@blamejs/exceptd-skills 0.14.8 → 0.14.10

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 0.14.10 — 2026-05-27
+
+`ci <playbook> --evidence -` no longer reports a false PASS when handed a flat submission. `run` accepts a flat submission (`{ "signal_overrides": {...} }`) and so do operators by habit; `ci` keyed the input by playbook id, found nothing under that key, and evaluated an empty submission — a detected finding came back PASS. A single-positional `ci` invocation now treats a flat (non-bundle-shaped) submission as belonging to that playbook, so `ci` and `run` agree. A real bundle keyed by playbook id is still routed per-key.
+
+`ai-run <playbook> --no-stream --evidence -` now rejects a non-object submission (`null`, an array, a scalar) at the read boundary, matching `run`. Previously the no-stream path skipped the shape guard and ran a malformed submission as if it were empty, so an operator believed a bad payload had been evaluated.
+
+The `ci` framework-gap rollup now carries the gap explanation. Each rollup entry's `why_insufficient` was always null because the rollup read a field that doesn't exist on a gap record; the text lives in `actual_gap`, which is now surfaced (alongside `required_control`).
+
+A regulatory clock now starts on an engine-confirmed detection, not only on an agent-submitted classification. When indicators fire and the engine itself classifies the detect phase as `detected`, `--ack` starts the notification clock and computes the jurisdiction deadlines — previously the clock only moved if the submission also carried `detection_classification: "detected"`, so an engine-confirmed finding left every deadline stalled at `pending_clock_start_event`.
+
+`framework-gap <framework> <scenario>` refuses an unknown framework instead of returning a zero-gap report that reads as "no gaps found." A typo or an untracked framework now errors with the list of frameworks the catalog covers; the documented short forms (`NIST-800-53`, `PCI-DSS-4.0`) and `all` continue to resolve.
+
+## 0.14.9 — 2026-05-27
+
+`refresh --advisory <id> --air-gap` now refuses (no network) instead of egressing. The `--air-gap` flag was parsed but dropped before the fetch, so an air-gapped advisory seed silently reached GHSA/OSV — an air-gap-guarantee violation. Both the flag and the `EXCEPTD_AIR_GAP=1` env now refuse identically.
+
+`--tlp` is wired through. It stamps the emitted bundle's CSAF `document.distribution` marking (TLP 2.0), validates the label against `CLEAR | GREEN | AMBER | AMBER+STRICT | RED`, and is refused on info-only verbs — previously it was accepted but never applied (a silent no-op).
+
+`refresh --advisory ""` errors instead of silently running a full refresh, and `refresh --help` now documents refresh's own exit-code scheme — notably that its exit 3 means "draft produced, review pending" (distinct from `exceptd run`'s exit 3, "ran but no evidence"), so scripts should branch on the `ok` field rather than `$?`.
+
 ## 0.14.8 — 2026-05-27
 
 SARIF output now carries file locations. A run's `results[].locations` are populated from per-indicator evidence locations, so a secret or file finding points at the file — and the line, when known — that triggered it instead of shipping location-less, which GitHub code scanning and most SARIF viewers drop or attribute to the repository root. A submission may supply locations directly (`evidence_locations: { "<indicator-id>": ["path", { "uri": "path", "startLine": N }] }`), and the code-scope collectors emit them from their hit data, so `exceptd collect <pb> | exceptd run <pb> --format sarif` produces located findings.

package/bin/exceptd.js

@@ -1603,6 +1603,31 @@ function dispatchPlaybook(cmd, argv) {
     runOpts.csafStatus = cs;
   }
 
+  // --tlp stamps the bundle's distribution marking (CSAF document.distribution
+  // TLP). Previously this flag was allowlisted but never wired into runOpts, so
+  // it was a silent no-op; the runner already emits distribution from
+  // runOpts.tlp. Validate against TLP 2.0 labels and refuse on info-only verbs,
+  // matching --csaf-status.
+  if (args.tlp !== undefined) {
+    if (!BUNDLE_FLAG_RELEVANT_VERBS.has(cmd)) {
+      return emitError(
+        `${cmd}: --tlp is irrelevant on this verb (no bundle is assembled). --tlp only applies to verbs that drive phases 5-7: ${[...BUNDLE_FLAG_RELEVANT_VERBS].sort().join(", ")}.`,
+        { verb: cmd, flag: "tlp", error_class: "irrelevant-flag", accepted_verbs: [...BUNDLE_FLAG_RELEVANT_VERBS].sort() },
+        pretty
+      );
+    }
+    const tlp = typeof args.tlp === "string" ? args.tlp.toUpperCase() : args.tlp;
+    const allowedTlp = ["CLEAR", "GREEN", "AMBER", "AMBER+STRICT", "RED"];
+    if (typeof tlp !== "string" || !allowedTlp.includes(tlp)) {
+      return emitError(
+        `${cmd}: --tlp must be one of ${JSON.stringify(allowedTlp)} (TLP 2.0). Got: ${JSON.stringify(String(args.tlp)).slice(0, 40)}`,
+        { verb: cmd, flag: "tlp", provided: args.tlp },
+        pretty
+      );
+    }
+    runOpts.tlp = tlp;
+  }
+
   // --bundle-deterministic + --bundle-epoch (v0.12.27): opt-in deterministic
   // bundle emit. When set, CSAF / OpenVEX / close-envelope timestamps freeze
   // to the supplied epoch (or the playbook's last_threat_review fallback),
@@ -7519,17 +7544,47 @@ function cmdAiRun(runner, args, runOpts, pretty) {
     // Read any pre-supplied evidence from stdin OR from --evidence flag.
     let payload = { observations: {}, verdict: {} };
     if (args.evidence) {
-      try { payload = readEvidence(args.evidence); }
+      // Apply the same shape guard `run` enforces at its read boundary: a
+      // submission must be a JSON object. Without this, `--no-stream` accepted
+      // `null` / `[]` / a scalar and ran as if empty, so an operator believed a
+      // malformed submission was evaluated (the streaming path is unaffected —
+      // it only fires on a well-formed evidence event).
+      try { payload = asEvidenceObject(readEvidence(args.evidence)); }
       catch (e) { return emitError(`ai-run: failed to read --evidence: ${e.message}`, null, pretty); }
     } else if (hasReadableStdin()) {
       // hasReadableStdin() probes via fstat before falling into
       // readFileSync(0). Wrapped-stdin test harnesses (isTTY===undefined,
       // size===0) would otherwise hang here.
       // Drain stdin for any evidence event.
-      try {
-        const buf = fs.readFileSync(0, "utf8");
-        if (buf.trim()) {
-          // Accept either a bare submission object or a single evidence event.
+      let buf = "";
+      try { buf = fs.readFileSync(0, "utf8"); }
+      catch { /* stdin empty / unreadable — fall through with empty payload */ }
+      if (buf.trim()) {
+        // First treat stdin as a single JSON document — the common
+        // `echo '<json>' | ai-run … --no-stream` shape. If it parses as one
+        // value we can apply the same shape guard `--evidence` gets: a bare
+        // `null` / `[]` / scalar is a malformed submission, not "no evidence",
+        // and must be rejected rather than silently run as empty.
+        let single;
+        let singleParsed = false;
+        try { single = JSON.parse(buf); singleParsed = true; } catch { /* not a single doc — fall to JSONL scan */ }
+        if (singleParsed) {
+          // An evidence event wrapper is the one object shape that is NOT
+          // itself the submission — unwrap it before guarding.
+          if (single && typeof single === "object" && !Array.isArray(single) && single.event === "evidence" && single.payload) {
+            payload = single.payload;
+          } else {
+            try { payload = asEvidenceObject(single); }
+            catch (e) { return emitError(`ai-run: failed to read evidence from stdin: ${e.message}`, null, pretty); }
+            // Normalize a bare submission into the {observations, verdict} shape.
+            if (!payload.observations && (payload.artifacts || payload.signal_overrides || payload.signals)) {
+              payload = { observations: { ...(payload.artifacts || {}), ...(payload.signal_overrides || {}) }, verdict: payload.signals || {} };
+            }
+          }
+        } else {
+          // JSONL / interleaved host-AI chatter: scan line-by-line for the
+          // first evidence event or bare submission, ignoring non-matching
+          // status frames the host may interleave.
           for (const line of buf.split(/\r?\n/)) {
             const t = line.trim();
             if (!t) continue;
@@ -7549,7 +7604,7 @@ function cmdAiRun(runner, args, runOpts, pretty) {
             } catch { /* skip non-JSON lines */ }
           }
         }
-      } catch { /* stdin empty / unreadable — fall through with empty payload */ }
+      }
     }
     const submission = buildSubmissionFromPayload(payload);
     let result;
@@ -8188,6 +8243,20 @@ function cmdCi(runner, args, runOpts, pretty) {
     }
   }
 
+  // Flat-submission tolerance for a single positional playbook. `ci` keys its
+  // bundle by playbook id (so --evidence-dir / multi-playbook bundles work),
+  // but `ci <pb> --evidence -` with the SAME flat/nested submission shape that
+  // `run` accepts would otherwise land as bundle[<pb>]=undefined → empty run →
+  // a false PASS that silently ignores the operator's evidence. When exactly
+  // one playbook is in scope and the bundle carries no playbook-id key (it's a
+  // single submission, not a multi-playbook bundle), treat it as that
+  // playbook's evidence.
+  if (ids.length === 1 && Object.keys(bundle).length > 0 && !(ids[0] in bundle)) {
+    const allIds = new Set(runner.listPlaybooks());
+    const looksLikeBundle = Object.keys(bundle).some(k => allIds.has(k));
+    if (!looksLikeBundle) bundle = { [ids[0]]: bundle };
+  }
+
   const results = [];
   let fail = false;
   let failReasons = [];
@@ -8315,7 +8384,10 @@ function cmdCi(runner, args, runOpts, pretty) {
         gapRollupMap.set(key, {
           framework: g.framework || null,
           claimed_control: g.claimed_control || null,
-          why_insufficient: g.why_insufficient || null,
+          // The explanatory text lives in `actual_gap`; the rollup previously
+          // read a nonexistent `why_insufficient` key and so was always null.
+          why_insufficient: g.actual_gap || g.why_insufficient || null,
+          required_control: g.required_control || null,
           playbooks: [r.playbook_id],
         });
       }

package/data/_indexes/_meta.json

@@ -1,10 +1,10 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-05-27T18:03:07.442Z",
+  "generated_at": "2026-05-27T19:33:19.529Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 54,
   "source_hashes": {
-    "manifest.json": "4e43fc695c4246f2ccdb47cf1807b7a40c961032926dbf3dd3d83bce9af9d7cd",
+    "manifest.json": "4d13f4f27b890997b5da18055a4bb0eac69a60b24b33dad97616c9fea8ba50d0",
     "data/atlas-ttps.json": "d24bc02859d40ccf1615db75cca68c077585904e41e0d8f6de448121e9b1abb0",
     "data/attack-techniques.json": "fa193f0d2d248176a8beddb641e9fe56ba4faa9e15dc253ff876dbf0c5d58a77",
     "data/cve-catalog.json": "3d451dda7ac0c7d57a4075ae4bafd3148c6184b35dc1bc59d8b81d1f2641e430",

package/lib/playbook-runner.js

@@ -1545,16 +1545,21 @@ function close(playbookId, directiveId, analyzeResult, validateResult, agentSign
     const obligation = (g.jurisdiction_obligations || []).find(o =>
       `${o.jurisdiction}/${o.regulation} ${o.window_hours}h` === na.obligation_ref
     );
-    // Thread runOpts through so computeClockStart can check
-    // operator_consent.explicit before auto-stamping detect_confirmed.
-    const clockStart = obligation ? computeClockStart(obligation.clock_starts, agentSignals, runOpts) : null;
-    // When the clock event is detect_confirmed AND the classification
-    // matched AND the operator did NOT pass --ack, surface
-    // clock_pending_ack so the notification record is visibly waiting on
-    // acknowledgement.
+    // Thread runOpts + the engine-computed classification through so
+    // computeClockStart can check operator_consent.explicit before
+    // auto-stamping detect_confirmed, and so an engine-confirmed detection
+    // starts the clock even without a separately-submitted classification.
+    const engineClassification = analyzeResult?._detect_classification || null;
+    const clockStart = obligation
+      ? computeClockStart(obligation.clock_starts, agentSignals, runOpts, engineClassification)
+      : null;
+    // When the clock event is detect_confirmed AND detection was confirmed
+    // (by the agent OR the engine) AND the operator did NOT pass --ack,
+    // surface clock_pending_ack so the notification record is visibly waiting
+    // on acknowledgement.
     const clockPendingAck = !clockStart
       && obligation?.clock_starts === 'detect_confirmed'
-      && agentSignals?.detection_classification === 'detected'
+      && (agentSignals?.detection_classification === 'detected' || engineClassification === 'detected')
       && !(runOpts && runOpts.operator_consent && runOpts.operator_consent.explicit === true);
     const deadline = obligation && clockStart
       ? new Date(clockStart.getTime() + obligation.window_hours * 3600 * 1000).toISOString()
@@ -2457,8 +2462,15 @@ function buildEvidenceBundle(format, playbook, analyze, validate, agentSignals,
     // the whole distribution block when no level is declared; the
     // pre-fix runner had no surface for this at all.
     const allowedTlp = new Set(['CLEAR', 'GREEN', 'AMBER', 'AMBER+STRICT', 'RED']);
+    // CSAF 2.0 §3.2.1.5.2 pins tlp.label to the TLP 1.0 enum
+    // (WHITE/GREEN/AMBER/RED). Map the modern TLP 2.0 labels the CLI accepts
+    // onto that enum so the emitted document stays schema-valid for strict
+    // CSAF 2.0 consumers, while preserving the operator's exact label in the
+    // free-form `text` field. (CLEAR≡WHITE; AMBER+STRICT carries AMBER's
+    // disclosure scope plus a stricter handling note.)
+    const CSAF_TLP_LABEL = { CLEAR: 'WHITE', 'AMBER+STRICT': 'AMBER', GREEN: 'GREEN', AMBER: 'AMBER', RED: 'RED' };
     const csafDistribution = (runOpts.tlp && allowedTlp.has(runOpts.tlp))
-      ? { tlp: { label: runOpts.tlp }, text: `TLP:${runOpts.tlp}` }
+      ? { tlp: { label: CSAF_TLP_LABEL[runOpts.tlp] }, text: `TLP:${runOpts.tlp}` }
       : null;
 
     return {
@@ -3564,13 +3576,21 @@ function stripOuterParens(expr) {
  *     waiting on acknowledgement.
  *   - All other events without an explicit timestamp: return null.
  */
-function computeClockStart(eventName, agentSignals, runOpts = {}) {
+function computeClockStart(eventName, agentSignals, runOpts = {}, engineClassification = null) {
   // The agent submits clock_started_at_<event> ISO strings as it progresses.
   const key = `clock_started_at_${eventName}`;
   if (agentSignals && agentSignals[key]) return new Date(agentSignals[key]);
   // For detect_confirmed: only auto-stamp when the operator has explicitly
   // acknowledged the result via --ack. Otherwise leave the clock pending.
-  if (eventName === 'detect_confirmed' && agentSignals?.detection_classification === 'detected'
+  // Detection is "confirmed" when EITHER the agent submitted
+  // detection_classification:'detected' OR the engine itself classified the
+  // detect phase as 'detected'. Pre-fix only the agent-submitted signal was
+  // honored, so an engine-confirmed detection (indicators fired from
+  // signal_overrides without a separate classification submission) never
+  // started the regulatory clock — notification deadlines silently stalled.
+  const detected = agentSignals?.detection_classification === 'detected'
+    || engineClassification === 'detected';
+  if (eventName === 'detect_confirmed' && detected
       && runOpts && runOpts.operator_consent && runOpts.operator_consent.explicit === true) {
     return new Date();
   }

package/lib/refresh-external.js

@@ -200,6 +200,16 @@ Air-gap workflow:
 Outputs:
   refresh-report.json (gitignored) — per-source status + every diff
 
+Exit codes (refresh's own scheme — distinct from the seven-phase verbs):
+  0  applied (or a clean dry-run with no diffs to surface)
+  2  error (unknown --source, unreadable fixture, invalid --advisory id, air-gap refusal)
+  3  draft produced, editorial review pending (a successful --advisory seed —
+     NOT a failure; run --advisory <id> --apply to land it, or curate first)
+  4  network/source unreachable
+Note: exit 3 here means "review needed", which differs from \`exceptd run\`'s
+exit 3 ("ran but no evidence"). Script \`refresh --advisory\` on the body's
+\`ok\` field, not on \`$? == 0\`.
+
 This module never auto-applies version-pin bumps — those require audit per
 AGENTS.md Hard Rule #12 and are surfaced as report-only findings.
 `);
@@ -1283,7 +1293,13 @@ async function seedSingleAdvisory(opts) {
   const sourceName = useOsv ? "osv" : "ghsa";
   const fixtureEnv = useOsv ? "EXCEPTD_OSV_FIXTURE" : "EXCEPTD_GHSA_FIXTURE";
 
-  let result = await sourceMod.fetchAdvisoryById(id, {});
+  // Thread the air-gap disposition (the --air-gap flag OR EXCEPTD_AIR_GAP=1)
+  // into the fetch. Previously this passed {} and dropped --air-gap, so
+  // `refresh --advisory <id> --air-gap` egressed to the network — an air-gap
+  // violation. Both source modules refuse (no fixture) when airGap is set.
+  const airGap = !!opts.airGap || process.env.EXCEPTD_AIR_GAP === "1";
+
+  let result = await sourceMod.fetchAdvisoryById(id, { airGap });
   // F4 (v0.12.11): CVE-* identifiers may have an OSV record before GHSA
   // publishes one (CNAs and OSV mirrors operate on different cadences).
   // When GHSA returns 404 specifically, retry through OSV's /v1/vulns/{id}
@@ -1291,7 +1307,7 @@ async function seedSingleAdvisory(opts) {
   // error message so operators know both sources were tried before failing.
   let fallbackSourceUsed = null;
   if (!result.ok && !useOsv && /^CVE-/i.test(id) && /HTTP 404/.test(result.error || "")) {
-    const fallback = await osvMod.fetchAdvisoryById(id, {});
+    const fallback = await osvMod.fetchAdvisoryById(id, { airGap });
     if (fallback.ok) {
       result = fallback;
       fallbackSourceUsed = "osv";
@@ -1410,6 +1426,16 @@ async function main() {
   // written, please review") so CI pipelines surface the needed editorial
   // step. Operator must run `--apply` for the write to land; without it,
   // the seed is printed to stdout for review.
+  // An empty --advisory value (`--advisory ""` / `--advisory=`) must error
+  // rather than silently falling through to a full-refresh dry-run.
+  if (opts.advisory === "") {
+    process.stderr.write(JSON.stringify({
+      ok: false,
+      error: "refresh: --advisory requires a non-empty identifier (e.g. CVE-2026-1234, GHSA-xxxx-xxxx-xxxx, MAL-2026-1).",
+    }) + "\n");
+    process.exitCode = 2;
+    return;
+  }
   if (opts.advisory) {
     return seedSingleAdvisory(opts);
   }

package/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "exceptd-security",
-  "version": "0.14.8",
+  "version": "0.14.10",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation",
   "homepage": "https://exceptd.com",
   "license": "Apache-2.0",
@@ -53,7 +53,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "lXhZgoIrrVloO3XaTvo/43AxZn4mwErstd7DR0O/oVhD3AOGODM4HqrageYEou9WKOdMEGP5mJNTjJsXdP5NDA==",
-      "signed_at": "2026-05-27T18:02:02.071Z",
+      "signed_at": "2026-05-27T19:09:39.423Z",
       "cwe_refs": [
         "CWE-125",
         "CWE-362",
@@ -123,7 +123,7 @@
       ],
       "last_threat_review": "2026-05-17",
       "signature": "ztSKk/zFMFbT12qRcEeBKpydBn7fTT86KxMmor0DTCoKQWk5fJ0fSInfP1XMSB6rFk4/SuSjKVxQRMKVJ5a+Cg==",
-      "signed_at": "2026-05-27T18:02:02.073Z",
+      "signed_at": "2026-05-27T19:09:39.425Z",
       "cwe_refs": [
         "CWE-1039",
         "CWE-1426",
@@ -196,7 +196,7 @@
       ],
       "last_threat_review": "2026-05-17",
       "signature": "K6QdPHNK5c4K5QFjrW0QsUhjp71D7SOisSoulwPNSvKRdi2rY+yg0kdckijBMkLMsVPyUvcC9giu93mKJ1OZDg==",
-      "signed_at": "2026-05-27T18:02:02.073Z",
+      "signed_at": "2026-05-27T19:09:39.425Z",
       "cwe_refs": [
         "CWE-22",
         "CWE-345",
@@ -248,7 +248,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-22",
       "signature": "Qd3SBWmUAaaT++e1Ry2wBIz/dCBmNBMl0+4Rb0etvJLES0fIBEAkU1mTbgNZnT5XOg9J5twdUpymWtmKnDDQCQ==",
-      "signed_at": "2026-05-27T18:02:02.074Z"
+      "signed_at": "2026-05-27T19:09:39.425Z"
     },
     {
       "name": "compliance-theater",
@@ -279,7 +279,7 @@
       ],
       "last_threat_review": "2026-05-22",
       "signature": "F2Shxae0ua0gPtvwzTRVzzHaIgJcFDRT3/akLUAZ4aaMQhkleKkcTaTpkjp+pTVEdPfLeLGNCeAOMs+whVYOBg==",
-      "signed_at": "2026-05-27T18:02:02.075Z"
+      "signed_at": "2026-05-27T19:09:39.426Z"
     },
     {
       "name": "exploit-scoring",
@@ -308,7 +308,7 @@
       ],
       "last_threat_review": "2026-05-18",
       "signature": "NA1hoQycvQhSUoG5rwlXX0mOVmGxoXRVezkELGEA2nZOdGis4gXkHT3O6Sfw7zxE4JuMrsCb65TEeOWk9WEPDg==",
-      "signed_at": "2026-05-27T18:02:02.075Z"
+      "signed_at": "2026-05-27T19:09:39.427Z"
     },
     {
       "name": "rag-pipeline-security",
@@ -345,7 +345,7 @@
       ],
       "last_threat_review": "2026-05-22",
       "signature": "W3pS8lnaCP96TQzsJpG5d5yv5IwgaQyS4Z2Ctcz5BOJf6LbajSIgeDgTZ4f4Bhr5m4E7KsgWGjZS4x7Fwd33BQ==",
-      "signed_at": "2026-05-27T18:02:02.075Z",
+      "signed_at": "2026-05-27T19:09:39.427Z",
       "cwe_refs": [
         "CWE-1395",
         "CWE-1426"
@@ -405,7 +405,7 @@
       ],
       "last_threat_review": "2026-05-17",
       "signature": "/WDGygh1Ck4yWlBWDGtEUVCqKB8d+UaJXoAoBXujtt+GAl8JbMNpaN1TvI0WkEltQ9dTxaAzSn20/eVDqv8iDQ==",
-      "signed_at": "2026-05-27T18:02:02.076Z",
+      "signed_at": "2026-05-27T19:09:39.427Z",
       "d3fend_refs": [
         "D3-CA",
         "D3-CSPP",
@@ -440,7 +440,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-22",
       "signature": "za1NKBpy9LC91F/ESO/qhUfmvVr8GNItQOjR5OJLeHm+2dQ9HHiFWQK2eo53V/n/0uhubuggURA3yS6kJuWwBg==",
-      "signed_at": "2026-05-27T18:02:02.076Z",
+      "signed_at": "2026-05-27T19:09:39.428Z",
       "cwe_refs": [
         "CWE-1188"
       ],
@@ -474,7 +474,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-18",
       "signature": "xiHAhhdufm9hCKU8PLiPE0MX65ej2F4OZwtlWLGLCiie9/km+Kiqbt192LcMvr94v83C98pb9wIaqFsFWft6AQ==",
-      "signed_at": "2026-05-27T18:02:02.076Z",
+      "signed_at": "2026-05-27T19:09:39.428Z",
       "forward_watch": [
         "New AI attack classes as ATLAS v6 publishes",
         "Post-quantum adversary capability timeline",
@@ -513,7 +513,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "oYsSk35N2Uzq7MRofACykylcVwkgPhI4luWZ14vmQT+gUKLyZiKVOUJbe1+7lGl6BYPRN0sUDQ0f7S5Eu5w2Ag==",
-      "signed_at": "2026-05-27T18:02:02.077Z"
+      "signed_at": "2026-05-27T19:09:39.428Z"
     },
     {
       "name": "zeroday-gap-learn",
@@ -540,7 +540,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-18",
       "signature": "igRqYyU1unRFH40BsPyAR62SPrk8QZv8dPGb8S9O9EvLCNOZAzm3t+HdT/NKqzWHwrpomOzkkkyLfYI/0qTUDA==",
-      "signed_at": "2026-05-27T18:02:02.077Z",
+      "signed_at": "2026-05-27T19:09:39.429Z",
       "forward_watch": [
         "New CISA KEV entries",
         "New ATLAS TTP additions in each ATLAS release",
@@ -604,7 +604,7 @@
       ],
       "last_threat_review": "2026-05-22",
       "signature": "i/17u4kJiSpcZAz7LnTyRePFugQOstQ1P4kVoe0oGf4E2/j8oIN9U9DccjUn/YHZhKWIJ2AILG/DMhvMrr3bBg==",
-      "signed_at": "2026-05-27T18:02:02.077Z",
+      "signed_at": "2026-05-27T19:09:39.429Z",
       "cwe_refs": [
         "CWE-327"
       ],
@@ -652,7 +652,7 @@
       ],
       "last_threat_review": "2026-05-22",
       "signature": "QuOVaQ4E2Sl39TClbhZ7HA9XrYAyRrDL44HY3RTE7aWLue0hV2cxaBt40ALGmHS++631QGFDlZTLZI77Tr6nAA==",
-      "signed_at": "2026-05-27T18:02:02.078Z"
+      "signed_at": "2026-05-27T19:09:39.429Z"
     },
     {
       "name": "security-maturity-tiers",
@@ -689,7 +689,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "8Px1s2lDj10/Q6erwEQlXgUHM1+OTruUR8qAHPX7Oo3k/l69N6P9sm0PsafS9wDFtj9l5C/OiLiFgzMlMt6vBw==",
-      "signed_at": "2026-05-27T18:02:02.078Z",
+      "signed_at": "2026-05-27T19:09:39.430Z",
       "cwe_refs": [
         "CWE-1188"
       ]
@@ -724,7 +724,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-11",
       "signature": "urRcataVWg6/utyEkSiOWoNxTL8sABRjPR7ShyDfZGnAozFph/yDktSoaPVxQDXwu9EfJE+qhUW5OYR/yJECBQ==",
-      "signed_at": "2026-05-27T18:02:02.078Z"
+      "signed_at": "2026-05-27T19:09:39.430Z"
     },
     {
       "name": "attack-surface-pentest",
@@ -796,7 +796,7 @@
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — Microsoft Edge 4-bug sandbox escape by Orange Tsai (DEVCORE); forward-watch only (browser sandbox, out of current playbook scope); track Microsoft Edge security advisory and KEV add"
       ],
       "signature": "C7lv65/Ecm8JJgSKxrX5lxx0YFzKWtrIQSKp+vy50I5e8945s1JmifGUUrnQwRQhq/Pkv7EmfiH5XSO8h75bDg==",
-      "signed_at": "2026-05-27T18:02:02.078Z"
+      "signed_at": "2026-05-27T19:09:39.430Z"
     },
     {
       "name": "fuzz-testing-strategy",
@@ -856,7 +856,7 @@
         "OSS-Fuzz-Gen / AI-assisted harness generation becoming the default expectation for OSS maintainers"
       ],
       "signature": "Z7ypCUnXx8JpLtgxxB6RHNi39w74AmrGY1N4ofAGCXhkuM2EaFVm1AU0dvl9UQ1bVLfHKEDGqMO/TwlIY7RABg==",
-      "signed_at": "2026-05-27T18:02:02.079Z"
+      "signed_at": "2026-05-27T19:09:39.431Z"
     },
     {
       "name": "dlp-gap-analysis",
@@ -931,7 +931,7 @@
         "Quebec Law 25, India DPDPA, KSA PDPL enforcement actions naming AI-tool prompt data as in-scope personal information"
       ],
       "signature": "IgEnpHOhCftAyfUNdKsjbrd169T9pJkk/rRM2ZEna+H18y7p5x48+1kME2sJMZjJuyAdQFBJi8PJXZFwLGI+DQ==",
-      "signed_at": "2026-05-27T18:02:02.079Z"
+      "signed_at": "2026-05-27T19:09:39.431Z"
     },
     {
       "name": "supply-chain-integrity",
@@ -1010,7 +1010,7 @@
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Megatron Bridge path traversal by haehae; AI training-stack file-system trust boundary; track patch and SBOM-attestation impact"
       ],
       "signature": "pcLrM98A3vUSZRjwNAk0aZ9umvOwB41XCLLsCOy/IebB2F/06oIrGUKkMHtHwm4pTVPShMMcKdZQQ3jz30FnCg==",
-      "signed_at": "2026-05-27T18:02:02.079Z"
+      "signed_at": "2026-05-27T19:09:39.431Z"
     },
     {
       "name": "defensive-countermeasure-mapping",
@@ -1067,7 +1067,7 @@
       ],
       "last_threat_review": "2026-05-11",
       "signature": "G5q5elh7Q7eu2xcwTVQJGDTGfvZR0OGQaLSLJPb2wjzCHFF8PWuZfCHZdjjqisiRzRWPyLlzgfHeMJqOdy7cBw==",
-      "signed_at": "2026-05-27T18:02:02.080Z"
+      "signed_at": "2026-05-27T19:09:39.432Z"
     },
     {
       "name": "identity-assurance",
@@ -1134,7 +1134,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "Wv5hGMeHjlaQK1zwicVCA7AvdKgJBgvcjdpGM9Ywahh9tagAKhbkOjybowDQZzu7OZ3bDkbh6pBYc1Sdwr6NAA==",
-      "signed_at": "2026-05-27T18:02:02.080Z"
+      "signed_at": "2026-05-27T19:09:39.432Z"
     },
     {
       "name": "ot-ics-security",
@@ -1190,7 +1190,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "8t5qKHd3yWi57dvG36YQkLN/X9bQWqtEiYjay4IfSmqhJpM/xXPaQVKNGz3wscrO8OLKUZ0OaX7Mj5kzpgBKBQ==",
-      "signed_at": "2026-05-27T18:02:02.080Z"
+      "signed_at": "2026-05-27T19:09:39.432Z"
     },
     {
       "name": "coordinated-vuln-disclosure",
@@ -1242,7 +1242,7 @@
         "NYDFS 23 NYCRR 500 amendments potentially adding explicit CVD program requirements"
       ],
       "signature": "GDGt4UPqBa04PjlpSmpyihGzd3OgfBN7jaAK5tfwp+LRSs3ygKOdbeivUCCHNagTY1hE6hG2Ou40ADfBFuXeAg==",
-      "signed_at": "2026-05-27T18:02:02.081Z"
+      "signed_at": "2026-05-27T19:09:39.433Z"
     },
     {
       "name": "threat-modeling-methodology",
@@ -1292,7 +1292,7 @@
         "PASTA v2 updates incorporating AI/ML application threats"
       ],
       "signature": "rFBpOQEJUPpl+v88Lw/WqVJRhTl80vy0VbPAbzQj3Q0suJRRrJg368I9uKu5LXIBKFDvKxnGIcIzbGg9NUtaCA==",
-      "signed_at": "2026-05-27T18:02:02.081Z"
+      "signed_at": "2026-05-27T19:09:39.433Z"
     },
     {
       "name": "webapp-security",
@@ -1366,7 +1366,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "ux85YI4t2mVHOyt744Yin1HHy+z11JIFygjKfFfQOBBl5QVV3A267jeIy7utix85irMcpZm/T3yx/ooqiK2tBA==",
-      "signed_at": "2026-05-27T18:02:02.081Z",
+      "signed_at": "2026-05-27T19:09:39.433Z",
       "forward_watch": [
         "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; AI-assisted discovery angle; track for active-exploitation confirmation and patch advisory affecting front-door web app deployments"
       ]
@@ -1419,7 +1419,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-15",
       "signature": "IIXnkZ5ZNqFwOto5KfytADTLLZLoyXNZACD1ORZ40P1HUAQxe6u2uyXFzzsfuob4Uy06jNkRGr2FFgCphUH1Cw==",
-      "signed_at": "2026-05-27T18:02:02.082Z"
+      "signed_at": "2026-05-27T19:09:39.434Z"
     },
     {
       "name": "sector-healthcare",
@@ -1479,7 +1479,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "AhF9KF8ZBlDteciV+F8IBSmFVYCvQOn44GmD4rZjgLoPxfIv/QE1/vSkK32zyqDKtHWkLSXExbkkPkxA/V6dDw==",
-      "signed_at": "2026-05-27T18:02:02.082Z"
+      "signed_at": "2026-05-27T19:09:39.435Z"
     },
     {
       "name": "sector-financial",
@@ -1560,7 +1560,7 @@
         "TIBER-EU framework v2.0 alignment with DORA TLPT RTS (JC 2024/40); cross-recognition with CBEST and iCAST"
       ],
       "signature": "HQgZvb4ReziEz5rNFr8i/O8/rJEZR+iHRROT7m/D2QUqhrcNISPkYXENsUZlG8xapzy/Ik92ehkseyj4hdmhCQ==",
-      "signed_at": "2026-05-27T18:02:02.083Z"
+      "signed_at": "2026-05-27T19:09:39.435Z"
     },
     {
       "name": "sector-federal-government",
@@ -1629,7 +1629,7 @@
         "Australia PSPF 2024 revision and ISM quarterly updates — track for Essential Eight Maturity Level requirements for federal entities"
       ],
       "signature": "linxmsXZiOYtcs71sSWgGCrvb8xQfmxmtTY5PRvZJ0/8FgJulo0tQtejzexYG775s7XhjAmGsDP238BQTQ8ADA==",
-      "signed_at": "2026-05-27T18:02:02.083Z"
+      "signed_at": "2026-05-27T19:09:39.435Z"
     },
     {
       "name": "sector-energy",
@@ -1694,7 +1694,7 @@
         "ICS-CERT advisory feed (https://www.cisa.gov/news-events/cybersecurity-advisories/ics-advisories) for vendor CVEs in Siemens, Rockwell, Schneider Electric, ABB, GE Vernova, Hitachi Energy, AVEVA / OSIsoft PI"
       ],
       "signature": "JjBfc0ovta560Clk0x3QGRM5osFJDwcvpy3rT7QEGdCIL827jzE8QCow1C8deXq+4JhY2sA/d7/8IsxikdlkCg==",
-      "signed_at": "2026-05-27T18:02:02.083Z"
+      "signed_at": "2026-05-27T19:09:39.436Z"
     },
     {
       "name": "sector-telecom",
@@ -1780,7 +1780,7 @@
         "O-RAN SFG / WG11 security specifications"
       ],
       "signature": "JWVxKFoKrbX4d+Tko1d4OBdwyg25MfFFKn4CT6E/CzH+YwnU3T6Y76uBQIKg3+gIGTvPduqyvQwQQ5FxKDuPBw==",
-      "signed_at": "2026-05-27T18:02:02.084Z"
+      "signed_at": "2026-05-27T19:09:39.436Z"
     },
     {
       "name": "api-security",
@@ -1849,7 +1849,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-18",
       "signature": "BmCRCestWqr55+fCynEhtAl5NWLT+xLTkpwS0Icp3SaoZOw/ce3Y6TtqjHRSKn4CBJq7YDiLRWxmhO3MStvOAA==",
-      "signed_at": "2026-05-27T18:02:02.084Z",
+      "signed_at": "2026-05-27T19:09:39.437Z",
       "forward_watch": [
         "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; track for active-exploitation confirmation and patch advisory affecting API gateway / reverse-proxy deployments",
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — LiteLLM 3-bug SSRF + Code Injection chain by k3vg3n; LLM-proxy API surface; track upstream patch and CVE assignments",
@@ -1935,7 +1935,7 @@
         "CISA KEV additions for cloud-control-plane CVEs (IMDSv1 abuses, federation token mishandling, cross-tenant boundary failures); CISA Cybersecurity Advisories for cross-cloud advisories"
       ],
       "signature": "/DV3pmZwrRySrk1OCbyI+0BQESacjupJfUX3eC2NGtXuYOBro0vndIP+z27heFxumnjU3a9sfla7/U9X+pqnDw==",
-      "signed_at": "2026-05-27T18:02:02.084Z"
+      "signed_at": "2026-05-27T19:09:39.437Z"
     },
     {
       "name": "container-runtime-security",
@@ -1997,7 +1997,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-15",
       "signature": "E2UGSf9ATyYgzBr8uM/0ubOUmDqo1jVA7f9mVxv6LHfWGCNuQNXDyuNou9VAmUCeeXEeUYIi3AFjXkJqpOkxDA==",
-      "signed_at": "2026-05-27T18:02:02.085Z",
+      "signed_at": "2026-05-27T19:09:39.438Z",
       "forward_watch": [
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Container Toolkit container escape ($50K award) by chompie / IBM X-Force XOR; high-severity container/hypervisor boundary break; track patch and KEV add post-embargo"
       ]
@@ -2071,7 +2071,7 @@
         "MITRE ATLAS v5.6.0 (released May 2026) shipped the AML.T0010 sub-technique expansion this forecast tracked plus new techniques (\"Publish Poisoned AI Agent Tool\", \"Escape to Host\"); inventory now 16 tactics, 84 techniques, 56 sub-techniques. Forward watch: subsequent ATLAS minor and major releases — track next-cadence updates to agentic-AI TTPs and MLOps-pipeline-specific techniques"
       ],
       "signature": "IL+DlRCDJN/p08iiJCFkasKcoyjcB0uWrJ6ORLjQcS1HrUa5Xt62QxVjYPHzaevlm5y36ZdmfESqsZJmzK3lCg==",
-      "signed_at": "2026-05-27T18:02:02.085Z"
+      "signed_at": "2026-05-27T19:09:39.438Z"
     },
     {
       "name": "incident-response-playbook",
@@ -2133,7 +2133,7 @@
         "NYDFS 23 NYCRR 500.17 amendments tightening ransom-payment 24h disclosure operationalization"
       ],
       "signature": "MmjLjlmOMLjhJJ4ZfR8MYlHam+ZB+eSqfh6Nv+DecaG4O5zeo9DBP/iL3cbyDVZxmhnhivgJild2ccYeWTeZAg==",
-      "signed_at": "2026-05-27T18:02:02.086Z"
+      "signed_at": "2026-05-27T19:09:39.439Z"
     },
     {
       "name": "ransomware-response",
@@ -2213,7 +2213,7 @@
       ],
       "last_threat_review": "2026-05-22",
       "signature": "ssueL03g9fWlhXpTe+IiY5l7RqQkunN4DTN5QETKE+VOX+qggdjAR8PONxk77ol4xWYmHrM/VcH8CNtXUEvgBA==",
-      "signed_at": "2026-05-27T18:02:02.086Z"
+      "signed_at": "2026-05-27T19:09:39.439Z"
     },
     {
       "name": "email-security-anti-phishing",
@@ -2266,7 +2266,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-18",
       "signature": "rK+WnuS+9tqEABmwc0jO/PEmxcLjG1/tmUb897HsClQeKzf+TQOlwBE+OsbtuKxpjYNwur62Xxs3TxObkwm8Cw==",
-      "signed_at": "2026-05-27T18:02:02.086Z"
+      "signed_at": "2026-05-27T19:09:39.439Z"
     },
     {
       "name": "age-gates-child-safety",
@@ -2334,7 +2334,7 @@
         "US state adult-site age-verification laws — 19+ states by mid-2026 (TX HB 18 upheld by SCOTUS June 2025 in Free Speech Coalition v. Paxton); track ongoing challenges in remaining states"
       ],
       "signature": "Rgho5TOFUL1txOzcVR0kASCNdovSU4yt99JlGilJlJRyg0A+BdeeQYrZrhPF6Vx2reUAVG0BeHfcZtSbi+cwCg==",
-      "signed_at": "2026-05-27T18:02:02.087Z"
+      "signed_at": "2026-05-27T19:09:39.440Z"
     },
     {
       "name": "cloud-iam-incident",
@@ -2414,7 +2414,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "e/kij7GtKaytROyIj7V5RH+FC9WtmVFzrmG2kIlNDNn29ep/CRNlIQKwXLpzo/81AIf634pmdr1qy/+vwIuUDA==",
-      "signed_at": "2026-05-27T18:02:02.087Z",
+      "signed_at": "2026-05-27T19:09:39.440Z",
       "forward_watch": [
         "AWS IAM Identity Center session-policy refresh and step-up-on-admin enforcement (anticipated 2026-H2 release)",
         "GCP Workload Identity Federation principal-set attribute mapping tightening (post-2026 Q3 Federation hardening guide)",
@@ -2508,7 +2508,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "ew9Kglc9fAZzbn0ZIfGP7WSK/j4eV2VhSvpy+s5bEfNEVYIMa2kZjnGBapgUsyGDLes9H9K2ovjQyX17+GKiBw==",
-      "signed_at": "2026-05-27T18:02:02.087Z",
+      "signed_at": "2026-05-27T19:09:39.440Z",
       "forward_watch": [
         "Entra ID conditional access evolution post-Midnight Blizzard — Microsoft's 2025-2026 commitments on legacy-tenant MFA enforcement and OAuth-app consent gating",
         "Okta IPSIE (Interoperability Profile for Secure Identity in the Enterprise) OpenID Foundation working-group output and adoption timeline",
@@ -2526,6 +2526,6 @@
   ],
   "manifest_signature": {
     "algorithm": "Ed25519",
-    "signature_base64": "xG4gZv1rcgWczi8BEOXyjd8fWOXBXkSdjEEHfoWTk3jVnPNWWy/Gu8rzzm+UWxAdtwaVJwUA9q34V/ObyQQPAg=="
+    "signature_base64": "kz1GOuevVLJH7BQe+0ZEZfgkd7GmCgXILgZxLT8NqAX+PCTLHWNoYFHNZjSEcuSL38OhhidKiqt5381iRh0CCw=="
   }
 }

package/orchestrator/index.js

@@ -165,11 +165,46 @@ Examples:
     return;
   }
 
+  // The set of framework IDs the catalog actually carries gaps for. Used both
+  // to expand `all` and to validate an explicit framework argument.
+  const knownFrameworks = [...new Set(Object.values(controlGaps).flatMap(g =>
+    Array.isArray(g.framework) ? g.framework : [g.framework]
+  ).filter(f => f && f !== 'ALL'))];
+
   const requested = args[0].toLowerCase() === 'all'
-    ? [...new Set(Object.values(controlGaps).flatMap(g =>
-        Array.isArray(g.framework) ? g.framework : [g.framework]
-      ).filter(f => f && f !== 'ALL'))]
+    ? knownFrameworks
     : [args[0]];
+
+  // Validate an explicit framework name. Pre-fix an unknown framework (typo,
+  // wrong casing, a framework the catalog doesn't track) produced a report
+  // with zero matching gaps — indistinguishable from a real "no gaps" result,
+  // so an operator could read a typo as proof the framework covers the
+  // scenario. Refuse with the known-framework list instead.
+  //
+  // Match exactly as gapReport does: normalize (strip case + spaces + hyphens)
+  // and accept a substring hit against either a gap's `framework` or a prefix
+  // hit against a gap KEY — so the documented short forms ("NIST-800-53"
+  // matching "NIST 800-53 Rev 5") still resolve. A framework is "known" when at
+  // least one catalog gap matches it, independent of the scenario; a known
+  // framework with no scenario gaps remains a legitimate empty result.
+  if (args[0].toLowerCase() !== 'all') {
+    const normalize = (s) => String(s).toLowerCase().replace(/[\s_-]/g, '');
+    const idNorm = normalize(args[0]);
+    const matchesFramework = Object.entries(controlGaps).some(([key, g]) => {
+      const fws = Array.isArray(g.framework) ? g.framework : [g.framework];
+      if (fws.some(f => f && normalize(f).includes(idNorm))) return true;
+      if (normalize(key).startsWith(idNorm)) return true;
+      return false;
+    });
+    if (!matchesFramework) {
+      const sorted = knownFrameworks.slice().sort();
+      const msg = `[framework-gap] unknown framework "${args[0]}". No catalog control gaps reference it. Known frameworks: ${sorted.join(', ')}. Use "all" to analyze every framework.`;
+      if (jsonOut) console.log(JSON.stringify({ ok: false, error: msg, known_frameworks: sorted }, null, 2));
+      else console.error(msg);
+      safeExit(EXIT_CODES.GENERIC_FAILURE);
+      return;
+    }
+  }
   const scenario = args[1];
 
   const report = gapReport(requested, scenario, controlGaps, cveCatalog);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/exceptd-skills",
-  "version": "0.14.8",
+  "version": "0.14.10",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 42 skills, 11 catalogs (406 CVEs / 171 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
   "keywords": [
     "ai-security",

package/sbom.cdx.json

@@ -1,22 +1,22 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:uuid:efaa11c0-807e-4b1b-85fc-013ffe4a03be",
+  "serialNumber": "urn:uuid:8fb68e61-0c23-484d-ae4f-4602b074d0f5",
   "version": 1,
   "metadata": {
-    "timestamp": "2153-06-02T04:44:48.000Z",
+    "timestamp": "2102-05-29T07:38:09.000Z",
     "tools": [
       {
         "vendor": "blamejs",
         "name": "scripts/refresh-sbom.js",
-        "version": "0.14.8"
+        "version": "0.14.10"
       }
     ],
     "component": {
-      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.14.8",
+      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.14.10",
       "type": "application",
       "name": "@blamejs/exceptd-skills",
-      "version": "0.14.8",
+      "version": "0.14.10",
       "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 42 skills, 11 catalogs (406 CVEs / 171 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
       "licenses": [
         {
@@ -25,17 +25,17 @@
           }
         }
       ],
-      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.14.8",
+      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.14.10",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "d5c212f9fdc1f7bfe668e5748d2600bfb4e83b95c51cc0e586c38260a55b794e"
+          "content": "dd31abe0df4f5c62f434ae6f9f797cd0175bce8e4efc586ce32e7f5358417308"
         }
       ],
       "externalReferences": [
         {
           "type": "distribution",
-          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.14.8"
+          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.14.10"
         },
         {
           "type": "vcs",
@@ -116,11 +116,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "c60bcbfd8ab7e452f8499fb77db281741a5bf37114dd4dc40796b6ac6978ccc1"
+          "content": "4ef9374f1d742ecdb9f226345ec01a50303e2e57a595481283a79026f99fecfb"
         },
         {
           "alg": "SHA3-512",
-          "content": "8db34a7f0e35925866912d486983afae5c01a0302ac1764fc1d777341cf33ed70157475aab9f2e5e394dd99b9f07abe5169ec482ceef4e77fa602b071d9075b6"
+          "content": "5f1e8ffbfa99c068814fff268481e8b3b46947d1acc6857895d257ea1cea53e901146cd2d188d92dfe53e012e8f4651d73d72b9521c4d73ec003262ff73f908e"
         }
       ]
     },
@@ -281,11 +281,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "86fafb59d29675231590513d2058e29728a8afd8e687022e657bd03cb023a44e"
+          "content": "c0503adedd57bbd05c86937d0f24e9ad5294883dd259d9a04f4575f74031ca98"
         },
         {
           "alg": "SHA3-512",
-          "content": "a22d43d83ac7cfbb66e68e4739efea6819e145b80d856571d8e444358e3d7507a9097d4cb8f20800295b5da3a799cde05dba6c1b5f3c3ca1ac873ef492d6038b"
+          "content": "0e10b7c282377f39927bd314c51bc88e509fb738d4f4e08256f13c7e7be4fde69a773e138c74b121d39b12b4555aaa2ca82b7ad4c0952c77d0f88ea43d045249"
         }
       ]
     },
@@ -1316,11 +1316,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "47ee765793b2495783076b55d9fbd5af3afb1599ecd326bae41156adaa27dd8f"
+          "content": "6a7cda7be47f08d77f5049fbf49adfe977dd5321d27fd28b2e02133cc7da76e5"
         },
         {
           "alg": "SHA3-512",
-          "content": "7ae97081829103b6d38bdffd76fc54fb3cabadc16cdbcc45f799793858185da5524f44b8b8826806f52245f587c48f23679311472a30e368c75c414853fc1353"
+          "content": "74cbfe39fa4d8a298d2d580cf66f7ec0b79d571eb99d8620ea9f186b2219e12cf729308812be539191d0c5213981f5a32a5cd75d844eabec9175b599e6ed4e1e"
         }
       ]
     },
@@ -1346,11 +1346,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "15ad90a0ad6522d51f1e76b3ad9f7d6853f0545a9c26b9bd5571ce13273b1a36"
+          "content": "19d6d3ebed46e74a44d8dd51f3b872af2a6ccc822956f7e36c68aeb8dea6a251"
         },
         {
           "alg": "SHA3-512",
-          "content": "6ac2fed3aae167c69b9d06ead294a7dd6e9848c034ac65319ad1da6f7839dee852b85f36e9ab1e1bef3e63e386139ea092b79228d055d71573142f2f28d2a0cc"
+          "content": "4c8f2b37db734bf999d145fd29a48ae1847652a9eed14f3db14d90527eafbff27146e80fc34f40439b988ea76783572053e59c1b9b113308d84327913af2ef6c"
         }
       ]
     },
@@ -1751,11 +1751,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "4e43fc695c4246f2ccdb47cf1807b7a40c961032926dbf3dd3d83bce9af9d7cd"
+          "content": "4d13f4f27b890997b5da18055a4bb0eac69a60b24b33dad97616c9fea8ba50d0"
         },
         {
           "alg": "SHA3-512",
-          "content": "83051f3b146fc2ac6b2253761bd62cae2c6959b042a85cc4b416ad2118c251373453efa22f6c676408a6a412a95826162ed336e47e1d21f6527fe5dea25f60da"
+          "content": "069ad77e2888bd780a9f1c3d3b38aaf32cf34b11727efc4d00156b6b0b90223beefdde0113848a2e30a9251dc143535d50a20d9850d37ee103c9e52c9b287c76"
         }
       ]
     },
@@ -1811,11 +1811,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "e6ca431c82725c29082fde73d3af13ef2b91607bfb79bcfa6741b98079e30062"
+          "content": "eab11c18ec8c198dcc77642271b1b51f1f942333eedade34ea3d0ce4e8cf65ed"
         },
         {
           "alg": "SHA3-512",
-          "content": "0126958b8a206310e712258b997140edf5222c28259f5450200e4756e88b03393963ea63ad3d1d238d8abc256d9fdb1101d810d26f9e474787a461f5749c1a0c"
+          "content": "7c9ffa98ba3bd538686d714e561f012598e792ec9a2c00503d0795c64e76e16d19f66c96c557998f66f9984999973e83b539c130a3b9f0908e07632c0dd660aa"
         }
       ]
     },