@rimelight/security 0.0.19 → 0.0.21

package/dist/config/index.d.mts

@@ -1,3 +1,3 @@
-import { i as SecurityOptions, n as RateLimitOptions, r as RateLimiterBinding, t as ConstructionOptions } from "../types-Dcvwj-af.mjs";
+import { i as SecurityOptions, n as RateLimitOptions, r as RateLimiterBinding, t as ConstructionOptions } from "../types-CL5HooHU.mjs";
 import { buildCspHeader } from "../csp.mjs";
 export { ConstructionOptions, RateLimitOptions, RateLimiterBinding, SecurityOptions, buildCspHeader };

package/dist/csp.d.mts

@@ -1,4 +1,4 @@
-import { i as SecurityOptions } from "./types-Dcvwj-af.mjs";
+import { i as SecurityOptions } from "./types-CL5HooHU.mjs";
 //#region src/csp.d.ts
 /**
  * Builds the Content-Security-Policy header string dynamically for a given request nonce.

package/dist/csp.mjs

@@ -4,27 +4,31 @@
 */
 function buildCspHeader(options = {}, nonce) {
 	const domain = options.domain || "";
+	const imgSources = Array.from(/* @__PURE__ */ new Set([
+		"'self'",
+		"data:",
+		...domain ? [`https://cdn.${domain}`] : [],
+		"https://i3.ytimg.com",
+		"https://www.youtube.com",
+		"https://www.youtube-nocookie.com",
+		...options.imgSrc || []
+	]));
+	const allowTurnstile = options.turnstile !== false;
 	const defaultDirectives = {
 		"default-src": ["'none'"],
-		"img-src": Array.from(/* @__PURE__ */ new Set([
-			"'self'",
-			"data:",
-			...domain ? [`https://cdn.${domain}`] : [],
-			"https://i3.ytimg.com",
-			"https://www.youtube.com",
-			"https://www.youtube-nocookie.com",
-			...options.imgSrc || []
-		])),
+		"img-src": imgSources,
 		"font-src": ["'self'"],
 		"connect-src": Array.from(/* @__PURE__ */ new Set([
 			"'self'",
 			"https://cloudflareinsights.com",
+			...allowTurnstile ? ["https://challenges.cloudflare.com"] : [],
 			...options.connectSrc || []
 		])),
 		"frame-ancestors": ["'none'"],
 		"frame-src": Array.from(/* @__PURE__ */ new Set([
 			"https://www.youtube.com",
 			"https://www.youtube-nocookie.com",
+			...allowTurnstile ? ["https://challenges.cloudflare.com"] : [],
 			...options.frameSrc || []
 		])),
 		"script-src": Array.from(/* @__PURE__ */ new Set([
@@ -32,6 +36,7 @@ function buildCspHeader(options = {}, nonce) {
 			...nonce ? [`'nonce-${nonce}'`] : [],
 			"https://static.cloudflareinsights.com",
 			"https://betterlytics.io/analytics.js",
+			...allowTurnstile ? ["https://challenges.cloudflare.com"] : [],
 			"'inline-speculation-rules'",
 			"'sha256-ZuMSxilKU+4KIM8LWna4lqBEKzd6WaiAjz6gamhm7zM='",
 			...options.scriptResources || []

package/dist/index.d.mts

@@ -1,5 +1,7 @@
-import { i as SecurityOptions, n as RateLimitOptions, r as RateLimiterBinding, t as ConstructionOptions } from "./types-Dcvwj-af.mjs";
+import { i as SecurityOptions, n as RateLimitOptions, r as RateLimiterBinding, t as ConstructionOptions } from "./types-CL5HooHU.mjs";
 import { buildCspHeader } from "./csp.mjs";
 import { RimelightSecurityPlugin, SecurityPluginOptions, security } from "./vite.mjs";
 import { CONSTRUCTION_GUEST_COOKIE, construction, isConstructionGuest, signInConstructionGuest } from "./middleware/construction.mjs";
-export { CONSTRUCTION_GUEST_COOKIE, ConstructionOptions, RateLimitOptions, RateLimiterBinding, RimelightSecurityPlugin, SecurityOptions, SecurityPluginOptions, buildCspHeader, construction, isConstructionGuest, security, security as sri, signInConstructionGuest };
+import rimelightSecurity, { RimelightSecurityOptions } from "./integration.mjs";
+import { TurnstileVerifyOptions, TurnstileVerifyResult, getTurnstileSecretKey, getTurnstileSiteKey, isTurnstileEnabled, verifyTurnstile } from "./turnstile.mjs";
+export { CONSTRUCTION_GUEST_COOKIE, ConstructionOptions, RateLimitOptions, RateLimiterBinding, RimelightSecurityOptions, RimelightSecurityPlugin, SecurityOptions, SecurityPluginOptions, TurnstileVerifyOptions, TurnstileVerifyResult, buildCspHeader, construction, getTurnstileSecretKey, getTurnstileSiteKey, isConstructionGuest, isTurnstileEnabled, rimelightSecurity, security, security as sri, signInConstructionGuest, verifyTurnstile };

package/dist/index.mjs

@@ -2,4 +2,6 @@ import "./types.mjs";
 import { buildCspHeader } from "./csp.mjs";
 import { security } from "./vite.mjs";
 import { CONSTRUCTION_GUEST_COOKIE, construction, isConstructionGuest, signInConstructionGuest } from "./middleware/construction.mjs";
-export { CONSTRUCTION_GUEST_COOKIE, buildCspHeader, construction, isConstructionGuest, security, security as sri, signInConstructionGuest };
+import rimelightSecurity from "./integration.mjs";
+import { getTurnstileSecretKey, getTurnstileSiteKey, isTurnstileEnabled, verifyTurnstile } from "./turnstile.mjs";
+export { CONSTRUCTION_GUEST_COOKIE, buildCspHeader, construction, getTurnstileSecretKey, getTurnstileSiteKey, isConstructionGuest, isTurnstileEnabled, rimelightSecurity, security, security as sri, signInConstructionGuest, verifyTurnstile };

package/dist/integration.d.mts

@@ -0,0 +1,26 @@
+import { i as SecurityOptions, t as ConstructionOptions } from "./types-CL5HooHU.mjs";
+import { AstroIntegration } from "astro";
+//#region src/integration.d.ts
+export interface RimelightSecurityOptions extends SecurityOptions {
+  /**
+   * Construction mode options & route injection settings
+   */
+  construction?: ConstructionOptions & {
+    /**
+     * Whether to automatically inject the construction page route. Defaults to true.
+     */
+    injectRoute?: boolean;
+    /**
+     * Pattern to inject for the construction route. Defaults to "/[locale]/construction" or
+     * "/construction".
+     */
+    routePattern?: string;
+  };
+}
+/**
+ * Astro Integration for Rimelight Security. Integrates Vite security plugins (CSP, SRI) and
+ * automatically injects the construction mode page route.
+ */
+export declare function rimelightSecurity(options?: RimelightSecurityOptions): AstroIntegration;
+//#endregion
+export { rimelightSecurity as default };

package/dist/integration.mjs

@@ -0,0 +1,20 @@
+import { security } from "./vite.mjs";
+//#region src/integration.ts
+/**
+* Astro Integration for Rimelight Security. Integrates Vite security plugins (CSP, SRI) and
+* automatically injects the construction mode page route.
+*/
+function rimelightSecurity(options = {}) {
+	return {
+		name: "@rimelight/security",
+		hooks: { "astro:config:setup": ({ injectRoute, updateConfig }) => {
+			if (options.construction?.injectRoute !== false) injectRoute({
+				pattern: options.construction?.routePattern || "/[locale]/construction",
+				entrypoint: "@rimelight/security/pages/construction.astro"
+			});
+			updateConfig({ vite: { plugins: [security(options)] } });
+		} }
+	};
+}
+//#endregion
+export { rimelightSecurity as default, rimelightSecurity };

package/dist/middleware/construction.d.mts

@@ -1,4 +1,4 @@
-import { t as ConstructionOptions } from "../types-Dcvwj-af.mjs";
+import { t as ConstructionOptions } from "../types-CL5HooHU.mjs";
 //#region src/middleware/construction.d.ts
 export declare const CONSTRUCTION_GUEST_COOKIE = "rimelight-construction-guest";
 /**

package/dist/middleware/ratelimit.d.mts

@@ -1,4 +1,4 @@
-import { n as RateLimitOptions } from "../types-Dcvwj-af.mjs";
+import { n as RateLimitOptions } from "../types-CL5HooHU.mjs";
 //#region src/middleware/ratelimit.d.ts
 /**
  * Middleware to enforce rate limits on sensitive endpoints using Cloudflare Rate Limiting bindings.
@@ -18,5 +18,5 @@ import { n as RateLimitOptions } from "../types-Dcvwj-af.mjs";
  *     })
  *   )
  */
-export declare const ratelimit: (options?: RateLimitOptions) => (c: any, next: () => Promise<any> | any) => Promise<Response | any>;
+export declare const ratelimit: (options?: RateLimitOptions) => (c: any, next: () => Promise<any>) => Promise<any>;
 //#endregion

package/dist/middleware/security.d.mts

@@ -1,4 +1,4 @@
-import { i as SecurityOptions } from "../types-Dcvwj-af.mjs";
+import { i as SecurityOptions } from "../types-CL5HooHU.mjs";
 //#region src/middleware/security.d.ts
 /**
  * Universal Security Middleware for Hono and Web Standards (Fetch API). Injects security headers,

package/dist/turnstile.d.mts

@@ -0,0 +1,53 @@
+//#region src/turnstile.d.ts
+export interface TurnstileVerifyOptions {
+  /**
+   * The response token provided by the Turnstile client-side widget (e.g. `cf-turnstile-response`).
+   */
+  token?: string | null | undefined;
+  /**
+   * The secret key for Turnstile verification. Can be passed directly or read from `env`.
+   */
+  secretKey?: string | undefined;
+  /**
+   * The Cloudflare environment or process environment object containing TURNSTILE_SECRET_KEY /
+   * TURNSTILE_SITE_KEY.
+   */
+  env?: any;
+  /**
+   * The client's IP address (e.g. from `CF-Connecting-IP` or `Astro.clientAddress`).
+   */
+  remoteIp?: string | undefined;
+  /**
+   * Whether to fail open (succeed) if keys are not configured or during network errors. Defaults to
+   * `true` (safe for local development).
+   */
+  failOpen?: boolean | undefined;
+  /**
+   * Custom verify endpoint URL. Defaults to
+   * `https://challenges.cloudflare.com/turnstile/v0/siteverify`.
+   */
+  endpoint?: string | undefined;
+}
+export interface TurnstileVerifyResult {
+  success: boolean;
+  error?: string | undefined;
+  errorCodes?: string[] | undefined;
+}
+/**
+ * Checks if Turnstile keys are present in the provided environment or `process.env`.
+ */
+export declare function isTurnstileEnabled(env?: any): boolean;
+/**
+ * Resolves the Turnstile secret key from options or environment.
+ */
+export declare function getTurnstileSecretKey(options: TurnstileVerifyOptions): string | undefined;
+/**
+ * Resolves the Turnstile site key from environment or process.env.
+ */
+export declare function getTurnstileSiteKey(env?: any): string | undefined;
+/**
+ * Verifies a Cloudflare Turnstile token on the server. Supports both options object and classic
+ * signature `(token, env, remoteIp)`.
+ */
+export declare function verifyTurnstile(tokenOrOptions: string | null | undefined | TurnstileVerifyOptions, legacyEnv?: any, legacyRemoteIp?: string): Promise<TurnstileVerifyResult>;
+//#endregion

package/dist/turnstile.mjs

@@ -0,0 +1,92 @@
+//#region src/turnstile.ts
+/**
+* Checks if Turnstile keys are present in the provided environment or `process.env`.
+*/
+function isTurnstileEnabled(env) {
+	const siteKey = env?.TURNSTILE_SITE_KEY || (typeof process !== "undefined" ? process.env?.["TURNSTILE_SITE_KEY"] : void 0);
+	const secretKey = env?.TURNSTILE_SECRET_KEY || (typeof process !== "undefined" ? process.env?.["TURNSTILE_SECRET_KEY"] : void 0);
+	return Boolean(siteKey && secretKey);
+}
+/**
+* Resolves the Turnstile secret key from options or environment.
+*/
+function getTurnstileSecretKey(options) {
+	if (options.secretKey) return options.secretKey;
+	return options.env?.TURNSTILE_SECRET_KEY || (typeof process !== "undefined" ? process.env?.["TURNSTILE_SECRET_KEY"] : void 0);
+}
+/**
+* Resolves the Turnstile site key from environment or process.env.
+*/
+function getTurnstileSiteKey(env) {
+	return env?.TURNSTILE_SITE_KEY || (typeof process !== "undefined" ? process.env?.["TURNSTILE_SITE_KEY"] : void 0);
+}
+/**
+* Verifies a Cloudflare Turnstile token on the server. Supports both options object and classic
+* signature `(token, env, remoteIp)`.
+*/
+async function verifyTurnstile(tokenOrOptions, legacyEnv, legacyRemoteIp) {
+	const options = typeof tokenOrOptions === "object" && tokenOrOptions !== null ? tokenOrOptions : {
+		token: tokenOrOptions,
+		env: legacyEnv,
+		remoteIp: legacyRemoteIp
+	};
+	const failOpen = options.failOpen ?? true;
+	const token = options.token;
+	const secretKey = getTurnstileSecretKey(options);
+	if (!secretKey) {
+		if (failOpen) {
+			console.log("[Turnstile] Keys missing or not configured. Skipping verification (Failing Open for local dev).");
+			return { success: true };
+		}
+		return {
+			success: false,
+			error: "Turnstile secret key is not configured."
+		};
+	}
+	if (!token) return {
+		success: false,
+		error: "Security check token is missing."
+	};
+	try {
+		const endpoint = options.endpoint || "https://challenges.cloudflare.com/turnstile/v0/siteverify";
+		const response = await fetch(endpoint, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({
+				secret: secretKey,
+				response: token,
+				remoteip: options.remoteIp
+			})
+		});
+		if (!response.ok) {
+			if (failOpen) {
+				console.error(`[Turnstile] API returned status ${response.status}. Failing open.`);
+				return { success: true };
+			}
+			return {
+				success: false,
+				error: `Cloudflare Turnstile API returned status ${response.status}`
+			};
+		}
+		const data = await response.json();
+		if (data.success) return { success: true };
+		const codes = data["error-codes"] || [];
+		let msg = "Bot check verification failed.";
+		if (codes.includes("timeout-or-duplicate")) msg = "Verification token expired or already used. Please refresh the security check.";
+		else if (codes.includes("invalid-input-response")) msg = "Invalid verification response. Please try again.";
+		return {
+			success: false,
+			error: msg,
+			errorCodes: codes
+		};
+	} catch (err) {
+		console.error("[Turnstile Exception]", err);
+		if (failOpen) return { success: true };
+		return {
+			success: false,
+			error: err?.message || "Turnstile verification encountered an exception."
+		};
+	}
+}
+//#endregion
+export { getTurnstileSecretKey, getTurnstileSiteKey, isTurnstileEnabled, verifyTurnstile };

package/dist/{types-Dcvwj-af.d.mts → types-CL5HooHU.d.mts}

@@ -29,6 +29,11 @@ interface SecurityOptions {
    * Additional style resources / origins
    */
   styleResources?: string[];
+  /**
+   * Enables Cloudflare Turnstile CSP allowances (challenges.cloudflare.com in script-src,
+   * frame-src, connect-src). Defaults to true.
+   */
+  turnstile?: boolean;
   /**
    * Enables the 'require-trusted-types-for' directive
    */

package/dist/types.d.mts

@@ -1,2 +1,2 @@
-import { i as SecurityOptions, n as RateLimitOptions, r as RateLimiterBinding, t as ConstructionOptions } from "./types-Dcvwj-af.mjs";
+import { i as SecurityOptions, n as RateLimitOptions, r as RateLimiterBinding, t as ConstructionOptions } from "./types-CL5HooHU.mjs";
 export { ConstructionOptions, RateLimitOptions, RateLimiterBinding, SecurityOptions };

package/dist/vite.d.mts

@@ -1,4 +1,4 @@
-import { i as SecurityOptions } from "./types-Dcvwj-af.mjs";
+import { i as SecurityOptions } from "./types-CL5HooHU.mjs";
 //#region src/vite.d.ts
 export interface RimelightSecurityPlugin {
   name: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rimelight/security",
-  "version": "0.0.19",
+  "version": "0.0.21",
   "private": false,
   "description": "Rimelight Entertainment's Security Package",
   "homepage": "https://rimelight.com/docs",
@@ -17,7 +17,7 @@
   },
   "files": [
     "dist",
-    "src/components"
+    "src"
   ],
   "type": "module",
   "exports": {
@@ -33,17 +33,30 @@
       "types": "./dist/config/index.d.mts",
       "import": "./dist/config/index.mjs"
     },
+    "./integration": {
+      "types": "./dist/integration.d.mts",
+      "import": "./dist/integration.mjs"
+    },
+    "./turnstile": {
+      "types": "./dist/turnstile.d.mts",
+      "import": "./dist/turnstile.mjs"
+    },
+    "./components/*": "./src/components/*",
+    "./layouts/*": "./src/layouts/*",
+    "./pages/*": "./src/pages/*",
     "./*": "./src/*"
   },
   "publishConfig": {
     "access": "public"
   },
   "dependencies": {
+    "@rimelight/i18n": "0.0.17",
+    "@rimelight/seo": "0.0.14",
     "@rimelight/ui": "0.0.57"
   },
   "devDependencies": {
     "@astrojs/check": "0.9.10",
-    "@rimelight/config": "0.0.15",
+    "@rimelight/config": "0.0.17",
     "astro": "7.3.3",
     "hono": "4.13.8",
     "typescript": "6.0.3"

package/src/components/ConstructionPage.astro

@@ -0,0 +1,166 @@
+---
+import ConstructionLayout from "../layouts/ConstructionLayout.astro";
+import ConstructionSignIn from "./ConstructionSignIn.astro";
+import RLALogo from "@rimelight/ui/components/logo/RLALogo.astro";
+import RLALocaleSelector from "@rimelight/ui/components/locale-selector/RLALocaleSelector.astro";
+import { t, getLocale } from "@rimelight/i18n";
+import { siteConfig } from "virtual:rimelight/seo";
+
+export interface LocaleOption {
+  code: string;
+  label?: string;
+  href?: string;
+}
+
+export interface Props {
+  title?: string | undefined;
+  description?: string | undefined;
+  metaTitle?: string | undefined;
+  metaDescription?: string | undefined;
+  noindex?: boolean | undefined;
+  favicon?: string | undefined;
+
+  // Branding & Logo
+  logoAlt?: string | undefined;
+  siteName?: string | undefined;
+  copyright?: string | undefined;
+
+  // Locales
+  locales?: (LocaleOption | string)[] | undefined;
+  currentLocale?: string | undefined;
+  showLocaleSelector?: boolean | undefined;
+
+  // Guest Passphrase Form
+  allowAuth?: boolean | undefined;
+  endpoint?: string | undefined;
+  passphraseLabel?: string | undefined;
+  passphrasePlaceholder?: string | undefined;
+  rememberMeLabel?: string | undefined;
+  signInButtonLabel?: string | undefined;
+  loadingButtonLabel?: string | undefined;
+  returnLaterText?: string | undefined;
+
+  // Layout & Styling
+  class?: string | undefined;
+  containerClass?: string | undefined;
+  bodyClass?: string | undefined;
+}
+
+const {
+  title,
+  description,
+  metaTitle,
+  metaDescription,
+  noindex = true,
+  favicon,
+  logoAlt,
+  siteName = (siteConfig as any)?.["name"] || "Rimelight Entertainment",
+  copyright,
+  locales = [
+    { code: "en", label: "English" },
+    { code: "pt", label: "Português" },
+  ],
+  currentLocale,
+  showLocaleSelector = true,
+  allowAuth = true,
+  endpoint = "/api/construction-guest",
+  passphraseLabel,
+  passphrasePlaceholder,
+  rememberMeLabel,
+  signInButtonLabel,
+  loadingButtonLabel,
+  returnLaterText,
+  class: className = "flex min-h-screen flex-col items-center justify-center bg-black px-4 py-12",
+  containerClass = "z-10 w-full max-w-md space-y-8 text-center",
+  bodyClass = "isolate bg-black"
+} = Astro.props;
+
+// Safe i18n translation helper with fallback
+const translate = (key: string, fallback: string): string => {
+  try {
+    const val = t(key);
+    if (val && val !== key) return val;
+  } catch {}
+  return fallback;
+};
+
+const resolvedMetaTitle = metaTitle ?? translate("page_construction.meta_title", title ?? "Under Construction");
+const resolvedMetaDescription = metaDescription ?? translate("page_construction.meta_description", description ?? "This site is currently undergoing scheduled maintenance.");
+const resolvedTitle = title ?? translate("page_construction.title", "Under Construction");
+const resolvedDescription = description ?? translate("page_construction.description", "This site is currently undergoing scheduled maintenance and is restricted to authorized personnel.");
+
+const resolvedPassphraseLabel = passphraseLabel ?? translate("page_construction.form_passphrase_label", "Passphrase");
+const resolvedPassphrasePlaceholder = passphrasePlaceholder ?? translate("page_construction.form_passphrase_placeholder", "Enter passphrase...");
+const resolvedRememberMeLabel = rememberMeLabel ?? translate("page_construction.form_remember_me_label", "Remember me");
+const resolvedSignInButtonLabel = signInButtonLabel ?? translate("page_construction.form_sign_in_button", "Sign In");
+const resolvedCopyright = copyright ?? `© ${new Date().getFullYear()} ${siteName}`;
+
+let resolvedCurrentLocale = currentLocale;
+if (!resolvedCurrentLocale) {
+  try {
+    resolvedCurrentLocale = getLocale();
+  } catch {
+    resolvedCurrentLocale = "en";
+  }
+}
+---
+
+<ConstructionLayout
+  title={resolvedMetaTitle}
+  description={resolvedMetaDescription}
+  favicon={favicon}
+  noindex={noindex}
+  bodyClass={bodyClass}
+>
+  <slot name="head" slot="head" />
+
+  <div class={className}>
+    <div class={containerClass}>
+      <slot name="header">
+        <div class="flex flex-col items-center gap-4">
+          <slot name="logo">
+            <RLALogo class="h-12 w-auto text-white" variant="logomark" mode="white" alt={logoAlt || siteName} />
+          </slot>
+          <slot name="title">
+            <h1 class="m-0 text-3xl font-bold text-white sm:text-4xl">
+              {resolvedTitle}
+            </h1>
+          </slot>
+          <slot name="description">
+            <p class="m-0 text-neutral-400">
+              {resolvedDescription}
+            </p>
+          </slot>
+        </div>
+      </slot>
+
+      <slot name="header-extra" />
+
+      <slot name="form">
+        <ConstructionSignIn
+          allowAuth={allowAuth}
+          endpoint={endpoint}
+          passphraseLabel={resolvedPassphraseLabel}
+          passphrasePlaceholder={resolvedPassphrasePlaceholder}
+          rememberMeLabel={resolvedRememberMeLabel}
+          signInButtonLabel={resolvedSignInButtonLabel}
+          loadingButtonLabel={loadingButtonLabel}
+          returnLaterText={returnLaterText}
+        />
+      </slot>
+
+      <slot name="footer">
+        <div class="flex flex-col items-center gap-2 text-xs text-neutral-500">
+          <slot name="locale-selector">
+            {showLocaleSelector && locales && locales.length > 1 && (
+              <RLALocaleSelector locales={locales as any} currentLocale={resolvedCurrentLocale} />
+            )}
+          </slot>
+          <slot name="copyright">
+            <span>{resolvedCopyright}</span>
+          </slot>
+        </div>
+      </slot>
+    </div>
+  </div>
+</ConstructionLayout>

package/src/components/ConstructionSignIn.astro

@@ -6,15 +6,15 @@ import RLAButton from "@rimelight/ui/components/button/RLAButton.astro"
 import RLACheckbox from "@rimelight/ui/components/checkbox/RLACheckbox.astro"
 
 interface Props {
-  allowAuth?: boolean
-  endpoint?: string
-  passphraseLabel?: string
-  passphrasePlaceholder?: string
-  rememberMeLabel?: string
-  signInButtonLabel?: string
-  loadingButtonLabel?: string
-  returnLaterText?: string
-  class?: string
+  allowAuth?: boolean | undefined
+  endpoint?: string | undefined
+  passphraseLabel?: string | undefined
+  passphrasePlaceholder?: string | undefined
+  rememberMeLabel?: string | undefined
+  signInButtonLabel?: string | undefined
+  loadingButtonLabel?: string | undefined
+  returnLaterText?: string | undefined
+  class?: string | undefined
 }
 
 const {

package/src/components/Turnstile.astro

@@ -0,0 +1,94 @@
+---
+import { getTurnstileSiteKey } from "../turnstile"
+
+export interface Props {
+  /**
+   * Cloudflare Turnstile Site Key. If omitted, attempts to read from `Astro.locals.runtime.env` or `import.meta.env`.
+   */
+  siteKey?: string
+
+  /**
+   * Theme mode for Turnstile widget: "auto", "light", or "dark". Defaults to "auto".
+   */
+  theme?: "auto" | "light" | "dark"
+
+  /**
+   * Widget size: "normal", "compact", or "flexible". Defaults to "normal".
+   */
+  size?: "normal" | "compact" | "flexible"
+
+  /**
+   * Optional custom CSS class.
+   */
+  class?: string
+
+  /**
+   * Form field name for the generated token. Defaults to "cf-turnstile-response".
+   */
+  responseFieldName?: string
+
+  /**
+   * Action name used for Turnstile analytics / reporting.
+   */
+  action?: string
+
+  /**
+   * CData payload if using custom challenge metadata.
+   */
+  cdata?: string
+
+  /**
+   * Turnstile execution mode: "render" (immediate) or "execute" (explicit).
+   */
+  execution?: "render" | "execute"
+
+  /**
+   * Turnstile appearance mode: "always", "execute", or "interaction-only".
+   */
+  appearance?: "always" | "execute" | "interaction-only"
+
+  /**
+   * Automatically load the Cloudflare Turnstile api.js script. Defaults to true.
+   */
+  injectScript?: boolean
+}
+
+const {
+  siteKey: propSiteKey,
+  theme = "auto",
+  size = "normal",
+  class: className = "cf-turnstile my-2",
+  responseFieldName = "cf-turnstile-response",
+  action,
+  cdata,
+  execution,
+  appearance,
+  injectScript = true,
+  ...rest
+} = Astro.props
+
+const env = (Astro.locals as any)?.runtime?.env
+const resolvedSiteKey = propSiteKey || getTurnstileSiteKey(env) || import.meta.env["TURNSTILE_SITE_KEY"] || ""
+---
+
+{
+  resolvedSiteKey && (
+    <>
+      <div
+        class={className}
+        data-sitekey={resolvedSiteKey}
+        data-theme={theme}
+        data-size={size}
+        data-response-field-name={responseFieldName}
+        data-action={action}
+        data-cdata={cdata}
+        data-execution={execution}
+        data-appearance={appearance}
+        {...rest}
+      />
+      {injectScript && (
+        <script is:inline src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>
+      )}
+    </>
+  )
+}

package/src/config/index.ts

@@ -0,0 +1,2 @@
+export * from "../types"
+export * from "../csp"