pastilhasandClaude Opus 5
707a2a5ba3
Step 3. Apple directly over HTTP/2 — no Expo, no library, just node:http2 and node:crypto. Three things here are the difference between working and a silent failure: - The provider JWT must be signed with dsaEncoding 'ieee-p1363'. Node's default is DER, which is a perfectly valid ECDSA signature that Apple rejects, and the rejection says nothing about why. A test asserts the signature is 64 bytes rather than trusting the flag. - Apple rejects a token minted more than once per 20 minutes and any token older than 60, so it is cached and refreshed at 40 — between the two walls, not per request. - APNs expects ONE long-lived HTTP/2 session carrying many requests. A session per push gets throttled, so sessions are kept per host and re-created only when they die, with an error handler so a transport failure cannot take the sidecar down as an unhandled rejection. Sandbox and production are separate hosts and separate token namespaces, so devices are sent per their stored `environment` — a debug-build token against production fails with BadDeviceToken and no other symptom. Dead tokens (BadDeviceToken, Unregistered, DeviceTokenNotForTopic) delete their row immediately; everything else counts a strike. Going direct means Apple answers inline, so none of Expo's deferred receipt-polling is needed. The doorbell rule is now enforced by a test, not just by convention: a producer that passes subject/from/body — which the type forbids but JavaScript permits — cannot get any of it into the serialized payload. `aps.alert` carries a generic title composed from the category, and the custom `officer` key carries ids the app fetches by. 12 tests, 100% of the JWT and payload paths. Verified against the real endpoint too: a throwaway key gets 403 InvalidProviderToken from api.sandbox.push.apple.com, which means the connection, path, apns-topic, push-type and JWT structure are all accepted and only the credential is missing. Still needed for a real send: APNS_KEY_P8, APNS_KEY_ID, APNS_TEAM_ID, and a device token from the app. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>