@danmoisan/drm-copilot-mcp 1.1.15 → 1.1.17

package/out/mcp-server.js

@@ -1146,9 +1146,9 @@ var require_util = __commonJS({
       }
     }
     exports2.eachItem = eachItem;
-    function makeMergeEvaluated({ mergeNames, mergeToName, mergeValues: mergeValues2, resultToName }) {
+    function makeMergeEvaluated({ mergeNames, mergeToName, mergeValues: mergeValues3, resultToName }) {
       return (gen, from, to, toName) => {
-        const res = to === void 0 ? from : to instanceof codegen_1.Name ? (from instanceof codegen_1.Name ? mergeNames(gen, from, to) : mergeToName(gen, from, to), to) : from instanceof codegen_1.Name ? (mergeToName(gen, to, from), from) : mergeValues2(from, to);
+        const res = to === void 0 ? from : to instanceof codegen_1.Name ? (from instanceof codegen_1.Name ? mergeNames(gen, from, to) : mergeToName(gen, from, to), to) : from instanceof codegen_1.Name ? (mergeToName(gen, to, from), from) : mergeValues3(from, to);
         return toName === codegen_1.Name && !(res instanceof codegen_1.Name) ? resultToName(gen, res) : res;
       };
     }
@@ -19984,6 +19984,237 @@ var BlastRadiusDeriveFileSystem = class {
   }
 };
 
+// ../../extensions/drm-copilot/src/lib/push-down/claude-blast-radius-overlay.ts
+var BLAST_RADIUS_OVERLAY_RELATIVE_PATH = "config/blast-radius.local.json";
+var STRING_LIST_KEYS = /* @__PURE__ */ new Set([
+  "shared_surfaces",
+  "shared_surface_globs",
+  "mandate_reads",
+  "mergeable_paths",
+  "path_roots"
+]);
+var MODULES_KEY = "modules";
+var VERSION_KEY = "version";
+var BlastRadiusOverlayError = class extends Error {
+  /** Relative path of the document that could not be composed. */
+  path;
+  /**
+   * @param path Relative path of the offending document.
+   * @param detail Reason appended to the message.
+   */
+  constructor(path16, detail) {
+    super(
+      `Blast-radius overlay ${path16} was not applied; ${BLAST_RADIUS_RELATIVE_PATH} was not written: ${detail}`
+    );
+    this.name = "BlastRadiusOverlayError";
+    this.path = path16;
+  }
+};
+function isJsonObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function isStringList(value) {
+  return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+function parseObject(text2, path16) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text2);
+  } catch (error2) {
+    const detail = error2 instanceof Error ? error2.message : String(error2);
+    throw new BlastRadiusOverlayError(path16, `not valid JSON (${detail})`);
+  }
+  if (!isJsonObject(parsed)) {
+    throw new BlastRadiusOverlayError(
+      path16,
+      "document root is not a JSON object"
+    );
+  }
+  return parsed;
+}
+function unionStrings(base, overlay) {
+  const composed = [...base];
+  const seen = new Set(base.filter((item) => typeof item === "string"));
+  for (const item of overlay) {
+    if (!seen.has(item)) {
+      seen.add(item);
+      composed.push(item);
+    }
+  }
+  return composed;
+}
+function composeStringList(key, base, overlay, overlayPath) {
+  if (!isStringList(overlay)) {
+    throw new BlastRadiusOverlayError(
+      overlayPath,
+      `key "${key}" must be a list of strings`
+    );
+  }
+  return unionStrings(Array.isArray(base) ? base : [], overlay);
+}
+function composeModules(base, overlay, overlayPath) {
+  if (!isJsonObject(overlay) || !Object.values(overlay).every((globs) => isStringList(globs))) {
+    throw new BlastRadiusOverlayError(
+      overlayPath,
+      `key "${MODULES_KEY}" must map module names to lists of strings`
+    );
+  }
+  const merged = { ...isJsonObject(base) ? base : {} };
+  for (const [name, globs] of Object.entries(overlay)) {
+    merged[name] = globs;
+  }
+  const composed = {};
+  for (const name of Object.keys(merged).sort(compareOrdinal)) {
+    const globs = merged[name] ?? [];
+    composed[name] = globs;
+    for (const glob of Array.isArray(globs) ? globs : []) {
+      if (typeof glob === "string" && FORBIDDEN_GLOBS.includes(glob)) {
+        throw new BlastRadiusGuardError(name, glob);
+      }
+    }
+  }
+  return composed;
+}
+function mergeValues2(base, overlay, dottedKey, overlayPath) {
+  if (isJsonObject(base) && isJsonObject(overlay)) {
+    const merged = {};
+    for (const [key, value] of Object.entries(base)) {
+      const overlayValue = overlay[key];
+      merged[key] = overlayValue === void 0 ? value : mergeValues2(
+        value,
+        overlayValue,
+        `${dottedKey}.${key}`,
+        overlayPath
+      );
+    }
+    for (const [key, value] of Object.entries(overlay)) {
+      if (!(key in merged)) {
+        merged[key] = value;
+      }
+    }
+    return merged;
+  }
+  if (Array.isArray(base) && Array.isArray(overlay)) {
+    if (!isStringList(overlay)) {
+      throw new BlastRadiusOverlayError(
+        overlayPath,
+        `key "${dottedKey}" must be a list of strings`
+      );
+    }
+    return unionStrings(base, overlay);
+  }
+  return overlay;
+}
+function composeKey(key, base, overlay, overlayPath) {
+  if (STRING_LIST_KEYS.has(key)) {
+    return composeStringList(key, base, overlay, overlayPath);
+  }
+  if (key === MODULES_KEY) {
+    return composeModules(base, overlay, overlayPath);
+  }
+  return base === void 0 ? overlay : mergeValues2(base, overlay, key, overlayPath);
+}
+function composeBlastRadiusOverlay(baseText, overlayText, overlayPath) {
+  if (overlayText === null) {
+    return baseText;
+  }
+  const overlay = parseObject(overlayText, overlayPath);
+  const base = parseObject(baseText, BLAST_RADIUS_RELATIVE_PATH);
+  if (VERSION_KEY in overlay && overlay[VERSION_KEY] !== base[VERSION_KEY]) {
+    throw new BlastRadiusOverlayError(
+      overlayPath,
+      `key "${VERSION_KEY}" does not match the base version`
+    );
+  }
+  const composed = {};
+  for (const [key, value] of Object.entries(base)) {
+    const overlayValue = overlay[key];
+    composed[key] = key === VERSION_KEY || overlayValue === void 0 ? value : composeKey(key, value, overlayValue, overlayPath);
+  }
+  for (const [key, value] of Object.entries(overlay)) {
+    if (!(key in composed)) {
+      composed[key] = composeKey(key, void 0, value, overlayPath);
+    }
+  }
+  return `${JSON.stringify(composed, null, 2)}
+`;
+}
+function normalizePosix6(value) {
+  return value.replace(/\\/g, "/").replace(/\/+$/, "");
+}
+function relativeToPosix6(path16, root) {
+  const normalizedPath = normalizePosix6(path16);
+  const normalizedRoot = normalizePosix6(root);
+  if (normalizedPath === normalizedRoot) {
+    return "";
+  }
+  const prefix = `${normalizedRoot}/`;
+  return normalizedPath.startsWith(prefix) ? normalizedPath.slice(prefix.length) : null;
+}
+var BlastRadiusOverlayFileSystem = class {
+  inner;
+  destinationRoot;
+  overlayRelativePath;
+  targetRelativePath;
+  /**
+   * @param inner The wrapped adapter performing real I/O.
+   * @param destinationRoot Destination workspace root (POSIX path).
+   * @param overlayRelativePath Destination-relative overlay path.
+   * @param targetRelativePath Destination-relative path the overlay composes
+   *   onto.
+   */
+  constructor(inner, destinationRoot, overlayRelativePath = BLAST_RADIUS_OVERLAY_RELATIVE_PATH, targetRelativePath = BLAST_RADIUS_RELATIVE_PATH) {
+    this.inner = inner;
+    this.destinationRoot = normalizePosix6(destinationRoot);
+    this.overlayRelativePath = overlayRelativePath;
+    this.targetRelativePath = targetRelativePath;
+  }
+  /** @inheritdoc */
+  listFiles(root) {
+    return this.inner.listFiles(root);
+  }
+  /** @inheritdoc */
+  isDir(path16) {
+    return this.inner.isDir(path16);
+  }
+  /** @inheritdoc */
+  isFile(path16) {
+    return this.inner.isFile(path16);
+  }
+  /** @inheritdoc */
+  readTextFile(path16) {
+    return this.inner.readTextFile(path16);
+  }
+  /** @inheritdoc */
+  ensureDir(path16) {
+    this.inner.ensureDir(path16);
+  }
+  /**
+   * Write a file, composing the destination overlay onto the target path.
+   *
+   * @param path Absolute destination POSIX path.
+   * @param content Content the layers above want to publish.
+   * @throws BlastRadiusOverlayError When the overlay cannot be composed; the
+   *   destination target keeps its prior bytes.
+   * @throws BlastRadiusGuardError When a composed module carries a forbidden
+   *   glob; the destination target keeps its prior bytes.
+   */
+  writeTextFile(path16, content) {
+    if (relativeToPosix6(path16, this.destinationRoot) !== this.targetRelativePath) {
+      this.inner.writeTextFile(path16, content);
+      return;
+    }
+    const overlayPath = `${this.destinationRoot}/${this.overlayRelativePath}`;
+    const overlayText = this.inner.isFile(overlayPath) ? this.inner.readTextFile(overlayPath) : null;
+    const composed = composeBlastRadiusOverlay(
+      content,
+      overlayText,
+      this.overlayRelativePath
+    );
+    this.inner.writeTextFile(path16, composed);
+  }
+};
+
 // ../../extensions/drm-copilot/src/lib/push-down/claude-gitignore-merge.ts
 var CLAUDE_GITIGNORE_RELATIVE_PATH = ".gitignore";
 var CLAUDE_GITIGNORE_BEGIN_SENTINEL = "# BEGIN drm-copilot managed ignores";
@@ -20043,12 +20274,363 @@ function toDocument(lines) {
   return `${lines.join(LINE_SEPARATOR)}${LINE_SEPARATOR}`;
 }
 
+// ../../extensions/drm-copilot/src/lib/push-down/claude-exclusion-manifest.ts
+var EXCLUSION_MANIFEST_RELATIVE_PATH = ".push-down-exclusions";
+var ExclusionManifestError = class extends Error {
+  /** Destination-relative manifest path. */
+  path;
+  /** 1-based offending line, or `undefined` when the whole file is at fault. */
+  line;
+  /**
+   * @param path Destination-relative manifest path.
+   * @param line Offending line, or `undefined` for a whole-file condition.
+   * @param reason Human-readable reason.
+   */
+  constructor(path16, line, reason) {
+    const location = line === void 0 ? path16 : `${path16} line ${String(line)}`;
+    super(`Malformed push-down exclusion manifest ${location}: ${reason}`);
+    this.name = "ExclusionManifestError";
+    this.path = path16;
+    this.line = line;
+  }
+};
+var BYTE_ORDER_MARK = "\uFEFF";
+var REPLACEMENT_CHARACTER = "\uFFFD";
+var LINE_SPLIT = /\r?\n/;
+var REPEATED_SLASH = /\/{2,}/g;
+var DRIVE_PREFIX = /^[A-Za-z]:/;
+function hasWildcard(normalized) {
+  return normalized.includes("*") || normalized.includes("?");
+}
+function escapeRegexCharacter(character) {
+  return /[\\^$.*+?()[\]{}|/-]/.test(character) ? `\\${character}` : character;
+}
+function globToRegexText(pattern) {
+  const parts = [];
+  let index = 0;
+  while (index < pattern.length) {
+    if (pattern.startsWith("**", index)) {
+      parts.push(".*");
+      index += 2;
+      continue;
+    }
+    const character = pattern.charAt(index);
+    if (character === "*") {
+      parts.push("[^/]*");
+    } else if (character === "?") {
+      parts.push("[^/]");
+    } else {
+      parts.push(escapeRegexCharacter(character));
+    }
+    index += 1;
+  }
+  return parts.join("");
+}
+function matchesGlob(pattern, candidate) {
+  return new RegExp(`^(?:${globToRegexText(pattern)})$`).test(candidate);
+}
+function normalizeExclusionEntry(raw) {
+  let text2 = raw.trim().replace(/\\/g, "/");
+  if (text2.startsWith("./")) {
+    text2 = text2.slice(2);
+  }
+  return text2.replace(REPEATED_SLASH, "/");
+}
+function malformedReason(normalized) {
+  const checks = [
+    [normalized === "", "entry is empty after normalization"],
+    [
+      normalized.startsWith("/") || DRIVE_PREFIX.test(normalized),
+      "entry is an absolute path"
+    ],
+    [normalized.split("/").includes(".."), "entry contains a '..' segment"],
+    [normalized.startsWith("!"), "negation entries are not supported"],
+    [
+      normalized.includes("[") || normalized.includes("]"),
+      "character classes are not supported"
+    ],
+    [
+      hasWildcard(normalized) && normalized.endsWith("/"),
+      "a wildcard entry must not end with '/'"
+    ],
+    [normalized.includes(REPLACEMENT_CHARACTER), "text is not valid UTF-8"]
+  ];
+  const failed = checks.find(([isFailed]) => isFailed);
+  return failed === void 0 ? void 0 : failed[1];
+}
+function classify(normalized) {
+  if (hasWildcard(normalized)) {
+    return "glob";
+  }
+  return normalized.endsWith("/") ? "directory" : "exact";
+}
+function parseExclusionManifest(text2, path16) {
+  const body = text2.startsWith(BYTE_ORDER_MARK) ? text2.slice(BYTE_ORDER_MARK.length) : text2;
+  const entries = [];
+  body.split(LINE_SPLIT).forEach((raw, offset) => {
+    const line = offset + 1;
+    const stripped = raw.trim();
+    if (stripped === "" || stripped.startsWith("#")) {
+      return;
+    }
+    const normalized = normalizeExclusionEntry(raw);
+    const reason = malformedReason(normalized);
+    if (reason !== void 0) {
+      throw new ExclusionManifestError(path16, line, reason);
+    }
+    entries.push({ raw, normalized, kind: classify(normalized), line });
+  });
+  return { path: path16, entries };
+}
+function matchesExclusionEntry(entry, candidate) {
+  if (entry.kind === "glob") {
+    return matchesGlob(entry.normalized, candidate);
+  }
+  const base = entry.normalized.replace(/\/+$/, "");
+  return candidate === base || candidate.startsWith(`${base}/`);
+}
+function planExclusions(payloadRelativePaths, manifest, destinationExists) {
+  const kept = [];
+  const skipped = [];
+  for (const relativePath2 of payloadRelativePaths) {
+    const entry = manifest.entries.find(
+      (candidate) => matchesExclusionEntry(candidate, relativePath2)
+    );
+    if (entry === void 0) {
+      kept.push(relativePath2);
+      continue;
+    }
+    skipped.push({
+      relativePath: relativePath2,
+      entry: entry.normalized,
+      line: entry.line,
+      destinationStatus: destinationExists(relativePath2) ? "present" : "absent"
+    });
+  }
+  const claimed = new Set(
+    skipped.map((skip) => `${String(skip.line)}\0${skip.entry}`)
+  );
+  const unmatchedEntries = manifest.entries.filter(
+    (entry) => !claimed.has(`${String(entry.line)}\0${entry.normalized}`)
+  );
+  return { kept, skipped, unmatchedEntries };
+}
+function assertManifestPathIsRootLevel(relativePath2, rootFolders) {
+  if (relativePath2.includes("/")) {
+    throw new Error(
+      `Exclusion manifest path must be root-level: ${relativePath2}`
+    );
+  }
+  const root = rootFolders.find((name) => relativePath2.startsWith(name));
+  if (root !== void 0) {
+    throw new Error(
+      `Exclusion manifest path must not begin with published root ${root}: ${relativePath2}`
+    );
+  }
+}
+
+// ../../extensions/drm-copilot/src/lib/push-down/claude-exclusion-filter.ts
+var EXCLUSION_CONFLICT_LINE_PREFIX = "push-down exclusion conflict:";
+var DEFAULT_ARTIFACT_DIRECTORY = "artifacts/claude-customizations";
+var ExclusionViolationError = class extends Error {
+  /**
+   * @param message Description of the refused write.
+   */
+  constructor(message) {
+    super(message);
+    this.name = "ExclusionViolationError";
+  }
+};
+function normalizePosix7(value) {
+  return value.replace(/\\/g, "/").replace(/\/+$/, "");
+}
+function relativeToPosix7(path16, root) {
+  const normalizedPath = normalizePosix7(path16);
+  const prefix = `${normalizePosix7(root)}/`;
+  return normalizedPath.startsWith(prefix) ? normalizedPath.slice(prefix.length) : void 0;
+}
+function findFirstMatch(manifest, candidate) {
+  return manifest.entries.find(
+    (entry) => matchesExclusionEntry(entry, candidate)
+  );
+}
+var ExclusionFilterFileSystem = class {
+  /** Skip records in enumeration order. */
+  skipped = [];
+  inner;
+  sourceRoot;
+  destinationRoot;
+  manifest;
+  artifactPrefix;
+  /**
+   * @param inner Adapter the engine would otherwise use.
+   * @param sourceRoot Root the engine enumerates payload files under.
+   * @param destinationRoot Destination workspace root.
+   * @param manifest Parsed manifest.
+   * @param artifactDirectory Destination-relative summary-artifact directory
+   *   exempt from the write guard.
+   */
+  constructor(inner, sourceRoot, destinationRoot, manifest, artifactDirectory = DEFAULT_ARTIFACT_DIRECTORY) {
+    this.inner = inner;
+    this.sourceRoot = normalizePosix7(sourceRoot);
+    this.destinationRoot = normalizePosix7(destinationRoot);
+    this.manifest = manifest;
+    this.artifactPrefix = `${normalizePosix7(artifactDirectory)}/`;
+  }
+  listFiles(root) {
+    const listed = this.inner.listFiles(root);
+    const relativeByPath = listed.map(
+      (path16) => [path16, relativeToPosix7(path16, this.sourceRoot)]
+    );
+    const candidates = relativeByPath.flatMap(
+      ([, relative2]) => relative2 === void 0 ? [] : [relative2]
+    );
+    const plan = planExclusions(
+      candidates,
+      this.manifest,
+      (relative2) => this.inner.isFile(`${this.destinationRoot}/${relative2}`)
+    );
+    this.skipped.push(...plan.skipped);
+    const kept = new Set(plan.kept);
+    return relativeByPath.filter(([, relative2]) => relative2 === void 0 || kept.has(relative2)).map(([path16]) => path16);
+  }
+  isDir(path16) {
+    return this.inner.isDir(path16);
+  }
+  isFile(path16) {
+    return this.inner.isFile(path16);
+  }
+  readTextFile(path16) {
+    return this.inner.readTextFile(path16);
+  }
+  ensureDir(path16) {
+    this.inner.ensureDir(path16);
+  }
+  /**
+   * Write through the inner adapter unless the target is excluded.
+   *
+   * @param path Target path.
+   * @param content Text to write.
+   * @throws ExclusionViolationError When the destination-relative target is
+   *   the manifest path or matches a manifest entry.
+   */
+  writeTextFile(path16, content) {
+    const relative2 = relativeToPosix7(path16, this.destinationRoot);
+    if (relative2 !== void 0 && !relative2.startsWith(this.artifactPrefix)) {
+      if (relative2 === EXCLUSION_MANIFEST_RELATIVE_PATH) {
+        throw new ExclusionViolationError(
+          `Refusing to write the push-down exclusion manifest: ${relative2}`
+        );
+      }
+      const entry = findFirstMatch(this.manifest, relative2);
+      if (entry !== void 0) {
+        throw new ExclusionViolationError(
+          `Refusing to write excluded path ${relative2} (entry ${entry.normalized}, line ${String(entry.line)})`
+        );
+      }
+    }
+    this.inner.writeTextFile(path16, content);
+  }
+};
+function readExclusionManifest(fs12, destinationRoot) {
+  const manifestPath = `${normalizePosix7(destinationRoot)}/${EXCLUSION_MANIFEST_RELATIVE_PATH}`;
+  if (!fs12.isFile(manifestPath)) {
+    if (fs12.isDir(manifestPath)) {
+      throw new ExclusionManifestError(
+        EXCLUSION_MANIFEST_RELATIVE_PATH,
+        void 0,
+        "path is not a regular file"
+      );
+    }
+    return void 0;
+  }
+  return parseExclusionManifest(
+    fs12.readTextFile(manifestPath),
+    EXCLUSION_MANIFEST_RELATIVE_PATH
+  );
+}
+function buildExclusionReport(manifest, skipped) {
+  const claimed = new Set(
+    skipped.map((skip) => `${String(skip.line)}\0${skip.entry}`)
+  );
+  return {
+    manifestPath: manifest.path,
+    entries: manifest.entries,
+    skipped: [...skipped],
+    unmatchedEntries: manifest.entries.filter(
+      (entry) => !claimed.has(`${String(entry.line)}\0${entry.normalized}`)
+    )
+  };
+}
+function renderExclusionLines(report) {
+  const skippedLines = report.skipped.map((skip) => {
+    const suffix2 = `${skip.relativePath} (entry ${skip.entry}, line ${String(skip.line)})`;
+    return skip.destinationStatus === "present" ? `${EXCLUSION_CONFLICT_LINE_PREFIX} destination file present, not overwritten: ${suffix2}` : `push-down exclusion: skipped ${suffix2}`;
+  });
+  const unmatchedLines = report.unmatchedEntries.map(
+    (entry) => `push-down exclusion: entry matched no payload path: ${entry.normalized} (line ${String(entry.line)})`
+  );
+  return [...skippedLines, ...unmatchedLines];
+}
+function exclusionReportPayload(report) {
+  return {
+    conflict_count: report.skipped.filter(
+      (skip) => skip.destinationStatus === "present"
+    ).length,
+    entries: report.entries.map((entry) => entry.normalized),
+    manifest_path: report.manifestPath,
+    skipped: report.skipped.map((skip) => ({
+      destination_status: skip.destinationStatus,
+      entry: skip.entry,
+      line: skip.line,
+      relative_path: skip.relativePath
+    })),
+    skipped_count: report.skipped.length,
+    unmatched_entries: report.unmatchedEntries.map((entry) => entry.normalized)
+  };
+}
+function appendExclusionsToArtifact(fs12, artifactPath, report) {
+  const payload = JSON.parse(fs12.readTextFile(artifactPath));
+  if (payload === null || typeof payload !== "object" || Array.isArray(payload)) {
+    throw new Error(`Summary artifact is not a JSON object: ${artifactPath}`);
+  }
+  const document = {
+    ...payload,
+    exclusions: exclusionReportPayload(report)
+  };
+  fs12.writeTextFile(artifactPath, stringifySorted(document, 2));
+}
+
 // ../../extensions/drm-copilot/src/lib/push-down/claude-customizations.ts
 var ARTIFACT_DIRECTORY4 = "artifacts/claude-customizations";
 var ROOT_FOLDERS2 = [".claude", "config"];
+assertManifestPathIsRootLevel(EXCLUSION_MANIFEST_RELATIVE_PATH, ROOT_FOLDERS2);
 var ROUTING_MERGE_RELATIVE_PATH = "config/orchestration-routing.json";
 var EXCLUDED_RELATIVE_PATHS = [
-  ".claude/settings.local.json"
+  ".claude/settings.local.json",
+  "config/blast-radius.local.json"
+];
+var DESTINATION_WRITE_DECORATORS = [
+  {
+    relativePath: ROUTING_MERGE_RELATIVE_PATH,
+    wrap: (inner, destinationRoot) => new RoutingMergeFileSystem(
+      inner,
+      destinationRoot,
+      ROUTING_MERGE_RELATIVE_PATH
+    )
+  },
+  {
+    relativePath: BLAST_RADIUS_RELATIVE_PATH,
+    wrap: (inner, destinationRoot) => new BlastRadiusOverlayFileSystem(inner, destinationRoot)
+  },
+  {
+    relativePath: BLAST_RADIUS_RELATIVE_PATH,
+    wrap: (inner, destinationRoot, { listEntries }) => listEntries === void 0 ? new BlastRadiusDeriveFileSystem(inner, destinationRoot) : new BlastRadiusDeriveFileSystem(
+      inner,
+      destinationRoot,
+      listEntries
+    )
+  }
 ];
 var BUNDLE_ROOT_RELATIVE_DIR = "extensions/drm-copilot/resources/claude-customizations";
 var PACK_MANIFEST_SUBDIR2 = "pack-manifests";
@@ -20091,23 +20673,19 @@ function pushDownCustomizations4(options) {
   } = options;
   const effectiveSource = sourceRoot ?? repoRoot;
   const effectiveBundle = bundleRoot ?? joinPosix7(effectiveSource, BUNDLE_ROOT_RELATIVE_DIR);
+  const manifest = readExclusionManifest(fs12, destinationRoot);
   const publishedPaths = resolvePublishedPaths2(
     packs ?? null,
     effectiveBundle,
     fs12
   );
-  const mergingFs = new RoutingMergeFileSystem(
-    fs12,
-    destinationRoot,
-    ROUTING_MERGE_RELATIVE_PATH
-  );
-  const derivingFs = listEntries === void 0 ? new BlastRadiusDeriveFileSystem(mergingFs, destinationRoot) : new BlastRadiusDeriveFileSystem(
-    mergingFs,
-    destinationRoot,
-    listEntries
+  const decoratorOptions = listEntries === void 0 ? {} : { listEntries };
+  const decoratedFs = DESTINATION_WRITE_DECORATORS.reduce(
+    (inner, decorator) => decorator.wrap(inner, destinationRoot, decoratorOptions),
+    fs12
   );
   const excludingFs = new ExcludingFileSystem(
-    derivingFs,
+    decoratedFs,
     repoRoot,
     EXCLUDED_RELATIVE_PATHS,
     {
@@ -20119,10 +20697,17 @@ function pushDownCustomizations4(options) {
       variantRoot: effectiveBundle
     }
   );
+  const exclusionFs = manifest === void 0 ? void 0 : new ExclusionFilterFileSystem(
+    excludingFs,
+    effectiveSource,
+    destinationRoot,
+    manifest,
+    ARTIFACT_DIRECTORY4
+  );
   const summary = pushDownCustomizations({
     repoRoot,
     destinationRoot,
-    fs: excludingFs,
+    fs: exclusionFs ?? excludingFs,
     ...sourceRoot === void 0 ? {} : { sourceRoot },
     ...artifactRoot === void 0 ? {} : { artifactRoot },
     rootFolders: ROOT_FOLDERS2,
@@ -20130,19 +20715,41 @@ function pushDownCustomizations4(options) {
     rewriteReferences: passthroughRewrite2,
     ...clock === void 0 ? {} : { clock }
   });
-  deliverDestinationGitignore(fs12, destinationRoot);
-  return summary;
+  const gitignoreSkip = deliverDestinationGitignore(
+    fs12,
+    destinationRoot,
+    manifest
+  );
+  if (manifest === void 0 || exclusionFs === void 0) {
+    return summary;
+  }
+  const skipped = gitignoreSkip === void 0 ? exclusionFs.skipped : [...exclusionFs.skipped, gitignoreSkip];
+  const report = buildExclusionReport(manifest, skipped);
+  appendExclusionsToArtifact(fs12, summary.artifactPath, report);
+  return { ...summary, exclusions: report };
 }
-function deliverDestinationGitignore(fs12, destinationRoot) {
+function deliverDestinationGitignore(fs12, destinationRoot, manifest) {
   const destinationPath = joinPosix7(
     destinationRoot,
     CLAUDE_GITIGNORE_RELATIVE_PATH
   );
+  const entry = manifest?.entries.find(
+    (candidate) => matchesExclusionEntry(candidate, CLAUDE_GITIGNORE_RELATIVE_PATH)
+  );
+  if (entry !== void 0) {
+    return {
+      relativePath: CLAUDE_GITIGNORE_RELATIVE_PATH,
+      entry: entry.normalized,
+      line: entry.line,
+      destinationStatus: fs12.isFile(destinationPath) ? "present" : "absent"
+    };
+  }
   const currentText = fs12.isFile(destinationPath) ? fs12.readTextFile(destinationPath) : "";
   const mergedText = mergeClaudeGitignore(currentText);
   if (mergedText !== currentText) {
     fs12.writeTextFile(destinationPath, mergedText);
   }
+  return void 0;
 }
 
 // ../../extensions/drm-copilot/src/lib/push-down/push-down-service-call.ts
@@ -20216,11 +20823,16 @@ function pushDownClaudeCustomizationsServiceCall(input) {
     ...input.memoryMode === void 0 ? {} : { memoryMode: input.memoryMode },
     ...input.clock === void 0 ? {} : { clock: input.clock }
   });
+  const lines = summary.exclusions === void 0 ? [] : renderExclusionLines(summary.exclusions);
+  for (const line of lines) {
+    input.log?.(line);
+  }
   return {
     tool: "push_down_claude_customizations",
     workspaceRoot: input.workspaceRoot,
     summary: "Pushed bundled Claude Code customizations into the destination workspace.",
-    artifacts: [normalizeGeneratedPath(summary.artifactPath)]
+    artifacts: [normalizeGeneratedPath(summary.artifactPath)],
+    ...lines.length > 0 ? { warnings: lines } : {}
   };
 }
 
@@ -28385,7 +28997,7 @@ function isPositiveInteger(value) {
 function isNonNegativeInteger(value) {
   return isIntegral(value) && value >= 0;
 }
-function isStringList(value) {
+function isStringList2(value) {
   return Array.isArray(value) && value.every(isNonEmptyString2);
 }
 function inBoundedRange(value, minimum, maximum) {
@@ -28403,7 +29015,7 @@ function validateBlastRadiusBlock(radius, context) {
   }
   const errors = [];
   for (const field of BLAST_RADIUS_LIST_FIELDS) {
-    if (!isStringList(radius[field])) {
+    if (!isStringList2(radius[field])) {
       errors.push(
         `${context} blast_radius.${field} must be a list of non-empty strings.`
       );
@@ -28828,14 +29440,14 @@ function validateDriftEvents(events, issueNums, context) {
       );
     }
     for (const field of ["declared", "observed"]) {
-      if (!isStringList(entry[field])) {
+      if (!isStringList2(entry[field])) {
         errors.push(
           `${entryContext} ${field} must be a list of non-empty strings.`
         );
       }
     }
     const escapedPaths = entry["escaped_paths"];
-    if (!isStringList(escapedPaths) || !Array.isArray(escapedPaths) || escapedPaths.length === 0) {
+    if (!isStringList2(escapedPaths) || !Array.isArray(escapedPaths) || escapedPaths.length === 0) {
       errors.push(
         `${entryContext} escaped_paths must be a non-empty list of non-empty strings.`
       );
@@ -33418,7 +34030,7 @@ function resolveReadinessSignal(fs12, featureDir) {
   }
   return [null, null];
 }
-function relativeToPosix6(root, path16) {
+function relativeToPosix8(root, path16) {
   const normalizedRoot = toPosixPath2(root).replace(/\/+$/u, "");
   const normalized = toPosixPath2(path16);
   if (normalized.startsWith(`${normalizedRoot}/`)) {
@@ -33451,7 +34063,7 @@ function discoverCanonicalEvidenceFiles(fs12, root, feature) {
   for (const pattern of CANONICAL_GLOBS) {
     for (const candidate of fs12.glob(featureRoot, pattern)) {
       if (fs12.isFile(candidate)) {
-        discovered.add(relativeToPosix7(normalizedRoot, candidate));
+        discovered.add(relativeToPosix9(normalizedRoot, candidate));
       }
     }
   }
@@ -33544,7 +34156,7 @@ function parseIntegerStrict(value) {
   }
   return Number.parseInt(value, 10);
 }
-function relativeToPosix7(root, absolute) {
+function relativeToPosix9(root, absolute) {
   const normalized = toPosixPath2(absolute);
   if (normalized.startsWith(`${root}/`)) {
     return normalized.slice(root.length + 1);
@@ -33732,11 +34344,11 @@ function buildContextFiles(params) {
   const contextFiles = [];
   for (const path16 of candidatePaths) {
     if (fs12.exists(path16)) {
-      contextFiles.push(relativeToPosix6(root, path16));
+      contextFiles.push(relativeToPosix8(root, path16));
     }
   }
   if (readinessSource !== null) {
-    contextFiles.push(relativeToPosix6(root, readinessSource));
+    contextFiles.push(relativeToPosix8(root, readinessSource));
   }
   const evidenceContextFiles = discoverCanonicalEvidenceFiles(
     fs12,