@netnodeag/kraftwerk 0.64.0 → 0.66.0

package/dist/cli/kraftwerk.js

@@ -17,8 +17,9 @@ import { registerWorkspaceCommands } from "./workspaces.js";
 import { registerRepoCommands } from "./repos.js";
 import { registerVibeableCommands } from "./vibeables.js";
 import { registerTrashCommands } from "./trash.js";
+import { registerDevicesCommands } from "./devices.js";
+import { registerDaemonCommand } from "./daemon.js";
 import { registerJournalCommands } from "./journal.js";
-import { registerTunnelCommands } from "./tunnel.js";
 import { applyDotenv } from "../dotenv.js";
 import { resolveWorkspace } from "../config.js";
 import { registerRoutineCommands } from "./routines.js";
@@ -40,7 +41,8 @@ import { runUi } from "./ui.js";
  *   kraftwerk repos ...               repositories the agents work on (list/add/update/remove)
  *   kraftwerk journal <agent> [entry] an agent's memory across sessions: print it, add a line
  *   kraftwerk trash ...               what was deleted: list, restore, purge, empty
- *   kraftwerk tunnel [setup <host>]   Cloudflare Tunnel to the inspector: run it alone, or set one up
+ *   kraftwerk devices ...             paired devices: list, pair one, revoke one
+ *   kraftwerk daemon                  the machine's kraftwerk: every open workspace at <slug>.localhost
  *   kraftwerk doctor                  preflight: harness CLIs, docker, workflows, env
  *   kraftwerk validate [paths...]     validate without executing
  *
@@ -291,13 +293,16 @@ registerProjectCommands(program);
 registerRepoCommands(program);
 registerVibeableCommands(program);
 registerTrashCommands(program);
+registerDevicesCommands(program);
+registerDaemonCommand(program);
 registerJournalCommands(program);
-registerTunnelCommands(program);
 program
     .command("ui")
     .description("Start the inspector web UI for this project's runs and workflows")
     .option("--port <port>", "Port for the web UI (default: kraftwerk.yml `port`, else 1981)")
     .option("--output <dir>", "Output directory to inspect (default: the project's output dir)")
+    .option("--lan", "Listen on the network too, so paired devices (a phone) reach it — others get a pairing screen")
+    .option("--standalone", "Run a server of its own even when the kraftwerk daemon runs")
     .action(async (opts) => {
     await runUi(process.cwd(), opts);
 });

package/dist/cli/ui.d.ts

@@ -1,4 +1,13 @@
+/**
+ * Published packages ship web/dist. A dev checkout builds it on
+ * first use (and after frontend edits: `npm run build` in web/).
+ */
+export declare function ensureBuilt(): string;
 export declare function runUi(cwd: string, opts: {
     port?: string;
     output?: string;
+    lan?: boolean;
+    standalone?: boolean;
 }): Promise<void>;
+/** The respawn loop for any long-running kraftwerk process (`ui`, `daemon`): see superviseUi. */
+export declare function supervise(argv: string[], what: string): Promise<void>;

package/dist/cli/ui.js

@@ -4,10 +4,12 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawn, spawnSync } from "node:child_process";
 import chalk from "chalk";
-import { absolutePath, publicUrlFor, resolveWorkspace } from "../config.js";
-import { startTunnel } from "./tunnel.js";
+import { absolutePath, resolveWorkspace, workspaceSlug } from "../config.js";
+import { slugClashes } from "../core/instances.js";
+import { daemonCall, findDaemon } from "../core/daemon.js";
 import { selfCommand } from "../core/self-command.js";
 import { RESTART_EXIT_CODE, startInspector } from "../server/server.js";
+import { networkUrls } from "../server/bind.js";
 /**
  * `kraftwerk ui` — start the inspector web UI pointed at the current
  * project's output dir. The server is dependency-free node:http (part of
@@ -26,7 +28,10 @@ const packageRoot = () => path.join(path.dirname(fileURLToPath(import.meta.url))
  * Published packages ship web/dist. A dev checkout builds it on
  * first use (and after frontend edits: `npm run build` in web/).
  */
-function ensureBuilt() {
+export function ensureBuilt() {
+    // Another build of the web UI (tests serve a stub; a dev setup may point at its own).
+    if (process.env.KRAFTWERK_WEB_DIR)
+        return path.resolve(process.env.KRAFTWERK_WEB_DIR);
     const web = path.join(packageRoot(), "web");
     const dist = path.join(web, "dist");
     if (existsSync(path.join(dist, "index.html")))
@@ -49,19 +54,46 @@ function ensureBuilt() {
     return dist;
 }
 export async function runUi(cwd, opts) {
+    // The machine runs a daemon: hand it this workspace, it serves it next to the others.
+    if (!opts.standalone && !opts.port && !opts.output && !opts.lan && process.env.KRAFTWERK_UI_SUPERVISED !== "1") {
+        const daemon = await findDaemon();
+        if (daemon) {
+            const project = await resolveWorkspace(cwd);
+            const r = await daemonCall(daemon.port, "open", project.root);
+            if (!r.ok) {
+                console.error(chalk.red(`✖ the kraftwerk daemon refused: ${r.data.error ?? r.status}`));
+                process.exit(1);
+            }
+            console.log(`${chalk.green("✔")} Kraftwerk UI: ${chalk.cyan(r.data.url)} ${chalk.dim(`(served by the kraftwerk daemon, pid ${daemon.pid})`)}`);
+            if (r.data.aliasPort)
+                console.log(chalk.dim(`  also at http://localhost:${r.data.aliasPort}`));
+            console.log(chalk.dim("  `kraftwerk workspaces stop .` closes it there; `kraftwerk ui --standalone` runs a server of its own instead."));
+            return;
+        }
+    }
+    // The server reads its bind address when it starts — in the supervised child, which inherits this.
+    if (opts.lan)
+        process.env.KRAFTWERK_UI_HOST ||= "0.0.0.0";
     if (process.env.KRAFTWERK_UI_SUPERVISED !== "1")
-        return superviseUi(cwd, opts);
+        return superviseUi(opts);
     const staticDir = ensureBuilt();
     const project = await resolveWorkspace(cwd);
     const outputDir = opts.output ? absolutePath(opts.output, cwd) : project.outputDir;
     // Port precedence: --port flag > kraftwerk.yml `port` > 1981.
     const port = opts.port ? Number(opts.port) : (project.config.port ?? 1981);
     await startInspector({ outputDir, staticDir, port, root: project.root });
+    // Two workspaces with one slug would share an address once one kraftwerk serves them all.
+    const slug = workspaceSlug(project);
+    const clash = await slugClashes(slug, project.root);
+    if (clash.length)
+        console.log(`${chalk.yellow("⚠")} slug "${slug}" is also used by ${clash.map((r) => r.root).join(", ")} — set \`slug:\` in one kraftwerk.yml so each workspace keeps its own address`);
     console.log(`${chalk.green("✔")} Kraftwerk UI: ${chalk.cyan(`http://localhost:${port}`)} ` +
         chalk.dim(`(output: ${outputDir})`));
-    const publicUrl = publicUrlFor(project);
-    if (publicUrl)
-        console.log(`${chalk.green("✔")} Public URL: ${chalk.cyan(publicUrl)}`);
+    const lan = networkUrls(port);
+    if (lan.length) {
+        console.log(`${chalk.green("✔")} On your network: ${lan.map((u) => chalk.cyan(u)).join(", ")}`);
+        console.log(chalk.dim("  Devices there get a pairing screen — `kraftwerk devices pair` (or settings → devices) makes the code."));
+    }
 }
 /**
  * Respawn loop around the real server. Spawns this same bin script via the
@@ -72,25 +104,18 @@ export async function runUi(cwd, opts) {
  * workspaces start` reports) takes the whole UI down; Ctrl-C signals the
  * foreground group and reaches both anyway.
  */
-async function superviseUi(cwd, opts) {
-    const { cmd, args } = selfCommand([
-        "ui",
-        ...(opts.port ? ["--port", opts.port] : []),
-        ...(opts.output ? ["--output", opts.output] : []),
-    ]);
-    // The tunnel lives with the supervisor, not the server: a self-restart
-    // (new version) swaps the server process and the tunnel stays up.
-    const project = await resolveWorkspace(cwd).catch(() => null);
-    const tunnel = project ? startTunnel(project, opts.port ? Number(opts.port) : (project.config.port ?? 1981)) : undefined;
+async function superviseUi(opts) {
+    return supervise(["ui", "--standalone", ...(opts.port ? ["--port", opts.port] : []), ...(opts.output ? ["--output", opts.output] : [])], "the UI");
+}
+/** The respawn loop for any long-running kraftwerk process (`ui`, `daemon`): see superviseUi. */
+export async function supervise(argv, what) {
+    const { cmd, args } = selfCommand(argv);
     for (;;) {
         const child = spawn(cmd, args, {
             stdio: "inherit",
             env: { ...process.env, KRAFTWERK_UI_SUPERVISED: "1" },
         });
-        const forward = (sig) => () => {
-            tunnel?.stop();
-            child.kill(sig);
-        };
+        const forward = (sig) => () => child.kill(sig);
         const handlers = { SIGTERM: forward("SIGTERM"), SIGINT: forward("SIGINT") };
         process.on("SIGTERM", handlers.SIGTERM);
         process.on("SIGINT", handlers.SIGINT);
@@ -100,13 +125,12 @@ async function superviseUi(cwd, opts) {
         process.off("SIGTERM", handlers.SIGTERM);
         process.off("SIGINT", handlers.SIGINT);
         if (result.code !== RESTART_EXIT_CODE) {
-            tunnel?.stop();
             // A signal-killed server is not a clean exit — say so in the exit code
             // (128 + signal, the shell convention) so callers can tell.
             if (result.signal)
                 process.exit(128 + (os.constants.signals[result.signal] ?? 1));
             process.exit(result.code ?? 1);
         }
-        console.log(chalk.dim("↻ relaunching the UI with the current install ..."));
+        console.log(chalk.dim(`↻ relaunching ${what} with the current install ...`));
     }
 }

package/dist/cli/workspaces.js

@@ -50,7 +50,9 @@ async function resolveRef(ref, needRoot = true) {
         e.root === ref ||
         e.name === ref ||
         (e.root && path.basename(e.root) === ref) ||
-        e.url === port);
+        e.url === port ||
+        // A daemon's workspace by its slug: <slug>.localhost.
+        e.url.startsWith(`http://${ref}.localhost:`));
     if (hits.length === 1)
         return hits[0];
     if (hits.length === 0) {
@@ -117,8 +119,8 @@ export function registerWorkspaceCommands(program) {
     });
     workspaces
         .command("stop")
-        .description("Stop a running UI (SIGTERM to its server; works for terminal-started ones too)")
-        .argument("<ref>", "Workspace name, folder name, root path, or port")
+        .description("Stop a running UI (closes it in the kraftwerk daemon, or SIGTERM to a server of its own)")
+        .argument("<ref>", "Workspace name, slug, folder name, root path, or port")
         .action(async (ref) => {
         const entry = await resolveRef(ref, false);
         if (!entry.live) {

package/dist/client/index.d.ts

@@ -63,7 +63,20 @@ export declare function errorOf(body: unknown): string | undefined;
 export interface ClientOptions {
     /** Where the server is; "" (the default) is the page's own origin. */
     baseUrl?: string;
+    /**
+     * The workspace (its slug) to talk to, through the `/w/<slug>` path form.
+     * Leave it out when the address already names one (`<slug>.localhost`, or
+     * a server's own port).
+     */
+    workspace?: string;
     fetch?: typeof fetch;
+    /**
+     * A paired device's token (from `devices.pair`), sent as `Authorization:
+     * Bearer`. A browser needs none: pairing sets an HttpOnly cookie.
+     */
+    token?: string;
+    /** Called when the server says this device is not paired (401 `{pair: true}`) — show the pairing screen. */
+    onUnauthorized?: () => void;
 }
 export interface Client {
     call<N extends ApiName>(name: N, ...input: InputArg<N>): Promise<ApiResult<N>>;
@@ -72,5 +85,9 @@ export interface Client {
     url<N extends ApiName>(name: N, ...input: InputArg<N>): string;
     /** Called after every change this client made (a non-GET route that went through). */
     onChange(fn: () => void): () => void;
+    /** The token the client was created with, if any (the socket sends it too). */
+    readonly token?: string;
+    /** Where routes live: baseUrl plus the workspace's `/w/<slug>` prefix. */
+    readonly baseUrl: string;
 }
 export declare function createClient(opts?: ClientOptions): Client;

package/dist/client/index.js

@@ -17,7 +17,7 @@ export function errorOf(body) {
     return typeof error === "string" && error ? error : undefined;
 }
 export function createClient(opts = {}) {
-    const base = (opts.baseUrl ?? "").replace(/\/+$/, "");
+    const base = (opts.baseUrl ?? "").replace(/\/+$/, "") + (opts.workspace ? `/w/${encodeURIComponent(opts.workspace)}` : "");
     const doFetch = opts.fetch ?? ((...a) => fetch(...a));
     const changeFns = new Set();
     const url = (name, input = {}) => {
@@ -44,7 +44,11 @@ export function createClient(opts = {}) {
             cache: "no-store",
             signal,
             keepalive,
-            headers: { ...(body !== undefined && !raw ? { "content-type": "application/json" } : {}), ...headers },
+            headers: {
+                ...(body !== undefined && !raw ? { "content-type": "application/json" } : {}),
+                ...(opts.token ? { authorization: `Bearer ${opts.token}` } : {}),
+                ...headers,
+            },
             body: body === undefined ? undefined : raw ? body : JSON.stringify(body),
         });
         const text = await res.text();
@@ -56,9 +60,13 @@ export function createClient(opts = {}) {
         if (res.ok && method !== "GET")
             for (const fn of changeFns)
                 fn();
+        if (res.status === 401 && data?.pair === true)
+            opts.onUnauthorized?.();
         return res.ok ? { ok: true, status: res.status, data } : { ok: false, status: res.status, data, error: errorOf(data) };
     };
     return {
+        token: opts.token,
+        baseUrl: base,
         onChange(fn) {
             changeFns.add(fn);
             return () => changeFns.delete(fn);

package/dist/client/live.d.ts

@@ -25,9 +25,8 @@ export interface Live {
     close(): void;
 }
 export interface LiveOptions {
-    /** The HTTP client for fallbacks; its baseUrl is the server. */
+    /** The HTTP client: its baseUrl (workspace prefix included) is where the socket connects too. */
     client: Client;
-    baseUrl?: string;
     WebSocket?: typeof WebSocket;
     EventSource?: typeof EventSource;
 }

package/dist/client/live.js

@@ -12,8 +12,10 @@ export function createLive(opts) {
     let retry;
     let counter = 0;
     const socketUrl = () => {
-        const base = opts.baseUrl ?? (typeof location === "undefined" ? "" : location.origin);
-        return `${base.replace(/^http/, "ws").replace(/\/+$/, "")}/api/ws`;
+        // The client's base carries the workspace prefix; a relative one is on this page's origin.
+        const base = /^https?:/.test(client.baseUrl) ? client.baseUrl : (typeof location === "undefined" ? "" : location.origin) + client.baseUrl;
+        // A browser's socket carries the device cookie; other runtimes cannot send headers on a WebSocket, so the token rides in the query.
+        return `${base.replace(/^http/, "ws").replace(/\/+$/, "")}/api/ws${client.token ? `?token=${encodeURIComponent(client.token)}` : ""}`;
     };
     const send = (msg) => {
         if (connected)

package/dist/client/routes.d.ts

@@ -43,6 +43,11 @@ export declare const ROUTES: {
     readonly "chats.setVibeable": readonly ["POST", "/api/chats/:id/vibeable"];
     readonly "chats.steer": readonly ["POST", "/api/chats/:id/steer"];
     readonly "chats.stopTask": readonly ["POST", "/api/chats/:id/task-stop"];
+    readonly "devices.code": readonly ["POST", "/api/devices/code"];
+    readonly "devices.list": readonly ["GET", "/api/devices"];
+    readonly "devices.pair": readonly ["POST", "/api/pair"];
+    readonly "devices.revoke": readonly ["DELETE", "/api/devices/:id"];
+    readonly "devices.self": readonly ["GET", "/api/devices/self"];
     readonly "files.delete": readonly ["DELETE", "/api/files"];
     readonly "files.list": readonly ["GET", "/api/files/list"];
     readonly "files.mkdir": readonly ["POST", "/api/files/folder"];
@@ -57,6 +62,9 @@ export declare const ROUTES: {
     readonly "git.pull": readonly ["POST", "/api/git/pull"];
     readonly "git.push": readonly ["POST", "/api/git/push"];
     readonly "git.status": readonly ["GET", "/api/git"];
+    readonly "hub.close": readonly ["POST", "/api/hub/close"];
+    readonly "hub.list": readonly ["GET", "/api/hub"];
+    readonly "hub.open": readonly ["POST", "/api/hub/open"];
     readonly "knowledge.concept": readonly ["GET", "/api/knowledge/:bundle/concept"];
     readonly "knowledge.create": readonly ["POST", "/api/knowledge"];
     readonly "knowledge.delete": readonly ["DELETE", "/api/knowledge/:bundle"];

package/dist/client/routes.js

@@ -44,6 +44,11 @@ export const ROUTES = {
     "chats.setVibeable": ["POST", "/api/chats/:id/vibeable"],
     "chats.steer": ["POST", "/api/chats/:id/steer"],
     "chats.stopTask": ["POST", "/api/chats/:id/task-stop"],
+    "devices.code": ["POST", "/api/devices/code"],
+    "devices.list": ["GET", "/api/devices"],
+    "devices.pair": ["POST", "/api/pair"],
+    "devices.revoke": ["DELETE", "/api/devices/:id"],
+    "devices.self": ["GET", "/api/devices/self"],
     "files.delete": ["DELETE", "/api/files"],
     "files.list": ["GET", "/api/files/list"],
     "files.mkdir": ["POST", "/api/files/folder"],
@@ -58,6 +63,9 @@ export const ROUTES = {
     "git.pull": ["POST", "/api/git/pull"],
     "git.push": ["POST", "/api/git/push"],
     "git.status": ["GET", "/api/git"],
+    "hub.close": ["POST", "/api/hub/close"],
+    "hub.list": ["GET", "/api/hub"],
+    "hub.open": ["POST", "/api/hub/open"],
     "knowledge.concept": ["GET", "/api/knowledge/:bundle/concept"],
     "knowledge.create": ["POST", "/api/knowledge"],
     "knowledge.delete": ["DELETE", "/api/knowledge/:bundle"],

package/dist/config.d.ts

@@ -12,6 +12,7 @@
  *   name: my-project           # display name (inspector header, "environment")
  *   icon: "⚡"                  # emoji shown as inspector favicon
  *   color: "#c2410c"           # accent for this workspace in the switcher (default: derived from the root)
+ *   slug: team-blau            # this workspace's address (team-blau.localhost); default: the folder name
  *   port: 1981                 # port `kraftwerk ui` listens on
  *   workflows: src/workflows   # workflows root, relative to the file
  *   output: output             # run-artifact directory, relative to the file
@@ -32,12 +33,6 @@
   *     root: apps               # one folder per app, part of the workspace. Default: kraftwerk-data/vibeables
  *   projects:                  # goal-scoped folders (brief, systems of record, links) that chats work in (absent = off, bare key = on)
  *     root: kraftwerk-data/projects   # one folder per project, part of the workspace. Default: kraftwerk-data/projects
- *   public: https://kw.example.com   # hostname the inspector is reached at through a tunnel or reverse proxy
- *   tunnel:                    # Cloudflare Tunnel run by `kraftwerk ui` (absent = off, bare key = on)
- *     name: kraftwerk          # locally-managed tunnel (cloudflared tunnel create); absent: TUNNEL_TOKEN env, dashboard-managed
- *     access:                  # verify the Cloudflare Access login on every request that arrives via `public`
- *       team: acme             # Zero Trust team name (https://<team>.cloudflareaccess.com)
- *       aud: 4714c135…         # Application Audience tag of the Access application
  *   cloud:                     # kraftwerk cloud manager — ON BY DEFAULT, `enabled: false` opts out
  *     url: https://srv.kraftwerk-cloud.netnode.cloud   # where the cloud answers (default). KRAFTWERK_CLOUD_URL env wins; "off" disables
  *     interval: 60             # seconds between heartbeats. Default: 60
@@ -126,39 +121,6 @@ export interface ProjectsConfig {
 export declare const PROJECTS_DEFAULT_ROOT = "kraftwerk-data/projects";
 /** Absolute projects root when the feature is on, undefined otherwise. */
 export declare function projectsRootFor(project: ResolvedWorkspace): string | undefined;
-/**
- * Cloudflare Access in front of the public hostname. Access puts a login
- * page on the hostname at Cloudflare's edge and hands the origin a signed
- * JWT per request (Cf-Access-Jwt-Assertion). With this block the inspector
- * verifies that token itself, so a removed or misconfigured Access policy
- * fails closed instead of exposing the UI, which has no login of its own.
- */
-export interface AccessConfig {
-    /** Zero Trust team name: the subdomain of https://<team>.cloudflareaccess.com */
-    team: string;
-    /** Application Audience (AUD) tag of the Access application, from its overview page. */
-    aud: string;
-}
-/**
- * Cloudflare Tunnel: `kraftwerk ui` runs cloudflared next to the inspector
- * so the loopback bind is reachable at `public` without an open port. The
- * tunnel itself is created once with cloudflared (or in the Zero Trust
- * dashboard); this block only says which one to run.
- */
-export interface TunnelConfig {
-    /** false keeps the block but turns the feature off. Default: true. */
-    enabled?: boolean;
-    /**
-     * Name of a locally-managed tunnel (`cloudflared tunnel create <name>`,
-     * `cloudflared tunnel route dns <name> <public host>`); cloudflared routes
-     * everything to the inspector port. Absent: a dashboard-managed tunnel,
-     * whose token comes from the TUNNEL_TOKEN environment variable and whose
-     * route to http://localhost:<port> is configured in the dashboard.
-     */
-    name?: string;
-    /** Verify the Cloudflare Access token on every request that arrives via `public`. */
-    access?: AccessConfig;
-}
 /**
  * Cloud manager: the kraftwerk cloud is ~/.kraftwerk made reachable over
  * the internet — a registry of instances across machines. Every inspector
@@ -189,14 +151,6 @@ export interface CloudSettings {
 }
 /** The effective cloud settings when the feature is on; undefined when kraftwerk.yml or the environment turned it off. */
 export declare function cloudFor(project: ResolvedWorkspace): CloudSettings | undefined;
-/** The public hostname (lowercase, no port) when `public` is set, undefined otherwise. */
-export declare function publicHostFor(project: ResolvedWorkspace): string | undefined;
-/** The public origin ("https://kw.example.com") when `public` is set, undefined otherwise. */
-export declare function publicUrlFor(project: ResolvedWorkspace): string | undefined;
-/** The tunnel block when the feature is on, undefined otherwise. */
-export declare function tunnelFor(project: ResolvedWorkspace): TunnelConfig | undefined;
-/** "kw.example.com" or "https://kw.example.com[:port]" → its URL; undefined when it is neither. */
-export declare function parsePublic(value: string): URL | undefined;
 /** A directory as a .gitignore entry: relative, forward slashes, no trailing slash; undefined outside the root. */
 export declare function ignoreEntryFor(projectRoot: string, dir: string): string | undefined;
 /** True when .gitignore text already covers the entry (with or without a leading or trailing slash). */
@@ -213,6 +167,12 @@ export interface SwitcherEntry {
 export interface WorkspaceConfig {
     /** Display name of the project ("environment"), shown in the inspector header. */
     name?: string;
+    /**
+     * The workspace's address on this machine: `<slug>.localhost`, `/w/<slug>/`.
+     * Unique per machine. Default: the folder name (see workspaceSlug). The
+     * name above may change freely; the slug only when you mean to move it.
+     */
+    slug?: string;
     /** Emoji used as the inspector favicon (browser-tab icon). */
     icon?: string;
     /** Accent colour (#rgb / #rrggbb) for this workspace in the switcher. Default: derived from the root path. */
@@ -239,14 +199,6 @@ export interface WorkspaceConfig {
     vibeables?: VibeablesConfig;
     /** Projects: goal-scoped folders the chats work in. Absent = off. */
     projects?: ProjectsConfig;
-    /**
-     * Hostname the inspector is reached at through a tunnel or reverse proxy,
-     * e.g. "https://kw.example.com". The loopback bind then answers requests
-     * carrying that Host even without X-Forwarded-Host (cloudflared sends none).
-     */
-    public?: string;
-    /** Cloudflare Tunnel run alongside the inspector. Absent = off. */
-    tunnel?: TunnelConfig;
     /** kraftwerk cloud manager this instance registers with. Absent = on with defaults; `enabled: false` opts out. */
     cloud?: CloudConfig;
 }
@@ -261,6 +213,8 @@ export interface ResolvedWorkspace {
     workflowsRoot?: string;
     /** Absolute run-artifact directory (may not exist yet). */
     outputDir: string;
+    /** Keys in kraftwerk.yml that an older kraftwerk read and this one ignores (`public`, `tunnel`), for doctor. Absent when none. */
+    legacyKeys?: string[];
 }
 /** True when the path exists and is a directory. */
 /**
@@ -287,3 +241,12 @@ export declare const resolveProject: typeof resolveWorkspace;
 export type Project = ResolvedWorkspace;
 /** @deprecated Use `WorkspaceConfig`. */
 export type ProjectConfig = WorkspaceConfig;
+/** A folder name as a slug: "Team Blau (2024)" → "team-blau-2024". */
+export declare function slugFromFolder(folder: string): string;
+/** The workspace's slug: kraftwerk.yml `slug`, else its folder name made into one. */
+export declare function workspaceSlug(ws: {
+    root: string;
+    config: {
+        slug?: string;
+    };
+}): string;