macro-agent 0.1.0 → 0.1.2

package/src/agent/types.ts

@@ -74,6 +74,9 @@ export interface SpawnAgentOptions {
    */
   role?: string;
 
+  /** Team instance ID this agent belongs to (set by TeamManager interceptor) */
+  team_instance?: string;
+
   /**
    * Stream ID to join (for workers and integrators).
    * Required for workers and integrators when using workspace isolation.
@@ -91,6 +94,12 @@ export interface SpawnAgentOptions {
    * If provided, the worker will claim this task and work on it.
    */
   dataplaneTaskId?: string;
+
+  /**
+   * Resolved capabilities for this agent's role.
+   * Injected by TeamRuntime spawn interceptor for capability-based workspace dispatch.
+   */
+  capabilities?: string[];
 }
 
 /**
@@ -380,4 +389,6 @@ export type AgentManagerErrorCode =
   | "NOT_RUNNING"
   | "INVALID_STATE"
   | "PERMISSION_DENIED"
-  | "CAPABILITY_DENIED";
+  | "CAPABILITY_DENIED"
+  | "SHUTDOWN_IN_PROGRESS"
+  | "FORK_NOT_SUPPORTED";

package/src/api/__tests__/server.test.ts

@@ -9,6 +9,7 @@ import type { EventStore } from "../../store/event-store.js";
 import type { AgentManager } from "../../agent/agent-manager.js";
 import type { TaskManager } from "../../task/task-manager.js";
 import type { MessageRouter } from "../../router/message-router.js";
+import type { TeamManager, TeamInstance } from "../../teams/team-manager.js";
 import type { Agent, Task, Event } from "../../store/types/index.js";
 
 // ─────────────────────────────────────────────────────────────────
@@ -154,6 +155,41 @@ function createMockMessageRouter(): MessageRouter {
   };
 }
 
+function createMockTeamInstance(overrides: Partial<TeamInstance> = {}): TeamInstance {
+  return {
+    id: "test-team-1",
+    templateName: "test-team",
+    runtime: {
+      getTaskMode: vi.fn(() => "push"),
+      getStrategyName: vi.fn(() => "queue"),
+      getManifest: vi.fn(() => ({
+        roles: [{ name: "worker", extends: "worker" }],
+        communication: { channels: [] },
+      })),
+    } as any,
+    result: {
+      rootId: "agent_root1",
+      companionIds: ["agent_comp1"],
+    },
+    ...overrides,
+  };
+}
+
+function createMockTeamManager(): TeamManager {
+  const instance = createMockTeamInstance();
+  return {
+    startTeam: vi.fn(async () => instance),
+    stopTeam: vi.fn(async () => {}),
+    teardownAll: vi.fn(async () => {}),
+    getTeamForAgent: vi.fn(() => undefined),
+    getInstance: vi.fn((id: string) => (id === instance.id ? instance : undefined)),
+    getInstances: vi.fn(() => [instance]),
+    hasActiveTeam: vi.fn(() => true),
+    install: vi.fn(),
+    uninstall: vi.fn(),
+  } as unknown as TeamManager;
+}
+
 // ─────────────────────────────────────────────────────────────────
 // Test Suite
 // ─────────────────────────────────────────────────────────────────
@@ -485,7 +521,7 @@ describe("API Server", () => {
 
   describe("Graceful Shutdown", () => {
     it("should call eventStore.persist and close on graceful shutdown", async () => {
-      const server = createTrackedServer();
+      const server = createTrackedServer(services, { port: 0 });
       await server.start();
       await server.stop();
 
@@ -495,7 +531,7 @@ describe("API Server", () => {
     });
 
     it("should skip grace period on force shutdown", async () => {
-      const server = createTrackedServer(services, { shutdownGracePeriodMs: 5000 });
+      const server = createTrackedServer(services, { port: 0, shutdownGracePeriodMs: 5000 });
       await server.start();
 
       const startTime = Date.now();
@@ -509,7 +545,7 @@ describe("API Server", () => {
     });
 
     it("should reject new messages during shutdown", async () => {
-      const server = createTrackedServer();
+      const server = createTrackedServer(services, { port: 0 });
       await server.start();
 
       // Initialize first
@@ -535,7 +571,7 @@ describe("API Server", () => {
     });
 
     it("should only shutdown once on multiple stop calls", async () => {
-      const server = createTrackedServer();
+      const server = createTrackedServer(services, { port: 0 });
       await server.start();
 
       // Call stop twice concurrently
@@ -549,6 +585,7 @@ describe("API Server", () => {
     it("should use custom shutdown grace period", async () => {
       const customGracePeriod = 100;
       const server = createTrackedServer(services, {
+        port: 0,
         shutdownGracePeriodMs: customGracePeriod,
       });
       await server.start();
@@ -1012,4 +1049,166 @@ describe("API Server", () => {
       );
     });
   });
+
+  // ─────────────────────────────────────────────────────────────────
+  // Team Management API Endpoints
+  // ─────────────────────────────────────────────────────────────────
+
+  describe("Team Management API", () => {
+    let teamManager: TeamManager;
+
+    beforeEach(() => {
+      teamManager = createMockTeamManager();
+      services = { ...services, teamManager };
+    });
+
+    describe("POST /api/teams", () => {
+      it("should start a team instance", async () => {
+        const server = createTrackedServer();
+        const res = await request(server.app)
+          .post("/api/teams")
+          .send({ template: "test-team" });
+
+        expect(res.status).toBe(201);
+        expect(res.body.id).toBe("test-team-1");
+        expect(res.body.templateName).toBe("test-team");
+        expect(res.body.rootAgentId).toBe("agent_root1");
+        expect(res.body.companionAgentIds).toEqual(["agent_comp1"]);
+        expect(res.body.taskMode).toBe("push");
+        expect(res.body.strategy).toBe("queue");
+        expect(teamManager.startTeam).toHaveBeenCalledWith("test-team", expect.any(String), undefined);
+      });
+
+      it("should return 400 when template is missing", async () => {
+        const server = createTrackedServer();
+        const res = await request(server.app)
+          .post("/api/teams")
+          .send({});
+
+        expect(res.status).toBe(400);
+        expect(res.body.code).toBe("INVALID_REQUEST");
+      });
+
+      it("should allow starting multiple teams", async () => {
+        const secondInstance = createMockTeamInstance({
+          id: "second-team-1",
+          templateName: "second-team",
+        });
+        (teamManager.startTeam as any)
+          .mockResolvedValueOnce(createMockTeamInstance())
+          .mockResolvedValueOnce(secondInstance);
+
+        const server = createTrackedServer();
+
+        const res1 = await request(server.app)
+          .post("/api/teams")
+          .send({ template: "test-team" });
+        expect(res1.status).toBe(201);
+
+        const res2 = await request(server.app)
+          .post("/api/teams")
+          .send({ template: "second-team" });
+        expect(res2.status).toBe(201);
+        expect(res2.body.id).toBe("second-team-1");
+      });
+
+      it("should return 500 on start failure", async () => {
+        (teamManager.startTeam as any).mockRejectedValueOnce(
+          new Error("Template not found")
+        );
+
+        const server = createTrackedServer();
+        const res = await request(server.app)
+          .post("/api/teams")
+          .send({ template: "bad-team" });
+
+        expect(res.status).toBe(500);
+        expect(res.body.code).toBe("TEAM_START_FAILED");
+      });
+    });
+
+    describe("GET /api/teams", () => {
+      it("should list running team instances", async () => {
+        const server = createTrackedServer();
+        const res = await request(server.app).get("/api/teams");
+
+        expect(res.status).toBe(200);
+        expect(res.body).toHaveLength(1);
+        expect(res.body[0].id).toBe("test-team-1");
+        expect(res.body[0].templateName).toBe("test-team");
+        expect(res.body[0].rootAgentId).toBe("agent_root1");
+      });
+
+      it("should return empty array when no teams running", async () => {
+        (teamManager.getInstances as any).mockReturnValue([]);
+
+        const server = createTrackedServer();
+        const res = await request(server.app).get("/api/teams");
+
+        expect(res.status).toBe(200);
+        expect(res.body).toEqual([]);
+      });
+    });
+
+    describe("GET /api/teams/:id", () => {
+      it("should return team instance details", async () => {
+        const server = createTrackedServer();
+        const res = await request(server.app).get("/api/teams/test-team-1");
+
+        expect(res.status).toBe(200);
+        expect(res.body.id).toBe("test-team-1");
+        expect(res.body.roles).toBeDefined();
+        expect(res.body.communication).toBeDefined();
+      });
+
+      it("should return 404 for unknown team", async () => {
+        const server = createTrackedServer();
+        const res = await request(server.app).get("/api/teams/nonexistent");
+
+        expect(res.status).toBe(404);
+        expect(res.body.code).toBe("TEAM_NOT_FOUND");
+      });
+    });
+
+    describe("DELETE /api/teams/:id", () => {
+      it("should teardown a team instance", async () => {
+        const server = createTrackedServer();
+        const res = await request(server.app).delete("/api/teams/test-team-1");
+
+        expect(res.status).toBe(200);
+        expect(res.body.success).toBe(true);
+        expect(teamManager.stopTeam).toHaveBeenCalledWith("test-team-1");
+      });
+
+      it("should return 404 for unknown team", async () => {
+        const server = createTrackedServer();
+        const res = await request(server.app).delete("/api/teams/nonexistent");
+
+        expect(res.status).toBe(404);
+        expect(res.body.code).toBe("TEAM_NOT_FOUND");
+      });
+
+      it("should return 500 on stop failure", async () => {
+        (teamManager.stopTeam as any).mockRejectedValueOnce(
+          new Error("Teardown failed")
+        );
+
+        const server = createTrackedServer();
+        const res = await request(server.app).delete("/api/teams/test-team-1");
+
+        expect(res.status).toBe(500);
+        expect(res.body.code).toBe("TEAM_STOP_FAILED");
+      });
+    });
+
+    describe("without teamManager", () => {
+      it("should not register team routes when teamManager is not provided", async () => {
+        const servicesNoTeam = { eventStore, agentManager, taskManager, messageRouter };
+        const server = createTrackedServer(servicesNoTeam);
+
+        const res = await request(server.app).get("/api/teams");
+        expect(res.status).toBe(404);
+      });
+    });
+  });
 });

package/src/api/server.ts

@@ -56,6 +56,8 @@ import {
   type InjectionDeps,
 } from "../steering/index.js";
 import type { AgentId } from "../store/types/index.js";
+import { secureCompare } from "../auth/token.js";
+import type { TeamManager } from "../teams/team-manager.js";
 
 // ─────────────────────────────────────────────────────────────────
 // Server Configuration
@@ -73,6 +75,9 @@ export interface APIServerConfig {
 
   /** Grace period in milliseconds for in-flight work during shutdown (default: 5000) */
   shutdownGracePeriodMs?: number;
+
+  /** Server token for Bearer auth on API routes. When set, all routes except /health require auth. */
+  serverToken?: string;
 }
 
 export interface APIServices {
@@ -84,6 +89,8 @@ export interface APIServices {
   mailService?: import("../mail/mail-service.js").MailService;
   /** Optional conversation map for agent-to-conversation tracking */
   conversationMap?: import("../mail/conversation-map.js").ConversationMap;
+  /** Optional team manager for dynamic team management */
+  teamManager?: TeamManager;
 }
 
 // ─────────────────────────────────────────────────────────────────
@@ -343,6 +350,113 @@ function registerConversationRoutes(
   });
 }
 
+// ─────────────────────────────────────────────────────────────────
+// Shared Team Routes Helper
+// ─────────────────────────────────────────────────────────────────
+
+/**
+ * Register team management REST endpoints on an Express app.
+ * Shared between standalone and shared API modes.
+ *
+ * Endpoints:
+ *   POST   /api/teams      — Start a team instance
+ *   GET    /api/teams      — List running team instances
+ *   GET    /api/teams/:id  — Get team instance details
+ *   DELETE /api/teams/:id  — Teardown a team instance
+ */
+function registerTeamRoutes(
+  app: Express,
+  teamManager: TeamManager | undefined,
+  defaultCwd: string,
+  sendError: (res: Response, status: number, code: string, message: string) => void,
+  broadcast?: (channel: string, message: WSMessage) => void,
+): void {
+  if (!teamManager) return;
+
+  // POST /api/teams — Start a team instance
+  app.post("/api/teams", async (req: Request, res: Response) => {
+    const { template, overrides } = req.body ?? {};
+    if (!template || typeof template !== "string") {
+      return sendError(res, 400, "INVALID_REQUEST", "Missing required field: template");
+    }
+
+    try {
+      const instance = await teamManager.startTeam(template, defaultCwd, overrides);
+      const result = {
+        id: instance.id,
+        templateName: instance.templateName,
+        rootAgentId: instance.result.rootId,
+        companionAgentIds: instance.result.companionIds,
+        taskMode: instance.runtime.getTaskMode(),
+        strategy: instance.runtime.getStrategyName(),
+      };
+
+      if (broadcast) {
+        broadcast("teams", { type: "team_started", data: result });
+      }
+
+      res.status(201).json(result);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      return sendError(res, 500, "TEAM_START_FAILED", message);
+    }
+  });
+
+  // GET /api/teams — List running team instances
+  app.get("/api/teams", (_req: Request, res: Response) => {
+    const instances = teamManager.getInstances();
+    res.json(instances.map((inst) => ({
+      id: inst.id,
+      templateName: inst.templateName,
+      rootAgentId: inst.result.rootId,
+      companionAgentIds: inst.result.companionIds,
+      taskMode: inst.runtime.getTaskMode(),
+      strategy: inst.runtime.getStrategyName(),
+    })));
+  });
+
+  // GET /api/teams/:id — Get team instance details
+  app.get("/api/teams/:id", (req: Request, res: Response) => {
+    const instance = teamManager.getInstance(req.params.id);
+    if (!instance) {
+      return sendError(res, 404, "TEAM_NOT_FOUND", `No team instance '${req.params.id}'`);
+    }
+
+    const manifest = instance.runtime.getManifest();
+    res.json({
+      id: instance.id,
+      templateName: instance.templateName,
+      rootAgentId: instance.result.rootId,
+      companionAgentIds: instance.result.companionIds,
+      taskMode: instance.runtime.getTaskMode(),
+      strategy: instance.runtime.getStrategyName(),
+      roles: manifest.roles,
+      communication: manifest.communication,
+    });
+  });
+
+  // DELETE /api/teams/:id — Teardown a team instance
+  app.delete("/api/teams/:id", async (req: Request, res: Response) => {
+    const instance = teamManager.getInstance(req.params.id);
+    if (!instance) {
+      return sendError(res, 404, "TEAM_NOT_FOUND", `No team instance '${req.params.id}'`);
+    }
+
+    try {
+      await teamManager.stopTeam(req.params.id);
+
+      if (broadcast) {
+        broadcast("teams", { type: "team_stopped", data: { id: req.params.id } });
+      }
+
+      res.json({ success: true });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      return sendError(res, 500, "TEAM_STOP_FAILED", message);
+    }
+  });
+}
+
 // ─────────────────────────────────────────────────────────────────
 // Create API Server
 // ─────────────────────────────────────────────────────────────────
@@ -351,7 +465,7 @@ export function createAPIServer(
   services: APIServices,
   config: APIServerConfig = {}
 ): APIServer {
-  const { port = 3000, host = "localhost", cors = true, shutdownGracePeriodMs = 5000 } = config;
+  const { port = 3000, host = "localhost", cors = true, shutdownGracePeriodMs = 5000, serverToken } = config;
   const { eventStore, agentManager, taskManager } = services;
 
   // Server state
@@ -374,12 +488,27 @@ export function createAPIServer(
   if (cors) {
     app.use((_req: Request, res: Response, next: NextFunction) => {
       res.header("Access-Control-Allow-Origin", "*");
-      res.header("Access-Control-Allow-Headers", "Content-Type");
+      res.header("Access-Control-Allow-Headers", "Content-Type, Authorization");
       res.header("Access-Control-Allow-Methods", "GET, POST, DELETE");
       next();
     });
   }
 
+  // Bearer token auth middleware (skip /health)
+  if (serverToken) {
+    app.use((req: Request, res: Response, next: NextFunction) => {
+      if (req.path === "/health") return next();
+      const authHeader = req.headers.authorization;
+      const token = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : undefined;
+      if (!token || !secureCompare(token, serverToken)) {
+        const error: APIError = { error: "Unauthorized", code: "AUTH_REQUIRED" };
+        res.status(401).json(error);
+        return;
+      }
+      next();
+    });
+  }
+
   // ─────────────────────────────────────────────────────────────────
   // Helper Functions
   // ─────────────────────────────────────────────────────────────────
@@ -438,7 +567,7 @@ export function createAPIServer(
       case "spawn":
         summary = `Agent ${event.payload.agent_id} spawned`;
         break;
-      case "terminate":
+      case "stop":
         summary = `Agent terminated: ${event.payload.reason}`;
         break;
       case "status":
@@ -549,8 +678,11 @@ export function createAPIServer(
     res.json(status);
   });
 
-  // GET /api/team - Get active team info
+  // GET /api/team - Get active team info (DEPRECATED: use GET /api/teams)
   app.get("/api/team", (_req: Request, res: Response) => {
+    res.set("Deprecation", "true");
+    res.set("Link", '</api/teams>; rel="successor-version"');
+
     // Check for team config in EventStore
     const statusEvents = eventStore.query({ type: "status", limit: 50 });
     const teamConfigEvent = statusEvents.find(
@@ -572,6 +704,9 @@ export function createAPIServer(
     });
   });
 
+  // Register dynamic team management routes
+  registerTeamRoutes(app, services.teamManager, process.cwd(), sendError, broadcastToChannel);
+
   // ─────────────────────────────────────────────────────────────────
   // Metrics Endpoints (Phase 5)
   // ─────────────────────────────────────────────────────────────────
@@ -1156,7 +1291,7 @@ export function createAPIServer(
     const gracePeriod = options?.force ? 0 : shutdownGracePeriodMs;
 
     // 1. Stop accepting new connections
-    server.close();
+    await new Promise<void>((resolve) => server.close(() => resolve()));
 
     // 2. Wait grace period for in-flight work
     if (gracePeriod > 0) {
@@ -1240,10 +1375,10 @@ export function createAPIServer(
  * @returns Express app
  */
 export function createAPIApp(
-  services: Pick<APIServices, "eventStore" | "agentManager" | "taskManager" | "messageRouter"> & Pick<Partial<APIServices>, "mailService" | "conversationMap">,
-  config: { cors?: boolean } = {}
+  services: Pick<APIServices, "eventStore" | "agentManager" | "taskManager" | "messageRouter"> & Pick<Partial<APIServices>, "mailService" | "conversationMap" | "teamManager">,
+  config: { cors?: boolean; serverToken?: string; defaultCwd?: string } = {}
 ): Express {
-  const { cors = true } = config;
+  const { cors = true, serverToken, defaultCwd } = config;
   const { agentManager, taskManager, messageRouter } = services;
 
   // Create shared state
@@ -1262,12 +1397,27 @@ export function createAPIApp(
   if (cors) {
     app.use((_req: Request, res: Response, next: NextFunction) => {
       res.header("Access-Control-Allow-Origin", "*");
-      res.header("Access-Control-Allow-Headers", "Content-Type");
+      res.header("Access-Control-Allow-Headers", "Content-Type, Authorization");
       res.header("Access-Control-Allow-Methods", "GET, POST, DELETE");
       next();
     });
   }
 
+  // Bearer token auth middleware (skip /health)
+  if (serverToken) {
+    app.use((req: Request, res: Response, next: NextFunction) => {
+      if (req.path === "/health") return next();
+      const authHeader = req.headers.authorization;
+      const token = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : undefined;
+      if (!token || !secureCompare(token, serverToken)) {
+        const error: APIError = { error: "Unauthorized", code: "AUTH_REQUIRED" };
+        res.status(401).json(error);
+        return;
+      }
+      next();
+    });
+  }
+
   // ─────────────────────────────────────────────────────────────────
   // Helper Functions
   // ─────────────────────────────────────────────────────────────────
@@ -1326,7 +1476,7 @@ export function createAPIApp(
       case "spawn":
         summary = `Agent ${event.payload.agent_id} spawned`;
         break;
-      case "terminate":
+      case "stop":
         summary = `Agent terminated: ${event.payload.reason}`;
         break;
       case "status":
@@ -1789,6 +1939,15 @@ export function createAPIApp(
   // Register conversation API routes (if mail service available)
   registerConversationRoutes(app, services, sendError);
 
+  // Register dynamic team management routes
+  registerTeamRoutes(
+    app,
+    services.teamManager,
+    defaultCwd ?? process.cwd(),
+    sendError,
+    state.broadcast,
+  );
+
   return app;
 }
 

package/src/api/types.ts

@@ -184,7 +184,9 @@ export type WSMessageType =
   | "status"
   | "error"
   | "conversation_update"
-  | "turn_added";
+  | "turn_added"
+  | "team_started"
+  | "team_stopped";
 
 export interface WSMessage {
   type: WSMessageType;

package/src/auth/__tests__/token.test.ts

@@ -0,0 +1,100 @@
+import { describe, it, expect } from "vitest";
+import { generateToken, secureCompare, AgentTokenManager } from "../token.js";
+
+describe("generateToken", () => {
+  it("generates a hex string of expected length", () => {
+    const token = generateToken();
+    // 32 bytes = 64 hex chars
+    expect(token).toHaveLength(64);
+    expect(token).toMatch(/^[0-9a-f]+$/);
+  });
+
+  it("generates different tokens each time", () => {
+    const a = generateToken();
+    const b = generateToken();
+    expect(a).not.toBe(b);
+  });
+
+  it("respects custom byte length", () => {
+    const token = generateToken(16);
+    expect(token).toHaveLength(32); // 16 bytes = 32 hex chars
+  });
+});
+
+describe("secureCompare", () => {
+  it("returns true for identical strings", () => {
+    expect(secureCompare("abc123", "abc123")).toBe(true);
+  });
+
+  it("returns false for different strings of same length", () => {
+    expect(secureCompare("abc123", "xyz789")).toBe(false);
+  });
+
+  it("returns false for different length strings", () => {
+    expect(secureCompare("short", "longer-string")).toBe(false);
+  });
+
+  it("returns true for empty strings", () => {
+    expect(secureCompare("", "")).toBe(true);
+  });
+});
+
+describe("AgentTokenManager", () => {
+  it("creates and verifies a token", () => {
+    const mgr = new AgentTokenManager();
+    const token = mgr.createToken("agent-1");
+    expect(token).toHaveLength(64);
+    expect(mgr.verifyToken("agent-1", token)).toBe(true);
+  });
+
+  it("rejects wrong token", () => {
+    const mgr = new AgentTokenManager();
+    mgr.createToken("agent-1");
+    expect(mgr.verifyToken("agent-1", "wrong-token")).toBe(false);
+  });
+
+  it("rejects unknown agent", () => {
+    const mgr = new AgentTokenManager();
+    expect(mgr.verifyToken("unknown", "any-token")).toBe(false);
+  });
+
+  it("revokes a token", () => {
+    const mgr = new AgentTokenManager();
+    const token = mgr.createToken("agent-1");
+    expect(mgr.revokeToken("agent-1")).toBe(true);
+    expect(mgr.verifyToken("agent-1", token)).toBe(false);
+    expect(mgr.hasToken("agent-1")).toBe(false);
+  });
+
+  it("revoke returns false for unknown agent", () => {
+    const mgr = new AgentTokenManager();
+    expect(mgr.revokeToken("unknown")).toBe(false);
+  });
+
+  it("hasToken returns correct state", () => {
+    const mgr = new AgentTokenManager();
+    expect(mgr.hasToken("agent-1")).toBe(false);
+    mgr.createToken("agent-1");
+    expect(mgr.hasToken("agent-1")).toBe(true);
+  });
+
+  it("createToken overwrites previous token", () => {
+    const mgr = new AgentTokenManager();
+    const token1 = mgr.createToken("agent-1");
+    const token2 = mgr.createToken("agent-1");
+    expect(token1).not.toBe(token2);
+    expect(mgr.verifyToken("agent-1", token1)).toBe(false);
+    expect(mgr.verifyToken("agent-1", token2)).toBe(true);
+  });
+
+  it("manages multiple agents independently", () => {
+    const mgr = new AgentTokenManager();
+    const t1 = mgr.createToken("agent-1");
+    const t2 = mgr.createToken("agent-2");
+    expect(mgr.verifyToken("agent-1", t1)).toBe(true);
+    expect(mgr.verifyToken("agent-2", t2)).toBe(true);
+    // Cross-validation fails
+    expect(mgr.verifyToken("agent-1", t2)).toBe(false);
+    expect(mgr.verifyToken("agent-2", t1)).toBe(false);
+  });
+});

package/src/auth/index.ts

@@ -0,0 +1 @@
+export { generateToken, secureCompare, AgentTokenManager } from "./token.js";