naro-cli 0.9.1 → 0.10.0

package/README.md

@@ -124,7 +124,16 @@ naro backend keys --reveal         Print the service key (a secret; needs databa
 naro backend keys rotate --service Replace a key (--anon or --service); the old one stops
                                    working at once (asks first)
 naro backend auth                  Sign-in settings: email, Google, GitHub, redirects,
-                                   and the callback URL to register for each production host
+                                   the callback URL to register for each production host,
+                                   sign-ups and the minimum password length
+naro backend auth signups off      Nobody signs up on their own (on opens them again)
+naro backend auth password --min-length 10
+                                   The fewest characters a new password takes (6–128)
+naro backend users                 The project's users: id, username, email, verified, created
+naro backend users create --username admin --password-stdin < password.txt
+                                   A confirmed account (--email too, or instead); works
+                                   while sign-ups are closed
+naro backend users delete admin    By id, username or email; ends its sessions (asks first)
 naro backend auth email set --provider resend --from "App <no-reply@example.com>" --api-key-stdin < resend-key.txt
                                    Confirmation and password reset emails from your Resend account
 naro backend auth oauth set github --client-id Iv1.abc --client-secret-stdin < github-secret.txt
@@ -316,10 +325,12 @@ message that the worker may still expect the new key — run
 `naro backend enable`; the CLI prints that hint (JSON `hint`) and exits 1.
 For a few seconds during a rotation the worker can already refuse the old key.
 
-`naro backend auth` sets up email and social sign-in with the project's own
-accounts — Naro runs no shared sender. Email (confirmation and password reset
-links) needs a Resend API key and a `from` address; Google and GitHub need
-the project's own OAuth app. `naro backend auth` prints a callback URL for
+Sign-in is naro Auth, the project's own (like Supabase Auth). Email and
+password sign-up and sign-in work as soon as the backend is on, with nothing
+to set up. `naro backend auth` adds the rest with the project's own
+accounts — Naro runs no shared sender. Sending email (confirmation and
+password reset links) needs a Resend API key and a `from` address; Google
+and GitHub need the project's own OAuth app. `naro backend auth` prints a callback URL for
 each production host — `https://<project>.naro.sh/_naro/v1/auth/callback/<provider>`
 and the same path on each custom domain. Register, as the app's redirect URI,
 the one for the origin your app passes to `createClient({ url })`: the
@@ -347,10 +358,59 @@ code or reset token rides in the URL fragment, which any script on the page
 — or an open redirect like `/logout?next=…` — can pass on: allow a path of
 sign-in pages rather than a whole origin. Each change uploads
 the Naro worker again; when that upload stops, the change is saved all the
-same and the command exits 1 with `BACKEND_PROVISION_FAILED` — run
-`naro backend enable` to finish. `require-verification on` needs email set
+same and the command exits 1 with `BACKEND_PROVISION_FAILED`, saying
+whether the worker runs it yet — run `naro backend enable` to finish. Until
+then `naro backend auth` shows the saved settings with a warning that the
+worker may still run older ones (`applied: false` with `--json`), so a
+`signups off` that did not upload never reads back as simply closed.
+`require-verification on` needs email set
 up (`VERIFICATION_NEEDS_EMAIL`), and email cannot be removed while it is on.
 
+For an app only its admins sign in to, close sign-ups and create the
+accounts yourself — with sign-ups closed, `authenticated` in a policy means
+exactly the users you made:
+
+```bash
+naro backend auth signups off
+naro backend users create --username admin --password-stdin < password.txt
+```
+
+`signups off` makes every sign-up answer `403 SIGNUPS_DISABLED` ("Sign-ups
+are closed for this project."), and a first Google or GitHub sign-in too;
+users that exist keep signing in. `naro backend users create` takes
+`--username`, `--email` or both, and the password from stdin
+(`--password-stdin`: a pipe, or a hidden prompt in a terminal). `--password
+<p>` works too, with a warning on stderr: it lands in shell history. The
+account is confirmed and signs in at once — by username with
+`naro.auth.signIn({ username, password })` — also while sign-ups are closed
+and while sign-in waits for a confirmed email; a username-only account has
+`email: null`. The output never carries the password. `naro backend users`
+lists every user (id, username, email, verified, created; `--json` for all
+fields), and `naro backend users delete <id|username|email>` removes one and
+ends its sessions — it asks first, and without a terminal needs `--yes`
+(`CONFIRMATION_REQUIRED` otherwise, exit 1, nothing deleted). A username is
+3–30 letters, digits, `_` and `.`, in any case. The backend's refusals pass
+through: `409 USERNAME_TAKEN` "That username is already taken.",
+`422 USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL`, `400 PASSWORD_TOO_SHORT`
+"Use at least {n} characters.", `429 WRITE_QUOTA_EXCEEDED`.
+
+While sign-ups are open, a sign-up with a username someone has answers
+`409 USERNAME_TAKEN`, so anyone can learn which usernames exist, as fast as
+sign-up's per-address rate limit allows. With sign-ups closed, every
+sign-up answers `403 SIGNUPS_DISABLED` first.
+
+`naro backend auth password --min-length <n>` sets the fewest characters a
+new password takes, 6 to 128 (6 by default). Sign-up, password reset and
+`users create` refuse a shorter one with "Use at least {n} characters.";
+sign-in never checks it, so passwords set before keep working. Both
+settings re-upload the Naro worker, like the other `naro backend auth`
+changes, and `naro backend auth` shows them (`Sign-ups:`, `Minimum password
+length:`).
+
+A backend turned on before user management answers the `users` commands
+`409 BACKEND_OUTDATED`: run `naro backend enable` once to update this
+project's backend, then run the command again.
+
 Policies are default deny: a table without one refuses every anon and
 signed-in request. Each of `--select`, `--insert`, `--update` and `--delete`
 takes `none`, `public`, `authenticated` or `owner`; `owner` lets a signed-in

package/dist/{chunk-Z757IOF3.js → chunk-5U6YPVZS.js}

@@ -18598,6 +18598,15 @@ var TERMINAL_DEPLOYMENT_STATUSES = [
 function isTerminalStatus(status) {
   return TERMINAL_DEPLOYMENT_STATUSES.includes(status);
 }
+var BACKEND_STEPS = [
+  "database",
+  "keys",
+  "secrets",
+  "worker",
+  "routes",
+  "migrate",
+  "health"
+];
 var STALLED_GRACE_MS = 2 * 6e4;
 function isStalledBackend(info3, now = Date.now()) {
   if (typeof info3.stalled === "boolean") return info3.stalled;
@@ -19315,6 +19324,35 @@ function backendInfo(body) {
     turningOff: body.turningOff === true
   };
 }
+function authConfig(body) {
+  return {
+    ...body,
+    signupsEnabled: typeof body.signupsEnabled === "boolean" ? body.signupsEnabled : true,
+    passwordMinLength: typeof body.passwordMinLength === "number" ? body.passwordMinLength : 6
+  };
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function authChange(answer) {
+  let body;
+  try {
+    body = await answer;
+  } catch (error51) {
+    const details = isNaroError(error51) ? error51.details : void 0;
+    if (isNaroError(error51) && error51.code === "BACKEND_PROVISION_FAILED" && isRecord(details?.auth) && isRecord(details.backend))
+      throw new NaroError(error51.code, error51.message, {
+        ...error51.status !== void 0 ? { status: error51.status } : {},
+        details: {
+          ...details,
+          auth: authConfig(details.auth),
+          backend: backendInfo(details.backend)
+        }
+      });
+    throw error51;
+  }
+  return { auth: authConfig(body.auth), backend: backendInfo(body.backend) };
+}
 var BackendApi = class {
   constructor(client) {
     this.client = client;
@@ -19447,11 +19485,13 @@ var BackendApi = class {
    * and the callback URLs to register with the providers. Never a secret.
    */
   async auth(projectId) {
-    return this.client.request(
-      this.path(projectId, "/auth"),
-      {
-        context: "Read sign-in settings"
-      }
+    return authConfig(
+      await this.client.request(
+        this.path(projectId, "/auth"),
+        {
+          context: "Read sign-in settings"
+        }
+      )
     );
   }
   /**
@@ -19460,32 +19500,86 @@ var BackendApi = class {
    * (nothing is saved), `BACKEND_NOT_READY` before the first provision,
    * `BACKEND_OFF` while the backend is turned off (nothing is saved),
    * `VERIFICATION_NEEDS_EMAIL` for a state where nobody could sign in. A
-   * failed upload is not an error — `backend.status` says `error` and the
-   * settings are saved; `enable` finishes. Two minutes, like enable.
+   * failed upload throws `BACKEND_PROVISION_FAILED` (502): the settings are
+   * saved, the message says whether the worker runs them yet, `details`
+   * holds `{ auth, backend }`, and `enable` finishes. (A control plane from
+   * before that resolves with `backend.status` `error` instead.) Two
+   * minutes, like enable.
    */
   async setAuth(projectId, patch) {
-    const answer = await this.client.request(
-      this.path(projectId, "/auth"),
-      {
+    return authChange(
+      this.client.request(this.path(projectId, "/auth"), {
         method: "PUT",
         body: patch,
         context: "Change sign-in settings",
         timeoutMs: PROVISION_TIMEOUT_MS
-      }
+      })
     );
-    return { auth: answer.auth, backend: backendInfo(answer.backend) };
   }
   /** Removes email or one provider; the same answer as `setAuth`. */
   async removeAuth(projectId, target) {
+    return authChange(
+      this.client.request(
+        this.path(projectId, `/auth?target=${encodeURIComponent(target)}`),
+        {
+          method: "DELETE",
+          context: "Change sign-in settings",
+          timeoutMs: PROVISION_TIMEOUT_MS
+        }
+      )
+    );
+  }
+  /**
+   * The project's users, newest first (spec 2026-09-26 §2.2): page 1 and 50
+   * a page unless given, at most 1000. `database.read`. `BACKEND_OFF` while
+   * the backend is turned off, `BACKEND_NOT_READY` before it is ready,
+   * `BACKEND_OUTDATED` while its Naro worker predates user management
+   * (`enable` updates it), `BACKEND_UNAVAILABLE` when it cannot be reached.
+   */
+  async listUsers(projectId, options = {}) {
+    const query = new URLSearchParams();
+    if (options.page !== void 0) query.set("page", String(options.page));
+    if (options.perPage !== void 0)
+      query.set("perPage", String(options.perPage));
+    const suffix = query.size > 0 ? `?${query.toString()}` : "";
+    const body = await this.client.request(
+      this.path(projectId, `/users${suffix}`),
+      { context: "List users" }
+    );
+    return { users: body.users, total: body.total };
+  }
+  /**
+   * Creates a user with a password, confirmed unless `emailConfirm: false`
+   * — also while sign-ups are closed and while sign-in waits for a
+   * confirmed email. A username-only user answers `email: null`.
+   * `database.write`. The Naro worker's refusals come through as it said
+   * them: `USERNAME_TAKEN` (409), `USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL`
+   * (422), `PASSWORD_TOO_SHORT` ("Use at least {n} characters."),
+   * `VALIDATION_ERROR`, `WRITE_QUOTA_EXCEEDED` (429, `details.retryAfter`).
+   */
+  async createUser(projectId, input) {
+    const body = { password: input.password };
+    if (input.email !== void 0) body.email = input.email;
+    if (input.username !== void 0) body.username = input.username;
+    if (input.emailConfirm !== void 0)
+      body.emailConfirm = input.emailConfirm;
     const answer = await this.client.request(
-      this.path(projectId, `/auth?target=${encodeURIComponent(target)}`),
-      {
-        method: "DELETE",
-        context: "Change sign-in settings",
-        timeoutMs: PROVISION_TIMEOUT_MS
-      }
+      this.path(projectId, "/users"),
+      { method: "POST", body, context: "Create user" }
+    );
+    return answer.user;
+  }
+  /**
+   * Deletes a user with its sign-in methods, and ends its sessions. Answers
+   * the user it was. `USER_NOT_FOUND` (404) for an id that is not one.
+   * `database.write`.
+   */
+  async deleteUser(projectId, userId) {
+    const answer = await this.client.request(
+      this.path(projectId, `/users/${encodeURIComponent(userId)}`),
+      { method: "DELETE", context: "Delete user" }
     );
-    return { auth: answer.auth, backend: backendInfo(answer.backend) };
+    return answer.user;
   }
   /** Every stored policy, by table name. Tables without one deny anon and signed-in requests. */
   async policies(projectId) {
@@ -21380,6 +21474,7 @@ export {
   resolveAuth,
   openBrowser,
   isTerminalStatus,
+  BACKEND_STEPS,
   isStalledBackend,
   POLICY_RULES,
   POLICY_ACTIONS,

package/dist/deploy.js

@@ -5,7 +5,7 @@ import {
   parseDotenv,
   readProjectEnv,
   slugify
-} from "./chunk-Z757IOF3.js";
+} from "./chunk-5U6YPVZS.js";
 import "./chunk-K3NQKI34.js";
 export {
   deployDirectory,

package/dist/index.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import {
+  BACKEND_STEPS,
   BOOKMARK_FORMAT_MESSAGE,
   NaroClient,
   NaroError,
@@ -52,7 +53,7 @@ import {
   systemTablePredicate,
   toNaroError,
   writeProjectLink
-} from "./chunk-Z757IOF3.js";
+} from "./chunk-5U6YPVZS.js";
 import "./chunk-K3NQKI34.js";
 
 // src/args.ts
@@ -83,7 +84,8 @@ var BOOLEAN_FLAGS = {
   "--no-write": "noWrite",
   "--signed-in": "signedIn",
   "--api-key-stdin": "apiKeyStdin",
-  "--client-secret-stdin": "clientSecretStdin"
+  "--client-secret-stdin": "clientSecretStdin",
+  "--password-stdin": "passwordStdin"
 };
 var REPEATED_FLAGS = {
   "--column": "columns"
@@ -120,7 +122,11 @@ var STRING_FLAGS = {
   "--from-file": "fromFile",
   "--provider": "provider",
   "--from": "from",
-  "--client-id": "clientId"
+  "--client-id": "clientId",
+  "--username": "username",
+  "--email": "email",
+  "--password": "password",
+  "--min-length": "minLength"
 };
 var SECRET_FLAGS = {
   "--api-key": "--api-key-stdin",
@@ -985,12 +991,24 @@ var AUTH_USAGE = {
   oauth: "Usage: naro backend auth oauth set google|github --client-id <id> --client-secret-stdin",
   oauthRemove: "Usage: naro backend auth oauth remove google|github",
   redirect: "Usage: naro backend auth redirects add|remove <url>",
-  verification: "Usage: naro backend auth require-verification on|off"
+  verification: "Usage: naro backend auth require-verification on|off",
+  signups: "Usage: naro backend auth signups on|off",
+  password: "Usage: naro backend auth password --min-length <n>"
 };
+var MIN_LENGTH_FLOOR = 6;
+var MIN_LENGTH_CEILING = 128;
 function sentence2(text) {
   const line = printable(text).trim();
   return /[.!?…]$/.test(line) ? line : `${line}.`;
 }
+function stoppedMessage(backend) {
+  const step = backend.step ?? "worker";
+  const reason = backend.error?.trim() ? `: ${sentence2(backend.error)}` : ".";
+  if (BACKEND_STEPS.indexOf(step) > BACKEND_STEPS.indexOf("worker"))
+    return `Saved and live on the Naro worker, but updating the backend stopped after the upload, at the ${step} step${reason} Run \`naro backend enable\` to finish.`;
+  return `Saved, but not live yet: updating the Naro worker stopped at the ${step} step${reason} The worker keeps its previous settings until \`naro backend enable\` puts the saved ones on it.`;
+}
+var NOT_APPLIED_WARNING = "\u26A0 These are the saved settings. The Naro worker's last update did not get past its upload, so it may still run older ones \u2014 run `naro backend enable` to put these on it.";
 function authLines(auth) {
   const lines = [
     auth.email ? `Email:       ${auth.email.provider} \u2014 ${printable(auth.email.from)} (API key ${printable(auth.email.apiKeyPrefix)}\u2026)` : "Email:       not set up"
@@ -1003,7 +1021,9 @@ function authLines(auth) {
   }
   lines.push(
     `Redirects:   ${[`${productionOrigins(auth).join(", ")} (production hosts, always)`, ...auth.redirectOrigins].join(", ")}`,
-    `Email verification: ${auth.requireEmailVerification ? "required to sign in" : "not required"}`
+    `Email verification: ${auth.requireEmailVerification ? "required to sign in" : "not required"}`,
+    `Sign-ups:    ${auth.signupsEnabled ? "open" : "closed (only `naro backend users create` makes accounts)"}`,
+    `Minimum password length: ${String(auth.passwordMinLength)}`
   );
   return lines;
 }
@@ -1026,9 +1046,9 @@ function adviceLines2(auth) {
     "Redirect URIs to register with each provider \u2014 the one for the origin your app passes to createClient({ url }):"
   );
   for (const provider of ["google", "github"]) {
-    const label = `  ${LABELS[provider]}: `;
+    const label2 = `  ${LABELS[provider]}: `;
     callbacksOf(auth, provider).forEach(
-      (url, index) => lines.push(`${index === 0 ? label : " ".repeat(label.length)}${url}`)
+      (url, index) => lines.push(`${index === 0 ? label2 : " ".repeat(label2.length)}${url}`)
     );
   }
   return lines;
@@ -1037,6 +1057,7 @@ async function runBackendAuthStatus(context) {
   const client = await context.client();
   const projectId = await context.resolveProjectId();
   const auth = await client.backend.auth(projectId);
+  if (auth.applied === false) context.output.warn(NOT_APPLIED_WARNING);
   context.output.result({ projectId, auth }, [
     ...authLines(auth),
     ...adviceLines2(auth)
@@ -1066,17 +1087,22 @@ async function change(context, send, done, after) {
         "The change did not answer within 2 minutes. `naro backend auth` shows what is saved, and `naro backend enable` finishes putting it on the Naro worker.",
         { cause: error }
       );
+    const saved = isNaroError(error) ? error.details?.auth : void 0;
+    if (isNaroError(error) && error.code === "BACKEND_PROVISION_FAILED" && typeof saved === "object" && saved !== null) {
+      for (const line of authLines(saved))
+        context.output.log(line);
+      throw new NaroError(error.code, error.message, {
+        details: { projectId, ...error.details }
+      });
+    }
     throw error;
   }
   const { auth, backend } = answer;
   if (backend.status === "error") {
     for (const line of authLines(auth)) context.output.log(line);
-    const step = backend.step ? `the ${backend.step} step` : "a step";
-    throw new NaroError(
-      "BACKEND_PROVISION_FAILED",
-      `Saved, but updating the Naro worker stopped at ${step}${backend.error ? `: ${sentence2(backend.error)}` : "."} Run \`naro backend enable\` to finish.`,
-      { details: { projectId, auth, backend } }
-    );
+    throw new NaroError("BACKEND_PROVISION_FAILED", stoppedMessage(backend), {
+      details: { projectId, auth, backend }
+    });
   }
   if (backend.status !== "ready")
     context.output.warn(
@@ -1272,6 +1298,199 @@ async function runBackendAuthRequireVerification(context) {
     ]
   );
 }
+async function runBackendAuthSignups(context) {
+  const [value] = context.positionals;
+  if (value !== "on" && value !== "off")
+    throw new NaroError("VALIDATION_FAILED", AUTH_USAGE.signups);
+  const open = value === "on";
+  const client = await context.client();
+  await change(
+    context,
+    (projectId) => client.backend.setAuth(projectId, { signupsEnabled: open }),
+    [
+      open ? "\u2705 Sign-ups are open: anyone can create an account, by email or with Google or GitHub." : "\u2705 Sign-ups are closed: sign-up answers 403 SIGNUPS_DISABLED, and a first Google or GitHub sign-in is refused. Existing users still sign in; create accounts with `naro backend users create`."
+    ]
+  );
+}
+async function runBackendAuthPassword(context) {
+  const given = context.flags.minLength;
+  if (given === void 0 || context.positionals.length > 0)
+    throw new NaroError("VALIDATION_FAILED", AUTH_USAGE.password);
+  const length = /^\d{1,3}$/.test(given) ? Number(given) : Number.NaN;
+  if (!Number.isInteger(length) || length < MIN_LENGTH_FLOOR || length > MIN_LENGTH_CEILING)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `--min-length must be a whole number from ${String(MIN_LENGTH_FLOOR)} to ${String(MIN_LENGTH_CEILING)}. ${AUTH_USAGE.password}`
+    );
+  const client = await context.client();
+  await change(
+    context,
+    (projectId) => client.backend.setAuth(projectId, { passwordMinLength: length }),
+    [
+      `\u2705 New passwords take at least ${String(length)} characters: sign-up, password reset and \`naro backend users create\`. Passwords set before still sign in.`
+    ]
+  );
+}
+
+// src/commands/backend-users.ts
+var USERS_USAGE = {
+  create: "Usage: naro backend users create (--username <name> | --email <address>) (--password-stdin | --password <password>)",
+  delete: "Usage: naro backend users delete <id|username|email> [--yes]"
+};
+var PASSWORD_FLAG_WARNING = "\u26A0 --password puts the password in your shell history. Pipe it in with --password-stdin instead.";
+var OUTDATED_MESSAGE = "This project's backend is older than user management. Run `naro backend enable` once to update this project's backend. Then run this command again.";
+var PAGE_SIZE = 1e3;
+var processStdin3 = {
+  stdinIsTty: () => process.stdin.isTTY === true,
+  readStdin
+};
+async function usersCall(call) {
+  try {
+    return await call();
+  } catch (error) {
+    if (isNaroError(error) && error.code === "BACKEND_OUTDATED")
+      throw new NaroError("BACKEND_OUTDATED", OUTDATED_MESSAGE, {
+        ...error.status !== void 0 ? { status: error.status } : {},
+        cause: error
+      });
+    throw error;
+  }
+}
+async function allUsers(client, projectId) {
+  const users = [];
+  let total = 0;
+  for (let page = 1; ; page++) {
+    const listed = await usersCall(
+      () => client.backend.listUsers(projectId, { page, perPage: PAGE_SIZE })
+    );
+    total = listed.total;
+    users.push(...listed.users);
+    if (listed.users.length < PAGE_SIZE || users.length >= total)
+      return { users, total };
+  }
+}
+function orDash(value) {
+  return value === null ? "-" : printable(value);
+}
+function label(user) {
+  return printable(user.username ?? user.email ?? user.id);
+}
+function userTable(users) {
+  const rows = users.map((user) => [
+    printable(user.id),
+    orDash(user.username),
+    orDash(user.email),
+    user.emailVerified ? "yes" : "no",
+    printable(user.createdAt)
+  ]);
+  const header = ["ID", "USERNAME", "EMAIL", "VERIFIED", "CREATED"];
+  const widths = header.map(
+    (title, column) => Math.max(title.length, ...rows.map((row) => row[column]?.length ?? 0))
+  );
+  return [header, ...rows].map(
+    (row) => row.map(
+      (cell, column) => column === row.length - 1 ? cell : cell.padEnd(widths[column] ?? 0)
+    ).join("  ")
+  );
+}
+async function runBackendUsersList(context) {
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const { users, total } = await allUsers(client, projectId);
+  context.output.result(
+    { projectId, users, total },
+    users.length === 0 ? [
+      "No users yet. Create one with `naro backend users create --username <name> --password-stdin`."
+    ] : [
+      `${String(total)} ${total === 1 ? "user" : "users"}, newest first:`,
+      ...userTable(users)
+    ]
+  );
+}
+async function passwordOf(context, input) {
+  const { password, passwordStdin } = context.flags;
+  if (password !== void 0 && passwordStdin)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `Pass the password one way: --password-stdin or --password. ${USERS_USAGE.create}`
+    );
+  if (password !== void 0) {
+    context.output.warn(PASSWORD_FLAG_WARNING);
+    if (password === "")
+      throw new NaroError("VALIDATION_FAILED", "The password is empty.");
+    return password;
+  }
+  if (!passwordStdin)
+    throw new NaroError(
+      "VALIDATION_FAILED",
+      `Pass the password on stdin with --password-stdin. ${USERS_USAGE.create}`
+    );
+  const value = input.stdinIsTty() ? await context.prompter.askHidden("? Password: ") : await input.readStdin();
+  if (value === "")
+    throw new NaroError("VALIDATION_FAILED", "No password came in on stdin.");
+  return value;
+}
+function userLines(user) {
+  return [
+    `ID:          ${printable(user.id)}`,
+    `Username:    ${orDash(user.username)}`,
+    `Email:       ${orDash(user.email)}`,
+    `Verified:    ${user.emailVerified ? "yes" : "no"}`,
+    `Created:     ${printable(user.createdAt)}`
+  ];
+}
+async function runBackendUsersCreate(context, input = processStdin3) {
+  const { username, email } = context.flags;
+  if (username === void 0 && email === void 0 || context.positionals.length > 0)
+    throw new NaroError("VALIDATION_FAILED", USERS_USAGE.create);
+  const password = await passwordOf(context, input);
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const body = { password };
+  if (username !== void 0) body.username = username;
+  if (email !== void 0) body.email = email;
+  const user = await usersCall(
+    () => client.backend.createUser(projectId, body)
+  );
+  const signIn = user.username === null ? "naro.auth.signIn({ email, password })" : `naro.auth.signIn({ username: ${JSON.stringify(printable(user.username))}, password })`;
+  context.output.result({ projectId, user }, [
+    `\u2705 Created user ${label(user)}. It signs in at once with ${signIn}.`,
+    ...userLines(user)
+  ]);
+}
+function find(users, given) {
+  const byId = users.find((user) => user.id === given);
+  if (byId) return byId;
+  const wanted = given.toLowerCase();
+  return users.find(
+    (user) => given.includes("@") ? user.email?.toLowerCase() === wanted : user.username?.toLowerCase() === wanted
+  );
+}
+async function runBackendUsersDelete(context) {
+  const [given] = context.positionals;
+  if (given === void 0 || context.positionals.length > 1)
+    throw new NaroError("VALIDATION_FAILED", USERS_USAGE.delete);
+  const client = await context.client();
+  const projectId = await context.resolveProjectId();
+  const { users } = await allUsers(client, projectId);
+  const user = find(users, given);
+  if (!user)
+    throw new NaroError(
+      "USER_NOT_FOUND",
+      `No user has the id, username or email ${printable(given)}. \`naro backend users\` lists them.`
+    );
+  const named = user.id === label(user) ? label(user) : `${label(user)} (${printable(user.id)})`;
+  await confirmOrAbort(
+    context,
+    `Delete the user ${named}? Their sessions end at once and the account cannot be brought back.`
+  );
+  const deleted = await usersCall(
+    () => client.backend.deleteUser(projectId, user.id)
+  );
+  context.output.result({ projectId, user: deleted }, [
+    `\u2705 Deleted user ${named}. Their sessions have ended.`
+  ]);
+}
 
 // src/commands/cancel.ts
 async function runCancel(context) {
@@ -1300,7 +1519,7 @@ async function runCancel(context) {
 // src/commands/db.ts
 import { readFileSync as readFileSync2 } from "fs";
 import { resolve } from "path";
-var processStdin3 = {
+var processStdin4 = {
   stdinIsTty: () => process.stdin.isTTY === true,
   readStdin
 };
@@ -1418,7 +1637,7 @@ async function readSql(context, deps) {
     throw new NaroError("VALIDATION_FAILED", USAGE);
   return sql;
 }
-async function runDbQuery(context, deps = processStdin3) {
+async function runDbQuery(context, deps = processStdin4) {
   const sql = await readSql(context, deps);
   const client = await context.client();
   const projectId = await context.resolveProjectId();
@@ -1682,7 +1901,7 @@ async function runDbRestore(context) {
     target = resolved.bookmark;
     at = resolved.timestamp ?? given.timestamp;
   }
-  const label = at === null ? `bookmark ${target}` : `${at} (bookmark ${target})`;
+  const label2 = at === null ? `bookmark ${target}` : `${at} (bookmark ${target})`;
   if (context.flags.dryRun) {
     context.output.result(
       {
@@ -1690,13 +1909,13 @@ async function runDbRestore(context) {
         bookmark: target,
         ...at === null ? {} : { timestamp: at }
       },
-      [`Would restore to ${label}. Nothing was changed.`]
+      [`Would restore to ${label2}. Nothing was changed.`]
     );
     return;
   }
   await confirmOrAbort(
     context,
-    `Restore the project database to ${label}? Everything written after that point is rolled back \u2014 migration history included \u2014 and queries running right now are cancelled.`
+    `Restore the project database to ${label2}? Everything written after that point is rolled back \u2014 migration history included \u2014 and queries running right now are cancelled.`
   );
   const before = await bookmarkNow(context, client, projectId);
   let restored;
@@ -2487,9 +2706,9 @@ async function resolveTeam(context, teams, deps = {}) {
     );
   const account = deps.accountLabel ? await deps.accountLabel() : "this account";
   if (only) {
-    const label = only.isPersonal ? `${only.name} (personal)` : only.name;
+    const label2 = only.isPersonal ? `${only.name} (personal)` : only.name;
     context.output.log(`
-   ${account} \u2192 ${label}`);
+   ${account} \u2192 ${label2}`);
     const ok = await context.prompter.confirm(
       "Deploy to this account and team?"
     );
@@ -4191,9 +4410,16 @@ Usage:
   naro backend keys [--reveal]       API keys; --reveal prints the service key (a secret; needs database write)
   naro backend keys rotate --anon|--service
                                      Replace a key; the old one stops working at once (asks first)
-  naro backend auth                  Sign-in settings: email, Google, GitHub, redirects, callback URLs
+  naro backend auth                  Sign-in settings: email, Google, GitHub, redirects, callback URLs,
+                                     sign-ups and the minimum password length
+  naro backend auth signups <on|off>
+                                     off: nobody signs up on their own, by email or Google/GitHub;
+                                     the accounts you create (naro backend users create) sign in
+  naro backend auth password --min-length <n>
+                                     The fewest characters a new password takes (6-128; 6 by default)
   naro backend auth email set --provider resend --from "App <no-reply@example.com>" --api-key-stdin
                                      Confirmation and reset emails from your Resend account
+                                     (email and password sign-in needs no setup)
   naro backend auth email remove     Turn email off (asks first)
   naro backend auth oauth set <google|github> --client-id <id> --client-secret-stdin
   naro backend auth oauth remove <google|github>  Turn a provider off (asks first)
@@ -4205,7 +4431,14 @@ Usage:
                                      Exits 1, changing nothing, when <url> is not in the list
   naro backend auth require-verification <on|off>
                                      Refuse sign-in until the email is confirmed (needs email)
-  naro policy list                   Who the Data API lets through, per table (no policy = deny)
+  naro backend users                 The project's users: id, username, email, verified, created
+  naro backend users create --username <name> --password-stdin
+                                     Create a confirmed account (--email <address> instead of or with
+                                     --username); works while sign-ups are closed. --password <p>
+                                     works too, but lands in shell history
+  naro backend users delete <id|username|email>
+                                     Delete a user and end its sessions (asks first; --yes to skip)
+  naro policy list                  Who the Data API lets through, per table (no policy = deny)
   naro policy set <table> [--select <rule>] [--insert <rule>] [--update <rule>] [--delete <rule>]
        [--owner <column>]            Rules: none | public | authenticated | owner (owner needs --owner)
        [--select-when <filter>] [--insert-when <filter>] [--update-when <filter>]
@@ -4249,6 +4482,11 @@ Global options:
   --client-id <id>  The OAuth app's client ID (naro backend auth oauth set)
   --api-key-stdin | --client-secret-stdin
                   Read the secret from stdin (a pipe, or a hidden prompt); never from argv
+  --username <name> | --email <address>
+                  The new user's username (3-30 of a-z, 0-9, _ and .) and/or email (naro backend users create)
+  --password-stdin  Read the new user's password from stdin (a pipe, or a hidden prompt)
+  --password <p>  The password in argv: works, but lands in shell history (naro backend users create)
+  --min-length <n>  Fewest characters of a new password, 6-128 (naro backend auth password)
   --select <rule> Rule for reads; --insert, --update, --delete likewise (naro policy set)
   --owner <column>  Column that holds the signed-in user's id, for the owner rule (naro policy set, db table create)
   --select-when <filter>  Condition for reads, e.g. 'user_id.eq.auth.uid()'; --insert-when (what a new
@@ -4315,6 +4553,29 @@ function routeBackendAuth(words) {
         handler: runBackendAuthRequireVerification,
         positionals: words.slice(1)
       };
+    // Spec 2026-09-26 §2.1, §2.4.
+    case "signups":
+      return { handler: runBackendAuthSignups, positionals: words.slice(1) };
+    case "password":
+      return { handler: runBackendAuthPassword, positionals: words.slice(1) };
+    default:
+      return null;
+  }
+}
+function routeBackendUsers(words) {
+  const [action] = words;
+  const rest = words.slice(1);
+  switch (action) {
+    case void 0:
+    case "list":
+    case "ls":
+      return rest.length === 0 ? { handler: runBackendUsersList, positionals: [] } : null;
+    case "create":
+      return { handler: runBackendUsersCreate, positionals: rest };
+    case "delete":
+    case "remove":
+    case "rm":
+      return { handler: runBackendUsersDelete, positionals: rest };
     default:
       return null;
   }
@@ -4484,6 +4745,8 @@ function route(parsed) {
           return null;
         case "auth":
           return routeBackendAuth(positionals.slice(1));
+        case "users":
+          return routeBackendUsers(positionals.slice(1));
         default:
           return null;
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "naro-cli",
-  "version": "0.9.1",
+  "version": "0.10.0",
   "type": "module",
   "bin": {
     "naro": "./dist/index.js"
@@ -33,10 +33,10 @@
     "tsx": "4.23.12",
     "typescript": "7.0.2",
     "vitest": "3.2.7",
-    "naro-js": "0.1.0",
+    "@next-deploy/config": "0.1.0",
+    "naro-js": "0.2.0",
     "@next-deploy/build": "0.1.0",
     "@next-deploy/core": "0.1.0",
-    "@next-deploy/config": "0.1.0",
     "@next-deploy/data-core": "0.1.0",
     "@next-deploy/sdk": "0.1.0"
   },