EXTENSIONS

Cloudflare Turnstile — CAPTCHA-free challenges, site widgets

Cloudflare Turnstile provisioning — adds an idempotent, dryRun-default `ensure` (find-or-create a widget by exact name, never persisting its secret) to the official @swamp/cloudflare/challenges/widgets model, and ships a per-app template that exports TURNSTILE_SITE_KEY / TURNSTILE_SECRET_KEY to a human-named 1Password item for @goodcraft/forge mergeEnv to consume.