@fabrika/app 0.7.0 → 0.8.1

package/src/contract/build.ts

@@ -58,7 +58,7 @@ import {
 	type TokenPurposeArtifact,
 	type WebhookScheme,
 } from '@fabrika/auth-core'
-import { isPolicyOrigin, MAX_CSP_ORIGINS } from '@fabrika/proxy-core/headers'
+import { isPolicyOrigin, MAX_CSP_ORIGINS, WORKER_BLOB_SOURCE } from '@fabrika/proxy-core/headers'
 import { z } from 'zod/v4'
 import { contractArtifactSchema } from './artifact-schema'
 import {
@@ -82,14 +82,23 @@ import {
 	type SpaAccessDeclaration,
 } from './declaration'
 import {
+	ALTCHA_LIMITS,
+	altchaSolvable,
+	altchaWorstSolveMs,
 	ATTACHMENT_LIMITS,
 	CHALLENGE_ACTION,
 	CHALLENGE_FIELD,
+	CHALLENGE_ISSUE_RATE,
 	CHALLENGE_ORIGINS,
+	CHALLENGE_PREFIX,
 	challengeAction,
+	challengeIssueBucket,
+	challengePath,
+	challengeRowId,
 	CONNECT_LIMITS,
 	CONNECT_PREFIX,
 	CONTRACT_DEFAULTS,
+	declaredChallengeAction,
 	exportBase,
 	FILE_LIMITS,
 	FORM_MULTIPART_TYPE,
@@ -127,6 +136,8 @@ const ATTACHMENT_FILENAMES: Readonly<Record<AttachmentFormat, RegExp>> = {
 const APP_SCOPE = 'app'
 const AUDIENCE = 'any consumer user'
 const IMPORT_FIELDS = ['app', 'export', 'version', 'digest', 'procedures', 'usedBy', 'timeoutMs']
+const TURNSTILE_CHALLENGE_FIELDS = ['provider', 'secret', 'siteKey', 'action']
+const ALTCHA_CHALLENGE_FIELDS = ['provider', 'secret', 'action', 'cost', 'maxAgeMs']
 /** Tables the framework keeps in the application's schema; no site reaches them unscoped. */
 const FRAMEWORK_TABLE_PREFIX = 'fabrika_'
 /** The most origins one site calls: a site that reaches more is an integration hub, which a connector import serves. */
@@ -215,6 +226,8 @@ class ArtifactBuilder {
 		const csp = this.#csp(contract.csp)
 		const tables = this.#checkTables()
 		this.#reserve(this.#endpoints.some((row) => row.source.kind === 'export') ? CONNECT_PREFIX : null)
+		// An unknown challenge path is a 404, never the root SPA's page.
+		this.#reserve(this.#endpoints.some((row) => row.source.kind === 'challenge') ? CHALLENGE_PREFIX : null)
 		this.#checkKickCycles()
 		const directories = this.#directories(dimensions)
 		const locale = this.#locale()
@@ -541,21 +554,22 @@ class ArtifactBuilder {
 	 * declares its own `action`.
 	 */
 	#challenge(id: string, where: string, challenge: object, fields: Readonly<Record<string, SchemaShape>>): ProcedureChallenge | undefined {
-		this.#keys(`${where} challenge`, challenge, ['provider', 'secret', 'siteKey', 'action'])
 		const provider: unknown = Reflect.get(challenge, 'provider')
+		if (provider !== 'turnstile' && provider !== 'altcha') {
+			this.#problem(where, `challenge provider ${JSON.stringify(provider)} is not one the framework verifies (allowed: 'turnstile', 'altcha')`)
+			return undefined
+		}
+		this.#keys(`${where} challenge`, challenge, provider === 'altcha' ? ALTCHA_CHALLENGE_FIELDS : TURNSTILE_CHALLENGE_FIELDS)
 		const secret: unknown = Reflect.get(challenge, 'secret')
 		const siteKey: unknown = Reflect.get(challenge, 'siteKey')
 		const declaredAction: unknown = Reflect.get(challenge, 'action')
-		if (provider !== 'turnstile') {
-			this.#problem(where, `challenge provider ${JSON.stringify(provider)} is not one the framework verifies (allowed: 'turnstile')`)
-			return undefined
-		}
 		if (typeof secret !== 'string' || !APPLICATION_VARIABLE.test(secret) || secret.startsWith('FABRIKA_')) {
+			const example = provider === 'altcha' ? 'ALTCHA_HMAC_KEY' : 'TURNSTILE_SECRET'
 			this.#problem(
 				where,
 				`challenge secret ${
 					JSON.stringify(secret)
-				} is not the name of an application variable (allowed: 'TURNSTILE_SECRET'; never the secret itself, never FABRIKA_*)`,
+				} is not the name of an application variable (allowed: '${example}'; never the secret itself, never FABRIKA_*)`,
 			)
 			return undefined
 		}
@@ -572,6 +586,35 @@ class ArtifactBuilder {
 			)
 		}
 		this.#challenges.push({ site: id, provider, secret, action })
+		if (provider === 'altcha') {
+			const cost = this.#bounded(
+				where,
+				'challenge.cost',
+				Reflect.get(challenge, 'cost'),
+				ALTCHA_LIMITS.cost,
+				ALTCHA_LIMITS.maxCost,
+				'iterations',
+				ALTCHA_LIMITS.minCost,
+			)
+			const maxAgeMs = this.#bounded(
+				where,
+				'challenge.maxAgeMs',
+				Reflect.get(challenge, 'maxAgeMs'),
+				ALTCHA_LIMITS.maxAgeMs,
+				ALTCHA_LIMITS.maxMaxAgeMs,
+				'ms',
+				ALTCHA_LIMITS.minMaxAgeMs,
+			)
+			if (!altchaSolvable(cost, maxAgeMs)) {
+				this.#problem(
+					where,
+					`its challenge of cost ${cost} takes a slow phone up to ${
+						altchaWorstSolveMs(cost)
+					} ms, more than the widget's ${ALTCHA_LIMITS.solveTimeoutMs} ms or half of maxAgeMs ${maxAgeMs} (allowed: a lower cost, or a longer maxAgeMs)`,
+				)
+			}
+			return { provider, secret, action, cost, maxAgeMs }
+		}
 		if (siteKey === undefined || !this.#applicationVariable(where, 'challenge siteKey', siteKey, 'TURNSTILE_SITE_KEY')) {
 			return { provider, secret, action }
 		}
@@ -588,7 +631,7 @@ class ArtifactBuilder {
 					`challenge.action ${JSON.stringify(declared)} is not a widget action (allowed: at most 32 letters, digits, '_' or '-', such as 'register')`,
 				)
 			}
-			return typeof declared === 'string' ? declared : challengeAction(id)
+			return declaredChallengeAction(id, declared)
 		}
 		const derived = challengeAction(id)
 		if (!CHALLENGE_ACTION.test(derived)) {
@@ -807,9 +850,44 @@ class ArtifactBuilder {
 			output: this.#output(where, procedure),
 			...origins,
 		})
+		const procedureRules = this.#procedureRules[id]
+		if (procedureRules?.challenge?.provider === 'altcha') {
+			this.#challengeIssuer(id, procedureRules.challenge.action, procedureRules.rate, origins)
+		}
 		return actions
 	}
 
+	/**
+	 * The framework's own `GET` that issues the ALTCHA challenge of public procedure `id`: anonymous like the procedure,
+	 * from the same origins, with buckets of its own that admit at least as many as the procedure's, and no body.
+	 */
+	#challengeIssuer(id: string, action: string, rate: AdmissionRate, origins: { readonly crossOrigin?: 'environment' | 'any' }): void {
+		const issuer = challengeRowId(id)
+		this.#row({
+			id: issuer,
+			source: { kind: 'challenge', name: id },
+			kind: 'public',
+			method: 'GET',
+			path: challengePath(action),
+			admission: null,
+			callers: [],
+			requirement: null,
+			input: null,
+			output: null,
+			...origins,
+		})
+		this.#procedureRules[issuer] = {
+			rate: {
+				perClient: challengeIssueBucket(rate.perClient, CHALLENGE_ISSUE_RATE.perClient),
+				perCaller: null,
+				perEndpoint: challengeIssueBucket(rate.perEndpoint, CHALLENGE_ISSUE_RATE.perEndpoint),
+				bytesPerHour: null,
+			},
+			challenge: null,
+			timeoutMs: PROCEDURE_LIMITS.timeoutMs,
+		}
+	}
+
 	/** A public procedure's `actions`: at least one action of the contract, each once. */
 	#workloadActions(where: string, value: unknown): readonly string[] {
 		if (!Array.isArray(value) || value.length === 0 || !value.every((action) => typeof action === 'string')) {
@@ -1124,12 +1202,13 @@ class ArtifactBuilder {
 	}
 
 	/** A declared whole number from 1 to `ceiling`, or `fallback` when it is absent or refused. */
-	#bounded(where: string, field: string, value: unknown, fallback: number, ceiling: number, unit: string): number {
+	/** A declared whole number from `floor` (1 unless named) to `ceiling`, or `fallback` when it is not declared. */
+	#bounded(where: string, field: string, value: unknown, fallback: number, ceiling: number, unit: string, floor = 1): number {
 		if (value === undefined) {
 			return fallback
 		}
-		if (typeof value !== 'number' || !Number.isSafeInteger(value) || value < 1 || value > ceiling) {
-			this.#problem(where, `${field} ${JSON.stringify(value)} is not a whole number of ${unit} from 1 to ${ceiling}`)
+		if (typeof value !== 'number' || !Number.isSafeInteger(value) || value < floor || value > ceiling) {
+			this.#problem(where, `${field} ${JSON.stringify(value)} is not a whole number of ${unit} from ${floor} to ${ceiling}`)
 			return fallback
 		}
 		return value
@@ -1892,7 +1971,20 @@ class ArtifactBuilder {
 			...(frameSrc.length === 0 ? {} : { frameSrc }),
 			...(styleSrc.length === 0 ? {} : { styleSrc }),
 			...(fontSrc.length === 0 ? {} : { fontSrc }),
+			...this.#challengeWorkers(),
+		}
+	}
+
+	/** `blob:` for workers, when a challenge provider's widget starts its own; the contract never declares it. */
+	#challengeWorkers(): Pick<CspExtensions, 'workerSrc'> {
+		const providers = [...new Set(this.#challenges.map((challenge) => challenge.provider))].sort()
+		const needing = providers.filter((provider) => CHALLENGE_ORIGINS[provider].workerSrc.length > 0)
+		if (needing.length === 0) {
+			return {}
 		}
+		const sites = this.#challenges.filter((challenge) => needing.includes(challenge.provider)).map((challenge) => `'${challenge.site}'`).sort()
+		const purpose = `the workers of the ${needing.join(' and ')} challenge of ${sites.join(', ')}`
+		return { workerSrc: [{ origin: WORKER_BLOB_SOURCE, purpose }] }
 	}
 
 	/** The declared sources, plus each fixed origin a challenge provider loads that the contract does not name itself. */

package/src/contract/connect.ts

@@ -150,8 +150,9 @@ export function incompatibleChanges(before: ExportDescription, after: ExportDesc
 
 /**
  * What `after` breaks for the callers of each mount `before` promises `compatibility: 'backward'`: a procedure it
- * removes, an input or a query that accepts less, another output, another HTTP shape (method, path, body codec), file
- * answer or access (its kind, callers, requirement and cross-origin form), or a mount moved. The promise binds the
+ * removes (including its generated challenge endpoint), an input or a query that accepts less, another output, another
+ * HTTP shape (method, path, body codec), file answer or access (its kind, callers, requirement and cross-origin form), or a
+ * mount moved. The promise binds the
  * publication that drops it too, so a breaking change is a new mount beside the old one. Empty when compatible.
  */
 export function incompatibleMountChanges(before: ContractArtifact, after: ContractArtifact): string[] {
@@ -165,9 +166,10 @@ export function incompatibleMountChanges(before: ContractArtifact, after: Contra
 			problems.push(`mount '${name}' promises backward compatibility, and this deploy removes or moves it`)
 			continue
 		}
-		for (const row of before.endpoints.filter((endpoint) => isMountProcedure(endpoint, name))) {
-			const next = after.endpoints.find((candidate) => candidate.id === row.id)
-			if (next === undefined || !isMountProcedure(next, name)) {
+		const current = mountEndpoints(after, name)
+		for (const row of mountEndpoints(before, name)) {
+			const next = current.find((candidate) => candidate.id === row.id)
+			if (next === undefined) {
 				problems.push(`removes '${row.id}'`)
 				continue
 			}
@@ -177,6 +179,12 @@ export function incompatibleMountChanges(before: ContractArtifact, after: Contra
 	return problems
 }
 
+/** A challenge URL is embedded in the mount's clients too, even though its row is outside the mount's prefix. */
+function mountEndpoints(artifact: ContractArtifact, mount: string): EndpointRow[] {
+	const procedures = new Set(artifact.endpoints.filter((row) => isMountProcedure(row, mount)).map((row) => row.id))
+	return artifact.endpoints.filter((row) => procedures.has(row.id) || (row.source.kind === 'challenge' && procedures.has(row.source.name)))
+}
+
 function isMountProcedure(row: EndpointRow, mount: string): boolean {
 	return row.source.kind === 'mount' && row.source.name === mount && (row.kind === 'query' || row.kind === 'mutation' || row.kind === 'public')
 }

package/src/contract/defaults.ts

@@ -2,6 +2,7 @@
 // source reaches them only through `buildArtifact`, so both producers emit the same artifact.
 
 import type { BodyAdmission, ChallengeProvider } from '@fabrika/auth-core'
+import { WORKER_BLOB_SOURCE } from '@fabrika/proxy-core/headers'
 
 export const CONTRACT_DEFAULTS = {
 	/** A failed job run is not retried unless the job asks for it: a retry repeats work. */
@@ -54,7 +55,7 @@ export const JOB_LIMITS = {
 /** A public mutation's buckets per minute unless it declares its own: per client and for the endpoint. */
 export const PUBLIC_MUTATION_RATE = { perClient: 10, perEndpoint: 100 } as const
 
-/** What Turnstile admits as a widget's `action`: at most 32 letters, digits, `_` and `-`. */
+/** What a widget's `action` may be: at most 32 letters, digits, `_` and `-`, what Turnstile admits, and a path segment. */
 export const CHALLENGE_ACTION = /^[A-Za-z0-9_-]{1,32}$/
 
 /**
@@ -71,11 +72,86 @@ export const CHALLENGE_FIELD = 'challengeToken'
 /** A procedure with file fields reads `multipart/form-data`; the proxy admits that type for its row. */
 export { FORM_MULTIPART_TYPE } from '@fabrika/auth-core'
 
-/** Each challenge provider's fixed browser origins: its widget's script and its frame. */
-export const CHALLENGE_ORIGINS: Readonly<Record<ChallengeProvider, { readonly scriptSrc: readonly string[]; readonly frameSrc: readonly string[] }>> =
-	{
-		turnstile: { scriptSrc: ['https://challenges.cloudflare.com'], frameSrc: ['https://challenges.cloudflare.com'] },
-	}
+/**
+ * Each challenge provider's fixed browser sources: the origins of its widget's script and frame, and `blob:` for workers
+ * when the widget starts its own. ALTCHA's widget is bundled with the page and solves in workers built from `Blob`s.
+ */
+export const CHALLENGE_ORIGINS: Readonly<
+	Record<ChallengeProvider, { readonly scriptSrc: readonly string[]; readonly frameSrc: readonly string[]; readonly workerSrc: readonly string[] }>
+> = {
+	turnstile: { scriptSrc: ['https://challenges.cloudflare.com'], frameSrc: ['https://challenges.cloudflare.com'], workerSrc: [] },
+	altcha: { scriptSrc: [], frameSrc: [], workerSrc: [WORKER_BLOB_SOURCE] },
+}
+
+/**
+ * An ALTCHA challenge: PBKDF2/SHA-256 attempts of `cost` iterations each, counted up to a number drawn per challenge
+ * between `minCounter` and `maxCounter`, so a browser makes that many attempts, about half of `maxCounter` on average.
+ * The draw starts at 1: a solver that knew a higher floor would skip the attempts below it, which the widget makes.
+ * `cost` and `maxAgeMs` are the contract's (`challenge.cost`, `challenge.maxAgeMs`), each with its default and its
+ * bounds, and together they must leave a slow phone time to solve (`altchaSolvable`). The HMAC key is at least
+ * `minKeyLength` characters: every issued challenge publishes a signature a short key could be guessed from. A solved
+ * payload is base64 JSON of the challenge and its solution, at most `maxTokenLength` characters.
+ */
+export const ALTCHA_LIMITS = {
+	algorithm: 'PBKDF2/SHA-256',
+	cost: 5000,
+	minCost: 1000,
+	maxCost: 18_000,
+	minCounter: 1,
+	maxCounter: 10_000,
+	maxAgeMs: 10 * 60_000,
+	minMaxAgeMs: 60_000,
+	maxMaxAgeMs: 60 * 60_000,
+	maxTokenLength: 4096,
+	minKeyLength: 32,
+	/** What a slow phone's widget runs over its workers, PBKDF2 iterations a second: the rate the worst case is sized by. */
+	slowIterationsPerSecond: 2_000_000,
+	/** How long the widget tries before it gives up. */
+	solveTimeoutMs: 90_000,
+} as const
+
+/** How long a slow phone takes for the worst draw of a challenge of `cost`, in ms. */
+export function altchaWorstSolveMs(cost: number): number {
+	return Math.ceil((cost * ALTCHA_LIMITS.maxCounter * 1000) / ALTCHA_LIMITS.slowIterationsPerSecond)
+}
+
+/** Whether a slow phone solves the worst draw before the widget gives up and within half the challenge's lifetime. */
+export function altchaSolvable(cost: number, maxAgeMs: number): boolean {
+	return altchaWorstSolveMs(cost) <= Math.min(ALTCHA_LIMITS.solveTimeoutMs, maxAgeMs / 2)
+}
+
+/**
+ * The `action` a procedure's challenge expects back: the declared one, else the endpoint id with `_` for `.`. The build
+ * and the typed client both read it here, so the client's challenge path is the artifact's.
+ */
+export function declaredChallengeAction(endpoint: string, declared: unknown): string {
+	return typeof declared === 'string' ? declared : challengeAction(endpoint)
+}
+
+/** Where an ALTCHA challenge is issued: one path per procedure, under its action. */
+export const CHALLENGE_PREFIX = '/__fabrika/challenge'
+
+export function challengePath(action: string): string {
+	return `${CHALLENGE_PREFIX}/${action}`
+}
+
+/** The endpoint id of the row that issues the challenge of public procedure `endpoint`. */
+export function challengeRowId(endpoint: string): string {
+	return `${endpoint}.challenge`
+}
+
+/**
+ * The buckets per minute of the endpoint that issues a challenge: a visitor fetches one per form shown and one more per
+ * expiry, and every issue costs the server one attempt's work. Each is at least this, and at least twice the
+ * procedure's own bucket, so the issuer never admits fewer submissions than the procedure declares. A bucket the
+ * procedure turns off (`null`) is this one on the issuer: the procedure's handler may be cheap, the issue never is.
+ */
+export const CHALLENGE_ISSUE_RATE = { perClient: 30, perEndpoint: 600 } as const
+
+/** The issuer's bucket for the procedure's `own`, within the ceiling of every bucket. */
+export function challengeIssueBucket(own: number | null, floor: number): number {
+	return Math.min(PROCEDURE_LIMITS.maxPerMinute, Math.max(floor, 2 * (own ?? 0)))
+}
 
 /**
  * The bounds of a file kind: the largest file a `scan: true` kind admits (the scanner reads at most this much of one

package/src/contract/define.ts

@@ -303,12 +303,13 @@ export interface Surface extends SurfaceSections {
 	readonly [name: string]: AnyMount | SurfaceSections[keyof SurfaceSections]
 }
 
-/** A public procedure's challenge: the provider and the application variables that hold its secret and its public site key. */
-export interface ChallengeOption {
+/** A public procedure's challenge, by provider: Turnstile, verified at Cloudflare, or ALTCHA, which the application issues and verifies. */
+export type ChallengeOption = TurnstileChallengeOption | AltchaChallengeOption
+
+interface ChallengeOptionBase {
 	readonly provider: ChallengeProvider
+	/** The application variable that holds the provider's secret (Turnstile's) or the HMAC key (ALTCHA's): a name, never the value. */
 	readonly secret: string
-	/** Served by every SPA mount at `<prefix>/__fabrika-config.json`, so the page renders the widget with it. */
-	readonly siteKey?: string
 	/**
 	 * The widget's `action`, which the verification expects back: at most 32 letters, digits, `_` and `-`. The endpoint id
 	 * with `_` for `.` by default (`api_visitors_register`).
@@ -316,6 +317,24 @@ export interface ChallengeOption {
 	readonly action?: string
 }
 
+export interface TurnstileChallengeOption extends ChallengeOptionBase {
+	readonly provider: 'turnstile'
+	/** Served by every SPA mount at `<prefix>/__fabrika-config.json`, so the page renders the widget with it. */
+	readonly siteKey?: string
+}
+
+/** The page fetches its challenge from `GET /__fabrika/challenge/<action>` (`challengeUrl` of `@fabrika/app/client`). */
+export interface AltchaChallengeOption extends ChallengeOptionBase {
+	readonly provider: 'altcha'
+	/**
+	 * The PBKDF2 iterations of one attempt, 1000 to 18000; 5000 by default. A browser makes up to 10000 attempts, about
+	 * 5000 on average, and the build refuses a cost a slow phone would not solve within 90 s or half of `maxAgeMs`.
+	 */
+	readonly cost?: number
+	/** How long a challenge may be solved and submitted, in ms, 60 s to an hour; ten minutes by default. */
+	readonly maxAgeMs?: number
+}
+
 export interface LinkKit<A extends string> {
 	query<const Acc extends LinkAccess<A>, O extends Schema, I extends InputSchema | null = null>(
 		def: ProcedureDef<I, O, Acc>,

package/src/implement/boot.ts

@@ -32,7 +32,7 @@ import type { FileObjectStore } from '@fabrika/platform'
 import { compileContract } from '../contract/compile'
 import { exportDescription } from '../contract/connect'
 import { isProcedure, type ProcedureDeclaration, type ProcedureTreeDeclaration, SURFACE_SECTIONS } from '../contract/declaration'
-import { exportBase, spaPrefixRowId } from '../contract/defaults'
+import { challengeRowId, exportBase, spaPrefixRowId } from '../contract/defaults'
 import type { AnyContract, Schema } from '../contract/define'
 import { kitOriginOf } from '../contract/handled'
 import { schemaFromShape } from '../contract/schema-from-shape'
@@ -45,7 +45,7 @@ import { bindJobs, type ContractJobs, type HandlerErrorSink } from '../jobs/runn
 import { environmentScrubber } from '../jobs/scrub'
 import { browserConfigs } from './browser-config'
 import { createCapabilityIssuer, requestIsReadOnly } from './capability'
-import type { ChallengeFetch } from './challenge'
+import type { ChallengeFetch, ChallengeWork } from './challenge'
 import { type ConnectFetch, wireImports } from './connect'
 import {
 	ContractRuntime,
@@ -120,6 +120,11 @@ export interface BootOptions {
 	 * Turnstile's always-passing test widget hands out for every call. Every other token stays single use.
 	 */
 	readonly repeatableChallengeToken?: string
+	/**
+	 * The work of every ALTCHA challenge in place of the contract's `cost`: the test kit's and `fabrika app dev`'s
+	 * (`MINIMAL_CHALLENGE_WORK`), so a test solves one in milliseconds. A deployed application never sets it.
+	 */
+	readonly challengeWork?: ChallengeWork
 	/**
 	 * The developer's own machine only (`fabrika app dev`): what a job's handler threw, which every log of a deployed
 	 * application withholds because it may carry a credential.
@@ -545,7 +550,33 @@ function admissionOptions(options: BootOptions): AdmissionOptions {
 		application: options.environment.application,
 		...(options.challengeFetch === undefined ? {} : { challengeFetch: options.challengeFetch }),
 		...(options.repeatableChallengeToken === undefined ? {} : { repeatableChallengeToken: options.repeatableChallengeToken }),
+		...(options.challengeWork === undefined ? {} : { challengeWork: options.challengeWork }),
+	}
+}
+
+/**
+ * The framework's own endpoint that issues the ALTCHA challenge of a served public procedure, with its own buckets;
+ * `null` for a procedure without one.
+ */
+function challengeIssuerEndpoint(
+	procedure: Extract<ServedEndpoint, { kind: 'public' }>,
+	rows: ReadonlyMap<string, EndpointRow>,
+	artifact: ContractArtifact,
+	options: BootOptions,
+	problems: string[],
+): ServedEndpoint | null {
+	const issuer = procedure.admission.challenge?.issuer ?? null
+	if (issuer === null) {
+		return null
 	}
+	const id = challengeRowId(procedure.row.id)
+	const row = rows.get(id)
+	if (row === undefined || row.source.kind !== 'challenge') {
+		problems.push(`public procedure '${procedure.row.id}' has no endpoint that issues its challenge`)
+		return null
+	}
+	const admission = procedureAdmission(id, artifact, admissionOptions(options), problems)
+	return admission === null ? null : { kind: 'challenge', row, issuer, admission }
 }
 
 /**
@@ -560,7 +591,7 @@ function publicEndpoint(
 	workloads: ReadonlyMap<string, WorkloadCredential>,
 	options: BootOptions,
 	problems: string[],
-): ServedEndpoint | null {
+): Extract<ServedEndpoint, { kind: 'public' }> | null {
 	const where = `public procedure '${row.id}'`
 	const site = bound === null ? undefined : servedSite(procedure.type, bound)
 	if (bound === null || site === undefined) {
@@ -729,6 +760,10 @@ export function boot(app: ContractImplementation, options: BootOptions): Contrac
 					const served = publicEndpoint(row, procedure, bound, artifact, workloads, options, problems)
 					if (served !== null) {
 						endpoints.set(id, served)
+						const issuer = challengeIssuerEndpoint(served, rows, artifact, options, problems)
+						if (issuer !== null) {
+							endpoints.set(issuer.row.id, issuer)
+						}
 					}
 					continue
 				}

package/src/implement/browser-config.ts

@@ -35,7 +35,8 @@ export function browserConfigs(
 	const siteKeys: Record<string, string> = {}
 	for (const [id, procedure] of Object.entries(artifact.procedures ?? {})) {
 		const challenge = procedure.challenge
-		if (challenge?.siteKey === undefined) continue
+		// Only Turnstile's widget needs a key in the page; ALTCHA's fetches its challenge from the application.
+		if (challenge?.provider !== 'turnstile' || challenge.siteKey === undefined) continue
 		const value = valueOf(challenge.siteKey)
 		if (value === null) problems.push(`procedure '${id}' names its ${challenge.provider} site key in ${challenge.siteKey}, which is not set`)
 		else siteKeys[challenge.siteKey] = value