Module push 

fz push (issue #184): the operator half of the push transports — a VAPID key pair, one test send, and a subscription check.

Three commands, each answering a question that otherwise only gets answered at send time, in production, silently:

• vapid_keygen makes the P-256 key pair a venture generates once and keeps forever, and prints the public half in the exact encoding a browser wants.
• send builds the venture’s adapters from its environment and sends one notification, printing the outcome and — when nothing was sent — why. This is the tool the needs-human live proofs (issue #186) are run with.
• inspect_subscription validates a Web Push subscription and prints the aud the adapter will sign, because a wrong aud is the commonest cause of a VAPID 401.

This module reads no push environment variable

It calls cratefield_push_wiring::build_push — the same function serve() calls on both runtimes and fz doctor calls through inspect_push — so fz push send and the deployment it is diagnosing cannot disagree about which variables a transport reads. Where a name has to appear in prose it comes from PushKey::name, not from a string literal, and crates/cli-acceptance/tests/push_env_guard.rs fails the build if that rule is broken here.

Nothing printed here came out of the environment

An adapter’s error is free to quote what it was handed, and issue #218’s review found the case that costs: VAPID_SUBJECT and VAPID_PRIVATE_KEY pasted the wrong way round put the private key into a log, because the subject is validated first and its error quotes the value. So the wiring report carries only variable names and fixed phrases, and this module prints the report — never a value it read. The same rule covers what the operator supplies: a device token, a subscription endpoint and its auth secret are all credential material, so a send prints the Recipient’s fingerprinting Debug and a subscription check prints the endpoint’s origin without its path.

The failure path is where that promise was broken. A FAILED report printed the PushError verbatim, and a transport failure carries the HTTP client’s own message — which for reqwest ends for url (<the whole URL>), the APNs device path and the Web Push bearer endpoint included. The fix is in two places, and the first is the important one: cratefield-runtime-native’s HTTP port no longer stringifies a reqwest::Error whole, so the leak is closed for tracing::error! and every persisted error too, not just for this command. SendReport then redacts its own recipient out of whatever reaches it anyway — this process is the one place that knows exactly which string is the capability, so it can be precise where a general rule has to be blunt. the_failure_path_never_prints_the_recipient holds the Sent(Err) arm the plan()-only test could not see.

Structs

KeygenOptions

Where a generated VAPID private key is allowed to go.

SendArgs

The command line of fz push send, before anything is parsed.

SendReport

The result of a fz push send, as the operator sees it.

SendRequest

One parsed send: a recipient and the notification for it.

SubscriptionReport

A subscription that passed every check the adapter makes.

VapidKeygen

A generated VAPID key pair.

Enums

PriorityArg

Priority as a command-line value.

Transport

The transport a fz push send is aimed at. The CLI’s spelling of Platform, which is core’s and carries no clap derive.

Functions

inspect_subscription

Validates a Web Push subscription and works out the aud the adapter will use for it.

plan

What send would do, without sending: the same wiring verdict for the same transport, from inspect_push, which has no HTTP client at all — so a --dry-run cannot reach the network however it is wired.

send

Sends one notification through the adapters this venture’s environment configures.

send_now

The same, in an fz built without the push-send feature: there is no HTTP client, so there is no send. See the other half’s documentation.

vapid_keygen

Generates a VAPID key pair and keeps the private half where options says.