@tiinex/core 0.3.0 → 0.4.0

package/src/tooling/portable/handoff/contextAudit.js

@@ -164,7 +164,27 @@ function auditRecipientV2(bundle = {}) {
   const findings = [...(inspection.findings || [])];
   if (unexplained) findings.push(finding('error', 'portable.handoff-context.v2.coverage.incomplete', 'Recipient-facing v2 context audit could not classify every visible root carrier.', { total: files.length, classified, unexplained }));
   const cacheMaterials = (inspection.caches || []).flatMap((cache) => cache.materials || []);
-  return deepFreeze({ schema: PORTABLE_HANDOFF_CONTEXT_AUDIT_SCHEMA_ID, status: inspection.status === 'valid' && !unexplained ? 'ready' : 'blocked', coverage: Object.freeze({ nonControlCarrierCount: files.length, classifiedCarrierCount: classified, unexplainedCarrierCount: unexplained, state: unexplained ? 'incomplete' : 'qualified' }), workspaceMaterializations: Object.freeze((inspection.workspaces || []).map((item) => Object.freeze({ workspaceId: item.workspaceId, reason: 'complete-workspace-archive-representation', qualification: 'qualified', carrierMode: 'archive', workspaceTargetPackagePath: item.workspaceArtifactPath, archivePackagePath: item.workspaceArchivePath, sourceWorkspaceTargetInnerPath: item.sourceWorkspaceTargetInnerPath, sourceWorkspaceTargetSha256: item.sourceWorkspaceTargetSha256 }))), materialCarriers: Object.freeze([]), generatedEntrypoints: Object.freeze([String(inspection.rootArtifact?.path || ''), RECIPIENT_V2_READ_PATH, ...(inspection.endpointRoles || []).map((item) => item.pointerPath), ...(inspection.participantRoles || []).map((item) => item.pointerPath), ...(inspection.routes || []).map((item) => item.pointerPath)].filter(Boolean)), namedPackageRequirements: Object.freeze([]), explicitDetachedMaterial: Object.freeze(cacheMaterials), unexplainedCarriers: Object.freeze([]), duplicateByteSummary: Object.freeze({ materialCarriersAlsoPresentInWorkspace: 0, totalMaterialCarriers: cacheMaterials.length, interpretation: 'Exact Workspace-scoped recipient cache material is permitted only when not satisfied by a qualified Workspace archive.' }), routeGrounding: Object.freeze((inspection.carrierProjection?.routes || []).map((route) => Object.freeze({ routeId: route.id, workspaceId: route.workspaceId, handoffPackagePath: route.packagePath, required: route.requiredClosure?.requirements || [] }))), inspections: Object.freeze({ recipientV2: inspection.status }), findings: Object.freeze(dedupeFindings(findings)), boundary: 'Recipient-facing v2 carriage audit over qualified visible Tiinex artifacts, exact payload bytes, and one transport-owned manifest control surface.' });
+  const parentBoundaryGroundingEligible = inspection.status === 'valid' && String(inspection.schema || '') === 'tiinex.portable.recipient-facing-handoff-package-v1.inspection.v1';
+  const lineageMaterializations = parentBoundaryGroundingEligible
+    ? (inspection.caches || []).flatMap((cache) => (cache.materials || [])
+      .filter((material) => String(material.classification || '') === 'parent-boundary')
+      .map((material) => Object.freeze({
+        qualification: 'qualified-package-v1-parent-boundary-cache',
+        workspaceId: String(material.targetWorkspaceId || ''),
+        workspaceRelativePath: String(material.targetPath || material.originalPath || ''),
+        sourceWorkspaceId: String(material.sourceWorkspaceId || ''),
+        sourceWorkspaceRelativePath: String(material.sourcePath || ''),
+        routeWorkspaceId: String(material.routeWorkspaceId || ''),
+        routeWorkspaceRelativePath: String(material.routePath || ''),
+        requirementId: String(material.requirementId || ''),
+        referenceTarget: String(material.referenceTarget || ''),
+        archivePackagePath: String(cache.archivePath || ''),
+        archiveEntry: String(material.archiveEntry || ''),
+        bytes: Number(material.bytes || 0),
+        sha256: String(material.sha256 || '')
+      })))
+    : [];
+  return deepFreeze({ schema: PORTABLE_HANDOFF_CONTEXT_AUDIT_SCHEMA_ID, status: inspection.status === 'valid' && !unexplained ? 'ready' : 'blocked', coverage: Object.freeze({ nonControlCarrierCount: files.length, classifiedCarrierCount: classified, unexplainedCarrierCount: unexplained, state: unexplained ? 'incomplete' : 'qualified' }), workspaceMaterializations: Object.freeze((inspection.workspaces || []).map((item) => Object.freeze({ workspaceId: item.workspaceId, reason: 'complete-workspace-archive-representation', qualification: 'qualified', carrierMode: 'archive', workspaceTargetPackagePath: item.workspaceArtifactPath, archivePackagePath: item.workspaceArchivePath, sourceWorkspaceTargetInnerPath: item.sourceWorkspaceTargetInnerPath, sourceWorkspaceTargetSha256: item.sourceWorkspaceTargetSha256 }))), lineageMaterializations: Object.freeze(lineageMaterializations), materialCarriers: Object.freeze([]), generatedEntrypoints: Object.freeze([String(inspection.rootArtifact?.path || ''), RECIPIENT_V2_READ_PATH, ...(inspection.endpointRoles || []).map((item) => item.pointerPath), ...(inspection.participantRoles || []).map((item) => item.pointerPath), ...(inspection.routes || []).map((item) => item.pointerPath)].filter(Boolean)), namedPackageRequirements: Object.freeze([]), explicitDetachedMaterial: Object.freeze(cacheMaterials), unexplainedCarriers: Object.freeze([]), duplicateByteSummary: Object.freeze({ materialCarriersAlsoPresentInWorkspace: 0, totalMaterialCarriers: cacheMaterials.length, interpretation: 'Exact Workspace-scoped recipient cache material is permitted only when not satisfied by a qualified Workspace archive.' }), routeGrounding: Object.freeze((inspection.carrierProjection?.routes || []).map((route) => Object.freeze({ routeId: route.id, workspaceId: route.workspaceId, handoffPackagePath: route.packagePath, required: route.requiredClosure?.requirements || [] }))), inspections: Object.freeze({ recipientV2: inspection.status, parentBoundaryGrounding: parentBoundaryGroundingEligible ? 'qualified-package-v1' : 'not-projected' }), findings: Object.freeze(dedupeFindings(findings)), boundary: 'Recipient-facing v2 carriage audit over qualified visible Tiinex artifacts and exact payload bytes. Complete Workspace snapshots and independently qualified package-v1 detached Parent-boundary lineage are projected separately; detached lineage never implies whole-Workspace carriage or membership.' });
 }
 
 function indexWorkspaceEntries(workspaces = []) {

package/src/tooling/portable/handoff/materialClosure.descriptor.js

@@ -131,7 +131,7 @@ function resolvePackagedWorkspace(index, key = '') {
 
 
 function descriptorRequirement(item = {}) {
-  return Object.freeze({ requirementId: String(item.requirementId || ''), name: String(item.requirementName || item.name || ''), classification: String(item.classification || ''), disposition: String(item.disposition || ''), referenceTarget: String(item.referenceTarget || ''), reason: String(item.reason || ''), recipientReferenceCapability: Boolean(item.recipientReferenceCapability), routeWorkspaceId: String(item.routeWorkspaceId || ''), routePath: String(item.routePath || ''), sourceRequirementId: String(item.sourceRequirementId || ''), materializedPackagePath: String(item.packagePath || item.selectedMaterial?.packagePath || ''), selectedMaterial: descriptorSelectedMaterial(item.selectedMaterial) });
+  return Object.freeze({ requirementId: String(item.requirementId || ''), name: String(item.requirementName || item.name || ''), classification: String(item.classification || ''), disposition: String(item.disposition || ''), referenceTarget: String(item.referenceTarget || ''), reason: String(item.reason || ''), recipientReferenceCapability: Boolean(item.recipientReferenceCapability), routeWorkspaceId: String(item.routeWorkspaceId || ''), routePath: String(item.routePath || ''), sourceRequirementId: String(item.sourceRequirementId || ''), sourceWorkspaceId: String(item.sourceWorkspaceId || ''), sourcePath: String(item.sourcePath || ''), targetWorkspaceId: String(item.targetWorkspaceId || ''), targetPath: String(item.targetPath || ''), materializedPackagePath: String(item.packagePath || item.selectedMaterial?.packagePath || ''), selectedMaterial: descriptorSelectedMaterial(item.selectedMaterial) });
 }
 function descriptorSelectedMaterial(material = null) {
   if (!material) return null;

package/src/tooling/portable/handoff/materialClosure.materials.js

@@ -110,7 +110,7 @@ function candidateBoundToRequirement(candidate, requirement) {
   return candidate.referenceTarget === target;
 }
 function resolution(disposition, requirement, candidates, selected, capability, reason) {
-  return deepFreeze({ disposition, requirementId: requirement.id, requirementName: String(requirement.name || ''), classification: requirement.classification, referenceTarget: String(requirement.reference?.target || ''), routeWorkspaceId: String(requirement.routeWorkspaceId || ''), routePath: String(requirement.routePath || ''), sourceRequirementId: String(requirement.sourceRequirementId || ''), recipientReferenceCapability: Boolean(capability), selectedMaterial: selected, candidates: Object.freeze(candidates), reason });
+  return deepFreeze({ disposition, requirementId: requirement.id, requirementName: String(requirement.name || ''), classification: requirement.classification, referenceTarget: String(requirement.reference?.target || ''), routeWorkspaceId: String(requirement.routeWorkspaceId || ''), routePath: String(requirement.routePath || ''), sourceRequirementId: String(requirement.sourceRequirementId || ''), sourceWorkspaceId: String(requirement.sourceWorkspaceId || ''), sourcePath: String(requirement.sourcePath || ''), targetWorkspaceId: String(requirement.targetWorkspaceId || ''), targetPath: String(requirement.targetPath || ''), recipientReferenceCapability: Boolean(capability), selectedMaterial: selected, candidates: Object.freeze(candidates), reason });
 }
 function serializable(value = {}) { const out = {}; for (const [key, item] of Object.entries(value || {})) if (typeof item !== 'function' && typeof item !== 'undefined') out[key] = item; return out; }
 function deepFreeze(value) { if (!value || typeof value !== 'object' || Object.isFrozen(value)) return value; if (ArrayBuffer.isView(value) || value instanceof ArrayBuffer) return value; for (const child of Object.values(value)) deepFreeze(child); return Object.freeze(value); }

package/src/tooling/portable/handoff/recipientV2.artifacts.js

@@ -154,7 +154,7 @@ function renderPayloadMaterialBindings(materials = []) {
     const referenceTarget = String(item?.referenceTarget || '').trim();
     const archiveEntry = String(item?.archiveEntry || '').trim();
     if (!requirementId || !referenceTarget || !archiveEntry) return '';
-    return `- Requirement Id: ${requirementId}\n  - Classification: ${classification || 'detached-material'}\n  - Material Reference: ${referenceTarget}\n  - Archive Entry: ${archiveEntry}${item?.routeWorkspaceId ? `\n  - Route Workspace Id: ${String(item.routeWorkspaceId)}` : ''}${item?.routePath ? `\n  - Route Path: ${String(item.routePath)}` : ''}${item?.sourceRequirementId ? `\n  - Source Requirement Id: ${String(item.sourceRequirementId)}` : ''}${item?.originalPath ? `\n  - Original Path: ${String(item.originalPath)}` : ''}${item?.bytes !== undefined ? `\n  - Byte Size: ${Number(item.bytes || 0)}` : ''}${item?.sha256 ? `\n  - SHA256: ${String(item.sha256)}` : ''}`;
+    return `- Requirement Id: ${requirementId}\n  - Classification: ${classification || 'detached-material'}\n  - Material Reference: ${referenceTarget}\n  - Archive Entry: ${archiveEntry}${item?.routeWorkspaceId ? `\n  - Route Workspace Id: ${String(item.routeWorkspaceId)}` : ''}${item?.routePath ? `\n  - Route Path: ${String(item.routePath)}` : ''}${item?.sourceRequirementId ? `\n  - Source Requirement Id: ${String(item.sourceRequirementId)}` : ''}${item?.sourceWorkspaceId ? `\n  - Source Workspace Id: ${String(item.sourceWorkspaceId)}` : ''}${item?.sourcePath ? `\n  - Source Path: ${String(item.sourcePath)}` : ''}${item?.targetWorkspaceId ? `\n  - Target Workspace Id: ${String(item.targetWorkspaceId)}` : ''}${item?.targetPath ? `\n  - Target Path: ${String(item.targetPath)}` : ''}${item?.originalPath ? `\n  - Original Path: ${String(item.originalPath)}` : ''}${item?.bytes !== undefined ? `\n  - Byte Size: ${Number(item.bytes || 0)}` : ''}${item?.sha256 ? `\n  - SHA256: ${String(item.sha256)}` : ''}`;
   }).filter(Boolean).join('\n');
 }
 

package/src/tooling/portable/handoff/recipientV2.inspect.helpers.js

@@ -191,17 +191,22 @@ export function virtualCacheMaterial(cache = {}, findings = []) {
   const byPath = new Map((archive?.entries || []).map((entry) => [String(entry.path || ''), entry]));
   const files = [];
   const materialized = [];
+  const boundEntries = new Map();
   for (const item of cache.facts?.materials || []) {
     const entry = byPath.get(String(item.archiveEntry || ''));
     if (!entry) {
       findings.push(finding('error', 'portable.handoff-v2-surface.cache.entry-missing', 'Context cache declaration does not resolve to exactly one archive entry.', { requirementId: item.requirementId || '', archiveEntry: item.archiveEntry || '' }));
       continue;
     }
+    const archiveEntry = String(item.archiveEntry || '');
+    boundEntries.set(archiveEntry, Number(boundEntries.get(archiveEntry) || 0) + 1);
     if (Number(item.bytes || 0) !== Number(entry.bytes || 0) || String(item.sha256 || '') !== String(entry.sha256 || '')) findings.push(finding('error', 'portable.handoff-v2-surface.cache.entry-identity-mismatch', 'Context cache entry bytes differ from its visible declaration.', { requirementId: item.requirementId || '', archiveEntry: item.archiveEntry || '' }));
     const packagePath = `recipient.v2.cache/${boundedRecipientToken(cache.facts?.workspaceId || 'workspace')}/${boundedRecipientToken(item.requirementId || item.archiveEntry)}.bin`;
     files.push(Object.freeze({ path: packagePath, data: entry.data, size: entry.bytes, kind: 'recipient-v2-virtual-cache-material' }));
-    materialized.push(Object.freeze({ requirementId: String(item.requirementId || ''), classification: String(item.classification || ''), referenceTarget: String(item.referenceTarget || ''), originalPath: String(item.originalPath || ''), packagePath, carrierKind: 'detached-material', bytes: Number(entry.bytes || 0), sha256: String(entry.sha256 || ''), authority: Object.freeze({ carrierDedupBasis: 'visible-cache-artifact-plus-exact-archive-entry-byte-identity' }) }));
+    materialized.push(Object.freeze({ requirementId: String(item.requirementId || ''), classification: String(item.classification || ''), referenceTarget: String(item.referenceTarget || ''), routeWorkspaceId: String(item.routeWorkspaceId || ''), routePath: String(item.routePath || ''), sourceRequirementId: String(item.sourceRequirementId || ''), sourceWorkspaceId: String(item.sourceWorkspaceId || ''), sourcePath: String(item.sourcePath || ''), targetWorkspaceId: String(item.targetWorkspaceId || ''), targetPath: String(item.targetPath || ''), originalPath: String(item.originalPath || ''), packagePath, carrierKind: 'detached-material', bytes: Number(entry.bytes || 0), sha256: String(entry.sha256 || ''), authority: Object.freeze({ carrierDedupBasis: 'visible-cache-artifact-plus-exact-archive-entry-byte-identity' }) }));
   }
+  for (const [archiveEntry, count] of boundEntries) if (count !== 1) findings.push(finding('error', 'portable.handoff-v2-surface.cache.entry-binding-ambiguous', 'Each cache archive entry must be claimed by exactly one visible material binding.', { archiveEntry, count }));
+  for (const entry of archive?.entries || []) if (!boundEntries.has(String(entry.path || ''))) findings.push(finding('error', 'portable.handoff-v2-surface.cache.entry-unbound', 'Each cache archive entry must be claimed by one visible material binding; opaque unbound dependency bytes are not permitted.', { archiveEntry: String(entry.path || '') }));
   return Object.freeze({ files: Object.freeze(files), materialized: Object.freeze(materialized) });
 }
 

package/src/tooling/portable/handoff/recipientV2.packageV1.build.js

@@ -1,9 +1,9 @@
 import { finalizeFile } from '../../../export/package.fileMap.js';
-import { packageFileByteView } from '../../../export/package.bytes.js';
+import { packageFileByteView, sha256Hex } from '../../../export/package.bytes.js';
 import { exportFileMapZipUint8Array } from '../../../export/package.zip.js';
 import { qualifyHandoffWorkspaceTarget } from './workspaceTargetConformance.js';
 import { inspectStoredWorkspaceArchive } from './workspaceByteProvider.js';
-import { renderRecipientV2ExternalPayload, renderRecipientV2Pointer } from './recipientV2.artifacts.js';
+import { RECIPIENT_V2_EXTERNAL_PAYLOAD_SCHEMA_TARGET, renderRecipientV2ExternalPayload, renderRecipientV2Pointer } from './recipientV2.artifacts.js';
 import { RECIPIENT_V2_READ_PATH } from './recipientV2.topology.js';
 import { RECIPIENT_V2_ROUTE_SELECTION_AUTHORITY, RECIPIENT_V2_SIBLING_ROUTE_INFERENCE, recipientV2EntryCurrentRead } from './recipientV2.entryContract.js';
 import { recipientV2TransportFacts } from './recipientV2.transportManifest.js';
@@ -14,8 +14,18 @@ import { RECIPIENT_V2_PACKAGE_V1_FORMAT_ID, RECIPIENT_V2_PACKAGE_V1_ROOT_PATH, R
 import { renderHandoffPackageV1 } from './recipientV2.packageV1.contract.js';
 import { inspectRecipientFacingV2PackageV1 } from './recipientV2.packageV1.inspect.js';
 import { blocked, deepFreeze, exactFile, workspaceSchemaTarget } from './recipientV2.packageV1.shared.js';
+import { sealPasswordWorkspacePayload } from '../../../transport/secureTransportV1.js';
+import { renderTransportEnvelopeV1, TRANSPORT_ENVELOPE_V1_ROLE } from './transportEnvelopeV1.js';
 
-export function buildRecipientFacingV2PackageV1(input = {}) {
+export function buildRecipientFacingV2PackageV1(input = {}) { return buildRecipientFacingV2PackageV1Prepared(input, new Map()); }
+
+export async function buildRecipientFacingV2PackageV1Secure(input = {}) {
+  const prepared = await prepareSealedWorkspaceBindings(input);
+  if (prepared.status !== 'ready') return prepared;
+  return buildRecipientFacingV2PackageV1Prepared(input, prepared.byWorkspaceId);
+}
+
+function buildRecipientFacingV2PackageV1Prepared(input = {}, sealedByWorkspaceId = new Map()) {
   const sourceSurface = input.sourceSurface || null;
   const descriptor = input.descriptor || input.bundle?.handoffClosure || {};
   const carrier = input.carrierProjection || {};
@@ -29,10 +39,11 @@ export function buildRecipientFacingV2PackageV1(input = {}) {
   const route = selected[0];
   const sourceWorkspaceById = new Map((sourceSurface.topology?.workspaces || []).map((item) => [String(item.workspaceId || ''), item]));
   const sourceByPath = new Map((sourceSurface.files || []).map((file) => [String(file.path || ''), file]));
-  // The package-v1 carrier preserves the complete inherited Workspace source chain.
-  // Route closure remains selected and minimal, but complete package-local Workspace
-  // bindings are not pruned merely because one carried Workspace is not on the
-  // selected Handoff's pre-Handoff closure.
+  // The package-v1 carrier preserves every complete Workspace source explicitly
+  // selected for carriage. Route closure remains selected and minimal, but an
+  // explicitly carried Workspace is not pruned merely because it is outside the
+  // selected Handoff's pre-Handoff closure. Qualified package-parent Workspaces
+  // used only as read-only requirement providers remain detached closure material.
   const workspaceIds = [...sourceWorkspaceById.keys()].filter(Boolean).sort();
   const workspacePlans = workspaceIds.map((workspaceId, index) => Object.freeze({ workspaceId, ordinal: index + 3, prefix: `001-${index + 3}`, slug: safeToken(workspaceId) }));
   const files = [];
@@ -54,18 +65,33 @@ export function buildRecipientFacingV2PackageV1(input = {}) {
     const targetQualification = qualifyHandoffWorkspaceTarget({ targetPath: innerPath, targetData, entries: parsed.entries || [] });
     if (targetQualification.state !== 'qualified') { findings.push(finding('error', 'portable.handoff-package-v1.workspace.target-unqualified', 'Exact Workspace artifact bytes inside the snapshot do not qualify.', { workspaceId: plan.workspaceId, reasons: targetQualification.reasons || [] })); continue; }
     const workspacePath = `${plan.prefix}-${plan.slug}.workspace.md`;
-    const archivePath = `${plan.prefix}-${plan.slug}.workspace.zip`;
     const workspaceFile = exactFile(workspacePath, targetData, 'recipient-v2-package-v1-exact-workspace-artifact', 'text/markdown');
-    const archiveFile = exactFile(archivePath, archiveData, 'recipient-v2-package-v1-complete-workspace-snapshot', 'application/zip');
-    files.push(workspaceFile, archiveFile);
+    files.push(workspaceFile);
     const parent = recipientV2ParentAuthority(workspaceFile, 'tiinex.workspace.v1', workspaceSchemaTarget(targetQualification), createdAt);
-    const projection = Object.freeze({
-      workspaceId: plan.workspaceId, ordinal: plan.ordinal, workspacePath, workspaceSha256: workspaceFile.sha256,
-      archivePath, archiveSha256: archiveFile.sha256, sourceWorkspaceTargetInnerPath: innerPath,
-      sourceWorkspaceTargetSha256: workspaceFile.sha256, sourceWorkspaceTargetBytes: workspaceFile.bytes, coverage: 'complete'
-    });
-    topology.workspaces.push(projection);
-    workspaceById.set(plan.workspaceId, { ...projection, file: workspaceFile, parent });
+    const sealedPrepared = sealedByWorkspaceId.get(plan.workspaceId) || null;
+    if (sealedPrepared) {
+      const protectedPayloadPath = `${plan.prefix}-${plan.slug}.protected.bin`;
+      const protectedPayloadDescriptorPath = `${plan.prefix}-${plan.slug}.protected-payload.trace.md`;
+      const transportEnvelopePath = `${plan.prefix}-${plan.slug}.transport-envelope.trace.md`;
+      const projection = Object.freeze({
+        workspaceId: plan.workspaceId, ordinal: plan.ordinal, workspacePath, workspaceSha256: workspaceFile.sha256,
+        snapshotKind: 'password-sealed-workspace-byte-tree', bindingState: 'sealed', protectedPayloadPath, protectedPayloadDescriptorPath, transportEnvelopePath,
+        protectedPayloadBytes: sealedPrepared.protectedPayload.byteLength, sourceWorkspaceTargetSha256: workspaceFile.sha256, sourceWorkspaceTargetBytes: workspaceFile.bytes, coverage: 'complete'
+      });
+      topology.workspaces.push(projection);
+      workspaceById.set(plan.workspaceId, { ...projection, file: workspaceFile, parent, sealed: true });
+    } else {
+      const archivePath = `${plan.prefix}-${plan.slug}.workspace.zip`;
+      const archiveFile = exactFile(archivePath, archiveData, 'recipient-v2-package-v1-complete-workspace-snapshot', 'application/zip');
+      files.push(archiveFile);
+      const projection = Object.freeze({
+        workspaceId: plan.workspaceId, ordinal: plan.ordinal, workspacePath, workspaceSha256: workspaceFile.sha256,
+        archivePath, archiveSha256: archiveFile.sha256, sourceWorkspaceTargetInnerPath: innerPath,
+        sourceWorkspaceTargetSha256: workspaceFile.sha256, sourceWorkspaceTargetBytes: workspaceFile.bytes, coverage: 'complete'
+      });
+      topology.workspaces.push(projection);
+      workspaceById.set(plan.workspaceId, { ...projection, file: workspaceFile, parent });
+    }
   }
 
   if (findings.some((item) => item.severity === 'error')) return blocked('workspace-binding-blocked', findings);
@@ -81,6 +107,15 @@ export function buildRecipientFacingV2PackageV1(input = {}) {
   topology.root = Object.freeze({ path: packageFile.path, sha256: packageFile.sha256 });
   const packageParent = recipientV2ParentAuthority(packageFile, RECIPIENT_V2_PACKAGE_V1_SCHEMA_ID, RECIPIENT_V2_PACKAGE_V1_SCHEMA_TARGET, createdAt);
 
+  for (const workspace of topology.workspaces.filter((item) => item.bindingState === 'sealed')) {
+    const prepared = sealedByWorkspaceId.get(workspace.workspaceId);
+    const protectedFile = exactFile(workspace.protectedPayloadPath, prepared.protectedPayload, 'recipient-v2-package-v1-password-sealed-workspace-payload', 'application/octet-stream');
+    const payloadFacts = recipientV2TransportFacts('password-sealed Workspace protected payload', { workspaceId: workspace.workspaceId, archivePath: protectedFile.path, archiveBytes: protectedFile.bytes, archiveSha256: protectedFile.sha256 });
+    const payloadArtifact = finalizeFile({ path: workspace.protectedPayloadDescriptorPath, kind: 'protected-workspace-payload-descriptor', logicalKind: 'recipient-v2-package-v1-password-sealed-payload-descriptor', mediaType: 'text/markdown', transportFacts: payloadFacts, content: renderRecipientV2ExternalPayload({ createdAt, parent: packageParent, title: `Protected Workspace Payload — ${workspace.workspaceId}`, summary: 'Exact password-sealed Workspace ciphertext. Protected Workspace filenames, directories, inner artifact paths, and plaintext inventory remain encrypted.', label: `${workspace.workspaceId} protected Workspace payload`, kind: 'password-sealed-workspace-ciphertext', mediaType: 'application/octet-stream', format: prepared.envelope.profile.contentEncryptionParameters.binaryFraming, role: 'password-sealed Workspace protected payload', workspaceId: workspace.workspaceId, location: protectedFile.path, bytes: protectedFile.bytes, sha256: protectedFile.sha256 }) });
+    const envelopeArtifact = finalizeFile({ path: workspace.transportEnvelopePath, kind: 'password-sealed-workspace-transport-envelope', logicalKind: 'recipient-v2-package-v1-transport-envelope', mediaType: 'text/markdown', transportFacts: recipientV2TransportFacts(TRANSPORT_ENVELOPE_V1_ROLE, { workspaceId: workspace.workspaceId, workspaceArtifactPath: workspace.workspacePath, protectedPayloadDescriptorPath: workspace.protectedPayloadDescriptorPath, workspaceBindingValue: prepared.envelope.workspaceBindingValue, profileId: prepared.envelope.profile.profileId, profileVersion: prepared.envelope.profile.profileVersion }), content: renderTransportEnvelopeV1({ createdAt, parent: packageParent, workspaceArtifactPath: workspace.workspacePath, protectedPayloadDescriptorPath: workspace.protectedPayloadDescriptorPath, envelope: prepared.envelope }) });
+    files.push(payloadArtifact, envelopeArtifact, protectedFile);
+  }
+
   const bootstrapSource = (input.bundle?.files || []).filter((file) => String(file.path || '').startsWith('tiinex.bootstrap/'));
   if (bootstrapSource.length) {
     const bootstrap = buildRecipientV2BootstrapCarrier(bootstrapSource, createdAt, findings, packageParent);
@@ -101,15 +136,16 @@ export function buildRecipientFacingV2PackageV1(input = {}) {
     const cacheFile = finalizeFile({ path: archivePath, kind: 'handoff-material-cache', logicalKind: 'recipient-v2-package-v1-workspace-dependency-cache', mediaType: 'application/zip', data: cacheBytes });
     const cacheFacts = {
       workspaceId: owningWorkspace.workspaceId, archivePath, archiveBytes: cacheFile.bytes, archiveSha256: cacheFile.sha256,
-      materials: selectedDetached.map((item, index) => ({ requirementId: item.requirementId, classification: item.classification, referenceTarget: item.referenceTarget, routeWorkspaceId: item.routeWorkspaceId, routePath: item.routePath, sourceRequirementId: item.sourceRequirementId, originalPath: item.originalPath, archiveEntry: cacheEntries[index].path, bytes: item.bytes, sha256: item.sha256 }))
+      materials: selectedDetached.map((item, index) => ({ requirementId: item.requirementId, classification: item.classification, referenceTarget: item.referenceTarget, routeWorkspaceId: item.routeWorkspaceId, routePath: item.routePath, sourceRequirementId: item.sourceRequirementId, sourceWorkspaceId: item.sourceWorkspaceId, sourcePath: item.sourcePath, targetWorkspaceId: item.targetWorkspaceId, targetPath: item.targetPath, originalPath: item.originalPath, archiveEntry: cacheEntries[index].path, bytes: item.bytes, sha256: item.sha256 }))
     };
-    const cacheArtifact = finalizeFile({ path: artifactPath, kind: 'tiinex-external-payload-artifact', logicalKind: 'recipient-v2-package-v1-workspace-dependency-cache-reference', mediaType: 'text/markdown', transportFacts: recipientV2TransportFacts('workspace-scoped Handoff dependency cache', cacheFacts), content: renderRecipientV2ExternalPayload({ createdAt, parent: owningWorkspace.parent, title: `Workspace Dependency Cache — ${owningWorkspace.workspaceId}`, summary: 'Exact route-bounded dependency bytes not satisfied by a complete carried Workspace snapshot.', label: `${owningWorkspace.workspaceId} Handoff dependency cache`, kind: 'zip export', role: 'workspace-scoped Handoff dependency cache', location: archivePath, bytes: cacheFile.bytes, sha256: cacheFile.sha256, facts: cacheFacts }) });
+    const cacheArtifact = finalizeFile({ path: artifactPath, kind: 'tiinex-external-payload-artifact', logicalKind: 'recipient-v2-package-v1-workspace-dependency-cache-reference', mediaType: 'text/markdown', transportFacts: recipientV2TransportFacts('workspace-scoped Handoff dependency cache', cacheFacts), content: renderRecipientV2ExternalPayload({ createdAt, parent: owningWorkspace.parent, title: `Workspace Dependency Cache — ${owningWorkspace.workspaceId}`, summary: 'Exact route-bounded dependency bytes not satisfied by a complete carried Workspace snapshot.', label: `${owningWorkspace.workspaceId} Handoff dependency cache`, kind: 'zip export', role: 'workspace-scoped Handoff dependency cache', location: archivePath, bytes: cacheFile.bytes, sha256: cacheFile.sha256, materials: cacheFacts.materials }) });
     files.push(cacheArtifact, cacheFile);
     cache = { workspaceId: owningWorkspace.workspaceId, artifactPath, archivePath, materials: cacheFacts.materials, parent: recipientV2ParentAuthority(cacheArtifact, 'tiinex.external.payload.v1', RECIPIENT_V2_EXTERNAL_PAYLOAD_SCHEMA_TARGET, createdAt) };
     topology.caches.push(Object.freeze({ workspaceId: cache.workspaceId, artifactPath, archivePath, materials: cache.materials }));
   }
 
   if (!owningWorkspace) findings.push(finding('error', 'portable.handoff-package-v1.route.workspace-unresolved', 'Selected Handoff route owning Workspace is not carried.'));
+  else if (owningWorkspace.sealed) findings.push(finding('error', 'portable.handoff-package-v1.route.workspace-sealed-forbidden', 'Selected authoritative Handoff route Workspace must remain a clear verified snapshot in Secure Transport V1.', { workspaceId: owningWorkspace.workspaceId }));
   else {
     const plan = workspacePlans.find((item) => item.workspaceId === owningWorkspace.workspaceId);
     const binding = bindingForWorkspace(descriptor, owningWorkspace.workspaceId);
@@ -144,4 +180,42 @@ export function buildRecipientFacingV2PackageV1(input = {}) {
   return Object.freeze({ status: inspection.status === 'valid' && !findings.some((item) => item.severity === 'error') ? 'ready' : 'blocked', files: Object.freeze(sortedFiles), topology: deepFreeze(topology), inspection, findings: Object.freeze([...findings, ...(inspection.findings || [])]), boundary: 'Recipient-facing tiinex.handoff.package.v1 carrier with exact complete Workspace artifacts/snapshots, bootstrap/cache External Payload ownership retained, and no redundant Workspace External Payload or Workspace Representation companions.' });
 }
 
+
+async function prepareSealedWorkspaceBindings(input = {}) {
+  const protections = Array.isArray(input.sealedWorkspaces) ? input.sealedWorkspaces : [];
+  if (!protections.length) return Object.freeze({ status: 'ready', byWorkspaceId: new Map() });
+  const sourceSurface = input.sourceSurface || null;
+  const carrier = input.carrierProjection || {};
+  if (!sourceSurface || sourceSurface.status !== 'ready') return blocked('source-surface-unready', sourceSurface?.findings || []);
+  const routes = (carrier.routes || []).filter((route) => route.state === 'qualified');
+  const selector = String(input.routeSelector || input.routeId || '').trim();
+  const selected = selector ? routes.filter((route) => route.id === selector || route.workspaceRelativePath === selector || `${String(route.workspaceId || '')}:${String(route.workspaceRelativePath || '')}` === selector || `handoff-route:${String(route.workspaceId || '')}:${String(route.workspaceRelativePath || '')}` === selector) : routes;
+  if (selected.length !== 1) return blocked('route-selection-unresolved', [finding('error', 'portable.handoff-package-v1.route-selection-unresolved', 'Secure package manufacture requires exactly one selected Handoff route.', { count: selected.length })]);
+  const routeWorkspaceId = String(selected[0].workspaceId || '');
+  const sourceWorkspaceById = new Map((sourceSurface.topology?.workspaces || []).map((item) => [String(item.workspaceId || ''), item]));
+  const sourceByPath = new Map((sourceSurface.files || []).map((file) => [String(file.path || ''), file]));
+  const byWorkspaceId = new Map();
+  const findings = [];
+  for (const protection of protections) {
+    const workspaceId = String(protection?.workspaceId || '').trim();
+    if (!workspaceId || byWorkspaceId.has(workspaceId)) { findings.push(finding('error', 'secure-transport.manufacture.workspace-id-invalid', 'Each sealed Workspace selection must identify one unique carried Workspace.', { workspaceId })); continue; }
+    if (workspaceId === routeWorkspaceId) { findings.push(finding('error', 'secure-transport.manufacture.route-workspace-must-remain-clear', 'Secure Transport V1 does not permit sealing the authoritative selected Handoff route Workspace.', { workspaceId })); continue; }
+    const source = sourceWorkspaceById.get(workspaceId);
+    const sourceArchive = source ? sourceByPath.get(String(source.archivePath || '')) : null;
+    if (!source || String(source.coverage || '') !== 'complete' || !sourceArchive) { findings.push(finding('error', 'secure-transport.manufacture.workspace-unresolved', 'Selected sealed Workspace must resolve to one complete qualified source snapshot.', { workspaceId })); continue; }
+    const archiveData = packageFileByteView(sourceArchive);
+    const parsed = inspectStoredWorkspaceArchive(archiveData, { ownedBytes: true });
+    const innerPath = String(source.sourceWorkspaceTargetInnerPath || '');
+    const targetMatches = (parsed.entries || []).filter((entry) => entry.path === innerPath);
+    if (parsed.state !== 'qualified' || targetMatches.length !== 1) { findings.push(finding('error', 'secure-transport.manufacture.workspace-source-unqualified', 'Selected sealed Workspace source archive/Workspace artifact correlation does not qualify.', { workspaceId })); continue; }
+    const targetData = packageFileByteView({ data: targetMatches[0].data });
+    const targetQualification = qualifyHandoffWorkspaceTarget({ targetPath: innerPath, targetData, entries: parsed.entries || [] });
+    if (targetQualification.state !== 'qualified') { findings.push(finding('error', 'secure-transport.manufacture.workspace-target-unqualified', 'Selected sealed Workspace artifact does not qualify before encryption.', { workspaceId, reasons: targetQualification.reasons || [] })); continue; }
+    const sealed = await sealPasswordWorkspacePayload({ plaintext: archiveData, workspaceBindingValue: sha256Hex(targetData), recipients: protection.recipients || [], crypto: input.crypto });
+    if (sealed.state !== 'sealed') { findings.push(finding('error', 'secure-transport.manufacture.seal-failed', 'Selected Workspace could not be sealed under the supported V1 profile.', { workspaceId, reason: sealed.reason || sealed.state })); continue; }
+    byWorkspaceId.set(workspaceId, sealed);
+  }
+  return findings.some((item) => item.severity === 'error') ? blocked('secure-workspace-preparation-blocked', findings) : Object.freeze({ status: 'ready', byWorkspaceId, findings: Object.freeze(findings) });
+}
+
 function hasBootstrap(bundle = {}) { return (bundle.files || []).some((file) => String(file.path || '').startsWith('tiinex.bootstrap/')); }

package/src/tooling/portable/handoff/recipientV2.packageV1.contract.js

@@ -24,7 +24,7 @@ export function renderHandoffPackageV1(input = {}) {
   const packageRole = [HANDOFF_PACKAGE_ROLE, WORKSPACE_PACKAGE_ROLE].includes(String(input.packageRole || '')) ? String(input.packageRole) : HANDOFF_PACKAGE_ROLE;
   const routeProfile = routeProfileForRole(packageRole);
   const workspaces = input.workspaces || [];
-  const workspaceBlocks = workspaces.map((workspace) => `- ${workspace.workspaceId}\n  - Workspace Id: ${workspace.workspaceId}\n  - Workspace Artifact: [${workspace.workspaceId} Workspace](${workspace.workspacePath})\n  - Snapshot Path: [${workspace.workspaceId} Snapshot](${workspace.archivePath})\n  - Workspace Artifact Inner Path: \`${workspace.sourceWorkspaceTargetInnerPath}\`\n  - Snapshot Kind: exact-workspace-byte-tree-archive\n  - Coverage: complete\n  - Binding State: verified\n  - Integrity Method: sha256\n  - Integrity Value: ${workspace.archiveSha256}\n  - Byte Size: ${workspace.archiveBytes || ''}`.replace(/\n  - Byte Size: $/, '')).join('\n');
+  const workspaceBlocks = workspaces.map((workspace) => renderWorkspaceBinding(workspace)).join('\n');
   const unsigned = `# Continuity Context\n\n- Envelope Schema: [tiinex.root.v1](${RECIPIENT_V2_ROOT_SCHEMA_TARGET})\n- Current\n  - Current Schema: [tiinex.handoff.package.v1](${RECIPIENT_V2_PACKAGE_V1_SCHEMA_TARGET})\n  - Created At: ${createdAt}\n  - Summary: Recipient-facing self-contained Handoff carrier identity, discovery, exact complete Workspace snapshot bindings, and fail-closed qualification boundary.\n\n---\n\n# Handoff Package\n\n## Package Identity\n\n- Package Role: ${packageRole}\n- Carrier Kind: self-contained\n\n## Bootstrap Exposure\n\n- Start Artifact: [Start](${input.startPath || RECIPIENT_V2_READ_PATH})\n${input.bootstrapPath ? `- Tooling Bootstrap Descriptor: [Bootstrap](${input.bootstrapPath})\n` : '- Tooling Bootstrap Descriptor: [Bootstrap](001-2-bootstrap.trace.md)\n'}- Bootstrap Rule: start-then-qualified-bootstrap\n\n## Workspace Snapshot Bindings\n\n${workspaceBlocks || '- none'}\n\n## Route Discovery\n\n- Route Placement Rule: ${routeProfile.routePlacementRule}\n- Continue-From Rule: ${routeProfile.continueFromRule}\n- Pre-Handoff Closure Rule: ${routeProfile.preHandoffClosureRule}\n\n## Carrier Continuity\n\n- Carrier Dimension: ${String(lineage.dimension || '001')}\n${lineage.parentDimension ? `- Parent Carrier Dimension: ${String(lineage.parentDimension)}\n` : ''}- Carrier Checkpoint: ${String(lineage.checkpointKind || 'progression')}\n${lineage.majorReason ? `- Major Reason: ${String(lineage.majorReason)}\n` : ''}- Carrier Profile Id: ${carrierProfile.id || 'none'}\n- Required Major Workspace Ids: ${carrierProfile.requiredMajorWorkspaceIds.length ? carrierProfile.requiredMajorWorkspaceIds.join(', ') : 'none'}\n\n## Qualification Boundary\n\n- Receiver Qualification: reverify-carried-authority-and-bytes\n- Failure Policy: fail-closed\n- Derived Inventory Authority: none\n\n## Interpretation Limits\n\n- Does Not Mean: package placement, discovery ancestry, or byte integrity creates Handoff, Workspace, Role, participation, acceptance, provenance, or Parent authority\n- Must Not Be Used To Claim: carrier convenience metadata overrides the authoritative contained artifacts or exact qualified source bytes\n- Generic Payload Boundary: bootstrap/cache payloads retain explicit External Payload ownership when required; complete Workspace snapshot binding is package-local only\n- Generic Representation Boundary: bounded, partial, independently selectable, multi-representation, or external-lifecycle Workspace representations require the generic Workspace Representation contract\n- Carrier Profile Boundary: required Workspace identifiers come only from the explicit carrier profile; literal project Workspace names have no generic semantic meaning\n\n---\n\n# Continuity Integrity\n\n- [sha256-base64url-c14n-v2](${C14N_V2_VALIDATOR_TARGET})\n  - Towards: self\n  - Value: pending\n`;
   const sealed = sealC14nV2Self(unsigned);
   if (sealed.state !== 'sealed') throw new Error(`portable.handoff-package-v1.integrity.seal-failed:${sealed.reason || sealed.state}`);
@@ -58,6 +58,7 @@ export function validatePackageFields(value, findings) {
   for (const [key, expected] of exact) if (String(value?.[key] || '') !== expected) findings.push(finding('error', `portable.handoff-package-v1.field.${key}.invalid`, 'Handoff package v1 required closed-domain field is missing or invalid.', { field: key, expected, observed: String(value?.[key] || '') }));
   if (!value?.startPath || !value?.bootstrapPath) findings.push(finding('error', 'portable.handoff-package-v1.bootstrap-exposure-invalid', 'Start Artifact and Tooling Bootstrap Descriptor must be package-local links.'));
   if (!Array.isArray(value?.workspaces) || !value.workspaces.length) findings.push(finding('error', 'portable.handoff-package-v1.workspace-bindings-missing', 'Handoff package v1 requires at least one complete Workspace snapshot binding.'));
+  for (const binding of value?.workspaces || []) validateWorkspaceBinding(binding, findings);
   if (!validCarrierDimension(value?.carrierDimension)) findings.push(finding('error', 'portable.handoff-package-v1.carrier-dimension-invalid', 'Carrier Dimension must be a canonical numeric hyphen path.', { value: value?.carrierDimension || '' }));
   if (value?.parentCarrierDimension && !validCarrierDimension(value.parentCarrierDimension)) findings.push(finding('error', 'portable.handoff-package-v1.parent-carrier-dimension-invalid', 'Parent Carrier Dimension must be a canonical numeric hyphen path.', { value: value.parentCarrierDimension || '' }));
   if (!['progression', 'major'].includes(String(value?.carrierCheckpoint || ''))) findings.push(finding('error', 'portable.handoff-package-v1.carrier-checkpoint-invalid', 'Carrier Checkpoint must be progression or major.'));
@@ -82,12 +83,16 @@ function parseWorkspaceBindings(text = '') {
       if (key === 'Workspace Id') current.workspaceId = value;
       else if (key === 'Workspace Artifact') current.workspaceArtifactPath = markdownTarget(value);
       else if (key === 'Snapshot Path') current.snapshotPath = markdownTarget(value);
+      else if (key === 'Protected Payload Descriptor') current.protectedPayloadDescriptorPath = markdownTarget(value);
+      else if (key === 'Transport Envelope') current.transportEnvelopePath = markdownTarget(value);
       else if (key === 'Workspace Artifact Inner Path') current.workspaceArtifactInnerPath = unquote(value);
       else if (key === 'Snapshot Kind') current.snapshotKind = value;
       else if (key === 'Coverage') current.coverage = value;
       else if (key === 'Binding State') current.bindingState = value;
       else if (key === 'Integrity Method') current.integrityMethod = value;
       else if (key === 'Integrity Value') current.integrityValue = value;
+      else if (key === 'Protection State') current.protectionState = value;
+      else if (key === 'Post-Open Correlation Rule') current.postOpenCorrelationRule = value;
       else if (key === 'Byte Size') current.byteSize = /^\d+$/.test(value) ? Number(value) : null;
     }
     out.push(current);
@@ -95,6 +100,30 @@ function parseWorkspaceBindings(text = '') {
   return out.map((item) => Object.freeze({ ...item, byteSize: item.byteSize ?? null }));
 }
 
+
+function renderWorkspaceBinding(workspace = {}) {
+  const sealed = String(workspace.snapshotKind || '') === 'password-sealed-workspace-byte-tree' || String(workspace.bindingState || '') === 'sealed';
+  if (sealed) return `- ${workspace.workspaceId}\n  - Workspace Id: ${workspace.workspaceId}\n  - Workspace Artifact: [${workspace.workspaceId} Workspace](${workspace.workspacePath})\n  - Protected Payload Descriptor: [${workspace.workspaceId} Protected Payload](${workspace.protectedPayloadDescriptorPath})\n  - Transport Envelope: [${workspace.workspaceId} Transport Envelope](${workspace.transportEnvelopePath})\n  - Snapshot Kind: password-sealed-workspace-byte-tree\n  - Coverage: complete\n  - Binding State: sealed\n  - Protection State: password-sealed\n  - Post-Open Correlation Rule: unique-exact-workspace-artifact-byte-match`;
+  return `- ${workspace.workspaceId}\n  - Workspace Id: ${workspace.workspaceId}\n  - Workspace Artifact: [${workspace.workspaceId} Workspace](${workspace.workspacePath})\n  - Snapshot Path: [${workspace.workspaceId} Snapshot](${workspace.archivePath})\n  - Workspace Artifact Inner Path: \`${workspace.sourceWorkspaceTargetInnerPath}\`\n  - Snapshot Kind: exact-workspace-byte-tree-archive\n  - Coverage: complete\n  - Binding State: verified\n  - Integrity Method: sha256\n  - Integrity Value: ${workspace.archiveSha256}\n  - Byte Size: ${workspace.archiveBytes || ''}`.replace(/\n  - Byte Size: $/, '');
+}
+
+function validateWorkspaceBinding(binding = {}, findings = []) {
+  const workspaceId = String(binding.workspaceId || '');
+  if (!workspaceId || !binding.workspaceArtifactPath || String(binding.coverage || '') !== 'complete') findings.push(finding('error', 'portable.handoff-package-v1.workspace-binding-common-invalid', 'Workspace binding requires Workspace Id, Workspace Artifact, and complete coverage.', { workspaceId }));
+  const kind = String(binding.snapshotKind || '');
+  if (kind === 'exact-workspace-byte-tree-archive') {
+    if (String(binding.bindingState || '') !== 'verified' || !binding.snapshotPath || !binding.workspaceArtifactInnerPath || String(binding.integrityMethod || '') !== 'sha256' || !/^[0-9a-f]{64}$/.test(String(binding.integrityValue || ''))) findings.push(finding('error', 'portable.handoff-package-v1.workspace-binding-clear-invalid', 'Clear Workspace binding requires exact complete verified sha256 snapshot fields.', { workspaceId }));
+    if (binding.protectedPayloadDescriptorPath || binding.transportEnvelopePath || binding.protectionState || binding.postOpenCorrelationRule) findings.push(finding('error', 'portable.handoff-package-v1.workspace-binding-clear-sealed-fields-forbidden', 'Clear Workspace binding must not expose sealed-only binding fields.', { workspaceId }));
+    return;
+  }
+  if (kind === 'password-sealed-workspace-byte-tree') {
+    if (String(binding.bindingState || '') !== 'sealed' || !binding.protectedPayloadDescriptorPath || !binding.transportEnvelopePath || String(binding.protectionState || '') !== 'password-sealed' || String(binding.postOpenCorrelationRule || '') !== 'unique-exact-workspace-artifact-byte-match') findings.push(finding('error', 'portable.handoff-package-v1.workspace-binding-sealed-invalid', 'Sealed Workspace binding requires exact password-sealed binding fields.', { workspaceId }));
+    if (binding.snapshotPath || binding.workspaceArtifactInnerPath || binding.integrityMethod || binding.integrityValue) findings.push(finding('error', 'portable.handoff-package-v1.workspace-binding-sealed-clear-fields-forbidden', 'Sealed Workspace binding must not expose clear snapshot path, inner Workspace path, or duplicated payload integrity fields.', { workspaceId }));
+    return;
+  }
+  findings.push(finding('error', 'portable.handoff-package-v1.workspace-binding-kind-invalid', 'Workspace binding Snapshot Kind is unsupported.', { workspaceId, snapshotKind: kind }));
+}
+
 function normalizeProfileId(value = '') {
   const text = String(value || '').trim();
   return text.toLowerCase() === 'none' ? '' : text;

package/src/tooling/portable/handoff/recipientV2.packageV1.inspect.helpers.js

@@ -7,6 +7,7 @@ import { parentTrace } from './recipientV2.lineage.js';
 import { finding } from './recipientV2.topology.materials.js';
 import { RECIPIENT_V2_PACKAGE_V1_FORMAT_ID, RECIPIENT_V2_PACKAGE_V1_ROOT_PATH } from './recipientV2.packageV1.constants.js';
 import { currentSchemaId, decodeUtf8, field, markdownTarget, numericDimension, oneFile, sectionText, unquote } from './recipientV2.packageV1.shared.js';
+import { parseTransportEnvelopeV1, TRANSPORT_ENVELOPE_V1_ROLE, TRANSPORT_ENVELOPE_V1_SCHEMA_ID } from './transportEnvelopeV1.js';
 
 export function validateRouteClosure(routePointers, endpointPointers, participantPointers, caches, workspaces, findings) {
   const roles = new Map([...(endpointPointers || []), ...(participantPointers || [])].map((item) => [item.path, item]));
@@ -55,7 +56,7 @@ function validateNumericParentChain(pointer, roles, cacheByPath, workspace, find
   }
 }
 
-export function deriveVisibleFacts({ markdown = '', schemaId = '', packageContract = null, index = new Map() } = {}) {
+export function deriveVisibleFacts({ file = null, markdown = '', schemaId = '', packageContract = null, index = new Map() } = {}) {
   if (schemaId === 'tiinex.pointer.v1') {
     const visible = parseRecipientV2Pointer(markdown);
     const role = String(visible.role || '');
@@ -84,6 +85,11 @@ export function deriveVisibleFacts({ markdown = '', schemaId = '', packageContra
     }
     return base;
   }
+  if (schemaId === TRANSPORT_ENVELOPE_V1_SCHEMA_ID) {
+    const visible = parseTransportEnvelopeV1(markdown);
+    const workspaceId = (packageContract?.workspaces || []).find((item) => item.transportEnvelopePath === file?.path)?.workspaceId || '';
+    return { factsFormat: 'portable-recipient-v2', factsVersion: 1, role: TRANSPORT_ENVELOPE_V1_ROLE, workspaceId: String(workspaceId || ''), workspaceArtifactPath: visible.workspaceArtifactPath, protectedPayloadDescriptorPath: visible.protectedPayloadDescriptorPath, workspaceBindingValue: visible.workspaceBindingValue, profileId: visible.profile?.profileId || '', profileVersion: Number(visible.profile?.profileVersion || 0) };
+  }
   if (schemaId === 'tiinex.external.payload.v1') {
     const visible = parseRecipientV2ExternalPayload(markdown);
     const role = String(visible.payloadRole || '');
@@ -118,7 +124,7 @@ function parsePayloadMaterials(section = '') {
     if (first) { if (current) out.push(current); current = { requirementId: first[1].trim() }; continue; }
     const match = line.match(/^\s{2}-\s+([^:]+):\s*(.*)$/); if (!current || !match) continue;
     const key = match[1].trim(), value = match[2].trim();
-    if (key === 'Classification') current.classification = value; else if (key === 'Material Reference') current.referenceTarget = value; else if (key === 'Archive Entry') current.archiveEntry = value; else if (key === 'Route Workspace Id') current.routeWorkspaceId = value; else if (key === 'Route Path') current.routePath = value; else if (key === 'Source Requirement Id') current.sourceRequirementId = value; else if (key === 'Original Path') current.originalPath = value; else if (key === 'Byte Size') current.bytes = Number(value || 0); else if (key === 'SHA256') current.sha256 = value;
+    if (key === 'Classification') current.classification = value; else if (key === 'Material Reference') current.referenceTarget = value; else if (key === 'Archive Entry') current.archiveEntry = value; else if (key === 'Route Workspace Id') current.routeWorkspaceId = value; else if (key === 'Route Path') current.routePath = value; else if (key === 'Source Requirement Id') current.sourceRequirementId = value; else if (key === 'Source Workspace Id') current.sourceWorkspaceId = value; else if (key === 'Source Path') current.sourcePath = value; else if (key === 'Target Workspace Id') current.targetWorkspaceId = value; else if (key === 'Target Path') current.targetPath = value; else if (key === 'Original Path') current.originalPath = value; else if (key === 'Byte Size') current.bytes = Number(value || 0); else if (key === 'SHA256') current.sha256 = value;
   }
   if (current) out.push(current);
   return out;