@blamejs/exceptd-skills 0.10.3 → 0.11.1

package/orchestrator/index.js

@@ -304,12 +304,62 @@ function runCurrency() {
 }
 
 async function runReport(format) {
+  // v0.11.1 feature #55: `report csaf` emits a CSAF 2.0 envelope covering
+  // every scanned finding + dispatched plan + currency posture. Useful for
+  // VEX downstreams that ingest CSAF JSON.
+  if (format === 'csaf') {
+    const scanResult = await scan();
+    const plan = dispatch(scanResult.findings);
+    const { currency_report } = currencyCheck();
+    const ver = (function(){try{return require('../package.json').version;}catch{return 'unknown';}})();
+    const csaf = {
+      document: {
+        category: 'csaf_security_advisory',
+        csaf_version: '2.0',
+        publisher: { category: 'vendor', name: 'exceptd', namespace: 'https://exceptd.com' },
+        title: `exceptd assessment report — ${scanResult.summary.total_findings} finding(s) across ${plan.plan.length} skill(s)`,
+        tracking: {
+          id: `exceptd-report-${Date.now()}`,
+          status: 'final',
+          version: ver,
+          initial_release_date: new Date().toISOString(),
+          revision_history: [{ number: '1', date: new Date().toISOString(), summary: 'Initial report emission' }],
+        },
+      },
+      vulnerabilities: scanResult.findings
+        .filter(f => f.cve_id)
+        .map(f => ({
+          cve: f.cve_id,
+          notes: [{ category: 'description', text: f.action_required || f.signal }],
+          scores: [{ products: [], cvss_v3: { base_score: 0 } }],
+          threats: f.severity === 'critical' ? [{ category: 'exploit_status', details: f.action_required }] : [],
+        })),
+      exceptd_extension: {
+        scan_summary: scanResult.summary,
+        dispatch_plan: plan,
+        skill_currency: currency_report,
+        host: scanResult.host,
+      },
+    };
+    process.stdout.write(JSON.stringify(csaf, null, 2) + '\n');
+    return;
+  }
+
   console.log(`[orchestrator] Generating ${format} report...\n`);
   const scanResult = await scan();
   const plan = dispatch(scanResult.findings);
   const { currency_report } = currencyCheck();
 
-  console.log('# exceptd Security Assessment Report');
+  // Bug #48: header now self-describes the report flavor so a piped-to-file
+  // report carries its provenance internally. Previously only stderr
+  // (`[orchestrator] Generating <X> report`) distinguished the three.
+  const flavorTitle = {
+    executive: 'Executive Report',
+    technical: 'Technical Report',
+    compliance: 'Compliance Report',
+  }[format] || 'Report';
+  console.log(`# exceptd ${flavorTitle}`);
+  console.log(`<!-- exceptd-report:flavor=${format} version=${(function(){try{return require('../package.json').version;}catch{return 'unknown';}})()} -->`);
   console.log(`Generated: ${new Date().toISOString()}\n`);
 
   console.log('## Executive Summary');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/exceptd-skills",
-  "version": "0.10.3",
+  "version": "0.11.1",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 38 skills, 10 catalogs, 34 jurisdictions, pre-computed indexes, Ed25519-signed.",
   "keywords": [
     "ai-security",

package/sbom.cdx.json

@@ -1,10 +1,10 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:uuid:9c80f3b8-1fb8-46a8-b68f-e1b6a0ddedb7",
+  "serialNumber": "urn:uuid:8c82a24f-1d6f-4e1f-80ad-08975a8a86ea",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-05-12T14:06:23.001Z",
+    "timestamp": "2026-05-12T15:11:00.344Z",
     "tools": [
       {
         "name": "hand-written",
@@ -13,10 +13,10 @@
       }
     ],
     "component": {
-      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.10.3",
+      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.11.1",
       "type": "application",
       "name": "@blamejs/exceptd-skills",
-      "version": "0.10.3",
+      "version": "0.11.1",
       "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 38 skills, 10 catalogs, 34 jurisdictions, pre-computed indexes, Ed25519-signed.",
       "licenses": [
         {
@@ -25,11 +25,11 @@
           }
         }
       ],
-      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.10.3",
+      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.11.1",
       "externalReferences": [
         {
           "type": "distribution",
-          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.10.3"
+          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.11.1"
         },
         {
           "type": "vcs",