# E2E Spec: Token Generation & Validation

## Overview
Test Ed25519-based API key and agent token generation and validation.
Covers `internal/token/token.go`.

## Setup
Use temp directory for config storage via failpoint injection.

## Test Cases

### API Key Lifecycle
- Generate creates key with "sk-dev." prefix
- Validate succeeds for freshly generated key
- Validate returns ErrInvalidFormat for malformed key (no dots, too short)
- Validate returns ErrExpired for key older than 7 days
- Validate returns ErrInvalidSignature for tampered payload
- Validate returns ErrInvalidSignature for wrong signing key

### Agent Token Lifecycle
- GenerateAgentTokenForServer creates token with "at-dev." prefix; generic daemon-route tests pass an empty server ID intentionally
- ValidateAgentTokenInfo succeeds for correct agent+token pair and returns the matched token record
- ValidateAgentTokenInfo returns ErrAgentMismatch for wrong agent
- ValidateAgentTokenInfo returns ErrInvalidFormat for malformed token
- Agent token contains agent ID in payload

### Key Pair Management
- Key pair auto-generated on first NewKeyManager call
- Subsequent calls use existing key pair
- Key pair persists across reload

### Singleton
- Default() returns same instance on repeated calls
- Concurrent access is safe

### Error Variants
- Empty string key returns ErrInvalidFormat
- Key with only prefix returns ErrInvalidFormat
- Invalid base64url in payload returns ErrInvalidFormat
- Invalid base64url in signature returns ErrInvalidFormat