[TheGreatAxios]

Summary

• ResolveTenantId, AgentTokenVerifier, requireGrant and mountAgentTokens are typed against the hub's TenantEnv (generic E extends TenantEnv), so hosts read c.get("tenant") without casts.
• requireAgentToken returns MiddlewareHandler<{ Variables: AgentTokenVariables }>; used inline on a route, c.get("agentToken") typechecks.
• ResolvedWorkflowRunScope, WorkflowRunScopeEnv and AgentTokenAuth are exported as the single definition for run-scoped mounts. Types only, no runtime change.
• @intx/hub-api is a required peer (type-only import): every host is a hub, and an optional peer would erase the types. AgentTokenAuth keeps its undefined/null sentinels so sibling imports swap one-for-one.
• Downstream: workbench apps/hub/src/server.ts can drop its resolveTenantId cast.
• First PR of the stack feat(types): type agent-token contexts against the hub's TenantEnv #4 → build: add eslint and prettier with a check script #11, based on main.

Verification

• bun run typecheck, bun run build: pass
• DATABASE_URL=... bun test --timeout 60000 ./src against local Postgres: 7 pass, 0 fail

Closes CL-9312
Closes CL-9174
Closes CL-9184

[TheGreatAxios]

Self-review

• Correctness: the verifier and middleware share one bearer lookup; the generic E extends TenantEnv handlers annotate Context<E> so host envs wider than TenantEnv (e.g. WorkflowRunScopeEnv) mount and verify without casts.
• Tests: the DB suite covers mint, revoke, gate, definition ownership, middleware and the verifier on a run-scoped app.
• Packaging: @intx/hub-api is type-only; required peer is intentional. Version bumps to 0.2.0 for the type break.
• Follow-up: workbench's hub drops its resolveTenantId cast when it takes 0.2.0.