@nylorun/runtime 0.3.0-beta → 0.4.0-beta

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.4.0-beta
+
+### Minor Changes
+
+- fa1860a: Use standard MODEL_PROVIDER, MODEL, MODEL_PROVIDER_API_KEY, and MODEL_PROVIDER_BASE_URL environment configuration. Export starter Hono apps and provide CLI development and production Node launchers. Existing starters require manual migration. Release preparation must update the creator Runtime compatibility pin with this release.
+
 ## 0.3.0-beta
 
 ### Minor Changes

package/README.md

@@ -29,18 +29,37 @@ Pass explicit `basePath` when a reverse proxy rewrites the public prefix.
 
 - `nylorun configure`
 - `nylorun dev [--no-studio] [--no-open]`
+- `nylorun start [entry]` (default: `dist/src/index.js`)
 - `nylorun studio --agent-url http://localhost:3000/agents [--port 4161] [--no-open]`
 
-Studio attaches to an application you run. Use your own TypeScript/build tooling and a Node adapter such as `@hono/node-server` when applicable. `projectAsset("agents/skills/catalog")` resolves bundled application assets from source or a compiled `dist/` deployment.
+Export your Hono application with `export default app`. The CLI supplies the Node server adapter. `nylorun dev` watches `src/index.ts`, waits for `/agents/v1/agents`, and starts project-local Studio. `PORT` defaults to 3000. `--no-studio` runs only the application; `--no-open` keeps the browser closed. Ctrl-C stops both processes. `nylorun start` serves the built app without Studio or development CORS.
 
-Provider credentials are stored in `.env/auth.json`, and selection in `.env/model.json`. `nylorun configure` can run before an agent graph is importable.
+### Environment configuration
 
-`nylorun dev` runs project-local `tsx watch src/index.ts`, waits for `/agents/v1/agents`, then starts project-local Studio. `PORT` defaults to 3000. `--no-studio` runs just the application; `--no-open` keeps the browser closed. Both flags can be combined. Ctrl-C stops both processes.
+Copy `.env.example` to `.env` and fill it in, or run `nylorun configure` before your agent graph is importable:
+
+```dotenv
+MODEL_PROVIDER=custom
+MODEL=your-model-id
+MODEL_PROVIDER_API_KEY=your-key
+MODEL_PROVIDER_BASE_URL=https://your-provider.example/v1
+```
+
+`MODEL_PROVIDER_BASE_URL` is required only for `MODEL_PROVIDER=custom`; omit it for built-in providers. `configure`, `dev`, and `start` load `.env` before importing the app. Existing process variables win; a missing `.env` is valid. `.env.local` is ignored by Git but is not automatically loaded. Direct imports of Runtime do not load dotenv files.
+
+Explicit `piModel({ selection })` options take precedence over environment selection. Environment selection takes precedence over legacy files; incomplete selection produces an error. `MODEL_PROVIDER_API_KEY` overrides provider-native variables such as `OPENAI_API_KEY` and `ANTHROPIC_API_KEY`, which override stored credentials. API-key deployments require no credential files. Supply the same variables through your hosting provider's environment settings.
+
+The optional wizard writes selection and entered API keys to `.env`, preserving unrelated configuration. It reuses environment credentials without copying them into the file. OAuth is an alternative where supported; its credentials and refresh state live in ignored `.nylorun/auth.json`. Keep `.env` and `.nylorun/` private.
 
 ### Upgrading an existing starter
 
-After upgrading Runtime to a release containing `nylorun dev`, change the development script to `"dev": "nylorun dev"` and remove `dev:app` and `scripts/dev.mjs`. Remove the duplicated `basePath` option for normal Hono mounts.
+Migration is manual; the CLI will not replace a legacy `.env` directory.
+
+1. Back up the existing `.env/` directory to a private location outside the project before replacing it with a file. Preserve any `config/model.json` too.
+2. Translate `model.json` fields `provider`, `model`, and `custom.baseUrl` into `MODEL_PROVIDER`, `MODEL`, and `MODEL_PROVIDER_BASE_URL`. Copy API keys into `MODEL_PROVIDER_API_KEY` or provider-native variables. Replace the old `NYLO_CUSTOM_API_KEY` variable with `MODEL_PROVIDER_API_KEY`.
+3. Merge `integrations.env` variables into `.env`. Move OAuth records into `.nylorun/auth.json`. Add `.env`, `.env.local`, and `.nylorun/` to `.gitignore`; remove the old `.env/` exceptions.
+4. Replace the entrypoint's `serve(...)` call and Node adapter import with `export default app`. Set scripts to `"dev": "nylorun dev"` and `"start": "nylorun start"`. Remove the application's `@hono/node-server` dependency if unused elsewhere. Keep your build and asset-copy steps.
 
-Run `npm run configure` to move model selection to `.env/model.json`. Runtime reads the legacy `config/model.json` only when the new file is absent. Successful configuration removes the legacy file and its directory only if empty; credentials remain in `.env/auth.json`. Do not set `NYLORUN_DEV` in production.
+Runtime retains legacy `.env/model.json`, `config/model.json`, and `.env/auth.json` reads for existing applications using their own launcher. It does not automatically move or delete these files. Use the matching Runtime release pinned by the new creator; older releases cannot launch an exported app.
 
-The starter now uses one `tsconfig.json` with `rootDir: "."` and `outDir: "dist"`. Remove `noEmit` from that file and use `tsc --noEmit` for checks. Change the build's compiler invocation to `tsc -p tsconfig.json` before deleting `tsconfig.build.json`. Keep your existing asset-copy step. Projects whose checks include tests may retain separate build configuration.
+The exported app follows Hono composition conventions. This change does not establish verified serverless persistence, execution lifetime, or Workers support. `projectAsset()` resolves bundled assets from source or compiled deployments.

package/dist/cli.js

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
-import { existsSync } from "node:fs";
-import { loadEnvFile } from "node:process";
 import { join } from "node:path";
 import { pathToFileURL } from "node:url";
 import { createRequire } from "node:module";
 import { ConfigurationCancelled, configureProvider, } from "./model/configure.js";
+import { loadProjectEnvironment } from "./environment.js";
 import { develop } from "./dev.js";
-const usage = `nylorun <configure|dev|studio>
+const usage = `nylorun <configure|dev|start|studio>
   dev [--no-studio] [--no-open]
+  start [entry]
   configure
   studio --agent-url <http(s)-url> [--port <n>] [--no-open]`;
 async function startStudio(agentServerUrl, open, port) {
@@ -37,6 +37,14 @@ async function main() {
     const [command, ...args] = process.argv.slice(2);
     if (!command || command === "--help" || command === "-h")
         return void console.log(usage);
+    if (["configure", "dev", "start"].includes(command))
+        loadProjectEnvironment();
+    if (command === "start") {
+        if (args.length > 1 || args[0]?.startsWith("--"))
+            throw new Error(usage);
+        await (await import("./launcher.js")).start(args[0]);
+        return;
+    }
     if (command === "dev") {
         process.exitCode = await develop(args);
         return;
@@ -48,9 +56,6 @@ async function main() {
         const cancel = (signal) => controller.abort(new ConfigurationCancelled(signal));
         process.once("SIGINT", () => cancel("SIGINT"));
         process.once("SIGTERM", () => cancel("SIGTERM"));
-        const integrations = join(process.cwd(), ".env", "integrations.env");
-        if (existsSync(integrations))
-            loadEnvFile(integrations);
         await configureProvider({ signal: controller.signal });
         return;
     }

package/dist/dev-entry.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/dev-entry.js

@@ -0,0 +1,2 @@
+import { start } from "./launcher.js";
+await start(process.argv[2] ?? "src/index.ts", true);

package/dist/dev.js

@@ -69,7 +69,12 @@ export async function develop(args) {
         }));
     };
     try {
-        launch([tsx, "watch", "src/index.ts"]);
+        launch([
+            tsx,
+            "watch",
+            fileURLToPath(new URL("./dev-entry.js", import.meta.url)),
+            "src/index.ts",
+        ]);
         if (!args.includes("--no-studio")) {
             const url = `http://127.0.0.1:${port}/agents/v1/agents`;
             const deadline = Date.now() + 20_000;

package/dist/environment.d.ts

@@ -0,0 +1,2 @@
+export declare function loadProjectEnvironment(root?: string): void;
+export declare function saveEnvironment(root: string, updates: Record<string, string | undefined>, signal?: AbortSignal): Promise<void>;

package/dist/environment.js

@@ -0,0 +1,64 @@
+import { readFileSync, statSync } from "node:fs";
+import { writeFile, rename, rm } from "node:fs/promises";
+import { join } from "node:path";
+import { randomUUID } from "node:crypto";
+import { loadEnvFile } from "node:process";
+export function loadProjectEnvironment(root = process.cwd()) {
+    const file = join(root, ".env");
+    try {
+        if (statSync(file).isDirectory())
+            throw new Error("The .env directory must be migrated manually: back it up, create a .env file with MODEL_PROVIDER, MODEL and MODEL_PROVIDER_API_KEY, and move OAuth credentials to .nylorun/auth.json. See the Runtime migration guide.");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return;
+        throw error;
+    }
+    loadEnvFile(file);
+}
+// Match complete dotenv assignments, including quoted multiline values.
+const assignment = /^(?:export\s+)?([\w]+)[\t ]*=[\t ]*(?:"[^"]*"|'[^']*'|`[^`]*`|[^#\r\n]*)([^\r\n]*)(?:\r?\n|$)/gm;
+export async function saveEnvironment(root, updates, signal) {
+    const file = join(root, ".env");
+    let contents = "";
+    try {
+        contents = readFileSync(file, "utf8");
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    const encode = (value) => {
+        // Node's dotenv parser has no general quote-escaping syntax. Select a
+        // delimiter absent from the value rather than changing the credential.
+        for (const quote of ["'", '"', "`"]) {
+            if (!value.includes(quote) && !(quote === '"' && /\\[nr]/.test(value)))
+                return quote + value + quote;
+        }
+        throw new Error("This value contains all dotenv quote delimiters; set it through your process environment instead.");
+    };
+    const remaining = new Set(Object.keys(updates));
+    contents = contents.replace(assignment, (whole, key, suffix) => {
+        if (!(key in updates))
+            return whole;
+        if (!remaining.delete(key))
+            return "";
+        return updates[key] === undefined
+            ? ""
+            : `${key}=${encode(updates[key])}${suffix}\n`;
+    });
+    if (contents && !contents.endsWith("\n"))
+        contents += "\n";
+    for (const key of remaining)
+        if (updates[key] !== undefined)
+            contents += `${key}=${encode(updates[key])}\n`;
+    const temporary = join(root, `.env-${randomUUID()}.tmp`);
+    try {
+        await writeFile(temporary, contents, { mode: 0o600, signal });
+        signal?.throwIfAborted();
+        await rename(temporary, file);
+    }
+    finally {
+        await rm(temporary, { force: true });
+    }
+}

package/dist/launcher.d.ts

@@ -0,0 +1 @@
+export declare function start(entry?: string, development?: boolean): Promise<void>;

package/dist/launcher.js

@@ -0,0 +1,28 @@
+import { serve } from "@hono/node-server";
+import { resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { loadProjectEnvironment } from "./environment.js";
+export async function start(entry = "dist/src/index.js", development = false) {
+    loadProjectEnvironment();
+    if (development)
+        process.env.NYLORUN_DEV = "1";
+    else
+        delete process.env.NYLORUN_DEV;
+    const port = Number(process.env.PORT ?? "3000");
+    if (!Number.isInteger(port) || port < 1 || port > 65535)
+        throw new Error("PORT must be an integer between 1 and 65535.");
+    const { default: app } = await import(pathToFileURL(resolve(entry)).href);
+    if (!app || typeof app.fetch !== "function")
+        throw new Error(`${entry} must export a Hono application with 'export default app' and a callable fetch.`);
+    const server = serve({ fetch: app.fetch.bind(app), port }, (info) => {
+        console.log(`Server is running on http://localhost:${info.port}`);
+    });
+    const stop = () => {
+        process.removeListener("SIGINT", stop);
+        process.removeListener("SIGTERM", stop);
+        server.close(() => process.exit(0));
+        setTimeout(() => process.exit(0), 5_000).unref();
+    };
+    process.once("SIGINT", stop);
+    process.once("SIGTERM", stop);
+}

package/dist/model/auth-store.d.ts

@@ -2,7 +2,8 @@ import type { Credential, CredentialInfo, CredentialStore } from "@earendil-work
 export declare class ProjectCredentialStore implements CredentialStore {
     #private;
     private readonly file;
-    constructor(file?: string);
+    private readonly legacyFile?;
+    constructor(file?: string, legacyFile?: string | undefined);
     read(providerId: string): Promise<Credential | undefined>;
     list(): Promise<readonly CredentialInfo[]>;
     modify(providerId: string, fn: (current: Credential | undefined) => Promise<Credential | undefined>): Promise<Credential | undefined>;

package/dist/model/auth-store.js

@@ -1,10 +1,13 @@
+var _a;
 import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 export class ProjectCredentialStore {
     file;
+    legacyFile;
     #chain = Promise.resolve();
-    constructor(file = join(process.cwd(), ".env", "auth.json")) {
+    constructor(file = join(process.cwd(), ".nylorun", "auth.json"), legacyFile) {
         this.file = file;
+        this.legacyFile = legacyFile;
     }
     async read(providerId) {
         return (await this.#all())[providerId];
@@ -54,8 +57,11 @@ export class ProjectCredentialStore {
             return JSON.parse(await readFile(this.file, "utf8"));
         }
         catch (error) {
-            if (error.code === "ENOENT")
+            if (["ENOENT", "ENOTDIR"].includes(error.code ?? "")) {
+                if (this.legacyFile)
+                    return new _a(this.legacyFile).#all();
                 return {};
+            }
             throw error;
         }
     }
@@ -83,3 +89,4 @@ export class ProjectCredentialStore {
         }
     }
 }
+_a = ProjectCredentialStore;

package/dist/model/configure.js

@@ -1,7 +1,6 @@
-import { mkdir, writeFile, rename, rm, rmdir } from "node:fs/promises";
-import { randomUUID } from "node:crypto";
 import { join } from "node:path";
 import { createInterface } from "node:readline/promises";
+import { saveEnvironment } from "../environment.js";
 import { ProjectCredentialStore } from "./auth-store.js";
 import { modelsFor } from "./models.js";
 export class ConfigurationCancelled extends Error {
@@ -21,7 +20,25 @@ export async function configureProvider(options = {}) {
     const signal = controller.signal;
     const forwardAbort = () => controller.abort(options.signal.reason);
     options.signal?.throwIfAborted();
-    const store = new ProjectCredentialStore(join(root, ".env", "auth.json"));
+    let enteredKey;
+    let enteredEnvironment = {};
+    const oauthStore = new ProjectCredentialStore(join(root, ".nylorun", "auth.json"), join(root, ".env", "auth.json"));
+    const store = {
+        read: (id) => oauthStore.read(id),
+        list: () => oauthStore.list(),
+        delete: (id) => oauthStore.delete(id),
+        async modify(id, fn) {
+            const next = await fn(await oauthStore.read(id));
+            if (next?.type === "api_key") {
+                if (next.key === "")
+                    throw new Error("An API key is required.");
+                enteredKey = next.key;
+                enteredEnvironment = { ...next.env };
+                return next;
+            }
+            return oauthStore.modify(id, async () => next);
+        },
+    };
     const models = modelsFor({ provider: "", model: "" }, store);
     const providers = models.getProviders();
     const prompt = createInterface({
@@ -59,7 +76,8 @@ export async function configureProvider(options = {}) {
                 custom: { baseUrl },
             };
             const customModels = modelsFor(selection, store);
-            await customModels.login("custom", "api_key", interaction());
+            if (!(await customModels.checkAuth("custom", { signal })))
+                await customModels.login("custom", "api_key", interaction());
             await save(selection);
         }
         else {
@@ -72,7 +90,17 @@ export async function configureProvider(options = {}) {
             if (!model)
                 throw new Error("Choose a listed model.");
             if (!(await models.checkAuth(chosen.id, { signal }))) {
-                await models.login(chosen.id, chosen.auth.oauth ? "oauth" : "api_key", interaction());
+                let method = chosen.auth.apiKey
+                    ? "api_key"
+                    : "oauth";
+                if (chosen.auth.apiKey && chosen.auth.oauth) {
+                    const answer = (await question("Choose authentication: 1. API key (default), 2. OAuth: ")).trim();
+                    if (answer && !["1", "2"].includes(answer))
+                        throw new Error("Choose authentication 1 or 2.");
+                    if (answer === "2")
+                        method = "oauth";
+                }
+                await models.login(chosen.id, method, interaction());
             }
             await save({ provider: chosen.id, model: model.id });
         }
@@ -92,34 +120,36 @@ export async function configureProvider(options = {}) {
     function interaction() {
         return {
             signal,
-            prompt: async (item) => question(item.message + ": "),
-            notify: (event) => output.write((event.url ?? event.verificationUri ?? event.message) + "\n"),
+            prompt: async (item) => {
+                if (item.type !== "select")
+                    return question(item.message + ": ");
+                item.options.forEach((option, index) => output.write(`${index + 1}. ${option.label}\n`));
+                const answer = (await question(item.message + " ")).trim();
+                const option = item.options.find((option) => option.id === answer) ??
+                    item.options[Number(answer) - 1];
+                if (!option)
+                    throw new Error("Choose a listed authentication option.");
+                return option.id;
+            },
+            notify: (event) => {
+                output.write(("url" in event
+                    ? event.url
+                    : "verificationUri" in event
+                        ? event.verificationUri
+                        : event.message) + "\n");
+            },
         };
     }
     async function save(selection) {
         signal.throwIfAborted();
-        const directory = join(root, ".env");
-        const temporary = join(directory, `.model-${randomUUID()}.json`);
-        try {
-            await mkdir(directory, { recursive: true });
-            await writeFile(temporary, JSON.stringify(selection, null, 2) + "\n", {
-                signal,
-            });
-            signal.throwIfAborted();
-            await rename(temporary, join(directory, "model.json"));
-            await rm(join(root, "config", "model.json"), { force: true });
-            try {
-                await rmdir(join(root, "config"));
-            }
-            catch (error) {
-                if (!(error instanceof Error) ||
-                    !("code" in error) ||
-                    !["ENOENT", "ENOTEMPTY", "EEXIST"].includes(String(error.code)))
-                    throw error;
-            }
-        }
-        finally {
-            await rm(temporary, { force: true });
-        }
+        await saveEnvironment(root, {
+            ...enteredEnvironment,
+            MODEL_PROVIDER: selection.provider,
+            MODEL: selection.model,
+            MODEL_PROVIDER_BASE_URL: selection.custom?.baseUrl,
+            ...(enteredKey === undefined
+                ? {}
+                : { MODEL_PROVIDER_API_KEY: enteredKey }),
+        }, signal);
     }
 }

package/dist/model/models.d.ts

@@ -1,4 +1,4 @@
-import type { ProjectCredentialStore } from "./auth-store.js";
+import { type CredentialStore } from "@earendil-works/pi-ai";
 export type Selection = Readonly<{
     provider: string;
     model: string;
@@ -6,4 +6,4 @@ export type Selection = Readonly<{
         baseUrl: string;
     }>;
 }>;
-export declare function modelsFor(selection: Selection, credentials: ProjectCredentialStore): import("@earendil-works/pi-ai").MutableModels;
+export declare function modelsFor(selection: Selection, credentials: CredentialStore): import("@earendil-works/pi-ai").MutableModels;

package/dist/model/models.js

@@ -1,8 +1,29 @@
-import { createProvider, envApiKeyAuth, } from "@earendil-works/pi-ai";
+import { createProvider, defaultProviderAuthContext, envApiKeyAuth, } from "@earendil-works/pi-ai";
 import { stream, streamSimple, } from "@earendil-works/pi-ai/api/openai-completions";
 import { builtinModels } from "@earendil-works/pi-ai/providers/all";
 export function modelsFor(selection, credentials) {
-    const models = builtinModels({ credentials });
+    const environmentFirst = {
+        async read(providerId, options) {
+            const explicit = process.env.MODEL_PROVIDER_API_KEY;
+            if (explicit &&
+                (!selection.provider || selection.provider === providerId))
+                return { type: "api_key", key: explicit };
+            const provider = models
+                .getProviders()
+                .find((item) => item.id === providerId);
+            const ambient = await provider?.auth.apiKey?.resolve({
+                ctx: defaultProviderAuthContext(),
+                signal: options?.signal ?? new AbortController().signal,
+            });
+            if (ambient)
+                return undefined;
+            return credentials.read(providerId, options);
+        },
+        list: (options) => credentials.list(options),
+        modify: (id, fn, options) => credentials.modify(id, fn, options),
+        delete: (id, options) => credentials.delete(id, options),
+    };
+    const models = builtinModels({ credentials: environmentFirst });
     if (!selection.custom)
         return models;
     const model = {
@@ -22,7 +43,7 @@ export function modelsFor(selection, credentials) {
         name: "Custom OpenAI-compatible",
         baseUrl: selection.custom.baseUrl,
         auth: {
-            apiKey: envApiKeyAuth("Custom API key", ["NYLO_CUSTOM_API_KEY"]),
+            apiKey: envApiKeyAuth("Custom API key", ["MODEL_PROVIDER_API_KEY"]),
         },
         models: [model],
         api: { stream, streamSimple },

package/dist/model/pi-model.js

@@ -17,7 +17,7 @@ export function piModel(options = {}) {
         context.signal.throwIfAborted();
         const root = options.root ?? process.cwd();
         const selection = options.selection ?? modelSelection(root);
-        const registry = modelsFor(selection, new ProjectCredentialStore(join(root, ".env", "auth.json")));
+        const registry = modelsFor(selection, new ProjectCredentialStore(join(root, ".nylorun", "auth.json"), join(root, ".env", "auth.json")));
         const selected = registry.getModel(selection.provider, selection.model);
         if (!selected)
             throw new Error("Unknown model. Run nylorun configure.");

package/dist/model/settings.js

@@ -1,6 +1,27 @@
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 export function modelSelection(root = process.cwd()) {
+    const { MODEL_PROVIDER: provider, MODEL: model, MODEL_PROVIDER_BASE_URL: baseUrl, } = process.env;
+    if (provider !== undefined || model !== undefined || baseUrl !== undefined) {
+        if (!provider?.trim() || !model?.trim())
+            throw new Error("Set both MODEL_PROVIDER and MODEL, or run nylorun configure.");
+        if (provider === "custom" && !baseUrl?.trim())
+            throw new Error("Set MODEL_PROVIDER_BASE_URL for MODEL_PROVIDER=custom.");
+        if (baseUrl && provider !== "custom")
+            throw new Error("MODEL_PROVIDER_BASE_URL requires MODEL_PROVIDER=custom.");
+        if (baseUrl) {
+            let url;
+            try {
+                url = new URL(baseUrl);
+            }
+            catch {
+                throw new Error("MODEL_PROVIDER_BASE_URL must be an HTTP(S) URL.");
+            }
+            if (!["http:", "https:"].includes(url.protocol))
+                throw new Error("MODEL_PROVIDER_BASE_URL must be an HTTP(S) URL.");
+        }
+        return { provider, model, ...(baseUrl ? { custom: { baseUrl } } : {}) };
+    }
     try {
         let contents;
         try {
@@ -9,7 +30,7 @@ export function modelSelection(root = process.cwd()) {
         catch (error) {
             if (!(error instanceof Error) ||
                 !("code" in error) ||
-                error.code !== "ENOENT")
+                !["ENOENT", "ENOTDIR"].includes(String(error.code)))
                 throw error;
             contents = readFileSync(join(root, "config", "model.json"), "utf8");
         }
@@ -30,17 +51,18 @@ export function projectSecrets(root = process.cwd()) {
     const values = Object.entries(process.env)
         .filter(([key]) => /key|token|secret|password|credential/i.test(key))
         .flatMap(([, value]) => (value ? [value] : []));
-    try {
-        const collect = (value) => {
-            if (typeof value === "string")
-                values.push(value);
-            else if (value && typeof value === "object")
-                Object.values(value).forEach(collect);
-        };
-        collect(JSON.parse(readFileSync(join(root, ".env", "auth.json"), "utf8")));
-    }
-    catch {
-        /* The vault may not exist before setup. */
-    }
+    for (const directory of [".nylorun", ".env"])
+        try {
+            const collect = (value) => {
+                if (typeof value === "string")
+                    values.push(value);
+                else if (value && typeof value === "object")
+                    Object.values(value).forEach(collect);
+            };
+            collect(JSON.parse(readFileSync(join(root, directory, "auth.json"), "utf8")));
+        }
+        catch {
+            /* The vault may not exist before setup. */
+        }
     return values;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nylorun/runtime",
-  "version": "0.3.0-beta",
+  "version": "0.4.0-beta",
   "description": "Portable agent runtime, Hono protocol router, model providers, and the Nylorun CLI.",
   "type": "module",
   "license": "Apache-2.0",
@@ -39,7 +39,8 @@
     "prepack": "npm run build"
   },
   "dependencies": {
-    "@earendil-works/pi-ai": "0.85.1"
+    "@earendil-works/pi-ai": "0.85.1",
+    "@hono/node-server": "^2.1.1"
   },
   "peerDependencies": {
     "hono": "^4.13.7"