okengine 0.2.6 → 0.3.2

package/src/docker/types.ts

@@ -37,7 +37,7 @@ export interface ServiceSpec {
   readonly port: number;
   /** Host port published in compose (dev defaults). */
   readonly hostPort: number;
-  /** Credential placeholders (values live in `.env.stack`, not YAML). */
+  /** Credential placeholders (values live in `.env.docker`, not YAML). */
   readonly credentials: ServiceCredentials;
 }
 
@@ -50,13 +50,22 @@ export interface ComposeHealthcheck {
   readonly start_period?: string;
 }
 
+/** Extra published host↔container port pair from a recipe. */
+export interface RecipeExtraPort {
+  readonly host: number;
+  readonly container: number;
+}
+
 /** Image-specific compose fragment from {@link ImageRecipe.apply}. */
 export interface RecipeApplyResult {
   readonly environment?: Readonly<Record<string, string>>;
   readonly command?: string | readonly string[];
+  readonly entrypoint?: string | readonly string[];
   readonly healthcheck?: ComposeHealthcheck;
   readonly volumes?: readonly string[];
   readonly user?: string;
+  /** Additional published ports (e.g. Mailpit UI, RustFS console). */
+  readonly extraPorts?: readonly RecipeExtraPort[];
 }
 
 /**
@@ -102,12 +111,13 @@ export interface DeriveOptions {
   readonly prod?: boolean;
   /**
    * Include the `app` service in `compose.yml` (default true).
-   * `oke dev --stack` sets false — host Bun runs the app; Docker is infra only.
+   * `oke dev --docker` sets false — host Bun runs the app; Docker is infra only.
    */
   readonly includeApp?: boolean;
   /**
    * Compose artefact directory relative to the project root (default `docker`).
-   * Controls generated `env_file` / `build.context` paths (e.g. `../.env.stack`).
+   * Controls generated `env_file` / `build.context` paths (`.env.docker` lives
+   * beside compose under this directory).
    * Pass `"."` for legacy root-level layout.
    */
   readonly composeDir?: string;
@@ -119,6 +129,8 @@ export interface DeriveOptions {
   readonly host?: string;
   /** Extra image recipes (plugins). */
   readonly recipes?: readonly ImageRecipe[];
+  /** Preserved optional controls from an existing `.env.docker`. */
+  readonly controls?: Readonly<Record<string, string>>;
   /**
    * Local stack instance id (6-hex). When set, host ports are offset so two
    * `oke dev -s` projects do not share one Postgres on `:5432`.
@@ -144,7 +156,7 @@ export interface DeriveResult {
   /** Generated files (Dockerfile + compose layers). */
   readonly files: readonly GeneratedFile[];
   /**
-   * Stack env contents for `.env.stack` — written by `oke dev --stack`,
+   * Stack env contents for `.env.docker` — written by `oke dev --docker`,
    * never embedded in YAML.
    */
   readonly stackEnv: Readonly<Record<string, string>>;

package/src/docs-origin.ts

@@ -1,12 +1,12 @@
 /**
  * Canonical public docs origin for error links, README, and the site.
  *
- * Flip this one constant when the custom domain is attached:
- * `https://oke.omqkhafi.dev`
+ * Keep in lockstep with `packages/create-oke/src/docs-origin.ts` and
+ * `site/app/layout.tsx` (`metadataBase`).
  */
 
-/** Live docs site (Vercel). Planned cutover: `https://oke.omqkhafi.dev`. */
-export const DOCS_ORIGIN = "https://okengine.vercel.app" as const;
+/** Live docs site. */
+export const DOCS_ORIGIN = "https://oke.omqkhafi.dev" as const;
 
 /**
  * Absolute docs URL for a path under the handbook / site.

package/src/drivers/ai-anthropic.ts

@@ -21,9 +21,7 @@ const ANTHROPIC_VERSION = "2023-06-01";
  *
  * @param options - API key / model / base URL / injectable fetch
  */
-export async function openAnthropic(
-  options: AiOpenOptions = {},
-): Promise<AiModelClient> {
+export async function openAnthropic(options: AiOpenOptions = {}): Promise<AiModelClient> {
   const apiKey = options.apiKey ?? process.env.ANTHROPIC_API_KEY;
   if (!apiKey) {
     throw new Error("anthropic: apiKey is required (or ANTHROPIC_API_KEY)");
@@ -48,17 +46,14 @@ export async function openAnthropic(
         body: JSON.stringify({
           model: resolvedModel,
           max_tokens: opts.maxTokens ?? 1024,
-          ...(opts.temperature !== undefined
-            ? { temperature: opts.temperature }
-            : {}),
+          ...(opts.temperature !== undefined ? { temperature: opts.temperature } : {}),
           ...(system !== undefined ? { system } : {}),
           messages,
         }),
       });
       const raw = (await res.json().catch(() => ({}))) as AnthropicMessagesResponse;
       if (!res.ok) {
-        const msg =
-          raw.error?.message ?? `anthropic HTTP ${res.status}`;
+        const msg = raw.error?.message ?? `anthropic HTTP ${res.status}`;
         throw new Error(`anthropic: ${msg}`);
       }
       const text = textFromContent(raw.content);
@@ -92,9 +87,7 @@ interface AnthropicMessagesResponse {
   readonly error?: { readonly message?: string };
 }
 
-function splitSystem(
-  messages: AiCompleteOptions["messages"],
-): {
+function splitSystem(messages: AiCompleteOptions["messages"]): {
   system?: string;
   messages: Array<{ role: "user" | "assistant"; content: string }>;
 } {
@@ -117,9 +110,7 @@ function splitSystem(
   };
 }
 
-function textFromContent(
-  content: AnthropicMessagesResponse["content"],
-): string {
+function textFromContent(content: AnthropicMessagesResponse["content"]): string {
   if (!content?.length) return "";
   return content
     .filter((b) => b.type === "text" && typeof b.text === "string")

package/src/drivers/ai-mock.ts

@@ -39,8 +39,7 @@ export const mockAiDriver: AiDriver = {
         if (payload === undefined) {
           payload = canned["*"] ?? { ok: true, echo: last };
         }
-        const text =
-          typeof payload === "string" ? payload : JSON.stringify(payload);
+        const text = typeof payload === "string" ? payload : JSON.stringify(payload);
         return {
           text,
           raw: payload,
@@ -70,9 +69,7 @@ export const mockAiDriver: AiDriver = {
  *
  * @param responses - Key → JSON payload
  */
-export function createMockAiDriver(
-  responses: Readonly<Record<string, unknown>>,
-): AiDriver {
+export function createMockAiDriver(responses: Readonly<Record<string, unknown>>): AiDriver {
   return {
     id: "mock",
     open(options = {}) {

package/src/drivers/ai-openai-compatible.ts

@@ -23,14 +23,10 @@ const DEFAULT_BASE = "https://api.openai.com/v1";
  *
  * @param options - API key / model / base URL / injectable fetch
  */
-export async function openOpenaiCompatible(
-  options: AiOpenOptions = {},
-): Promise<AiModelClient> {
+export async function openOpenaiCompatible(options: AiOpenOptions = {}): Promise<AiModelClient> {
   const apiKey = options.apiKey ?? process.env.OPENAI_API_KEY;
   if (!apiKey) {
-    throw new Error(
-      "openai-compatible: apiKey is required (or OPENAI_API_KEY)",
-    );
+    throw new Error("openai-compatible: apiKey is required (or OPENAI_API_KEY)");
   }
   const model = options.model ?? "gpt-4o-mini";
   const baseUrl = (options.baseUrl ?? DEFAULT_BASE).replace(/\/$/, "");
@@ -65,8 +61,7 @@ export async function openOpenaiCompatible(
       });
       const raw = (await res.json().catch(() => ({}))) as OpenAiChatResponse;
       if (!res.ok) {
-        const msg =
-          raw.error?.message ?? `openai-compatible HTTP ${res.status}`;
+        const msg = raw.error?.message ?? `openai-compatible HTTP ${res.status}`;
         throw new Error(`openai-compatible: ${msg}`);
       }
       const text = raw.choices?.[0]?.message?.content ?? "";
@@ -94,8 +89,7 @@ export async function openOpenaiCompatible(
       });
       const raw = (await res.json().catch(() => ({}))) as OpenAiEmbedResponse;
       if (!res.ok) {
-        const msg =
-          raw.error?.message ?? `openai-compatible embed HTTP ${res.status}`;
+        const msg = raw.error?.message ?? `openai-compatible embed HTTP ${res.status}`;
         throw new Error(`openai-compatible: ${msg}`);
       }
       const vectors = (raw.data ?? [])

package/src/drivers/ai-providers.test.ts

@@ -4,10 +4,7 @@
 
 import { describe, expect, test } from "bun:test";
 import { anthropicAiDriver, openAnthropic } from "./ai-anthropic.ts";
-import {
-  openaiCompatibleAiDriver,
-  openOpenaiCompatible,
-} from "./ai-openai-compatible.ts";
+import { openaiCompatibleAiDriver, openOpenaiCompatible } from "./ai-openai-compatible.ts";
 import { mockAiDriver } from "./ai-mock.ts";
 
 describe("anthropic driver", () => {
@@ -56,9 +53,7 @@ describe("anthropic driver", () => {
       messages: Array<{ role: string }>;
     };
     expect(body.system).toBe("be brief");
-    expect(body.messages).toEqual([
-      { role: "user", content: "hi" } as { role: string },
-    ]);
+    expect(body.messages).toEqual([{ role: "user", content: "hi" } as { role: string }]);
   });
 
   test("HTTP error surfaces provider message", async () => {
@@ -73,18 +68,16 @@ describe("anthropic driver", () => {
       apiKey: "sk-test",
       fetch: fetchFn,
     });
-    await expect(
-      client.complete({ messages: [{ role: "user", content: "x" }] }),
-    ).rejects.toThrow("rate limited");
+    await expect(client.complete({ messages: [{ role: "user", content: "x" }] })).rejects.toThrow(
+      "rate limited",
+    );
   });
 
   test("live Anthropic ask when ANTHROPIC_API_KEY is set", async () => {
     const key = process.env.ANTHROPIC_API_KEY;
     if (!key) {
       // Clearly-marked skip — never fail CI for lack of credentials.
-      console.log(
-        "skip: live anthropic ask (ANTHROPIC_API_KEY not set)",
-      );
+      console.log("skip: live anthropic ask (ANTHROPIC_API_KEY not set)");
       return;
     }
     const client = await anthropicAiDriver.open({

package/src/drivers/bun-native-completeness.test.ts

@@ -7,10 +7,7 @@
 
 import { describe, expect, test } from "bun:test";
 import { createBunRedisClient } from "./redis.ts";
-import {
-  createBunSignalRedisClient,
-  parseXreadgroupReply,
-} from "./signal-redis.ts";
+import { createBunSignalRedisClient, parseXreadgroupReply } from "./signal-redis.ts";
 
 /** One row in the completeness report. */
 export interface BunNativeGapRow {
@@ -26,10 +23,7 @@ export interface BunNativeGapRow {
  * Kept as a pure function so the gate test and human report share one source.
  */
 export function bunNativeCompletenessReport(): readonly BunNativeGapRow[] {
-  const redisProto = Bun.RedisClient.prototype as unknown as Record<
-    string,
-    unknown
-  >;
+  const redisProto = Bun.RedisClient.prototype as unknown as Record<string, unknown>;
   const hasTypedScan = typeof redisProto.scan === "function";
   const hasTypedPublish = typeof redisProto.publish === "function";
   const hasTypedSubscribe = typeof redisProto.subscribe === "function";
@@ -57,8 +51,7 @@ export function bunNativeCompletenessReport(): readonly BunNativeGapRow[] {
     {
       surface: "redis signal",
       capability: "native Bun bind (publish/subscribe)",
-      status:
-        hasTypedPublish && hasTypedSubscribe ? "closed" : "bun_limitation",
+      status: hasTypedPublish && hasTypedSubscribe ? "closed" : "bun_limitation",
       note:
         hasTypedPublish && hasTypedSubscribe
           ? "createBunSignalRedisClient uses typed publish/subscribe"
@@ -107,9 +100,7 @@ describe("Bun native client completeness", () => {
     expect(rows.length).toBe(8);
 
     const closed = rows.filter((r) => r.status === "closed").map((r) => r.capability);
-    const limited = rows
-      .filter((r) => r.status === "bun_limitation")
-      .map((r) => r.capability);
+    const limited = rows.filter((r) => r.status === "bun_limitation").map((r) => r.capability);
 
     // Closed on Bun 1.3.14
     expect(closed).toContain("SCAN (typed)");
@@ -141,13 +132,13 @@ describe("Bun native client completeness", () => {
       [
         "oke:signal:order",
         [
-          ["1-0", ["payload", "{\"a\":1}", "signal", "order"]],
+          ["1-0", ["payload", '{"a":1}', "signal", "order"]],
           ["1-1", ["payload", "{}", "signal", "order"]],
         ],
       ],
     ]);
     expect(parsed).toEqual([
-      { id: "1-0", fields: { payload: "{\"a\":1}", signal: "order" } },
+      { id: "1-0", fields: { payload: '{"a":1}', signal: "order" } },
       { id: "1-1", fields: { payload: "{}", signal: "order" } },
     ]);
     expect(parseXreadgroupReply(null)).toEqual([]);

package/src/drivers/channel-console.ts

@@ -21,9 +21,7 @@ import { createChannelInbox } from "./channel-types.ts";
 function formatAddressInput(input: AddressInput): string {
   if (typeof input === "string") return input;
   if (Array.isArray(input)) {
-    return input
-      .map((t) => (typeof t === "string" ? t : t.address))
-      .join(",");
+    return input.map((t) => (typeof t === "string" ? t : t.address)).join(",");
   }
   return input.address;
 }
@@ -33,9 +31,7 @@ function formatAddressInput(input: AddressInput): string {
  *
  * @param options - Optional shared inbox
  */
-export function openConsoleChannel(
-  options: ChannelOpenOptions = {},
-): ChannelDriver {
+export function openConsoleChannel(options: ChannelOpenOptions = {}): ChannelDriver {
   const inbox = options.inbox ?? createChannelInbox();
 
   const channel: ChannelTransport = {
@@ -88,7 +84,10 @@ export function openConsoleChannel(
         template: mail.template,
         at: Date.now(),
       });
-      const recipients = to.split(",").map((s) => s.trim()).filter(Boolean);
+      const recipients = to
+        .split(",")
+        .map((s) => s.trim())
+        .filter(Boolean);
       return {
         messageId: id,
         accepted: recipients,

package/src/drivers/channel-fcm.ts

@@ -15,9 +15,7 @@ import type {
  *
  * @param options - `token` (OAuth access token) + `from` (project id)
  */
-export function openFcmChannel(
-  options: ChannelOpenOptions = {},
-): ChannelDriver {
+export function openFcmChannel(options: ChannelOpenOptions = {}): ChannelDriver {
   const accessToken = options.token ?? options.apiKey;
   const projectId = options.from;
   const fetchFn = options.fetch ?? globalThis.fetch;
@@ -30,31 +28,25 @@ export function openFcmChannel(
       if (!accessToken || !projectId) {
         throw new Error("fcm: token and from (project id) are required");
       }
-      const res = await fetchFn(
-        `${base}/v1/projects/${projectId}/messages:send`,
-        {
-          method: "POST",
-          headers: {
-            Authorization: `Bearer ${accessToken}`,
-            "Content-Type": "application/json",
-          },
-          body: JSON.stringify({
-            message: {
-              token: message.to,
-              notification: {
-                title: message.subject ?? message.template ?? "notification",
-                body: message.text ?? "",
-              },
-              data: Object.fromEntries(
-                Object.entries(message.data ?? {}).map(([k, v]) => [
-                  k,
-                  String(v),
-                ]),
-              ),
-            },
-          }),
+      const res = await fetchFn(`${base}/v1/projects/${projectId}/messages:send`, {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${accessToken}`,
+          "Content-Type": "application/json",
         },
-      );
+        body: JSON.stringify({
+          message: {
+            token: message.to,
+            notification: {
+              title: message.subject ?? message.template ?? "notification",
+              body: message.text ?? "",
+            },
+            data: Object.fromEntries(
+              Object.entries(message.data ?? {}).map(([k, v]) => [k, String(v)]),
+            ),
+          },
+        }),
+      });
       const body = (await res.json().catch(() => ({}))) as {
         name?: string;
         error?: { message?: string };
@@ -79,9 +71,7 @@ export function openFcmChannel(
         ok: true,
         messageId: id,
         driverId: "fcm",
-        attempts: [
-          { driverId: "fcm", ok: true, at: Date.now(), messageId: id },
-        ],
+        attempts: [{ driverId: "fcm", ok: true, at: Date.now(), messageId: id }],
       };
     },
   };

package/src/drivers/channel-resend.ts

@@ -10,9 +10,7 @@ import type { ChannelDriver, ChannelOpenOptions } from "./channel-types.ts";
  *
  * @param options - API key
  */
-export function openResendChannel(
-  options: ChannelOpenOptions = {},
-): ChannelDriver {
+export function openResendChannel(options: ChannelOpenOptions = {}): ChannelDriver {
   if (!options.apiKey) {
     throw new Error("resend channel: apiKey is required");
   }

package/src/drivers/channel-smtp.ts

@@ -10,18 +10,14 @@ import type { ChannelDriver, ChannelOpenOptions } from "./channel-types.ts";
  *
  * @param options - Host / port / auth
  */
-export function openSmtpChannel(
-  options: ChannelOpenOptions = {},
-): ChannelDriver {
+export function openSmtpChannel(options: ChannelOpenOptions = {}): ChannelDriver {
   if (!options.host) {
     throw new Error("smtp channel: host is required");
   }
   const transport = new SMTPTransport({
     host: options.host,
     port: options.port ?? 587,
-    ...(options.user && options.pass
-      ? { auth: { user: options.user, pass: options.pass } }
-      : {}),
+    ...(options.user && options.pass ? { auth: { user: options.user, pass: options.pass } } : {}),
   });
   return { id: "smtp", transport };
 }

package/src/drivers/channel-types.ts

@@ -5,12 +5,7 @@
  * run unchanged. Non-email media (sms / whatsapp / push) use {@link ChannelTransport}.
  */
 
-import type {
-  MailOptions,
-  SendResult,
-  Transport,
-  VerifyResult,
-} from "sently";
+import type { MailOptions, SendResult, Transport, VerifyResult } from "sently";
 
 export type {
   Address,
@@ -35,12 +30,7 @@ export type ChannelDriverId =
   | "webpush";
 
 /** Channel medium. */
-export type ChannelMediumId =
-  | "email"
-  | "sms"
-  | "whatsapp"
-  | "push"
-  | "any";
+export type ChannelMediumId = "email" | "sms" | "whatsapp" | "push" | "any";
 
 /** Unified outbound message (medium-agnostic). */
 export interface ChannelMessage {

package/src/drivers/channel-unifonic.ts

@@ -15,9 +15,7 @@ import type {
  *
  * @param options - `apiKey` + optional `from` (sender id)
  */
-export function openUnifonicChannel(
-  options: ChannelOpenOptions = {},
-): ChannelDriver {
+export function openUnifonicChannel(options: ChannelOpenOptions = {}): ChannelDriver {
   const apiKey = options.apiKey;
   const from = options.from ?? "OKE";
   const fetchFn = options.fetch ?? globalThis.fetch;
@@ -62,9 +60,7 @@ export function openUnifonicChannel(
         ok: true,
         messageId: id,
         driverId: "unifonic",
-        attempts: [
-          { driverId: "unifonic", ok: true, at: Date.now(), messageId: id },
-        ],
+        attempts: [{ driverId: "unifonic", ok: true, at: Date.now(), messageId: id }],
       };
     },
   };

package/src/drivers/channel-wa-cloud.ts

@@ -15,9 +15,7 @@ import type {
  *
  * @param options - `token` (access token) + `from` (phone number id)
  */
-export function openWaCloudChannel(
-  options: ChannelOpenOptions = {},
-): ChannelDriver {
+export function openWaCloudChannel(options: ChannelOpenOptions = {}): ChannelDriver {
   const token = options.token ?? options.apiKey;
   const phoneNumberId = options.from;
   const fetchFn = options.fetch ?? globalThis.fetch;
@@ -67,9 +65,7 @@ export function openWaCloudChannel(
         ok: true,
         messageId: id,
         driverId: "wa-cloud",
-        attempts: [
-          { driverId: "wa-cloud", ok: true, at: Date.now(), messageId: id },
-        ],
+        attempts: [{ driverId: "wa-cloud", ok: true, at: Date.now(), messageId: id }],
       };
     },
   };

package/src/drivers/channel-webpush.ts

@@ -47,9 +47,7 @@ function b64urlEncode(bytes: Uint8Array): string {
  *
  * @param privateKeyB64 - Base64url private key
  */
-async function importVapidPrivateKey(
-  privateKeyB64: string,
-): Promise<CryptoKey> {
+async function importVapidPrivateKey(privateKeyB64: string): Promise<CryptoKey> {
   const raw = b64urlDecode(privateKeyB64);
   // Prefer PKCS8; fall back to raw JWK construction for 32-byte seeds.
   if (raw.length > 32) {
@@ -64,11 +62,10 @@ async function importVapidPrivateKey(
   // Build a minimal JWK from d (and a synthetic public x/y via derive is hard);
   // tests inject fetch and only need Authorization header shape — use ECDSA
   // with a generated key when raw seed is provided without full PKCS8.
-  const pair = await crypto.subtle.generateKey(
-    { name: "ECDSA", namedCurve: "P-256" },
-    true,
-    ["sign", "verify"],
-  );
+  const pair = await crypto.subtle.generateKey({ name: "ECDSA", namedCurve: "P-256" }, true, [
+    "sign",
+    "verify",
+  ]);
   return pair.privateKey;
 }
 
@@ -89,17 +86,11 @@ async function buildVapidJwt(
   );
   const exp = Math.floor(Date.now() / 1000) + 12 * 60 * 60;
   const payload = b64urlEncode(
-    new TextEncoder().encode(
-      JSON.stringify({ aud: audience, exp, sub: subject }),
-    ),
+    new TextEncoder().encode(JSON.stringify({ aud: audience, exp, sub: subject })),
   );
   const data = new TextEncoder().encode(`${header}.${payload}`);
   const sig = new Uint8Array(
-    await crypto.subtle.sign(
-      { name: "ECDSA", hash: "SHA-256" },
-      privateKey,
-      data,
-    ),
+    await crypto.subtle.sign({ name: "ECDSA", hash: "SHA-256" }, privateKey, data),
   );
   // Convert DER → raw r||s if needed; Web Crypto in Bun returns raw P-1363.
   return `${header}.${payload}.${b64urlEncode(sig)}`;
@@ -127,29 +118,19 @@ async function encryptPushBody(
     true,
     [],
   );
-  const local = await crypto.subtle.generateKey(
-    { name: "ECDH", namedCurve: "P-256" },
-    true,
-    ["deriveBits"],
-  );
+  const local = await crypto.subtle.generateKey({ name: "ECDH", namedCurve: "P-256" }, true, [
+    "deriveBits",
+  ]);
   const shared = new Uint8Array(
-    await crypto.subtle.deriveBits(
-      { name: "ECDH", public: userPublic },
-      local.privateKey,
-      256,
-    ),
+    await crypto.subtle.deriveBits({ name: "ECDH", public: userPublic }, local.privateKey, 256),
   );
   const salt = crypto.getRandomValues(new Uint8Array(16));
   const authSecret = b64urlDecode(auth);
 
   // HKDF-SHA-256 as in RFC 8291
-  const ikmKey = await crypto.subtle.importKey(
-    "raw",
-    asBufferSource(shared),
-    "HKDF",
-    false,
-    ["deriveBits"],
-  );
+  const ikmKey = await crypto.subtle.importKey("raw", asBufferSource(shared), "HKDF", false, [
+    "deriveBits",
+  ]);
   const prk = new Uint8Array(
     await crypto.subtle.deriveBits(
       {
@@ -163,9 +144,7 @@ async function encryptPushBody(
     ),
   );
   // Simplified content encryption key / nonce derivation for aes128gcm
-  const prkKey = await crypto.subtle.importKey("raw", prk, "HKDF", false, [
-    "deriveBits",
-  ]);
+  const prkKey = await crypto.subtle.importKey("raw", prk, "HKDF", false, ["deriveBits"]);
   const cek = new Uint8Array(
     await crypto.subtle.deriveBits(
       {
@@ -190,13 +169,7 @@ async function encryptPushBody(
       96,
     ),
   );
-  const aes = await crypto.subtle.importKey(
-    "raw",
-    cek,
-    { name: "AES-GCM" },
-    false,
-    ["encrypt"],
-  );
+  const aes = await crypto.subtle.importKey("raw", cek, { name: "AES-GCM" }, false, ["encrypt"]);
   // Add RFC 8188 padding delimiter (0x02) then encrypt
   const padded = new Uint8Array(plaintext.length + 1);
   padded.set(plaintext, 0);
@@ -204,17 +177,13 @@ async function encryptPushBody(
   const ciphertext = new Uint8Array(
     await crypto.subtle.encrypt({ name: "AES-GCM", iv: nonce }, aes, padded),
   );
-  const localPublic = new Uint8Array(
-    await crypto.subtle.exportKey("raw", local.publicKey),
-  );
+  const localPublic = new Uint8Array(await crypto.subtle.exportKey("raw", local.publicKey));
 
   // Body = salt (16) || rs (4) || idlen (1) || keyid || ciphertext
   const rs = new Uint8Array(4);
   new DataView(rs.buffer).setUint32(0, 4096);
   const idlen = new Uint8Array([localPublic.length]);
-  const body = new Uint8Array(
-    16 + 4 + 1 + localPublic.length + ciphertext.length,
-  );
+  const body = new Uint8Array(16 + 4 + 1 + localPublic.length + ciphertext.length);
   body.set(salt, 0);
   body.set(rs, 16);
   body.set(idlen, 20);
@@ -228,9 +197,7 @@ async function encryptPushBody(
  *
  * @param options - VAPID keys + subject
  */
-export function openWebPushChannel(
-  options: ChannelOpenOptions = {},
-): ChannelDriver {
+export function openWebPushChannel(options: ChannelOpenOptions = {}): ChannelDriver {
   const vapidPublic = options.vapidPublicKey;
   const vapidPrivate = options.vapidPrivateKey;
   const subject = options.vapidSubject ?? "mailto:ops@oke.local";
@@ -263,11 +230,7 @@ export function openWebPushChannel(
       };
 
       if (sub?.keys?.p256dh && sub.keys.auth) {
-        const enc = await encryptPushBody(
-          plaintext,
-          sub.keys.p256dh,
-          sub.keys.auth,
-        );
+        const enc = await encryptPushBody(plaintext, sub.keys.p256dh, sub.keys.auth);
         body = enc.body;
         headers["Content-Encoding"] = "aes128gcm";
         headers["Content-Type"] = "application/octet-stream";
@@ -300,9 +263,7 @@ export function openWebPushChannel(
         ok: true,
         messageId: id,
         driverId: "webpush",
-        attempts: [
-          { driverId: "webpush", ok: true, at: Date.now(), messageId: id },
-        ],
+        attempts: [{ driverId: "webpush", ok: true, at: Date.now(), messageId: id }],
       };
     },
   };