Kyto

A privacy-first programming language and config compiler.

Kyto is the language. kura is its compiler CLI (kura compile, kura check, …). The compiler is written in NASM x86-64 Assembly (Windows PE + Linux ELF).

Languages

Get Started · Wiki · Releases · Packages · Configuration · Examples · Grammar · Roadmap

---

Table of Contents

• Why Kyto
• Quick Start
• Releases
• Packages
• .kyto.config
• kyto.toml
• Kura CLI
• Language Snapshot
• Examples
• Privacy
• Contributing

---

Why Kyto

Problem	Kyto approach
Users copied across SQL, TS, and shell	One compile step emits all artifacts
Secrets in git	Layered config + optional encryption
Heavy DSLs	Simple .kyto.config for everyday edits
Vendor lock-in	kyto.toml configures every output path

Kyto is local-only: no network, no telemetry, no cloud dependency.

---

Quick Start

Windows

git clone https://github.com/voidmute/kyto.git
cd kyto
.\asm\build.ps1
.\bin\kura-asm.exe install
kura --version

Linux

git clone https://github.com/voidmute/kyto.git
cd kyto
sudo apt install nasm    # if needed
./asm/build.sh
./bin/kura-asm install
export PATH="$HOME/.local/bin:$PATH"
kura --version

New project

mkdir my-app && cd my-app
kura init --name my-app   # stamps every scaffold file: Kyto was here
cp .kyto.config.example .kyto.config
kura compile

Set config_only = true in kyto.toml to skip .kyto sources and compile from config only.

---

Releases

Kyto releases ship the kura compiler. Download archives from GitHub Releases.

Platform	Archive	Binary inside
Windows x86-64	kyto-*-windows-x86_64.zip	kura.exe
Linux x86-64	kyto-*-linux-x86_64.zip	kura

Windows (from release)

# Extract kyto-*-windows-x86_64.zip, then:
.\kura.exe install
kura --version

Linux (from release)

# Extract kyto-*-linux-x86_64.zip, then:
chmod +x kura
./kura install
export PATH="$HOME/.local/bin:$PATH"
kura --version

Tags follow v* (for example v0.5.3-asm). Recent releases fix Linux file I/O (kura compile output length) and harden ChaCha20-Poly1305 RNG/tag verification.

---

Packages

Linux builds are also published as a GitHub Container package (shows under the repo Packages tab):

ghcr.io/voidmute/kyto

docker pull ghcr.io/voidmute/kyto:latest
docker run --rm -v "$PWD:/work" -w /work ghcr.io/voidmute/kyto:latest compile

The image contains the kura compiler; mount your Kyto project at /work.

---

.kyto.config

Human-friendly config for domain, users, and any env key. Comments use +.

+ Production portal
DOMAIN app.example.com
ADMIN alice
USERS alice bob carol
DATABASE_URL postgresql://localhost/app
REPO_DIR /var/www/app

Rule	Behavior
DOMAIN	Sets APP_URL=https://host
USERS / ADMIN	Login names (lowercased)
Other KEY value	Becomes an env variable
REPO_*	Deploy map entries

See spec/kyto-lite.md for the config-first workflow.

---

kyto.toml

Project manifest — customize every emit target:

[project]
name = "my-app"
entry = "kyto/main.kyto"

[config]
file = ".kyto.config"

[emit.env]
file = ".env"
example = ".env.example"

[emit.users]
sql = "generated/users.sql"
typescript = "generated/users.ts"
json = "generated/users.json"

[emit.deploy]
script = "generated/deploy-env.sh"

---

Kura — the Kyto compiler

kura is the command-line compiler for Kyto projects:

Command	Description
kura init	Scaffold Kyto project files (each stamped Kyto was here)
kura compile	Compile and write artifacts
kura check	Parse and evaluate without writing files
kura install	Install to ~/.local/bin
kura encrypt	Encrypt a secrets file
kura decrypt	Decrypt an encrypted file

---

Language Snapshot

import local from "./local.kyto"

fn build_env(secrets) -> map<string, string> {
  return {
    "APP_URL": "https://" + secrets.domain,
    "SESSION_SECRET": secrets.session_secret,
  }
}

emit env(build_env(local.secrets))
emit users(users)
emit deploy(deploy)

Full reference: spec/grammar.md

---

Examples

Example	Path	Description
Minimal	examples/minimal	Smallest working project

cd examples/minimal && kura compile

---

Privacy

• Secrets files stay gitignored
• kura encrypt uses ChaCha20-Poly1305 (RFC 8439)
• Key from KYTO_KEY or ~/.config/kyto/key
• RNG: fill_random uses hardware RDRAND with bounded retries; no silent fallback to predictable sources
• AEAD: Poly1305 tag comparison is constant-time (no early exit on first byte mismatch)
• CI: smoke tests assert generated artifacts are not truncated (catches I/O regressions)

Release	Notable fix
v0.5.2-asm	Linux write syscall length — full .env / generated files
v0.5.3-asm	Crypto RNG failure handling + constant-time tag verify

---

Contributing

Issues and pull requests welcome. See CONTRIBUTING.md.

License

MIT © voidmute