@blamejs/exceptd-skills 0.14.6 → 0.14.8

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.14.8 — 2026-05-27
+
+SARIF output now carries file locations. A run's `results[].locations` are populated from per-indicator evidence locations, so a secret or file finding points at the file — and the line, when known — that triggered it instead of shipping location-less, which GitHub code scanning and most SARIF viewers drop or attribute to the repository root. A submission may supply locations directly (`evidence_locations: { "<indicator-id>": ["path", { "uri": "path", "startLine": N }] }`), and the code-scope collectors emit them from their hit data, so `exceptd collect <pb> | exceptd run <pb> --format sarif` produces located findings.
+
+## 0.14.7 — 2026-05-27
+
+The deprecated-alias help is now honest about behavior. `scan`, `dispatch`, `currency`, `validate-cves`, and `validate-rfcs` still run their original (legacy orchestrator) implementation and emit that older output shape — they are not transparent aliases of the canonical verbs listed as their replacements, and the help no longer implies otherwise.
+
+`attest diff --against <sid>` validates the comparison session-id with the same gate as the primary one, so a path-traversal or malformed value returns an explicit "invalid session-id" error instead of a misleading "no session dir found".
+
 ## 0.14.6 — 2026-05-27
 
 `attest verify --require-signed` makes an unsigned or sidecar-stripped attestation a failure (exit 1) instead of accepting it as "unsigned, exit 0". An audit gate can now require a valid Ed25519 signature, closing the path where deleting the `.sig` downgraded a tampered attestation to a passing verify. Default `attest verify` stays lenient — an unsigned attestation is reported but not failed (the common keyless-CI case).

package/bin/exceptd.js

@@ -506,9 +506,12 @@ here so old scripts know where each moved:
 Deprecated aliases (still work — prefer the canonical verb)
 ───────────────────────────────────────────────────────────
 
-These still run. The [DEPRECATED] prefix keeps them out of the active-verbs
-list that \`exceptd help | grep '^  [a-z]'\` surfaces. Each maps to a canonical
-verb:
+These still run their original implementation — they are NOT transparent
+aliases, and several (scan, dispatch, currency, validate-cves, validate-rfcs)
+emit the older orchestrator output shape, not the canonical verb's. Migrate to
+the canonical replacement listed (whose output may differ); the [DEPRECATED]
+prefix keeps them out of the active-verbs list \`exceptd help | grep '^  [a-z]'\`
+surfaces.
 
   [DEPRECATED] scan              → discover --scan-only
   [DEPRECATED] dispatch          → discover
@@ -5490,6 +5493,13 @@ function cmdAttest(runner, args, runOpts, pretty) {
     // session (= reattest). With --against, compares two sessions A vs B
     // by evidence_hash + artifact-level field diff.
     if (args.against) {
+      // Validate the --against id with the same gate as the primary sid, so a
+      // traversal/garbage value (`../../etc/passwd`) gets the explicit "invalid
+      // session-id" message rather than a misleading "no session dir found".
+      try { validateSessionIdForRead(args.against); }
+      catch (e) {
+        return emitError(`attest diff --against: ${e.message}`, { against_input: typeof args.against === "string" ? args.against.slice(0, 80) : typeof args.against }, pretty);
+      }
       const otherDir = findSessionDir(args.against, runOpts);
       if (!otherDir) {
         return emitError(`attest diff --against ${args.against}: no session dir found.`, null, pretty);

package/data/_indexes/_meta.json

@@ -1,10 +1,10 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-05-27T16:47:46.405Z",
+  "generated_at": "2026-05-27T18:03:07.442Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 54,
   "source_hashes": {
-    "manifest.json": "971fd9c7d8cdf08f06cb136826664adee342f52c0260e5b4e228d055c19addae",
+    "manifest.json": "4e43fc695c4246f2ccdb47cf1807b7a40c961032926dbf3dd3d83bce9af9d7cd",
     "data/atlas-ttps.json": "d24bc02859d40ccf1615db75cca68c077585904e41e0d8f6de448121e9b1abb0",
     "data/attack-techniques.json": "fa193f0d2d248176a8beddb641e9fe56ba4faa9e15dc253ff876dbf0c5d58a77",
     "data/cve-catalog.json": "3d451dda7ac0c7d57a4075ae4bafd3148c6184b35dc1bc59d8b81d1f2641e430",

package/lib/collectors/cicd-pipeline-compromise.js

@@ -21,7 +21,7 @@
 
 const fs = require("node:fs");
 const path = require("node:path");
-const { isLinkedWorktreeDir } = require("./scan-excludes");
+const { isLinkedWorktreeDir, buildEvidenceLocations } = require("./scan-excludes");
 
 const COLLECTOR_ID = "cicd-pipeline-compromise";
 
@@ -294,6 +294,20 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
     "wildcarded-oidc-sub-claim": oidcWildcards.length > 0 ? "hit" : "miss",
   };
 
+  // Per-indicator file locations for every indicator flipped to "hit", so a
+  // SARIF result points at the workflow YAML (or OIDC trust JSON) that
+  // triggered it. Line-scanned indicators (workflow-injection-sink,
+  // actions-floating-tag-pin) carry a real line; the trigger-shape and
+  // OIDC-wildcard indicators record the file only and surface as file-level.
+  const evidence_locations = {};
+  const evidenceSources = { ...aggregateHits, "wildcarded-oidc-sub-claim": oidcWildcards };
+  for (const [id, list] of Object.entries(evidenceSources)) {
+    if (signal_overrides[id] === "hit") {
+      const locs = buildEvidenceLocations(list);
+      if (locs.length) evidence_locations[id] = locs;
+    }
+  }
+
   const artifacts = {
     "workflow-yaml-inventory": {
       value: workflows.length ? workflows.map(w => w.rel).join(", ") : "no workflow files found at cwd",
@@ -348,6 +362,7 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
     },
     artifacts,
     signal_overrides,
+    ...(Object.keys(evidence_locations).length ? { evidence_locations } : {}),
     collector_meta: {
       collector_id: COLLECTOR_ID,
       collector_version: "2026-05-21",

package/lib/collectors/citation-hygiene.js

@@ -30,7 +30,7 @@
 const fs = require("node:fs");
 const path = require("node:path");
 
-const { codeExcludeSet, isLinkedWorktreeDir } = require("./scan-excludes");
+const { codeExcludeSet, isLinkedWorktreeDir, buildEvidenceLocations } = require("./scan-excludes");
 
 const COLLECTOR_ID = "citation-hygiene";
 
@@ -447,12 +447,25 @@ function collect({ cwd = process.cwd() } = {}) {
     },
   };
 
+  // Per-indicator file locations for the indicators flipped to "hit",
+  // so SARIF results point at the source file that carries the bad
+  // citation. The hits record the file but not a line, so locations are
+  // file-level (no startLine).
+  const evidence_locations = {};
+  for (const id of Object.keys(hits)) {
+    if (signal_overrides[id] === "hit") {
+      const locs = buildEvidenceLocations(hits[id]);
+      if (locs.length) evidence_locations[id] = locs;
+    }
+  }
+
   return {
     precondition_checks: {
       "repo-cites-security-references": totalCveCitations > 0 || totalRfcCitations > 0,
     },
     artifacts,
     signal_overrides,
+    ...(Object.keys(evidence_locations).length ? { evidence_locations } : {}),
     // The citations the offline catalog could not confirm. `applyResolution`
     // (opt-in --resolve) consumes this to resolve + flip them; on a plain
     // collect it documents what still needs verification.

package/lib/collectors/containers.js

@@ -20,7 +20,7 @@
 
 const fs = require("node:fs");
 const path = require("node:path");
-const { codeExcludeSet, isLinkedWorktreeDir } = require("./scan-excludes");
+const { codeExcludeSet, isLinkedWorktreeDir, buildEvidenceLocations } = require("./scan-excludes");
 
 const COLLECTOR_ID = "containers";
 
@@ -374,6 +374,19 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
     signal_overrides[id] = list.length > 0 ? "hit" : "miss";
   }
 
+  // Per-indicator file locations for every indicator flipped to "hit", so a
+  // SARIF result points at the Dockerfile / compose / k8s manifest line that
+  // triggered it. Line-scanned hits carry a real line number (emitted as
+  // startLine); whole-file hits (e.g. runs-as-root, cluster-admin-binding)
+  // record line 0 and surface as file-level locations.
+  const evidence_locations = {};
+  for (const [id, list] of Object.entries(allHits)) {
+    if (signal_overrides[id] === "hit") {
+      const locs = buildEvidenceLocations(list);
+      if (locs.length) evidence_locations[id] = locs;
+    }
+  }
+
   const summarize = (list, limit = 5) => {
     if (list.length === 0) return "0 hits";
     const sample = list.slice(0, limit).map(h => `${h.file}:${h.line}`).join(", ");
@@ -415,6 +428,7 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
     },
     artifacts,
     signal_overrides,
+    ...(Object.keys(evidence_locations).length ? { evidence_locations } : {}),
     collector_meta: {
       collector_id: COLLECTOR_ID,
       collector_version: "2026-05-20",

package/lib/collectors/crypto-codebase.js

@@ -16,7 +16,7 @@
 
 const fs = require("node:fs");
 const path = require("node:path");
-const { codeExcludeSet, isLinkedWorktreeDir } = require("./scan-excludes");
+const { codeExcludeSet, isLinkedWorktreeDir, buildEvidenceLocations } = require("./scan-excludes");
 
 const COLLECTOR_ID = "crypto-codebase";
 
@@ -455,12 +455,28 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
     },
   };
 
+  // Per-indicator file locations for the call-site indicators flipped to
+  // "hit". The cross-file derived indicators (ecdsa-without-pqc-roadmap,
+  // no-ml-kem-implementation, fips-claim-without-runtime-activation,
+  // vendored-pqc-no-provenance) describe a whole-repo state rather than a
+  // single offending file, so they carry no file-level location. The
+  // call-site scans record the file but not a line, so locations are
+  // file-level (no startLine).
+  const evidence_locations = {};
+  for (const id of Object.keys(hits)) {
+    if (signal_overrides[id] === "hit") {
+      const locs = buildEvidenceLocations(hits[id]);
+      if (locs.length) evidence_locations[id] = locs;
+    }
+  }
+
   return {
     precondition_checks: {
       "repo-context": sourceFiles.length > 0,
     },
     artifacts,
     signal_overrides,
+    ...(Object.keys(evidence_locations).length ? { evidence_locations } : {}),
     collector_meta: {
       collector_id: COLLECTOR_ID,
       collector_version: "2026-05-20",

package/lib/collectors/library-author.js

@@ -31,7 +31,7 @@
 
 const fs = require("node:fs");
 const path = require("node:path");
-const { codeExcludeSet, isLinkedWorktreeDir } = require("./scan-excludes");
+const { codeExcludeSet, isLinkedWorktreeDir, buildEvidenceLocations } = require("./scan-excludes");
 
 const COLLECTOR_ID = "library-author";
 
@@ -483,6 +483,20 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
     signal_overrides["lockfile-missing-integrity"] = lockfileMissingIntegrity;
   }
 
+  // Per-indicator file locations for the publish-workflow indicators
+  // flipped to "hit", so a SARIF result points at the workflow file (and,
+  // for mutable action refs, the offending `uses:` line). The other
+  // indicators (provenance / sbom / security.md / security.txt / vendor /
+  // lockfile) reflect a whole-repo presence-or-absence state with no single
+  // offending file, so they carry no file-level location here.
+  const evidence_locations = {};
+  for (const id of Object.keys(workflowHits)) {
+    if (signal_overrides[id] === "hit") {
+      const locs = buildEvidenceLocations(workflowHits[id]);
+      if (locs.length) evidence_locations[id] = locs;
+    }
+  }
+
   const artifacts = {
     "release-workflows": {
       value: publishWorkflows.length
@@ -515,6 +529,7 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
     },
     artifacts,
     signal_overrides,
+    ...(Object.keys(evidence_locations).length ? { evidence_locations } : {}),
     collector_meta: {
       collector_id: COLLECTOR_ID,
       collector_version: "2026-05-20",

package/lib/collectors/sbom.js

@@ -17,6 +17,7 @@
 
 const fs = require("node:fs");
 const path = require("node:path");
+const { buildEvidenceLocations } = require("./scan-excludes");
 
 const COLLECTOR_ID = "sbom";
 
@@ -377,12 +378,23 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
     }
   }
 
+  // Per-indicator file location for the one deterministically-decided
+  // indicator: a lockfile-no-integrity hit points at the npm lockfile that
+  // carries integrity-less entries. File-level (the gap is spread across
+  // many entries, not one line).
+  const evidence_locations = {};
+  if (signal_overrides["lockfile-no-integrity"] === "hit" && npmLockfile) {
+    const locs = buildEvidenceLocations([{ file: npmLockfile.file }]);
+    if (locs.length) evidence_locations["lockfile-no-integrity"] = locs;
+  }
+
   return {
     precondition_checks: {
       "sbom-tool-available": hasAnything,
     },
     artifacts,
     signal_overrides,
+    ...(Object.keys(evidence_locations).length ? { evidence_locations } : {}),
     collector_meta: {
       collector_id: COLLECTOR_ID,
       collector_version: "2026-05-20",

package/lib/collectors/secrets.js

@@ -18,7 +18,7 @@
 
 const fs = require("node:fs");
 const path = require("node:path");
-const { codeExcludeSet, isLinkedWorktreeDir } = require("./scan-excludes");
+const { codeExcludeSet, isLinkedWorktreeDir, buildEvidenceLocations } = require("./scan-excludes");
 
 const COLLECTOR_ID = "secrets";
 
@@ -309,6 +309,40 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
   const sshKeyPostures = process.platform === "win32" ? [] : sshPrivateKeys.map(f => ({ file: f.rel, ...statPosture(f.full) }));
   signal_overrides["ssh-key-bad-perms"] = sshKeyPostures.some(p => p.error == null && p.mode !== 0o600) ? "hit" : "miss";
 
+  // Per-indicator file locations for every indicator flipped to "hit", so
+  // a SARIF result points at the file carrying the secret / bad posture.
+  // Content-regex hits record a byte offset rather than a line, so these
+  // are file-level locations (no startLine). The file-presence and
+  // posture indicators contribute the carrier file path directly.
+  const evidence_locations = {};
+  for (const p of INDICATOR_PATTERNS) {
+    if (signal_overrides[p.id] === "hit") {
+      const locs = buildEvidenceLocations(prodHitsByIndicator[p.id] || []);
+      if (locs.length) evidence_locations[p.id] = locs;
+    }
+  }
+  // ssh-private-key-block also fires on private-key file presence — fold in
+  // the discovered key files alongside any content-scan hits, de-duplicated.
+  if (signal_overrides["ssh-private-key-block"] === "hit") {
+    const locs = buildEvidenceLocations([
+      ...(prodHitsByIndicator["ssh-private-key-block"] || []),
+      ...prodSshPrivateKeys,
+    ]);
+    if (locs.length) evidence_locations["ssh-private-key-block"] = locs;
+  }
+  if (signal_overrides["world-writable-env-file"] === "hit") {
+    const locs = buildEvidenceLocations(
+      envFilePostures.filter(p => p.error == null && (p.mode & 0o022) !== 0),
+    );
+    if (locs.length) evidence_locations["world-writable-env-file"] = locs;
+  }
+  if (signal_overrides["ssh-key-bad-perms"] === "hit") {
+    const locs = buildEvidenceLocations(
+      sshKeyPostures.filter(p => p.error == null && p.mode !== 0o600),
+    );
+    if (locs.length) evidence_locations["ssh-key-bad-perms"] = locs;
+  }
+
   const summarizeFiles = (list) => list.map(f => f.rel).join(", ");
   const artifacts = {
     "repo-tree": {
@@ -355,6 +389,7 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
     },
     artifacts,
     signal_overrides,
+    ...(Object.keys(evidence_locations).length ? { evidence_locations } : {}),
     collector_meta: {
       collector_id: COLLECTOR_ID,
       collector_version: "2026-05-20",

package/lib/playbook-runner.js

@@ -621,6 +621,14 @@ function detect(playbookId, directiveId, agentSubmission = {}, runOpts = {}) {
   // on the per-indicator result. See AGENTS.md Hard Rule #6 (compliance
   // theater) and AGENTS.md §"detect (AI)" — a `hit` without its FP checks
   // is not yet a `detected` classification.
+  // Optional per-indicator evidence locations the submission supplies
+  // (`evidence_locations: { "<indicator-id>": ["path", {uri,startLine}] }`).
+  // Threaded onto each firing indicator so the SARIF renderer can populate
+  // results[].locations — without this, secret/file findings ship
+  // location-less and GitHub code-scanning drops them.
+  const _evLocs = (agentSubmission && typeof agentSubmission.evidence_locations === 'object'
+    && agentSubmission.evidence_locations !== null && !Array.isArray(agentSubmission.evidence_locations))
+    ? agentSubmission.evidence_locations : {};
   const indicatorResults = (det.indicators || []).map(ind => {
     const rawOverride = overrides[ind.id];
     const override = canonicalize(rawOverride);
@@ -695,10 +703,12 @@ function detect(playbookId, directiveId, agentSubmission = {}, runOpts = {}) {
       const anyCaptured = Object.values(artifacts).some(a => a && a.captured);
       verdict = anyCaptured ? 'inconclusive' : 'miss';
     }
+    const indLocs = (verdict === 'hit' && Array.isArray(_evLocs[ind.id]) && _evLocs[ind.id].length) ? _evLocs[ind.id] : null;
     return {
       id: ind.id, type: ind.type, confidence: ind.confidence,
       deterministic: ind.deterministic, atlas_ref: ind.atlas_ref || null,
       attack_ref: ind.attack_ref || null, verdict,
+      ...(indLocs ? { evidence_locations: indLocs } : {}),
       ...(fpChecksUnsatisfied ? { fp_checks_unsatisfied: fpChecksUnsatisfied } : {})
     };
   });
@@ -1999,7 +2009,26 @@ function looksLikePath(src) {
   return false;
 }
 function sarifLocationsForIndicator(playbook, indicator) {
-  void indicator;
+  // Prefer per-indicator evidence locations the submission supplied (threaded
+  // onto the firing indicator by detect()). Each entry is a path string or
+  // { uri, startLine?, endLine? }. This is what gives SARIF results a real
+  // file location instead of the coarse playbook-source fallback below.
+  const ev = indicator && Array.isArray(indicator.evidence_locations) ? indicator.evidence_locations : null;
+  if (ev && ev.length) {
+    const locs = [];
+    for (const e of ev) {
+      if (typeof e === "string" && e.trim()) {
+        locs.push({ physicalLocation: { artifactLocation: { uri: e.trim() } } });
+      } else if (e && typeof e === "object" && typeof e.uri === "string" && e.uri.trim()) {
+        const pl = { artifactLocation: { uri: e.uri.trim() } };
+        if (Number.isInteger(e.startLine) && e.startLine > 0) {
+          pl.region = { startLine: e.startLine, ...(Number.isInteger(e.endLine) && e.endLine >= e.startLine ? { endLine: e.endLine } : {}) };
+        }
+        locs.push({ physicalLocation: pl });
+      }
+    }
+    if (locs.length) return locs;
+  }
   const arts = (playbook.phases?.look?.artifacts) || [];
   const candidates = arts
     .map(a => a && (a.source || a.air_gap_alternative))
@@ -2863,6 +2892,10 @@ function normalizeSubmission(submission, playbook) {
     signal_overrides: { ...(submission.signal_overrides || {}) },
     signals: { ...(submission.signals || {}) },
     precondition_checks: { ...(submission.precondition_checks || {}) },
+    // Carry per-indicator evidence locations through flat normalization so
+    // detect() can thread them onto firing indicators for SARIF results[].locations.
+    ...(submission.evidence_locations && typeof submission.evidence_locations === 'object'
+      ? { evidence_locations: submission.evidence_locations } : {}),
     _original_shape: 'flat (v0.11.0)',
     // normalizeSubmission pushes structured errors (e.g.
     // signal_overrides_invalid) onto submission._runErrors above. For flat

package/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "exceptd-security",
-  "version": "0.14.6",
+  "version": "0.14.8",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation",
   "homepage": "https://exceptd.com",
   "license": "Apache-2.0",
@@ -53,7 +53,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "lXhZgoIrrVloO3XaTvo/43AxZn4mwErstd7DR0O/oVhD3AOGODM4HqrageYEou9WKOdMEGP5mJNTjJsXdP5NDA==",
-      "signed_at": "2026-05-27T16:39:56.409Z",
+      "signed_at": "2026-05-27T18:02:02.071Z",
       "cwe_refs": [
         "CWE-125",
         "CWE-362",
@@ -123,7 +123,7 @@
       ],
       "last_threat_review": "2026-05-17",
       "signature": "ztSKk/zFMFbT12qRcEeBKpydBn7fTT86KxMmor0DTCoKQWk5fJ0fSInfP1XMSB6rFk4/SuSjKVxQRMKVJ5a+Cg==",
-      "signed_at": "2026-05-27T16:39:56.411Z",
+      "signed_at": "2026-05-27T18:02:02.073Z",
       "cwe_refs": [
         "CWE-1039",
         "CWE-1426",
@@ -196,7 +196,7 @@
       ],
       "last_threat_review": "2026-05-17",
       "signature": "K6QdPHNK5c4K5QFjrW0QsUhjp71D7SOisSoulwPNSvKRdi2rY+yg0kdckijBMkLMsVPyUvcC9giu93mKJ1OZDg==",
-      "signed_at": "2026-05-27T16:39:56.412Z",
+      "signed_at": "2026-05-27T18:02:02.073Z",
       "cwe_refs": [
         "CWE-22",
         "CWE-345",
@@ -248,7 +248,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-22",
       "signature": "Qd3SBWmUAaaT++e1Ry2wBIz/dCBmNBMl0+4Rb0etvJLES0fIBEAkU1mTbgNZnT5XOg9J5twdUpymWtmKnDDQCQ==",
-      "signed_at": "2026-05-27T16:39:56.412Z"
+      "signed_at": "2026-05-27T18:02:02.074Z"
     },
     {
       "name": "compliance-theater",
@@ -279,7 +279,7 @@
       ],
       "last_threat_review": "2026-05-22",
       "signature": "F2Shxae0ua0gPtvwzTRVzzHaIgJcFDRT3/akLUAZ4aaMQhkleKkcTaTpkjp+pTVEdPfLeLGNCeAOMs+whVYOBg==",
-      "signed_at": "2026-05-27T16:39:56.413Z"
+      "signed_at": "2026-05-27T18:02:02.075Z"
     },
     {
       "name": "exploit-scoring",
@@ -308,7 +308,7 @@
       ],
       "last_threat_review": "2026-05-18",
       "signature": "NA1hoQycvQhSUoG5rwlXX0mOVmGxoXRVezkELGEA2nZOdGis4gXkHT3O6Sfw7zxE4JuMrsCb65TEeOWk9WEPDg==",
-      "signed_at": "2026-05-27T16:39:56.413Z"
+      "signed_at": "2026-05-27T18:02:02.075Z"
     },
     {
       "name": "rag-pipeline-security",
@@ -345,7 +345,7 @@
       ],
       "last_threat_review": "2026-05-22",
       "signature": "W3pS8lnaCP96TQzsJpG5d5yv5IwgaQyS4Z2Ctcz5BOJf6LbajSIgeDgTZ4f4Bhr5m4E7KsgWGjZS4x7Fwd33BQ==",
-      "signed_at": "2026-05-27T16:39:56.413Z",
+      "signed_at": "2026-05-27T18:02:02.075Z",
       "cwe_refs": [
         "CWE-1395",
         "CWE-1426"
@@ -405,7 +405,7 @@
       ],
       "last_threat_review": "2026-05-17",
       "signature": "/WDGygh1Ck4yWlBWDGtEUVCqKB8d+UaJXoAoBXujtt+GAl8JbMNpaN1TvI0WkEltQ9dTxaAzSn20/eVDqv8iDQ==",
-      "signed_at": "2026-05-27T16:39:56.414Z",
+      "signed_at": "2026-05-27T18:02:02.076Z",
       "d3fend_refs": [
         "D3-CA",
         "D3-CSPP",
@@ -440,7 +440,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-22",
       "signature": "za1NKBpy9LC91F/ESO/qhUfmvVr8GNItQOjR5OJLeHm+2dQ9HHiFWQK2eo53V/n/0uhubuggURA3yS6kJuWwBg==",
-      "signed_at": "2026-05-27T16:39:56.414Z",
+      "signed_at": "2026-05-27T18:02:02.076Z",
       "cwe_refs": [
         "CWE-1188"
       ],
@@ -474,7 +474,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-18",
       "signature": "xiHAhhdufm9hCKU8PLiPE0MX65ej2F4OZwtlWLGLCiie9/km+Kiqbt192LcMvr94v83C98pb9wIaqFsFWft6AQ==",
-      "signed_at": "2026-05-27T16:39:56.414Z",
+      "signed_at": "2026-05-27T18:02:02.076Z",
       "forward_watch": [
         "New AI attack classes as ATLAS v6 publishes",
         "Post-quantum adversary capability timeline",
@@ -513,7 +513,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "oYsSk35N2Uzq7MRofACykylcVwkgPhI4luWZ14vmQT+gUKLyZiKVOUJbe1+7lGl6BYPRN0sUDQ0f7S5Eu5w2Ag==",
-      "signed_at": "2026-05-27T16:39:56.415Z"
+      "signed_at": "2026-05-27T18:02:02.077Z"
     },
     {
       "name": "zeroday-gap-learn",
@@ -540,7 +540,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-18",
       "signature": "igRqYyU1unRFH40BsPyAR62SPrk8QZv8dPGb8S9O9EvLCNOZAzm3t+HdT/NKqzWHwrpomOzkkkyLfYI/0qTUDA==",
-      "signed_at": "2026-05-27T16:39:56.415Z",
+      "signed_at": "2026-05-27T18:02:02.077Z",
       "forward_watch": [
         "New CISA KEV entries",
         "New ATLAS TTP additions in each ATLAS release",
@@ -604,7 +604,7 @@
       ],
       "last_threat_review": "2026-05-22",
       "signature": "i/17u4kJiSpcZAz7LnTyRePFugQOstQ1P4kVoe0oGf4E2/j8oIN9U9DccjUn/YHZhKWIJ2AILG/DMhvMrr3bBg==",
-      "signed_at": "2026-05-27T16:39:56.415Z",
+      "signed_at": "2026-05-27T18:02:02.077Z",
       "cwe_refs": [
         "CWE-327"
       ],
@@ -652,7 +652,7 @@
       ],
       "last_threat_review": "2026-05-22",
       "signature": "QuOVaQ4E2Sl39TClbhZ7HA9XrYAyRrDL44HY3RTE7aWLue0hV2cxaBt40ALGmHS++631QGFDlZTLZI77Tr6nAA==",
-      "signed_at": "2026-05-27T16:39:56.416Z"
+      "signed_at": "2026-05-27T18:02:02.078Z"
     },
     {
       "name": "security-maturity-tiers",
@@ -689,7 +689,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "8Px1s2lDj10/Q6erwEQlXgUHM1+OTruUR8qAHPX7Oo3k/l69N6P9sm0PsafS9wDFtj9l5C/OiLiFgzMlMt6vBw==",
-      "signed_at": "2026-05-27T16:39:56.416Z",
+      "signed_at": "2026-05-27T18:02:02.078Z",
       "cwe_refs": [
         "CWE-1188"
       ]
@@ -724,7 +724,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-11",
       "signature": "urRcataVWg6/utyEkSiOWoNxTL8sABRjPR7ShyDfZGnAozFph/yDktSoaPVxQDXwu9EfJE+qhUW5OYR/yJECBQ==",
-      "signed_at": "2026-05-27T16:39:56.416Z"
+      "signed_at": "2026-05-27T18:02:02.078Z"
     },
     {
       "name": "attack-surface-pentest",
@@ -796,7 +796,7 @@
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — Microsoft Edge 4-bug sandbox escape by Orange Tsai (DEVCORE); forward-watch only (browser sandbox, out of current playbook scope); track Microsoft Edge security advisory and KEV add"
       ],
       "signature": "C7lv65/Ecm8JJgSKxrX5lxx0YFzKWtrIQSKp+vy50I5e8945s1JmifGUUrnQwRQhq/Pkv7EmfiH5XSO8h75bDg==",
-      "signed_at": "2026-05-27T16:39:56.417Z"
+      "signed_at": "2026-05-27T18:02:02.078Z"
     },
     {
       "name": "fuzz-testing-strategy",
@@ -856,7 +856,7 @@
         "OSS-Fuzz-Gen / AI-assisted harness generation becoming the default expectation for OSS maintainers"
       ],
       "signature": "Z7ypCUnXx8JpLtgxxB6RHNi39w74AmrGY1N4ofAGCXhkuM2EaFVm1AU0dvl9UQ1bVLfHKEDGqMO/TwlIY7RABg==",
-      "signed_at": "2026-05-27T16:39:56.417Z"
+      "signed_at": "2026-05-27T18:02:02.079Z"
     },
     {
       "name": "dlp-gap-analysis",
@@ -931,7 +931,7 @@
         "Quebec Law 25, India DPDPA, KSA PDPL enforcement actions naming AI-tool prompt data as in-scope personal information"
       ],
       "signature": "IgEnpHOhCftAyfUNdKsjbrd169T9pJkk/rRM2ZEna+H18y7p5x48+1kME2sJMZjJuyAdQFBJi8PJXZFwLGI+DQ==",
-      "signed_at": "2026-05-27T16:39:56.417Z"
+      "signed_at": "2026-05-27T18:02:02.079Z"
     },
     {
       "name": "supply-chain-integrity",
@@ -1010,7 +1010,7 @@
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Megatron Bridge path traversal by haehae; AI training-stack file-system trust boundary; track patch and SBOM-attestation impact"
       ],
       "signature": "pcLrM98A3vUSZRjwNAk0aZ9umvOwB41XCLLsCOy/IebB2F/06oIrGUKkMHtHwm4pTVPShMMcKdZQQ3jz30FnCg==",
-      "signed_at": "2026-05-27T16:39:56.418Z"
+      "signed_at": "2026-05-27T18:02:02.079Z"
     },
     {
       "name": "defensive-countermeasure-mapping",
@@ -1067,7 +1067,7 @@
       ],
       "last_threat_review": "2026-05-11",
       "signature": "G5q5elh7Q7eu2xcwTVQJGDTGfvZR0OGQaLSLJPb2wjzCHFF8PWuZfCHZdjjqisiRzRWPyLlzgfHeMJqOdy7cBw==",
-      "signed_at": "2026-05-27T16:39:56.418Z"
+      "signed_at": "2026-05-27T18:02:02.080Z"
     },
     {
       "name": "identity-assurance",
@@ -1134,7 +1134,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "Wv5hGMeHjlaQK1zwicVCA7AvdKgJBgvcjdpGM9Ywahh9tagAKhbkOjybowDQZzu7OZ3bDkbh6pBYc1Sdwr6NAA==",
-      "signed_at": "2026-05-27T16:39:56.418Z"
+      "signed_at": "2026-05-27T18:02:02.080Z"
     },
     {
       "name": "ot-ics-security",
@@ -1190,7 +1190,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "8t5qKHd3yWi57dvG36YQkLN/X9bQWqtEiYjay4IfSmqhJpM/xXPaQVKNGz3wscrO8OLKUZ0OaX7Mj5kzpgBKBQ==",
-      "signed_at": "2026-05-27T16:39:56.419Z"
+      "signed_at": "2026-05-27T18:02:02.080Z"
     },
     {
       "name": "coordinated-vuln-disclosure",
@@ -1242,7 +1242,7 @@
         "NYDFS 23 NYCRR 500 amendments potentially adding explicit CVD program requirements"
       ],
       "signature": "GDGt4UPqBa04PjlpSmpyihGzd3OgfBN7jaAK5tfwp+LRSs3ygKOdbeivUCCHNagTY1hE6hG2Ou40ADfBFuXeAg==",
-      "signed_at": "2026-05-27T16:39:56.419Z"
+      "signed_at": "2026-05-27T18:02:02.081Z"
     },
     {
       "name": "threat-modeling-methodology",
@@ -1292,7 +1292,7 @@
         "PASTA v2 updates incorporating AI/ML application threats"
       ],
       "signature": "rFBpOQEJUPpl+v88Lw/WqVJRhTl80vy0VbPAbzQj3Q0suJRRrJg368I9uKu5LXIBKFDvKxnGIcIzbGg9NUtaCA==",
-      "signed_at": "2026-05-27T16:39:56.419Z"
+      "signed_at": "2026-05-27T18:02:02.081Z"
     },
     {
       "name": "webapp-security",
@@ -1366,7 +1366,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "ux85YI4t2mVHOyt744Yin1HHy+z11JIFygjKfFfQOBBl5QVV3A267jeIy7utix85irMcpZm/T3yx/ooqiK2tBA==",
-      "signed_at": "2026-05-27T16:39:56.420Z",
+      "signed_at": "2026-05-27T18:02:02.081Z",
       "forward_watch": [
         "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; AI-assisted discovery angle; track for active-exploitation confirmation and patch advisory affecting front-door web app deployments"
       ]
@@ -1419,7 +1419,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-15",
       "signature": "IIXnkZ5ZNqFwOto5KfytADTLLZLoyXNZACD1ORZ40P1HUAQxe6u2uyXFzzsfuob4Uy06jNkRGr2FFgCphUH1Cw==",
-      "signed_at": "2026-05-27T16:39:56.420Z"
+      "signed_at": "2026-05-27T18:02:02.082Z"
     },
     {
       "name": "sector-healthcare",
@@ -1479,7 +1479,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "AhF9KF8ZBlDteciV+F8IBSmFVYCvQOn44GmD4rZjgLoPxfIv/QE1/vSkK32zyqDKtHWkLSXExbkkPkxA/V6dDw==",
-      "signed_at": "2026-05-27T16:39:56.421Z"
+      "signed_at": "2026-05-27T18:02:02.082Z"
     },
     {
       "name": "sector-financial",
@@ -1560,7 +1560,7 @@
         "TIBER-EU framework v2.0 alignment with DORA TLPT RTS (JC 2024/40); cross-recognition with CBEST and iCAST"
       ],
       "signature": "HQgZvb4ReziEz5rNFr8i/O8/rJEZR+iHRROT7m/D2QUqhrcNISPkYXENsUZlG8xapzy/Ik92ehkseyj4hdmhCQ==",
-      "signed_at": "2026-05-27T16:39:56.421Z"
+      "signed_at": "2026-05-27T18:02:02.083Z"
     },
     {
       "name": "sector-federal-government",
@@ -1629,7 +1629,7 @@
         "Australia PSPF 2024 revision and ISM quarterly updates — track for Essential Eight Maturity Level requirements for federal entities"
       ],
       "signature": "linxmsXZiOYtcs71sSWgGCrvb8xQfmxmtTY5PRvZJ0/8FgJulo0tQtejzexYG775s7XhjAmGsDP238BQTQ8ADA==",
-      "signed_at": "2026-05-27T16:39:56.422Z"
+      "signed_at": "2026-05-27T18:02:02.083Z"
     },
     {
       "name": "sector-energy",
@@ -1694,7 +1694,7 @@
         "ICS-CERT advisory feed (https://www.cisa.gov/news-events/cybersecurity-advisories/ics-advisories) for vendor CVEs in Siemens, Rockwell, Schneider Electric, ABB, GE Vernova, Hitachi Energy, AVEVA / OSIsoft PI"
       ],
       "signature": "JjBfc0ovta560Clk0x3QGRM5osFJDwcvpy3rT7QEGdCIL827jzE8QCow1C8deXq+4JhY2sA/d7/8IsxikdlkCg==",
-      "signed_at": "2026-05-27T16:39:56.422Z"
+      "signed_at": "2026-05-27T18:02:02.083Z"
     },
     {
       "name": "sector-telecom",
@@ -1780,7 +1780,7 @@
         "O-RAN SFG / WG11 security specifications"
       ],
       "signature": "JWVxKFoKrbX4d+Tko1d4OBdwyg25MfFFKn4CT6E/CzH+YwnU3T6Y76uBQIKg3+gIGTvPduqyvQwQQ5FxKDuPBw==",
-      "signed_at": "2026-05-27T16:39:56.423Z"
+      "signed_at": "2026-05-27T18:02:02.084Z"
     },
     {
       "name": "api-security",
@@ -1849,7 +1849,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-18",
       "signature": "BmCRCestWqr55+fCynEhtAl5NWLT+xLTkpwS0Icp3SaoZOw/ce3Y6TtqjHRSKn4CBJq7YDiLRWxmhO3MStvOAA==",
-      "signed_at": "2026-05-27T16:39:56.423Z",
+      "signed_at": "2026-05-27T18:02:02.084Z",
       "forward_watch": [
         "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; track for active-exploitation confirmation and patch advisory affecting API gateway / reverse-proxy deployments",
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — LiteLLM 3-bug SSRF + Code Injection chain by k3vg3n; LLM-proxy API surface; track upstream patch and CVE assignments",
@@ -1935,7 +1935,7 @@
         "CISA KEV additions for cloud-control-plane CVEs (IMDSv1 abuses, federation token mishandling, cross-tenant boundary failures); CISA Cybersecurity Advisories for cross-cloud advisories"
       ],
       "signature": "/DV3pmZwrRySrk1OCbyI+0BQESacjupJfUX3eC2NGtXuYOBro0vndIP+z27heFxumnjU3a9sfla7/U9X+pqnDw==",
-      "signed_at": "2026-05-27T16:39:56.423Z"
+      "signed_at": "2026-05-27T18:02:02.084Z"
     },
     {
       "name": "container-runtime-security",
@@ -1997,7 +1997,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-15",
       "signature": "E2UGSf9ATyYgzBr8uM/0ubOUmDqo1jVA7f9mVxv6LHfWGCNuQNXDyuNou9VAmUCeeXEeUYIi3AFjXkJqpOkxDA==",
-      "signed_at": "2026-05-27T16:39:56.424Z",
+      "signed_at": "2026-05-27T18:02:02.085Z",
       "forward_watch": [
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Container Toolkit container escape ($50K award) by chompie / IBM X-Force XOR; high-severity container/hypervisor boundary break; track patch and KEV add post-embargo"
       ]
@@ -2071,7 +2071,7 @@
         "MITRE ATLAS v5.6.0 (released May 2026) shipped the AML.T0010 sub-technique expansion this forecast tracked plus new techniques (\"Publish Poisoned AI Agent Tool\", \"Escape to Host\"); inventory now 16 tactics, 84 techniques, 56 sub-techniques. Forward watch: subsequent ATLAS minor and major releases — track next-cadence updates to agentic-AI TTPs and MLOps-pipeline-specific techniques"
       ],
       "signature": "IL+DlRCDJN/p08iiJCFkasKcoyjcB0uWrJ6ORLjQcS1HrUa5Xt62QxVjYPHzaevlm5y36ZdmfESqsZJmzK3lCg==",
-      "signed_at": "2026-05-27T16:39:56.424Z"
+      "signed_at": "2026-05-27T18:02:02.085Z"
     },
     {
       "name": "incident-response-playbook",
@@ -2133,7 +2133,7 @@
         "NYDFS 23 NYCRR 500.17 amendments tightening ransom-payment 24h disclosure operationalization"
       ],
       "signature": "MmjLjlmOMLjhJJ4ZfR8MYlHam+ZB+eSqfh6Nv+DecaG4O5zeo9DBP/iL3cbyDVZxmhnhivgJild2ccYeWTeZAg==",
-      "signed_at": "2026-05-27T16:39:56.425Z"
+      "signed_at": "2026-05-27T18:02:02.086Z"
     },
     {
       "name": "ransomware-response",
@@ -2213,7 +2213,7 @@
       ],
       "last_threat_review": "2026-05-22",
       "signature": "ssueL03g9fWlhXpTe+IiY5l7RqQkunN4DTN5QETKE+VOX+qggdjAR8PONxk77ol4xWYmHrM/VcH8CNtXUEvgBA==",
-      "signed_at": "2026-05-27T16:39:56.425Z"
+      "signed_at": "2026-05-27T18:02:02.086Z"
     },
     {
       "name": "email-security-anti-phishing",
@@ -2266,7 +2266,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-18",
       "signature": "rK+WnuS+9tqEABmwc0jO/PEmxcLjG1/tmUb897HsClQeKzf+TQOlwBE+OsbtuKxpjYNwur62Xxs3TxObkwm8Cw==",
-      "signed_at": "2026-05-27T16:39:56.425Z"
+      "signed_at": "2026-05-27T18:02:02.086Z"
     },
     {
       "name": "age-gates-child-safety",
@@ -2334,7 +2334,7 @@
         "US state adult-site age-verification laws — 19+ states by mid-2026 (TX HB 18 upheld by SCOTUS June 2025 in Free Speech Coalition v. Paxton); track ongoing challenges in remaining states"
       ],
       "signature": "Rgho5TOFUL1txOzcVR0kASCNdovSU4yt99JlGilJlJRyg0A+BdeeQYrZrhPF6Vx2reUAVG0BeHfcZtSbi+cwCg==",
-      "signed_at": "2026-05-27T16:39:56.426Z"
+      "signed_at": "2026-05-27T18:02:02.087Z"
     },
     {
       "name": "cloud-iam-incident",
@@ -2414,7 +2414,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "e/kij7GtKaytROyIj7V5RH+FC9WtmVFzrmG2kIlNDNn29ep/CRNlIQKwXLpzo/81AIf634pmdr1qy/+vwIuUDA==",
-      "signed_at": "2026-05-27T16:39:56.426Z",
+      "signed_at": "2026-05-27T18:02:02.087Z",
       "forward_watch": [
         "AWS IAM Identity Center session-policy refresh and step-up-on-admin enforcement (anticipated 2026-H2 release)",
         "GCP Workload Identity Federation principal-set attribute mapping tightening (post-2026 Q3 Federation hardening guide)",
@@ -2508,7 +2508,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "ew9Kglc9fAZzbn0ZIfGP7WSK/j4eV2VhSvpy+s5bEfNEVYIMa2kZjnGBapgUsyGDLes9H9K2ovjQyX17+GKiBw==",
-      "signed_at": "2026-05-27T16:39:56.426Z",
+      "signed_at": "2026-05-27T18:02:02.087Z",
       "forward_watch": [
         "Entra ID conditional access evolution post-Midnight Blizzard — Microsoft's 2025-2026 commitments on legacy-tenant MFA enforcement and OAuth-app consent gating",
         "Okta IPSIE (Interoperability Profile for Secure Identity in the Enterprise) OpenID Foundation working-group output and adoption timeline",
@@ -2526,6 +2526,6 @@
   ],
   "manifest_signature": {
     "algorithm": "Ed25519",
-    "signature_base64": "jaU6t8/XQsZjuao9XKu1lo6+aI0Msx2yyhXYgFeIymx5Y0K9Q3B+8E+DMRhNnMK0OBzqWosSe78W8QC2rgW7Dw=="
+    "signature_base64": "xG4gZv1rcgWczi8BEOXyjd8fWOXBXkSdjEEHfoWTk3jVnPNWWy/Gu8rzzm+UWxAdtwaVJwUA9q34V/ObyQQPAg=="
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/exceptd-skills",
-  "version": "0.14.6",
+  "version": "0.14.8",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 42 skills, 11 catalogs (406 CVEs / 171 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
   "keywords": [
     "ai-security",

package/sbom.cdx.json

@@ -1,22 +1,22 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:uuid:b9a42c4d-10ae-4669-a7ec-f274d008a62e",
+  "serialNumber": "urn:uuid:efaa11c0-807e-4b1b-85fc-013ffe4a03be",
   "version": 1,
   "metadata": {
-    "timestamp": "2124-09-11T23:10:05.000Z",
+    "timestamp": "2153-06-02T04:44:48.000Z",
     "tools": [
       {
         "vendor": "blamejs",
         "name": "scripts/refresh-sbom.js",
-        "version": "0.14.6"
+        "version": "0.14.8"
       }
     ],
     "component": {
-      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.14.6",
+      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.14.8",
       "type": "application",
       "name": "@blamejs/exceptd-skills",
-      "version": "0.14.6",
+      "version": "0.14.8",
       "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 42 skills, 11 catalogs (406 CVEs / 171 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
       "licenses": [
         {
@@ -25,17 +25,17 @@
           }
         }
       ],
-      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.14.6",
+      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.14.8",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "ed809dcd4cd228d7bd1db21aa6c1e7a4925380209744dfe81d922daaa557aabe"
+          "content": "d5c212f9fdc1f7bfe668e5748d2600bfb4e83b95c51cc0e586c38260a55b794e"
         }
       ],
       "externalReferences": [
         {
           "type": "distribution",
-          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.14.6"
+          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.14.8"
         },
         {
           "type": "vcs",
@@ -116,11 +116,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "0b854c0687bd09f915c5d269b14c66b2f719af12c3fd9cbab6415c40897dc774"
+          "content": "c60bcbfd8ab7e452f8499fb77db281741a5bf37114dd4dc40796b6ac6978ccc1"
         },
         {
           "alg": "SHA3-512",
-          "content": "2db81638d88224207f8e746adffad6e4601b372aea657d83c316d8edcd8a1c19eeb331cd0c6b94d18800e9f3082328a9131dcd4e8f4b724c84447bc4d1c9d09d"
+          "content": "8db34a7f0e35925866912d486983afae5c01a0302ac1764fc1d777341cf33ed70157475aab9f2e5e394dd99b9f07abe5169ec482ceef4e77fa602b071d9075b6"
         }
       ]
     },
@@ -281,11 +281,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "ff890e1cd9f9b9cee3fecd9e486e5a9f033f672dc062a0965f9346cd794879c5"
+          "content": "86fafb59d29675231590513d2058e29728a8afd8e687022e657bd03cb023a44e"
         },
         {
           "alg": "SHA3-512",
-          "content": "de90a00ec90a66111f410fa2fc73d214346c1d79a33c9c1095d515c00a8e5ddd6a0bb90464068b9014c1975d209820d3b8dcf8b306eb151780554a5a841a7f04"
+          "content": "a22d43d83ac7cfbb66e68e4739efea6819e145b80d856571d8e444358e3d7507a9097d4cb8f20800295b5da3a799cde05dba6c1b5f3c3ca1ac873ef492d6038b"
         }
       ]
     },
@@ -926,11 +926,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "863401bc0695c24ff874651a7c1accf4f64bcce041cb38beccc4f0264d2ca2dc"
+          "content": "d406014a161ca337c2914be650190d8539a5c9e159c6ed8b79cd276c64cafd14"
         },
         {
           "alg": "SHA3-512",
-          "content": "2b522780fb1a08f9cd3485ce2d0b7f1789ee82fbb24ebab96eea3485b17815213bbbaba26d84a24bc522b813069288f27212b575205ebe423e9e5c3c31844643"
+          "content": "24c1d46c3426d695f15320bb75a2a0da84f571bd898a767f3effc1819b06ad9d06a2f638e2bd838f9aabcb1aa676e1809462272736515e4c817e2793c293a546"
         }
       ]
     },
@@ -941,11 +941,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "b31872b10eb815a53d7753f294dc8409de58b847c296ca2d91c5be4548a3e696"
+          "content": "302103324d99f623036027fc589da04c2c9f23c1c45d3e00c6f47df38a1ae236"
         },
         {
           "alg": "SHA3-512",
-          "content": "46aa9be2df845e10938e5f76a120d42541e3726d92b682504a70dde1d7f6c046606e33ff44bde3ca708d30065d85484d5ab3baa32e93340e6d3f8ac7ac878a1f"
+          "content": "e6ebd328eb2bb79263e8ccdcefb4ed3345c269f41296d1ec0844c649e2fe8817054c72bdf3647e4a212c5321bf1248f3feac5ee9741edefa5dfdf1f532b6e365"
         }
       ]
     },
@@ -956,11 +956,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "262c2f130934dc1b6ebc913022c22416e5831d5a5d6edc561b76c238effce55a"
+          "content": "73fca55e2330e73529d06eb8944114d2f18b483294d373719356dce0556a831d"
         },
         {
           "alg": "SHA3-512",
-          "content": "cf58367fe3110bce44331acd279984e58a8eab417bd97afe12a48b68064234b3786a843294de17a90ae5c3f81bb60d9663b002bc84d03372e133a243c2fcdd7a"
+          "content": "d1deb64457f7be99a4dd5fcc504cffdc6b4ddec26d778946af93c5ea60ee399f9c6bb82de1a4cb0165e7708914a7a56e1b61f4f443e6c83b62ece23ceff2d11b"
         }
       ]
     },
@@ -986,11 +986,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "0a787c60af275a8333087569725a61fdefc0baf2b76076689c2f0a84751b0f95"
+          "content": "536c55f5043145bac0221ee954052d5afd9e89cdb7984fa2357a6bdb46a2dd59"
         },
         {
           "alg": "SHA3-512",
-          "content": "98b61cb38b79aaa556c6b34243fbdd798f1307ecebab09ffdee647f92a7ad388d8110f47ba1e3bff0a01e833c306fb3b9ed243c945e4eb4d448a314bff042571"
+          "content": "ae704ef06e34bcc36c0c72a7fe54ac6ae53b2d2964ea27edac285bbf5eae07a90b795acb5a600d2b829cf7f384532b8addcad1a127741d63ab0557fdff72aa07"
         }
       ]
     },
@@ -1046,11 +1046,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "6a40b3d23b3e524064e8fa4499f1a81e28238d08e3c2f91e6c2127ce6809f21a"
+          "content": "f8a32293e9a8707e05846bbc0c07336d9f5f31a3551ec9df9c146386005cba7c"
         },
         {
           "alg": "SHA3-512",
-          "content": "b097b4de51845a2f1d88ea8d4d891568f9a76e9b9bdd4d280e962ec84af57c5136a47804d0cd005e4e8fbdd50513d0666409463b5958a03da4520f20f750cfa9"
+          "content": "b4859aec9f78d53ce82a871eba0069714a6cee8c2b1ce043dc3389fad6ee3e17127c8f5e3e5ae901737410be5491df016412cd1b00954278a768a446252b5b1e"
         }
       ]
     },
@@ -1091,11 +1091,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "f18c26869948b9b8a4412bf1aab962da0e72f22e528935c6b6365ef735529085"
+          "content": "465fdfd904c1fd5c63b2178d79f7fd47988d023f10178065e2726b742aa657df"
         },
         {
           "alg": "SHA3-512",
-          "content": "3273de072023f27010489b0e9b9af13c241a724e477765d3f27ad25ddac97816984f08b03f92265ab72c5d258a2f2998f05221f5275b263b5c774f28695e70ec"
+          "content": "f4fc95ed4cf22f078e21ca1bf767c8f53ebb096702046902edf4d4c5ea484bb7d4184cb7ab3fee1ecc5c4bfaec3564c87d3ffd8b9d798a12bf72616c32e3a942"
         }
       ]
     },
@@ -1106,11 +1106,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "329a31ed657b2fc57b51a5e66e5bed05ada149b48e1c469ae02ed2242794efa9"
+          "content": "66b9b2769bcbe2a5ce10c45d3ab1d673ef6aeec2b69d708bd82001bc3833a44a"
         },
         {
           "alg": "SHA3-512",
-          "content": "c5024081f23b7d72c8b5287e2392f840b525bcba855d6a555ab9ed562fb84668eaacc801ae0b420b49439ad83f48dd1f653bcbb1f9aa6cf898c99ecc560a61ff"
+          "content": "1682ce067416147cfc772ca1217e440e02bf90440273f0aba2c2d069913af9bb282a570f9530f3163af3e85d3a2c37f502c98ca6564b28c6fa719d7612d483c8"
         }
       ]
     },
@@ -1121,11 +1121,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "40541ea833836853ab38775d6c840680c36da15a374508acd5710dc7f04a4181"
+          "content": "b507b1a6bcb1a0d4511c72921bdb0406f37a9a602d1d0614d270aad8cbe41691"
         },
         {
           "alg": "SHA3-512",
-          "content": "d63e298bd5c38e5c5a6b55770611df01d1a12ad46863875b2625a5b5dba29fd0d25e492c606d3a6e1bab3b56554555b44d2ef00714fcdded4ed495fb07fab8c4"
+          "content": "bd26426ef94c0eecd346ebea1e2bb78aae0ffa01a54831b61034656b68f3896c2ae89406deee0faf16bc86088ba284e1b6944c1aab5906050dc0657c8d684728"
         }
       ]
     },
@@ -1316,11 +1316,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "7d129a3edcb6ee6ff77622fb7ab2a9b9dd45a218d7a74d209edc72375c1d4cba"
+          "content": "47ee765793b2495783076b55d9fbd5af3afb1599ecd326bae41156adaa27dd8f"
         },
         {
           "alg": "SHA3-512",
-          "content": "4411999d653bceaa72d15b1f9bfa267949a233e09161a003af49da39c8aaca533143428f6ea5d7fade114a744c28c804b1c7c2c5e58b993fa921ea1ae9ab3a48"
+          "content": "7ae97081829103b6d38bdffd76fc54fb3cabadc16cdbcc45f799793858185da5524f44b8b8826806f52245f587c48f23679311472a30e368c75c414853fc1353"
         }
       ]
     },
@@ -1751,11 +1751,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "971fd9c7d8cdf08f06cb136826664adee342f52c0260e5b4e228d055c19addae"
+          "content": "4e43fc695c4246f2ccdb47cf1807b7a40c961032926dbf3dd3d83bce9af9d7cd"
         },
         {
           "alg": "SHA3-512",
-          "content": "84cb08646737cce3ecae2cfc4541f2573ecee19fd54531fba1fe57fe72e4b17a961f73f8d40b4f13b4aa0b5c19a4685f90fa5c8da9bbd236cdd430d4f4761c6f"
+          "content": "83051f3b146fc2ac6b2253761bd62cae2c6959b042a85cc4b416ad2118c251373453efa22f6c676408a6a412a95826162ed336e47e1d21f6527fe5dea25f60da"
         }
       ]
     },