@tiinex/app 0.1.1

package/src/export/export.plan.js

@@ -0,0 +1,182 @@
+import { buildWorkspaceTreeExportBundle } from '@tiinex/core/export/tree.bundle.js';
+import { resolveTransportPlan, TransportLevel } from '@tiinex/core/sources/transport.levels.js';
+
+export const EXPORT_PLAN_SCHEMA_ID = 'tiinex.export.plan.v1';
+export const ExportAdapterId = Object.freeze({
+  download: 'download',
+  github: 'github',
+  handoffPackage: 'handoff-package'
+});
+export const ExportType = Object.freeze({
+  tree: 'tree',
+  handoffPackage: 'handoff-package',
+  githubPublish: 'github-publish',
+  workspaceEntrypoint: 'workspace-entrypoint',
+  duplicate: 'duplicate'
+});
+export const ExportScope = Object.freeze({
+  local: 'local',
+  source: 'source',
+  all: 'all'
+});
+
+export function buildWorkspaceExportPlan(workspace = {}, options = {}) {
+  const selectedExportType = normalizeExportType(options.exportType || ExportType.tree);
+  const impliedAdapter = selectedExportType === ExportType.handoffPackage ? ExportAdapterId.handoffPackage : selectedExportType === ExportType.githubPublish ? ExportAdapterId.github : ExportAdapterId.download;
+  const selectedAdapterId = normalizeExportAdapterId(options.adapterId || impliedAdapter);
+  const selectedScope = normalizeExportScope(options.scope || ExportScope.all);
+  const treeBundle = selectedAdapterId === ExportAdapterId.download && selectedExportType === ExportType.tree
+    ? buildWorkspaceTreeExportBundle(workspace, { clock: options.clock })
+    : null;
+  const transport = resolveTransportPlan({ transportLevels: { 'local-download': TransportLevel.TL0 } }, 'local-download', { defaultLevel: TransportLevel.TL0, allowFallback: false });
+  const counts = exportCounts(workspace, treeBundle);
+  const adapters = buildAdapterPlans({ selectedAdapterId, selectedExportType, selectedScope, counts, transport, treeBundle });
+  const selectedAdapter = adapters.find((adapter) => adapter.id === selectedAdapterId) || adapters[0];
+  return deepFreeze({
+    schema: EXPORT_PLAN_SCHEMA_ID,
+    status: selectedAdapter?.status || 'blocked',
+    step: 'configure',
+    selectedAdapterId,
+    selectedExportType,
+    selectedScope,
+    operation: selectedAdapter?.operation || 'local-download',
+    transport,
+    transportLevel: transport.selectedLevel,
+    adapters,
+    scopes: buildScopePlans(selectedScope, counts),
+    exportTypes: buildExportTypePlans(selectedExportType, treeBundle),
+    counts,
+    execution: executionPlan({ selectedAdapter, selectedAdapterId, selectedExportType }),
+    boundary: 'Export Plan is a read-model for adapter/scope/transport selection. It does not mutate source material or infer provenance from presentation paths.',
+    packageEnvelope: selectedExportType === ExportType.handoffPackage,
+    treeBundle
+  });
+}
+
+export function normalizeExportAdapterId(value = '') {
+  const text = String(value || '').trim().toLowerCase();
+  if (text === ExportAdapterId.github) return ExportAdapterId.github;
+  if (text === ExportAdapterId.handoffPackage || text === 'package' || text === 'handoff') return ExportAdapterId.handoffPackage;
+  return ExportAdapterId.download;
+}
+
+export function normalizeExportType(value = '') {
+  const text = String(value || '').trim().toLowerCase();
+  if (text === ExportType.handoffPackage || text === 'package' || text === 'handoff') return ExportType.handoffPackage;
+  if (text === ExportType.githubPublish || text === 'publish' || text === 'github') return ExportType.githubPublish;
+  if (text === ExportType.workspaceEntrypoint || text === 'workspace') return ExportType.workspaceEntrypoint;
+  if (text === ExportType.duplicate || text === 'copy') return ExportType.duplicate;
+  return ExportType.tree;
+}
+
+export function normalizeExportScope(value = '') {
+  const text = String(value || '').trim().toLowerCase();
+  if (text === ExportScope.local) return ExportScope.local;
+  if (text === ExportScope.source) return ExportScope.source;
+  return ExportScope.all;
+}
+
+function buildAdapterPlans({ selectedAdapterId, selectedExportType, selectedScope, counts, transport, treeBundle }) {
+  return Object.freeze([
+    Object.freeze({
+      id: ExportAdapterId.download,
+      label: 'Download',
+      icon: 'download',
+      status: selectedExportType === ExportType.tree ? 'ready' : 'disabled',
+      selected: selectedAdapterId === ExportAdapterId.download,
+      operation: 'local-download',
+      transportLevel: transport.selectedLevel,
+      capability: 'Files · assets · ordinary tree zip',
+      description: 'Client-side TL0 local download. Ordinary tree export mirrors the logical Tiinex tree and has no package envelope.',
+      files: treeBundle?.counts?.files || counts.records + counts.assets + counts.workspaceEntries,
+      boundary: 'No source write, no remote traversal, no credential material.'
+    }),
+    Object.freeze({
+      id: ExportAdapterId.github,
+      label: 'GitHub',
+      icon: 'github',
+      status: 'available',
+      selected: selectedAdapterId === ExportAdapterId.github,
+      operation: 'guided-browser-publication',
+      transportLevel: TransportLevel.TL0,
+      capability: 'Exact issue / issue-comment · Copy · Open · Verify',
+      description: 'Guided no-auth GitHub publication uses the accepted shared exact social target contract. Tiinex copies the exact payload, opens GitHub, then requires read-after-write verification before creating a local receipt/source binding.',
+      files: counts.records,
+      boundary: 'Visible as a future adapter only; this dialog never fakes GitHub write.'
+    }),
+    Object.freeze({
+      id: ExportAdapterId.handoffPackage,
+      label: 'Handoff package',
+      icon: 'archive',
+      status: 'available',
+      selected: selectedAdapterId === ExportAdapterId.handoffPackage,
+      operation: 'local-download',
+      transportLevel: TransportLevel.TL0,
+      capability: 'Recoverability envelope · local material + source references + workspace context',
+      description: 'Explicit execution builds and qualifies the operational package from the latest workspace through shared package authority. No package snapshot is built or cached in this read-model.',
+      files: 0,
+      boundary: 'Explicit non-default package envelope. Ordinary Tree export stays envelope-free.'
+    })
+  ]);
+}
+
+function buildScopePlans(selectedScope, counts) {
+  return Object.freeze([
+    Object.freeze({ id: ExportScope.local, label: 'Local', selected: selectedScope === ExportScope.local, status: 'future', description: 'Local drafts and browser-session material. Scope filtering is reserved for a later slice.', count: counts.localRecords }),
+    Object.freeze({ id: ExportScope.source, label: 'Source', selected: selectedScope === ExportScope.source, status: 'future', description: 'Source-backed material references. Scope filtering is reserved for a later slice.', count: counts.sourceRecords }),
+    Object.freeze({ id: ExportScope.all, label: 'All', selected: selectedScope === ExportScope.all, status: 'ready', description: 'Every loaded record/file in this workspace tree.', count: counts.records + counts.workspaceEntries })
+  ]);
+}
+
+function buildExportTypePlans(selectedExportType, treeBundle) {
+  return Object.freeze([
+    Object.freeze({ id: ExportType.tree, label: 'Tree export', selected: selectedExportType === ExportType.tree, status: 'ready', description: 'Ordinary zip mirroring the visible logical tree 1:1.', packageEnvelope: false, files: treeBundle?.counts?.files || 0 }),
+    Object.freeze({ id: ExportType.handoffPackage, label: 'Handoff package', selected: selectedExportType === ExportType.handoffPackage, status: 'available', description: 'Explicit Execute builds and qualifies the recoverability package from the latest workspace. No package bytes or exact inspection are prepared during render/read-model construction.', packageEnvelope: true, files: 0 }),
+    Object.freeze({ id: ExportType.githubPublish, label: 'GitHub publish', selected: selectedExportType === ExportType.githubPublish, status: 'available', description: 'Guided issue / issue-comment publication. Exact local Markdown remains the shared outbound payload; GitHub mutation stays human-performed.', packageEnvelope: false })
+  ]);
+}
+
+function executionPlan({ selectedAdapter, selectedAdapterId, selectedExportType }) {
+  if (selectedExportType === ExportType.handoffPackage && selectedAdapterId === ExportAdapterId.handoffPackage) {
+    return Object.freeze({
+      available: true,
+      action: 'download-handoff-package',
+      label: 'Download Handoff package',
+      boundary: 'Explicit execution resolves the latest workspace, builds and inspects that exact operational package once, then performs one TL0 browser download. No serialized Handoff snapshot is cached in the render/read-model plan.'
+    });
+  }
+  if (selectedExportType === ExportType.githubPublish || selectedAdapterId === ExportAdapterId.github) {
+    return Object.freeze({ available: true, action: 'guided-github-publication', label: 'Guided GitHub publication', boundary: 'Guided browser routine only: exact shared plan → Copy → Open GitHub → exact read-after-write Verify. No GitHub API mutation occurs in Site.' });
+  }
+  return Object.freeze({
+    available: selectedAdapter?.status === 'ready' && selectedExportType === ExportType.tree && selectedAdapterId === ExportAdapterId.download,
+    action: 'download-tree-zip',
+    label: 'Execute tree export',
+    boundary: 'Executes a TL0 local browser download. It does not publish, write to a source, create a handoff package, or include credential material.'
+  });
+}
+
+function exportCounts(workspace = {}, treeBundle = null) {
+  const records = Array.isArray(workspace.records) ? workspace.records : [];
+  const assets = Array.isArray(workspace.assets) ? workspace.assets : [];
+  const sourceRecords = records.filter((record) => String(record?.source?.boundary || record?.boundary || '').toLowerCase().includes('source-backed') || record?.source?.sourceBacked === true).length;
+  const localRecords = records.length - sourceRecords;
+  return Object.freeze({
+    records: records.length,
+    assets: assets.length,
+    workspaceEntries: treeBundle?.counts?.workspaceEntries || 0,
+    sourceRecords,
+    localRecords,
+    files: treeBundle?.counts?.files ?? (records.length + assets.length),
+    findings: treeBundle?.counts?.findings || 0,
+    errors: treeBundle?.counts?.errors || 0,
+    warnings: treeBundle?.counts?.warnings || 0
+  });
+}
+
+function deepFreeze(value) {
+  if (!value || typeof value !== 'object' || Object.isFrozen(value)) return value;
+  Object.freeze(value);
+  for (const child of Object.values(value)) deepFreeze(child);
+  return value;
+}

package/src/export/handoff.plan.js

@@ -0,0 +1,50 @@
+import { buildExportPackageBundle, inspectExportPackageBundle } from '@tiinex/core/export/package.builder.js';
+import { buildRecipientRelativeHandoffTransportPackage, roundTripRecipientRelativeHandoffTransportPackage } from '@tiinex/core/tooling/portable/handoff/materialClosure.package.js';
+
+export function prepareWorkspaceHandoffExport(workspace = {}, options = {}) {
+  const bundle = options.prebuiltBundle || buildExportPackageBundle(workspace, {
+    clock: options.clock,
+    builtAt: options.builtAt,
+    includeDegraded: options.includeDegraded !== false
+  });
+  const inspection = options.inspection || inspectExportPackageBundle(bundle);
+  const executable = inspection.status === 'valid' && bundle.status !== 'blocked';
+  return Object.freeze({
+    schema: 'tiinex.export.handoff.preparation.v1',
+    status: executable ? (bundle.status === 'degraded' ? 'degraded' : 'ready') : 'blocked',
+    executable,
+    bundle,
+    inspection,
+    boundary: 'Explicit Handoff package preparation only. Shared package owners define material/source/context truth; callers do not reinterpret package files or mutate workspace/source state.'
+  });
+}
+
+
+export function prepareRecipientRelativeWorkspaceHandoffExport(input = {}, options = {}) {
+  const built = buildRecipientRelativeHandoffTransportPackage(input, options);
+  const roundtrip = options.verifyRoundtrip === false ? null : roundTripRecipientRelativeHandoffTransportPackage(built, options);
+  const executable = built.status !== 'blocked' && built.inspection?.status === 'valid' && built.closureInspection?.status === 'valid' && built.carrierInspection?.status === 'valid' && built.pointerEntrypointInspection?.status === 'valid' && built.coldConsumerEntrypointInspection?.status === 'valid' && (!roundtrip || roundtrip.status === 'passed');
+  const carrierTransportReady = built.carrierProjection?.mode !== 'shared' || built.carrierProjection?.status === 'ready';
+  const transportExecutable = executable && carrierTransportReady && built.transportCompanion?.status === 'ready' && built.companionInspection?.status === 'valid';
+  return Object.freeze({
+    schema: 'tiinex.export.handoff.recipient-relative-preparation.v1',
+    status: executable ? built.status : 'blocked',
+    executable,
+    transportExecutable,
+    plan: built.plan,
+    bundle: built.bundle,
+    descriptor: built.descriptor,
+    transportCompanion: built.transportCompanion,
+    inspection: built.inspection,
+    closureInspection: built.closureInspection,
+    carrierProjection: built.carrierProjection,
+    carrierInspection: built.carrierInspection,
+    pointerEntrypointProjection: built.pointerEntrypointProjection,
+    pointerEntrypointInspection: built.pointerEntrypointInspection,
+    coldConsumerProjection: built.coldConsumerProjection,
+    coldConsumerEntrypointInspection: built.coldConsumerEntrypointInspection,
+    companionInspection: built.companionInspection,
+    roundtrip,
+    boundary: 'Site-facing delegation to shared portable recipient-relative package and non-authoritative transport companion owners. Projection readiness is exposed separately and does not redefine Handoff semantics, provider authority, workspace completeness, or acceptance/completion.'
+  });
+}

package/src/export/package.builder.case.mjs

@@ -0,0 +1,97 @@
+import assert from 'node:assert/strict';
+import { buildExportPackageBundle, inspectExportPackageBundle } from '@tiinex/core/export/package.builder.js';
+
+const validDraftMarkdown = `# Continuity Context
+
+- Envelope Schema: [tiinex.root.v1](tiinex.root.v1.schema.md)
+- Current
+  - Current Schema: [tiinex.topic.v1](tiinex.topic.v1.schema.md)
+  - Created At: 2026-07-21T00:00:00.000Z
+  - Summary: Draft
+  - Status: draft/local
+
+---
+
+# Draft
+
+# Continuity Integrity
+
+- Draft Local Integrity
+  - Method: browser-local-draft
+  - Value: pending-publication-or-export
+`;
+
+const readyWorkspace = {
+  id: 'w-ready',
+  title: 'Ready package',
+  records: [
+    { id: 'draft-ready', title: 'Draft', path: 'drafts/draft.md', markdown: validDraftMarkdown, source: { adapterId: 'local' }, sourceMode: 'local-transition' },
+    { id: 'source-ready', title: 'Source', path: 'topics/source.md', markdown: validDraftMarkdown, source: { adapterId: 'github', repo: 'Tiinex/docs', ref: 'main', materializedCommit: 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' }, sourceTarget: { surface: 'repoFiles', targetKind: 'github-repo-file', sourceArtifactPath: 'topics/source.md', materializedCommit: 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' } }
+  ],
+  assets: [{ id: 'asset-ready', name: 'Image', path: 'assets/image.png', content: 'image-bytes', type: 'image/png', source: { adapterId: 'local' } }]
+};
+
+const bundle = buildExportPackageBundle(readyWorkspace, { clock: () => '2026-07-21T02:10:00.000Z' });
+assert.equal(bundle.schema, 'tiinex.export.package.bundle.v1');
+assert.equal(bundle.status, 'ready');
+assert.equal(bundle.boundary.includes('mutates no source'), true);
+assert.equal(bundle.contract.status, 'ready');
+assert.equal(bundle.manifest.counts.localDrafts, 1);
+assert.equal(bundle.counts.localDraftFiles, 1);
+assert.equal(bundle.counts.sourceReferenceFiles, 1);
+assert.equal(bundle.counts.assetContentFiles, 1);
+assert.ok(bundle.files.some((file) => file.path === 'tiinex.package/index.json'));
+assert.ok(bundle.files.some((file) => file.path === 'tiinex.package/manifest.json'));
+assert.ok(bundle.files.some((file) => file.path === 'tiinex.package/receipt.json'));
+assert.ok(bundle.files.some((file) => file.path === 'artifacts/drafts/draft.md' && file.kind === 'artifact-markdown'));
+assert.ok(bundle.files.some((file) => file.kind === 'source-reference' && file.content.includes('Tiinex/docs')));
+assert.ok(bundle.files.some((file) => file.path === 'assets/assets/image.png' && file.kind === 'asset-content'));
+assert.equal(bundle.files.filter((file) => file.kind === 'source-reference').every((file) => !file.path.startsWith('artifacts/')), true, 'source references must not become local artifacts');
+assert.equal(bundle.files.filter((file) => file.kind === 'asset-content').every((file) => !file.path.startsWith('artifacts/')), true, 'assets must not become artifact leaves');
+assert.ok(bundle.packageFingerprint.startsWith('tixfp1-'));
+const inspection = inspectExportPackageBundle(bundle);
+assert.equal(inspection.status, 'valid');
+
+const repeat = buildExportPackageBundle(readyWorkspace, { clock: () => '2026-07-21T02:11:00.000Z' });
+assert.equal(repeat.packageId, bundle.packageId, 'package id remains manifest-deterministic');
+assert.notEqual(repeat.packageFingerprint, bundle.packageFingerprint, 'build receipt time changes the full file-map fingerprint');
+assert.deepEqual(
+  repeat.files.filter((file) => ['artifact-markdown', 'source-reference', 'asset-content', 'asset-metadata', 'workspace-candidate'].includes(file.kind)).map((file) => [file.path, file.fingerprint]),
+  bundle.files.filter((file) => ['artifact-markdown', 'source-reference', 'asset-content', 'asset-metadata', 'workspace-candidate'].includes(file.kind)).map((file) => [file.path, file.fingerprint]),
+  'material files remain deterministic across clock changes'
+);
+
+const degradedWorkspace = {
+  id: 'w-degraded',
+  title: 'Degraded package',
+  records: [
+    { id: 'source-unpinned', title: 'Source unpinned', path: '../topics/source.md', markdown: validDraftMarkdown, source: { adapterId: 'github', repo: 'Tiinex/docs', ref: '' } }
+  ],
+  assets: [{ id: 'asset-large', path: '/assets/large.bin', previewState: 'omitted-large', source: { adapterId: 'local' } }],
+  workspaceMergeCandidates: [{ id: 'wc', path: '../root.workspace.md' }]
+};
+const degraded = buildExportPackageBundle(degradedWorkspace, { clock: () => '2026-07-21T02:12:00.000Z' });
+assert.equal(degraded.status, 'degraded');
+assert.equal(degraded.counts.sourceReferenceFiles, 1);
+assert.equal(degraded.counts.assetMetadataFiles, 1);
+assert.equal(degraded.counts.workspaceCandidateFiles, 1);
+assert.ok(degraded.files.some((file) => file.kind === 'asset-metadata' && file.path.startsWith('metadata/assets/')));
+assert.ok(degraded.findings.some((finding) => finding.code === 'export.package.bundle.source-reference.degraded'));
+assert.equal(inspectExportPackageBundle(degraded).status, 'valid');
+
+const blockedWorkspace = {
+  id: 'w-blocked',
+  title: 'Blocked package',
+  records: [{ id: 'no-md', title: 'No markdown', path: 'no-md.md', source: { adapterId: 'local' } }]
+};
+const blocked = buildExportPackageBundle(blockedWorkspace, { clock: () => '2026-07-21T02:13:00.000Z' });
+assert.equal(blocked.status, 'blocked');
+assert.equal(blocked.counts.materialFiles, 0, 'blocked package should not include material files by default');
+assert.ok(blocked.files.some((file) => file.path === 'tiinex.package/manifest.json'));
+assert.ok(blocked.findings.some((finding) => finding.code === 'export.package.bundle.blocked'));
+assert.equal(inspectExportPackageBundle(blocked).status, 'valid');
+
+const tampered = Object.assign({}, bundle, { files: [Object.assign({}, bundle.files[0], { bytes: 1 })] });
+assert.equal(inspectExportPackageBundle(tampered).status, 'invalid');
+
+console.log('export.package.builder: ok');

package/src/export/package.controlTopology.case.mjs

@@ -0,0 +1,130 @@
+import assert from 'node:assert/strict';
+import { buildExportPackageBundle, inspectExportPackageBundle } from '@tiinex/core/export/package.builder.js';
+import { buildExportPackageFileMap, finalizeFile } from '@tiinex/core/export/package.fileMap.js';
+import { EXPORT_PACKAGE_CONTROL_PATHS } from '@tiinex/core/export/package.controlTopology.js';
+import { packageFileBytes } from '@tiinex/core/export/package.bytes.js';
+
+const markdown = `# Continuity Context
+
+- Envelope Schema: [tiinex.root.v1](tiinex.root.v1.schema.md)
+- Current
+  - Current Schema: [tiinex.topic.v1](tiinex.topic.v1.schema.md)
+  - Created At: 2026-08-19T00:00:00.000Z
+  - Summary: Control topology
+  - Status: draft/local
+
+---
+
+# Control topology
+
+# Continuity Integrity
+
+- Draft Local Integrity
+  - Method: browser-local-draft
+  - Value: pending-publication-or-export
+`;
+
+const bundle = buildExportPackageBundle({
+  id: 'w-control-topology',
+  title: 'Control topology',
+  records: [{ id: 'a', title: 'A', path: 'a.md', markdown, source: { adapterId: 'local' }, sourceMode: 'local-transition' }],
+  assets: []
+}, { clock: () => '2026-08-19T13:35:00.000Z' });
+
+assert.equal(inspectExportPackageBundle(bundle).status, 'valid');
+
+const requiredPaths = Object.values(EXPORT_PACKAGE_CONTROL_PATHS);
+for (const path of requiredPaths) {
+  const candidate = path === EXPORT_PACKAGE_CONTROL_PATHS.fileMap
+    ? { ...bundle, files: bundle.files.filter((file) => file.path !== path) }
+    : removeControlAndRebuildFileMap(bundle, path);
+  const inspection = inspectExportPackageBundle(candidate);
+  assert.equal(inspection.status, 'invalid', `missing ${path} must fail closed`);
+  assert.ok(inspection.findings.some((finding) => finding.code === 'export.package.bundle.control-missing' && finding.path === path), `missing ${path} should be identified as required control topology`);
+}
+
+for (const path of requiredPaths) {
+  const candidate = path === EXPORT_PACKAGE_CONTROL_PATHS.fileMap
+    ? replaceControlWithoutRebuild(bundle, path, '{not-json')
+    : replaceControlAndRebuildFileMap(bundle, path, '{not-json');
+  const inspection = inspectExportPackageBundle(candidate);
+  assert.equal(inspection.status, 'invalid', `unreadable ${path} must fail closed`);
+  assert.ok(inspection.findings.some((finding) => finding.code === 'export.package.bundle.control-unreadable' && finding.path === path), `unreadable ${path} should be identified`);
+}
+
+const pointerCases = [
+  ['manifestPath', EXPORT_PACKAGE_CONTROL_PATHS.manifest],
+  ['receiptPath', EXPORT_PACKAGE_CONTROL_PATHS.receipt],
+  ['buildReceiptPath', EXPORT_PACKAGE_CONTROL_PATHS.buildReceipt],
+  ['contractPath', EXPORT_PACKAGE_CONTROL_PATHS.contract],
+  ['findingsPath', EXPORT_PACKAGE_CONTROL_PATHS.findings],
+  ['fileMapPath', EXPORT_PACKAGE_CONTROL_PATHS.fileMap]
+];
+for (const [field, expected] of pointerCases) {
+  const candidate = mutateJsonControlAndRebuildFileMap(bundle, EXPORT_PACKAGE_CONTROL_PATHS.index, (index) => {
+    index[field] = `redirected/${field}.json`;
+  });
+  const inspection = inspectExportPackageBundle(candidate);
+  assert.equal(inspection.status, 'invalid', `redirected ${field} must fail closed`);
+  assert.ok(inspection.findings.some((finding) => finding.code === 'export.package.bundle.index-control-pointer-mismatch' && finding.field === field && finding.expected === expected));
+}
+
+const blankPointer = mutateJsonControlAndRebuildFileMap(bundle, EXPORT_PACKAGE_CONTROL_PATHS.index, (index) => {
+  index.contractPath = '';
+});
+const blankInspection = inspectExportPackageBundle(blankPointer);
+assert.equal(blankInspection.status, 'invalid');
+assert.ok(blankInspection.findings.some((finding) => finding.code === 'export.package.bundle.index-control-pointer-missing' && finding.field === 'contractPath'));
+
+const duplicatePointer = mutateJsonControlAndRebuildFileMap(bundle, EXPORT_PACKAGE_CONTROL_PATHS.index, (index) => {
+  index.contractPath = index.buildReceiptPath;
+});
+const duplicateInspection = inspectExportPackageBundle(duplicatePointer);
+assert.equal(duplicateInspection.status, 'invalid');
+assert.ok(duplicateInspection.findings.some((finding) => finding.code === 'export.package.bundle.index-control-pointer-duplicate'));
+assert.ok(duplicateInspection.findings.some((finding) => finding.code === 'export.package.bundle.index-control-pointer-mismatch' && finding.field === 'contractPath'));
+
+for (const path of [
+  EXPORT_PACKAGE_CONTROL_PATHS.buildReceipt,
+  EXPORT_PACKAGE_CONTROL_PATHS.contract,
+  EXPORT_PACKAGE_CONTROL_PATHS.findings
+]) {
+  const candidate = removeControlAndRebuildFileMap(bundle, path);
+  const inspection = inspectExportPackageBundle(candidate);
+  assert.equal(inspection.status, 'invalid', `removing ${path} and rebuilding durable file map must remain invalid`);
+  assert.ok(inspection.findings.some((finding) => finding.code === 'export.package.bundle.control-missing' && finding.path === path));
+}
+
+function removeControlAndRebuildFileMap(source, path) {
+  const governed = source.files.filter((file) => file.path !== path && file.path !== EXPORT_PACKAGE_CONTROL_PATHS.fileMap);
+  return withRebuiltFileMap(source, governed);
+}
+
+function replaceControlWithoutRebuild(source, path, content) {
+  const replacement = finalizeFile({ ...source.files.find((file) => file.path === path), content, data: undefined });
+  return { ...source, files: source.files.map((file) => file.path === path ? replacement : file) };
+}
+
+function replaceControlAndRebuildFileMap(source, path, content) {
+  const replacement = finalizeFile({ ...source.files.find((file) => file.path === path), content, data: undefined });
+  const governed = source.files
+    .filter((file) => file.path !== EXPORT_PACKAGE_CONTROL_PATHS.fileMap)
+    .map((file) => file.path === path ? replacement : file);
+  return withRebuiltFileMap(source, governed);
+}
+
+function mutateJsonControlAndRebuildFileMap(source, path, mutate) {
+  const original = source.files.find((file) => file.path === path);
+  const value = JSON.parse(new TextDecoder().decode(packageFileBytes(original)));
+  mutate(value);
+  return replaceControlAndRebuildFileMap(source, path, `${JSON.stringify(value, null, 2)}\n`);
+}
+
+function withRebuiltFileMap(source, governed) {
+  const fileMap = buildExportPackageFileMap(governed, { packageId: source.packageId });
+  const template = source.files.find((file) => file.path === EXPORT_PACKAGE_CONTROL_PATHS.fileMap);
+  const mapFile = finalizeFile({ ...template, content: `${JSON.stringify(fileMap, null, 2)}\n`, data: undefined });
+  return { ...source, files: [...governed, mapFile], fileMap };
+}
+
+console.log('export.package.controlTopology: ok');

package/src/export/package.zip.case.mjs

@@ -0,0 +1,33 @@
+import assert from 'node:assert/strict';
+import { Buffer } from 'node:buffer';
+import { buildExportPackageBundle } from '@tiinex/core/export/package.builder.js';
+import { exportPackageZipUint8Array } from '@tiinex/core/export/package.zip.js';
+
+const md = `# Continuity Context
+
+- Envelope Schema: [tiinex.root.v1](tiinex.root.v1.schema.md)
+- Current
+  - Current Schema: [tiinex.topic.v1](tiinex.topic.v1.schema.md)
+  - Created At: 2026-07-21T00:00:00.000Z
+  - Summary: Draft
+  - Status: draft/local
+
+---
+
+# Draft
+
+# Continuity Integrity
+
+- Draft Local Integrity
+  - Method: browser-local-draft
+  - Value: pending-publication-or-export
+`;
+const bundle = buildExportPackageBundle({ id: 'w', title: 'W', records: [{ id: 'r', title: 'Draft', path: 'draft.md', markdown: md, source: { adapterId: 'local' } }] }, { clock: () => '2026-07-21T00:00:00.000Z' });
+const bytes = exportPackageZipUint8Array(bundle);
+assert.equal(bytes[0], 0x50);
+assert.equal(bytes[1], 0x4b);
+const header = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+assert.equal(header.getUint16(10, true), 0, 'deterministic ZIP time should be midnight');
+assert.equal(header.getUint16(12, true), 0x0021, 'deterministic ZIP date should be 1980-01-01');
+assert(Buffer.from(bytes).includes(Buffer.from('tiinex.package/manifest.json')), 'zip should include manifest path');
+console.log('export.package.zip: ok');