naro-cli 0.21.0 → 0.22.0

package/dist/index.js

@@ -32,6 +32,8 @@ import {
   deployDirectory,
   detectGitInfo,
   ensureGitignoreHasNaro,
+  environmentGuidance,
+  environmentSlugProblem,
   formatRedirectEntry,
   generateTypes,
   indexesFromRows,
@@ -97,7 +99,7 @@ import {
   usageMonthOf,
   userForAccessToken,
   writeProjectLink
-} from "./chunk-FFPOVA7I.js";
+} from "./chunk-MBSO3K6L.js";
 import "./chunk-K3NQKI34.js";
 
 // src/args.ts
@@ -543,6 +545,37 @@ import { readFileSync as readFileSync6 } from "fs";
 import { dirname as dirname4, join as join6 } from "path";
 import { fileURLToPath } from "url";
 
+// src/data-environment.ts
+var DATA_ENV_MESSAGES = {
+  name: "--env must be production or an environment name.",
+  preview: "--env preview has no data of its own: preview deployments use production's. Drop --env, or name an environment.",
+  projectWide: (command) => `--env is not an option of ${command}: turning the backend on or off applies to every environment.`
+};
+function dataEnvironment(flags) {
+  const value = flags.env;
+  if (value === void 0 || value === "production") return null;
+  if (value === "preview")
+    throw new NaroError("VALIDATION_FAILED", DATA_ENV_MESSAGES.preview);
+  if (environmentSlugProblem(value) !== null)
+    throw new NaroError("VALIDATION_FAILED", DATA_ENV_MESSAGES.name);
+  return value;
+}
+async function dataClient(context) {
+  return (await context.client()).inEnvironment(dataEnvironment(context.flags));
+}
+function databaseName(environment) {
+  return environment === null ? "the project database" : `the ${environment} environment's database`;
+}
+function enableBackendCommand(environment) {
+  return environment === null ? "naro backend enable" : `naro environments provision ${environment}`;
+}
+function envFlag(environment) {
+  return environment === null ? "" : ` --env ${environment}`;
+}
+function forEnvironment(text, environment) {
+  return environmentGuidance(text, environment);
+}
+
 // src/commands/migration.ts
 import { mkdirSync, readFileSync, writeFileSync } from "fs";
 import { join, relative } from "path";
@@ -641,7 +674,7 @@ async function runMigrationNew(context, deps = processStdin) {
   ]);
 }
 async function runMigrationList(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const dir = migrationsDir(context);
   const local = listMigrationFiles(dir);
@@ -721,7 +754,7 @@ async function runMigrationRepair(context) {
       "VALIDATION_FAILED",
       "Pass --status applied or --status reverted."
     );
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const ledger = await appliedMigrations(client, projectId);
   const recorded = ledger.some(
@@ -735,7 +768,7 @@ async function runMigrationRepair(context) {
   }
   await confirmOrAbort(
     context,
-    status === "applied" ? `Mark ${key} as applied in the project database's ledger? Its SQL is not run.` : `Remove ${key} from the project database's ledger? Its SQL is not rolled back.`
+    status === "applied" ? `Mark ${key} as applied in ${databaseName(dataEnvironment(context.flags))}'s ledger? Its SQL is not run.` : `Remove ${key} from ${databaseName(dataEnvironment(context.flags))}'s ledger? Its SQL is not rolled back.`
   );
   if (status === "applied" && ledger.length === 0)
     await client.db.query(projectId, { sql: LEDGER_DDL });
@@ -754,7 +787,7 @@ async function runMigrationRepair(context) {
   ]);
 }
 async function runMigrationUp(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const dir = migrationsDir(context);
   const local = listMigrationFiles(dir);
@@ -782,7 +815,7 @@ async function runMigrationUp(context) {
   for (const name of pending) context.output.log(`  ${printable(name)}`);
   await confirmOrAbort(
     context,
-    `Apply ${String(pending.length)} migration(s) to the project database? Each file is applied all-or-nothing; a failure stops the run.`
+    `Apply ${String(pending.length)} migration(s) to ${databaseName(dataEnvironment(context.flags))}? Each file is applied all-or-nothing; a failure stops the run.`
   );
   const { applied, warnings } = await applyMigrationFiles(
     context,
@@ -1227,14 +1260,20 @@ function backendLines(info, now2 = Date.now()) {
     );
   return lines;
 }
-function adviceLines(info, now2) {
+var ENVIRONMENT_TURNING_OFF_ADVICE = "Turning it off did not finish: your app's /_naro/* requests may still be answered. The control plane finishes it within a few minutes: the backend's switch is production's, and every environment follows it.";
+function adviceLines(info, now2, environment = null) {
   if (!info.enabled && info.status !== "none") {
     if (!info.turningOff) return [OFF_ADVICE];
-    return [leaseHeld(info, now2) ? TURNING_OFF_NOW_ADVICE : TURNING_OFF_ADVICE];
+    if (leaseHeld(info, now2)) return [TURNING_OFF_NOW_ADVICE];
+    return [
+      environment === null ? TURNING_OFF_ADVICE : ENVIRONMENT_TURNING_OFF_ADVICE
+    ];
   }
   switch (info.status) {
     case "none":
-      return ["Run `naro backend enable` to turn it on."];
+      return [
+        environment === null ? "Run `naro backend enable` to turn it on." : `This environment has no backend yet: \`naro environments provision ${environment}\` makes it while production's backend is on \u2014 turn that on with \`naro backend enable\`.`
+      ];
     case "error":
       return [
         ...info.error ? [`Error:       ${printable(info.error)}`] : [],
@@ -1255,17 +1294,21 @@ function stoppedAt(info) {
   return `stopped at ${step}${info.error ? `: ${sentence(info.error)}` : "."}`;
 }
 async function runBackendInfo(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const backend = await client.backend.info(projectId);
   const now2 = Date.now();
+  const environment = dataEnvironment(context.flags);
   context.output.result(
     { projectId, backend, stalled: isStalledBackend(backend, now2) },
-    [...backendLines(backend, now2), ...adviceLines(backend, now2)]
+    [
+      ...backendLines(backend, now2),
+      ...adviceLines(backend, now2, environment)
+    ].map((line) => forEnvironment(line, environment))
   );
 }
 async function runBackendEnable(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   let backend;
   try {
@@ -1309,7 +1352,7 @@ async function runBackendEnable(context) {
 }
 async function runBackendDisable(context) {
   await confirmOrAbort(context, DISABLE_QUESTION);
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const backend = await client.backend.disable(projectId);
   if (backend.status === "none") {
@@ -1326,7 +1369,8 @@ async function runBackendDisable(context) {
   ]);
 }
 async function runBackendKeys(context) {
-  const client = await context.client();
+  const environment = dataEnvironment(context.flags);
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const keys = await client.backend.keys(projectId);
   if (!context.flags.reveal) {
@@ -1339,7 +1383,10 @@ async function runBackendKeys(context) {
       [
         `Anon key:    ${keys.anonKey}`,
         `Service key: ${keys.serviceKeyPrefix}\u2026 (hidden)`,
-        "`naro backend keys --reveal` prints the service key (needs database write access)."
+        forEnvironment(
+          "`naro backend keys --reveal` prints the service key (needs database write access).",
+          environment
+        )
       ]
     );
     return;
@@ -1359,19 +1406,19 @@ function rotateKind(context) {
 function keyLabel(kind) {
   return kind === "anon" ? "Anon key:    " : "Service key: ";
 }
-function rotationWarning(kind, backend) {
+function rotationWarning(kind, backend, environment = null) {
   if (backend.status === "error")
-    return `\u26A0 The ${kind} key is replaced, but provisioning ${stoppedAt(backend)} Run \`naro backend enable\` to finish.`;
+    return `\u26A0 The ${kind} key is replaced, but provisioning ${stoppedAt(backend)} Run \`${enableBackendCommand(environment)}\` to finish.`;
   if (backend.status !== "ready")
-    return `\u26A0 The ${kind} key is replaced; another provisioning run is finishing the backend. Check it with \`naro backend\`.`;
+    return `\u26A0 The ${kind} key is replaced; another provisioning run is finishing the backend. Check it with \`naro backend${envFlag(environment)}\`.`;
   return null;
 }
-function checkKeysSentence(kind) {
+function checkKeysSentence(kind, environment = null) {
   const keys = kind === "service" ? "naro backend keys --reveal" : "naro backend keys";
-  return `Run \`${keys}\` to see which key is live, then \`naro backend enable\`.`;
+  return `Run \`${keys}${envFlag(environment)}\` to see which key is live, then \`${enableBackendCommand(environment)}\`.`;
 }
-function rotationHint(kind) {
-  return `The rotation may have gone through anyway. ${checkKeysSentence(kind)}`;
+function rotationHint(kind, environment = null) {
+  return `The rotation may have gone through anyway. ${checkKeysSentence(kind, environment)}`;
 }
 function outcomeUnknown(error) {
   return error.code === "BACKEND_ROTATION_FAILED" || error.code === "INTERNAL_ERROR" || error.code === "NETWORK_ERROR" || error.status !== void 0 && error.status >= 500;
@@ -1382,18 +1429,19 @@ async function runBackendKeysRotate(context) {
     context,
     `Replace the ${kind} key? Every client still sending the old one gets 401 INVALID_API_KEY as soon as the new key is live.`
   );
-  const client = await context.client();
+  const client = await dataClient(context);
+  const environment = dataEnvironment(context.flags);
   const projectId = await context.resolveProjectId();
   let rotated;
   try {
     rotated = await client.backend.rotateKey(projectId, kind);
   } catch (error) {
     if (!isNaroError(error)) throw error;
-    const hint = rotationHint(kind);
+    const hint = rotationHint(kind, environment);
     if (error.code === "TIMEOUT")
       throw new NaroError(
         "TIMEOUT",
-        `Rotating the key did not answer within 2 minutes, so whether it happened is not known. ${checkKeysSentence(kind)}`,
+        `Rotating the key did not answer within 2 minutes, so whether it happened is not known. ${checkKeysSentence(kind, environment)}`,
         { details: { hint }, cause: error }
       );
     if (!outcomeUnknown(error)) throw error;
@@ -1405,7 +1453,7 @@ async function runBackendKeysRotate(context) {
     });
   }
   const { backend, key } = rotated;
-  const warning = rotationWarning(kind, backend);
+  const warning = rotationWarning(kind, backend, environment);
   if (kind === "service") context.output.warn(SERVICE_KEY_WARNING);
   if (warning) context.output.warn(warning);
   context.output.result(
@@ -1442,14 +1490,21 @@ function sentence2(text) {
   const line = printable(text).trim();
   return /[.!?…]$/.test(line) ? line : `${line}.`;
 }
-function stoppedMessage(backend) {
+function stoppedMessage(backend, environment = null) {
+  const enable = enableBackendCommand(environment);
   const step = backend.step ?? "worker";
   const reason = backend.error?.trim() ? `: ${sentence2(backend.error)}` : ".";
   if (BACKEND_STEPS.indexOf(step) > BACKEND_STEPS.indexOf("worker"))
-    return `Saved and live on the Naro worker, but updating the backend stopped after the upload, at the ${step} step${reason} Run \`naro backend enable\` to finish.`;
-  return `Saved, but not live yet: updating the Naro worker stopped at the ${step} step${reason} The worker keeps its previous settings until \`naro backend enable\` puts the saved ones on it.`;
+    return `Saved and live on the Naro worker, but updating the backend stopped after the upload, at the ${step} step${reason} Run \`${enable}\` to finish.`;
+  return `Saved, but not live yet: updating the Naro worker stopped at the ${step} step${reason} The worker keeps its previous settings until \`${enable}\` puts the saved ones on it.`;
 }
 var NOT_APPLIED_WARNING = "\u26A0 These are the saved settings. The Naro worker's last update did not get past its upload, so it may still run older ones \u2014 run `naro backend enable` to put these on it.";
+function notAppliedWarning(environment) {
+  return environment === null ? NOT_APPLIED_WARNING : NOT_APPLIED_WARNING.replace(
+    "`naro backend enable`",
+    `\`${enableBackendCommand(environment)}\``
+  );
+}
 function authLines(auth) {
   const lines = [
     auth.email ? `Email:       ${auth.email.provider} \u2014 ${printable(auth.email.from)} (API key ${printable(auth.email.apiKeyPrefix)}\u2026)` : "Email:       not set up"
@@ -1495,14 +1550,18 @@ function adviceLines2(auth) {
   return lines;
 }
 async function runBackendAuthStatus(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const auth = await client.backend.auth(projectId);
-  if (auth.applied === false) context.output.warn(NOT_APPLIED_WARNING);
-  context.output.result({ projectId, auth }, [
-    ...authLines(auth),
-    ...adviceLines2(auth)
-  ]);
+  const environment = dataEnvironment(context.flags);
+  if (auth.applied === false)
+    context.output.warn(notAppliedWarning(environment));
+  context.output.result(
+    { projectId, auth },
+    [...authLines(auth), ...adviceLines2(auth)].map(
+      (line) => forEnvironment(line, environment)
+    )
+  );
 }
 async function readSecret(context, input, given, flag, what, usage) {
   if (!given)
@@ -1518,6 +1577,7 @@ async function readSecret(context, input, given, flag, what, usage) {
 }
 async function change(context, send2, done, after) {
   const projectId = await context.resolveProjectId();
+  const environment = dataEnvironment(context.flags);
   let answer;
   try {
     answer = await send2(projectId);
@@ -1525,13 +1585,13 @@ async function change(context, send2, done, after) {
     if (isNaroError(error) && error.code === "TIMEOUT")
       throw new NaroError(
         "TIMEOUT",
-        "The change did not answer within 2 minutes. `naro backend auth` shows what is saved, and `naro backend enable` finishes putting it on the Naro worker.",
+        `The change did not answer within 2 minutes. \`naro backend auth${envFlag(environment)}\` shows what is saved, and \`${enableBackendCommand(environment)}\` finishes putting it on the Naro worker.`,
         { cause: error }
       );
     const saved = isNaroError(error) ? error.details?.auth : void 0;
     if (isNaroError(error) && error.code === "BACKEND_PROVISION_FAILED" && typeof saved === "object" && saved !== null) {
       for (const line of authLines(saved))
-        context.output.log(line);
+        context.output.log(forEnvironment(line, environment));
       throw new NaroError(error.code, error.message, {
         details: { projectId, ...error.details }
       });
@@ -1540,20 +1600,29 @@ async function change(context, send2, done, after) {
   }
   const { auth, backend } = answer;
   if (backend.status === "error") {
-    for (const line of authLines(auth)) context.output.log(line);
-    throw new NaroError("BACKEND_PROVISION_FAILED", stoppedMessage(backend), {
-      details: { projectId, auth, backend }
-    });
+    for (const line of authLines(auth))
+      context.output.log(forEnvironment(line, environment));
+    throw new NaroError(
+      "BACKEND_PROVISION_FAILED",
+      stoppedMessage(backend, environment),
+      {
+        details: { projectId, auth, backend }
+      }
+    );
   }
   if (backend.status !== "ready")
     context.output.warn(
-      "\u26A0 Saved; another provisioning run is finishing the backend. Check it with `naro backend`."
+      forEnvironment(
+        "\u26A0 Saved; another provisioning run is finishing the backend. Check it with `naro backend`.",
+        environment
+      )
     );
-  context.output.result({ projectId, auth, backend }, [
-    ...done,
-    ...after ? after(auth) : [],
-    ...authLines(auth)
-  ]);
+  context.output.result(
+    { projectId, auth, backend },
+    [...done, ...after ? after(auth) : [], ...authLines(auth)].map(
+      (line) => forEnvironment(line, environment)
+    )
+  );
 }
 async function runBackendAuthEmailSet(context, input = processStdin2) {
   const { provider, from } = context.flags;
@@ -1572,7 +1641,7 @@ async function runBackendAuthEmailSet(context, input = processStdin2) {
     "Resend API key",
     AUTH_USAGE.email
   );
-  const client = await context.client();
+  const client = await dataClient(context);
   await change(
     context,
     (projectId) => client.backend.setAuth(projectId, {
@@ -1588,7 +1657,7 @@ async function runBackendAuthEmailRemove(context) {
     context,
     "Remove email? Confirmation and password reset emails stop at once."
   );
-  const client = await context.client();
+  const client = await dataClient(context);
   await change(
     context,
     (projectId) => client.backend.removeAuth(projectId, "email"),
@@ -1614,7 +1683,7 @@ async function runBackendAuthOAuthSet(context, input = processStdin2) {
     `${LABELS[provider]} client secret`,
     AUTH_USAGE.oauth
   );
-  const client = await context.client();
+  const client = await dataClient(context);
   const patch = {
     oauth: { [provider]: { clientId, clientSecret } }
   };
@@ -1632,7 +1701,7 @@ async function runBackendAuthOAuthRemove(context) {
     context,
     `Remove ${LABELS[provider]} sign-in? Users who signed in with ${LABELS[provider]} cannot sign in with it until it is set up again.`
   );
-  const client = await context.client();
+  const client = await dataClient(context);
   await change(
     context,
     (projectId) => client.backend.removeAuth(projectId, provider),
@@ -1640,7 +1709,7 @@ async function runBackendAuthOAuthRemove(context) {
   );
 }
 async function runBackendAuthRedirectsList(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const auth = await client.backend.auth(projectId);
   const production = productionOrigins(auth);
@@ -1657,7 +1726,10 @@ async function runBackendAuthRedirectsList(context) {
       ),
       ...auth.redirectOrigins,
       ...auth.redirectOrigins.length === 0 ? [
-        "Only the project's own origin may be sent back to. Add another with `naro backend auth redirects add <url>` \u2014 an origin, or only the pages under a path like https://app.example.com/auth/."
+        forEnvironment(
+          "Only the project's own origin may be sent back to. Add another with `naro backend auth redirects add <url>` \u2014 an origin, or only the pages under a path like https://app.example.com/auth/.",
+          dataEnvironment(context.flags)
+        )
       ] : []
     ]
   );
@@ -1670,7 +1742,7 @@ function originOf(context) {
 }
 async function runBackendAuthRedirectsAdd(context) {
   const origin = originOf(context);
-  const client = await context.client();
+  const client = await dataClient(context);
   await change(
     context,
     (projectId) => client.backend.setAuth(projectId, {
@@ -1684,7 +1756,7 @@ function allowing(list, origin) {
 }
 async function runBackendAuthRedirectsRemove(context) {
   const given = originOf(context);
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const parsed = parseRedirectEntry(given);
   if (parsed) {
@@ -1730,7 +1802,7 @@ async function runBackendAuthRequireVerification(context) {
   if (value !== "on" && value !== "off")
     throw new NaroError("VALIDATION_FAILED", AUTH_USAGE.verification);
   const on = value === "on";
-  const client = await context.client();
+  const client = await dataClient(context);
   await change(
     context,
     (projectId) => client.backend.setAuth(projectId, { requireEmailVerification: on }),
@@ -1744,7 +1816,7 @@ async function runBackendAuthSignups(context) {
   if (value !== "on" && value !== "off")
     throw new NaroError("VALIDATION_FAILED", AUTH_USAGE.signups);
   const open = value === "on";
-  const client = await context.client();
+  const client = await dataClient(context);
   await change(
     context,
     (projectId) => client.backend.setAuth(projectId, { signupsEnabled: open }),
@@ -1763,7 +1835,7 @@ async function runBackendAuthPassword(context) {
       "VALIDATION_FAILED",
       `--min-length must be a whole number from ${String(MIN_LENGTH_FLOOR)} to ${String(MIN_LENGTH_CEILING)}. ${AUTH_USAGE.password}`
     );
-  const client = await context.client();
+  const client = await dataClient(context);
   await change(
     context,
     (projectId) => client.backend.setAuth(projectId, { passwordMinLength: length }),
@@ -1835,13 +1907,16 @@ function userTable(users) {
   );
 }
 async function runBackendUsersList(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const { users, total } = await allUsers(client, projectId);
   context.output.result(
     { projectId, users, total },
     users.length === 0 ? [
-      "No users yet. Create one with `naro backend users create --username <name> --password-stdin`."
+      forEnvironment(
+        "No users yet. Create one with `naro backend users create --username <name> --password-stdin`.",
+        dataEnvironment(context.flags)
+      )
     ] : [
       `${String(total)} ${total === 1 ? "user" : "users"}, newest first:`,
       ...userTable(users)
@@ -1885,7 +1960,7 @@ async function runBackendUsersCreate(context, input = processStdin3) {
   if (username === void 0 && email === void 0 || context.positionals.length > 0)
     throw new NaroError("VALIDATION_FAILED", USERS_USAGE.create);
   const password = await passwordOf(context, input);
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const body = { password };
   if (username !== void 0) body.username = username;
@@ -1911,7 +1986,7 @@ async function runBackendUsersDelete(context) {
   const [given] = context.positionals;
   if (given === void 0 || context.positionals.length > 1)
     throw new NaroError("VALIDATION_FAILED", USERS_USAGE.delete);
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const { users } = await allUsers(client, projectId);
   const user = find(users, given);
@@ -2018,7 +2093,7 @@ function usageLines(info) {
   }
   return lines;
 }
-function describeLines(info) {
+function describeLines(info, environment = null) {
   const lines = [
     `Provider: ${info.provider}`,
     `Status:   ${info.status}`,
@@ -2039,17 +2114,22 @@ function describeLines(info) {
   );
   lines.push(...usageLines(info));
   if (info.provider === "none")
-    lines.push("Run `naro db enable` to create the database.");
+    lines.push(
+      environment === null ? "Run `naro db enable` to create the database." : `The ${environment} environment has no database yet. Run \`naro environments provision ${environment}\` to make it.`
+    );
   return lines;
 }
 async function runDbInfo(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const database = await client.db.info(projectId);
-  context.output.result({ projectId, database }, describeLines(database));
+  context.output.result(
+    { projectId, database },
+    describeLines(database, dataEnvironment(context.flags))
+  );
 }
 async function runDbEnable(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const database = await client.db.enable(projectId);
   context.output.result({ projectId, database }, [
@@ -2080,7 +2160,7 @@ async function readSql(context, deps) {
 }
 async function runDbQuery(context, deps = processStdin4) {
   const sql = await readSql(context, deps);
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const result = await client.db.query(projectId, { sql });
   const lines = [];
@@ -2115,14 +2195,16 @@ var defaults = {
     writeFileSync2(path, data, { flag: "wx" });
   }
 };
-var EXPORT_NOTICE = "Exporting the project database. Cloudflare holds other queries to this database until the export finishes.";
+function exportNotice(environment) {
+  return `Exporting ${databaseName(environment)}. Cloudflare holds other queries to this database until the export finishes.`;
+}
 function reasonOf(error) {
   return error instanceof Error ? error.message : String(error);
 }
 function withoutUrl(text, url) {
   return text.split(url).join("the signed URL").replace(/\S*X-Amz-Signature=\S*/gi, "the signed URL");
 }
-function downloadFailed(url, reason, original) {
+function downloadFailed(url, reason, original, again = "naro db dump") {
   const scrubbed = withoutUrl(reason, url);
   let cause;
   if (original !== void 0) {
@@ -2135,7 +2217,7 @@ function downloadFailed(url, reason, original) {
   }
   return new NaroError(
     "DATABASE_UNAVAILABLE",
-    `Could not download the dump (${scrubbed}). Run naro db dump again.`,
+    `Could not download the dump (${scrubbed}). Run ${again} again.`,
     cause === void 0 ? {} : { cause }
   );
 }
@@ -2153,17 +2235,22 @@ var DownloadStreamError = class extends Error {
     this.name = "DownloadStreamError";
   }
 };
-async function openDownload(deps, url) {
+async function openDownload(deps, url, again) {
   let response;
   try {
     response = await deps.fetch(url);
   } catch (error) {
-    throw downloadFailed(url, reasonOf(error), error);
+    throw downloadFailed(url, reasonOf(error), error, again);
   }
   if (!response.ok || response.body === null) {
     await response.body?.cancel().catch(() => {
     });
-    throw downloadFailed(url, `HTTP ${String(response.status)}`);
+    throw downloadFailed(
+      url,
+      `HTTP ${String(response.status)}`,
+      void 0,
+      again
+    );
   }
   return response.body;
 }
@@ -2198,8 +2285,8 @@ async function streamInto(body, destination, end) {
   await pipeline(chunksOf(body), counter, destination, { end });
   return bytes;
 }
-function streamFailed(error, url, shown) {
-  return error instanceof DownloadStreamError ? downloadFailed(url, reasonOf(error.original), error.original) : writeFailed(shown, error);
+function streamFailed(error, url, shown, again) {
+  return error instanceof DownloadStreamError ? downloadFailed(url, reasonOf(error.original), error.original, again) : writeFailed(shown, error);
 }
 function refuseDirectory(path, shown) {
   let isDirectory = false;
@@ -2220,8 +2307,8 @@ function makeOutputDirectory(path, shown) {
     throw writeFailed(shown, error);
   }
 }
-async function downloadToFile(deps, url, path, shown) {
-  const body = await openDownload(deps, url);
+async function downloadToFile(deps, url, path, shown, again) {
+  const body = await openDownload(deps, url, again);
   const partial = join2(
     dirname(path),
     `.${basename(path)}.${String(process.pid)}.part`
@@ -2235,15 +2322,15 @@ async function downloadToFile(deps, url, path, shown) {
       rmSync(partial, { force: true });
     } catch {
     }
-    throw streamFailed(error, url, shown);
+    throw streamFailed(error, url, shown, again);
   }
 }
-async function downloadToStdout(deps, url) {
-  const body = await openDownload(deps, url);
+async function downloadToStdout(deps, url, again) {
+  const body = await openDownload(deps, url, again);
   try {
     return await streamInto(body, deps.stdout, false);
   } catch (error) {
-    throw streamFailed(error, url, "stdout");
+    throw streamFailed(error, url, "stdout", again);
   }
 }
 async function runDbDump(context, overrides = {}) {
@@ -2272,10 +2359,12 @@ async function runDbDump(context, overrides = {}) {
   };
   const output = flags.output === void 0 ? null : { path: resolve2(context.cwd, flags.output), shown: flags.output };
   if (output) refuseDirectory(output.path, output.shown);
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   if (output) makeOutputDirectory(output.path, output.shown);
-  context.output.warn(EXPORT_NOTICE);
+  const environment = dataEnvironment(context.flags);
+  const again = `naro db dump${envFlag(environment)}`;
+  context.output.warn(exportNotice(environment));
   const step = await client.db.export(projectId, options, {
     sleep: deps.sleep
   });
@@ -2283,16 +2372,16 @@ async function runDbDump(context, overrides = {}) {
   if (file === null)
     throw new NaroError(
       "DATABASE_UNAVAILABLE",
-      "Could not download the dump (Cloudflare finished the export without a file). Run naro db dump again."
+      `Could not download the dump (Cloudflare finished the export without a file). Run ${again} again.`
     );
-  const bytes = output === null ? await downloadToStdout(deps, file.url) : await downloadToFile(deps, file.url, output.path, output.shown);
+  const bytes = output === null ? await downloadToStdout(deps, file.url, again) : await downloadToFile(deps, file.url, output.path, output.shown, again);
   const bookmark = step.atBookmark;
   if (!context.output.json) {
     context.output.warn(
       `\u2713 Wrote ${flags.output ?? "stdout"} (${humanSize(bytes)}) at bookmark ${bookmark}.`
     );
     context.output.warn(
-      `  naro db restore --bookmark ${bookmark} returns the database to this point.`
+      `  naro db restore --bookmark ${bookmark}${envFlag(dataEnvironment(context.flags))} returns the database to this point.`
     );
   }
   context.output.result({ output: flags.output, bytes, atBookmark: bookmark });
@@ -2313,7 +2402,7 @@ function withWayBack(context, error, before) {
     return error;
   if (!context.output.json)
     context.output.warn(
-      `Before this attempt the database was at bookmark ${before}. If the restore ran anyway, naro db restore --bookmark ${before} undoes it.`
+      `Before this attempt the database was at bookmark ${before}. If the restore ran anyway, naro db restore --bookmark ${before}${envFlag(dataEnvironment(context.flags))} undoes it.`
     );
   return new NaroError(error.code, error.message, {
     ...error.status === void 0 ? {} : { status: error.status },
@@ -2331,7 +2420,7 @@ async function runDbRestore(context) {
     );
   if ("bookmark" in given && !isBookmark(given.bookmark))
     throw new NaroError("VALIDATION_FAILED", BOOKMARK_FORMAT_MESSAGE);
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   let target;
   let at = null;
@@ -2358,7 +2447,7 @@ async function runDbRestore(context) {
   }
   await confirmOrAbort(
     context,
-    `Restore the project database to ${label3}? Everything written after that point is rolled back \u2014 migration history included \u2014 and queries running right now are cancelled.`
+    `Restore ${databaseName(dataEnvironment(context.flags))} to ${label3}? Everything written after that point is rolled back \u2014 migration history included \u2014 and queries running right now are cancelled.`
   );
   const before = await bookmarkNow(context, client, projectId);
   let restored;
@@ -2373,8 +2462,8 @@ async function runDbRestore(context) {
       previousBookmark: restored.previousBookmark
     },
     [
-      `\u2713 Restored the project database to bookmark ${restored.bookmark}.`,
-      `  To undo: naro db restore --bookmark ${restored.previousBookmark}`
+      `\u2713 Restored ${databaseName(dataEnvironment(context.flags))} to bookmark ${restored.bookmark}.`,
+      `  To undo: naro db restore --bookmark ${restored.previousBookmark}${envFlag(dataEnvironment(context.flags))}`
     ]
   );
 }
@@ -2390,7 +2479,7 @@ async function runDbPull(context, overrides = {}) {
   const name = nextMigrationFileName(existing, "remote_schema");
   const path = join2(dir, name);
   const shown = relativeToCwd(context, path);
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   await confirmOrAbort(
     context,
@@ -2524,7 +2613,7 @@ function issueLines(issues, tables) {
   ];
 }
 async function runDbLint(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const tables = await client.db.tables(projectId);
   const answer = await client.db.query(projectId, { sql: DIAGNOSTICS_SQL });
@@ -2730,7 +2819,7 @@ function resetStopped(context, error, bookmark, lead, message) {
   const naroError = isNaroError(error) ? error : toNaroError(error);
   if (!context.output.json)
     context.output.warn(
-      bookmark === null ? lead : `${lead} The database was at bookmark ${bookmark} \u2014 naro db restore --bookmark ${bookmark} undoes the reset.`
+      bookmark === null ? lead : `${lead} The database was at bookmark ${bookmark} \u2014 naro db restore --bookmark ${bookmark}${envFlag(dataEnvironment(context.flags))} undoes the reset.`
     );
   return new NaroError(naroError.code, message(naroError.message), {
     ...naroError.status === void 0 ? {} : { status: naroError.status },
@@ -2757,7 +2846,7 @@ ${problemLines.join("\n")}`,
       { details: { problems } }
     );
   const texts = files.map((name) => readFileSync3(join3(dir, name), "utf8"));
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const bookmark = context.flags.dryRun ? null : await bookmarkNow(context, client, projectId, "resetting");
   const { policyTable: policyTable2, storageTable, ...input } = await readSchema(
@@ -2831,11 +2920,11 @@ ${problemLines.join("\n")}`,
   }
   if (bookmark !== null)
     context.output.log(
-      `The database is at bookmark ${bookmark} \u2014 naro db restore --bookmark ${bookmark} undoes the reset.`
+      `The database is at bookmark ${bookmark} \u2014 naro db restore --bookmark ${bookmark}${envFlag(dataEnvironment(context.flags))} undoes the reset.`
     );
   await confirmOrAbort(
     context,
-    `Reset the project database? This drops ${counts}, clears the migration ledger, then re-applies ${String(files.length)} migration file(s) from ${shownDir}.`
+    `Reset ${databaseName(dataEnvironment(context.flags))}? This drops ${counts}, clears the migration ledger, then re-applies ${String(files.length)} migration file(s) from ${shownDir}.`
   );
   let done = 0;
   const total = plan.batches.length;
@@ -2887,8 +2976,10 @@ ${problemLines.join("\n")}`,
       warnings
     },
     [
-      `\u2713 Reset the project database: dropped ${String(dropped)} object(s), re-applied ${String(reapplied.length)} migration(s).`,
-      ...bookmark === null ? [] : [`  To undo: naro db restore --bookmark ${bookmark}`]
+      `\u2713 Reset ${databaseName(dataEnvironment(context.flags))}: dropped ${String(dropped)} object(s), re-applied ${String(reapplied.length)} migration(s).`,
+      ...bookmark === null ? [] : [
+        `  To undo: naro db restore --bookmark ${bookmark}${envFlag(dataEnvironment(context.flags))}`
+      ]
     ]
   );
 }
@@ -3524,6 +3615,12 @@ function policyTable(policies) {
   ];
 }
 var UNSHOWN = "has characters that cannot be shown here";
+function hintsFor(lines, environment) {
+  if (environment === null) return lines;
+  return lines.map(
+    (line) => line.includes(UNSHOWN) || line.startsWith("Add one with ") ? forEnvironment(line, environment) : line
+  );
+}
 function statementLine(policy) {
   if (policy.invalid !== null)
     return printable(
@@ -3556,7 +3653,7 @@ function policyStatements(policies) {
 }
 async function runPolicyList(context) {
   const table3 = context.flags.table;
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const policies = await client.backend.rlsPolicies(
     projectId,
@@ -3574,7 +3671,10 @@ async function runPolicyList(context) {
       "No policies yet: every table denies anon and signed-in requests.",
       'Add one with `naro policy create "CREATE POLICY \u2026"` or `naro policy set <table> --select public`.'
     ];
-  context.output.result({ projectId, policies }, lines);
+  context.output.result(
+    { projectId, policies },
+    hintsFor(lines, dataEnvironment(context.flags))
+  );
 }
 function statementText(context) {
   const [positional] = context.positionals;
@@ -3648,7 +3748,7 @@ async function runStatements(client, projectId, statements, allowUnindexed) {
 }
 async function runPolicyCreate(context) {
   const statements = policyStatementsOf(statementText(context));
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const applied = await runStatements(
     client,
@@ -3669,7 +3769,7 @@ async function runPolicyDrop(context) {
     context,
     `Drop policy ${printable(name)} on ${printable(table3)}? It stops applying within about 10 seconds.`
   );
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const dropped = await client.backend.dropRlsPolicy(
     projectId,
@@ -3683,7 +3783,7 @@ async function runPolicyDrop(context) {
 async function runPolicySet(context) {
   const [table3] = context.positionalOrThrow(1, SET_USAGE);
   const patch = policyPatch(context.flags, context, table3);
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const policy = await client.backend.setPolicy(
     projectId,
@@ -3700,11 +3800,14 @@ async function runPolicySet(context) {
   }
   context.output.result(
     { projectId, policy, ...named === void 0 ? {} : { policies: named } },
-    [
-      `\u2705 Saved the policy for ${printable(policy.table)}. ${TAKES_EFFECT}`,
-      ...policyTable([policy]),
-      ...named === void 0 || named.length === 0 ? [] : ["", ...policyStatements(named)]
-    ]
+    hintsFor(
+      [
+        `\u2705 Saved the policy for ${printable(policy.table)}. ${TAKES_EFFECT}`,
+        ...policyTable([policy]),
+        ...named === void 0 || named.length === 0 ? [] : ["", ...policyStatements(named)]
+      ],
+      dataEnvironment(context.flags)
+    )
   );
 }
 async function runPolicyRemove(context) {
@@ -3713,7 +3816,7 @@ async function runPolicyRemove(context) {
     context,
     `Remove every policy on ${printable(table3)}? Anon and signed-in requests to it are denied from then on.`
   );
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const policy = await client.backend.removePolicy(projectId, table3);
   const names = policy.policies ?? [];
@@ -3846,7 +3949,7 @@ function ruleText(value) {
   return "invalid" in value ? "invalid" : "condition";
 }
 var SUGAR_NAME = /^naro_(?:select|insert|update|delete)$/;
-function removedLines(policy, dryRun) {
+function removedLines(policy, dryRun, environment) {
   const verb = dryRun ? "Would remove" : "\u2713 Removed";
   const names = policy.policies ?? [];
   let line;
@@ -3884,7 +3987,11 @@ function removedLines(policy, dryRun) {
     lines.push(
       `  As a command, for the owner ${one ? "rule" : "rules"} (${owners.map((owner) => printable(owner.name)).join(", ")}): CREATE POLICY has no owner column, so naro policy create cannot make ${one ? "it" : "them"} again.`,
       // The server's bytes, or not shown: a name may hold a line break.
-      typeof command !== "string" ? "  naro policy set <table> --<action> owner --owner <column> sets one." : isPrintable(command) ? command : "  The command has characters that cannot be shown here: --json has the exact text."
+      // Under --env, the command acts on the environment (PR #343 review 2).
+      typeof command !== "string" ? forEnvironment(
+        "  naro policy set <table> --<action> owner --owner <column> sets one.",
+        environment
+      ) : isPrintable(command) ? forEnvironment(command, environment) : "  The command has characters that cannot be shown here: --json has the exact text."
     );
   }
   return lines;
@@ -3899,7 +4006,7 @@ async function runSchemaChange(context, operations, question) {
     const { confirm: _confirm, ...rest } = operation;
     return rest;
   }) : operations;
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const dir = migrationsDir(context);
   const local = listMigrationFiles(dir);
@@ -3924,7 +4031,9 @@ async function runSchemaChange(context, operations, question) {
       ...sqlLines,
       `Dry run \u2014 nothing was applied. It would be recorded as ${printable(result.name)}.`,
       ...result.policies.map((policy) => policyLine(policy, true)),
-      ...removed.flatMap((policy) => removedLines(policy, true))
+      ...removed.flatMap(
+        (policy) => removedLines(policy, true, dataEnvironment(context.flags))
+      )
     ]);
     return;
   }
@@ -3946,7 +4055,10 @@ async function runSchemaChange(context, operations, question) {
     }
   }
   for (const warning of allWarnings)
-    context.output.warn(`\u26A0 ${printable(warning)}`);
+    context.output.warn(
+      `\u26A0 ${printable(forEnvironment(warning, dataEnvironment(context.flags)))}`
+    );
+  fileWarning &&= forEnvironment(fileWarning, dataEnvironment(context.flags));
   if (fileWarning) context.output.warn(`\u26A0 ${printable(fileWarning)}`);
   context.output.result(
     {
@@ -3960,7 +4072,9 @@ async function runSchemaChange(context, operations, question) {
       ...sqlLines,
       file === null ? `\u2705 Applied ${printable(result.name)}.` : `\u2705 Applied ${printable(result.name)} and wrote ${printable(file)}.`,
       ...result.policies.map((policy) => policyLine(policy)),
-      ...removed.flatMap((policy) => removedLines(policy, false))
+      ...removed.flatMap(
+        (policy) => removedLines(policy, false, dataEnvironment(context.flags))
+      )
     ]
   );
 }
@@ -4011,24 +4125,29 @@ async function runDbTableRename(context) {
   if (!table3 || !to) throw new NaroError("VALIDATION_FAILED", USAGE2.rename);
   await runSchemaChange(context, [{ op: "renameTable", table: table3, to }]);
 }
+function inDatabase(environment) {
+  return environment === null ? "" : ` in ${databaseName(environment)}`;
+}
 async function runDbTableDropColumn(context) {
   const [table3, column] = context.positionals;
   if (!table3 || !column)
     throw new NaroError("VALIDATION_FAILED", USAGE2.dropColumn);
   const target = `${table3}.${column}`;
+  const env = dataEnvironment(context.flags);
   await runSchemaChange(
     context,
     [{ op: "dropColumn", table: table3, column, confirm: target }],
-    `Drop column ${printable(target)} and its value in every row? naro db restore can bring it back (Time Travel, 30 days).`
+    `Drop column ${printable(target)}${inDatabase(env)} and its value in every row? naro db restore${envFlag(env)} can bring it back (Time Travel, 30 days).`
   );
 }
 async function runDbTableDrop(context) {
   const [table3] = context.positionals;
   if (!table3) throw new NaroError("VALIDATION_FAILED", USAGE2.drop);
+  const env = dataEnvironment(context.flags);
   await runSchemaChange(
     context,
     [{ op: "dropTable", table: table3, confirm: table3 }],
-    `Drop table ${printable(table3)} and every row in it? naro db restore can bring it back (Time Travel, 30 days).`
+    `Drop table ${printable(table3)}${inDatabase(env)} and every row in it? naro db restore${envFlag(env)} can bring it back (Time Travel, 30 days).`
   );
 }
 async function runDbIndexCreate(context) {
@@ -5103,6 +5222,7 @@ ${serializeDotenv(vars)}`;
 var CREATE_USAGE2 = "Usage: naro environments create <slug> [--branch <branch>] [--copy-env preview|production|none] [--database schema|empty]";
 var SET_USAGE2 = "Usage: naro environments set <slug> [--branch <branch> | --no-branch] [--protection on|off]";
 var DELETE_USAGE = "Usage: naro environments delete <slug> [--yes]";
+var PROVISION_USAGE = "Usage: naro environments provision <slug>";
 var NO_BRANCH = "\u2014";
 function parseCopyEnv(value) {
   if (value === void 0) return void 0;
@@ -5137,14 +5257,26 @@ function table2(rows) {
     ).join("  ")
   );
 }
+function dataCell(environment) {
+  const status = environment.data?.status ?? "none";
+  return status === "none" ? NO_BRANCH : status;
+}
 function environmentRow(environment) {
   return [
     environment.slug,
     environment.url,
     environment.branch ?? NO_BRANCH,
-    environment.protectionEnabled ? "on" : "off"
+    environment.protectionEnabled ? "on" : "off",
+    dataCell(environment)
   ];
 }
+function dataErrorLines(environments) {
+  return environments.flatMap(
+    (environment) => environment.data?.status === "error" ? [
+      `\u26A0 ${environment.slug}: ${environment.data.error ?? "its data could not be made."} Run \`naro environments provision ${environment.slug}\` to try again.`
+    ] : []
+  );
+}
 async function runEnvironmentsList(context) {
   const projectId = await context.resolveProjectId();
   const client = await context.client();
@@ -5152,9 +5284,10 @@ async function runEnvironmentsList(context) {
   const count2 = String(environments.length);
   context.output.result({ projectId, environments, limit }, [
     ...environments.length === 0 ? ["No environments. Create one with `naro environments create qa`."] : table2([
-      ["slug", "url", "branch", "protection"],
+      ["slug", "url", "branch", "protection", "data"],
       ...environments.map(environmentRow)
     ]),
+    ...dataErrorLines(environments),
     limit === null ? `${count2} environment${environments.length === 1 ? "" : "s"}` : `${count2} of ${String(limit)} environments`
   ]);
 }
@@ -5217,7 +5350,7 @@ async function runEnvironmentsDelete(context) {
   const projectId = await context.resolveProjectId();
   await confirmOrAbort(
     context,
-    `Delete environment ${slug}? Its worker and protection key are removed.`
+    `Delete environment ${slug}? Its worker, protection key and data \u2014 database, backend and Storage files \u2014 are removed.`
   );
   const client = await context.client();
   const found = await client.environments.get(projectId, slug);
@@ -5226,6 +5359,16 @@ async function runEnvironmentsDelete(context) {
     `\u2705 Deleted environment ${slug}`
   ]);
 }
+async function runEnvironmentsProvision(context) {
+  const [slug] = context.positionalOrThrow(1, PROVISION_USAGE);
+  const projectId = await context.resolveProjectId();
+  const client = await context.client();
+  const found = await client.environments.get(projectId, slug);
+  const environment = await client.environments.provision(projectId, found.id);
+  context.output.result({ projectId, environment }, [
+    (environment.data?.status ?? "none") === "none" ? `Environment ${slug} has no data to make: the project uses neither a Naro database nor a backend.` : `\u2705 Making environment ${slug}'s data \u2014 \`naro environments\` shows how it goes.`
+  ]);
+}
 
 // src/commands/gen.ts
 import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync5 } from "fs";
@@ -5235,7 +5378,7 @@ async function runGenTypes(context) {
   const { lang } = context.flags;
   if (lang !== void 0 && lang !== "typescript")
     throw new NaroError("VALIDATION_FAILED", LANG_MESSAGE);
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const tables = await client.db.tables(projectId);
   const read = await policiesForTypes(client, projectId);
@@ -5731,6 +5874,9 @@ function tableName(table3) {
   const name = printable(table3.name);
   return table3.exists ? name : `${name} (dropped)`;
 }
+function linesFor(lines, environment) {
+  return lines.map((line) => forEnvironment(line, environment));
+}
 function realtimeLines(info) {
   if (!info.enabled)
     return [
@@ -5744,14 +5890,14 @@ function realtimeLines(info) {
     live2 === null ? "Connections now: not known \u2014 the backend is off or not ready, or the hub did not answer" : `Connections now: ${number(live2.connections)} \xB7 channels ${number(live2.channels)} \xB7 presences ${number(live2.presences)}`
   ];
 }
-async function enableRealtime(client, projectId) {
+async function enableRealtime(client, projectId, environment) {
   try {
     return await client.realtime.enable(projectId);
   } catch (error) {
     if (isNaroError(error) && error.code === "TIMEOUT")
       throw new NaroError(
         "TIMEOUT",
-        "Turning Realtime on did not answer within 2 minutes. `naro realtime` shows where it got to, and `naro realtime enable` again picks up where it stopped.",
+        `Turning Realtime on did not answer within 2 minutes. \`naro realtime${envFlag(environment)}\` shows where it got to, and \`naro realtime enable${envFlag(environment)}\` again picks up where it stopped.`,
         { cause: error }
       );
     throw error;
@@ -5763,28 +5909,41 @@ function tableNames2(context, usage) {
   return context.positionals;
 }
 async function runRealtimeStatus(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const realtime = await client.realtime.info(projectId);
-  context.output.result({ projectId, realtime }, realtimeLines(realtime));
+  context.output.result(
+    { projectId, realtime },
+    linesFor(realtimeLines(realtime), dataEnvironment(context.flags))
+  );
 }
 async function runRealtimeEnable(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
-  const realtime = await enableRealtime(client, projectId);
-  context.output.result({ projectId, realtime }, [
-    "\u2705 Realtime is on. Publish a table with naro realtime tables add <table>.",
-    ...realtimeLines(realtime)
-  ]);
+  const environment = dataEnvironment(context.flags);
+  const realtime = await enableRealtime(client, projectId, environment);
+  context.output.result(
+    { projectId, realtime },
+    linesFor(
+      [
+        "\u2705 Realtime is on. Publish a table with naro realtime tables add <table>.",
+        ...realtimeLines(realtime)
+      ],
+      environment
+    )
+  );
 }
 async function runRealtimeTablesList(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const tables = await client.realtime.listTables(projectId);
   context.output.result(
     { projectId, tables },
     tables.length === 0 ? [
-      "No published tables. `naro realtime tables add <table>` publishes one."
+      forEnvironment(
+        "No published tables. `naro realtime tables add <table>` publishes one.",
+        dataEnvironment(context.flags)
+      )
     ] : tables.map(
       (table3) => table3.exists ? `  ${printable(table3.name)}` : `  ${printable(table3.name)}  (dropped: no such table now)`
     )
@@ -5792,7 +5951,7 @@ async function runRealtimeTablesList(context) {
 }
 async function runRealtimeTablesAdd(context) {
   const names = tableNames2(context, ADD_USAGE);
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const tables = [];
   for (const name of names) {
@@ -5814,7 +5973,7 @@ async function runRealtimeTablesRemove(context) {
     context,
     names.length === 1 ? `Stop publishing ${shown}? Subscribers stop receiving its changes within about 10 seconds.` : `Stop publishing ${shown}? Subscribers stop receiving their changes within about 10 seconds.`
   );
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const tables = [];
   for (const name of names) {
@@ -5934,6 +6093,9 @@ function meterLines(info) {
     );
   return lines;
 }
+function linesFor2(lines, environment) {
+  return lines.map((line) => forEnvironment(line, environment));
+}
 function storageLines(info) {
   if (info.disabledAt !== null)
     return [
@@ -5957,27 +6119,27 @@ function storageLines(info) {
     ...info.buckets.map(bucketLine)
   ];
 }
-async function enableStorage(client, projectId) {
+async function enableStorage(client, projectId, environment = null) {
   try {
     return await client.storage.enable(projectId);
   } catch (error) {
     if (isNaroError(error) && error.code === "TIMEOUT")
       throw new NaroError(
         "TIMEOUT",
-        "Turning Storage on did not answer within 2 minutes. `naro storage` shows where it got to, and `naro storage enable` again picks up where it stopped.",
+        `Turning Storage on did not answer within 2 minutes. \`naro storage${envFlag(environment)}\` shows where it got to, and \`naro storage enable${envFlag(environment)}\` again picks up where it stopped.`,
         { cause: error }
       );
     throw error;
   }
 }
-async function disableStorage(client, projectId) {
+async function disableStorage(client, projectId, environment = null) {
   try {
     return await client.storage.disable(projectId);
   } catch (error) {
     if (isNaroError(error) && error.code === "TIMEOUT")
       throw new NaroError(
         "TIMEOUT",
-        "Turning Storage off did not answer within 2 minutes. `naro storage` shows where it got to, and `naro storage disable` again picks up where it stopped.",
+        `Turning Storage off did not answer within 2 minutes. \`naro storage${envFlag(environment)}\` shows where it got to, and \`naro storage disable${envFlag(environment)}\` again picks up where it stopped.`,
         { cause: error }
       );
     throw error;
@@ -6004,23 +6166,34 @@ function bucketFields(flags) {
   return fields;
 }
 async function runStorageStatus(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const storage = await client.storage.info(projectId);
-  context.output.result({ projectId, storage }, storageLines(storage));
+  context.output.result(
+    { projectId, storage },
+    linesFor2(storageLines(storage), dataEnvironment(context.flags))
+  );
 }
 async function runStorageEnable(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
-  const storage = await enableStorage(client, projectId);
+  const environment = dataEnvironment(context.flags);
+  const storage = await enableStorage(client, projectId, environment);
   context.output.result({ projectId, storage }, [
     `\u2705 Storage is on: R2 bucket ${printable(storage.bucket ?? "unknown")}.`,
-    ...storage.usage === null ? ["\u23F3 The backend is still finishing; check `naro backend` in a minute."] : [],
-    ...storageLines(storage)
+    ...linesFor2(
+      [
+        ...storage.usage === null ? [
+          "\u23F3 The backend is still finishing; check `naro backend` in a minute."
+        ] : [],
+        ...storageLines(storage)
+      ],
+      environment
+    )
   ]);
 }
 async function runStorageDisable(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const current = await client.storage.info(projectId);
   if (current.bucket === null) {
@@ -6029,27 +6202,34 @@ async function runStorageDisable(context) {
     ]);
     return;
   }
+  const environment = dataEnvironment(context.flags);
   if (current.disabledAt === null)
-    await confirmOrAbort(context, DISABLE_QUESTION3);
-  const storage = await disableStorage(client, projectId);
+    await confirmOrAbort(
+      context,
+      forEnvironment(DISABLE_QUESTION3, environment)
+    );
+  const storage = await disableStorage(client, projectId, environment);
   context.output.result({ projectId, storage }, [
-    "\u2705 Storage is off. Buckets and files are kept; naro storage enable turns it on again.",
-    ...storageLines(storage)
+    `\u2705 Storage is off. Buckets and files are kept; naro storage enable${envFlag(environment)} turns it on again.`,
+    ...linesFor2(storageLines(storage), environment)
   ]);
 }
 async function runStorageBucketList(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const buckets = await client.storage.listBuckets(projectId);
   context.output.result(
     { projectId, buckets },
-    buckets.length === 0 ? [NO_BUCKETS] : buckets.map(bucketLine)
+    linesFor2(
+      buckets.length === 0 ? [NO_BUCKETS] : buckets.map(bucketLine),
+      dataEnvironment(context.flags)
+    )
   );
 }
 async function runStorageBucketCreate(context) {
   const name = bucketName(context, CREATE_USAGE3);
   const input = { name, ...bucketFields(context.flags) };
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   let bucket;
   try {
@@ -6058,12 +6238,12 @@ async function runStorageBucketCreate(context) {
     if (!isNaroError(error) || error.code !== "STORAGE_NOT_ENABLED")
       throw error;
     context.output.log(ENABLE_FIRST);
-    await enableStorage(client, projectId);
+    await enableStorage(client, projectId, dataEnvironment(context.flags));
     bucket = await client.storage.createBucket(projectId, input);
   }
   context.output.result({ projectId, bucket }, [
     `\u2705 Created bucket ${printable(bucket.name)}.`,
-    bucketLine(bucket)
+    forEnvironment(bucketLine(bucket), dataEnvironment(context.flags))
   ]);
 }
 async function runStorageBucketUpdate(context) {
@@ -6074,13 +6254,13 @@ async function runStorageBucketUpdate(context) {
       context,
       `Make bucket ${name} public? Anyone with an object's URL can download it.`
     );
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const bucket = await client.storage.updateBucket(projectId, name, patch);
   const takesEffect = patch.public === false ? "It takes effect within about 10 seconds; copies Naro's edge already holds can be served for up to 5 minutes." : "It takes effect within about 10 seconds.";
   context.output.result({ projectId, bucket }, [
     `\u2705 Updated bucket ${printable(bucket.name)}. ${takesEffect}`,
-    bucketLine(bucket)
+    forEnvironment(bucketLine(bucket), dataEnvironment(context.flags))
   ]);
 }
 function refuseSearch(context, why) {
@@ -6116,7 +6296,7 @@ async function runStorageBucketEmpty(context) {
     context,
     `bucket empty deletes every object in the bucket. ${EMPTY_USAGE}`
   );
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const bucket = await client.storage.getBucket(projectId, name);
   await confirmOrAbort(
@@ -6139,7 +6319,7 @@ async function runStorageBucketRemove(context) {
     context,
     empty ? `bucket remove --empty deletes every object in the bucket before it removes the bucket. ${REMOVE_USAGE3}` : `bucket remove removes the whole bucket. ${REMOVE_USAGE3}`
   );
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   let question = `Remove bucket ${name}?`;
   if (empty) {
@@ -6362,6 +6542,116 @@ var SESSION_PREFIXES = ["/auth/", "/realtime/"];
 function storeFor(config, path) {
   return SESSION_PREFIXES.some((prefix) => path.startsWith(prefix)) ? config.tokens : config.accessJwt ?? null;
 }
+var ACCESS_JWT_MARGIN_MS = 6e4;
+function timesOf(jwt) {
+  const payload = jwt.split(".")[1];
+  if (payload === void 0 || payload === "") return null;
+  try {
+    const base64 = payload.replace(/-/g, "+").replace(/_/g, "/");
+    const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, "=");
+    const claims = JSON.parse(atob(padded));
+    if (!isRecord(claims)) return null;
+    const { exp, iat } = claims;
+    if (typeof exp !== "number" || !Number.isFinite(exp)) return null;
+    return {
+      exp: exp * 1e3,
+      iat: typeof iat === "number" && Number.isFinite(iat) ? iat * 1e3 : null
+    };
+  } catch {
+    return null;
+  }
+}
+function expiryOf(jwt) {
+  return timesOf(jwt)?.exp ?? null;
+}
+var skews = /* @__PURE__ */ new WeakMap();
+function localExpiry(config, jwt) {
+  const exp = expiryOf(jwt);
+  return exp === null ? null : exp - (skews.get(config.tokens) ?? 0);
+}
+var SESSION_GONE_CODES = /* @__PURE__ */ new Set([
+  "UNAUTHORIZED",
+  "INVALID_SESSION",
+  "FAILED_TO_GET_SESSION"
+]);
+var renewing = /* @__PURE__ */ new WeakMap();
+function renewAccessJwt(config, jwtStore, session) {
+  const pending = renewing.get(config.tokens);
+  if (pending?.session === session) return pending.done;
+  const done = (async () => {
+    const result = await callWith(
+      config,
+      { method: "GET", path: "/auth/token", withToken: true },
+      void 0,
+      session
+    );
+    if (result.error !== null) {
+      if (result.answer?.status !== 401 || !SESSION_GONE_CODES.has(result.error.code))
+        return result.error;
+      await config.tokens.clearIf(session);
+      await config.tokens.whileIs(null, () => jwtStore.clear());
+      return invalidSession();
+    }
+    const { body, status } = result.answer;
+    const jwt = isRecord(body) ? body.token : void 0;
+    if (typeof jwt !== "string" || jwt === "") return invalidResponse(status);
+    const arrived = Date.now();
+    await config.tokens.whileIs(session, async () => {
+      const iat = timesOf(jwt)?.iat;
+      if (iat !== void 0 && iat !== null)
+        skews.set(config.tokens, iat - arrived);
+      await jwtStore.set(jwt);
+    });
+    return null;
+  })();
+  const entry = { session, done };
+  renewing.set(config.tokens, entry);
+  void done.finally(() => {
+    if (renewing.get(config.tokens) === entry) renewing.delete(config.tokens);
+  });
+  return done;
+}
+async function accessJwtFor(config, jwtStore) {
+  for (let round = 0; round < 2; round += 1) {
+    const session = await config.tokens.get();
+    const jwt = await jwtStore.get();
+    if (session === null || config.service) return { token: jwt, session };
+    const expiry = jwt === null ? null : localExpiry(config, jwt);
+    if (jwt !== null && (expiry === null || expiry - ACCESS_JWT_MARGIN_MS > Date.now()))
+      return { token: jwt, session };
+    const error = await renewAccessJwt(config, jwtStore, session);
+    const stored = await config.tokens.get();
+    if (stored !== session) {
+      if (stored === null) return error ? { error } : { token: null, session };
+      continue;
+    }
+    if (error === null) {
+      const renewed = await jwtStore.get();
+      return renewed === null ? { error: invalidSession() } : { token: renewed, session };
+    }
+    if (jwt !== null && expiry !== null && expiry > Date.now())
+      return { token: jwt, session };
+    return { error };
+  }
+  return { error: invalidSession() };
+}
+async function bearerFor(config, path, withToken) {
+  if (!withToken) return { token: null, session: null };
+  const store = storeFor(config, path);
+  if (store === null) return { token: null, session: null };
+  if (store === config.tokens) {
+    const token = await store.get();
+    return { token, session: token };
+  }
+  return accessJwtFor(config, store);
+}
+async function retryBearer(config, path, error, first) {
+  if (error?.code !== "INVALID_SESSION" || first.token === null || first.session === null || config.accessJwt === void 0 || storeFor(config, path) !== config.accessJwt || await config.tokens.get() !== first.session)
+    return null;
+  const renewed = await bearerFor(config, path, true);
+  if ("error" in renewed) return renewed;
+  return renewed.token === null || renewed.token === first.token || renewed.session !== first.session ? null : renewed;
+}
 async function receive(config, options, init) {
   const controller = options.timeoutMs !== void 0 && typeof AbortController === "function" ? new AbortController() : null;
   if (controller) init.signal = controller.signal;
@@ -6405,8 +6695,16 @@ async function call(config, options) {
       return { error: invalidQuery("", "is not JSON"), answer: null };
     }
   }
+  const bearer = await bearerFor(config, options.path, options.withToken);
+  if ("error" in bearer) return { error: bearer.error, answer: null };
+  const result = await callWith(config, options, payload, bearer.token);
+  const again = await retryBearer(config, options.path, result.error, bearer);
+  if (again === null) return result;
+  if ("error" in again) return { error: again.error, answer: null };
+  return callWith(config, options, payload, again.token);
+}
+async function callWith(config, options, payload, token) {
   const store = storeFor(config, options.path);
-  const token = options.withToken && store ? await store.get() : null;
   const headers = {
     ...options.headers,
     apikey: config.apiKey
@@ -6450,8 +6748,48 @@ async function settled(store, error, headers, token) {
   return RETRY_AFTER_CODES.has(error.code) ? withRetryAfter(error, headers) : error;
 }
 async function send(config, options) {
+  const bearer = await untilAborted(
+    bearerFor(config, options.path, options.withToken),
+    options.signal
+  );
+  if (bearer === ABORTED) return { error: uploadAborted(), status: null };
+  if ("error" in bearer) return { error: bearer.error, status: null };
+  const result = await sendWith(config, options, bearer.token);
+  if (result.error?.code !== "INVALID_SESSION" || isStream(options.body))
+    return result;
+  const again = await untilAborted(
+    retryBearer(config, options.path, result.error, bearer),
+    options.signal
+  );
+  if (again === ABORTED) return { error: uploadAborted(), status: null };
+  if (again === null) return result;
+  if ("error" in again) return { error: again.error, status: null };
+  return sendWith(config, options, again.token);
+}
+var ABORTED = Symbol("aborted");
+function untilAborted(promise, signal) {
+  if (!signal) return promise;
+  if (signal.aborted) return Promise.resolve(ABORTED);
+  return new Promise((resolve7, reject) => {
+    const stop = () => resolve7(ABORTED);
+    signal.addEventListener("abort", stop, { once: true });
+    promise.then(
+      (value) => {
+        signal.removeEventListener("abort", stop);
+        resolve7(value);
+      },
+      (error) => {
+        signal.removeEventListener("abort", stop);
+        reject(error);
+      }
+    );
+  });
+}
+function isStream(body) {
+  return typeof ReadableStream === "function" && body instanceof ReadableStream;
+}
+async function sendWith(config, options, token) {
   const store = storeFor(config, options.path);
-  const token = options.withToken && store ? await store.get() : null;
   const headers = {
     ...options.headers,
     apikey: config.apiKey
@@ -7305,6 +7643,23 @@ var TokenStore = class {
       this.#changed();
     });
   }
+  /**
+   * Runs `operation` only while `expected` is the stored token (null: none
+   * is stored), inside this
+   * store's queue, and says whether it ran: no write to this store lands
+   * between the check and the end of the operation. A refreshed access JWT
+   * is kept this way (`http.ts`), so one minted for a session that a
+   * sign-in replaced meanwhile never lands on top of the new session's.
+   * `operation` must not call this store's public methods (it would wait
+   * on itself); another store's are fine.
+   */
+  whileIs(expected, operation) {
+    return this.#serial(async () => {
+      if (await this.#get() !== expected) return false;
+      await operation();
+      return true;
+    });
+  }
   /**
    * Calls `listener` after every write of the token — a sign-in, a
    * sign-out, a renewed session, a cleared INVALID_SESSION — from inside the
@@ -11056,7 +11411,8 @@ var NaroClient2 = class {
       apiKey,
       fetch: options.fetch,
       tokens: new TokenStore(storage, storageKey(baseUrl)),
-      accessJwt: new TokenStore(storage, accessJwtKey(baseUrl))
+      accessJwt: new TokenStore(storage, accessJwtKey(baseUrl)),
+      service
     };
     this.auth = new AuthClient(http, {
       verifiers: new FlowVerifiers(
@@ -11207,18 +11563,27 @@ function unwrap(result) {
 }
 var ONE_KEY = /^[\x21-\x7e]+$/;
 async function objects(context) {
-  const client = await context.client();
+  const client = await dataClient(context);
   const projectId = await context.resolveProjectId();
   const backend = await client.backend.info(projectId);
-  if (backend.status === "none")
+  const environment = dataEnvironment(context.flags);
+  if (backend.status === "none") {
     throw new NaroError(
       "BACKEND_NOT_READY",
-      "This project has no backend yet. Run `naro backend enable`, then `naro storage enable`."
+      environment === null ? "This project has no backend yet. Run `naro backend enable`, then `naro storage enable`." : `The ${environment} environment has no backend yet. Run \`naro environments provision ${environment}\` to make it.`
+    );
+  }
+  if (!backend.enabled)
+    throw new NaroError(
+      "BACKEND_OFF",
+      forEnvironment(BACKEND_OFF_MESSAGE, environment)
     );
-  if (!backend.enabled) throw new NaroError("BACKEND_OFF", BACKEND_OFF_MESSAGE);
   const state = await client.storage.info(projectId);
   if (state.disabledAt !== null)
-    throw new NaroError("STORAGE_OFF", STORAGE_OFF_MESSAGE);
+    throw new NaroError(
+      "STORAGE_OFF",
+      forEnvironment(STORAGE_OFF_MESSAGE, environment)
+    );
   let serviceKey = process.env.NARO_SERVICE_KEY?.trim() ?? "";
   if (serviceKey !== "" && !ONE_KEY.test(serviceKey))
     throw new NaroError(
@@ -11239,7 +11604,10 @@ async function objects(context) {
   } catch (error) {
     throw new NaroError(
       "BACKEND_NOT_READY",
-      `The project's backend url cannot be used (${printable(backend.url)}). Run \`naro backend\` to see where the backend got to.`,
+      forEnvironment(
+        `The project's backend url cannot be used (${printable(backend.url)}). Run \`naro backend\` to see where the backend got to.`,
+        environment
+      ),
       { cause: error }
     );
   }
@@ -11313,7 +11681,7 @@ async function storageLs(context) {
         "VALIDATION_FAILED",
         `--search needs a naro:// path. ${LS_USAGE}`
       );
-    const client = await context.client();
+    const client = await dataClient(context);
     const projectId2 = await context.resolveProjectId();
     const buckets = await client.storage.listBuckets(projectId2);
     context.output.result(
@@ -11970,12 +12338,14 @@ Usage:
   naro env pull [file]               Write env vars to .env.local
        target is production, preview, all or an environment name; add and import use all when none is given
 
-  naro environments                  List the project's environments: address, branch, protection, and how many the plan allows
+  naro environments                  List the project's environments: address, branch, protection, data, and how many the plan allows
   naro environments create <slug> [--branch <b>] [--copy-env preview|production|none] [--database schema|empty]
                                      A QA or staging surface served at <subdomain>--<slug>; starts with preview's variables
   naro environments set <slug> [--branch <b> | --no-branch] [--protection on|off]
                                      Change the branch whose pushes deploy here, or who can open it (protection off asks first; --yes in CI)
-  naro environments delete <slug>    Delete it with its worker and protection key (asks first; --yes in CI)
+  naro environments delete <slug>    Delete it with its worker, protection key and data (asks first; --yes in CI)
+  naro environments provision <slug>
+                                     Make its data \u2014 database, backend, Storage \u2014 or go on after a stop
 
   naro domains list | add <host> [--no-www] | remove <host>
        add example.com also connects www.example.com and redirects the apex to
@@ -11984,6 +12354,9 @@ Usage:
   naro domains verify [host] [--wait]  Re-check DNS and print what is missing
        exits non-zero while a domain is not live yet
 
+  The data commands below (db, migration, gen, backend, policy, storage, realtime) take --env <name>:
+       a named environment's data instead of production's, which preview shares
+       (naro-cli 0.21.0 and older ignore --env on them and act on production)
   naro db enable                     Create the project's database (Cloudflare D1)
   naro db info                       Database status, size, table count and limits
        and today's writes against the daily write limit (UTC)
@@ -12149,7 +12522,8 @@ Global options:
   --browser <b>   Only this browser: chrome, edge, firefox, opera, safari or other (naro analytics, naro insights)
   --os <o>        Only this operating system: android, ios, linux, macos, windows or other (naro analytics, naro insights)
   --to <environment>  production (the default) or an environment name: where naro promote publishes the build (naro promote)
-  --env <e>       production or preview (naro logs, naro insights: production by default; naro env pull, naro deploy: preview by default, or an environment name)
+  --env <e>       production or preview (naro logs, naro insights: production by default; naro env pull, naro deploy: preview by default, or an environment name);
+                  production or an environment name for the data commands (naro db, migration, gen, backend, policy, storage, realtime: production by default)
   --branch <b>    naro environments create, set: the branch whose pushes deploy to that environment. naro deploy: the default
                   branch of a project this deploy creates or updates (the deploy's own branch follows where it goes)
   --no-branch     No branch deploys to the environment any more (naro environments set; not with --branch)
@@ -12374,10 +12748,59 @@ function routeRealtime(words) {
 async function refuseTo() {
   throw new NaroError("VALIDATION_FAILED", "--to is only for naro promote.");
 }
+var DATA_COMMANDS = /* @__PURE__ */ new Set([
+  "db",
+  "migration",
+  "gen",
+  "backend",
+  "policy",
+  "storage",
+  "realtime"
+]);
+var PROJECT_WIDE_BACKEND = /* @__PURE__ */ new Set(["enable", "provision", "disable"]);
+function dataEnvRefusal(parsed) {
+  if (parsed.flags.env === void 0 || !DATA_COMMANDS.has(parsed.command ?? ""))
+    return null;
+  const sub = parsed.positionals[0];
+  if (parsed.command === "backend" && sub !== void 0 && PROJECT_WIDE_BACKEND.has(sub) && parsed.flags.env !== "production")
+    return new NaroError(
+      "VALIDATION_FAILED",
+      DATA_ENV_MESSAGES.projectWide(`naro backend ${sub}`)
+    );
+  try {
+    dataEnvironment(parsed.flags);
+    return null;
+  } catch (error) {
+    return error;
+  }
+}
+function guidedError(error, parsed) {
+  if (!isNaroError(error) || !DATA_COMMANDS.has(parsed.command ?? ""))
+    return error;
+  if (dataEnvRefusal(parsed) !== null) return error;
+  let environment;
+  try {
+    environment = dataEnvironment(parsed.flags);
+  } catch {
+    return error;
+  }
+  if (environment === null) return error;
+  const usage = error.message.indexOf("Usage: ");
+  error.message = usage === -1 ? forEnvironment(error.message, environment) : `${forEnvironment(error.message.slice(0, usage), environment)}${error.message.slice(usage)}`;
+  return error;
+}
 function route(parsed) {
   const routed = routeCommand(parsed);
   if (routed && parsed.flags.to !== void 0 && parsed.command !== "promote" && parsed.command !== "rollback")
     return { handler: refuseTo, positionals: routed.positionals };
+  const refusal = routed ? dataEnvRefusal(parsed) : null;
+  if (routed && refusal)
+    return {
+      handler: async () => {
+        throw refusal;
+      },
+      positionals: routed.positionals
+    };
   return routed;
 }
 function routeCommand(parsed) {
@@ -12499,6 +12922,11 @@ function routeCommand(parsed) {
             handler: runEnvironmentsDelete,
             positionals: positionals.slice(1)
           };
+        case "provision":
+          return {
+            handler: runEnvironmentsProvision,
+            positionals: positionals.slice(1)
+          };
         default:
           return null;
       }
@@ -12725,7 +13153,7 @@ async function main(argv = process.argv.slice(2)) {
   try {
     await routed.handler(context);
   } catch (error) {
-    context.output.fail(error);
+    context.output.fail(guidedError(error, parsed));
   }
 }
 void main();