chainlesschain 0.162.147 → 0.162.149

package/src/harness/remote-session-audit-sink.js

@@ -0,0 +1,132 @@
+// Remote Session audit log — durable JSONL sink.
+//
+// Attaches to RemoteSessionAuditLog's `sink` seam to persist the (already
+// privacy-filtered) audit trail to a newline-delimited JSON file so it survives
+// a host restart for forensics. Each entry is one JSON line; the file is
+// size-bounded with simple rotation (audit.jsonl → audit.jsonl.1 → …) so it can
+// never grow unbounded. Reads tolerate a torn last line (crash mid-append) by
+// skipping any line that will not parse.
+//
+// Deliberately dependency-free (node:fs only) and injectable — a SQLite-backed
+// sink could implement the same { handler, readAll } shape later without
+// touching the audit log or its call sites.
+
+import fs from "node:fs";
+import path from "node:path";
+
+const DEFAULT_MAX_BYTES = 5 * 1024 * 1024; // 5 MiB
+const DEFAULT_BACKUPS = 1;
+
+export class RemoteSessionAuditFileSink {
+  constructor(options = {}) {
+    if (!options.path) {
+      throw new Error("RemoteSessionAuditFileSink requires a path");
+    }
+    this.path = options.path;
+    this.maxBytes = options.maxBytes || DEFAULT_MAX_BYTES;
+    this.backups = Number.isInteger(options.backups)
+      ? options.backups
+      : DEFAULT_BACKUPS;
+    this.fs = options.fs || fs;
+    this._ensureDir();
+  }
+
+  _ensureDir() {
+    try {
+      this.fs.mkdirSync(path.dirname(this.path), { recursive: true });
+    } catch {
+      // Best effort — a later append will surface a real error if the dir is
+      // genuinely unwritable, and the audit log swallows sink throws anyway.
+    }
+  }
+
+  /** Bound function to pass as RemoteSessionAuditLog({ sink }). */
+  get handler() {
+    return (entry) => this.append(entry);
+  }
+
+  /** Append one entry as a JSON line, rotating first if it would overflow. */
+  append(entry) {
+    const line = `${JSON.stringify(entry)}\n`;
+    this._rotateIfNeeded(Buffer.byteLength(line, "utf8"));
+    this.fs.appendFileSync(this.path, line, "utf8");
+  }
+
+  _rotateIfNeeded(incomingBytes) {
+    let size = 0;
+    try {
+      size = this.fs.statSync(this.path).size;
+    } catch {
+      return; // No file yet — nothing to rotate.
+    }
+    if (size + incomingBytes <= this.maxBytes) return;
+    if (this.backups <= 0) {
+      // No history kept — truncate by removing the active file.
+      try {
+        this.fs.rmSync(this.path);
+      } catch {
+        /* ignore */
+      }
+      return;
+    }
+    // Shift backups: .(<n-1>) → .(<n>), …, active → .1, dropping the oldest.
+    for (let i = this.backups; i >= 1; i -= 1) {
+      const src = i === 1 ? this.path : `${this.path}.${i - 1}`;
+      const dst = `${this.path}.${i}`;
+      try {
+        if (this.fs.existsSync(src)) this.fs.renameSync(src, dst);
+      } catch {
+        /* ignore a single failed rotation step */
+      }
+    }
+  }
+
+  /**
+   * Read persisted entries oldest-first across the active file and its backups.
+   * Corrupt/partial lines are skipped. `limit` keeps only the newest N.
+   */
+  readAll({ limit } = {}) {
+    const files = [];
+    for (let i = this.backups; i >= 1; i -= 1) files.push(`${this.path}.${i}`);
+    files.push(this.path);
+    const entries = [];
+    for (const file of files) {
+      let raw;
+      try {
+        raw = this.fs.readFileSync(file, "utf8");
+      } catch {
+        continue; // Missing backup slot — expected.
+      }
+      for (const line of raw.split("\n")) {
+        const trimmed = line.trim();
+        if (!trimmed) continue;
+        try {
+          entries.push(JSON.parse(trimmed));
+        } catch {
+          // Torn write (crash mid-append) or manual edit — skip the line.
+        }
+      }
+    }
+    if (limit && limit > 0 && entries.length > limit) {
+      return entries.slice(entries.length - limit);
+    }
+    return entries;
+  }
+
+  /**
+   * Build a sink from env, or null when no audit file is configured. Enable with
+   * CHAINLESSCHAIN_REMOTE_SESSION_AUDIT_FILE (path); tune the rotation ceiling
+   * with CHAINLESSCHAIN_REMOTE_SESSION_AUDIT_MAX_BYTES.
+   */
+  static fromEnv(env = {}, options = {}) {
+    const filePath = env.CHAINLESSCHAIN_REMOTE_SESSION_AUDIT_FILE;
+    if (!filePath) return null;
+    const maxBytes =
+      Number(env.CHAINLESSCHAIN_REMOTE_SESSION_AUDIT_MAX_BYTES) || undefined;
+    return new RemoteSessionAuditFileSink({
+      path: filePath,
+      maxBytes,
+      ...options,
+    });
+  }
+}

package/src/harness/remote-session-audit.js

@@ -0,0 +1,110 @@
+// Remote Session audit log.
+//
+// A bounded, in-memory, privacy-respecting audit trail for one CLI host process
+// — matched to the ephemeral (in-memory, 12h TTL) nature of remote sessions.
+// Captures WHO did WHAT and WHEN across a session's lifecycle and remote control
+// events, but deliberately does NOT record prompt/tool payloads (only shapes
+// like content length), keeping the trail useful for forensics without
+// hoarding session content. A pluggable `sink` seam lets a durable backend
+// (JSONL file, SQLite audit_log) be attached later without touching call sites.
+
+const DEFAULT_MAX_ENTRIES = 1000;
+
+export const REMOTE_SESSION_AUDIT_ACTIONS = Object.freeze([
+  "session.created",
+  "pairing-token.issued",
+  "device.joined",
+  "device.revoked",
+  "device.disconnected",
+  "session.closed",
+  "control.prompt",
+  "control.approval",
+  "control.interrupt",
+  "push.registered",
+  "push.sent",
+  "push.failed",
+  "push.skipped",
+  "push.unregistered",
+]);
+
+export class RemoteSessionAuditLog {
+  constructor(options = {}) {
+    this.now = options.now || Date.now;
+    this.maxEntries = options.maxEntries || DEFAULT_MAX_ENTRIES;
+    this.sink = typeof options.sink === "function" ? options.sink : null;
+    this.entries = [];
+    this.seq = 0;
+    // Hydrate from a durable sink so audit queries survive a host restart. The
+    // persisted entries are NOT re-written to the sink (they are already
+    // there); we only pre-fill the in-memory ring and carry the seq high-water
+    // forward so new entries stay strictly monotonic.
+    if (Array.isArray(options.initialEntries)) {
+      this._hydrate(options.initialEntries);
+    }
+  }
+
+  _hydrate(entries) {
+    const recent = entries.slice(-this.maxEntries);
+    for (const entry of recent) {
+      if (!entry || !entry.action) continue;
+      this.entries.push({ ...entry });
+      if (typeof entry.seq === "number" && entry.seq > this.seq) {
+        this.seq = entry.seq;
+      }
+    }
+  }
+
+  /**
+   * Append an audit entry. Never throws into the caller — a broken sink or bad
+   * argument must not take down the live session it is auditing.
+   */
+  record({ sessionId = null, actor = null, action, detail = null } = {}) {
+    if (!action) return null;
+    const entry = {
+      seq: (this.seq += 1),
+      timestamp: this.now(),
+      sessionId,
+      actor,
+      action,
+      detail: detail && typeof detail === "object" ? { ...detail } : detail,
+    };
+    this.entries.push(entry);
+    if (this.entries.length > this.maxEntries) {
+      this.entries.splice(0, this.entries.length - this.maxEntries);
+    }
+    if (this.sink) {
+      try {
+        this.sink(entry);
+      } catch {
+        // A durable-sink failure must not break the session being audited.
+      }
+    }
+    return entry;
+  }
+
+  /** Newest-first, optionally filtered by session and/or action. */
+  list({ sessionId, action, limit } = {}) {
+    let out = this.entries;
+    if (sessionId) out = out.filter((entry) => entry.sessionId === sessionId);
+    if (action) out = out.filter((entry) => entry.action === action);
+    out = [...out].reverse();
+    if (limit && limit > 0) out = out.slice(0, limit);
+    return out.map((entry) => ({ ...entry }));
+  }
+
+  stats(sessionId) {
+    const scope = sessionId
+      ? this.entries.filter((entry) => entry.sessionId === sessionId)
+      : this.entries;
+    const byAction = {};
+    for (const entry of scope) {
+      byAction[entry.action] = (byAction[entry.action] || 0) + 1;
+    }
+    return { total: scope.length, byAction };
+  }
+
+  clear() {
+    this.entries = [];
+    this.seq = 0;
+  }
+}

package/src/harness/remote-session-crypto.js

@@ -0,0 +1,217 @@
+import {
+  createCipheriv,
+  createDecipheriv,
+  createHash,
+  createPrivateKey,
+  createPublicKey,
+  diffieHellman,
+  generateKeyPairSync,
+  hkdfSync,
+  randomBytes,
+} from "crypto";
+
+const PROTOCOL = "chainlesschain.remote-session.e2ee.v1";
+const PAIRING_SCHEME = "chainlesschain://remote-session/pair#";
+
+function b64(value) {
+  return Buffer.from(value).toString("base64url");
+}
+
+function unb64(value) {
+  return Buffer.from(value, "base64url");
+}
+
+function exportPublicKey(key) {
+  return b64(key.export({ type: "spki", format: "der" }));
+}
+
+function importPublicKey(value) {
+  let der = unb64(value);
+  if (der.length === 32) {
+    // RFC 8410 SubjectPublicKeyInfo prefix for a raw X25519 public key.
+    der = Buffer.concat([Buffer.from("302a300506032b656e032100", "hex"), der]);
+  }
+  return createPublicKey({ key: der, type: "spki", format: "der" });
+}
+
+function aad(sessionId, senderId, sequence) {
+  return Buffer.from(
+    `${PROTOCOL}\n${sessionId}\n${senderId}\n${sequence}`,
+    "utf8",
+  );
+}
+
+function deriveKey(privateKey, peerPublicKey, sessionId, pairingToken) {
+  const secret = diffieHellman({ privateKey, publicKey: peerPublicKey });
+  const salt = createHash("sha256").update(pairingToken, "utf8").digest();
+  return Buffer.from(
+    hkdfSync(
+      "sha256",
+      secret,
+      salt,
+      Buffer.from(`${PROTOCOL}:${sessionId}`),
+      32,
+    ),
+  );
+}
+
+export function createRemoteSessionKeyPair() {
+  const { publicKey, privateKey } = generateKeyPairSync("x25519");
+  return {
+    publicKey: exportPublicKey(publicKey),
+    privateKey: b64(privateKey.export({ type: "pkcs8", format: "der" })),
+  };
+}
+
+export function createRemotePairingUri({
+  relayUrl,
+  remoteSessionId,
+  hostPeerId,
+  hostPublicKey,
+  pairingToken,
+  expiresAt,
+}) {
+  if (
+    !relayUrl ||
+    !remoteSessionId ||
+    !hostPeerId ||
+    !hostPublicKey ||
+    !pairingToken
+  ) {
+    throw new Error("Incomplete Remote Session pairing payload");
+  }
+  const payload = {
+    v: 1,
+    relayUrl,
+    remoteSessionId,
+    hostPeerId,
+    hostPublicKey,
+    pairingToken,
+    expiresAt,
+  };
+  return `${PAIRING_SCHEME}${b64(JSON.stringify(payload))}`;
+}
+
+export function parseRemotePairingUri(uri, now = Date.now()) {
+  if (typeof uri !== "string" || !uri.startsWith(PAIRING_SCHEME)) {
+    throw new Error("Invalid Remote Session pairing URI");
+  }
+  let payload;
+  try {
+    payload = JSON.parse(
+      unb64(uri.slice(PAIRING_SCHEME.length)).toString("utf8"),
+    );
+  } catch {
+    throw new Error("Malformed Remote Session pairing payload");
+  }
+  if (
+    payload.v !== 1 ||
+    !payload.relayUrl ||
+    !payload.remoteSessionId ||
+    !payload.hostPeerId ||
+    !payload.hostPublicKey ||
+    !payload.pairingToken
+  ) {
+    throw new Error("Incomplete Remote Session pairing payload");
+  }
+  if (payload.expiresAt && payload.expiresAt <= now) {
+    throw new Error("Remote Session pairing payload expired");
+  }
+  return payload;
+}
+
+export class RemoteSessionCryptoContext {
+  constructor({ sessionId, localPeerId, privateKey, publicKey } = {}) {
+    if (!sessionId || !localPeerId)
+      throw new Error("sessionId and localPeerId are required");
+    let keyPair;
+    if (!privateKey || !publicKey) keyPair = createRemoteSessionKeyPair();
+    this.sessionId = sessionId;
+    this.localPeerId = localPeerId;
+    this.privateKey = createPrivateKey({
+      key: unb64(privateKey || keyPair.privateKey),
+      type: "pkcs8",
+      format: "der",
+    });
+    this.publicKey = publicKey || keyPair.publicKey;
+    this.keys = new Map();
+    this.sendSequence = 0;
+    this.receivedSequences = new Map();
+  }
+
+  pair(peerId, peerPublicKey, pairingToken) {
+    if (!peerId || !peerPublicKey || !pairingToken)
+      throw new Error("Incomplete peer key material");
+    this.keys.set(
+      peerId,
+      deriveKey(
+        this.privateKey,
+        importPublicKey(peerPublicKey),
+        this.sessionId,
+        pairingToken,
+      ),
+    );
+  }
+
+  encrypt(peerId, message) {
+    const key = this.keys.get(peerId);
+    if (!key) throw new Error(`No encryption key for peer: ${peerId}`);
+    const sequence = ++this.sendSequence;
+    const nonce = randomBytes(12);
+    const cipher = createCipheriv("aes-256-gcm", key, nonce);
+    cipher.setAAD(aad(this.sessionId, this.localPeerId, sequence));
+    const ciphertext = Buffer.concat([
+      cipher.update(JSON.stringify(message), "utf8"),
+      cipher.final(),
+    ]);
+    return {
+      v: 1,
+      sessionId: this.sessionId,
+      senderId: this.localPeerId,
+      sequence,
+      nonce: b64(nonce),
+      ciphertext: b64(ciphertext),
+      tag: b64(cipher.getAuthTag()),
+    };
+  }
+
+  decrypt(envelope) {
+    if (envelope?.v !== 1 || envelope.sessionId !== this.sessionId) {
+      throw new Error("Invalid encrypted Remote Session envelope");
+    }
+    const key = this.keys.get(envelope.senderId);
+    if (!key)
+      throw new Error(`No encryption key for peer: ${envelope.senderId}`);
+    const previous = this.receivedSequences.get(envelope.senderId) || 0;
+    if (
+      !Number.isSafeInteger(envelope.sequence) ||
+      envelope.sequence <= previous
+    ) {
+      throw new Error(
+        "Remote Session replay or out-of-order envelope rejected",
+      );
+    }
+    try {
+      const decipher = createDecipheriv(
+        "aes-256-gcm",
+        key,
+        unb64(envelope.nonce),
+      );
+      decipher.setAAD(
+        aad(this.sessionId, envelope.senderId, envelope.sequence),
+      );
+      decipher.setAuthTag(unb64(envelope.tag));
+      const plaintext = Buffer.concat([
+        decipher.update(unb64(envelope.ciphertext)),
+        decipher.final(),
+      ]);
+      const message = JSON.parse(plaintext.toString("utf8"));
+      this.receivedSequences.set(envelope.senderId, envelope.sequence);
+      return message;
+    } catch (error) {
+      throw new Error(
+        `Remote Session envelope authentication failed: ${error.message}`,
+      );
+    }
+  }
+}

package/src/harness/remote-session-push-apns.js

@@ -0,0 +1,246 @@
+// Remote Session vendor push — Apple Push Notification service (APNs) sender.
+//
+// A concrete implementation of the RemoteSessionPushDispatcher `sender` contract
+// for iOS/macOS devices, using APNs' HTTP/2 provider API with token-based
+// (JWT ES256) auth: a short-lived bearer signed with the .p8 auth key
+// (key id + team id). APNs mandates HTTP/2, so the network transport is an
+// injectable `request` function (default: node:http2) — everything else is
+// injectable too (clock, signer), so the whole chain is unit-testable with a
+// generated EC keypair and a fake transport, no real credentials or network.
+// The payload carries NO session content, only routing ids.
+
+import { sign as cryptoSign } from "node:crypto";
+import http2 from "node:http2";
+import fs from "node:fs";
+import { PushTokenUnregisteredError } from "./remote-session-push-errors.js";
+
+const PROD_HOST = "https://api.push.apple.com";
+const SANDBOX_HOST = "https://api.sandbox.push.apple.com";
+// APNs auth tokens are valid up to 60 min; refresh well inside that window.
+const JWT_TTL_MS = 50 * 60 * 1000;
+const JWT_SKEW_MS = 60 * 1000;
+
+function base64url(input) {
+  return Buffer.from(input)
+    .toString("base64")
+    .replace(/\+/g, "-")
+    .replace(/\//g, "_")
+    .replace(/=+$/, "");
+}
+
+function dropUndefined(obj) {
+  const out = {};
+  for (const [key, value] of Object.entries(obj)) {
+    if (value !== undefined) out[key] = value;
+  }
+  return out;
+}
+
+/** Default HTTP/2 transport for APNs. Resolves `{ status, headers, body }`. */
+function http2Request({ url, headers, body }) {
+  return new Promise((resolve, reject) => {
+    const target = new URL(url);
+    const client = http2.connect(`${target.protocol}//${target.host}`);
+    client.on("error", reject);
+    const req = client.request({
+      ":method": "POST",
+      ":path": `${target.pathname}${target.search}`,
+      ...headers,
+    });
+    let status = 0;
+    let responseHeaders = {};
+    let data = "";
+    req.on("response", (h) => {
+      status = Number(h[":status"]) || 0;
+      responseHeaders = h;
+    });
+    req.setEncoding("utf8");
+    req.on("data", (chunk) => {
+      data += chunk;
+    });
+    req.on("end", () => {
+      client.close();
+      resolve({ status, headers: responseHeaders, body: data });
+    });
+    req.on("error", (error) => {
+      client.close();
+      reject(error);
+    });
+    req.end(body);
+  });
+}
+
+/** Mints + caches the ES256 provider JWT from a .p8 auth key. */
+export class ApnsTokenProvider {
+  constructor(options = {}) {
+    if (!options.keyId) throw new Error("ApnsTokenProvider requires a keyId");
+    if (!options.teamId) throw new Error("ApnsTokenProvider requires a teamId");
+    if (!options.privateKey) {
+      throw new Error("ApnsTokenProvider requires a privateKey (.p8 contents)");
+    }
+    this.keyId = options.keyId;
+    this.teamId = options.teamId;
+    this.privateKey = options.privateKey;
+    this.now = options.now || Date.now;
+    // ES256 = ECDSA P-256 / SHA-256 with a raw R||S signature (JOSE form).
+    this.sign =
+      options.sign ||
+      ((input, key) =>
+        cryptoSign("sha256", Buffer.from(input), {
+          key,
+          dsaEncoding: "ieee-p1363",
+        }));
+    this._cached = null; // { token, expiresAt }
+  }
+
+  getToken() {
+    const now = this.now();
+    if (this._cached && this._cached.expiresAt - JWT_SKEW_MS > now) {
+      return this._cached.token;
+    }
+    const header = base64url(
+      JSON.stringify({ alg: "ES256", kid: this.keyId, typ: "JWT" }),
+    );
+    const payload = base64url(
+      JSON.stringify({ iss: this.teamId, iat: Math.floor(now / 1000) }),
+    );
+    const signingInput = `${header}.${payload}`;
+    const signature = base64url(this.sign(signingInput, this.privateKey));
+    const token = `${signingInput}.${signature}`;
+    this._cached = { token, expiresAt: now + JWT_TTL_MS };
+    return token;
+  }
+}
+
+/** Sends one high-priority alert to a device token via APNs HTTP/2. */
+export class ApnsPushSender {
+  constructor(options = {}) {
+    if (!options.tokenProvider) {
+      throw new Error("ApnsPushSender requires a tokenProvider");
+    }
+    if (!options.topic) {
+      throw new Error("ApnsPushSender requires a topic (app bundle id)");
+    }
+    this.tokenProvider = options.tokenProvider;
+    this.topic = options.topic;
+    this.host = options.host || (options.production ? PROD_HOST : SANDBOX_HOST);
+    this.request = options.request || http2Request;
+  }
+
+  /** Bound function matching the dispatcher's `sender` contract. */
+  get handler() {
+    return (payload) => this.send(payload);
+  }
+
+  async send({ token, notification, sessionId, clientId } = {}) {
+    if (!token) throw new Error("APNs send requires a device token");
+    const jwt = this.tokenProvider.getToken();
+    const payload = {
+      aps: dropUndefined({
+        alert: notification
+          ? dropUndefined({
+              title: notification.title,
+              body: notification.body,
+            })
+          : undefined,
+        sound: "default",
+      }),
+      // Routing ids only; no session content.
+      "remote-session": dropUndefined({
+        type: "approval-request",
+        sessionId: sessionId != null ? String(sessionId) : undefined,
+        clientId: clientId != null ? String(clientId) : undefined,
+      }),
+    };
+    const res = await this.request({
+      url: `${this.host}/3/device/${token}`,
+      headers: {
+        authorization: `bearer ${jwt}`,
+        "apns-topic": this.topic,
+        "apns-push-type": "alert",
+        "apns-priority": "10",
+      },
+      body: JSON.stringify(payload),
+    });
+    if (res.status === 200) {
+      return { id: res.headers?.["apns-id"] || null };
+    }
+    const reason = parseReason(res.body);
+    // A retired/invalid device token: 410 Unregistered or 400 BadDeviceToken —
+    // prune it rather than retry forever.
+    if (
+      res.status === 410 ||
+      reason === "Unregistered" ||
+      reason === "BadDeviceToken"
+    ) {
+      throw new PushTokenUnregisteredError(
+        `APNs token unregistered: ${reason || res.status}`,
+      );
+    }
+    throw new Error(`APNs send failed (${res.status}): ${reason || res.body}`);
+  }
+}
+
+function parseReason(body) {
+  if (!body) return null;
+  try {
+    return JSON.parse(body).reason || null;
+  } catch {
+    return null;
+  }
+}
+
+function loadPrivateKey(env, options) {
+  if (options.privateKey) return options.privateKey;
+  const inline = env.CHAINLESSCHAIN_REMOTE_SESSION_APNS_KEY_P8;
+  if (inline) return inline;
+  const filePath = env.CHAINLESSCHAIN_REMOTE_SESSION_APNS_KEY;
+  if (filePath) {
+    const fsMod = options.fs || fs;
+    try {
+      return fsMod.readFileSync(filePath, "utf8");
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+
+/**
+ * Build a bound APNs `sender` from env, or null when APNs is not configured.
+ *
+ * APNs env:
+ *   CHAINLESSCHAIN_REMOTE_SESSION_APNS_KEY       (path to .p8), or
+ *   CHAINLESSCHAIN_REMOTE_SESSION_APNS_KEY_P8    (inline .p8 PEM)
+ *   CHAINLESSCHAIN_REMOTE_SESSION_APNS_KEY_ID
+ *   CHAINLESSCHAIN_REMOTE_SESSION_APNS_TEAM_ID
+ *   CHAINLESSCHAIN_REMOTE_SESSION_APNS_TOPIC      (app bundle id)
+ *   CHAINLESSCHAIN_REMOTE_SESSION_APNS_PRODUCTION ("true" → prod host)
+ */
+export function createApnsPushSender(env = {}, options = {}) {
+  const privateKey = loadPrivateKey(env, options);
+  const keyId = options.keyId || env.CHAINLESSCHAIN_REMOTE_SESSION_APNS_KEY_ID;
+  const teamId =
+    options.teamId || env.CHAINLESSCHAIN_REMOTE_SESSION_APNS_TEAM_ID;
+  const topic = options.topic || env.CHAINLESSCHAIN_REMOTE_SESSION_APNS_TOPIC;
+  if (!privateKey || !keyId || !teamId || !topic) return null;
+  let tokenProvider;
+  try {
+    tokenProvider =
+      options.tokenProvider ||
+      new ApnsTokenProvider({ keyId, teamId, privateKey, ...options });
+  } catch {
+    return null; // Malformed credentials — stay disabled rather than crash.
+  }
+  const production =
+    options.production !== undefined
+      ? options.production
+      : String(env.CHAINLESSCHAIN_REMOTE_SESSION_APNS_PRODUCTION) === "true";
+  const sender = new ApnsPushSender({
+    tokenProvider,
+    topic,
+    production,
+    ...options,
+  });
+  return sender.handler;
+}