chore(release): @hasna/knowledge 0.2.105

[andrei-hasna]

Summary

• bump @hasna/knowledge to 0.2.105
• record the canonical API URL and fail-closed project-resource response fix
• rebuild the three version-bearing public artifacts deterministically

Verification

• focused project-resource/API URL tests: 15 pass, 0 fail
• full suite: 493 pass, 2 skip, 0 fail
• build-config typecheck: exit 0
• build: exit 0
• generated-artifact verification: 6 bundles rebuild byte-identically
• public package tests: 7 pass, 0 fail
• public package validator: ok, 82 files
• npm pack dry run: @hasna/knowledge@0.2.105
• contracts conformance: valid/invalid fixtures pass
• no-cloud scan: pass
• prepublish gate: pass
• staged and exact-range redacted gitleaks: no leaks found
• gitleaks positive control: leaks found: 1
• git diff check: exit 0

Task: KNO-00027

This PR is intentionally draft and stops before review, merge, tag, publish,
install, or deploy.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] NO_GO — #93 @ 599f9de — lens: correctness+isolation+wiring, reviewer codewith-sol-reviewer (1 of 1)

P0: None found.

P1 — src/project-links.ts: the HTTP response validators check field shape but do not bind a returned page/resource to the requested project, kind, resource ID, requested kind set, or client authority identity. listProjectResources() passes the response to assertProjectResourcePage() without expected request identity; readProjectResource() likewise accepts any structurally valid resource envelope. Executing the exact head with a supported injected fetch returned these literal lines at exit 0:

LIST accepted requested=requested returned=other tenant=tenant-b

EXACT accepted requested=requested/project/requested returned=other/project/other

The CLI then wraps these results as ok: true. A valid-shaped cross-project (and potentially cross-tenant) response therefore defeats exact-read isolation and the release claim that malformed success responses fail closed. Bind the validated envelope and every resource to the requested project/kind/id and expected authority identity; add negative tests for wrong-project, wrong-kind, wrong-id, and mixed-resource pages.

P2: None recorded.

P3: None recorded.

Could not verify production API behavior, publish/install, or the post-merge registry artifact. Exact-head GitHub checks were complete: seven succeeded and one optional check was skipped. The PR was still draft. No repository was modified and no merge was performed.

[andrei-hasna]

VERDICT: GO

Focused independent re-review of the one named release-provenance blocker on exact candidate:

• base: 13bd7f1fd6ee9a2a706ca440995891c65389a041
• head: f99eb64a84d487664c183dda71c49130b56f2de4
• head / merge-result tree: ccd5e7de9a3cdc099281dd6b11b3aa725b0a0b69
• prior blocked head: 599f9dee67b3fdd9149d7371a06ef581e98d6f03

The named P1 is fixed. The remediation pins typescript exactly at 5.9.3 in package.json and bun.lock, invokes the package-local compiler with bun run tsc, regenerates the affected declarations/bundles, and adds a focused release regression that rejects a floating compiler or bunx tsc.

Independent focused evidence:

• fresh bun install --frozen-lockfile: typescript@5.9.3, exit 0
• bun run tsc --version: Version 5.9.3, exit 0
• package release regression: 8 pass, 0 fail
• bun run verify:generated: verify-generated-artifacts: 6 generated bundles rebuild byte-identically and carry no stale generated code., exit 0; worktree remained clean
• bun run prepublishOnly: contracts conformance, no-cloud scan, build, and public-package validator all passed; worktree remained clean
• package before and after prepublish: 82 files both times; byte comparison exit 0; both SHA-256 43e9014c85f80c0daa9b8c42fcab72feb1f2af775ac214a3b5833e3f2a5019ef
• isolated tarball install succeeded; Bun imports for root/storage/serve passed; Node import of the supported ./serve export passed; installed CLI reported @hasna/knowledge 0.2.105
• remediation diff check passed; range scan reported no leaks found across the one remediation commit
• CI run 31542384609 is terminal success on this exact head with all seven required jobs successful

No concrete reachable in-scope P0/P1 direct regression remains in deterministic package bytes, install/publish provenance, package integrity, secrets, or compatibility. No new P2/P3 item is required from this focused pass.