nixamp 0.28.37 → 0.28.41

package/src/locales/platforms.ts

@@ -1,5 +1,26 @@
 /* English fallback for BackToSchool platform and installation messages. */
 export default {
+  "Nixamp Share link or HTTPS media URL": "Nixamp Share link or HTTPS media URL",
+  "For TV playback, use a Nixamp Share link or a direct HTTPS media URL. Pairux viewing opens separately.": "For TV playback, use a Nixamp Share link or a direct HTTPS media URL. Pairux viewing opens separately.",
+
+  "Paused": "Paused",
+  "Broadcast ended": "Broadcast ended",
+  "Class broadcast": "Class broadcast",
+  "Play": "Play",
+  "Pause": "Pause",
+  "Retry playback": "Retry playback",
+  "Back 10 seconds": "Back 10 seconds",
+  "Forward 10 seconds": "Forward 10 seconds",
+  "Mute": "Mute",
+  "Unmute": "Unmute",
+  "Full screen": "Full screen",
+  "Exit full screen": "Exit full screen",
+  "Playing": "Playing",
+  "Select Play to watch the broadcast.": "Select Play to watch the broadcast.",
+  "The broadcast could not be loaded. Try again.": "The broadcast could not be loaded. Try again.",
+  "This Pairux broadcast opens separately. For playback here on Fire TV, the host needs to share a Nixamp stream or direct media link.": "This Pairux broadcast opens separately. For playback here on Fire TV, the host needs to share a Nixamp stream or direct media link.",
+  "Open on Pairux": "Open on Pairux",
+
   "Supported platforms": "Supported platforms",
   "In review": "In review",
   "Not available": "Not available",

package/src/nixamp-link-api.ts

@@ -0,0 +1,220 @@
+/**
+ * The routes behind "Connect nixamp" on a site that runs on this codebase
+ * but is not nixamp.com.
+ *
+ *   GET    /api/v1/nixamp/connect     send the browser to nixamp.com's consent page
+ *   GET    /api/v1/nixamp/callback    the code comes back; tokens are kept
+ *   GET    /api/v1/nixamp/connection  whether this account is connected, and as whom
+ *   DELETE /api/v1/nixamp/connection  withdraw the grant, both sides
+ *   GET    /api/v1/nixamp/streams     the servers you run on nixamp, and what is live
+ *
+ * All five want the site's own session: the person, signed in here. What
+ * they hold on nixamp's side is a client token, and it never leaves the
+ * server -- the page only ever learns a handle and a list of streams.
+ */
+import type { IncomingMessage, ServerResponse } from "node:http";
+import { tokenFrom, type Accounts } from "./accounts.ts";
+import type { NixampLinks } from "./nixamp-link.ts";
+import type { ServerStreams, StreamPick } from "./nixamp-link-types.ts";
+export type { ServerStreams, StreamPick } from "./nixamp-link-types.ts";
+
+export interface NixampLinkApiOptions {
+  links: NixampLinks;
+  accounts: Accounts;
+  /** nixamp.com, or whatever is the issuer. */
+  issuer: string;
+  /** This site, as the redirect URI is built from it: https://backtoschool.help. */
+  site: string;
+  /** The redirect URIs the client registered on the issuer; the callback must be one. */
+  redirectUris: string[];
+  /** Where the browser lands after the callback. */
+  home?: string;
+  secureCookies?: boolean;
+  fetcher?: typeof fetch;
+}
+
+const COOKIE = "nixamp_connect";
+const CALLBACK = "/api/v1/nixamp/callback";
+
+export function nixampLinkPath(path: string): boolean {
+  return path === "/api/v1/nixamp/connect" || path === CALLBACK || path === "/api/v1/nixamp/connection" || path === "/api/v1/nixamp/streams";
+}
+
+function json(response: ServerResponse, code: number, body: unknown, headers: Record<string, string> = {}): void {
+  const value = JSON.stringify(body);
+  response.writeHead(code, {
+    ...headers,
+    "content-type": "application/json; charset=utf-8",
+    "content-length": Buffer.byteLength(value),
+    "cache-control": "no-store",
+  });
+  response.end(value);
+}
+
+function cookieValue(headers: IncomingMessage["headers"], name: string): string {
+  const raw = headers.cookie ?? "";
+  for (const part of raw.split(";")) {
+    const [key, ...rest] = part.trim().split("=");
+    if (key === name) return decodeURIComponent(rest.join("="));
+  }
+  return "";
+}
+
+function legCookie(value: string, secure: boolean): string {
+  const parts = [`${COOKIE}=${encodeURIComponent(value)}`, `Path=${CALLBACK}`, "Max-Age=600", "SameSite=Lax", "HttpOnly"];
+  if (secure) parts.push("Secure");
+  return parts.join("; ");
+}
+
+function clearedLegCookie(): string {
+  return `${COOKIE}=; Path=${CALLBACK}; Max-Age=0; SameSite=Lax; HttpOnly`;
+}
+
+function landing(home: string, outcome: string, reason = ""): string {
+  const url = new URL(home, "http://placeholder.invalid");
+  url.searchParams.set("nixamp", outcome);
+  if (reason) url.searchParams.set("reason", reason.slice(0, 200));
+  return `${url.pathname}${url.search}${url.hash || "#settings"}`;
+}
+
+/**
+ * Every server the nixamp account remembers, asked what it is doing.
+ *
+ * The account's own list comes from nixamp.com with the client token; each
+ * server is then asked directly, with the share key the account kept for it,
+ * and given four seconds. One that does not answer is listed as out of
+ * reach rather than dropped, so a host sees why a stream is missing.
+ */
+export async function streamsFor(token: string, issuer: string, pageSite: string, fetcher: typeof fetch): Promise<ServerStreams[]> {
+  const base = issuer.replace(/\/+$/, "");
+  let servers: { id: string; name: string; url: string; key: string }[] = [];
+  const answer = await fetcher(`${base}/api/v1/servers`, {
+    headers: { authorization: `Bearer ${token}`, accept: "application/json" },
+    signal: AbortSignal.timeout(8000),
+  });
+  if (!answer.ok) throw new Error(answer.status === 401 ? "nixamp.com no longer accepts this connection" : `nixamp.com answered ${answer.status}`);
+  const body = (await answer.json().catch(() => ({}))) as { servers?: typeof servers };
+  servers = Array.isArray(body.servers) ? body.servers : [];
+  const page = pageSite.replace(/\/+$/, "");
+  const linkTo = (address: string, play: string): string => `${page}/?url=${encodeURIComponent(address)}&play=${encodeURIComponent(play)}`;
+  return Promise.all(servers.map(async (server): Promise<ServerStreams> => {
+    const out: ServerStreams = { id: server.id, name: server.name || server.url, url: server.url, reachable: false, playing: false, nowPlaying: "", live: "", channels: [] };
+    try {
+      const url = new URL("/api/streams", server.url.endsWith("/") ? server.url : `${server.url}/`);
+      if (server.key) url.searchParams.set("k", server.key);
+      const response = await fetcher(url.href, { headers: { accept: "application/json" }, signal: AbortSignal.timeout(4000) });
+      if (!response.ok) return out;
+      const data = (await response.json()) as {
+        server?: { name?: string; nowPlaying?: string; playing?: boolean; url?: string };
+        channels?: { id: string; name: string; kind?: string; listeners?: number }[];
+      };
+      // What a viewer link is built on: the server's own view-only address
+      // when it publishes one, else its plain address. Never the key the
+      // account kept, which may open the controls.
+      const viewer = data.server?.url && /^https?:\/\//.test(data.server.url) ? data.server.url : server.url;
+      out.reachable = true;
+      out.name = data.server?.name || out.name;
+      out.playing = data.server?.playing === true;
+      out.nowPlaying = data.server?.nowPlaying ?? "";
+      out.live = out.playing ? linkTo(viewer, "live") : "";
+      out.channels = (data.channels ?? []).map((one): StreamPick => ({
+        server: out.name,
+        serverUrl: server.url,
+        id: one.id,
+        name: one.name,
+        kind: one.kind ?? "audio",
+        listeners: typeof one.listeners === "number" ? one.listeners : 0,
+        link: linkTo(viewer, `channel:${one.id}`),
+      }));
+    } catch {
+      // Out of reach: said so, above.
+    }
+    return out;
+  }));
+}
+
+export async function handleNixampLinkApi(
+  request: IncomingMessage,
+  response: ServerResponse,
+  url: URL,
+  options: NixampLinkApiOptions,
+): Promise<boolean> {
+  const path = url.pathname;
+  if (!nixampLinkPath(path)) return false;
+  const home = options.home ?? "/";
+  const redirectUri = `${options.site.replace(/\/+$/, "")}${CALLBACK}`;
+  const registered = options.redirectUris.includes(redirectUri);
+
+  const account = await options.accounts.whoIs(tokenFrom(request.headers));
+  if (account === null) {
+    if (path === CALLBACK) {
+      response.writeHead(302, { location: landing(home, "failed", "sign in here first, then connect again"), "set-cookie": clearedLegCookie() });
+      response.end();
+      return true;
+    }
+    json(response, 401, { error: "sign in first" });
+    return true;
+  }
+
+  if (path === "/api/v1/nixamp/connect") {
+    if (request.method !== "GET") { json(response, 405, { error: "GET only" }); return true; }
+    if (!registered) { json(response, 400, { error: "this site is not registered as a nixamp client" }); return true; }
+    const leg = options.links.begin(redirectUri);
+    response.writeHead(302, { location: leg.url, "set-cookie": legCookie(`${leg.state}.${leg.verifier}`, options.secureCookies ?? false), "cache-control": "no-store" });
+    response.end();
+    return true;
+  }
+
+  if (path === CALLBACK) {
+    if (request.method !== "GET") { json(response, 405, { error: "GET only" }); return true; }
+    const kept = cookieValue(request.headers, COOKIE);
+    const dot = kept.indexOf(".");
+    const state = dot > 0 ? kept.slice(0, dot) : "";
+    const verifier = dot > 0 ? kept.slice(dot + 1) : "";
+    const headers = { "set-cookie": clearedLegCookie(), "cache-control": "no-store" };
+    const refused = url.searchParams.get("error");
+    if (refused) {
+      response.writeHead(302, { ...headers, location: landing(home, refused === "access_denied" ? "denied" : "failed", url.searchParams.get("error_description") ?? refused) });
+      response.end();
+      return true;
+    }
+    const code = url.searchParams.get("code") ?? "";
+    if (state === "" || url.searchParams.get("state") !== state || code === "") {
+      response.writeHead(302, { ...headers, location: landing(home, "failed", "that link is not the one this browser started; try again") });
+      response.end();
+      return true;
+    }
+    try {
+      await options.links.finish(account.id, { code, verifier, redirectUri });
+      response.writeHead(302, { ...headers, location: landing(home, "connected") });
+    } catch (error) {
+      response.writeHead(302, { ...headers, location: landing(home, "failed", (error as Error).message) });
+    }
+    response.end();
+    return true;
+  }
+
+  if (path === "/api/v1/nixamp/connection") {
+    if (request.method === "GET") {
+      json(response, 200, { ...(await options.links.of(account.id)), available: registered });
+      return true;
+    }
+    if (request.method === "DELETE") {
+      json(response, 200, { ok: true, withdrawn: await options.links.disconnect(account.id) });
+      return true;
+    }
+    json(response, 405, { error: "GET or DELETE" });
+    return true;
+  }
+
+  // /api/v1/nixamp/streams
+  if (request.method !== "GET") { json(response, 405, { error: "GET only" }); return true; }
+  const token = await options.links.accessToken(account.id);
+  if (token === "") { json(response, 409, { error: "connect your nixamp account first", connected: false }); return true; }
+  try {
+    json(response, 200, { servers: await streamsFor(token, options.issuer, options.issuer, options.fetcher ?? fetch) });
+  } catch (error) {
+    json(response, 502, { error: (error as Error).message });
+  }
+  return true;
+}

package/src/nixamp-link-types.ts

@@ -0,0 +1,36 @@
+/**
+ * What "Connect nixamp" looks like from a page: a leaf module, so a client
+ * bundle can name these shapes without pulling the server in behind them.
+ */
+
+/** The connection as the account holder sees it. Never the tokens. */
+export interface LinkView {
+  connected: boolean;
+  handle: string;
+  nixampUserId: string;
+  scope: string;
+  since: number | null;
+}
+
+/** A stream somebody could pick: a channel on one of their servers, as a link a classroom accepts. */
+export interface StreamPick {
+  server: string;
+  serverUrl: string;
+  id: string;
+  name: string;
+  kind: string;
+  listeners: number;
+  link: string;
+}
+
+export interface ServerStreams {
+  id: string;
+  name: string;
+  url: string;
+  reachable: boolean;
+  playing: boolean;
+  nowPlaying: string;
+  /** A link to what the server itself is playing, when it is. */
+  live: string;
+  channels: StreamPick[];
+}

package/src/nixamp-link.ts

@@ -0,0 +1,265 @@
+/**
+ * A nixamp account, connected to an account here.
+ *
+ * backtoschool.help runs on the nixamp codebase, and for a while its sign-in
+ * dialog said so: "your BackToSchool identity is your NixAmp account". That
+ * made a password manager file the nixamp password under the school's
+ * address, and it made nixamp a thing every teacher had to have. Neither is
+ * wanted. A BackToSchool account is a BackToSchool account; nixamp is the
+ * broadcast backend a host may plug in, and plugging it in is a choice.
+ *
+ * So the school is an OAuth 2.1 client of nixamp.com, the way bittorrented
+ * is: PKCE, a consent page on nixamp.com, a refresh token kept here against
+ * the school account, and a grant the person can withdraw from either side.
+ * What the connection buys is the list of the servers they run on nixamp and
+ * what is live on them, so "go live" is a pick from a list rather than a
+ * link pasted from a terminal.
+ *
+ * The client half of OAuth is behind an interface, because the server on the
+ * other end is this same program in production and a stub in a test.
+ */
+import { randomBytes } from "node:crypto";
+import type { Queryable } from "./follows.ts";
+import { challengeFor } from "./oauth-server.ts";
+import type { LinkView } from "./nixamp-link-types.ts";
+export type { LinkView } from "./nixamp-link-types.ts";
+
+const TABLE = "nixamp_links";
+
+const SCHEMA = `
+  CREATE TABLE IF NOT EXISTS ${TABLE} (
+    user_id           TEXT PRIMARY KEY,
+    nixamp_user_id    TEXT NOT NULL,
+    handle            TEXT NOT NULL DEFAULT '',
+    scope             TEXT NOT NULL DEFAULT '',
+    access_token      TEXT NOT NULL DEFAULT '',
+    access_expires_at TIMESTAMPTZ,
+    refresh_token     TEXT NOT NULL DEFAULT '',
+    created_at        TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at        TIMESTAMPTZ NOT NULL DEFAULT NOW()
+  );
+`;
+
+/** What the school asks nixamp for: who you are, your servers, and to keep it. */
+export const LINK_SCOPE = "profile streams offline_access";
+
+/** How long before an access token's end it is treated as spent. */
+const EARLY_MS = 60_000;
+
+export interface TokenGrant {
+  access_token: string;
+  refresh_token?: string;
+  expires_in?: number;
+  scope?: string;
+}
+
+export interface WhoAmI {
+  sub: string;
+  handle?: string;
+}
+
+/** The client side of OAuth 2.1, against the issuer, however it is reached. */
+export interface OAuthExchange {
+  authorizeUrl(query: Record<string, string>): string;
+  /** The token endpoint. Rejects with an Error whose message is fit to show. */
+  token(form: URLSearchParams): Promise<TokenGrant>;
+  userinfo(accessToken: string): Promise<WhoAmI>;
+  revoke(token: string): Promise<void>;
+}
+
+export const NOT_CONNECTED: LinkView = { connected: false, handle: "", nixampUserId: "", scope: "", since: null };
+
+/** The real thing: nixamp.com over HTTP. */
+export function nixampExchange(issuer: string, clientId: string, fetcher: typeof fetch = fetch): OAuthExchange {
+  const base = issuer.replace(/\/+$/, "");
+  async function post(path: string, form: URLSearchParams, accept: "json" | "none"): Promise<Record<string, unknown>> {
+    let response: Response;
+    try {
+      response = await fetcher(`${base}${path}`, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+        body: form.toString(),
+        signal: AbortSignal.timeout(10_000),
+      });
+    } catch {
+      throw new Error("nixamp.com could not be reached");
+    }
+    const body = (await response.json().catch(() => ({}))) as Record<string, unknown>;
+    if (!response.ok && accept === "json") {
+      const description = typeof body["error_description"] === "string" ? body["error_description"] : typeof body["error"] === "string" ? body["error"] : `nixamp.com answered ${response.status}`;
+      throw new Error(description);
+    }
+    return body;
+  }
+  return {
+    authorizeUrl(query) {
+      const url = new URL(`${base}/api/v1/oauth/authorize`);
+      for (const [key, value] of Object.entries(query)) url.searchParams.set(key, value);
+      return url.href;
+    },
+    async token(form) {
+      form.set("client_id", clientId);
+      const body = await post("/api/v1/oauth/token", form, "json");
+      if (typeof body["access_token"] !== "string" || body["access_token"] === "") throw new Error("nixamp.com sent no token");
+      return body as unknown as TokenGrant;
+    },
+    async userinfo(accessToken) {
+      let response: Response;
+      try {
+        response = await fetcher(`${base}/api/v1/oauth/userinfo`, {
+          headers: { authorization: `Bearer ${accessToken}`, accept: "application/json" },
+          signal: AbortSignal.timeout(10_000),
+        });
+      } catch {
+        throw new Error("nixamp.com could not be reached");
+      }
+      if (!response.ok) throw new Error("nixamp.com did not say whose token that is");
+      const body = (await response.json().catch(() => ({}))) as Record<string, unknown>;
+      if (typeof body["sub"] !== "string" || body["sub"] === "") throw new Error("nixamp.com did not say whose token that is");
+      return { sub: body["sub"], ...(typeof body["handle"] === "string" ? { handle: body["handle"] } : {}) };
+    },
+    async revoke(token) {
+      const form = new URLSearchParams({ token, client_id: clientId });
+      await post("/api/v1/oauth/revoke", form, "none").catch(() => undefined);
+    },
+  };
+}
+
+function asTime(value: unknown): number | null {
+  if (value instanceof Date) return value.getTime();
+  if (typeof value === "string") {
+    const at = Date.parse(value);
+    return Number.isNaN(at) ? null : at;
+  }
+  return null;
+}
+
+function view(row: Record<string, unknown> | undefined): LinkView {
+  if (!row) return { ...NOT_CONNECTED };
+  return {
+    connected: true,
+    handle: String(row["handle"] ?? ""),
+    nixampUserId: String(row["nixamp_user_id"] ?? ""),
+    scope: String(row["scope"] ?? ""),
+    since: asTime(row["created_at"]),
+  };
+}
+
+export class NixampLinks {
+  private ready: Promise<void> | null = null;
+
+  constructor(
+    private readonly db: Queryable,
+    private readonly exchange: OAuthExchange,
+    private readonly clientId: string,
+    private readonly now: () => number = () => Date.now(),
+    /** How nixamp.com and the servers it lists are reached, for what the tokens are used on. */
+    readonly fetcher: typeof fetch = fetch,
+  ) {}
+
+  private async ensure(): Promise<void> {
+    this.ready ??= this.db.query(SCHEMA).then(() => undefined);
+    await this.ready;
+  }
+
+  /**
+   * The first leg: where to send the browser, and the two secrets the
+   * callback must bring back. The state is the CSRF check, the verifier is
+   * PKCE; both live in a short cookie on the school's origin, never here.
+   */
+  begin(redirectUri: string): { url: string; state: string; verifier: string } {
+    const state = randomBytes(24).toString("base64url");
+    const verifier = randomBytes(48).toString("base64url");
+    const url = this.exchange.authorizeUrl({
+      response_type: "code",
+      client_id: this.clientId,
+      redirect_uri: redirectUri,
+      scope: LINK_SCOPE,
+      state,
+      code_challenge: challengeFor(verifier),
+      code_challenge_method: "S256",
+    });
+    return { url, state, verifier };
+  }
+
+  /** The second leg: the code becomes tokens, the tokens say whose, and that is kept. */
+  async finish(userId: string, leg: { code: string; verifier: string; redirectUri: string }): Promise<LinkView> {
+    const grant = await this.exchange.token(new URLSearchParams({
+      grant_type: "authorization_code",
+      code: leg.code,
+      code_verifier: leg.verifier,
+      redirect_uri: leg.redirectUri,
+    }));
+    const who = await this.exchange.userinfo(grant.access_token);
+    await this.ensure();
+    await this.db.query(
+      `INSERT INTO ${TABLE} (user_id, nixamp_user_id, handle, scope, access_token, access_expires_at, refresh_token)
+       VALUES ($1, $2, $3, $4, $5, $6, $7)
+       ON CONFLICT (user_id) DO UPDATE SET nixamp_user_id = EXCLUDED.nixamp_user_id, handle = EXCLUDED.handle,
+         scope = EXCLUDED.scope, access_token = EXCLUDED.access_token, access_expires_at = EXCLUDED.access_expires_at,
+         refresh_token = EXCLUDED.refresh_token, updated_at = NOW()`,
+      [userId, who.sub, who.handle ?? "", grant.scope ?? LINK_SCOPE, grant.access_token, this.expiry(grant), grant.refresh_token ?? ""],
+    );
+    return this.of(userId);
+  }
+
+  private expiry(grant: TokenGrant): Date {
+    const seconds = typeof grant.expires_in === "number" && grant.expires_in > 0 ? grant.expires_in : 3600;
+    return new Date(this.now() + seconds * 1000);
+  }
+
+  async of(userId: string): Promise<LinkView> {
+    await this.ensure();
+    const { rows } = await this.db.query(
+      `SELECT nixamp_user_id, handle, scope, created_at FROM ${TABLE} WHERE user_id = $1`,
+      [userId],
+    );
+    return view(rows[0]);
+  }
+
+  /**
+   * A token good for a call right now, refreshed when the one kept is about
+   * to end. "" when there is no connection, or the refresh was refused --
+   * which is what a grant withdrawn on nixamp.com looks like from here, and
+   * the row is dropped so the settings page says so too.
+   */
+  async accessToken(userId: string): Promise<string> {
+    await this.ensure();
+    const { rows } = await this.db.query(
+      `SELECT access_token, access_expires_at, refresh_token FROM ${TABLE} WHERE user_id = $1`,
+      [userId],
+    );
+    const row = rows[0];
+    if (!row) return "";
+    const access = String(row["access_token"] ?? "");
+    const until = asTime(row["access_expires_at"]);
+    if (access !== "" && until !== null && until - this.now() > EARLY_MS) return access;
+    const refresh = String(row["refresh_token"] ?? "");
+    if (refresh === "") return "";
+    let grant: TokenGrant;
+    try {
+      grant = await this.exchange.token(new URLSearchParams({ grant_type: "refresh_token", refresh_token: refresh }));
+    } catch {
+      await this.db.query(`DELETE FROM ${TABLE} WHERE user_id = $1`, [userId]);
+      return "";
+    }
+    await this.db.query(
+      `UPDATE ${TABLE} SET access_token = $2, access_expires_at = $3, refresh_token = $4, updated_at = NOW() WHERE user_id = $1`,
+      [userId, grant.access_token, this.expiry(grant), grant.refresh_token ?? refresh],
+    );
+    return grant.access_token;
+  }
+
+  /** Withdraw the grant on nixamp.com and forget it here. True when there was one. */
+  async disconnect(userId: string): Promise<boolean> {
+    await this.ensure();
+    const { rows } = await this.db.query(`SELECT refresh_token, access_token FROM ${TABLE} WHERE user_id = $1`, [userId]);
+    const row = rows[0];
+    if (!row) return false;
+    const refresh = String(row["refresh_token"] ?? "");
+    const access = String(row["access_token"] ?? "");
+    await this.exchange.revoke(refresh !== "" ? refresh : access);
+    await this.db.query(`DELETE FROM ${TABLE} WHERE user_id = $1`, [userId]);
+    return true;
+  }
+}

package/src/notify.ts

@@ -1,3 +1,4 @@
+import { sendPush } from "@profullstack/notifications/server";
 import { mailSender, type BrandedMailSender } from "./mail-sender.ts";
 
 /**
@@ -168,53 +169,37 @@ function escapeHtml(value: string): string {
 /**
  * Web push, to a browser, a desktop app or an installed PWA.
  *
- * The library is imported lazily because it is only needed on the instance
- * that has VAPID keys -- which is nixamp.com and nowhere else. A laptop
- * running `nixamp serve` should not pay to load it.
+ * Sent with @profullstack/notifications, which does VAPID and the payload
+ * encryption with node:crypto and nothing else, so there is no library to load
+ * lazily on the one instance (nixamp.com) that has keys. The keys are the same
+ * base64url pair web-push used, so nothing had to be regenerated.
  *
  * 404 and 410 mean the vendor has retired the subscription. That is not a
  * failure to retry; it is a row to delete.
  */
 export function webPush(
-  { publicKey, privateKey, subject, onEvent }: {
+  { publicKey, privateKey, subject, onEvent, fetch }: {
     publicKey: string;
     privateKey: string;
     /** A mailto: or https: URL identifying us to the push service. */
     subject: string;
     onEvent?: (message: string) => void;
+    fetch?: typeof globalThis.fetch;
   },
 ): (target: PushTarget, note: Notification) => Promise<PushResult> {
-  let library: Promise<{ sendNotification: Function; setVapidDetails: Function }> | null = null;
-
-  const load = async () => {
-    library ??= import("web-push").then((mod) => {
-      const wp = ((mod as Record<string, unknown>)["default"] ?? mod) as {
-        sendNotification: Function;
-        setVapidDetails: Function;
-      };
-      wp.setVapidDetails(subject, publicKey, privateKey);
-      return wp;
-    });
-    return library;
-  };
-
+  const keys = { publicKey, privateKey };
   return async (target, note) => {
-    try {
-      const wp = await load();
-      await wp.sendNotification(
-        { endpoint: target.endpoint, keys: { p256dh: target.p256dh, auth: target.auth } },
-        JSON.stringify({ title: note.title, body: note.body, url: note.url }),
-        { TTL: 60 * 30 },
-      );
-      return "sent";
-    } catch (error) {
-      const status = (error as { statusCode?: number }).statusCode;
-      if (status === 404 || status === 410) {
-        onEvent?.(`  push endpoint retired by the vendor, dropping it`);
-        return "gone";
-      }
-      onEvent?.(`  push failed: ${status ?? (error as Error).message}`);
-      return "failed";
+    const result = await sendPush(
+      { endpoint: target.endpoint, keys: { p256dh: target.p256dh, auth: target.auth } },
+      { title: note.title, body: note.body, url: note.url },
+      { keys, subject, ttl: 60 * 30, ...(fetch ? { fetch } : {}) },
+    );
+    if (result.sent) return "sent";
+    if (result.gone) {
+      onEvent?.(`  push endpoint retired by the vendor, dropping it`);
+      return "gone";
     }
+    onEvent?.(`  push failed: ${result.status ?? result.error}`);
+    return "failed";
   };
 }