@dupecom/botcha-cloudflare 0.11.0 → 0.13.0

package/dist/analytics.js

@@ -30,10 +30,10 @@ export async function logAnalyticsEvent(analytics, event) {
             event.solveTimeMs || 0,
             event.responseTimeMs || 0,
         ];
+        // IMPORTANT: Analytics Engine only supports a SINGLE index.
+        // Multiple indexes silently drops the data point.
         const indexes = [
             event.eventType,
-            event.challengeType || 'none',
-            event.endpoint || 'unknown',
         ];
         analytics.writeDataPoint({
             blobs,

package/dist/dashboard/auth.d.ts

@@ -30,6 +30,14 @@ type Bindings = {
 type Variables = {
     dashboardAppId?: string;
 };
+/**
+ * Generate a 1-hour dashboard session JWT for the given app_id.
+ */
+export declare function generateSessionToken(appId: string, jwtSecret: string): Promise<string>;
+/**
+ * Set the dashboard session cookie on a response context.
+ */
+export declare function setSessionCookie(c: Context, token: string): void;
 /**
  * Middleware: Require dashboard authentication.
  *
@@ -117,13 +125,16 @@ export declare function handleDeviceCodeVerify(c: Context<{
     success: true;
     code: string;
     login_url: string;
+    magic_link: string;
     expires_in: number;
     instructions: string;
 }, import("hono/utils/http-status").ContentfulStatusCode, "json">)>;
 /**
  * GET /dashboard/code
+ * GET /dashboard/code/:code
  *
  * Renders the device code redemption page for humans.
+ * Supports pre-filled codes from URL path or query params.
  */
 export declare function renderDeviceCodePage(c: Context<{
     Bindings: Bindings;

package/dist/dashboard/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/dashboard/auth.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAMvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAKjD,KAAK,QAAQ,GAAG;IACd,UAAU,EAAE,WAAW,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,CAAC,EAAE,sBAAsB,CAAC;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;CACxB,CAAC;AAGF,KAAK,SAAS,GAAG;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAsCF;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,EAAE,iBAAiB,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAmChG,CAAC;AAIF;;;;;GAKG;AACH,wBAAsB,4BAA4B,CAAC,CAAC,EAAE,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC;;;;;;;;;;oEA2CpF;AAgDD;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAAC,CAAC,EAAE,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC;;;;;;;;;;;oEAwBjF;AAID;;;;GAIG;AACH,wBAAsB,yBAAyB,CAAC,CAAC,EAAE,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC;;;;;;;;;;oEAEjF;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,CAAC,EAAE,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC;;;;;;;;;;oEA2B9E;AAID;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,CAAC,EAAE,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC,qBAkE5E;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAAC,CAAC,EAAE,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC,gFAqB9E;AAID;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,CAAC,EAAE,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC,gFAyBnE;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC,gFAGpE;AAID;;;;;;;;;;;;GAYG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,EAAE,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC,gFA2BxE;AAID;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,CAAC,EAAE,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC,qBA6HvE"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/dashboard/auth.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAMvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAKjD,KAAK,QAAQ,GAAG;IACd,UAAU,EAAE,WAAW,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,CAAC,EAAE,sBAAsB,CAAC;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;CACxB,CAAC;AAGF,KAAK,SAAS,GAAG;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAIF;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAc5F;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAQhE;AAID;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,EAAE,iBAAiB,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAmChG,CAAC;AAIF;;;;;GAKG;AACH,wBAAsB,4BAA4B,CAAC,CAAC,EAAE,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC;;;;;;;;;;oEA2CpF;AAgDD;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAAC,CAAC,EAAE,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC;;;;;;;;;;;oEAwBjF;AAID;;;;GAIG;AACH,wBAAsB,yBAAyB,CAAC,CAAC,EAAE,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC;;;;;;;;;;oEAEjF;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,CAAC,EAAE,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC;;;;;;;;;;;oEA4B9E;AAID;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,CAAC,EAAE,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC,qBA2E5E;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAAC,CAAC,EAAE,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC,gFAqB9E;AAID;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,CAAC,EAAE,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC,gFAyBnE;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC,gFAGpE;AAID;;;;;;;;;;;;GAYG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,EAAE,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC,gFA2BxE;AAID;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,CAAC,EAAE,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC,qBA6HvE"}

package/dist/dashboard/auth.js

@@ -10,7 +10,7 @@ import { LoginLayout, Card, Divider } from './layout';
 /**
  * Generate a 1-hour dashboard session JWT for the given app_id.
  */
-async function generateSessionToken(appId, jwtSecret) {
+export async function generateSessionToken(appId, jwtSecret) {
     const encoder = new TextEncoder();
     const secretKey = encoder.encode(jwtSecret);
     return new SignJWT({
@@ -28,7 +28,7 @@ async function generateSessionToken(appId, jwtSecret) {
 /**
  * Set the dashboard session cookie on a response context.
  */
-function setSessionCookie(c, token) {
+export function setSessionCookie(c, token) {
     setCookie(c, 'botcha_session', token, {
         path: '/dashboard',
         httpOnly: true,
@@ -216,21 +216,31 @@ export async function handleDeviceCodeVerify(c) {
         success: true,
         code,
         login_url: `${baseUrl}/dashboard/code`,
+        magic_link: `${baseUrl}/go/${code}`,
         expires_in: 600,
-        instructions: `Tell your human: Visit ${baseUrl}/dashboard/code and enter code: ${code}`,
+        instructions: `Give your human this link: ${baseUrl}/go/${code} (or visit ${baseUrl}/dashboard/code and enter code: ${code})`,
     });
 }
 // ============ DEVICE CODE REDEMPTION (human-facing) ============
 /**
  * GET /dashboard/code
+ * GET /dashboard/code/:code
  *
  * Renders the device code redemption page for humans.
+ * Supports pre-filled codes from URL path or query params.
  */
 export async function renderDeviceCodePage(c) {
     const url = new URL(c.req.url);
     const error = url.searchParams.get('error');
-    const prefill = url.searchParams.get('code') || '';
     const emailSent = url.searchParams.get('email_sent') === '1';
+    // Get prefill code from URL path or query params
+    const pathCode = c.req.param('code')?.toUpperCase() || '';
+    const queryCode = url.searchParams.get('code') || '';
+    let prefill = pathCode || queryCode;
+    // Strip BOTCHA- prefix if present (form only needs the suffix)
+    if (prefill.startsWith('BOTCHA-')) {
+        prefill = prefill.slice(7);
+    }
     const errorMap = {
         invalid: 'Invalid or expired code. Ask your agent for a new one.',
         missing: 'Please enter a device code.',

package/dist/dashboard/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/dashboard/index.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAqB5B,KAAK,QAAQ,GAAG;IACd,UAAU,EAAE,OAAO,eAAe,EAAE,WAAW,CAAC;IAChD,WAAW,EAAE,OAAO,eAAe,EAAE,WAAW,CAAC;IACjD,IAAI,EAAE,OAAO,eAAe,EAAE,WAAW,CAAC;IAC1C,SAAS,CAAC,EAAE,OAAO,cAAc,EAAE,sBAAsB,CAAC;IAC1D,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,KAAK,SAAS,GAAG;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,QAAA,MAAM,SAAS;cAAwB,QAAQ;eAAa,SAAS;yCAAK,CAAC;AA+D3E,eAAe,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/dashboard/index.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAqB5B,KAAK,QAAQ,GAAG;IACd,UAAU,EAAE,OAAO,eAAe,EAAE,WAAW,CAAC;IAChD,WAAW,EAAE,OAAO,eAAe,EAAE,WAAW,CAAC;IACjD,IAAI,EAAE,OAAO,eAAe,EAAE,WAAW,CAAC;IAC1C,SAAS,CAAC,EAAE,OAAO,cAAc,EAAE,sBAAsB,CAAC;IAC1D,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,KAAK,SAAS,GAAG;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,QAAA,MAAM,SAAS;cAAwB,QAAQ;eAAa,SAAS;yCAAK,CAAC;AAgE3E,eAAe,SAAS,CAAC"}

package/dist/dashboard/index.js

@@ -26,6 +26,7 @@ dashboard.post('/email-login', handleEmailLogin);
 dashboard.get('/logout', handleLogout);
 // Device code pages (human enters code here)
 dashboard.get('/code', renderDeviceCodePage);
+dashboard.get('/code/:code', renderDeviceCodePage); // Pre-filled code from URL
 dashboard.post('/code', handleDeviceCodeRedeem);
 // ============ PROTECTED ROUTES (auth required) ============
 // Apply auth middleware to all routes below

package/dist/dashboard/landing.d.ts

@@ -2,11 +2,11 @@
  * BOTCHA Landing Pages (JSX)
  *
  * Two views at GET /:
- *   - LandingPage: for unverified human visitors (has token input)
+ *   - LandingPage: ultra-minimal — one prompt to copy-paste to your agent
  *   - VerifiedLandingPage: for humans whose agent solved the challenge
  *
- * Uses the same terminal aesthetic as the dashboard:
- * JetBrains Mono, dot-shadow Cards, scanline overlay.
+ * Design: the human's only job is to copy one prompt, paste it into their
+ * agent, and click the link the agent gives back. That's it.
  */
 import type { FC } from 'hono/jsx';
 export declare const LandingPage: FC<{

package/dist/dashboard/landing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"landing.d.ts","sourceRoot":"","sources":["../../src/dashboard/landing.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,UAAU,CAAC;AAanC,eAAO,MAAM,WAAW,EAAE,EAAE,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAwG/D,CAAC;AAIF,eAAO,MAAM,mBAAmB,EAAE,EAAE,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAgG3E,CAAC"}
+{"version":3,"file":"landing.d.ts","sourceRoot":"","sources":["../../src/dashboard/landing.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,UAAU,CAAC;AAsCnC,eAAO,MAAM,WAAW,EAAE,EAAE,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAgI/D,CAAC;AAyBF,eAAO,MAAM,mBAAmB,EAAE,EAAE,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAoF3E,CAAC"}

package/dist/dashboard/landing.js

@@ -7,18 +7,39 @@ const BOTCHA_ASCII = `██████╗  ██████╗ ████
 ██╔══██╗██║   ██║   ██║   ██║     ██╔══██║██╔══██║
 ██████╔╝╚██████╔╝   ██║   ╚██████╗██║  ██║██║  ██║
 ╚═════╝  ╚═════╝    ╚═╝    ╚═════╝╚═╝  ╚═╝╚═╝  ╚═╝`;
+const AGENT_PROMPT = `Run: curl -s https://botcha.ai -H 'Accept: application/json' — then follow the instructions in the response to verify yourself and get me access.`;
+// Clipboard copy icon (Lucide-style, 16x16)
+const COPY_ICON = `<svg xmlns="http://www.w3.org/2000/svg" width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="square" stroke-linejoin="miter"><rect x="9" y="9" width="13" height="13" rx="0"/><path d="M5 15H4a1 1 0 0 1-1-1V4a1 1 0 0 1 1-1h10a1 1 0 0 1 1 1v1"/></svg>`;
+const CHECK_ICON = `<svg xmlns="http://www.w3.org/2000/svg" width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="square" stroke-linejoin="miter"><polyline points="20 6 9 17 4 12"/></svg>`;
+const COPY_SCRIPT = `
+function copyPrompt() {
+  var text = document.getElementById('agent-prompt').textContent.trim();
+  navigator.clipboard.writeText(text).then(function() {
+    var label = document.getElementById('copy-label');
+    var icon = document.getElementById('copy-icon');
+    var txt = document.getElementById('copy-text');
+    label.style.color = 'var(--green)';
+    icon.innerHTML = '${CHECK_ICON.replace(/'/g, "\\'")}';
+    txt.textContent = 'Copied — now paste into your agent';
+    setTimeout(function() {
+      label.style.color = 'var(--text-muted)';
+      icon.innerHTML = '${COPY_ICON.replace(/'/g, "\\'")}';
+      txt.textContent = 'Click to copy';
+    }, 2500);
+  });
+}
+`;
 // ============ UNVERIFIED LANDING PAGE ============
 export const LandingPage = ({ version, error }) => {
-    return (_jsxs(LandingLayout, { version: version, children: [_jsx("a", { href: "/", class: "ascii-logo", children: BOTCHA_ASCII }), _jsxs("p", { class: "text-muted", style: "text-align: center; font-size: 0.75rem; margin: -1rem 0 0.5rem;", children: ['>', "_\u00A0prove you're a bot"] }), _jsx("p", { class: "landing-tagline", children: "Reverse CAPTCHA for AI agents. Humans need not apply." }), _jsxs(Card, { title: "You're a human", children: [_jsx("p", { class: "text-muted", style: "font-size: 0.8125rem; line-height: 1.7;", children: "This site is for AI agents. To see what's here, ask your agent to verify." }), _jsxs("p", { class: "text-muted", style: "font-size: 0.8125rem; line-height: 1.7; margin-top: 0.75rem;", children: ["Tell your AI agent:", _jsx("br", {}), _jsx("code", { style: "font-size: 0.8125rem;", children: "\"Go to botcha.ai, solve the challenge, and give me the code.\"" })] }), _jsxs("form", { method: "post", action: "/gate", style: "margin-top: 1.25rem;", children: [_jsx("label", { for: "code", class: "form-label", style: "font-size: 0.75rem; color: var(--text-muted); display: block; margin-bottom: 0.375rem;", children: "Enter the code your agent gives you:" }), _jsx("input", { id: "code", name: "code", type: "text", placeholder: "BOTCHA-XXXXXX", required: true, autocomplete: "off", spellcheck: false, maxlength: 13, style: "width: 100%; font-size: 1.25rem; font-family: var(--font); font-weight: 700; letter-spacing: 0.15em; text-transform: uppercase; padding: 0.75rem; text-align: center; border: 2px solid var(--border); border-radius: 6px; background: var(--bg); color: var(--text);" }), error && (_jsx("p", { style: "color: var(--red); font-size: 0.75rem; margin-top: 0.5rem;", children: error })), _jsx("button", { type: "submit", style: "margin-top: 0.75rem; width: 100%; padding: 0.625rem 1rem; font-family: var(--font); font-size: 0.875rem; font-weight: 600; background: var(--accent); color: #fff; border: none; border-radius: 4px; cursor: pointer;", children: "Unlock" })] })] }), _jsxs(Card, { title: "Developers", children: [_jsx("p", { class: "text-muted mb-2", style: "font-size: 0.75rem;", children: "Protect your APIs so only verified AI agents can access them:" }), _jsx("pre", { children: _jsx("code", { children: `npm install @botcha/verify    # Express/Hono middleware
-pip install botcha-verify     # FastAPI/Django middleware` }) }), _jsxs("div", { class: "landing-links", style: "margin-top: 1rem;", children: [_jsx("a", { href: "/openapi.json", class: "landing-link", children: "OpenAPI" }), _jsx("a", { href: "https://github.com/dupe-com/botcha", class: "landing-link", children: "GitHub" }), _jsx("a", { href: "https://www.npmjs.com/package/@dupecom/botcha", class: "landing-link", children: "npm" }), _jsx("a", { href: "https://pypi.org/project/botcha/", class: "landing-link", children: "PyPI" })] })] }), _jsx("script", { type: "application/botcha+json", id: "botcha-challenge", dangerouslySetInnerHTML: {
+    return (_jsxs(LandingLayout, { version: version, children: [_jsx("a", { href: "/", class: "ascii-logo", children: BOTCHA_ASCII }), _jsxs("p", { class: "text-muted", style: "text-align: center; font-size: 0.75rem; margin: -1rem 0 0.5rem;", children: ['>', "_\u00A0prove you're a bot"] }), _jsx("p", { class: "landing-tagline", children: "This site is for AI agents. Bring yours." }), _jsx("p", { class: "text-muted", style: "font-size: 0.6875rem; text-transform: uppercase; letter-spacing: 0.15em; text-align: center; margin: 2rem 0 0.625rem;", children: "Paste this into your AI agent" }), _jsx("div", { class: "card", style: "margin-bottom: 1.5rem;", children: _jsx("div", { class: "card-body", children: _jsxs("button", { id: "prompt-btn", onclick: "copyPrompt()", type: "button", class: "card-inner", style: "display: block; width: 100%; padding: 1.5rem; border: none; border-radius: 0; cursor: pointer; font-family: var(--font); text-align: left; text-transform: none; letter-spacing: normal; box-shadow: none; transition: background 0.2s;", children: [_jsx("code", { id: "agent-prompt", style: "font-size: 1.125rem; font-weight: 700; color: var(--accent); line-height: 1.5; display: block; background: none; border: none; padding: 0;", children: AGENT_PROMPT }), _jsxs("span", { id: "copy-label", style: "display: flex; align-items: center; gap: 0.375rem; margin-top: 1rem; font-size: 0.6875rem; font-weight: 500; color: var(--text-muted); text-transform: uppercase; letter-spacing: 0.1em; transition: color 0.2s;", children: [_jsx("span", { id: "copy-icon", style: "display: flex; transition: color 0.2s;", dangerouslySetInnerHTML: { __html: COPY_ICON } }), _jsx("span", { id: "copy-text", children: "Click to copy" })] })] }) }) }), _jsx("div", { style: "text-align: center; margin: 1.5rem 0;", children: _jsxs("p", { class: "text-muted", style: "font-size: 0.75rem; line-height: 2;", children: ["Your agent solves a challenge to prove it's a bot.", _jsx("br", {}), "It gives you a link back. Click it. You're in."] }) }), error && (_jsx("div", { style: "text-align: center; margin-bottom: 0.5rem;", children: _jsx("p", { style: "color: var(--red); font-size: 0.75rem;", children: error }) })), _jsxs("details", { style: "margin-top: 1rem;", children: [_jsx("summary", { class: "text-muted", style: "font-size: 0.6875rem; cursor: pointer; text-align: center; list-style: none; text-decoration: underline; text-underline-offset: 3px;", children: "Already have a code?" }), _jsx("form", { method: "post", action: "/gate", style: "margin-top: 0.75rem;", children: _jsxs("div", { style: "display: flex; gap: 0;", children: [_jsx("input", { id: "code", name: "code", type: "text", placeholder: "BOTCHA-XXXXXX", required: true, autocomplete: "off", spellcheck: false, maxlength: 13, style: "flex: 1; font-size: 0.875rem; font-family: var(--font); font-weight: 600; letter-spacing: 0.1em; text-transform: uppercase; padding: 0.625rem; text-align: center; border: 1px solid var(--border); border-radius: 0; background: var(--bg); color: var(--text);" }), _jsxs("button", { type: "submit", style: "padding: 0.625rem 1rem; font-family: var(--font); font-size: 0.8125rem; font-weight: 600; background: var(--accent); color: #fff; border: 1px solid var(--accent); border-left: none; border-radius: 0; cursor: pointer; white-space: nowrap;", children: ["Go ", '>'] })] }) })] }), _jsx("script", { type: "application/botcha+json", id: "botcha-challenge", dangerouslySetInnerHTML: {
                     __html: JSON.stringify({
                         version: '1.0',
                         type: 'inline-challenge',
-                        description: 'AI agents: solve this challenge to prove you\'re a bot!',
+                        description: 'AI agents: solve this challenge to prove you are a bot!',
                         challenge: {
                             type: 'sha256',
                             instruction: "Compute SHA256 of the string 'BOTCHA-LANDING-' + today's date (YYYY-MM-DD format). Return first 16 hex chars.",
-                            example: "For 2026-01-15: SHA256('BOTCHA-LANDING-2026-01-15') → first 16 chars",
+                            example: "For 2026-01-15: SHA256('BOTCHA-LANDING-2026-01-15') -> first 16 chars",
                             submit_to: 'https://botcha.ai/api/verify-landing',
                             method: 'POST',
                             body_format: {
@@ -31,15 +52,34 @@ pip install botcha-verify     # FastAPI/Django middleware` }) }), _jsxs("div", {
                             header_to_include: 'X-Botcha-Landing-Token',
                         },
                     }, null, 2),
-                } }), _jsxs("div", { class: "landing-footer", children: [_jsxs("span", { children: ["v", version] }), _jsx("span", { class: "landing-footer-sep", children: "\u00B7" }), _jsx("a", { href: "https://botcha.ai", children: "botcha.ai" }), _jsx("span", { class: "landing-footer-sep", children: "\u00B7" }), _jsx("a", { href: "https://github.com/i8ramin", children: "@i8ramin" })] })] }));
+                } }), _jsx("script", { dangerouslySetInnerHTML: { __html: COPY_SCRIPT } }), _jsxs("div", { class: "landing-footer", children: [_jsxs("span", { children: ["v", version] }), _jsx("span", { class: "landing-footer-sep", children: "\u00B7" }), _jsx("a", { href: "/openapi.json", children: "API" }), _jsx("span", { class: "landing-footer-sep", children: "\u00B7" }), _jsx("a", { href: "https://github.com/dupe-com/botcha", children: "GitHub" }), _jsx("span", { class: "landing-footer-sep", children: "\u00B7" }), _jsx("a", { href: "https://github.com/i8ramin", children: "@i8ramin" })] })] }));
 };
 // ============ VERIFIED LANDING PAGE ============
+const ONBOARD_PROMPT = `Run: curl -s https://botcha.ai -H 'Accept: application/json' — then follow the instructions to verify yourself, create an app for me, and get me into the dashboard. Ask me for my email address when you need it.`;
+const VERIFIED_COPY_SCRIPT = `
+function copyOnboardPrompt() {
+  var text = document.getElementById('onboard-prompt').textContent.trim();
+  navigator.clipboard.writeText(text).then(function() {
+    var label = document.getElementById('onboard-label');
+    var icon = document.getElementById('onboard-icon');
+    var txt = document.getElementById('onboard-text');
+    label.style.color = 'var(--green)';
+    icon.innerHTML = '${CHECK_ICON.replace(/'/g, "\\'")}';
+    txt.textContent = 'Copied — now paste into your agent';
+    setTimeout(function() {
+      label.style.color = 'var(--text-muted)';
+      icon.innerHTML = '${COPY_ICON.replace(/'/g, "\\'")}';
+      txt.textContent = 'Click to copy';
+    }, 2500);
+  });
+}
+`;
 export const VerifiedLandingPage = ({ version, solveTime }) => {
-    return (_jsxs(LandingLayout, { version: version, children: [_jsx("a", { href: "/", class: "ascii-logo", children: BOTCHA_ASCII }), _jsxs("p", { class: "text-muted", style: "text-align: center; font-size: 0.75rem; margin: -1rem 0 0.5rem;", children: ['>', "_\u00A0verified"] }), _jsxs("p", { class: "landing-tagline", style: "color: var(--green);", children: ["Your agent proved it's a bot", solveTime ? ` in ${solveTime}ms` : '', ". Welcome."] }), _jsxs(Card, { title: "Get started", children: [_jsx("p", { class: "text-muted", style: "font-size: 0.8125rem; line-height: 1.7;", children: "You have an AI agent. Here's what to do with it." }), _jsx("p", { class: "text-muted", style: "font-size: 0.75rem; line-height: 1.6; margin-top: 0.5rem; font-style: italic;", children: "Copy any of these prompts and paste them to your agent:" })] }), _jsxs(Card, { title: "1. Create your app", children: [_jsx("p", { class: "text-muted", style: "font-size: 0.8125rem; line-height: 1.7;", children: "Tell your agent to create a BOTCHA app tied to your email. This gives you an identity on the platform \u2014 your agent gets API keys, you get a dashboard." }), _jsxs("div", { style: "margin-top: 0.75rem; padding: 0.75rem; background: rgba(255,255,255,0.03); border: 1px solid var(--border); border-radius: 6px;", children: [_jsx("p", { style: "font-size: 0.625rem; text-transform: uppercase; letter-spacing: 0.1em; color: var(--text-muted); margin-bottom: 0.375rem;", children: "Say this to your agent:" }), _jsxs("code", { style: "font-size: 0.8125rem; line-height: 1.6; color: var(--accent);", children: ["\"Go to botcha.ai and create an app for me. My email is ", _jsx("span", { contentEditable: "plaintext-only", spellcheck: false, style: "color: var(--green); border-bottom: 1px dashed var(--green); outline: none; min-width: 3ch; padding: 0 2px;", children: "you@example.com" }), ". Save the app_id and app_secret somewhere safe.\""] })] }), _jsx("p", { class: "text-muted", style: "font-size: 0.6875rem; margin-top: 0.5rem;", children: "Your agent will call the API, get your credentials, and a verification code will be emailed to you." })] }), _jsxs(Card, { title: "2. Verify your email", children: [_jsx("p", { class: "text-muted", style: "font-size: 0.8125rem; line-height: 1.7;", children: "Check your inbox for a 6-digit code from BOTCHA. Give it to your agent to confirm your email." }), _jsxs("div", { style: "margin-top: 0.75rem; padding: 0.75rem; background: rgba(255,255,255,0.03); border: 1px solid var(--border); border-radius: 6px;", children: [_jsx("p", { style: "font-size: 0.625rem; text-transform: uppercase; letter-spacing: 0.1em; color: var(--text-muted); margin-bottom: 0.375rem;", children: "Say this to your agent:" }), _jsx("code", { style: "font-size: 0.8125rem; line-height: 1.6; color: var(--accent);", children: "\"The verification code from BOTCHA is [code]. Verify my email.\"" })] }), _jsx("p", { class: "text-muted", style: "font-size: 0.6875rem; margin-top: 0.5rem;", children: "This enables account recovery if you ever lose your credentials." })] }), _jsxs(Card, { title: "3. Open your dashboard", children: [_jsx("p", { class: "text-muted", style: "font-size: 0.8125rem; line-height: 1.7;", children: "Your agent can give you a short code to access your management dashboard \u2014 usage stats, API keys, and settings." }), _jsxs("div", { style: "margin-top: 0.75rem; padding: 0.75rem; background: rgba(255,255,255,0.03); border: 1px solid var(--border); border-radius: 6px;", children: [_jsx("p", { style: "font-size: 0.625rem; text-transform: uppercase; letter-spacing: 0.1em; color: var(--text-muted); margin-bottom: 0.375rem;", children: "Say this to your agent:" }), _jsx("code", { style: "font-size: 0.8125rem; line-height: 1.6; color: var(--accent);", children: "\"Get me a dashboard code for BOTCHA.\"" })] }), _jsxs("p", { class: "text-muted", style: "font-size: 0.6875rem; margin-top: 0.5rem;", children: ["Your agent gives you a ", _jsx("code", { children: "BOTCHA-XXXX" }), " code. Enter it at ", _jsx("a", { href: "/dashboard/code", style: "font-weight: 600;", children: "/dashboard/code" }), "."] })] }), _jsxs(Card, { title: "For developers", children: [_jsx("p", { class: "text-muted", style: "font-size: 0.8125rem; line-height: 1.7; margin-bottom: 0.75rem;", children: "Protect your own APIs so only verified AI agents can access them:" }), _jsx("pre", { children: _jsx("code", { children: `# Client SDK (for your agent)
+    return (_jsxs(LandingLayout, { version: version, children: [_jsx("a", { href: "/", class: "ascii-logo", children: BOTCHA_ASCII }), _jsxs("p", { class: "text-muted", style: "text-align: center; font-size: 0.75rem; margin: -1rem 0 0.5rem;", children: ['>', "_\u00A0verified"] }), _jsxs("p", { class: "landing-tagline", style: "color: var(--green);", children: ["Your agent proved it's a bot", solveTime ? ` in ${solveTime}ms` : '', ". Welcome."] }), _jsx("p", { class: "text-muted", style: "font-size: 0.6875rem; text-transform: uppercase; letter-spacing: 0.15em; text-align: center; margin: 2rem 0 0.625rem;", children: "Set up your account \u2014 paste this to your agent" }), _jsx("div", { class: "card", style: "margin-bottom: 1.5rem;", children: _jsx("div", { class: "card-body", children: _jsxs("button", { id: "onboard-btn", onclick: "copyOnboardPrompt()", type: "button", class: "card-inner", style: "display: block; width: 100%; padding: 1.5rem; border: none; border-radius: 0; cursor: pointer; font-family: var(--font); text-align: left; text-transform: none; letter-spacing: normal; box-shadow: none; transition: background 0.2s;", children: [_jsx("code", { id: "onboard-prompt", style: "font-size: 1rem; font-weight: 700; color: var(--accent); line-height: 1.5; display: block; background: none; border: none; padding: 0;", children: ONBOARD_PROMPT }), _jsxs("span", { id: "onboard-label", style: "display: flex; align-items: center; gap: 0.375rem; margin-top: 1rem; font-size: 0.6875rem; font-weight: 500; color: var(--text-muted); text-transform: uppercase; letter-spacing: 0.1em; transition: color 0.2s;", children: [_jsx("span", { id: "onboard-icon", style: "display: flex; transition: color 0.2s;", dangerouslySetInnerHTML: { __html: COPY_ICON } }), _jsx("span", { id: "onboard-text", children: "Click to copy" })] })] }) }) }), _jsx("div", { style: "text-align: center; margin: 1.5rem 0;", children: _jsxs("p", { class: "text-muted", style: "font-size: 0.75rem; line-height: 2;", children: ["Your agent will ask for your email, create your app,", _jsx("br", {}), "and give you a link to your dashboard. You just click it."] }) }), _jsxs(Card, { title: "For developers", children: [_jsx("p", { class: "text-muted", style: "font-size: 0.8125rem; line-height: 1.7; margin-bottom: 0.75rem;", children: "Protect your own APIs so only verified AI agents can access them:" }), _jsx("pre", { children: _jsx("code", { children: `# Client SDK (for your agent)
 npm install @dupecom/botcha     # TypeScript
 pip install botcha              # Python
 
 # Server SDK (protect your APIs)
 npm install @botcha/verify      # Express/Hono
-pip install botcha-verify       # FastAPI/Django` }) }), _jsxs("div", { class: "landing-links", style: "margin-top: 1rem;", children: [_jsx("a", { href: "/openapi.json", class: "landing-link", children: "OpenAPI" }), _jsx("a", { href: "/ai.txt", class: "landing-link", children: "ai.txt" }), _jsx("a", { href: "https://github.com/dupe-com/botcha", class: "landing-link", children: "GitHub" }), _jsx("a", { href: "https://www.npmjs.com/package/@dupecom/botcha", class: "landing-link", children: "npm" }), _jsx("a", { href: "https://pypi.org/project/botcha/", class: "landing-link", children: "PyPI" })] })] }), _jsxs("div", { class: "landing-footer", children: [_jsxs("span", { children: ["v", version] }), _jsx("span", { class: "landing-footer-sep", children: "\u00B7" }), _jsx("a", { href: "https://botcha.ai", children: "botcha.ai" }), _jsx("span", { class: "landing-footer-sep", children: "\u00B7" }), _jsx("a", { href: "https://github.com/i8ramin", children: "@i8ramin" })] })] }));
+pip install botcha-verify       # FastAPI/Django` }) }), _jsxs("div", { class: "landing-links", style: "margin-top: 1rem;", children: [_jsx("a", { href: "/openapi.json", class: "landing-link", children: "OpenAPI" }), _jsx("a", { href: "/ai.txt", class: "landing-link", children: "ai.txt" }), _jsx("a", { href: "https://github.com/dupe-com/botcha", class: "landing-link", children: "GitHub" }), _jsx("a", { href: "https://www.npmjs.com/package/@dupecom/botcha", class: "landing-link", children: "npm" }), _jsx("a", { href: "https://pypi.org/project/botcha/", class: "landing-link", children: "PyPI" })] })] }), _jsx("script", { dangerouslySetInnerHTML: { __html: VERIFIED_COPY_SCRIPT } }), _jsxs("div", { class: "landing-footer", children: [_jsxs("span", { children: ["v", version] }), _jsx("span", { class: "landing-footer-sep", children: "\u00B7" }), _jsx("a", { href: "https://botcha.ai", children: "botcha.ai" }), _jsx("span", { class: "landing-footer-sep", children: "\u00B7" }), _jsx("a", { href: "https://github.com/i8ramin", children: "@i8ramin" })] })] }));
 };

package/dist/dashboard/pages.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pages.d.ts","sourceRoot":"","sources":["../../src/dashboard/pages.tsx"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,UAAU,CAAC;AA+CnC,eAAO,MAAM,aAAa,EAAE,EAAE,CAAC;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAqG/C,CAAC"}
+{"version":3,"file":"pages.d.ts","sourceRoot":"","sources":["../../src/dashboard/pages.tsx"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,UAAU,CAAC;AAgDnC,eAAO,MAAM,aAAa,EAAE,EAAE,CAAC;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAqG/C,CAAC"}

package/dist/dashboard/pages.js

@@ -8,7 +8,7 @@ const PeriodSelector = ({ currentPeriod = '24h', targetId, endpoint, }) => {
         { value: '7d', label: '7D' },
         { value: '30d', label: '30D' },
     ];
-    return (_jsx("div", { class: "period-selector", style: "display: flex; gap: 0.5rem; margin-bottom: 1rem;", children: periods.map((p) => (_jsx("button", { class: p.value === currentPeriod ? '' : 'secondary', "hx-get": `${endpoint}?period=${p.value}`, "hx-target": `#${targetId}`, "hx-swap": "innerHTML", style: "padding: 0.4rem 0.8rem; font-size: 0.75rem;", children: p.label }))) }));
+    return (_jsx("div", { class: "period-selector", style: "display: flex; gap: 0.5rem; margin-bottom: 1rem;", children: periods.map((p) => (_jsx("button", { class: p.value === currentPeriod ? '' : 'secondary', "hx-get": `${endpoint}?period=${p.value}`, "hx-target": `#${targetId}`, "hx-swap": "innerHTML", onclick: `this.parentElement.querySelectorAll('button').forEach(b=>b.className='secondary');this.className=''`, style: "padding: 0.4rem 0.8rem; font-size: 0.75rem;", children: p.label }))) }));
 };
 // ============ LOADING SKELETON ============
 const LoadingSkeleton = () => (_jsxs("div", { children: [_jsx("div", { class: "skeleton skeleton-heading" }), _jsx("div", { class: "skeleton skeleton-text", style: "width: 80%;" }), _jsx("div", { class: "skeleton skeleton-text", style: "width: 60%;" }), _jsx("div", { class: "skeleton skeleton-text", style: "width: 90%;" })] }));

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * BOTCHA - Cloudflare Workers Edition v0.11.0
+ * BOTCHA - Cloudflare Workers Edition v0.12.0
  *
  * Prove you're a bot. Humans need not apply.
  *
@@ -13,6 +13,7 @@ type Bindings = {
     RATE_LIMITS: KVNamespace;
     APPS: KVNamespace;
     AGENTS: KVNamespace;
+    SESSIONS: KVNamespace;
     ANALYTICS?: AnalyticsEngineDataset;
     JWT_SECRET: string;
     BOTCHA_VERSION: string;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.tsx"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,EAYL,KAAK,WAAW,EACjB,MAAM,cAAc,CAAC;AAkBtB,OAAO,EACL,KAAK,sBAAsB,EAM5B,MAAM,aAAa,CAAC;AAGrB,KAAK,QAAQ,GAAG;IACd,UAAU,EAAE,WAAW,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,WAAW,CAAC;IACpB,SAAS,CAAC,EAAE,sBAAsB,CAAC;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,KAAK,SAAS,GAAG;IACf,YAAY,CAAC,EAAE;QACb,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,iBAAiB,CAAC;QACxB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;CACH,CAAC;AAEF,QAAA,MAAM,GAAG;cAAwB,QAAQ;eAAa,SAAS;yCAAK,CAAC;AA++DrE,eAAe,GAAG,CAAC;AAGnB,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,yBAAyB,EACzB,uBAAuB,EACvB,0BAA0B,EAC1B,wBAAwB,EACxB,uBAAuB,EACvB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EACL,aAAa,EACb,WAAW,EACX,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,KAAK,EACV,KAAK,YAAY,GAClB,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.tsx"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,EAYL,KAAK,WAAW,EACjB,MAAM,cAAc,CAAC;AAyBtB,OAAO,EACL,KAAK,sBAAsB,EAM5B,MAAM,aAAa,CAAC;AAGrB,KAAK,QAAQ,GAAG;IACd,UAAU,EAAE,WAAW,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,EAAE,WAAW,CAAC;IACtB,SAAS,CAAC,EAAE,sBAAsB,CAAC;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,KAAK,SAAS,GAAG;IACf,YAAY,CAAC,EAAE;QACb,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,iBAAiB,CAAC;QACxB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;CACH,CAAC;AAEF,QAAA,MAAM,GAAG;cAAwB,QAAQ;eAAa,SAAS;yCAAK,CAAC;AA0iErE,eAAe,GAAG,CAAC;AAGnB,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,yBAAyB,EACzB,uBAAuB,EACvB,0BAA0B,EAC1B,wBAAwB,EACxB,uBAAuB,EACvB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EACL,aAAa,EACb,WAAW,EACX,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,KAAK,EACV,KAAK,YAAY,GAClB,MAAM,SAAS,CAAC"}

package/dist/index.js

@@ -1,6 +1,6 @@
 import { jsx as _jsx } from "hono/jsx/jsx-runtime";
 /**
- * BOTCHA - Cloudflare Workers Edition v0.11.0
+ * BOTCHA - Cloudflare Workers Edition v0.12.0
  *
  * Prove you're a bot. Humans need not apply.
  *
@@ -21,6 +21,7 @@ import { createApp, getApp, getAppByEmail, verifyEmailCode, rotateAppSecret, reg
 import { sendEmail, verificationEmail, recoveryEmail, secretRotatedEmail } from './email';
 import { LandingPage, VerifiedLandingPage } from './dashboard/landing';
 import { createAgent, getAgent, listAgents } from './agents';
+import { registerTAPAgentRoute, getTAPAgentRoute, listTAPAgentsRoute, createTAPSessionRoute, getTAPSessionRoute, } from './tap-routes.js';
 import { trackChallengeGenerated, trackChallengeVerified, trackAuthAttempt, trackRateLimitExceeded, } from './analytics';
 const app = new Hono();
 // ============ MIDDLEWARE ============
@@ -31,7 +32,7 @@ app.route('/dashboard', dashboardRoutes);
 // BOTCHA discovery headers
 app.use('*', async (c, next) => {
     await next();
-    c.header('X-Botcha-Version', c.env.BOTCHA_VERSION || '0.11.0');
+    c.header('X-Botcha-Version', c.env.BOTCHA_VERSION || '0.13.0');
     c.header('X-Botcha-Enabled', 'true');
     c.header('X-Botcha-Methods', 'speed-challenge,reasoning-challenge,hybrid-challenge,standard-challenge,jwt-token');
     c.header('X-Botcha-Docs', 'https://botcha.ai/openapi.json');
@@ -121,7 +122,7 @@ function detectAcceptPreference(c) {
     return 'html';
 }
 app.get('/', async (c) => {
-    const version = c.env.BOTCHA_VERSION || '0.11.0';
+    const version = c.env.BOTCHA_VERSION || '0.13.0';
     const preference = detectAcceptPreference(c);
     const baseUrl = new URL(c.req.url).origin;
     // Check if agent is verified (optional Bearer token)
@@ -153,7 +154,15 @@ app.get('/', async (c) => {
                 // Invalid/expired cookie — fall through to unverified landing
             }
         }
-        return c.html(_jsx(LandingPage, { version: version }));
+        // Check for error from /go/:code redirect
+        const url = new URL(c.req.url);
+        const errorParam = url.searchParams.get('error');
+        const errorMap = {
+            invalid: 'Invalid or expired code. Ask your agent to try again.',
+            missing: 'No code provided.',
+        };
+        const error = errorParam ? errorMap[errorParam] : undefined;
+        return c.html(_jsx(LandingPage, { version: version, error: error }));
     }
     // === UNVERIFIED: minimal teaser — just enough to get started ===
     if (!isVerified) {
@@ -170,9 +179,9 @@ app.get('/', async (c) => {
                 step4: `Revisit: GET ${baseUrl}/ with header Authorization: Bearer <access_token>`,
             },
             human_handoff: {
-                note: 'After verifying, you will receive a short code (BOTCHA-XXXXXX). Give it to your human.',
-                instruction: 'Tell your human: "Enter this code at botcha.ai to unlock the site."',
-                code_field: 'human_code from step 3 response',
+                note: 'After verifying, the response includes a human_link. Give it to your human to open in their browser.',
+                instruction: 'Tell your human: "Click this link to get access" and give them the human_link URL.',
+                link_field: 'human_link from step 3 response',
             },
             hint: 'You have 500ms. Only a bot can do this.',
             links: {
@@ -198,8 +207,10 @@ You have 500ms. Only a bot can do this.
 
 ## Human Handoff
 
-After verifying, give your human the \`access_token\` and tell them:
-**"Paste this token into the input at botcha.ai to unlock the full site."**
+After verifying, the response includes a \`human_link\`. Give this URL to your human:
+**"Click this link to get access: {human_link}"**
+
+The link works for 5 minutes. Your human clicks it, gets a cookie, and sees the verified site.
 
 ---
 
@@ -332,50 +343,8 @@ app.post('/gate', async (c) => {
     }
     // Normalize: accept "BOTCHA-ABC123" or just "ABC123"
     const code = input.startsWith('BOTCHA-') ? input : `BOTCHA-${input}`;
-    // Look up the code in KV
-    let token = null;
-    try {
-        token = await c.env.CHALLENGES.get(`gate:${code}`);
-    }
-    catch {
-        // KV error — fail open with helpful message
-    }
-    if (!token) {
-        return c.html(_jsx(LandingPage, { version: version, error: "Invalid or expired code. Ask your agent to solve a new challenge." }), 401);
-    }
-    // Verify the token is still valid
-    const result = await verifyToken(token, c.env.JWT_SECRET, c.env);
-    if (!result.valid) {
-        // Code existed but token expired — clean up
-        try {
-            await c.env.CHALLENGES.delete(`gate:${code}`);
-        }
-        catch { }
-        return c.html(_jsx(LandingPage, { version: version, error: "Code expired. Ask your agent to solve a new challenge." }), 401);
-    }
-    // Delete the code after use (one-time use)
-    try {
-        await c.env.CHALLENGES.delete(`gate:${code}`);
-    }
-    catch { }
-    // Mint a long-lived visitor JWT (1 year) — only proves "an agent vouched for this human"
-    // This is NOT an access token and cannot be used for API calls
-    const vPayload = result.payload;
-    const visitorToken = await new SignJWT({
-        type: 'botcha-visitor',
-        solveTime: vPayload?.solveTime,
-        gateCode: code,
-    })
-        .setProtectedHeader({ alg: 'HS256' })
-        .setIssuedAt()
-        .setExpirationTime('365d')
-        .sign(new TextEncoder().encode(c.env.JWT_SECRET));
-    // Set a 1-year visitor cookie and redirect to /
-    const ONE_YEAR = 365 * 24 * 60 * 60;
-    const headers = new Headers();
-    headers.append('Set-Cookie', `botcha_visitor=${visitorToken}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=${ONE_YEAR}`);
-    headers.set('Location', '/');
-    return new Response(null, { status: 302, headers });
+    // Redirect to /go/:code which handles both gate codes and device codes
+    return c.redirect(`/go/${code}`);
 });
 app.get('/health', (c) => {
     return c.json({ status: 'ok', runtime: 'cloudflare-workers' });
@@ -397,7 +366,7 @@ app.get('/ai.txt', (c) => {
 });
 // OpenAPI spec
 app.get('/openapi.json', (c) => {
-    const version = c.env.BOTCHA_VERSION || '0.11.0';
+    const version = c.env.BOTCHA_VERSION || '0.13.0';
     return c.json(getOpenApiSpec(version), 200, {
         'Cache-Control': 'public, max-age=3600',
     });
@@ -691,16 +660,17 @@ app.post('/v1/token/verify', async (c) => {
         refresh_expires_in: tokenResult.refresh_expires_in,
         solveTimeMs: result.solveTimeMs,
         message: `Challenge verified in ${result.solveTimeMs}ms. You are a bot.`,
-        // === Human handoff code (GIVE THIS TO YOUR HUMAN) ===
+        // === Human handoff (GIVE THIS TO YOUR HUMAN) ===
+        // The magic link is the primary way to get your human in.
+        // They click it, get a cookie, and see the verified landing page.
+        human_link: `${baseUrl}/go/${gateCode}`,
         human_code: gateCode,
-        human_url: `${baseUrl}`,
-        human_instruction: `Give your human this code: ${gateCode} — they enter it at ${baseUrl} to see the site.`,
+        human_instruction: `Give your human this link to open in their browser: ${baseUrl}/go/${gateCode}`,
         // === What to do next ===
         usage: {
             header: 'Authorization: Bearer <access_token>',
             try_it: 'GET /agent-only',
             full_docs: 'GET / with Authorization: Bearer <access_token>',
-            human_handoff: `Tell your human: "Enter code ${gateCode} at ${baseUrl} to unlock the site."`,
             refresh: 'POST /v1/token/refresh with {"refresh_token":"<refresh_token>"}',
             revoke: 'POST /v1/token/revoke with {"token":"<token>"}',
         },
@@ -708,6 +678,8 @@ app.post('/v1/token/verify', async (c) => {
         badge,
         // Backward compatibility
         token: tokenResult.access_token,
+        human_magic_link: `${baseUrl}/go/${gateCode}`,
+        human_url: `${baseUrl}`,
     });
 });
 // Refresh access token using refresh token
@@ -1612,6 +1584,14 @@ app.get('/v1/agents', async (c) => {
         }, 500);
     }
 });
+// ============ TAP (TRUSTED AGENT PROTOCOL) ENDPOINTS ============
+// TAP agent registration and retrieval
+app.post('/v1/agents/register/tap', registerTAPAgentRoute);
+app.get('/v1/agents/tap', listTAPAgentsRoute);
+app.get('/v1/agents/:id/tap', getTAPAgentRoute);
+// TAP session management
+app.post('/v1/sessions/tap', createTAPSessionRoute);
+app.get('/v1/sessions/:id/tap', getTAPSessionRoute);
 // ============ DASHBOARD AUTH API ENDPOINTS ============
 // Challenge-based dashboard login (agent direct)
 app.post('/v1/auth/dashboard', handleDashboardAuthChallenge);
@@ -1619,6 +1599,73 @@ app.post('/v1/auth/dashboard/verify', handleDashboardAuthVerify);
 // Device code flow (agent → human handoff)
 app.post('/v1/auth/device-code', handleDeviceCodeChallenge);
 app.post('/v1/auth/device-code/verify', handleDeviceCodeVerify);
+// ============ ONE-CLICK ACCESS LINKS ============
+/**
+ * GET /go/:code - One-click device code redemption
+ *
+ * Magic link for instant dashboard access. Agent gives human this link:
+ * https://botcha.ai/go/BOTCHA-XXXX → auto-login + redirect to dashboard
+ *
+ * UX improvement: no more copy-pasting codes!
+ */
+app.get('/go/:code', async (c) => {
+    const code = c.req.param('code')?.toUpperCase();
+    if (!code) {
+        return c.redirect('/?error=missing');
+    }
+    // Normalize: accept "AR8CZX", "BOTCHA-AR8CZX", etc.
+    let normalizedCode = code;
+    if (!code.startsWith('BOTCHA-')) {
+        normalizedCode = `BOTCHA-${code}`;
+    }
+    // === Try gate code first (visitor access from /v1/token/verify) ===
+    // Gate codes are stored as gate:{code} → access_token string
+    let gateToken = null;
+    try {
+        gateToken = await c.env.CHALLENGES.get(`gate:${normalizedCode}`);
+    }
+    catch { }
+    if (gateToken) {
+        // Verify the underlying token is still valid
+        const result = await verifyToken(gateToken, c.env.JWT_SECRET, c.env);
+        // Delete the code (one-time use) regardless of token validity
+        try {
+            await c.env.CHALLENGES.delete(`gate:${normalizedCode}`);
+        }
+        catch { }
+        if (result.valid) {
+            // Mint a long-lived visitor JWT (1 year) — proves "an agent vouched for this human"
+            const vPayload = result.payload;
+            const visitorToken = await new SignJWT({
+                type: 'botcha-visitor',
+                solveTime: vPayload?.solveTime,
+                gateCode: normalizedCode,
+            })
+                .setProtectedHeader({ alg: 'HS256' })
+                .setIssuedAt()
+                .setExpirationTime('365d')
+                .sign(new TextEncoder().encode(c.env.JWT_SECRET));
+            const ONE_YEAR = 365 * 24 * 60 * 60;
+            const headers = new Headers();
+            headers.append('Set-Cookie', `botcha_visitor=${visitorToken}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=${ONE_YEAR}`);
+            headers.set('Location', '/');
+            return new Response(null, { status: 302, headers });
+        }
+        // Gate token expired — fall through to try device code
+    }
+    // === Try device code (dashboard access from /v1/auth/device-code/verify) ===
+    const { redeemDeviceCode } = await import('./dashboard/device-code');
+    const data = await redeemDeviceCode(c.env.CHALLENGES, normalizedCode);
+    if (data) {
+        // Generate session token and redirect to dashboard
+        const { generateSessionToken, setSessionCookie } = await import('./dashboard/auth');
+        const sessionToken = await generateSessionToken(data.app_id, c.env.JWT_SECRET);
+        setSessionCookie(c, sessionToken);
+        return c.redirect('/dashboard');
+    }
+    // Neither code type found — redirect to landing with error
+    return c.redirect('/?error=invalid');
+});
 // ============ LEGACY ENDPOINTS (v0 - backward compatibility) ============
 app.get('/api/challenge', async (c) => {
     const difficulty = c.req.query('difficulty') || 'medium';