alibabacloud-agentcore-sdk 0.1.0

package/dist/chunk-BVZ7H2F5.cjs

@@ -0,0 +1,582 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; } var _class; var _class2; var _class3; var _class4;
+
+var _chunkYZP55W7Scjs = require('./chunk-YZP55W7S.cjs');
+
+
+
+var _chunk2E5EWEDGcjs = require('./chunk-2E5EWEDG.cjs');
+
+
+
+
+
+
+var _chunk5RKN46UUcjs = require('./chunk-5RKN46UU.cjs');
+
+
+var _chunkLE5P3SJWcjs = require('./chunk-LE5P3SJW.cjs');
+
+
+
+
+var _chunkJSP7ZROScjs = require('./chunk-JSP7ZROS.cjs');
+
+// src/runtime/environment.ts
+var _promises = require('fs/promises');
+var DEFAULT_ENV_PATH = "/var/run/agentcore/agent/env";
+function words(line) {
+  const parts = [];
+  let word = "";
+  let quote = "";
+  let started = false;
+  for (let i = 0; i < line.length; i++) {
+    const char = line[i];
+    if (quote === "'") {
+      if (char === quote) quote = "";
+      else word += char;
+    } else if (char === "\\") {
+      const next = line[++i];
+      if (next === void 0) throw new Error("incomplete escape");
+      if (quote === '"' && next !== '"' && next !== "\\") word += "\\";
+      word += next;
+      started = true;
+    } else if (quote) {
+      if (char === quote) quote = "";
+      else word += char;
+    } else if (char === '"' || char === "'") {
+      quote = char;
+      started = true;
+    } else if (/\s/.test(char)) {
+      if (started) {
+        parts.push(word);
+        word = "";
+        started = false;
+      }
+    } else {
+      word += char;
+      started = true;
+    }
+  }
+  if (quote) throw new Error("unclosed quote");
+  if (started) parts.push(word);
+  return parts;
+}
+function parseRuntimeEnvironment(text) {
+  const values = /* @__PURE__ */ Object.create(null);
+  for (const [index, raw] of text.split(/\r?\n/).entries()) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#")) continue;
+    try {
+      const parts = words(line);
+      if (parts.length !== 2 || parts[0] !== "export") throw new Error("expected export");
+      const match = /^([A-Za-z_][A-Za-z0-9_]*)=([\s\S]*)$/.exec(parts[1]);
+      if (!match || Object.hasOwn(values, match[1])) throw new Error("invalid assignment");
+      values[match[1]] = match[2];
+    } catch (e) {
+      throw new (0, _chunkJSP7ZROScjs.ConfigError)(`invalid runtime env at line ${index + 1}`);
+    }
+  }
+  return values;
+}
+var RuntimeEnvironmentProvider = class {
+  constructor(path = DEFAULT_ENV_PATH) {
+    this.path = path;
+  }
+  
+  async read() {
+    let text;
+    try {
+      text = await _promises.readFile.call(void 0, this.path, "utf8");
+    } catch (cause) {
+      throw new (0, _chunkJSP7ZROScjs.ConfigError)("cannot read AgentCore runtime env", { cause });
+    }
+    return parseRuntimeEnvironment(text);
+  }
+  async snapshot() {
+    const values = await this.read();
+    const endpoint = values.AGENTCORE_CONTROL_ENDPOINT || process.env.AGENTCORE_CONTROL_ENDPOINT;
+    return {
+      controllerUrl: _chunk5RKN46UUcjs.httpUrl.call(void 0, values.AGENTCORE_CONTROLLER_URL || values.AGENTTEAMS_CONTROLLER_URL, "runtime Controller URL"),
+      agentSATokenFile: _chunk5RKN46UUcjs.requiredString.call(void 0, values.AGENTCORE_AUTH_TOKEN_FILE || values.AGENTTEAMS_AUTH_TOKEN_FILE, "runtime SA token file"),
+      controlPlaneEndpoint: _optionalChain([endpoint, 'optionalAccess', _ => _.trim, 'call', _2 => _2()]) || void 0
+    };
+  }
+  async value(name) {
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) throw new (0, _chunkJSP7ZROScjs.ConfigError)("runtime environment name is invalid");
+    const values = await this.read();
+    return _chunk5RKN46UUcjs.requiredString.call(void 0, values[name] || process.env[name], `runtime env ${name}`);
+  }
+  async taskServiceEndpoint() {
+    const values = await this.read();
+    const endpoint = values.AGENTCORE_TASK_SERVICE_ENDPOINT || process.env.AGENTCORE_TASK_SERVICE_ENDPOINT;
+    if (_optionalChain([endpoint, 'optionalAccess', _3 => _3.trim, 'call', _4 => _4()])) return _chunk5RKN46UUcjs.httpUrl.call(void 0, endpoint, "Task Service endpoint");
+    const gateway = _chunk5RKN46UUcjs.httpUrl.call(void 0, values.AGENTTEAMS_MATRIX_URL || process.env.AGENTTEAMS_MATRIX_URL, "Task Service endpoint");
+    return gateway.endsWith("/agentteams-app") ? gateway : `${gateway}/agentteams-app`;
+  }
+};
+
+// src/runtime/managed.ts
+
+var _promises3 = require('timers/promises');
+var ManagedRuntimeSource = (_class = class {
+  constructor(options = {}) {;_class.prototype.__init.call(this);
+    this.options = options;
+  }
+  
+  
+  
+  __init() {this.lifetime = new AbortController()}
+  async resolve() {
+    this.lifetime.signal.throwIfAborted();
+    if (this.bindings) return this.bindings;
+    if (this.pending) return this.pending;
+    const request = this.load();
+    this.pending = request;
+    try {
+      this.bindings = await request;
+      return this.bindings;
+    } finally {
+      this.pending = void 0;
+    }
+  }
+  close() {
+    this.lifetime.abort();
+  }
+  async load() {
+    const configPath = this.options.configPath || process.env.AGENTCORE_CONFIG_PATH || _chunk5RKN46UUcjs.DEFAULT_CONFIG_PATH;
+    const rawTimeout = _nullishCoalesce(process.env.AGENTCORE_CONFIG_WAIT_TIMEOUT, () => ( "10"));
+    if (!/^\d+$/.test(rawTimeout) || !Number.isSafeInteger(Number(rawTimeout))) {
+      throw new (0, _chunkJSP7ZROScjs.ConfigError)("AGENTCORE_CONFIG_WAIT_TIMEOUT must be a non-negative integer");
+    }
+    const deadline = performance.now() + Number(rawTimeout) * 1e3;
+    let config;
+    const logger = _nullishCoalesce(this.options.logger, () => ( _chunkLE5P3SJWcjs.nullLogger));
+    for (; ; ) {
+      this.lifetime.signal.throwIfAborted();
+      let data;
+      try {
+        data = await _promises.readFile.call(void 0, configPath);
+      } catch (cause) {
+        const remaining = deadline - performance.now();
+        if (!(cause && typeof cause === "object" && "code" in cause && cause.code === "ENOENT") || remaining <= 0) {
+          throw new (0, _chunkJSP7ZROScjs.ConfigError)("cannot read agent.yaml", { cause });
+        }
+        logger.info("agentcore.runtime.config.waiting_for_mount", { path: configPath, retryInMs: Math.min(500, remaining) });
+        await _promises3.setTimeout.call(void 0, Math.min(500, remaining), void 0, { signal: this.lifetime.signal });
+        continue;
+      }
+      config = _chunk5RKN46UUcjs.parseAgentConfig.call(void 0, data);
+      break;
+    }
+    const configuredEnv = this.options.envPath || process.env.AGENTCORE_ENV_PATH;
+    const envPath = configuredEnv || DEFAULT_ENV_PATH;
+    let hasEnvironment = Boolean(configuredEnv);
+    if (!hasEnvironment) {
+      try {
+        await _promises.access.call(void 0, envPath);
+        hasEnvironment = true;
+      } catch (cause) {
+        if (!(cause && typeof cause === "object" && "code" in cause && cause.code === "ENOENT")) {
+          throw new (0, _chunkJSP7ZROScjs.ConfigError)("cannot access AgentCore runtime env", { cause });
+        }
+      }
+    }
+    const environment = hasEnvironment ? await new RuntimeEnvironmentProvider(envPath).snapshot() : void 0;
+    const bindings = {
+      config,
+      controllerEndpoint: _optionalChain([environment, 'optionalAccess', _5 => _5.controllerUrl]),
+      controlPlaneEndpoint: _nullishCoalesce(_nullishCoalesce(this.options.controlPlaneEndpoint, () => ( _optionalChain([environment, 'optionalAccess', _6 => _6.controlPlaneEndpoint]))), () => ( process.env.AGENTCORE_CONTROL_ENDPOINT)),
+      agentSATokens: environment ? new (0, _chunk2E5EWEDGcjs.AgentSATokenProvider)(environment.agentSATokenFile) : void 0
+    };
+    this.lifetime.signal.throwIfAborted();
+    logger.info("agentcore.runtime.source.resolved", { mode: "managed", envLoaded: hasEnvironment, workspaceId: config.workspaceId });
+    return bindings;
+  }
+}, _class);
+
+// src/runtime/debug.ts
+var _util = require('util');
+
+
+// src/runtime/control-config.ts
+var _crypto = require('crypto');
+var _net = require('net');
+function objectKey(value, field) {
+  const key = _chunk5RKN46UUcjs.requiredString.call(void 0, value, field);
+  if (/[\\\r\n]/.test(key) || key.split("/").some((p) => !p || p === "." || p === "..")) {
+    throw new (0, _chunkJSP7ZROScjs.CredentialExchangeError)(`Controller returned an invalid ${field}`);
+  }
+  return key;
+}
+var ControlConfigLoader = (_class2 = class {
+  constructor(endpoint, source, options = {}) {;_class2.prototype.__init2.call(this);
+    this.options = options;
+    this.controller = new (0, _chunk2E5EWEDGcjs.ControllerClient)(endpoint, source, options);
+    this.logger = _nullishCoalesce(options.logger, () => ( _chunkLE5P3SJWcjs.nullLogger));
+  }
+  
+  
+  
+  __init2() {this.lifetime = new AbortController()}
+  #credential;
+  
+  async load() {
+    const credential = await this.credential();
+    const data = await this.download(credential, credential.agentConfigPath);
+    return _chunk5RKN46UUcjs.parseAgentConfig.call(void 0, data);
+  }
+  async loadTeams() {
+    let credential = await this.credential();
+    if (!credential.teamsConfigPath) credential = await this.credential(true);
+    return credential.teamsConfigPath ? this.download(credential, credential.teamsConfigPath, true) : void 0;
+  }
+  close() {
+    this.controller.close();
+    this.lifetime.abort();
+    this.#credential = void 0;
+  }
+  async credential(force = false) {
+    this.lifetime.signal.throwIfAborted();
+    if (!force && this.#credential && this.#credential.expiration > Date.now() + 6e4) return this.#credential;
+    if (this.pending) return this.pending;
+    const request = this.exchange();
+    this.pending = request;
+    try {
+      this.#credential = await request;
+      return this.#credential;
+    } finally {
+      this.pending = void 0;
+    }
+  }
+  async exchange() {
+    const response = await this.controller.post("/api/v1/credentials/sts", { purpose: "oss", target: "control" });
+    if (response.status === 401) throw new (0, _chunkJSP7ZROScjs.AuthenticationError)("Controller rejected the Agent SA token");
+    if (response.status < 200 || response.status >= 300) throw new (0, _chunkJSP7ZROScjs.CredentialExchangeError)(`Controller control-config STS failed with HTTP ${response.status}`);
+    try {
+      const data = _chunk5RKN46UUcjs.object.call(void 0, response.payload, "control-config STS");
+      const read = (field) => _chunk5RKN46UUcjs.requiredString.call(void 0, data[field], field);
+      const endpoint = read("oss_endpoint");
+      const ossEndpoint = _chunk5RKN46UUcjs.httpUrl.call(void 0, endpoint.includes("://") ? endpoint : `https://${endpoint}`, "OSS endpoint");
+      if (new URL(ossEndpoint).pathname !== "/") throw new Error("OSS endpoint path");
+      const ossBucket = read("oss_bucket");
+      if (!/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/.test(ossBucket)) throw new Error("OSS bucket");
+      const expiration = Date.parse(read("expiration"));
+      if (!(expiration > Date.now())) throw new Error("expired control-config STS");
+      return {
+        accessKeyId: read("access_key_id"),
+        accessKeySecret: read("access_key_secret"),
+        securityToken: read("security_token"),
+        expiration,
+        ossEndpoint,
+        ossBucket,
+        agentConfigPath: objectKey(data.agent_config_path, "agent_config_path"),
+        teamsConfigPath: data.teams_config_path == null ? void 0 : objectKey(data.teams_config_path, "teams_config_path")
+      };
+    } catch (e2) {
+      throw new (0, _chunkJSP7ZROScjs.CredentialExchangeError)("Controller returned an invalid control-config STS response");
+    }
+  }
+  async download(credential, key, missingOK = false) {
+    const original = new URL(credential.ossEndpoint);
+    const candidates = [original];
+    if (/^(?:[a-z0-9-]+\.)?oss-.+-internal\.aliyuncs\.com$/.test(original.hostname)) {
+      const fallback = new URL(original);
+      fallback.hostname = fallback.hostname.replace("-internal.aliyuncs.com", ".aliyuncs.com");
+      candidates.push(fallback);
+    }
+    let lastStatus;
+    for (const endpoint of candidates) {
+      this.lifetime.signal.throwIfAborted();
+      const url = new URL(endpoint);
+      const pathStyle = url.hostname === "localhost" || _net.isIP.call(void 0, url.hostname.replace(/^\[|\]$/g, "")) !== 0;
+      if (!pathStyle && !url.hostname.startsWith(`${credential.ossBucket}.`)) url.hostname = `${credential.ossBucket}.${url.hostname}`;
+      const encodedKey = key.split("/").map((part) => encodeURIComponent(part).replace(/[!'()*]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`)).join("/");
+      url.pathname = `${pathStyle ? `/${credential.ossBucket}` : ""}/${encodedKey}`;
+      const date = (/* @__PURE__ */ new Date()).toUTCString();
+      const canonical = `GET
+
+
+${date}
+x-oss-security-token:${credential.securityToken}
+/${credential.ossBucket}/${key}`;
+      const signature = _crypto.createHmac.call(void 0, "sha1", credential.accessKeySecret).update(canonical).digest("base64");
+      this.logger.debug("agentcore.control_config.download.started", { host: url.host, path: url.pathname });
+      try {
+        const response = await fetch(url, {
+          headers: { Date: date, Authorization: `OSS ${credential.accessKeyId}:${signature}`, "x-oss-security-token": credential.securityToken },
+          redirect: "manual",
+          signal: AbortSignal.any([this.lifetime.signal, AbortSignal.timeout(_nullishCoalesce(this.options.timeoutMs, () => ( 1e4)))])
+        });
+        if (response.ok) {
+          const data = await _chunkYZP55W7Scjs.readBytes.call(void 0, response, 1024 * 1024, "runtime config");
+          this.logger.info("agentcore.control_config.download.succeeded", { host: url.host, bytes: data.length });
+          return data;
+        }
+        lastStatus = response.status;
+        await _optionalChain([response, 'access', _7 => _7.body, 'optionalAccess', _8 => _8.cancel, 'call', _9 => _9()]);
+        if (missingOK && response.status === 404) return void 0;
+        this.logger.warn("agentcore.control_config.download.failed", { host: url.host, status: response.status });
+      } catch (error) {
+        this.lifetime.signal.throwIfAborted();
+        if (error instanceof _chunkJSP7ZROScjs.ConfigError) throw error;
+        this.logger.warn("agentcore.control_config.download.failed", { host: url.host, reason: "transport_error" });
+      }
+    }
+    throw new (0, _chunkJSP7ZROScjs.ConfigError)(lastStatus ? `AgentCore configuration download failed with HTTP ${lastStatus}` : "cannot reach the AgentCore configuration store");
+  }
+}, _class2);
+
+// src/runtime/debug.ts
+var DebugToken = (_class3 = class {
+  constructor(jwtToken, controllerUrl, modelGatewayUrl, matrixUrl) {;_class3.prototype.__init3.call(this);
+    this.controllerUrl = controllerUrl;
+    this.modelGatewayUrl = modelGatewayUrl;
+    this.matrixUrl = matrixUrl;
+    this.#jwtToken = jwtToken;
+  }
+  
+  
+  
+  __init3() {this.product = "agentcore"}
+  #jwtToken;
+  get jwtToken() {
+    return this.#jwtToken;
+  }
+  [_util.inspect.custom]() {
+    return "DebugToken(product=agentcore, <redacted>)";
+  }
+  toJSON() {
+    return this[_util.inspect.custom]();
+  }
+}, _class3);
+function parseDebugToken(value) {
+  try {
+    const encoded = value.trim();
+    if (!encoded || encoded.length > 35e4 || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(encoded)) throw new Error("base64");
+    const raw = Buffer.from(encoded, "base64");
+    if (raw.length > 256 * 1024) throw new Error("size");
+    const data = _chunk5RKN46UUcjs.object.call(void 0, JSON.parse(new TextDecoder("utf8", { fatal: true }).decode(raw)), "debug token");
+    if (data.product !== "agentcore") throw new Error("product");
+    const controller = _chunk5RKN46UUcjs.httpUrl.call(void 0, data.controllerUrl, "controllerUrl");
+    if (new URL(controller).pathname !== "/") throw new Error("controllerUrl path");
+    return new DebugToken(
+      _chunk5RKN46UUcjs.requiredString.call(void 0, data.jwtToken, "jwtToken"),
+      controller,
+      _chunk5RKN46UUcjs.httpUrl.call(void 0, data.modelGatewayUrl, "modelGatewayUrl"),
+      _chunk5RKN46UUcjs.httpUrl.call(void 0, data.matrixUrl, "matrixUrl")
+    );
+  } catch (e3) {
+    throw new (0, _chunkJSP7ZROScjs.ConfigError)("AGENTCORE_DEBUG_TOKEN is invalid");
+  }
+}
+var DebugTokenExchangeUnavailable = class extends _chunkJSP7ZROScjs.AuthenticationError {
+};
+var DebugRuntimeSource = (_class4 = class {
+  constructor(token, options = {}) {;_class4.prototype.__init4.call(this);_class4.prototype.__init5.call(this);_class4.prototype.__init6.call(this);
+    this.token = token;
+    this.options = options;
+    this.#jwtToken = token.jwtToken;
+    this.configLoader = new ControlConfigLoader(token.controllerUrl, this, options);
+    this.controller = new (0, _chunk2E5EWEDGcjs.ControllerClient)(token.controllerUrl, this, options);
+    this.logger = _nullishCoalesce(options.logger, () => ( _chunkLE5P3SJWcjs.nullLogger));
+  }
+  
+  
+  #jwtToken;
+  #saToken;
+  __init4() {this.saExpiresAt = 0}
+  __init5() {this.jwtExpiresAt = 0}
+  
+  
+  
+  
+  __init6() {this.lifetime = new AbortController()}
+  
+  
+  
+  get matrixUrl() {
+    return this.token.matrixUrl;
+  }
+  async resolve() {
+    this.lifetime.signal.throwIfAborted();
+    if (this.bindings) return this.bindings;
+    if (this.resolving) return this.resolving;
+    const request = this.load();
+    this.resolving = request;
+    try {
+      this.bindings = await request;
+      return this.bindings;
+    } finally {
+      this.resolving = void 0;
+    }
+  }
+  async get() {
+    this.lifetime.signal.throwIfAborted();
+    if (this.#saToken && this.saExpiresAt > Date.now() + 6e4) return this.#saToken;
+    return this.exchange();
+  }
+  async refresh(current) {
+    this.lifetime.signal.throwIfAborted();
+    if (this.#saToken && this.#saToken !== current) return this.#saToken;
+    return this.exchange();
+  }
+  async loadTeamsConfig() {
+    await this.resolve();
+    return this.configLoader.loadTeams();
+  }
+  async exchangeMatrixToken() {
+    const response = await this.controller.post("/api/v1/credentials/matrix-token");
+    if (response.status < 200 || response.status >= 300) throw new (0, _chunkJSP7ZROScjs.AuthenticationError)(`Controller Matrix token request failed with HTTP ${response.status}`);
+    try {
+      return _chunk5RKN46UUcjs.requiredString.call(void 0, _chunk5RKN46UUcjs.object.call(void 0, response.payload, "Matrix token").access_token, "access_token");
+    } catch (e4) {
+      throw new (0, _chunkJSP7ZROScjs.AuthenticationError)("Controller returned an invalid Matrix token response");
+    }
+  }
+  close() {
+    this.lifetime.abort();
+    if (this.refreshTimer) clearTimeout(this.refreshTimer);
+    this.configLoader.close();
+    this.controller.close();
+    this.#saToken = void 0;
+    this.#jwtToken = "";
+  }
+  [_util.inspect.custom]() {
+    return "DebugRuntimeSource(<redacted>)";
+  }
+  toJSON() {
+    return this[_util.inspect.custom]();
+  }
+  async load() {
+    const config = await this.configLoader.load();
+    this.lifetime.signal.throwIfAborted();
+    const override = (mounted) => {
+      const gateway = new URL(this.token.modelGatewayUrl);
+      const runtime = new URL(mounted);
+      if (runtime.pathname !== "/") gateway.pathname = runtime.pathname;
+      return gateway.toString().replace(/\/+$/, "");
+    };
+    const projected = Object.freeze({
+      ...config,
+      modelGatewayUrl: override(config.modelGatewayUrl),
+      mcpGatewayUrl: override(config.mcpGatewayUrl)
+    });
+    this.logger.info("agentcore.runtime.source.resolved", { mode: "debug", workspaceId: config.workspaceId });
+    return {
+      config: projected,
+      controllerEndpoint: this.token.controllerUrl,
+      controlPlaneEndpoint: this.options.controlPlaneEndpoint,
+      agentSATokens: this
+    };
+  }
+  async exchange() {
+    this.lifetime.signal.throwIfAborted();
+    if (this.exchanging) return this.exchanging;
+    const request = this.requestToken().then((data) => {
+      this.lifetime.signal.throwIfAborted();
+      this.#saToken = data.token;
+      this.saExpiresAt = data.expiresAt;
+      this.#jwtToken = data.jwtToken;
+      this.jwtExpiresAt = data.jwtExpiresAt;
+      this.scheduleRefresh();
+      this.logger.info("agentcore.runtime.debug.sa_exchange.succeeded", {
+        expiration: new Date(this.saExpiresAt).toISOString(),
+        jwtExpiration: new Date(this.jwtExpiresAt).toISOString()
+      });
+      return this.#saToken;
+    });
+    this.exchanging = request;
+    try {
+      return await request;
+    } finally {
+      this.exchanging = void 0;
+    }
+  }
+  scheduleRefresh(delay = Math.max(1e3, this.jwtExpiresAt - Date.now() - 3e5)) {
+    if (this.refreshTimer) clearTimeout(this.refreshTimer);
+    if (this.lifetime.signal.aborted) return;
+    this.refreshTimer = setTimeout(() => {
+      void this.backgroundRefresh();
+    }, delay);
+    this.refreshTimer.unref();
+  }
+  async backgroundRefresh() {
+    if (this.lifetime.signal.aborted || this.jwtExpiresAt <= Date.now()) return;
+    try {
+      await this.exchange();
+    } catch (error) {
+      if (this.lifetime.signal.aborted) return;
+      const remaining = this.jwtExpiresAt - Date.now();
+      this.logger.warn("agentcore.runtime.debug.jwt_refresh.failed", { reason: error instanceof DebugTokenExchangeUnavailable ? "temporarily_unavailable" : "authentication_failed" });
+      if (error instanceof DebugTokenExchangeUnavailable && remaining > 1e3) this.scheduleRefresh(Math.min(3e4, remaining / 2));
+    }
+  }
+  async requestToken() {
+    const url = `${this.token.controllerUrl}/api/v1/edge/token`;
+    for (let attempt = 1; attempt <= (_nullishCoalesce(this.options.maxAttempts, () => ( 3))); attempt++) {
+      let response;
+      let payload;
+      try {
+        response = await fetch(url, {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ jwtToken: this.#jwtToken }),
+          redirect: "manual",
+          signal: AbortSignal.any([this.lifetime.signal, AbortSignal.timeout(_nullishCoalesce(this.options.timeoutMs, () => ( 1e4)))])
+        });
+        const text = await response.text();
+        try {
+          payload = JSON.parse(text);
+        } catch (e5) {
+          payload = void 0;
+        }
+      } catch (e6) {
+        this.lifetime.signal.throwIfAborted();
+        if (attempt === (_nullishCoalesce(this.options.maxAttempts, () => ( 3)))) throw new DebugTokenExchangeUnavailable("cannot reach the AgentCore Controller");
+        this.logger.warn("agentcore.runtime.debug.sa_exchange.retry", { url, attempt, reason: "transport_error" });
+        await _promises3.setTimeout.call(void 0, 50 * 2 ** (attempt - 1), void 0, { signal: this.lifetime.signal });
+        continue;
+      }
+      if ([500, 502, 503, 504].includes(response.status)) {
+        if (attempt === (_nullishCoalesce(this.options.maxAttempts, () => ( 3)))) throw new DebugTokenExchangeUnavailable("Controller debug token service is unavailable");
+        this.logger.warn("agentcore.runtime.debug.sa_exchange.retry", { url, attempt, status: response.status });
+        await _promises3.setTimeout.call(void 0, 50 * 2 ** (attempt - 1), void 0, { signal: this.lifetime.signal });
+        continue;
+      }
+      if ([401, 403].includes(response.status)) throw new (0, _chunkJSP7ZROScjs.AuthenticationError)("Controller rejected the AgentCore debug token");
+      if (!response.ok) throw new (0, _chunkJSP7ZROScjs.AuthenticationError)(`Controller debug token exchange failed with HTTP ${response.status}`);
+      try {
+        const data = _chunk5RKN46UUcjs.object.call(void 0, payload, "debug token response");
+        const token = _chunk5RKN46UUcjs.requiredString.call(void 0, data.token, "token");
+        const jwtToken = _chunk5RKN46UUcjs.requiredString.call(void 0, data.jwtToken, "jwtToken");
+        const expiresAt = Date.parse(_chunk5RKN46UUcjs.requiredString.call(void 0, data.expiresAt, "expiresAt"));
+        const jwtExpiresAt = Date.parse(_chunk5RKN46UUcjs.requiredString.call(void 0, data.jwtExpiresAt, "jwtExpiresAt"));
+        if (!(expiresAt > Date.now()) || !(jwtExpiresAt > Date.now())) throw new Error("expiry");
+        return { token, jwtToken, expiresAt, jwtExpiresAt };
+      } catch (e7) {
+        throw new (0, _chunkJSP7ZROScjs.AuthenticationError)("Controller returned an invalid debug token response");
+      }
+    }
+    throw new DebugTokenExchangeUnavailable("Controller debug token service is unavailable");
+  }
+}, _class4);
+function createRuntimeSource(options = {}) {
+  const raw = _optionalChain([process, 'access', _10 => _10.env, 'access', _11 => _11.AGENTCORE_DEBUG_TOKEN, 'optionalAccess', _12 => _12.trim, 'call', _13 => _13()]);
+  if (raw) return new DebugRuntimeSource(parseDebugToken(raw), {
+    controlPlaneEndpoint: _nullishCoalesce(options.controlPlaneEndpoint, () => ( process.env.AGENTCORE_CONTROL_ENDPOINT)),
+    logger: options.logger
+  });
+  return new ManagedRuntimeSource(options);
+}
+
+
+
+
+
+
+
+
+
+
+exports.DEFAULT_ENV_PATH = DEFAULT_ENV_PATH; exports.parseRuntimeEnvironment = parseRuntimeEnvironment; exports.RuntimeEnvironmentProvider = RuntimeEnvironmentProvider; exports.ManagedRuntimeSource = ManagedRuntimeSource; exports.DebugToken = DebugToken; exports.parseDebugToken = parseDebugToken; exports.DebugRuntimeSource = DebugRuntimeSource; exports.createRuntimeSource = createRuntimeSource;
+//# sourceMappingURL=chunk-BVZ7H2F5.cjs.map

package/dist/chunk-BVZ7H2F5.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["/Users/zhuoguang/Documents/Code/collaborate/hiclaw/agentcore-sdk-nodejs/dist/chunk-BVZ7H2F5.cjs","../src/runtime/environment.ts","../src/runtime/managed.ts","../src/runtime/debug.ts","../src/runtime/control-config.ts"],"names":[],"mappings":"AAAA;AACE;AACF,wDAA6B;AAC7B;AACE;AACA;AACF,wDAA6B;AAC7B;AACE;AACA;AACA;AACA;AACA;AACF,wDAA6B;AAC7B;AACE;AACF,wDAA6B;AAC7B;AACE;AACA;AACA;AACF,wDAA6B;AAC7B;AACA;ACvBA,uCAAyB;AAIlB,IAAM,iBAAA,EAAmB,8BAAA;AAQhC,SAAS,KAAA,CAAM,IAAA,EAAwB;AACrC,EAAA,MAAM,MAAA,EAAkB,CAAC,CAAA;AACzB,EAAA,IAAI,KAAA,EAAO,EAAA;AACX,EAAA,IAAI,MAAA,EAAQ,EAAA;AACZ,EAAA,IAAI,QAAA,EAAU,KAAA;AACd,EAAA,IAAA,CAAA,IAAS,EAAA,EAAI,CAAA,EAAG,EAAA,EAAI,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAA,EAAK;AACpC,IAAA,MAAM,KAAA,EAAO,IAAA,CAAK,CAAC,CAAA;AACnB,IAAA,GAAA,CAAI,MAAA,IAAU,GAAA,EAAK;AACjB,MAAA,GAAA,CAAI,KAAA,IAAS,KAAA,EAAO,MAAA,EAAQ,EAAA;AAAA,MAAA,KAAS,KAAA,GAAQ,IAAA;AAAA,IAC/C,EAAA,KAAA,GAAA,CAAW,KAAA,IAAS,IAAA,EAAM;AACxB,MAAA,MAAM,KAAA,EAAO,IAAA,CAAK,EAAE,CAAC,CAAA;AACrB,MAAA,GAAA,CAAI,KAAA,IAAS,KAAA,CAAA,EAAW,MAAM,IAAI,KAAA,CAAM,mBAAmB,CAAA;AAC3D,MAAA,GAAA,CAAI,MAAA,IAAU,IAAA,GAAO,KAAA,IAAS,IAAA,GAAO,KAAA,IAAS,IAAA,EAAM,KAAA,GAAQ,IAAA;AAC5D,MAAA,KAAA,GAAQ,IAAA;AACR,MAAA,QAAA,EAAU,IAAA;AAAA,IACZ,EAAA,KAAA,GAAA,CAAW,KAAA,EAAO;AAChB,MAAA,GAAA,CAAI,KAAA,IAAS,KAAA,EAAO,MAAA,EAAQ,EAAA;AAAA,MAAA,KAAS,KAAA,GAAQ,IAAA;AAAA,IAC/C,EAAA,KAAA,GAAA,CAAW,KAAA,IAAS,IAAA,GAAO,KAAA,IAAS,GAAA,EAAK;AACvC,MAAA,MAAA,EAAQ,IAAA;AACR,MAAA,QAAA,EAAU,IAAA;AAAA,IACZ,EAAA,KAAA,GAAA,CAAW,IAAA,CAAK,IAAA,CAAK,IAAI,CAAA,EAAG;AAC1B,MAAA,GAAA,CAAI,OAAA,EAAS;AAAE,QAAA,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA;AAAG,QAAA,KAAA,EAAO,EAAA;AAAI,QAAA,QAAA,EAAU,KAAA;AAAA,MAAO;AAAA,IAC/D,EAAA,KAAO;AACL,MAAA,KAAA,GAAQ,IAAA;AACR,MAAA,QAAA,EAAU,IAAA;AAAA,IACZ;AAAA,EACF;AACA,EAAA,GAAA,CAAI,KAAA,EAAO,MAAM,IAAI,KAAA,CAAM,gBAAgB,CAAA;AAC3C,EAAA,GAAA,CAAI,OAAA,EAAS,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA;AAC5B,EAAA,OAAO,KAAA;AACT;AAEO,SAAS,uBAAA,CAAwB,IAAA,EAAsC;AAC5E,EAAA,MAAM,OAAA,kBAAiC,MAAA,CAAO,MAAA,CAAO,IAAI,CAAA;AACzD,EAAA,IAAA,CAAA,MAAW,CAAC,KAAA,EAAO,GAAG,EAAA,GAAK,IAAA,CAAK,KAAA,CAAM,OAAO,CAAA,CAAE,OAAA,CAAQ,CAAA,EAAG;AACxD,IAAA,MAAM,KAAA,EAAO,GAAA,CAAI,IAAA,CAAK,CAAA;AACtB,IAAA,GAAA,CAAI,CAAC,KAAA,GAAQ,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,EAAG,QAAA;AACnC,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,EAAQ,KAAA,CAAM,IAAI,CAAA;AACxB,MAAA,GAAA,CAAI,KAAA,CAAM,OAAA,IAAW,EAAA,GAAK,KAAA,CAAM,CAAC,EAAA,IAAM,QAAA,EAAU,MAAM,IAAI,KAAA,CAAM,iBAAiB,CAAA;AAClF,MAAA,MAAM,MAAA,EAAQ,sCAAA,CAAuC,IAAA,CAAK,KAAA,CAAM,CAAC,CAAE,CAAA;AACnE,MAAA,GAAA,CAAI,CAAC,MAAA,GAAS,MAAA,CAAO,MAAA,CAAO,MAAA,EAAQ,KAAA,CAAM,CAAC,CAAE,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,oBAAoB,CAAA;AACpF,MAAA,MAAA,CAAO,KAAA,CAAM,CAAC,CAAE,EAAA,EAAI,KAAA,CAAM,CAAC,CAAA;AAAA,IAC7B,EAAA,UAAQ;AAAE,MAAA,MAAM,IAAI,kCAAA,CAAY,CAAA,4BAAA,EAA+B,MAAA,EAAQ,CAAC,CAAA,CAAA;AAAK,IAAA;AAC/E,EAAA;AACO,EAAA;AACT;AAEwC;AACQ,EAAA;AAAzB,IAAA;AAA0B,EAAA;AAA1B,EAAA;AACyB,EAAA;AACxC,IAAA;AACA,IAAA;AAAyC,MAAA;AAAmB,IAAA;AACD,MAAA;AAC/D,IAAA;AACmC,IAAA;AACrC,EAAA;AAC8C,EAAA;AACb,IAAA;AAC+B,IAAA;AACvD,IAAA;AACqD,MAAA;AAClB,MAAA;AACE,MAAA;AAC5C,IAAA;AACF,EAAA;AAC2C,EAAA;AACa,IAAA;AACvB,IAAA;AAC0B,IAAA;AAC3D,EAAA;AAC6C,EAAA;AACZ,IAAA;AAC4B,IAAA;AACZ,IAAA;AACiB,IAAA;AACC,IAAA;AACnE,EAAA;AACF;AD0BqE;AACA;AErHpC;AACG;AAwBuB;AAIS,EAAA;AAArC,IAAA;AAAsC,EAAA;AAAtC,EAAA;AAHrB,EAAA;AACA,EAAA;AACwC,iBAAA;AAGN,EAAA;AACJ,IAAA;AACL,IAAA;AACD,IAAA;AACJ,IAAA;AACX,IAAA;AACX,IAAA;AAAwB,MAAA;AAAqB,MAAA;AACjD,IAAA;AAAyB,MAAA;AAAW,IAAA;AACtC,EAAA;AACc,EAAA;AAAsB,IAAA;AAAG,EAAA;AAEQ,EAAA;AACa,IAAA;AACM,IAAA;AACF,IAAA;AACtC,MAAA;AACxB,IAAA;AAC0D,IAAA;AACtD,IAAA;AACkC,IAAA;AAC7B,IAAA;AAC6B,MAAA;AAChC,MAAA;AACA,MAAA;AAAkC,QAAA;AAAmB,MAAA;AACV,QAAA;AACS,QAAA;AACK,UAAA;AAC3D,QAAA;AAC4D,QAAA;AACI,QAAA;AAChE,QAAA;AACF,MAAA;AAC8B,MAAA;AAC9B,MAAA;AACF,IAAA;AAC0D,IAAA;AACzB,IAAA;AACS,IAAA;AACrB,IAAA;AACf,MAAA;AAAsB,QAAA;AAAoB,QAAA;AAAsB,MAAA;AACZ,QAAA;AAC9B,UAAA;AACxB,QAAA;AACF,MAAA;AACF,IAAA;AAC+C,IAAA;AAC9B,IAAA;AACf,MAAA;AACiC,MAAA;AAC0B,MAAA;AACL,MAAA;AACxD,IAAA;AACoC,IAAA;AACqB,IAAA;AAClD,IAAA;AACT,EAAA;AACF;AF4GqE;AACA;AGpM7C;AACY;AHsMiC;AACA;AIxM1C;AACN;AAmBqC;AACjB,EAAA;AAC4B,EAAA;AAC/B,IAAA;AACpC,EAAA;AACO,EAAA;AACT;AAEiC;AAM6E,EAAA;AAAjC,IAAA;AACT,IAAA;AAChC,IAAA;AAClC,EAAA;AAH2E,EAAA;AAL1D,EAAA;AACA,EAAA;AAC+B,kBAAA;AAChD,EAAA;AACQ,EAAA;AAM2B,EAAA;AACQ,IAAA;AACe,IAAA;AAC3B,IAAA;AAC/B,EAAA;AAEmD,EAAA;AACV,IAAA;AACkB,IAAA;AACK,IAAA;AAChE,EAAA;AAEc,EAAA;AAAwB,IAAA;AAAuB,IAAA;AAAsB,IAAA;AAAW,EAAA;AAE1B,EAAA;AAC9B,IAAA;AAC4B,IAAA;AAClC,IAAA;AACA,IAAA;AACf,IAAA;AACX,IAAA;AAA2B,MAAA;AAAqB,MAAA;AACpD,IAAA;AAAyB,MAAA;AAAW,IAAA;AACtC,EAAA;AAEqD,EAAA;AACP,IAAA;AACe,IAAA;AACI,IAAA;AAC3D,IAAA;AACwD,MAAA;AACO,MAAA;AAC7B,MAAA;AACmB,MAAA;AACI,MAAA;AACxB,MAAA;AACuB,MAAA;AACV,MAAA;AACA,MAAA;AACzC,MAAA;AAC4B,QAAA;AAA4C,QAAA;AAAuC,QAAA;AACpH,QAAA;AAAY,QAAA;AAAa,QAAA;AAC0B,QAAA;AACW,QAAA;AAChE,MAAA;AACM,IAAA;AAAoC,MAAA;AAA+D,IAAA;AAC7G,EAAA;AAEuH,EAAA;AACtE,IAAA;AACnB,IAAA;AACiC,IAAA;AAC1B,MAAA;AAAiD,MAAA;AAC1D,MAAA;AAC1B,IAAA;AACI,IAAA;AAC+B,IAAA;AACG,MAAA;AACR,MAAA;AAC+B,MAAA;AACF,MAAA;AACT,MAAA;AACa,MAAA;AACzB,MAAA;AAClB,MAAA;AAAA;AAAA;AAAgB;AAAkD,qBAAA;AAAiC,CAAA;AACtD,MAAA;AACA,MAAA;AAC3D,MAAA;AACgC,QAAA;AACwB,UAAA;AAC9C,UAAA;AAAqE,UAAA;AAChF,QAAA;AACgB,QAAA;AACqC,UAAA;AACnC,UAAA;AACV,UAAA;AACT,QAAA;AACsB,QAAA;AACM,QAAA;AACqB,QAAA;AACY,QAAA;AAC/C,MAAA;AACsB,QAAA;AACI,QAAA;AACqB,QAAA;AAC/D,MAAA;AACF,IAAA;AACmC,IAAA;AACrC,EAAA;AACF;AJwMqE;AACA;AG9T7C;AAGsG,EAAA;AAArF,IAAA;AAAgC,IAAA;AAAkC,IAAA;AAAsC,IAAA;AAAU,EAAA;AAAlH,EAAA;AAAgC,EAAA;AAAkC,EAAA;AAFtF,kBAAA;AACnB,EAAA;AAEuB,EAAA;AAAc,IAAA;AAAW,EAAA;AACrB,EAAA;AAAS,IAAA;AAA6C,EAAA;AAChE,EAAA;AAA8B,IAAA;AAAG,EAAA;AACpD;AAE2D;AACrD,EAAA;AACyB,IAAA;AACkB,IAAA;AACJ,IAAA;AACU,IAAA;AACa,IAAA;AACL,IAAA;AACG,IAAA;AACJ,IAAA;AAC/C,IAAA;AAAmD,MAAA;AAAG,MAAA;AAChB,MAAA;AAAsC,MAAA;AAAC,IAAA;AAClF,EAAA;AAA0D,IAAA;AAAG,EAAA;AACvE;AAE4C;AAAqB;AAIY;AAcyB,EAAA;AAAvE,IAAA;AAAoC,IAAA;AACxC,IAAA;AAC0C,IAAA;AACL,IAAA;AAC5B,IAAA;AAClC,EAAA;AAL6B,EAAA;AAAoC,EAAA;AAbjE,EAAA;AACA,EAAA;AACsB,kBAAA;AACC,kBAAA;AACf,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACwC,kBAAA;AAC/B,EAAA;AACA,EAAA;AACA,EAAA;AAQO,EAAA;AAAoB,IAAA;AAAW,EAAA;AAEb,EAAA;AACJ,IAAA;AACL,IAAA;AACC,IAAA;AACN,IAAA;AACT,IAAA;AACb,IAAA;AAAwB,MAAA;AAAqB,MAAA;AACjD,IAAA;AAA2B,MAAA;AAAW,IAAA;AACxC,EAAA;AAC6B,EAAA;AACS,IAAA;AACgC,IAAA;AAC/C,IAAA;AACvB,EAAA;AACgD,EAAA;AACV,IAAA;AACwB,IAAA;AACvC,IAAA;AACvB,EAAA;AACyD,EAAA;AAAqB,IAAA;AAAsC,IAAA;AAAG,EAAA;AAC1E,EAAA;AACC,IAAA;AACmB,IAAA;AAC3D,IAAA;AAAiE,MAAA;AAC/D,IAAA;AAAgC,MAAA;AAAyD,IAAA;AACjG,EAAA;AACc,EAAA;AACQ,IAAA;AACiC,IAAA;AAC7B,IAAA;AAAyB,IAAA;AAAmB,IAAA;AAA4B,IAAA;AAClG,EAAA;AAC2B,EAAA;AAAS,IAAA;AAAkC,EAAA;AACrD,EAAA;AAA8B,IAAA;AAAG,EAAA;AAEH,EAAA;AACD,IAAA;AACR,IAAA;AACE,IAAA;AACc,MAAA;AACnB,MAAA;AAC0B,MAAA;AACb,MAAA;AAC9C,IAAA;AAC6C,IAAA;AAAK,MAAA;AACA,MAAA;AAA+C,MAAA;AAChG,IAAA;AAC6D,IAAA;AACvD,IAAA;AAAU,MAAA;AAA0C,MAAA;AACtB,MAAA;AAAqC,MAAA;AAAK,IAAA;AACjF,EAAA;AAE0C,EAAA;AACJ,IAAA;AACH,IAAA;AACkB,IAAA;AACb,MAAA;AACf,MAAA;AAA+B,MAAA;AAC9B,MAAA;AAAmC,MAAA;AACpC,MAAA;AACJ,MAAA;AACoC,QAAA;AAA0D,QAAA;AAC9G,MAAA;AACW,MAAA;AACb,IAAA;AACiB,IAAA;AACd,IAAA;AAAe,MAAA;AAAW,IAAA;AAA4B,MAAA;AAAW,IAAA;AACvE,EAAA;AAE4E,EAAA;AACrB,IAAA;AACnB,IAAA;AACG,IAAA;AAA8B,MAAA;AAAW,IAAA;AACtD,IAAA;AAC1B,EAAA;AACiD,EAAA;AACe,IAAA;AAC1D,IAAA;AAAsB,MAAA;AACZ,IAAA;AACsB,MAAA;AACa,MAAA;AACgB,MAAA;AACT,MAAA;AACxD,IAAA;AACF,EAAA;AAEoH,EAAA;AAC3E,IAAA;AACuB,IAAA;AACxD,MAAA;AACA,MAAA;AACA,MAAA;AAC0B,QAAA;AAClB,UAAA;AAAsD,UAAA;AACb,UAAA;AAAa,UAAA;AACH,UAAA;AAC5D,QAAA;AACgC,QAAA;AAC7B,QAAA;AAA2B,UAAA;AAAW,QAAA;AAAY,UAAA;AAAW,QAAA;AAC3D,MAAA;AAC8B,QAAA;AACuB,QAAA;AAC1C,QAAA;AAC8C,QAAA;AAAoB,QAAA;AACrF,MAAA;AACoD,MAAA;AACS,QAAA;AAC1C,QAAA;AAC8C,QAAA;AAAoB,QAAA;AACrF,MAAA;AACoD,MAAA;AACJ,MAAA;AAC5C,MAAA;AACiD,QAAA;AACH,QAAA;AAA4D,QAAA;AAChD,QAAA;AACR,QAAA;AACO,QAAA;AACT,QAAA;AAC5C,MAAA;AAAgC,QAAA;AAAwD,MAAA;AAClG,IAAA;AACwC,IAAA;AAC1C,EAAA;AACF;AAEwF;AAClC,EAAA;AACS,EAAA;AACG,IAAA;AAC9C,IAAA;AACjB,EAAA;AACsC,EAAA;AACzC;AH2XqE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA","file":"/Users/zhuoguang/Documents/Code/collaborate/hiclaw/agentcore-sdk-nodejs/dist/chunk-BVZ7H2F5.cjs","sourcesContent":[null,"import { readFile } from 'node:fs/promises';\nimport { ConfigError } from '../errors';\nimport { httpUrl, requiredString } from './config';\n\nexport const DEFAULT_ENV_PATH = '/var/run/agentcore/agent/env';\nexport interface RuntimeEnvironment {\n  controllerUrl: string;\n  agentSATokenFile: string;\n  controlPlaneEndpoint?: string;\n}\n\n// Tokenize shell quoting, but deliberately do not evaluate expansions or commands.\nfunction words(line: string): string[] {\n  const parts: string[] = [];\n  let word = '';\n  let quote = '';\n  let started = false;\n  for (let i = 0; i < line.length; i++) {\n    const char = line[i]!;\n    if (quote === \"'\") {\n      if (char === quote) quote = ''; else word += char;\n    } else if (char === '\\\\') {\n      const next = line[++i];\n      if (next === undefined) throw new Error('incomplete escape');\n      if (quote === '\"' && next !== '\"' && next !== '\\\\') word += '\\\\';\n      word += next;\n      started = true;\n    } else if (quote) {\n      if (char === quote) quote = ''; else word += char;\n    } else if (char === '\"' || char === \"'\") {\n      quote = char;\n      started = true;\n    } else if (/\\s/.test(char)) {\n      if (started) { parts.push(word); word = ''; started = false; }\n    } else {\n      word += char;\n      started = true;\n    }\n  }\n  if (quote) throw new Error('unclosed quote');\n  if (started) parts.push(word);\n  return parts;\n}\n\nexport function parseRuntimeEnvironment(text: string): Record<string, string> {\n  const values: Record<string, string> = Object.create(null) as Record<string, string>;\n  for (const [index, raw] of text.split(/\\r?\\n/).entries()) {\n    const line = raw.trim();\n    if (!line || line.startsWith('#')) continue;\n    try {\n      const parts = words(line);\n      if (parts.length !== 2 || parts[0] !== 'export') throw new Error('expected export');\n      const match = /^([A-Za-z_][A-Za-z0-9_]*)=([\\s\\S]*)$/.exec(parts[1]!);\n      if (!match || Object.hasOwn(values, match[1]!)) throw new Error('invalid assignment');\n      values[match[1]!] = match[2]!;\n    } catch { throw new ConfigError(`invalid runtime env at line ${index + 1}`); }\n  }\n  return values;\n}\n\nexport class RuntimeEnvironmentProvider {\n  constructor(readonly path = DEFAULT_ENV_PATH) {}\n  async read(): Promise<Record<string, string>> {\n    let text: string;\n    try { text = await readFile(this.path, 'utf8'); } catch (cause) {\n      throw new ConfigError('cannot read AgentCore runtime env', { cause });\n    }\n    return parseRuntimeEnvironment(text);\n  }\n  async snapshot(): Promise<RuntimeEnvironment> {\n    const values = await this.read();\n    const endpoint = values.AGENTCORE_CONTROL_ENDPOINT || process.env.AGENTCORE_CONTROL_ENDPOINT;\n    return {\n      controllerUrl: httpUrl(values.AGENTCORE_CONTROLLER_URL || values.AGENTTEAMS_CONTROLLER_URL, 'runtime Controller URL'),\n      agentSATokenFile: requiredString(values.AGENTCORE_AUTH_TOKEN_FILE || values.AGENTTEAMS_AUTH_TOKEN_FILE, 'runtime SA token file'),\n      controlPlaneEndpoint: endpoint?.trim() || undefined,\n    };\n  }\n  async value(name: string): Promise<string> {\n    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) throw new ConfigError('runtime environment name is invalid');\n    const values = await this.read();\n    return requiredString(values[name] || process.env[name], `runtime env ${name}`);\n  }\n  async taskServiceEndpoint(): Promise<string> {\n    const values = await this.read();\n    const endpoint = values.AGENTCORE_TASK_SERVICE_ENDPOINT || process.env.AGENTCORE_TASK_SERVICE_ENDPOINT;\n    if (endpoint?.trim()) return httpUrl(endpoint, 'Task Service endpoint');\n    const gateway = httpUrl(values.AGENTTEAMS_MATRIX_URL || process.env.AGENTTEAMS_MATRIX_URL, 'Task Service endpoint');\n    return gateway.endsWith('/agentteams-app') ? gateway : `${gateway}/agentteams-app`;\n  }\n}\n","import { access, readFile } from 'node:fs/promises';\nimport { setTimeout as sleep } from 'node:timers/promises';\nimport { ConfigError } from '../errors';\nimport { AgentSATokenProvider, type AgentSATokenSource } from '../auth/agent-sa-token';\nimport { nullLogger, type Logger } from '../logging';\nimport { DEFAULT_CONFIG_PATH, parseAgentConfig, type AgentConfig } from './config';\nimport { DEFAULT_ENV_PATH, RuntimeEnvironmentProvider } from './environment';\n\nexport interface RuntimeBindings {\n  config: AgentConfig;\n  controllerEndpoint?: string;\n  controlPlaneEndpoint?: string;\n  agentSATokens?: AgentSATokenSource;\n}\nexport interface RuntimeSource {\n  resolve(): Promise<RuntimeBindings>;\n  close(): void | Promise<void>;\n}\nexport interface ManagedRuntimeOptions {\n  configPath?: string;\n  envPath?: string;\n  controlPlaneEndpoint?: string;\n  logger?: Logger;\n}\n\nexport class ManagedRuntimeSource implements RuntimeSource {\n  private bindings?: RuntimeBindings;\n  private pending?: Promise<RuntimeBindings>;\n  private readonly lifetime = new AbortController();\n  constructor(private readonly options: ManagedRuntimeOptions = {}) {}\n\n  async resolve(): Promise<RuntimeBindings> {\n    this.lifetime.signal.throwIfAborted();\n    if (this.bindings) return this.bindings;\n    if (this.pending) return this.pending;\n    const request = this.load();\n    this.pending = request;\n    try { this.bindings = await request; return this.bindings; }\n    finally { this.pending = undefined; }\n  }\n  close(): void { this.lifetime.abort(); }\n\n  private async load(): Promise<RuntimeBindings> {\n    const configPath = this.options.configPath || process.env.AGENTCORE_CONFIG_PATH || DEFAULT_CONFIG_PATH;\n    const rawTimeout = process.env.AGENTCORE_CONFIG_WAIT_TIMEOUT ?? '10';\n    if (!/^\\d+$/.test(rawTimeout) || !Number.isSafeInteger(Number(rawTimeout))) {\n      throw new ConfigError('AGENTCORE_CONFIG_WAIT_TIMEOUT must be a non-negative integer');\n    }\n    const deadline = performance.now() + Number(rawTimeout) * 1000;\n    let config: AgentConfig;\n    const logger = this.options.logger ?? nullLogger;\n    for (;;) {\n      this.lifetime.signal.throwIfAborted();\n      let data: Buffer;\n      try { data = await readFile(configPath); } catch (cause) {\n        const remaining = deadline - performance.now();\n        if (!(cause && typeof cause === 'object' && 'code' in cause && cause.code === 'ENOENT') || remaining <= 0) {\n          throw new ConfigError('cannot read agent.yaml', { cause });\n        }\n        logger.info('agentcore.runtime.config.waiting_for_mount', { path: configPath, retryInMs: Math.min(500, remaining) });\n        await sleep(Math.min(500, remaining), undefined, { signal: this.lifetime.signal });\n        continue;\n      }\n      config = parseAgentConfig(data);\n      break;\n    }\n    const configuredEnv = this.options.envPath || process.env.AGENTCORE_ENV_PATH;\n    const envPath = configuredEnv || DEFAULT_ENV_PATH;\n    let hasEnvironment = Boolean(configuredEnv);\n    if (!hasEnvironment) {\n      try { await access(envPath); hasEnvironment = true; } catch (cause) {\n        if (!(cause && typeof cause === 'object' && 'code' in cause && cause.code === 'ENOENT')) {\n          throw new ConfigError('cannot access AgentCore runtime env', { cause });\n        }\n      }\n    }\n    const environment = hasEnvironment ? await new RuntimeEnvironmentProvider(envPath).snapshot() : undefined;\n    const bindings = {\n      config,\n      controllerEndpoint: environment?.controllerUrl,\n      controlPlaneEndpoint: this.options.controlPlaneEndpoint ?? environment?.controlPlaneEndpoint ?? process.env.AGENTCORE_CONTROL_ENDPOINT,\n      agentSATokens: environment ? new AgentSATokenProvider(environment.agentSATokenFile) : undefined,\n    };\n    this.lifetime.signal.throwIfAborted();\n    logger.info('agentcore.runtime.source.resolved', { mode: 'managed', envLoaded: hasEnvironment, workspaceId: config.workspaceId });\n    return bindings;\n  }\n}\n","import { inspect } from 'node:util';\nimport { setTimeout as sleep } from 'node:timers/promises';\nimport { AuthenticationError, ConfigError } from '../errors';\nimport { nullLogger, type Logger } from '../logging';\nimport { ControllerClient, type ControllerOptions } from '../auth/controller';\nimport type { AgentSATokenSource } from '../auth/agent-sa-token';\nimport { httpUrl, object, requiredString, type AgentConfig } from './config';\nimport { ControlConfigLoader } from './control-config';\nimport { ManagedRuntimeSource, type ManagedRuntimeOptions, type RuntimeBindings, type RuntimeSource } from './managed';\n\nexport class DebugToken {\n  readonly product = 'agentcore';\n  #jwtToken: string;\n  constructor(jwtToken: string, readonly controllerUrl: string, readonly modelGatewayUrl: string, readonly matrixUrl: string) { this.#jwtToken = jwtToken; }\n  get jwtToken(): string { return this.#jwtToken; }\n  [inspect.custom](): string { return 'DebugToken(product=agentcore, <redacted>)'; }\n  toJSON(): string { return this[inspect.custom](); }\n}\n\nexport function parseDebugToken(value: string): DebugToken {\n  try {\n    const encoded = value.trim();\n    if (!encoded || encoded.length > 350_000 || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(encoded)) throw new Error('base64');\n    const raw = Buffer.from(encoded, 'base64');\n    if (raw.length > 256 * 1024) throw new Error('size');\n    const data = object(JSON.parse(new TextDecoder('utf8', { fatal: true }).decode(raw)), 'debug token');\n    if (data.product !== 'agentcore') throw new Error('product');\n    const controller = httpUrl(data.controllerUrl, 'controllerUrl');\n    if (new URL(controller).pathname !== '/') throw new Error('controllerUrl path');\n    return new DebugToken(requiredString(data.jwtToken, 'jwtToken'), controller,\n      httpUrl(data.modelGatewayUrl, 'modelGatewayUrl'), httpUrl(data.matrixUrl, 'matrixUrl'));\n  } catch { throw new ConfigError('AGENTCORE_DEBUG_TOKEN is invalid'); }\n}\n\nclass DebugTokenExchangeUnavailable extends AuthenticationError {}\n\nexport interface DebugRuntimeOptions extends ControllerOptions { controlPlaneEndpoint?: string; }\n\nexport class DebugRuntimeSource implements RuntimeSource, AgentSATokenSource {\n  #jwtToken: string;\n  #saToken?: string;\n  private saExpiresAt = 0;\n  private jwtExpiresAt = 0;\n  private bindings?: RuntimeBindings;\n  private resolving?: Promise<RuntimeBindings>;\n  private exchanging?: Promise<string>;\n  private refreshTimer?: ReturnType<typeof setTimeout>;\n  private readonly lifetime = new AbortController();\n  private readonly configLoader: ControlConfigLoader;\n  private readonly controller: ControllerClient;\n  private readonly logger: Logger;\n\n  constructor(private readonly token: DebugToken, private readonly options: DebugRuntimeOptions = {}) {\n    this.#jwtToken = token.jwtToken;\n    this.configLoader = new ControlConfigLoader(token.controllerUrl, this, options);\n    this.controller = new ControllerClient(token.controllerUrl, this, options);\n    this.logger = options.logger ?? nullLogger;\n  }\n  get matrixUrl(): string { return this.token.matrixUrl; }\n\n  async resolve(): Promise<RuntimeBindings> {\n    this.lifetime.signal.throwIfAborted();\n    if (this.bindings) return this.bindings;\n    if (this.resolving) return this.resolving;\n    const request = this.load();\n    this.resolving = request;\n    try { this.bindings = await request; return this.bindings; }\n    finally { this.resolving = undefined; }\n  }\n  async get(): Promise<string> {\n    this.lifetime.signal.throwIfAborted();\n    if (this.#saToken && this.saExpiresAt > Date.now() + 60_000) return this.#saToken;\n    return this.exchange();\n  }\n  async refresh(current: string): Promise<string> {\n    this.lifetime.signal.throwIfAborted();\n    if (this.#saToken && this.#saToken !== current) return this.#saToken;\n    return this.exchange();\n  }\n  async loadTeamsConfig(): Promise<Uint8Array | undefined> { await this.resolve(); return this.configLoader.loadTeams(); }\n  async exchangeMatrixToken(): Promise<string> {\n    const response = await this.controller.post('/api/v1/credentials/matrix-token');\n    if (response.status < 200 || response.status >= 300) throw new AuthenticationError(`Controller Matrix token request failed with HTTP ${response.status}`);\n    try { return requiredString(object(response.payload, 'Matrix token').access_token, 'access_token'); }\n    catch { throw new AuthenticationError('Controller returned an invalid Matrix token response'); }\n  }\n  close(): void {\n    this.lifetime.abort();\n    if (this.refreshTimer) clearTimeout(this.refreshTimer);\n    this.configLoader.close(); this.controller.close(); this.#saToken = undefined; this.#jwtToken = '';\n  }\n  [inspect.custom](): string { return 'DebugRuntimeSource(<redacted>)'; }\n  toJSON(): string { return this[inspect.custom](); }\n\n  private async load(): Promise<RuntimeBindings> {\n    const config = await this.configLoader.load();\n    this.lifetime.signal.throwIfAborted();\n    const override = (mounted: string) => {\n      const gateway = new URL(this.token.modelGatewayUrl);\n      const runtime = new URL(mounted);\n      if (runtime.pathname !== '/') gateway.pathname = runtime.pathname;\n      return gateway.toString().replace(/\\/+$/, '');\n    };\n    const projected: AgentConfig = Object.freeze({ ...config,\n      modelGatewayUrl: override(config.modelGatewayUrl), mcpGatewayUrl: override(config.mcpGatewayUrl),\n    });\n    this.logger.info('agentcore.runtime.source.resolved', { mode: 'debug', workspaceId: config.workspaceId });\n    return { config: projected, controllerEndpoint: this.token.controllerUrl,\n      controlPlaneEndpoint: this.options.controlPlaneEndpoint, agentSATokens: this };\n  }\n\n  private async exchange(): Promise<string> {\n    this.lifetime.signal.throwIfAborted();\n    if (this.exchanging) return this.exchanging;\n    const request = this.requestToken().then((data) => {\n      this.lifetime.signal.throwIfAborted();\n      this.#saToken = data.token; this.saExpiresAt = data.expiresAt;\n      this.#jwtToken = data.jwtToken; this.jwtExpiresAt = data.jwtExpiresAt;\n      this.scheduleRefresh();\n      this.logger.info('agentcore.runtime.debug.sa_exchange.succeeded', {\n        expiration: new Date(this.saExpiresAt).toISOString(), jwtExpiration: new Date(this.jwtExpiresAt).toISOString(),\n      });\n      return this.#saToken;\n    });\n    this.exchanging = request;\n    try { return await request; } finally { this.exchanging = undefined; }\n  }\n\n  private scheduleRefresh(delay = Math.max(1000, this.jwtExpiresAt - Date.now() - 300_000)): void {\n    if (this.refreshTimer) clearTimeout(this.refreshTimer);\n    if (this.lifetime.signal.aborted) return;\n    this.refreshTimer = setTimeout(() => { void this.backgroundRefresh(); }, delay);\n    this.refreshTimer.unref();\n  }\n  private async backgroundRefresh(): Promise<void> {\n    if (this.lifetime.signal.aborted || this.jwtExpiresAt <= Date.now()) return;\n    try { await this.exchange(); }\n    catch (error) {\n      if (this.lifetime.signal.aborted) return;\n      const remaining = this.jwtExpiresAt - Date.now();\n      this.logger.warn('agentcore.runtime.debug.jwt_refresh.failed', { reason: error instanceof DebugTokenExchangeUnavailable ? 'temporarily_unavailable' : 'authentication_failed' });\n      if (error instanceof DebugTokenExchangeUnavailable && remaining > 1000) this.scheduleRefresh(Math.min(30_000, remaining / 2));\n    }\n  }\n\n  private async requestToken(): Promise<{ token: string; expiresAt: number; jwtToken: string; jwtExpiresAt: number }> {\n    const url = `${this.token.controllerUrl}/api/v1/edge/token`;\n    for (let attempt = 1; attempt <= (this.options.maxAttempts ?? 3); attempt++) {\n      let response: Response;\n      let payload: unknown;\n      try {\n        response = await fetch(url, {\n          method: 'POST', headers: { 'Content-Type': 'application/json' },\n          body: JSON.stringify({ jwtToken: this.#jwtToken }), redirect: 'manual',\n          signal: AbortSignal.any([this.lifetime.signal, AbortSignal.timeout(this.options.timeoutMs ?? 10_000)]),\n        });\n        const text = await response.text();\n        try { payload = JSON.parse(text); } catch { payload = undefined; }\n      } catch {\n        this.lifetime.signal.throwIfAborted();\n        if (attempt === (this.options.maxAttempts ?? 3)) throw new DebugTokenExchangeUnavailable('cannot reach the AgentCore Controller');\n        this.logger.warn('agentcore.runtime.debug.sa_exchange.retry', { url, attempt, reason: 'transport_error' });\n        await sleep(50 * 2 ** (attempt - 1), undefined, { signal: this.lifetime.signal }); continue;\n      }\n      if ([500, 502, 503, 504].includes(response.status)) {\n        if (attempt === (this.options.maxAttempts ?? 3)) throw new DebugTokenExchangeUnavailable('Controller debug token service is unavailable');\n        this.logger.warn('agentcore.runtime.debug.sa_exchange.retry', { url, attempt, status: response.status });\n        await sleep(50 * 2 ** (attempt - 1), undefined, { signal: this.lifetime.signal }); continue;\n      }\n      if ([401, 403].includes(response.status)) throw new AuthenticationError('Controller rejected the AgentCore debug token');\n      if (!response.ok) throw new AuthenticationError(`Controller debug token exchange failed with HTTP ${response.status}`);\n      try {\n        const data = object(payload, 'debug token response');\n        const token = requiredString(data.token, 'token'); const jwtToken = requiredString(data.jwtToken, 'jwtToken');\n        const expiresAt = Date.parse(requiredString(data.expiresAt, 'expiresAt'));\n        const jwtExpiresAt = Date.parse(requiredString(data.jwtExpiresAt, 'jwtExpiresAt'));\n        if (!(expiresAt > Date.now()) || !(jwtExpiresAt > Date.now())) throw new Error('expiry');\n        return { token, jwtToken, expiresAt, jwtExpiresAt };\n      } catch { throw new AuthenticationError('Controller returned an invalid debug token response'); }\n    }\n    throw new DebugTokenExchangeUnavailable('Controller debug token service is unavailable');\n  }\n}\n\nexport function createRuntimeSource(options: ManagedRuntimeOptions = {}): RuntimeSource {\n  const raw = process.env.AGENTCORE_DEBUG_TOKEN?.trim();\n  if (raw) return new DebugRuntimeSource(parseDebugToken(raw), {\n    controlPlaneEndpoint: options.controlPlaneEndpoint ?? process.env.AGENTCORE_CONTROL_ENDPOINT,\n    logger: options.logger,\n  });\n  return new ManagedRuntimeSource(options);\n}\n","import { createHmac } from 'node:crypto';\nimport { isIP } from 'node:net';\nimport { AuthenticationError, ConfigError, CredentialExchangeError } from '../errors';\nimport { ControllerClient, type ControllerOptions } from '../auth/controller';\nimport type { AgentSATokenSource } from '../auth/agent-sa-token';\nimport { readBytes } from '../http';\nimport { nullLogger, type Logger } from '../logging';\nimport { httpUrl, object, parseAgentConfig, requiredString, type AgentConfig } from './config';\n\ninterface ControlCredential {\n  accessKeyId: string;\n  accessKeySecret: string;\n  securityToken: string;\n  expiration: number;\n  ossEndpoint: string;\n  ossBucket: string;\n  agentConfigPath: string;\n  teamsConfigPath?: string;\n}\n\nfunction objectKey(value: unknown, field: string): string {\n  const key = requiredString(value, field);\n  if (/[\\\\\\r\\n]/.test(key) || key.split('/').some((p) => !p || p === '.' || p === '..')) {\n    throw new CredentialExchangeError(`Controller returned an invalid ${field}`);\n  }\n  return key;\n}\n\nexport class ControlConfigLoader {\n  private readonly controller: ControllerClient;\n  private readonly logger: Logger;\n  private readonly lifetime = new AbortController();\n  #credential?: ControlCredential;\n  private pending?: Promise<ControlCredential>;\n  constructor(endpoint: string, source: AgentSATokenSource, private readonly options: ControllerOptions = {}) {\n    this.controller = new ControllerClient(endpoint, source, options);\n    this.logger = options.logger ?? nullLogger;\n  }\n\n  async load(): Promise<AgentConfig> {\n    const credential = await this.credential();\n    const data = await this.download(credential, credential.agentConfigPath);\n    return parseAgentConfig(data!);\n  }\n\n  async loadTeams(): Promise<Uint8Array | undefined> {\n    let credential = await this.credential();\n    if (!credential.teamsConfigPath) credential = await this.credential(true);\n    return credential.teamsConfigPath ? this.download(credential, credential.teamsConfigPath, true) : undefined;\n  }\n\n  close(): void { this.controller.close(); this.lifetime.abort(); this.#credential = undefined; }\n\n  private async credential(force = false): Promise<ControlCredential> {\n    this.lifetime.signal.throwIfAborted();\n    if (!force && this.#credential && this.#credential.expiration > Date.now() + 60_000) return this.#credential;\n    if (this.pending) return this.pending;\n    const request = this.exchange();\n    this.pending = request;\n    try { this.#credential = await request; return this.#credential; }\n    finally { this.pending = undefined; }\n  }\n\n  private async exchange(): Promise<ControlCredential> {\n    const response = await this.controller.post('/api/v1/credentials/sts', { purpose: 'oss', target: 'control' });\n    if (response.status === 401) throw new AuthenticationError('Controller rejected the Agent SA token');\n    if (response.status < 200 || response.status >= 300) throw new CredentialExchangeError(`Controller control-config STS failed with HTTP ${response.status}`);\n    try {\n      const data = object(response.payload, 'control-config STS');\n      const read = (field: string) => requiredString(data[field], field);\n      const endpoint = read('oss_endpoint');\n      const ossEndpoint = httpUrl(endpoint.includes('://') ? endpoint : `https://${endpoint}`, 'OSS endpoint');\n      if (new URL(ossEndpoint).pathname !== '/') throw new Error('OSS endpoint path');\n      const ossBucket = read('oss_bucket');\n      if (!/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/.test(ossBucket)) throw new Error('OSS bucket');\n      const expiration = Date.parse(read('expiration'));\n      if (!(expiration > Date.now())) throw new Error('expired control-config STS');\n      return {\n        accessKeyId: read('access_key_id'), accessKeySecret: read('access_key_secret'), securityToken: read('security_token'),\n        expiration, ossEndpoint, ossBucket,\n        agentConfigPath: objectKey(data.agent_config_path, 'agent_config_path'),\n        teamsConfigPath: data.teams_config_path == null ? undefined : objectKey(data.teams_config_path, 'teams_config_path'),\n      };\n    } catch { throw new CredentialExchangeError('Controller returned an invalid control-config STS response'); }\n  }\n\n  private async download(credential: ControlCredential, key: string, missingOK = false): Promise<Uint8Array | undefined> {\n    const original = new URL(credential.ossEndpoint);\n    const candidates = [original];\n    if (/^(?:[a-z0-9-]+\\.)?oss-.+-internal\\.aliyuncs\\.com$/.test(original.hostname)) {\n      const fallback = new URL(original); fallback.hostname = fallback.hostname.replace('-internal.aliyuncs.com', '.aliyuncs.com');\n      candidates.push(fallback);\n    }\n    let lastStatus: number | undefined;\n    for (const endpoint of candidates) {\n      this.lifetime.signal.throwIfAborted();\n      const url = new URL(endpoint);\n      const pathStyle = url.hostname === 'localhost' || isIP(url.hostname.replace(/^\\[|\\]$/g, '')) !== 0;\n      if (!pathStyle && !url.hostname.startsWith(`${credential.ossBucket}.`)) url.hostname = `${credential.ossBucket}.${url.hostname}`;\n      const encodedKey = key.split('/').map((part) => encodeURIComponent(part).replace(/[!'()*]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`)).join('/');\n      url.pathname = `${pathStyle ? `/${credential.ossBucket}` : ''}/${encodedKey}`;\n      const date = new Date().toUTCString();\n      const canonical = `GET\\n\\n\\n${date}\\nx-oss-security-token:${credential.securityToken}\\n/${credential.ossBucket}/${key}`;\n      const signature = createHmac('sha1', credential.accessKeySecret).update(canonical).digest('base64');\n      this.logger.debug('agentcore.control_config.download.started', { host: url.host, path: url.pathname });\n      try {\n        const response = await fetch(url, {\n          headers: { Date: date, Authorization: `OSS ${credential.accessKeyId}:${signature}`, 'x-oss-security-token': credential.securityToken },\n          redirect: 'manual', signal: AbortSignal.any([this.lifetime.signal, AbortSignal.timeout(this.options.timeoutMs ?? 10_000)]),\n        });\n        if (response.ok) {\n          const data = await readBytes(response, 1024 * 1024, 'runtime config');\n          this.logger.info('agentcore.control_config.download.succeeded', { host: url.host, bytes: data.length });\n          return data;\n        }\n        lastStatus = response.status;\n        await response.body?.cancel();\n        if (missingOK && response.status === 404) return undefined;\n        this.logger.warn('agentcore.control_config.download.failed', { host: url.host, status: response.status });\n      } catch (error) {\n        this.lifetime.signal.throwIfAborted();\n        if (error instanceof ConfigError) throw error;\n        this.logger.warn('agentcore.control_config.download.failed', { host: url.host, reason: 'transport_error' });\n      }\n    }\n    throw new ConfigError(lastStatus ? `AgentCore configuration download failed with HTTP ${lastStatus}` : 'cannot reach the AgentCore configuration store');\n  }\n}\n"]}