工作原理
開放標準，無服務提供者
Web 推播透過每個瀏覽器的推播服務在瀏覽器自己的 Web 推播協定上執行。沒有付費的第三方推播供應商，也沒有每個訊息的費用。
VAPID 金鑰，自動生成
首次啟用時，Flash 會為您產生工作區的 VAPID 應用程式伺服器金鑰 — 無需手動建立、貼上或旋轉。
會員發起訂閱
會員透過入口網站的隱私頁面自行訂閱。瀏覽器的權限提示會進行限制－沒有權限，就無法訂閱。
按訂閱加密
每個推送有效負載都使用各個訂閱的金鑰進行加密（RFC 8291 訊息加密），因此只有該成員的瀏覽器才能讀取。
啟用它（管理員）
管理者為工作區啟用 Web 推播功能。無需產生金鑰——Flash 會在首次啟用時建立 VAPID 應用伺服器金鑰對。
// Admin enables web push for the workspace in Settings → Web Push.
// On first enable, Flash GENERATES the VAPID application-server keypair automatically —
// you don't create or paste keys. You set a contact email and can fire a test send.
//
// Settings → Web Push:
// • Enable web push (OFF by default, per workspace)
// • Contact email (identifies the sender to the browser push services)
// • Send test notification (verify the end-to-end path)
//
// The public VAPID application server key is what the member's browser uses when it
// creates a push subscription (below).會員訂閱流程
成員的瀏覽器使用工作區的公共 VAPID 金鑰建立訂閱；入口網站將其發佈到Flash。請參閱會員入口網站嵌入指南，以了解其所依賴的登入消費者會說。
// Members subscribe THEMSELVES from the member portal privacy page. The web-push card
// only renders when (a) the browser supports the Push API AND (b) the workspace enabled
// web push. Tapping it triggers the browser's native permission prompt.
//
// 1. Portal registers a service worker.
// 2. Browser creates a PushSubscription using the workspace's public VAPID key
// (Notification.requestPermission() → pushManager.subscribe(...)).
// 3. The portal posts that subscription (endpoint + p256dh + auth keys) to Flash:
POST https://flash.socialhub.ai/api/member/web-push
Content-Type: application/json
{
"endpoint": "<browser push service endpoint>",
"keys": { "p256dh": "<client public key>", "auth": "<client auth secret>" }
}
// → 200 { data: { ok: true } }
// GET https://flash.socialhub.ai/api/member/web-push → the workspace public key + whether web push is on
// DELETE https://flash.socialhub.ai/api/member/web-push { "endpoint": "..." } → unsubscribe
// The member identity comes from the signed-in member session — never the body.交付方式：頻道，而非API 調用
// You do NOT call a "send web push" endpoint directly. Web push is a CHANNEL in the
// same send/automation stack as email and app push. When a campaign or journey targets
// a subscribed member:
//
// • Flash encrypts the payload to that member's subscription keys (RFC 8291) and
// hands it to the member's own browser push service for delivery.
// • Subscriptions that the push service reports as gone/expired are pruned
// automatically, so you don't keep sending into dead endpoints.