npm - @blamejs/exceptd-skills - Versions diffs - 0.16.24 → 0.16.25 - Mend

@blamejs/exceptd-skills 0.16.24 → 0.16.25

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (6) hide show

package/CHANGELOG.md CHANGED Viewed

@@ -1,5 +1,9 @@
 # Changelog
+## 0.16.25 — 2026-06-05
+The `refresh` air-gap guidance now consistently names `--prefetch` as the cache-populate command. The `refresh --help` synopsis and the `--from-cache` missing-path error hint previously presented `--no-network` as a populate alias — but `--no-network` is the report-only dry run that writes nothing, so an operator following that guidance produced an empty cache and then hit a confusing "path does not exist" on the offline host. `--no-network` is now documented as the report-only mode it actually is, and the air-gap hint points at `--prefetch`.
 ## 0.16.24 — 2026-06-05
 Attestation replay tamper-gating, collector detection integrity, and lock-lifecycle fixes.

package/data/_indexes/_meta.json CHANGED Viewed

@@ -1,10 +1,10 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-06-05T22:20:42.479Z",
+  "generated_at": "2026-06-06T00:45:44.721Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 63,
   "source_hashes": {
-    "manifest.json": "fe65c62f46bbb3c069247eb19169ac4ab99bf0354e3e9cfe432782bf402a918a",
+    "manifest.json": "9e5780f8d8bec94d6cff2d22e16c940f63e7a38d8dfefe17a201cf93eaeabf93",
     "data/atlas-ttps.json": "f66b456cf82a3c20575d8479de41f7b11b7ee5693eb1fcf64a67e162ae1b88a2",
     "data/attack-techniques.json": "c39f28e3402ef13ad9b7076819f63fda67a22f97e3e375cfe01c4a4e0beff7c9",
     "data/cve-catalog.json": "51d8425a49e5cc0375d0a154a83a16816e99c3141a5bbafe6383607ca11be240",

package/lib/refresh-external.js CHANGED Viewed

@@ -109,13 +109,17 @@ function parseArgs(argv) {
     // older than 7d or one that was prefetched without a signing keypair.
     // EXCEPTD_FORCE_STALE=1 mirrors for non-interactive automation.
     else if (a === "--force-stale") out.forceStale = true;
-    // Aliases that bin/exceptd.js may pass through or translate; accept them
-    // here so the unknown-flag guard below doesn't false-reject a legitimate
-    // operator invocation. (--no-network / --indexes-only / --network /
-    // --curate / --prefetch are normally rewritten upstream, but tolerate
-    // them when refresh-external is invoked directly.)
+    // --prefetch / --no-network are prefetch-cache operations. Capture them so
+    // main() can delegate to lib/prefetch.js (the same routing bin/exceptd.js
+    // performs) when this script is invoked directly — otherwise the help
+    // text's "report-only, no cache write" promise for --no-network is a lie
+    // on the direct path, which would fall through to the live refresh loop.
+    else if (a === "--no-network") { out.noNetwork = true; }
+    else if (a === "--prefetch") { out.prefetch = true; }
+    // Remaining bin-translated aliases are tolerated as no-ops at this layer
+    // so the unknown-flag guard below doesn't false-reject them.
     else if (
-      a === "--no-network" || a === "--prefetch" || a === "--indexes-only" ||
+      a === "--indexes-only" ||
       a === "--network" || a === "--curate" || a === "--force-stale-acked"
     ) { /* accepted, no-op at this layer */ }
     // Any remaining --flag is an unrecognized typo. Record it; refuse after
@@ -148,8 +152,10 @@ Modes:
                      place. Same trust anchor as \`npm update -g\`, only the
                      data slice changes — useful when you want fresher
                      intel without re-resolving CLI/lib code.
-  --prefetch         (alias: --no-network) populate the cache for offline use.
-                     Equivalent to \`exceptd prefetch\`.
+  --prefetch         populate the cache for offline use. Equivalent to
+                     \`exceptd prefetch\`.
+  --no-network       report-only: list what would be fetched, WITHOUT writing
+                     the cache (the dry-run opposite of --prefetch).
   --from-cache [<p>] read from prefetch cache (default .cache/upstream).
                      Combine with --apply to upsert against cached data
                      entirely offline. Cache must be pre-populated via --prefetch.
@@ -1099,15 +1105,16 @@ function loadCtx(opts) {
     const abs = path.resolve(opts.fromCache);
     ctx.cacheDir = abs;
     if (!fs.existsSync(abs)) {
-      // v0.11.14 (#129): operators following the website's air-gap workflow
-      // hit this with an unhelpful "path does not exist" stack trace. The
-      // cache is populated by `exceptd refresh --no-network` (which routes
-      // to prefetch). Tell them exactly that, and emit a structured JSON
-      // error to stderr instead of a fatal stack trace.
+      // Operators following the air-gap workflow hit this with an unhelpful
+      // "path does not exist" stack trace. The cache is populated by
+      // `exceptd refresh --prefetch` (which routes to prefetch) — NOT by
+      // `--no-network`, which is the report-only dry run that writes nothing.
+      // Tell them exactly that, and emit a structured JSON error to stderr
+      // instead of a fatal stack trace.
       const err = new Error(
         `refresh: --from-cache path does not exist: ${abs}\n` +
-        `Hint: the cache is populated by running \`exceptd refresh --no-network\` (or \`exceptd refresh --prefetch\`) ` +
-        `on a connected host first. Air-gap workflow: (1) on connected host: \`exceptd refresh --no-network\`, ` +
+        `Hint: the cache is populated by running \`exceptd refresh --prefetch\` ` +
+        `on a connected host first. Air-gap workflow: (1) on connected host: \`exceptd refresh --prefetch\`, ` +
         `(2) copy .cache/upstream/ across the boundary, (3) on offline host: \`exceptd refresh --from-cache --apply\`.`
       );
       err._exceptd_hint = true;
@@ -1526,6 +1533,24 @@ async function main() {
     return;
   }
+  // `--prefetch` / `--no-network` are prefetch-cache operations. The operator
+  // path (bin/exceptd.js) routes them to lib/prefetch.js; when this script is
+  // invoked directly, delegate the SAME way so behavior matches the help text:
+  // --prefetch populates the cache, --no-network is a report-only dry run that
+  // writes nothing. Without this, the direct path fell through to the live
+  // refresh loop and could egress + write refresh-report.json despite
+  // --no-network.
+  if (opts.prefetch || opts.noNetwork) {
+    const { spawnSync } = require("child_process");
+    const pfArgs = [require.resolve("./prefetch.js")];
+    if (opts.noNetwork) pfArgs.push("--no-network");
+    if (opts.source) pfArgs.push("--source", opts.source);
+    if (opts.quiet) pfArgs.push("--quiet");
+    const r = spawnSync(process.execPath, pfArgs, { stdio: "inherit" });
+    process.exitCode = r.status == null ? 1 : r.status;
+    return;
+  }
   // v0.12.0: `--advisory <id>` short-circuits the normal source loop and
   // seeds a single CVE catalog entry from GHSA. Exits non-zero ("draft
   // written, please review") so CI pipelines surface the needed editorial

package/manifest.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "exceptd-security",
-  "version": "0.16.24",
+  "version": "0.16.25",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation",
   "homepage": "https://exceptd.com",
   "license": "Apache-2.0",
@@ -53,7 +53,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "0H+JfyUVmo/pVFEi5rLENATHjlukPVUqnOWmNPEH77wm8svKGK0aNJ46k6QU5GdHb8c9X9pVJKiuhON6AxDjDw==",
-      "signed_at": "2026-06-05T21:54:10.774Z",
+      "signed_at": "2026-06-06T00:30:06.267Z",
       "cwe_refs": [
         "CWE-125",
         "CWE-362",
@@ -123,7 +123,7 @@
       ],
       "last_threat_review": "2026-05-17",
       "signature": "PHwHEsoy7ctBYOtlAfAdCDVfsq2Bpk9+qESSF+5dVkDcez2zp2v9Ihsv2vqMEs3QxMndyQ+t7NVezyt5VamSCg==",
-      "signed_at": "2026-06-05T21:54:10.776Z",
+      "signed_at": "2026-06-06T00:30:06.268Z",
       "cwe_refs": [
         "CWE-1039",
         "CWE-1426",
@@ -196,7 +196,7 @@
       ],
       "last_threat_review": "2026-05-17",
       "signature": "dD4p7lcRtMyfITOncqLkpOeMy6x6gM0V7UlWHgLEdcxqODb1s75ar1cBtTqDWPbMv6ZAzVo2HJLDK1hVjjU2AQ==",
-      "signed_at": "2026-06-05T21:54:10.776Z",
+      "signed_at": "2026-06-06T00:30:06.269Z",
       "cwe_refs": [
         "CWE-22",
         "CWE-345",
@@ -248,7 +248,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-22",
       "signature": "wsw8Mlr/gyw6S7Iaao9BVHdU5LFPWl8WVymW17Lkq9J1Mui0+fCrTg6UbrsaeE3s7EW3TVgzBuK+8EFd1+H5AA==",
-      "signed_at": "2026-06-05T21:54:10.776Z"
+      "signed_at": "2026-06-06T00:30:06.269Z"
     },
     {
       "name": "compliance-theater",
@@ -279,7 +279,7 @@
       ],
       "last_threat_review": "2026-05-22",
       "signature": "uVTc1QRKOKcIVDajBz+q2egjiEAyOQaDNsvVI2ghj5FD0VvquoUBBE5Naca2FkaZa790EHWCsVZ4hhdaSQs2DQ==",
-      "signed_at": "2026-06-05T21:54:10.777Z"
+      "signed_at": "2026-06-06T00:30:06.270Z"
     },
     {
       "name": "exploit-scoring",
@@ -308,7 +308,7 @@
       ],
       "last_threat_review": "2026-05-18",
       "signature": "Vne6mNYAubRMzF8Fz6CrU/hbvV+UzkGbpmWQrRSGlqNTGPHgzKOhDcZ2cqgRAI9AGz4IBE79dMaQrXqsnni9AQ==",
-      "signed_at": "2026-06-05T21:54:10.778Z"
+      "signed_at": "2026-06-06T00:30:06.270Z"
     },
     {
       "name": "rag-pipeline-security",
@@ -345,7 +345,7 @@
       ],
       "last_threat_review": "2026-05-22",
       "signature": "5rw2i39SxY2WphBbDLEP28wufnbPPE9+PWt54hmaGdwHXr9RLiVt5liL/5xp14sehlVgFsfpR/bg9vy//xV0DA==",
-      "signed_at": "2026-06-05T21:54:10.778Z",
+      "signed_at": "2026-06-06T00:30:06.271Z",
       "cwe_refs": [
         "CWE-1395",
         "CWE-1426"
@@ -405,7 +405,7 @@
       ],
       "last_threat_review": "2026-05-17",
       "signature": "Vqu49nzntFWjn9A/QeJzm7q/2xk/cZJ6HFQKtiNi1zgcxzXKm+MlFdkaLgYHWj5/9HJohxyIDyBJQTvcJ20eDQ==",
-      "signed_at": "2026-06-05T21:54:10.778Z",
+      "signed_at": "2026-06-06T00:30:06.271Z",
       "cwe_refs": [
         "CWE-918"
       ],
@@ -443,7 +443,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-22",
       "signature": "W87VdyVdAxAdcRI6P/8StaV+MS8ZSPKM9HOCK9n/bBO6BM3ZSE3uImVoyJVpAXQlUpUGN+A3lCJZXv64LuxwDg==",
-      "signed_at": "2026-06-05T21:54:10.779Z",
+      "signed_at": "2026-06-06T00:30:06.271Z",
       "cwe_refs": [
         "CWE-1188"
       ],
@@ -477,7 +477,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-18",
       "signature": "wdVX+edeNekpaIldqkhvtraV6DquLvIsKAjuZVwPQYn3l1vS99HXuFxmNsD7UeMlO3qgC6Dysfsto9EnuH0RBg==",
-      "signed_at": "2026-06-05T21:54:10.779Z",
+      "signed_at": "2026-06-06T00:30:06.272Z",
       "forward_watch": [
         "New AI attack classes as ATLAS v6 publishes",
         "Post-quantum adversary capability timeline",
@@ -516,7 +516,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "b5miTiY0cnxETd2btxorfZBdJKt/fLnQx20sGYUb9zEqGqtm0LMLpghkW68j4/9k48KNyuGMtNWiKTSnodUGBw==",
-      "signed_at": "2026-06-05T21:54:10.779Z"
+      "signed_at": "2026-06-06T00:30:06.272Z"
     },
     {
       "name": "zeroday-gap-learn",
@@ -543,7 +543,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-18",
       "signature": "xbkip0AQtWQKAu+O6r/gYECNjezS6O9k9xkkJsYbMlr+j8CdqH3p5/0l+GZmDidImRC/DL07GCnKrk9HRR/yDQ==",
-      "signed_at": "2026-06-05T21:54:10.780Z",
+      "signed_at": "2026-06-06T00:30:06.273Z",
       "forward_watch": [
         "New CISA KEV entries",
         "New ATLAS TTP additions in each ATLAS release",
@@ -607,7 +607,7 @@
       ],
       "last_threat_review": "2026-05-22",
       "signature": "li2NnC1oeVIr22ComP5QbcQoh5xpWITuaKpza1s2SsUkH6kGnnt4wFfFAzaC1ORmH9x2cr8hN8kaNANG/eIMBQ==",
-      "signed_at": "2026-06-05T21:54:10.780Z",
+      "signed_at": "2026-06-06T00:30:06.273Z",
       "cwe_refs": [
         "CWE-327"
       ],
@@ -655,7 +655,7 @@
       ],
       "last_threat_review": "2026-05-22",
       "signature": "sZHlJ7ueHPdtzVbR+yXQ5+wKgNyjWsa1LKVg9aWTmg/Onl71DvEILMyJiLpPQjseT56Mnr1DMYJE8xOGlffBAw==",
-      "signed_at": "2026-06-05T21:54:10.781Z"
+      "signed_at": "2026-06-06T00:30:06.273Z"
     },
     {
       "name": "security-maturity-tiers",
@@ -692,7 +692,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "3AwFnEJu6DukPPNep/3SnuPWEuV060fJEQIwThFm7ujmdbFk0/Ii0XwGv1dkvbbK7ymMdOQpp35l4aLONAucDA==",
-      "signed_at": "2026-06-05T21:54:10.781Z",
+      "signed_at": "2026-06-06T00:30:06.274Z",
       "cwe_refs": [
         "CWE-1188"
       ]
@@ -727,7 +727,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-11",
       "signature": "iJWevUBurLvt2v8X+Ch2eHmZkPWpKeAtIpxTIP4MwbUHyco3igDeBywJCyaR2vURYRx8LkzzIMM8DxQM4LAXBQ==",
-      "signed_at": "2026-06-05T21:54:10.781Z"
+      "signed_at": "2026-06-06T00:30:06.274Z"
     },
     {
       "name": "attack-surface-pentest",
@@ -799,7 +799,7 @@
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — Microsoft Edge 4-bug sandbox escape by Orange Tsai (DEVCORE); forward-watch only (browser sandbox, out of current playbook scope); track Microsoft Edge security advisory and KEV add"
       ],
       "signature": "DDMzI+4En4aIkwBUCGW6nj1eEkCyLqHGn2LJ2rnwWfYatjPI1U5HrTZNAN/n9JqWtAzk8F3rmsKehaaz5iNWDA==",
-      "signed_at": "2026-06-05T21:54:10.782Z"
+      "signed_at": "2026-06-06T00:30:06.274Z"
     },
     {
       "name": "fuzz-testing-strategy",
@@ -859,7 +859,7 @@
         "OSS-Fuzz-Gen / AI-assisted harness generation becoming the default expectation for OSS maintainers"
       ],
       "signature": "dJB0iAstIUbyny+udl3OIkaLScEmqS97LNP73yQ8mxt+0bcqxZjpfXaWLzLuIQblGYvUvz75/H6rO2EJuGd4AQ==",
-      "signed_at": "2026-06-05T21:54:10.782Z"
+      "signed_at": "2026-06-06T00:30:06.275Z"
     },
     {
       "name": "dlp-gap-analysis",
@@ -934,7 +934,7 @@
         "Quebec Law 25, India DPDPA, KSA PDPL enforcement actions naming AI-tool prompt data as in-scope personal information"
       ],
       "signature": "KEAoMji3VcPX/ZXXqVe6OStxSkTssfY9fIRPyPcDYqh50GzOFQ6koNOTBVAiWOvjDjQ38g12xun5srbqgmvRAw==",
-      "signed_at": "2026-06-05T21:54:10.782Z"
+      "signed_at": "2026-06-06T00:30:06.275Z"
     },
     {
       "name": "supply-chain-integrity",
@@ -1013,7 +1013,7 @@
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Megatron Bridge path traversal by haehae; AI training-stack file-system trust boundary; track patch and SBOM-attestation impact"
       ],
       "signature": "zuW8T0EMbVV83GsUP/W20Use2gBTicBW021T0sY7qsRY/U5qsPWkXYIWp3SdiKLTIKqTEd/0T7LQebjIs2QKCA==",
-      "signed_at": "2026-06-05T21:54:10.783Z"
+      "signed_at": "2026-06-06T00:30:06.275Z"
     },
     {
       "name": "defensive-countermeasure-mapping",
@@ -1070,7 +1070,7 @@
       ],
       "last_threat_review": "2026-05-11",
       "signature": "Qe0Hg9BrX3Zm5pj0n2z/oiHbAXWdA2Dq461zc4izkkUjEX2CZ02rODjCI2ELbrVOU3GC7edxqAxA+5U/ObnHDQ==",
-      "signed_at": "2026-06-05T21:54:10.783Z"
+      "signed_at": "2026-06-06T00:30:06.276Z"
     },
     {
       "name": "identity-assurance",
@@ -1137,7 +1137,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "UV3458QXSkEpenzrOmdlTTfPHUD4hNyKMDHoeZDq/kiFb4mAG0ghQGTTgI9Ru8cJbSmYM1++m9N5TFIJ6JJPBg==",
-      "signed_at": "2026-06-05T21:54:10.783Z"
+      "signed_at": "2026-06-06T00:30:06.276Z"
     },
     {
       "name": "ot-ics-security",
@@ -1193,7 +1193,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "kIVzsPsJ72PzzWQwTuvjoHHoVEDCday5I52M9ohjB3/Ak+zlA8oyWLO/BKb/XuYY4fOApjfxTErSWv5uHQ2zDw==",
-      "signed_at": "2026-06-05T21:54:10.784Z"
+      "signed_at": "2026-06-06T00:30:06.276Z"
     },
     {
       "name": "coordinated-vuln-disclosure",
@@ -1245,7 +1245,7 @@
         "NYDFS 23 NYCRR 500 amendments potentially adding explicit CVD program requirements"
       ],
       "signature": "bWr27Q1uN9xCe1ib4QulszBa7YIDNkGqo72k5nm2cK98LyPblicD+sO9MnGckAyB22BTN/cIB+FwFMcI5IxvBw==",
-      "signed_at": "2026-06-05T21:54:10.784Z"
+      "signed_at": "2026-06-06T00:30:06.277Z"
     },
     {
       "name": "threat-modeling-methodology",
@@ -1295,7 +1295,7 @@
         "PASTA v2 updates incorporating AI/ML application threats"
       ],
       "signature": "Q854yzLqXdOazc6EyQbZzgAlivuq2vGFDVUCrxSldSvx/HX/ZM/uzmJyP7aBG7ZsMHxj6Lmj/H82YQoo1e+NCQ==",
-      "signed_at": "2026-06-05T21:54:10.784Z"
+      "signed_at": "2026-06-06T00:30:06.277Z"
     },
     {
       "name": "webapp-security",
@@ -1369,7 +1369,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "4ccahkJpGJZtwD7EBpnGcN0sEGPMEw8eqV+tvePVS04YAkLgYVWtlkasI/8n0be9xB+77x+Sjj3kIi2j2Lf9CA==",
-      "signed_at": "2026-06-05T21:54:10.785Z",
+      "signed_at": "2026-06-06T00:30:06.277Z",
       "forward_watch": [
         "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; AI-assisted discovery angle; track for active-exploitation confirmation and patch advisory affecting front-door web app deployments"
       ]
@@ -1422,7 +1422,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-15",
       "signature": "SBB7c3wNYfIdkyOp4g4nW0WP7xS+YokMzg32aaeJdbf14LTGQRzQUvSqb2TCj2HFUSHESOyKT1JpkAfyHLSQBQ==",
-      "signed_at": "2026-06-05T21:54:10.785Z"
+      "signed_at": "2026-06-06T00:30:06.278Z"
     },
     {
       "name": "sector-healthcare",
@@ -1482,7 +1482,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "U04GNLyRas1VmfEsB8khH4iqFZPwx96sPY0Kw9iVsSPU+KTeEFqwgtWK1X1pzgb+T16Pc7HSrCaXDOpTFvQEDw==",
-      "signed_at": "2026-06-05T21:54:10.786Z"
+      "signed_at": "2026-06-06T00:30:06.278Z"
     },
     {
       "name": "sector-financial",
@@ -1563,7 +1563,7 @@
         "TIBER-EU framework v2.0 alignment with DORA TLPT RTS (JC 2024/40); cross-recognition with CBEST and iCAST"
       ],
       "signature": "xbylLqNPBuEsFE/MNVeGy/01K6yiJXMxQbzC1F4RWU5aseDGbNy5HrAv2JWI2+Aft05ozreNPjccvu66yJ5EBw==",
-      "signed_at": "2026-06-05T21:54:10.786Z"
+      "signed_at": "2026-06-06T00:30:06.279Z"
     },
     {
       "name": "sector-federal-government",
@@ -1632,7 +1632,7 @@
         "Australia PSPF 2024 revision and ISM quarterly updates — track for Essential Eight Maturity Level requirements for federal entities"
       ],
       "signature": "C9c3JuBhUbwcb7uZpDdy+PNT8sYmYIxzD4uRHu421ePW1aSFJ8fkMvuTzSO8vD/F/jOOg5opM4kov/xSAn+qCg==",
-      "signed_at": "2026-06-05T21:54:10.787Z"
+      "signed_at": "2026-06-06T00:30:06.279Z"
     },
     {
       "name": "sector-energy",
@@ -1697,7 +1697,7 @@
         "ICS-CERT advisory feed (https://www.cisa.gov/news-events/cybersecurity-advisories/ics-advisories) for vendor CVEs in Siemens, Rockwell, Schneider Electric, ABB, GE Vernova, Hitachi Energy, AVEVA / OSIsoft PI"
       ],
       "signature": "oz8Q5WVaY8au4IjbaZahx/DSaC00Q44ylSL3mDkTerCEpW/EyPUeiLeGxSrWxBCwVFEKSSJvnhJjhvX5lDPcCg==",
-      "signed_at": "2026-06-05T21:54:10.787Z"
+      "signed_at": "2026-06-06T00:30:06.280Z"
     },
     {
       "name": "sector-telecom",
@@ -1783,7 +1783,7 @@
         "O-RAN SFG / WG11 security specifications"
       ],
       "signature": "NAtyzfLPXlUuB78Snb9nWmbZalC1CNlIYN9rYhdEmtB/xQGC6vVnThgrEAHlm7v/jMCFuknvEpUHKdscUnUADw==",
-      "signed_at": "2026-06-05T21:54:10.787Z"
+      "signed_at": "2026-06-06T00:30:06.280Z"
     },
     {
       "name": "api-security",
@@ -1852,7 +1852,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-18",
       "signature": "1UTjZNC5Lyrgw93LAizdXVeSmv3jS8YQNT1db5OKsldub50+o1FXmAH4+3MxZozaOGDCX3yXbdDJSJaaSmfuAA==",
-      "signed_at": "2026-06-05T21:54:10.788Z",
+      "signed_at": "2026-06-06T00:30:06.280Z",
       "forward_watch": [
         "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; track for active-exploitation confirmation and patch advisory affecting API gateway / reverse-proxy deployments",
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — LiteLLM 3-bug SSRF + Code Injection chain by k3vg3n; LLM-proxy API surface; track upstream patch and CVE assignments",
@@ -1938,7 +1938,7 @@
         "CISA KEV additions for cloud-control-plane CVEs (IMDSv1 abuses, federation token mishandling, cross-tenant boundary failures); CISA Cybersecurity Advisories for cross-cloud advisories"
       ],
       "signature": "EdsY4xe7YA8X8m+KZUbq49JwoCXgRKEz2eg3m86O37rvBmpm8ppvl9hrsekygvpBh2VmCHL2dEYiOD8OM2n7CA==",
-      "signed_at": "2026-06-05T21:54:10.788Z"
+      "signed_at": "2026-06-06T00:30:06.281Z"
     },
     {
       "name": "container-runtime-security",
@@ -2000,7 +2000,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-15",
       "signature": "fnLKPLkjjRCJ/F9wdmZ1w1lXmqEJvTYkv6Uu+9OTd5vZTWKz3QMuxKOsas+ctCdOvTaeloqPUUprXx+ZZdDpCg==",
-      "signed_at": "2026-06-05T21:54:10.789Z",
+      "signed_at": "2026-06-06T00:30:06.281Z",
       "forward_watch": [
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Container Toolkit container escape ($50K award) by chompie / IBM X-Force XOR; high-severity container/hypervisor boundary break; track patch and KEV add post-embargo"
       ]
@@ -2074,7 +2074,7 @@
         "MITRE ATLAS v5.6.0 (released May 2026) shipped the AML.T0010 sub-technique expansion this forecast tracked plus new techniques (\"Publish Poisoned AI Agent Tool\", \"Escape to Host\"); inventory now 16 tactics, 84 techniques, 56 sub-techniques. Forward watch: subsequent ATLAS minor and major releases — track next-cadence updates to agentic-AI TTPs and MLOps-pipeline-specific techniques"
       ],
       "signature": "t3dkdpTX04zvjitEeOJThpgjurLd1UO9GOut4LXSZgY3ULhfknI4zT7G5+m2RSZZTo7yyeZrwpg+7vEg9K6mAw==",
-      "signed_at": "2026-06-05T21:54:10.789Z"
+      "signed_at": "2026-06-06T00:30:06.281Z"
     },
     {
       "name": "incident-response-playbook",
@@ -2136,7 +2136,7 @@
         "NYDFS 23 NYCRR 500.17 amendments tightening ransom-payment 24h disclosure operationalization"
       ],
       "signature": "+1kmtA6rAvIyDjjy+cJHK6BcfylyVsa5cUjRFijlFR9GsQfB93JnmkEJOqML50pdlcxtJI3yUodHpL3/YJGtCA==",
-      "signed_at": "2026-06-05T21:54:10.789Z"
+      "signed_at": "2026-06-06T00:30:06.282Z"
     },
     {
       "name": "ransomware-response",
@@ -2216,7 +2216,7 @@
       ],
       "last_threat_review": "2026-05-22",
       "signature": "h48ASCz63aBfHzLKxMVDADMuT4atriK0iE6bJeVzZTsx/e8+hyv4fLP7+zYxT9Oe0Gss3v/Xy+t+Wd9uwzV+Aw==",
-      "signed_at": "2026-06-05T21:54:10.790Z"
+      "signed_at": "2026-06-06T00:30:06.282Z"
     },
     {
       "name": "email-security-anti-phishing",
@@ -2269,7 +2269,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-18",
       "signature": "FVBn4ex2qPIo9SHMVJ6tntoz4tVwjbIq3m6wDjjZyv2JODlS+90GBYCOkNamxxkmw/6de6SMs0YHQiF/xjo/DQ==",
-      "signed_at": "2026-06-05T21:54:10.790Z"
+      "signed_at": "2026-06-06T00:30:06.283Z"
     },
     {
       "name": "age-gates-child-safety",
@@ -2337,7 +2337,7 @@
         "US state adult-site age-verification laws — 19+ states by mid-2026 (TX HB 18 upheld by SCOTUS June 2025 in Free Speech Coalition v. Paxton); track ongoing challenges in remaining states"
       ],
       "signature": "ZHVdGWCcfG98tSVB0b9mwrsYwv71V3uUEl+6ss7omSQhmNvqV5s6MAZM5YladBt9MK/8T/zBrTYN4gAonOP+BQ==",
-      "signed_at": "2026-06-05T21:54:10.791Z"
+      "signed_at": "2026-06-06T00:30:06.283Z"
     },
     {
       "name": "cloud-iam-incident",
@@ -2417,7 +2417,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "r9ii4nb3HJELdtKCGF5qy9PHOiot3GC24yfxfGAKlLENHkdRvRkvvL99eV/6RXyfUaMyrnc2Te8tPQcNu5bsDg==",
-      "signed_at": "2026-06-05T21:54:10.791Z",
+      "signed_at": "2026-06-06T00:30:06.284Z",
       "forward_watch": [
         "AWS IAM Identity Center session-policy refresh and step-up-on-admin enforcement (anticipated 2026-H2 release)",
         "GCP Workload Identity Federation principal-set attribute mapping tightening (post-2026 Q3 Federation hardening guide)",
@@ -2511,7 +2511,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "9mfDtMApMAg9V/lmwpniNxo/6gNZoOEoYDfyFvyWvKrPMtc7H9F8uz06FVoARe/J49saAKTVXOurNE1D/KtpCQ==",
-      "signed_at": "2026-06-05T21:54:10.791Z",
+      "signed_at": "2026-06-06T00:30:06.284Z",
       "forward_watch": [
         "Entra ID conditional access evolution post-Midnight Blizzard — Microsoft's 2025-2026 commitments on legacy-tenant MFA enforcement and OAuth-app consent gating",
         "Okta IPSIE (Interoperability Profile for Secure Identity in the Enterprise) OpenID Foundation working-group output and adoption timeline",
@@ -2583,7 +2583,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "dOFgANMtHm64uSFRjMfeA0fWZS9ISwMTt59I2CbjaF1PgTtbtb8yg/f+3pC4eXcXIET0KPGxRRmENycfIz3rAw==",
-      "signed_at": "2026-06-05T21:54:10.792Z"
+      "signed_at": "2026-06-06T00:30:06.284Z"
     },
     {
       "name": "mail-server-hardening",
@@ -2642,7 +2642,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "5x8RGzKo/T2IbYnFkYMZs16ThD9a5FEdrKHsnwvtMuGxdyyfZsKNIJVWw2I8O0um0UOXwwkl17Z3zhch26ymCQ==",
-      "signed_at": "2026-06-05T21:54:10.792Z"
+      "signed_at": "2026-06-06T00:30:06.284Z"
     },
     {
       "name": "network-trust",
@@ -2698,7 +2698,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "C/RdmnGjXKreKiGkwJfUESIxUwQzisGJ9A7KBdE9cBRBHBYHkAcScV89L+Z3kOG032Qax6LeIQai7Lr3nrQBCA==",
-      "signed_at": "2026-06-05T21:54:10.792Z"
+      "signed_at": "2026-06-06T00:30:06.285Z"
     },
     {
       "name": "audit-log-integrity",
@@ -2753,7 +2753,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "LvUAq+rXCA8PgNy9lTKOmFqa8T9EJg4JEH0axXvEAf9MIHqbR51ergUkFMLaTuvFuApwsPu0r1C30QgScZbiAw==",
-      "signed_at": "2026-06-05T21:54:10.793Z"
+      "signed_at": "2026-06-06T00:30:06.285Z"
     },
     {
       "name": "self-update-integrity",
@@ -2807,7 +2807,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "BOQZ8G9LdyG/tfpz6rCU4THz5Dq2HGJkUV7uCqSTCMrqnXH6seNXKM41FWawYo0s2VUlXtRgaO7ETp5qgxw+CQ==",
-      "signed_at": "2026-06-05T21:54:10.793Z"
+      "signed_at": "2026-06-06T00:30:06.285Z"
     },
     {
       "name": "multitenancy-isolation",
@@ -2865,7 +2865,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "bncN0VE4ns0lxtPe48xDR33lerw54BPVkSwX7XlrLQcMHTrV94lmjO8z4ZP4Ko61n+KpuP2SNU8v9JT0bGMmAA==",
-      "signed_at": "2026-06-05T21:54:10.793Z"
+      "signed_at": "2026-06-06T00:30:06.285Z"
     },
     {
       "name": "decompression-dos",
@@ -2923,7 +2923,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "03i0ZO5ScHIOjGvDKUEsws6m+20fnlJrEhSBtMU7PJzQutrPpmW9gULE0wbayTD5H9URh5nSKZuuVjvjVhZNCg==",
-      "signed_at": "2026-06-05T21:54:10.793Z"
+      "signed_at": "2026-06-06T00:30:06.285Z"
     },
     {
       "name": "log-injection-telemetry",
@@ -2978,7 +2978,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "twTmA2l+Am2k2PCzB2DNxDQwoYlGopJp/3QgQwBsP7h2LF+uNudisqfuOVV/bYnWfrUhuYZUWbsR3mhzbJCUBw==",
-      "signed_at": "2026-06-05T21:54:10.794Z"
+      "signed_at": "2026-06-06T00:30:06.286Z"
     },
     {
       "name": "privacy-consent-ops",
@@ -3033,11 +3033,11 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "0sfKSVrIf555c9bDGkXB96fUClN52fMAMYoQsNQ9eUUSzDiWUwdou+q0gYt43nObtj3m9Yb9X6q3oCXDVMgUDg==",
-      "signed_at": "2026-06-05T21:54:10.794Z"
+      "signed_at": "2026-06-06T00:30:06.286Z"
     }
   ],
   "manifest_signature": {
     "algorithm": "Ed25519",
-    "signature_base64": "mV0pAkSn14nwUzoUbvbXQqctfe42CQBEKApecPrRWWOxhyI7mjM2XhYoHDdogS6sDtQhJZgcUSZm0+rs1ITkDw=="
+    "signature_base64": "yjbWNMCX7Be5GfNF5WciEnzDeuUyJ6NldTbYRA6nx5C2QXPJYyVJVCI1bZtH3EsxmgmM7Ap/Wjzb0kZ+UtiLAg=="
   }
 }

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/exceptd-skills",
-  "version": "0.16.24",
+  "version": "0.16.25",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (439 CVEs / 177 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
   "keywords": [
     "ai-security",

package/sbom.cdx.json CHANGED Viewed

@@ -1,22 +1,22 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:uuid:521b3f50-68ed-486c-8801-dcdfa6f46a2d",
+  "serialNumber": "urn:uuid:4be06296-b7a7-4bd7-9a37-610ea0d4f29b",
   "version": 1,
   "metadata": {
-    "timestamp": "2069-08-26T11:43:12.000Z",
+    "timestamp": "2066-05-04T18:08:22.000Z",
     "tools": [
       {
         "vendor": "blamejs",
         "name": "scripts/refresh-sbom.js",
-        "version": "0.16.24"
+        "version": "0.16.25"
       }
     ],
     "component": {
-      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.16.24",
+      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.16.25",
       "type": "application",
       "name": "@blamejs/exceptd-skills",
-      "version": "0.16.24",
+      "version": "0.16.25",
       "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (439 CVEs / 177 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
       "licenses": [
         {
@@ -25,17 +25,17 @@
           }
         }
       ],
-      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.16.24",
+      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.16.25",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "ecf00501bf1417cff985373ccbad6088384a14dfe144ab32a62cc1589400ca22"
+          "content": "5ef637e552a5ff3a2d5aa1f5eba8f27ffe7fbae273d5c849b57f8585a87c87a1"
         }
       ],
       "externalReferences": [
         {
           "type": "distribution",
-          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.16.24"
+          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.16.25"
         },
         {
           "type": "vcs",
@@ -116,11 +116,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "5ce7c68af3aad70ce86b63bb3e09e15787cb5631830b5fa7065d94ae1ef61dbb"
+          "content": "abc127f24f9df3b712d6bf1c3fc9a807e45d30dba6b4a4f36717eeabcf7ac5db"
         },
         {
           "alg": "SHA3-512",
-          "content": "1c4122bd634c77dce08017f8ef3629f0a35e7e2ba6c29d047192c62bdbe429aabe2847709d40c1f33b0923af1c101388d2c13590ff1bdba673e0ff3349cde5db"
+          "content": "8ef078cc62d24a611e4fbee7f78351e3b46c956a01c8f233f7a6c3694cb37b172763cd38e57e30ddd8b1d1a0ad020c6ec15d832c4a7a722f86c13f432bc1e1e8"
         }
       ]
     },
@@ -1481,11 +1481,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "218780f3bd9ebfa07ae5dae99f28f98f7d80462bbc4826dfae3456e5737fd3da"
+          "content": "fd24753dbcacea52c27e3b9b14b7ee3b38618e321320b4ffc5521c6e186f40ea"
         },
         {
           "alg": "SHA3-512",
-          "content": "a89c45de464e1310f05d5ad6247aa78c0a85d8454461185e137c0925f151da1f5c1e50b7e914e092ae56f51a28c8d6b37594d6631a96352042d0d5627c5eb0b0"
+          "content": "3222ecc66362e5beb02d0062a3d3ed3b6477e0d230558c0d6f60a09c0bfdaf38acc1fd0d7711227e0fa3ca23f348c8088b6ccdcc3e011d7c7f842e9e10e82c14"
         }
       ]
     },
@@ -1886,11 +1886,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "fe65c62f46bbb3c069247eb19169ac4ab99bf0354e3e9cfe432782bf402a918a"
+          "content": "9e5780f8d8bec94d6cff2d22e16c940f63e7a38d8dfefe17a201cf93eaeabf93"
         },
         {
           "alg": "SHA3-512",
-          "content": "bb490a647c2e048d0b4a5a1d3edea04d4055ee8d58db1dba1e4945a3a34837d5e43174e7b526b846bc534cbf8fdbdd90ab0161115ccaa5ac16d4a2a15492d8b4"
+          "content": "293c8fa7baf29b0d170319cc726f7a0c4125de3f7e946ce7144fc9da0b20951dde1bb83883155649c640ccd5feb5450cb760c5a1d04738dfd654b431295a7a05"
         }
       ]
     },