@slicedearth/whoisleuth-cli 2.4.0 → 2.6.0

package/lib/static-html-analysis.mjs

@@ -4,6 +4,7 @@
 import { htmlTreeEvents, isHtmlElement, parseBoundedHtml, MAX_STATIC_HTML_CHARS, MAX_STATIC_HTML_TAGS, MAX_STATIC_HTML_TREE_EVENTS, } from "./bounded-html-document.mjs";
 import { MAX_CSP_META_POLICIES, MAX_RESPONSE_POLICY_HEADER_BYTES, } from "./response-policy.mjs";
 import { MAX_FAVICON_BYTES, MAX_FAVICON_CANDIDATES } from "./outbound-request-bounds.mjs";
+import { CREDENTIAL_CATEGORY_NAMES, MAX_CREDENTIAL_FORMS, MAX_CREDENTIAL_INPUTS } from "../packages/evidence/credential-form-attribution.mjs";
 import { MAX_PAGE_PUBLICATION_DECLARATIONS, MAX_PAGE_PUBLICATION_META_ELEMENTS, MAX_PAGE_PUBLICATION_ROBOTS_DIRECTIVES, } from "./homepage-metadata-contract.mjs";
 const MAX_STATIC_STRUCTURE_TOKENS = MAX_STATIC_HTML_TREE_EVENTS;
 const MAX_TAG_LENGTH = 4_096;
@@ -14,8 +15,8 @@ const MAX_SCRIPT_MEDIA_TYPE_LENGTH = 120;
 const MAX_INLINE_SCRIPT_TOTAL_CHARS = 65_536;
 const MAX_INLINE_SCRIPT_CHARS = MAX_INLINE_SCRIPT_TOTAL_CHARS;
 const MAX_STATIC_VISIBLE_TEXT_CHARS = MAX_STATIC_HTML_CHARS;
-const MAX_STATIC_FORMS = 50;
-const MAX_STATIC_INPUTS = 500;
+const MAX_STATIC_FORMS = MAX_CREDENTIAL_FORMS;
+const MAX_STATIC_INPUTS = MAX_CREDENTIAL_INPUTS;
 const MAX_STATIC_PUBLICATION_META_ELEMENTS = MAX_PAGE_PUBLICATION_META_ELEMENTS;
 const MAX_STATIC_PUBLICATION_DECLARATIONS = MAX_PAGE_PUBLICATION_DECLARATIONS;
 const MAX_STATIC_ROBOTS_DIRECTIVES = MAX_PAGE_PUBLICATION_ROBOTS_DIRECTIVES;
@@ -197,6 +198,29 @@ function stylesheetCandidate(attributes) {
         truncated: rel.truncated || href.truncated || disabled.truncated || media.truncated,
     };
 }
+export function staticControlDisabled(elements, index, firstLegends) {
+    const hasDisabled = (element) => element.attributes.some(attribute => attribute.name === 'disabled');
+    if (hasDisabled(elements[index]))
+        return true;
+    for (let parent = elements[index]?.parent ?? null; parent !== null; parent = elements[parent]?.parent ?? null) {
+        const fieldset = elements[parent];
+        if (!fieldset.html || fieldset.name !== 'fieldset' || !hasDisabled(fieldset))
+            continue;
+        const legend = firstLegends.get(parent);
+        let underLegend = false;
+        for (let current = index; current !== null; current = elements[current]?.parent ?? null) {
+            if (current === legend) {
+                underLegend = true;
+                break;
+            }
+            if (current === parent)
+                break;
+        }
+        if (!underLegend)
+            return true;
+    }
+    return false;
+}
 function analyzeStaticHtml(value, options = {}) {
     const parsed = parseBoundedHtml(value);
     const { inputLimitReached } = parsed;
@@ -209,6 +233,7 @@ function analyzeStaticHtml(value, options = {}) {
     const iconCounts = [0, 0];
     const tokens = [];
     const elementStack = [];
+    const firstLegends = new Map();
     const visibleTextParts = [];
     const structureTokens = [];
     const scripts = [];
@@ -386,6 +411,8 @@ function analyzeStaticHtml(value, options = {}) {
             };
             elementStack.push(elements.length);
             elements.push(element);
+            if (htmlElement && tagName === 'legend' && element.parent !== null && !firstLegends.has(element.parent))
+                firstLegends.set(element.parent, elements.length - 1);
             appendToken({ kind: 'start', element });
             // Foreign drawing attributes are not HTML technology, form or resource
             // inputs. Their per-element omission still reaches fingerprinting, but
@@ -628,7 +655,8 @@ function analyzeStaticHtml(value, options = {}) {
                 }
                 else {
                     forms.inputsObserved += 1;
-                    const categories = inputCategories(token.attrs);
+                    const categories = staticControlDisabled(elements, elements.length - 1, firstLegends)
+                        ? { values: [], truncated: false } : inputCategories(token.attrs);
                     if (categories.truncated)
                         forms.truncated = true;
                     if (categories.values.length)
@@ -716,4 +744,4 @@ function analyzeStaticHtml(value, options = {}) {
         inlineCharactersExamined,
     };
 }
-export { MAX_ATTRIBUTES_PER_TAG, MAX_INLINE_SCRIPT_CHARS, MAX_INLINE_SCRIPT_TOTAL_CHARS, MAX_SCRIPT_ELEMENTS, MAX_SCRIPT_MEDIA_TYPE_LENGTH, MAX_STATIC_FORMS, MAX_STATIC_HTML_CHARS, MAX_STATIC_INPUTS, MAX_STATIC_PUBLICATION_META_ELEMENTS, MAX_STATIC_PUBLICATION_DECLARATIONS, MAX_STATIC_ROBOTS_DIRECTIVES, MAX_STATIC_HTML_TAGS, MAX_STATIC_STRUCTURE_TOKENS, MAX_STATIC_VISIBLE_TEXT_CHARS, MAX_TAG_LENGTH, analyzeStaticHtml, };
+export { MAX_ATTRIBUTES_PER_TAG, MAX_INLINE_SCRIPT_CHARS, MAX_INLINE_SCRIPT_TOTAL_CHARS, MAX_SCRIPT_ELEMENTS, MAX_SCRIPT_REFERENCE_LENGTH, MAX_SCRIPT_MEDIA_TYPE_LENGTH, MAX_STATIC_FORMS, MAX_STATIC_HTML_CHARS, MAX_STATIC_INPUTS, MAX_STATIC_PUBLICATION_META_ELEMENTS, MAX_STATIC_PUBLICATION_DECLARATIONS, MAX_STATIC_ROBOTS_DIRECTIVES, MAX_STATIC_HTML_TAGS, MAX_STATIC_STRUCTURE_TOKENS, MAX_STATIC_VISIBLE_TEXT_CHARS, MAX_TAG_LENGTH, analyzeStaticHtml, inputCategories as classifyStaticCredentialInput, };

package/lib/structured-data-identity.mjs

@@ -6,7 +6,7 @@
 import { domainToASCII } from 'node:url';
 import { createObservation } from "../packages/evidence/observation.mjs";
 import { MAX_STRUCTURED_DATA_ENTITIES, MAX_STRUCTURED_DATA_SAME_AS_HOSTS, STRUCTURED_DATA_IDENTITY_VERSION, } from "./lookup-child-profile-contract.mjs";
-import { isUriShapedLabel } from "./portable-generator.mjs";
+import { isUriShapedLabel } from "../packages/analysis/portable-generator.mjs";
 import { analyzeStaticHtml, } from "./static-html-analysis.mjs";
 const MAX_STRUCTURED_DATA_SCRIPTS = 8;
 const MAX_STRUCTURED_DATA_SCRIPT_CHARS = 16_384;

package/lib/technology-evidence-role.mjs

@@ -1,51 +1 @@
-const TECHNOLOGY_EVIDENCE_ROLE_ORDER = Object.freeze([
-    'observed_edge',
-    'application_platform',
-    'framework_runtime',
-    'embedded_dependency',
-]);
-const TECHNOLOGY_EVIDENCE_ROLE_SET = new Set(TECHNOLOGY_EVIDENCE_ROLE_ORDER);
-function record(value) {
-    return value && typeof value === 'object' && !Array.isArray(value)
-        ? value
-        : {};
-}
-function technologyEvidenceRoles(value) {
-    const finding = record(value);
-    const roles = new Set();
-    let hasExplicitRole = false;
-    for (const role of Array.isArray(finding.roles) ? finding.roles.slice(0, 4) : []) {
-        if (typeof role === 'string' && TECHNOLOGY_EVIDENCE_ROLE_SET.has(role)) {
-            roles.add(role);
-            hasExplicitRole = true;
-        }
-    }
-    const evidenceValues = Array.isArray(finding.evidence) ? finding.evidence.slice(0, 4) : [];
-    for (const evidenceValue of evidenceValues) {
-        const evidence = record(evidenceValue);
-        if (typeof evidence.role === 'string'
-            && TECHNOLOGY_EVIDENCE_ROLE_SET.has(evidence.role)) {
-            roles.add(evidence.role);
-            hasExplicitRole = true;
-        }
-    }
-    if (!hasExplicitRole) {
-        const resourceOriginOnly = evidenceValues.length > 0
-            && evidenceValues.every((evidence) => (String(record(evidence).source).toLowerCase() === 'resource origin'));
-        if (evidenceValues.some((evidence) => String(record(evidence).source).toLowerCase() === 'resource origin')) {
-            roles.add('embedded_dependency');
-        }
-        if (!resourceOriginOnly) {
-            const category = String(finding.category).toLowerCase();
-            if (category === 'delivery platform')
-                roles.add('observed_edge');
-            else if (['application runtime', 'web framework', 'static site generator', 'web server'].includes(category)) {
-                roles.add('framework_runtime');
-            }
-            else
-                roles.add('application_platform');
-        }
-    }
-    return TECHNOLOGY_EVIDENCE_ROLE_ORDER.filter((role) => roles.has(role));
-}
-export { TECHNOLOGY_EVIDENCE_ROLE_ORDER, technologyEvidenceRoles, };
+export { TECHNOLOGY_EVIDENCE_ROLE_ORDER, technologyEvidenceRoles, } from "../packages/evidence/technology-evidence-role.mjs";

package/lib/threat-intelligence-manifests.mjs

@@ -1,7 +1,7 @@
 import { registerCuratedConnector, registerThreatIntelligenceProvider, isCuratedConnectorDefinition, isThreatIntelligenceProvider, } from "./threat-intelligence-definition-registry.mjs";
 import { CURATED_CONNECTOR_CONTRACT_VERSION, MAX_CACHE_TTL_MS, MAX_CONNECTOR_ENTITIES, MAX_CONNECTOR_RELATIONSHIPS, MAX_RESPONSE_BYTES, MAX_TIMEOUT_MS, THREAT_INTELLIGENCE_CONTRACT_VERSION, } from "./threat-intelligence-runtime.mjs";
 import { boundedInteger, boundedHttpsUrl, enumValue, exactKeys, isRecord, strictBoundedString, } from "./bounded-contract-normalizers.mjs";
-import { THREAT_INTELLIGENCE_CAPABILITIES, THREAT_INTELLIGENCE_TARGET_EXPOSURES, CURATED_CONNECTOR_KINDS, CURATED_CONNECTOR_COLLECTIONS, CURATED_CONNECTOR_CREDENTIAL_MODES, CURATED_CONNECTOR_ENTITY_VALUES, CURATED_CONNECTOR_RELATIONSHIP_TYPES, CURATED_CONNECTOR_TARGET_EXPOSURES, CURATED_CONNECTOR_RELATIONSHIP_ENDPOINTS as CONNECTOR_RELATIONSHIP_ENDPOINTS, } from "./threat-intelligence-types.mjs";
+import { THREAT_INTELLIGENCE_CAPABILITIES, THREAT_INTELLIGENCE_TARGET_EXPOSURES, CURATED_CONNECTOR_KINDS, CURATED_CONNECTOR_COLLECTIONS, CURATED_CONNECTOR_CREDENTIAL_MODES, CURATED_CONNECTOR_ENTITY_VALUES, CURATED_CONNECTOR_RELATIONSHIP_TYPES, CURATED_CONNECTOR_TARGET_EXPOSURES, CURATED_CONNECTOR_RELATIONSHIP_ENDPOINTS as CONNECTOR_RELATIONSHIP_ENDPOINTS, } from "../packages/analysis/threat-intelligence-types.mjs";
 import { normalizeLegacyIsoTimestamp } from "../packages/evidence/observation.mjs";
 const MAX_PROVIDER_ID_LENGTH = 40;
 const MAX_PROVIDER_LABEL_LENGTH = 100;

package/lib/threat-intelligence-runtime.mjs

@@ -5,7 +5,7 @@
 // output budgets before producing separately attributed normalized evidence.
 import { createObservation } from "../packages/evidence/observation.mjs";
 import { latestObservationCohort } from "../packages/evidence/latest-observations.mjs";
-import { CURATED_CONNECTOR_RELATIONSHIP_TYPES, CURATED_CONNECTOR_RELATIONSHIP_CLASSIFICATIONS, CURATED_CONNECTOR_RELATIONSHIP_ENDPOINTS as CONNECTOR_RELATIONSHIP_ENDPOINTS, THREAT_INTELLIGENCE_CONTRACT_VERSION, THREAT_INTELLIGENCE_CATEGORIES, THREAT_INTELLIGENCE_CONFIDENCES, THREAT_INTELLIGENCE_ENVELOPE_VERSION, THREAT_INTELLIGENCE_RESULT_STATES, THREAT_INTELLIGENCE_SCHEMA, THREAT_INTELLIGENCE_SEVERITIES, } from "./threat-intelligence-types.mjs";
+import { CURATED_CONNECTOR_RELATIONSHIP_TYPES, CURATED_CONNECTOR_RELATIONSHIP_CLASSIFICATIONS, CURATED_CONNECTOR_RELATIONSHIP_ENDPOINTS as CONNECTOR_RELATIONSHIP_ENDPOINTS, THREAT_INTELLIGENCE_CONTRACT_VERSION, THREAT_INTELLIGENCE_CATEGORIES, THREAT_INTELLIGENCE_CONFIDENCES, THREAT_INTELLIGENCE_ENVELOPE_VERSION, THREAT_INTELLIGENCE_RESULT_STATES, THREAT_INTELLIGENCE_SCHEMA, THREAT_INTELLIGENCE_SEVERITIES, } from "../packages/analysis/threat-intelligence-types.mjs";
 import { assertCuratedConnectorDefinition, assertThreatIntelligenceProvider, } from "./threat-intelligence-definition-registry.mjs";
 import { boundedHttpsUrl, boundedString, isRecord, isoTimestamp, strictBoundedString, } from "./bounded-contract-normalizers.mjs";
 import { CURATED_CONNECTOR_ENTITY_TYPES, MAX_THREAT_INTELLIGENCE_URL_LENGTH, normalizeCuratedConnectorTarget, normalizeThreatIntelligenceTarget, } from "./threat-intelligence-targets.mjs";

package/lib/threat-intelligence-targets.mjs

@@ -2,7 +2,7 @@
 // and curated connectors. These helpers never perform network requests.
 import { classifyQuery } from "./classify.mjs";
 import { enumValue, exactKeys, strictBoundedString, } from "./bounded-contract-normalizers.mjs";
-import { CURATED_CONNECTOR_ENTITY_VALUES, CURATED_CONNECTOR_TARGET_EXPOSURES, THREAT_INTELLIGENCE_TARGET_EXPOSURES, } from "./threat-intelligence-types.mjs";
+import { CURATED_CONNECTOR_ENTITY_VALUES, CURATED_CONNECTOR_TARGET_EXPOSURES, THREAT_INTELLIGENCE_TARGET_EXPOSURES, } from "../packages/analysis/threat-intelligence-types.mjs";
 export const MAX_THREAT_INTELLIGENCE_URL_LENGTH = 2048;
 const TARGET_EXPOSURES = Object.freeze({
     domain: Object.freeze(['registrable_domain']),

package/lib/threat-intelligence-types.mjs

@@ -1,75 +1,2 @@
-// Provider-neutral types shared by threat-intelligence and curated connector
-// manifests, fixture harnesses, normalizers, and result builders.
-export const THREAT_INTELLIGENCE_SCHEMA = 'whoisleuth.threat-intelligence-result';
-export const THREAT_INTELLIGENCE_CONTRACT_VERSION = 1;
-export const THREAT_INTELLIGENCE_ENVELOPE_VERSION = 1;
-export const THREAT_INTELLIGENCE_TARGET_EXPOSURES = Object.freeze([
-    'registrable_domain', 'hostname', 'origin', 'full_url',
-]);
-export const THREAT_INTELLIGENCE_CAPABILITIES = Object.freeze([
-    'domain_lookup', 'url_lookup', 'indicator_search',
-]);
-export const THREAT_INTELLIGENCE_CATEGORIES = Object.freeze([
-    'phishing',
-    'malware',
-    'spam',
-    'suspicious',
-    'abuse',
-    'unknown',
-]);
-export const THREAT_INTELLIGENCE_SEVERITIES = Object.freeze([
-    'critical',
-    'high',
-    'medium',
-    'low',
-    'unknown',
-]);
-export const THREAT_INTELLIGENCE_CONFIDENCES = Object.freeze([
-    'high',
-    'medium',
-    'low',
-    'unknown',
-]);
-export const THREAT_INTELLIGENCE_RESULT_STATES = Object.freeze([
-    'success',
-    'partial',
-    'not_found',
-    'unsupported',
-    'skipped',
-    'rate_limited',
-    'unavailable',
-    'error',
-]);
-export const CURATED_CONNECTOR_KINDS = Object.freeze(['discovery', 'enrichment']);
-export const CURATED_CONNECTOR_COLLECTIONS = Object.freeze(['passive', 'active', 'third_party']);
-export const CURATED_CONNECTOR_CREDENTIAL_MODES = Object.freeze(['none', 'optional', 'required']);
-export const CURATED_CONNECTOR_ENTITY_VALUES = Object.freeze([
-    'domain', 'hostname', 'url', 'ipv4', 'ipv6', 'asn', 'certificate',
-]);
-export const CURATED_CONNECTOR_RELATIONSHIP_TYPES = Object.freeze([
-    'domain_resolves_to_ip', 'domain_uses_nameserver', 'domain_uses_mail_server',
-    'domain_presented_certificate', 'certificate_names_domain', 'ip_hosts_domain',
-    'domain_related_to_domain',
-]);
-export const CURATED_CONNECTOR_RELATIONSHIP_CLASSIFICATIONS = Object.freeze(['direct', 'normalized', 'derived']);
-export const CURATED_CONNECTOR_TARGET_EXPOSURES = Object.freeze({
-    domain: Object.freeze(['registrable_domain']),
-    hostname: Object.freeze(['hostname']),
-    url: THREAT_INTELLIGENCE_TARGET_EXPOSURES,
-    ipv4: Object.freeze(['ip_address']),
-    ipv6: Object.freeze(['ip_address']),
-    asn: Object.freeze(['asn']),
-    certificate: Object.freeze(['certificate_fingerprint']),
-});
-function relationshipEndpoints(from, to) {
-    return Object.freeze({ from: Object.freeze(from), to: Object.freeze(to) });
-}
-export const CURATED_CONNECTOR_RELATIONSHIP_ENDPOINTS = Object.freeze({
-    domain_resolves_to_ip: relationshipEndpoints(['domain', 'hostname'], ['ipv4', 'ipv6']),
-    domain_uses_nameserver: relationshipEndpoints(['domain'], ['hostname']),
-    domain_uses_mail_server: relationshipEndpoints(['domain'], ['hostname']),
-    domain_presented_certificate: relationshipEndpoints(['domain', 'hostname'], ['certificate']),
-    certificate_names_domain: relationshipEndpoints(['certificate'], ['domain', 'hostname']),
-    ip_hosts_domain: relationshipEndpoints(['ipv4', 'ipv6'], ['domain', 'hostname']),
-    domain_related_to_domain: relationshipEndpoints(['domain', 'hostname'], ['domain', 'hostname']),
-});
+// Retained public import; the runtime-neutral implementation lives in the domain layer.
+export * from "../packages/analysis/threat-intelligence-types.mjs";

package/lib/tls-intelligence.mjs

@@ -705,6 +705,7 @@ function skippedTlsObservation(detail = 'TLS evidence collection is disabled by
     };
 }
 async function collectTlsIntelligence(hostname, options = {}) {
+    options.signal?.throwIfAborted();
     const normalizedHostname = normalizeTlsHostname(hostname);
     const now = options.now || Date.now;
     const observedAt = options.observedAt || (() => new Date().toISOString());
@@ -725,9 +726,11 @@ async function collectTlsIntelligence(hostname, options = {}) {
                 resolutionDeadline = setTimer(() => reject(new Error('TLS resolution timed out')), timeoutMs);
             }),
         ]);
+        options.signal?.throwIfAborted();
         records = normalizePublicAddressRecords(resolved);
     }
     catch (error) {
+        options.signal?.throwIfAborted();
         return failedTlsObservation(error, { sniHost: normalizedHostname, observedAt: observedAt(), durationMs: now() - started });
     }
     finally {
@@ -755,18 +758,29 @@ async function collectTlsIntelligence(hostname, options = {}) {
             durationMs: now() - started,
         });
     }
-    return new Promise((resolve) => {
+    return new Promise((resolve, reject) => {
         let socket;
         let deadline;
         let settled = false;
-        const finish = (result) => {
-            if (settled)
-                return;
-            settled = true;
+        const cleanup = () => {
             if (deadline !== undefined)
                 clearTimer(deadline);
+            options.signal?.removeEventListener('abort', cancelled);
             if (socket && typeof socket.destroy === 'function')
                 socket.destroy();
+        };
+        const cancelled = () => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            reject(options.signal.reason);
+        };
+        const finish = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
             resolve(result);
         };
         const fail = (error) => finish(failedTlsObservation(error, {
@@ -776,6 +790,11 @@ async function collectTlsIntelligence(hostname, options = {}) {
             observedAt: observedAt(),
             durationMs: now() - started,
         }));
+        options.signal?.addEventListener('abort', cancelled, { once: true });
+        if (options.signal?.aborted) {
+            cancelled();
+            return;
+        }
         try {
             socket = connect({
                 host: selected.address,
@@ -787,6 +806,8 @@ async function collectTlsIntelligence(hostname, options = {}) {
                 checkServerIdentity: () => undefined,
                 ALPNProtocols: ['h2', 'http/1.1'],
             }, () => {
+                if (settled)
+                    return;
                 try {
                     const peerCertificate = socket.getPeerCertificate(true);
                     let hostnameError = null;
@@ -816,6 +837,10 @@ async function collectTlsIntelligence(hostname, options = {}) {
                     fail(error);
                 }
             });
+            if (settled) {
+                socket.destroy();
+                return;
+            }
             socket.once('error', fail);
             deadline = setTimer(() => fail(new Error('TLS handshake timed out')), remainingMs);
             if (settled && deadline !== undefined)

package/lib/typosquat-generator.mjs

@@ -2,7 +2,7 @@
 // objects so a later scan can explain why each domain was generated; callers
 // that only need the historical string list can use the compatibility wrapper.
 import { advancedConfusableVariantsForAscii, confusableCharactersForAscii, estimateAdvancedConfusableVariants, MAX_ADVANCED_CONFUSABLE_VARIANTS, wholeLabelConfusableVariantsForAscii, } from "./idn-confusables.mjs";
-import { canonicalRegistrableDomain, normalizeDiscoverySuffix } from "./registrable-domain.mjs";
+import { canonicalRegistrableDomain, normalizeDiscoverySuffix } from "../packages/analysis/registrable-domain.mjs";
 import { MAX_DOMAIN_NAME_LENGTH, MAX_DOMAIN_LABEL_LENGTH } from "../packages/contracts/domain-name.mjs";
 export { MAX_ADVANCED_CONFUSABLE_VARIANTS };
 function buildKeyboardAdjacency(rows) {
@@ -775,12 +775,21 @@ export function generateTyposquatCandidateSet(rawInput, fallbackTlds, options =
         const advanced = advancedConfusableVariantsForAscii(name);
         const rejectedBefore = state.rejectedVariantCount;
         let rejectedByEncoding = 0;
+        const encodedLabels = new Set();
+        let duplicatesAfterEncoding = 0;
         for (const variant of advanced.variants) {
             const ascii = toAsciiLabel(variant.unicodeLabel);
             if (!ascii) {
                 rejectedByEncoding += 1;
                 continue;
             }
+            // Different Unicode spellings can identify the same IDNA domain. They
+            // are duplicate candidates, not work omitted by a resource budget.
+            if (encodedLabels.has(ascii)) {
+                duplicatesAfterEncoding += 1;
+                continue;
+            }
+            encodedLabels.add(ascii);
             addVariant(state, ascii, 'unicode_homoglyph_depth_2');
         }
         const generated = [...state.variants.values()]
@@ -788,7 +797,7 @@ export function generateTyposquatCandidateSet(rawInput, fallbackTlds, options =
             .length;
         const rejectedByValidation = state.rejectedVariantCount - rejectedBefore;
         const omittedByBudget = advanced.omittedByBudget
-            + Math.max(0, advanced.variants.length - rejectedByEncoding - rejectedByValidation - generated);
+            + Math.max(0, advanced.variants.length - duplicatesAfterEncoding - rejectedByEncoding - rejectedByValidation - generated);
         advancedConfusable = {
             generated,
             omittedByPolicy: advanced.omittedByPolicy + rejectedByEncoding + rejectedByValidation,