@blamejs/exceptd-skills 0.14.27 → 0.15.0

package/sbom.cdx.json

@@ -1,23 +1,23 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:uuid:a1c62002-6a6e-415b-8858-5f5496dff5cf",
+  "serialNumber": "urn:uuid:779a30c1-027c-4fca-b5e9-b9ddbfd4f383",
   "version": 1,
   "metadata": {
-    "timestamp": "2112-01-04T09:08:18.000Z",
+    "timestamp": "2089-08-02T11:08:49.000Z",
     "tools": [
       {
         "vendor": "blamejs",
         "name": "scripts/refresh-sbom.js",
-        "version": "0.14.27"
+        "version": "0.15.0"
       }
     ],
     "component": {
-      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.14.27",
+      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.15.0",
       "type": "application",
       "name": "@blamejs/exceptd-skills",
-      "version": "0.14.27",
-      "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 42 skills, 11 catalogs (406 CVEs / 171 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
+      "version": "0.15.0",
+      "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 42 skills, 11 catalogs (427 CVEs / 173 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
       "licenses": [
         {
           "license": {
@@ -25,17 +25,17 @@
           }
         }
       ],
-      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.14.27",
+      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.15.0",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "529a8b801ca55ffc07bf18f5fa4257d944e293efc1d3d3b3cfab9bf526e50f12"
+          "content": "958178dbd6a92b6863edbb5d1e77004b11bbf65850e70d1d1a010ada78d2ca61"
         }
       ],
       "externalReferences": [
         {
           "type": "distribution",
-          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.14.27"
+          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.15.0"
         },
         {
           "type": "vcs",
@@ -101,11 +101,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "c53e00aca85205cfae25eba8f333e64f43e48823013cdc1e4f4dcdd8260ddfe7"
+          "content": "0ec6914dd27c3c015bbd1a6c6e534853f5aaef25ac7299b6e40f309553e7546c"
         },
         {
           "alg": "SHA3-512",
-          "content": "d7a884c53b790f39f8d487d07dfc4b75f56d433639e8cc7c592e1d6fa830b02a7fa82c32164264132b08342a082245d2396edf90884813cdeca1d79591ed0b75"
+          "content": "2b00b049ab8261131963e476fcc40486d684b4e95a0dcbdc20affd978dc073e8b151af6b75c9cfe2d292b9b8cda65aed1b27b36588ca40f7299538f09b093a40"
         }
       ]
     },
@@ -116,11 +116,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "4770e4b32325dfd1a272cd0fb0674da4833e0eaa0e2617ec7ac6ed1506bde2fe"
+          "content": "5f6f30b13d184ad89b9ec37b646a415efe9c3b321950ead58173d96151561fe8"
         },
         {
           "alg": "SHA3-512",
-          "content": "920915f9a0102bc5e4f689aca131c9d5540dc4a458fb201e13c8a44bece58f03487f91b79f6fb53cde1161f3b98d239e9ba7736c8042e7e8f9736ce379894118"
+          "content": "9e279065a57a02b74c37e8f0c9c239ef05976769493d49b172a0f6a77ae49023b23de61f0215e608dcb14e80b2ebfae9a492d8b3afecde0bf4de5dacbeb48e49"
         }
       ]
     },
@@ -176,11 +176,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "ec4903c106417648c6ba1077f7a00ac381b1f946f9c71abdc550e6555af4ca8d"
+          "content": "45236da64a3811cc1301477352b6c8aa29b91907f5b9c988176002648284bc52"
         },
         {
           "alg": "SHA3-512",
-          "content": "7a43733a284a3e1769df521f62a3a021b23935ea3e6ab19f1a1702c59f47474f58b953898ceb8309f8b747a0aa970270ee7c593ecca9ab52948e1e269ccae502"
+          "content": "9f1f6812a30abc0c973f7b67a428029bb97726dfac7da51c4cf984e01ee5373c2422f2b3d3512427d182fb0b14ec248ef5bba07e21ff72f5fb6893180d9a7498"
         }
       ]
     },
@@ -281,11 +281,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "b96501c14bcb65b8cd627010ec92192e1fb0682723d5515b0f4d1f03f7f19c92"
+          "content": "95b02d8293463cbf429a6ec57285c73ab83e9c93172391d019187ae68fe3a924"
         },
         {
           "alg": "SHA3-512",
-          "content": "e52228baae7e25225230785cbb64c288fc23dc903043d3436759f03a3fc5d794c12bfa77c2edfded4537e0d0c8bf4127169cb221eb85a112cf548d9c864d2acb"
+          "content": "8a3367e81fe6e0ac89cc430aa7b55da3fd52e30ccdc2b790f0e36a2db699ab0f60cd1027afe7d48aba4f38101a419495e1f03edd25f87eee64d67a8b68f53aa0"
         }
       ]
     },
@@ -311,11 +311,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "da108a493511ce0b04c37d0e69ed357e9b61fff94b9c78c205eaf64bb2496dce"
+          "content": "57b8a1b4e1c3f524a76b4bded09b3082b36b783db3df116f863892072e0f65e9"
         },
         {
           "alg": "SHA3-512",
-          "content": "2d6ab4dfb080b2851517c3c7fc6591384efe968c9134d348e6b08df256435f027e9c9cf5a8f128a806695c59d74bf99ff4830470084f059aab83a57ca1713962"
+          "content": "b26b4e1fa83eaf753e998a1965a7f114b3e93135650a5fe6d99d36dab6c2a1a62426882813d005997fc2f92507c9de0186a6b50a906690ccc43cd906b2bf17ba"
         }
       ]
     },
@@ -326,11 +326,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "f8a734e43b2f53f0ac2bb68859d422ed8e1a04ae27a587fd0f90396a58f36561"
+          "content": "5849b48dd5489ba6d10cbd3b0b25c9d8412e3932e0ae2304364ec95cf254ec97"
         },
         {
           "alg": "SHA3-512",
-          "content": "322d5bb432bc42e384d20c4fe3a8a4ef1af7c7ae240de03ced286c3f25c1788e150f17f6ce8509a277b31ac67bb9007c52c011886430abbaea9ad1c6a55ec58d"
+          "content": "5f105049ae035b4408213e1d67a584ba95cd7cf12fb71819d9e6972297bc9e91310242a657e718d107e0f3af12b48c50a660989d593d9db4d308cec0def924f9"
         }
       ]
     },
@@ -341,11 +341,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "8abc97e4e4312bdc3b26cc777cd95c5482a7b12cd77e7704a7cda24f1e4d8057"
+          "content": "0fd275c2a61754958d68cea03a92794a67cf1c1d4d609f81a5728334df013ee3"
         },
         {
           "alg": "SHA3-512",
-          "content": "e2cfdf031349a3b606409f91d4d1a7be9881d308d64d65da892259c0509613b88e2a53041466c732f23106dd9090a4304009ab2e0d96b844072648703d0e8c62"
+          "content": "f6ca0b0e10d8b5d9d45ed43fd3b80d95ecd6ecb99a0241daa7e08695de2c02c7532d720cd4e61b6c3e9a138dfb9306ccefab43715d2a1c2b16cc34784e6d34ce"
         }
       ]
     },
@@ -401,11 +401,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "ddff6bcd32734bd97ba9c92b065303b1b69596f4e360fd3ce77cd0ceaab15871"
+          "content": "29e7b6aa841ddf2530ca5971bdb60d7a715684b2f6264141ad49f0de9a039d78"
         },
         {
           "alg": "SHA3-512",
-          "content": "d829a79c9844b96985ebf886829072a941215e5167873fa1149d88c1515e4463d49a9a57ce7b236cf2c5499f241f4c6fa5f86d37182423d6b4fd71576b2d65a4"
+          "content": "db18692914f44c8cbc9a853fe43865a5547058b5b0dc656e45e83da322072a323fa08b40479ecb8dbb2d1aac1997dccff05be3c26351098806b41a750248c43e"
         }
       ]
     },
@@ -806,11 +806,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "13d620e664064517a55bd573070be891056c95b89290d769a8b433aa369eacbe"
+          "content": "e8202ffa99ed7c7d40b89ee5eedbea33839048cbff482e09329292e6700a5157"
         },
         {
           "alg": "SHA3-512",
-          "content": "b43eeff2f2c525ca236deff7a9f6a5ecc88aed86a429269903df7cae0b1e92953ff1b84afa53d161db661da337cc108e294473eec0447ba8eb8648a9343c4ed7"
+          "content": "6a606c36b778ec60e04d59aa02fe08fa6c845c2131f264b7c739f881a89a738bdddd32274b1a0c9d2d27ef829529f5392db2fd803bb9075455d4214f3d3b01ff"
         }
       ]
     },
@@ -1256,11 +1256,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "e81dd33acfffe2ff28da4b278bcdc11b7e4616dbc6ff4cd1c92f0f99baf97c8a"
+          "content": "ec24ab0571195a679fda6d7fd23c9c577e9616ba655fd04e4231817ca725f7e4"
         },
         {
           "alg": "SHA3-512",
-          "content": "a0f8c147fefd6c91640d2fbe0c606c371c4f83c8a2f3b380c8d212ec92d8616ee1da220269b42638d60d75fcc730e822cb29e1e87f408e9dd553eed76b7aee02"
+          "content": "7f083e86fa43a70e514d2b62d7337ccfcc644ba5a225936ec972cd11540e6d262321c092acb271897881d2803c9e0b40896aa8af5b272ac0f101c9ef24491bf2"
         }
       ]
     },
@@ -1301,11 +1301,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "48aa70089fe9fc3bee80e19042d28d91ceb996ed018b6131db970dba7cadb90e"
+          "content": "2b956a7a8d528e93e6cce8c2b09e7b228495c4d688c1403f7de5f60bc62d71b1"
         },
         {
           "alg": "SHA3-512",
-          "content": "25eebb05dae2722fb94fccdc580334d82efdcbe4a7b4e099b9b5adc55b5ffb94cebc9f645f0e6effdb46db6a8ad1aa0358ac6014c525ceb32dbef655d082cbfe"
+          "content": "ea8d4ff719262d817b2892dbec6e14f687afde27b7ab31ca621c6e9b0a4ccf98eb3aa5a4753281efd06f188b6d0e34bf98aaf995758cf9c3a9379bae5bb17313"
         }
       ]
     },
@@ -1316,11 +1316,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "074ab23671792535ace6dc60b46350cda272bb8a19a28e104586aadbc879d486"
+          "content": "60bd6a680557bc848a723a20fc50049941b658f08c72205b4afb0ae19584d837"
         },
         {
           "alg": "SHA3-512",
-          "content": "940022bc025bf54514d10dc87c48fa645679953087f6f19659a06d16ea8337d9108785bd18a7ecbc2d1b395b621bf323baf9a898de1896159421e0fa4abf462b"
+          "content": "8648247dd05f0dcb9da52f2795da8ebda8e95e2652ddf3b1aff5c8cb4d530b7d8bbe4949e061641ace658445baa4f1f5ad1ff8444a0bbb6b964e8adf0e4cd30e"
         }
       ]
     },
@@ -1586,11 +1586,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "ba92f12ed265afe414fa79b88aaa677c5bf9b44e4c3837e4d1571e927f28803d"
+          "content": "d3e8dbc27d2a48759a4f40d7e075801065814bc3d971775c2272bc1f26dc1a89"
         },
         {
           "alg": "SHA3-512",
-          "content": "c437e1c817718659544eb1bb1f3181f783619b77f76675494301d329ab0af011e8b03051634ec9039afaefaeba8eb7eaae511bfff63b163dbed51234e70c8b44"
+          "content": "73ef5fd057c8257b4187cd429499e7494d290e0c9792f8e779d8909a9f77e13f8d1d282489ed79c855fa83a45464eb5acbccc603d4baf86325d2bc136ae60a11"
         }
       ]
     },
@@ -1751,11 +1751,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "c01b0ab7d4e2fc7e1df238aef12a757006bd88c4b5d920d7aa49e4fd70fa92a6"
+          "content": "2075a9d45002fe52785b0aa326d3bf6531f6b9b611c4c8ae166b413ca5f06b8c"
         },
         {
           "alg": "SHA3-512",
-          "content": "73903eea2e7d744fba4e3518486110e2880bc2dc3262a9f16f4c535cd5bf0306c23f06e0e3bf4eb9591b1ac6268f051c0d310197067e21ae82d2bb3db180c85e"
+          "content": "f6d432a3b181644811b9e5a8ba646cfa750996451ab408ad34c3bc6fc2d47f3dc3d85e88dda762fe69f63024bfc700d4a58fd19765052eeb77364544eb790988"
         }
       ]
     },
@@ -1811,11 +1811,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "4c9ec7d070014f0e1fac5958c1c995ca708df52b7f19c2a36c60573e7629d5b4"
+          "content": "e16aa7a99b3ea873c3977e8649665f4704aa890595654b8f851ba0f5565d0518"
         },
         {
           "alg": "SHA3-512",
-          "content": "f61247ab992bfa2c7ea073a1cf550b94b0a381363b88a23d3c716b154d840d3e28f1e58358ab87b7f264c81e6cd6357fe7d5d02e9f913f9748d62d5fa3b64116"
+          "content": "168c82da32d91b2a9b012948939dea72523b1c6ebe4da06cb49ca27dbefc8ead66c834f1be68a684f049114ebd106903cac6ef5b98e0a7830b8b3e1170f4e865"
         }
       ]
     },
@@ -2171,11 +2171,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "ef47f63889341675c90bc07d835f5cfab137b83ab44820799de715e4762c1c74"
+          "content": "79b3d1d5795a64f30ef65a9ec383a212d2eda581cdec4b6b261671b8ef8ad82b"
         },
         {
           "alg": "SHA3-512",
-          "content": "ba197b6fce1c871d80ac2becadb0fff9161b790d78ed5a9409d7100da55e73a6a50ea644771b550bfd9654a69953c8b905fc609d3078d8fe9542d629dde5e9d4"
+          "content": "175a1243ad5d375a4d75467073214620021498f5439763581563ee4ded3a03344d1ea824735eb38c200bf5d0dd59c79c6fa0ba0d082d6966f92fb8387769bced"
         }
       ]
     },
@@ -2246,11 +2246,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "d126c48bee7da18f03cefba681dcae5b931a0472658e4d7e0227ce3e29461026"
+          "content": "1d3b7bd15af17a88afb82dada50494433299455e76206b23a895f1ff9ca8a696"
         },
         {
           "alg": "SHA3-512",
-          "content": "1ba4ffa94b0bf0bdb7e0bd0b537d016424da070d7c6991b90446dc8991dc005d13d5d306cc69d10ad73f765154eb09716b68cad38ab609069f105974006f4d3e"
+          "content": "d4c3a7dc1af799ed3d8f28ba47b87a3ef4781cb28f688e76322d15404772e5199cc292bcee979eaefb19d0bb519635353a328412c59fd5baa412548282637ec8"
         }
       ]
     },
@@ -2291,11 +2291,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "81967862730d2fcfd6b42442031d584cf9718939305d40f7b5ae2ab590f7c85c"
+          "content": "5a7fa5b528b49ca506043e5e3a0ce4a240059a9ff57a187f36750529a8dc64fc"
         },
         {
           "alg": "SHA3-512",
-          "content": "f8d0179cf645f05b3838ebf8ac024689a21bdd7b5a22a824ac47db866ce1246d3fb256dcf71eaa2c8e177dccd9447478dc655edc01f043f7532ac403c6b181fa"
+          "content": "c122f45cc73ffd2a9cd3e72d0a398cd2297bd73b80b2ca540c4d9a8457c199cf7607bd34b60c9535557cf19f5b6d619014a6b14577909c69d11101785bc3fc56"
         }
       ]
     },

package/scripts/check-catalog-gap-budget.js

@@ -51,7 +51,11 @@ function loadAll() {
 // in tests/shipped-catalog-integrity.test.js.
 const BUDGET = {
   "content-quality": 12,
-  "temporal-staleness": 260,
+  // temporal-staleness counts CURATED entries only — auto-imported draft
+  // KEV-due-passed findings are calendar-drift noise (they once saturated a
+  // 260 budget). Curated actual ~20; 35 leaves headroom without the count
+  // breaching the budget purely as the calendar advances.
+  "temporal-staleness": 35,
   "logical-consistency": 5,
   "cross-ref-completeness": 5,
   "schema-evolution": 0,

package/scripts/check-test-coverage.js

@@ -272,6 +272,15 @@ function extractCliSurface(content) {
     let m;
     while ((m = re.exec(playbookBlock[1])) !== null) verbs.add(m[1]);
   }
+  // REMOVED_VERBS keys are still part of the CLI surface: invoking one returns
+  // a structured refusal envelope (a real, test-covered contract). Counting
+  // them keeps a verb in the surface set when its vestigial COMMANDS entry is
+  // dropped — otherwise removing dead COMMANDS table rows for already-retired
+  // verbs reads as a fresh "removed-but-test-remains" against the refusal test.
+  const removedBlock = content.match(/const REMOVED_VERBS = \{([\s\S]*?)\n\};/);
+  if (removedBlock) {
+    for (const m of removedBlock[1].matchAll(/^\s*"?([a-zA-Z][\w-]+)"?\s*:/gm)) verbs.add(m[1]);
+  }
   const flagRe = /(--[a-zA-Z][\w-]+)/g;
   let m;
   while ((m = flagRe.exec(content)) !== null) flags.add(m[1]);

package/scripts/predeploy.js

@@ -68,7 +68,11 @@ const GATES = [
   {
     name: "Validate CVE catalog schema + zero-day learning coverage",
     command: process.execPath,
-    args: [path.join(ROOT, "lib", "validate-cve-catalog.js")],
+    // --strict promotes the deferred warning checks (cross-catalog ref
+    // resolution, strict CVSS-vector prefix, KEV-date-required, Hard-Rule-#14
+    // IoCs) to hard failures so they block a release rather than scrolling
+    // past. Auto-imported drafts stay exempt.
+    args: [path.join(ROOT, "lib", "validate-cve-catalog.js"), "--strict"],
     ciJobName: "Data integrity (catalog + manifest snapshot)",
   },
   // the "validate-cves --offline --no-fail" and
@@ -89,7 +93,7 @@ const GATES = [
   {
     name: "Lint skill files",
     command: process.execPath,
-    args: [path.join(ROOT, "lib", "lint-skills.js")],
+    args: [path.join(ROOT, "lib", "lint-skills.js"), "--strict"],
     ciJobName: "Lint skill files",
   },
   {
@@ -113,7 +117,7 @@ const GATES = [
   {
     name: "Validate catalog _meta (tlp + source_confidence + freshness_policy)",
     command: process.execPath,
-    args: [path.join(ROOT, "lib", "validate-catalog-meta.js")],
+    args: [path.join(ROOT, "lib", "validate-catalog-meta.js"), "--strict"],
     ciJobName: "Data integrity (catalog + manifest snapshot)",
   },
   {
@@ -174,7 +178,7 @@ const GATES = [
     // v0.13.0 additions) all validate cleanly.
     name: "Validate playbooks (schema + cross-refs)",
     command: process.execPath,
-    args: [path.join(ROOT, "lib", "validate-playbooks.js")],
+    args: [path.join(ROOT, "lib", "validate-playbooks.js"), "--strict"],
     ciJobName: "Validate playbooks",
   },
   {