Without the facade

The facade is the recommended default, not a requirement. The facade root, RoundlyConsulting\Onboarding\OnboardingManager, is a container singleton — inject it through the constructor for exactly the same API, as an explicit dependency with no static calls:

use Illuminate\Http\JsonResponse;
use Illuminate\Http\RedirectResponse;
use Illuminate\Http\Request;
use RoundlyConsulting\Onboarding\OnboardingManager;

final class OnboardingController
{
    public function __construct(private OnboardingManager $onboarding) {}

    public function show(Request $request): JsonResponse
    {
        return response()->json($this->onboarding->for($request->user())?->toData());
    }

    public function dismiss(Request $request, string $step): RedirectResponse
    {
        $this->onboarding->for($request->user())?->dismiss($step);

        return back();
    }
}

Onboarding::fake() swaps the container binding as well as the facade, so an injected OnboardingManager gets the fake too.

No action classes

Unlike most Roundly packages, Onboarding ships no actions to compose: flows and steps are declarative, and the manager registers, resolves and persists them. The facade and the injected manager are the two entry points.

Manager methods

dismissStep(Flow $flow, string $step) is public but @internal — the single path every dismissal takes, so the fake sees them all. Dismiss through Flow::dismiss() or $user->dismissOnboardingStep() instead.