@blamejs/exceptd-skills 0.18.24 → 0.18.26

package/sbom.cdx.json

@@ -1,23 +1,23 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:uuid:894cbd3b-4618-4b79-a5c9-b11b5825edcb",
+  "serialNumber": "urn:uuid:17a665c7-0250-4aa5-a6f8-3fc5f08db9f8",
   "version": 1,
   "metadata": {
-    "timestamp": "2098-12-29T23:16:11.000Z",
+    "timestamp": "2038-07-29T08:56:39.000Z",
     "tools": [
       {
         "vendor": "blamejs",
         "name": "scripts/refresh-sbom.js",
-        "version": "0.18.24"
+        "version": "0.18.26"
       }
     ],
     "component": {
-      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.18.24",
+      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.18.26",
       "type": "application",
       "name": "@blamejs/exceptd-skills",
-      "version": "0.18.24",
-      "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (819 CVEs / 218 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
+      "version": "0.18.26",
+      "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (823 CVEs / 218 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
       "licenses": [
         {
           "license": {
@@ -25,17 +25,17 @@
           }
         }
       ],
-      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.18.24",
+      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.18.26",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "a56e589d42bcb304e7660f06bf0d6edb07226f48d1aa4b67e503367ae4d4242d"
+          "content": "3e96aad34572b9d0bd661caddf3365a2381b47204d75450962dd869573164841"
         }
       ],
       "externalReferences": [
         {
           "type": "distribution",
-          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.18.24"
+          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.18.26"
         },
         {
           "type": "vcs",
@@ -116,11 +116,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "a2b961c082f47916ac5e3dea188ef1049c94b751fc2828569f43515f6df60f37"
+          "content": "ec67d2c158d8a12f3109b8095d9e4f6b1c806e1139ec40f475d605a34faf39b1"
         },
         {
           "alg": "SHA3-512",
-          "content": "293943c4b6fa2e5d9b57588c74178628df887e8bdc87f28146591812e4ded93d1980e5059d25d6f8fc4cac62730301443b72e7cda12fb8115c66b30732b75bb5"
+          "content": "fcd1c4b9f2790011111926b9be44178565bf4252fa77f62f3e4ed66249b489c437f4c5ee27ef14daa4a314d16fd75010a317d21bdcda40459fe2a9e8bfa88334"
         }
       ]
     },
@@ -311,11 +311,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "b9791cfae3465f95d8c59700b3fcf593e4a7a95e47bd28a18c10a782c4aa7ab7"
+          "content": "15110923850a8873f41d4d85612a63736279389b9567b1446dd88b8398f73457"
         },
         {
           "alg": "SHA3-512",
-          "content": "4d48ce6bea5fc8b7b935e3bfa6477ca000ad2c16190e19ea7469afc229171bfab82e78c4118c252adaf12472561f2303501d5bb15b303e6d7c7447eaa56b5f6c"
+          "content": "8e99a9a2733aebd96f8e363a20dbc4cbc52f714bac65601a982b3992e0e9e2d50ab3d95b2a1e189bf9782ecb070c535be838d44a1bf3759ff7f18f2babb7f18d"
         }
       ]
     },
@@ -326,11 +326,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "c5545943732112ae69ef6d1381d76704e1621821a423bf4cd01b162a9afaae01"
+          "content": "662031d56c6ab7364328176339ae8f474c6312f288ca3d5154c8c31c7f5c86dd"
         },
         {
           "alg": "SHA3-512",
-          "content": "a2640ec636a3a5540a6cec709d3cd694e802f0d6d895e9eaf82b529f864d40f7c4c352b827acec62d92528bd5b7bbc55b02eaf96cc225888a5410c019c31ad0c"
+          "content": "ff261e1f0b867a25162d45d54a4ae078a131af011364dcc5894244a1f5a3bd1c804ce08389d695638fd60501b4f62b8f2227edbfbc949db80e6abecc6f42e863"
         }
       ]
     },
@@ -341,11 +341,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "307122227ce1dd5975e5c602de7a82d538b258cdf2f04b62092a72f7b96f6fb2"
+          "content": "7c91d37ee96dea56047a368c6ca86399ef2c3d92385019f94a3613a0c257e634"
         },
         {
           "alg": "SHA3-512",
-          "content": "139e9cc55e48421cdc42e4b8ea94155a67e1505d96f9f33c083b48353c5a093b482d4a4061c5563f5213a64918862ff73072bfd0b5b621ee6aa54ebeef8b45f5"
+          "content": "0b7bdfd5ceb6f21d40e5e864aa6a6383e060e5d2fa223696682fa83a60106d39ad3e6d4bd983db44cf7f78b199c04ef99493cb61f0a13108f0b5886af05cfd4f"
         }
       ]
     },
@@ -401,11 +401,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "c35e90008b2d99c20e33e341ea5440fc2a24bb10cdba9e709a1d34e069f94565"
+          "content": "f0bfc430eebdc5818179805f73b236fbbbc73763e5f11c4905aade9cacd41fd4"
         },
         {
           "alg": "SHA3-512",
-          "content": "4c0faa7fedcc3c8af45a7648779f4f2cfb8e0b66369f87788a531de4bc706c1e2d3f57e3260c586ed6b649aa53647163284e79b1079170c7f360a4c55beae3ab"
+          "content": "b387ab676625be6a74f87f637bd54ed12d585f639ae5eef1e4298d81ccf6025a4a79f62c3a012fc02a112cd537ffb548abfe9669426d56f6feec67b4af77e68d"
         }
       ]
     },
@@ -941,11 +941,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "49ecd1aee2cfc5fe79a4ba0eb3c510d27427d773a5d56d15fef71b4b756b2ec1"
+          "content": "1712c3efebbe89e387105575be739ece9ac500a91b46fdd2b45c78f15ec5746b"
         },
         {
           "alg": "SHA3-512",
-          "content": "6d6f81ebd1767e3ebc2a3cb159707924e1595cf3509c13344b0c81e8239abd7312eeb4360f5ea43d6ea464efdfb3f718f67e7ab22a083d6c97209a26e4947a91"
+          "content": "6b230aa4fdcaec9596381e6c904def8971ff42c79294e2228a655ec74caba3069407b177f9ff766865120c1f04658df6b66f05bb23bf1eacb03b1fee4585d805"
         }
       ]
     },
@@ -1796,11 +1796,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "578cc34601ab5139f3cc0458a67dcef3e560f0d8af7bd35bd189776b34166d74"
+          "content": "1374754d2105d46ab5a43a5da58d2730679e85b0aa7b9226b1052b543329f986"
         },
         {
           "alg": "SHA3-512",
-          "content": "2ff7fb40dbe9214d30214546d6d561c2d2d341abeaf7388f98ce6b8e67fa650034cea196d0a2c43a9e38dd59fc3560990c4c6eec9c2ca4ec26c74847d263b8ad"
+          "content": "751354f4050264ab78a889e4b8b8aa66ae25468ec263f4b31ace716ac0f789e0f6931ff8dce9e5da3f3928c106dd0aac17bd91f9a13852c25be9f310c87d2689"
         }
       ]
     },
@@ -1931,11 +1931,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "6d1b779b2fe397bdcb7cd3381a0fa9526875845cdec8ee0cd9496480f2c13bb7"
+          "content": "4207cec11036cf109667a54673ac7de7aa7ef4110a3193a09c0879699c64369f"
         },
         {
           "alg": "SHA3-512",
-          "content": "940267f134e92af882b6cac9e22da4fefe37d1993fe99725d04ebc40ec1e57c4e59ea2272cb127c746fc0bd10093459cd98c849bd7d0fed2ede9005ed167a119"
+          "content": "615a770c6beb260fd421102be17f99439f4c4364cf4d175dde74fc422a62cdcdc3d93713226c6bdfce5a73c945ed9c04206afe93e57e9c69c6cfc22a7b4f3534"
         }
       ]
     },
@@ -2404,6 +2404,21 @@
         }
       ]
     },
+    {
+      "bom-ref": "file:scripts/check-framework-gap-coverage.js",
+      "type": "file",
+      "name": "scripts/check-framework-gap-coverage.js",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "add8a9fbd8c99e349dd52243c797d2935f38e26cd7db92d00b0662e759f143e2"
+        },
+        {
+          "alg": "SHA3-512",
+          "content": "2aa68e3f24cd5883d4f536a9a2e754326000aaf0a49994fc68c2267a536c4eff83bcca07ec9f75a4e54e6c44a81c774a4e9a36d5a658139a80e9d055ef539b27"
+        }
+      ]
+    },
     {
       "bom-ref": "file:scripts/check-manifest-snapshot.js",
       "type": "file",
@@ -2546,11 +2561,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "9a78740b83a08ed8e45be5fc2c0116e2d961f7b6e487b6432fabdad7935b3295"
+          "content": "3bde5d6bc4e5670229c6fa1aa1bb5125d5c078fdd5b9c1846ad583d6be7e34d6"
         },
         {
           "alg": "SHA3-512",
-          "content": "c432b0c2a4040b47566b32f8315674af371bb6b187576ee8c820c80714e3d00a2493cd6c7566cdbb3755a974531e5ae1323220efcf777fee5fc3058c9bb67b85"
+          "content": "186dcc36e5ac1f9030f2ff61a66a176a2f393ebdb8534304157d0f28a56a5ad72ba517d879e452a2d4e8be72098845ec28cdfd84e690ee208296461dee0e5dab"
         }
       ]
     },

package/scripts/check-framework-gap-coverage.js

@@ -0,0 +1,103 @@
+#!/usr/bin/env node
+/*
+ * scripts/check-framework-gap-coverage.js
+ *
+ * AGENTS.md Hard Rule #5 (global-first) enforcement gate. Every curated CVE
+ * in data/cve-catalog.json must declare a framework_control_gaps statement
+ * for all five jurisdiction buckets:
+ *
+ *   NIST  — NIST-800-53-* / NIST-800-63*
+ *   EU    — NIS2-* / DORA-* / EU-AI-* / GDPR-*
+ *   UK    — UK-CAF-*
+ *   AU    — AU-Essential-8-* / AU-ISM-*
+ *   ISO   — ISO-27001-2022-*
+ *
+ * A multi-jurisdiction operator reading the offline catalog's framework-gap
+ * output must get coverage for every required jurisdiction on every CVE, not
+ * a US-centric subset. Before this gate, two-thirds of the corpus mapped only
+ * a subset; a codex review surfaced it, the corpus was completed, and this
+ * gate keeps it from regressing when new CVEs are curated.
+ *
+ * Draft entries (_auto_imported === true) are exempt — they carry raw NVD
+ * data that has not been through curation yet. The curation bar (elsewhere)
+ * requires drafts to be promoted before shipping, at which point this gate
+ * applies.
+ *
+ * Exit code: 0 when every curated entry is complete, 1 when any entry omits a
+ * required bucket (the list is printed). Uses process.exitCode (not
+ * process.exit) so buffered stdout drains before the process ends.
+ */
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const ROOT = path.resolve(__dirname, '..');
+// Catalog path is overridable (argv[2]) so the gate's own test can point it at
+// a fixture; defaults to the shipped catalog for the real predeploy run.
+const CATALOG = process.argv[2] || path.join(ROOT, 'data', 'cve-catalog.json');
+
+const REQUIRED = ['NIST', 'EU', 'UK', 'AU', 'ISO'];
+
+function bucketOf(key) {
+  if (/^NIST/i.test(key)) return 'NIST';
+  // EU bucket is the security-regulation family AGENTS.md Hard Rule #5 names:
+  // NIS2, DORA, the EU AI Act, and the EU Cyber Resilience Act. GDPR / EU-GDPR
+  // (data-protection) is NOT sufficient on its own — an entry mapped only to
+  // GDPR still owes NIS2/DORA/EU-AI coverage, so GDPR does not satisfy this
+  // bucket. Note EU-AI / EU-CRA match here; EU-GDPR deliberately does not.
+  if (/^(NIS2|DORA|EU-AI|EU-CRA)/i.test(key)) return 'EU';
+  if (/^UK-CAF/i.test(key)) return 'UK';
+  if (/^(AU-Essential-?8|AU-ISM|Essential-?8)/i.test(key)) return 'AU';
+  if (/^ISO-?27001/i.test(key)) return 'ISO';
+  return 'OTHER';
+}
+
+function main() {
+  let catalog;
+  try {
+    catalog = JSON.parse(fs.readFileSync(CATALOG, 'utf8'));
+  } catch (e) {
+    process.stdout.write(`[check-framework-gap-coverage] cannot read ${CATALOG}: ${e.message}\n`);
+    process.exitCode = 1;
+    return;
+  }
+
+  const partial = [];
+  let checked = 0;
+  for (const id of Object.keys(catalog)) {
+    if (id === '_meta') continue;
+    const entry = catalog[id];
+    if (!entry || entry._auto_imported === true) continue;
+    checked++;
+    const gaps = entry.framework_control_gaps || {};
+    const have = new Set(Object.keys(gaps).map(bucketOf));
+    const missing = REQUIRED.filter((b) => !have.has(b));
+    if (missing.length) partial.push({ id, missing });
+  }
+
+  if (partial.length === 0) {
+    process.stdout.write(
+      `[check-framework-gap-coverage] ok — all ${checked} curated entries declare framework-gap coverage for every required jurisdiction (${REQUIRED.join(', ')}).\n`
+    );
+    return;
+  }
+
+  process.stdout.write(
+    `[check-framework-gap-coverage] FAIL: ${partial.length} of ${checked} curated entries omit at least one required jurisdiction bucket (Hard Rule #5, global-first):\n`
+  );
+  for (const p of partial.slice(0, 40)) {
+    process.stdout.write(`  ${p.id}: missing ${p.missing.join(', ')}\n`);
+  }
+  if (partial.length > 40) {
+    process.stdout.write(`  ... and ${partial.length - 40} more\n`);
+  }
+  process.stdout.write(
+    'Add a CVE-specific framework_control_gaps statement for each missing bucket ' +
+      '(NIST/EU/UK/AU/ISO). Keys must resolve to a real control in data/framework-control-gaps.json.\n'
+  );
+  process.exitCode = 1;
+}
+
+main();

package/scripts/predeploy.js

@@ -211,6 +211,17 @@ const GATES = [
     args: [path.join(ROOT, "scripts", "check-catalog-gap-budget.js")],
     ciJobName: "Data integrity (catalog + manifest snapshot)",
   },
+  {
+    // Global-first framework-gap coverage gate (AGENTS.md Hard Rule #5).
+    // Every curated CVE must declare a framework_control_gaps statement for
+    // all five jurisdiction buckets (NIST, EU, UK, AU, ISO). Drafts are
+    // exempt. Prevents a US-centric subset from shipping in the offline
+    // catalog's framework-gap output for multi-jurisdiction operators.
+    name: "Framework-gap jurisdiction coverage (Hard Rule #5)",
+    command: process.execPath,
+    args: [path.join(ROOT, "scripts", "check-framework-gap-coverage.js")],
+    ciJobName: "Data integrity (catalog + manifest snapshot)",
+  },
   {
     // Version-tag drift gate. Compares the tracked tree against a
     // baseline snapshot of pre-existing `// vX.Y.Z` comments and