shabbat-gate 0.1.3 → 0.2.0

package/CHANGELOG.md

@@ -3,6 +3,40 @@
 All notable changes to this package are documented here. Format loosely follows
 [Keep a Changelog](https://keepachangelog.com/).
 
+## [0.2.0] - Unreleased
+
+### Added
+
+- `ShabbatGateConfig.enforceVisitorLocation` - when `true`, the gate blocks a visitor during
+  Shabbat/Yom Tov in *their own* location (from Cloudflare's `request.cf` geolocation), not
+  only Israel's. The site is closed to them if it's Shabbat in Israel **or** where they are,
+  so an overseas visitor stays blocked from Israel's candle-lighting right through their own
+  local havdalah. Holidays for a visitor outside Israel use diaspora two-day Yom Tov reckoning
+  (`i=off`); Chanukah/Purim/Yom HaAtzma'ut/Chol HaMoed stay open either way. Falls back to the
+  Israel-only decision when a request has no geolocation (local `wrangler dev`, unplaceable IP).
+  Defaults to `false` (original Israel-only behavior).
+- **Localized secondary holding-page message.** For a visitor physically outside Israel, the
+  default holding page now shows the Hebrew message, then (below a blank-line gap) a message in
+  the visitor's own browser language (from `Accept-Language`). Built-in languages: English
+  (default/fallback), French, Russian, Spanish, German, and Arabic (right-to-left).
+  Hebrew-speaking visitors and visitors
+  in Israel get no second message. Reopen time is shown in the visitor's own timezone. Works
+  independently of `enforceVisitorLocation` (whenever the site is closed and the visitor is
+  known to be abroad).
+- New exports supporting the above: `fetchWindows` now takes an optional third `options`
+  argument (`{ israelMode?, tzid? }`) for computing a non-Israel calendar; `mergeWindows`
+  (coalesces overlapping window lists into continuous ones); `SUPPORTED_LANGUAGES`,
+  `resolveVisitorLanguage`, and the `SecondaryMessage` / `SupportedLanguage` /
+  `FetchWindowsOptions` types.
+
+### Changed
+
+- `HoldingPageContext` gained an optional `secondary?: SecondaryMessage` field (the localized
+  block). Existing custom `renderHoldingPage` functions are unaffected - the field is optional
+  and simply ignored if unused.
+- The default holding page now HTML-escapes `siteName` and all label fields before
+  interpolation.
+
 ## [0.1.3] - 2026-07-12
 
 ### Fixed

package/README.he.md

@@ -99,15 +99,47 @@ export interface ShabbatGateConfig {
     reasonLabel: string;
     closingLabel: string;
     untilLabel: string;
+    /** הודעה מקומית אופציונלית שמוצגת מתחת להודעה בעברית (עם רווח), עבור גולש מחוץ
+     *  לישראל, בשפת הדפדפן שלו. חסרה עבור גולשים בישראל / דוברי עברית / כשמיקום
+     *  הגולש לא ידוע. */
+    secondary?: { dir: 'ltr' | 'rtl'; lines: string[] };
   }) => string;
 
   /** דקות לסגור את האתר *לפני* הדלקת נרות ולפתוח אותו *אחרי* הבדלה, מעל החלון הגולמי
    *  מ-Hebcal. ברירת מחדל: 0. שימושי כרפידת בטחון מול סחיפת שעון / גלישה של הרגע
    *  האחרון בדיוק בגבול החלון. */
   bufferMinutes?: number;
+
+  /** כשמוגדר `true`, חוסם גולש גם בזמן שבת/יום-טוב *במיקום שלו עצמו* (לפי הגאו-לוקיישן
+   *  של Cloudflare ב-`request.cf`), לא רק בזמן של ישראל. האתר סגור לגולש אם זו שבת
+   *  בישראל *או* במקום שבו הוא נמצא - כך שגולש בחו"ל נשאר חסום מהדלקת הנרות בישראל ועד
+   *  צאת השבת המקומית שלו. חגים לגולש מחוץ לישראל מחושבים לפי יום-טוב שני של גלויות
+   *  (יומיים). ברירת מחדל: `false` (שער לפי ישראל בלבד, ההתנהגות המקורית). אם אין נתוני
+   *  מיקום לבקשה (למשל `wrangler dev` מקומי, או IP ש-Cloudflare לא ממקם) - אותה בקשה
+   *  נופלת חזרה להחלטה לפי ישראל בלבד. */
+  enforceVisitorLocation?: boolean;
 }
 ```
 
+### חסימה גם לפי אזור הזמן של הגולש (`enforceVisitorLocation`)
+
+ברירת המחדל: השער מחושב לפי לוח הזמנים של **ישראל** בלבד, לכל גולש בעולם. ברגע שיוצאת
+שבת בישראל, האתר נפתח לכולם - גם לגולש בארה"ב שאצלו עדיין שבת.
+
+עם `enforceVisitorLocation: true` השער הופך ל**איחוד של שתי שבתות**: האתר סגור לגולש אם
+זו שבת/יום-טוב בישראל **או** במיקום שממנו הוא גולש. דוגמה לגולש בניו יורק: הוא נחסם כבר
+מהדלקת הנרות בישראל (גם אם אצלו עדיין יום שישי בצהריים), ונשאר חסום ברצף עד צאת השבת
+המקומית שלו. חגים מחושבים לו לפי חשבון גלותי (יום-טוב שני של גלויות). חנוכה, פורים, יום
+העצמאות וחול המועד לא חוסמים - לא בישראל ולא בחו"ל.
+
+### הודעה בשפה מקומית לגולש מחו"ל
+
+כשגולש נמצא מחוץ לישראל, דף ה"סגור" הדיפולטי מציג קודם את ההודעה בעברית, ומתחתיה (עם
+רווח של שתי שורות) הודעה בשפת הדפדפן שלו (לפי כותרת `Accept-Language`). שפות מובנות:
+אנגלית (ברירת מחדל), צרפתית, רוסית, ספרדית, גרמנית, וערבית (מוצגת מימין לשמאל). גולש דובר
+עברית או גולש בישראל לא מקבל שורה שנייה. שעת הפתיחה מוצגת לגולש מחו"ל באזור הזמן שלו. זה עובד גם ללא
+`enforceVisitorLocation` (בכל פעם שהאתר סגור וידוע שהגולש בחו"ל).
+
 דוגמה מלאה:
 
 ```ts
@@ -134,8 +166,11 @@ export const onRequest: PagesFunction = (context) => gate(context);
    שבועיות + `maj=on` לחגים מרכזיים), עם `latitude`/`longitude` מועברים ישירות, כך שכל
    חלון מחושב נכון למיקום שהוגדר, לא רק החלון הקרוב ביותר.
 4. אם הוגדר `bufferMinutes`, הוא מוחל מעל החלונות שנשלפו לפני בדיקת הזמן.
-5. אם הזמן הנוכחי נופל בתוך חלון, מוצג דף ה"סגור" (HTTP 200). אחרת, האתר האמיתי עובר.
-6. כל שגיאה בדרך גורמת למעבר לאתר האמיתי.
+5. אם הוגדר `enforceVisitorLocation`, נשלף לוח זמנים שני לפי מיקום הגולש (מ-`request.cf`,
+   בחשבון גלותי לגולש מחוץ לישראל) ומאוחד עם חלונות ישראל - חוסמים אם הזמן נופל באחד
+   מהם. חלונות חופפים ממוזגים לחלון רציף אחד כדי ששעת הפתיחה המוצגת תהיה מדויקת.
+6. אם הזמן הנוכחי נופל בתוך חלון, מוצג דף ה"סגור" (HTTP 200). אחרת, האתר האמיתי עובר.
+7. כל שגיאה בדרך גורמת למעבר לאתר האמיתי.
 
 ## מפתח קאש פנימי
 

package/README.md

@@ -99,15 +99,49 @@ export interface ShabbatGateConfig {
     reasonLabel: string;
     closingLabel: string;
     untilLabel: string;
+    /** Optional localized message shown below the Hebrew one (with a blank-line
+     *  gap), for a visitor outside Israel, in their own browser language. Absent
+     *  for visitors in Israel, Hebrew-speaking visitors, or unknown location. */
+    secondary?: { dir: 'ltr' | 'rtl'; lines: string[] };
   }) => string;
 
   /** Minutes to close the site *before* candle-lighting and reopen *after*
    *  havdalah, on top of the raw Hebcal window. Defaults to 0. Useful padding
    *  against clock drift / last-minute browsing right at the boundary. */
   bufferMinutes?: number;
+
+  /** When `true`, also block a visitor during Shabbat/Yom Tov in *their own*
+   *  location (from Cloudflare's `request.cf` geolocation), not only Israel's.
+   *  Closed to them if it's Shabbat in Israel *or* where they are - so an
+   *  overseas visitor stays blocked from Israel's candle-lighting through their
+   *  own local havdalah. Holidays for a visitor outside Israel use diaspora
+   *  two-day Yom Tov reckoning. Defaults to `false` (Israel-only). Falls back to
+   *  the Israel-only decision when a request has no geolocation (local dev,
+   *  unplaceable IP). */
+  enforceVisitorLocation?: boolean;
 }
 ```
 
+### Blocking by the visitor's timezone too (`enforceVisitorLocation`)
+
+By default the gate uses **Israel's** calendar for every visitor worldwide: the moment
+Shabbat ends in Israel, the site reopens for everyone - including a US visitor for whom it's
+still Shabbat. Set `enforceVisitorLocation: true` to make it the **union of two Shabbatot**:
+the site is closed to a visitor if it's Shabbat/Yom Tov in Israel **or** where they are. A New
+York visitor is then blocked from Israel's candle-lighting (even if it's still Friday afternoon
+for them) continuously through their own local havdalah. Holidays are reckoned diaspora-style
+(two-day Yom Tov) for visitors abroad. Chanukah, Purim, Yom HaAtzma'ut and Chol HaMoed never
+block, in Israel or abroad.
+
+### Localized message for visitors abroad
+
+When a visitor is outside Israel, the default holding page shows the Hebrew message first,
+then (below a two-line gap) a message in their browser language (from `Accept-Language`).
+Built-in languages: English (default/fallback), French, Russian, Spanish, German, and Arabic
+(rendered right-to-left). Hebrew speakers and visitors in Israel get no second message; the
+reopen time is shown in the visitor's own timezone. This works even without `enforceVisitorLocation` (whenever the site is
+closed and the visitor is known to be abroad).
+
 Full example:
 
 ```ts
@@ -134,9 +168,13 @@ export const onRequest: PagesFunction = (context) => gate(context);
    endpoint (`ss=on` for weekly Shabbat + `maj=on` for major holidays), passing `latitude`/
    `longitude` directly so every window is correctly localized, not just the nearest one.
 4. `bufferMinutes` (if set) is applied on top of the fetched windows before the time check.
-5. If the current time falls inside a window, serve the holding page (HTTP 200). Otherwise let
+5. If `enforceVisitorLocation` is set, a second window list is fetched for the visitor's own
+   location (from `request.cf`, diaspora reckoning when abroad) and unioned with Israel's -
+   blocking if the time falls inside either. Overlapping windows are coalesced into one
+   continuous window so the shown reopen time is accurate.
+6. If the current time falls inside a window, serve the holding page (HTTP 200). Otherwise let
    the real site through.
-6. Any error along the way falls through to the real site.
+7. Any error along the way falls through to the real site.
 
 ## Internal cache key
 

package/dist/hebcal.d.ts

@@ -20,6 +20,12 @@ interface HebcalItem {
      *  recently in the feed (which leaks into unrelated windows - see below). */
     memo?: string;
 }
+/** Hebcal's own "candles"/"havdalah" items always carry the generic literal
+ *  "הדלקת נרות"/"הבדלה" in their `hebrew` field, never the occasion name - so
+ *  it's unusable as a display label on its own. For a plain Shabbat week
+ *  (no accompanying `holiday` item), fall back to this fixed pair instead. */
+export declare const SHABBAT_LABEL = "\u05E9\u05D1\u05EA \u05E7\u05D5\u05D3\u05E9";
+export declare const SHABBAT_CLOSING_LABEL = "\u05D4\u05E9\u05D1\u05EA";
 /**
  * Pairs candles/havdalah events into continuous windows. Multi-day holidays
  * (e.g. Rosh Hashana) emit two "candles" events but only one "havdalah" at the
@@ -44,9 +50,24 @@ export declare function pairWindows(items: HebcalItem[], defaults?: {
     label: string;
     closingLabel: string;
 }): Window[];
+export interface FetchWindowsOptions {
+    /** `true` (default) = Israel single-day Yom Tov reckoning (`i=on`). `false` =
+     *  diaspora two-day Yom Tov reckoning (`i=off`), correct for a visitor
+     *  physically outside Israel. Only affects how many days a *Torah* Yom Tov
+     *  spans - the `maj=on&min=off&mod=off` filter is independent of `i`, so
+     *  Chanukah/Purim/Yom HaAtzma'ut/Chol HaMoed stay excluded either way. */
+    israelMode?: boolean;
+    /** IANA timezone the candle-lighting/havdalah times are computed against
+     *  (defaults to `'Asia/Jerusalem'`). Pass the visitor's own timezone when
+     *  computing their local windows so day boundaries line up with their sunset,
+     *  not Jerusalem's. */
+    tzid?: string;
+}
 /**
- * Fetches and merges Shabbat + major-holiday (Israel single-day Yom Tov mode)
- * windows for the next ~45 days from Hebcal's free public JSON API.
+ * Fetches and merges Shabbat + major-holiday windows for the next ~45 days from
+ * Hebcal's free public JSON API. Defaults to Israel single-day Yom Tov mode at
+ * Jerusalem's timezone; pass `options` to compute windows for a visitor's own
+ * location/reckoning instead (see {@link FetchWindowsOptions}).
  *
  * Uses a *single* call to the `/hebcal` endpoint (not the separate `/shabbat`
  * endpoint) with `ss=on` added, passing `latitude`/`longitude` directly
@@ -60,7 +81,22 @@ export declare function pairWindows(items: HebcalItem[], defaults?: {
  * range, correctly localized, in one chronologically-ordered, already-merged
  * list - which also means there's nothing left to de-duplicate.
  */
-export declare function fetchWindows(latitude: number, longitude: number): Promise<Window[]>;
+export declare function fetchWindows(latitude: number, longitude: number, options?: FetchWindowsOptions): Promise<Window[]>;
+/**
+ * Coalesces overlapping/touching windows into continuous ones. Needed when two
+ * independently-computed window lists are unioned (e.g. Israel's Shabbat and a
+ * foreign visitor's local Shabbat, which partially overlap): naively searching
+ * the concatenated list with {@link findActiveWindow} would return whichever
+ * matching window comes first and report *its* `end`, so a visitor sitting
+ * inside both windows could be told the site reopens at Israel's (earlier)
+ * havdalah while they're still blocked by their own later one. Merging first
+ * makes the reported reopen time the true end of the combined block.
+ *
+ * When two windows overlap, the merged window keeps the label of whichever one
+ * ends *later* - that's the occasion actually keeping the visitor blocked, and
+ * the one whose end time is shown.
+ */
+export declare function mergeWindows(windows: Window[]): Window[];
 /** Pure function: is `now` inside any of the given windows? */
 export declare function isBlocked(windows: Window[], now: number): boolean;
 /** Pure function: the window covering `now`, if any. */

package/dist/hebcal.js

@@ -2,8 +2,8 @@
  *  "הדלקת נרות"/"הבדלה" in their `hebrew` field, never the occasion name - so
  *  it's unusable as a display label on its own. For a plain Shabbat week
  *  (no accompanying `holiday` item), fall back to this fixed pair instead. */
-const SHABBAT_LABEL = 'שבת קודש';
-const SHABBAT_CLOSING_LABEL = 'השבת';
+export const SHABBAT_LABEL = 'שבת קודש';
+export const SHABBAT_CLOSING_LABEL = 'השבת';
 /**
  * Pairs candles/havdalah events into continuous windows. Multi-day holidays
  * (e.g. Rosh Hashana) emit two "candles" events but only one "havdalah" at the
@@ -61,8 +61,10 @@ function toISODate(date) {
     return date.toISOString().slice(0, 10);
 }
 /**
- * Fetches and merges Shabbat + major-holiday (Israel single-day Yom Tov mode)
- * windows for the next ~45 days from Hebcal's free public JSON API.
+ * Fetches and merges Shabbat + major-holiday windows for the next ~45 days from
+ * Hebcal's free public JSON API. Defaults to Israel single-day Yom Tov mode at
+ * Jerusalem's timezone; pass `options` to compute windows for a visitor's own
+ * location/reckoning instead (see {@link FetchWindowsOptions}).
  *
  * Uses a *single* call to the `/hebcal` endpoint (not the separate `/shabbat`
  * endpoint) with `ss=on` added, passing `latitude`/`longitude` directly
@@ -76,17 +78,20 @@ function toISODate(date) {
  * range, correctly localized, in one chronologically-ordered, already-merged
  * list - which also means there's nothing left to de-duplicate.
  */
-export async function fetchWindows(latitude, longitude) {
+export async function fetchWindows(latitude, longitude, options = {}) {
+    const israelMode = options.israelMode ?? true;
+    const tzid = options.tzid ?? 'Asia/Jerusalem';
     const start = new Date();
     const end = new Date(start.getTime() + 45 * 24 * 60 * 60 * 1000);
     const startParam = toISODate(start);
     const endParam = toISODate(end);
-    // i=on = Israel single-day Yom Tov reckoning (not diaspora 2-day).
+    // i=on = Israel single-day Yom Tov reckoning; i=off = diaspora 2-day.
     // c=on = attach candles/havdalah entries to holidays, not just bare dates.
     // ss=on = weekly Shabbat candle-lighting/havdalah, localized to lat/long.
     // maj=on + everything else off = only real work-restricted Yom Tov days.
+    const iParam = israelMode ? 'on' : 'off';
     const url = `https://www.hebcal.com/hebcal?cfg=json&v=1&maj=on&min=off&mod=off&nx=off&mf=off&ss=on` +
-        `&c=on&i=on&latitude=${latitude}&longitude=${longitude}&tzid=Asia/Jerusalem` +
+        `&c=on&i=${iParam}&latitude=${latitude}&longitude=${longitude}&tzid=${encodeURIComponent(tzid)}` +
         `&start=${startParam}&end=${endParam}`;
     const res = await fetch(url);
     if (!res.ok) {
@@ -96,6 +101,38 @@ export async function fetchWindows(latitude, longitude) {
     const windows = pairWindows(data.items ?? [], { label: SHABBAT_LABEL, closingLabel: SHABBAT_CLOSING_LABEL });
     return windows.sort((a, b) => a.start - b.start);
 }
+/**
+ * Coalesces overlapping/touching windows into continuous ones. Needed when two
+ * independently-computed window lists are unioned (e.g. Israel's Shabbat and a
+ * foreign visitor's local Shabbat, which partially overlap): naively searching
+ * the concatenated list with {@link findActiveWindow} would return whichever
+ * matching window comes first and report *its* `end`, so a visitor sitting
+ * inside both windows could be told the site reopens at Israel's (earlier)
+ * havdalah while they're still blocked by their own later one. Merging first
+ * makes the reported reopen time the true end of the combined block.
+ *
+ * When two windows overlap, the merged window keeps the label of whichever one
+ * ends *later* - that's the occasion actually keeping the visitor blocked, and
+ * the one whose end time is shown.
+ */
+export function mergeWindows(windows) {
+    const sorted = [...windows].sort((a, b) => a.start - b.start);
+    const merged = [];
+    for (const w of sorted) {
+        const last = merged[merged.length - 1];
+        if (last && w.start <= last.end) {
+            if (w.end > last.end) {
+                last.end = w.end;
+                last.label = w.label;
+                last.closingLabel = w.closingLabel;
+            }
+        }
+        else {
+            merged.push({ ...w });
+        }
+    }
+    return merged;
+}
 /** Pure function: is `now` inside any of the given windows? */
 export function isBlocked(windows, now) {
     return findActiveWindow(windows, now) !== undefined;

package/dist/holdingPage.d.ts

@@ -1,8 +1,15 @@
+import type { SecondaryMessage } from './translations.js';
+export type { SecondaryMessage } from './translations.js';
 export interface HoldingPageContext {
     siteName: string;
     reasonLabel: string;
     closingLabel: string;
     untilLabel: string;
+    /** Optional localized message shown below the Hebrew one (with a blank-line
+     *  gap), for a visitor outside Israel, in their own browser language. Absent
+     *  for visitors in Israel, Hebrew-speaking visitors, or when the visitor's
+     *  location is unknown. */
+    secondary?: SecondaryMessage;
 }
 /** Simple, centered, mobile-responsive holding page. Inline CSS only, no external assets. */
 export declare function defaultRenderHoldingPage(ctx: HoldingPageContext): string;

package/dist/holdingPage.js

@@ -1,38 +1,58 @@
+/** Minimal HTML-escaping for text interpolated into the page. */
+function escapeHtml(text) {
+    return text
+        .replace(/&/g, '&')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;');
+}
+function renderSecondary(secondary) {
+    if (!secondary) {
+        return '';
+    }
+    const lines = secondary.lines.map((line) => `    <p>${escapeHtml(line)}</p>`).join('\n');
+    return `
+    <div class="secondary" dir="${secondary.dir}">
+${lines}
+    </div>`;
+}
 /** Simple, centered, mobile-responsive holding page. Inline CSS only, no external assets. */
 export function defaultRenderHoldingPage(ctx) {
-    return `<!doctype html>
-<html lang="he" dir="rtl">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<meta name="robots" content="noindex">
-<title>${ctx.siteName}</title>
-<style>
-  * { box-sizing: border-box; }
-  body {
-    margin: 0;
-    min-height: 100vh;
-    display: flex;
-    align-items: center;
-    justify-content: center;
-    font-family: system-ui, -apple-system, "Segoe UI", sans-serif;
-    background: #0f2138;
-    color: #f3efe4;
-    text-align: center;
-    padding: 24px;
-  }
-  .card { max-width: 480px; }
-  h1 { font-size: 1.5rem; margin: 0 0 12px; }
-  p { font-size: 1rem; line-height: 1.6; color: #c8a951; margin: 0 0 8px; }
-  .until { font-size: 0.9rem; color: #9fb0c4; }
-</style>
-</head>
-<body>
-  <div class="card">
-    <h1>${ctx.siteName}</h1>
-    <p>האתר סגור לכבוד ${ctx.reasonLabel}, ניפגש שוב אחרי צאת ${ctx.closingLabel}.</p>
-    <p class="until">שעת פתיחה משוערת: ${ctx.untilLabel}</p>
-  </div>
-</body>
+    return `<!doctype html>
+<html lang="he" dir="rtl">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="robots" content="noindex">
+<title>${escapeHtml(ctx.siteName)}</title>
+<style>
+  * { box-sizing: border-box; }
+  body {
+    margin: 0;
+    min-height: 100vh;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    font-family: system-ui, -apple-system, "Segoe UI", sans-serif;
+    background: #0f2138;
+    color: #f3efe4;
+    text-align: center;
+    padding: 24px;
+  }
+  .card { max-width: 480px; }
+  h1 { font-size: 1.5rem; margin: 0 0 12px; }
+  p { font-size: 1rem; line-height: 1.6; color: #c8a951; margin: 0 0 8px; }
+  .until { font-size: 0.9rem; color: #9fb0c4; }
+  /* The requested two blank lines of separation before the localized block. */
+  .secondary { margin-top: 3rem; }
+  .secondary p { font-size: 0.95rem; color: #d9d2c2; }
+</style>
+</head>
+<body>
+  <div class="card">
+    <h1>${escapeHtml(ctx.siteName)}</h1>
+    <p>האתר סגור לכבוד ${escapeHtml(ctx.reasonLabel)}, ניפגש שוב אחרי צאת ${escapeHtml(ctx.closingLabel)}.</p>
+    <p class="until">שעת פתיחה משוערת: ${escapeHtml(ctx.untilLabel)}</p>${renderSecondary(ctx.secondary)}
+  </div>
+</body>
 </html>`;
 }

package/dist/index.d.ts

@@ -1,7 +1,9 @@
 import { type HoldingPageContext } from './holdingPage.js';
-export type { Window } from './hebcal.js';
-export type { HoldingPageContext } from './holdingPage.js';
-export { isBlocked, findActiveWindow, pairWindows, fetchWindows } from './hebcal.js';
+export type { Window, FetchWindowsOptions } from './hebcal.js';
+export type { HoldingPageContext, SecondaryMessage } from './holdingPage.js';
+export type { SupportedLanguage } from './translations.js';
+export { isBlocked, findActiveWindow, mergeWindows, pairWindows, fetchWindows } from './hebcal.js';
+export { SUPPORTED_LANGUAGES, resolveVisitorLanguage } from './translations.js';
 export { isBot, BOT_PATTERN } from './botPattern.js';
 export { defaultRenderHoldingPage } from './holdingPage.js';
 export interface ShabbatGateConfig {
@@ -24,6 +26,16 @@ export interface ShabbatGateConfig {
      *  boundary - applied at decision time, not baked into the cached windows,
      *  so changing it takes effect immediately without waiting on the cache. */
     bufferMinutes?: number;
+    /** When `true`, also block a visitor during Shabbat/Yom Tov in *their own*
+     *  location (derived from Cloudflare's `request.cf` geolocation), not only
+     *  during Israel's. The site is then closed to them if it's Shabbat in Israel
+     *  *or* where they are - so an overseas visitor stays blocked from Israel's
+     *  candle-lighting right through their own local havdalah. Holidays for a
+     *  visitor outside Israel use diaspora two-day Yom Tov reckoning. Defaults to
+     *  `false` (Israel-only gate, the original behavior). If geolocation is
+     *  unavailable for a request (e.g. local `wrangler dev`, or an IP Cloudflare
+     *  can't place), that request falls back to the Israel-only decision. */
+    enforceVisitorLocation?: boolean;
 }
 /** Internal cache key for the merged window list (~24h TTL via the Workers
  *  Cache API). Exported so consumers that do their own caching of

package/dist/index.js

@@ -1,7 +1,9 @@
 import { isBot } from './botPattern.js';
-import { fetchWindows, findActiveWindow } from './hebcal.js';
+import { fetchWindows, findActiveWindow, mergeWindows, SHABBAT_LABEL } from './hebcal.js';
 import { defaultRenderHoldingPage } from './holdingPage.js';
-export { isBlocked, findActiveWindow, pairWindows, fetchWindows } from './hebcal.js';
+import { buildSecondaryMessage, resolveVisitorLanguage } from './translations.js';
+export { isBlocked, findActiveWindow, mergeWindows, pairWindows, fetchWindows } from './hebcal.js';
+export { SUPPORTED_LANGUAGES, resolveVisitorLanguage } from './translations.js';
 export { isBot, BOT_PATTERN } from './botPattern.js';
 export { defaultRenderHoldingPage } from './holdingPage.js';
 const JERUSALEM_LATITUDE = 31.7683;
@@ -12,15 +14,21 @@ const JERUSALEM_LONGITUDE = 35.2137;
  *  can pick a different key and avoid accidentally colliding with this one -
  *  which would silently serve stale, unprocessed windows for up to 24h. */
 export const INTERNAL_CACHE_KEY_URL = 'https://internal.cache/shabbat-gate-windows-v1';
+/** Cache-key prefix for per-visitor-location window lists. Keyed by rounded
+ *  coordinates + timezone + reckoning so all visitors within ~1° of each other
+ *  share one cached fetch (sunset differs by only a few minutes across a cell -
+ *  immaterial at "block the whole site or not" granularity). */
+const VISITOR_CACHE_KEY_PREFIX = 'https://internal.cache/shabbat-gate-visitor-v1';
 const CACHE_TTL_SECONDS = 24 * 60 * 60;
-async function getWindows(latitude, longitude) {
+/** Fetch a window list through the Workers Cache API under a fixed key. */
+async function getCachedWindows(cacheKeyUrl, fetcher) {
     const cache = caches.default;
-    const cacheRequest = new Request(INTERNAL_CACHE_KEY_URL);
+    const cacheRequest = new Request(cacheKeyUrl);
     const cached = await cache.match(cacheRequest);
     if (cached) {
         return (await cached.json());
     }
-    const windows = await fetchWindows(latitude, longitude);
+    const windows = await fetcher();
     const cacheResponse = new Response(JSON.stringify(windows), {
         headers: {
             'content-type': 'application/json',
@@ -30,9 +38,39 @@ async function getWindows(latitude, longitude) {
     await cache.put(cacheRequest, cacheResponse);
     return windows;
 }
-function formatJerusalemTime(epochMs) {
+/** Reads the visitor's geolocation from Cloudflare's `request.cf`. Returns
+ *  `null` when any needed field is missing/unparseable (local dev, an IP CF
+ *  can't place) so callers can fall back to the Israel-only decision. A visitor
+ *  physically in Israel gets Israel single-day reckoning; everyone else gets
+ *  diaspora two-day Yom Tov. */
+function readVisitorLocation(request) {
+    const cf = request.cf;
+    if (!cf) {
+        return null;
+    }
+    const latitude = Number(cf.latitude);
+    const longitude = Number(cf.longitude);
+    const tzid = typeof cf.timezone === 'string' ? cf.timezone : '';
+    if (!Number.isFinite(latitude) || !Number.isFinite(longitude) || !tzid) {
+        return null;
+    }
+    return { latitude, longitude, tzid, israelMode: cf.country === 'IL' };
+}
+/** Israel/Jerusalem windows - the base gate, always computed. */
+function getIsraelWindows(latitude, longitude) {
+    return getCachedWindows(INTERNAL_CACHE_KEY_URL, () => fetchWindows(latitude, longitude));
+}
+/** Windows for a specific visitor location, cached per rounded cell. */
+function getVisitorWindows(loc) {
+    const rlat = Math.round(loc.latitude);
+    const rlon = Math.round(loc.longitude);
+    const iParam = loc.israelMode ? 'on' : 'off';
+    const cacheKey = `${VISITOR_CACHE_KEY_PREFIX}?lat=${rlat}&lon=${rlon}&tz=${encodeURIComponent(loc.tzid)}&i=${iParam}`;
+    return getCachedWindows(cacheKey, () => fetchWindows(loc.latitude, loc.longitude, { israelMode: loc.israelMode, tzid: loc.tzid }));
+}
+function formatTime(epochMs, tzid) {
     return new Intl.DateTimeFormat('he-IL', {
-        timeZone: 'Asia/Jerusalem',
+        timeZone: tzid,
         day: '2-digit',
         month: '2-digit',
         hour: '2-digit',
@@ -67,17 +105,42 @@ async function evaluateGate(config, request) {
     try {
         const latitude = config.latitude ?? JERUSALEM_LATITUDE;
         const longitude = config.longitude ?? JERUSALEM_LONGITUDE;
-        const windows = applyBuffer(await getWindows(latitude, longitude), config.bufferMinutes ?? 0);
+        const bufferMinutes = config.bufferMinutes ?? 0;
+        // Read the visitor's location once - it drives both the optional extra
+        // enforcement (their local Shabbat windows) and the localized message /
+        // local-time display shown to a visitor outside Israel.
+        const visitor = readVisitorLocation(request);
+        const isAbroad = visitor !== null && !visitor.israelMode;
+        let windows = applyBuffer(await getIsraelWindows(latitude, longitude), bufferMinutes);
+        if (config.enforceVisitorLocation && visitor) {
+            const visitorWindows = applyBuffer(await getVisitorWindows(visitor), bufferMinutes);
+            // Union of both calendars: block if it's Shabbat/Yom Tov in Israel OR
+            // where the visitor is. Merge coalesces the overlap into one continuous
+            // block so the shown reopen time is the true end of both.
+            windows = mergeWindows([...windows, ...visitorWindows]);
+        }
         const active = findActiveWindow(windows, Date.now());
         if (!active) {
             return { type: 'pass' };
         }
+        // For a visitor abroad, show times in their own timezone (that's who is
+        // looking at the page) and append a message in their browser language.
+        const displayTzid = isAbroad ? visitor.tzid : 'Asia/Jerusalem';
+        const untilLabel = formatTime(active.end, displayTzid);
+        let secondary;
+        if (isAbroad) {
+            const language = resolveVisitorLanguage(request.headers.get('accept-language') ?? '');
+            if (language !== 'he') {
+                secondary = buildSecondaryMessage(language, active.label === SHABBAT_LABEL, untilLabel);
+            }
+        }
         const render = config.renderHoldingPage ?? defaultRenderHoldingPage;
         const html = render({
             siteName: config.siteName,
             reasonLabel: active.label,
             closingLabel: active.closingLabel,
-            untilLabel: formatJerusalemTime(active.end),
+            untilLabel,
+            secondary,
         });
         return { type: 'block', html };
     }

package/dist/translations.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Localized secondary holding-page messages, shown *below* the Hebrew message
+ * to a visitor physically outside Israel, in their own browser language.
+ *
+ * Deliberately generic: each pack only distinguishes "Shabbat" from "a Jewish
+ * holiday" and states the approximate reopen time - it never tries to name the
+ * specific holiday (Shmini Atzeret, Shavuot, ...), since reliably translating
+ * every occasion name into every language is out of scope. The exact occasion
+ * name stays on the Hebrew line only.
+ */
+export type SupportedLanguage = 'en' | 'fr' | 'ru' | 'es' | 'de' | 'ar';
+export declare const SUPPORTED_LANGUAGES: readonly SupportedLanguage[];
+/**
+ * Picks the visitor's display language from an `Accept-Language` header value.
+ * Walks the header's tags in the browser's stated order and returns the first
+ * one we have a pack for. Returns `'he'` (a signal to skip the second block
+ * entirely) if Hebrew is the visitor's top preference - they already read the
+ * Hebrew message, a translated copy would be redundant. Falls back to `'en'`
+ * when nothing matches.
+ */
+export declare function resolveVisitorLanguage(acceptLanguage: string): SupportedLanguage | 'he';
+export interface SecondaryMessage {
+    /** Text direction for the localized block (all current packs are `ltr`). */
+    dir: 'ltr' | 'rtl';
+    /** Localized lines to render, in order: [closed-reason, reopen-time]. */
+    lines: string[];
+}
+/** Builds the localized two-line block for a given language + occasion. */
+export declare function buildSecondaryMessage(language: SupportedLanguage, isShabbat: boolean, untilTime: string): SecondaryMessage;

package/dist/translations.js

@@ -0,0 +1,81 @@
+/**
+ * Localized secondary holding-page messages, shown *below* the Hebrew message
+ * to a visitor physically outside Israel, in their own browser language.
+ *
+ * Deliberately generic: each pack only distinguishes "Shabbat" from "a Jewish
+ * holiday" and states the approximate reopen time - it never tries to name the
+ * specific holiday (Shmini Atzeret, Shavuot, ...), since reliably translating
+ * every occasion name into every language is out of scope. The exact occasion
+ * name stays on the Hebrew line only.
+ */
+export const SUPPORTED_LANGUAGES = ['en', 'fr', 'ru', 'es', 'de', 'ar'];
+const PACKS = {
+    en: {
+        dir: 'ltr',
+        shabbat: 'This site is closed in observance of Shabbat.',
+        holiday: 'This site is closed in observance of a Jewish holiday.',
+        until: (time) => `We'll be back after nightfall, around ${time}.`,
+    },
+    fr: {
+        dir: 'ltr',
+        shabbat: 'Ce site est fermé en observance du Chabbat.',
+        holiday: 'Ce site est fermé en observance d’une fête juive.',
+        until: (time) => `Nous serons de retour après la tombée de la nuit, vers ${time}.`,
+    },
+    ru: {
+        dir: 'ltr',
+        shabbat: 'Этот сайт закрыт в честь субботы (Шаббата).',
+        holiday: 'Этот сайт закрыт в честь еврейского праздника.',
+        until: (time) => `Мы вернёмся после наступления темноты, примерно в ${time}.`,
+    },
+    es: {
+        dir: 'ltr',
+        shabbat: 'Este sitio está cerrado en observancia del Shabat.',
+        holiday: 'Este sitio está cerrado en observancia de una festividad judía.',
+        until: (time) => `Volveremos después del anochecer, alrededor de las ${time}.`,
+    },
+    de: {
+        dir: 'ltr',
+        shabbat: 'Diese Website ist zu Ehren des Schabbat geschlossen.',
+        holiday: 'Diese Website ist zu Ehren eines jüdischen Feiertags geschlossen.',
+        until: (time) => `Wir sind nach Einbruch der Nacht wieder da, gegen ${time}.`,
+    },
+    ar: {
+        dir: 'rtl',
+        shabbat: 'هذا الموقع مغلق احترامًا ليوم السبت (شابات).',
+        holiday: 'هذا الموقع مغلق احترامًا لعيد يهودي.',
+        until: (time) => `سنعود بعد حلول الظلام، حوالي ${time}.`,
+    },
+};
+/**
+ * Picks the visitor's display language from an `Accept-Language` header value.
+ * Walks the header's tags in the browser's stated order and returns the first
+ * one we have a pack for. Returns `'he'` (a signal to skip the second block
+ * entirely) if Hebrew is the visitor's top preference - they already read the
+ * Hebrew message, a translated copy would be redundant. Falls back to `'en'`
+ * when nothing matches.
+ */
+export function resolveVisitorLanguage(acceptLanguage) {
+    const tags = acceptLanguage
+        .split(',')
+        .map((part) => part.trim().split(';')[0].toLowerCase())
+        .filter(Boolean);
+    for (const tag of tags) {
+        const primary = tag.split('-')[0];
+        if (primary === 'he' || primary === 'iw') {
+            return 'he';
+        }
+        if (SUPPORTED_LANGUAGES.includes(primary)) {
+            return primary;
+        }
+    }
+    return 'en';
+}
+/** Builds the localized two-line block for a given language + occasion. */
+export function buildSecondaryMessage(language, isShabbat, untilTime) {
+    const pack = PACKS[language];
+    return {
+        dir: pack.dir,
+        lines: [isShabbat ? pack.shabbat : pack.holiday, pack.until(untilTime)],
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shabbat-gate",
-  "version": "0.1.3",
+  "version": "0.2.0",
   "description": "Cloudflare Pages/Workers middleware that closes a site to human visitors during Shabbat and major Jewish holidays (Israel-observance rules), while always letting search engines and AI crawlers through.",
   "type": "module",
   "main": "./dist/index.js",