@skillsmith/core 0.11.2 → 0.11.3

package/dist/src/security/scanner/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,kBAAkB,EAClB,UAAU,EACV,cAAc,EACd,oBAAoB,GACrB,MAAM,YAAY,CAAA;AAGnB,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,6BAA6B,EAC7B,mBAAmB,EACnB,yBAAyB,EACzB,YAAY,EACZ,uBAAuB,GACxB,MAAM,eAAe,CAAA;AAGtB,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAGjE,OAAO,EAAE,yBAAyB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAG3F,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAG/D,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,kBAAkB,EAClB,UAAU,EACV,cAAc,EACd,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,YAAY,CAAA;AAGnB,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,6BAA6B,EAC7B,mBAAmB,EACnB,yBAAyB,EACzB,YAAY,EACZ,uBAAuB,GACxB,MAAM,eAAe,CAAA;AAGtB,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAGjE,OAAO,EAAE,yBAAyB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAK3F,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAI1D,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,kBAAkB,CAAA;AAGzB,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,aAAa,EACb,eAAe,EACf,6BAA6B,EAC7B,+BAA+B,EAC/B,kCAAkC,GACnC,MAAM,gBAAgB,CAAA;AAGvB,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,+BAA+B,CAAA;AACtC,YAAY,EACV,mBAAmB,EACnB,mBAAmB,EACnB,kCAAkC,GACnC,MAAM,+BAA+B,CAAA;AAGtC,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAA;AAGjE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAG/D,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAA"}

package/dist/src/security/scanner/index.js

@@ -9,6 +9,19 @@ export { DEFAULT_ALLOWED_DOMAINS, SENSITIVE_PATH_PATTERNS, JAILBREAK_PATTERNS, S
 export { SEVERITY_WEIGHTS, CATEGORY_WEIGHTS } from './weights.js';
 // Regex utilities (for testing/extending)
 export { MAX_LINE_LENGTH_FOR_REGEX, safeRegexTest, safeRegexCheck } from './regex-utils.js';
+// Obfuscation-defeat primitive (SMI-4703: reused by
+// packages/doc-retrieval-mcp/src/security/memory-injection-scanner.ts's
+// normalization pipeline rather than reimplemented there)
+export { stripInvisible } from './SecurityScanner.exec.js';
+// Confusable/homoglyph normalization primitives (SMI-595 extraction, for testing/extending;
+// also reused by SMI-4703's memory-injection-scanner.ts confusable-fold step)
+export { CONFUSABLES, isFullwidthLatin, isMathAlphanumeric, confusableSkeleton, } from './confusables.js';
+// Typosquat detector (SMI-595)
+export { BRAND_ALIASES, levenshteinDistance, scanTyposquat, detectTyposquat, applyTyposquatEnforcementMode, resolveTyposquatEnforcementMode, DEFAULT_TYPOSQUAT_ENFORCEMENT_MODE, } from './typosquat.js';
+// Typosquat reference-name list builder (SMI-595)
+export { buildTyposquatReferenceList, DEFAULT_TOP_INSTALLED_LIMIT, } from './typosquat-reference-list.js';
+// describeSignals (SMI-595, for testing/extending)
+export { describeSignals } from './SecurityScanner.formatters.js';
 // Main class
 export { SecurityScanner, default } from './SecurityScanner.js';
 // Hostile-update comparator (SMI-5535, R0 Wave 2A)

package/dist/src/security/scanner/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/security/scanner/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAaH,mCAAmC;AACnC,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,6BAA6B,EAC7B,mBAAmB,EACnB,yBAAyB,EACzB,YAAY,EACZ,uBAAuB,GACxB,MAAM,eAAe,CAAA;AAEtB,kCAAkC;AAClC,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAEjE,0CAA0C;AAC1C,OAAO,EAAE,yBAAyB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAE3F,aAAa;AACb,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAE/D,mDAAmD;AACnD,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/security/scanner/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAcH,mCAAmC;AACnC,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,6BAA6B,EAC7B,mBAAmB,EACnB,yBAAyB,EACzB,YAAY,EACZ,uBAAuB,GACxB,MAAM,eAAe,CAAA;AAEtB,kCAAkC;AAClC,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAEjE,0CAA0C;AAC1C,OAAO,EAAE,yBAAyB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAE3F,oDAAoD;AACpD,wEAAwE;AACxE,0DAA0D;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAE1D,4FAA4F;AAC5F,8EAA8E;AAC9E,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,kBAAkB,CAAA;AAEzB,+BAA+B;AAC/B,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,aAAa,EACb,eAAe,EACf,6BAA6B,EAC7B,+BAA+B,EAC/B,kCAAkC,GACnC,MAAM,gBAAgB,CAAA;AAEvB,kDAAkD;AAClD,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,+BAA+B,CAAA;AAOtC,mDAAmD;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAA;AAEjE,aAAa;AACb,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAE/D,mDAAmD;AACnD,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAA"}

package/dist/src/security/scanner/types.d.ts

@@ -6,7 +6,7 @@
 /**
  * Types of security findings that can be detected
  */
-export type SecurityFindingType = 'url' | 'sensitive_path' | 'jailbreak' | 'suspicious_pattern' | 'social_engineering' | 'prompt_leaking' | 'data_exfiltration' | 'privilege_escalation' | 'ai_defence' | 'ssrf' | 'pii' | 'code_execution' | 'obfuscated_directive';
+export type SecurityFindingType = 'url' | 'sensitive_path' | 'jailbreak' | 'suspicious_pattern' | 'social_engineering' | 'prompt_leaking' | 'data_exfiltration' | 'privilege_escalation' | 'ai_defence' | 'ssrf' | 'pii' | 'code_execution' | 'obfuscated_directive' | 'typosquat';
 /**
  * Severity levels for security findings
  */
@@ -53,6 +53,7 @@ export interface RiskScoreBreakdown {
     pii: number;
     codeExecution: number;
     obfuscatedDirective: number;
+    typosquat: number;
 }
 /**
  * Comprehensive scan report with risk scoring
@@ -89,6 +90,16 @@ export interface HostileUpdateVerdict {
     /** One concrete human-readable sentence citing the deciding signal. */
     reason: string;
 }
+/**
+ * SMI-595: Rollout mode for the typosquat detector.
+ * - `off`   — detector output is discarded entirely (no findings surface).
+ * - `warn`  — shadow mode (default): findings surface but are capped at
+ *   `medium` severity regardless of the raw detector's confidence, so a
+ *   false positive on this early-stage heuristic can't alone quarantine
+ *   an install.
+ * - `block` — findings surface at their raw (uncapped) severity.
+ */
+export type TyposquatEnforcementMode = 'off' | 'warn' | 'block';
 /**
  * Configuration options for the security scanner
  */
@@ -98,5 +109,7 @@ export interface ScannerOptions {
     maxContentLength?: number;
     /** Risk score threshold for failing a scan (default: 40) */
     riskThreshold?: number;
+    /** SMI-595: typosquat detector enforcement mode (default: 'warn'). */
+    typosquatEnforcementMode?: TyposquatEnforcementMode;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/src/security/scanner/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAC3B,KAAK,GACL,gBAAgB,GAChB,WAAW,GACX,oBAAoB,GACpB,oBAAoB,GACpB,gBAAgB,GAChB,mBAAmB,GACnB,sBAAsB,GACtB,YAAY,GACZ,MAAM,GACN,KAAK,GACL,gBAAgB,GAChB,sBAAsB,CAAA;AAE1B;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAA;AAErE;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAA;AAEzD;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,mBAAmB,CAAA;IACzB,QAAQ,EAAE,gBAAgB,CAAA;IAC1B,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,iFAAiF;IACjF,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAChC,qEAAqE;IACrE,UAAU,CAAC,EAAE,iBAAiB,CAAA;IAC9B,0IAA0I;IAC1I,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAA;IACjB,iBAAiB,EAAE,MAAM,CAAA;IACzB,aAAa,EAAE,MAAM,CAAA;IACrB,gBAAgB,EAAE,MAAM,CAAA;IACxB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,cAAc,EAAE,MAAM,CAAA;IACtB,cAAc,EAAE,MAAM,CAAA;IACtB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;IACX,aAAa,EAAE,MAAM,CAAA;IACrB,mBAAmB,EAAE,MAAM,CAAA;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,OAAO,CAAA;IACf,QAAQ,EAAE,eAAe,EAAE,CAAA;IAC3B,SAAS,EAAE,IAAI,CAAA;IACf,cAAc,EAAE,MAAM,CAAA;IACtB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAA;IACjB,0CAA0C;IAC1C,aAAa,EAAE,kBAAkB,CAAA;CAClC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,QAAQ,GAAG,YAAY,GAAG,SAAS,CAAA;IAC5C,8EAA8E;IAC9E,WAAW,EAAE,eAAe,EAAE,CAAA;IAC9B,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAA;IACjB,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,4DAA4D;IAC5D,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAC3B,KAAK,GACL,gBAAgB,GAChB,WAAW,GACX,oBAAoB,GACpB,oBAAoB,GACpB,gBAAgB,GAChB,mBAAmB,GACnB,sBAAsB,GACtB,YAAY,GACZ,MAAM,GACN,KAAK,GACL,gBAAgB,GAChB,sBAAsB,GACtB,WAAW,CAAA;AAEf;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAA;AAErE;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAA;AAEzD;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,mBAAmB,CAAA;IACzB,QAAQ,EAAE,gBAAgB,CAAA;IAC1B,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,iFAAiF;IACjF,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAChC,qEAAqE;IACrE,UAAU,CAAC,EAAE,iBAAiB,CAAA;IAC9B,0IAA0I;IAC1I,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAA;IACjB,iBAAiB,EAAE,MAAM,CAAA;IACzB,aAAa,EAAE,MAAM,CAAA;IACrB,gBAAgB,EAAE,MAAM,CAAA;IACxB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,cAAc,EAAE,MAAM,CAAA;IACtB,cAAc,EAAE,MAAM,CAAA;IACtB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;IACX,aAAa,EAAE,MAAM,CAAA;IACrB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,OAAO,CAAA;IACf,QAAQ,EAAE,eAAe,EAAE,CAAA;IAC3B,SAAS,EAAE,IAAI,CAAA;IACf,cAAc,EAAE,MAAM,CAAA;IACtB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAA;IACjB,0CAA0C;IAC1C,aAAa,EAAE,kBAAkB,CAAA;CAClC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,QAAQ,GAAG,YAAY,GAAG,SAAS,CAAA;IAC5C,8EAA8E;IAC9E,WAAW,EAAE,eAAe,EAAE,CAAA;IAC9B,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAA;IACjB,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,wBAAwB,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,CAAA;AAE/D;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,4DAA4D;IAC5D,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,sEAAsE;IACtE,wBAAwB,CAAC,EAAE,wBAAwB,CAAA;CACpD"}

package/dist/src/security/scanner/typosquat-reference-list.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Typosquat reference-name list builder
+ * @module @skillsmith/core/security/scanner/typosquat-reference-list
+ *
+ * SMI-595 §2: a name-comparison detector is only as good as its reference
+ * list; a hand-maintained list goes stale the moment a new popular skill
+ * ships. The reference list is built from two sources:
+ *
+ *  1. Every skill published by an owner in `HIGH_TRUST_OWNERS`
+ *     (`packages/core/src/scripts/github-import/signal-of-intent.ts`).
+ *  2. The top-N installed skills by install count (N configurable, default
+ *     200) — covers popular community skills that aren't from a
+ *     `HIGH_TRUST_OWNERS` publisher but are popular enough to be worth
+ *     impersonating.
+ *
+ * Plus `BRAND_ALIASES` (`typosquat.ts` §3) — brand names not derivable from
+ * either source above.
+ *
+ * This module is a pure builder: it accepts the two source arrays already
+ * fetched by the caller (rather than querying a database or the GitHub API
+ * itself), so it stays cheaply unit-testable. Wiring a *live* caller that
+ * sources real `HIGH_TRUST_OWNERS`-published skill names and real
+ * install-count data, refreshed on the existing metadata-refresh cadence
+ * (`.claude/development/deployment-guide.md`'s "Metadata Refresh (every 4h
+ * :30)" job — no new cron), is a follow-up integration point, not built out
+ * this wave.
+ */
+/** A minimal reference-skill shape: only the fields this builder needs. */
+export interface ReferenceSkillEntry {
+    author: string;
+    name: string;
+}
+/** An installed skill together with its install count, for the top-N filter. */
+export interface InstalledSkillEntry extends ReferenceSkillEntry {
+    installCount: number;
+}
+/** SMI-595 §2: default top-N cutoff for installed skills folded into the list. */
+export declare const DEFAULT_TOP_INSTALLED_LIMIT = 200;
+export interface BuildTyposquatReferenceListOptions {
+    /** Skills published by an owner in `HIGH_TRUST_OWNERS`. */
+    highTrustOwnerSkills?: ReferenceSkillEntry[];
+    /** All installed skills with a known install count; only the top N (by
+     *  count, descending) are folded in. */
+    installedSkills?: InstalledSkillEntry[];
+    /** Max number of installed skills to fold in. Default: `DEFAULT_TOP_INSTALLED_LIMIT` (200). */
+    topInstalledLimit?: number;
+}
+/**
+ * Build the lowercase reference-name set used by `scanTyposquat()`. Combines
+ * HIGH_TRUST_OWNERS-published skill names, the top-N installed skills by
+ * install count, and the bare brand tokens from `BRAND_ALIASES`.
+ */
+export declare function buildTyposquatReferenceList(options?: BuildTyposquatReferenceListOptions): ReadonlySet<string>;
+//# sourceMappingURL=typosquat-reference-list.d.ts.map

package/dist/src/security/scanner/typosquat-reference-list.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"typosquat-reference-list.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/typosquat-reference-list.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,2EAA2E;AAC3E,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;CACb;AAED,gFAAgF;AAChF,MAAM,WAAW,mBAAoB,SAAQ,mBAAmB;IAC9D,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,kFAAkF;AAClF,eAAO,MAAM,2BAA2B,MAAM,CAAA;AAE9C,MAAM,WAAW,kCAAkC;IACjD,2DAA2D;IAC3D,oBAAoB,CAAC,EAAE,mBAAmB,EAAE,CAAA;IAC5C;4CACwC;IACxC,eAAe,CAAC,EAAE,mBAAmB,EAAE,CAAA;IACvC,+FAA+F;IAC/F,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,GAAE,kCAAuC,GAC/C,WAAW,CAAC,MAAM,CAAC,CAyBrB"}

package/dist/src/security/scanner/typosquat-reference-list.js

@@ -0,0 +1,55 @@
+/**
+ * Typosquat reference-name list builder
+ * @module @skillsmith/core/security/scanner/typosquat-reference-list
+ *
+ * SMI-595 §2: a name-comparison detector is only as good as its reference
+ * list; a hand-maintained list goes stale the moment a new popular skill
+ * ships. The reference list is built from two sources:
+ *
+ *  1. Every skill published by an owner in `HIGH_TRUST_OWNERS`
+ *     (`packages/core/src/scripts/github-import/signal-of-intent.ts`).
+ *  2. The top-N installed skills by install count (N configurable, default
+ *     200) — covers popular community skills that aren't from a
+ *     `HIGH_TRUST_OWNERS` publisher but are popular enough to be worth
+ *     impersonating.
+ *
+ * Plus `BRAND_ALIASES` (`typosquat.ts` §3) — brand names not derivable from
+ * either source above.
+ *
+ * This module is a pure builder: it accepts the two source arrays already
+ * fetched by the caller (rather than querying a database or the GitHub API
+ * itself), so it stays cheaply unit-testable. Wiring a *live* caller that
+ * sources real `HIGH_TRUST_OWNERS`-published skill names and real
+ * install-count data, refreshed on the existing metadata-refresh cadence
+ * (`.claude/development/deployment-guide.md`'s "Metadata Refresh (every 4h
+ * :30)" job — no new cron), is a follow-up integration point, not built out
+ * this wave.
+ */
+import { BRAND_ALIASES } from './typosquat.js';
+/** SMI-595 §2: default top-N cutoff for installed skills folded into the list. */
+export const DEFAULT_TOP_INSTALLED_LIMIT = 200;
+/**
+ * Build the lowercase reference-name set used by `scanTyposquat()`. Combines
+ * HIGH_TRUST_OWNERS-published skill names, the top-N installed skills by
+ * install count, and the bare brand tokens from `BRAND_ALIASES`.
+ */
+export function buildTyposquatReferenceList(options = {}) {
+    const { highTrustOwnerSkills = [], installedSkills = [], topInstalledLimit = DEFAULT_TOP_INSTALLED_LIMIT, } = options;
+    const names = new Set();
+    for (const entry of highTrustOwnerSkills) {
+        if (entry.name)
+            names.add(entry.name.toLowerCase());
+    }
+    const topInstalled = [...installedSkills]
+        .sort((a, b) => b.installCount - a.installCount)
+        .slice(0, Math.max(0, topInstalledLimit));
+    for (const entry of topInstalled) {
+        if (entry.name)
+            names.add(entry.name.toLowerCase());
+    }
+    for (const brand of Object.keys(BRAND_ALIASES)) {
+        names.add(brand.toLowerCase());
+    }
+    return names;
+}
+//# sourceMappingURL=typosquat-reference-list.js.map

package/dist/src/security/scanner/typosquat-reference-list.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"typosquat-reference-list.js","sourceRoot":"","sources":["../../../../src/security/scanner/typosquat-reference-list.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAa9C,kFAAkF;AAClF,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,CAAA;AAY9C;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CACzC,UAA8C,EAAE;IAEhD,MAAM,EACJ,oBAAoB,GAAG,EAAE,EACzB,eAAe,GAAG,EAAE,EACpB,iBAAiB,GAAG,2BAA2B,GAChD,GAAG,OAAO,CAAA;IAEX,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAE/B,KAAK,MAAM,KAAK,IAAI,oBAAoB,EAAE,CAAC;QACzC,IAAI,KAAK,CAAC,IAAI;YAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;IACrD,CAAC;IAED,MAAM,YAAY,GAAG,CAAC,GAAG,eAAe,CAAC;SACtC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC;SAC/C,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAA;IAC3C,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,IAAI,KAAK,CAAC,IAAI;YAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;IACrD,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QAC/C,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAA;IAChC,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/src/security/scanner/typosquat-reference-list.test.d.ts

@@ -0,0 +1,5 @@
+/**
+ * SMI-595 §2: typosquat-reference-list.ts — reference-list builder tests.
+ */
+export {};
+//# sourceMappingURL=typosquat-reference-list.test.d.ts.map

package/dist/src/security/scanner/typosquat-reference-list.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"typosquat-reference-list.test.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/typosquat-reference-list.test.ts"],"names":[],"mappings":"AAAA;;GAEG"}

package/dist/src/security/scanner/typosquat-reference-list.test.js

@@ -0,0 +1,52 @@
+/**
+ * SMI-595 §2: typosquat-reference-list.ts — reference-list builder tests.
+ */
+import { describe, it, expect } from 'vitest';
+import { buildTyposquatReferenceList, DEFAULT_TOP_INSTALLED_LIMIT, } from './typosquat-reference-list.js';
+import { BRAND_ALIASES } from './typosquat.js';
+describe('buildTyposquatReferenceList (SMI-595 §2)', () => {
+    it('folds in HIGH_TRUST_OWNERS-published skill names, lowercased', () => {
+        const list = buildTyposquatReferenceList({
+            highTrustOwnerSkills: [{ author: 'anthropics', name: 'Claude-Helper' }],
+        });
+        expect(list.has('claude-helper')).toBe(true);
+    });
+    it('folds in the top-N installed skills by install count', () => {
+        const list = buildTyposquatReferenceList({
+            installedSkills: [
+                { author: 'a', name: 'popular-skill', installCount: 1000 },
+                { author: 'b', name: 'niche-skill', installCount: 1 },
+            ],
+            topInstalledLimit: 1,
+        });
+        expect(list.has('popular-skill')).toBe(true);
+        expect(list.has('niche-skill')).toBe(false); // cut off by the limit
+    });
+    it('respects the default top-N limit of 200', () => {
+        expect(DEFAULT_TOP_INSTALLED_LIMIT).toBe(200);
+        const installedSkills = Array.from({ length: 250 }, (_, i) => ({
+            author: 'a',
+            name: `skill-${i}`,
+            installCount: 250 - i, // skill-0 has the highest count
+        }));
+        const list = buildTyposquatReferenceList({ installedSkills });
+        expect(list.has('skill-0')).toBe(true); // rank 1, well within top 200
+        expect(list.has('skill-249')).toBe(false); // rank 250, cut off
+    });
+    it('always includes the BRAND_ALIASES keys, even with no other sources', () => {
+        const list = buildTyposquatReferenceList();
+        for (const brand of Object.keys(BRAND_ALIASES)) {
+            expect(list.has(brand)).toBe(true);
+        }
+    });
+    it('deduplicates a name that appears in both sources', () => {
+        const list = buildTyposquatReferenceList({
+            highTrustOwnerSkills: [{ author: 'anthropics', name: 'shared-skill' }],
+            installedSkills: [{ author: 'anthropics', name: 'shared-skill', installCount: 5 }],
+        });
+        // A Set naturally dedupes; just confirm the entry is present exactly once
+        // (Set semantics already guarantee this, this is a readability check).
+        expect([...list].filter((n) => n === 'shared-skill')).toHaveLength(1);
+    });
+});
+//# sourceMappingURL=typosquat-reference-list.test.js.map

package/dist/src/security/scanner/typosquat-reference-list.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"typosquat-reference-list.test.js","sourceRoot":"","sources":["../../../../src/security/scanner/typosquat-reference-list.test.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAE9C,QAAQ,CAAC,0CAA0C,EAAE,GAAG,EAAE;IACxD,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,IAAI,GAAG,2BAA2B,CAAC;YACvC,oBAAoB,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;SACxE,CAAC,CAAA;QACF,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC9C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,IAAI,GAAG,2BAA2B,CAAC;YACvC,eAAe,EAAE;gBACf,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,eAAe,EAAE,YAAY,EAAE,IAAI,EAAE;gBAC1D,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,EAAE;aACtD;YACD,iBAAiB,EAAE,CAAC;SACrB,CAAC,CAAA;QACF,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC5C,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA,CAAC,uBAAuB;IACrE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,CAAC,2BAA2B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC7C,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7D,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,SAAS,CAAC,EAAE;YAClB,YAAY,EAAE,GAAG,GAAG,CAAC,EAAE,gCAAgC;SACxD,CAAC,CAAC,CAAA;QACH,MAAM,IAAI,GAAG,2BAA2B,CAAC,EAAE,eAAe,EAAE,CAAC,CAAA;QAC7D,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA,CAAC,8BAA8B;QACrE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA,CAAC,oBAAoB;IAChE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,IAAI,GAAG,2BAA2B,EAAE,CAAA;QAC1C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YAC/C,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACpC,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,IAAI,GAAG,2BAA2B,CAAC;YACvC,oBAAoB,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;YACtE,eAAe,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;SACnF,CAAC,CAAA;QACF,0EAA0E;QAC1E,uEAAuE;QACvE,MAAM,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,cAAc,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IACvE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/src/security/scanner/typosquat.d.ts

@@ -0,0 +1,100 @@
+/**
+ * Typosquat / impersonation detector for skill names
+ * @module @skillsmith/core/security/scanner/typosquat
+ *
+ * SMI-595: no Levenshtein-distance / character-substitution / homoglyph
+ * name-comparison detector against a popular-skill-name list existed
+ * anywhere in this codebase prior to this module — content-based scanning
+ * (`SecurityScanner`) cannot catch a name-only impersonation attempt where
+ * the skill's actual content is benign (e.g. `anthopic/claude-helper` or
+ * `аnthropic/skill` with a Cyrillic `а`).
+ *
+ * Three independent checks, deliberately NOT conflated:
+ *
+ *  1. **Exact-skeleton impersonation** — fires ONLY on exact confusable-folded
+ *     equality to a reference name, never on substring/affix match. This is a
+ *     deliberately narrow rule: `anthropic-community-mcp`, `unofficial-claude-
+ *     tools`, `awesome-gemini-skills` are normal, non-malicious community
+ *     naming conventions that happen to contain a brand token and must NOT be
+ *     blocked by this rule.
+ *  2. **Levenshtein edit-distance ≤2** — catches near-miss variants
+ *     (`anthropc`, `anthropic1`, `anthropci`) that don't fold to an exact
+ *     skeleton match but are still suspiciously close to a reference name.
+ *  3. **Authority-claiming affix** — INDEPENDENT of #1: a candidate containing
+ *     a reference brand token PLUS an affix that claims official status
+ *     (`-official`, `-verified`, `-authentic`, `-genuine`) is flagged
+ *     regardless of whether it passes the exact-skeleton check, because the
+ *     affix itself is the impersonation vector. Benign functional affixes
+ *     (`-mcp`, `-tools`, `-community`) do NOT trigger this — they simply
+ *     aren't in the curated affix list.
+ *
+ * Consumer-surface decision (Wave 1 Step 6): the install-time scanner path
+ * (risk-score wiring — see types.ts/weights.ts/SecurityScanner.helpers.ts) is
+ * the primary *enforcement* surface (blocks/warns before a skill lands on
+ * disk). `skill_audit` (existing MCP tool) is the recommended primary
+ * *consumer-facing* surface for on-demand querying of typosquat status on an
+ * already-installed skill — live-wiring that tool to this detector is
+ * deferred to a filed follow-up (SMI-5711), out of this wave's scope.
+ *
+ * Integration note: `SecurityScanner.scan()` takes `content` only, not a
+ * skill name/author — this wave does NOT change that signature or thread a
+ * live reference list through `scripts/skill-scanner/scanner.ts`'s scan
+ * pipeline (that would require sourcing real HIGH_TRUST_OWNERS-published
+ * skill data and real install-count data, which is a live-data/infra
+ * integration, not a detector-design concern). This module is a
+ * self-contained, fully-tested unit ready to be wired into that pipeline as a
+ * follow-up.
+ */
+import type { SecurityFinding, TyposquatEnforcementMode } from './types.js';
+export type { TyposquatEnforcementMode };
+/**
+ * Brand names that are NOT derivable from `HIGH_TRUST_OWNERS`' GitHub owner
+ * slugs (`signal-of-intent.ts`) or from the installed-skill corpus at all —
+ * the product/brand a typosquat would actually target (`anthropic`, `claude`,
+ * `gemini`) differs from the GitHub org slug that publishes it (`anthropics`,
+ * `google-gemini`). Folded into the reference list
+ * (`typosquat-reference-list.ts`) as bare-brand reference entries, and also
+ * used as the curated "brand token" corpus for the authority-claiming-affix
+ * check below (§1 rule 3) — a narrower, independent check from the
+ * exact-skeleton rule (§1 rule 1).
+ *
+ * Values cross-checked against `HIGH_TRUST_OWNERS`
+ * (`packages/core/src/scripts/github-import/signal-of-intent.ts`) — kept in
+ * sync manually, same convention as that file's own documented
+ * cross-boundary-import constraint.
+ */
+export declare const BRAND_ALIASES: Readonly<Record<string, string>>;
+/**
+ * Standard iterative-DP Levenshtein edit distance (insertion/deletion/
+ * substitution). Inputs here are short skill-name strings, so an O(n*m) table
+ * is more than fast enough — no early-exit optimization needed.
+ */
+export declare function levenshteinDistance(a: string, b: string): number;
+/**
+ * Run all three checks against a single candidate skill name/id. Returns
+ * RAW findings (uncapped severity) — callers apply
+ * `applyTyposquatEnforcementMode()` before surfacing them, per the
+ * `typosquatEnforcementMode` rollout config (§6).
+ *
+ * `referenceNames` should already be lowercase (as produced by
+ * `buildTyposquatReferenceList()` in `typosquat-reference-list.ts`).
+ */
+export declare function scanTyposquat(candidateName: string, referenceNames: ReadonlySet<string>): SecurityFinding[];
+/** SMI-595: default rollout mode — shadow mode, matching the
+ *  `concurrency-audit-pr.yml` precedent (shadow for a period, then promote). */
+export declare const DEFAULT_TYPOSQUAT_ENFORCEMENT_MODE: TyposquatEnforcementMode;
+/** Resolve the effective enforcement mode, applying the default when unset. */
+export declare function resolveTyposquatEnforcementMode(mode?: TyposquatEnforcementMode): TyposquatEnforcementMode;
+/**
+ * Apply the rollout mode to raw typosquat findings:
+ * - `off`   — discard all findings.
+ * - `warn`  — cap severity at `medium` regardless of the raw detector's
+ *   confidence (confidence is left untouched — only severity is capped).
+ * - `block` — pass findings through at their raw severity.
+ */
+export declare function applyTyposquatEnforcementMode(findings: SecurityFinding[], mode?: TyposquatEnforcementMode): SecurityFinding[];
+/**
+ * Convenience one-shot: detect + apply the enforcement mode in a single call.
+ */
+export declare function detectTyposquat(candidateName: string, referenceNames: ReadonlySet<string>, mode?: TyposquatEnforcementMode): SecurityFinding[];
+//# sourceMappingURL=typosquat.d.ts.map

package/dist/src/security/scanner/typosquat.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"typosquat.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/typosquat.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAG3E,YAAY,EAAE,wBAAwB,EAAE,CAAA;AAMxC;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAO1D,CAAA;AAmDD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAyBhE;AAMD;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAC3B,aAAa,EAAE,MAAM,EACrB,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,GAClC,eAAe,EAAE,CAgEnB;AAMD;gFACgF;AAChF,eAAO,MAAM,kCAAkC,EAAE,wBAAiC,CAAA;AAElF,+EAA+E;AAC/E,wBAAgB,+BAA+B,CAC7C,IAAI,CAAC,EAAE,wBAAwB,GAC9B,wBAAwB,CAE1B;AAID;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,eAAe,EAAE,EAC3B,IAAI,GAAE,wBAA6D,GAClE,eAAe,EAAE,CAQnB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,aAAa,EAAE,MAAM,EACrB,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,EACnC,IAAI,GAAE,wBAA6D,GAClE,eAAe,EAAE,CAEnB"}

package/dist/src/security/scanner/typosquat.js

@@ -0,0 +1,256 @@
+/**
+ * Typosquat / impersonation detector for skill names
+ * @module @skillsmith/core/security/scanner/typosquat
+ *
+ * SMI-595: no Levenshtein-distance / character-substitution / homoglyph
+ * name-comparison detector against a popular-skill-name list existed
+ * anywhere in this codebase prior to this module — content-based scanning
+ * (`SecurityScanner`) cannot catch a name-only impersonation attempt where
+ * the skill's actual content is benign (e.g. `anthopic/claude-helper` or
+ * `аnthropic/skill` with a Cyrillic `а`).
+ *
+ * Three independent checks, deliberately NOT conflated:
+ *
+ *  1. **Exact-skeleton impersonation** — fires ONLY on exact confusable-folded
+ *     equality to a reference name, never on substring/affix match. This is a
+ *     deliberately narrow rule: `anthropic-community-mcp`, `unofficial-claude-
+ *     tools`, `awesome-gemini-skills` are normal, non-malicious community
+ *     naming conventions that happen to contain a brand token and must NOT be
+ *     blocked by this rule.
+ *  2. **Levenshtein edit-distance ≤2** — catches near-miss variants
+ *     (`anthropc`, `anthropic1`, `anthropci`) that don't fold to an exact
+ *     skeleton match but are still suspiciously close to a reference name.
+ *  3. **Authority-claiming affix** — INDEPENDENT of #1: a candidate containing
+ *     a reference brand token PLUS an affix that claims official status
+ *     (`-official`, `-verified`, `-authentic`, `-genuine`) is flagged
+ *     regardless of whether it passes the exact-skeleton check, because the
+ *     affix itself is the impersonation vector. Benign functional affixes
+ *     (`-mcp`, `-tools`, `-community`) do NOT trigger this — they simply
+ *     aren't in the curated affix list.
+ *
+ * Consumer-surface decision (Wave 1 Step 6): the install-time scanner path
+ * (risk-score wiring — see types.ts/weights.ts/SecurityScanner.helpers.ts) is
+ * the primary *enforcement* surface (blocks/warns before a skill lands on
+ * disk). `skill_audit` (existing MCP tool) is the recommended primary
+ * *consumer-facing* surface for on-demand querying of typosquat status on an
+ * already-installed skill — live-wiring that tool to this detector is
+ * deferred to a filed follow-up (SMI-5711), out of this wave's scope.
+ *
+ * Integration note: `SecurityScanner.scan()` takes `content` only, not a
+ * skill name/author — this wave does NOT change that signature or thread a
+ * live reference list through `scripts/skill-scanner/scanner.ts`'s scan
+ * pipeline (that would require sourcing real HIGH_TRUST_OWNERS-published
+ * skill data and real install-count data, which is a live-data/infra
+ * integration, not a detector-design concern). This module is a
+ * self-contained, fully-tested unit ready to be wired into that pipeline as a
+ * follow-up.
+ */
+import { confusableSkeleton } from './confusables.js';
+// ============================================================================
+// Brand aliases (§3)
+// ============================================================================
+/**
+ * Brand names that are NOT derivable from `HIGH_TRUST_OWNERS`' GitHub owner
+ * slugs (`signal-of-intent.ts`) or from the installed-skill corpus at all —
+ * the product/brand a typosquat would actually target (`anthropic`, `claude`,
+ * `gemini`) differs from the GitHub org slug that publishes it (`anthropics`,
+ * `google-gemini`). Folded into the reference list
+ * (`typosquat-reference-list.ts`) as bare-brand reference entries, and also
+ * used as the curated "brand token" corpus for the authority-claiming-affix
+ * check below (§1 rule 3) — a narrower, independent check from the
+ * exact-skeleton rule (§1 rule 1).
+ *
+ * Values cross-checked against `HIGH_TRUST_OWNERS`
+ * (`packages/core/src/scripts/github-import/signal-of-intent.ts`) — kept in
+ * sync manually, same convention as that file's own documented
+ * cross-boundary-import constraint.
+ */
+export const BRAND_ALIASES = {
+    anthropic: 'anthropics',
+    claude: 'anthropics',
+    gemini: 'google-gemini',
+    copilot: 'microsoft',
+    vercel: 'vercel-labs',
+    salesforce: 'SalesforceCommerceCloud',
+};
+// ============================================================================
+// Authority-claiming affixes (§1 rule 3 / Change #5)
+// ============================================================================
+/**
+ * A small, curated "claims official status" affix list. Deliberately narrow —
+ * benign functional affixes (`mcp`, `tools`, `community`, `helper`, ...)
+ * simply aren't in this list, so they never trigger this check.
+ */
+const AUTHORITY_CLAIMING_AFFIXES = new Set([
+    'official',
+    'verified',
+    'authentic',
+    'genuine',
+]);
+/** Minimum reference-name length considered for the Levenshtein check (§1 rule 2).
+ *  Guards against noisy false positives on very short brand tokens where an
+ *  edit distance of 2 covers a large fraction of unrelated short words. */
+const MIN_LEVENSHTEIN_REFERENCE_LENGTH = 6;
+/** Maximum Levenshtein edit distance considered a typosquat variant. */
+const MAX_LEVENSHTEIN_DISTANCE = 2;
+// ============================================================================
+// Folding / tokenization helpers
+// ============================================================================
+/**
+ * Fold a candidate/reference name through the confusable-skeleton map, then
+ * NFKC, then lowercase — the comparison key used by the exact-skeleton and
+ * Levenshtein checks (§1 rules 1 and 2).
+ */
+function foldSkillName(raw) {
+    return confusableSkeleton(raw).normalize('NFKC').toLowerCase();
+}
+/** Split a name into lowercase alphanumeric tokens on any separator. */
+function tokenize(raw) {
+    return raw
+        .toLowerCase()
+        .split(/[^a-z0-9]+/i)
+        .filter((t) => t.length > 0);
+}
+// ============================================================================
+// Levenshtein distance
+// ============================================================================
+/**
+ * Standard iterative-DP Levenshtein edit distance (insertion/deletion/
+ * substitution). Inputs here are short skill-name strings, so an O(n*m) table
+ * is more than fast enough — no early-exit optimization needed.
+ */
+export function levenshteinDistance(a, b) {
+    if (a === b)
+        return 0;
+    const aLen = a.length;
+    const bLen = b.length;
+    if (aLen === 0)
+        return bLen;
+    if (bLen === 0)
+        return aLen;
+    let prevRow = new Array(bLen + 1);
+    let currRow = new Array(bLen + 1);
+    for (let j = 0; j <= bLen; j++)
+        prevRow[j] = j;
+    for (let i = 1; i <= aLen; i++) {
+        currRow[0] = i;
+        for (let j = 1; j <= bLen; j++) {
+            const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+            currRow[j] = Math.min(prevRow[j] + 1, // deletion
+            currRow[j - 1] + 1, // insertion
+            prevRow[j - 1] + cost // substitution
+            );
+        }
+        ;
+        [prevRow, currRow] = [currRow, prevRow];
+    }
+    return prevRow[bLen];
+}
+// ============================================================================
+// Detector
+// ============================================================================
+/**
+ * Run all three checks against a single candidate skill name/id. Returns
+ * RAW findings (uncapped severity) — callers apply
+ * `applyTyposquatEnforcementMode()` before surfacing them, per the
+ * `typosquatEnforcementMode` rollout config (§6).
+ *
+ * `referenceNames` should already be lowercase (as produced by
+ * `buildTyposquatReferenceList()` in `typosquat-reference-list.ts`).
+ */
+export function scanTyposquat(candidateName, referenceNames) {
+    const findings = [];
+    const candidateLower = candidateName.toLowerCase();
+    const foldedCandidate = foldSkillName(candidateName);
+    // ---- Rule 1: exact-skeleton impersonation --------------------------------
+    // Fires ONLY when folding changed something meaningful (a confusable
+    // substitution / fullwidth / math-alphanumeric fold occurred) AND the
+    // folded form exactly equals a reference name. A candidate whose lowercase
+    // form already equals the reference (pure case difference, or the
+    // candidate IS the reference) is not an impersonation attempt.
+    for (const reference of referenceNames) {
+        if (foldedCandidate === reference && candidateLower !== reference) {
+            findings.push({
+                type: 'typosquat',
+                severity: 'critical',
+                confidence: 'high',
+                message: `Skill name folds to the same confusable-skeleton as a well-known reference name ("${reference}") but is not byte-identical to it.`,
+                location: candidateName,
+                category: 'typosquat:impersonation-exact-skeleton',
+            });
+            break;
+        }
+    }
+    // ---- Rule 2: Levenshtein edit-distance <= 2 ------------------------------
+    // Skipped once rule 1 already fired for this candidate (distance 0 in
+    // folded space is rule 1's job, not rule 2's — no double-counting).
+    if (findings.length === 0) {
+        for (const reference of referenceNames) {
+            if (reference.length < MIN_LEVENSHTEIN_REFERENCE_LENGTH)
+                continue;
+            // Cheap length-delta pre-filter before the O(n*m) DP.
+            if (Math.abs(foldedCandidate.length - reference.length) > MAX_LEVENSHTEIN_DISTANCE)
+                continue;
+            const distance = levenshteinDistance(foldedCandidate, reference);
+            if (distance > 0 && distance <= MAX_LEVENSHTEIN_DISTANCE) {
+                findings.push({
+                    type: 'typosquat',
+                    severity: 'high',
+                    confidence: 'medium',
+                    message: `Skill name is an edit-distance-${distance} variant of a well-known reference name ("${reference}").`,
+                    location: candidateName,
+                    category: 'typosquat:levenshtein',
+                });
+                break;
+            }
+        }
+    }
+    // ---- Rule 3: authority-claiming affix (independent of rule 1) -----------
+    const tokens = tokenize(candidateName);
+    const hasBrandToken = tokens.some((t) => Object.prototype.hasOwnProperty.call(BRAND_ALIASES, t));
+    const hasAuthorityAffix = tokens.some((t) => AUTHORITY_CLAIMING_AFFIXES.has(t));
+    if (hasBrandToken && hasAuthorityAffix) {
+        findings.push({
+            type: 'typosquat',
+            severity: 'critical',
+            confidence: 'high',
+            message: `Skill name combines a known brand token with an affix that claims official/verified status.`,
+            location: candidateName,
+            category: 'typosquat:authority-affix',
+        });
+    }
+    return findings;
+}
+// ============================================================================
+// Enforcement mode (§6)
+// ============================================================================
+/** SMI-595: default rollout mode — shadow mode, matching the
+ *  `concurrency-audit-pr.yml` precedent (shadow for a period, then promote). */
+export const DEFAULT_TYPOSQUAT_ENFORCEMENT_MODE = 'warn';
+/** Resolve the effective enforcement mode, applying the default when unset. */
+export function resolveTyposquatEnforcementMode(mode) {
+    return mode ?? DEFAULT_TYPOSQUAT_ENFORCEMENT_MODE;
+}
+const DOWNGRADE_TO_MEDIUM = new Set(['high', 'critical']);
+/**
+ * Apply the rollout mode to raw typosquat findings:
+ * - `off`   — discard all findings.
+ * - `warn`  — cap severity at `medium` regardless of the raw detector's
+ *   confidence (confidence is left untouched — only severity is capped).
+ * - `block` — pass findings through at their raw severity.
+ */
+export function applyTyposquatEnforcementMode(findings, mode = DEFAULT_TYPOSQUAT_ENFORCEMENT_MODE) {
+    if (mode === 'off')
+        return [];
+    if (mode === 'warn') {
+        return findings.map((finding) => DOWNGRADE_TO_MEDIUM.has(finding.severity) ? { ...finding, severity: 'medium' } : finding);
+    }
+    return findings;
+}
+/**
+ * Convenience one-shot: detect + apply the enforcement mode in a single call.
+ */
+export function detectTyposquat(candidateName, referenceNames, mode = DEFAULT_TYPOSQUAT_ENFORCEMENT_MODE) {
+    return applyTyposquatEnforcementMode(scanTyposquat(candidateName, referenceNames), mode);
+}
+//# sourceMappingURL=typosquat.js.map