chore(release): bump sessions to 0.12.13

[andrei-hasna]

Summary

• Bumps @hasna/sessions from 0.12.12 to 0.12.13.
• Releases the merged transfer fix from fix(transfer): make manifest paths re-exportable #58 so manifest-advertised projects resolve their recorded originalPath and can be re-exported.
• Changes only package.json; bun.lock is unchanged.
• This PR does not merge, tag, publish, install, or modify live session homes.

Candidate

• Base: 849c724a10e10ec91aabe12a3b978157db69113a
• Head: 392f0937670b19f625090c0ddb511c1a8cad8451
• Tree: b8e4aa7c4ed7612004f40a7053067d47c2677bac

Registry-to-main provenance

• The npm registry record for @hasna/sessions@0.12.12 has gitHead=null, so provenance used the approved content-equivalence fallback.
• The downloaded registry tarball matched npm's published SHA-1 shasum and SHA-512 integrity.
• Rebuilding release commit 16ed6348e0dc991b463f04619004710066367cd9 with install scripts disabled, then packing with scripts disabled, produced a byte-identical 149-file package tree.
• Release commit 16ed6348e0dc991b463f04619004710066367cd9 and merged fix(transfer): make manifest paths re-exportable #58/current main 849c724a10e10ec91aabe12a3b978157db69113a are in one ancestor chain.

Validation

• Focused transfer regression: 6 pass, 0 fail, 23 expect() calls.
• Full suite: 379 pass, 0 fail, 1,798 expect() calls across 44 files.
• Typecheck: bun run typecheck — exit 0.
• Build: bun run build — exit 0.
• Release gate: bun run prepublishOnly — exit 0.
• Pack: @hasna/sessions@0.12.13, 149 files, package size 890,145 bytes — exit 0.
• Diff integrity: git diff --check origin/main..HEAD — exit 0; range contains only package.json.
• Lock integrity: BUN_LOCK_UNCHANGED=1.
• Shield positive control: one synthetic GitHub-token finding, exit 1.
• Shield negative control: No secret exposure findings detected., exit 0.
• Staged Shield review: No security issues found in staged changes., exit 0.
• Gitleaks positive control: leaks found: 2, configured exit 7.
• Gitleaks negative control: no leaks found, exit 0.
• Staged and commit-range Gitleaks: no leaks found, exit 0.

Scope note

A whole-repository Shield file sweep reports pre-existing findings in unchanged files. The reviewed release range is one line in package.json; staged Shield and staged/range Gitleaks are clean. This PR neither changes nor suppresses those existing findings.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] GO — #59 @ 392f093 — lens: correctness+security+gates, reviewer unresolved-account002 (1 of 1)

Scope read:

• git log --oneline origin/main..HEAD at fresh base 849c724a10e10ec91aabe12a3b978157db69113a: one commit, 392f093 chore(release): bump sessions to 0.12.13.
• git diff origin/main...HEAD --stat: package.json | 2 +-.
• Read the full diff and complete surrounding package.json. The only change is @hasna/sessions version 0.12.12 to 0.12.13; no source, dependency, script, lockfile, workflow, or trust-boundary change is present.
• Post-gate git status --short: clean.

Commands and exact results:

• bun install — exit 0; setup only, 117 packages installed.
• bun run typecheck — exit 0; PASS; the declared typecheck gate emitted no pass/fail count.
• bun run test — exit 0; PASS; 379 pass, 0 fail, 1798 expect() calls, 44 files.
• npm view @hasna/sessions version --json — exit 0; registry latest is 0.12.12.
• npm view @hasna/sessions@0.12.13 version --json — exit 1 with E404; confirms the candidate version is not already published. This is a registry preflight, not a repository test gate.

Blocking P0/P1 findings: none.

Non-blocking follow-ups: none.

Verdict: GO. The exact current candidate is safe to merge under the requested correctness, security, and declared-gate acceptance criteria.