diff --git a/packages/artplayer-plugin-hls-control/.npmignore b/packages/artplayer-plugin-hls-control/.npmignore
index 4439c6874..2b272d565 100644
--- a/packages/artplayer-plugin-hls-control/.npmignore
+++ b/packages/artplayer-plugin-hls-control/.npmignore
@@ -2,4 +2,5 @@ node_modules
 .DS_Store
 yarn.lock
 package-lock.json
-src
\ No newline at end of file
+src
+tsconfig.json
diff --git a/packages/artplayer-plugin-hls-control/ARCHITECTURE.md b/packages/artplayer-plugin-hls-control/ARCHITECTURE.md
index dd34c2957..a46eb5bed 100644
--- a/packages/artplayer-plugin-hls-control/ARCHITECTURE.md
+++ b/packages/artplayer-plugin-hls-control/ARCHITECTURE.md
@@ -134,3 +134,11 @@ it adds an evaluate and may change timing, so it is off by default. Direct ordin
 HTTP without ArtPlayer/plugin or a Worker observer still reproduced crashes with
 both reset-first and SDK-first teardown. A passing no-worker control does not
 replace worker acceptance. See the 2026-09-14 HTTP teardown checkpoint in refactor.
+
+## Package file boundary
+
+The package .npmignore excludes src and tsconfig.json. The implementation config
+extends the repository root and must not ship to consumers. PKG-HLS-PACK-01
+compares real Yarn archives before/after the exclusion: all distribution and
+declaration bytes must remain identical, with every historical entry retained.
+See ../../refactor/changes/2026-09-15-PKG-HLS-PACK-01-config.md.
diff --git a/refactor/baselines/hls-pack-config-validation.json b/refactor/baselines/hls-pack-config-validation.json
new file mode 100644
index 000000000..c135fb082
--- /dev/null
+++ b/refactor/baselines/hls-pack-config-validation.json
@@ -0,0 +1,88 @@
+{
+  "task": "PKG-HLS-PACK-01",
+  "capturedAt": "2026-09-14T18:19:43.946Z",
+  "sourceHead": "2d45135873595ce18bdb8ea643da8c6e089ff6fc",
+  "node": "24.21.0",
+  "yarn": "1.22.22",
+  "before": {
+    "path": "refactor/.cache/packages/run-5SF5jI/artplayer-plugin-hls-control.tgz",
+    "sha256": "acde688170f089952c94399aa0caf1fcde6d4e0ad508de789364811340b4d7d4",
+    "files": [
+      "package/ARCHITECTURE.md",
+      "package/README.md",
+      "package/dist/artplayer-plugin-hls-control.js",
+      "package/dist/artplayer-plugin-hls-control.legacy.js",
+      "package/dist/artplayer-plugin-hls-control.mjs",
+      "package/package.json",
+      "package/tsconfig.json",
+      "package/types/artplayer-plugin-hls-control.d.cts",
+      "package/types/artplayer-plugin-hls-control.d.mts",
+      "package/types/artplayer-plugin-hls-control.d.ts"
+    ],
+    "rejected": "Implementation tsconfig leaked into package"
+  },
+  "interim": {
+    "path": "refactor/.cache/hls-pack-fix/artplayer-plugin-hls-control.tgz",
+    "sha256": "4657a8b8554ce262affbbd637a3f10ad4f8d085dce305d4a466520e4cc5d6c4d",
+    "rejected": "Source/dependencies leaked into package",
+    "reason": "Original ignore file had no final newline; first append joined src and tsconfig. Corrected with two explicit lines; interim archive retained."
+  },
+  "after": {
+    "path": "refactor/.cache/hls-pack-fix/artplayer-plugin-hls-control-fixed.tgz",
+    "sha256": "3358eb2dd4c46958b5bbc23c2a0a571266dcee905b594f1666c29f5f5b14bd93",
+    "files": [
+      "package/ARCHITECTURE.md",
+      "package/README.md",
+      "package/dist/artplayer-plugin-hls-control.js",
+      "package/dist/artplayer-plugin-hls-control.legacy.js",
+      "package/dist/artplayer-plugin-hls-control.mjs",
+      "package/package.json",
+      "package/types/artplayer-plugin-hls-control.d.cts",
+      "package/types/artplayer-plugin-hls-control.d.mts",
+      "package/types/artplayer-plugin-hls-control.d.ts"
+    ],
+    "passed": true
+  },
+  "removed": [
+    "package/tsconfig.json"
+  ],
+  "byteEqual": [
+    {
+      "file": "package/dist/artplayer-plugin-hls-control.js",
+      "sha256": "8e163d4ab6734cbc45e7f539de7db644c7faf36d0318469a86d300bf6365cca6"
+    },
+    {
+      "file": "package/dist/artplayer-plugin-hls-control.legacy.js",
+      "sha256": "fd7be1c5bf8f994b61fc040ff96eb628fc442568d99f4b5fee4f611bac1d28c0"
+    },
+    {
+      "file": "package/dist/artplayer-plugin-hls-control.mjs",
+      "sha256": "64286498c1e90c3927236318383db193698a9dcbf39f91e93fc2b4ea2239e786"
+    },
+    {
+      "file": "package/types/artplayer-plugin-hls-control.d.cts",
+      "sha256": "ad4c3e7f7d2ba6b8371108bf08dfa13cccf78a1add846ba53cab8774c8fff0b6"
+    },
+    {
+      "file": "package/types/artplayer-plugin-hls-control.d.mts",
+      "sha256": "27a3a17a48f0bc92c3c50783be253730d87d01e9be627ab2726bdc552fecf1f3"
+    },
+    {
+      "file": "package/types/artplayer-plugin-hls-control.d.ts",
+      "sha256": "3bce772f8f7cb7b6421b2c2dc4a1ea22987f3f1483f1dca7ca4ab08f75cf7a9d"
+    }
+  ],
+  "manifestUnchanged": true,
+  "historicalFiles": [
+    "package/README.md",
+    "package/dist/artplayer-plugin-hls-control.js",
+    "package/dist/artplayer-plugin-hls-control.legacy.js",
+    "package/dist/artplayer-plugin-hls-control.mjs",
+    "package/package.json",
+    "package/types/artplayer-plugin-hls-control.d.ts"
+  ],
+  "limitations": [
+    "Normal Yarn pack on the same isolated source-build snapshot, replacing only ignore and architecture files. No playback or full release approval claim.",
+    "Architecture documentation changes intentionally; all dist/types and package.json bytes remain unchanged."
+  ]
+}
diff --git a/refactor/changes/2026-09-15-PKG-HLS-PACK-01-config.md b/refactor/changes/2026-09-15-PKG-HLS-PACK-01-config.md
new file mode 100644
index 000000000..e8890d421
--- /dev/null
+++ b/refactor/changes/2026-09-15-PKG-HLS-PACK-01-config.md
@@ -0,0 +1,18 @@
+# PKG-HLS-PACK-01 排除 npm 包中的内部 tsconfig
+
+CI-01 的十二包真实打包在 HLS Control 被现有 checkFiles 拒绝：.npmignore 排除了
+src，却遗漏 tsconfig.json。该内部配置引用仓库根目录，不属于公开消费者入口。
+给排除规则单独添加 tsconfig.json；公开 JS、声明、导出和运行时行为不变。
+
+使用同一隔离源码构建快照，以固定 Node 24.21.0 / Yarn 1.22.22 实际 pack 比较：
+旧归档准确复现 Implementation tsconfig leaked，新归档完整文件校验通过，仅移除
+package/tsconfig.json；六个 dist/types 文件和 package.json 精确字节不变，实际旧版
+全部分发文件保留。现有泄漏负例与实际归档校验组成回归证据，不增加镜像测试。
+
+实施中首次追加遇到旧 ignore 文件无末尾换行，导致 src 与新规则拼接；实际包检查
+又正确拒绝 src 泄漏。已改为两条明确规则，中间失败归档保留，没有覆盖首轮错误。
+见 [机器证据](../baselines/hls-pack-config-validation.json)。这不代表重新验证播放、
+全包模块消费或完整十二包安装。CI-01 接续实际安装与浏览器验证，HLS-06 仍开放。
+
+包内 ARCHITECTURE.md 记录产物边界。没有更换依赖、锁文件或生成 JS；撤销本任务
+会恢复内部配置泄漏。未推送或发布。
diff --git a/refactor/plan.md b/refactor/plan.md
index 3905db857..bc38fb5ff 100644
--- a/refactor/plan.md
+++ b/refactor/plan.md
@@ -2,9 +2,9 @@
 
 > 由 tasks.json 生成。请修改数据后运行 `node refactor/scripts/plan.mjs --write`，不要手改本表。
 
-基线：`40fcda6a37d0049d42e49c1e64e70d4fd9ba5f7f`。总任务 262 项，范围 22 个包及工作区/示例。
+基线：`40fcda6a37d0049d42e49c1e64e70d4fd9ba5f7f`。总任务 263 项，范围 22 个包及工作区/示例。
 
-状态：todo 44 / doing 22 / blocked 0 / done 196 / deferred 0。风险 L/M/H 表示兼容风险，不表示工期。
+状态：todo 44 / doing 22 / blocked 0 / done 197 / deferred 0。风险 L/M/H 表示兼容风险，不表示工期。
 
 前置依赖是启动条件；验收是完成条件。任务可以继续拆分，但不能复用或悄悄删除旧 ID。
 
@@ -26,7 +26,7 @@
 | artplayer-plugin-danmuku-mask | 1.1.0 | PKG-MASK-01, PKG-MASK-02, PKG-MASK-03, PKG-MASK-04, PKG-MASK-05, PKG-MASK-06, ENG-LINT-01, PKG-DANMUKU-MASK-LOAD-01 |
 | artplayer-plugin-dash-control | 1.1.0 | PKG-DASH-01, PKG-DASH-02, PKG-DASH-03, PKG-DASH-04, PKG-DASH-SEEK-01, PKG-DASH-MENU-01, PKG-DASH-05, PKG-DASH-06 |
 | artplayer-plugin-document-pip | 1.1.0 | PKG-DPIP-01, PKG-DPIP-02, PKG-DPIP-03, PKG-DPIP-04, PKG-DPIP-05, PKG-DPIP-06 |
-| artplayer-plugin-hls-control | 1.1.0 | PKG-HLS-01, PKG-HLS-02, PKG-HLS-03, PKG-HLS-04, PKG-HLS-SDK-01, PKG-HLS-05, PKG-HLS-06 |
+| artplayer-plugin-hls-control | 1.1.0 | PKG-HLS-01, PKG-HLS-02, PKG-HLS-03, PKG-HLS-04, PKG-HLS-SDK-01, PKG-HLS-05, PKG-HLS-06, PKG-HLS-PACK-01 |
 | artplayer-plugin-jassub | 1.1.0 | PKG-JASSUB-01, PKG-JASSUB-02, PKG-JASSUB-03, PKG-JASSUB-04, PKG-JASSUB-05, PKG-JASSUB-06, PKG-JASSUB-07, PKG-JASSUB-08, PKG-JASSUB-09, PKG-JASSUB-10 |
 | artplayer-plugin-multiple-subtitles | 1.2.0 | PKG-MULTI-SUB-01, PKG-MULTI-SUB-02, PKG-MULTI-SUB-03, PKG-MULTI-SUB-04, PKG-MULTI-SUB-07, PKG-MULTI-SUB-08, PKG-MULTI-SUB-05, PKG-MULTI-SUB-06, PKG-MULTI-SUB-09, PKG-MULTI-SUB-10, PKG-MULTI-SUB-11 |
 | artplayer-plugin-vast | 1.2.0 | PKG-VAST-01, PKG-VAST-02, PKG-VAST-03, PKG-VAST-04, PKG-VAST-05, PKG-VAST-06, PKG-VAST-07 |
@@ -208,7 +208,8 @@
 | PKG-HLS-04 | artplayer-plugin-hls-control<br>迁移自有源码和公开类型 | PKG-HLS-03, ENG-04, ENG-06, CORE-07 | HLS 能力适配类型、回调上下文和旧 getName 参数 | 严格类型检查、旧消费样例通过；声明路径/导出和同步异步兼容 | H | done |
 | PKG-HLS-SDK-01 | artplayer-plugin-hls-control<br>验证真实 SDK worker 与分组轨道组合 | PKG-HLS-04, CORE-22 | 固定历史及当前 SDK 归档、真实 worker/多音轨组、外部选择与重绑定浏览器证据 | 受支持桌面 MSE 引擎与新旧核心通过；无 worker 回退伪通过，设备缺口仍由 PKG-HLS-05 保持未完成 | H | doing |
 | PKG-HLS-05 | artplayer-plugin-hls-control<br>验证新旧核心和组合 | PKG-HLS-04, CORE-22, PKG-HLS-SDK-01 | 本地多码率 HLS、换成无轨道来源、旧核心和最终核心 | 最终核心与原支持范围核心分别通过；设备/SDK 缺证据不能标完成 | H | todo |
-| PKG-HLS-06 | artplayer-plugin-hls-control<br>验证分发并同步文档 | PKG-HLS-05, ENG-07 | hls.control.js、依赖范围与回退记录 | tarball 入口/资源、类型、8082 demo 和 README 一致，有回退记录 | H | todo |
+| PKG-HLS-06 | artplayer-plugin-hls-control<br>验证分发并同步文档 | PKG-HLS-05, ENG-07, PKG-HLS-PACK-01 | hls.control.js、依赖范围与回退记录 | tarball 入口/资源、类型、8082 demo 和 README 一致，有回退记录 | H | todo |
+| PKG-HLS-PACK-01 | artplayer-plugin-hls-control<br>排除发布包内的实现 TypeScript 配置 | PKG-HLS-04, ENG-07 | 修正 npm 排除规则，真实打包核验公开入口与声明不变 | 旧归档复现 tsconfig 泄漏，新归档排除内部配置，全部历史 dist/types 保留且 JS/声明字节相同；正常 Yarn 打包与通用包校验通过 | M | done |
 
 ## 5 包迁移：artplayer-plugin-dash-control
 
@@ -689,3 +690,4 @@
 - PKG-CHAPTER-HOVER-01: [记录](changes/2026-09-14-PKG-CHAPTER-HOVER-01-geometry.md) [记录](baselines/chapter-hover-validation.json)
 - PKG-CANVAS-SUBTITLE-01: [记录](changes/2026-09-14-PKG-CANVAS-SUBTITLE-01-track.md) [记录](baselines/canvas-subtitles-validation.json)
 - PKG-DANMUKU-MASK-LOAD-01: [记录](changes/2026-09-14-PKG-DANMUKU-08-combined-load.md) [记录](baselines/danmuku-combined-load-validation.json) [记录](changes/2026-09-14-PKG-DANMUKU-MASK-LOAD-01-scheduling.md) [记录](baselines/danmuku-mask-load-validation.json)
+- PKG-HLS-PACK-01: [记录](changes/2026-09-15-PKG-HLS-PACK-01-config.md) [记录](baselines/hls-pack-config-validation.json)
diff --git a/refactor/progress.md b/refactor/progress.md
index f3de1aa42..b106253f1 100644
--- a/refactor/progress.md
+++ b/refactor/progress.md
@@ -1,5 +1,12 @@
 # 进度与证据
 
+## PKG-HLS-PACK-01 修正实现配置进入 npm 包
+
+十二包安装准备发现 HLS 的内部 tsconfig 未排除。已修正 .npmignore，实际旧包
+拒绝/新包通过，六个公开 JS/声明文件与 package.json 字节不变；中间换行拼接
+错误也被校验拦截并保留归档。见[记录](changes/2026-09-15-PKG-HLS-PACK-01-config.md)。
+此任务独立完成，263 项现为 197 done、22 doing、44 todo；CI-01 接续安装与浏览器。
+
 ## CI-01 音频、缩略图和多字幕接入安装矩阵
 
 九包安装与完整文件核验通过，统一安装清单扩展到 25 文件/762 项。本轮新增
diff --git a/refactor/tasks.json b/refactor/tasks.json
index eac6cf312..6c32eebf6 100644
--- a/refactor/tasks.json
+++ b/refactor/tasks.json
@@ -2150,7 +2150,8 @@
       ],
       "dependsOn": [
         "PKG-HLS-05",
-        "ENG-07"
+        "ENG-07",
+        "PKG-HLS-PACK-01"
       ],
       "status": "todo",
       "risk": "H",
@@ -5524,6 +5525,26 @@
         "changes/2026-09-14-PKG-DANMUKU-MASK-LOAD-01-scheduling.md",
         "baselines/danmuku-mask-load-validation.json"
       ]
+    },
+    {
+      "id": "PKG-HLS-PACK-01",
+      "phase": "5 包迁移：artplayer-plugin-hls-control",
+      "title": "排除发布包内的实现 TypeScript 配置",
+      "scope": [
+        "artplayer-plugin-hls-control"
+      ],
+      "dependsOn": [
+        "PKG-HLS-04",
+        "ENG-07"
+      ],
+      "status": "done",
+      "risk": "M",
+      "deliverable": "修正 npm 排除规则，真实打包核验公开入口与声明不变",
+      "acceptance": "旧归档复现 tsconfig 泄漏，新归档排除内部配置，全部历史 dist/types 保留且 JS/声明字节相同；正常 Yarn 打包与通用包校验通过",
+      "evidence": [
+        "changes/2026-09-15-PKG-HLS-PACK-01-config.md",
+        "baselines/hls-pack-config-validation.json"
+      ]
     }
   ]
 }