@desplega.ai/agent-swarm 2.4.3 → 2.4.4

package/dist/{index-d0g18bax.js → index-thm0y6a8.js}

@@ -2,38 +2,38 @@ import"./cli-ns59dc6r.js";
 import {
   startHeartbeat2,
   stopHeartbeat2
-} from "./cli-8y99kfey.js";
-import"./cli-f0p0f6ja.js";
-import"./cli-mzkwkbdy.js";
-import"./cli-kgnkyabk.js";
+} from "./cli-3cgngyd8.js";
+import"./cli-dqb4n629.js";
+import"./cli-82d3nkc3.js";
+import"./cli-v3yr2gbg.js";
 import"./cli-smvcw9z5.js";
-import"./cli-1eszr343.js";
+import"./cli-2zqpkvtt.js";
 import"./cli-qz93y3x5.js";
 import"./cli-3h26v7yj.js";
 import"./cli-e8xyjvfc.js";
-import"./cli-npfe9t1s.js";
-import"./cli-73ezfhha.js";
+import"./cli-xc27fwzg.js";
+import"./cli-2y91wnbh.js";
 import"./cli-3ggwdtb0.js";
-import"./cli-pygdsgh8.js";
-import"./cli-1n9gdg56.js";
-import"./cli-vq9gqarq.js";
+import"./cli-esxerzg7.js";
+import"./cli-t7cyef5g.js";
+import"./cli-amyhm3gj.js";
 import"./cli-qje9k2nh.js";
-import"./cli-0dxxwfkt.js";
-import"./cli-s9rr4gr2.js";
+import"./cli-51y09c6p.js";
+import"./cli-q6r7t299.js";
 import"./cli-8nyhf7za.js";
 import"./cli-ejs3m1sx.js";
-import"./cli-6eyncg0y.js";
+import"./cli-cynvc9fj.js";
 import"./cli-13p25grh.js";
 import"./cli-0adyhvq2.js";
-import"./cli-tkf4x6ha.js";
-import"./cli-v87dr6e3.js";
-import"./cli-gx0j2khs.js";
-import"./cli-sds5zzs8.js";
+import"./cli-qkhc5aqy.js";
+import"./cli-1d70crsy.js";
+import"./cli-w6nadkh4.js";
+import"./cli-9fhkkpj5.js";
 import"./cli-445c1vp7.js";
 import"./cli-kvzgak7c.js";
 import"./cli-b2mz5mjc.js";
-import"./cli-qp2m4btv.js";
-import"./cli-vcgscaan.js";
+import"./cli-4dg55wsk.js";
+import"./cli-p20r8w42.js";
 import"./cli-wt645v7q.js";
 export {
   startHeartbeat2 as startHeartbeat,

package/dist/{index-x8xbyn1t.js → index-ww2vznkp.js}

@@ -3,7 +3,7 @@ import {
   resetEmbeddingProvider2,
   getMemoryStore2,
   init_memory
-} from "./cli-vcgscaan.js";
+} from "./cli-p20r8w42.js";
 init_memory();
 
 export {

package/dist/{keepalive-y5t1my7m.js → keepalive-hrh7xnr9.js}

@@ -1,10 +1,10 @@
 import {
   listKeepAliveAuthorizations,
   init_oauth
-} from "./cli-vcgscaan.js";
+} from "./cli-p20r8w42.js";
 import {
   ensureAuthorizationTokenOrThrow
-} from "./cli-pygdsgh8.js";
+} from "./cli-esxerzg7.js";
 import {
   scrubSecrets,
   init_secret_scrubber
@@ -57,7 +57,7 @@ async function notifySlack(text) {
     return;
   }
   try {
-    const { getSlackApp } = await import("./app-6sv8mhzm.js");
+    const { getSlackApp } = await import("./app-rb7vc02s.js");
     const app = getSlackApp();
     if (!app) {
       console.warn("[OAuth Keepalive] Slack not available, cannot send notification");

package/dist/{lead-2xwtq66b.js → lead-ee8vazz2.js}

@@ -1,67 +1,66 @@
 import"./cli-qz93y3x5.js";
 import {
   getEnabledCapabilities
-} from "./cli-kgnkyabk.js";
-import"./cli-v1sjhn52.js";
-import"./cli-vcgscaan.js";
-import"./cli-qp2m4btv.js";
-import"./cli-1n9gdg56.js";
-import"./cli-vq9gqarq.js";
-import"./cli-npfe9t1s.js";
-import"./cli-1eszr343.js";
-import"./cli-0dxxwfkt.js";
-import"./cli-73ezfhha.js";
-import"./cli-pygdsgh8.js";
+} from "./cli-v3yr2gbg.js";
+import"./cli-p20r8w42.js";
+import"./cli-4dg55wsk.js";
+import"./cli-t7cyef5g.js";
+import"./cli-amyhm3gj.js";
+import"./cli-xc27fwzg.js";
+import"./cli-2zqpkvtt.js";
+import"./cli-51y09c6p.js";
+import"./cli-2y91wnbh.js";
+import"./cli-esxerzg7.js";
 import"./cli-3ggwdtb0.js";
-import"./cli-tkf4x6ha.js";
-import"./cli-v87dr6e3.js";
-import"./cli-s9rr4gr2.js";
+import"./cli-qkhc5aqy.js";
+import"./cli-1d70crsy.js";
+import"./cli-q6r7t299.js";
 import"./cli-8nyhf7za.js";
 import"./cli-kvzgak7c.js";
 import"./cli-445c1vp7.js";
 import"./cli-ejs3m1sx.js";
 import"./cli-wt645v7q.js";
-import"./cli-6eyncg0y.js";
+import"./cli-cynvc9fj.js";
 import"./cli-e8xyjvfc.js";
 import"./cli-qje9k2nh.js";
-import"./cli-gx0j2khs.js";
+import"./cli-w6nadkh4.js";
 import"./cli-3h26v7yj.js";
 import"./cli-smvcw9z5.js";
 import"./cli-0xk505e8.js";
 import"./cli-bn0rewsy.js";
 import"./cli-77cd6gy8.js";
-import"./cli-6aen3ezb.js";
+import"./cli-xj0re5tm.js";
 import {
   runAgent
-} from "./cli-1012xb7j.js";
+} from "./cli-zrwpctp4.js";
 import"./cli-a5ebc95n.js";
 import"./cli-gx4rm0qx.js";
 import"./cli-5kqnemen.js";
 import"./cli-jc1g9ndz.js";
-import"./cli-1ma335fz.js";
+import"./cli-1ephgwnq.js";
 import"./cli-1m17dc9d.js";
 import"./cli-pnp2j5zg.js";
 import"./cli-d82btycs.js";
 import"./cli-0726awxw.js";
-import"./cli-aa3tb29r.js";
-import"./cli-h0mgxann.js";
+import"./cli-55qmbp6z.js";
+import"./cli-vdm20wej.js";
 import"./cli-4bd1rck6.js";
 import"./cli-vbhgkw9h.js";
 import"./cli-er83cjbn.js";
 import"./cli-a0kcty51.js";
 import"./cli-kr5tjjtz.js";
-import"./cli-zvbb4n0e.js";
-import"./cli-58vwn100.js";
+import"./cli-vq97g1jq.js";
+import"./cli-bnz0r3kc.js";
 import"./cli-s95dknxh.js";
-import"./cli-wk28hzqn.js";
-import"./cli-038fga5k.js";
+import"./cli-44159k28.js";
+import"./cli-te6b5wvg.js";
 import"./cli-vfha21c9.js";
 import"./cli-36ckw0wx.js";
-import"./cli-aypbg9r2.js";
+import"./cli-zrk6jxv8.js";
 import"./cli-4zsenjhy.js";
 import"./cli-13p25grh.js";
 import"./cli-0adyhvq2.js";
-import"./cli-sds5zzs8.js";
+import"./cli-9fhkkpj5.js";
 
 // src/commands/lead.ts
 var leadConfig = {

package/dist/{maintenance-ybfsaedv.js → maintenance-e8wnwnqx.js}

@@ -1,7 +1,7 @@
 import {
   reembedAllScripts,
   init_embeddings
-} from "./cli-vcgscaan.js";
+} from "./cli-p20r8w42.js";
 
 // src/be/scripts/maintenance.ts
 init_embeddings();

package/dist/{oauth-refresh-sweep-909jmn12.js → oauth-refresh-sweep-zm0yj4sj.js}

@@ -2,10 +2,10 @@ import {
   getAuthorizationById,
   listAuthorizationSweepRows,
   init_oauth
-} from "./cli-vcgscaan.js";
+} from "./cli-p20r8w42.js";
 import {
   forceRefreshAuthorizationOrThrow
-} from "./cli-pygdsgh8.js";
+} from "./cli-esxerzg7.js";
 import {
   scrubSecrets,
   init_secret_scrubber

package/dist/{onboard-xn6fkkys.js → onboard-dtwcq603.js}

@@ -16,7 +16,7 @@ import {
   createDefaultSettingsLocal,
   createDefaultMcpJson,
   createHooksConfig
-} from "./cli-e4d78xsv.js";
+} from "./cli-37yb7307.js";
 import {
   getSlackConfiguration,
   isSlackConfigured,
@@ -25,7 +25,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-1xsraagq.js";
+} from "./cli-pccfmtb5.js";
 import {
   getApiKey,
   init_api_key

package/dist/{otel-impl-e6mn0z13.js → otel-impl-w3fbhpn0.js}

@@ -14,7 +14,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-1xsraagq.js";
+} from "./cli-pccfmtb5.js";
 import {
   scrubSecrets,
   init_secret_scrubber

package/dist/{pricing-refresh-ygd362ep.js → pricing-refresh-j38dehfs.js}

@@ -1,9 +1,9 @@
 import {
   requestModelCatalogRefresh2,
   startPricingRefreshLoop2
-} from "./cli-npfe9t1s.js";
-import"./cli-vq9gqarq.js";
-import"./cli-vcgscaan.js";
+} from "./cli-xc27fwzg.js";
+import"./cli-amyhm3gj.js";
+import"./cli-p20r8w42.js";
 export {
   requestModelCatalogRefresh2 as requestModelCatalogRefresh,
   startPricingRefreshLoop2 as startPricingRefreshLoop

package/dist/{rbac-roles-c9axvfnz.js → rbac-roles-ae8yttq4.js}

@@ -2,11 +2,11 @@ import {
   getDb2,
   getDbClient2,
   init_db3
-} from "./cli-vcgscaan.js";
+} from "./cli-p20r8w42.js";
 import {
   PermissionVerbSchema,
   init_rbac
-} from "./cli-8vverzf7.js";
+} from "./cli-ba8ne1es.js";
 import {
   isEnvFlagEnabled,
   init_env_flag

package/dist/{rbac-roles-mb470p4e.js → rbac-roles-ejxx9b35.js}

@@ -2,8 +2,8 @@ import {
   getUserGrant2,
   ensureRbacSeedsSynced2,
   init_rbac_roles
-} from "./cli-qp2m4btv.js";
-import"./cli-vcgscaan.js";
+} from "./cli-4dg55wsk.js";
+import"./cli-p20r8w42.js";
 init_rbac_roles();
 
 export {

package/dist/{render-v2-g0306nh1.js → render-v2-n16n0phe.js}

@@ -2,9 +2,9 @@ import {
   isSlackRenderV2Enabled2,
   ensureSlackThreadTree2,
   processSlackRenderV22
-} from "./cli-tkf4x6ha.js";
-import"./cli-v87dr6e3.js";
-import"./cli-vcgscaan.js";
+} from "./cli-qkhc5aqy.js";
+import"./cli-1d70crsy.js";
+import"./cli-p20r8w42.js";
 export {
   ensureSlackThreadTree2 as ensureSlackThreadTree,
   isSlackRenderV2Enabled2 as isSlackRenderV2Enabled,

package/dist/{resume-v315hnq6.js → resume-z0fgjc38.js}

@@ -9,17 +9,17 @@ import {
   resumeFromChildRun2,
   initWaitBusSubscriptions2,
   subscribeWaitToBus2
-} from "./cli-0dxxwfkt.js";
-import"./cli-s9rr4gr2.js";
+} from "./cli-51y09c6p.js";
+import"./cli-q6r7t299.js";
 import"./cli-8nyhf7za.js";
 import"./cli-ejs3m1sx.js";
 import"./cli-13p25grh.js";
 import"./cli-0adyhvq2.js";
-import"./cli-tkf4x6ha.js";
-import"./cli-v87dr6e3.js";
+import"./cli-qkhc5aqy.js";
+import"./cli-1d70crsy.js";
 import"./cli-445c1vp7.js";
 import"./cli-kvzgak7c.js";
-import"./cli-vcgscaan.js";
+import"./cli-p20r8w42.js";
 import"./cli-wt645v7q.js";
 export {
   cancelWorkflowRun2 as cancelWorkflowRun,

package/dist/{session-access-2zg285a1.js → session-access-cv3mq6mc.js}

@@ -5,18 +5,20 @@ import {
   canReadSession2,
   readableByFor2,
   SESSION_WRITE_DENIED2,
+  denyParentAttach2,
   pathSessionDenial2,
   bodySessionDenial2,
   userAgentIdentityDenial2
-} from "./cli-6eyncg0y.js";
-import"./cli-sds5zzs8.js";
-import"./cli-qp2m4btv.js";
-import"./cli-vcgscaan.js";
+} from "./cli-cynvc9fj.js";
+import"./cli-9fhkkpj5.js";
+import"./cli-4dg55wsk.js";
+import"./cli-p20r8w42.js";
 export {
   SESSION_READ_DENIED2 as SESSION_READ_DENIED,
   SESSION_WRITE_DENIED2 as SESSION_WRITE_DENIED,
   bodySessionDenial2 as bodySessionDenial,
   canReadSession2 as canReadSession,
+  denyParentAttach2 as denyParentAttach,
   pathSessionDenial2 as pathSessionDenial,
   readableByFor2 as readableByFor,
   resolveSessionActor2 as resolveSessionActor,

package/dist/{setup-a4mtf02k.js → setup-mafhj3yt.js}

@@ -15,7 +15,7 @@ import {
   createDefaultSettingsLocal,
   createDefaultMcpJson,
   createHooksConfig
-} from "./cli-e4d78xsv.js";
+} from "./cli-37yb7307.js";
 import {
   getApiKey,
   init_api_key

package/dist/{work-objects-9fr0fgtn.js → work-objects-8b86mgjp.js}

@@ -2,45 +2,45 @@ import {
   getAgentById2,
   getTaskById2,
   init_db3
-} from "./cli-vcgscaan.js";
+} from "./cli-p20r8w42.js";
 import {
   slackTaskOutput,
   getTaskUrl
-} from "./cli-tkf4x6ha.js";
+} from "./cli-qkhc5aqy.js";
 import {
   shouldBlockChannel2
-} from "./cli-v87dr6e3.js";
-import"./cli-kgnkyabk.js";
-import"./cli-0dxxwfkt.js";
-import"./cli-73ezfhha.js";
-import"./cli-pygdsgh8.js";
+} from "./cli-1d70crsy.js";
+import"./cli-v3yr2gbg.js";
+import"./cli-51y09c6p.js";
+import"./cli-2y91wnbh.js";
+import"./cli-esxerzg7.js";
 import"./cli-3ggwdtb0.js";
-import"./cli-s9rr4gr2.js";
+import"./cli-q6r7t299.js";
 import"./cli-8nyhf7za.js";
 import"./cli-kvzgak7c.js";
 import"./cli-445c1vp7.js";
 import"./cli-ejs3m1sx.js";
 import"./cli-wt645v7q.js";
-import"./cli-1eszr343.js";
-import"./cli-vq9gqarq.js";
-import"./cli-npfe9t1s.js";
+import"./cli-2zqpkvtt.js";
+import"./cli-amyhm3gj.js";
+import"./cli-xc27fwzg.js";
 import"./cli-qz93y3x5.js";
-import"./cli-qp2m4btv.js";
-import"./cli-1n9gdg56.js";
+import"./cli-4dg55wsk.js";
+import"./cli-t7cyef5g.js";
 import"./cli-e8xyjvfc.js";
 import"./cli-qje9k2nh.js";
-import"./cli-gx0j2khs.js";
-import"./cli-6eyncg0y.js";
+import"./cli-w6nadkh4.js";
+import"./cli-cynvc9fj.js";
 import"./cli-3h26v7yj.js";
 import"./cli-smvcw9z5.js";
-import"./cli-4yef8ghv.js";
-import"./cli-bxrqvpg5.js";
+import"./cli-2v045xyf.js";
+import"./cli-b8k7epj1.js";
 import {
   isUserAllowed2
-} from "./cli-dm8p2dpf.js";
+} from "./cli-gqvh8d8a.js";
 import"./cli-13p25grh.js";
 import"./cli-0adyhvq2.js";
-import"./cli-sds5zzs8.js";
+import"./cli-9fhkkpj5.js";
 import {
   isEnvFlagEnabled,
   init_env_flag

package/dist/{worker-qae22jeb.js → worker-16s75hm5.js}

@@ -1,67 +1,66 @@
 import"./cli-qz93y3x5.js";
 import {
   getEnabledCapabilities
-} from "./cli-kgnkyabk.js";
-import"./cli-v1sjhn52.js";
-import"./cli-vcgscaan.js";
-import"./cli-qp2m4btv.js";
-import"./cli-1n9gdg56.js";
-import"./cli-vq9gqarq.js";
-import"./cli-npfe9t1s.js";
-import"./cli-1eszr343.js";
-import"./cli-0dxxwfkt.js";
-import"./cli-73ezfhha.js";
-import"./cli-pygdsgh8.js";
+} from "./cli-v3yr2gbg.js";
+import"./cli-p20r8w42.js";
+import"./cli-4dg55wsk.js";
+import"./cli-t7cyef5g.js";
+import"./cli-amyhm3gj.js";
+import"./cli-xc27fwzg.js";
+import"./cli-2zqpkvtt.js";
+import"./cli-51y09c6p.js";
+import"./cli-2y91wnbh.js";
+import"./cli-esxerzg7.js";
 import"./cli-3ggwdtb0.js";
-import"./cli-tkf4x6ha.js";
-import"./cli-v87dr6e3.js";
-import"./cli-s9rr4gr2.js";
+import"./cli-qkhc5aqy.js";
+import"./cli-1d70crsy.js";
+import"./cli-q6r7t299.js";
 import"./cli-8nyhf7za.js";
 import"./cli-kvzgak7c.js";
 import"./cli-445c1vp7.js";
 import"./cli-ejs3m1sx.js";
 import"./cli-wt645v7q.js";
-import"./cli-6eyncg0y.js";
+import"./cli-cynvc9fj.js";
 import"./cli-e8xyjvfc.js";
 import"./cli-qje9k2nh.js";
-import"./cli-gx0j2khs.js";
+import"./cli-w6nadkh4.js";
 import"./cli-3h26v7yj.js";
 import"./cli-smvcw9z5.js";
 import"./cli-0xk505e8.js";
 import"./cli-bn0rewsy.js";
 import"./cli-77cd6gy8.js";
-import"./cli-6aen3ezb.js";
+import"./cli-xj0re5tm.js";
 import {
   runAgent
-} from "./cli-1012xb7j.js";
+} from "./cli-zrwpctp4.js";
 import"./cli-a5ebc95n.js";
 import"./cli-gx4rm0qx.js";
 import"./cli-5kqnemen.js";
 import"./cli-jc1g9ndz.js";
-import"./cli-1ma335fz.js";
+import"./cli-1ephgwnq.js";
 import"./cli-1m17dc9d.js";
 import"./cli-pnp2j5zg.js";
 import"./cli-d82btycs.js";
 import"./cli-0726awxw.js";
-import"./cli-aa3tb29r.js";
-import"./cli-h0mgxann.js";
+import"./cli-55qmbp6z.js";
+import"./cli-vdm20wej.js";
 import"./cli-4bd1rck6.js";
 import"./cli-vbhgkw9h.js";
 import"./cli-er83cjbn.js";
 import"./cli-a0kcty51.js";
 import"./cli-kr5tjjtz.js";
-import"./cli-zvbb4n0e.js";
-import"./cli-58vwn100.js";
+import"./cli-vq97g1jq.js";
+import"./cli-bnz0r3kc.js";
 import"./cli-s95dknxh.js";
-import"./cli-wk28hzqn.js";
-import"./cli-038fga5k.js";
+import"./cli-44159k28.js";
+import"./cli-te6b5wvg.js";
 import"./cli-vfha21c9.js";
 import"./cli-36ckw0wx.js";
-import"./cli-aypbg9r2.js";
+import"./cli-zrk6jxv8.js";
 import"./cli-4zsenjhy.js";
 import"./cli-13p25grh.js";
 import"./cli-0adyhvq2.js";
-import"./cli-sds5zzs8.js";
+import"./cli-9fhkkpj5.js";
 
 // src/commands/worker.ts
 var workerConfig = {

package/dist/worker-token-xf11yyds.js

@@ -0,0 +1,136 @@
+import {
+  getApiKey,
+  init_api_key
+} from "./cli-pax9q4ff.js";
+
+// src/commands/worker-token.ts
+init_api_key();
+var WORKER_TOKEN_USAGE = `Usage:
+  agent-swarm worker-token <create|rotate|revoke> (--agent-id <id> | --name <name>) [options]
+
+Options:
+  --agent-id <id>     Agent the token is bound to
+  --name <name>       Agent name. create makes the agent when no agent has this name
+  --ttl-days <n>      Token lifetime (create, rotate). Default: no expiry
+  --grace-sec <n>     How long the old token keeps working after rotate (default 300)
+  --api-url <url>     Swarm API URL (default: MCP_BASE_URL or http://localhost:3013)
+  --api-key <key>     Operator swarm API key (default: AGENT_SWARM_API_KEY or API_KEY, falling back to 123123)
+  -h, --help          Show this help`;
+var ACTIONS = new Set(["create", "rotate", "revoke"]);
+function parseWorkerTokenArgs(args) {
+  const parsed = { showHelp: false };
+  const number = (flag, value, min) => {
+    const n = Number(value);
+    if (!Number.isInteger(n) || n < min)
+      parsed.error = `${flag} must be an integer >= ${min}`;
+    return n;
+  };
+  for (let i = 0;i < args.length; i++) {
+    const arg = args[i];
+    if (arg === "--help" || arg === "-h")
+      parsed.showHelp = true;
+    else if (arg === "--agent-id")
+      parsed.agentId = args[++i];
+    else if (arg === "--name")
+      parsed.name = args[++i];
+    else if (arg === "--api-url")
+      parsed.apiUrl = args[++i];
+    else if (arg === "--api-key")
+      parsed.apiKey = args[++i];
+    else if (arg === "--ttl-days")
+      parsed.ttlDays = number(arg, args[++i], 1);
+    else if (arg === "--grace-sec")
+      parsed.graceSec = number(arg, args[++i], 0);
+    else if (!parsed.action && ACTIONS.has(arg))
+      parsed.action = arg;
+    else
+      parsed.error = `Unknown argument: ${arg}`;
+  }
+  if (parsed.error || parsed.showHelp)
+    return parsed;
+  if (!parsed.action)
+    parsed.error = "Missing action: create, rotate, or revoke";
+  else if (!parsed.agentId === !parsed.name)
+    parsed.error = "Pass exactly one of --agent-id or --name";
+  return parsed;
+}
+async function readError(res) {
+  const text = await res.text().catch(() => "");
+  try {
+    return JSON.parse(text).error ?? text;
+  } catch {
+    return text;
+  }
+}
+async function runWorkerToken(args, deps = {}) {
+  const env = deps.env ?? process.env;
+  const doFetch = deps.fetch ?? fetch;
+  const stdout = deps.stdout ?? ((line) => console.log(line));
+  const stderr = deps.stderr ?? ((line) => console.error(line));
+  const parsed = parseWorkerTokenArgs(args);
+  if (parsed.showHelp) {
+    stdout(WORKER_TOKEN_USAGE);
+    return 0;
+  }
+  if (parsed.error) {
+    stderr(`${parsed.error}
+
+${WORKER_TOKEN_USAGE}`);
+    return 1;
+  }
+  const apiUrl = (parsed.apiUrl ?? env.MCP_BASE_URL ?? "http://localhost:3013").replace(/\/+$/, "");
+  const apiKey = parsed.apiKey ?? (getApiKey(env) || "123123");
+  const headers = { Authorization: `Bearer ${apiKey}`, "Content-Type": "application/json" };
+  let agentId = parsed.agentId;
+  let name;
+  if (!agentId) {
+    const res = await doFetch(`${apiUrl}/api/agents`, { headers });
+    if (!res.ok) {
+      stderr(`Listing agents failed (${res.status}): ${await readError(res)}`);
+      return 1;
+    }
+    const { agents } = await res.json();
+    const matches = agents.filter((agent) => agent.name === parsed.name);
+    if (matches.length > 1) {
+      stderr(`Several agents are named "${parsed.name}"; pass --agent-id instead`);
+      return 1;
+    }
+    agentId = matches[0]?.id;
+    if (!agentId) {
+      if (parsed.action !== "create") {
+        stderr(`No agent is named "${parsed.name}"`);
+        return 1;
+      }
+      agentId = crypto.randomUUID();
+      name = parsed.name;
+    }
+  }
+  const base = `${apiUrl}/api/agents/${encodeURIComponent(agentId)}/token`;
+  const ttlMs = parsed.ttlDays === undefined ? undefined : parsed.ttlDays * 86400000;
+  const res = parsed.action === "revoke" ? await doFetch(base, { method: "DELETE", headers }) : await doFetch(parsed.action === "rotate" ? `${base}/rotate` : base, {
+    method: "POST",
+    headers,
+    body: JSON.stringify(parsed.action === "rotate" ? { graceSec: parsed.graceSec, ttlMs } : { name, ttlMs })
+  });
+  if (!res.ok) {
+    stderr(`worker-token ${parsed.action} failed (${res.status}): ${await readError(res)}`);
+    return 1;
+  }
+  if (parsed.action === "revoke") {
+    const { revoked } = await res.json();
+    stderr(`Revoked ${revoked} worker token(s) of agent ${agentId}.`);
+    return 0;
+  }
+  const token = await res.json();
+  if (token.agentCreated)
+    stderr(`Created agent ${agentId} (${name}).`);
+  stderr(`Worker token for agent ${agentId}, ${token.expiresAt ? `expires ${token.expiresAt}` : "no expiry"}.`);
+  if (token.previousExpiresAt)
+    stderr(`The previous token stops working at ${token.previousExpiresAt}.`);
+  stderr(`Set it as the worker's API_KEY with AGENT_ID=${agentId}. It is shown only once.`);
+  stdout(token.plaintext);
+  return 0;
+}
+export {
+  runWorkerToken
+};