@agentvisa/widget 0.2.0 → 0.2.2

package/dist/core.d.ts

@@ -3,6 +3,21 @@
  * Used by Express and Next.js middleware — no framework deps here.
  */
 export declare const DEFAULT_API_BASE = "https://api.agentvisa.ai";
+export declare const DEFAULT_REDIRECT_URL = "https://agentvisa.ai/for-agents";
+/**
+ * Detect whether an incoming request looks like an AI agent.
+ *
+ * Used to guard the viral redirect loop — we only send requests to
+ * agentvisa.ai/for-agents when there is evidence the requester is an
+ * AI agent that can act on the instructions there. Bot scrapers and
+ * human browsers get a plain 401 instead.
+ *
+ * Detection hierarchy:
+ *   Strong  (any one → true): RFC 9421 Signature-Input, Agent-Authorization header
+ *   Medium  (any one → true): known AI User-Agent pattern
+ *   Weak combo (both needed): no browser fingerprint headers + no text/html in Accept
+ */
+export declare function isLikelyAiAgent(headers: Record<string, string | string[] | undefined>): boolean;
 export interface AgentVisaConfig {
     /** Your widget ID from the AgentVisa dashboard */
     widgetId: string;
@@ -12,30 +27,56 @@ export interface AgentVisaConfig {
     apiBaseUrl?: string;
     /**
      * What to do when verification fails or token is missing.
-     * "block" (default) — return 401 and stop the request.
+     * "redirect" (default) — redirect the agent to redirectUrl (agentvisa.ai/for-agents).
+     * "block"    — return 401 and stop the request. The redirect_url is still included
+     *              in the JSON body so the agent knows where to go.
      * "passthrough" — attach result to request and continue; let your
      *   handler decide. Useful for soft-gating or analytics.
      */
-    onUnverified?: "block" | "passthrough";
+    onUnverified?: "redirect" | "block" | "passthrough";
+    /**
+     * Where to send unverified agents.
+     * Defaults to "https://agentvisa.ai/for-agents".
+     * Only used when onUnverified is "redirect".
+     */
+    redirectUrl?: string;
+    /**
+     * Timeout in milliseconds for the /v1/verify API call.
+     * Defaults to 5000ms (5 seconds).
+     * If the AgentVisa API does not respond within this window, callVerify()
+     * returns { valid: false, reason: "network_error" } — your onUnverified
+     * policy then applies, so your site stays up even if AgentVisa is down.
+     */
+    timeoutMs?: number;
 }
 export interface VerifyResult {
     valid: boolean;
     reason: string;
     plan?: string;
     widget_id?: string;
-    human_name?: string | null;
     verified_at?: string | null;
     expires_at?: string | null;
-    five_factor?: string;
-    age_over_18?: string;
-    age_over_21?: string;
-    multiple_agents_authorized?: string;
-    verifications_today?: number;
+    domain_verified?: boolean;
+    age_over_18?: "y" | "n" | "null";
+    age_over_21?: "y" | "n" | "null";
+    gov_id_pic_validation?: "y" | "n" | "null";
+    multiple_agents_authorized?: "y" | "n" | "null";
+    member_since?: string;
+    email_confirmed?: boolean;
+    phone_last4_confirmed?: boolean;
+    web_bot_auth_bound?: boolean;
 }
 /**
  * Call /v1/verify with a TemporaryToken.
- * Returns the full API response or a synthetic error result on network failure.
+ *
+ * @param temporaryToken  The tmp_xxx token from the agent's request header
+ * @param config          Resolved widget config (widgetId, apiKey, apiBaseUrl)
+ * @param forwardHeaders  Optional headers from the original agent request.
+ *                        Pass these so the backend can detect Web Bot Auth binding
+ *                        (Signature-Input header) and populate web_bot_auth_bound.
+ *
+ * Returns the full VerifyResult or a synthetic error result on network failure.
  */
-export declare function callVerify(temporaryToken: string, config: Required<AgentVisaConfig>): Promise<VerifyResult>;
+export declare function callVerify(temporaryToken: string, config: Required<AgentVisaConfig>, forwardHeaders?: Record<string, string | string[] | undefined>): Promise<VerifyResult>;
 export declare function resolveConfig(config: AgentVisaConfig): Required<AgentVisaConfig>;
 //# sourceMappingURL=core.d.ts.map

package/dist/core.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../src/core.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,eAAO,MAAM,gBAAgB,6BAA6B,CAAC;AAE3D,MAAM,WAAW,eAAe;IAC9B,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,GAAG,aAAa,CAAC;CACxC;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAE3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAC9B,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,QAAQ,CAAC,eAAe,CAAC,GAChC,OAAO,CAAC,YAAY,CAAC,CAcvB;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC,CAMhF"}
+{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../src/core.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,eAAO,MAAM,gBAAgB,6BAA6B,CAAC;AAC3D,eAAO,MAAM,oBAAoB,oCAAoC,CAAC;AA0BtE;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GACrD,OAAO,CAyBT;AAED,MAAM,WAAW,eAAe;IAC9B,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,UAAU,GAAG,OAAO,GAAG,aAAa,CAAC;IACpD;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IAGnB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAG3B,eAAe,CAAC,EAAE,OAAO,CAAC;IAG1B,WAAW,CAAC,EAAE,GAAG,GAAG,GAAG,GAAG,MAAM,CAAC;IACjC,WAAW,CAAC,EAAE,GAAG,GAAG,GAAG,GAAG,MAAM,CAAC;IACjC,qBAAqB,CAAC,EAAE,GAAG,GAAG,GAAG,GAAG,MAAM,CAAC;IAC3C,0BAA0B,CAAC,EAAE,GAAG,GAAG,GAAG,GAAG,MAAM,CAAC;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC;IAItB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAIhC,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,UAAU,CAC9B,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,QAAQ,CAAC,eAAe,CAAC,EACjC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GAC7D,OAAO,CAAC,YAAY,CAAC,CAqCvB;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC,CAQhF"}

package/dist/core.js

@@ -3,30 +3,119 @@
  * Used by Express and Next.js middleware — no framework deps here.
  */
 export const DEFAULT_API_BASE = "https://api.agentvisa.ai";
+export const DEFAULT_REDIRECT_URL = "https://agentvisa.ai/for-agents";
+// ── Agent signal detection ────────────────────────────────────────────────────
+/**
+ * Known AI agent / LLM user-agent substrings (case-insensitive).
+ * Not exhaustive — the UA check is a medium-confidence signal only.
+ * The strongest signals are RFC 9421 headers (Signature-Input, Agent-Authorization).
+ */
+const AI_UA_PATTERNS = [
+    /claude/i,
+    /anthropic/i,
+    /openai/i,
+    /chatgpt/i,
+    /gpt-[0-9]/i,
+    /gemini/i,
+    /cursor\//i,
+    /windsurf/i,
+    /codeium/i,
+    /perplexity/i,
+    /copilot/i,
+    /agentvisa/i,
+    /python-httpx/i,
+    /python-requests/i,
+];
+/**
+ * Detect whether an incoming request looks like an AI agent.
+ *
+ * Used to guard the viral redirect loop — we only send requests to
+ * agentvisa.ai/for-agents when there is evidence the requester is an
+ * AI agent that can act on the instructions there. Bot scrapers and
+ * human browsers get a plain 401 instead.
+ *
+ * Detection hierarchy:
+ *   Strong  (any one → true): RFC 9421 Signature-Input, Agent-Authorization header
+ *   Medium  (any one → true): known AI User-Agent pattern
+ *   Weak combo (both needed): no browser fingerprint headers + no text/html in Accept
+ */
+export function isLikelyAiAgent(headers) {
+    const h = (name) => {
+        const v = headers[name.toLowerCase()];
+        return Array.isArray(v) ? v[0] : (v ?? "");
+    };
+    // Strong: RFC 9421 Web Bot Auth — signed request almost certainly from AI operator
+    if (h("signature-input") || h("agent-authorization"))
+        return true;
+    // Medium: known AI User-Agent
+    const ua = h("user-agent");
+    if (ua && AI_UA_PATTERNS.some((p) => p.test(ua)))
+        return true;
+    // Weak combo: no browser fingerprint + no HTML in Accept
+    // Real browsers always send sec-fetch-* and always include text/html in Accept.
+    const hasBrowserFingerprint = !!h("sec-fetch-mode") || !!h("sec-fetch-site") || !!h("sec-ch-ua");
+    const accept = h("accept");
+    const acceptsHtml = accept.includes("text/html");
+    const looksLikeApiClient = accept.includes("application/json") || accept === "*/*" || accept === "";
+    if (!hasBrowserFingerprint && !acceptsHtml && looksLikeApiClient)
+        return true;
+    return false;
+}
 /**
  * Call /v1/verify with a TemporaryToken.
- * Returns the full API response or a synthetic error result on network failure.
+ *
+ * @param temporaryToken  The tmp_xxx token from the agent's request header
+ * @param config          Resolved widget config (widgetId, apiKey, apiBaseUrl)
+ * @param forwardHeaders  Optional headers from the original agent request.
+ *                        Pass these so the backend can detect Web Bot Auth binding
+ *                        (Signature-Input header) and populate web_bot_auth_bound.
+ *
+ * Returns the full VerifyResult or a synthetic error result on network failure.
  */
-export async function callVerify(temporaryToken, config) {
+export async function callVerify(temporaryToken, config, forwardHeaders) {
+    // Forward Signature-Input from the original agent request so the backend
+    // can detect Web Bot Auth binding and set web_bot_auth_bound in Pro responses.
+    const extraHeaders = {};
+    if (forwardHeaders) {
+        const sigInput = forwardHeaders["signature-input"];
+        if (sigInput) {
+            extraHeaders["signature-input"] = Array.isArray(sigInput) ? sigInput[0] : sigInput;
+        }
+    }
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), config.timeoutMs);
     try {
-        const url = `${config.apiBaseUrl}/v1/verify?token=${encodeURIComponent(temporaryToken)}&widget_id=${encodeURIComponent(config.widgetId)}`;
-        const response = await fetch(url, {
+        const response = await fetch(`${config.apiBaseUrl}/v1/verify`, {
             method: "POST",
             headers: {
                 "Content-Type": "application/json",
                 "X-Widget-Api-Key": config.apiKey,
+                ...extraHeaders,
             },
+            body: JSON.stringify({
+                token: temporaryToken,
+                widget_id: config.widgetId,
+            }),
+            signal: controller.signal,
         });
         return await response.json();
     }
     catch {
+        // Covers AbortError (timeout) and genuine network errors.
+        // Returning network_error lets the caller's onUnverified policy decide
+        // what to do — the site stays up even when AgentVisa is unreachable.
         return { valid: false, reason: "network_error" };
     }
+    finally {
+        clearTimeout(timer);
+    }
 }
 export function resolveConfig(config) {
     return {
         apiBaseUrl: DEFAULT_API_BASE,
-        onUnverified: "block",
+        onUnverified: "redirect",
+        redirectUrl: DEFAULT_REDIRECT_URL,
+        timeoutMs: 5000,
         ...config,
     };
 }

package/dist/core.js.map

@@ -1 +1 @@
-{"version":3,"file":"core.js","sourceRoot":"","sources":["../src/core.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,0BAA0B,CAAC;AAkC3D;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,cAAsB,EACtB,MAAiC;IAEjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,UAAU,oBAAoB,kBAAkB,CAAC,cAAc,CAAC,cAAc,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1I,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,kBAAkB,EAAE,MAAM,CAAC,MAAM;aAClC;SACF,CAAC,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAkB,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACnD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAuB;IACnD,OAAO;QACL,UAAU,EAAE,gBAAgB;QAC5B,YAAY,EAAE,OAAO;QACrB,GAAG,MAAM;KACV,CAAC;AACJ,CAAC"}
+{"version":3,"file":"core.js","sourceRoot":"","sources":["../src/core.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,0BAA0B,CAAC;AAC3D,MAAM,CAAC,MAAM,oBAAoB,GAAG,iCAAiC,CAAC;AAEtE,iFAAiF;AAEjF;;;;GAIG;AACH,MAAM,cAAc,GAAa;IAC/B,SAAS;IACT,YAAY;IACZ,SAAS;IACT,UAAU;IACV,YAAY;IACZ,SAAS;IACT,WAAW;IACX,WAAW;IACX,UAAU;IACV,aAAa;IACb,UAAU;IACV,YAAY;IACZ,eAAe;IACf,kBAAkB;CACnB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAsD;IAEtD,MAAM,CAAC,GAAG,CAAC,IAAY,EAAU,EAAE;QACjC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACtC,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC;IAEF,mFAAmF;IACnF,IAAI,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,qBAAqB,CAAC;QAAE,OAAO,IAAI,CAAC;IAElE,8BAA8B;IAC9B,MAAM,EAAE,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC;IAC3B,IAAI,EAAE,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9D,yDAAyD;IACzD,gFAAgF;IAChF,MAAM,qBAAqB,GACzB,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACrE,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC3B,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACjD,MAAM,kBAAkB,GACtB,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,EAAE,CAAC;IAE3E,IAAI,CAAC,qBAAqB,IAAI,CAAC,WAAW,IAAI,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAE9E,OAAO,KAAK,CAAC;AACf,CAAC;AAgED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,cAAsB,EACtB,MAAiC,EACjC,cAA8D;IAE9D,yEAAyE;IACzE,+EAA+E;IAC/E,MAAM,YAAY,GAA2B,EAAE,CAAC;IAChD,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;QACnD,IAAI,QAAQ,EAAE,CAAC;YACb,YAAY,CAAC,iBAAiB,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QACrF,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAErE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,CAAC,UAAU,YAAY,EAAE;YAC7D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,kBAAkB,EAAE,MAAM,CAAC,MAAM;gBACjC,GAAG,YAAY;aAChB;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,KAAK,EAAE,cAAc;gBACrB,SAAS,EAAE,MAAM,CAAC,QAAQ;aAC3B,CAAC;YACF,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAkB,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;QAC1D,uEAAuE;QACvE,qEAAqE;QACrE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACnD,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAuB;IACnD,OAAO;QACL,UAAU,EAAE,gBAAgB;QAC5B,YAAY,EAAE,UAAU;QACxB,WAAW,EAAE,oBAAoB;QACjC,SAAS,EAAE,IAAI;QACf,GAAG,MAAM;KACV,CAAC;AACJ,CAAC"}

package/dist/express/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/express/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,eAAe,EAAE,YAAY,EAA6B,MAAM,YAAY,CAAC;AAEtF,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,CAAC;AAI9C,UAAU,GAAG;IACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,SAAS,CAAC,EAAE;QACV,QAAQ,EAAE,OAAO,CAAC;QAClB,MAAM,CAAC,EAAE,YAAY,CAAC;QACtB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED,UAAU,GAAG;IACX,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC;IAC1B,IAAI,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9C;AAED,KAAK,MAAM,GAAG,CAAC,GAAG,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;AAEtC,wBAAgB,SAAS,CAAC,MAAM,EAAE,eAAe,IAI7C,KAAK,GAAG,EACR,KAAK,GAAG,EACR,MAAM,MAAM,KACX,OAAO,CAAC,IAAI,CAAC,CA2CjB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/express/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,eAAe,EAAE,YAAY,EAA8C,MAAM,YAAY,CAAC;AAEvG,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,CAAC;AAI9C,UAAU,GAAG;IACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,SAAS,CAAC,EAAE;QACV,QAAQ,EAAE,OAAO,CAAC;QAClB,MAAM,CAAC,EAAE,YAAY,CAAC;QACtB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED,UAAU,GAAG;IACX,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC;IAC1B,IAAI,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9C;AAED,KAAK,MAAM,GAAG,CAAC,GAAG,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;AAEtC,wBAAgB,SAAS,CAAC,MAAM,EAAE,eAAe,IAI7C,KAAK,GAAG,EACR,KAAK,GAAG,EACR,MAAM,MAAM,KACX,OAAO,CAAC,IAAI,CAAC,CAkGjB"}

package/dist/express/index.js

@@ -17,11 +17,15 @@
  *   req.agentVisa.result    — full VerifyResult (if verified)
  *   req.agentVisa.reason    — failure reason (if not verified + passthrough mode)
  */
-import { callVerify, resolveConfig } from "../core.js";
+import { callVerify, resolveConfig, isLikelyAiAgent } from "../core.js";
 export function agentVisa(config) {
     const resolved = resolveConfig(config);
     return async function agentVisaMiddleware(req, res, next) {
-        const rawToken = req.headers["x-agentvisa-token"];
+        // Accept both header modes:
+        //   Standard:     X-AgentVisa-Token: tmp_xxx
+        //   Web Bot Auth: AgentVisa-Assertion: tmp_xxx (covered by RFC 9421 Signature-Input)
+        const rawAssertion = req.headers["agentvisa-assertion"];
+        const rawToken = rawAssertion ?? req.headers["x-agentvisa-token"];
         const token = Array.isArray(rawToken) ? rawToken[0] : rawToken;
         // ── No token present ────────────────────────────────────────────────────
         if (!token) {
@@ -29,28 +33,78 @@ export function agentVisa(config) {
                 req.agentVisa = { verified: false, reason: "no_token" };
                 return next();
             }
+            if (resolved.onUnverified === "redirect") {
+                // Only redirect if this actually looks like an AI agent.
+                // Bot scrapers and human browsers get a plain 401 — we don't want
+                // them flooding agentvisa.ai/for-agents or triggering the growth loop
+                // for non-agent traffic.
+                if (!isLikelyAiAgent(req.headers)) {
+                    res.setHeader("X-AgentVisa-Required", resolved.widgetId);
+                    res.status(401).json({
+                        error: "agentvisa_required",
+                        reason: "no_token",
+                        widget_id: resolved.widgetId,
+                        info_url: resolved.redirectUrl,
+                    });
+                    return;
+                }
+                res.setHeader("X-AgentVisa-Required", resolved.widgetId);
+                res.setHeader("Location", resolved.redirectUrl);
+                res.status(302).json({
+                    error: "agentvisa_required",
+                    reason: "no_token",
+                    widget_id: resolved.widgetId,
+                    signup_url: "https://agentvisa.ai/signup",
+                    info_url: resolved.redirectUrl,
+                    message: "This site requires an AgentVisa. Tell your human immediately to visit https://agentvisa.ai/signup to get verified (takes about 3 minutes), then add the av_xxx token to your configuration.",
+                });
+                return;
+            }
             res.setHeader("X-AgentVisa-Required", resolved.widgetId);
             res.status(401).json({
                 error: "agentvisa_required",
-                message: "This endpoint requires an AgentVisa verification token. " +
-                    "Call POST /v1/token/assert with your api/token and this widget_id " +
-                    "to get a TemporaryToken, then retry with X-AgentVisa-Token: <token>.",
+                reason: "no_token",
                 widget_id: resolved.widgetId,
+                signup_url: "https://agentvisa.ai/signup",
+                info_url: resolved.redirectUrl,
+                message: "This site requires an AgentVisa. Tell your human immediately to visit " +
+                    "https://agentvisa.ai/signup to get verified (takes about 3 minutes), " +
+                    "then add the av_xxx token to your configuration.",
             });
             return;
         }
         // ── Token present — verify it ───────────────────────────────────────────
-        const result = await callVerify(token, resolved);
+        // Forward original request headers so the backend can detect Signature-Input
+        // and populate web_bot_auth_bound in Pro responses.
+        const result = await callVerify(token, resolved, req.headers);
         if (!result.valid) {
             if (resolved.onUnverified === "passthrough") {
                 req.agentVisa = { verified: false, reason: result.reason, result };
                 return next();
             }
+            if (resolved.onUnverified === "redirect") {
+                res.setHeader("X-AgentVisa-Required", resolved.widgetId);
+                res.setHeader("Location", resolved.redirectUrl);
+                res.status(302).json({
+                    error: "agentvisa_verification_failed",
+                    reason: result.reason,
+                    widget_id: resolved.widgetId,
+                    signup_url: "https://agentvisa.ai/signup",
+                    info_url: resolved.redirectUrl,
+                    message: "AgentVisa verification failed (see reason field). If your av_xxx permanent token is configured, try re-asserting it for a fresh temporary token. If the problem persists, ask your human to check their account at https://agentvisa.ai/dashboard.",
+                });
+                return;
+            }
             res.setHeader("X-AgentVisa-Required", resolved.widgetId);
             res.status(401).json({
                 error: "agentvisa_verification_failed",
                 reason: result.reason,
                 widget_id: resolved.widgetId,
+                signup_url: "https://agentvisa.ai/signup",
+                info_url: resolved.redirectUrl,
+                message: "AgentVisa verification failed (see reason field). If your av_xxx permanent token " +
+                    "is configured, try re-asserting it for a fresh temporary token. If the problem " +
+                    "persists, ask your human to check their account at https://agentvisa.ai/dashboard.",
             });
             return;
         }

package/dist/express/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/express/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAiC,UAAU,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAuBtF,MAAM,UAAU,SAAS,CAAC,MAAuB;IAC/C,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAEvC,OAAO,KAAK,UAAU,mBAAmB,CACvC,GAAQ,EACR,GAAQ,EACR,IAAY;QAEZ,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAE/D,2EAA2E;QAC3E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,QAAQ,CAAC,YAAY,KAAK,aAAa,EAAE,CAAC;gBAC5C,GAAG,CAAC,SAAS,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;gBACxD,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,sBAAsB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACzD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,oBAAoB;gBAC3B,OAAO,EACL,0DAA0D;oBAC1D,oEAAoE;oBACpE,sEAAsE;gBACxE,SAAS,EAAE,QAAQ,CAAC,QAAQ;aAC7B,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,2EAA2E;QAC3E,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAEjD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,IAAI,QAAQ,CAAC,YAAY,KAAK,aAAa,EAAE,CAAC;gBAC5C,GAAG,CAAC,SAAS,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;gBACnE,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,sBAAsB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACzD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,+BAA+B;gBACtC,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,QAAQ,CAAC,QAAQ;aAC7B,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,2EAA2E;QAC3E,GAAG,CAAC,SAAS,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC3C,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/express/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAiC,UAAU,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAuBvG,MAAM,UAAU,SAAS,CAAC,MAAuB;IAC/C,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAEvC,OAAO,KAAK,UAAU,mBAAmB,CACvC,GAAQ,EACR,GAAQ,EACR,IAAY;QAEZ,4BAA4B;QAC5B,6CAA6C;QAC7C,qFAAqF;QACrF,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,YAAY,IAAI,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QAClE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAE/D,2EAA2E;QAC3E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,QAAQ,CAAC,YAAY,KAAK,aAAa,EAAE,CAAC;gBAC5C,GAAG,CAAC,SAAS,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;gBACxD,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YACD,IAAI,QAAQ,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;gBACzC,yDAAyD;gBACzD,kEAAkE;gBAClE,sEAAsE;gBACtE,yBAAyB;gBACzB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;oBAClC,GAAG,CAAC,SAAS,CAAC,sBAAsB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;oBACzD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBACnB,KAAK,EAAE,oBAAoB;wBAC3B,MAAM,EAAE,UAAU;wBAClB,SAAS,EAAE,QAAQ,CAAC,QAAQ;wBAC5B,QAAQ,EAAE,QAAQ,CAAC,WAAW;qBAC/B,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,SAAS,CAAC,sBAAsB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACzD,GAAG,CAAC,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;gBAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,oBAAoB;oBAC3B,MAAM,EAAE,UAAU;oBAClB,SAAS,EAAE,QAAQ,CAAC,QAAQ;oBAC5B,UAAU,EAAE,6BAA6B;oBACzC,QAAQ,EAAE,QAAQ,CAAC,WAAW;oBAC9B,OAAO,EAAE,6LAA6L;iBACvM,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,sBAAsB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACzD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,oBAAoB;gBAC3B,MAAM,EAAE,UAAU;gBAClB,SAAS,EAAE,QAAQ,CAAC,QAAQ;gBAC5B,UAAU,EAAE,6BAA6B;gBACzC,QAAQ,EAAE,QAAQ,CAAC,WAAW;gBAC9B,OAAO,EACL,wEAAwE;oBACxE,uEAAuE;oBACvE,kDAAkD;aACrD,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,2EAA2E;QAC3E,6EAA6E;QAC7E,oDAAoD;QACpD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAE9D,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,IAAI,QAAQ,CAAC,YAAY,KAAK,aAAa,EAAE,CAAC;gBAC5C,GAAG,CAAC,SAAS,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;gBACnE,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YACD,IAAI,QAAQ,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;gBACzC,GAAG,CAAC,SAAS,CAAC,sBAAsB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACzD,GAAG,CAAC,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;gBAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,+BAA+B;oBACtC,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,SAAS,EAAE,QAAQ,CAAC,QAAQ;oBAC5B,UAAU,EAAE,6BAA6B;oBACzC,QAAQ,EAAE,QAAQ,CAAC,WAAW;oBAC9B,OAAO,EAAE,oPAAoP;iBAC9P,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,sBAAsB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACzD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,+BAA+B;gBACtC,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,QAAQ,CAAC,QAAQ;gBAC5B,UAAU,EAAE,6BAA6B;gBACzC,QAAQ,EAAE,QAAQ,CAAC,WAAW;gBAC9B,OAAO,EACL,mFAAmF;oBACnF,iFAAiF;oBACjF,oFAAoF;aACvF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,2EAA2E;QAC3E,GAAG,CAAC,SAAS,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC3C,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -3,17 +3,34 @@ interface WidgetOptions {
     widgetId: string;
     plan?: Plan;
     apiBaseUrl?: string;
+    /**
+     * Redirect unverified agents to redirectUrl automatically.
+     * Default: true. Set to false to handle the result yourself.
+     */
+    redirectOnFail?: boolean;
+    /**
+     * Where to send unverified agents.
+     * Default: "https://agentvisa.ai/for-agents"
+     */
+    redirectUrl?: string;
 }
 interface VerificationResult {
     valid: boolean;
     reason: string;
     plan: Plan;
     widget_id: string;
-    human_name: string | null;
-    email: string | null;
-    phone: string | null;
     verified_at: string | null;
     expires_at: string | null;
+    domain_verified?: boolean;
+    human_name?: string | null;
+    email?: string | null;
+    phone?: string | null;
+    age_over_18?: "y" | "n" | "null";
+    age_over_21?: "y" | "n" | "null";
+    gov_id_pic_validation?: "y" | "n" | "null";
+    multiple_agents_authorized?: "y" | "n" | "null";
+    member_since?: string;
+    web_bot_auth_bound?: boolean;
 }
 
 declare class AgentVisa {

package/dist/next/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/next/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,eAAe,EAAE,YAAY,EAA6B,MAAM,YAAY,CAAC;AAEtF,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,CAAC;AAE9C,KAAK,WAAW,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEtE;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,eAAe,EACvB,OAAO,CAAC,EAAE,WAAW,GACpB,WAAW,CA8Bb"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/next/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,eAAe,EAAE,YAAY,EAA8C,MAAM,YAAY,CAAC;AAEvG,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,CAAC;AAE9C,KAAK,WAAW,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEtE;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,eAAe,EACvB,OAAO,CAAC,EAAE,WAAW,GACpB,WAAW,CAuDb"}

package/dist/next/index.js

@@ -28,7 +28,7 @@
  *   X-AgentVisa-Verified: true
  *   X-AgentVisa-Reason:   ok
  */
-import { callVerify, resolveConfig } from "../core.js";
+import { callVerify, resolveConfig, isLikelyAiAgent } from "../core.js";
 /**
  * Wrap a Next.js middleware handler (or use standalone).
  *
@@ -39,23 +39,46 @@ import { callVerify, resolveConfig } from "../core.js";
 export function withAgentVisa(config, handler) {
     const resolved = resolveConfig(config);
     return async function agentVisaMiddleware(request) {
-        const token = request.headers.get("x-agentvisa-token") ?? undefined;
+        // Accept both header modes:
+        //   Standard:     X-AgentVisa-Token: tmp_xxx
+        //   Web Bot Auth: AgentVisa-Assertion: tmp_xxx (covered by RFC 9421 Signature-Input)
+        const token = request.headers.get("agentvisa-assertion") ??
+            request.headers.get("x-agentvisa-token") ??
+            undefined;
+        // Convert Headers to a plain object so we can forward Signature-Input
+        const forwardHeaders = {};
+        request.headers.forEach((value, key) => { forwardHeaders[key] = value; });
         // ── No token ──────────────────────────────────────────────────────────
         if (!token) {
             if (resolved.onUnverified === "passthrough") {
                 const req = addVerificationHeaders(request, false, "no_token");
                 return handler ? handler(req) : passthroughResponse(req);
             }
-            return blockedResponse(resolved.widgetId, "no_token");
+            if (resolved.onUnverified === "redirect") {
+                // Only redirect if this actually looks like an AI agent.
+                // Bot scrapers and human browsers get a plain 401 — we don't want
+                // them flooding agentvisa.ai/for-agents or triggering the growth loop
+                // for non-agent traffic.
+                const reqHeaders = {};
+                request.headers.forEach((v, k) => { reqHeaders[k] = v; });
+                if (!isLikelyAiAgent(reqHeaders)) {
+                    return blockedResponse(resolved.widgetId, "no_token", resolved.redirectUrl);
+                }
+                return redirectResponse(resolved.widgetId, "no_token", resolved.redirectUrl);
+            }
+            return blockedResponse(resolved.widgetId, "no_token", resolved.redirectUrl);
         }
         // ── Verify ────────────────────────────────────────────────────────────
-        const result = await callVerify(token, resolved);
+        const result = await callVerify(token, resolved, forwardHeaders);
         if (!result.valid) {
             if (resolved.onUnverified === "passthrough") {
                 const req = addVerificationHeaders(request, false, result.reason);
                 return handler ? handler(req) : passthroughResponse(req);
             }
-            return blockedResponse(resolved.widgetId, result.reason);
+            if (resolved.onUnverified === "redirect") {
+                return redirectResponse(resolved.widgetId, result.reason, resolved.redirectUrl);
+            }
+            return blockedResponse(resolved.widgetId, result.reason, resolved.redirectUrl);
         }
         // ── Verified ──────────────────────────────────────────────────────────
         const req = addVerificationHeaders(request, true, "ok");
@@ -63,14 +86,37 @@ export function withAgentVisa(config, handler) {
     };
 }
 // ── Helpers ─────────────────────────────────────────────────────────────────
-function blockedResponse(widgetId, reason) {
+function redirectResponse(widgetId, reason, redirectUrl) {
+    const isVerificationFailure = reason !== "no_token";
+    return new Response(JSON.stringify({
+        error: isVerificationFailure ? "agentvisa_verification_failed" : "agentvisa_required",
+        reason,
+        widget_id: widgetId,
+        signup_url: "https://agentvisa.ai/signup",
+        info_url: redirectUrl,
+        message: isVerificationFailure
+            ? "AgentVisa verification failed (see reason field). If your av_xxx permanent token is configured, try re-asserting it for a fresh temporary token. If the problem persists, ask your human to check their account at https://agentvisa.ai/dashboard."
+            : "This site requires an AgentVisa. Tell your human immediately to visit https://agentvisa.ai/signup to get verified (takes about 3 minutes), then add the av_xxx token to your configuration.",
+    }), {
+        status: 302,
+        headers: {
+            "Content-Type": "application/json",
+            "Location": redirectUrl,
+            "X-AgentVisa-Required": widgetId,
+        },
+    });
+}
+function blockedResponse(widgetId, reason, redirectUrl) {
+    const isVerificationFailure = reason !== "no_token";
     return new Response(JSON.stringify({
-        error: "agentvisa_required",
+        error: isVerificationFailure ? "agentvisa_verification_failed" : "agentvisa_required",
         reason,
         widget_id: widgetId,
-        message: "This endpoint requires an AgentVisa verification token. " +
-            "Call POST /v1/token/assert with your api/token and this widget_id " +
-            "to get a TemporaryToken, then retry with X-AgentVisa-Token: <token>.",
+        signup_url: "https://agentvisa.ai/signup",
+        info_url: redirectUrl,
+        message: isVerificationFailure
+            ? "AgentVisa verification failed (see reason field). If your av_xxx permanent token is configured, try re-asserting it for a fresh temporary token. If the problem persists, ask your human to check their account at https://agentvisa.ai/dashboard."
+            : "This site requires an AgentVisa. Tell your human immediately to visit https://agentvisa.ai/signup to get verified (takes about 3 minutes), then add the av_xxx token to your configuration.",
     }), {
         status: 401,
         headers: {

package/dist/next/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/next/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAiC,UAAU,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAMtF;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAuB,EACvB,OAAqB;IAErB,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAEvC,OAAO,KAAK,UAAU,mBAAmB,CAAC,OAAgB;QACxD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,SAAS,CAAC;QAEpE,yEAAyE;QACzE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,QAAQ,CAAC,YAAY,KAAK,aAAa,EAAE,CAAC;gBAC5C,MAAM,GAAG,GAAG,sBAAsB,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;gBAC/D,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;YAC3D,CAAC;YACD,OAAO,eAAe,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACxD,CAAC;QAED,yEAAyE;QACzE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAEjD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,IAAI,QAAQ,CAAC,YAAY,KAAK,aAAa,EAAE,CAAC;gBAC5C,MAAM,GAAG,GAAG,sBAAsB,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;gBAClE,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;YAC3D,CAAC;YACD,OAAO,eAAe,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3D,CAAC;QAED,yEAAyE;QACzE,MAAM,GAAG,GAAG,sBAAsB,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACxD,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAC3D,CAAC,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,SAAS,eAAe,CAAC,QAAgB,EAAE,MAAc;IACvD,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;QACb,KAAK,EAAE,oBAAoB;QAC3B,MAAM;QACN,SAAS,EAAE,QAAQ;QACnB,OAAO,EACL,0DAA0D;YAC1D,oEAAoE;YACpE,sEAAsE;KACzE,CAAC,EACF;QACE,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,sBAAsB,EAAE,QAAQ;SACjC;KACF,CACF,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAAgB,EAChB,QAAiB,EACjB,MAAc;IAEd,wEAAwE;IACxE,gEAAgE;IAChE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;IAC1C,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE;QAC9B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO;QACP,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,mEAAmE;QACnE,MAAM,EAAE,MAAM;KACf,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAgB;IAC3C,sDAAsD;IACtD,uDAAuD;IACvD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,mBAAmB,EAAE,GAAG;YACxB,sBAAsB,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,OAAO;YAC9E,oBAAoB,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,SAAS;SAC7E;KACF,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/next/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAiC,UAAU,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAMvG;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAuB,EACvB,OAAqB;IAErB,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAEvC,OAAO,KAAK,UAAU,mBAAmB,CAAC,OAAgB;QACxD,4BAA4B;QAC5B,6CAA6C;QAC7C,qFAAqF;QACrF,MAAM,KAAK,GACT,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;YAC1C,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;YACxC,SAAS,CAAC;QAEZ,sEAAsE;QACtE,MAAM,cAAc,GAA2B,EAAE,CAAC;QAClD,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAE1E,yEAAyE;QACzE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,QAAQ,CAAC,YAAY,KAAK,aAAa,EAAE,CAAC;gBAC5C,MAAM,GAAG,GAAG,sBAAsB,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;gBAC/D,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;YAC3D,CAAC;YACD,IAAI,QAAQ,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;gBACzC,yDAAyD;gBACzD,kEAAkE;gBAClE,sEAAsE;gBACtE,yBAAyB;gBACzB,MAAM,UAAU,GAAuC,EAAE,CAAC;gBAC1D,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC1D,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,CAAC;oBACjC,OAAO,eAAe,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;gBAC9E,CAAC;gBACD,OAAO,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;YAC/E,CAAC;YACD,OAAO,eAAe,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC9E,CAAC;QAED,yEAAyE;QACzE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;QAEjE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,IAAI,QAAQ,CAAC,YAAY,KAAK,aAAa,EAAE,CAAC;gBAC5C,MAAM,GAAG,GAAG,sBAAsB,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;gBAClE,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;YAC3D,CAAC;YACD,IAAI,QAAQ,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;gBACzC,OAAO,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;YAClF,CAAC;YACD,OAAO,eAAe,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;QACjF,CAAC;QAED,yEAAyE;QACzE,MAAM,GAAG,GAAG,sBAAsB,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACxD,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAC3D,CAAC,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,SAAS,gBAAgB,CAAC,QAAgB,EAAE,MAAc,EAAE,WAAmB;IAC7E,MAAM,qBAAqB,GAAG,MAAM,KAAK,UAAU,CAAC;IACpD,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;QACb,KAAK,EAAE,qBAAqB,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,oBAAoB;QACrF,MAAM;QACN,SAAS,EAAE,QAAQ;QACnB,UAAU,EAAE,6BAA6B;QACzC,QAAQ,EAAE,WAAW;QACrB,OAAO,EAAE,qBAAqB;YAC5B,CAAC,CAAC,oPAAoP;YACtP,CAAC,CAAC,6LAA6L;KAClM,CAAC,EACF;QACE,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,UAAU,EAAE,WAAW;YACvB,sBAAsB,EAAE,QAAQ;SACjC;KACF,CACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB,EAAE,MAAc,EAAE,WAAmB;IAC5E,MAAM,qBAAqB,GAAG,MAAM,KAAK,UAAU,CAAC;IACpD,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;QACb,KAAK,EAAE,qBAAqB,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,oBAAoB;QACrF,MAAM;QACN,SAAS,EAAE,QAAQ;QACnB,UAAU,EAAE,6BAA6B;QACzC,QAAQ,EAAE,WAAW;QACrB,OAAO,EAAE,qBAAqB;YAC5B,CAAC,CAAC,oPAAoP;YACtP,CAAC,CAAC,6LAA6L;KAClM,CAAC,EACF;QACE,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,sBAAsB,EAAE,QAAQ;SACjC;KACF,CACF,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAAgB,EAChB,QAAiB,EACjB,MAAc;IAEd,wEAAwE;IACxE,gEAAgE;IAChE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;IAC1C,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE;QAC9B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO;QACP,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,mEAAmE;QACnE,MAAM,EAAE,MAAM;KACf,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAgB;IAC3C,sDAAsD;IACtD,uDAAuD;IACvD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,mBAAmB,EAAE,GAAG;YACxB,sBAAsB,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,OAAO;YAC9E,oBAAoB,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,SAAS;SAC7E;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/widget.esm.js

@@ -1,6 +1,7 @@
 const DEFAULT_API_BASE = "https://api.agentvisa.ai";
+const DEFAULT_REDIRECT_URL = "https://agentvisa.ai/for-agents";
 async function verifyToken(options) {
-    const { widgetId, plan = "basic", apiBaseUrl = DEFAULT_API_BASE, } = options;
+    const { widgetId, plan = "basic", apiBaseUrl = DEFAULT_API_BASE, redirectOnFail = true, redirectUrl = DEFAULT_REDIRECT_URL, } = options;
     const url = new URL("/v1/verify", apiBaseUrl);
     url.searchParams.set("widget_id", widgetId);
     url.searchParams.set("plan", plan);
@@ -18,7 +19,7 @@ async function verifyToken(options) {
         }),
     });
     if (!response.ok) {
-        return {
+        const result = {
             valid: false,
             reason: "network_error",
             plan,
@@ -29,8 +30,16 @@ async function verifyToken(options) {
             verified_at: null,
             expires_at: null,
         };
+        if (redirectOnFail && typeof window !== "undefined") {
+            window.location.href = redirectUrl;
+        }
+        return result;
     }
-    return response.json();
+    const result = await response.json();
+    if (!result.valid && redirectOnFail && typeof window !== "undefined") {
+        window.location.href = redirectUrl;
+    }
+    return result;
 }
 
 class AgentVisa {

package/dist/widget.js

@@ -5,8 +5,9 @@
 })(this, (function (exports) { 'use strict';
 
     const DEFAULT_API_BASE = "https://api.agentvisa.ai";
+    const DEFAULT_REDIRECT_URL = "https://agentvisa.ai/for-agents";
     async function verifyToken(options) {
-        const { widgetId, plan = "basic", apiBaseUrl = DEFAULT_API_BASE, } = options;
+        const { widgetId, plan = "basic", apiBaseUrl = DEFAULT_API_BASE, redirectOnFail = true, redirectUrl = DEFAULT_REDIRECT_URL, } = options;
         const url = new URL("/v1/verify", apiBaseUrl);
         url.searchParams.set("widget_id", widgetId);
         url.searchParams.set("plan", plan);
@@ -24,7 +25,7 @@
             }),
         });
         if (!response.ok) {
-            return {
+            const result = {
                 valid: false,
                 reason: "network_error",
                 plan,
@@ -35,8 +36,16 @@
                 verified_at: null,
                 expires_at: null,
             };
+            if (redirectOnFail && typeof window !== "undefined") {
+                window.location.href = redirectUrl;
+            }
+            return result;
         }
-        return response.json();
+        const result = await response.json();
+        if (!result.valid && redirectOnFail && typeof window !== "undefined") {
+            window.location.href = redirectUrl;
+        }
+        return result;
     }
 
     class AgentVisa {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentvisa/widget",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "AgentVisa widget + server middleware for Express and Next.js",
   "keywords": [
     "agentvisa",
@@ -16,10 +16,10 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/agentvisa/widget.git"
+    "url": "git+https://github.com/AgentVisa-ai/widget.git"
   },
   "bugs": {
-    "url": "https://github.com/agentvisa/widget/issues"
+    "url": "https://github.com/AgentVisa-ai/widget/issues"
   },
   "homepage": "https://agentvisa.ai",
   "type": "module",