יומן שינויים

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

How site owners (and their AI agents) should read this file

• Sites load the widget from a major-version URL (/v1/), so every 1.x.y release reaches them automatically. A new major version (2.0.0) never reaches a site until it changes its script URL.
• Entries that need something from the site owner start with [Action required] and say exactly what to change (usually a new or renamed config field). Entries without that marker need nothing.
• Entries caused by a change in Israeli accessibility law or IS 5568 start with [Legal] and link the official source.
• Machine-readable copy: https://shayach.co.il/v1/changelog.json, generated from this file at build time.

Unreleased

Added

• תפריט עליון דביק והצגת תפריט הנגישות והסריקה החינמית יחד בתחילת האתר.
• בדיקת אתר ראשונית לאורחים עם Turnstile, תצוגה חלקית וכניסה חינמית; סריקה פרטית בפאנל לאתרים פעילים של המשתמש, תוצאות מפורטות בעברית ומגבלות ברורות.
• פרוקסי אורח באותו origin, שימור התצוגה החלקית במהלך הביקור ותיעוד חיבור הסריקה. העברת הדוח המלא אחרי הרשמה עדיין אינה זמינה.

1.11.8 - 2026-10-07

Changed

• [Legal] Docs: documents offered for download on a site (PDF, Word, Excel, PowerPoint) that were prepared on or after 26 October 2017 must themselves meet IS 5568 Part 2 (September 2023), which applies WCAG 2.0 to digital documents (regulation 35א(ג)(1)). README.md, docs/guide.md, docs/ai-agents.md (with the ten success criteria and the national changes), llms.txt and the home page now say so, and that the widget cannot make documents accessible (Standards Institution, regulations on Nevo). Nothing to change in the config; if some of your documents are not accessible yet, list them in statement.knownLimitations.
• [Legal] Docs: the honesty notices in README.md, docs/ai-agents.md, docs/guide.md, llms.txt and the home page now also say that, besides lawsuits, the Commission can impose administrative fines for a website without an accessibility statement or a site or app without the required adjustments (section 26ז of the law and its Eighth Schedule), with the amounts in force from 1 January 2026 (ילקוט הפרסומים 14154, law on Nevo). Nothing to change.

1.11.7 - 2026-10-06

Added

• The owner gets a notification when a new person signs in to the panel for the first time and when someone adds a site (name, email, domain), through a Netlify form. The privacy page says so. Nothing changes on customer sites.

1.11.6 - 2026-10-06

Changed

• The widget configurator (/configurator/) is now for signed-in users only. Visitors who are not signed in are sent to the sign-in page and come back to the configurator after signing in. It is no longer in the sitemap or in the public menus for signed-out visitors, and it is marked noindex. Nothing changes on customer sites.

1.11.5 - 2026-10-06

Changed

• The management panel (/panel/) has a new look for signed-in users: a dark plum dashboard with an overview of weekly loads, active and paused sites, a list of sites that need attention, and a sites table with status and activity lines. Site details, adding a site and the admin overview moved into the same design. Nothing changes on customer sites.

1.11.4 - 2026-10-05

Added

• Bing Webmaster Tools site verification tag on the home page.

1.11.3 - 2026-10-05

Added

• Microsoft Clarity on the marketing pages of shayach.co.il (not the panel, not customer sites), with a matching section in the privacy page.

1.11.2 - 2026-10-05

Changed

• Search: structured data (TechArticle and breadcrumbs) on the docs pages, breadcrumbs on the statement pages, and more descriptive page titles. No page address changed.

1.11.1 - 2026-10-05

Changed

• Search: the privacy page is in the sitemap, the docs pages have a single top heading each, and two page descriptions are more specific.

1.11.0 - 2026-10-05

Changed

• The widget now loads only on sites registered at https://shayach.co.il/panel/. A page without a valid site key, or on a domain other than the registered one, shows no widget. Registration is free. Localhost is unaffected.

1.10.4 - 2026-10-05

Changed

• The panel is wider and roomier, the site list is easier to read, and the site key is no longer shown: the install code already contains it, so there is nothing to copy by hand.

1.10.3 - 2026-10-05

Changed

• The site header now shows the signed-in user's photo and email, with a menu for the panel and sign-out. Signed-out visitors still see the sign-in link.
• The management panel is redesigned: a clearer site page with numbered install steps, a seven-day activity chart, and separate pause, rename and remove actions that each explain what they do.

1.10.2 - 2026-10-05

Added

• A Google Search Console ownership file for shayach.co.il, needed to show the service name on Google's sign-in screen.

1.10.1 - 2026-10-05

Changed

• The panel at /panel/ is now a list of your sites on the side with the selected site's details next to it, and shows your Google photo and email once you are signed in.

Added

• A privacy page at /privacy/.
• A Google Search Console ownership file for shayach.co.il, needed to show the service name on Google's sign-in screen.

1.10.0 - 2026-10-05

Added

• Free registration and a management panel at https://shayach.co.il/panel/ (Google sign-in). Each site owner adds the domains they own and gets a site key and a ready snippet per site.
• siteKey config option and a site-key check: widget.js and statement.js now load only with a key that is registered, enabled and bound to the page's domain (www counts as the same site). Local development (localhost, 127.0.0.1) needs no key. Without a valid key nothing mounts and one console notice points to the panel. In this release the check only reports and does not block yet; blocking starts in the next minor release.
• An anonymous usage ping, at most once a day per browser: it adds one to a daily counter for the site key and stamps the site's last-seen time, so site owners can see the widget is active. No cookie, page address, referrer or visitor id is sent.
• The configurator has a site key field, and the generated code includes it.

Changed

• [Action required] Every site that embeds the widget must add siteKey to window.A11yConfig (register free at https://shayach.co.il/panel/). Strictly this is breaking inside 1.x; it ships as a minor release on /v1/ as a deliberate exception, because no site outside the owner's own had installed the widget yet.
• Docs, FAQ and llms.txt no longer say "no registration" or "no network requests": they describe the key check and the anonymous ping.
• widget.js gzip budget raised from 7 KB to 8 KB for the key check.

1.9.2 - 2026-10-05

Changed

• The site no longer reserves a rail for its own accessibility button; it floats and any visitor can drag it.
• Added an FAQ answer: visitors can drag the button if it bothers them, and the site owner is responsible for it not covering text.

1.9.1 - 2026-10-05

Fixed

• Reserve a site-matched rail for the site accessibility button so it does not cover reading content on mobile or desktop.

1.9.0 - 2026-10-04

Added

• Site: the configurator's statement step asks which screen readers the site was tested with (NVDA, JAWS, VoiceOver on iOS, TalkBack on Android), which pages depend on third-party content, and any temporary accessibility faults, and writes them to statement.assistiveTech, statement.thirdPartyPages and statement.temporaryNotices. The home page answers two more questions from the Commission's FAQ (no accessibility seal; which sites the regulation applies to), the AI agents page lists the new questions an agent asks, and the sample statement lists the screen readers it was tested with.

Changed

• [Legal] [Action required] The Commission's statement guide requires, whenever the situation exists, a partial-conformance declaration for pages whose accessibility depends on third-party content and ongoing notices in the statement about temporary accessibility faults; regulation 34(ד) requires telling the public about an interruption of an accessibility adjustment longer than a week, with the alternative means; and the Commission's FAQ requires listing in the statement the screen readers the site is accessible with (statement guide, FAQ, regulations on Nevo). docs/ai-agents.md, docs/guide.md, llms.txt and the schema descriptions now describe these fields as required when they apply, not as optional. What to do: set statement.assistiveTech to the screen readers the site was actually tested with (the Commission names JAWS, NVDA, VoiceOver on iOS and TalkBack on Android; at least one, and never one that was not tested); if any pages depend on third-party content (user comments, blogs, galleries, aggregated feeds, dynamic ads), list them in statement.thirdPartyPages; while a temporary accessibility fault lasts, describe it and what visitors can do meanwhile in statement.temporaryNotices, and remove it when fixed. The statement cannot detect these situations, so it never lists them as missing. The two ways to reach the statement stay required; links from several places and one link name everywhere are described as recommended.
• [Legal] [Action required] Statement: the third-party section now uses the partial-conformance wording of the Commission's statement guide, in all four languages: in terms of infrastructure the listed pages are accessible, but because their accessibility depends on a third party, they may not conform to the standard (gov.il). If your config lists statement.thirdPartyPages, check that the listed pages' own parts are accessible; if they are not, describe the problem in statement.knownLimitations instead. Sites without thirdPartyPages are not affected.
• [Legal] Docs: the honesty notices in README.md, docs/ai-agents.md, docs/guide.md and llms.txt, and the home page, now also cite the Commission's FAQ that it gives no accessibility seal for websites and that a statement does not stop the Commission or anyone else from checking the site or suing, and a new section "Who the regulation applies to" gives the FAQ's scope: any site serving the public in Israel wherever it is hosted, including sites abroad aimed at Israelis, sites serving only businesses and free services, but not a site serving only a public outside Israel (gov.il). Nothing to change.

1.8.1 - 2026-10-04

Changed

• Site: shayach.netlify.app now redirects every path to https://shayach.co.il with a permanent redirect. The widget and its /v1/ URL are unchanged. Nothing to change.

1.8.0 - 2026-10-04

Added

• Site: the configurator's statement step asks for the statement languages: Hebrew, English or both. With English the suggestions are in English, and with both every detail gets a Hebrew and an English field, the suggestions fill both, the code gets per-language values and the preview switches between the two languages.
• Statement: every text you write (the organization name and description, list items such as adjustments, notices, contact names and the like) can now be given once per language instead of as one string, for example organizationName: { he: "מאפיית הדוגמה", en: "Example Bakery" }. The statement shows the value in its own language, else the page's language, else the first value given. Plain strings work exactly as before. Nothing to change; see "Owner text in several languages" in docs/ai-agents.md.

Changed

• Widget: console warnings about invalid config values are shorter and all take one form: the option, the value and what the widget used instead (for example [shayach] icon.size: 120 is not valid; using 96.). The allowed values are in the schema and docs/ai-agents.md. This keeps widget.js small. Nothing to change.

1.7.0 - 2026-10-02

Added

• Widget: when both statement and statementUrl are set, the statement window also links to the statement page (new tab). Nothing to change: sites with both settings get the link automatically. With only statement the window has no link, and with only statementUrl the about card's button still links to the page.

1.6.4 - 2026-10-02

Changed

• Site: the statement page now says the business has no in-person reception, is open to search engines and is in the sitemap.

Fixed

• Site: the widget's "full statement" button opens the statement window on every page of the site (it navigated away on pages that had only the statement address).

1.6.3 - 2026-10-02

Changed

• Site: the accessibility statement page now lists the accessibility contact (name, phone, email) given by the owner.

1.6.2 - 2026-10-02

Added

• Site: the site's own accessibility statement page at /accessibility-statement/, linked from the footer and from the widget's about card. It lists only facts that were checked; the contact details and physical-service line are still listed as missing until the owner confirms them. The page is noindex until then.

Changed

• Widget: the button shows a grab cursor (grabbing while it is dragged), so visitors can tell it can be moved. Dragging itself is unchanged.

1.6.1 - 2026-10-02

Fixed

• Configurator: after ticking "already have a statement page", the address field now reliably receives focus in Safari-based browsers.

1.6.0 - 2026-10-02

Added

• Visitors can move the accessibility button: drag it (it snaps to the nearest of ten spots, five on each side) or choose a spot in the new "Button position" card in the panel, which also works with a keyboard. The choice is saved in the visitor's own browser for that site, and Reset settings puts the button back. Turn it off with icon.draggable: false.
• Four new button positions for icon.position and icon.mobile.position: upper-right, upper-left, lower-right, lower-left, a quarter and three quarters of the way down the screen.
• theme.scrollbar: the color of the scrollbars in the panel and the statement window. Default: theme.primary. A color below 3:1 against theme.surface is replaced with theme.text, with a warning.
• The panel's last card, "About the accessibility menu", says what the menu is, lists the tools this menu has, notes that it does not replace an accessible site, and opens the full statement.
• The generated statement opens in a readable window over the page: fact boxes, the contact details first, one block per section of the official template, and a print button that prints only the statement (in black on white, whatever the panel colors).
• statement.js: data-layout="blocks" on the container renders the same block layout, with a minimal style scoped to the statement that keeps the page's font and colors (tune it with the CSS custom properties --shayach-accent, --shayach-surface, --shayach-line and --shayach-muted). Without it the markup is unchanged.
• Site: the configurator has a new step, "Accessibility statement": a short form with a live preview, the statement page address (default /accessibility-statement, or the address of a page you already have), the statement page code (in the block layout), and instructions for each platform. It also offers the ten positions, the drag switch and the scrollbar color.

Changed

• The panel's sections are collapsible cards, one open at a time, with a badge showing how many adjustments are on in each.
• The statement window replaces the statement view inside the panel. The footer's "הצהרת נגישות" still links to statementUrl when it is set.
• The panel opens on the side where the button is now, also after a visitor moved it.
• The "could not load" message appears below the button when the button is in the top half of the screen.
• The panel's color contrast warnings are logged when the panel first opens instead of on page load. The button's own colors are still corrected before it appears.
• widget.js is now up to 7 KB gzip (was 6 KB), for the drag code.
• Compatibility: an older 1.x widget.js (for example a copy a visitor's browser cached before this release) warns about the four new position values and uses the default position, warns that icon.draggable and theme.scrollbar are unknown options and ignores them, and does not offer the position card, until the browser loads this version.

Removed

• icon.image: the button always shows the universal accessibility symbol, in the four shapes. A config that still sets icon.image gets an unknown-option warning in the console and the regular icon. No site had installed the widget with a custom image, so nothing needs to change.

1.5.0 - 2026-10-02

Added

• Site: the logo spheres as a soft background on every page. They drift slowly, move with scroll (parallax) and gently with the pointer on desktop. Static soft blobs under reduced-motion.

Changed

• Site: scrollbars match the site colors everywhere (page, code blocks, dialog, widget preview). The ink and muted text colors are slightly darker so text stays at AA contrast over the background.
• Widget: the panel's scrolling area uses the theme colors for its scrollbar (thumb from the primary color). No config change and nothing to do.

1.4.3 - 2026-10-02

Changed

• Site: configurator steps slide in the reading direction going forward and reverse going back, with a light scale and blur, and the step number pulses. Page-to-page navigation has a softer slide and fade with a steady header (browsers without view transitions get a fade-in on load). All motion is off under reduced-motion.

1.4.2 - 2026-10-02

Fixed

• Site: the configurator showed a "next step" button on the last step and a "back" button on the first, because the hidden attribute lost to the button display rule. Elements with the hidden attribute are now always hidden.
• Site: the paste dialog keeps one size when switching platforms. The instructions scroll inside it.

1.4.1 - 2026-10-02

Fixed

• Site: on narrow screens the configurator form was wider than the screen because of the code block, which clipped text on the left. Long links in the docs pages now wrap.

1.4.0 - 2026-10-02

Fixed

• Site: the configurator scripts and styles are always revalidated, so a cached page can no longer pair with an old script. The "where to paste" dialog jumps to the instructions on small screens after a platform is chosen, and has a way back to the list.
• Site: the next-step button on the last step before the code now reads "לקבלת הקוד".

Changed

• Site: the example accessibility statement page is restyled to match the site and moved to /statement/ (/statement.html redirects).
• Site: the docs have styled pages at /docs/guide/, /docs/ai-agents/, /docs/schema/ and /docs/changelog/, rendered from the same sources at build time. The raw .md and .json files are unchanged. The footer links point to the styled pages.

1.3.0 - 2026-10-02

Changed

• Site: the configurator no longer has a profiles step (4 steps now). The six profiles are still explained on the home page.
• Site: the paste guide is a dialog with a platform picker (WordPress, Wix, Shopify, Webflow, Squarespace, plain HTML, AI tools, Google Sites).
• Site: the "what is Shayach" section is redesigned. The FAQ is animated and pages fade between each other. All motion is off under reduced-motion.
• Site: the footer font credit line is removed (the font license file stays in the repo).
• Docs: the AI agents guide link in docs/guide.md points to the site.

1.2.1 - 2026-10-02

Fixed

• The site share images (/assets/og-image.png, /assets/og-image-square.png) render the Hebrew text in the site font.

1.2.0 - 2026-10-02

Added

• The Shayach website at the site root: a Hebrew home page that explains the widget, a configurator page that builds the script tag (language, colors, icon size, shape and position, with a live preview), and a page for AI agents. Includes favicons, share images, sitemap.xml, robots.txt and structured data.
• The Hebrew installation guide and the technical reference are also served as Markdown at /docs/guide.md and /docs/ai-agents.md.

Changed

• /llms.txt links to those two files on the site instead of GitHub, and lists the new pages. The widget files under /v1/ are unchanged.

1.1.0 - 2026-10-02

Added

• statement.js also renders into a container with the new attribute data-shayach-statement. The old attribute data-il-a11y-statement keeps working.

Changed

• The project is renamed Shayach (שייך). The repository is now github.com/blakazulu/shayach.
• The widget's address is now https://shayach.co.il/v1/widget.js (and https://shayach.co.il/v1/statement.js for the statement). The old address il-a11y-widget.netlify.app no longer works; no site had installed it yet. New installs use the new address, and the Content Security Policy instructions now name https://shayach.co.il.
• The widget's own element ids (#shayach, #shayach-overlay), the settings storage key (shayach:v1) and the console warning prefix ([shayach]) use the new name. Settings visitors saved under the old name are not carried over, so a returning visitor starts from the defaults once.

1.0.1 - 2026-10-02

Changed

• Documentation split into three documents: a Hebrew README for site owners and decision makers, a Hebrew step-by-step installation guide for owners with no technical background (docs/guide.md), and an English technical reference for AI agents and developers (docs/ai-agents.md). llms.txt now points to the new reference, and the demo page links to the Hebrew guide.

Fixed

• An empty updatedAt in the statement (as in the guide's fill-in template) is listed as not filled in yet, without a console warning.

1.0.0 - 2026-10-02

Added

• Project scaffolding: license (Apache 2.0 with NOTICE attribution), changelog, README, design document.
• Compliance agents: weekly law monitor, independent verifier, and applier, with a shared runner script and a GitHub Actions workflow.
• compliance/legal-state.json: single source of truth for Israeli website accessibility requirements, accessibility statement requirements and the official statement template, with a verification status on every item.
• Headless-browser fetcher for official sites that block plain fetching (gov.il, justice.gov.il).
• Widget loader (/v1/widget.js) with a configurable floating button: four shapes, six positions, size, offsets, mobile overrides, custom image and colors. Adds nothing to the page until a visitor uses it.
• Accessibility panel (side drawer) in Hebrew, Arabic, Russian and English with language switch, reset, hide for the session, keyboard and screen reader support, and automatic WCAG 2.2 AA text contrast for any theme.
• First adjustments: highlight links, highlight headings. Settings are remembered across pages.
• window.A11yConfig validation with console warnings, and its JSON Schema at /v1/config.schema.json.
• Text adjustments: font size (100% to 200%, scales px, rem and em sites without compounding, including content added later), line height, letter and word spacing (never letter-spaces Arabic), readable font, dyslexia font (OpenDyslexic, downloaded only when turned on), text alignment.
• Color adjustments: dark, light and high contrast, monochrome, low and high saturation. Filters apply to the root element so fixed headers keep working.
• [Action required] for sites with a Content Security Policy that want the dyslexia font: allow https://shayach.co.il in font-src.
• Navigation and display: stop animations (CSS animations, transitions, smooth scrolling, autoplaying videos, GIFs), hide images (kept for screen readers), emphasize focus, big cursor, reading guide, reading mask, and a page structure view to jump to headings and regions.
• Read aloud: click or focus any text to hear it with the device's voice for that language, with adjustable speed; disabled with an explanation when the device has no voice for the page language.
• Six one-click profiles: seizure safe, vision impaired, ADHD friendly, cognitive, dyslexia, keyboard navigation.
• Generated accessibility statement (הצהרת נגישות) in Hebrew, Arabic, Russian and English, following the Commission's official template, shown in the panel and on the site's own page with /v1/statement.js.
• [Legal] The statement covers every item in the Commission's guide on the accessibility statement (updated 15.04.2026), including measures taken, known limitations, temporary fault notices and partial conformance for third-party content (gov.il).
• [Action required] Add statement details to window.A11yConfig (organization name, updated date, adjustments made, contact, physical arrangements), publish a statement page, set statementUrl, and link the page from your footer: the Commission's guide requires at least two ways to reach the statement.
• [Legal] README documents the small-business exemption thresholds, where the regulation (100,000 ILS) and the Commission's guide (120,000 ILS) differ (Nevo, gov.il).
• llms.txt for AI agents at /llms.txt and a machine-readable changelog.json at /v1/changelog.json.

Changed

• Adjustments work under a strict Content-Security-Policy without style-src 'unsafe-inline'.

Fixed

• A saved read aloud on a device without a voice can now be turned off.
• A technological exemption without alternatives now logs a warning, because regulation 35ו(ג) requires publishing the alternative adjustments.
• Owner-written statement text keeps its own language marking when the statement is shown in another language, so screen readers pronounce it correctly. Write it in the site's language.
• statement: null is treated as no statement (no statement button).
• Reading guide and reading mask are disabled with an explanation on touch-only devices.
• Font size no longer touches the widget's own page overlay.
• Read aloud prefers voices installed on the device over online voices.
• Adjustments win over !important rules in CSS cascade layers (Tailwind v4 ! utilities) and over every unlayered page rule.
• The button, reading aids, font size, stop animations and contrast keep working when a site replaces the whole <body> on navigation (Turbo Drive, some single-page app routers).
• Dark and light contrast now also override colors a page sets with !important in an element's own style attribute, and restore them when turned off.
• Adjustments now also reach content inside open shadow roots (web components), including components added or defined after an adjustment is turned on. Closed shadow roots stay out of reach.
• Escape closes the panel after a mouse click inside it, also in Safari, which never focuses a clicked button.
• The statement container accepts only whole heading levels 1 to 4, is rendered once even if statement.js is included twice, and one broken container no longer stops the others. A phone number without digits is shown as plain text, and a contact with only a name now logs a warning.
• Font size honors an em or rem font-size the page sets later while scaling is active, and restores it exactly when turned off.