v0.1.15: Entity not-found classification, mul label fallback, format() disclosure

Entity not-found classification, mul label fallback, format() disclosure

Seven issue fixes across the REST service, tool definitions, and the entity resource, plus a framework and supply-chain maintenance pass.

Fixed:

• Out-of-range IDs leaked the raw REST URL and status from wikidata_get_entity, wikidata_get_statements, wikidata_get_sitelinks, and wikidata://entity/{id} — the catch blocks tested data.status, which nothing populates. All four now classify 404 and 400 alike as entity_not_found (#13)
• One out-of-range ID no longer collapses a wikidata_get_labels batch to found: 0 — the ID named in a top-level no-such-entity rejection is dropped and the rest re-requested (#14)
• mul-only entities render their label instead of a bare QID — languagefallback=1 on the MediaWiki path, resolveLangValue() on the REST path, which has no fallback parameter (#15)
• format() discloses the total when it cuts a language sample — the wikidata_get_labels language list (#19), the wikidata_get_entity descriptions and alias language list (#22)
• wikidata_get_statements rejects a malformed properties entry with invalid_property before the fetch instead of dropping it or leaking a raw 400 (#24)
• docs/design.md per-tool Errors bullets reconciled to the declared errors[] contracts (#23)

Added:

• isEntityNotFoundError(err) and resolveLangValue(map, lang) exported from wikidata-rest-service.ts
• invalid_property error contract on wikidata_get_statements

Changed:

• Installs gated behind a 3-day minimumReleaseAge and scanned by Socket; Dockerfile pins oven/bun:1.3.14

Dependency bumps:

• @cyanheads/mcp-ts-core ^0.10.9 → ^0.10.14
• tsc-alias ^1.8.17 → ^1.9.0
• @socketsecurity/bun-security-scanner ^1.1.2 (new)
• js-yaml 3.14.2 → 3.15.0 (transitive) — clears GHSA-h67p-54hq-rp68

171 tests pass; bun run devcheck clean.

CHANGELOG v0.1.15