@blamejs/exceptd-skills 0.14.2 → 0.14.4

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.14.4 — 2026-05-27
+
+Clearer errors. A case-only playbook typo — `run SECRETS` — now suggests the right id ("Did you mean: secrets?") instead of only printing the id-format rule. Input-validation errors (a bad `--scope`, malformed evidence) are reported plainly rather than dressed as an "internal error" with a file-a-bug pointer. `exceptd ask` now points a question that names a specific CVE or RFC at the direct resolver (`exceptd cve <id>` / `exceptd rfc <n>`). The malformed-CVE message reads accurately for a short year, not only a non-numeric tail, and the RFC resolver's documentation reflects that obsoleted/historic RFCs are now in the local index.
+
+## 0.14.3 — 2026-05-27
+
+The resolved-citation cache is now integrity-checked. Each cached record carries a content digest (covering its `resolved_at` timestamp) that is verified on read, and freshness is gated on that timestamp rather than the file's modification time. A cache file edited in place — flipping a rejected CVE to "published" — is rejected as tampered instead of trusted, and a touched file can no longer resurrect a stale verdict. This closes a path where a writable cache could launder a rejected or fabricated citation into a passing verdict (which feeds `collect citation-hygiene --resolve` and, in turn, attestations).
+
+`exceptd cve` and `exceptd rfc` reject unknown flags instead of silently ignoring them — a mistyped `--json` no longer emits human text into a pipe that asked for JSON.
+
+Malformed evidence is rejected at the boundary. A JSON `null`, array, or scalar piped to `run --evidence -` now returns "evidence must be a JSON object" instead of being silently accepted as an empty run or surfacing as an internal error.
+
+`collect citation-hygiene --resolve` now flags a cited RFC number that resolves to nothing, matching how it already flags a fabricated CVE. `ci --max-rwep` rejects a non-numeric or negative cap instead of silently coercing it to 0 (which had quietly degenerated the gate to "block everything"). `run --format` notes on stderr when it overrides `--json`. `cve`, `rfc`, `collect`, `watch`, and `report` are now listed in `exceptd help`.
+
 ## 0.14.2 — 2026-05-27
 
 `exceptd collect citation-hygiene --resolve` now resolves the cited CVEs the offline catalog can't confirm — once each, through the shared resolver cache — and flips their verdicts instead of parking them as inconclusive for an agent to chase: a rejected or disputed identifier becomes a hit, a well-formed identifier NVD doesn't know becomes fabricated, and a confirmed one clears. Honors `--air-gap` (catalog and cache only, no network).

package/bin/exceptd.js

@@ -450,8 +450,19 @@ Canonical verbs
   verify-attestation <sid>   Alias for \`attest verify\`.
   run-all                    Alias for \`run --all\`.
 
+  cve <CVE-ID>               Resolve a CVE citation: published | rejected | disputed
+                             | fabricated | nonexistent (catalog → cache → one NVD
+                             lookup). --air-gap/--no-network offline-only; exit 2 on
+                             a citation that won't stand up.
+  rfc <number>               Resolve an RFC number → title + status from the local
+                             index (offline). --check "<title>" flags a mismatch.
+  collect <playbook>         Run a playbook's companion collector; emits submission
+                             JSON to pipe into \`run --evidence -\`. --resolve
+                             (citation-hygiene) resolves uncatalogued citations.
   skill <name>               Show context for a specific skill.
   framework-gap <fw> <ref>   Programmatic gap analysis (one framework, one CVE/scenario).
+  watch [--alerts]           Forward-watch aggregator across skills.
+  report [executive]         Structured posture report.
   path                       Absolute path to the installed package.
   version                    Package version.
 
@@ -945,6 +956,19 @@ function readJsonFile(filePath) {
   }
 }
 
+// Evidence must be a JSON object. `null`, an array, or a scalar parse as valid
+// JSON but are not a submission — without this guard `null` NPE'd deep in the
+// runner ("internal error") and `[]` / a wrong-typed field were silently
+// accepted and run as if empty, so an operator believed a malformed submission
+// was evaluated. Reject at the read boundary with an actionable message.
+function asEvidenceObject(parsed) {
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    const got = parsed === null ? "null" : Array.isArray(parsed) ? "array" : typeof parsed;
+    throw new Error(`evidence must be a JSON object (e.g. {"artifacts": {...}, "signal_overrides": {...}}); got ${got}. Run \`exceptd brief <playbook>\` for the expected shape.`);
+  }
+  return parsed;
+}
+
 function readEvidence(evidenceFlag) {
   if (!evidenceFlag) return {};
   // v0.12.12: file-path branch enforces a max size to defend against an
@@ -988,7 +1012,7 @@ function readEvidence(evidenceFlag) {
       );
       return {};
     }
-    return JSON.parse(text);
+    return asEvidenceObject(JSON.parse(text));
   }
   let stat;
   try { stat = fs.statSync(evidenceFlag); }
@@ -999,7 +1023,7 @@ function readEvidence(evidenceFlag) {
   // Route through readJsonFile() for UTF-8-BOM / UTF-16 tolerance.
   // Windows-tool-emitted JSON commonly carries these markers; the raw "utf8"
   // decode in readFileSync chokes on the leading 0xFEFF.
-  return readJsonFile(evidenceFlag);
+  return asEvidenceObject(readJsonFile(evidenceFlag));
 }
 
 function loadRunner() {
@@ -1691,6 +1715,19 @@ function dispatchPlaybook(cmd, argv) {
         return emitError(`Playbook not found: "${wanted}". ${hint}`, { verb: cmd, wanted, type: "playbook_not_found" }, pretty);
       }
     }
+    // Distinguish an operator-input validation error from a genuine internal
+    // fault. A validation message ("--scope must be one of […]", "must match
+    // …") is the operator's to fix — emit it plainly instead of labeling it an
+    // "internal error" and inviting a bug report. The NPE/typeerror guards keep
+    // real internal faults (that happen to contain "invalid") on the bug path.
+    const msg = e && e.message ? String(e.message) : String(e);
+    if (
+      /\b(must be|must match|not in accepted set|is not a valid|unrecognized)\b|\binvalid /i.test(msg) &&
+      msg.length < 300 &&
+      !/cannot read prop|is not a function|is not defined|undefined \(reading|maximum call stack/i.test(msg)
+    ) {
+      return emitError(`${cmd}: ${msg}`, { verb: cmd, type: "validation_error" }, pretty);
+    }
     // Wrap bare e.message so operators see the verb that triggered the
     // failure + the next action they can take. Re-running with --pretty
     // expands the cause for log-scraping; the GitHub-issues pointer lets
@@ -2950,9 +2987,26 @@ function validateScopeOrThrow(scope) {
 function refuseInvalidPlaybookId(verb, playbookId, pretty) {
   const r = validateIdComponent(playbookId, "playbook");
   if (!r.ok) {
+    // A case-only typo (`run SECRETS`) fails the lowercase-only id regex
+    // before the fuzzy "did you mean" path ever runs. If lowercasing yields a
+    // real playbook, suggest it — the most common id typo shouldn't get the
+    // least helpful error.
+    let suggestion = null;
+    if (typeof playbookId === "string") {
+      const lowered = playbookId.toLowerCase();
+      if (lowered !== playbookId && validateIdComponent(lowered, "playbook").ok) {
+        try {
+          if (fs.existsSync(path.join(PKG_ROOT, "data", "playbooks", `${lowered}.json`))) suggestion = lowered;
+        } catch { /* fall back to no suggestion */ }
+      }
+    }
     emitError(
-      `${verb}: invalid <playbook> id — ${r.reason}.`,
-      { verb, provided: typeof playbookId === "string" ? playbookId.slice(0, 80) : typeof playbookId },
+      `${verb}: invalid <playbook> id — ${r.reason}.${suggestion ? ` Did you mean: ${suggestion}?` : ""}`,
+      {
+        verb,
+        provided: typeof playbookId === "string" ? playbookId.slice(0, 80) : typeof playbookId,
+        ...(suggestion ? { did_you_mean: [suggestion] } : {}),
+      },
       pretty
     );
     return true;
@@ -3576,6 +3630,14 @@ function cmdRun(runner, args, runOpts, pretty) {
         pretty,
       );
     }
+    // --format wins over --json (one stdout document). Note it rather than
+    // silently discarding --json — a script that pipes for JSON and later adds
+    // --format markdown for a human would otherwise get non-JSON with no signal.
+    if ((args.json || global.__exceptdWantJson) && requested !== "json") {
+      process.stderr.write(
+        `[exceptd] note: --format "${requested}" overrides --json; stdout is the ${requested} document, not the JSON envelope.\n`
+      );
+    }
     // Only one document can be written to stdout. When several --format values
     // are given, emit the first and tell the operator where the rest live so
     // the extras aren't silently dropped.
@@ -7632,6 +7694,13 @@ function cmdAsk(runner, args, runOpts, pretty) {
   if (!question) {
     return emitError("ask: usage: exceptd ask \"<plain-English question>\"", null, pretty);
   }
+  // ask routes to playbooks, but a question naming a specific CVE / RFC ("is
+  // CVE-… real", "what is RFC 9404") is answered directly by the resolver
+  // verbs — point at them on stderr so the operator gets the right tool.
+  const cveTok = question.match(/\bCVE-\d{4}-\d{3,}\b/i);
+  const rfcTok = question.match(/\bRFC[-\s]?(\d{1,6})\b/i);
+  if (cveTok) process.stderr.write(`[exceptd] tip: to validate that identifier directly, run \`exceptd cve ${cveTok[0].toUpperCase()}\`.\n`);
+  if (rfcTok) process.stderr.write(`[exceptd] tip: to resolve that RFC directly, run \`exceptd rfc ${rfcTok[1]}\`.\n`);
   const ids = runner.listPlaybooks();
   const q = question.toLowerCase();
 
@@ -7831,6 +7900,16 @@ function cmdAsk(runner, args, runOpts, pretty) {
 function cmdCi(runner, args, runOpts, pretty) {
   const scope = args.scope;
   const maxRwep = args["max-rwep"] !== undefined ? Number(args["max-rwep"]) : null;
+  // Reject a non-numeric / negative cap rather than silently coercing it.
+  // `--max-rwep abc` previously became Number→NaN→0, degenerating the gate to
+  // "block everything at RWEP 0" with no error — a silently-broken CI gate.
+  if (maxRwep !== null && (!Number.isFinite(maxRwep) || maxRwep < 0)) {
+    return emitError(
+      `ci: --max-rwep must be a non-negative number; got ${JSON.stringify(String(args["max-rwep"]))}.`,
+      { verb: "ci", provided: args["max-rwep"] },
+      pretty,
+    );
+  }
   const blockOnClock = !!args["block-on-jurisdiction-clock"];
 
   // v0.11.9 (#115): --required <playbook,playbook,...> takes precedence over

package/data/_indexes/_meta.json

@@ -1,10 +1,10 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-05-27T13:10:02.958Z",
+  "generated_at": "2026-05-27T15:14:36.966Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 54,
   "source_hashes": {
-    "manifest.json": "e3c6dc62608d025f8f60ae232bdd54da7433eb8c1d29bdef81deee51122dae4c",
+    "manifest.json": "e9db8b2640844856c72c5e120fe7973d10d3e5d237c38ab38c26bf4c5eaf7af8",
     "data/atlas-ttps.json": "d24bc02859d40ccf1615db75cca68c077585904e41e0d8f6de448121e9b1abb0",
     "data/attack-techniques.json": "fa193f0d2d248176a8beddb641e9fe56ba4faa9e15dc253ff876dbf0c5d58a77",
     "data/cve-catalog.json": "3d451dda7ac0c7d57a4075ae4bafd3148c6184b35dc1bc59d8b81d1f2641e430",

package/lib/citation-resolve.js

@@ -23,6 +23,7 @@
 
 const fs = require("node:fs");
 const path = require("node:path");
+const crypto = require("node:crypto");
 
 const PKG_ROOT = path.join(__dirname, "..");
 const CVE_CATALOG = process.env.EXCEPTD_CVE_CATALOG || path.join(PKG_ROOT, "data", "cve-catalog.json");
@@ -44,28 +45,64 @@ function rfcIndex() {
   return _rfc;
 }
 
-// --- resolved-id cache (atomic JSON files, TTL-bounded, best-effort) ---
+// --- resolved-id cache (atomic JSON files, TTL-bounded, integrity-checked) ---
+//
+// The cache feeds security verdicts (and, via citation-hygiene --resolve,
+// attestations), so a record is only trusted if it carries a matching content
+// digest AND its own `resolved_at` is within the freshness window. A file an
+// attacker (or a corrupt/half-written process) edits in place without
+// recomputing `_digest` is rejected as a cache-miss — it can never launder a
+// rejected/fabricated citation into "published". This is the resolved-cache
+// analogue of the prefetch cache's sha256+signature model; full maintainer
+// signing isn't possible operator-side (no private key), so the digest binds
+// the record to itself and makes tampering detectable.
 function cachePath(kind, id) {
   // Read the env at call time so tests can isolate the cache per-case.
   const dir = process.env.EXCEPTD_RESOLVE_CACHE_DIR || RESOLVE_CACHE_DIR;
   const safe = id.replace(/[^A-Za-z0-9._-]/g, "_");
   return path.join(dir, kind, `${safe}.json`);
 }
+// sha256 over the record's canonical bytes (sorted keys, `_digest` excluded).
+// `resolved_at` IS covered, so the staleness clock can't be rewritten apart
+// from the verdict.
+function recordDigest(record) {
+  const canon = {};
+  for (const k of Object.keys(record).sort()) {
+    if (k === "_digest") continue;
+    canon[k] = record[k];
+  }
+  return crypto.createHash("sha256").update(JSON.stringify(canon)).digest("hex");
+}
 function cacheGet(kind, id) {
   try {
     const p = cachePath(kind, id);
-    const st = fs.statSync(p);
-    if (Date.now() - st.mtimeMs > CACHE_TTL_MS) return null;
-    return JSON.parse(fs.readFileSync(p, "utf8"));
+    const record = JSON.parse(fs.readFileSync(p, "utf8"));
+    if (!record || typeof record !== "object") return null;
+    // Integrity: a record without a matching digest is tampered/corrupt → miss.
+    if (typeof record._digest !== "string" || record._digest !== recordDigest(record)) return null;
+    // Freshness keyed on the record's own resolved_at (not file mtime, which a
+    // `touch` can reset). Reject future-dated records as a poisoning signal,
+    // mirroring the prefetch cache's future-date guard.
+    const ts = Date.parse(record.resolved_at || "");
+    if (!Number.isFinite(ts)) return null;
+    const age = Date.now() - ts;
+    if (age < -60_000 || age > CACHE_TTL_MS) return null;
+    delete record._digest; // internal integrity field — never surface it
+    return record;
   } catch { return null; }
 }
 function cachePut(kind, id, record) {
   try {
     const p = cachePath(kind, id);
     fs.mkdirSync(path.dirname(p), { recursive: true });
-    const tmp = `${p}.${process.pid}.tmp`;
-    fs.writeFileSync(tmp, JSON.stringify(record));
-    fs.renameSync(tmp, p); // atomic — concurrent agents can't read a half-written file
+    const signed = { ...record };
+    signed._digest = recordDigest(signed);
+    // Random suffix (not just pid) so two cachePut calls for the same id in one
+    // process — a Promise.all fan-out or worker threads sharing a pid — don't
+    // race the same tmp path. Matches lib/prefetch.js writeFileAtomic.
+    const tmp = `${p}.${process.pid}.${crypto.randomBytes(4).toString("hex")}.tmp`;
+    fs.writeFileSync(tmp, JSON.stringify(signed));
+    fs.renameSync(tmp, p); // atomic — concurrent readers never see a half-written file
   } catch { /* cache is an optimization, never fatal */ }
 }
 
@@ -84,7 +121,7 @@ async function resolveCve(id, opts = {}) {
 
   if (!CVE_RE.test(cveId)) {
     return { ...base, status: "fabricated", from: "format",
-      reason: "not the canonical CVE-YYYY-NNNN form — a non-numeric tail is a fabricated identifier" };
+      reason: "not the canonical CVE-YYYY-NNNN form (4-digit year + 4-or-more-digit sequence) — a malformed identifier" };
   }
 
   // 1. curated catalog (offline, authoritative for the ids it covers)
@@ -165,10 +202,11 @@ async function resolveCve(id, opts = {}) {
 
 /**
  * Resolve an RFC citation. Returns { id, kind:"rfc", number, title, rfc_status,
- * found, from, ... }. The local index covers the whole current RFC series, so
- * number->title resolution is fully offline. Obsoleted/historic RFCs are
- * excluded from the index, so a not-found number is either obsoleted or
- * nonexistent; the optional network step disambiguates.
+ * found, from, ... }. The local index covers the whole RFC series — current
+ * AND obsoleted/historic (the latter carry `_obsoleted` + `obsoleted_by`) — so
+ * number->title resolution, including "is this RFC superseded?", is fully
+ * offline. A number absent from the index is almost certainly nonexistent (or
+ * an UNKNOWN-status placeholder); the optional network step confirms.
  */
 async function resolveRfc(id, opts = {}) {
   const raw = String(id || "").trim();
@@ -201,7 +239,7 @@ async function resolveRfc(id, opts = {}) {
   // 3. offline: report the ambiguity rather than guessing
   if (isAirGap(opts) || opts.noNetwork) {
     return { ...base, number: num, found: false, status: "unknown", from: "offline",
-      reason: "not in the local RFC index — likely obsoleted/historic (excluded from the index) or nonexistent; verify at datatracker.ietf.org when online" };
+      reason: "not in the local RFC index (which includes obsoleted/historic RFCs) — most likely a nonexistent number; confirm at datatracker.ietf.org when online" };
   }
 
   // 4. disambiguate obsoleted vs nonexistent via the datatracker, once + cached

package/lib/collectors/citation-hygiene.js

@@ -522,12 +522,18 @@ async function applyResolution(submission, opts = {}) {
     signals["cve-citation-needs-external-verification"] = cveUnknown > 0 ? "inconclusive" : "miss";
   }
 
+  let rfcNonexistentHit = false;
   for (const item of rfcList) {
     const cite = String(item.citation || "");
     const num = (cite.match(/(\d+)/) || [])[1];
     const r = await resolver.resolveRfc(num || cite, { airGap });
     resolved.rfc.push({ citation: cite, file: item.file, status: r.status, found: r.found, from: r.from, title: r.title || null });
+    // A cited RFC number that resolves to nothing is a bad citation, same class
+    // as a fabricated CVE — surface it instead of discarding the verdict. (An
+    // obsoleted/historic RFC that resolves IS a real RFC, so it isn't flagged.)
+    if (r.status === "nonexistent") rfcNonexistentHit = true;
   }
+  if (rfcNonexistentHit) signals["rfc-number-title-mismatch"] = "hit";
 
   const out = { ...submission, signal_overrides: signals };
   out.artifacts = { ...(submission.artifacts || {}) };

package/lib/cve-cli.js

@@ -15,6 +15,19 @@ const { resolveCve } = require("./citation-resolve.js");
 (async () => {
   const argv = process.argv.slice(2);
   const flags = new Set(argv.filter((a) => a.startsWith("--")));
+  // Reject unknown flags rather than silently ignoring them — the same
+  // contract the in-process verbs enforce. A swallowed `--josn` would emit
+  // human text into a pipe that asked for JSON and defeat a CI gate.
+  const KNOWN = new Set(["--json", "--pretty", "--air-gap", "--no-network", "--help", "-h"]);
+  const unknown = [...flags].filter((f) => !KNOWN.has(f));
+  if (unknown.length > 0) {
+    process.stderr.write(JSON.stringify({
+      ok: false, verb: "cve", error: `cve: unknown flag(s): ${unknown.join(", ")}`,
+      unknown_flags: unknown, known_flags: ["--json", "--pretty", "--air-gap", "--no-network"],
+    }) + "\n");
+    process.exitCode = 1;
+    return;
+  }
   const id = argv.find((a) => !a.startsWith("--"));
   const pretty = flags.has("--pretty");
   const json = flags.has("--json") || pretty;

package/lib/rfc-cli.js

@@ -16,6 +16,19 @@ const { resolveRfc } = require("./citation-resolve.js");
 (async () => {
   const argv = process.argv.slice(2);
   const flags = new Set(argv.filter((a) => a.startsWith("--")));
+  // Reject unknown flags (same contract as the in-process verbs). `--check`
+  // consumes the following token as its value; that value is a positional, not
+  // a flag, so it isn't checked here.
+  const KNOWN = new Set(["--json", "--pretty", "--air-gap", "--no-network", "--check", "--help", "-h"]);
+  const unknown = [...flags].filter((f) => !KNOWN.has(f));
+  if (unknown.length > 0) {
+    process.stderr.write(JSON.stringify({
+      ok: false, verb: "rfc", error: `rfc: unknown flag(s): ${unknown.join(", ")}`,
+      unknown_flags: unknown, known_flags: ["--json", "--pretty", "--air-gap", "--no-network", "--check"],
+    }) + "\n");
+    process.exitCode = 1;
+    return;
+  }
   const positionals = argv.filter((a) => !a.startsWith("--"));
   const id = positionals[0];
   const pretty = flags.has("--pretty");

package/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "exceptd-security",
-  "version": "0.14.2",
+  "version": "0.14.4",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation",
   "homepage": "https://exceptd.com",
   "license": "Apache-2.0",
@@ -53,7 +53,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "lXhZgoIrrVloO3XaTvo/43AxZn4mwErstd7DR0O/oVhD3AOGODM4HqrageYEou9WKOdMEGP5mJNTjJsXdP5NDA==",
-      "signed_at": "2026-05-27T13:01:18.484Z",
+      "signed_at": "2026-05-27T15:13:33.851Z",
       "cwe_refs": [
         "CWE-125",
         "CWE-362",
@@ -123,7 +123,7 @@
       ],
       "last_threat_review": "2026-05-17",
       "signature": "ztSKk/zFMFbT12qRcEeBKpydBn7fTT86KxMmor0DTCoKQWk5fJ0fSInfP1XMSB6rFk4/SuSjKVxQRMKVJ5a+Cg==",
-      "signed_at": "2026-05-27T13:01:18.486Z",
+      "signed_at": "2026-05-27T15:13:33.853Z",
       "cwe_refs": [
         "CWE-1039",
         "CWE-1426",
@@ -196,7 +196,7 @@
       ],
       "last_threat_review": "2026-05-17",
       "signature": "K6QdPHNK5c4K5QFjrW0QsUhjp71D7SOisSoulwPNSvKRdi2rY+yg0kdckijBMkLMsVPyUvcC9giu93mKJ1OZDg==",
-      "signed_at": "2026-05-27T13:01:18.487Z",
+      "signed_at": "2026-05-27T15:13:33.854Z",
       "cwe_refs": [
         "CWE-22",
         "CWE-345",
@@ -248,7 +248,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-22",
       "signature": "Qd3SBWmUAaaT++e1Ry2wBIz/dCBmNBMl0+4Rb0etvJLES0fIBEAkU1mTbgNZnT5XOg9J5twdUpymWtmKnDDQCQ==",
-      "signed_at": "2026-05-27T13:01:18.487Z"
+      "signed_at": "2026-05-27T15:13:33.854Z"
     },
     {
       "name": "compliance-theater",
@@ -279,7 +279,7 @@
       ],
       "last_threat_review": "2026-05-22",
       "signature": "F2Shxae0ua0gPtvwzTRVzzHaIgJcFDRT3/akLUAZ4aaMQhkleKkcTaTpkjp+pTVEdPfLeLGNCeAOMs+whVYOBg==",
-      "signed_at": "2026-05-27T13:01:18.488Z"
+      "signed_at": "2026-05-27T15:13:33.855Z"
     },
     {
       "name": "exploit-scoring",
@@ -308,7 +308,7 @@
       ],
       "last_threat_review": "2026-05-18",
       "signature": "NA1hoQycvQhSUoG5rwlXX0mOVmGxoXRVezkELGEA2nZOdGis4gXkHT3O6Sfw7zxE4JuMrsCb65TEeOWk9WEPDg==",
-      "signed_at": "2026-05-27T13:01:18.488Z"
+      "signed_at": "2026-05-27T15:13:33.855Z"
     },
     {
       "name": "rag-pipeline-security",
@@ -345,7 +345,7 @@
       ],
       "last_threat_review": "2026-05-22",
       "signature": "W3pS8lnaCP96TQzsJpG5d5yv5IwgaQyS4Z2Ctcz5BOJf6LbajSIgeDgTZ4f4Bhr5m4E7KsgWGjZS4x7Fwd33BQ==",
-      "signed_at": "2026-05-27T13:01:18.489Z",
+      "signed_at": "2026-05-27T15:13:33.856Z",
       "cwe_refs": [
         "CWE-1395",
         "CWE-1426"
@@ -405,7 +405,7 @@
       ],
       "last_threat_review": "2026-05-17",
       "signature": "/WDGygh1Ck4yWlBWDGtEUVCqKB8d+UaJXoAoBXujtt+GAl8JbMNpaN1TvI0WkEltQ9dTxaAzSn20/eVDqv8iDQ==",
-      "signed_at": "2026-05-27T13:01:18.489Z",
+      "signed_at": "2026-05-27T15:13:33.856Z",
       "d3fend_refs": [
         "D3-CA",
         "D3-CSPP",
@@ -440,7 +440,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-22",
       "signature": "za1NKBpy9LC91F/ESO/qhUfmvVr8GNItQOjR5OJLeHm+2dQ9HHiFWQK2eo53V/n/0uhubuggURA3yS6kJuWwBg==",
-      "signed_at": "2026-05-27T13:01:18.489Z",
+      "signed_at": "2026-05-27T15:13:33.857Z",
       "cwe_refs": [
         "CWE-1188"
       ],
@@ -474,7 +474,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-18",
       "signature": "xiHAhhdufm9hCKU8PLiPE0MX65ej2F4OZwtlWLGLCiie9/km+Kiqbt192LcMvr94v83C98pb9wIaqFsFWft6AQ==",
-      "signed_at": "2026-05-27T13:01:18.490Z",
+      "signed_at": "2026-05-27T15:13:33.857Z",
       "forward_watch": [
         "New AI attack classes as ATLAS v6 publishes",
         "Post-quantum adversary capability timeline",
@@ -513,7 +513,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "oYsSk35N2Uzq7MRofACykylcVwkgPhI4luWZ14vmQT+gUKLyZiKVOUJbe1+7lGl6BYPRN0sUDQ0f7S5Eu5w2Ag==",
-      "signed_at": "2026-05-27T13:01:18.490Z"
+      "signed_at": "2026-05-27T15:13:33.857Z"
     },
     {
       "name": "zeroday-gap-learn",
@@ -540,7 +540,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-18",
       "signature": "igRqYyU1unRFH40BsPyAR62SPrk8QZv8dPGb8S9O9EvLCNOZAzm3t+HdT/NKqzWHwrpomOzkkkyLfYI/0qTUDA==",
-      "signed_at": "2026-05-27T13:01:18.491Z",
+      "signed_at": "2026-05-27T15:13:33.858Z",
       "forward_watch": [
         "New CISA KEV entries",
         "New ATLAS TTP additions in each ATLAS release",
@@ -604,7 +604,7 @@
       ],
       "last_threat_review": "2026-05-22",
       "signature": "i/17u4kJiSpcZAz7LnTyRePFugQOstQ1P4kVoe0oGf4E2/j8oIN9U9DccjUn/YHZhKWIJ2AILG/DMhvMrr3bBg==",
-      "signed_at": "2026-05-27T13:01:18.491Z",
+      "signed_at": "2026-05-27T15:13:33.858Z",
       "cwe_refs": [
         "CWE-327"
       ],
@@ -652,7 +652,7 @@
       ],
       "last_threat_review": "2026-05-22",
       "signature": "QuOVaQ4E2Sl39TClbhZ7HA9XrYAyRrDL44HY3RTE7aWLue0hV2cxaBt40ALGmHS++631QGFDlZTLZI77Tr6nAA==",
-      "signed_at": "2026-05-27T13:01:18.491Z"
+      "signed_at": "2026-05-27T15:13:33.858Z"
     },
     {
       "name": "security-maturity-tiers",
@@ -689,7 +689,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "8Px1s2lDj10/Q6erwEQlXgUHM1+OTruUR8qAHPX7Oo3k/l69N6P9sm0PsafS9wDFtj9l5C/OiLiFgzMlMt6vBw==",
-      "signed_at": "2026-05-27T13:01:18.492Z",
+      "signed_at": "2026-05-27T15:13:33.859Z",
       "cwe_refs": [
         "CWE-1188"
       ]
@@ -724,7 +724,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-11",
       "signature": "urRcataVWg6/utyEkSiOWoNxTL8sABRjPR7ShyDfZGnAozFph/yDktSoaPVxQDXwu9EfJE+qhUW5OYR/yJECBQ==",
-      "signed_at": "2026-05-27T13:01:18.492Z"
+      "signed_at": "2026-05-27T15:13:33.859Z"
     },
     {
       "name": "attack-surface-pentest",
@@ -796,7 +796,7 @@
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — Microsoft Edge 4-bug sandbox escape by Orange Tsai (DEVCORE); forward-watch only (browser sandbox, out of current playbook scope); track Microsoft Edge security advisory and KEV add"
       ],
       "signature": "C7lv65/Ecm8JJgSKxrX5lxx0YFzKWtrIQSKp+vy50I5e8945s1JmifGUUrnQwRQhq/Pkv7EmfiH5XSO8h75bDg==",
-      "signed_at": "2026-05-27T13:01:18.493Z"
+      "signed_at": "2026-05-27T15:13:33.859Z"
     },
     {
       "name": "fuzz-testing-strategy",
@@ -856,7 +856,7 @@
         "OSS-Fuzz-Gen / AI-assisted harness generation becoming the default expectation for OSS maintainers"
       ],
       "signature": "Z7ypCUnXx8JpLtgxxB6RHNi39w74AmrGY1N4ofAGCXhkuM2EaFVm1AU0dvl9UQ1bVLfHKEDGqMO/TwlIY7RABg==",
-      "signed_at": "2026-05-27T13:01:18.493Z"
+      "signed_at": "2026-05-27T15:13:33.860Z"
     },
     {
       "name": "dlp-gap-analysis",
@@ -931,7 +931,7 @@
         "Quebec Law 25, India DPDPA, KSA PDPL enforcement actions naming AI-tool prompt data as in-scope personal information"
       ],
       "signature": "IgEnpHOhCftAyfUNdKsjbrd169T9pJkk/rRM2ZEna+H18y7p5x48+1kME2sJMZjJuyAdQFBJi8PJXZFwLGI+DQ==",
-      "signed_at": "2026-05-27T13:01:18.493Z"
+      "signed_at": "2026-05-27T15:13:33.860Z"
     },
     {
       "name": "supply-chain-integrity",
@@ -1010,7 +1010,7 @@
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Megatron Bridge path traversal by haehae; AI training-stack file-system trust boundary; track patch and SBOM-attestation impact"
       ],
       "signature": "pcLrM98A3vUSZRjwNAk0aZ9umvOwB41XCLLsCOy/IebB2F/06oIrGUKkMHtHwm4pTVPShMMcKdZQQ3jz30FnCg==",
-      "signed_at": "2026-05-27T13:01:18.494Z"
+      "signed_at": "2026-05-27T15:13:33.861Z"
     },
     {
       "name": "defensive-countermeasure-mapping",
@@ -1067,7 +1067,7 @@
       ],
       "last_threat_review": "2026-05-11",
       "signature": "G5q5elh7Q7eu2xcwTVQJGDTGfvZR0OGQaLSLJPb2wjzCHFF8PWuZfCHZdjjqisiRzRWPyLlzgfHeMJqOdy7cBw==",
-      "signed_at": "2026-05-27T13:01:18.494Z"
+      "signed_at": "2026-05-27T15:13:33.861Z"
     },
     {
       "name": "identity-assurance",
@@ -1134,7 +1134,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "Wv5hGMeHjlaQK1zwicVCA7AvdKgJBgvcjdpGM9Ywahh9tagAKhbkOjybowDQZzu7OZ3bDkbh6pBYc1Sdwr6NAA==",
-      "signed_at": "2026-05-27T13:01:18.494Z"
+      "signed_at": "2026-05-27T15:13:33.861Z"
     },
     {
       "name": "ot-ics-security",
@@ -1190,7 +1190,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "8t5qKHd3yWi57dvG36YQkLN/X9bQWqtEiYjay4IfSmqhJpM/xXPaQVKNGz3wscrO8OLKUZ0OaX7Mj5kzpgBKBQ==",
-      "signed_at": "2026-05-27T13:01:18.495Z"
+      "signed_at": "2026-05-27T15:13:33.862Z"
     },
     {
       "name": "coordinated-vuln-disclosure",
@@ -1242,7 +1242,7 @@
         "NYDFS 23 NYCRR 500 amendments potentially adding explicit CVD program requirements"
       ],
       "signature": "GDGt4UPqBa04PjlpSmpyihGzd3OgfBN7jaAK5tfwp+LRSs3ygKOdbeivUCCHNagTY1hE6hG2Ou40ADfBFuXeAg==",
-      "signed_at": "2026-05-27T13:01:18.495Z"
+      "signed_at": "2026-05-27T15:13:33.862Z"
     },
     {
       "name": "threat-modeling-methodology",
@@ -1292,7 +1292,7 @@
         "PASTA v2 updates incorporating AI/ML application threats"
       ],
       "signature": "rFBpOQEJUPpl+v88Lw/WqVJRhTl80vy0VbPAbzQj3Q0suJRRrJg368I9uKu5LXIBKFDvKxnGIcIzbGg9NUtaCA==",
-      "signed_at": "2026-05-27T13:01:18.495Z"
+      "signed_at": "2026-05-27T15:13:33.862Z"
     },
     {
       "name": "webapp-security",
@@ -1366,7 +1366,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "ux85YI4t2mVHOyt744Yin1HHy+z11JIFygjKfFfQOBBl5QVV3A267jeIy7utix85irMcpZm/T3yx/ooqiK2tBA==",
-      "signed_at": "2026-05-27T13:01:18.496Z",
+      "signed_at": "2026-05-27T15:13:33.863Z",
       "forward_watch": [
         "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; AI-assisted discovery angle; track for active-exploitation confirmation and patch advisory affecting front-door web app deployments"
       ]
@@ -1419,7 +1419,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-15",
       "signature": "IIXnkZ5ZNqFwOto5KfytADTLLZLoyXNZACD1ORZ40P1HUAQxe6u2uyXFzzsfuob4Uy06jNkRGr2FFgCphUH1Cw==",
-      "signed_at": "2026-05-27T13:01:18.496Z"
+      "signed_at": "2026-05-27T15:13:33.863Z"
     },
     {
       "name": "sector-healthcare",
@@ -1479,7 +1479,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "AhF9KF8ZBlDteciV+F8IBSmFVYCvQOn44GmD4rZjgLoPxfIv/QE1/vSkK32zyqDKtHWkLSXExbkkPkxA/V6dDw==",
-      "signed_at": "2026-05-27T13:01:18.497Z"
+      "signed_at": "2026-05-27T15:13:33.864Z"
     },
     {
       "name": "sector-financial",
@@ -1560,7 +1560,7 @@
         "TIBER-EU framework v2.0 alignment with DORA TLPT RTS (JC 2024/40); cross-recognition with CBEST and iCAST"
       ],
       "signature": "HQgZvb4ReziEz5rNFr8i/O8/rJEZR+iHRROT7m/D2QUqhrcNISPkYXENsUZlG8xapzy/Ik92ehkseyj4hdmhCQ==",
-      "signed_at": "2026-05-27T13:01:18.497Z"
+      "signed_at": "2026-05-27T15:13:33.864Z"
     },
     {
       "name": "sector-federal-government",
@@ -1629,7 +1629,7 @@
         "Australia PSPF 2024 revision and ISM quarterly updates — track for Essential Eight Maturity Level requirements for federal entities"
       ],
       "signature": "linxmsXZiOYtcs71sSWgGCrvb8xQfmxmtTY5PRvZJ0/8FgJulo0tQtejzexYG775s7XhjAmGsDP238BQTQ8ADA==",
-      "signed_at": "2026-05-27T13:01:18.498Z"
+      "signed_at": "2026-05-27T15:13:33.865Z"
     },
     {
       "name": "sector-energy",
@@ -1694,7 +1694,7 @@
         "ICS-CERT advisory feed (https://www.cisa.gov/news-events/cybersecurity-advisories/ics-advisories) for vendor CVEs in Siemens, Rockwell, Schneider Electric, ABB, GE Vernova, Hitachi Energy, AVEVA / OSIsoft PI"
       ],
       "signature": "JjBfc0ovta560Clk0x3QGRM5osFJDwcvpy3rT7QEGdCIL827jzE8QCow1C8deXq+4JhY2sA/d7/8IsxikdlkCg==",
-      "signed_at": "2026-05-27T13:01:18.498Z"
+      "signed_at": "2026-05-27T15:13:33.865Z"
     },
     {
       "name": "sector-telecom",
@@ -1780,7 +1780,7 @@
         "O-RAN SFG / WG11 security specifications"
       ],
       "signature": "JWVxKFoKrbX4d+Tko1d4OBdwyg25MfFFKn4CT6E/CzH+YwnU3T6Y76uBQIKg3+gIGTvPduqyvQwQQ5FxKDuPBw==",
-      "signed_at": "2026-05-27T13:01:18.498Z"
+      "signed_at": "2026-05-27T15:13:33.865Z"
     },
     {
       "name": "api-security",
@@ -1849,7 +1849,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-18",
       "signature": "BmCRCestWqr55+fCynEhtAl5NWLT+xLTkpwS0Icp3SaoZOw/ce3Y6TtqjHRSKn4CBJq7YDiLRWxmhO3MStvOAA==",
-      "signed_at": "2026-05-27T13:01:18.499Z",
+      "signed_at": "2026-05-27T15:13:33.866Z",
       "forward_watch": [
         "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; track for active-exploitation confirmation and patch advisory affecting API gateway / reverse-proxy deployments",
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — LiteLLM 3-bug SSRF + Code Injection chain by k3vg3n; LLM-proxy API surface; track upstream patch and CVE assignments",
@@ -1935,7 +1935,7 @@
         "CISA KEV additions for cloud-control-plane CVEs (IMDSv1 abuses, federation token mishandling, cross-tenant boundary failures); CISA Cybersecurity Advisories for cross-cloud advisories"
       ],
       "signature": "/DV3pmZwrRySrk1OCbyI+0BQESacjupJfUX3eC2NGtXuYOBro0vndIP+z27heFxumnjU3a9sfla7/U9X+pqnDw==",
-      "signed_at": "2026-05-27T13:01:18.499Z"
+      "signed_at": "2026-05-27T15:13:33.866Z"
     },
     {
       "name": "container-runtime-security",
@@ -1997,7 +1997,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-15",
       "signature": "E2UGSf9ATyYgzBr8uM/0ubOUmDqo1jVA7f9mVxv6LHfWGCNuQNXDyuNou9VAmUCeeXEeUYIi3AFjXkJqpOkxDA==",
-      "signed_at": "2026-05-27T13:01:18.499Z",
+      "signed_at": "2026-05-27T15:13:33.867Z",
       "forward_watch": [
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Container Toolkit container escape ($50K award) by chompie / IBM X-Force XOR; high-severity container/hypervisor boundary break; track patch and KEV add post-embargo"
       ]
@@ -2071,7 +2071,7 @@
         "MITRE ATLAS v5.6.0 (released May 2026) shipped the AML.T0010 sub-technique expansion this forecast tracked plus new techniques (\"Publish Poisoned AI Agent Tool\", \"Escape to Host\"); inventory now 16 tactics, 84 techniques, 56 sub-techniques. Forward watch: subsequent ATLAS minor and major releases — track next-cadence updates to agentic-AI TTPs and MLOps-pipeline-specific techniques"
       ],
       "signature": "IL+DlRCDJN/p08iiJCFkasKcoyjcB0uWrJ6ORLjQcS1HrUa5Xt62QxVjYPHzaevlm5y36ZdmfESqsZJmzK3lCg==",
-      "signed_at": "2026-05-27T13:01:18.500Z"
+      "signed_at": "2026-05-27T15:13:33.867Z"
     },
     {
       "name": "incident-response-playbook",
@@ -2133,7 +2133,7 @@
         "NYDFS 23 NYCRR 500.17 amendments tightening ransom-payment 24h disclosure operationalization"
       ],
       "signature": "MmjLjlmOMLjhJJ4ZfR8MYlHam+ZB+eSqfh6Nv+DecaG4O5zeo9DBP/iL3cbyDVZxmhnhivgJild2ccYeWTeZAg==",
-      "signed_at": "2026-05-27T13:01:18.500Z"
+      "signed_at": "2026-05-27T15:13:33.867Z"
     },
     {
       "name": "ransomware-response",
@@ -2213,7 +2213,7 @@
       ],
       "last_threat_review": "2026-05-22",
       "signature": "ssueL03g9fWlhXpTe+IiY5l7RqQkunN4DTN5QETKE+VOX+qggdjAR8PONxk77ol4xWYmHrM/VcH8CNtXUEvgBA==",
-      "signed_at": "2026-05-27T13:01:18.501Z"
+      "signed_at": "2026-05-27T15:13:33.868Z"
     },
     {
       "name": "email-security-anti-phishing",
@@ -2266,7 +2266,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-18",
       "signature": "rK+WnuS+9tqEABmwc0jO/PEmxcLjG1/tmUb897HsClQeKzf+TQOlwBE+OsbtuKxpjYNwur62Xxs3TxObkwm8Cw==",
-      "signed_at": "2026-05-27T13:01:18.501Z"
+      "signed_at": "2026-05-27T15:13:33.868Z"
     },
     {
       "name": "age-gates-child-safety",
@@ -2334,7 +2334,7 @@
         "US state adult-site age-verification laws — 19+ states by mid-2026 (TX HB 18 upheld by SCOTUS June 2025 in Free Speech Coalition v. Paxton); track ongoing challenges in remaining states"
       ],
       "signature": "Rgho5TOFUL1txOzcVR0kASCNdovSU4yt99JlGilJlJRyg0A+BdeeQYrZrhPF6Vx2reUAVG0BeHfcZtSbi+cwCg==",
-      "signed_at": "2026-05-27T13:01:18.501Z"
+      "signed_at": "2026-05-27T15:13:33.869Z"
     },
     {
       "name": "cloud-iam-incident",
@@ -2414,7 +2414,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "e/kij7GtKaytROyIj7V5RH+FC9WtmVFzrmG2kIlNDNn29ep/CRNlIQKwXLpzo/81AIf634pmdr1qy/+vwIuUDA==",
-      "signed_at": "2026-05-27T13:01:18.502Z",
+      "signed_at": "2026-05-27T15:13:33.869Z",
       "forward_watch": [
         "AWS IAM Identity Center session-policy refresh and step-up-on-admin enforcement (anticipated 2026-H2 release)",
         "GCP Workload Identity Federation principal-set attribute mapping tightening (post-2026 Q3 Federation hardening guide)",
@@ -2508,7 +2508,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "ew9Kglc9fAZzbn0ZIfGP7WSK/j4eV2VhSvpy+s5bEfNEVYIMa2kZjnGBapgUsyGDLes9H9K2ovjQyX17+GKiBw==",
-      "signed_at": "2026-05-27T13:01:18.502Z",
+      "signed_at": "2026-05-27T15:13:33.869Z",
       "forward_watch": [
         "Entra ID conditional access evolution post-Midnight Blizzard — Microsoft's 2025-2026 commitments on legacy-tenant MFA enforcement and OAuth-app consent gating",
         "Okta IPSIE (Interoperability Profile for Secure Identity in the Enterprise) OpenID Foundation working-group output and adoption timeline",
@@ -2526,6 +2526,6 @@
   ],
   "manifest_signature": {
     "algorithm": "Ed25519",
-    "signature_base64": "9b/atKjAsgw3KU9Wmcw1Q1eD+ULRwUX0n+5Hs69QOva/OlR7B3eYZQuF6r6MkBg4hJRAY6FPmzDAe9iUqnQWBA=="
+    "signature_base64": "SrNc6vocUdcYk7atUeRrn4NtpQvZiV6zV+ji5u98RrvyFXyrYC5WUuNb+vLDw7g2Et+DXoVhrEFYdLBBdu7cAQ=="
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/exceptd-skills",
-  "version": "0.14.2",
+  "version": "0.14.4",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 42 skills, 11 catalogs (406 CVEs / 171 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
   "keywords": [
     "ai-security",

package/sbom.cdx.json

@@ -1,22 +1,22 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:uuid:0af1688b-ffe0-4b0b-b177-9598a354bd03",
+  "serialNumber": "urn:uuid:a194c2f0-f0ce-431b-8f4a-b65b77158b35",
   "version": 1,
   "metadata": {
-    "timestamp": "2031-10-26T22:04:59.000Z",
+    "timestamp": "2111-11-27T22:30:08.000Z",
     "tools": [
       {
         "vendor": "blamejs",
         "name": "scripts/refresh-sbom.js",
-        "version": "0.14.2"
+        "version": "0.14.4"
       }
     ],
     "component": {
-      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.14.2",
+      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.14.4",
       "type": "application",
       "name": "@blamejs/exceptd-skills",
-      "version": "0.14.2",
+      "version": "0.14.4",
       "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 42 skills, 11 catalogs (406 CVEs / 171 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
       "licenses": [
         {
@@ -25,17 +25,17 @@
           }
         }
       ],
-      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.14.2",
+      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.14.4",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "d1c4e08bc2fcade623d92d3a5d9398cf2a804e50aea76b0efd31f45c09184016"
+          "content": "40d489d13880ac08e06950ab7861942877ff8a58252776f6b09afc7673fe0bb5"
         }
       ],
       "externalReferences": [
         {
           "type": "distribution",
-          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.14.2"
+          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.14.4"
         },
         {
           "type": "vcs",
@@ -116,11 +116,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "8ad69ce7f1057bfa600caa1cca31bd4332a75b6c403ab3087c923dec6c4f756c"
+          "content": "514cf558d8176835b4436899c98c9563e5a5ee0bafab302ee7da33c962d94b4b"
         },
         {
           "alg": "SHA3-512",
-          "content": "b4389da9ddc26c2730e2187de177c9bf3d6f4d9cffb838ac32f4b9a10205dd37099dd171de68ec9df160049b347bc08e96bba5ec9d665ac28bd626d8afdaa1cd"
+          "content": "cfb90c6522c178454f8f48f84d5bd0dc7574c0f5625885ff714c7d8d8e62539e1c0c7fc71155e7b8b2ab49e7f16469421bba3f44e7a72c6794f2c76d706d3677"
         }
       ]
     },
@@ -281,11 +281,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "5c10d15f2560ef31ffce7904f7d3ad5cd6f0377b3353971f5f3f2834d9090dd3"
+          "content": "ef6fce318d6de37570aab08acee1836972f2cb019ff366c7cd21789dbcee8095"
         },
         {
           "alg": "SHA3-512",
-          "content": "1db6e57551d5c411dd0e3ce937556930e2549adc2c145c8548bc651963901f8d4c7c5825f7dce8dce115d9bbe5d6bd7fc61ef563532beb288770a0cd28c0501b"
+          "content": "6005808589c04f5045481044a4b607fc764c7ff34334ff46a108a4c4e10b9bddfbd6b60b6f163c979f3ea704ef7cf3f53bbfcef1c0bad3d884cf8c3699c097f2"
         }
       ]
     },
@@ -881,11 +881,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "cbfe304f39dfcc2a889171ff92c17b0c8590ccf69f2883cf630499ef4e89d04f"
+          "content": "7fc089baec25ccb5a228db85572ccd3dc5029832792edfc624c6ed2c24d8289b"
         },
         {
           "alg": "SHA3-512",
-          "content": "92057e0bfc5e24cdac6251fd35aaab415afe3ea9a5a31623016779d0e7ad3d56fc607dea815c6cd7fd21ccbcc9294ecfe8817486c6611611b0ca4f9113d4178c"
+          "content": "2c1f27474cded1a4b063c9e261fc0c0e633d4f4478da43d5ad74f1308c1a28366cd87a0b05e096cd485f00037cc5abcb1250160622363d28c74aea3e3777b449"
         }
       ]
     },
@@ -941,11 +941,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "5576bf3ca7f4f2c69f22c93303d808c3f302bf53b62d46cbb7ec23f5f72f9f8b"
+          "content": "b31872b10eb815a53d7753f294dc8409de58b847c296ca2d91c5be4548a3e696"
         },
         {
           "alg": "SHA3-512",
-          "content": "6f2f8db0387761724feb916761459b73c9ab58064de5d5b30e3e04141601bd36e8903fc1e351501abc48501dfac9ecc6583d89afdfd4df27c9394db1a9b9eda4"
+          "content": "46aa9be2df845e10938e5f76a120d42541e3726d92b682504a70dde1d7f6c046606e33ff44bde3ca708d30065d85484d5ab3baa32e93340e6d3f8ac7ac878a1f"
         }
       ]
     },
@@ -1151,11 +1151,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "b1012dac78542a9c7fad7945ee1c15671d710a39d054ab9a6ef0a8f78c9282f2"
+          "content": "bacd5bb4d26af7a025bc0e9cc8139551618bd352927acbaeaa5855ae1ea86849"
         },
         {
           "alg": "SHA3-512",
-          "content": "6b2892048c6338da5ea68a490bd861d71e7ff31affb2fdbe13b48202d7b71b6b9ea453692f4cdca6c756725b747f4310fc174e21cf2700fda32022ab57955e20"
+          "content": "a5c7a22d905441b487b8cdaaff5744a7f008c00b8629b513ebd059eee3e07c6fccb7ac7c62bad3055a1204a92b493db38ef5fbc033da0fe2eca52a6d4b5d6585"
         }
       ]
     },
@@ -1376,11 +1376,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "53800bf89522a15e0f8f6f888c5f04410f6c17a2c6537738dc74d5e173a9d43c"
+          "content": "96ffa31aaa2239a597eaea9f789777cb33241d13cbd87a295573740912cb1e1a"
         },
         {
           "alg": "SHA3-512",
-          "content": "170bbfd54710e1834f1d6e64d6c22c15f6e884bd874053c42c7d1dbbb42effa937572ba8d6617af7c0f698776e13b9a350ad020ebe06bac6a3f9cb972a30ec6c"
+          "content": "dea608cddf51207d631dd3be0700ad313860750ce7f94ae3cd177b578999e499196f7a26ebc11be2524505901ab94efbda6a49ea78f8830fec9404e1bf75c67a"
         }
       ]
     },
@@ -1751,11 +1751,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "e3c6dc62608d025f8f60ae232bdd54da7433eb8c1d29bdef81deee51122dae4c"
+          "content": "e9db8b2640844856c72c5e120fe7973d10d3e5d237c38ab38c26bf4c5eaf7af8"
         },
         {
           "alg": "SHA3-512",
-          "content": "e526912ad23c013ab847d002800b354a74e2f89663702b34a9b82eb18ea99b1fd725cacef689543f2e5eee305df757420bb802978cb108f5c58d5156cec6482f"
+          "content": "5c7cf5ee1a9226a81b7abd1a5fc18e536da5996c0d4031846793de843badcb92118901155536aba87cf508456b19a8f1f51992da30f590345faaf8dfb73f112e"
         }
       ]
     },