@gnomondigital/nebulas-kit-core 0.5.0 → 0.5.1

package/dist/index.d.ts

@@ -10,6 +10,7 @@ export { handleA2AProxy, type ProxyRequest, type ProxyResponse, type ProxyHandle
 export { getAuthStrategy, getAuthHeaders, type AuthStrategy, } from "./server/auth-strategies.js";
 export { createConfigResponse, type ConfigResponse, type AgentCard, type AgentCardCapabilities, } from "./server/config-handler.js";
 export { createA2AExpressRouter, type A2AExpressRouterOptions, } from "./server/express.js";
+export { configureNebulasServer, getNebulasServerConfig, type NebulasServerRuntimeConfig, } from "./server/runtime-config.js";
 export { getCachedAccessTokenFromEnvService, } from "./server/env-service-token.js";
 export { handleNebulasProxy, isRefreshTokenInvalid, type NebulasProxyRequest, type NebulasProxyResponse, type NebulasProxyHandlerOptions, } from "./server/nebulas-proxy-handler.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,GAC1B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,wBAAwB,GACzB,MAAM,0BAA0B,CAAC;AAElC,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAE5F,OAAO,EACL,cAAc,EACd,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,mBAAmB,GACzB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,eAAe,EACf,cAAc,EACd,KAAK,YAAY,GAClB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,oBAAoB,EACpB,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,KAAK,qBAAqB,GAC3B,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,sBAAsB,EACtB,KAAK,uBAAuB,GAC7B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,kCAAkC,GACnC,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,0BAA0B,GAChC,MAAM,mCAAmC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,GAC1B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,wBAAwB,GACzB,MAAM,0BAA0B,CAAC;AAElC,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAE5F,OAAO,EACL,cAAc,EACd,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,mBAAmB,GACzB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,eAAe,EACf,cAAc,EACd,KAAK,YAAY,GAClB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,oBAAoB,EACpB,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,KAAK,qBAAqB,GAC3B,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,sBAAsB,EACtB,KAAK,uBAAuB,GAC7B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,0BAA0B,GAChC,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,kCAAkC,GACnC,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,0BAA0B,GAChC,MAAM,mCAAmC,CAAC"}

package/dist/index.js

@@ -9,5 +9,6 @@ export { handleA2AProxy, } from "./server/proxy-handler.js";
 export { getAuthStrategy, getAuthHeaders, } from "./server/auth-strategies.js";
 export { createConfigResponse, } from "./server/config-handler.js";
 export { createA2AExpressRouter, } from "./server/express.js";
+export { configureNebulasServer, getNebulasServerConfig, } from "./server/runtime-config.js";
 export { getCachedAccessTokenFromEnvService, } from "./server/env-service-token.js";
 export { handleNebulasProxy, isRefreshTokenInvalid, } from "./server/nebulas-proxy-handler.js";

package/dist/server/auth-strategies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-strategies.d.ts","sourceRoot":"","sources":["../../src/server/auth-strategies.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,YAAY,GACpB,SAAS,GACT,oBAAoB,GACpB,yBAAyB,CAAC;AAO9B,wBAAsB,cAAc,CAAC,OAAO,EAAE;IAC5C,QAAQ,EAAE,YAAY,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CA8ClC;AAED,wBAAgB,eAAe,IAAI,YAAY,CAU9C"}
+{"version":3,"file":"auth-strategies.d.ts","sourceRoot":"","sources":["../../src/server/auth-strategies.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,YAAY,GACpB,SAAS,GACT,oBAAoB,GACpB,yBAAyB,CAAC;AAO9B,wBAAsB,cAAc,CAAC,OAAO,EAAE;IAC5C,QAAQ,EAAE,YAAY,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CA4ClC;AAED,wBAAgB,eAAe,IAAI,YAAY,CAU9C"}

package/dist/server/auth-strategies.js

@@ -1,13 +1,14 @@
 import { exchangeEntraOnBehalfOfToken } from "./entra/session-token.js";
 import { getAuth0ClientCredentialsToken } from "./auth0/client-credentials.js";
 import { getCachedAccessTokenFromEnvService } from "./env-service-token.js";
+import { getNebulasServerConfig } from "./runtime-config.js";
 function getAuthProvider() {
-    const provider = process.env.AUTH_PROVIDER?.toLowerCase();
+    const provider = getNebulasServerConfig().authProvider;
     return provider === "entra" ? "entra" : "auth0";
 }
 export async function getAuthHeaders(options) {
     const headers = {};
-    const apiKey = options.apiKey ?? process.env.A2A_API_KEY;
+    const apiKey = options.apiKey ?? getNebulasServerConfig().a2aApiKey;
     if (apiKey)
         headers["x-api-key"] = apiKey;
     const provider = getAuthProvider();
@@ -26,11 +27,9 @@ export async function getAuthHeaders(options) {
             if (token) {
                 if (provider === "entra" && options.strategy === "session") {
                     const obo = await exchangeEntraOnBehalfOfToken(token);
-                    console.log("obo", obo);
                     headers["Authorization"] = `Bearer ${obo.access_token}`;
                 }
                 else {
-                    console.log("token", token);
                     headers["Authorization"] = `Bearer ${token}`;
                 }
             }
@@ -50,7 +49,7 @@ export async function getAuthHeaders(options) {
     return headers;
 }
 export function getAuthStrategy() {
-    const s = process.env.A2A_AUTH_STRATEGY?.toLowerCase();
+    const s = getNebulasServerConfig().a2aAuthStrategy;
     if (s === "session" ||
         s === "client_credentials" ||
         s === "resource_owner_password") {

package/dist/server/auth0/auth-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-handler.d.ts","sourceRoot":"","sources":["../../../src/server/auth0/auth-handler.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,eAAe,CAAC,CA+B1B"}
+{"version":3,"file":"auth-handler.d.ts","sourceRoot":"","sources":["../../../src/server/auth0/auth-handler.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,eAAe,CAAC,CAgC1B"}

package/dist/server/auth0/auth-handler.js

@@ -2,14 +2,16 @@
  * Auth0 handler for Resource Owner Password flow.
  * Exchanges username/password for Auth0 token.
  */
+import { getNebulasServerConfig } from "../runtime-config.js";
 /**
  * Exchange username/password for Auth0 access token.
  */
 export async function exchangePasswordForToken(username, password) {
-    const domain = process.env.AUTH0_DOMAIN;
-    const clientId = process.env.AUTH0_CLIENT_ID;
-    const clientSecret = process.env.AUTH0_CLIENT_SECRET;
-    const audience = process.env.AUTH0_A2A_AUDIENCE;
+    const config = getNebulasServerConfig().auth0;
+    const domain = config?.domain;
+    const clientId = config?.clientId;
+    const clientSecret = config?.clientSecret;
+    const audience = config?.audience;
     if (!domain || !clientId || !clientSecret) {
         throw new Error("AUTH0_DOMAIN, AUTH0_CLIENT_ID, AUTH0_CLIENT_SECRET required for ROP");
     }

package/dist/server/auth0/client-credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client-credentials.d.ts","sourceRoot":"","sources":["../../../src/server/auth0/client-credentials.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,wBAAsB,8BAA8B,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAuClF"}
+{"version":3,"file":"client-credentials.d.ts","sourceRoot":"","sources":["../../../src/server/auth0/client-credentials.ts"],"names":[],"mappings":"AAIA;;GAEG;AACH,wBAAsB,8BAA8B,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAwClF"}

package/dist/server/auth0/client-credentials.js

@@ -1,12 +1,14 @@
+import { getNebulasServerConfig } from "../runtime-config.js";
 let m2mTokenCache = null;
 /**
  * Get Auth0 token via client credentials (M2M).
  */
 export async function getAuth0ClientCredentialsToken() {
-    const domain = process.env.AUTH0_DOMAIN;
-    const clientId = process.env.AUTH0_CLIENT_ID;
-    const clientSecret = process.env.AUTH0_CLIENT_SECRET;
-    const audience = process.env.AUTH0_A2A_AUDIENCE;
+    const config = getNebulasServerConfig().auth0;
+    const domain = config?.domain;
+    const clientId = config?.clientId;
+    const clientSecret = config?.clientSecret;
+    const audience = config?.audience;
     if (!domain || !clientId || !clientSecret || !audience) {
         return undefined;
     }

package/dist/server/auth0/env-service-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env-service-token.d.ts","sourceRoot":"","sources":["../../../src/server/auth0/env-service-token.ts"],"names":[],"mappings":"AAEA,wBAAsB,4BAA4B,IAAI,OAAO,CAAC;IAC5D,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC,CASD"}
+{"version":3,"file":"env-service-token.d.ts","sourceRoot":"","sources":["../../../src/server/auth0/env-service-token.ts"],"names":[],"mappings":"AAGA,wBAAsB,4BAA4B,IAAI,OAAO,CAAC;IAC5D,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC,CAUD"}

package/dist/server/auth0/env-service-token.js

@@ -1,9 +1,11 @@
 import { exchangePasswordForToken } from "./auth-handler.js";
+import { getNebulasServerConfig } from "../runtime-config.js";
 export async function exchangeAuth0EnvServiceToken() {
-    const username = process.env.AUTH0_ROP_USERNAME;
-    const password = process.env.AUTH0_ROP_PASSWORD;
+    const serviceUser = getNebulasServerConfig().auth0ServiceUser;
+    const username = serviceUser?.username;
+    const password = serviceUser?.password;
     if (!username || !password) {
-        throw new Error("AUTH0_ROP_USERNAME and AUTH0_ROP_PASSWORD are required for Auth0 env ROP token");
+        throw new Error("Auth0 service user credentials are required for service ROP token");
     }
     return exchangePasswordForToken(username, password);
 }

package/dist/server/config-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-handler.d.ts","sourceRoot":"","sources":["../../src/server/config-handler.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,MAAM,WAAW,qBAAqB;IACpC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,qBAAqB,CAAC;IACrC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;IAC7B,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,2BAA2B;IAC1C,sEAAsE;IACtE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,kGAAkG;IAClG,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAyBD,wBAAsB,oBAAoB,CACxC,OAAO,CAAC,EAAE,2BAA2B,GACpC,OAAO,CAAC,cAAc,CAAC,CAoBzB"}
+{"version":3,"file":"config-handler.d.ts","sourceRoot":"","sources":["../../src/server/config-handler.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,WAAW,qBAAqB;IACpC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,qBAAqB,CAAC;IACrC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;IAC7B,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,2BAA2B;IAC1C,sEAAsE;IACtE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,kGAAkG;IAClG,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AA0BD,wBAAsB,oBAAoB,CACxC,OAAO,CAAC,EAAE,2BAA2B,GACpC,OAAO,CAAC,cAAc,CAAC,CAmBzB"}

package/dist/server/config-handler.js

@@ -3,10 +3,10 @@
  * Fetches agent card from A2A_URL/.well-known/agent-card.json when A2A_URL is set.
  * Framework-agnostic; returns JSON response body.
  */
-import { nodeEnv } from "./node-env.js";
-const A2A_URL = nodeEnv("A2A_URL") || nodeEnv("NEXT_PUBLIC_A2A_URL") || "";
+import { getNebulasServerConfig } from "./runtime-config.js";
 async function fetchAgentCard(headers) {
-    const base = A2A_URL.replace(/\/$/, "");
+    const a2aUrl = getNebulasServerConfig().a2aUrl ?? "";
+    const base = a2aUrl.replace(/\/$/, "");
     if (!base)
         return null;
     const url = `${base}/.well-known/agent-card.json`;
@@ -29,9 +29,8 @@ async function fetchAgentCard(headers) {
     }
 }
 export async function createConfigResponse(options) {
-    const nebulasProjectId = nodeEnv("NEBULAS_PROJECT_ID") ?? null;
+    const nebulasProjectId = getNebulasServerConfig().nebulasProjectId ?? null;
     const includeAgentCard = options?.includeAgentCard !== false;
-    console.log("includeAgentCard", includeAgentCard);
     if (!includeAgentCard) {
         return {
             nebulasProjectId,

package/dist/server/entra/env-service-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env-service-token.d.ts","sourceRoot":"","sources":["../../../src/server/entra/env-service-token.ts"],"names":[],"mappings":"AAmEA,wBAAsB,mCAAmC,IAAI,OAAO,CAAC;IACnE,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC,CAuED"}
+{"version":3,"file":"env-service-token.d.ts","sourceRoot":"","sources":["../../../src/server/entra/env-service-token.ts"],"names":[],"mappings":"AAkEA,wBAAsB,mCAAmC,IAAI,OAAO,CAAC;IACnE,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC,CAwED"}

package/dist/server/entra/env-service-token.js

@@ -1,5 +1,6 @@
 import { readFile } from "node:fs/promises";
 import { X509Certificate, createHash, createSign, randomUUID } from "node:crypto";
+import { getNebulasServerConfig } from "../runtime-config.js";
 function base64UrlEncode(input) {
     const buf = typeof input === "string" ? Buffer.from(input, "utf8") : input;
     return buf
@@ -8,12 +9,10 @@ function base64UrlEncode(input) {
         .replace(/\//g, "_")
         .replace(/=+$/g, "");
 }
-async function readEnvOrFile(valueEnv, pathEnv) {
-    const inline = process.env[valueEnv];
-    if (inline) {
-        return inline.replace(/\\n/g, "\n");
+async function readInlineOrFile(inlineValue, filePath) {
+    if (inlineValue) {
+        return inlineValue.replace(/\\n/g, "\n");
     }
-    const filePath = process.env[pathEnv];
     if (filePath) {
         const content = await readFile(filePath, "utf8");
         return content;
@@ -53,21 +52,22 @@ function createClientAssertion(options) {
     return `${signingInput}.${base64UrlEncode(signature)}`;
 }
 export async function exchangeEntraClientCredentialsToken() {
-    const tenantId = process.env.ENTRA_TENANT_ID;
-    const clientId = process.env.ENTRA_CLIENT_ID;
-    const clientSecret = process.env.ENTRA_CLIENT_SECRET;
-    const certificatePem = await readEnvOrFile("ENTRA_CLIENT_CERTIFICATE", "ENTRA_CLIENT_CERTIFICATE_PATH");
-    const privateKeyPem = await readEnvOrFile("ENTRA_CLIENT_PRIVATE_KEY", "ENTRA_CLIENT_PRIVATE_KEY_PATH");
-    const scope = process.env.ENTRA_A2A_SCOPE || process.env.ENTRA_SCOPE;
+    const config = getNebulasServerConfig().entraService;
+    const tenantId = config?.tenantId;
+    const clientId = config?.clientId;
+    const clientSecret = config?.clientSecret;
+    const certificatePem = await readInlineOrFile(config?.certificatePem, config?.certificatePath);
+    const privateKeyPem = await readInlineOrFile(config?.privateKeyPem, config?.privateKeyPath);
+    const scope = config?.scope;
     if (!tenantId || !clientId || !scope) {
-        throw new Error("ENTRA_TENANT_ID, ENTRA_CLIENT_ID, and ENTRA_A2A_SCOPE (or ENTRA_SCOPE) are required for Entra service token");
+        throw new Error("Entra service config requires tenantId, clientId, and scope");
     }
     const hasCertificateAuth = Boolean(certificatePem || privateKeyPem);
     if (hasCertificateAuth && (!certificatePem || !privateKeyPem)) {
-        throw new Error("Entra certificate auth requires both certificate and private key (ENTRA_CLIENT_CERTIFICATE/ENTRA_CLIENT_CERTIFICATE_PATH and ENTRA_CLIENT_PRIVATE_KEY/ENTRA_CLIENT_PRIVATE_KEY_PATH)");
+        throw new Error("Entra certificate auth requires both certificate and private key");
     }
     if (!hasCertificateAuth && !clientSecret) {
-        throw new Error("Provide ENTRA_CLIENT_SECRET or certificate credentials for Entra service token");
+        throw new Error("Provide Entra clientSecret or certificate credentials for service token");
     }
     const tokenUrl = `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`;
     const body = new URLSearchParams({

package/dist/server/entra/session-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-token.d.ts","sourceRoot":"","sources":["../../../src/server/entra/session-token.ts"],"names":[],"mappings":"AAkEA,wBAAsB,4BAA4B,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC;IACnF,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC,CAiFD"}
+{"version":3,"file":"session-token.d.ts","sourceRoot":"","sources":["../../../src/server/entra/session-token.ts"],"names":[],"mappings":"AAiEA,wBAAsB,4BAA4B,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC;IACnF,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC,CA0ED"}

package/dist/server/entra/session-token.js

@@ -1,5 +1,6 @@
 import { readFile } from "node:fs/promises";
 import { X509Certificate, createHash, createSign, randomUUID } from "node:crypto";
+import { getNebulasServerConfig } from "../runtime-config.js";
 function base64UrlEncode(input) {
     const buf = typeof input === "string" ? Buffer.from(input, "utf8") : input;
     return buf
@@ -8,12 +9,10 @@ function base64UrlEncode(input) {
         .replace(/\//g, "_")
         .replace(/=+$/g, "");
 }
-async function readEnvOrFile(valueEnv, pathEnv) {
-    const inline = process.env[valueEnv];
-    if (inline) {
-        return inline.replace(/\\n/g, "\n");
+async function readInlineOrFile(inlineValue, filePath) {
+    if (inlineValue) {
+        return inlineValue.replace(/\\n/g, "\n");
     }
-    const filePath = process.env[pathEnv];
     if (filePath) {
         return readFile(filePath, "utf8");
     }
@@ -52,25 +51,22 @@ function createClientAssertion(options) {
     return `${signingInput}.${base64UrlEncode(signature)}`;
 }
 export async function exchangeEntraOnBehalfOfToken(userAccessToken) {
-    const tenantId = process.env.ENTRA_TENANT_ID;
-    const clientId = process.env.ENTRA_OBO_CLIENT_ID;
-    const clientSecret = process.env.ENTRA_OBO_CLIENT_SECRET;
-    const certificatePem = await readEnvOrFile("ENTRA_CLIENT_CERTIFICATE", "ENTRA_CLIENT_CERTIFICATE_PATH");
-    const privateKeyPem = await readEnvOrFile("ENTRA_CLIENT_PRIVATE_KEY", "ENTRA_CLIENT_PRIVATE_KEY_PATH");
-    // OBO should request delegated user scopes for the downstream API.
-    // Prefer a dedicated OBO scope, while keeping legacy fallbacks.
-    const scope = process.env.ENTRA_OBO_SCOPE ||
-        process.env.ENTRA_SCOPE ||
-        process.env.ENTRA_A2A_SCOPE;
+    const config = getNebulasServerConfig().entraObo;
+    const tenantId = config?.tenantId;
+    const clientId = config?.clientId;
+    const clientSecret = config?.clientSecret;
+    const certificatePem = await readInlineOrFile(config?.certificatePem, config?.certificatePath);
+    const privateKeyPem = await readInlineOrFile(config?.privateKeyPem, config?.privateKeyPath);
+    const scope = config?.scope;
     if (!tenantId || !clientId || !scope) {
-        throw new Error("ENTRA_TENANT_ID, ENTRA_CLIENT_ID, and ENTRA_OBO_SCOPE (or ENTRA_SCOPE, legacy ENTRA_A2A_SCOPE) are required for Entra OBO token");
+        throw new Error("Entra OBO config requires tenantId, clientId, and scope");
     }
     const hasCertificateAuth = Boolean(certificatePem || privateKeyPem);
     if (hasCertificateAuth && (!certificatePem || !privateKeyPem)) {
-        throw new Error("Entra certificate auth requires both certificate and private key (ENTRA_CLIENT_CERTIFICATE/ENTRA_CLIENT_CERTIFICATE_PATH and ENTRA_CLIENT_PRIVATE_KEY/ENTRA_CLIENT_PRIVATE_KEY_PATH)");
+        throw new Error("Entra certificate auth requires both certificate and private key");
     }
     if (!hasCertificateAuth && !clientSecret) {
-        throw new Error("Provide ENTRA_CLIENT_SECRET or certificate credentials for Entra OBO token");
+        throw new Error("Provide Entra clientSecret or certificate credentials for OBO token");
     }
     const tokenUrl = `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`;
     const body = new URLSearchParams({
@@ -93,7 +89,6 @@ export async function exchangeEntraOnBehalfOfToken(userAccessToken) {
     else {
         body.set("client_secret", clientSecret);
     }
-    console.log("body", body.toString());
     const res = await fetch(tokenUrl, {
         method: "POST",
         headers: { "Content-Type": "application/x-www-form-urlencoded" },

package/dist/server/env-service-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env-service-token.d.ts","sourceRoot":"","sources":["../../src/server/env-service-token.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAwCH;;;GAGG;AACH,wBAAsB,kCAAkC,IAAI,OAAO,CAAC,MAAM,CAAC,CAiB1E"}
+{"version":3,"file":"env-service-token.d.ts","sourceRoot":"","sources":["../../src/server/env-service-token.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAyCH;;;GAGG;AACH,wBAAsB,kCAAkC,IAAI,OAAO,CAAC,MAAM,CAAC,CAiB1E"}

package/dist/server/env-service-token.js

@@ -6,11 +6,12 @@
  */
 import { exchangeAuth0EnvServiceToken } from "./auth0/env-service-token.js";
 import { exchangeEntraClientCredentialsToken } from "./entra/env-service-token.js";
+import { getNebulasServerConfig } from "./runtime-config.js";
 const EXPIRY_SKEW_MS = 60000;
 let cache = null;
 let refreshPromise = null;
 function getAuthProvider() {
-    const provider = process.env.AUTH_PROVIDER?.toLowerCase();
+    const provider = getNebulasServerConfig().authProvider;
     if (provider === "entra") {
         return "entra";
     }

package/dist/server/nebulas-proxy-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nebulas-proxy-handler.d.ts","sourceRoot":"","sources":["../../src/server/nebulas-proxy-handler.ts"],"names":[],"mappings":"AAAA;;;GAGG;AASH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,GAAG,WAAW,CAAC;CAC1D;AAED,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,mBAAmB,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3E;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAS3D;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,mBAAmB,EACxB,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,oBAAoB,CAAC,CAwH/B"}
+{"version":3,"file":"nebulas-proxy-handler.d.ts","sourceRoot":"","sources":["../../src/server/nebulas-proxy-handler.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,GAAG,WAAW,CAAC;CAC1D;AAED,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,mBAAmB,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3E;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAS3D;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,mBAAmB,EACxB,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,oBAAoB,CAAC,CA6H/B"}

package/dist/server/nebulas-proxy-handler.js

@@ -2,11 +2,7 @@
  * Framework-agnostic Nebulas API proxy handler.
  * Proxies requests to the Nebulas API (conversations, chat_messages).
  */
-import { nodeEnv } from "./node-env.js";
-const NEBULAS_API_URL = nodeEnv("NEBULAS_API_URL") || "http://localhost:8020";
-const A2A_AUDIENCE = nodeEnv("AUTH0_A2A_AUDIENCE");
-const A2A_API_KEY = nodeEnv("A2A_API_KEY");
-const NEBULAS_API_KEY = nodeEnv("NEBULAS_API_KEY");
+import { getNebulasServerConfig } from "./runtime-config.js";
 /**
  * Check if an error indicates invalid refresh token (for session re-auth).
  */
@@ -23,8 +19,13 @@ export function isRefreshTokenInvalid(err) {
  * Proxies to NEBULAS_API_URL with auth headers from getHeaders or API keys.
  */
 export async function handleNebulasProxy(req, options = {}) {
+    const config = getNebulasServerConfig();
+    const nebulasApiUrl = config.nebulasApiUrl ?? "http://localhost:8020";
+    const a2aAudience = config.auth0?.audience;
+    const a2aApiKey = config.a2aApiKey;
+    const nebulasApiKey = config.nebulasApiKey;
     const backendPath = `/${req.path.join("/")}`;
-    const url = new URL(backendPath, NEBULAS_API_URL.replace(/\/$/, "") + "/");
+    const url = new URL(backendPath, nebulasApiUrl.replace(/\/$/, "") + "/");
     for (const [key, value] of Object.entries(req.searchParams)) {
         url.searchParams.set(key, value);
     }
@@ -33,11 +34,11 @@ export async function handleNebulasProxy(req, options = {}) {
     if (contentType) {
         headers["Content-Type"] = contentType;
     }
-    if (NEBULAS_API_KEY) {
-        headers["x-api-key"] = NEBULAS_API_KEY;
+    if (nebulasApiKey) {
+        headers["x-api-key"] = nebulasApiKey;
     }
-    else if (A2A_API_KEY) {
-        headers["x-api-key"] = A2A_API_KEY;
+    else if (a2aApiKey) {
+        headers["x-api-key"] = a2aApiKey;
     }
     if (options.headers) {
         Object.assign(headers, options.headers);
@@ -59,7 +60,7 @@ export async function handleNebulasProxy(req, options = {}) {
                     }),
                 };
             }
-            if (!A2A_API_KEY && !NEBULAS_API_KEY) {
+            if (!a2aApiKey && !nebulasApiKey) {
                 return {
                     status: 401,
                     headers: { "Content-Type": "application/json" },
@@ -73,7 +74,7 @@ export async function handleNebulasProxy(req, options = {}) {
         }
     }
     const hasAuth = headers["Authorization"] || headers["x-api-key"];
-    if (!hasAuth && (A2A_AUDIENCE || options.getHeaders)) {
+    if (!hasAuth && (a2aAudience || options.getHeaders)) {
         return {
             status: 401,
             headers: { "Content-Type": "application/json" },

package/dist/server/nextjs.d.ts

@@ -64,7 +64,7 @@ export interface CreateA2AProxyHandlerOptions {
  * Propagates Set-Cookie from Auth0 token refresh.
  *
  * Use in app/api/a2a/route.ts:
- *   const handler = createA2AProxyHandler({ auth0, audience: process.env.AUTH0_A2A_AUDIENCE, apiKey: process.env.A2A_API_KEY });
+ *   const handler = createA2AProxyHandler({ auth0, audience: "api://your-audience", apiKey: "your-api-key" });
  *   export const POST = handler;
  */
 export declare function createA2AProxyHandler(options: CreateA2AProxyHandlerOptions): (request: NextRequest) => Promise<Response>;
@@ -83,7 +83,7 @@ export interface CreateA2AProxyHandlerFromEnvServiceOptions {
  * Next.js POST handler for the A2A proxy using service auth (Auth0 ROP or Entra client credentials), not Auth0 session.
  *
  * Use in app/api/a2a/route.ts:
- *   export const POST = createA2AProxyHandlerFromEnvService({ apiKey: process.env.A2A_API_KEY });
+ *   export const POST = createA2AProxyHandlerFromEnvService({ apiKey: "your-api-key" });
  */
 export declare function createA2AProxyHandlerFromEnvService(options?: CreateA2AProxyHandlerFromEnvServiceOptions): (request: NextRequest) => Promise<Response>;
 /**
@@ -99,7 +99,7 @@ export interface CreateNebulasProxyHandlerOptions {
  * Proxies requests to NEBULAS_API_URL with Auth0 session token or API key.
  *
  * Use in app/api/nebulas/[...path]/route.ts:
- *   const handler = createNebulasProxyHandler({ auth0, audience: process.env.AUTH0_A2A_AUDIENCE, apiKey: process.env.NEBULAS_API_KEY });
+ *   const handler = createNebulasProxyHandler({ auth0, audience: "api://your-audience", apiKey: "your-api-key" });
  *   export const GET = handler;
  *   export const POST = handler;
  *   export const PUT = handler;

package/dist/server/nextjs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nextjs.d.ts","sourceRoot":"","sources":["../../src/server/nextjs.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAkB,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAiB9E;;GAEG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE,mBAAmB,qBAa9B;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACxE;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE,sBAAsB,qBAsBjC;AAED;;;GAGG;AACH,MAAM,WAAW,0BAA0B;IACzC,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAC7D,cAAc,CACZ,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,GACzB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/B;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE;IAClD,UAAU,EAAE,0BAA0B,CAAC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,CACF,OAAO,EAAE,WAAW,EACpB,YAAY,CAAC,EAAE,YAAY,KACxB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAoDnC;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C,KAAK,EAAE,0BAA0B,CAAC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,IAO3C,SAAS,WAAW,uBA0BnD;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,CAAC,EAAE,0BAA0B,GACnC,CAAC,OAAO,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAmB5D;AAED,MAAM,WAAW,0CAA0C;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,wBAAgB,mCAAmC,CACjD,OAAO,CAAC,EAAE,0CAA0C,IAEtB,SAAS,WAAW,uBAgCnD;AAED;;GAEG;AACH,MAAM,WAAW,gCAAgC;IAC/C,IAAI,EAAE,0BAA0B,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,gCAAgC,IAE/E,SAAS,WAAW,EACpB,KAAK;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAA;CAAE,oCAiE/C"}
+{"version":3,"file":"nextjs.d.ts","sourceRoot":"","sources":["../../src/server/nextjs.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAkB,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAiB9E;;GAEG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE,mBAAmB,qBAa9B;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACxE;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE,sBAAsB,qBAoBjC;AAED;;;GAGG;AACH,MAAM,WAAW,0BAA0B;IACzC,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAC7D,cAAc,CACZ,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,GACzB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/B;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE;IAClD,UAAU,EAAE,0BAA0B,CAAC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,CACF,OAAO,EAAE,WAAW,EACpB,YAAY,CAAC,EAAE,YAAY,KACxB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAoDnC;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C,KAAK,EAAE,0BAA0B,CAAC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,IAO3C,SAAS,WAAW,uBA0BnD;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,CAAC,EAAE,0BAA0B,GACnC,CAAC,OAAO,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAmB5D;AAED,MAAM,WAAW,0CAA0C;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,wBAAgB,mCAAmC,CACjD,OAAO,CAAC,EAAE,0CAA0C,IAEtB,SAAS,WAAW,uBAgCnD;AAED;;GAEG;AACH,MAAM,WAAW,gCAAgC;IAC/C,IAAI,EAAE,0BAA0B,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,gCAAgC,IAE/E,SAAS,WAAW,EACpB,KAAK;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAA;CAAE,oCAiE/C"}

package/dist/server/nextjs.js

@@ -48,7 +48,6 @@ export async function handleA2AConfigNextJsGET(request, options) {
             throw e;
         }
     }
-    console.log("headers", headers);
     const config = await createConfigResponse({ includeAgentCard, headers });
     return new Response(JSON.stringify(config), {
         status: 200,
@@ -111,7 +110,7 @@ export function createGetHeadersForSession(options) {
  * Propagates Set-Cookie from Auth0 token refresh.
  *
  * Use in app/api/a2a/route.ts:
- *   const handler = createA2AProxyHandler({ auth0, audience: process.env.AUTH0_A2A_AUDIENCE, apiKey: process.env.A2A_API_KEY });
+ *   const handler = createA2AProxyHandler({ auth0, audience: "api://your-audience", apiKey: "your-api-key" });
  *   export const POST = handler;
  */
 export function createA2AProxyHandler(options) {
@@ -170,7 +169,7 @@ export function createGetHeadersROP(options) {
  * Next.js POST handler for the A2A proxy using service auth (Auth0 ROP or Entra client credentials), not Auth0 session.
  *
  * Use in app/api/a2a/route.ts:
- *   export const POST = createA2AProxyHandlerFromEnvService({ apiKey: process.env.A2A_API_KEY });
+ *   export const POST = createA2AProxyHandlerFromEnvService({ apiKey: "your-api-key" });
  */
 export function createA2AProxyHandlerFromEnvService(options) {
     return async function handler(request) {
@@ -205,7 +204,7 @@ export function createA2AProxyHandlerFromEnvService(options) {
  * Proxies requests to NEBULAS_API_URL with Auth0 session token or API key.
  *
  * Use in app/api/nebulas/[...path]/route.ts:
- *   const handler = createNebulasProxyHandler({ auth0, audience: process.env.AUTH0_A2A_AUDIENCE, apiKey: process.env.NEBULAS_API_KEY });
+ *   const handler = createNebulasProxyHandler({ auth0, audience: "api://your-audience", apiKey: "your-api-key" });
  *   export const GET = handler;
  *   export const POST = handler;
  *   export const PUT = handler;

package/dist/server/proxy-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxy-handler.d.ts","sourceRoot":"","sources":["../../src/server/proxy-handler.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,sBAAsB,CAAC;AAM9B,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,mBAAmB;IAClC,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,YAAY,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACrE,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,YAAY,EACjB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,aAAa,CAAC,CAmFxB"}
+{"version":3,"file":"proxy-handler.d.ts","sourceRoot":"","sources":["../../src/server/proxy-handler.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,sBAAsB,CAAC;AAG9B,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,mBAAmB;IAClC,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,YAAY,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACrE,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,YAAY,EACjB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,aAAa,CAAC,CAoFxB"}

package/dist/server/proxy-handler.js

@@ -3,13 +3,13 @@
  * Accepts a minimal request/response interface.
  */
 import { getAuthStrategy, getAuthHeaders, } from "./auth-strategies.js";
-import { nodeEnv } from "./node-env.js";
-const A2A_URL = nodeEnv("A2A_URL") || nodeEnv("NEXT_PUBLIC_A2A_URL") || "http://localhost:9999";
+import { getNebulasServerConfig } from "./runtime-config.js";
 /**
  * Handle A2A proxy request. Returns response to send.
  */
 export async function handleA2AProxy(req, options = {}) {
-    const url = A2A_URL.replace(/\/$/, "");
+    const a2aUrl = getNebulasServerConfig().a2aUrl ?? "http://localhost:9999";
+    const url = a2aUrl.replace(/\/$/, "");
     let headers;
     if (options.headers) {
         headers = {
@@ -27,7 +27,7 @@ export async function handleA2AProxy(req, options = {}) {
         else if (strategy === "session" && options.getSessionToken) {
             bearerToken = await options.getSessionToken(req);
         }
-        if (strategy === "session" && !bearerToken && !nodeEnv("A2A_API_KEY")) {
+        if (strategy === "session" && !bearerToken && !getNebulasServerConfig().a2aApiKey) {
             return {
                 status: 401,
                 headers: { "Content-Type": "application/json" },

package/dist/server/runtime-config.d.ts

@@ -0,0 +1,45 @@
+export type AuthProvider = "auth0" | "entra";
+export interface Auth0RuntimeConfig {
+    domain: string;
+    clientId: string;
+    clientSecret: string;
+    audience?: string;
+}
+export interface Auth0ServiceUserRuntimeConfig {
+    username: string;
+    password: string;
+}
+export interface EntraCertificateRuntimeConfig {
+    certificatePem?: string;
+    certificatePath?: string;
+    privateKeyPem?: string;
+    privateKeyPath?: string;
+}
+export interface EntraServiceRuntimeConfig extends EntraCertificateRuntimeConfig {
+    tenantId: string;
+    clientId: string;
+    clientSecret?: string;
+    scope: string;
+}
+export interface EntraOboRuntimeConfig extends EntraCertificateRuntimeConfig {
+    tenantId: string;
+    clientId: string;
+    clientSecret?: string;
+    scope: string;
+}
+export interface NebulasServerRuntimeConfig {
+    a2aUrl?: string;
+    a2aAuthStrategy?: "session" | "client_credentials" | "resource_owner_password";
+    a2aApiKey?: string;
+    authProvider?: AuthProvider;
+    nebulasApiUrl?: string;
+    nebulasApiKey?: string;
+    nebulasProjectId?: string;
+    auth0?: Auth0RuntimeConfig;
+    auth0ServiceUser?: Auth0ServiceUserRuntimeConfig;
+    entraService?: EntraServiceRuntimeConfig;
+    entraObo?: EntraOboRuntimeConfig;
+}
+export declare function configureNebulasServer(config: Partial<NebulasServerRuntimeConfig>): void;
+export declare function getNebulasServerConfig(): Readonly<NebulasServerRuntimeConfig>;
+//# sourceMappingURL=runtime-config.d.ts.map

package/dist/server/runtime-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-config.d.ts","sourceRoot":"","sources":["../../src/server/runtime-config.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,OAAO,CAAC;AAE7C,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,6BAA6B;IAC5C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,yBAA0B,SAAQ,6BAA6B;IAC9E,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,qBAAsB,SAAQ,6BAA6B;IAC1E,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,SAAS,GAAG,oBAAoB,GAAG,yBAAyB,CAAC;IAC/E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAC3B,gBAAgB,CAAC,EAAE,6BAA6B,CAAC;IACjD,YAAY,CAAC,EAAE,yBAAyB,CAAC;IACzC,QAAQ,CAAC,EAAE,qBAAqB,CAAC;CAClC;AAID,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,OAAO,CAAC,0BAA0B,CAAC,GAC1C,IAAI,CAeN;AAED,wBAAgB,sBAAsB,IAAI,QAAQ,CAAC,0BAA0B,CAAC,CAE7E"}

package/dist/server/runtime-config.js

@@ -0,0 +1,20 @@
+let runtimeConfig = {};
+export function configureNebulasServer(config) {
+    runtimeConfig = {
+        ...runtimeConfig,
+        ...config,
+        auth0: config.auth0 ? { ...runtimeConfig.auth0, ...config.auth0 } : runtimeConfig.auth0,
+        auth0ServiceUser: config.auth0ServiceUser
+            ? { ...runtimeConfig.auth0ServiceUser, ...config.auth0ServiceUser }
+            : runtimeConfig.auth0ServiceUser,
+        entraService: config.entraService
+            ? { ...runtimeConfig.entraService, ...config.entraService }
+            : runtimeConfig.entraService,
+        entraObo: config.entraObo
+            ? { ...runtimeConfig.entraObo, ...config.entraObo }
+            : runtimeConfig.entraObo,
+    };
+}
+export function getNebulasServerConfig() {
+    return runtimeConfig;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gnomondigital/nebulas-kit-core",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "type": "module",
   "sideEffects": false,
   "main": "./dist/index.js",