users.py: 'token <name>' subcommand — mint named API keys from the CLI

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/users.py

@@ -24,6 +24,9 @@ def main():
     p.add_argument("username")
     d = sub.add_parser("delete")
     d.add_argument("username")
+    t = sub.add_parser("token", help="mint a named API token (printed ONCE — store it in a .env)")
+    t.add_argument("name", help="what this key is for, e.g. m1ultra, deadstock-agent")
+    t.add_argument("--user", default=None, help="username to bind to (default: the owner)")
     args = ap.parse_args()
 
     if args.cmd == "add":
@@ -47,6 +50,16 @@ def main():
             sys.exit("no such user")
         auth.delete_user(con, u["id"])
         print("deleted")
+    elif args.cmd == "token":
+        if args.user:
+            u = auth.get_user_by_name(con, args.user)
+        else:
+            u = next((x for x in auth.list_users(con) if x["role"] == "owner"), None)
+        if not u:
+            sys.exit("no such user")
+        raw = auth.create_token(con, u["id"], name=args.name)
+        print(f"# token '{args.name}' for {u['username']} — shown once, goes in a .env:")
+        print(f"MB_TOKEN={raw}")
 
 
 if __name__ == "__main__":