hasna · andrei-hasna · Aug 11, 2026 · Aug 11, 2026 · Aug 11, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.2.105
+
+- Honor the canonical Knowledge API URL and fail closed with typed errors when
+  paged or exact project-resource responses omit or malform their envelopes,
+  preventing false `ok: true` results and undefined-resource crashes.
+
 ## 0.2.104
 
 - Add package-owned guarded CLI helpers for create, update, bounded query, and

diff --git a/bin/knowledge-mcp.js b/bin/knowledge-mcp.js
@@ -14997,7 +14997,7 @@ import { existsSync as existsSync15, readFileSync as readFileSync14, writeFileSy
 // package.json
 var package_default = {
   name: "@hasna/knowledge",
-  version: "0.2.104",
+  version: "0.2.105",
   description: "Agent-friendly local knowledge CLI with JSON output, pagination, and safe destructive actions",
   type: "module",
   exports: {
@@ -15056,7 +15056,7 @@ var package_default = {
     serve: "bun src/serve-entry.ts",
     "verify:generated": "bun scripts/verify-generated-artifacts.mjs",
     "contracts:conformance": "contracts conformance fixtures",
-    build: "rm -rf dist && bun build --target=bun --outfile=bin/knowledge.js --minify --external pg --external @hasna/machines --external @hasna/machines/consumer --external @aws-sdk/client-s3 --external @aws-sdk/credential-providers --external ai --external @ai-sdk/openai --external @ai-sdk/anthropic --external @ai-sdk/deepseek src/cli.ts && bun build --target=bun --outfile=bin/knowledge-mcp.js --external pg --external @hasna/machines --external @hasna/machines/consumer --external @modelcontextprotocol/sdk --external @aws-sdk/client-s3 --external @aws-sdk/credential-providers --external ai --external @ai-sdk/openai --external @ai-sdk/anthropic --external @ai-sdk/deepseek src/mcp.js && bun build --target=bun --outfile=bin/knowledge-serve.js --external pg --external @hasna/machines --external @hasna/machines/consumer --external @aws-sdk/client-s3 --external @aws-sdk/credential-providers --external ai --external @ai-sdk/openai --external @ai-sdk/anthropic --external @ai-sdk/deepseek src/serve-entry.ts && bun build ./src/index.ts ./src/storage.ts ./src/serve.ts --outdir ./dist --target bun --external pg --external @hasna/machines --external @hasna/machines/consumer --external @aws-sdk/client-s3 --external @aws-sdk/credential-providers --external ai --external @ai-sdk/openai --external @ai-sdk/anthropic --external @ai-sdk/deepseek && bun scripts/strip-generated-trailing-whitespace.mjs && bunx tsc -p tsconfig.build.json",
+    build: "rm -rf dist && bun build --target=bun --outfile=bin/knowledge.js --minify --external pg --external @hasna/machines --external @hasna/machines/consumer --external @aws-sdk/client-s3 --external @aws-sdk/credential-providers --external ai --external @ai-sdk/openai --external @ai-sdk/anthropic --external @ai-sdk/deepseek src/cli.ts && bun build --target=bun --outfile=bin/knowledge-mcp.js --external pg --external @hasna/machines --external @hasna/machines/consumer --external @modelcontextprotocol/sdk --external @aws-sdk/client-s3 --external @aws-sdk/credential-providers --external ai --external @ai-sdk/openai --external @ai-sdk/anthropic --external @ai-sdk/deepseek src/mcp.js && bun build --target=bun --outfile=bin/knowledge-serve.js --external pg --external @hasna/machines --external @hasna/machines/consumer --external @aws-sdk/client-s3 --external @aws-sdk/credential-providers --external ai --external @ai-sdk/openai --external @ai-sdk/anthropic --external @ai-sdk/deepseek src/serve-entry.ts && bun build ./src/index.ts ./src/storage.ts ./src/serve.ts --outdir ./dist --target bun --external pg --external @hasna/machines --external @hasna/machines/consumer --external @aws-sdk/client-s3 --external @aws-sdk/credential-providers --external ai --external @ai-sdk/openai --external @ai-sdk/anthropic --external @ai-sdk/deepseek && bun scripts/strip-generated-trailing-whitespace.mjs && bun run tsc -p tsconfig.build.json",
     prepublishOnly: "bun run contracts:conformance && contracts no-cloud-scan . && bun run build && node scripts/validate-public-package.mjs"
   },
   keywords: [
@@ -15103,7 +15103,8 @@ var package_default = {
     "@electric-sql/pglite": "^0.5.4",
     "@hasna/contracts": "0.8.5",
     "@types/bun": "^1.3.14",
-    "@types/pg": "^8.15.6"
+    "@types/pg": "^8.15.6",
+    typescript: "5.9.3"
   }
 };
 

diff --git a/bin/knowledge.js b/bin/knowledge.js
diff --git a/bun.lock b/bun.lock
diff --git a/dist/artifact-store.d.ts b/dist/artifact-store.d.ts
@@ -24,7 +24,7 @@ export interface ArtifactStore {
 export declare function normalizeArtifactKey(key: string): string;
 export declare class LocalArtifactStore implements ArtifactStore {
     private readonly root;
-    readonly type: 'local';
+    readonly type: "local";
     readonly canRead = true;
     readonly canWrite = true;
     constructor(root: string);
@@ -44,7 +44,7 @@ export interface S3ArtifactStoreOptions {
 }
 export declare class S3ArtifactStore implements ArtifactStore {
     private readonly options;
-    readonly type: 's3';
+    readonly type: "s3";
     readonly canRead = true;
     readonly canWrite = true;
     private client?;

diff --git a/dist/db/storage-sync.d.ts b/dist/db/storage-sync.d.ts
@@ -9,7 +9,7 @@
  * shared store only through the HTTP ApiStore. This module keeps only local,
  * read-only status helpers.
  */
-export declare const STORAGE_TABLES: readonly ['sources', 'wiki_pages', 'source_revisions', 'chunks', 'chunk_embeddings', 'wiki_backlinks', 'citations', 'knowledge_indexes', 'runs', 'run_events', 'provider_usage', 'redaction_findings', 'storage_objects', 'audit_events', 'approval_gates', 'vector_index_entries', 'reindex_queue', 'knowledge_machines', 'knowledge_sync_snapshots', 'knowledge_sync_changes', 'knowledge_sync_conflicts', 'knowledge_sync_table_clocks', 'knowledge_sync_imports'];
+export declare const STORAGE_TABLES: readonly ["sources", "wiki_pages", "source_revisions", "chunks", "chunk_embeddings", "wiki_backlinks", "citations", "knowledge_indexes", "runs", "run_events", "provider_usage", "redaction_findings", "storage_objects", "audit_events", "approval_gates", "vector_index_entries", "reindex_queue", "knowledge_machines", "knowledge_sync_snapshots", "knowledge_sync_changes", "knowledge_sync_conflicts", "knowledge_sync_table_clocks", "knowledge_sync_imports"];
 export declare const KNOWLEDGE_STORAGE_TABLES: readonly ["sources", "wiki_pages", "source_revisions", "chunks", "chunk_embeddings", "wiki_backlinks", "citations", "knowledge_indexes", "runs", "run_events", "provider_usage", "redaction_findings", "storage_objects", "audit_events", "approval_gates", "vector_index_entries", "reindex_queue", "knowledge_machines", "knowledge_sync_snapshots", "knowledge_sync_changes", "knowledge_sync_conflicts", "knowledge_sync_table_clocks", "knowledge_sync_imports"];
 type StorageTable = (typeof STORAGE_TABLES)[number];
 /**

diff --git a/dist/guarded-cli.d.ts b/dist/guarded-cli.d.ts
@@ -1,6 +1,6 @@
 import { KNOWLEDGE_GUARDED_WRITE_CONTRACT, type KnowledgePrivateInputDescriptor, type KnowledgePrivateQueryDescriptor, type KnowledgePrivateResultProof } from './guarded-write-contract.js';
-export declare const KNOWLEDGE_GUARDED_CLI_REQUEST_SCHEMA: 'knowledge.guarded-cli-request.v1';
-export declare const KNOWLEDGE_GUARDED_CLI_RESULT_SCHEMA: 'knowledge.guarded-cli-result.v1';
+export declare const KNOWLEDGE_GUARDED_CLI_REQUEST_SCHEMA: "knowledge.guarded-cli-request.v1";
+export declare const KNOWLEDGE_GUARDED_CLI_RESULT_SCHEMA: "knowledge.guarded-cli-result.v1";
 type KnowledgeGuardedCliAction = 'write' | 'query' | 'readback';
 type KnowledgeGuardedCliTransport = 'process_ipc' | 'anonymous_fd';
 export interface KnowledgeGuardedCliPrivateResult {

diff --git a/dist/guarded-write-contract.d.ts b/dist/guarded-write-contract.d.ts
@@ -1,11 +1,11 @@
 import type { KnowledgeItem, KnowledgeItemVersion } from './store.js';
-export declare const KNOWLEDGE_GUARDED_WRITE_CONTRACT: 'FCAME-1';
-export declare const KNOWLEDGE_PRIVATE_INPUT_SCHEMA: 'hasna.knowledge.private-input.v1';
-export declare const KNOWLEDGE_PRIVATE_TITLE_LOOKUP_SCHEMA: 'hasna.knowledge.private-title-lookup.v1';
-export declare const KNOWLEDGE_PRIVATE_QUERY_SCHEMA: 'hasna.knowledge.private-query.v1';
-export declare const KNOWLEDGE_PRIVATE_RESULT_SCHEMA: 'hasna.knowledge.private-result.v1';
-export declare const KNOWLEDGE_RELATIONS_SCHEMA: 'hasna.knowledge.relations.v1';
-export declare const KNOWLEDGE_RELATIONS_METADATA_KEY: 'hasna_knowledge_relations';
+export declare const KNOWLEDGE_GUARDED_WRITE_CONTRACT: "FCAME-1";
+export declare const KNOWLEDGE_PRIVATE_INPUT_SCHEMA: "hasna.knowledge.private-input.v1";
+export declare const KNOWLEDGE_PRIVATE_TITLE_LOOKUP_SCHEMA: "hasna.knowledge.private-title-lookup.v1";
+export declare const KNOWLEDGE_PRIVATE_QUERY_SCHEMA: "hasna.knowledge.private-query.v1";
+export declare const KNOWLEDGE_PRIVATE_RESULT_SCHEMA: "hasna.knowledge.private-result.v1";
+export declare const KNOWLEDGE_RELATIONS_SCHEMA: "hasna.knowledge.relations.v1";
+export declare const KNOWLEDGE_RELATIONS_METADATA_KEY: "hasna_knowledge_relations";
 export type KnowledgeAuthorityClassification = 'user_hosted' | 'hasna_saas';
 export type KnowledgeGuardedWriteVerb = 'create' | 'update';
 export interface KnowledgeAuthorityBinding {

diff --git a/dist/index.js b/dist/index.js
@@ -37953,7 +37953,7 @@ function migrateLegacyKnowledgeWorkspace(options) {
 // package.json
 var package_default = {
   name: "@hasna/knowledge",
-  version: "0.2.104",
+  version: "0.2.105",
   description: "Agent-friendly local knowledge CLI with JSON output, pagination, and safe destructive actions",
   type: "module",
   exports: {
@@ -38012,7 +38012,7 @@ var package_default = {
     serve: "bun src/serve-entry.ts",
     "verify:generated": "bun scripts/verify-generated-artifacts.mjs",
     "contracts:conformance": "contracts conformance fixtures",
-    build: "rm -rf dist && bun build --target=bun --outfile=bin/knowledge.js --minify --external pg --external @hasna/machines --external @hasna/machines/consumer --external @aws-sdk/client-s3 --external @aws-sdk/credential-providers --external ai --external @ai-sdk/openai --external @ai-sdk/anthropic --external @ai-sdk/deepseek src/cli.ts && bun build --target=bun --outfile=bin/knowledge-mcp.js --external pg --external @hasna/machines --external @hasna/machines/consumer --external @modelcontextprotocol/sdk --external @aws-sdk/client-s3 --external @aws-sdk/credential-providers --external ai --external @ai-sdk/openai --external @ai-sdk/anthropic --external @ai-sdk/deepseek src/mcp.js && bun build --target=bun --outfile=bin/knowledge-serve.js --external pg --external @hasna/machines --external @hasna/machines/consumer --external @aws-sdk/client-s3 --external @aws-sdk/credential-providers --external ai --external @ai-sdk/openai --external @ai-sdk/anthropic --external @ai-sdk/deepseek src/serve-entry.ts && bun build ./src/index.ts ./src/storage.ts ./src/serve.ts --outdir ./dist --target bun --external pg --external @hasna/machines --external @hasna/machines/consumer --external @aws-sdk/client-s3 --external @aws-sdk/credential-providers --external ai --external @ai-sdk/openai --external @ai-sdk/anthropic --external @ai-sdk/deepseek && bun scripts/strip-generated-trailing-whitespace.mjs && bunx tsc -p tsconfig.build.json",
+    build: "rm -rf dist && bun build --target=bun --outfile=bin/knowledge.js --minify --external pg --external @hasna/machines --external @hasna/machines/consumer --external @aws-sdk/client-s3 --external @aws-sdk/credential-providers --external ai --external @ai-sdk/openai --external @ai-sdk/anthropic --external @ai-sdk/deepseek src/cli.ts && bun build --target=bun --outfile=bin/knowledge-mcp.js --external pg --external @hasna/machines --external @hasna/machines/consumer --external @modelcontextprotocol/sdk --external @aws-sdk/client-s3 --external @aws-sdk/credential-providers --external ai --external @ai-sdk/openai --external @ai-sdk/anthropic --external @ai-sdk/deepseek src/mcp.js && bun build --target=bun --outfile=bin/knowledge-serve.js --external pg --external @hasna/machines --external @hasna/machines/consumer --external @aws-sdk/client-s3 --external @aws-sdk/credential-providers --external ai --external @ai-sdk/openai --external @ai-sdk/anthropic --external @ai-sdk/deepseek src/serve-entry.ts && bun build ./src/index.ts ./src/storage.ts ./src/serve.ts --outdir ./dist --target bun --external pg --external @hasna/machines --external @hasna/machines/consumer --external @aws-sdk/client-s3 --external @aws-sdk/credential-providers --external ai --external @ai-sdk/openai --external @ai-sdk/anthropic --external @ai-sdk/deepseek && bun scripts/strip-generated-trailing-whitespace.mjs && bun run tsc -p tsconfig.build.json",
     prepublishOnly: "bun run contracts:conformance && contracts no-cloud-scan . && bun run build && node scripts/validate-public-package.mjs"
   },
   keywords: [
@@ -38059,7 +38059,8 @@ var package_default = {
     "@electric-sql/pglite": "^0.5.4",
     "@hasna/contracts": "0.8.5",
     "@types/bun": "^1.3.14",
-    "@types/pg": "^8.15.6"
+    "@types/pg": "^8.15.6",
+    typescript: "5.9.3"
   }
 };
 

diff --git a/dist/knowledge-mode.d.ts b/dist/knowledge-mode.d.ts
@@ -58,9 +58,9 @@ export declare function resolveKnowledgeModeSelection(env?: NodeJS.ProcessEnv):
  * Server-side tokens, in probe order. Kept as a small derivation seam so a
  * future contracts enum change fails loudly instead of guessing a backend.
  */
-export declare const SERVER_MODE_CANDIDATES: readonly ['postgres'];
+export declare const SERVER_MODE_CANDIDATES: readonly ["postgres"];
 /** On-box tokens. */
-export declare const LOCAL_MODE_CANDIDATES: readonly ['sqlite'];
+export declare const LOCAL_MODE_CANDIDATES: readonly ["sqlite"];
 /** Accepts a mode token or throws. Injectable so both enum generations are testable. */
 export type ModeNormalizer = (value: string) => unknown;
 /** The live-contracts token meaning "the app server". */

diff --git a/dist/project-links.d.ts b/dist/project-links.d.ts
@@ -1,10 +1,10 @@
 import type { ItemStore } from './item-store.js';
 import type { KnowledgeItem } from './store.js';
 import type { PoolQueryClient } from './generated/storage-kit/index.js';
-export declare const KNOWLEDGE_PROJECT_REGISTRATION_ROUTE: 'knowledge.project-registration.v1';
-export declare const KNOWLEDGE_PROJECT_RESOURCES_ROUTE: 'knowledge.project-resources.v1';
+export declare const KNOWLEDGE_PROJECT_REGISTRATION_ROUTE: "knowledge.project-registration.v1";
+export declare const KNOWLEDGE_PROJECT_RESOURCES_ROUTE: "knowledge.project-resources.v1";
 export declare const KNOWLEDGE_PROJECT_REGISTRATION_SCHEMA_VERSION: 1;
-export declare const KNOWLEDGE_PROJECT_MEMBERSHIP_RULE: 'explicit_collection_binding';
+export declare const KNOWLEDGE_PROJECT_MEMBERSHIP_RULE: "explicit_collection_binding";
 /**
  * Keyset pages fetch exactly one extra producer row to decide whether a
  * continuation cursor is required. Scalar snapshot/count queries are separate

diff --git a/dist/query-contract.d.ts b/dist/query-contract.d.ts
@@ -3,7 +3,7 @@
  * contract. New clients require it whenever an older server could otherwise
  * ignore a query field and return a plausible, but semantically wrong, page.
  */
-export declare const KNOWLEDGE_BOUNDED_QUERY_CAPABILITY: 'hasna.knowledge.bounded-query.v1';
+export declare const KNOWLEDGE_BOUNDED_QUERY_CAPABILITY: "hasna.knowledge.bounded-query.v1";
 export interface KnowledgeBoundedQueryEnvelope {
     query_capability: typeof KNOWLEDGE_BOUNDED_QUERY_CAPABILITY;
 }

diff --git a/dist/sync.d.ts b/dist/sync.d.ts
@@ -206,7 +206,7 @@ export interface KnowledgeSyncConflictEvidence {
     citations: KnowledgeSyncConflictProposalCitation[];
     read_only_tools: KnowledgeSyncConflictReadOnlyToolCall[];
 }
-export declare const KNOWLEDGE_SYNC_TABLES: readonly ['sources', 'wiki_pages', 'source_revisions', 'chunks', 'chunk_embeddings', 'wiki_backlinks', 'citations', 'knowledge_indexes', 'runs', 'run_events', 'provider_usage', 'redaction_findings', 'storage_objects', 'audit_events', 'approval_gates', 'vector_index_entries', 'reindex_queue', 'knowledge_machines', 'knowledge_sync_snapshots', 'knowledge_sync_changes', 'knowledge_sync_conflicts', 'knowledge_sync_table_clocks', 'knowledge_sync_imports'];
+export declare const KNOWLEDGE_SYNC_TABLES: readonly ["sources", "wiki_pages", "source_revisions", "chunks", "chunk_embeddings", "wiki_backlinks", "citations", "knowledge_indexes", "runs", "run_events", "provider_usage", "redaction_findings", "storage_objects", "audit_events", "approval_gates", "vector_index_entries", "reindex_queue", "knowledge_machines", "knowledge_sync_snapshots", "knowledge_sync_changes", "knowledge_sync_conflicts", "knowledge_sync_table_clocks", "knowledge_sync_imports"];
 export declare const KNOWLEDGE_SYNC_PROTOCOL_VERSION = 2;
 export declare const KNOWLEDGE_SYNC_MIN_PROTOCOL_VERSION = 1;
 export type KnowledgeSyncTable = (typeof KNOWLEDGE_SYNC_TABLES)[number];

diff --git a/dist/workspace.d.ts b/dist/workspace.d.ts
@@ -77,27 +77,27 @@ export interface KnowledgeConfig {
     };
 }
 export declare const EXAMPLE_KNOWLEDGE_CANONICAL: {
-    readonly division: 'xyz';
-    readonly app_type: 'opensource';
-    readonly app: 'knowledge';
-    readonly env: 'prod';
+    readonly division: "xyz";
+    readonly app_type: "opensource";
+    readonly app: "knowledge";
+    readonly env: "prod";
     readonly local_path: string;
     readonly s3: {
-        readonly bucket: 'example-knowledge-prod';
-        readonly region: 'us-east-1';
-        readonly profile: 'example-infra';
-        readonly prefix: '.hasna/knowledge';
-        readonly server_side_encryption: 'AES256';
+        readonly bucket: "example-knowledge-prod";
+        readonly region: "us-east-1";
+        readonly profile: "example-infra";
+        readonly prefix: ".hasna/knowledge";
+        readonly server_side_encryption: "AES256";
     };
     readonly secrets: {
-        readonly env: 'example/knowledge/prod/env';
-        readonly aws: 'example/knowledge/prod/aws';
-        readonly s3: 'example/knowledge/prod/s3';
+        readonly env: "example/knowledge/prod/env";
+        readonly aws: "example/knowledge/prod/aws";
+        readonly s3: "example/knowledge/prod/s3";
         readonly rds: any;
-        readonly future_rds: 'example/knowledge/prod/rds';
+        readonly future_rds: "example/knowledge/prod/rds";
     };
-    readonly source_owner: 'open-files';
-    readonly evidence_doc: 'docs/canonical-secrets-bootstrap-2026-06-08.md';
+    readonly source_owner: "open-files";
+    readonly evidence_doc: "docs/canonical-secrets-bootstrap-2026-06-08.md";
 };
 export declare function canonicalExampleKnowledgeStorage(): KnowledgeConfig['storage'];
 export declare function legacyGlobalStorePath(): string;