naro-mcp 0.9.0 → 0.10.0

package/README.md

@@ -65,7 +65,7 @@ Headless/CI agents can skip `naro login` and set a token instead:
 | `cancel_deployment`                                                                     | Stops a build that is still running (QUEUED–BUILDING). Does not undo a deployment that already went live — use `rollback_deployment` for that                                                                                                                                                                                                                                                                            |
 | `enable_database`, `get_database`, `list_tables`                                        | The project's D1 database: turn it on, status/size/limits, schema (verbose: true for columns, indexes and foreign keys)                                                                                                                                                                                                                                                                                                  |
 | `execute_sql`                                                                           | Run SQL (argument `query`, optional `params` for a single statement; several statements run as one transaction). Destructive; under `--read-only` it stays but accepts a single read statement only                                                                                                                                                                                                                      |
-| `apply_migration`, `list_migrations`, `generate_typescript_types`                       | Numbered migrations in the `d1_migrations` ledger wrangler also uses (each file all-or-nothing), and TypeScript types for the schema (text only; its `Database` is what `createClient<Database>()` from `@naro/sdk` takes)                                                                                                                                                                                               |
+| `apply_migration`, `list_migrations`, `generate_typescript_types`                       | Numbered migrations in the `d1_migrations` ledger wrangler also uses (each file all-or-nothing), and TypeScript types for the schema (text only; its `Database` is what `createClient<Database>()` from `naro-js` takes)                                                                                                                                                                                                 |
 | `create_table`, `alter_table`, `drop_table`, `create_index`, `drop_index`               | Schema changes without SQL: naro renders checked DDL, applies it as one numbered migration (`NNNN_schema_<op>_<table>.sql`) and writes the file like `apply_migration`. `alter_table` adds, renames or drops a column or renames the table. Dropping a table or column needs `confirm`; `alter_table`, `drop_table` and `drop_index` are destructive and hidden under `--read-only`. `dryRun: true` returns the SQL only |
 | `export_database`                                                                       | SQL dump of the database (`schemaOnly`, `dataOnly`, `tables`): waits up to 5 minutes and returns a signed download link plus `atBookmark`, the point the dump reflects                                                                                                                                                                                                                                                   |
 | `restore_database`                                                                      | Time Travel restore to a `bookmark` or a `timestamp` (last 30 days). Destructive; hidden under `--read-only`. Returns `previousBookmark`, which undoes it                                                                                                                                                                                                                                                                |

package/dist/index.js

@@ -1179,6 +1179,35 @@ function backendInfo(body) {
     turningOff: body.turningOff === true
   };
 }
+function authConfig(body) {
+  return {
+    ...body,
+    signupsEnabled: typeof body.signupsEnabled === "boolean" ? body.signupsEnabled : true,
+    passwordMinLength: typeof body.passwordMinLength === "number" ? body.passwordMinLength : 6
+  };
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function authChange(answer) {
+  let body;
+  try {
+    body = await answer;
+  } catch (error51) {
+    const details = isNaroError(error51) ? error51.details : void 0;
+    if (isNaroError(error51) && error51.code === "BACKEND_PROVISION_FAILED" && isRecord(details?.auth) && isRecord(details.backend))
+      throw new NaroError(error51.code, error51.message, {
+        ...error51.status !== void 0 ? { status: error51.status } : {},
+        details: {
+          ...details,
+          auth: authConfig(details.auth),
+          backend: backendInfo(details.backend)
+        }
+      });
+    throw error51;
+  }
+  return { auth: authConfig(body.auth), backend: backendInfo(body.backend) };
+}
 var BackendApi = class {
   constructor(client) {
     this.client = client;
@@ -1311,11 +1340,13 @@ var BackendApi = class {
    * and the callback URLs to register with the providers. Never a secret.
    */
   async auth(projectId) {
-    return this.client.request(
-      this.path(projectId, "/auth"),
-      {
-        context: "Read sign-in settings"
-      }
+    return authConfig(
+      await this.client.request(
+        this.path(projectId, "/auth"),
+        {
+          context: "Read sign-in settings"
+        }
+      )
     );
   }
   /**
@@ -1324,32 +1355,86 @@ var BackendApi = class {
    * (nothing is saved), `BACKEND_NOT_READY` before the first provision,
    * `BACKEND_OFF` while the backend is turned off (nothing is saved),
    * `VERIFICATION_NEEDS_EMAIL` for a state where nobody could sign in. A
-   * failed upload is not an error — `backend.status` says `error` and the
-   * settings are saved; `enable` finishes. Two minutes, like enable.
+   * failed upload throws `BACKEND_PROVISION_FAILED` (502): the settings are
+   * saved, the message says whether the worker runs them yet, `details`
+   * holds `{ auth, backend }`, and `enable` finishes. (A control plane from
+   * before that resolves with `backend.status` `error` instead.) Two
+   * minutes, like enable.
    */
   async setAuth(projectId, patch) {
-    const answer = await this.client.request(
-      this.path(projectId, "/auth"),
-      {
+    return authChange(
+      this.client.request(this.path(projectId, "/auth"), {
         method: "PUT",
         body: patch,
         context: "Change sign-in settings",
         timeoutMs: PROVISION_TIMEOUT_MS
-      }
+      })
     );
-    return { auth: answer.auth, backend: backendInfo(answer.backend) };
   }
   /** Removes email or one provider; the same answer as `setAuth`. */
   async removeAuth(projectId, target) {
+    return authChange(
+      this.client.request(
+        this.path(projectId, `/auth?target=${encodeURIComponent(target)}`),
+        {
+          method: "DELETE",
+          context: "Change sign-in settings",
+          timeoutMs: PROVISION_TIMEOUT_MS
+        }
+      )
+    );
+  }
+  /**
+   * The project's users, newest first (spec 2026-09-26 §2.2): page 1 and 50
+   * a page unless given, at most 1000. `database.read`. `BACKEND_OFF` while
+   * the backend is turned off, `BACKEND_NOT_READY` before it is ready,
+   * `BACKEND_OUTDATED` while its Naro worker predates user management
+   * (`enable` updates it), `BACKEND_UNAVAILABLE` when it cannot be reached.
+   */
+  async listUsers(projectId, options2 = {}) {
+    const query = new URLSearchParams();
+    if (options2.page !== void 0) query.set("page", String(options2.page));
+    if (options2.perPage !== void 0)
+      query.set("perPage", String(options2.perPage));
+    const suffix = query.size > 0 ? `?${query.toString()}` : "";
+    const body = await this.client.request(
+      this.path(projectId, `/users${suffix}`),
+      { context: "List users" }
+    );
+    return { users: body.users, total: body.total };
+  }
+  /**
+   * Creates a user with a password, confirmed unless `emailConfirm: false`
+   * — also while sign-ups are closed and while sign-in waits for a
+   * confirmed email. A username-only user answers `email: null`.
+   * `database.write`. The Naro worker's refusals come through as it said
+   * them: `USERNAME_TAKEN` (409), `USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL`
+   * (422), `PASSWORD_TOO_SHORT` ("Use at least {n} characters."),
+   * `VALIDATION_ERROR`, `WRITE_QUOTA_EXCEEDED` (429, `details.retryAfter`).
+   */
+  async createUser(projectId, input) {
+    const body = { password: input.password };
+    if (input.email !== void 0) body.email = input.email;
+    if (input.username !== void 0) body.username = input.username;
+    if (input.emailConfirm !== void 0)
+      body.emailConfirm = input.emailConfirm;
     const answer = await this.client.request(
-      this.path(projectId, `/auth?target=${encodeURIComponent(target)}`),
-      {
-        method: "DELETE",
-        context: "Change sign-in settings",
-        timeoutMs: PROVISION_TIMEOUT_MS
-      }
+      this.path(projectId, "/users"),
+      { method: "POST", body, context: "Create user" }
+    );
+    return answer.user;
+  }
+  /**
+   * Deletes a user with its sign-in methods, and ends its sessions. Answers
+   * the user it was. `USER_NOT_FOUND` (404) for an id that is not one.
+   * `database.write`.
+   */
+  async deleteUser(projectId, userId) {
+    const answer = await this.client.request(
+      this.path(projectId, `/users/${encodeURIComponent(userId)}`),
+      { method: "DELETE", context: "Delete user" }
     );
-    return { auth: answer.auth, backend: backendInfo(answer.backend) };
+    return answer.user;
   }
   /** Every stored policy, by table name. Tables without one deny anon and signed-in requests. */
   async policies(projectId) {
@@ -17397,7 +17482,7 @@ var DATABASE_TOOLS = [
       destructiveHint: false,
       idempotentHint: true
     },
-    description: `Generates TypeScript types for the D1 schema: one Row interface per table and view, a Database type with Row, Insert and Update per table that createClient<Database>() from @naro/sdk reads, the Tables, TablesInsert and TablesUpdate helpers, and an Env with the DB binding. Returns the text only \u2014 write it to a file yourself (for example src/database.types.ts). A view that could not be described is an empty interface in the text and is named under the undescribed key. Where the backend's insert rule for a table is owner, its owner column is optional in Insert (the backend fills it); when the policies cannot be read, the result says policies: "unavailable" with policiesReason, and the owner columns stay required. ${UNTRUSTED}`,
+    description: `Generates TypeScript types for the D1 schema: one Row interface per table and view, a Database type with Row, Insert and Update per table that createClient<Database>() from naro-js reads, the Tables, TablesInsert and TablesUpdate helpers, and an Env with the DB binding. Returns the text only \u2014 write it to a file yourself (for example src/database.types.ts). A view that could not be described is an empty interface in the text and is named under the undescribed key. Where the backend's insert rule for a table is owner, its owner column is optional in Insert (the backend fills it); when the policies cannot be read, the result says policies: "unavailable" with policiesReason, and the owner columns stay required. ${UNTRUSTED}`,
     inputSchema: { type: "object", properties: { ...PROJECT_ARGS } },
     handler: async (args, deps) => {
       assertProjectArgs(args);
@@ -18339,7 +18424,7 @@ function toolErrorJson(error51) {
 }
 
 // src/server.ts
-var SERVER_VERSION = "0.9.0";
+var SERVER_VERSION = "0.10.0";
 function visibleTools(options2) {
   const { features, readOnly } = options2;
   return TOOLS.flatMap((tool) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "naro-mcp",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "type": "module",
   "bin": {
     "naro-mcp": "./dist/index.js"
@@ -18,7 +18,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",
     "@supabase/supabase-js": "2.112.3",
-    "naro-cli": "0.9.0"
+    "naro-cli": "0.10.0"
   },
   "devDependencies": {
     "tsup": "8.5.0",