open-local-audit 0.77.0 → 0.79.0

package/dist/rules.js

@@ -1,6 +1,8 @@
 import { load } from "cheerio";
 import { findPhoneNumbersInText, getCountries, parsePhoneNumberFromString } from "libphonenumber-js/max";
 import { detectPageForms, hasContactOrBookingLink } from "./contact.js";
+import { cookieNames } from "./dotnet-stack.js";
+import { applyTypeContext, contextBase, expandNodeId, isLocalBusinessType, noTypeContext } from "./local-business-types.js";
 function finding(rule, context) {
     return {
         id: rule.id,
@@ -30,25 +32,39 @@ function jsonLdTypes(node) {
     const types = Array.isArray(typeValue) ? typeValue : [typeValue];
     return types.filter((type) => typeof type === "string");
 }
-function flattenJsonLd(value) {
+const nodeScopes = new WeakMap();
+// Flattens top-level and @graph or @included node objects; with embedded set, also node objects nested
+// as property values, such as an address or a mainEntity.
+function flattenJsonLd(value, block, context = noTypeContext, embedded = false) {
     if (Array.isArray(value)) {
-        return value.flatMap((item) => flattenJsonLd(item));
+        return value.flatMap((item) => flattenJsonLd(item, block, context, embedded));
     }
     if (!value || typeof value !== "object") {
         return [];
     }
     const node = value;
-    const graphNodes = flattenJsonLd(node["@graph"]);
-    return [node, ...graphNodes];
+    const localContext = node["@context"];
+    const nodeContext = applyTypeContext(context, localContext);
+    // A context with "@propagate": false, alone or in a context array, applies to this node only; nested
+    // nodes return to the previous context, which no longer gets the lenient no-context reading.
+    const localContexts = Array.isArray(localContext) ? localContext : [localContext];
+    const propagates = !localContexts.some((entry) => hasObjectField(entry) && entry["@propagate"] === false);
+    const childContext = propagates ? nodeContext : { ...context, declared: true };
+    nodeScopes.set(node, { context: nodeContext, nestedContext: childContext, block });
+    // @graph and @included both hold further node objects of the same document.
+    const nestedKeys = embedded
+        ? Object.keys(node).filter((key) => !key.startsWith("@") || ["@graph", "@included", "@list", "@set"].includes(key))
+        : ["@graph", "@included"];
+    return [node, ...nestedKeys.flatMap((key) => flattenJsonLd(node[key], block, childContext, embedded))];
 }
-function jsonLdNodes($) {
+function jsonLdNodes($, embedded = false) {
     return $('script[type="application/ld+json"]')
         .toArray()
-        .flatMap((element) => {
+        .flatMap((element, block) => {
         const raw = $(element).text();
         try {
             const parsed = JSON.parse(raw);
-            return flattenJsonLd(parsed);
+            return flattenJsonLd(parsed, block, noTypeContext, embedded);
         }
         catch {
             return [];
@@ -72,7 +88,7 @@ function hasSuccessfulResource(statusCode) {
     return typeof statusCode === "number" && statusCode >= 200 && statusCode < 400;
 }
 function localBusinessNodes($) {
-    return jsonLdNodes($).filter((node) => jsonLdTypes(node).some((type) => type.endsWith("LocalBusiness") || type === "LocalBusiness"));
+    return jsonLdNodes($).filter((node) => jsonLdTypes(node).some((type) => isLocalBusinessType(type, nodeScopes.get(node)?.context)));
 }
 function hasObjectField(value) {
     return Boolean(value && typeof value === "object" && !Array.isArray(value));
@@ -80,12 +96,116 @@ function hasObjectField(value) {
 function hasStringField(value) {
     return typeof value === "string" && value.trim().length > 0;
 }
-function hasLocalBusinessContactFields($) {
+// A day or time is a non-empty string, or a JSON-LD value or node object carrying one, such as
+// {"@id": "https://schema.org/Monday"} or {"@value": "09:00"}.
+function hasOpeningHoursValue(value) {
+    if (hasStringField(value)) {
+        return true;
+    }
+    if (!hasObjectField(value)) {
+        return false;
+    }
+    const fields = value;
+    return ["@id", "@value", "name"].some((key) => hasStringField(fields[key]));
+}
+function hasOpeningHoursData(specification) {
+    if (!hasObjectField(specification)) {
+        return false;
+    }
+    const fields = specification;
+    return ["dayOfWeek", "opens", "closes"].some((field) => {
+        const values = Array.isArray(fields[field]) ? fields[field] : [fields[field]];
+        return values.some(hasOpeningHoursValue);
+    });
+}
+// JSON-LD @id values are IRIs relative to the document base: the page URL, or its <base href>.
+function documentBase($, snapshot) {
+    const pageUrl = snapshot.finalUrl || snapshot.url;
+    try {
+        return new URL($("base[href]").first().attr("href") ?? "", pageUrl).href;
+    }
+    catch {
+        return pageUrl;
+    }
+}
+// An @id as a lookup key: compact IRIs expand through the JSON-LD context and relative IRIs resolve
+// against the context's @base or the document base, while blank node labels such as "_:b0" stay local
+// to their script block.
+function nodeKey(id, context, block, documentBaseIri) {
+    const expanded = expandNodeId(id, context);
+    if (expanded.startsWith("_:")) {
+        return `${block} ${expanded}`;
+    }
+    try {
+        return new URL(expanded, contextBase(documentBaseIri, context) ?? undefined).href;
+    }
+    catch {
+        return expanded;
+    }
+}
+function nodeIdKey(node, base) {
+    const scope = nodeScopes.get(node);
+    return scope && typeof node["@id"] === "string" ? nodeKey(node["@id"], scope.context, scope.block, base) : undefined;
+}
+// The key of a node reference such as {"@id": "#hours"} found in the owner node's property. As in JSON-LD
+// expansion, an object holding only @id keeps the owner's context even when that context does not
+// propagate, while any other nested object returns to the previous context; the property term's own
+// scoped @context then applies, and finally the reference's own @context.
+function referenceKey(reference, owner, property, base) {
+    const scope = nodeScopes.get(owner);
+    if (!scope || !hasObjectField(reference)) {
+        return undefined;
+    }
+    const fields = reference;
+    const idOnly = Object.keys(fields).length === 1;
+    const propertyContext = applyTypeContext(idOnly ? scope.context : scope.nestedContext, scope.context.terms.get(property)?.scopedContext);
+    const context = idOnly ? propertyContext : applyTypeContext(propertyContext, fields["@context"]);
+    return typeof fields["@id"] === "string" ? nodeKey(fields["@id"], context, scope.block, base) : undefined;
+}
+// Every JSON-LD node with each @id, embedded ones included, keyed as above; nodes sharing an @id
+// describe the same thing.
+function jsonLdNodesById($, base) {
+    const nodesById = new Map();
+    for (const node of jsonLdNodes($, true)) {
+        const key = nodeIdKey(node, base);
+        if (key !== undefined) {
+            nodesById.set(key, [...(nodesById.get(key) ?? []), node]);
+        }
+    }
+    return nodesById;
+}
+// A node together with every other node that shares its @id.
+function nodeFragments(node, nodesById, base) {
+    const key = nodeIdKey(node, base);
+    return key === undefined ? [node] : (nodesById.get(key) ?? [node]);
+}
+// openingHours may be one string or a list; openingHoursSpecification is one object or a list of them,
+// each with a day or time, or an {"@id": ...} reference to nodes elsewhere in the graph that have one.
+function hasOpeningHoursField(node, nodesById, base) {
+    const specifications = Array.isArray(node.openingHoursSpecification)
+        ? node.openingHoursSpecification
+        : [node.openingHoursSpecification];
+    return (stringValues(node.openingHours).length > 0 ||
+        specifications.some((specification) => {
+            const reference = referenceKey(specification, node, "openingHoursSpecification", base);
+            const referenced = reference === undefined ? [] : (nodesById.get(reference) ?? []);
+            return hasOpeningHoursData(specification) || referenced.some(hasOpeningHoursData);
+        }));
+}
+// The business's fields may be split across nodes that share its @id.
+function hasLocalBusinessContactFields($, snapshot) {
     const nodes = localBusinessNodes($);
     if (nodes.length === 0) {
         return true;
     }
-    return nodes.some((node) => hasStringField(node.telephone) && hasObjectField(node.address) && hasStringField(node.openingHours));
+    const base = documentBase($, snapshot);
+    const nodesById = jsonLdNodesById($, base);
+    return nodes.some((node) => {
+        const fragments = nodeFragments(node, nodesById, base);
+        return (fragments.some((fragment) => hasStringField(fragment.telephone)) &&
+            fragments.some((fragment) => hasObjectField(fragment.address)) &&
+            fragments.some((fragment) => hasOpeningHoursField(fragment, nodesById, base)));
+    });
 }
 function stringValues(value) {
     const values = Array.isArray(value) ? value : [value];
@@ -622,18 +742,23 @@ function streetAddressVisible(streetAddress, regions) {
         return false;
     });
 }
-function localBusinessNapMismatches($) {
+// As with the contact fields, the business's telephone and address may sit on any node sharing its @id.
+function localBusinessNapMismatches($, snapshot) {
     const nodes = localBusinessNodes($);
     if (nodes.length === 0) {
         return [];
     }
     const index = jsonLdIndex($);
+    const base = documentBase($, snapshot);
+    const nodesById = jsonLdNodesById($, base);
     const body = visibleBody($);
     const regions = visibleAddressRegions($, body);
     const mismatches = [];
     for (const node of nodes) {
-        for (const telephone of stringValues(node.telephone)) {
-            const country = schemaCountry(node, index) ?? parsePhoneNumberFromString(telephone.trim())?.country;
+        const fragments = nodeFragments(node, nodesById, base);
+        const fragmentCountry = fragments.map((fragment) => schemaCountry(fragment, index)).find((code) => code !== undefined);
+        for (const telephone of fragments.flatMap((fragment) => stringValues(fragment.telephone))) {
+            const country = fragmentCountry ?? parsePhoneNumberFromString(telephone.trim())?.country;
             const phones = visiblePhones($, body, country);
             if (phones.length === 0) {
                 continue;
@@ -651,7 +776,7 @@ function localBusinessNapMismatches($) {
             }
         }
         if (regions.length > 0) {
-            for (const streetAddress of streetAddresses(node, index)) {
+            for (const streetAddress of fragments.flatMap((fragment) => streetAddresses(fragment, index))) {
                 if (!streetAddressVisible(streetAddress, regions)) {
                     mismatches.push(`Schema streetAddress "${streetAddress.trim()}" not found in visible page text`);
                 }
@@ -849,6 +974,202 @@ function tlsCertificateEvidence(tls) {
             : `Certificate expires ${date} (${tls.daysRemaining} day${tls.daysRemaining === 1 ? "" : "s"})`;
     return tls.issuer ? `${status}; issuer ${tls.issuer}` : status;
 }
+const languageCode = /^[a-z]{2,3}(?:-[a-z0-9]{1,8})*$/i;
+function htmlLangEvidence($) {
+    const attribute = $("html").attr("lang");
+    const lang = (attribute ?? "").trim();
+    if (!lang) {
+        return attribute === undefined ? "No lang attribute on the <html> element" : "The lang attribute on the <html> element is empty";
+    }
+    return languageCode.test(lang) ? undefined : `lang="${lang}" is not a valid language code`;
+}
+const unlabelledInputTypes = new Set(["hidden", "submit", "button", "reset", "image"]);
+function textOf($, element) {
+    const copy = $(element).clone();
+    copy.find("input, select, textarea").remove();
+    return copy.text().replace(/\s+/g, " ").trim();
+}
+function hasAccessibleName($, element) {
+    const control = $(element);
+    const ids = (control.attr("aria-labelledby") ?? "").split(/\s+/).filter(Boolean);
+    if (ids.some((id) => $("[id]").toArray().some((target) => $(target).attr("id") === id && textOf($, target)))) {
+        return true;
+    }
+    if (["aria-label", "title", "placeholder"].some((name) => (control.attr(name) ?? "").trim())) {
+        return true;
+    }
+    const id = control.attr("id");
+    const labels = [
+        ...control.closest("label").toArray(),
+        ...(id ? $("label[for]").toArray().filter((label) => $(label).attr("for") === id) : [])
+    ];
+    return labels.some((label) => textOf($, label));
+}
+function describeControl($, element) {
+    const control = $(element);
+    const tag = element.tagName?.toLowerCase() ?? "input";
+    const type = control.attr("type");
+    const name = control.attr("name");
+    const id = control.attr("id");
+    return `${tag}${type ? `[type=${type}]` : ""}${name ? `[name=${name}]` : id ? `#${id}` : ""}`;
+}
+function formFields($) {
+    const fields = visibleBody($)
+        .find("input, select, textarea")
+        .toArray()
+        // Fields under aria-hidden, such as the off-screen Mailchimp spam trap, are not exposed to assistive technology.
+        .filter((element) => !unlabelledInputTypes.has(($(element).attr("type") ?? "").trim().toLowerCase()) && $(element).closest('[aria-hidden="true"]').length === 0);
+    const unlabelled = fields.filter((element) => !hasAccessibleName($, element)).map((element) => describeControl($, element));
+    return { total: fields.length, unlabelled };
+}
+// Lighthouse's English list of non-descriptive link text, plus "continue reading", "find out more", and common Turkish and German equivalents.
+const genericLinkText = new Set([
+    "click here",
+    "click this",
+    "go",
+    "here",
+    "information",
+    "learn more",
+    "more",
+    "more info",
+    "more information",
+    "right here",
+    "read more",
+    "see more",
+    "start",
+    "this",
+    "continue reading",
+    "find out more",
+    "buraya tıklayın",
+    "buraya tıkla",
+    "tıklayın",
+    "tıkla",
+    "devamı",
+    "devamını oku",
+    "daha fazla",
+    "detaylar",
+    "ayrıntılar",
+    "hier",
+    "hier klicken",
+    "mehr",
+    "mehr erfahren",
+    "mehr lesen",
+    "weiterlesen"
+]);
+function genericLinks($) {
+    return visibleBody($)
+        .find("a[href]")
+        .toArray()
+        .flatMap((element) => {
+        const link = $(element);
+        const href = (link.attr("href") ?? "").trim();
+        if (!href || href.startsWith("#") || /^javascript:/i.test(href) || link.attr("aria-labelledby")) {
+            return [];
+        }
+        const label = (link.attr("aria-label") ?? "").trim() ||
+            [link.text(), ...link.find("img[alt]").toArray().map((image) => $(image).attr("alt") ?? "")].join(" ");
+        const shown = label.replace(/\s+/g, " ").trim();
+        const key = shown.toLowerCase().replace(/^[^\p{L}\p{N}]+|[^\p{L}\p{N}]+$/gu, "");
+        return genericLinkText.has(key) ? [`"${shown}" (${href})`] : [];
+    });
+}
+function firstFive(items) {
+    return [...items.slice(0, 5), ...(items.length > 5 ? [`and ${items.length - 5} more`] : [])].join("; ");
+}
+const trackers = [
+    [
+        "Google Analytics or Ads",
+        /googletagmanager\.com\/gtag\/js|google-analytics\.com\/(?:analytics|ga|urchin)\.js|\bgtag\(\s*['"]config['"]|\bga\(\s*['"]create['"]/i
+    ],
+    ["Google Tag Manager", /googletagmanager\.com\/gtm\.js/i],
+    ["Meta Pixel", /connect\.facebook\.net\/[\w-]+\/fbevents\.js|\bfbq\(\s*['"]init['"]/i],
+    ["Hotjar", /static\.hotjar\.com|\b_hjSettings\b/i],
+    ["Microsoft Clarity", /clarity\.ms\/tag/i],
+    ["LinkedIn Insight Tag", /snap\.licdn\.com\/li\.lms-analytics|\b_linkedin_partner_id\b/i],
+    ["TikTok Pixel", /analytics\.tiktok\.com/i],
+    ["Microsoft Advertising", /bat\.bing\.com\/bat\.js/i]
+];
+const trackingCookie = /^(?:_ga(?:_\w+)?|_gid|_gat(?:_\w+)?|_gcl_\w+|_fbp|_fbc|_hj\w+|_clck|_clsk|_uetsid|_uetvid|_ttp|li_fat_id)$/;
+// Consent platforms, IAB TCF, Google consent mode defaults, website-builder banners, and common cookie banner markup.
+// Matching is deliberately broad: a page that shows any sign of a consent step is not flagged.
+const consentTool = /cookiebot|cookielaw\.org|onetrust|optanon|cookieyes|cookie-law-info|termly\.io|iubenda|complianz|cmplz|osano|usercentrics|cmp\.quantcast\.com|__tcfapi|didomi|cookiefirst|cookie-script\.com|civiccomputing|cookiecontrol|borlabs|klaro|real-cookie-banner|moove[_-]gdpr|cookie[_-]?(?:notice|consent|banner|bar|law)|consent[_-]?(?:banner|manager)|cookiehub|axeptio|tarteaucitron|trustarc|consentmanager|gdpr[_-]?cookie|cc-window|cc-banner|sqs-cookie-banner|\bfs-cc\b|fundingchoicesmessages\.google\.com|hs-banner|hs-eu-cookie|consentPolicy|customerPrivacy|\bgtag\(\s*['"]consent['"]\s*,\s*['"]default['"]/i;
+// Consent tools hold tags back as type="text/plain" until visitors accept, so only executable scripts count.
+const executableScriptTypes = new Set(["", "text/javascript", "application/javascript", "module"]);
+function loadedTrackers($) {
+    const scripts = $("script")
+        .toArray()
+        .filter((element) => executableScriptTypes.has(($(element).attr("type") ?? "").trim().toLowerCase()))
+        .map((element) => `${$(element).attr("src") ?? ""} ${$(element).text()}`)
+        .join("\n");
+    return trackers.filter(([, pattern]) => pattern.test(scripts)).map(([name]) => name);
+}
+function serverTrackingCookies(snapshot) {
+    return Array.from(new Set(cookieNames(snapshot.headers["set-cookie"]).filter((name) => trackingCookie.test(name))));
+}
+function hasConsentTool(snapshot) {
+    return consentTool.test(snapshot.html);
+}
+function consentEvidence($, snapshot) {
+    const names = loadedTrackers($);
+    const cookies = serverTrackingCookies(snapshot);
+    const scripts = names.length > 0 ? `${names.join(", ")} ${names.length === 1 ? "loads" : "load"} with no consent tool found` : "No consent tool found";
+    return cookies.length > 0 ? `${scripts}; tracking cookies set by the server: ${cookies.join(", ")}` : scripts;
+}
+const privacyLinkText = /privacy|privacidad|privacit|gizlilik|kvkk|kişisel veri|datenschutz|confidentialit|données personnelles|protección de datos|data protection|gdpr|privacybeleid|privacyverklaring/i;
+const privacyLinkPath = /privacy|privacidad|gizlilik|kvkk|aydinlatma|datenschutz|confidentialit|gdpr|data-protection/i;
+const privacyPolicyHosts = ["iubenda.com", "termly.io", "privacypolicies.com", "freeprivacypolicy.com"];
+function bareHost(host) {
+    return host.toLowerCase().replace(/^www\./, "");
+}
+function onHost(host, domain) {
+    return host === domain || host.endsWith(`.${domain}`);
+}
+// The URL parser keeps percent sequences that do not decode, such as "/20%-off", so fall back to the raw path.
+function decodedPath(url) {
+    try {
+        return decodeURIComponent(url.pathname);
+    }
+    catch {
+        return url.pathname;
+    }
+}
+function hasPrivacyPolicyLink($, snapshot) {
+    if ($("[rel~='privacy-policy'][href]").length > 0) {
+        return true;
+    }
+    let pageHost;
+    try {
+        pageHost = bareHost(new URL(snapshot.finalUrl).hostname);
+    }
+    catch {
+        pageHost = undefined;
+    }
+    return $("a[href]")
+        .toArray()
+        .some((element) => {
+        let url;
+        try {
+            url = new URL(($(element).attr("href") ?? "").trim(), snapshot.finalUrl);
+        }
+        catch {
+            return false;
+        }
+        const host = bareHost(url.hostname);
+        const ownSite = pageHost !== undefined && (onHost(host, pageHost) || onHost(pageHost, host));
+        if (!/^https?:$/.test(url.protocol) || !(ownSite || privacyPolicyHosts.some((domain) => onHost(host, domain)))) {
+            return false;
+        }
+        return privacyLinkText.test($(element).text()) || privacyLinkPath.test(decodedPath(url));
+    });
+}
+function privacyEvidence($, snapshot) {
+    const names = loadedTrackers($);
+    const context = [
+        ...(detectPageForms($, snapshot.finalUrl).enquiryForm ? ["has an enquiry form"] : []),
+        ...(names.length > 0 ? [`loads ${names.join(", ")}`] : [])
+    ];
+    return `No privacy policy link found${context.length > 0 ? `; the page ${context.join(" and ")}` : ""}`;
+}
 function hasPlaceholderSocialLinks($) {
     return $("a")
         .toArray()
@@ -1027,7 +1348,7 @@ const rules = [
         severity: "medium",
         source: "JSON-LD",
         recommendation: "Add LocalBusiness schema when the page represents a local business location.",
-        check: ({ $ }) => hasJsonLdType($, (type) => type.endsWith("LocalBusiness") || type === "LocalBusiness"),
+        check: ({ $ }) => localBusinessNodes($).length > 0,
         evidence: () => "No LocalBusiness JSON-LD type found"
     },
     {
@@ -1036,9 +1357,9 @@ const rules = [
         category: "search-basics",
         severity: "medium",
         source: "JSON-LD",
-        recommendation: "Add telephone, address, and openingHours fields to LocalBusiness schema.",
-        check: ({ $ }) => hasLocalBusinessContactFields($),
-        evidence: () => "LocalBusiness schema is missing telephone, address, or openingHours"
+        recommendation: "Add telephone, address, and openingHours or openingHoursSpecification fields to LocalBusiness schema.",
+        check: ({ $, snapshot }) => hasLocalBusinessContactFields($, snapshot),
+        evidence: () => "LocalBusiness schema is missing telephone, address, or opening hours"
     },
     {
         id: "localbusiness-schema-nap-consistency",
@@ -1047,8 +1368,8 @@ const rules = [
         severity: "medium",
         source: "JSON-LD",
         recommendation: "Make the LocalBusiness schema telephone and streetAddress match the phone number and address shown on the page, so search engines and customers see one consistent listing.",
-        check: ({ $ }) => localBusinessNapMismatches($).length === 0,
-        evidence: ({ $ }) => localBusinessNapMismatches($).join("; ")
+        check: ({ $, snapshot }) => localBusinessNapMismatches($, snapshot).length === 0,
+        evidence: ({ $, snapshot }) => localBusinessNapMismatches($, snapshot).join("; ")
     },
     {
         id: "organization-schema-present",
@@ -1112,6 +1433,26 @@ const rules = [
             hasLink($, (href) => href.toLowerCase().startsWith("mailto:")),
         evidence: ({ $, snapshot }) => `No enquiry form, contact page link, or email link${detectPageForms($, snapshot.finalUrl).newsletterForm ? "; only a newsletter signup form" : ""}`
     },
+    {
+        id: "privacy-policy-link-present",
+        title: "Privacy policy link is missing",
+        category: "trust-contact",
+        severity: "medium",
+        source: "Privacy links",
+        recommendation: "Link to a privacy policy from every page, usually in the footer, explaining what personal data the site collects through forms, analytics, and cookies and how visitors can contact you about it.",
+        check: ({ $, snapshot }) => hasPrivacyPolicyLink($, snapshot),
+        evidence: ({ $, snapshot }) => privacyEvidence($, snapshot)
+    },
+    {
+        id: "cookie-consent-present",
+        title: "Tracking loads without a cookie consent tool",
+        category: "trust-contact",
+        severity: "medium",
+        source: "Tracking and consent",
+        recommendation: "Add a cookie consent banner that holds advertising and non-essential analytics tags until visitors accept, as UK and EU cookie rules (PECR and the ePrivacy Directive) generally expect, or remove trackers you do not use.",
+        check: ({ $, snapshot }) => (loadedTrackers($).length === 0 && serverTrackingCookies(snapshot).length === 0) || hasConsentTool(snapshot),
+        evidence: ({ $, snapshot }) => consentEvidence($, snapshot)
+    },
     {
         id: "placeholder-copy-absent",
         title: "Placeholder copy is still visible",
@@ -1246,6 +1587,42 @@ const rules = [
                 .filter((element) => $(element).attr("alt") === undefined).length;
             return `${missing} of ${images} images missing alt attributes`;
         }
+    },
+    {
+        id: "html-lang-present",
+        title: "Page language is not declared",
+        category: "mobile-usability",
+        severity: "low",
+        source: "HTML lang",
+        recommendation: 'Set the page language on the <html> element, such as lang="en-GB", so screen readers pronounce the text correctly and browsers offer the right translation.',
+        check: ({ $ }) => htmlLangEvidence($) === undefined,
+        evidence: ({ $ }) => htmlLangEvidence($) ?? ""
+    },
+    {
+        id: "form-labels-present",
+        title: "Some form fields have no label",
+        category: "mobile-usability",
+        severity: "low",
+        source: "Form labels",
+        recommendation: "Give every form field a visible label, or at least an aria-label, so screen reader users and people using voice control know what to enter.",
+        check: ({ $ }) => formFields($).unlabelled.length === 0,
+        evidence: ({ $ }) => {
+            const { total, unlabelled } = formFields($);
+            return `${unlabelled.length} of ${total} form field${total === 1 ? "" : "s"} ${unlabelled.length === 1 ? "has" : "have"} no label: ${firstFive(unlabelled)}`;
+        }
+    },
+    {
+        id: "link-text-descriptive",
+        title: "Some links use generic text",
+        category: "search-basics",
+        severity: "low",
+        source: "Link text",
+        recommendation: 'Replace link text such as "Read more" or "Click here" with words that say where the link goes, such as "Dental implant prices".',
+        check: ({ $ }) => genericLinks($).length === 0,
+        evidence: ({ $ }) => {
+            const links = genericLinks($);
+            return `${links.length} link${links.length === 1 ? " uses" : "s use"} generic text: ${firstFive(links)}`;
+        }
     }
 ];
 export function runRules(snapshot) {
@@ -1260,18 +1637,43 @@ export function runRules(snapshot) {
 export const ruleCount = rules.length;
 // Real sites can mention these phrases, so only short pages count as placeholders. Maintenance copy must be
 // about the whole site ("Website temporarily down", "Our site is offline") or open the page ("Under maintenance."), so a short page
-// saying "Our booking system is temporarily unavailable" keeps its normal audit.
+// saying "Our booking system is temporarily unavailable" keeps its normal audit. Conditional copy such as
+// "If our site is offline, call us" describes a fallback, not the site's state.
 const placeholderTextLimit = 600;
 const maintenanceCopy = /(?:^|[.!?]\s+|\b(?:our|this|the) )(?:web)?site (?:is )?(?:temporarily |currently )?(?:down|unavailable|offline|under maintenance)\b|^(?:we(?:'|’)re |we are )?(?:currently |temporarily )?(?:down for|under(?:going)?) (?:scheduled )?maintenance\b/i;
 const parkedCopy = /\b(?:(?:this )?domain (?:name )?(?:may be|is) for sale|buy this domain|domain is parked|parked (?:free,? )?(?:courtesy of|by)|this domain has been registered)\b/i;
+// "Should" is left out: as a condition it inverts the sentence ("Should our site go offline"), which the
+// notice pattern never matches, and otherwise it is advice ("You should be aware that our site is offline").
+const conditionalWords = /\b(?:if|when|whenever|unless|in case)\b/i;
+// The first maintenance notice whose sentence is not conditional; "If for any reason our site is offline,
+// call us" describes a fallback, not the site's state. Semicolons and line breaks between visible blocks end the clause, so
+// a "When to contact us" menu item does not hide the notice under it.
+function maintenanceNotice(text) {
+    for (const match of text.matchAll(new RegExp(maintenanceCopy.source, "gi"))) {
+        // A match opening with sentence punctuation starts a new sentence, so nothing before it applies.
+        const sentence = /^[.!?]/.test(match[0]) ? "" : (text.slice(0, match.index).split(/[.!?;\n]/).pop() ?? "");
+        // A condition right after the notice governs it too ("Our site is offline when scheduled maintenance
+        // occurs"), but a later, separate clause does not ("Our site is offline, so if you need help call us").
+        const governedAfter = /^\s*,?\s*(?:(?:but|and|yet)\s+)?(?:(?:only|just|even|except|usually|sometimes)\s+)?(?:if|when|whenever|unless|in case)\b/i.test(text.slice((match.index ?? 0) + match[0].length));
+        if (!governedAfter && !conditionalWords.test(`${sentence} ${match[0]}`)) {
+            return match;
+        }
+    }
+    return undefined;
+}
 export function detectPlaceholderPage(snapshot) {
     const $ = load(snapshot.html);
-    const text = `${$("title").text()} ${collapsedText(visibleBody($))}`.replace(/\s+/g, " ").trim();
+    const title = $("title").text().replace(/\s+/g, " ").trim();
+    const lines = visibleLines(visibleBody($));
+    const body = lines.join("\n");
+    const text = `${title} ${lines.join(" ")}`.trim();
     if (text.length > placeholderTextLimit) {
         return undefined;
     }
+    // The title and body are matched separately, so a notice opening the body is not read as continuing the
+    // title ("Acme Dental" then "Site is temporarily offline.").
     const parked = text.match(parkedCopy);
-    const maintenance = parked ? undefined : text.match(maintenanceCopy);
+    const maintenance = parked ? undefined : (maintenanceNotice(body) ?? maintenanceNotice(title));
     const match = parked ?? maintenance;
     if (!match) {
         return undefined;