shabbat-gate 0.4.0 → 0.4.2

package/CHANGELOG.md

@@ -3,7 +3,56 @@
 All notable changes to this package are documented here. Format loosely follows
 [Keep a Changelog](https://keepachangelog.com/).
 
-## [0.4.0] - Unreleased
+## [0.4.2] - Unreleased
+
+### Fixed
+
+- **A window-list refresh during Shabbat or a holiday dropped the closure in progress, so the
+  site reopened mid-Shabbat.** Found 2026-09-15 on a consumer site. `fetchWindows` asked Hebcal
+  for a range starting *today*; on a closed day the candle lighting was yesterday, so the
+  response held only the havdalah, `pairWindows` (which opens a window only on candles) ignored
+  it, and the list had no window covering `now`. The cache is fresh for 24 hours, so a list
+  fetched on Friday went stale on Saturday and the first visitor after that refreshed it into
+  an "open" answer for the rest of Shabbat. Same for Yom Kippur and every Yom Tov day after the
+  first. Verified against live Hebcal: a range starting 2026-09-19 does not block Saturday noon,
+  one starting 2026-09-21 does not block Yom Kippur noon.
+
+  The range now starts `HEBCAL_LOOKBACK_DAYS` (4) days back, which covers the longest closure
+  (a two-day Rosh Hashana running into Shabbat). Past windows in the list are harmless. Applies
+  to the visitor-location windows too. Regression test: a fetch on Saturday noon, with Hebcal's
+  start-date filtering simulated, must still report blocked.
+
+## [0.4.1] - 2026-08-29
+
+### Fixed
+
+- **`adsbot-google` in the crawler allowlist was cloaking under Google Ads policy - caused a
+  real Ads + Merchant Center account suspension.** Found 2026-08-29 on a consumer site: during
+  a gate closure window, AdsBot-Google (the crawler Google Ads uses to verify what a real ad
+  landing page shows) saw the full real site, while a human clicking the same ad saw the holding
+  page. Google's suspension notice for "עקיפת מערכות: הסוואה" (circumventing systems: cloaking)
+  described exactly this - showing Google's verification bot different content than what users
+  see - almost verbatim.
+
+  Removing the explicit `adsbot-google` term from `BOT_PATTERN`'s alternation alone would **not**
+  have fixed this: the pattern's generic `bot` alternative already matches the substring "Bot" in
+  "AdsBot-Google", so it stayed allowed regardless. `isBot()` now checks a dedicated
+  `AD_VERIFICATION_BOT_PATTERN` first and returns `false` before the broad pattern ever runs, so
+  these crawlers are gated exactly like a human visitor. Every other crawler in `BOT_PATTERN`
+  (Googlebot, Bingbot, GPTBot, ClaudeBot, etc.) is unaffected - organic/AI indexing during a
+  closure window is a different, broadly-tolerated risk category from a dedicated ad-verification
+  bot, which ad-network policy specifically requires to see what humans see.
+
+  Two more crawlers in the same risk category are excluded alongside AdsBot-Google, for the same
+  reason and hitting the same "bot" substring problem: **`Storebot-Google`** (Google
+  Merchant Center/Shopping's product landing-page verifier - directly relevant here, since
+  Merchant Center was the linked account also suspended) and **`adidxbot`** (Microsoft
+  Advertising/Bing Ads' equivalent landing-page verification crawler).
+
+  Regression tests assert `isBot()` returns `false` for AdsBot-Google, AdsBot-Google-Mobile,
+  Storebot-Google, and adidxbot user agents.
+
+## [0.4.0] - 2026-07-28
 
 ### Fixed
 

package/dist/botPattern.d.ts

@@ -1,8 +1,8 @@
 /**
  * Broad, case-insensitive allowlist for search engine and AI crawlers.
  * Matches let a request through unconditionally, before any gate logic runs.
- * Erring toward "let more things through" is the safe direction here, since
- * the whole point of this list is protecting SEO/crawlability.
+ * Erring toward "let more things through" is the safe direction for organic/AI
+ * crawlers, since the whole point of this list is protecting SEO/crawlability.
  */
 export declare const BOT_PATTERN: RegExp;
 export declare function isBot(userAgent: string): boolean;

package/dist/botPattern.js

@@ -1,10 +1,37 @@
 /**
  * Broad, case-insensitive allowlist for search engine and AI crawlers.
  * Matches let a request through unconditionally, before any gate logic runs.
- * Erring toward "let more things through" is the safe direction here, since
- * the whole point of this list is protecting SEO/crawlability.
+ * Erring toward "let more things through" is the safe direction for organic/AI
+ * crawlers, since the whole point of this list is protecting SEO/crawlability.
  */
-export const BOT_PATTERN = /bot|crawl|spider|slurp|googlebot|google-inspectiontool|adsbot-google|bingbot|duckduckbot|baiduspider|yandex|facebookexternalhit|twitterbot|linkedinbot|whatsapp|telegrambot|discordbot|applebot|gptbot|chatgpt-user|oai-searchbot|ccbot|claudebot|claude-web|anthropic-ai|perplexitybot|google-extended|bytespider|semrushbot|ahrefsbot|mj12bot|petalbot/i;
+export const BOT_PATTERN = /bot|crawl|spider|slurp|googlebot|google-inspectiontool|bingbot|duckduckbot|baiduspider|yandex|facebookexternalhit|twitterbot|linkedinbot|whatsapp|telegrambot|discordbot|applebot|gptbot|chatgpt-user|oai-searchbot|ccbot|claudebot|claude-web|anthropic-ai|perplexitybot|google-extended|bytespider|semrushbot|ahrefsbot|mj12bot|petalbot/i;
+/**
+ * Dedicated ad/shopping-network verification crawlers are deliberately NOT
+ * allowed through the gate, even though their user agents also match the
+ * generic `bot` term above (e.g. "AdsBot-Google" and "Storebot-Google" both
+ * contain the substring "bot", "adidxbot" ends in it) - excluding them from
+ * BOT_PATTERN's alternation alone would do nothing, since that bare substring
+ * still matches.
+ *
+ * Unlike organic/AI indexing crawlers, these bots exist specifically to
+ * verify that a live ad or shopping listing's destination page matches what a
+ * human clicking it sees - Google Ads, Google Merchant Center/Shopping, and
+ * Microsoft Advertising all require exactly that. Letting one bypass the gate
+ * means it sees the real site during a closure window while a human visitor
+ * sees the holding page - a textbook cloaking pattern, and the exact
+ * violation Google's policy team cited when it suspended a consumer's Ads +
+ * Merchant Center accounts over this (2026-08-29).
+ *
+ * - `adsbot-google` - AdsBot-Google / AdsBot-Google-Mobile, verifies Google
+ *   Ads landing pages.
+ * - `storebot-google` - verifies Google Shopping / Merchant Center product
+ *   landing pages against the submitted feed.
+ * - `adidxbot` - Microsoft Advertising's (Bing Ads) equivalent landing-page
+ *   verification crawler.
+ */
+const AD_VERIFICATION_BOT_PATTERN = /adsbot-google|storebot-google|adidxbot/i;
 export function isBot(userAgent) {
+    if (AD_VERIFICATION_BOT_PATTERN.test(userAgent))
+        return false;
     return BOT_PATTERN.test(userAgent);
 }

package/dist/hebcal.d.ts

@@ -50,6 +50,10 @@ export declare function pairWindows(items: HebcalItem[], defaults?: {
     label: string;
     closingLabel: string;
 }): Window[];
+/** How far back the Hebcal range starts. The longest closure is a two-day Rosh
+ *  Hashana running into Shabbat, whose first candles are lit three days before
+ *  it ends; four days covers it with a margin for the UTC date boundary. */
+export declare const HEBCAL_LOOKBACK_DAYS = 4;
 export interface FetchWindowsOptions {
     /** `true` (default) = Israel single-day Yom Tov reckoning (`i=on`). `false` =
      *  diaspora two-day Yom Tov reckoning (`i=off`), correct for a visitor
@@ -92,7 +96,8 @@ export declare class HebcalTimeoutError extends Error {
     constructor(timeoutMs: number);
 }
 /**
- * Fetches and merges Shabbat + major-holiday windows for the next ~45 days from
+ * Fetches and merges Shabbat + major-holiday windows from a few days back (so a
+ * closure already in progress is included) to ~45 days ahead, from
  * Hebcal's free public JSON API. Defaults to Israel single-day Yom Tov mode at
  * Jerusalem's timezone; pass `options` to compute windows for a visitor's own
  * location/reckoning instead (see {@link FetchWindowsOptions}).

package/dist/hebcal.js

@@ -60,6 +60,10 @@ export function pairWindows(items, defaults) {
 function toISODate(date) {
     return date.toISOString().slice(0, 10);
 }
+/** How far back the Hebcal range starts. The longest closure is a two-day Rosh
+ *  Hashana running into Shabbat, whose first candles are lit three days before
+ *  it ends; four days covers it with a margin for the UTC date boundary. */
+export const HEBCAL_LOOKBACK_DAYS = 4;
 /** Conservative default: Hebcal normally answers in well under a second, and
  *  the answer only has to be waited for on a cold cache anyway. */
 export const DEFAULT_HEBCAL_TIMEOUT_MS = 3000;
@@ -73,7 +77,8 @@ export class HebcalTimeoutError extends Error {
     }
 }
 /**
- * Fetches and merges Shabbat + major-holiday windows for the next ~45 days from
+ * Fetches and merges Shabbat + major-holiday windows from a few days back (so a
+ * closure already in progress is included) to ~45 days ahead, from
  * Hebcal's free public JSON API. Defaults to Israel single-day Yom Tov mode at
  * Jerusalem's timezone; pass `options` to compute windows for a visitor's own
  * location/reckoning instead (see {@link FetchWindowsOptions}).
@@ -93,8 +98,12 @@ export class HebcalTimeoutError extends Error {
 export async function fetchWindows(latitude, longitude, options = {}) {
     const israelMode = options.israelMode ?? true;
     const tzid = options.tzid ?? 'Asia/Jerusalem';
-    const start = new Date();
-    const end = new Date(start.getTime() + 45 * 24 * 60 * 60 * 1000);
+    // Start a few days back, not today: on a closed day the candle lighting that
+    // opened the closure was yesterday, and without it pairWindows drops the
+    // whole window - a refresh during Shabbat would reopen the site (2026-09-15).
+    const now = Date.now();
+    const start = new Date(now - HEBCAL_LOOKBACK_DAYS * 24 * 60 * 60 * 1000);
+    const end = new Date(now + 45 * 24 * 60 * 60 * 1000);
     const startParam = toISODate(start);
     const endParam = toISODate(end);
     // A specific city (geonameid) yields Hebcal's official times for that city;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shabbat-gate",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "description": "Cloudflare Pages/Workers middleware that closes a site to human visitors during Shabbat and major Jewish holidays (Israel-observance rules), while always letting search engines and AI crawlers through.",
   "type": "module",
   "main": "./dist/index.js",