okengine 0.10.1 → 0.10.2

package/src/plugins/cors.test.ts

@@ -28,7 +28,7 @@ function preflight(path = "/x", headers: Record<string, string> = {}): Request {
 
 describe("cors plugin — preflight", () => {
   test("answers preflight for a path bound to another method (edge)", async () => {
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "cors-pre" }).plug(
       cors({ origin: "https://app.example.com" }),
     );
@@ -42,7 +42,7 @@ describe("cors plugin — preflight", () => {
   });
 
   test("denied origins get a 204 without CORS headers — the browser blocks quietly", async () => {
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "cors-deny" }).plug(
       cors({ origin: "https://other.example.com" }),
     );
@@ -54,7 +54,7 @@ describe("cors plugin — preflight", () => {
   });
 
   test("no origin configured answers nothing — cross-origin closed by default", async () => {
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "cors-closed" }).plug(cors());
 
     const res = await app.fetch(preflight());
@@ -62,7 +62,7 @@ describe("cors plugin — preflight", () => {
   });
 
   test("a plain unmatched OPTIONS without preflight headers still 404s", async () => {
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "cors-404" }).plug(cors({ origin: "*" }));
 
     const res = await app.fetch(new Request("http://localhost/x", { method: "OPTIONS" }));
@@ -70,7 +70,7 @@ describe("cors plugin — preflight", () => {
   });
 
   test("reflects request headers by default, honors configured lists and maxAge", async () => {
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "cors-hdr" }).plug(
       cors({ origin: "*", maxAge: 600, allowedHeaders: ["x-custom"] }),
     );
@@ -91,7 +91,7 @@ describe("cors plugin — preflight", () => {
   });
 
   test("allowlist + credentials reflects only listed origins", async () => {
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "cors-cred" }).plug(
       cors({ origin: ["https://app.example.com", "https://admin.example.com"], credentials: true }),
     );
@@ -109,7 +109,7 @@ describe("cors plugin — preflight", () => {
 
 describe("cors plugin — actual requests", () => {
   test("allowed origins get allow-origin (+ exposed headers) on matched responses", async () => {
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "cors-actual" }).plug(
       cors({ origin: ["https://app.example.com"], exposedHeaders: ["x-total"] }),
     );
@@ -124,7 +124,7 @@ describe("cors plugin — actual requests", () => {
   });
 
   test("allowlist + credentials on matched responses reflects only listed origins", async () => {
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "cors-actual-cred" }).plug(
       cors({ origin: ["https://app.example.com"], credentials: true }),
     );
@@ -145,7 +145,7 @@ describe("cors plugin — actual requests", () => {
   });
 
   test("denied origins get no CORS headers on matched responses", async () => {
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "cors-actual-deny" }).plug(
       cors({ origin: "https://ok.example.com" }),
     );
@@ -159,7 +159,7 @@ describe("cors plugin — actual requests", () => {
   });
 
   test("requests without an Origin header are untouched", async () => {
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "cors-no-origin" }).plug(cors({ origin: "*" }));
 
     const res = await app.fetch(new Request("http://localhost/x"));

package/src/plugins/csrf.test.ts

@@ -20,8 +20,8 @@ function mutating(headers: Record<string, string> = {}): Request {
 }
 
 function appWith(options: Parameters<typeof csrf>[0]) {
-  on(http.post("/transfer"), flow({ name: "transfer.create", do: () => ({ moved: true }) }));
-  on(http.get("/balance"), flow({ name: "balance.get", do: () => ({ balance: 5 }) }));
+  on(http.post("/transfer"), flow("transfer.create", { do: () => ({ moved: true }) }));
+  on(http.get("/balance"), flow("balance.get", { do: () => ({ balance: 5 }) }));
   return oke({ autoBoot: false, name: `csrf-${crypto.randomUUID()}` }).plug(csrf(options));
 }
 

package/src/plugins/headers.test.ts

@@ -18,7 +18,7 @@ beforeEach(() => {
 
 describe("headers plugin", () => {
   test("sets the default trio on a successful response", async () => {
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "sec" }).plug(headers());
 
     const res = await app.fetch(new Request("http://localhost/x"));
@@ -31,7 +31,7 @@ describe("headers plugin", () => {
   });
 
   test("helmet-parity defaults: agent cluster, dns prefetch, download, cross-domain, xss filter", async () => {
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "sec-parity" }).plug(headers());
 
     const res = await app.fetch(new Request("http://localhost/x"));
@@ -44,7 +44,7 @@ describe("headers plugin", () => {
   });
 
   test("each parity default can be switched off", async () => {
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "sec-off" }).plug(
       headers({
         originAgentCluster: false,
@@ -64,7 +64,7 @@ describe("headers plugin", () => {
   });
 
   test("dnsPrefetchControl allow, custom cross-domain policy, COEP stamps when configured", async () => {
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "sec-tuned" }).plug(
       headers({
         dnsPrefetchControl: { allow: true },
@@ -84,8 +84,7 @@ describe("headers plugin", () => {
     const poweredByApp = (options: Parameters<typeof headers>[0], name: string) => {
       on(
         http.get("/x"),
-        flow({
-          name: "x.get",
+        flow("x.get", {
           do: () =>
             new Response("{}", {
               headers: { "content-type": "application/json", "x-powered-by": "Express" },
@@ -111,7 +110,7 @@ describe("headers plugin", () => {
   });
 
   test("structured CSP merges over helmet's defaults, camelCase keys, report-only mode", async () => {
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "sec-csp-builder" }).plug(
       headers({
         contentSecurityPolicy: {
@@ -131,7 +130,7 @@ describe("headers plugin", () => {
   });
 
   test("structured CSP with useDefaults: false emits exactly the given directives", async () => {
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "sec-csp-bare" }).plug(
       headers({
         contentSecurityPolicy: { useDefaults: false, directives: { "default-src": ["'none'"] } },
@@ -151,7 +150,7 @@ describe("headers plugin", () => {
   test("headers land on failures too (onResponse runs after onError)", async () => {
     on(
       http.get("/deny"),
-      flow({ name: "x.deny", do: () => ({ ok: true }) }).hook("beforeHandle", () =>
+      flow("x.deny", { do: () => ({ ok: true }) }).hook("beforeHandle", () =>
         fail("Forbidden", {}),
       ),
     );
@@ -164,7 +163,7 @@ describe("headers plugin", () => {
   });
 
   test("adds CSP only when configured", async () => {
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "sec-csp" }).plug(
       headers({ contentSecurityPolicy: "default-src 'self'" }),
     );
@@ -175,7 +174,7 @@ describe("headers plugin", () => {
   });
 
   test("HSTS is off by default", async () => {
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "sec-hsts-off" }).plug(headers());
 
     const res = await app.fetch(new Request("http://localhost/x"));
@@ -184,7 +183,7 @@ describe("headers plugin", () => {
   });
 
   test("hsts: true stamps a one-year max-age", async () => {
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "sec-hsts-on" }).plug(headers({ hsts: true }));
 
     const res = await app.fetch(new Request("http://localhost/x"));
@@ -193,7 +192,7 @@ describe("headers plugin", () => {
   });
 
   test("hsts object tunes max-age, subdomains, preload", async () => {
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "sec-hsts-tuned" }).plug(
       headers({ hsts: { maxAge: 63072000, includeSubDomains: true, preload: true } }),
     );
@@ -206,7 +205,7 @@ describe("headers plugin", () => {
   });
 
   test("permissions-policy and cross-origin policies stamp when configured", async () => {
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "sec-extra" }).plug(
       headers({
         permissionsPolicy: "camera=(), microphone=()",
@@ -223,7 +222,7 @@ describe("headers plugin", () => {
   });
 
   test("an explicit app-set value wins by default", async () => {
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "sec-keep" });
     app.hook("onResponse", (ctx) => {
       if (!ctx.response) return;

package/src/plugins/ip-allowlist.test.ts

@@ -25,7 +25,7 @@ function get(ip?: string): Request {
 
 describe("ipAllowlist plugin", () => {
   test("allow list: listed IPs pass, others get 403 Forbidden", async () => {
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "ips" }).plug(ipAllowlist({ allow: ["203.0.113.7"] }));
 
     const ok = await app.fetch(get("203.0.113.7"));
@@ -39,7 +39,7 @@ describe("ipAllowlist plugin", () => {
   });
 
   test("deny list: blocked IPs get 403 ip_denied, others pass", async () => {
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "ips-deny" }).plug(
       ipAllowlist({ deny: ["198.51.100.9"] }),
     );
@@ -54,7 +54,7 @@ describe("ipAllowlist plugin", () => {
   });
 
   test("deny wins over allow on overlap", async () => {
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "ips-both" }).plug(
       ipAllowlist({ allow: ["203.0.113.7"], deny: ["203.0.113.7"] }),
     );
@@ -64,7 +64,7 @@ describe("ipAllowlist plugin", () => {
   });
 
   test("XFF last hop is the client; a spoofed first hop cannot bypass allow", async () => {
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "ips-xff" }).plug(
       ipAllowlist({ allow: ["203.0.113.7"] }),
     );
@@ -78,7 +78,7 @@ describe("ipAllowlist plugin", () => {
   });
 
   test("spoofed first hop cannot bypass a deny rule", async () => {
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "ips-xff-deny" }).plug(
       ipAllowlist({ deny: ["198.51.100.9"] }),
     );
@@ -92,7 +92,7 @@ describe("ipAllowlist plugin", () => {
   });
 
   test("trustedProxyDepth selects the hop behind N trusted proxies", async () => {
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     // Chain: spoofed, real-client, cdn-egress — depth 2 skips the nearest proxy hop.
     const app = oke({ autoBoot: false, name: "ips-depth" }).plug(
       ipAllowlist({ allow: ["203.0.113.7"], trustedProxyDepth: 2 }),
@@ -113,7 +113,7 @@ describe("ipAllowlist plugin", () => {
   });
 
   test("missing header: denied when allow is set, permitted for deny-only", async () => {
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     const strict = oke({ autoBoot: false, name: "ips-missing-allow" }).plug(
       ipAllowlist({ allow: ["203.0.113.7"] }),
     );
@@ -123,7 +123,7 @@ describe("ipAllowlist plugin", () => {
 
     resetBindings();
     resetFlowSeq();
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
 
     const lax = oke({ autoBoot: false, name: "ips-missing-deny" }).plug(
       ipAllowlist({ deny: ["198.51.100.9"] }),
@@ -133,7 +133,7 @@ describe("ipAllowlist plugin", () => {
   });
 
   test("custom header name is honored", async () => {
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "ips-custom" }).plug(
       ipAllowlist({ allow: ["203.0.113.7"], header: "x-real-ip" }),
     );

package/src/plugins/magic-link.ts

@@ -107,9 +107,7 @@ export function magicLink(opts: MagicLinkOptions = {}): PluginDef {
         })
       : magicLinkTemplate;
 
-  const request = flow({
-    name: "auth.requestMagicLink",
-    unit: "auth",
+  const request = flow("auth.requestMagicLink", {
     plane: "user",
     in: z.object({ email: z.string().min(3) }),
     out: z.object({
@@ -144,9 +142,7 @@ export function magicLink(opts: MagicLinkOptions = {}): PluginDef {
     },
   });
 
-  const verify = flow({
-    name: "auth.verifyMagicLink",
-    unit: "auth",
+  const verify = flow("auth.verifyMagicLink", {
     plane: "user",
     in: z.object({ token: z.string().min(1) }),
     out: SessionTokensOut,

package/src/plugins/maintenance-mode.test.ts

@@ -17,7 +17,7 @@ beforeEach(() => {
 
 describe("maintenanceMode plugin", () => {
   test("returns 503 with ServiceUnavailable envelope and Retry-After", async () => {
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "maint" }).plug(maintenanceMode({ retryAfter: 120 }));
 
     const res = await app.fetch(new Request("http://localhost/x"));
@@ -35,7 +35,7 @@ describe("maintenanceMode plugin", () => {
   });
 
   test("enabled: false passes traffic through", async () => {
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "maint-off" }).plug(
       maintenanceMode({ enabled: false }),
     );
@@ -46,8 +46,8 @@ describe("maintenanceMode plugin", () => {
   });
 
   test("allowPaths prefixes keep serving", async () => {
-    on(http.get("/health"), flow({ name: "health.get", do: () => ({ up: true }) }));
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/health"), flow("health.get", { do: () => ({ up: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "maint-allow" }).plug(
       maintenanceMode({ allowPaths: ["/health"] }),
     );
@@ -60,7 +60,7 @@ describe("maintenanceMode plugin", () => {
   });
 
   test("bypass header lets operators through (any non-empty value)", async () => {
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "maint-bypass" }).plug(
       maintenanceMode({ bypassHeader: "x-ops-token" }),
     );
@@ -75,7 +75,7 @@ describe("maintenanceMode plugin", () => {
   });
 
   test("the 503 still flows through onResponse (other plugins stamp it)", async () => {
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "maint-stamp" }).plug(maintenanceMode());
     app.hook("onResponse", (ctx) => {
       if (!ctx.response) return;

package/src/plugins/otp.ts

@@ -236,9 +236,7 @@ export function otp(opts: OtpOptions): PluginDef {
   });
 
   if (opts.mode === "provider") {
-    const request = flow({
-      name: "auth.requestOtp",
-      unit: "auth",
+    const request = flow("auth.requestOtp", {
       plane: "user",
       in: z.object({
         phone: z.string().min(8),
@@ -277,9 +275,7 @@ export function otp(opts: OtpOptions): PluginDef {
       },
     });
 
-    const verify = flow({
-      name: "auth.verifyOtp",
-      unit: "auth",
+    const verify = flow("auth.verifyOtp", {
       plane: "user",
       in: z.object({
         phone: z.string().min(8),
@@ -347,9 +343,7 @@ export function otp(opts: OtpOptions): PluginDef {
   }
 
   // ── App mode ───────────────────────────────────────────────────────────
-  const request = flow({
-    name: "auth.requestOtp",
-    unit: "auth",
+  const request = flow("auth.requestOtp", {
     plane: "user",
     in: z.object({
       email: z.string().min(3).optional(),
@@ -415,9 +409,7 @@ export function otp(opts: OtpOptions): PluginDef {
     },
   });
 
-  const resend = flow({
-    name: "auth.resendOtp",
-    unit: "auth",
+  const resend = flow("auth.resendOtp", {
     plane: "user",
     in: z.object({
       email: z.string().min(3).optional(),
@@ -486,9 +478,7 @@ export function otp(opts: OtpOptions): PluginDef {
     },
   });
 
-  const verify = flow({
-    name: "auth.verifyOtp",
-    unit: "auth",
+  const verify = flow("auth.verifyOtp", {
     plane: "user",
     in: z.object({
       email: z.string().min(3).optional(),

package/src/plugins/passkey.ts

@@ -87,9 +87,7 @@ export function passkey(opts: PasskeyOptions = {}): PluginDef {
   const rpId = opts.rpId ?? "localhost";
   const origins = opts.origins ?? ["http://localhost", "https://localhost"];
 
-  const registerOptions = flow({
-    name: "auth.passkeyRegisterOptions",
-    unit: "auth",
+  const registerOptions = flow("auth.passkeyRegisterOptions", {
     plane: "user",
     out: z.object({
       challenge: z.string(),
@@ -115,9 +113,7 @@ export function passkey(opts: PasskeyOptions = {}): PluginDef {
     },
   });
 
-  const register = flow({
-    name: "auth.passkeyRegister",
-    unit: "auth",
+  const register = flow("auth.passkeyRegister", {
     plane: "user",
     in: CeremonyIn.extend({
       publicKey: z.string().min(1),
@@ -171,9 +167,7 @@ export function passkey(opts: PasskeyOptions = {}): PluginDef {
     },
   });
 
-  const authenticateOptions = flow({
-    name: "auth.passkeyAuthenticateOptions",
-    unit: "auth",
+  const authenticateOptions = flow("auth.passkeyAuthenticateOptions", {
     plane: "user",
     in: z.object({ email: z.string().optional() }),
     out: z.object({
@@ -199,9 +193,7 @@ export function passkey(opts: PasskeyOptions = {}): PluginDef {
     },
   });
 
-  const authenticate = flow({
-    name: "auth.passkeyAuthenticate",
-    unit: "auth",
+  const authenticate = flow("auth.passkeyAuthenticate", {
     plane: "user",
     in: CeremonyIn.extend({
       challenge: z.string().min(1),

package/src/plugins/two-factor.ts

@@ -59,9 +59,7 @@ export function twoFactor(opts: TwoFactorOptions = {}): PluginDef {
   const factors = opts.factors ?? createTwoFactorStore();
   const issuer = opts.issuer ?? "oke";
 
-  const enable = flow({
-    name: "auth.twoFactorEnable",
-    unit: "auth",
+  const enable = flow("auth.twoFactorEnable", {
     plane: "user",
     out: z.object({
       secret: z.string(),
@@ -91,9 +89,7 @@ export function twoFactor(opts: TwoFactorOptions = {}): PluginDef {
     },
   });
 
-  const verify = flow({
-    name: "auth.twoFactorVerify",
-    unit: "auth",
+  const verify = flow("auth.twoFactorVerify", {
     plane: "user",
     in: z.object({
       userId: z.string().min(1),
@@ -127,9 +123,7 @@ export function twoFactor(opts: TwoFactorOptions = {}): PluginDef {
     },
   });
 
-  const disable = flow({
-    name: "auth.twoFactorDisable",
-    unit: "auth",
+  const disable = flow("auth.twoFactorDisable", {
     plane: "user",
     out: z.object({ ok: z.literal(true) }),
     errors: { AuthFailed },

package/src/plugins/username.ts

@@ -319,9 +319,7 @@ export function username(opts: UsernamePluginOptions = {}): PluginDef {
   resolveUsernamePolicy(usernamePolicy);
   const crypto = createBunCrypto();
 
-  const signUp = flow({
-    name: "auth.signUpUsername",
-    unit: "auth",
+  const signUp = flow("auth.signUpUsername", {
     plane: "user",
     in: UsernameIn,
     out: SessionTokensOut,
@@ -385,9 +383,7 @@ export function username(opts: UsernamePluginOptions = {}): PluginDef {
     },
   });
 
-  const signIn = flow({
-    name: "auth.signInUsername",
-    unit: "auth",
+  const signIn = flow("auth.signInUsername", {
     plane: "user",
     in: UsernameIn,
     out: SessionTokensOut,

package/src/release/measure.ts

@@ -302,7 +302,7 @@ const { flow } = await import(${JSON.stringify(paths.flow)});
 const { on, resetBindings } = await import(${JSON.stringify(paths.on)});
 const { http } = await import(${JSON.stringify(paths.http)});
 resetBindings();
-on(http.get("/ping"), flow({ name: "ping", do: () => ({ ok: true }) }));
+on(http.get("/ping"), flow("ping", { do: () => ({ ok: true }) }));
 const app = oke({ name: "cold-start" });
 const rt = createBunRuntime();
 const server = rt.serve(app, { port: 0, hostname: "127.0.0.1" });

package/src/runs/runs.test.ts

@@ -59,9 +59,7 @@ describe("zero-instrumentation dimensions", () => {
 
     on(
       http.get("/book").gate(member),
-      flow({
-        name: "book.create",
-        unit: "bookings",
+      flow("bookings.create", {
         plane: "user",
         effects: { reads: ["sql:bookings"] },
         do: async (_input, fx) => {
@@ -92,7 +90,7 @@ describe("zero-instrumentation dimensions", () => {
     const events = await runs.all();
     expect(events.length).toBe(1);
     const e = events[0]!;
-    expect(e.flow).toBe("book.create");
+    expect(e.flow).toBe("bookings.create");
     expect(e.unit).toBe("bookings");
     expect(e.trigger).toBe("http");
     expect(e.plane).toBe("user");
@@ -103,7 +101,7 @@ describe("zero-instrumentation dimensions", () => {
     expect(e.buildVersion).toBe("1.2.3");
     expect(e.logs.length).toBe(1);
     expect(e.logs[0]!.message).toBe("booking started");
-    expect(e.dimensions.flow).toBe("book.create");
+    expect(e.dimensions.flow).toBe("bookings.create");
     expect(e.dimensions.tenant).toBe("org_a41");
     expect(e.dimensions.cache).toBe("hit");
 

package/src/runtime/serve.test.ts

@@ -57,15 +57,13 @@ function rawHttp(port: number, payload: string): Promise<string> {
 function buildApp() {
   on(
     http.get("/ping").gate(gate.public),
-    flow({
-      name: "ping",
+    flow("ping", {
       do: () => ({ ok: true as const, n: 1 }),
     }),
   );
   on(
     http.get("/notes/:id").gate(gate.public),
-    flow({
-      name: "notes.get",
+    flow("notes.get", {
       do: ({ id }: { id: string }) => ({ id }),
     }),
   );

package/src/test/create-test-app.test.ts

@@ -37,9 +37,7 @@ describe("createTestApp — four-applications surface", () => {
 
     on(
       http.post("/orders").gate(member),
-      flow({
-        name: "orders.create",
-        unit: "orders",
+      flow("orders.create", {
         in: z.object({ sku: z.string(), qty: z.number() }),
         out: z.object({ id: z.string() }),
         effects: { emits: ["order-placed"] },
@@ -53,8 +51,7 @@ describe("createTestApp — four-applications surface", () => {
 
     on(
       orderPlaced,
-      flow({
-        name: "orders.onPlaced",
+      flow("orders.onPlaced", {
         effects: { sends: ["order-confirmed"] },
         do: async ({ orderId }, fx) => {
           await fx.send(orderConfirmed, {
@@ -67,8 +64,7 @@ describe("createTestApp — four-applications surface", () => {
 
     on(
       every("1h"),
-      flow({
-        name: "orders.expire",
+      flow("orders.expire", {
         do: (_i, fx) => {
           fx.log.info("expire");
         },

package/src/test/provisions.integration.test.ts

@@ -48,8 +48,7 @@ describe("Provisions integration", () => {
       }),
     });
 
-    const chargeOrder = flow({
-      name: "payments.chargeOrder",
+    const chargeOrder = flow("payments.chargeOrder", {
       durable: true,
       in: z.object({ orderId: z.string() }),
       out: z.boolean(),
@@ -69,9 +68,7 @@ describe("Provisions integration", () => {
 
     on(
       http.post("/orders").gate(member, canOrder),
-      flow({
-        name: "orders.create",
-        unit: "orders",
+      flow("orders.create", {
         in: z.object({ sku: z.string(), qty: z.number() }),
         out: z.object({ id: z.string() }),
         effects: { emits: ["order-placed"], calls: ["payments.chargeOrder"] },
@@ -85,8 +82,7 @@ describe("Provisions integration", () => {
 
     on(
       orderPlaced,
-      flow({
-        name: "orders.onPlaced",
+      flow("orders.onPlaced", {
         effects: { calls: ["payments.chargeOrder"] },
         do: async ({ orderId }, fx) => {
           await fx.call(chargeOrder, { orderId });
@@ -96,8 +92,7 @@ describe("Provisions integration", () => {
 
     on(
       orderNews,
-      flow({
-        name: "notifications.onNews",
+      flow("notifications.onNews", {
         effects: { sends: ["order-confirmed"] },
         do: async ({ orderId, status }, fx) => {
           if (status !== "confirmed") return;