Skip to content
YAS.SH
CHANGELOG · v3.29.0

Changelog

Every release shipped to yas.sh. This tree is v3.29.0. Open the pages below, or use the contact page.

New pages in this tree
  • /remittanceRemittance Advice preflight. Will this RA upload? Local Shafafiya / DHPO CurrentRules.
  • /ar/remittanceإشعار التحويل. Arabic surface of the same preflight.
  • /sk/remittanceRemittance (SK). Slovak surface of the same preflight.
  • /investigateInvestigate. Goal → evidence-backed mission.
  • /ar/investigateحقّق. Arabic Investigate.
  • /sk/investigateVyšetrovanie. Slovak Investigate.
  • /labRecord lab. One-shot SPF / DMARC / BIMI / MTA-STS — not hosted EasySPF.
  • /ar/labالمعمل. Arabic lab.
  • /sk/labLaboratórium. Slovak lab.
v3.36.2

Add domain is back

  • Fixed: the previous release removed the Add domain button while adding the Remove button — the domains screen could delete but not create
  • The empty state now offers the same action, so a first domain can be added directly from it
  • New automated check asserts that every management screen still exposes create, list and delete, so an action cannot be dropped silently again
v3.36.1

Remove a sending domain, and a build fix

  • Sending domains can now be removed from the dashboard — previously the interface could only add them, so a mistyped domain stayed forever
  • Removing a verified domain asks for confirmation and spells out that sending stops immediately and the DKIM key is destroyed
  • The domains page now shows TTL and priority, copies the whole record set in one click, and shows per-record guidance
  • Fixed a build error introduced in 3.36.0 when the DNS record builder was split into its own module
v3.36.0

Domain setup now points you straight at your DNS provider

  • Domain verification detects where your DNS is hosted and links directly to the record editor for that zone, with provider-specific warnings such as Cloudflare's proxy setting
  • Optional bounce MX: when the operator configures a feedback host, the record set includes a ready-to-paste MX so a sending domain can receive bounces without you owning a mailbox
  • Records now show TTL and priority and can be copied as a single block, matching the layout other providers use
v3.35.1

Stronger DKIM keys and a deeper domain check

  • Fixed a build error introduced in 3.35.0 by the message hygiene helper
  • DKIM key size is now configurable at 2048, 3072 or 4096 bits, with the DNS trade-offs of each documented
  • Domain verification now also checks MX, MTA-STS and TLS-RPT, and reports the real size of your published DKIM key
v3.35.0

Every message now ships a text alternative and a valid HTML document

  • Fixed: HTML-only messages and bare HTML fragments cost spam-filter points on every send — the platform now adds a plain-text alternative and wraps fragments in a proper HTML document
  • Domain verification checks MX and DMARC and explains the deliverability impact instead of silently ignoring them
  • New deliverability audit: pnpm email:deliverability <domain> reports SPF lookup budget, DKIM key size, DMARC policy, MX, MTA-STS and TLS-RPT
v3.34.3

Configuration validator for the email module

  • New check reports where operator settings silently contradict the plan a customer is paying for — global kill switch, missing provider credentials, duplicate keys, and per-domain budgets that cap a paid plan
  • Run it with pnpm email:config against any .env file before deploying
v3.34.2

Paid send limits are actually applied at send time

  • Fixed: quota reservation still enforced free-tier recipient limits during sending, so a paid account was capped at 200 per day even while the dashboard showed its real plan
  • Fixed: the usage endpoint reported free-tier limits to paid accounts
  • Email settings now shows your real plan, retention, account sending state and — when sending is paused — exactly why and what happens next
  • Operators can read or release an account's sending state from the CLI instead of editing the database by hand
v3.34.1

Retention now follows the plan you pay for

  • Fixed: email retention deleted every account's messages at the free-tier window, so plans with longer retention lost data early — retention is now resolved per account
  • Cleaned up unused imports left by the entitlement refactor, clearing all lint warnings from the production build
v3.34.0

Email now reflects the plan you actually pay for

  • Fixed: the email module never read any billing record, so every account resolved to Free limits no matter which plan was purchased — send quotas, domains, API keys, contacts, templates and webhooks were all capped at the free tier
  • Fixed: the email sidebar displayed a hardcoded FREE PLAN badge and a hardcoded quota line; Arabic and Slovak ignored the plan entirely
  • Sending blocked by account state now explains which state and what happens next, instead of only saying contact support
  • New diagnostic: pnpm email:entitlement <email> reports plan, entitlement source, trust state and domain verification in one command
v3.33.0

Page context is now designed, not dumped — and speaks all three languages

  • Fixed: the tools directory description was being appended to all 74 individual tool pages, because it was mounted in a layout that also wraps every tool route
  • Fixed: /ar/tools, /sk/tools, /ar/pricing and /sk/pricing showed no page context at all — localized routes do not inherit those layouts
  • Rewritten presentation: lead paragraph, readable measure, capability cards with icons, numbered steps, audience chips and a collapsible FAQ instead of two large blocks of text
  • Arabic and Slovak now cover all 15 pages, not 5 — roughly 9,100 words of localized context
  • New page-by-language coverage check runs in CI so a page cannot ship with missing or unstructured content
v3.32.0

Pre-application audit: localized pages no longer mix languages

  • Long-form tool documentation is English-only, so it no longer renders inside Arabic and Slovak tool pages — those pages are now coherent in their own language
  • Arabic and Slovak tool pages are noindex until they carry localized long-form content, and are no longer submitted in the sitemap; they remain fully usable and re-enable themselves automatically once translated
  • /sk/blog is no longer submitted for indexing — there are no Slovak posts yet, so it was an empty listing
  • /search is now noindex: an internal search page is navigation, not content
  • /status — new explainer covering each component, how incidents are handled, and what to check first when something looks broken
v3.31.0

Monitoring explained, and hub pages now speak Arabic and Slovak

  • /monitoring — new explainer covering what monitoring watches, how scheduled scanning and verdict-change alerting work, what the first scan usually finds, and six FAQs
  • Arabic and Slovak explainers for /tools /monitoring /qr-code /pricing /docs — the /ar and /sk routes now render their own language instead of English
  • /login — concise context on what an account is for and how credentials are stored, without turning a sign-in screen into a landing page
  • Fixed a code-quality gate that flagged an English sentence in the JWT documentation as a TypeScript type annotation, because a colon happened to be followed by the word it looks for
v3.30.1

Every hub page now explains what it is for

  • /tools — the directory now explains what the 100 tools cover, how client-side and server-side execution differ, who the tools are for, and answers the questions people actually ask
  • Same treatment on /docs /blog /faq /solutions /compare /resources /integrations /qr-code /pricing /about /enterprise — roughly 4,400 words of new explanatory content
  • Tools catalog gained full SEO metadata (keywords, canonical, en/ar/sk hreflang, OpenGraph, Twitter) plus CollectionPage, ItemList and BreadcrumbList structured data
  • Fixed: two strings explaining double-escaped HTML entities contained a literal double-escaped entity, which failed the entity-verification test suite
v3.30.0

Every tool page now explains the standard it implements

  • All 74 indexable tools gained long-form documentation: how it works (keyed to the governing RFC), real-world use cases, pro tips, honest limitations and an FAQ
  • Median original content per tool page went from 119 to 642 words — roughly 40,900 words of new technical writing
  • Tool pages now emit schema.org FAQPage and BreadcrumbList structured data generated from the same content that is rendered
  • Ads render only where the page carries substantial publisher content, enforced in code rather than by a maintained allowlist
  • New `pnpm audit:deep-content` gate blocks any future tool from shipping thin
  • New `pnpm doctor` verifies a working tree against the file manifest and repairs missing files
v3.28.1

Changelog lists every new page URL — remittance is v3.28

v3.28.0

Remittance Advice preflight — predict the Shafafiya reject

  • /remittance (EN/AR/SK): local Remittance.Advice XML/JSON validator, file never leaves the tab
  • Rules from official RemittanceAdvice.xsd, CommonTypes DateTimeForm, CurrentRules (RA column) and 1,180 DoH denial codes
  • Upload verdict: 6 MB cap, filename reserved chars, DispositionFlag enum, RecordCount, rule 79 DenialCode, TKBK negatives, settlement dates
  • Honest skip: we do not ship live CPT/clinician license workbooks or call the Post Office
v3.27.3

Investigate + Lab: briefing desk, not a kebab-case dropdown

v3.27.2

EasyDMARC paid-gap lab

  • /lab: BIMI live check + Tiny P/S SVG validate + record generator (Managed BIMI is paid on EasyDMARC)
  • Local DMARC aggregate XML analyzer — no RUA inbox, XML never needs an account
  • Record studio: SPF / DMARC / DKIM placeholder / MTA-STS policy / TLS-RPT generators
  • Honest skip: we do not host EasySPF macros, RUA/RUF mailboxes, GeoMaps, or reputation alert subscriptions
v3.27.1

Labs competitors keep behind paid plans

  • SPF What-If: recursive RFC 7208 lookup budget + one-shot flatten (PowerSPF / AutoSPF / Instant SPF are paid)
  • DMARC enforcement rehearsal: none → quarantine → reject from live public records, not RUA
  • Message vs live domain: pasted headers correlated with today's SPF/DKIM/DMARC
  • Vendor aliases (Google, Microsoft, SendGrid, SES, Mailgun…) for include rehearsals
v3.27.0

Intelligence Engine — investigate, don't pick a tool

  • New /investigate console (EN / AR / SK): state a goal, YAS runs a multi-tool mission
  • Missions: domain twin, email deliverability, website health, URL safety, TLS, email-header forensics, JWT forensics, DNS
  • Evidence → Reasoning → Action findings; Fix-it snippets labeled generated and never auto-applied
  • Secret / PII guardian blocks PEM, cloud keys and live secrets before remote lookups
  • REST: GET/POST /api/v1/intelligence, POST /api/v1/intelligence/mission, secrets scan and compare
  • Ask YAS routes investigation-shaped questions to /investigate instead of a single utility
  • Before/after mission snapshots in the browser; Markdown / JSON / executive export
v3.26.2

Mac unzip lint + smoke CSRF headers

  • ESLint ignores macOS ._ AppleDouble files
  • Smoke tests send Origin on cookie POSTs and accept 302 or 308 redirects
v3.26.1

Blog dates build again; Node 26 accepted

  • Blog article pages build (ISO dates for search engines)
  • Start refuses to run if the last build failed
  • Node 22–26 accepted (pnpm engine warning gone on Node 26)
v3.26.0

Safer accounts and clearer product claims

  • Verification and welcome emails are queued so a restart does not drop them
  • Login and sign-up limits can use Redis when REDIS_URL is set
  • Removed 24/7 SLA wording we cannot verify
v3.25.0

Invite-only workspace, clearer privacy, and a more honest public site

  • Sign-up copy now matches reality: the workspace is invite-only. Request an invitation, or use the 100 free tools without an account
  • Cookie banner available in English, Arabic and Slovak. Google ads load only after you choose Accept All
  • Privacy and cookie policies explain Google AdSense and reCAPTCHA, with a link to how Google uses data on partner sites
  • Checkout is a real page again — it explains that paid plans are for invited accounts, instead of returning 404
  • Status page reports a live health check from your region and no longer pretends to be a published uptime SLA
  • Blog article dates and the status page address are fixed for search engines
  • Search and the sitemap focus on on-topic guides (email, DNS, links, QR) instead of listing every thin tool page
v3.24.2

Email module, invite-only beta, Arabic and Slovak surfaces

  • Transactional email workspace (domains, templates, logs) behind an invited account
  • Login, register and tool guides expanded in Arabic and Slovak
v3.23.0

YAS AI identity, site-aware guide, and CSS production fix

  • Fixed the 16 production CSS optimizer warnings at the source: unescaped Tailwind slash/comma selectors in the light-theme override layer are now valid CSS, with semantic design tokens replacing fragile white/opacity hacks
  • New AI YAS mark (Y letterform + intelligence spark) for the logo, favicon, chat avatar and app icon
  • Restored controlled brand-palette rotation on refresh; explicit ◈ choices stay locked in localStorage and never overwrite light/dark or font preferences
  • YAS AI chat redesigned: conversation history, ready state, copy/retry, RTL-safe Arabic + English, mobile layout
  • Ask YAS now answers only from published site knowledge, FAQ, tools and solutions — unknown questions offer Send to YAS Support
  • Support fallback uses the existing server-side email seam; unconfigured mail returns an honest error (never a fake send)
v3.22.1

Tuesday 128 default palette

  • Default brand tokens follow the Tuesday 128 lime + lavender look, with --brand-fg for readable text on solid fills
  • Light-mode accent stays deep green for WCAG contrast; other palettes remain available via the ◈ cycler
v3.22.0

Secure tokens, branded email, complete light theme

  • Environment-driven API keys and verification tokens
  • Professional branded email templates for every transactional message
  • Light theme completed across text, borders, prose and form controls
v3.21.0

Tool contract, guided catalog, Ask YAS recommendations

  • Link Checker contract fixed (browser-only tools no longer return a success-shaped API body)
  • One canonical tool definition drives catalog, pages, API metadata and tests
  • Ask YAS recommends tools and workflow packs from curated intents
v3.20.0

Hardening and content audit

  • Security, SEO and AdSense readiness hardening
  • Expanded reserved-alias protection and CSRF origin checks
v3.0.1

Enterprise release — production-ready platform

  • bug fixes
  • Oracle Linux 9 deployment kit: systemd unit, Nginx config, backup script, setup guide
v3.0.0

Enterprise release — production-ready platform

  • Full feature parity with yas.sh: resources, testimonials, compare, FAQ, changelog, community, plugins, integrations, QR landing, campaigns, heatmap
  • Server-side contact endpoint — provider key removed from client bundle
  • Password gate now uses POST — no passwords in URLs or logs
  • Live system status page with real /api/health checks
  • Newsletter with unsubscribe tokens and per-IP rate limiting
  • Cookie consent banner with settings page
  • OpenAPI 3.1 spec expanded to match every implemented endpoint
  • Search index covers all tools, docs, and case studies
  • ESLint 9 flat config + zero-warning lint pipeline
  • Tailwind typography plugin — article typography now renders correctly
  • Persisted light/dark mode; brand palette can rotate per session unless locked
  • SEO: full sitemap (docs, tools, case studies, all pages), JSON-LD on FAQ and articles
v2.1.0

Pass 2 hardening

  • Status and case-studies routes fixed
  • Contact form a11y + validation + honeypot
  • 52 bilingual articles with optimized WebP heroes
v2.0.0

Modular platform

  • Link engine with alias, password, expiry
  • QR studio (PNG/SVG)
  • Bot-filtered analytics
  • API keys with scopes
Ask YAS AI
🍪 Cookies & privacy. Essential cookies keep you signed in and remember language and theme. Google AdSense and reCAPTCHA are Google technologies: AdSense runs only after Accept All; reCAPTCHA loads on sign-in and contact forms. See how Google uses data: https://policies.google.com/technologies/partner-sites cookie policy · privacy policy.
Settings