@pebblehouse/odin-cli 0.10.2 → 0.13.0

package/README.md

@@ -82,7 +82,7 @@ All commands output JSON to stdout. Errors go to stderr with non-zero exit codes
 |----------|---------|-------------|
 | `ODIN_API_URL` | `https://www.odin.mu` | API base URL |
 | `ODIN_SUPABASE_URL` | — | Supabase URL (for token refresh) |
-| `ODIN_SUPABASE_ANON_KEY` | — | Supabase anon key (for token refresh) |
+| `ODIN_SUPABASE_PUBLISHABLE_KEY` | — | Supabase publishable key (for token refresh) |
 
 ## License
 

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { Command as Command18 } from "commander";
+import { Command as Command21 } from "commander";
 
 // src/auth/login.ts
 import { createServer } from "http";
@@ -37,7 +37,7 @@ function clearCredentials() {
 // src/auth/login.ts
 var API_URL = process.env.ODIN_API_URL ?? "https://www.odin.mu";
 async function login() {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     const server = createServer(async (req, res) => {
       if (req.method === "POST" && req.url?.startsWith("/callback")) {
         let body = "";
@@ -70,7 +70,7 @@ async function login() {
   </div>
 </body></html>`);
         server.close();
-        resolve2();
+        resolve3();
       } else {
         res.writeHead(404);
         res.end();
@@ -105,12 +105,12 @@ import { createClient } from "@supabase/supabase-js";
 import { existsSync as existsSync2, writeFileSync as writeFileSync2, unlinkSync as unlinkSync2, readFileSync as readFileSync2, mkdirSync as mkdirSync2 } from "fs";
 import { dirname } from "path";
 var SUPABASE_URL = process.env.ODIN_SUPABASE_URL ?? "https://vdiwtiiksdyhlibqrngw.supabase.co";
-var SUPABASE_ANON_KEY = process.env.ODIN_SUPABASE_ANON_KEY ?? "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InZkaXd0aWlrc2R5aGxpYnFybmd3Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzM2ODM4NDksImV4cCI6MjA4OTI1OTg0OX0.gAccODqqhBnL_npqG7H42EvaT2CWR1P2pqo5NVjKFas";
+var SUPABASE_PUBLISHABLE_KEY = process.env.ODIN_SUPABASE_PUBLISHABLE_KEY ?? "sb_publishable_qTgDHReuOlNcsxm_r7PIrg_K-EV3F7a";
 var REFRESH_THRESHOLD_SECONDS = 900;
 var LOCK_PATH = CREDENTIALS_PATH + ".lock";
 var LOCK_STALE_MS = 1e4;
 function createNodeClient() {
-  return createClient(SUPABASE_URL, SUPABASE_ANON_KEY, {
+  return createClient(SUPABASE_URL, SUPABASE_PUBLISHABLE_KEY, {
     auth: {
       autoRefreshToken: false,
       persistSession: false
@@ -281,8 +281,15 @@ docsCmd.command("create <slug> <type>").description("Create a document").require
   process.stdout.write(JSON.stringify(res) + "\n");
   if (res.error) process.exit(1);
 });
-docsCmd.command("delete <slug> <type>").description("Delete a document").action(async (slug, type) => {
-  const res = await apiRequest(`/pebbles/${slug}/documents/${type}`, {
+docsCmd.command("delete <slug> [type]").description("Delete a document by type, or by --id (unambiguous)").option("--id <id>", "Delete a specific document by its UUID").action(async (slug, type, opts) => {
+  if (!opts.id && !type) {
+    process.stdout.write(
+      JSON.stringify({ data: null, error: "Provide a <type> or --id <uuid> to delete" }) + "\n"
+    );
+    process.exit(1);
+  }
+  const path = opts.id ? `/pebbles/${slug}/documents/id/${opts.id}` : `/pebbles/${slug}/documents/${type}`;
+  const res = await apiRequest(path, {
     method: "DELETE"
   });
   process.stdout.write(JSON.stringify(res) + "\n");
@@ -858,12 +865,21 @@ blueprintsCmd.command("deprecate <id>").description("Deprecate a blueprint").act
   process.stdout.write(JSON.stringify(res) + "\n");
   if (res.error) process.exit(1);
 });
-blueprintsCmd.command("add-asset <id>").description("Add an asset reference to a blueprint").requiredOption("--title <title>", "Asset title").requiredOption("--url <url>", "Asset URL").option("--type <type>", "Asset type (screenshot|diagram|code-snippet|figma-link|github-link|raw-text|other)", "other").option("--description <description>", "Asset description").action(async (id, opts) => {
+blueprintsCmd.command("add-asset <id>").description("Add an asset reference or inline content to a blueprint").requiredOption("--title <title>", "Asset title").option("--url <url>", "Asset URL (optional if content provided)").option("--content <content>", "Inline content string").option("--content-file <path>", "Read content from file").option("--type <type>", "Asset type (screenshot|diagram|code-snippet|figma-link|github-link|raw-text|visual-spec|other)", "other").option("--description <description>", "Asset description").action(async (id, opts) => {
+  let content = opts.content;
+  if (opts.contentFile) {
+    content = readFileSync9(opts.contentFile, "utf-8");
+  }
+  if (!opts.url && !content) {
+    process.stderr.write("Error: at least one of --url, --content, or --content-file is required\n");
+    process.exit(1);
+  }
   const res = await apiRequest(`/blueprints/${id}/assets`, {
     method: "POST",
     body: {
       title: opts.title,
-      asset_url: opts.url,
+      asset_url: opts.url || null,
+      content: content || null,
       type: opts.type,
       description: opts.description ?? ""
     }
@@ -1151,12 +1167,553 @@ personaRunsCmd.command("capture").description("Read marker + transcript, compute
   process.stdout.write(JSON.stringify(res.data) + "\n");
 });
 
-// src/index.ts
+// src/commands/blog.ts
+import { Command as Command18 } from "commander";
 import { readFileSync as readFileSync13 } from "fs";
+var blogCmd = new Command18("blog").description("Manage blog posts");
+blogCmd.command("list <slug>").description("List blog posts for a pebble").option("--status <status>", "Filter by status (draft, review, published, archived)").option("--tag <tag>", "Filter by tag").option("--page <page>", "Page number", "1").option("--per-page <perPage>", "Results per page", "20").action(async (slug, opts) => {
+  const params = {};
+  if (opts.status) params.status = opts.status;
+  if (opts.tag) params.tag = opts.tag;
+  params.page = opts.page;
+  params.per_page = opts.perPage;
+  const res = await apiRequest(`/pebbles/${slug}/blog`, { params });
+  process.stdout.write(JSON.stringify(res) + "\n");
+  if (res.error) process.exit(1);
+});
+blogCmd.command("get <slug> <idOrSlug>").description("Get a blog post by UUID or slug").action(async (slug, idOrSlug) => {
+  const res = await apiRequest(`/pebbles/${slug}/blog/${idOrSlug}`);
+  process.stdout.write(JSON.stringify(res) + "\n");
+  if (res.error) process.exit(1);
+});
+blogCmd.command("create <slug> <title>").description("Create a blog post").requiredOption("--post-slug <postSlug>", "URL slug for the post").option("--blocks <blocks>", "Content blocks as JSON string").option("--file <path>", "Read content blocks from JSON file").option("--status <status>", "Initial status (draft, review)", "draft").option("--metadata <metadata>", "Post metadata as JSON string").option("--campaign-id <campaignId>", "Link to a marketing campaign").action(async (slug, title, opts) => {
+  let blocks = [];
+  if (opts.file) {
+    blocks = JSON.parse(readFileSync13(opts.file, "utf-8"));
+  } else if (opts.blocks) {
+    blocks = JSON.parse(opts.blocks);
+  }
+  const body = {
+    title,
+    slug: opts.postSlug,
+    blocks,
+    status: opts.status
+  };
+  if (opts.metadata) body.metadata = JSON.parse(opts.metadata);
+  if (opts.campaignId) body.campaign_id = opts.campaignId;
+  const res = await apiRequest(`/pebbles/${slug}/blog`, {
+    method: "POST",
+    body
+  });
+  process.stdout.write(JSON.stringify(res) + "\n");
+  if (res.error) process.exit(1);
+});
+blogCmd.command("update <slug> <id>").description("Update a blog post").option("--title <title>", "New title").option("--post-slug <postSlug>", "New URL slug").option("--blocks <blocks>", "Content blocks as JSON string").option("--file <path>", "Read content blocks from JSON file").option("--status <status>", "New status (draft, review, published, archived)").option("--metadata <metadata>", "Post metadata as JSON string").action(async (slug, id, opts) => {
+  const body = {};
+  if (opts.title) body.title = opts.title;
+  if (opts.postSlug) body.slug = opts.postSlug;
+  if (opts.file) body.blocks = JSON.parse(readFileSync13(opts.file, "utf-8"));
+  else if (opts.blocks) body.blocks = JSON.parse(opts.blocks);
+  if (opts.status) body.status = opts.status;
+  if (opts.metadata) body.metadata = JSON.parse(opts.metadata);
+  const res = await apiRequest(`/pebbles/${slug}/blog/${id}`, {
+    method: "PUT",
+    body
+  });
+  process.stdout.write(JSON.stringify(res) + "\n");
+  if (res.error) process.exit(1);
+});
+blogCmd.command("delete <slug> <id>").description("Delete a blog post").action(async (slug, id) => {
+  const res = await apiRequest(`/pebbles/${slug}/blog/${id}`, {
+    method: "DELETE"
+  });
+  process.stdout.write(JSON.stringify(res) + "\n");
+  if (res.error) process.exit(1);
+});
+
+// src/commands/api-keys.ts
+import { Command as Command19 } from "commander";
+var apiKeysCmd = new Command19("api-keys").description("Manage API keys for server-to-server access");
+apiKeysCmd.command("list <slug>").description("List API keys for a pebble").action(async (slug) => {
+  const res = await apiRequest(`/pebbles/${slug}/api-keys`);
+  process.stdout.write(JSON.stringify(res) + "\n");
+  if (res.error) process.exit(1);
+});
+apiKeysCmd.command("create <slug>").description("Create a new API key").requiredOption("--name <name>", "Human-readable key name").requiredOption("--scopes <scopes>", "Comma-separated scopes (e.g. blog:read,marketing_content:read)").option("--expires-at <expiresAt>", "Expiration timestamp (ISO 8601)").action(async (slug, opts) => {
+  const scopes = opts.scopes.split(",").map((s) => s.trim());
+  const body = { name: opts.name, scopes };
+  if (opts.expiresAt) body.expires_at = opts.expiresAt;
+  const res = await apiRequest(`/pebbles/${slug}/api-keys`, {
+    method: "POST",
+    body
+  });
+  process.stdout.write(JSON.stringify(res) + "\n");
+  if (res.error) process.exit(1);
+  if (res.data?.key) {
+    process.stderr.write(
+      `
+  Store this key securely -- it cannot be retrieved again:
+  ${res.data.key}
+
+`
+    );
+  }
+});
+apiKeysCmd.command("revoke <slug> <id>").description("Revoke an API key").action(async (slug, id) => {
+  const res = await apiRequest(`/pebbles/${slug}/api-keys/${id}/revoke`, {
+    method: "POST"
+  });
+  process.stdout.write(JSON.stringify(res) + "\n");
+  if (res.error) process.exit(1);
+});
+apiKeysCmd.command("delete <slug> <id>").description("Permanently delete an API key").action(async (slug, id) => {
+  const res = await apiRequest(`/pebbles/${slug}/api-keys/${id}`, {
+    method: "DELETE"
+  });
+  process.stdout.write(JSON.stringify(res) + "\n");
+  if (res.error) process.exit(1);
+});
+
+// src/commands/pebble/index.ts
+import { Command as Command20 } from "commander";
+
+// src/commands/pebble/provisioner.ts
+async function runProvisioner(ctx, steps) {
+  const report = { steps: [], captured: ctx.captured };
+  for (const step of steps) {
+    let result;
+    const checked = await step.check(ctx);
+    if (checked && checked.status === "satisfied") result = checked;
+    else if (checked && checked.status === "blocked") result = checked;
+    else result = await step.apply(ctx);
+    if (result.data) {
+      Object.assign(ctx.captured, result.data);
+    }
+    report.steps.push({
+      id: step.id,
+      label: step.label,
+      status: result.status,
+      detail: result.detail
+    });
+    if (result.status === "blocked") return { report, halted: true };
+    if (result.status === "failed") return { report, halted: true };
+  }
+  return { report, halted: false };
+}
+
+// src/commands/pebble/exec.ts
+import { execFile } from "child_process";
+function run(cmd, args, opts = {}) {
+  return new Promise((resolve3) => {
+    execFile(cmd, args, { cwd: opts.cwd, encoding: "utf-8" }, (err, stdout, stderr) => {
+      const code = err && typeof err.code === "number" ? err.code : err ? 1 : 0;
+      resolve3({ ok: code === 0, stdout: stdout ?? "", stderr: stderr ?? "", code });
+    });
+  });
+}
+
+// src/commands/pebble/steps/doppler.ts
+var dopplerStep = {
+  id: "doppler",
+  label: "Doppler project + dev/prd configs",
+  async check(ctx) {
+    const cli = await run("doppler", ["--version"]);
+    if (!cli.ok) {
+      return { status: "blocked", detail: "Doppler CLI not found. Install + run `doppler login`." };
+    }
+    const got = await run("doppler", ["projects", "get", ctx.slug]);
+    return got.ok ? { status: "satisfied", detail: `Project ${ctx.slug} exists` } : null;
+  },
+  async apply(ctx) {
+    if (ctx.dryRun) {
+      return {
+        status: "applied",
+        detail: `[dry-run] would create Doppler project ${ctx.slug} + dev/prd configs`
+      };
+    }
+    const c = await run("doppler", ["projects", "create", ctx.slug]);
+    if (!c.ok) return { status: "failed", detail: `doppler projects create failed: ${c.stderr}` };
+    await run("doppler", ["configs", "create", "dev", "-p", ctx.slug]);
+    await run("doppler", ["configs", "create", "prd", "-p", ctx.slug]);
+    return { status: "applied", detail: `Created Doppler project ${ctx.slug} + dev/prd configs` };
+  }
+};
+
+// src/commands/pebble/steps/github.ts
+import { spawn } from "child_process";
+import { resolve } from "path";
+var ORG = "pebblehouse";
+var TEMPLATE = "pebblehouse/pebble-template";
+var githubRepoStep = {
+  id: "github",
+  label: "GitHub repo from pebble-template",
+  async check(ctx) {
+    const cli = await run("gh", ["--version"]);
+    if (!cli.ok) {
+      return { status: "blocked", detail: "GitHub CLI not found. Install + run `gh auth login`." };
+    }
+    const view = await run("gh", ["repo", "view", `${ORG}/${ctx.slug}`]);
+    if (view.ok) {
+      const repoDir = ctx.repoDir ?? resolve(ctx.repoDir ?? ".", ctx.slug);
+      return {
+        status: "satisfied",
+        detail: `Repo ${ORG}/${ctx.slug} exists`,
+        data: { repoDir }
+      };
+    }
+    return null;
+  },
+  async apply(ctx) {
+    if (ctx.dryRun) {
+      return {
+        status: "applied",
+        detail: `[dry-run] would create ${ORG}/${ctx.slug} from ${TEMPLATE}`
+      };
+    }
+    const parent = ctx.repoDir ?? ".";
+    const c = await run(
+      "gh",
+      [
+        "repo",
+        "create",
+        `${ORG}/${ctx.slug}`,
+        "--template",
+        TEMPLATE,
+        "--private",
+        "--clone"
+      ],
+      { cwd: parent }
+    );
+    if (!c.ok) return { status: "failed", detail: `gh repo create failed: ${c.stderr}` };
+    const repoDir = resolve(parent, ctx.slug);
+    return {
+      status: "applied",
+      detail: `Created ${ORG}/${ctx.slug} and cloned to ${repoDir}`,
+      data: { repoDir }
+    };
+  }
+};
+var githubSecretStep = {
+  id: "github-secret",
+  label: "GitHub Actions secret DOPPLER_TOKEN_PRD",
+  async check(ctx) {
+    const cli = await run("gh", ["--version"]);
+    if (!cli.ok) {
+      return { status: "blocked", detail: "GitHub CLI not found. Install + run `gh auth login`." };
+    }
+    const list = await run("gh", ["secret", "list", "-R", `${ORG}/${ctx.slug}`]);
+    if (list.ok && /DOPPLER_TOKEN_PRD/.test(list.stdout)) {
+      return { status: "satisfied", detail: "DOPPLER_TOKEN_PRD already set" };
+    }
+    return null;
+  },
+  async apply(ctx) {
+    if (ctx.dryRun) {
+      return {
+        status: "applied",
+        detail: "[dry-run] would mint scoped prd token and set DOPPLER_TOKEN_PRD"
+      };
+    }
+    const token = await run("doppler", [
+      "configs",
+      "tokens",
+      "create",
+      "ci",
+      "-p",
+      ctx.slug,
+      "-c",
+      "prd",
+      "--plain"
+    ]);
+    if (!token.ok) {
+      return { status: "failed", detail: `doppler token mint failed: ${token.stderr}` };
+    }
+    const set = await setSecretViaStdin(
+      ["secret", "set", "DOPPLER_TOKEN_PRD", "-R", `${ORG}/${ctx.slug}`],
+      token.stdout.trim()
+    );
+    if (!set.ok) {
+      return { status: "failed", detail: `gh secret set failed: ${set.stderr}` };
+    }
+    return { status: "applied", detail: "Set DOPPLER_TOKEN_PRD (read-only prd token)" };
+  }
+};
+function setSecretViaStdin(args, value) {
+  return new Promise((resolvePromise) => {
+    const child = spawn("gh", args, { stdio: ["pipe", "ignore", "pipe"] });
+    let stderr = "";
+    child.stderr.on("data", (d) => {
+      stderr += d.toString();
+    });
+    child.on("error", (e) => resolvePromise({ ok: false, stderr: e.message }));
+    child.on("close", (code) => resolvePromise({ ok: code === 0, stderr }));
+    child.stdin.write(value);
+    child.stdin.end();
+  });
+}
+
+// src/commands/pebble/steps/vercel.ts
+var vercelStep = {
+  id: "vercel",
+  label: "Vercel project",
+  async check(ctx) {
+    const cli = await run("vercel", ["--version"]);
+    if (!cli.ok) {
+      return { status: "blocked", detail: "Vercel CLI not found. Install + run `vercel login`." };
+    }
+    const list = await run("vercel", ["project", "ls"]);
+    if (list.ok && new RegExp(`(^|\\s)${ctx.slug}(\\s|$)`, "m").test(list.stdout)) {
+      return { status: "satisfied", detail: `Vercel project ${ctx.slug} exists` };
+    }
+    return null;
+  },
+  async apply(ctx) {
+    if (ctx.dryRun) {
+      return { status: "applied", detail: `[dry-run] would add Vercel project ${ctx.slug}` };
+    }
+    const c = await run("vercel", ["project", "add", ctx.slug]);
+    if (!c.ok) return { status: "failed", detail: `vercel project add failed: ${c.stderr}` };
+    return { status: "applied", detail: `Added Vercel project ${ctx.slug}` };
+  }
+};
+
+// src/commands/pebble/steps/r2.ts
+var bucketName = (slug) => `${slug}-tfstate`;
+var r2Step = {
+  id: "r2",
+  label: "Cloudflare R2 tfstate bucket",
+  async check(ctx) {
+    const cli = await run("wrangler", ["--version"]);
+    if (!cli.ok) {
+      return { status: "blocked", detail: "Wrangler CLI not found. Install + run `wrangler login`." };
+    }
+    const list = await run("wrangler", ["r2", "bucket", "list"]);
+    if (list.ok && list.stdout.includes(bucketName(ctx.slug))) {
+      return { status: "satisfied", detail: `Bucket ${bucketName(ctx.slug)} exists` };
+    }
+    return null;
+  },
+  async apply(ctx) {
+    if (ctx.dryRun) {
+      return {
+        status: "applied",
+        detail: `[dry-run] would create R2 bucket ${bucketName(ctx.slug)} + store S3 creds to Doppler prd`
+      };
+    }
+    const c = await run("wrangler", ["r2", "bucket", "create", bucketName(ctx.slug)]);
+    if (!c.ok) return { status: "failed", detail: `r2 bucket create failed: ${c.stderr}` };
+    return {
+      status: "applied",
+      detail: `Created R2 bucket ${bucketName(ctx.slug)}`,
+      data: { tfstate_bucket: bucketName(ctx.slug) }
+    };
+  }
+};
+
+// src/commands/pebble/steps/supabase.ts
+var supabaseStep = {
+  id: "supabase",
+  label: "Supabase project",
+  async check(ctx) {
+    const cli = await run("supabase", ["--version"]);
+    if (!cli.ok) {
+      return { status: "blocked", detail: "Supabase CLI not found. Install + run `supabase login`." };
+    }
+    const list = await run("supabase", ["projects", "list"]);
+    if (list.ok && new RegExp(`(^|\\s)${ctx.slug}(\\s|$)`, "m").test(list.stdout)) {
+      return { status: "satisfied", detail: `Supabase project ${ctx.slug} exists` };
+    }
+    return null;
+  },
+  async apply(ctx) {
+    if (ctx.dryRun) {
+      return { status: "applied", detail: `[dry-run] would create Supabase project ${ctx.slug}` };
+    }
+    const c = await run("supabase", ["projects", "create", ctx.slug]);
+    if (!c.ok) return { status: "failed", detail: `supabase projects create failed: ${c.stderr}` };
+    const ref = parseRef(c.stdout);
+    return {
+      status: "applied",
+      detail: `Created Supabase project ${ctx.slug}${ref ? ` (${ref})` : ""}`,
+      data: ref ? { supabase_ref: ref } : void 0
+    };
+  }
+};
+function parseRef(stdout) {
+  const m = stdout.match(/[a-z]{20}/);
+  return m ? m[0] : void 0;
+}
+
+// src/commands/pebble/steps/resend.ts
+var resendStep = {
+  id: "resend",
+  label: "Resend sending domain (send-only)",
+  async check(ctx) {
+    const cli = await run("resend", ["--version"]);
+    if (!cli.ok) {
+      return {
+        status: "blocked",
+        detail: "Resend CLI not found / not configured. Set RESEND_API_KEY and install the CLI."
+      };
+    }
+    const list = await run("resend", ["domains", "list"]);
+    if (list.ok && list.stdout.includes(ctx.slug)) {
+      return { status: "satisfied", detail: `Resend sending domain for ${ctx.slug} exists` };
+    }
+    return null;
+  },
+  async apply(ctx) {
+    if (ctx.dryRun) {
+      return {
+        status: "applied",
+        detail: `[dry-run] would create Resend sending domain for ${ctx.slug} (send-only)`
+      };
+    }
+    const c = await run("resend", ["domains", "create", ctx.slug]);
+    if (!c.ok) return { status: "failed", detail: `resend domains create failed: ${c.stderr}` };
+    return { status: "applied", detail: `Created Resend sending domain for ${ctx.slug} (send-only)` };
+  }
+};
+
+// src/commands/pebble/steps/stripe.ts
+var stripeStep = {
+  id: "stripe",
+  label: "Stripe account (conditional)",
+  async check() {
+    return { status: "satisfied", detail: "conditional \u2014 evaluate in init bet" };
+  },
+  async apply() {
+    return { status: "satisfied", detail: "conditional \u2014 evaluate in init bet" };
+  }
+};
+
+// src/commands/pebble/steps/index.ts
+var CORE_STEPS = [
+  dopplerStep,
+  githubRepoStep,
+  vercelStep,
+  r2Step,
+  supabaseStep,
+  resendStep,
+  githubSecretStep
+];
+var STEP_REGISTRY = {
+  doppler: dopplerStep,
+  github: githubRepoStep,
+  vercel: vercelStep,
+  r2: r2Step,
+  supabase: supabaseStep,
+  resend: resendStep,
+  stripe: stripeStep
+};
+
+// src/commands/pebble/init-bet.ts
+function renderInitBetBody(slug, report) {
+  const rows = report.steps.map((s) => `| ${s.id} | ${s.status} | ${s.detail} |`).join("\n");
+  return `# Initialize ${slug}
+
+## Problem
+\`${slug}\` is genesis'd from \`pebble-template\` with the full IaC spine (PLACEHOLDER_* values), but its real stack is unknown. \`infra-apply\` is OFF until the spine is tailored to the actual stack.
+
+## Solution
+1. Interview the actual stack (which providers/workflows this pebble needs).
+2. Trim the template's tofu modules + workflow set to match; remove dangling refs in \`main.tf\`/\`variables.tf\`.
+3. Provision any conditional providers via \`odin pebble provision <provider> ${slug}\`.
+4. Worktree eval + run the test suite.
+5. Flip the deploy-ready signal so \`infra-apply\` runs on merge.
+
+## Constraints
+- Brownfield-safe; never blow away live resources.
+- No plaintext secrets or tfstate in git.
+- Reuse the codified IaC standard (blueprint 36839408 + pebble-template); no parallel layout.
+
+## Success Looks Like
+- Clean no-op \`tofu plan\`.
+- \`infra-apply\` flipped on and green on merge.
+- Test suite passes.
+
+### Provisioned day-one
+| Provider | Status | Detail |
+|---|---|---|
+${rows}
+
+### Conditional providers to evaluate
+- [ ] stripe (only if this pebble takes payments)
+- [ ] Resend inbound / email-routing (only if this pebble receives mail)
+- [ ] any tail provider specific to the stack
+`;
+}
+
+// src/commands/pebble/new.ts
+async function runNew(name, opts) {
+  const slug = name.toLowerCase().replace(/[^a-z0-9-]/g, "-");
+  const created = await apiRequest("/pebbles", {
+    method: "POST",
+    body: { slug, name }
+  });
+  if (created.error && !/already exists/i.test(created.error)) {
+    console.error(created.error);
+    return 1;
+  }
+  const ctx = {
+    slug,
+    name,
+    repoDir: opts.dir ?? null,
+    dryRun: !!opts.dryRun,
+    captured: {}
+  };
+  const { report, halted } = await runProvisioner(ctx, CORE_STEPS);
+  const last = report.steps[report.steps.length - 1];
+  process.stdout.write(JSON.stringify({ slug, report }) + "\n");
+  if (halted && last?.status === "failed") return 1;
+  if (halted && last?.status === "blocked") {
+    process.stderr.write(`
+Paused: ${last.detail}
+Re-run \`odin pebble new ${name}\` after acting.
+`);
+    return 0;
+  }
+  const body = renderInitBetBody(slug, report);
+  const bet = await apiRequest(`/pebbles/${slug}/bets`, {
+    method: "POST",
+    body: { title: `Initialize ${slug}`, source: "odin-cli", content: body, status: "shaped" }
+  });
+  process.stdout.write(JSON.stringify(bet) + "\n");
+  if (opts.run && bet.data?.id) {
+    process.stderr.write(`
+Hand off: /odin:eng-manager bet:${bet.data.id}
+`);
+  }
+  return 0;
+}
+
+// src/commands/pebble/index.ts
+var pebbleCmd = new Command20("pebble").description(
+  "Provision and initialize pebbles (eng-infra, run-once)"
+);
+pebbleCmd.command("new <name>").description("Provision a new pebble from pebble-template (day-one)").option("--run", "Hand off to eng-manager on the init bet").option("--dir <path>", "Parent dir to clone into").option("--dry-run", "Print the plan; mutate nothing").action(async (name, opts) => {
+  process.exit(await runNew(name, { run: opts.run, dir: opts.dir, dryRun: opts.dryRun }));
+});
+pebbleCmd.command("provision <provider> <slug>").description("Run one provider step against an existing pebble").option("--dry-run", "Print; mutate nothing").action(async (provider, slug, opts) => {
+  const step = STEP_REGISTRY[provider];
+  if (!step) {
+    console.error(`Unknown provider: ${provider}`);
+    process.exit(1);
+  }
+  const { report, halted } = await runProvisioner(
+    { slug, name: slug, repoDir: null, dryRun: !!opts.dryRun, captured: {} },
+    [step]
+  );
+  process.stdout.write(JSON.stringify(report) + "\n");
+  process.exit(halted && report.steps[0]?.status === "failed" ? 1 : 0);
+});
+
+// src/index.ts
+import { readFileSync as readFileSync14 } from "fs";
 import { fileURLToPath } from "url";
-import { dirname as dirname2, resolve } from "path";
+import { dirname as dirname2, resolve as resolve2 } from "path";
 var __dirname = dirname2(fileURLToPath(import.meta.url));
-var pkg = JSON.parse(readFileSync13(resolve(__dirname, "../package.json"), "utf-8"));
+var pkg = JSON.parse(readFileSync14(resolve2(__dirname, "../package.json"), "utf-8"));
 var GOLD = "\x1B[33m";
 var DIM = "\x1B[2m";
 var RESET = "\x1B[0m";
@@ -1174,7 +1731,7 @@ ${RESET}
   ${DIM}${cwd}${RESET}
 `);
 }
-var program = new Command18();
+var program = new Command21();
 program.name("odin").description("CLI for Odin \u2014 the knowledge backbone for Pebble House").version(VERSION);
 program.command("login").description("Authenticate with Odin via browser").action(async () => {
   printBanner();
@@ -1206,6 +1763,9 @@ program.addCommand(betsCmd);
 program.addCommand(tasksCmd);
 program.addCommand(roadmapsCmd);
 program.addCommand(personaRunsCmd);
+program.addCommand(blogCmd);
+program.addCommand(apiKeysCmd);
+program.addCommand(pebbleCmd);
 process.on("exit", () => {
   process.stderr.write("\n\n\n\n\n");
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pebblehouse/odin-cli",
-  "version": "0.10.2",
+  "version": "0.13.0",
   "type": "module",
   "description": "CLI for Odin — the knowledge backbone for Pebble House",
   "bin": {
@@ -34,7 +34,7 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@supabase/supabase-js": "^2.47.10",
+    "@supabase/supabase-js": "^2.105.0",
     "commander": "^12.0.0",
     "open": "^10.0.0"
   },