okengine 0.10.1 → 0.10.3

package/README.md

@@ -74,7 +74,7 @@ import { z } from "zod";
 
 export const health = on(
   http.get("/health").gate(gate.public),
-  flow({
+  flow("health.check", {
     out: z.object({ ok: z.literal(true) }),
     do: () => ({ ok: true as const }),
   }),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "okengine",
-  "version": "0.10.1",
+  "version": "0.10.3",
   "description": "One law. Eight elements. Ten exports. One package. One manifest. Every backend need is derived, never added.",
   "license": "MIT",
   "repository": {

package/site/content/docs/ai/mcp.mdx

@@ -98,7 +98,6 @@ The docs content ships inside the `okengine` package, so the index your agent se
 
 ## Learn more
 
-- [Console · Access](/docs/console/access) — how operator tokens and grants work
 - [Agent contracts](/docs/ai/skills) — what agents are taught about the system they operate
 - [Flow](/docs/elements/flow) — the effects the MCP reads back
 

package/site/content/docs/elements/ai.mdx

@@ -289,7 +289,6 @@ Bound it at declaration: `maxSteps` caps iterations, `budget.maxCostPerRun` caps
 
 - [Flow](/docs/elements/flow) — `fx.ask` and `fx.search` inside `do`
 - [Store](/docs/elements/store) — `store.index`, the home of embeddings
-- [Console · AI](/docs/console/ai) — prompts, versions, cost per run
 
 ## Next
 
@@ -304,9 +303,4 @@ Bound it at declaration: `maxSteps` caps iterations, `budget.maxCostPerRun` caps
     description="Eight elements overview."
     href="/docs/get-started/introduction"
   />
-  <Card
-    title="Console"
-    description="Panels derived from the Manifest."
-    href="/docs/console/overview"
-  />
 </Cards>

package/site/content/docs/elements/channel.mdx

@@ -326,7 +326,6 @@ Confirm a visible OS notification titled `okengine webpush interop`.
 ## Learn more
 
 - [Flow](/docs/elements/flow) — `fx.send` inside `do`
-- [Console · Channels](/docs/console/channels) — receipts, attempts, suppression
 - [Environment Variables](/docs/reference/environment-variables) — Channel boot credentials
 - [Configuration](/docs/reference/configuration) — `drivers.channel.*` maps
 - [i18n](/docs/reference/i18n) — ICU / `fx.t` vs Channel `{{field}}` catalogs
@@ -341,9 +340,4 @@ Confirm a visible OS notification titled `okengine webpush interop`.
     description="Eight elements overview."
     href="/docs/get-started/introduction"
   />
-  <Card
-    title="Console"
-    description="Panels derived from the Manifest."
-    href="/docs/console/overview"
-  />
 </Cards>

package/site/content/docs/elements/clock.mdx

@@ -26,7 +26,7 @@ import { on, flow, every } from "okengine";
 
 export const purgeOld = on(
   every("1h"),
-  flow({
+  flow("links.purgeOld", {
     do: async (_, fx) => {
       const cutoff = fx.clock.now() - 30 * 24 * 60 * 60 * 1000; // 30 days
       await fx.store(db).delete(links).where(lt(links.createdAt, cutoff));
@@ -55,7 +55,7 @@ export const dailyReport = clock("daily-report", {
 ```typescript title="src/flows/reports/daily.ts"
 export const sendDaily = on(
   dailyReport,
-  flow({
+  flow("reports.sendDaily", {
     do: async (_, fx) => {
       /* … */
     },
@@ -195,7 +195,6 @@ They are not sharing one CronStore. In-memory leases are per process. Point ever
 
 - [Flow](/docs/elements/flow) — `on(trigger, flow)` and the `fx` surface
 - [fx · Runs](/docs/reference/fx#runs-observability-read) — native SLO checkers via `on(every(…))` + `fx.runs`
-- [Console · Clock](/docs/console/clock) — health numbers, pause / edit / wake early
 - [Signal](/docs/elements/signal) — reacting to events instead of time
 
 ## Next
@@ -207,9 +206,4 @@ They are not sharing one CronStore. In-memory leases are per process. Point ever
     description="Eight elements overview."
     href="/docs/get-started/introduction"
   />
-  <Card
-    title="Console"
-    description="Panels derived from the Manifest."
-    href="/docs/console/overview"
-  />
 </Cards>

package/site/content/docs/elements/flow.mdx

@@ -28,7 +28,7 @@ import { z } from "zod";
 
 export const createOrder = on(
   http.post("/orders"),
-  flow({
+  flow("orders.create", {
     in: z.object({ sku: z.string(), qty: z.number().int().min(1) }),
     out: z.object({ id: z.string() }),
     errors: { OutOfStock: z.object({ left: z.number() }) },
@@ -106,7 +106,7 @@ Built-in codes attach a localized `message` ([Errors](/docs/reference/errors));
 ```typescript
 export const findOrder = on(
   http.get("/orders/:id").gate(member), // gates evaluate before do runs
-  flow({
+  flow("orders.find", {
     in: z.object({ id: z.string() }),
     out: Order,
     errors: { NotFound: z.object({}) },
@@ -124,7 +124,7 @@ await fx.emit(orderPlaced, { orderId: id }); // inside the producing flow
 
 on(
   orderPlaced,
-  flow({
+  flow("orders.sendReceipt", {
     do: async ({ orderId }, fx) => {
       /* … */
     },
@@ -139,7 +139,7 @@ on(
 ```typescript
 on(
   every("1h"),
-  flow({
+  flow("sessions.sweepExpired", {
     do: async (_, fx) => {
       const cutoff = fx.clock.now() - 30 * 24 * 60 * 60 * 1000;
       await fx.store(db).delete(sessions).where(lt(sessions.createdAt, cutoff));
@@ -155,7 +155,7 @@ CDC is built in; the flow receives `{ before, after }`:
 ```typescript
 on(
   db.table(orders).changed("status"),
-  flow({
+  flow("orders.reverify", {
     do: ({ before, after }, fx) => fx.log.info("status", { from: before.status, to: after.status }),
   }),
 );
@@ -166,7 +166,7 @@ on(
 Drop `on()` and it is still a real Flow — contracts, Manifest entry, everything. Other flows call it through `fx.call`:
 
 ```typescript
-export const getOrder = flow({
+export const getOrder = flow("orders.get", {
   in: OrderRef,
   out: Order,
   do: async ({ id }, fx) => {
@@ -211,7 +211,7 @@ Everything a flow may touch, on one object:
 Set `durable: true` and every `fx` call is journaled. Wrap side effects in `fx.step` and they never re-run on replay:
 
 ```typescript
-export const chargeOrder = flow({
+export const chargeOrder = flow("payments.chargeOrder", {
   durable: true, // every fx call below is journaled
   in: OrderRef,
   out: z.boolean(),
@@ -233,14 +233,14 @@ export const chargeOrder = flow({
 
 Replay is **at-least-once** for a step whose body never persisted (crash mid-step, lease overrun): that step re-runs on reclaim, so keep step bodies short or internally idempotent. A client transport retry starts a _new_ run with a fresh `runId` — request-level idempotency is an application concern, not the journal's.
 
-For flaky sub-steps, wrap the work in `fx.retry` **inside** `fx.step` so a completed charge is never retried on resume. Coarse whole-body retry is also available as `flow({ retry: { retries, delay, backoff, jitter } })` and reuses the same journal session.
+For flaky sub-steps, wrap the work in `fx.retry` **inside** `fx.step` so a completed charge is never retried on resume. Coarse whole-body retry is also available as `flow(name, { retry: { retries, delay, backoff, jitter } })` and reuses the same journal session.
 
 After a **terminal** failure (`fx.fail` or exhausted retries / uncaught throw), optional
 `compensate` runs under the same journal. Undo work must use **new** step names
 (`undo:…`) — never rewind forward steps:
 
 ```typescript
-export const chargeOrder = flow({
+export const chargeOrder = flow("payments.chargeOrder", {
   durable: true,
   in: OrderRef,
   out: z.boolean(),
@@ -295,7 +295,7 @@ Use `fx.all` (or `fx.race`) with thunks. The first rejection aborts siblings thr
 </Accordion>
 <Accordion title="Durable flow retried a completed charge">
 
-Put `fx.retry` **inside** `fx.step`, not around it. Completed steps replay from the journal and never re-run. `flow({ retry })` is for coarse whole-body retries on the same session.
+Put `fx.retry` **inside** `fx.step`, not around it. Completed steps replay from the journal and never re-run. `flow(name, { retry })` is for coarse whole-body retries on the same session.
 
 </Accordion>
 <Accordion title="When does compensate run?">
@@ -320,8 +320,6 @@ Only that run fails — the schedule keeps firing and the process does not exit.
 - [fx](/docs/reference/fx) — full `fx` surface, including ICU `fx.t` / `fx.locale`
 - [Signal](/docs/elements/signal) — delivery physics (`once` · `broadcast` · `live`)
 - [Clock](/docs/elements/clock) — schedules and durable sleep
-- [Console · Flows](/docs/console/flows) — the Manifest-derived panel
-- [Runs](/docs/console/runs) — how a flow execution is observed
 
 ## Next
 
@@ -332,9 +330,4 @@ Only that run fails — the schedule keeps firing and the process does not exit.
     description="Eight elements overview."
     href="/docs/get-started/introduction"
   />
-  <Card
-    title="Console"
-    description="Panels derived from the Manifest."
-    href="/docs/console/overview"
-  />
 </Cards>

package/site/content/docs/elements/gate.mdx

@@ -66,7 +66,7 @@ import { member, canBook, fair } from "../../gates";
 
 export const health = on(
   http.get("/health").gate(gate.public),
-  flow({
+  flow("health.check", {
     out: HealthOut,
     do: () => ({ ok: true as const }),
   }),
@@ -74,7 +74,7 @@ export const health = on(
 
 export const shorten = on(
   http.post("/links").gate(member, canBook, fair),
-  flow({
+  flow("links.shorten", {
     in: NewLink,
     out: LinkCode,
     errors: { Taken },
@@ -174,8 +174,8 @@ Every HTTP trigger must carry a gate or `gate.public`. Omitting both fails boot
 `GateBootError` — message starts with `gate boot failed —` and lists every gap.
 
 ```typescript
-on(http.get("/health").gate(gate.public), flow({/* … */}));
-on(http.post("/bookings").gate(member, canBook), flow({/* … */}));
+on(http.get("/health").gate(gate.public), flow("health.check", {/* … */}));
+on(http.post("/bookings").gate(member, canBook), flow("bookings.create", {/* … */}));
 ```
 
 **Consequence:** first `fetch` / `execute` auto-boots (`autoBoot` defaults to `true`).
@@ -308,7 +308,6 @@ Keying an authenticated endpoint by IP punishes shared NAT.
 - [fx](/docs/reference/fx) — `fx.auth`, `fx.operator`, `fx.principal`
 - [Client](/docs/reference/client) — Bearer `createClient` + `okengine/client/auth`
 - [Plugins](/docs/plugins) — username, magic link, OTP, TOTP, passkeys
-- [Console · Gates](/docs/console/gates) — decision audit and posture
 - [Vault](/docs/elements/vault) — credentials your policies protect
 
 ## Next
@@ -316,9 +315,4 @@ Keying an authenticated endpoint by IP punishes shared NAT.
 <Cards>
   <Card title="Vault" description="Continue to Vault." href="/docs/elements/vault" />
   <Card title="Plugins" description="Sign-in method plugins under /auth." href="/docs/plugins" />
-  <Card
-    title="Console"
-    description="Panels derived from the Manifest."
-    href="/docs/console/overview"
-  />
 </Cards>

package/site/content/docs/elements/signal.mdx

@@ -58,7 +58,7 @@ A signal is a trigger like any other — the consumer is an ordinary Flow:
 ```typescript title="src/flows/orders/send-confirmation.ts"
 export const sendConfirmation = on(
   orderPlaced,
-  flow({
+  flow("orders.sendConfirmation", {
     in: z.object({ orderId: z.string(), total: z.number() }),
     do: async (input, fx) => {
       await fx.send(orderConfirmed, { to: "user-1", data: input });
@@ -131,8 +131,7 @@ export const orderStatus = signal("order-status", {
 ```typescript title="src/flows/fulfillment/on-order.ts"
 on(
   orderPlaced,
-  flow({
-    name: "fulfillment.onOrder",
+  flow("fulfillment.onOrder", {
     do: async ({ orderId }, fx) => {
       await fx.emit(orderChanged, { orderId, kind: "placed" });
       await fx.emit(orderStatus, { orderId, status: "fulfilling" });
@@ -147,8 +146,7 @@ on(
 ```typescript title="src/flows/orders/side-effects.ts"
 on(
   orderChanged,
-  flow({
-    name: "cache.onOrderChanged",
+  flow("cache.onOrderChanged", {
     do: async ({ orderId }, fx) => {
       /* invalidate order:{orderId} */
     },
@@ -157,8 +155,7 @@ on(
 
 on(
   orderChanged,
-  flow({
-    name: "notify.onOrderChanged",
+  flow("notify.onOrderChanged", {
     do: async ({ orderId }, fx) => {
       await fx.send(orderConfirmed, { to: "user-1", data: { orderId } });
     },
@@ -294,7 +291,6 @@ At-least-once: crash-after-claim reclaims when the lease expires, and a handler
 ## Learn more
 
 - [Flow](/docs/elements/flow) — `on(trigger, flow)` and `fx.emit`
-- [Console · Signals](/docs/console/signals) — topology, delivery stats, DLQ replay
 - [Clock](/docs/elements/clock) — scheduled and delayed work
 
 ## Next
@@ -306,9 +302,4 @@ At-least-once: crash-after-claim reclaims when the lease expires, and a handler
     description="Eight elements overview."
     href="/docs/get-started/introduction"
   />
-  <Card
-    title="Console"
-    description="Panels derived from the Manifest."
-    href="/docs/console/overview"
-  />
 </Cards>

package/site/content/docs/elements/store.mdx

@@ -80,7 +80,7 @@ All data access goes through `fx.store(db)` — a typed session, one table at a
 ```typescript title="src/flows/notes/create.ts"
 export const createNote = on(
   http.post("/notes"),
-  flow({
+  flow("notes.create", {
     in: z.object({ title: z.string(), body: z.string() }),
     out: z.object({ id: z.string() }),
     do: async (input, fx) => {
@@ -490,9 +490,8 @@ await fx.store(sessions).set(`sess:${token}`, { userId }, "7d");
 const keys = await fx.store(sessions).list("sess:");
 ```
 
-**Consequence:** `list` is how the [Console · Store](/docs/console/store) browser enumerates a
-namespace. Prefer stable key prefixes (`user:`, `sess:`) so both your Flows and the Console stay
-readable.
+**Consequence:** `list` enumerates a namespace. Prefer stable key prefixes (`user:`, `sess:`) so
+your Flows and operator tools stay readable.
 
 ### Per-environment KV drivers
 
@@ -637,9 +636,9 @@ images: {
 
 **Known limit:** `fs` is single-host. Under horizontal scale each replica sees its own filesystem (silently inconsistent object views). Boot prints a one-shot warning when `drivers.store.files` is `fs`. Use `s3` for docker/prod (create-oke templates already do).
 
-<Callout title="Console can browse, not edit bytes">
-  The [Console · Store](/docs/console/store) lists keys and can delete them. Direct edit is **KV +
-  SQL only** — blob bodies are not patched from the Console.
+<Callout title="Operator tools can browse, not edit bytes">
+  Operator tools can list keys and delete them. Direct edit is **KV + SQL only** — blob bodies are
+  not patched.
 </Callout>
 
 ### Images — `image` / `putImage`
@@ -861,9 +860,9 @@ Container images come from the `images` map — change the vendor by changing th
 
 Columns tagged `.pii()` or `.sensitive()` are masked at the store boundary — flows, logs, and the Console see a mask, not the value. Revealing cleartext PII requires an explicit `pii:reveal` gate on the flow, so access is a permission, not a convention.
 
-Optional `description` on a store (and `.describe("…")` on fields) becomes the human title in the
-[Console · Store](/docs/console/store) browser. Single-table `reads` / `writes` in the Manifest
-power cache invalidation and that same PII masking — see the Callout under [Querying by hand](#querying-by-hand).
+Optional `description` on a store (and `.describe("…")` on fields) becomes its human title in
+operator tools. Single-table `reads` / `writes` in the Manifest power cache invalidation and that
+same PII masking — see the Callout under [Querying by hand](#querying-by-hand).
 
 ## Troubleshooting
 
@@ -915,7 +914,6 @@ Unlike KV/Files, unset `drivers.store.index` does **not** promote to `pgvector`
 - [Flow](/docs/elements/flow) — the `fx.store` session inside `do`
 - [AI](/docs/elements/ai) — `ai.embed` into a vector `store.index`, searched via `fx.search`
 - [Gate](/docs/elements/gate) — `pii:reveal` and other permissions on flows
-- [Console · Store](/docs/console/store) — browse data, cache keys, PII masking
 - [CLI Reference](/docs/reference/cli) — `oke db push` · `generate` · `migrate`
 - [Configuration](/docs/reference/configuration) — `drivers.store` maps and `images` pins
 - [Environment variables](/docs/reference/environment-variables) — Redis · S3 · meilisearch URLs
@@ -929,9 +927,4 @@ Unlike KV/Files, unset `drivers.store.index` does **not** promote to `pgvector`
     description="Eight elements overview."
     href="/docs/get-started/introduction"
   />
-  <Card
-    title="Console"
-    description="Panels derived from the Manifest."
-    href="/docs/console/overview"
-  />
 </Cards>

package/site/content/docs/elements/vault.mdx

@@ -62,7 +62,7 @@ Call `.reveal()` once at the boundary that needs the real credential:
 ```typescript title="src/flows/billing/charge.ts"
 export const charge = on(
   http.post("/charge"),
-  flow({
+  flow("billing.charge", {
     in: ChargeInput,
     out: z.object({ id: z.string() }),
     do: async (input, fx) => {
@@ -251,7 +251,6 @@ Set the new value (`oke vault set` or the Console). The Console's rotation view
 
 ## Learn more
 
-- [Console · Vault](/docs/console/vault) — fingerprints, resolution chain, rotation blast radius
 - [Flow](/docs/elements/flow) — how `fx.vault` reads secrets inside `do`
 - [CLI Reference](/docs/reference/cli) — `oke vault set` · `list` · `import`
 
@@ -264,9 +263,4 @@ Set the new value (`oke vault set` or the Console). The Console's rotation view
     description="Eight elements overview."
     href="/docs/get-started/introduction"
   />
-  <Card
-    title="Console"
-    description="Panels derived from the Manifest."
-    href="/docs/console/overview"
-  />
 </Cards>

package/site/content/docs/get-started/basic-usage.mdx

@@ -44,9 +44,7 @@ import { z } from "zod";
 
 export const health = on(
   http.get("/health").gate(gate.public),
-  flow({
-    name: "main.health",
-    unit: "main",
+  flow("main.health", {
     out: z.object({ ok: z.literal(true) }),
     do: () => ({ ok: true as const }),
   }),
@@ -148,7 +146,6 @@ bun test
 - [Flow](/docs/elements/flow) — triggers, contracts, effects, and composition
 - [Store](/docs/elements/store) — SQL, KV, files, index
 - [fx](/docs/reference/fx) — the full effect surface
-- [Console · Overview](/docs/console/overview) — Manifest-derived panels
 
 ## Next
 
@@ -163,9 +160,4 @@ bun test
     description="SQL, KV, files, index, and declarative resources."
     href="/docs/elements/store"
   />
-  <Card
-    title="Console"
-    description="Manifest-derived flows, effects, traces, and architecture."
-    href="/docs/console/overview"
-  />
 </Cards>

package/site/content/docs/get-started/introduction.mdx

@@ -29,7 +29,7 @@ import { z } from "zod";
 
 export const health = on(
   http.get("/health"),
-  flow({
+  flow("health.check", {
     out: z.object({ ok: z.literal(true) }),
     do: () => ({ ok: true as const }),
   }),

package/site/content/docs/get-started/why.mdx

@@ -49,7 +49,7 @@ shared lifecycle, optional live DB config, nothing to re-copy.
 Your observability stack learned your routes from sampled traffic. The Flow
 you deployed an hour ago is invisible until someone wires it by hand.
 
-**OKE derives:** the [Console](/docs/console/overview) reads the Manifest —
+**OKE derives:** its operator interface reads the Manifest —
 flows, effects, traces, architecture — current on every save, in dev and prod
 (`:6533`).
 
@@ -118,7 +118,6 @@ ninth element — the set of eight is closed.
 - [Flow](/docs/elements/flow) — how effects are recorded and inferred
 - [Vault](/docs/elements/vault) — fail-loud secret contracts
 - [Plugins](/docs/reference/plugins) — the official HTTP glue set
-- [Console · Overview](/docs/console/overview) — the Manifest-derived operator UI
 
 ## Next
 

package/site/content/docs/index.mdx

@@ -31,7 +31,6 @@ on(orderPlaced, sendReceipt);
     description="Official extensions — security, ops, performance."
     href="/docs/plugins"
   />
-  <Card title="Console" description="Manifest-derived operator panels." href="/docs/console" />
   <Card
     title="Deployment"
     description="Compose, Swarm, Kubernetes, reverse proxy."

package/site/content/docs/meta.json

@@ -6,7 +6,6 @@
     "get-started",
     "elements",
     "plugins",
-    "console",
     "deployment",
     "recipes",
     "providers",

package/site/content/docs/reference/cli.md

@@ -67,18 +67,18 @@ so ● updates live if you stop a container; AI ● tracks model phase while the
 AI container is up. Boot does not wait for the model to become ready.
 
 On a TTY with `-d`, keyboard controls stay active under Logs. Status ● for
-compose/AI live on the board **above** Logs (not as log lines). Press `c` to
-clear the log pane and reprint the latest board. `l` / `?` also refresh first
-so the services/help panel is not mixed into request logs.
-
-| Key                          | Action                              |
-| ---------------------------- | ----------------------------------- |
-| `?`                          | help                                |
-| `c`                          | refresh — clear logs, show latest ● |
-| `q`                          | quit `oke dev`                      |
-| `l`                          | list docker services                |
-| `u` / `x`                    | compose up / stop (whole stack)     |
-| `1`–`9` then `u` / `x` / `r` | start / stop / restart one service  |
+compose/AI live on the board **above** Logs (not as log lines) — it already
+lists every service, so refresh is enough to see the stack; there is no
+separate services panel. Press `r` to clear the log pane and reprint the
+latest board. `?` also refreshes first so the help panel is not mixed into
+request logs.
+
+| Key       | Action                              |
+| --------- | ----------------------------------- |
+| `?`       | help                                |
+| `r`       | refresh — clear logs, show latest ● |
+| `q`       | quit `oke dev`                      |
+| `u` / `x` | compose up / stop (whole stack)     |
 
 Compose stays quiet unless it fails. Process-local boot notices print once under
 the hero (not once per process).

package/site/content/docs/reference/fx.mdx

@@ -7,7 +7,7 @@ icon: "Braces"
 `fx` is the second argument of every `do` — the single door to the world. This page is the whole surface; each entry notes the **effect it records**, which is what feeds the Manifest, caching, and capability checks.
 
 ```typescript
-flow({
+flow("orders.example", {
   do: async (input, fx) => {
     // everything below, on this one object
   },
@@ -51,8 +51,7 @@ Declare `effects: { reads: ["runs"] }`. Powers native SLO checkers (Clock + Chan
 ```typescript
 on(
   every("5m"),
-  flow({
-    name: "ops.slo-check",
+  flow("ops.slo-check", {
     effects: { reads: ["runs"], sends: ["slo-alert"] },
     do: async (_, fx) => {
       const breaches = await fx.runs.checkSlo(
@@ -133,7 +132,7 @@ const rows = await fx.using(
 );
 ```
 
-**Consequence:** put `fx.retry` inside `fx.step` on durable flows so a completed charge never re-runs on resume. Coarse whole-body retry is `flow({ retry: { … } })` on the same journal session.
+**Consequence:** put `fx.retry` inside `fx.step` on durable flows so a completed charge never re-runs on resume. Coarse whole-body retry is `flow(name, { retry: { … } })` on the same journal session.
 
 ## Channel
 
@@ -260,9 +259,9 @@ must log who started the call chain.
 ## Not on `fx`
 
 <Callout title="No fx.metric">
-  Investigated and declined. [Runs](/docs/console/runs) already own per-invocation observability as
-  wide events. Native alerting is `fx.runs` + Clock + Channel — not a second counter/gauge API.
-  Optional OTLP export for existing Grafana/Datadog stacks is additive and never required.
+  Investigated and declined. `fx.runs` already provides per-invocation observability as wide events.
+  Native alerting is `fx.runs` + Clock + Channel — not a second counter/gauge API. Optional OTLP
+  export for existing Grafana/Datadog stacks is additive and never required.
 </Callout>
 
 ## Learn more

package/src/auth/auth.test.ts

@@ -177,8 +177,7 @@ describe("cross-plane compile error", () => {
         path: "src/flows/console/store.ts",
         flow: "console.store.query",
         source: `
-          export const query = flow({
-            name: "console.store.query",
+          export const query = flow("console.store.query", {
             plane: "operator",
             do: (_i, fx) => fx.auth.userId,
           });

package/src/auth/bindings.ts

@@ -205,9 +205,7 @@ export function createAuthHttpBindings(
 
   const base = config.basePath;
 
-  const refresh = flow({
-    name: "auth.refresh",
-    unit: "auth",
+  const refresh = flow("auth.refresh", {
     plane: "user",
     in: RefreshIn,
     out: SessionTokensOut,
@@ -231,9 +229,7 @@ export function createAuthHttpBindings(
     },
   });
 
-  const revoke = flow({
-    name: "auth.revoke",
-    unit: "auth",
+  const revoke = flow("auth.revoke", {
     plane: "user",
     in: RevokeIn,
     out: z.object({ ok: z.literal(true) }),
@@ -252,9 +248,7 @@ export function createAuthHttpBindings(
     },
   });
 
-  const me = flow({
-    name: "auth.me",
-    unit: "auth",
+  const me = flow("auth.me", {
     plane: "user",
     out: MeOut,
     errors: { AuthFailed },
@@ -289,9 +283,7 @@ export function createAuthHttpBindings(
   ];
 
   if (config.emailAndPassword.enabled) {
-    const signInEmail = flow({
-      name: "auth.signInEmail",
-      unit: "auth",
+    const signInEmail = flow("auth.signInEmail", {
       plane: "user",
       in: EmailPasswordIn,
       out: SessionTokensOut,
@@ -319,9 +311,7 @@ export function createAuthHttpBindings(
       },
     });
 
-    const signUpEmail = flow({
-      name: "auth.signUpEmail",
-      unit: "auth",
+    const signUpEmail = flow("auth.signUpEmail", {
       plane: "user",
       in: EmailPasswordIn,
       out: SessionTokensOut,

package/src/auth/gate-auth.test.ts

@@ -136,7 +136,7 @@ describe("gate.auth — autoBoot / posture", () => {
   });
 
   test(".needs(auth) satisfied by gate.auth without .plug(auth())", async () => {
-    on(http.get("/x").gate(AUTH_SESSION_GATE), flow({ name: "x", do: () => ({ ok: true }) }));
+    on(http.get("/x").gate(AUTH_SESSION_GATE), flow("x", { do: () => ({ ok: true }) }));
     const dependent = plugin("needs-auth", { version: "0.0.1" }).needs("auth");
     const app = oke({
       name: "needs-gate-auth",
@@ -309,7 +309,7 @@ describe("gate.auth — email Flows + security", () => {
   });
 
   test("missing gate on custom HTTP still GateBootError", async () => {
-    on(http.get("/open"), flow({ name: "open", do: () => ({ ok: true }) }));
+    on(http.get("/open"), flow("open", { do: () => ({ ok: true }) }));
     const app = oke({
       name: "gap",
       env: "local",

package/src/cli/ai-setup/ai-setup.test.ts

@@ -117,7 +117,9 @@ export default defineConfig({
     },
   },
   images: {
-    "store.sql": "postgres:18-alpine",
+    store: {
+      sql: "postgres:18-alpine",
+    },
   },
 });
 `,