nylorun 0.12.1-beta → 0.13.0-beta

package/dist/client/model/configure.js

@@ -0,0 +1,294 @@
+import { createInterface } from "node:readline/promises";
+import { randomUUID } from "node:crypto";
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { nylorunHome } from "@nylorun/core/project";
+import { CliError } from "../../errors.js";
+import { loadPiAi } from "./pi-ai.js";
+/** Exit 130 on SIGINT, 143 on SIGTERM. */
+export class ConfigurationCancelled extends CliError {
+    signal;
+    constructor(signal) {
+        super(`Provider configuration cancelled (${signal}).`, signal === "SIGINT" ? 130 : 143);
+        this.signal = signal;
+        this.name = "ConfigurationCancelled";
+    }
+}
+/**
+ * Build a pi-ai registry for interactive login. Catalog listing prefers the
+ * Tenant API payload when provided (F2-4).
+ */
+function modelsFor({ builtinModels, createProvider, stream, streamSimple }, selection, credentials, catalog) {
+    const models = builtinModels({ credentials });
+    if (selection.custom) {
+        const model = {
+            id: selection.model,
+            name: selection.model,
+            api: "openai-completions",
+            provider: "custom",
+            baseUrl: selection.custom.baseUrl,
+            reasoning: false,
+            input: ["text", "image"],
+            cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+            contextWindow: 128000,
+            maxTokens: 16384,
+        };
+        models.setProvider(createProvider({
+            id: "custom",
+            name: "Custom OpenAI-compatible",
+            baseUrl: selection.custom.baseUrl,
+            auth: {
+                apiKey: {
+                    name: "Custom API key",
+                    async login(interaction) {
+                        const key = await interaction.prompt({
+                            type: "secret",
+                            message: "API key",
+                        });
+                        return { type: "api_key", key: key.trim() };
+                    },
+                    async resolve() {
+                        const credential = await credentials.read("custom");
+                        if (!credential || credential.type !== "api_key")
+                            return undefined;
+                        const key = credential.key;
+                        if (!key)
+                            return undefined;
+                        return { type: "api_key", auth: { apiKey: key } };
+                    },
+                },
+            },
+            models: [model],
+            api: { stream, streamSimple },
+        }));
+    }
+    return {
+        models,
+        listProviders() {
+            if (catalog?.providers.length) {
+                return catalog.providers.map((provider) => {
+                    const live = models.getProvider(provider.id);
+                    return {
+                        id: provider.id,
+                        name: provider.name,
+                        auth: {
+                            ...(live?.auth?.apiKey || provider.auth?.apiKey
+                                ? { apiKey: live?.auth?.apiKey ?? {} }
+                                : {}),
+                            ...(live?.auth?.oauth || provider.auth?.oauth
+                                ? { oauth: live?.auth?.oauth ?? {} }
+                                : {}),
+                            ...(!live?.auth?.apiKey &&
+                                !live?.auth?.oauth &&
+                                !provider.auth?.apiKey &&
+                                !provider.auth?.oauth
+                                ? { apiKey: {} }
+                                : {}),
+                        },
+                    };
+                });
+            }
+            return models.getProviders().map((provider) => ({
+                id: provider.id,
+                name: provider.name,
+                auth: {
+                    ...(provider.auth?.apiKey ? { apiKey: provider.auth.apiKey } : {}),
+                    ...(provider.auth?.oauth ? { oauth: provider.auth.oauth } : {}),
+                },
+            }));
+        },
+        listModels(providerId) {
+            const fromCatalog = catalog?.providers.find((p) => p.id === providerId);
+            if (fromCatalog?.models.length)
+                return fromCatalog.models;
+            return models.getModels(providerId).map((model) => ({
+                id: model.id,
+                name: model.name,
+            }));
+        },
+    };
+}
+/** The Tenant's model catalog (`GET /v1/tenant/models`, Management API). */
+export async function fetchModelCatalog(admin) {
+    return await admin.models.catalog();
+}
+// Internal options also allow isolated prompt tests without changing process globals.
+export async function configureProvider(options = {}) {
+    const login = { getDeviceId: options.deviceId ?? installationId };
+    const output = options.output ?? process.stdout;
+    const controller = new AbortController();
+    const signal = controller.signal;
+    const forwardAbort = () => controller.abort(options.signal.reason);
+    options.signal?.throwIfAborted();
+    const ai = await loadPiAi();
+    options.signal?.throwIfAborted();
+    let captured;
+    const store = {
+        async read() {
+            return undefined;
+        },
+        async list() {
+            return [];
+        },
+        async delete() { },
+        async modify(_id, fn) {
+            const next = await fn(captured);
+            if (next?.type === "api_key" && !next.key)
+                throw new Error("An API key is required.");
+            if (next)
+                captured = next;
+            return next ?? captured;
+        },
+    };
+    const registry = modelsFor(ai, { provider: "", model: "" }, store, options.catalog);
+    const providers = registry.listProviders();
+    const prompt = createInterface({
+        input: options.input ?? process.stdin,
+        output,
+    });
+    const onInt = () => controller.abort(new ConfigurationCancelled("SIGINT"));
+    const onClose = () => controller.abort(new Error("Configuration input closed before setup completed."));
+    const closeOnAbort = () => prompt.close();
+    prompt.on("SIGINT", onInt);
+    prompt.on("close", onClose);
+    signal.addEventListener("abort", closeOnAbort, { once: true });
+    options.signal?.addEventListener("abort", forwardAbort, { once: true });
+    if (options.signal?.aborted)
+        forwardAbort();
+    async function question(message) {
+        signal.throwIfAborted();
+        return prompt.question(message, { signal });
+    }
+    /** A positive whole number of tokens, or undefined for the default. */
+    async function tokens(message) {
+        const answer = (await question(message)).trim();
+        if (!answer)
+            return undefined;
+        const value = Number(answer);
+        if (!Number.isInteger(value) || value < 1)
+            throw new Error(`${message.split(" (")[0]} must be a whole number of tokens.`);
+        return value;
+    }
+    try {
+        signal.throwIfAborted();
+        output.write("0. Custom OpenAI-compatible provider\n");
+        providers.forEach((provider, index) => output.write(`${index + 1}. ${provider.name} (${provider.id})\n`));
+        const choice = Number(await question("Choose a provider: "));
+        if (choice === 0) {
+            const baseUrl = (await question("OpenAI-compatible base URL: "))
+                .trim()
+                .replace(/\/$/, "");
+            const model = (await question("Model id: ")).trim();
+            if (!baseUrl || !model)
+                throw new Error("A base URL and model id are required.");
+            const contextWindow = await tokens("Context window in tokens (Enter for 32768): ");
+            const maxTokens = await tokens("Max output tokens (Enter for 8192): ");
+            const settings = {
+                ...(contextWindow ? { contextWindow } : {}),
+                ...(maxTokens ? { maxTokens } : {}),
+            };
+            const selection = {
+                provider: "custom",
+                model,
+                custom: { baseUrl },
+            };
+            const custom = modelsFor(ai, selection, store, options.catalog);
+            if (!(await custom.models.checkAuth("custom", { signal })))
+                await custom.models.login("custom", "api_key", interaction(), login);
+            return {
+                ...prompted(selection),
+                ...(Object.keys(settings).length ? { settings } : {}),
+            };
+        }
+        else {
+            const chosen = providers[choice - 1];
+            if (!chosen)
+                throw new Error("Choose a listed provider.");
+            const available = registry.listModels(chosen.id);
+            available.forEach((model, index) => output.write(`${index + 1}. ${model.name} (${model.id})\n`));
+            const model = available[Number(await question("Choose a model: ")) - 1];
+            if (!model)
+                throw new Error("Choose a listed model.");
+            if (!(await registry.models.checkAuth(chosen.id, { signal }))) {
+                let method = chosen.auth.apiKey
+                    ? "api_key"
+                    : "oauth";
+                if (chosen.auth.apiKey && chosen.auth.oauth) {
+                    const answer = (await question("Choose authentication: 1. API key (default), 2. OAuth: ")).trim();
+                    if (answer && !["1", "2"].includes(answer))
+                        throw new Error("Choose authentication 1 or 2.");
+                    if (answer === "2")
+                        method = "oauth";
+                }
+                await registry.models.login(chosen.id, method, interaction(), login);
+            }
+            return prompted({ provider: chosen.id, model: model.id });
+        }
+    }
+    catch (error) {
+        throw signal.aborted ? signal.reason : error;
+    }
+    finally {
+        options.signal?.removeEventListener("abort", forwardAbort);
+        signal.removeEventListener("abort", closeOnAbort);
+        prompt.removeListener("SIGINT", onInt);
+        prompt.removeListener("close", onClose);
+        prompt.close();
+    }
+    function interaction() {
+        return {
+            signal,
+            prompt: async (item) => {
+                if (item.type !== "select")
+                    return question(item.message + ": ");
+                item.options.forEach((option, index) => output.write(`${index + 1}. ${option.label}\n`));
+                const answer = (await question(item.message + " ")).trim();
+                const option = item.options.find((option) => option.id === answer) ??
+                    item.options[Number(answer) - 1];
+                if (!option)
+                    throw new Error("Choose a listed authentication option.");
+                return option.id;
+            },
+            notify: (event) => {
+                output.write(("url" in event
+                    ? event.url
+                    : "verificationUri" in event
+                        ? event.verificationUri
+                        : event.message) + "\n");
+            },
+        };
+    }
+    function prompted(selection) {
+        signal.throwIfAborted();
+        if (!captured)
+            throw new Error("An API key or OAuth credential is required.");
+        output.write("Provider configuration saved.\n");
+        return {
+            provider: selection.provider,
+            model: selection.model,
+            ...(selection.custom?.baseUrl
+                ? { baseUrl: selection.custom.baseUrl }
+                : {}),
+            auth: captured,
+        };
+    }
+}
+/**
+ * A stable id for this CLI installation, created on first use under the Host root.
+ * OpenAI's "Sign in with ChatGPT" sends it as the agent host id.
+ */
+export function installationId(home = nylorunHome()) {
+    const file = join(home, "cli-installation-id");
+    try {
+        const existing = readFileSync(file, "utf8").trim();
+        if (existing)
+            return existing;
+    }
+    catch {
+        /* Created below on first use. */
+    }
+    const id = randomUUID();
+    mkdirSync(home, { recursive: true });
+    writeFileSync(file, `${id}\n`, { mode: 0o600 });
+    return id;
+}

package/dist/client/model/host-model.d.ts

@@ -0,0 +1,4 @@
+import type { ManagementClient } from "@nylorun/admin";
+import type { PromptedModel } from "./configure.js";
+/** Set the installation's Tenant model provider (`PUT /v1/tenant/model`, Management API). */
+export declare function putHostModel(admin: ManagementClient, model: PromptedModel): ReturnType<ManagementClient["models"]["put"]>;

package/dist/client/model/host-model.js

@@ -0,0 +1,13 @@
+import { randomUUID } from "node:crypto";
+/** Set the installation's Tenant model provider (`PUT /v1/tenant/model`, Management API). */
+export async function putHostModel(admin, model) {
+    return await admin.models.put({
+        idempotencyKey: randomUUID(),
+        provider: model.provider,
+        model: model.model,
+        ...(model.baseUrl ? { baseUrl: model.baseUrl } : {}),
+        ...(model.settings ? { settings: model.settings } : {}),
+        // A prompted credential is complete: pi-ai's type leaves its fields optional.
+        auth: model.auth,
+    });
+}

package/dist/client/model/pi-ai.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The pi-ai `nylo configure` loads; nylorun's devDependency has the same version
+ * (scripts/check-package.mjs).
+ */
+export declare const PI_AI_VERSION = "0.99.1";
+/** What `nylo configure` uses of pi-ai: its provider registry and login flows. */
+export interface PiAi {
+    createProvider: typeof import("@earendil-works/pi-ai").createProvider;
+    builtinModels: typeof import("@earendil-works/pi-ai/providers/all").builtinModels;
+    stream: typeof import("@earendil-works/pi-ai/api/openai-completions").stream;
+    streamSimple: typeof import("@earendil-works/pi-ai/api/openai-completions").streamSimple;
+}
+/**
+ * pi-ai, with its provider SDKs about 100 MB, is not a dependency of nylorun, so
+ * `npx nylorun` stays small: only `nylo configure` needs it. It loads pi-ai from beside nylorun
+ * when it resolves there (the workspace, or a project that installs it), else from
+ * `<Nylorun home>/lib/pi-ai-<version>/`, which it installs with npm on first use.
+ */
+export declare function loadPiAi(options?: {
+    home?: string;
+    /** Import pi-ai from beside nylorun (tests). */
+    packages?: () => Promise<PiAi>;
+    /** Install `PI_AI_VERSION` into a directory holding its package.json (tests). */
+    install?: (directory: string) => Promise<void>;
+    log?: (line: string) => void;
+}): Promise<PiAi>;

package/dist/client/model/pi-ai.js

@@ -0,0 +1,104 @@
+import { spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { existsSync } from "node:fs";
+import { mkdir, rename, rm, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { pathToFileURL } from "node:url";
+import { nylorunHome } from "@nylorun/core/project";
+import { CliError } from "../../errors.js";
+/**
+ * The pi-ai `nylo configure` loads; nylorun's devDependency has the same version
+ * (scripts/check-package.mjs).
+ */
+export const PI_AI_VERSION = "0.99.1";
+const PI_AI = "@earendil-works/pi-ai";
+/** The module written beside an on-demand install, which resolves pi-ai from there. */
+const ENTRY = "pi-ai.js";
+const ENTRY_SOURCE = `export { createProvider } from "${PI_AI}";
+export { builtinModels } from "${PI_AI}/providers/all";
+export { stream, streamSimple } from "${PI_AI}/api/openai-completions";
+`;
+async function fromPackages() {
+    const [ai, all, completions] = await Promise.all([
+        import("@earendil-works/pi-ai"),
+        import("@earendil-works/pi-ai/providers/all"),
+        import("@earendil-works/pi-ai/api/openai-completions"),
+    ]);
+    return {
+        createProvider: ai.createProvider,
+        builtinModels: all.builtinModels,
+        stream: completions.stream,
+        streamSimple: completions.streamSimple,
+    };
+}
+const notInstalled = (error) => error?.code === "ERR_MODULE_NOT_FOUND" &&
+    String(error.message).includes(`'${PI_AI}'`);
+/**
+ * pi-ai, with its provider SDKs about 100 MB, is not a dependency of nylorun, so
+ * `npx nylorun` stays small: only `nylo configure` needs it. It loads pi-ai from beside nylorun
+ * when it resolves there (the workspace, or a project that installs it), else from
+ * `<Nylorun home>/lib/pi-ai-<version>/`, which it installs with npm on first use.
+ */
+export async function loadPiAi(options = {}) {
+    try {
+        return await (options.packages ?? fromPackages)();
+    }
+    catch (error) {
+        if (!notInstalled(error))
+            throw error;
+    }
+    const directory = join(nylorunHome(options.home), "lib", `pi-ai-${PI_AI_VERSION}`);
+    if (!existsSync(join(directory, ENTRY))) {
+        (options.log ?? ((line) => console.error(line)))(`nylo configure uses ${PI_AI}@${PI_AI_VERSION} for the model providers' sign-in, which nylorun does not install. Installing it once into ${directory}…`);
+        await installInto(directory, options.install ?? npmInstall);
+    }
+    return (await import(pathToFileURL(join(directory, ENTRY)).href));
+}
+/** Install beside `directory`, then move it in place; a concurrent install that won is kept. */
+async function installInto(directory, install) {
+    const temporary = `${directory}.${randomBytes(4).toString("hex")}.tmp`;
+    try {
+        await mkdir(temporary, { recursive: true });
+        await writeFile(join(temporary, "package.json"), `${JSON.stringify({ private: true, type: "module", dependencies: { [PI_AI]: PI_AI_VERSION } }, null, 2)}\n`);
+        await install(temporary);
+        await writeFile(join(temporary, ENTRY), ENTRY_SOURCE);
+        await rename(temporary, directory).catch((error) => {
+            if (!existsSync(join(directory, ENTRY)))
+                throw error;
+        });
+    }
+    catch (error) {
+        throw new CliError(`Could not install ${PI_AI}@${PI_AI_VERSION} for nylo configure: ${error instanceof Error ? error.message : String(error)}. Install it beside nylorun (npm install ${PI_AI}@${PI_AI_VERSION}), or set the model provider in Studio.`, 1);
+    }
+    finally {
+        await rm(temporary, { recursive: true, force: true });
+    }
+}
+/** The npm that runs this command (`npx` sets npm_execpath), else the one beside node, else PATH's. */
+function npm() {
+    const candidates = [
+        process.env.npm_execpath,
+        join(dirname(process.execPath), "node_modules/npm/bin/npm-cli.js"),
+        join(dirname(process.execPath), "../lib/node_modules/npm/bin/npm-cli.js"),
+    ];
+    const cli = candidates.find((path) => path?.endsWith("npm-cli.js") && existsSync(path));
+    return cli ? { command: process.execPath, args: [cli] } : { command: "npm", args: [] };
+}
+/** `npm install` without scripts; its output goes to stderr, so stdout stays the prompts'. */
+function npmInstall(directory) {
+    const { command, args } = npm();
+    return new Promise((resolve, reject) => {
+        const child = spawn(command, [
+            ...args,
+            "install",
+            "--omit=dev",
+            "--ignore-scripts",
+            "--no-audit",
+            "--no-fund",
+            "--no-update-notifier",
+            "--loglevel=error",
+        ], { cwd: directory, stdio: ["ignore", 2, 2] });
+        child.once("error", reject);
+        child.once("close", (code) => code === 0 ? resolve() : reject(new Error(`npm install exited with ${code}`)));
+    });
+}

package/dist/client/project/connection.d.ts

@@ -0,0 +1,36 @@
+import { type ManagementClient } from "@nylorun/admin";
+import { type ProjectCredentials, type ProjectLink as LinkFile } from "@nylorun/core/project";
+/**
+ * The Project link (format 3), which `nylorun start` writes and `nylo` only reads with
+ * `@nylorun/core/project`'s reader. `tenantId` is information: the installation serves one
+ * Tenant, so nothing selects it.
+ */
+export type ProjectLink = LinkFile & {
+    format: 3;
+};
+/** The Project's link; one of an older nylorun (formats 0 to 2) is refused. */
+export declare function readLink(projectRoot: string): Promise<ProjectLink | undefined>;
+/**
+ * The Project's credentials (mode 0600), which `nylorun start` writes beside the link: the
+ * application key and its principal, and the management key and its principal when it issued
+ * one. A format 0 file's legacy `executors` map is ignored.
+ */
+export declare function readCredentials(projectRoot: string): Promise<ProjectCredentials | undefined>;
+/** The installation `nylo` acts on: a Runtime URL, an application key and a management key. */
+export interface LinkedConnection {
+    url: string;
+    /** The application key (Runtime API); absent when only a management key is set. */
+    key?: string;
+    /** The management key (Management API), when there is one. */
+    managementKey?: string;
+    /** The Project link it came from, when it came from one. */
+    link?: ProjectLink;
+}
+/**
+ * The Project's link and credentials, else `NYLORUN_RUNTIME_URL` with `NYLORUN_SERVER_KEY`, or
+ * `NYLORUN_MANAGEMENT_KEY`, or both; `NYLORUN_MANAGEMENT_KEY` also stands in for a Project
+ * credentials file without one. The installation serves one Tenant, so nothing names it.
+ */
+export declare function linkedConnection(projectRoot: string, env?: Readonly<Record<string, string | undefined>>): Promise<LinkedConnection>;
+/** The Management API client of `connection`; refused without a management key. */
+export declare function managementClient(connection: LinkedConnection): ManagementClient;

package/dist/client/project/connection.js

@@ -0,0 +1,80 @@
+import { chmod } from "node:fs/promises";
+import { createManagementClient } from "@nylorun/admin";
+import { ProjectFileError, projectCredentialsPath, projectLinkPath, readProjectCredentials, readProjectLink, } from "@nylorun/core/project";
+import { CliError } from "../../errors.js";
+/** The Project's link; one of an older nylorun (formats 0 to 2) is refused. */
+export async function readLink(projectRoot) {
+    const path = projectLinkPath(projectRoot);
+    let link;
+    try {
+        link = readProjectLink(projectRoot);
+    }
+    catch (error) {
+        if (!(error instanceof ProjectFileError))
+            throw error;
+        throw new CliError(error.reason === "newer"
+            ? `Project link at ${path} has an unsupported format. Upgrade nylorun.`
+            : `Invalid Project link at ${path}. Remove .nylorun/link.json and run "npx nylorun start".`, 1);
+    }
+    if (link === undefined)
+        return undefined;
+    if (link.format !== 3)
+        throw new CliError(`The Project link at ${path} is from an older nylorun. Run "npx nylorun start" in this project to link it again.`, 1);
+    return { ...link, format: 3 };
+}
+/**
+ * The Project's credentials (mode 0600), which `nylorun start` writes beside the link: the
+ * application key and its principal, and the management key and its principal when it issued
+ * one. A format 0 file's legacy `executors` map is ignored.
+ */
+export async function readCredentials(projectRoot) {
+    const path = projectCredentialsPath(projectRoot);
+    let credentials;
+    try {
+        credentials = readProjectCredentials(projectRoot);
+    }
+    catch (error) {
+        if (!(error instanceof ProjectFileError))
+            throw error;
+        throw new CliError(error.reason === "newer"
+            ? `Project credentials at ${path} have an unsupported format. Upgrade nylorun.`
+            : `Invalid Project credentials at ${path}. Remove .nylorun/credentials.json and run "npx nylorun start".`, 1);
+    }
+    if (credentials)
+        await chmod(path, 0o600);
+    return credentials;
+}
+/**
+ * The Project's link and credentials, else `NYLORUN_RUNTIME_URL` with `NYLORUN_SERVER_KEY`, or
+ * `NYLORUN_MANAGEMENT_KEY`, or both; `NYLORUN_MANAGEMENT_KEY` also stands in for a Project
+ * credentials file without one. The installation serves one Tenant, so nothing names it.
+ */
+export async function linkedConnection(projectRoot, env = process.env) {
+    const link = await readLink(projectRoot);
+    const credentials = await readCredentials(projectRoot);
+    const managementKey = env.NYLORUN_MANAGEMENT_KEY?.trim();
+    if (link && credentials) {
+        const management = credentials.managementKey ?? managementKey;
+        return {
+            url: link.hostUrl,
+            key: credentials.applicationKey,
+            ...(management ? { managementKey: management } : {}),
+            link,
+        };
+    }
+    const url = env.NYLORUN_RUNTIME_URL?.trim();
+    const key = env.NYLORUN_SERVER_KEY?.trim();
+    if (url && (key || managementKey))
+        return {
+            url: url.replace(/\/$/, ""),
+            ...(key ? { key } : {}),
+            ...(managementKey ? { managementKey } : {}),
+        };
+    throw new CliError(`No Project link in ${projectRoot}. Run "npx nylorun start" in this project to start its Tenant and link it, or set NYLORUN_RUNTIME_URL and NYLORUN_SERVER_KEY (or NYLORUN_MANAGEMENT_KEY).`, 1);
+}
+/** The Management API client of `connection`; refused without a management key. */
+export function managementClient(connection) {
+    if (!connection.managementKey)
+        throw new CliError(`No management key for the Tenant at ${connection.url}: run npx nylorun start, or set NYLORUN_MANAGEMENT_KEY.`, 1);
+    return createManagementClient({ url: connection.url, key: connection.managementKey });
+}

package/dist/client/project/env.d.ts

@@ -0,0 +1,3 @@
+/** Two `export` lines for `nylo env` (was `nylorun status --env`, F2-7). */
+export declare function printLinkedEnvExports(projectRoot?: string): Promise<void>;
+export declare function shellQuote(value: string): string;

package/dist/client/project/env.js

@@ -0,0 +1,19 @@
+import { findProjectRoot } from "@nylorun/core/project";
+import { readCredentials, readLink } from "./connection.js";
+/** Two `export` lines for `nylo env` (was `nylorun status --env`, F2-7). */
+export async function printLinkedEnvExports(projectRoot = process.cwd()) {
+    const root = findProjectRoot(projectRoot) ?? projectRoot;
+    const link = await readLink(root);
+    const credentials = await readCredentials(root);
+    if (!link || !credentials) {
+        console.log('# No Project link in this directory. Run "npx nylorun start" in this project to start its Tenant and link it.');
+        return;
+    }
+    console.log(`export NYLORUN_RUNTIME_URL=${shellQuote(link.hostUrl)}`);
+    console.log(`export NYLORUN_SERVER_KEY=${shellQuote(credentials.applicationKey)}`);
+}
+export function shellQuote(value) {
+    if (/^[A-Za-z0-9_./:-]+$/.test(value))
+        return value;
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}

package/dist/command.d.ts

@@ -0,0 +1,8 @@
+/** Both commands refuse native Windows before acting; WSL2 runs them. */
+export declare function refuseNativeWindows(): void;
+/**
+ * Run a command (`nylorun` or `nylo`) and exit once stdout and stderr are flushed: with
+ * `process.exitCode` (0 when unset), or after printing a failure's message with its
+ * `CliError` exit code (else 1).
+ */
+export declare function runCommand(main: () => Promise<void>): void;

package/dist/command.js

@@ -0,0 +1,23 @@
+import { CliError } from "./errors.js";
+/** Both commands refuse native Windows before acting; WSL2 runs them. */
+export function refuseNativeWindows() {
+    if (process.platform === "win32")
+        throw new CliError("Nylorun does not run on native Windows. Use WSL2: install Node 24 and Docker (Docker Desktop's WSL integration) inside your WSL distribution and run nylorun there (https://learn.microsoft.com/windows/wsl/install).", 1);
+}
+/**
+ * Run a command (`nylorun` or `nylo`) and exit once stdout and stderr are flushed: with
+ * `process.exitCode` (0 when unset), or after printing a failure's message with its
+ * `CliError` exit code (else 1).
+ */
+export function runCommand(main) {
+    void main().then(() => finish(process.exitCode === undefined ? 0 : Number(process.exitCode)), (error) => {
+        console.error(error instanceof Error ? error.message : String(error));
+        return finish(error instanceof CliError ? error.exitCode : 1);
+    });
+}
+async function finish(code) {
+    process.exitCode = code;
+    for (const stream of [process.stdout, process.stderr])
+        await new Promise((resolve) => stream.write("", () => resolve()));
+    process.exit(code);
+}

package/dist/errors.d.ts

@@ -1,4 +1,4 @@
-/** Exit codes are part of the CLI contract; see cli/README.md. */
+/** Exit codes are part of both commands' contract; see nylorun/README.md ("Exit codes"). */
 export declare class CliError extends Error {
     readonly exitCode: number;
     constructor(message: string, exitCode?: number);

package/dist/errors.js

@@ -1,4 +1,4 @@
-/** Exit codes are part of the CLI contract; see cli/README.md. */
+/** Exit codes are part of both commands' contract; see nylorun/README.md ("Exit codes"). */
 export class CliError extends Error {
     exitCode;
     constructor(message, exitCode = 1) {

package/dist/nylo.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+import "./baseline.js";

package/dist/nylo.js

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+import "./baseline.js";
+import { runCommand } from "./command.js";
+// `nylo`, the Runtime client (client/). `nylorun`'s entry never imports it, so `npx nylorun start`
+// loads none of it, nor @nylorun/admin.
+runCommand(async () => {
+    const { main } = await import("./client/cli.js");
+    await main(process.argv.slice(2));
+});

package/dist/project/link.d.ts

@@ -31,7 +31,8 @@ export interface KeyCredentials {
 export declare function readProjectCredentials(projectRoot: string): Promise<KeyCredentials | undefined>;
 /**
  * A credentials file (format 0 or 1): the Project's, or one the nylorun commands keep in the
- * Host root. Undefined when absent or unreadable, so `start` replaces it.
+ * Host root. Undefined when absent or unreadable, so `start` replaces it; a newer format is an
+ * error, as for the link, so this release never rewrites it in its own.
  */
 export declare function readCredentialsFile(path: string): Promise<KeyCredentials | undefined>;
 /** `.nylorun/credentials.json` (format 1, mode 0600). */