@agent-native/core 0.84.20 → 0.84.22

package/corpus/templates/videos/README.md

@@ -1,212 +1,33 @@
-# Video Studio
+# Video
 
-A powerful Remotion-based video composition studio with AI-powered generation, interactive cursor animations, and advanced timeline controls.
+An agent-native, Remotion-based video composition studio. Describe a video in
+plain English and the agent generates animated React compositions with camera
+moves, interactive cursor animations, and a full timeline editor.
 
-## 🚀 Quick Start
+**Live app: [videos.agent-native.com](https://videos.agent-native.com)**
 
-```bash
-pnpm install
-pnpm run dev
-```
-
-Open http://localhost:8080 to access the studio.
-
-## ✨ Features
-
-### 🎬 AI-Powered Generation
-
-- Describe videos in natural language
-- Attach reference images, logos, and assets
-- Generates React components and animation tracks automatically
-
-### 🎥 Camera System
-
-- 6 animatable properties: translate X/Y, scale, rotate X/Y, perspective
-- Multi-keyframe selection with box-select and shift-click
-- Visual camera controls with real-time preview
-
-### 🖱️ Interactive Cursor
-
-- Position tracking with smooth animations
-- Hover and click detection
-- Component-type based interactions
-- Visual cursor with multiple states
-
-### 🎭 Cursor Interactions
-
-- Add hover animations to any component type
-- Click effects with timing control
-- Scale, translate, and rotate on interaction
-- Duration and easing customization
-
-### ⚡ Advanced Timeline
-
-- Multi-keyframe selection and editing
-- Visual easing selector (20+ curves)
-- View range control for focused editing
-- Track properties panel with live preview
-- Expression-controlled animations (programmatic)
-
-### 🎨 Built-in Components
-
-- Kinetic Text (typing reveal, drift, explode)
-- Logo Reveal (particle burst)
-- Logo Explode (SVG scatter)
-- Interactive Demo (hover buttons)
-- Interactive Card Grid (cursor-reactive cards)
-- Slideshow (multi-slide transitions)
-
-## 🛠️ Helper Functions
-
-```typescript
-import { createBlankComposition, addComposition } from "@/remotion/registry";
-
-import {
-  createCameraTrack,
-  createCursorTrack,
-  createAnimationTrack,
-  createFadeInTrack,
-  createSlideInTrack,
-  createCursorPath,
-  createClickEvents,
-  validateComposition,
-} from "@/utils/compositionHelpers";
-
-// Create a new composition
-const comp = createBlankComposition("My Video");
-addComposition(comp);
-
-// Or build manually with full control
-const tracks = [
-  createCameraTrack(240),
-  createCursorTrack(240),
-  createFadeInTrack("title", "Title Entrance", 0, 30),
-];
-
-validateComposition(tracks); // Ensure it has required tracks
-```
-
-## 📖 Key Concepts
-
-### Compositions
-
-- **ID**: URL-friendly slug (auto-generated from title)
-- **Tracks**: Animation timelines (camera, cursor, custom)
-- **Props**: Component configuration (colors, text, etc.)
-- **Dimensions**: Default 1920×1080 @ 30fps
-
-### Tracks
-
-- **Camera**: Controls viewport (required)
-- **Cursor**: Tracks pointer position (required for interactions)
-- **Custom**: Element-specific animations (optional)
+Compositions are code-driven and yours to own. Generate with AI or build manually
+with the same track system, then refine keyframes, easing, and cursor
+interactions on the timeline.
 
-### Keyframes
+## Features
 
-- **Simple**: from/to values with easing
-- **Complex**: Multiple keyframes with individual easing
-- **Programmatic**: Code-driven animations with parameters
+- Describe videos in natural language and get React components + animation tracks.
+- Camera system with animatable translate, scale, rotate, and perspective.
+- Interactive cursor with hover/click detection and component-type interactions.
+- Advanced timeline: multi-keyframe editing, easing curves, and view ranges.
+- Built-in components: kinetic text, logo reveal/explode, slideshows, and more.
+- Standardized 1920×1080 @ 30fps compositions.
 
-### Cursor Interactions
+## Develop locally
 
-- **Hover**: Trigger when cursor enters component bounds
-- **Click**: Trigger on cursor click events
-- **Component-Type Based**: Apply to all instances globally
-
-## 🎯 Common Workflows
-
-### Create with AI
-
-1. Click "+ New Composition"
-2. Describe your video
-3. Attach references (optional)
-4. Press Enter
-5. Edit and customize
-
-### Create Manually
-
-1. Copy `BlankComposition.tsx` as template
-2. Modify component code
-3. Register in `registry.ts`
-4. Export in `compositions/index.ts`
-5. Navigate to `/c/your-comp-id`
-
-### Add Cursor Interactions
-
-1. Ensure cursor track exists
-2. Add `<Cursor>` to component
-3. Use `useHoverAnimation()` hook
-4. Configure in Properties → Cursor Interactions
-
-### Multi-Keyframe Editing
-
-1. Box-select: Click+drag in timeline
-2. Shift-click: Add individual keyframes
-3. Drag selection: Move all together
-4. Maintains relative timing
-
-## 📁 Project Structure
-
-```
-app/
-├── remotion/
-│   ├── compositions/        # Video components
-│   ├── ui-components/       # Reusable elements (Cursor, etc.)
-│   ├── hooks/              # Animation hooks
-│   ├── CameraHost.tsx      # Camera wrapper
-│   ├── registry.ts         # Composition registry
-│   └── trackAnimation.ts   # Track utilities
-├── components/             # Studio UI components
-├── pages/                  # Routes (Index, CompositionView)
-├── utils/                  # Helpers and utilities
-└── contexts/              # React context providers
-
-server/
-├── routes/                # API endpoints
-└── index.ts              # Express server
-
-docs/examples/
-└── create-composition.example.ts  # Example creation script
-```
-
-## 🔧 Development
-
-### Commands
+Scaffold your own copy and run it:
 
 ```bash
-# Development
-pnpm run dev           # Start dev server (http://localhost:8080)
-
-# Build
-pnpm run build         # Build client and server
-
-# Production
-pnpm start             # Run production server
-
-# Testing
-pnpm test              # Run tests
-pnpm typecheck         # Type checking
-pnpm format.fix        # Format code
+npx @agent-native/core@latest create my-videos --standalone --template videos
+cd my-videos
+pnpm install
+pnpm dev
 ```
 
-### Environment
-
-All compositions run at:
-
-- **30fps** (standardized)
-- **1920×1080** (Wide format default)
-- **240 frames** (8 seconds default duration)
-
-## 🎓 Learn More
-
-- **Remotion Docs**: https://remotion.dev/docs
-- **Builder.io Docs**: https://www.builder.io/c/docs/projects
-- **Example Compositions**: Check `app/remotion/compositions/` folder
-
-## 📝 License
-
-Private project.
-
----
-
-**Ready to create?** Click "+ New Composition" and describe your first video! 🎬
+Full docs: [agent-native.com/docs/template-videos](https://agent-native.com/docs/template-videos).

package/dist/a2a/caller-auth.d.ts

@@ -1,5 +1,6 @@
 export interface A2ACallerAuth {
     apiKey?: string;
+    apiKeyFallbacks?: string[];
     userEmail?: string;
     orgId?: string;
     orgDomain?: string;

package/dist/a2a/caller-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"caller-auth.d.ts","sourceRoot":"","sources":["../../src/a2a/caller-auth.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,wBAAsB,oBAAoB,CAAC,OAAO,CAAC,EAAE;IACnD,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,GAAG,OAAO,CAAC,aAAa,CAAC,CAmCzB"}
+{"version":3,"file":"caller-auth.d.ts","sourceRoot":"","sources":["../../src/a2a/caller-auth.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,wBAAsB,oBAAoB,CAAC,OAAO,CAAC,EAAE;IACnD,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,GAAG,OAAO,CAAC,aAAa,CAAC,CA+DzB"}

package/dist/a2a/caller-auth.js

@@ -23,20 +23,46 @@ export async function resolveA2ACallerAuth(options) {
         }
         catch { }
     }
-    let apiKey;
+    const apiKeyAttempts = [];
+    const addApiKeyAttempt = (token) => {
+        if (!token || apiKeyAttempts.includes(token))
+            return;
+        apiKeyAttempts.push(token);
+    };
     if (userEmail && (orgSecret || process.env.A2A_SECRET)) {
-        try {
-            apiKey = await signA2AToken(userEmail, orgDomain, orgSecret, {
-                expiresIn: options?.expiresIn ?? DEFAULT_A2A_CALLER_TOKEN_TTL,
-                preferGlobalSecret: !orgSecret,
-            });
+        if (process.env.A2A_SECRET?.trim()) {
+            try {
+                addApiKeyAttempt(await signA2AToken(userEmail, orgDomain, orgSecret, {
+                    expiresIn: options?.expiresIn ?? DEFAULT_A2A_CALLER_TOKEN_TTL,
+                    preferGlobalSecret: true,
+                }));
+            }
+            catch { }
+        }
+        if (orgSecret) {
+            try {
+                addApiKeyAttempt(await signA2AToken(userEmail, orgDomain, orgSecret, {
+                    expiresIn: options?.expiresIn ?? DEFAULT_A2A_CALLER_TOKEN_TTL,
+                    preferGlobalSecret: false,
+                }));
+            }
+            catch { }
         }
-        catch { }
     }
     if (options?.includeGoogleToken) {
         await attachGoogleTokenMetadata(metadata, userEmail);
     }
-    return { apiKey, userEmail, orgId, orgDomain, orgSecret, metadata };
+    return {
+        apiKey: apiKeyAttempts[0],
+        ...(apiKeyAttempts.length > 1
+            ? { apiKeyFallbacks: apiKeyAttempts.slice(1) }
+            : {}),
+        userEmail,
+        orgId,
+        orgDomain,
+        orgSecret,
+        metadata,
+    };
 }
 async function attachGoogleTokenMetadata(metadata, userEmail) {
     if (process.env.NODE_ENV !== "production" || !userEmail)

package/dist/a2a/caller-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"caller-auth.js","sourceRoot":"","sources":["../../src/a2a/caller-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,mBAAmB,GACpB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAW3C,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAG1C;IACC,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,IAAI,SAAS;QAAE,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAC;IAE9C,IAAI,SAA6B,CAAC;IAClC,IAAI,SAA6B,CAAC;IAClC,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YACH,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YAC3D,SAAS,GAAG,CAAC,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC;YACrD,IAAI,SAAS;gBAAE,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QACV,IAAI,CAAC;YACH,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YAC9D,SAAS,GAAG,CAAC,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IAED,IAAI,MAA0B,CAAC;IAC/B,IAAI,SAAS,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,YAAY,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE;gBAC3D,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,4BAA4B;gBAC7D,kBAAkB,EAAE,CAAC,SAAS;aAC/B,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IAED,IAAI,OAAO,EAAE,kBAAkB,EAAE,CAAC;QAChC,MAAM,yBAAyB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,QAAiC,EACjC,SAA6B;IAE7B,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,CAAC,SAAS;QAAE,OAAO;IAEhE,IAAI,CAAC;QACH,MAAM,EAAE,wBAAwB,EAAE,GAChC,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;QACnC,IAAI,MAAM,EAAE,YAAY,EAAE,CAAC;YACzB,QAAQ,CAAC,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC;QAC7C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;AACZ,CAAC","sourcesContent":["import {\n  getRequestOrgId,\n  getRequestUserEmail,\n} from \"../server/request-context.js\";\nimport { signA2AToken } from \"./client.js\";\n\nconst DEFAULT_A2A_CALLER_TOKEN_TTL = \"30m\";\n\nexport interface A2ACallerAuth {\n  apiKey?: string;\n  userEmail?: string;\n  orgId?: string;\n  orgDomain?: string;\n  orgSecret?: string;\n  metadata: Record<string, unknown>;\n}\n\nexport async function resolveA2ACallerAuth(options?: {\n  expiresIn?: string | number;\n  includeGoogleToken?: boolean;\n}): Promise<A2ACallerAuth> {\n  const userEmail = getRequestUserEmail();\n  const metadata: Record<string, unknown> = {};\n  if (userEmail) metadata.userEmail = userEmail;\n\n  let orgDomain: string | undefined;\n  let orgSecret: string | undefined;\n  const orgId = getRequestOrgId();\n  if (orgId) {\n    try {\n      const { getOrgDomain } = await import(\"../org/context.js\");\n      orgDomain = (await getOrgDomain(orgId)) ?? undefined;\n      if (orgDomain) metadata.orgDomain = orgDomain;\n    } catch {}\n    try {\n      const { getOrgA2ASecret } = await import(\"../org/context.js\");\n      orgSecret = (await getOrgA2ASecret(orgId)) ?? undefined;\n    } catch {}\n  }\n\n  let apiKey: string | undefined;\n  if (userEmail && (orgSecret || process.env.A2A_SECRET)) {\n    try {\n      apiKey = await signA2AToken(userEmail, orgDomain, orgSecret, {\n        expiresIn: options?.expiresIn ?? DEFAULT_A2A_CALLER_TOKEN_TTL,\n        preferGlobalSecret: !orgSecret,\n      });\n    } catch {}\n  }\n\n  if (options?.includeGoogleToken) {\n    await attachGoogleTokenMetadata(metadata, userEmail);\n  }\n\n  return { apiKey, userEmail, orgId, orgDomain, orgSecret, metadata };\n}\n\nasync function attachGoogleTokenMetadata(\n  metadata: Record<string, unknown>,\n  userEmail: string | undefined,\n): Promise<void> {\n  if (process.env.NODE_ENV !== \"production\" || !userEmail) return;\n\n  try {\n    const { listOAuthAccountsByOwner } =\n      await import(\"../oauth-tokens/store.js\");\n    const accounts = await listOAuthAccountsByOwner(\"google\", userEmail);\n    const tokens = accounts[0]?.tokens;\n    if (tokens?.access_token) {\n      metadata.googleToken = tokens.access_token;\n    }\n  } catch {}\n}\n"]}
+{"version":3,"file":"caller-auth.js","sourceRoot":"","sources":["../../src/a2a/caller-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,mBAAmB,GACpB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAY3C,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAG1C;IACC,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,IAAI,SAAS;QAAE,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAC;IAE9C,IAAI,SAA6B,CAAC;IAClC,IAAI,SAA6B,CAAC;IAClC,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YACH,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YAC3D,SAAS,GAAG,CAAC,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC;YACrD,IAAI,SAAS;gBAAE,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QACV,IAAI,CAAC;YACH,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YAC9D,SAAS,GAAG,CAAC,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IAED,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,MAAM,gBAAgB,GAAG,CAAC,KAAyB,EAAE,EAAE;QACrD,IAAI,CAAC,KAAK,IAAI,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO;QACrD,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC,CAAC;IACF,IAAI,SAAS,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACvD,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,gBAAgB,CACd,MAAM,YAAY,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE;oBAClD,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,4BAA4B;oBAC7D,kBAAkB,EAAE,IAAI;iBACzB,CAAC,CACH,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC;QACD,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC;gBACH,gBAAgB,CACd,MAAM,YAAY,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE;oBAClD,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,4BAA4B;oBAC7D,kBAAkB,EAAE,KAAK;iBAC1B,CAAC,CACH,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC;IACH,CAAC;IAED,IAAI,OAAO,EAAE,kBAAkB,EAAE,CAAC;QAChC,MAAM,yBAAyB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACvD,CAAC;IAED,OAAO;QACL,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;QACzB,GAAG,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;YAC3B,CAAC,CAAC,EAAE,eAAe,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;YAC9C,CAAC,CAAC,EAAE,CAAC;QACP,SAAS;QACT,KAAK;QACL,SAAS;QACT,SAAS;QACT,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,QAAiC,EACjC,SAA6B;IAE7B,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,CAAC,SAAS;QAAE,OAAO;IAEhE,IAAI,CAAC;QACH,MAAM,EAAE,wBAAwB,EAAE,GAChC,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;QACnC,IAAI,MAAM,EAAE,YAAY,EAAE,CAAC;YACzB,QAAQ,CAAC,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC;QAC7C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;AACZ,CAAC","sourcesContent":["import {\n  getRequestOrgId,\n  getRequestUserEmail,\n} from \"../server/request-context.js\";\nimport { signA2AToken } from \"./client.js\";\n\nconst DEFAULT_A2A_CALLER_TOKEN_TTL = \"30m\";\n\nexport interface A2ACallerAuth {\n  apiKey?: string;\n  apiKeyFallbacks?: string[];\n  userEmail?: string;\n  orgId?: string;\n  orgDomain?: string;\n  orgSecret?: string;\n  metadata: Record<string, unknown>;\n}\n\nexport async function resolveA2ACallerAuth(options?: {\n  expiresIn?: string | number;\n  includeGoogleToken?: boolean;\n}): Promise<A2ACallerAuth> {\n  const userEmail = getRequestUserEmail();\n  const metadata: Record<string, unknown> = {};\n  if (userEmail) metadata.userEmail = userEmail;\n\n  let orgDomain: string | undefined;\n  let orgSecret: string | undefined;\n  const orgId = getRequestOrgId();\n  if (orgId) {\n    try {\n      const { getOrgDomain } = await import(\"../org/context.js\");\n      orgDomain = (await getOrgDomain(orgId)) ?? undefined;\n      if (orgDomain) metadata.orgDomain = orgDomain;\n    } catch {}\n    try {\n      const { getOrgA2ASecret } = await import(\"../org/context.js\");\n      orgSecret = (await getOrgA2ASecret(orgId)) ?? undefined;\n    } catch {}\n  }\n\n  const apiKeyAttempts: string[] = [];\n  const addApiKeyAttempt = (token: string | undefined) => {\n    if (!token || apiKeyAttempts.includes(token)) return;\n    apiKeyAttempts.push(token);\n  };\n  if (userEmail && (orgSecret || process.env.A2A_SECRET)) {\n    if (process.env.A2A_SECRET?.trim()) {\n      try {\n        addApiKeyAttempt(\n          await signA2AToken(userEmail, orgDomain, orgSecret, {\n            expiresIn: options?.expiresIn ?? DEFAULT_A2A_CALLER_TOKEN_TTL,\n            preferGlobalSecret: true,\n          }),\n        );\n      } catch {}\n    }\n    if (orgSecret) {\n      try {\n        addApiKeyAttempt(\n          await signA2AToken(userEmail, orgDomain, orgSecret, {\n            expiresIn: options?.expiresIn ?? DEFAULT_A2A_CALLER_TOKEN_TTL,\n            preferGlobalSecret: false,\n          }),\n        );\n      } catch {}\n    }\n  }\n\n  if (options?.includeGoogleToken) {\n    await attachGoogleTokenMetadata(metadata, userEmail);\n  }\n\n  return {\n    apiKey: apiKeyAttempts[0],\n    ...(apiKeyAttempts.length > 1\n      ? { apiKeyFallbacks: apiKeyAttempts.slice(1) }\n      : {}),\n    userEmail,\n    orgId,\n    orgDomain,\n    orgSecret,\n    metadata,\n  };\n}\n\nasync function attachGoogleTokenMetadata(\n  metadata: Record<string, unknown>,\n  userEmail: string | undefined,\n): Promise<void> {\n  if (process.env.NODE_ENV !== \"production\" || !userEmail) return;\n\n  try {\n    const { listOAuthAccountsByOwner } =\n      await import(\"../oauth-tokens/store.js\");\n    const accounts = await listOAuthAccountsByOwner(\"google\", userEmail);\n    const tokens = accounts[0]?.tokens;\n    if (tokens?.access_token) {\n      metadata.googleToken = tokens.access_token;\n    }\n  } catch {}\n}\n"]}

package/dist/a2a/client.d.ts

@@ -27,14 +27,17 @@ export declare function signA2AToken(email: string, orgDomain?: string, orgSecre
      */
     extraClaims?: Record<string, unknown>;
 }): Promise<string>;
+export declare function shouldPreferGlobalA2ASecret(orgSecret?: string): boolean;
 export declare class A2AClient {
     private baseUrl;
     private apiKey?;
+    private apiKeyAttempts;
     private endpointCandidates;
     private endpointResolved;
     private requestTimeoutMs?;
     constructor(baseUrl: string, apiKey?: string, options?: {
         requestTimeoutMs?: number;
+        fallbackApiKeys?: string[];
     });
     /**
      * Detect which A2A path the target agent uses.
@@ -42,6 +45,7 @@ export declare class A2AClient {
      */
     resolveEndpoint(): Promise<void>;
     private headers;
+    private markApiKeySucceeded;
     private rpc;
     getAgentCard(): Promise<AgentCard>;
     send(message: Message, opts?: {

package/dist/a2a/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/a2a/client.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,SAAS,EAGT,OAAO,EACP,IAAI,EACL,MAAM,YAAY,CAAC;AAEpB,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,YAAY,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAU5D;CACF;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,MAAM,EACb,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC,GACA,OAAO,CAAC,MAAM,CAAC,CA+BjB;AAED,qBAAa,SAAS;IACpB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,kBAAkB,CAAgB;IAC1C,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,gBAAgB,CAAC,CAAS;IAElC,YACE,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,EAWxC;IAED;;;OAGG;IACG,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAuBrC;IAED,OAAO,CAAC,OAAO;YAQD,GAAG;IAqCX,YAAY,IAAI,OAAO,CAAC,SAAS,CAAC,CAUvC;IAEK,IAAI,CACR,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QACL,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC;;;;;;;WAOG;QACH,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,GACA,OAAO,CAAC,IAAI,CAAC,CAef;IAED;;OAEG;IACG,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ3C;IAED;;;;;;;;OAQG;IACG,WAAW,CACf,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QACL,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,wDAAwD;QACxD,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,iCAAiC;QACjC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,oEAAoE;QACpE,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;KACjC,GACA,OAAO,CAAC,IAAI,CAAC,CA2Bf;IAEM,MAAM,CACX,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAChE,cAAc,CAAC,IAAI,CAAC,CA2DtB;YAEa,wBAAwB;YAyBxB,QAAQ;CAuBvB;AA2DD;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;IACL,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GACA,OAAO,CAAC,MAAM,CAAC,CAsEjB"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/a2a/client.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,SAAS,EAGT,OAAO,EACP,IAAI,EACL,MAAM,YAAY,CAAC;AAEpB,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,YAAY,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAU5D;CACF;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,MAAM,EACb,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC,GACA,OAAO,CAAC,MAAM,CAAC,CA+BjB;AAED,wBAAgB,2BAA2B,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAEvE;AAED,qBAAa,SAAS;IACpB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,cAAc,CAA4B;IAClD,OAAO,CAAC,kBAAkB,CAAgB;IAC1C,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,gBAAgB,CAAC,CAAS;IAElC,YACE,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,EAepE;IAED;;;OAGG;IACG,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAuBrC;IAED,OAAO,CAAC,OAAO;IAQf,OAAO,CAAC,mBAAmB;YAQb,GAAG;IA+CX,YAAY,IAAI,OAAO,CAAC,SAAS,CAAC,CAUvC;IAEK,IAAI,CACR,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QACL,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC;;;;;;;WAOG;QACH,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,GACA,OAAO,CAAC,IAAI,CAAC,CAef;IAED;;OAEG;IACG,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ3C;IAED;;;;;;;;OAQG;IACG,WAAW,CACf,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QACL,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,wDAAwD;QACxD,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,iCAAiC;QACjC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,oEAAoE;QACpE,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;KACjC,GACA,OAAO,CAAC,IAAI,CAAC,CA2Bf;IAEM,MAAM,CACX,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAChE,cAAc,CAAC,IAAI,CAAC,CAsEtB;YAEa,wBAAwB;YAyBxB,QAAQ;CA2BvB;AAgFD;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;IACL,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GACA,OAAO,CAAC,MAAM,CAAC,CAmEjB"}

package/dist/a2a/client.js

@@ -50,9 +50,13 @@ export async function signA2AToken(email, orgDomain, orgSecret, options) {
         jwt.setAudience(options.audience);
     return jwt.sign(new TextEncoder().encode(secret));
 }
+export function shouldPreferGlobalA2ASecret(orgSecret) {
+    return !!process.env.A2A_SECRET?.trim() || !orgSecret;
+}
 export class A2AClient {
     baseUrl;
     apiKey;
+    apiKeyAttempts;
     endpointCandidates = [];
     endpointResolved = false;
     requestTimeoutMs;
@@ -65,6 +69,10 @@ export class A2AClient {
             this.endpointResolved = true;
         }
         this.apiKey = apiKey;
+        this.apiKeyAttempts = uniqueAuthTokens([
+            apiKey,
+            ...(options?.fallbackApiKeys ?? []),
+        ]);
         this.requestTimeoutMs = options?.requestTimeoutMs;
     }
     /**
@@ -92,13 +100,20 @@ export class A2AClient {
             }
         }
     }
-    headers() {
+    headers(apiKey = this.apiKey) {
         const h = { "Content-Type": "application/json" };
-        if (this.apiKey) {
-            h["Authorization"] = `Bearer ${this.apiKey}`;
+        if (apiKey) {
+            h["Authorization"] = `Bearer ${apiKey}`;
         }
         return h;
     }
+    markApiKeySucceeded(apiKey) {
+        this.apiKey = apiKey;
+        this.apiKeyAttempts = uniqueAuthTokens([
+            apiKey,
+            ...this.apiKeyAttempts.filter((token) => token !== apiKey),
+        ]);
+    }
     async rpc(method, params) {
         const body = {
             jsonrpc: "2.0",
@@ -109,18 +124,26 @@ export class A2AClient {
         await this.ensureEndpointCandidates();
         let lastError = null;
         for (const url of this.endpointCandidates) {
-            console.log(`[A2A Client] POST ${url} method=${method}`);
-            const startTime = Date.now();
-            const res = await this.postJson(url, body);
-            console.log(`[A2A Client] Response: ${res.status} in ${Date.now() - startTime}ms`);
-            if (res.ok) {
-                this.endpointCandidates = [url];
-                return res.json();
-            }
-            const text = await res.text();
-            lastError = new Error(`A2A request failed (${res.status}): ${text}`);
-            if (!shouldTryNextEndpoint(res.status)) {
-                throw lastError;
+            for (let i = 0; i < this.apiKeyAttempts.length; i++) {
+                console.log(`[A2A Client] POST ${url} method=${method}`);
+                const startTime = Date.now();
+                const res = await this.postJson(url, body, this.apiKeyAttempts[i]);
+                console.log(`[A2A Client] Response: ${res.status} in ${Date.now() - startTime}ms`);
+                if (res.ok) {
+                    this.endpointCandidates = [url];
+                    this.markApiKeySucceeded(this.apiKeyAttempts[i]);
+                    return res.json();
+                }
+                const text = await res.text();
+                lastError = new Error(`A2A request failed (${res.status}): ${text}`);
+                if (i < this.apiKeyAttempts.length - 1 &&
+                    isA2AAuthRejectionResponse(res.status, text)) {
+                    continue;
+                }
+                if (!shouldTryNextEndpoint(res.status)) {
+                    throw lastError;
+                }
+                break;
             }
         }
         throw lastError ?? new Error("No A2A endpoint candidates available");
@@ -206,15 +229,25 @@ export class A2AClient {
         let res = null;
         let lastError = null;
         for (const candidate of this.endpointCandidates) {
-            res = await this.postJson(candidate, body);
-            if (res.ok) {
-                this.endpointCandidates = [candidate];
+            for (let i = 0; i < this.apiKeyAttempts.length; i++) {
+                res = await this.postJson(candidate, body, this.apiKeyAttempts[i]);
+                if (res.ok) {
+                    this.endpointCandidates = [candidate];
+                    this.markApiKeySucceeded(this.apiKeyAttempts[i]);
+                    break;
+                }
+                const text = await res.text();
+                lastError = new Error(`A2A stream failed (${res.status}): ${text}`);
+                if (i < this.apiKeyAttempts.length - 1 &&
+                    isA2AAuthRejectionResponse(res.status, text)) {
+                    continue;
+                }
+                if (!shouldTryNextEndpoint(res.status))
+                    throw lastError;
                 break;
             }
-            const text = await res.text();
-            lastError = new Error(`A2A stream failed (${res.status}): ${text}`);
-            if (!shouldTryNextEndpoint(res.status))
-                throw lastError;
+            if (res?.ok)
+                break;
         }
         if (!res?.ok) {
             throw lastError ?? new Error("No A2A endpoint candidates available");
@@ -271,7 +304,7 @@ export class A2AClient {
         }
         this.endpointCandidates = unique(candidates);
     }
-    async postJson(url, body) {
+    async postJson(url, body, apiKey = this.apiKey) {
         const controller = this.requestTimeoutMs
             ? new AbortController()
             : undefined;
@@ -281,7 +314,7 @@ export class A2AClient {
         try {
             return await ssrfSafeFetch(url, {
                 method: "POST",
-                headers: this.headers(),
+                headers: this.headers(apiKey),
                 body: JSON.stringify(body),
                 signal: controller?.signal,
             }, { maxRedirects: 3 });
@@ -342,6 +375,21 @@ function shouldTryNextEndpoint(status) {
 function unique(values) {
     return Array.from(new Set(values));
 }
+function uniqueAuthTokens(values) {
+    const result = [];
+    for (const value of values) {
+        if (result.includes(value))
+            continue;
+        result.push(value);
+    }
+    if (result.length === 0)
+        result.push(undefined);
+    return result;
+}
+function isA2AAuthRejectionResponse(status, text) {
+    return (status === 401 ||
+        /A2A error \(-32001\): (?:Invalid or expired A2A token|Invalid API key|Authentication required)|Invalid or expired A2A token|Invalid API key|Authentication required/i.test(text));
+}
 /**
  * One-shot convenience function: send a text message and get a text response.
  *
@@ -350,19 +398,6 @@ function unique(values) {
  * identity (instead of blindly trusting metadata).
  */
 export async function callAgent(url, text, opts) {
-    let apiKey = opts?.apiKey;
-    // Auto-sign with JWT when an A2A secret (org or global) is available and we have a user email
-    if (!apiKey &&
-        opts?.userEmail &&
-        (opts?.orgSecret || process.env.A2A_SECRET)) {
-        try {
-            apiKey = await signA2AToken(opts.userEmail, opts.orgDomain, opts.orgSecret, { preferGlobalSecret: !opts.orgSecret });
-        }
-        catch {
-            // Fall back to unsigned call
-        }
-    }
-    const client = new A2AClient(url, apiKey);
     const metadata = {};
     if (opts?.userEmail)
         metadata.userEmail = opts.userEmail;
@@ -378,15 +413,40 @@ export async function callAgent(url, text, opts) {
         role: "user",
         parts: [{ type: "text", text }],
     };
-    let task;
-    if (useAsync) {
+    const apiKeyAttempts = await buildA2AApiKeyAttempts(opts);
+    let lastAuthError;
+    for (let i = 0; i < apiKeyAttempts.length; i++) {
         try {
-            task = await client.sendAndWait(message, {
-                contextId: opts?.contextId,
-                metadata,
-                timeoutMs: opts?.timeoutMs,
-                pollIntervalMs: opts?.pollIntervalMs,
+            const fallbackApiKeys = apiKeyAttempts
+                .slice(i + 1)
+                .filter((token) => token !== undefined);
+            const client = new A2AClient(url, apiKeyAttempts[i], {
+                fallbackApiKeys,
             });
+            let task;
+            if (useAsync) {
+                task = await client.sendAndWait(message, {
+                    contextId: opts?.contextId,
+                    metadata,
+                    timeoutMs: opts?.timeoutMs,
+                    pollIntervalMs: opts?.pollIntervalMs,
+                });
+            }
+            else {
+                task = await client.send(message, {
+                    contextId: opts?.contextId,
+                    metadata,
+                });
+            }
+            // Extract text from the response
+            const responseMessage = task.status.message;
+            if (responseMessage) {
+                const textParts = responseMessage.parts
+                    .filter((p) => p.type === "text")
+                    .map((p) => p.text);
+                return textParts.join("\n");
+            }
+            return "";
         }
         catch (err) {
             if (err instanceof A2ATaskTimeoutError) {
@@ -394,25 +454,55 @@ export async function callAgent(url, text, opts) {
                 if (recoverableText)
                     return recoverableText;
             }
+            if (i < apiKeyAttempts.length - 1 && isA2AAuthRejection(err)) {
+                lastAuthError = err;
+                continue;
+            }
             throw err;
         }
     }
-    else {
-        task = await client.send(message, {
-            contextId: opts?.contextId,
-            metadata,
-        });
-    }
-    // Extract text from the response
-    const responseMessage = task.status.message;
-    if (responseMessage) {
-        const textParts = responseMessage.parts
-            .filter((p) => p.type === "text")
-            .map((p) => p.text);
-        return textParts.join("\n");
-    }
+    if (lastAuthError)
+        throw lastAuthError;
     return "";
 }
+async function buildA2AApiKeyAttempts(opts) {
+    const attempts = [];
+    const add = (token) => {
+        if (token === undefined || attempts.includes(token))
+            return;
+        attempts.push(token);
+    };
+    add(opts?.apiKey);
+    if (opts?.userEmail && (opts.orgSecret || process.env.A2A_SECRET)) {
+        if (process.env.A2A_SECRET?.trim()) {
+            try {
+                add(await signA2AToken(opts.userEmail, opts.orgDomain, opts.orgSecret, {
+                    preferGlobalSecret: true,
+                }));
+            }
+            catch {
+                // Keep any explicit token attempt, then fall back below.
+            }
+        }
+        if (opts.orgSecret) {
+            try {
+                add(await signA2AToken(opts.userEmail, opts.orgDomain, opts.orgSecret, {
+                    preferGlobalSecret: false,
+                }));
+            }
+            catch {
+                // Fall through to the attempts we already have.
+            }
+        }
+    }
+    if (attempts.length === 0)
+        attempts.push(undefined);
+    return attempts;
+}
+function isA2AAuthRejection(err) {
+    const message = err instanceof Error ? err.message : String(err ?? "");
+    return /A2A request failed \(401\)|A2A error \(-32001\): (?:Invalid or expired A2A token|Invalid API key|Authentication required)|Invalid or expired A2A token|Invalid API key|Authentication required/i.test(message);
+}
 function extractRecoverableArtifactText(task) {
     if (!task.status.message?.metadata?.agentNativeRecoverableArtifacts) {
         return "";