const timeout = opts.timeout || this.defaultTimeout;
+    const headers = {
+      ...this.defaultHeaders
+    };
+    if (opts.token) {
+      headers["Authorization"] = `Bearer ${opts.token}`;
+    }
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), timeout);
+    try {
+      const response = await fetch(url, {
+        method: "HEAD",
+        headers,
+        signal: controller.signal,
+        redirect: "follow"
+      });
+      return response.ok;
+    } catch {
+      return false;
+    } finally {
+      clearTimeout(timeoutId);
+    }
+  }
+};
+function createHttpStorage(options) {
+  return new HttpStorage(options);
+}
+
+// src/storage/manager.ts
+var StorageManager = class {
+  providers = /* @__PURE__ */ new Map();
+  priority;
+  constructor(config = {}) {
+    this.providers.set("local", new LocalStorage(config.local));
+    this.providers.set("github", new GitHubStorage(config.github));
+    this.providers.set("http", new HttpStorage(config.http));
+    this.priority = config.priority || ["local", "github", "http"];
+  }
+  /**
+   * Register a custom storage provider
+   */
+  registerProvider(provider) {
+    this.providers.set(provider.type, provider);
+  }
+  /**
+   * Remove a storage provider
+   */
+  removeProvider(type) {
+    return this.providers.delete(type);
+  }
+  /**
+   * Get a provider by type
+   */
+  getProvider(type) {
+    return this.providers.get(type);
+  }
+  /**
+   * Get all registered providers
+   */
+  getProviders() {
+    return Array.from(this.providers.values());
+  }
+  /**
+   * Find the best provider for a reference
+   */
+  findProvider(reference) {
+    for (const type of this.priority) {
+      const provider = this.providers.get(type);
+      if (provider && provider.canHandle(reference)) {
+        return provider;
+      }
+    }
+    return null;
+  }
+  /**
+   * Fetch content for a reference
+   *
+   * Tries providers in priority order until one succeeds.
+   */
+  async fetch(reference, options) {
+    const errors = [];
+    for (const type of this.priority) {
+      const provider = this.providers.get(type);
+      if (!provider || !provider.canHandle(reference)) {
+        continue;
+      }
+      try {
+        return await provider.fetch(reference, options);
+      } catch (error) {
+        errors.push(error instanceof Error ? error : new Error(String(error)));
+      }
+    }
+    if (errors.length === 0) {
+      throw new Error(`No provider can handle reference: ${reference.uri}`);
+    }
+    const firstError = errors[0];
+    if (firstError) {
+      if (errors.length > 1) {
+        throw new Error(`All providers failed for ${reference.uri}. First error: ${firstError.message}`);
+      }
+      throw firstError;
+    }
+    throw new Error(`Unknown error fetching ${reference.uri}`);
+  }
+  /**
+   * Check if content exists for a reference
+   *
+   * Returns true if any provider reports the content exists.
+   */
+  async exists(reference, options) {
+    for (const type of this.priority) {
+      const provider = this.providers.get(type);
+      if (!provider || !provider.canHandle(reference)) {
+        continue;
+      }
+      try {
+        if (await provider.exists(reference, options)) {
+          return true;
+        }
+      } catch {
+      }
+    }
+    return false;
+  }
+  /**
+   * Fetch content using a specific provider
+   */
+  async fetchWith(type, reference, options) {
+    const provider = this.providers.get(type);
+    if (!provider) {
+      throw new Error(`Provider not found: ${type}`);
+    }
+    return provider.fetch(reference, options);
+  }
+  /**
+   * Fetch multiple references in parallel
+   */
+  async fetchMany(references, options) {
+    const results = /* @__PURE__ */ new Map();
+    const promises = references.map(async (ref) => {
+      try {
+        const result = await this.fetch(ref, options);
+        results.set(ref.uri, result);
+      } catch (error) {
+        results.set(ref.uri, error instanceof Error ? error : new Error(String(error)));
+      }
+    });
+    await Promise.all(promises);
+    return results;
+  }
+  /**
+   * Get provider status (for diagnostics)
+   */
+  getStatus() {
+    return this.priority.map((type, index) => {
+      const provider = this.providers.get(type);
+      return {
+        type,
+        name: provider?.name || type,
+        priority: index
+      };
+    });
+  }
+};
+function createStorageManager(config) {
+  return new StorageManager(config);
+}
+var defaultManager = null;
+function getDefaultStorageManager() {
+  if (!defaultManager) {
+    defaultManager = createStorageManager();
+  }
+  return defaultManager;
+}
+function setDefaultStorageManager(manager) {
+  defaultManager = manager;
+}
+
+// src/cache/entry.ts
+function calculateContentHash(content) {
+  let hash = 2166136261;
+  for (let i = 0; i < content.length; i++) {
+    hash ^= content[i] ?? 0;
+    hash = Math.imul(hash, 16777619);
+  }
+  return (hash >>> 0).toString(16).padStart(8, "0");
+}
+function createCacheEntry(uri, result, ttl) {
+  const now = Date.now();
+  const metadata = {
+    uri,
+    cachedAt: now,
+    expiresAt: now + ttl * 1e3,
+    ttl,
+    contentHash: calculateContentHash(result.content),
+    size: result.size,
+    contentType: result.contentType,
+    source: result.source,
+    accessCount: 1,
+    lastAccessedAt: now,
+    providerMetadata: result.metadata
+  };
+  if (result.metadata?.etag && typeof result.metadata.etag === "string") {
+    metadata.etag = result.metadata.etag;
+  }
+  if (result.metadata?.lastModified && typeof result.metadata.lastModified === "string") {
+    metadata.lastModified = result.metadata.lastModified;
+  }
+  return {
+    metadata,
+    content: result.content
+  };
+}
+function getCacheEntryStatus(entry) {
+  const now = Date.now();
+  if (now < entry.metadata.expiresAt) {
+    return "fresh";
+  }
+  const staleWindow = 5 * 60 * 1e3;
+  if (now < entry.metadata.expiresAt + staleWindow) {
+    return "stale";
+  }
+  return "expired";
+}
+function isCacheEntryValid(entry) {
+  const status = getCacheEntryStatus(entry);
+  return status === "fresh" || status === "stale";
+}
+function isCacheEntryFresh(entry) {
+  return getCacheEntryStatus(entry) === "fresh";
+}
+function touchCacheEntry(entry) {
+  entry.metadata.accessCount++;
+  entry.metadata.lastAccessedAt = Date.now();
+}
+function serializeCacheEntry(entry) {
+  return {
+    metadata: entry.metadata,
+    content: entry.content.toString("base64")
+  };
+}
+function deserializeCacheEntry(serialized) {
+  return {
+    metadata: serialized.metadata,
+    content: Buffer.from(serialized.content, "base64")
+  };
+}
+function getRemainingTtl(entry) {
+  const remaining = entry.metadata.expiresAt - Date.now();
+  return Math.max(0, Math.floor(remaining / 1e3));
+}
+function hasContentChanged(entry, newContent) {
+  return entry.metadata.contentHash !== calculateContentHash(newContent);
+}
+function getCacheEntryAge(entry) {
+  return Math.floor((Date.now() - entry.metadata.cachedAt) / 1e3);
+}
+var CachePersistence = class {
+  cacheDir;
+  extension;
+  atomicWrites;
+  constructor(options) {
+    this.cacheDir = options.cacheDir;
+    this.extension = options.extension || ".cache";
+    this.atomicWrites = options.atomicWrites ?? true;
+  }
+  /**
+   * Get the cache file path for a URI
+   */
+  getCachePath(uri) {
+    const match = uri.match(/^codex:\/\/([^/]+)\/([^/]+)(?:\/(.*))?$/);
+    if (!match || !match[1] || !match[2]) {
+      throw new Error(`Invalid codex URI: ${uri}`);
+    }
+    const [, org, project, filePath] = match;
+    const relativePath = filePath || "index";
+    return path3.join(this.cacheDir, org, project, relativePath + this.extension);
+  }
+  /**
+   * Get the metadata file path for a URI
+   */
+  getMetadataPath(uri) {
+    return this.getCachePath(uri).replace(this.extension, ".meta.json");
+  }
+  /**
+   * Read a cache entry from disk
+   */
+  async read(uri) {
+    const cachePath = this.getCachePath(uri);
+    const metadataPath = this.getMetadataPath(uri);
+    try {
+      const [metadataJson, content] = await Promise.all([
+        fs2.readFile(metadataPath, "utf-8"),
+        fs2.readFile(cachePath)
+      ]);
+      const metadata = JSON.parse(metadataJson);
+      return {
+        metadata,
+        content
+      };
+    } catch (error) {
+      if (error.code === "ENOENT") {
+        return null;
+      }
+      throw error;
+    }
+  }
+  /**
+   * Write a cache entry to disk
+   */
+  async write(entry) {
+    const cachePath = this.getCachePath(entry.metadata.uri);
+    const metadataPath = this.getMetadataPath(entry.metadata.uri);
+    await fs2.mkdir(path3.dirname(cachePath), { recursive: true });
+    if (this.atomicWrites) {
+      const tempCachePath = cachePath + ".tmp";
+      const tempMetadataPath = metadataPath + ".tmp";
+      try {
+        await Promise.all([
+          fs2.writeFile(tempCachePath, entry.content),
+          fs2.writeFile(tempMetadataPath, JSON.stringify(entry.metadata, null, 2))
+        ]);
+        await Promise.all([
+          fs2.rename(tempCachePath, cachePath),
+          fs2.rename(tempMetadataPath, metadataPath)
+        ]);
+      } catch (error) {
+        await Promise.all([
+          fs2.unlink(tempCachePath).catch(() => {
+          }),
+          fs2.unlink(tempMetadataPath).catch(() => {
+          })
+        ]);
+        throw error;
+      }
+    } else {
+      await Promise.all([
+        fs2.writeFile(cachePath, entry.content),
+        fs2.writeFile(metadataPath, JSON.stringify(entry.metadata, null, 2))
+      ]);
+    }
+  }
+  /**
+   * Delete a cache entry
+   */
+  async delete(uri) {
+    const cachePath = this.getCachePath(uri);
+    const metadataPath = this.getMetadataPath(uri);
+    try {
+      await Promise.all([fs2.unlink(cachePath), fs2.unlink(metadataPath)]);
+      return true;
+    } catch (error) {
+      if (error.code === "ENOENT") {
+        return false;
+      }
+      throw error;
+    }
+  }
+  /**
+   * Check if a cache entry exists
+   */
+  async exists(uri) {
+    const cachePath = this.getCachePath(uri);
+    try {
+      await fs2.access(cachePath);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  /**
+   * List all cached URIs
+   */
+  async list() {
+    const uris = [];
+    try {
+      const orgs = await fs2.readdir(this.cacheDir);
+      for (const org of orgs) {
+        const orgPath = path3.join(this.cacheDir, org);
+        const orgStat = await fs2.stat(orgPath);
+        if (!orgStat.isDirectory()) continue;
+        const projects = await fs2.readdir(orgPath);
+        for (const project of projects) {
+          const projectPath = path3.join(orgPath, project);
+          const projectStat = await fs2.stat(projectPath);
+          if (!projectStat.isDirectory()) continue;
+          const files = await this.listFilesRecursive(projectPath);
+          for (const file of files) {
+            if (file.endsWith(this.extension)) {
+              const relativePath = path3.relative(projectPath, file);
+              const filePath = relativePath.slice(0, -this.extension.length);
+              uris.push(`codex://${org}/${project}/${filePath}`);
+            }
+          }
+        }
+      }
+    } catch (error) {
+      if (error.code === "ENOENT") {
+        return [];
+      }
+      throw error;
+    }
+    return uris;
+  }
+  /**
+   * Recursively list files in a directory
+   */
+  async listFilesRecursive(dir) {
+    const files = [];
+    const entries = await fs2.readdir(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      const fullPath = path3.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        files.push(...await this.listFilesRecursive(fullPath));
+      } else if (entry.isFile()) {
+        files.push(fullPath);
+      }
+    }
+    return files;
+  }
+  /**
+   * Clear all cache entries
+   */
+  async clear() {
+    let count = 0;
+    try {
+      const orgs = await fs2.readdir(this.cacheDir);
+      for (const org of orgs) {
+        const orgPath = path3.join(this.cacheDir, org);
+        const stat = await fs2.stat(orgPath);
+        if (stat.isDirectory()) {
+          await fs2.rm(orgPath, { recursive: true });
+          count++;
+        }
+      }
+    } catch (error) {
+      if (error.code !== "ENOENT") {
+        throw error;
+      }
+    }
+    return count;
+  }
+  /**
+   * Clear expired entries
+   */
+  async clearExpired() {
+    const uris = await this.list();
+    let cleared = 0;
+    for (const uri of uris) {
+      const entry = await this.read(uri);
+      if (entry && entry.metadata.expiresAt < Date.now()) {
+        if (await this.delete(uri)) {
+          cleared++;
+        }
+      }
+    }
+    return cleared;
+  }
+  /**
+   * Get cache statistics
+   */
+  async getStats() {
+    const stats = {
+      entryCount: 0,
+      totalSize: 0,
+      freshCount: 0,
+      staleCount: 0,
+      expiredCount: 0
+    };
+    const uris = await this.list();
+    const now = Date.now();
+    const staleWindow = 5 * 60 * 1e3;
+    for (const uri of uris) {
+      const entry = await this.read(uri);
+      if (entry) {
+        stats.entryCount++;
+        stats.totalSize += entry.metadata.size;
+        if (now < entry.metadata.expiresAt) {
+          stats.freshCount++;
+        } else if (now < entry.metadata.expiresAt + staleWindow) {
+          stats.staleCount++;
+        } else {
+          stats.expiredCount++;
+        }
+      }
+    }
+    return stats;
+  }
+  /**
+   * Ensure cache directory exists
+   */
+  async ensureDir() {
+    await fs2.mkdir(this.cacheDir, { recursive: true });
+  }
+  /**
+   * Get cache directory path
+   */
+  getCacheDir() {
+    return this.cacheDir;
+  }
+};
+function createCachePersistence(options) {
+  return new CachePersistence(options);
+}
+
+// src/cache/manager.ts
+var CacheManager = class {
+  memoryCache = /* @__PURE__ */ new Map();
+  persistence;
+  storage = null;
+  config;
+  // LRU tracking
+  accessOrder = [];
+  // Background refresh tracking
+  refreshPromises = /* @__PURE__ */ new Map();
+  constructor(config) {
+    this.config = {
+      cacheDir: config.cacheDir,
+      defaultTtl: config.defaultTtl ?? 3600,
+      // 1 hour default
+      maxMemoryEntries: config.maxMemoryEntries ?? 1e3,
+      maxMemorySize: config.maxMemorySize ?? 50 * 1024 * 1024,
+      // 50MB
+      enablePersistence: config.enablePersistence ?? true,
+      staleWhileRevalidate: config.staleWhileRevalidate ?? true,
+      backgroundRefreshThreshold: config.backgroundRefreshThreshold ?? 60
+      // 1 minute
+    };
+    this.persistence = this.config.enablePersistence ? createCachePersistence({ cacheDir: this.config.cacheDir }) : null;
+  }
+  /**
+   * Set the storage manager for fetching
+   */
+  setStorageManager(storage) {
+    this.storage = storage;
+  }
+  /**
+   * Get content for a reference
+   *
+   * Implements cache-first strategy with stale-while-revalidate.
+   */
+  async get(reference, options) {
+    const ttl = options?.ttl ?? this.config.defaultTtl;
+    let entry = this.memoryCache.get(reference.uri);
+    if (!entry && this.persistence) {
+      entry = await this.persistence.read(reference.uri) ?? void 0;
+      if (entry) {
+        this.setMemoryEntry(reference.uri, entry);
+      }
+    }
+    if (entry) {
+      const status = getCacheEntryStatus(entry);
+      if (status === "fresh") {
+        touchCacheEntry(entry);
+        return this.entryToResult(entry);
+      }
+      if (status === "stale" && this.config.staleWhileRevalidate) {
+        touchCacheEntry(entry);
+        const result = this.entryToResult(entry);
+        this.backgroundRefresh(reference, ttl, options);
+        return result;
+      }
+    }
+    return this.fetchAndCache(reference, ttl, options);
+  }
+  /**
+   * Check if content is cached
+   */
+  async has(uri) {
+    if (this.memoryCache.has(uri)) {
+      return true;
+    }
+    if (this.persistence) {
+      return this.persistence.exists(uri);
+    }
+    return false;
+  }
+  /**
+   * Get cache entry without fetching
+   */
+  async lookup(uri) {
+    let entry = this.memoryCache.get(uri);
+    if (entry) {
+      return {
+        entry,
+        hit: true,
+        fresh: isCacheEntryFresh(entry),
+        source: "memory"
+      };
+    }
+    if (this.persistence) {
+      entry = await this.persistence.read(uri) ?? void 0;
+      if (entry) {
+        this.setMemoryEntry(uri, entry);
+        return {
+          entry,
+          hit: true,
+          fresh: isCacheEntryFresh(entry),
+          source: "disk"
+        };
+      }
+    }
+    return {
+      entry: null,
+      hit: false,
+      fresh: false,
+      source: "none"
+    };
+  }
+  /**
+   * Store content in cache
+   */
+  async set(uri, result, ttl) {
+    const actualTtl = ttl ?? this.config.defaultTtl;
+    const entry = createCacheEntry(uri, result, actualTtl);
+    this.setMemoryEntry(uri, entry);
+    if (this.persistence) {
+      await this.persistence.write(entry);
+    }
+    return entry;
+  }
+  /**
+   * Invalidate a cache entry
+   */
+  async invalidate(uri) {
+    let removed = false;
+    if (this.memoryCache.has(uri)) {
+      this.memoryCache.delete(uri);
+      this.removeFromAccessOrder(uri);
+      removed = true;
+    }
+    if (this.persistence) {
+      const diskRemoved = await this.persistence.delete(uri);
+      removed = removed || diskRemoved;
+    }
+    return removed;
+  }
+  /**
+   * Invalidate all entries matching a pattern
+   */
+  async invalidatePattern(pattern) {
+    let count = 0;
+    for (const uri of this.memoryCache.keys()) {
+      if (pattern.test(uri)) {
+        this.memoryCache.delete(uri);
+        this.removeFromAccessOrder(uri);
+        count++;
+      }
+    }
+    if (this.persistence) {
+      const uris = await this.persistence.list();
+      for (const uri of uris) {
+        if (pattern.test(uri)) {
+          await this.persistence.delete(uri);
+          count++;
+        }
+      }
+    }
+    return count;
+  }
+  /**
+   * Clear all cache entries
+   */
+  async clear() {
+    this.memoryCache.clear();
+    this.accessOrder = [];
+    if (this.persistence) {
+      await this.persistence.clear();
+    }
+  }
+  /**
+   * Clear expired entries
+   */
+  async clearExpired() {
+    let count = 0;
+    const now = Date.now();
+    for (const [uri, entry] of this.memoryCache) {
+      if (entry.metadata.expiresAt < now) {
+        this.memoryCache.delete(uri);
+        this.removeFromAccessOrder(uri);
+        count++;
+      }
+    }
+    if (this.persistence) {
+      count += await this.persistence.clearExpired();
+    }
+    return count;
+  }
+  /**
+   * Get cache statistics
+   */
+  async getStats() {
+    let diskStats = {
+      entryCount: 0,
+      totalSize: 0,
+      freshCount: 0,
+      staleCount: 0,
+      expiredCount: 0
+    };
+    if (this.persistence) {
+      diskStats = await this.persistence.getStats();
+    }
+    let memorySize = 0;
+    for (const entry of this.memoryCache.values()) {
+      memorySize += entry.metadata.size;
+    }
+    return {
+      ...diskStats,
+      memoryEntries: this.memoryCache.size,
+      memorySize
+    };
+  }
+  /**
+   * Preload content into cache
+   */
+  async preload(references, options) {
+    if (!this.storage) {
+      throw new Error("Storage manager not set");
+    }
+    await Promise.all(
+      references.map(async (ref) => {
+        try {
+          await this.get(ref, options);
+        } catch {
+        }
+      })
+    );
+  }
+  /**
+   * Get metadata for a cached entry
+   */
+  async getMetadata(uri) {
+    const result = await this.lookup(uri);
+    return result.entry?.metadata ?? null;
+  }
+  /**
+   * Get remaining TTL for an entry
+   */
+  async getTtl(uri) {
+    const result = await this.lookup(uri);
+    if (result.entry) {
+      return getRemainingTtl(result.entry);
+    }
+    return null;
+  }
+  /**
+   * Fetch content and store in cache
+   */
+  async fetchAndCache(reference, ttl, options) {
+    if (!this.storage) {
+      throw new Error("Storage manager not set");
+    }
+    const result = await this.storage.fetch(reference, options);
+    await this.set(reference.uri, result, ttl);
+    return result;
+  }
+  /**
+   * Background refresh for stale-while-revalidate
+   */
+  backgroundRefresh(reference, ttl, options) {
+    const uri = reference.uri;
+    if (this.refreshPromises.has(uri)) {
+      return;
+    }
+    const promise = this.fetchAndCache(reference, ttl, options).then(() => {
+      const entry = this.memoryCache.get(uri);
+      return entry ?? null;
+    }).catch(() => null).finally(() => {
+      this.refreshPromises.delete(uri);
+    });
+    this.refreshPromises.set(uri, promise);
+  }
+  /**
+   * Set entry in memory cache with LRU eviction
+   */
+  setMemoryEntry(uri, entry) {
+    this.removeFromAccessOrder(uri);
+    this.accessOrder.push(uri);
+    this.memoryCache.set(uri, entry);
+    this.evictIfNeeded();
+  }
+  /**
+   * Evict entries if over limits
+   */
+  evictIfNeeded() {
+    while (this.memoryCache.size > this.config.maxMemoryEntries) {
+      this.evictOldest();
+    }
+    let totalSize = 0;
+    for (const entry of this.memoryCache.values()) {
+      totalSize += entry.metadata.size;
+    }
+    while (totalSize > this.config.maxMemorySize && this.memoryCache.size > 0) {
+      const evicted = this.evictOldest();
+      if (evicted) {
+        totalSize -= evicted.metadata.size;
+      } else {
+        break;
+      }
+    }
+  }
+  /**
+   * Evict the oldest entry (LRU)
+   */
+  evictOldest() {
+    if (this.accessOrder.length === 0) {
+      return null;
+    }
+    const oldest = this.accessOrder.shift();
+    if (oldest) {
+      const entry = this.memoryCache.get(oldest);
+      this.memoryCache.delete(oldest);
+      return entry ?? null;
+    }
+    return null;
+  }
+  /**
+   * Remove URI from access order
+   */
+  removeFromAccessOrder(uri) {
+    const index = this.accessOrder.indexOf(uri);
+    if (index !== -1) {
+      this.accessOrder.splice(index, 1);
+    }
+  }
+  /**
+   * Convert cache entry to fetch result
+   */
+  entryToResult(entry) {
+    return {
+      content: entry.content,
+      contentType: entry.metadata.contentType,
+      size: entry.metadata.size,
+      source: entry.metadata.source,
+      metadata: entry.metadata.providerMetadata
+    };
+  }
+};
+function createCacheManager(config) {
+  return new CacheManager(config);
+}
+var defaultCacheManager = null;
+function getDefaultCacheManager() {
+  if (!defaultCacheManager) {
+    defaultCacheManager = createCacheManager({
+      cacheDir: ".fractary/plugins/codex/cache"
+    });
+  }
+  return defaultCacheManager;
+}
+function setDefaultCacheManager(manager) {
+  defaultCacheManager = manager;
+}
+
+// src/mcp/tools.ts
+var CODEX_TOOLS = [
+  {
+    name: "codex_fetch",
+    description: "Fetch a document from the Codex knowledge base by URI. Returns the document content.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        uri: {
+          type: "string",
+          description: "Codex URI in format: codex://org/project/path/to/file.md"
+        },
+        branch: {
+          type: "string",
+          description: "Git branch to fetch from (default: main)"
+        },
+        noCache: {
+          type: "boolean",
+          description: "Bypass cache and fetch fresh content"
+        }
+      },
+      required: ["uri"]
+    }
+  },
+  {
+    name: "codex_search",
+    description: "Search for documents in the Codex knowledge base.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        query: {
+          type: "string",
+          description: "Search query string"
+        },
+        org: {
+          type: "string",
+          description: "Filter by organization"
+        },
+        project: {
+          type: "string",
+          description: "Filter by project"
+        },
+        limit: {
+          type: "number",
+          description: "Maximum number of results (default: 10)"
+        },
+        type: {
+          type: "string",
+          description: "Filter by artifact type (e.g., docs, specs, logs)"
+        }
+      },
+      required: ["query"]
+    }
+  },
+  {
+    name: "codex_list",
+    description: "List documents in the Codex cache.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        org: {
+          type: "string",
+          description: "Filter by organization"
+        },
+        project: {
+          type: "string",
+          description: "Filter by project"
+        },
+        includeExpired: {
+          type: "boolean",
+          description: "Include expired cache entries"
+        }
+      }
+    }
+  },
+  {
+    name: "codex_invalidate",
+    description: "Invalidate cached documents matching a pattern.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        pattern: {
+          type: "string",
+          description: "URI pattern to invalidate (supports regex)"
+        }
+      },
+      required: ["pattern"]
+    }
+  }
+];
+function textResult(text, isError = false) {
+  return {
+    content: [{ type: "text", text }],
+    isError
+  };
+}
+function resourceResult(uri, content, mimeType) {
+  return {
+    content: [
+      {
+        type: "resource",
+        resource: {
+          uri,
+          mimeType,
+          text: content
+        }
+      }
+    ]
+  };
+}
+async function handleFetch(args, ctx) {
+  const { uri, branch, noCache } = args;
+  const ref = resolveReference(uri);
+  if (!ref) {
+    return textResult(`Invalid codex URI: ${uri}`, true);
+  }
+  try {
+    let result;
+    if (noCache) {
+      result = await ctx.storage.fetch(ref, { branch });
+      await ctx.cache.set(uri, result);
+    } else {
+      result = await ctx.cache.get(ref, { branch });
+    }
+    const content = result.content.toString("utf-8");
+    return resourceResult(uri, content, result.contentType);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return textResult(`Failed to fetch ${uri}: ${message}`, true);
+  }
+}
+async function handleSearch(args, ctx) {
+  const { query, org, project, limit = 10 } = args;
+  const stats = await ctx.cache.getStats();
+  if (stats.entryCount === 0) {
+    return textResult("No documents in cache. Use codex_fetch to load documents first.");
+  }
+  const message = `Search functionality requires a search index.
+Query: "${query}"
+Filters: org=${org || "any"}, project=${project || "any"}
+Limit: ${limit}
+
+To fetch documents, use codex_fetch with a specific URI like:
+codex://org/project/docs/file.md`;
+  return textResult(message);
+}
+async function handleList(args, ctx) {
+  const { org, project, includeExpired } = args;
+  const stats = await ctx.cache.getStats();
+  let message = `Cache Statistics:
+- Total entries: ${stats.entryCount}
+- Memory entries: ${stats.memoryEntries}
+- Memory size: ${formatBytes(stats.memorySize)}
+- Total size: ${formatBytes(stats.totalSize)}
+- Fresh: ${stats.freshCount}
+- Stale: ${stats.staleCount}
+- Expired: ${stats.expiredCount}`;
+  if (org) {
+    message += `
+
+Filtered by org: ${org}`;
+  }
+  if (project) {
+    message += `
+Filtered by project: ${project}`;
+  }
+  if (includeExpired) {
+    message += `
+Including expired entries`;
+  }
+  return textResult(message);
+}
+async function handleInvalidate(args, ctx) {
+  const { pattern } = args;
+  try {
+    const regex = new RegExp(pattern);
+    const count = await ctx.cache.invalidatePattern(regex);
+    return textResult(`Invalidated ${count} cache entries matching pattern: ${pattern}`);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return textResult(`Invalid pattern: ${message}`, true);
+  }
+}
+async function handleToolCall(name, args, ctx) {
+  switch (name) {
+    case "codex_fetch":
+      return handleFetch(args, ctx);
+    case "codex_search":
+      return handleSearch(args, ctx);
+    case "codex_list":
+      return handleList(args, ctx);
+    case "codex_invalidate":
+      return handleInvalidate(args, ctx);
+    default:
+      return textResult(`Unknown tool: ${name}`, true);
+  }
+}
+function formatBytes(bytes) {
+  if (bytes === 0) return "0 B";
+  const k = 1024;
+  const sizes = ["B", "KB", "MB", "GB"];
+  const i = Math.floor(Math.log(bytes) / Math.log(k));
+  return `${parseFloat((bytes / Math.pow(k, i)).toFixed(2))} ${sizes[i]}`;
+}
+
+// src/mcp/server.ts
+var McpServer = class {
+  config;
+  toolContext;
+  constructor(config) {
+    this.config = {
+      name: config.name ?? "codex",
+      version: config.version ?? "1.0.0",
+      cache: config.cache,
+      storage: config.storage
+    };
+    this.toolContext = {
+      cache: config.cache,
+      storage: config.storage
+    };
+  }
+  /**
+   * Get server info
+   */
+  getServerInfo() {
+    return {
+      name: this.config.name,
+      version: this.config.version,
+      capabilities: this.getCapabilities()
+    };
+  }
+  /**
+   * Get server capabilities
+   */
+  getCapabilities() {
+    return {
+      tools: {
+        listChanged: false
+      },
+      resources: {
+        subscribe: false,
+        listChanged: false
+      }
+    };
+  }
+  /**
+   * List available tools
+   */
+  listTools() {
+    return CODEX_TOOLS;
+  }
+  /**
+   * Call a tool
+   */
+  async callTool(name, args) {
+    return handleToolCall(name, args, this.toolContext);
+  }
+  /**
+   * List available resources
+   */
+  async listResources() {
+    const resources = [];
+    const stats = await this.config.cache.getStats();
+    resources.push({
+      uri: "codex://cache/summary",
+      name: "Cache Summary",
+      description: `${stats.entryCount} cached documents`,
+      mimeType: "text/plain"
+    });
+    return resources;
+  }
+  /**
+   * List resource templates
+   */
+  listResourceTemplates() {
+    return [
+      {
+        uriTemplate: "codex://{org}/{project}/{path}",
+        name: "Codex Document",
+        description: "Fetch a document from the Codex knowledge base",
+        mimeType: "text/markdown"
+      }
+    ];
+  }
+  /**
+   * Read a resource
+   */
+  async readResource(uri) {
+    if (uri === "codex://cache/summary") {
+      const stats = await this.config.cache.getStats();
+      return [
+        {
+          uri,
+          mimeType: "text/plain",
+          text: `Cache Statistics:
+- Total entries: ${stats.entryCount}
+- Memory entries: ${stats.memoryEntries}
+- Fresh: ${stats.freshCount}
+- Stale: ${stats.staleCount}
+- Expired: ${stats.expiredCount}`
+        }
+      ];
+    }
+    const ref = resolveReference(uri);
+    if (!ref) {
+      throw new Error(`Invalid codex URI: ${uri}`);
+    }
+    const result = await this.config.cache.get(ref);
+    return [
+      {
+        uri,
+        mimeType: result.contentType,
+        text: result.content.toString("utf-8")
+      }
+    ];
+  }
+  /**
+   * Handle JSON-RPC request
+   *
+   * This method handles the low-level MCP protocol messages.
+   */
+  async handleRequest(method, params) {
+    switch (method) {
+      case "initialize":
+        return {
+          protocolVersion: "2024-11-05",
+          serverInfo: this.getServerInfo(),
+          capabilities: this.getCapabilities()
+        };
+      case "tools/list":
+        return { tools: this.listTools() };
+      case "tools/call": {
+        const { name, arguments: args } = params;
+        return await this.callTool(name, args);
+      }
+      case "resources/list":
+        return { resources: await this.listResources() };
+      case "resources/templates/list":
+        return { resourceTemplates: this.listResourceTemplates() };
+      case "resources/read": {
+        const { uri } = params;
+        return { contents: await this.readResource(uri) };
+      }
+      case "prompts/list":
+        return { prompts: [] };
+      default:
+        throw new Error(`Unknown method: ${method}`);
+    }
+  }
+  /**
+   * Process a JSON-RPC message
+   */
+  async processMessage(message) {
+    let id = null;
+    try {
+      const request = JSON.parse(message);
+      id = request.id;
+      const { method, params } = request;
+      const result = await this.handleRequest(method, params);
+      return JSON.stringify({
+        jsonrpc: "2.0",
+        id,
+        result
+      });
+    } catch (error) {
+      const errorMessage = error instanceof Error ? error.message : String(error);
+      return JSON.stringify({
+        jsonrpc: "2.0",
+        id,
+        error: {
+          code: -32603,
+          message: errorMessage
+        }
+      });
+    }
+  }
+};
+function createMcpServer(config) {
+  return new McpServer(config);
+}
+
+// src/sync/types.ts
+var DEFAULT_SYNC_CONFIG = {
+  defaultDirection: "to-codex",
+  rules: [],
+  defaultExcludes: [
+    "**/node_modules/**",
+    "**/.git/**",
+    "**/.DS_Store",
+    "**/Thumbs.db",
+    "**/*.log",
+    "**/.env*",
+    "**/dist/**",
+    "**/build/**",
+    "**/coverage/**"
+  ],
+  deleteOrphans: false,
+  conflictStrategy: "newest"
+};
+function evaluatePath(path5, rules, direction, defaultExcludes = []) {
+  for (const pattern of defaultExcludes) {
+    if (micromatch2.isMatch(path5, pattern)) {
+      return {
+        path: path5,
+        shouldSync: false,
+        reason: `Excluded by default pattern: ${pattern}`
+      };
+    }
+  }
+  const sortedRules = [...rules].sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0));
+  for (const rule of sortedRules) {
+    if (rule.direction && rule.direction !== direction) {
+      continue;
+    }
+    if (micromatch2.isMatch(path5, rule.pattern)) {
+      return {
+        path: path5,
+        shouldSync: rule.include,
+        matchedRule: rule,
+        reason: rule.include ? `Included by rule: ${rule.pattern}` : `Excluded by rule: ${rule.pattern}`
+      };
+    }
+  }
+  return {
+    path: path5,
+    shouldSync: true,
+    reason: "No matching rule, included by default"
+  };
+}
+function evaluatePaths(paths, rules, direction, defaultExcludes = []) {
+  const results = /* @__PURE__ */ new Map();
+  for (const path5 of paths) {
+    results.set(path5, evaluatePath(path5, rules, direction, defaultExcludes));
+  }
+  return results;
+}
+function filterSyncablePaths(paths, rules, direction, defaultExcludes = []) {
+  return paths.filter(
+    (path5) => evaluatePath(path5, rules, direction, defaultExcludes).shouldSync
+  );
+}
+function createRulesFromPatterns(include = [], exclude = []) {
+  const rules = [];
+  for (const pattern of exclude) {
+    rules.push({
+      pattern,
+      include: false,
+      priority: 100
+    });
+  }
+  for (const pattern of include) {
+    rules.push({
+      pattern,
+      include: true,
+      priority: 50
+    });
+  }
+  return rules;
+}
+function mergeRules(...ruleSets) {
+  return ruleSets.flat();
+}
+function summarizeEvaluations(results) {
+  const summary = {
+    total: results.size,
+    included: 0,
+    excluded: 0,
+    byReason: {}
+  };
+  for (const result of results.values()) {
+    if (result.shouldSync) {
+      summary.included++;
+    } else {
+      summary.excluded++;
+    }
+    summary.byReason[result.reason] = (summary.byReason[result.reason] ?? 0) + 1;
+  }
+  return summary;
+}
+function validateRules(rules) {
+  const errors = [];
+  for (let i = 0; i < rules.length; i++) {
+    const rule = rules[i];
+    if (!rule) continue;
+    if (!rule.pattern || rule.pattern.trim() === "") {
+      errors.push(`Rule ${i}: pattern is empty`);
+      continue;
+    }
+    try {
+      micromatch2.isMatch("test", rule.pattern);
+    } catch {
+      errors.push(`Rule ${i}: invalid pattern "${rule.pattern}"`);
+    }
+    if (rule.direction && !["to-codex", "from-codex", "bidirectional"].includes(rule.direction)) {
+      errors.push(`Rule ${i}: invalid direction "${rule.direction}"`);
+    }
+  }
+  return errors;
+}
+
+// src/sync/planner.ts
+function createSyncPlan(sourceFiles, targetFiles, options, config) {
+  const direction = options.direction ?? config.defaultDirection;
+  const targetMap = new Map(targetFiles.map((f) => [f.path, f]));
+  const sourceMap = new Map(sourceFiles.map((f) => [f.path, f]));
+  const files = [];
+  const conflicts = [];
+  const skipped = [];
+  const rules = [
+    ...config.rules,
+    ...(options.include ?? []).map((p) => ({ pattern: p, include: true, priority: 200 })),
+    ...(options.exclude ?? []).map((p) => ({ pattern: p, include: false, priority: 200 }))
+  ];
+  const excludes = [...config.defaultExcludes];
+  for (const sourceFile of sourceFiles) {
+    const evaluation = evaluatePath(sourceFile.path, rules, direction, excludes);
+    if (!evaluation.shouldSync) {
+      skipped.push({
+        path: sourceFile.path,
+        operation: "skip",
+        size: sourceFile.size,
+        reason: evaluation.reason
+      });
+      continue;
+    }
+    const targetFile = targetMap.get(sourceFile.path);
+    if (!targetFile) {
+      files.push({
+        path: sourceFile.path,
+        operation: "create",
+        size: sourceFile.size,
+        mtime: sourceFile.mtime,
+        hash: sourceFile.hash
+      });
+    } else {
+      const isDifferent = sourceFile.hash !== targetFile.hash;
+      if (isDifferent) {
+        if (options.force) {
+          files.push({
+            path: sourceFile.path,
+            operation: "update",
+            size: sourceFile.size,
+            mtime: sourceFile.mtime,
+            hash: sourceFile.hash
+          });
+        } else if (targetFile.mtime > sourceFile.mtime) {
+          conflicts.push({
+            path: sourceFile.path,
+            operation: "conflict",
+            size: sourceFile.size,
+            mtime: sourceFile.mtime,
+            reason: "Target file is newer than source"
+          });
+        } else {
+          files.push({
+            path: sourceFile.path,
+            operation: "update",
+            size: sourceFile.size,
+            mtime: sourceFile.mtime,
+            hash: sourceFile.hash
+          });
+        }
+      } else {
+        skipped.push({
+          path: sourceFile.path,
+          operation: "skip",
+          size: sourceFile.size,
+          reason: "Files are identical"
+        });
+      }
+    }
+  }
+  if (options.delete) {
+    for (const targetFile of targetFiles) {
+      if (!sourceMap.has(targetFile.path)) {
+        const evaluation = evaluatePath(targetFile.path, rules, direction, excludes);
+        if (evaluation.shouldSync) {
+          files.push({
+            path: targetFile.path,
+            operation: "delete",
+            size: targetFile.size
+          });
+        }
+      }
+    }
+  }
+  let limitedFiles = files;
+  if (options.maxFiles && files.length > options.maxFiles) {
+    limitedFiles = files.slice(0, options.maxFiles);
+    for (const file of files.slice(options.maxFiles)) {
+      skipped.push({
+        ...file,
+        operation: "skip",
+        reason: "Exceeded max files limit"
+      });
+    }
+  }
+  const totalBytes = limitedFiles.reduce((sum, f) => sum + (f.size ?? 0), 0);
+  return {
+    direction,
+    source: direction === "from-codex" ? "codex" : "local",
+    target: direction === "from-codex" ? "local" : "codex",
+    files: limitedFiles,
+    totalFiles: limitedFiles.length,
+    totalBytes,
+    conflicts,
+    skipped
+  };
+}
+function estimateSyncTime(plan, bytesPerSecond = 1024 * 1024) {
+  const transferTime = plan.totalBytes / bytesPerSecond * 1e3;
+  const overheadPerFile = 50;
+  const overhead = plan.totalFiles * overheadPerFile;
+  return Math.ceil(transferTime + overhead);
+}
+function createEmptySyncPlan(direction = "to-codex") {
+  return {
+    direction,
+    source: direction === "from-codex" ? "codex" : "local",
+    target: direction === "from-codex" ? "local" : "codex",
+    files: [],
+    totalFiles: 0,
+    totalBytes: 0,
+    conflicts: [],
+    skipped: []
+  };
+}
+function filterPlanOperations(plan, operations) {
+  const filtered = plan.files.filter(
+    (f) => operations.includes(f.operation)
+  );
+  return {
+    ...plan,
+    files: filtered,
+    totalFiles: filtered.length,
+    totalBytes: filtered.reduce((sum, f) => sum + (f.size ?? 0), 0)
+  };
+}
+function getPlanStats(plan) {
+  return {
+    creates: plan.files.filter((f) => f.operation === "create").length,
+    updates: plan.files.filter((f) => f.operation === "update").length,
+    deletes: plan.files.filter((f) => f.operation === "delete").length,
+    skips: plan.skipped.length,
+    conflicts: plan.conflicts.length,
+    totalBytes: plan.totalBytes
+  };
+}
+function formatPlanSummary(plan) {
+  const stats = getPlanStats(plan);
+  const lines = [
+    `Sync Plan: ${plan.source} \u2192 ${plan.target}`,
+    `Direction: ${plan.direction}`,
+    "",
+    `Operations:`,
+    `  Create: ${stats.creates} files`,
+    `  Update: ${stats.updates} files`,
+    `  Delete: ${stats.deletes} files`,
+    `  Skip: ${stats.skips} files`,
+    ""
+  ];
+  if (stats.conflicts > 0) {
+    lines.push(`\u26A0\uFE0F Conflicts: ${stats.conflicts} files`);
+    lines.push("");
+  }
+  lines.push(`Total: ${plan.totalFiles} files (${formatBytes2(stats.totalBytes)})`);
+  return lines.join("\n");
+}
+function formatBytes2(bytes) {
+  if (bytes === 0) return "0 B";
+  const k = 1024;
+  const sizes = ["B", "KB", "MB", "GB"];
+  const i = Math.floor(Math.log(bytes) / Math.log(k));
+  return `${parseFloat((bytes / Math.pow(k, i)).toFixed(2))} ${sizes[i]}`;
+}
+
+// src/sync/manager.ts
+var SyncManager = class {
+  localStorage;
+  config;
+  manifestPath;
+  manifest = null;
+  constructor(options) {
+    this.localStorage = options.localStorage;
+    this.config = {
+      ...DEFAULT_SYNC_CONFIG,
+      ...options.config
+    };
+    this.manifestPath = options.manifestPath ?? ".fractary/codex-sync-manifest.json";
+  }
+  /**
+   * Load the sync manifest
+   */
+  async loadManifest() {
+    try {
+      const content = await this.localStorage.readText(this.manifestPath);
+      this.manifest = JSON.parse(content);
+      return this.manifest;
+    } catch {
+      return null;
+    }
+  }
+  /**
+   * Save the sync manifest
+   */
+  async saveManifest(manifest) {
+    this.manifest = manifest;
+    await this.localStorage.write(this.manifestPath, JSON.stringify(manifest, null, 2));
+  }
+  /**
+   * Get or create manifest
+   */
+  async getOrCreateManifest(org, project) {
+    let manifest = await this.loadManifest();
+    if (!manifest || manifest.org !== org || manifest.project !== project) {
+      manifest = {
+        version: 1,
+        org,
+        project,
+        lastSync: 0,
+        entries: {}
+      };
+    }
+    return manifest;
+  }
+  /**
+   * List local files
+   */
+  async listLocalFiles(directory) {
+    const files = await this.localStorage.list(directory);
+    const fileInfos = [];
+    for (const file of files) {
+      try {
+        const content = await this.localStorage.readText(file);
+        const buffer = Buffer.from(content);
+        fileInfos.push({
+          path: file,
+          size: buffer.length,
+          mtime: Date.now(),
+          // Would need fs.stat for real mtime
+          hash: calculateContentHash(buffer)
+        });
+      } catch {
+      }
+    }
+    return fileInfos;
+  }
+  /**
+   * Create a sync plan
+   *
+   * @param _org - Organization (reserved for future use)
+   * @param _project - Project (reserved for future use)
+   * @param sourceDir - Source directory to sync from
+   * @param targetFiles - Files currently in the target
+   * @param options - Sync options
+   */
+  async createPlan(_org, _project, sourceDir, targetFiles, options) {
+    const sourceFiles = await this.listLocalFiles(sourceDir);
+    const plan = createSyncPlan(
+      sourceFiles,
+      targetFiles,
+      options ?? {},
+      this.config
+    );
+    plan.estimatedTime = estimateSyncTime(plan);
+    return plan;
+  }
+  /**
+   * Execute a sync plan (dry run)
+   *
+   * In a real implementation, this would actually copy files.
+   * For the SDK, we provide the plan and let consumers execute.
+   */
+  async executePlan(plan, options) {
+    const startTime = Date.now();
+    const errors = [];
+    let synced = 0;
+    let failed = 0;
+    if (options?.dryRun) {
+      return {
+        success: true,
+        plan,
+        synced: plan.totalFiles,
+        failed: 0,
+        skipped: plan.skipped.length,
+        errors: [],
+        duration: Date.now() - startTime,
+        timestamp: Date.now()
+      };
+    }
+    for (let i = 0; i < plan.files.length; i++) {
+      const file = plan.files[i];
+      if (!file) continue;
+      try {
+        if (options?.onProgress) {
+          options.onProgress(i + 1, plan.totalFiles, file.path);
+        }
+        synced++;
+      } catch (error) {
+        failed++;
+        errors.push({
+          path: file.path,
+          error: error instanceof Error ? error.message : String(error)
+        });
+      }
+    }
+    return {
+      success: failed === 0,
+      plan,
+      synced,
+      failed,
+      skipped: plan.skipped.length,
+      errors,
+      duration: Date.now() - startTime,
+      timestamp: Date.now()
+    };
+  }
+  /**
+   * Update manifest after sync
+   */
+  async updateManifest(org, project, syncedFiles) {
+    const manifest = await this.getOrCreateManifest(org, project);
+    const now = Date.now();
+    for (const file of syncedFiles) {
+      if (file.operation === "delete") {
+        delete manifest.entries[file.path];
+      } else if (file.operation === "create" || file.operation === "update") {
+        manifest.entries[file.path] = {
+          path: file.path,
+          hash: file.hash ?? "",
+          size: file.size ?? 0,
+          syncedAt: now,
+          source: "local"
+        };
+      }
+    }
+    manifest.lastSync = now;
+    await this.saveManifest(manifest);
+  }
+  /**
+   * Get sync status for a file
+   */
+  async getFileStatus(path5) {
+    const manifest = await this.loadManifest();
+    return manifest?.entries[path5] ?? null;
+  }
+  /**
+   * Check if a file is synced
+   */
+  async isFileSynced(path5) {
+    const status = await this.getFileStatus(path5);
+    return status !== null;
+  }
+  /**
+   * Get last sync timestamp
+   */
+  async getLastSyncTime() {
+    const manifest = await this.loadManifest();
+    return manifest?.lastSync ?? null;
+  }
+  /**
+   * Clear sync manifest
+   */
+  async clearManifest() {
+    try {
+      await this.localStorage.delete(this.manifestPath);
+      this.manifest = null;
+    } catch {
+    }
+  }
+  /**
+   * Get sync configuration
+   */
+  getConfig() {
+    return { ...this.config };
+  }
+  /**
+   * Update sync configuration
+   */
+  updateConfig(updates) {
+    this.config = {
+      ...this.config,
+      ...updates
+    };
+  }
+};
+function createSyncManager(config) {
+  return new SyncManager(config);
+}
+
+// src/permissions/types.ts
+var DEFAULT_PERMISSION_CONFIG = {
+  defaultLevel: "read",
+  defaultAllow: true,
+  rules: [],
+  enforced: false
+};
+var PERMISSION_LEVEL_ORDER = ["none", "read", "write", "admin"];
+function levelGrants(granted, required) {
+  const grantedIndex = PERMISSION_LEVEL_ORDER.indexOf(granted);
+  const requiredIndex = PERMISSION_LEVEL_ORDER.indexOf(required);
+  return grantedIndex >= requiredIndex;
+}
+function maxLevel(a, b) {
+  const aIndex = PERMISSION_LEVEL_ORDER.indexOf(a);
+  const bIndex = PERMISSION_LEVEL_ORDER.indexOf(b);
+  return PERMISSION_LEVEL_ORDER[Math.max(aIndex, bIndex)] ?? "none";
+}
+function minLevel(a, b) {
+  const aIndex = PERMISSION_LEVEL_ORDER.indexOf(a);
+  const bIndex = PERMISSION_LEVEL_ORDER.indexOf(b);
+  return PERMISSION_LEVEL_ORDER[Math.min(aIndex, bIndex)] ?? "none";
+}
+function ruleMatchesContext(rule, context) {
+  if (rule.enabled === false) {
+    return false;
+  }
+  switch (rule.scope) {
+    case "org":
+      if (rule.org && context.org !== rule.org) {
+        return false;
+      }
+      break;
+    case "project":
+      if (rule.org && context.org !== rule.org) {
+        return false;
+      }
+      if (rule.project && context.project !== rule.project) {
+        return false;
+      }
+      break;
+  }
+  return true;
+}
+function ruleMatchesPath(rule, path5) {
+  return micromatch2.isMatch(path5, rule.pattern);
+}
+function ruleMatchesAction(rule, action) {
+  return rule.actions.includes(action);
+}
+function evaluatePermission(path5, action, context, config) {
+  const sortedRules = [...config.rules].sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0));
+  for (const rule of sortedRules) {
+    if (!ruleMatchesContext(rule, context)) {
+      continue;
+    }
+    if (!ruleMatchesPath(rule, path5)) {
+      continue;
+    }
+    if (!ruleMatchesAction(rule, action)) {
+      continue;
+    }
+    return {
+      allowed: rule.level !== "none",
+      level: rule.level,
+      matchedRule: rule,
+      reason: `Matched rule: ${rule.description ?? rule.pattern}`
+    };
+  }
+  return {
+    allowed: config.defaultAllow,
+    level: config.defaultLevel,
+    reason: config.defaultAllow ? "Allowed by default" : "Denied by default"
+  };
+}
+function isAllowed(path5, action, context, config) {
+  const result = evaluatePermission(path5, action, context, config);
+  return result.allowed;
+}
+function hasPermission(path5, action, requiredLevel, context, config) {
+  const result = evaluatePermission(path5, action, context, config);
+  return levelGrants(result.level, requiredLevel);
+}
+function evaluatePermissions(paths, action, context, config) {
+  const results = /* @__PURE__ */ new Map();
+  for (const path5 of paths) {
+    results.set(path5, evaluatePermission(path5, action, context, config));
+  }
+  return results;
+}
+function filterByPermission(paths, action, context, config, requiredLevel = "read") {
+  return paths.filter((path5) => {
+    const result = evaluatePermission(path5, action, context, config);
+    return levelGrants(result.level, requiredLevel);
+  });
+}
+function validateRules2(rules) {
+  const errors = [];
+  for (let i = 0; i < rules.length; i++) {
+    const rule = rules[i];
+    if (!rule) continue;
+    if (!rule.pattern || rule.pattern.trim() === "") {
+      errors.push(`Rule ${i}: pattern is empty`);
+      continue;
+    }
+    try {
+      micromatch2.isMatch("test", rule.pattern);
+    } catch {
+      errors.push(`Rule ${i}: invalid pattern "${rule.pattern}"`);
+    }
+    if (!rule.actions || rule.actions.length === 0) {
+      errors.push(`Rule ${i}: actions are empty`);
+    }
+    if (rule.scope === "org" && !rule.org) {
+      errors.push(`Rule ${i}: org scope requires org field`);
+    }
+    if (rule.scope === "project" && !rule.project) {
+      errors.push(`Rule ${i}: project scope requires project field`);
+    }
+  }
+  return errors;
+}
+function createRule(options) {
+  return {
+    pattern: options.pattern,
+    actions: options.actions,
+    level: options.level,
+    scope: options.scope ?? "global",
+    org: options.org,
+    project: options.project,
+    priority: options.priority ?? 0,
+    description: options.description,
+    enabled: true
+  };
+}
+var CommonRules = {
+  /** Allow all actions for docs */
+  allowDocs: () => createRule({
+    pattern: "docs/**",
+    actions: ["fetch", "cache", "sync"],
+    level: "read",
+    description: "Allow read access to docs"
+  }),
+  /** Deny access to private files */
+  denyPrivate: () => createRule({
+    pattern: "**/.private/**",
+    actions: ["fetch", "cache", "sync"],
+    level: "none",
+    priority: 100,
+    description: "Deny access to private files"
+  }),
+  /** Read-only access to specs */
+  readOnlySpecs: () => createRule({
+    pattern: "specs/**",
+    actions: ["fetch", "cache"],
+    level: "read",
+    description: "Read-only access to specs"
+  }),
+  /** Admin access for management */
+  adminManage: () => createRule({
+    pattern: "**",
+    actions: ["manage", "invalidate"],
+    level: "admin",
+    description: "Admin access for management operations"
+  })
+};
+
+// src/permissions/manager.ts
+var PermissionManager = class {
+  config;
+  defaultContext;
+  constructor(options = {}) {
+    this.config = {
+      ...DEFAULT_PERMISSION_CONFIG,
+      ...options.config,
+      // Create a new rules array to avoid shared state
+      rules: options.config?.rules ? [...options.config.rules] : []
+    };
+    this.defaultContext = options.defaultContext ?? {};
+  }
+  /**
+   * Check if an action is allowed for a path
+   */
+  isAllowed(path5, action, context) {
+    const result = this.evaluate(path5, action, context);
+    return result.allowed;
+  }
+  /**
+   * Check if a permission level is granted
+   */
+  hasPermission(path5, action, requiredLevel, context) {
+    const result = this.evaluate(path5, action, context);
+    return levelGrants(result.level, requiredLevel);
+  }
+  /**
+   * Evaluate permission for a path and action
+   */
+  evaluate(path5, action, context) {
+    const mergedContext = { ...this.defaultContext, ...context };
+    if (!this.config.enforced) {
+      return {
+        allowed: true,
+        level: "admin",
+        reason: "Permissions not enforced"
+      };
+    }
+    return evaluatePermission(path5, action, mergedContext, this.config);
+  }
+  /**
+   * Filter paths by permission
+   */
+  filterAllowed(paths, action, context, requiredLevel = "read") {
+    const mergedContext = { ...this.defaultContext, ...context };
+    if (!this.config.enforced) {
+      return paths;
+    }
+    return filterByPermission(paths, action, mergedContext, this.config, requiredLevel);
+  }
+  /**
+   * Add a permission rule
+   */
+  addRule(rule) {
+    const errors = validateRules2([rule]);
+    if (errors.length > 0) {
+      throw new Error(`Invalid rule: ${errors.join(", ")}`);
+    }
+    this.config.rules.push(rule);
+  }
+  /**
+   * Remove a permission rule by ID
+   */
+  removeRule(id) {
+    const index = this.config.rules.findIndex((r) => r.id === id);
+    if (index === -1) {
+      return false;
+    }
+    this.config.rules.splice(index, 1);
+    return true;
+  }
+  /**
+   * Get all rules
+   */
+  getRules() {
+    return [...this.config.rules];
+  }
+  /**
+   * Clear all rules
+   */
+  clearRules() {
+    this.config.rules = [];
+  }
+  /**
+   * Set rules (replace all)
+   */
+  setRules(rules) {
+    const errors = validateRules2(rules);
+    if (errors.length > 0) {
+      throw new Error(`Invalid rules: ${errors.join(", ")}`);
+    }
+    this.config.rules = [...rules];
+  }
+  /**
+   * Get configuration
+   */
+  getConfig() {
+    return { ...this.config, rules: [...this.config.rules] };
+  }
+  /**
+   * Update configuration
+   */
+  updateConfig(updates) {
+    this.config = {
+      ...this.config,
+      ...updates
+    };
+  }
+  /**
+   * Set default context
+   */
+  setDefaultContext(context) {
+    this.defaultContext = { ...context };
+  }
+  /**
+   * Get default context
+   */
+  getDefaultContext() {
+    return { ...this.defaultContext };
+  }
+  /**
+   * Enable permission enforcement
+   */
+  enable() {
+    this.config.enforced = true;
+  }
+  /**
+   * Disable permission enforcement
+   */
+  disable() {
+    this.config.enforced = false;
+  }
+  /**
+   * Check if permissions are enforced
+   */
+  isEnforced() {
+    return this.config.enforced;
+  }
+  /**
+   * Assert permission (throws if denied)
+   */
+  assertPermission(path5, action, requiredLevel = "read", context) {
+    const result = this.evaluate(path5, action, context);
+    if (!levelGrants(result.level, requiredLevel)) {
+      throw new PermissionDeniedError(
+        `Permission denied for ${action} on ${path5}: ${result.reason}`,
+        path5,
+        action,
+        result
+      );
+    }
+  }
+};
+var PermissionDeniedError = class extends Error {
+  constructor(message, path5, action, result) {
+    super(message);
+    this.path = path5;
+    this.action = action;
+    this.result = result;
+    this.name = "PermissionDeniedError";
+  }
+};
+function createPermissionManager(config) {
+  return new PermissionManager(config);
+}
+var defaultManager2 = null;
+function getDefaultPermissionManager() {
+  if (!defaultManager2) {
+    defaultManager2 = createPermissionManager();
+  }
+  return defaultManager2;
+}
+function setDefaultPermissionManager(manager) {
+  defaultManager2 = manager;
+}
+
+// src/migration/detector.ts
+function detectVersion(config) {
+  if (!config || typeof config !== "object") {
+    return {
+      version: "unknown",
+      confidence: "high",
+      reason: "Invalid configuration object"
+    };
+  }
+  const obj = config;
+  if (obj.version === "3.0") {
+    return {
+      version: "3.0",
+      confidence: "high",
+      reason: "Explicit version field found"
+    };
+  }
+  if (isModernConfig(config)) {
+    return {
+      version: "3.0",
+      confidence: "medium",
+      reason: "Modern structure detected (organization object, sync.patterns)"
+    };
+  }
+  if (isLegacyConfig(config)) {
+    return {
+      version: "2.x",
+      confidence: "high",
+      reason: "Legacy structure detected (org/defaultOrg/codexRepo at top level)"
+    };
+  }
+  const knownFields = [
+    "org",
+    "defaultOrg",
+    "codexRepo",
+    "autoSync",
+    "syncRules",
+    "organization",
+    "sync",
+    "cache"
+  ];
+  const hasKnownFields = knownFields.some((field) => field in obj);
+  if (hasKnownFields) {
+    return {
+      version: "2.x",
+      confidence: "low",
+      reason: "Some known fields found, assuming v2.x"
+    };
+  }
+  return {
+    version: "unknown",
+    confidence: "high",
+    reason: "No recognizable configuration structure"
+  };
+}
+function isModernConfig(config) {
+  if (!config || typeof config !== "object") {
+    return false;
+  }
+  const obj = config;
+  if (!obj.organization || typeof obj.organization !== "object") {
+    return false;
+  }
+  const org = obj.organization;
+  if (typeof org.name !== "string" || typeof org.codexRepo !== "string") {
+    return false;
+  }
+  if (!obj.sync || typeof obj.sync !== "object") {
+    return false;
+  }
+  const sync = obj.sync;
+  if (!Array.isArray(sync.patterns)) {
+    return false;
+  }
+  return true;
+}
+function isLegacyConfig(config) {
+  if (!config || typeof config !== "object") {
+    return false;
+  }
+  const obj = config;
+  const legacyMarkers = ["org", "defaultOrg", "codexRepo", "codexPath"];
+  const hasLegacyMarker = legacyMarkers.some(
+    (marker) => marker in obj && typeof obj[marker] === "string"
+  );
+  if (hasLegacyMarker) {
+    return true;
+  }
+  if (Array.isArray(obj.autoSync)) {
+    return true;
+  }
+  if (obj.syncRules && typeof obj.syncRules === "object") {
+    const syncRules = obj.syncRules;
+    if (Array.isArray(syncRules.include) || Array.isArray(syncRules.exclude)) {
+      return true;
+    }
+  }
+  return false;
+}
+function needsMigration(config) {
+  const detection = detectVersion(config);
+  return detection.version === "2.x";
+}
+function getMigrationRequirements(config) {
+  const requirements = [];
+  if (!config || typeof config !== "object") {
+    requirements.push("Valid configuration object required");
+    return requirements;
+  }
+  const obj = config;
+  if (!obj.org && !obj.defaultOrg) {
+    requirements.push("Organization name is required (org or defaultOrg)");
+  }
+  if (!obj.codexRepo && !obj.codexPath) {
+    requirements.push("Codex repository name is required (codexRepo or codexPath)");
+  }
+  return requirements;
+}
+
+// src/migration/migrator.ts
+var DEFAULT_MIGRATION_OPTIONS = {
+  preserveUnknown: false,
+  strict: false,
+  defaultOrg: "organization",
+  defaultCodexRepo: "codex"
+};
+function migrateConfig(config, options = {}) {
+  const mergedOptions = { ...DEFAULT_MIGRATION_OPTIONS, ...options };
+  const result = {
+    success: false,
+    warnings: [],
+    errors: [],
+    changes: []
+  };
+  const detection = detectVersion(config);
+  if (detection.version === "3.0") {
+    if (isModernConfig(config)) {
+      result.success = true;
+      result.config = config;
+      result.warnings.push("Configuration is already v3.0, no migration needed");
+      return result;
+    }
+  }
+  if (detection.version === "unknown") {
+    result.errors.push(`Cannot migrate: ${detection.reason}`);
+    return result;
+  }
+  if (!isLegacyConfig(config)) {
+    result.errors.push("Configuration does not match expected v2.x format");
+    return result;
+  }
+  try {
+    const migrated = performMigration(config, mergedOptions, result);
+    result.config = migrated;
+    result.success = true;
+  } catch (error) {
+    result.errors.push(
+      `Migration failed: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  return result;
+}
+function performMigration(legacy, options, result) {
+  const orgName = legacy.org || legacy.defaultOrg || options.defaultOrg;
+  if (legacy.org && legacy.defaultOrg && legacy.org !== legacy.defaultOrg) {
+    result.warnings.push(
+      `Both 'org' and 'defaultOrg' specified with different values. Using 'org': ${legacy.org}`
+    );
+  }
+  if (!legacy.org && !legacy.defaultOrg) {
+    result.changes.push({
+      type: "added",
+      path: "organization.name",
+      newValue: orgName,
+      description: `Added default organization name: ${orgName}`
+    });
+  } else {
+    const fieldUsed = legacy.org ? "org" : "defaultOrg";
+    result.changes.push({
+      type: "renamed",
+      path: "organization.name",
+      oldValue: fieldUsed,
+      newValue: "organization.name",
+      description: `Renamed '${fieldUsed}' to 'organization.name'`
+    });
+  }
+  const codexRepo = legacy.codexRepo || legacy.codexPath || options.defaultCodexRepo;
+  if (legacy.codexRepo && legacy.codexPath && legacy.codexRepo !== legacy.codexPath) {
+    result.warnings.push(
+      `Both 'codexRepo' and 'codexPath' specified with different values. Using 'codexRepo': ${legacy.codexRepo}`
+    );
+  }
+  if (!legacy.codexRepo && !legacy.codexPath) {
+    result.changes.push({
+      type: "added",
+      path: "organization.codexRepo",
+      newValue: codexRepo,
+      description: `Added default codex repository: ${codexRepo}`
+    });
+  } else {
+    const fieldUsed = legacy.codexRepo ? "codexRepo" : "codexPath";
+    result.changes.push({
+      type: "renamed",
+      path: "organization.codexRepo",
+      oldValue: fieldUsed,
+      newValue: "organization.codexRepo",
+      description: `Renamed '${fieldUsed}' to 'organization.codexRepo'`
+    });
+  }
+  const patterns = [];
+  if (legacy.autoSync && legacy.autoSync.length > 0) {
+    for (const legacyPattern of legacy.autoSync) {
+      const modernPattern = migrateSyncPattern(legacyPattern, result);
+      patterns.push(modernPattern);
+    }
+    result.changes.push({
+      type: "transformed",
+      path: "sync.patterns",
+      oldValue: "autoSync",
+      newValue: "sync.patterns",
+      description: `Converted ${legacy.autoSync.length} auto-sync pattern(s) to modern format`
+    });
+  }
+  const include = [];
+  const exclude = [];
+  if (legacy.syncRules) {
+    if (legacy.syncRules.include) {
+      include.push(...legacy.syncRules.include);
+      result.changes.push({
+        type: "renamed",
+        path: "sync.include",
+        oldValue: "syncRules.include",
+        newValue: "sync.include",
+        description: "Moved syncRules.include to sync.include"
+      });
+    }
+    if (legacy.syncRules.exclude) {
+      exclude.push(...legacy.syncRules.exclude);
+      result.changes.push({
+        type: "renamed",
+        path: "sync.exclude",
+        oldValue: "syncRules.exclude",
+        newValue: "sync.exclude",
+        description: "Moved syncRules.exclude to sync.exclude"
+      });
+    }
+  }
+  const modern = {
+    version: "3.0",
+    organization: {
+      name: orgName,
+      codexRepo
+    },
+    sync: {
+      patterns,
+      include,
+      exclude,
+      defaultDirection: "to-codex"
+    }
+  };
+  if (legacy.environments) {
+    modern.environments = {};
+    for (const [envName, envConfig] of Object.entries(legacy.environments)) {
+      const envResult = {
+        success: false,
+        warnings: [],
+        errors: [],
+        changes: []
+      };
+      try {
+        const migratedEnv = performMigration(
+          { ...legacy, ...envConfig },
+          { ...options },
+          envResult
+        );
+        modern.environments[envName] = {
+          organization: migratedEnv.organization,
+          sync: migratedEnv.sync
+        };
+        result.changes.push({
+          type: "transformed",
+          path: `environments.${envName}`,
+          description: `Migrated environment '${envName}'`
+        });
+        result.warnings.push(...envResult.warnings.map((w) => `[${envName}] ${w}`));
+      } catch {
+        result.warnings.push(`Failed to migrate environment '${envName}', skipping`);
+      }
+    }
+  }
+  result.changes.push({
+    type: "added",
+    path: "version",
+    newValue: "3.0",
+    description: "Added version field"
+  });
+  return modern;
+}
+function migrateSyncPattern(legacy, result) {
+  const modern = {
+    pattern: legacy.pattern
+  };
+  if (legacy.destination) {
+    modern.target = legacy.destination;
+  }
+  if (legacy.bidirectional) {
+    modern.direction = "bidirectional";
+  }
+  if (legacy.targets && legacy.targets.length > 0) {
+    result.warnings.push(
+      `Pattern '${legacy.pattern}' had multiple targets (${legacy.targets.join(", ")}). In v3.0, each target should be a separate pattern.`
+    );
+    if (!modern.target && legacy.targets[0]) {
+      modern.target = legacy.targets[0];
+    }
+  }
+  return modern;
+}
+function validateMigratedConfig(config) {
+  const errors = [];
+  if (config.version !== "3.0") {
+    errors.push(`Invalid version: ${config.version}, expected '3.0'`);
+  }
+  if (!config.organization) {
+    errors.push("Missing organization configuration");
+  } else {
+    if (!config.organization.name) {
+      errors.push("Missing organization.name");
+    }
+    if (!config.organization.codexRepo) {
+      errors.push("Missing organization.codexRepo");
+    }
+  }
+  if (!config.sync) {
+    errors.push("Missing sync configuration");
+  } else {
+    if (!Array.isArray(config.sync.patterns)) {
+      errors.push("sync.patterns must be an array");
+    }
+    if (!Array.isArray(config.sync.include)) {
+      errors.push("sync.include must be an array");
+    }
+    if (!Array.isArray(config.sync.exclude)) {
+      errors.push("sync.exclude must be an array");
+    }
+  }
+  return errors;
+}
+function generateMigrationReport(result) {
+  const lines = ["# Migration Report", ""];
+  if (result.success) {
+    lines.push("Status: SUCCESS");
+  } else {
+    lines.push("Status: FAILED");
+  }
+  lines.push("");
+  if (result.changes.length > 0) {
+    lines.push("## Changes", "");
+    for (const change of result.changes) {
+      lines.push(`- [${change.type.toUpperCase()}] ${change.path}: ${change.description}`);
+    }
+    lines.push("");
+  }
+  if (result.warnings.length > 0) {
+    lines.push("## Warnings", "");
+    for (const warning of result.warnings) {
+      lines.push(`- ${warning}`);
+    }
+    lines.push("");
+  }
+  if (result.errors.length > 0) {
+    lines.push("## Errors", "");
+    for (const error of result.errors) {
+      lines.push(`- ${error}`);
+    }
+    lines.push("");
+  }
+  return lines.join("\n");
+}
+function createEmptyModernConfig(org, codexRepo) {
+  return {
+    version: "3.0",
+    organization: {
+      name: org,
+      codexRepo
+    },
+    sync: {
+      patterns: [],
+      include: ["**/*.md", "CLAUDE.md"],
+      exclude: ["**/node_modules/**", "**/.git/**"],
+      defaultDirection: "to-codex"
+    }
+  };
+}
+
+// src/migration/references.ts
+var LEGACY_PATTERNS = {
+  /** @codex: style references */
+  CODEX_TAG: /@codex:\s*([^\s\]]+)/g,
+  /** [codex:...] style references */
+  CODEX_BRACKET: /\[codex:\s*([^\]]+)\]/g,
+  /** {{codex:...}} style references */
+  CODEX_MUSTACHE: /\{\{codex:\s*([^}]+)\}\}/g,
+  /** Simple path references in specific contexts */
+  SIMPLE_PATH: /codex\/([a-zA-Z0-9_-]+\/[a-zA-Z0-9_\-/.]+)/g
+};
+function convertLegacyReferences(text, options = {}) {
+  const result = {
+    original: text,
+    converted: text,
+    references: [],
+    modified: false
+  };
+  result.converted = processPattern(
+    result.converted,
+    LEGACY_PATTERNS.CODEX_TAG,
+    "codex-tag",
+    options,
+    result.references
+  );
+  result.converted = processPattern(
+    result.converted,
+    LEGACY_PATTERNS.CODEX_BRACKET,
+    "codex-bracket",
+    options,
+    result.references
+  );
+  result.converted = processPattern(
+    result.converted,
+    LEGACY_PATTERNS.CODEX_MUSTACHE,
+    "codex-mustache",
+    options,
+    result.references
+  );
+  result.converted = processPattern(
+    result.converted,
+    LEGACY_PATTERNS.SIMPLE_PATH,
+    "simple-path",
+    options,
+    result.references
+  );
+  result.modified = result.original !== result.converted;
+  return result;
+}
+function processPattern(text, pattern, format, options, references) {
+  pattern.lastIndex = 0;
+  return text.replace(pattern, (match, captured, offset) => {
+    const uri = convertToUri(captured.trim(), options);
+    references.push({
+      original: match,
+      uri,
+      position: offset,
+      format
+    });
+    if (options.preserveWrapper) {
+      switch (format) {
+        case "codex-tag":
+          return `@codex: ${uri}`;
+        case "codex-bracket":
+          return `[${uri}]`;
+        case "codex-mustache":
+          return `{{${uri}}}`;
+        case "simple-path":
+          return uri;
+      }
+    }
+    return uri;
+  });
+}
+function convertToUri(reference, options = {}) {
+  const trimmed = reference.trim();
+  if (trimmed.startsWith("codex://")) {
+    return trimmed;
+  }
+  const parts = parseReference2(trimmed);
+  const org = parts.org || options.defaultOrg || "_";
+  const project = parts.project || options.defaultProject || "_";
+  const path5 = parts.path;
+  return `codex://${org}/${project}/${path5}`;
+}
+function parseReference2(reference) {
+  const trimmed = reference.trim();
+  if (trimmed.startsWith("./") || trimmed.startsWith("../")) {
+    return { path: trimmed };
+  }
+  const parts = trimmed.split("/");
+  if (parts.length >= 3) {
+    const [org, project, ...rest] = parts;
+    return {
+      org: org || void 0,
+      project: project || void 0,
+      path: rest.join("/")
+    };
+  }
+  if (parts.length === 2) {
+    return { path: trimmed };
+  }
+  return { path: trimmed };
+}
+function findLegacyReferences(text) {
+  const references = [];
+  for (const [name, pattern] of Object.entries(LEGACY_PATTERNS)) {
+    pattern.lastIndex = 0;
+    let match;
+    while ((match = pattern.exec(text)) !== null) {
+      const format = name.toLowerCase().replace("_", "-");
+      references.push({
+        original: match[0],
+        uri: match[1] || "",
+        position: match.index,
+        format
+      });
+    }
+  }
+  references.sort((a, b) => a.position - b.position);
+  return references;
+}
+function hasLegacyReferences(text) {
+  for (const pattern of Object.values(LEGACY_PATTERNS)) {
+    pattern.lastIndex = 0;
+    if (pattern.test(text)) {
+      return true;
+    }
+  }
+  return false;
+}
+function migrateFileReferences(content, options = {}) {
+  return convertLegacyReferences(content, options);
+}
+function generateReferenceMigrationSummary(results) {
+  const lines = ["# Reference Migration Summary", ""];
+  let totalRefs = 0;
+  let modifiedFiles = 0;
+  for (const result of results) {
+    if (result.modified) {
+      modifiedFiles++;
+    }
+    totalRefs += result.references.length;
+  }
+  lines.push(`- Total files processed: ${results.length}`);
+  lines.push(`- Files with changes: ${modifiedFiles}`);
+  lines.push(`- Total references converted: ${totalRefs}`);
+  lines.push("");
+  const byFormat = /* @__PURE__ */ new Map();
+  for (const result of results) {
+    for (const ref of result.references) {
+      byFormat.set(ref.format, (byFormat.get(ref.format) || 0) + 1);
+    }
+  }
+  if (byFormat.size > 0) {
+    lines.push("## References by Format", "");
+    for (const [format, count] of byFormat.entries()) {
+      lines.push(`- ${format}: ${count}`);
+    }
+  }
+  return lines.join("\n");
+}
+
+export { AutoSyncPatternSchema, BUILT_IN_TYPES, CODEX_TOOLS, CODEX_URI_PREFIX, CacheManager, CachePersistence, CodexConfigSchema, CodexError, CommonRules, ConfigurationError, CustomTypeSchema, DEFAULT_CACHE_DIR, DEFAULT_FETCH_OPTIONS, DEFAULT_MIGRATION_OPTIONS, DEFAULT_PERMISSION_CONFIG, DEFAULT_SYNC_CONFIG, DEFAULT_TYPE, GitHubStorage, HttpStorage, LEGACY_PATTERNS, LEGACY_REF_PREFIX, LocalStorage, McpServer, MetadataSchema, PERMISSION_LEVEL_ORDER, PermissionDeniedError, PermissionManager, StorageManager, SyncManager, SyncRulesSchema, TTL, TypeRegistry, TypesConfigSchema, ValidationError, buildUri, calculateCachePath, calculateContentHash, convertLegacyReference, convertLegacyReferences, convertToUri, createCacheEntry, createCacheManager, createCachePersistence, createDefaultRegistry, createEmptyModernConfig, createEmptySyncPlan, createGitHubStorage, createHttpStorage, createLocalStorage, createMcpServer, createPermissionManager, createRule, createRulesFromPatterns, createStorageManager, createSyncManager, createSyncPlan, deserializeCacheEntry, detectContentType, detectCurrentProject, detectVersion, estimateSyncTime, evaluatePath, evaluatePaths, evaluatePatterns, evaluatePermission, evaluatePermissions, extendType, extractOrgFromRepoName, extractRawFrontmatter, filterByPatterns, filterByPermission, filterPlanOperations, filterSyncablePaths, findLegacyReferences, formatPlanSummary, generateMigrationReport, generateReferenceMigrationSummary, getBuiltInType, getBuiltInTypeNames, getCacheEntryAge, getCacheEntryStatus, getCurrentContext, getCustomSyncDestinations, getDefaultCacheManager, getDefaultConfig, getDefaultDirectories, getDefaultPermissionManager, getDefaultRules, getDefaultStorageManager, getDirectory, getExtension, getFilename, getMigrationRequirements, getPlanStats, getRelativeCachePath, getRemainingTtl, getTargetRepos, handleFetch, handleInvalidate, handleList, handleSearch, handleToolCall, hasContentChanged, hasFrontmatter, hasLegacyReferences, hasPermission as hasPermissionLevel, isBuiltInType, isCacheEntryFresh, isCacheEntryValid, isCurrentProjectUri, isLegacyConfig, isLegacyReference, isModernConfig, isAllowed as isPermissionAllowed, isValidUri, levelGrants, loadConfig, loadCustomTypes, matchAnyPattern, matchPattern, maxLevel, mergeFetchOptions, mergeRules, mergeTypes, migrateConfig, migrateFileReferences, minLevel, needsMigration, parseCustomDestination, parseMetadata, parseReference, parseTtl, resolveOrganization, resolveReference, resolveReferences, ruleMatchesAction, ruleMatchesContext, ruleMatchesPath, sanitizePath, serializeCacheEntry, setDefaultCacheManager, setDefaultPermissionManager, setDefaultStorageManager, shouldSyncToRepo, summarizeEvaluations, touchCacheEntry, validateCustomTypes, validateMetadata, validateMigratedConfig, validateOrg, validatePath, validateRules2 as validatePermissionRules, validateProject, validateRules, validateUri };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map