chainlesschain 0.162.147 → 0.162.149

package/src/harness/remote-session-push-errors.js

@@ -0,0 +1,15 @@
+// Shared error types for Remote Session vendor push senders.
+
+/**
+ * A device token the vendor reports as no longer valid (uninstalled app, token
+ * rotated). The caller should prune it so it is never retried. Raised by every
+ * provider (FCM UNREGISTERED, APNs 410/BadDeviceToken, …) so the dispatcher and
+ * ws-server pruning logic can key off a single `code`.
+ */
+export class PushTokenUnregisteredError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "PushTokenUnregisteredError";
+    this.code = "PUSH_TOKEN_UNREGISTERED";
+  }
+}

package/src/harness/remote-session-push-fcm.js

@@ -0,0 +1,238 @@
+// Remote Session vendor push — Firebase Cloud Messaging (HTTP v1) sender.
+//
+// A concrete implementation of the RemoteSessionPushDispatcher `sender`
+// contract that delivers approval wake-ups to Android devices through FCM's
+// current HTTP v1 API (the legacy server-key API is retired). Auth uses a
+// Google service account: a short-lived OAuth2 access token minted by signing a
+// JWT (RS256) with the service account private key and exchanging it at
+// oauth2.googleapis.com — no long-lived server key on disk.
+//
+// Everything is injectable (fetch, clock, signer, fs) so the whole chain is
+// unit-testable with a generated keypair and a fake transport — no real
+// credentials or network. The payload carries NO session content, only the
+// routing shape (aligns with the audit log's privacy-first stance).
+
+import { createSign } from "node:crypto";
+import fs from "node:fs";
+import { PushTokenUnregisteredError } from "./remote-session-push-errors.js";
+
+// Re-exported for existing importers; canonical definition lives in the shared
+// errors module so every provider raises the same type.
+export { PushTokenUnregisteredError };
+
+const FCM_SCOPE = "https://www.googleapis.com/auth/firebase.messaging";
+const DEFAULT_TOKEN_URI = "https://oauth2.googleapis.com/token";
+const JWT_BEARER_GRANT = "urn:ietf:params:oauth:grant-type:jwt-bearer";
+const ACCESS_TOKEN_SKEW_MS = 60_000; // refresh a minute before real expiry
+const ASSERTION_TTL_SEC = 3600;
+
+function base64url(input) {
+  return Buffer.from(input)
+    .toString("base64")
+    .replace(/\+/g, "-")
+    .replace(/\//g, "_")
+    .replace(/=+$/, "");
+}
+
+async function safeText(res) {
+  try {
+    return await res.text();
+  } catch {
+    return "";
+  }
+}
+
+function dropUndefined(obj) {
+  const out = {};
+  for (const [key, value] of Object.entries(obj)) {
+    if (value !== undefined) out[key] = value;
+  }
+  return out;
+}
+
+/** Mints + caches OAuth2 access tokens from a Google service account. */
+export class GoogleServiceAccountTokenProvider {
+  constructor(serviceAccount = {}, options = {}) {
+    if (!serviceAccount.client_email || !serviceAccount.private_key) {
+      throw new Error(
+        "Service account must include client_email and private_key",
+      );
+    }
+    this.clientEmail = serviceAccount.client_email;
+    this.privateKey = serviceAccount.private_key;
+    this.tokenUri = serviceAccount.token_uri || DEFAULT_TOKEN_URI;
+    this.scope = options.scope || FCM_SCOPE;
+    this.now = options.now || Date.now;
+    this.fetch = options.fetch || globalThis.fetch;
+    // RS256 = RSA PKCS#1 v1.5 over SHA-256. Injectable for tests.
+    this.sign =
+      options.sign ||
+      ((signingInput, key) =>
+        createSign("RSA-SHA256").update(signingInput).sign(key));
+    this._cached = null; // { token, expiresAt }
+  }
+
+  async getAccessToken() {
+    const now = this.now();
+    if (this._cached && this._cached.expiresAt - ACCESS_TOKEN_SKEW_MS > now) {
+      return this._cached.token;
+    }
+    const assertion = this._buildAssertion(now);
+    const body = new URLSearchParams({
+      grant_type: JWT_BEARER_GRANT,
+      assertion,
+    });
+    const res = await this.fetch(this.tokenUri, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: body.toString(),
+    });
+    if (!res.ok) {
+      throw new Error(
+        `OAuth token request failed (${res.status}): ${await safeText(res)}`,
+      );
+    }
+    const json = await res.json();
+    if (!json.access_token) {
+      throw new Error("OAuth token response missing access_token");
+    }
+    const expiresInMs = (Number(json.expires_in) || ASSERTION_TTL_SEC) * 1000;
+    this._cached = { token: json.access_token, expiresAt: now + expiresInMs };
+    return this._cached.token;
+  }
+
+  _buildAssertion(now) {
+    const iat = Math.floor(now / 1000);
+    const header = base64url(JSON.stringify({ alg: "RS256", typ: "JWT" }));
+    const payload = base64url(
+      JSON.stringify({
+        iss: this.clientEmail,
+        scope: this.scope,
+        aud: this.tokenUri,
+        iat,
+        exp: iat + ASSERTION_TTL_SEC,
+      }),
+    );
+    const signingInput = `${header}.${payload}`;
+    const signature = base64url(this.sign(signingInput, this.privateKey));
+    return `${signingInput}.${signature}`;
+  }
+}
+
+/** Sends one high-priority data+notification message via FCM HTTP v1. */
+export class FcmV1PushSender {
+  constructor(options = {}) {
+    if (!options.projectId) {
+      throw new Error("FcmV1PushSender requires projectId");
+    }
+    if (!options.tokenProvider) {
+      throw new Error("FcmV1PushSender requires a tokenProvider");
+    }
+    this.projectId = options.projectId;
+    this.tokenProvider = options.tokenProvider;
+    this.fetch = options.fetch || globalThis.fetch;
+    this.endpoint =
+      options.endpoint ||
+      `https://fcm.googleapis.com/v1/projects/${options.projectId}/messages:send`;
+  }
+
+  /** Bound function matching the dispatcher's `sender` contract. */
+  get handler() {
+    return (payload) => this.send(payload);
+  }
+
+  async send({ token, notification, sessionId, clientId } = {}) {
+    if (!token) throw new Error("FCM send requires a device token");
+    const accessToken = await this.tokenProvider.getAccessToken();
+    const message = {
+      message: dropUndefined({
+        token,
+        notification: notification
+          ? dropUndefined({
+              title: notification.title,
+              body: notification.body,
+            })
+          : undefined,
+        // Data-only fields let the app route the wake-up; no session content.
+        data: dropUndefined({
+          type: "remote-session.approval-request",
+          sessionId: sessionId != null ? String(sessionId) : undefined,
+          clientId: clientId != null ? String(clientId) : undefined,
+        }),
+        android: { priority: "high" },
+        apns: { headers: { "apns-priority": "10" } },
+      }),
+    };
+    const res = await this.fetch(this.endpoint, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify(message),
+    });
+    if (res.ok) {
+      const json = await res.json().catch(() => ({}));
+      return { id: json.name || null };
+    }
+    const text = await safeText(res);
+    // A retired/uninstalled token surfaces as HTTP 404 or an UNREGISTERED /
+    // NOT_FOUND error status — prune it rather than retry forever.
+    if (res.status === 404 || /UNREGISTERED|NOT_FOUND/i.test(text)) {
+      throw new PushTokenUnregisteredError(`FCM token unregistered: ${text}`);
+    }
+    throw new Error(`FCM send failed (${res.status}): ${text}`);
+  }
+}
+
+function loadServiceAccount(env, options) {
+  if (options.serviceAccount) return options.serviceAccount;
+  const inline = env.CHAINLESSCHAIN_REMOTE_SESSION_FCM_SERVICE_ACCOUNT_JSON;
+  if (inline) {
+    try {
+      return JSON.parse(inline);
+    } catch {
+      return null;
+    }
+  }
+  const filePath = env.CHAINLESSCHAIN_REMOTE_SESSION_FCM_SERVICE_ACCOUNT;
+  if (filePath) {
+    const fsMod = options.fs || fs;
+    try {
+      return JSON.parse(fsMod.readFileSync(filePath, "utf8"));
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+
+/**
+ * Build a bound FCM `sender` from env, or null when FCM is not configured. The
+ * provider dispatch (fcm vs apns vs …) is the caller's job — see
+ * remote-session-push-senders.js.
+ *
+ * FCM env:
+ *   CHAINLESSCHAIN_REMOTE_SESSION_FCM_SERVICE_ACCOUNT      (path to JSON), or
+ *   CHAINLESSCHAIN_REMOTE_SESSION_FCM_SERVICE_ACCOUNT_JSON (inline JSON)
+ *   CHAINLESSCHAIN_REMOTE_SESSION_FCM_PROJECT_ID     (optional; else service
+ *                                                     account project_id)
+ */
+export function createFcmPushSender(env = {}, options = {}) {
+  const serviceAccount = loadServiceAccount(env, options);
+  if (!serviceAccount) return null;
+  const projectId =
+    env.CHAINLESSCHAIN_REMOTE_SESSION_FCM_PROJECT_ID ||
+    serviceAccount.project_id;
+  if (!projectId) return null;
+  let tokenProvider;
+  try {
+    tokenProvider =
+      options.tokenProvider ||
+      new GoogleServiceAccountTokenProvider(serviceAccount, options);
+  } catch {
+    return null; // Malformed service account — stay disabled rather than crash.
+  }
+  const sender = new FcmV1PushSender({ projectId, tokenProvider, ...options });
+  return sender.handler;
+}

package/src/harness/remote-session-push-huawei.js

@@ -0,0 +1,174 @@
+// Remote Session vendor push — Huawei (HMS Push Kit) sender.
+//
+// A concrete implementation of the RemoteSessionPushDispatcher `sender` contract
+// for Huawei/HarmonyOS devices via HMS Push Kit. Auth is OAuth2 client
+// credentials (app id + secret) exchanged for a short-lived access token —
+// simpler than FCM's signed JWT — then a Bearer POST to messages:send. Plain
+// HTTPS with an injectable `fetch` (default global), fully unit-testable with a
+// fake transport. The payload carries only routing ids (no session content).
+
+import { PushTokenUnregisteredError } from "./remote-session-push-errors.js";
+
+const DEFAULT_TOKEN_URI =
+  "https://oauth-login.cloud.huawei.com/oauth2/v3/token";
+const DEFAULT_PUSH_HOST = "https://push-api.cloud.huawei.com";
+const ACCESS_TOKEN_SKEW_MS = 60_000;
+// HMS success + invalid-token result codes (single-token send).
+const CODE_SUCCESS = "80000000";
+const CODE_ALL_TOKENS_INVALID = "80300007";
+const CODE_SOME_TOKENS_INVALID = "80100000";
+const INVALID_TOKEN_RE = /invalid.*token|token.*invalid|unregist/i;
+
+async function safeText(res) {
+  try {
+    return await res.text();
+  } catch {
+    return "";
+  }
+}
+
+function dropUndefined(obj) {
+  const out = {};
+  for (const [key, value] of Object.entries(obj)) {
+    if (value !== undefined) out[key] = value;
+  }
+  return out;
+}
+
+/** Mints + caches an OAuth2 access token from HMS client credentials. */
+export class HuaweiTokenProvider {
+  constructor(options = {}) {
+    if (!options.appId)
+      throw new Error("HuaweiTokenProvider requires an appId");
+    if (!options.appSecret) {
+      throw new Error("HuaweiTokenProvider requires an appSecret");
+    }
+    this.appId = options.appId;
+    this.appSecret = options.appSecret;
+    this.tokenUri = options.tokenUri || DEFAULT_TOKEN_URI;
+    this.now = options.now || Date.now;
+    this.fetch = options.fetch || globalThis.fetch;
+    this._cached = null; // { token, expiresAt }
+  }
+
+  async getAccessToken() {
+    const now = this.now();
+    if (this._cached && this._cached.expiresAt - ACCESS_TOKEN_SKEW_MS > now) {
+      return this._cached.token;
+    }
+    const body = new URLSearchParams({
+      grant_type: "client_credentials",
+      client_id: this.appId,
+      client_secret: this.appSecret,
+    });
+    const res = await this.fetch(this.tokenUri, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: body.toString(),
+    });
+    if (!res.ok) {
+      throw new Error(
+        `Huawei OAuth failed (${res.status}): ${await safeText(res)}`,
+      );
+    }
+    const json = await res.json();
+    if (!json.access_token) {
+      throw new Error("Huawei OAuth response missing access_token");
+    }
+    const ttl = (Number(json.expires_in) || 3600) * 1000;
+    this._cached = { token: json.access_token, expiresAt: now + ttl };
+    return this._cached.token;
+  }
+}
+
+/** Sends one notification to an HMS device token. */
+export class HuaweiPushSender {
+  constructor(options = {}) {
+    if (!options.appId) throw new Error("HuaweiPushSender requires an appId");
+    if (!options.tokenProvider) {
+      throw new Error("HuaweiPushSender requires a tokenProvider");
+    }
+    this.appId = options.appId;
+    this.tokenProvider = options.tokenProvider;
+    this.fetch = options.fetch || globalThis.fetch;
+    this.endpoint =
+      options.endpoint ||
+      `${options.host || DEFAULT_PUSH_HOST}/v1/${options.appId}/messages:send`;
+  }
+
+  /** Bound function matching the dispatcher's `sender` contract. */
+  get handler() {
+    return (payload) => this.send(payload);
+  }
+
+  async send({ token, notification, sessionId, clientId } = {}) {
+    if (!token) throw new Error("Huawei send requires a device token");
+    const accessToken = await this.tokenProvider.getAccessToken();
+    const data = { type: "remote-session.approval-request" };
+    if (sessionId != null) data.sessionId = String(sessionId);
+    if (clientId != null) data.clientId = String(clientId);
+    const message = {
+      message: dropUndefined({
+        notification: notification
+          ? dropUndefined({
+              title: notification.title,
+              body: notification.body,
+            })
+          : undefined,
+        android: { urgency: "HIGH" },
+        data: JSON.stringify(data), // routing ids only, no session content
+        token: [token],
+      }),
+    };
+    const res = await this.fetch(this.endpoint, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify(message),
+    });
+    const json = await res.json().catch(() => ({}));
+    if (res.ok && json.code === CODE_SUCCESS) {
+      return { id: json.requestId || null };
+    }
+    const code = json.code || `HTTP ${res.status}`;
+    const msg = json.msg || "";
+    // A single-token send that reports invalid/all-invalid tokens means this
+    // token is dead — prune it rather than retry.
+    if (
+      code === CODE_ALL_TOKENS_INVALID ||
+      code === CODE_SOME_TOKENS_INVALID ||
+      INVALID_TOKEN_RE.test(String(msg))
+    ) {
+      throw new PushTokenUnregisteredError(
+        `Huawei token invalid (${code}): ${msg}`.trim(),
+      );
+    }
+    throw new Error(`Huawei push failed (${code}): ${msg}`.trim());
+  }
+}
+
+/**
+ * Build a bound Huawei `sender` from env, or null when unconfigured.
+ *
+ * Huawei env:
+ *   CHAINLESSCHAIN_REMOTE_SESSION_HUAWEI_APP_ID
+ *   CHAINLESSCHAIN_REMOTE_SESSION_HUAWEI_APP_SECRET
+ */
+export function createHuaweiPushSender(env = {}, options = {}) {
+  const appId =
+    options.appId || env.CHAINLESSCHAIN_REMOTE_SESSION_HUAWEI_APP_ID;
+  const appSecret =
+    options.appSecret || env.CHAINLESSCHAIN_REMOTE_SESSION_HUAWEI_APP_SECRET;
+  if (!appId || !appSecret) return null;
+  let tokenProvider;
+  try {
+    tokenProvider =
+      options.tokenProvider ||
+      new HuaweiTokenProvider({ appId, appSecret, ...options });
+  } catch {
+    return null; // Malformed credentials — stay disabled rather than crash.
+  }
+  return new HuaweiPushSender({ appId, tokenProvider, ...options }).handler;
+}

package/src/harness/remote-session-push-oppo.js

@@ -0,0 +1,171 @@
+// Remote Session vendor push — OPPO (HeyTap / ColorOS push) sender.
+//
+// A concrete implementation of the RemoteSessionPushDispatcher `sender` contract
+// for OPPO/OnePlus/realme devices via the OPPO Push (HeyTap) server API. Auth is
+// a two-step handshake: sign = SHA256(app_key + timestamp + master_secret) is
+// exchanged for a short-lived `auth_token` (valid ~24h), then a form POST to the
+// unicast endpoint carries that token. Plain HTTPS with an injectable `fetch`
+// (default global), fully unit-testable with a fake transport. The payload
+// carries only routing ids (no session content).
+
+import { createHash } from "node:crypto";
+import { PushTokenUnregisteredError } from "./remote-session-push-errors.js";
+
+const DEFAULT_HOST = "https://api.push.oppomobile.com";
+const AUTH_PATH = "/server/v1/auth";
+const SEND_PATH = "/server/v1/message/notification/unicast";
+// OPPO auth_token is valid for 24h; refresh a few minutes early.
+const AUTH_TOKEN_TTL_MS = 24 * 60 * 60 * 1000;
+const AUTH_TOKEN_SKEW_MS = 5 * 60_000;
+const CODE_SUCCESS = 0;
+// OPPO has no single canonical "unregistered" code for a stale registration id;
+// match the message text it returns alongside the failing code.
+const INVALID_TOKEN_RE =
+  /invalid.*registration|registration.*invalid|invalid.*token|token.*invalid|unregist|not ?exist|无效|不存在/i;
+
+async function safeText(res) {
+  try {
+    return await res.text();
+  } catch {
+    return "";
+  }
+}
+
+function sha256Hex(input) {
+  return createHash("sha256").update(input, "utf8").digest("hex");
+}
+
+/** Mints + caches an OPPO auth_token from app key + master secret. */
+export class OppoAuthProvider {
+  constructor(options = {}) {
+    if (!options.appKey) throw new Error("OppoAuthProvider requires an appKey");
+    if (!options.masterSecret) {
+      throw new Error("OppoAuthProvider requires a masterSecret");
+    }
+    this.appKey = options.appKey;
+    this.masterSecret = options.masterSecret;
+    this.host = options.host || DEFAULT_HOST;
+    this.now = options.now || Date.now;
+    this.fetch = options.fetch || globalThis.fetch;
+    this._cached = null; // { token, expiresAt }
+  }
+
+  async getAuthToken() {
+    const now = this.now();
+    if (this._cached && this._cached.expiresAt - AUTH_TOKEN_SKEW_MS > now) {
+      return this._cached.token;
+    }
+    const timestamp = String(now);
+    const sign = sha256Hex(`${this.appKey}${timestamp}${this.masterSecret}`);
+    const body = new URLSearchParams({
+      app_key: this.appKey,
+      sign,
+      timestamp,
+    });
+    const res = await this.fetch(`${this.host}${AUTH_PATH}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: body.toString(),
+    });
+    if (!res.ok) {
+      throw new Error(
+        `OPPO auth failed (${res.status}): ${await safeText(res)}`,
+      );
+    }
+    const json = await res.json();
+    const token = json?.data?.auth_token;
+    if (Number(json.code) !== CODE_SUCCESS || !token) {
+      throw new Error(
+        `OPPO auth response missing auth_token: ${json.message || json.code}`,
+      );
+    }
+    this._cached = { token, expiresAt: now + AUTH_TOKEN_TTL_MS };
+    return token;
+  }
+}
+
+/** Sends one notification to an OPPO registration id. */
+export class OppoPushSender {
+  constructor(options = {}) {
+    if (!options.authProvider) {
+      throw new Error("OppoPushSender requires an authProvider");
+    }
+    this.authProvider = options.authProvider;
+    this.host = options.host || DEFAULT_HOST;
+    this.fetch = options.fetch || globalThis.fetch;
+  }
+
+  /** Bound function matching the dispatcher's `sender` contract. */
+  get handler() {
+    return (payload) => this.send(payload);
+  }
+
+  async send({ token, notification, sessionId, clientId } = {}) {
+    if (!token) throw new Error("OPPO send requires a registration id");
+    const authToken = await this.authProvider.getAuthToken();
+    // Routing ids only — no session content.
+    const data = { type: "remote-session.approval-request" };
+    if (sessionId != null) data.sessionId = String(sessionId);
+    if (clientId != null) data.clientId = String(clientId);
+    const message = {
+      target_type: 2, // 2 = single registration_id
+      target_value: token,
+      notification: {
+        title: notification?.title || "Approval requested",
+        content: notification?.body || "A coding session needs your approval",
+        click_action_type: 0, // open the app
+        action_parameters: JSON.stringify(data),
+      },
+    };
+    const body = new URLSearchParams({
+      auth_token: authToken,
+      message: JSON.stringify(message),
+    });
+    const res = await this.fetch(`${this.host}${SEND_PATH}`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        auth_token: authToken,
+      },
+      body: body.toString(),
+    });
+    const json = await res.json().catch(() => ({}));
+    if (res.ok && Number(json.code) === CODE_SUCCESS) {
+      return { id: json.data?.messageId || null };
+    }
+    const reason = json.message || `HTTP ${res.status}`;
+    if (INVALID_TOKEN_RE.test(String(reason))) {
+      throw new PushTokenUnregisteredError(
+        `OPPO registration id invalid: ${reason}`,
+      );
+    }
+    throw new Error(`OPPO push failed (${json.code ?? res.status}): ${reason}`);
+  }
+}
+
+/**
+ * Build a bound OPPO `sender` from env, or null when unconfigured.
+ *
+ * OPPO env:
+ *   CHAINLESSCHAIN_REMOTE_SESSION_OPPO_APP_KEY
+ *   CHAINLESSCHAIN_REMOTE_SESSION_OPPO_MASTER_SECRET
+ *   CHAINLESSCHAIN_REMOTE_SESSION_OPPO_HOST  (optional; override the API host)
+ */
+export function createOppoPushSender(env = {}, options = {}) {
+  const appKey =
+    options.appKey || env.CHAINLESSCHAIN_REMOTE_SESSION_OPPO_APP_KEY;
+  const masterSecret =
+    options.masterSecret ||
+    env.CHAINLESSCHAIN_REMOTE_SESSION_OPPO_MASTER_SECRET;
+  if (!appKey || !masterSecret) return null;
+  const host = options.host || env.CHAINLESSCHAIN_REMOTE_SESSION_OPPO_HOST;
+  let authProvider;
+  try {
+    authProvider =
+      options.authProvider ||
+      new OppoAuthProvider({ appKey, masterSecret, host, ...options });
+  } catch {
+    return null; // Malformed credentials — stay disabled rather than crash.
+  }
+  return new OppoPushSender({ authProvider, host, ...options }).handler;
+}

package/src/harness/remote-session-push-senders.js

@@ -0,0 +1,42 @@
+// Remote Session vendor push — provider dispatch.
+//
+// Picks a concrete `sender` implementation by CHAINLESSCHAIN_REMOTE_SESSION_
+// PUSH_PROVIDER (default "fcm"). Each provider factory returns a bound sender
+// or null when unconfigured; unknown/unimplemented providers yield null so the
+// dispatcher stays a no-op. Adding a provider (HMS / Xiaomi / …) is one import
+// + one case here.
+
+import { createFcmPushSender } from "./remote-session-push-fcm.js";
+import { createApnsPushSender } from "./remote-session-push-apns.js";
+import { createWebPushSender } from "./remote-session-push-web.js";
+import { createXiaomiPushSender } from "./remote-session-push-xiaomi.js";
+import { createHuaweiPushSender } from "./remote-session-push-huawei.js";
+import { createOppoPushSender } from "./remote-session-push-oppo.js";
+import { createVivoPushSender } from "./remote-session-push-vivo.js";
+
+export function createRemoteSessionPushSender(env = {}, options = {}) {
+  const provider = (
+    env.CHAINLESSCHAIN_REMOTE_SESSION_PUSH_PROVIDER || "fcm"
+  ).toLowerCase();
+  switch (provider) {
+    case "fcm":
+      return createFcmPushSender(env, options);
+    case "apns":
+      return createApnsPushSender(env, options);
+    case "web":
+      return createWebPushSender(env, options);
+    case "xiaomi":
+    case "mi":
+      return createXiaomiPushSender(env, options);
+    case "huawei":
+    case "hms":
+      return createHuaweiPushSender(env, options);
+    case "oppo":
+    case "heytap":
+      return createOppoPushSender(env, options);
+    case "vivo":
+      return createVivoPushSender(env, options);
+    default:
+      return null;
+  }
+}