name = "turnstile-siteverify"
main = "src/index.ts"
compatibility_date = "2026-05-01"
compatibility_flags = ["nodejs_compat"]

# Serve the post-deploy form (public/post-deploy.html) as a static asset.
# After deploy, customers land on /post-deploy.html with their Worker URL
# prefilled, and can create a Turnstile widget without leaving the flow.
[assets]
directory = "./public"
binding = "ASSETS"

# Workers Observability — structured logs, latency tracking, error rates
# all surface in the Worker's Observability tab in the dashboard.
[observability]
enabled = true

[vars]
# CORS allowed origin. Override per-environment.
# In production, set this to your customer-facing domain (e.g. "https://example.com").
# Leaving as "*" for development; production deploys MUST set this explicitly.
ALLOWED_ORIGIN = "*"

# Optional: defense against cross-site token replay. If set, the Worker
# rejects siteverify responses whose hostname doesn't match. Set this to
# your customer-facing domain (e.g. "www.example.com") for additional safety
# on single-domain deployments. Leave empty for multi-site deployments.
# EXPECTED_HOSTNAME = ""

# Log verbosity. One of: debug, info, warn, error.
LOG_LEVEL = "info"

# Secrets — never commit. Set via:
#   wrangler secret put TURNSTILE_SECRET_KEY
# For local dev, create .dev.vars (gitignored) with:
#   TURNSTILE_SECRET_KEY=your-secret-here