@pebblehouse/odin-cli 0.12.0 → 0.14.0

package/README.md

@@ -82,7 +82,7 @@ All commands output JSON to stdout. Errors go to stderr with non-zero exit codes
 |----------|---------|-------------|
 | `ODIN_API_URL` | `https://www.odin.mu` | API base URL |
 | `ODIN_SUPABASE_URL` | — | Supabase URL (for token refresh) |
-| `ODIN_SUPABASE_ANON_KEY` | — | Supabase anon key (for token refresh) |
+| `ODIN_SUPABASE_PUBLISHABLE_KEY` | — | Supabase publishable key (for token refresh) |
 
 ## License
 

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { Command as Command20 } from "commander";
+import { Command as Command23 } from "commander";
 
 // src/auth/login.ts
 import { createServer } from "http";
@@ -37,7 +37,7 @@ function clearCredentials() {
 // src/auth/login.ts
 var API_URL = process.env.ODIN_API_URL ?? "https://www.odin.mu";
 async function login() {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     const server = createServer(async (req, res) => {
       if (req.method === "POST" && req.url?.startsWith("/callback")) {
         let body = "";
@@ -70,7 +70,7 @@ async function login() {
   </div>
 </body></html>`);
         server.close();
-        resolve2();
+        resolve3();
       } else {
         res.writeHead(404);
         res.end();
@@ -105,12 +105,12 @@ import { createClient } from "@supabase/supabase-js";
 import { existsSync as existsSync2, writeFileSync as writeFileSync2, unlinkSync as unlinkSync2, readFileSync as readFileSync2, mkdirSync as mkdirSync2 } from "fs";
 import { dirname } from "path";
 var SUPABASE_URL = process.env.ODIN_SUPABASE_URL ?? "https://vdiwtiiksdyhlibqrngw.supabase.co";
-var SUPABASE_ANON_KEY = process.env.ODIN_SUPABASE_ANON_KEY ?? "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InZkaXd0aWlrc2R5aGxpYnFybmd3Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzM2ODM4NDksImV4cCI6MjA4OTI1OTg0OX0.gAccODqqhBnL_npqG7H42EvaT2CWR1P2pqo5NVjKFas";
+var SUPABASE_PUBLISHABLE_KEY = process.env.ODIN_SUPABASE_PUBLISHABLE_KEY ?? "sb_publishable_qTgDHReuOlNcsxm_r7PIrg_K-EV3F7a";
 var REFRESH_THRESHOLD_SECONDS = 900;
 var LOCK_PATH = CREDENTIALS_PATH + ".lock";
 var LOCK_STALE_MS = 1e4;
 function createNodeClient() {
-  return createClient(SUPABASE_URL, SUPABASE_ANON_KEY, {
+  return createClient(SUPABASE_URL, SUPABASE_PUBLISHABLE_KEY, {
     auth: {
       autoRefreshToken: false,
       persistSession: false
@@ -974,9 +974,38 @@ betsCmd.command("delete <slug> <id>").description("Delete a bet").action(async (
 });
 betsCmd.addCommand(depsCmd);
 
-// src/commands/tasks.ts
+// src/commands/bet-comments.ts
 import { Command as Command15 } from "commander";
-var tasksCmd = new Command15("tasks").description("Manage tasks");
+import { readFileSync as readFileSync11 } from "fs";
+var betCommentsCmd = new Command15("bet-comments").description("Manage bet comments");
+betCommentsCmd.command("list <slug> <betId>").description("List comments for a bet (oldest first)").action(async (slug, betId) => {
+  const res = await apiRequest(`/pebbles/${slug}/bets/${betId}/comments`);
+  process.stdout.write(JSON.stringify(res) + "\n");
+  if (res.error) process.exit(1);
+});
+betCommentsCmd.command("create <slug> <betId> [body]").description("Post a comment on a bet (append-only)").option("--author-type <type>", "persona | human", "persona").option("--author-label <label>", "Verbatim author slug/handle").option("--parent <id>", "Reply to a top-level comment (one level only)").option("--kind <kind>", "metadata.kind: build-summary | escalation | note").option("--pipeline-stage <stage>", "metadata.pipeline_stage").option("--pr-url <url>", "metadata.pr_url").option("--file <path>", "Read body from file").action(async (slug, betId, body, opts) => {
+  const commentBody = opts.file ? readFileSync11(opts.file, "utf-8") : body ?? "";
+  const metadata = {};
+  if (opts.kind) metadata.kind = opts.kind;
+  if (opts.pipelineStage) metadata.pipeline_stage = opts.pipelineStage;
+  if (opts.prUrl) metadata.pr_url = opts.prUrl;
+  const res = await apiRequest(`/pebbles/${slug}/bets/${betId}/comments`, {
+    method: "POST",
+    body: {
+      author_type: opts.authorType,
+      author_label: opts.authorLabel,
+      body: commentBody,
+      parent_comment_id: opts.parent,
+      metadata: Object.keys(metadata).length ? metadata : void 0
+    }
+  });
+  process.stdout.write(JSON.stringify(res) + "\n");
+  if (res.error) process.exit(1);
+});
+
+// src/commands/tasks.ts
+import { Command as Command16 } from "commander";
+var tasksCmd = new Command16("tasks").description("Manage tasks");
 tasksCmd.command("list <slug>").description("List tasks for a pebble").option("--status <status>", "Filter by status").option("--bet <bet-id>", "Filter by bet ID").action(async (slug, opts) => {
   const params = {};
   if (opts.status) params.status = opts.status;
@@ -1021,9 +1050,9 @@ tasksCmd.command("delete <slug> <id>").description("Delete a task").action(async
 });
 
 // src/commands/roadmaps.ts
-import { Command as Command16 } from "commander";
-import { readFileSync as readFileSync11 } from "fs";
-var roadmapsCmd = new Command16("roadmaps").description("Manage roadmaps");
+import { Command as Command17 } from "commander";
+import { readFileSync as readFileSync12 } from "fs";
+var roadmapsCmd = new Command17("roadmaps").description("Manage roadmaps");
 roadmapsCmd.command("list <slug>").description("List roadmaps for a pebble").option("--status <status>", "Filter by status").action(async (slug, opts) => {
   const params = {};
   if (opts.status) params.status = opts.status;
@@ -1037,7 +1066,7 @@ roadmapsCmd.command("get <slug> <id>").description("Get a roadmap by ID (include
   if (res.error) process.exit(1);
 });
 roadmapsCmd.command("create <slug> <title>").description("Create a roadmap").option("--source <source>", "Source agent", "claude-code").option("--content <content>", "Roadmap content").option("--file <path>", "Read content from file").option("--status <status>", "Roadmap status").action(async (slug, title, opts) => {
-  const content = opts.file ? readFileSync11(opts.file, "utf-8") : opts.content ?? "";
+  const content = opts.file ? readFileSync12(opts.file, "utf-8") : opts.content ?? "";
   const res = await apiRequest(`/pebbles/${slug}/roadmaps`, {
     method: "POST",
     body: { title, source: opts.source, content, status: opts.status }
@@ -1048,7 +1077,7 @@ roadmapsCmd.command("create <slug> <title>").description("Create a roadmap").opt
 roadmapsCmd.command("update <slug> <id>").description("Update a roadmap").option("--title <title>", "New title").option("--content <content>", "New content").option("--file <path>", "Read content from file").option("--status <status>", "New status").action(async (slug, id, opts) => {
   const body = {};
   if (opts.title) body.title = opts.title;
-  if (opts.file) body.content = readFileSync11(opts.file, "utf-8");
+  if (opts.file) body.content = readFileSync12(opts.file, "utf-8");
   else if (opts.content) body.content = opts.content;
   if (opts.status) body.status = opts.status;
   const res = await apiRequest(`/pebbles/${slug}/roadmaps/${id}`, {
@@ -1067,11 +1096,11 @@ roadmapsCmd.command("delete <slug> <id>").description("Delete a roadmap").action
 });
 
 // src/commands/persona-runs.ts
-import { Command as Command17 } from "commander";
-import { readFileSync as readFileSync12 } from "fs";
+import { Command as Command18 } from "commander";
+import { readFileSync as readFileSync13 } from "fs";
 import { join as join2 } from "path";
 import { homedir as homedir2 } from "os";
-var personaRunsCmd = new Command17("persona-runs").description(
+var personaRunsCmd = new Command18("persona-runs").description(
   "Manage per-persona per-session token usage rows"
 );
 personaRunsCmd.command("list <slug>").description("List persona runs for a pebble").option("--bet-id <id>", "Filter by bet_id").option("--plan-id <id>", "Filter by plan_id").option("--persona <name>", "Filter by persona name").option("--limit <n>", "Max rows", "50").action(async (slug, opts) => {
@@ -1095,7 +1124,7 @@ personaRunsCmd.command("get <slug> <id>").description("Get a persona run by id")
   if (res.error) process.exit(1);
 });
 personaRunsCmd.command("create <slug>").description("Create/upsert a persona run from a JSON file").requiredOption("--file <path>", "JSON payload matching PersonaRunCreate").action(async (slug, opts) => {
-  const body = JSON.parse(readFileSync12(opts.file, "utf-8"));
+  const body = JSON.parse(readFileSync13(opts.file, "utf-8"));
   const res = await apiRequest(`/pebbles/${slug}/persona-runs`, {
     method: "POST",
     body
@@ -1107,7 +1136,7 @@ personaRunsCmd.command("capture").description("Read marker + transcript, compute
   const markerPath = opts.marker ?? join2(homedir2(), ".claude", "odin-context", `${opts.sessionId}.json`);
   let marker = {};
   try {
-    marker = JSON.parse(readFileSync12(markerPath, "utf-8"));
+    marker = JSON.parse(readFileSync13(markerPath, "utf-8"));
   } catch {
     process.exit(0);
   }
@@ -1117,7 +1146,7 @@ personaRunsCmd.command("capture").description("Read marker + transcript, compute
   let input = 0, output = 0, cacheRead = 0, cacheCreate = 0;
   let minTs = null, maxTs = null;
   try {
-    const raw = readFileSync12(opts.transcript, "utf-8");
+    const raw = readFileSync13(opts.transcript, "utf-8");
     for (const line of raw.split("\n")) {
       if (!line.trim()) continue;
       let obj;
@@ -1168,10 +1197,10 @@ personaRunsCmd.command("capture").description("Read marker + transcript, compute
 });
 
 // src/commands/blog.ts
-import { Command as Command18 } from "commander";
-import { readFileSync as readFileSync13 } from "fs";
-var blogCmd = new Command18("blog").description("Manage blog posts");
-blogCmd.command("list <slug>").description("List blog posts for a pebble").option("--status <status>", "Filter by status (draft, review, published, archived)").option("--tag <tag>", "Filter by tag").option("--page <page>", "Page number", "1").option("--per-page <perPage>", "Results per page", "20").action(async (slug, opts) => {
+import { Command as Command19 } from "commander";
+import { readFileSync as readFileSync14 } from "fs";
+var blogCmd = new Command19("blog").description("Manage blog posts");
+blogCmd.command("list <slug>").description("List blog posts for a pebble").option("--status <status>", "Filter by status (draft, review, scheduled, published, archived)").option("--tag <tag>", "Filter by tag").option("--page <page>", "Page number", "1").option("--per-page <perPage>", "Results per page", "20").action(async (slug, opts) => {
   const params = {};
   if (opts.status) params.status = opts.status;
   if (opts.tag) params.tag = opts.tag;
@@ -1186,10 +1215,10 @@ blogCmd.command("get <slug> <idOrSlug>").description("Get a blog post by UUID or
   process.stdout.write(JSON.stringify(res) + "\n");
   if (res.error) process.exit(1);
 });
-blogCmd.command("create <slug> <title>").description("Create a blog post").requiredOption("--post-slug <postSlug>", "URL slug for the post").option("--blocks <blocks>", "Content blocks as JSON string").option("--file <path>", "Read content blocks from JSON file").option("--status <status>", "Initial status (draft, review)", "draft").option("--metadata <metadata>", "Post metadata as JSON string").option("--campaign-id <campaignId>", "Link to a marketing campaign").action(async (slug, title, opts) => {
+blogCmd.command("create <slug> <title>").description("Create a blog post").requiredOption("--post-slug <postSlug>", "URL slug for the post").option("--blocks <blocks>", "Content blocks as JSON string").option("--file <path>", "Read content blocks from JSON file").option("--status <status>", "Initial status (draft, review, scheduled)", "draft").option("--scheduled-publish-at <iso>", "UTC ISO timestamp for scheduled publishing (required when --status scheduled)").option("--metadata <metadata>", "Post metadata as JSON string").option("--campaign-id <campaignId>", "Link to a marketing campaign").action(async (slug, title, opts) => {
   let blocks = [];
   if (opts.file) {
-    blocks = JSON.parse(readFileSync13(opts.file, "utf-8"));
+    blocks = JSON.parse(readFileSync14(opts.file, "utf-8"));
   } else if (opts.blocks) {
     blocks = JSON.parse(opts.blocks);
   }
@@ -1199,6 +1228,7 @@ blogCmd.command("create <slug> <title>").description("Create a blog post").requi
     blocks,
     status: opts.status
   };
+  if (opts.scheduledPublishAt) body.scheduled_publish_at = opts.scheduledPublishAt;
   if (opts.metadata) body.metadata = JSON.parse(opts.metadata);
   if (opts.campaignId) body.campaign_id = opts.campaignId;
   const res = await apiRequest(`/pebbles/${slug}/blog`, {
@@ -1208,13 +1238,15 @@ blogCmd.command("create <slug> <title>").description("Create a blog post").requi
   process.stdout.write(JSON.stringify(res) + "\n");
   if (res.error) process.exit(1);
 });
-blogCmd.command("update <slug> <id>").description("Update a blog post").option("--title <title>", "New title").option("--post-slug <postSlug>", "New URL slug").option("--blocks <blocks>", "Content blocks as JSON string").option("--file <path>", "Read content blocks from JSON file").option("--status <status>", "New status (draft, review, published, archived)").option("--metadata <metadata>", "Post metadata as JSON string").action(async (slug, id, opts) => {
+blogCmd.command("update <slug> <id>").description("Update a blog post").option("--title <title>", "New title").option("--post-slug <postSlug>", "New URL slug").option("--blocks <blocks>", "Content blocks as JSON string").option("--file <path>", "Read content blocks from JSON file").option("--status <status>", "New status (draft, review, scheduled, published, archived)").option("--scheduled-publish-at <iso>", "UTC ISO timestamp for scheduled publishing (required when --status scheduled). Pass empty string to clear.").option("--metadata <metadata>", "Post metadata as JSON string").action(async (slug, id, opts) => {
   const body = {};
   if (opts.title) body.title = opts.title;
   if (opts.postSlug) body.slug = opts.postSlug;
-  if (opts.file) body.blocks = JSON.parse(readFileSync13(opts.file, "utf-8"));
+  if (opts.file) body.blocks = JSON.parse(readFileSync14(opts.file, "utf-8"));
   else if (opts.blocks) body.blocks = JSON.parse(opts.blocks);
   if (opts.status) body.status = opts.status;
+  if (opts.scheduledPublishAt !== void 0)
+    body.scheduled_publish_at = opts.scheduledPublishAt === "" ? null : opts.scheduledPublishAt;
   if (opts.metadata) body.metadata = JSON.parse(opts.metadata);
   const res = await apiRequest(`/pebbles/${slug}/blog/${id}`, {
     method: "PUT",
@@ -1232,14 +1264,14 @@ blogCmd.command("delete <slug> <id>").description("Delete a blog post").action(a
 });
 
 // src/commands/api-keys.ts
-import { Command as Command19 } from "commander";
-var apiKeysCmd = new Command19("api-keys").description("Manage API keys for server-to-server access");
+import { Command as Command20 } from "commander";
+var apiKeysCmd = new Command20("api-keys").description("Manage API keys for server-to-server access");
 apiKeysCmd.command("list <slug>").description("List API keys for a pebble").action(async (slug) => {
   const res = await apiRequest(`/pebbles/${slug}/api-keys`);
   process.stdout.write(JSON.stringify(res) + "\n");
   if (res.error) process.exit(1);
 });
-apiKeysCmd.command("create <slug>").description("Create a new API key").requiredOption("--name <name>", "Human-readable key name").requiredOption("--scopes <scopes>", "Comma-separated scopes (e.g. blog:read,marketing_content:read)").option("--expires-at <expiresAt>", "Expiration timestamp (ISO 8601)").action(async (slug, opts) => {
+apiKeysCmd.command("create <slug>").description("Create a new API key").requiredOption("--name <name>", "Human-readable key name").requiredOption("--scopes <scopes>", "Comma-separated scopes (e.g. blog:read,marketing_content:read,faqs:read)").option("--expires-at <expiresAt>", "Expiration timestamp (ISO 8601)").action(async (slug, opts) => {
   const scopes = opts.scopes.split(",").map((s) => s.trim());
   const body = { name: opts.name, scopes };
   if (opts.expiresAt) body.expires_at = opts.expiresAt;
@@ -1274,12 +1306,922 @@ apiKeysCmd.command("delete <slug> <id>").description("Permanently delete an API
   if (res.error) process.exit(1);
 });
 
+// src/commands/pebble/index.ts
+import { Command as Command21 } from "commander";
+
+// src/commands/pebble/provisioner.ts
+async function runProvisioner(ctx, steps) {
+  const report = { steps: [], captured: ctx.captured };
+  for (const step of steps) {
+    let result;
+    const checked = await step.check(ctx);
+    if (checked && checked.status === "satisfied") result = checked;
+    else if (checked && checked.status === "blocked") result = checked;
+    else result = await step.apply(ctx);
+    if (result.data) {
+      Object.assign(ctx.captured, result.data);
+    }
+    report.steps.push({
+      id: step.id,
+      label: step.label,
+      status: result.status,
+      detail: result.detail
+    });
+    if (result.status === "blocked") return { report, halted: true };
+    if (result.status === "failed") return { report, halted: true };
+  }
+  return { report, halted: false };
+}
+
+// src/commands/pebble/exec.ts
+import { execFile } from "child_process";
+function run(cmd, args, opts = {}) {
+  return new Promise((resolve3) => {
+    execFile(cmd, args, { cwd: opts.cwd, encoding: "utf-8" }, (err, stdout2, stderr) => {
+      const code = err && typeof err.code === "number" ? err.code : err ? 1 : 0;
+      resolve3({ ok: code === 0, stdout: stdout2 ?? "", stderr: stderr ?? "", code });
+    });
+  });
+}
+
+// src/commands/pebble/steps/doppler.ts
+var dopplerStep = {
+  id: "doppler",
+  label: "Doppler project + dev/prd configs",
+  async check(ctx) {
+    const cli = await run("doppler", ["--version"]);
+    if (!cli.ok) {
+      return { status: "blocked", detail: "Doppler CLI not found. Install + run `doppler login`." };
+    }
+    const got = await run("doppler", ["projects", "get", ctx.slug]);
+    return got.ok ? { status: "satisfied", detail: `Project ${ctx.slug} exists` } : null;
+  },
+  async apply(ctx) {
+    if (ctx.dryRun) {
+      return {
+        status: "applied",
+        detail: `[dry-run] would create Doppler project ${ctx.slug} + dev/prd configs`
+      };
+    }
+    const c = await run("doppler", ["projects", "create", ctx.slug]);
+    if (!c.ok) return { status: "failed", detail: `doppler projects create failed: ${c.stderr}` };
+    await run("doppler", ["configs", "create", "dev", "-p", ctx.slug]);
+    await run("doppler", ["configs", "create", "prd", "-p", ctx.slug]);
+    return { status: "applied", detail: `Created Doppler project ${ctx.slug} + dev/prd configs` };
+  }
+};
+
+// src/commands/pebble/steps/github.ts
+import { spawn } from "child_process";
+import { resolve } from "path";
+var ORG = "pebblehouse";
+var TEMPLATE = "pebblehouse/pebble-template";
+var githubRepoStep = {
+  id: "github",
+  label: "GitHub repo from pebble-template",
+  async check(ctx) {
+    const cli = await run("gh", ["--version"]);
+    if (!cli.ok) {
+      return { status: "blocked", detail: "GitHub CLI not found. Install + run `gh auth login`." };
+    }
+    const view = await run("gh", ["repo", "view", `${ORG}/${ctx.slug}`]);
+    if (view.ok) {
+      const repoDir = ctx.repoDir ?? resolve(ctx.repoDir ?? ".", ctx.slug);
+      return {
+        status: "satisfied",
+        detail: `Repo ${ORG}/${ctx.slug} exists`,
+        data: { repoDir }
+      };
+    }
+    return null;
+  },
+  async apply(ctx) {
+    if (ctx.dryRun) {
+      return {
+        status: "applied",
+        detail: `[dry-run] would create ${ORG}/${ctx.slug} from ${TEMPLATE}`
+      };
+    }
+    const parent = ctx.repoDir ?? ".";
+    const c = await run(
+      "gh",
+      [
+        "repo",
+        "create",
+        `${ORG}/${ctx.slug}`,
+        "--template",
+        TEMPLATE,
+        "--private",
+        "--clone"
+      ],
+      { cwd: parent }
+    );
+    if (!c.ok) return { status: "failed", detail: `gh repo create failed: ${c.stderr}` };
+    const repoDir = resolve(parent, ctx.slug);
+    return {
+      status: "applied",
+      detail: `Created ${ORG}/${ctx.slug} and cloned to ${repoDir}`,
+      data: { repoDir }
+    };
+  }
+};
+var githubSecretStep = {
+  id: "github-secret",
+  label: "GitHub Actions secret DOPPLER_TOKEN_PRD",
+  async check(ctx) {
+    const cli = await run("gh", ["--version"]);
+    if (!cli.ok) {
+      return { status: "blocked", detail: "GitHub CLI not found. Install + run `gh auth login`." };
+    }
+    const list = await run("gh", ["secret", "list", "-R", `${ORG}/${ctx.slug}`]);
+    if (list.ok && /DOPPLER_TOKEN_PRD/.test(list.stdout)) {
+      return { status: "satisfied", detail: "DOPPLER_TOKEN_PRD already set" };
+    }
+    return null;
+  },
+  async apply(ctx) {
+    if (ctx.dryRun) {
+      return {
+        status: "applied",
+        detail: "[dry-run] would mint scoped prd token and set DOPPLER_TOKEN_PRD"
+      };
+    }
+    const token = await run("doppler", [
+      "configs",
+      "tokens",
+      "create",
+      "ci",
+      "-p",
+      ctx.slug,
+      "-c",
+      "prd",
+      "--plain"
+    ]);
+    if (!token.ok) {
+      return { status: "failed", detail: `doppler token mint failed: ${token.stderr}` };
+    }
+    const set = await setSecretViaStdin(
+      ["secret", "set", "DOPPLER_TOKEN_PRD", "-R", `${ORG}/${ctx.slug}`],
+      token.stdout.trim()
+    );
+    if (!set.ok) {
+      return { status: "failed", detail: `gh secret set failed: ${set.stderr}` };
+    }
+    return { status: "applied", detail: "Set DOPPLER_TOKEN_PRD (read-only prd token)" };
+  }
+};
+function setSecretViaStdin(args, value) {
+  return new Promise((resolvePromise) => {
+    const child = spawn("gh", args, { stdio: ["pipe", "ignore", "pipe"] });
+    let stderr = "";
+    child.stderr.on("data", (d) => {
+      stderr += d.toString();
+    });
+    child.on("error", (e) => resolvePromise({ ok: false, stderr: e.message }));
+    child.on("close", (code) => resolvePromise({ ok: code === 0, stderr }));
+    child.stdin.write(value);
+    child.stdin.end();
+  });
+}
+
+// src/commands/pebble/steps/vercel.ts
+var vercelStep = {
+  id: "vercel",
+  label: "Vercel project",
+  async check(ctx) {
+    const cli = await run("vercel", ["--version"]);
+    if (!cli.ok) {
+      return { status: "blocked", detail: "Vercel CLI not found. Install + run `vercel login`." };
+    }
+    const list = await run("vercel", ["project", "ls"]);
+    if (list.ok && new RegExp(`(^|\\s)${ctx.slug}(\\s|$)`, "m").test(list.stdout)) {
+      return { status: "satisfied", detail: `Vercel project ${ctx.slug} exists` };
+    }
+    return null;
+  },
+  async apply(ctx) {
+    if (ctx.dryRun) {
+      return { status: "applied", detail: `[dry-run] would add Vercel project ${ctx.slug}` };
+    }
+    const c = await run("vercel", ["project", "add", ctx.slug]);
+    if (!c.ok) return { status: "failed", detail: `vercel project add failed: ${c.stderr}` };
+    return { status: "applied", detail: `Added Vercel project ${ctx.slug}` };
+  }
+};
+
+// src/commands/pebble/steps/r2.ts
+var bucketName = (slug) => `${slug}-tfstate`;
+var r2Step = {
+  id: "r2",
+  label: "Cloudflare R2 tfstate bucket",
+  async check(ctx) {
+    const cli = await run("wrangler", ["--version"]);
+    if (!cli.ok) {
+      return { status: "blocked", detail: "Wrangler CLI not found. Install + run `wrangler login`." };
+    }
+    const list = await run("wrangler", ["r2", "bucket", "list"]);
+    if (list.ok && list.stdout.includes(bucketName(ctx.slug))) {
+      return { status: "satisfied", detail: `Bucket ${bucketName(ctx.slug)} exists` };
+    }
+    return null;
+  },
+  async apply(ctx) {
+    if (ctx.dryRun) {
+      return {
+        status: "applied",
+        detail: `[dry-run] would create R2 bucket ${bucketName(ctx.slug)} + store S3 creds to Doppler prd`
+      };
+    }
+    const c = await run("wrangler", ["r2", "bucket", "create", bucketName(ctx.slug)]);
+    if (!c.ok) return { status: "failed", detail: `r2 bucket create failed: ${c.stderr}` };
+    return {
+      status: "applied",
+      detail: `Created R2 bucket ${bucketName(ctx.slug)}`,
+      data: { tfstate_bucket: bucketName(ctx.slug) }
+    };
+  }
+};
+
+// src/commands/pebble/steps/supabase.ts
+var supabaseStep = {
+  id: "supabase",
+  label: "Supabase project",
+  async check(ctx) {
+    const cli = await run("supabase", ["--version"]);
+    if (!cli.ok) {
+      return { status: "blocked", detail: "Supabase CLI not found. Install + run `supabase login`." };
+    }
+    const list = await run("supabase", ["projects", "list"]);
+    if (list.ok && new RegExp(`(^|\\s)${ctx.slug}(\\s|$)`, "m").test(list.stdout)) {
+      return { status: "satisfied", detail: `Supabase project ${ctx.slug} exists` };
+    }
+    return null;
+  },
+  async apply(ctx) {
+    if (ctx.dryRun) {
+      return { status: "applied", detail: `[dry-run] would create Supabase project ${ctx.slug}` };
+    }
+    const c = await run("supabase", ["projects", "create", ctx.slug]);
+    if (!c.ok) return { status: "failed", detail: `supabase projects create failed: ${c.stderr}` };
+    const ref = parseRef(c.stdout);
+    return {
+      status: "applied",
+      detail: `Created Supabase project ${ctx.slug}${ref ? ` (${ref})` : ""}`,
+      data: ref ? { supabase_ref: ref } : void 0
+    };
+  }
+};
+function parseRef(stdout2) {
+  const m = stdout2.match(/[a-z]{20}/);
+  return m ? m[0] : void 0;
+}
+
+// src/commands/pebble/steps/resend.ts
+var resendStep = {
+  id: "resend",
+  label: "Resend sending domain (send-only)",
+  async check(ctx) {
+    const cli = await run("resend", ["--version"]);
+    if (!cli.ok) {
+      return {
+        status: "blocked",
+        detail: "Resend CLI not found / not configured. Set RESEND_API_KEY and install the CLI."
+      };
+    }
+    const list = await run("resend", ["domains", "list"]);
+    if (list.ok && list.stdout.includes(ctx.slug)) {
+      return { status: "satisfied", detail: `Resend sending domain for ${ctx.slug} exists` };
+    }
+    return null;
+  },
+  async apply(ctx) {
+    if (ctx.dryRun) {
+      return {
+        status: "applied",
+        detail: `[dry-run] would create Resend sending domain for ${ctx.slug} (send-only)`
+      };
+    }
+    const c = await run("resend", ["domains", "create", ctx.slug]);
+    if (!c.ok) return { status: "failed", detail: `resend domains create failed: ${c.stderr}` };
+    return { status: "applied", detail: `Created Resend sending domain for ${ctx.slug} (send-only)` };
+  }
+};
+
+// src/commands/pebble/steps/stripe.ts
+var stripeStep = {
+  id: "stripe",
+  label: "Stripe account (conditional)",
+  async check() {
+    return { status: "satisfied", detail: "conditional \u2014 evaluate in init bet" };
+  },
+  async apply() {
+    return { status: "satisfied", detail: "conditional \u2014 evaluate in init bet" };
+  }
+};
+
+// src/commands/pebble/steps/index.ts
+var CORE_STEPS = [
+  dopplerStep,
+  githubRepoStep,
+  vercelStep,
+  r2Step,
+  supabaseStep,
+  resendStep,
+  githubSecretStep
+];
+var STEP_REGISTRY = {
+  doppler: dopplerStep,
+  github: githubRepoStep,
+  vercel: vercelStep,
+  r2: r2Step,
+  supabase: supabaseStep,
+  resend: resendStep,
+  stripe: stripeStep
+};
+
+// src/commands/pebble/init-bet.ts
+function renderInitBetBody(slug, report) {
+  const rows = report.steps.map((s) => `| ${s.id} | ${s.status} | ${s.detail} |`).join("\n");
+  return `# Initialize ${slug}
+
+## Problem
+\`${slug}\` is genesis'd from \`pebble-template\` with the full IaC spine (PLACEHOLDER_* values), but its real stack is unknown. \`infra-apply\` is OFF until the spine is tailored to the actual stack.
+
+## Solution
+1. Interview the actual stack (which providers/workflows this pebble needs).
+2. Trim the template's tofu modules + workflow set to match; remove dangling refs in \`main.tf\`/\`variables.tf\`.
+3. Provision any conditional providers via \`odin pebble provision <provider> ${slug}\`.
+4. Worktree eval + run the test suite.
+5. Flip the deploy-ready signal so \`infra-apply\` runs on merge.
+
+## Constraints
+- Brownfield-safe; never blow away live resources.
+- No plaintext secrets or tfstate in git.
+- Reuse the codified IaC standard (blueprint 36839408 + pebble-template); no parallel layout.
+
+## Success Looks Like
+- Clean no-op \`tofu plan\`.
+- \`infra-apply\` flipped on and green on merge.
+- Test suite passes.
+
+### Provisioned day-one
+| Provider | Status | Detail |
+|---|---|---|
+${rows}
+
+### Conditional providers to evaluate
+- [ ] stripe (only if this pebble takes payments)
+- [ ] Resend inbound / email-routing (only if this pebble receives mail)
+- [ ] any tail provider specific to the stack
+`;
+}
+
+// src/commands/pebble/new.ts
+async function runNew(name, opts) {
+  const slug = name.toLowerCase().replace(/[^a-z0-9-]/g, "-");
+  const created = await apiRequest("/pebbles", {
+    method: "POST",
+    body: { slug, name }
+  });
+  if (created.error && !/already exists/i.test(created.error)) {
+    console.error(created.error);
+    return 1;
+  }
+  const ctx = {
+    slug,
+    name,
+    repoDir: opts.dir ?? null,
+    dryRun: !!opts.dryRun,
+    captured: {}
+  };
+  const { report, halted } = await runProvisioner(ctx, CORE_STEPS);
+  const last = report.steps[report.steps.length - 1];
+  process.stdout.write(JSON.stringify({ slug, report }) + "\n");
+  if (halted && last?.status === "failed") return 1;
+  if (halted && last?.status === "blocked") {
+    process.stderr.write(`
+Paused: ${last.detail}
+Re-run \`odin pebble new ${name}\` after acting.
+`);
+    return 0;
+  }
+  const body = renderInitBetBody(slug, report);
+  const bet = await apiRequest(`/pebbles/${slug}/bets`, {
+    method: "POST",
+    body: { title: `Initialize ${slug}`, source: "odin-cli", content: body, status: "shaped" }
+  });
+  process.stdout.write(JSON.stringify(bet) + "\n");
+  if (opts.run && bet.data?.id) {
+    process.stderr.write(`
+Hand off: /odin:eng-manager bet:${bet.data.id}
+`);
+  }
+  return 0;
+}
+
+// src/commands/pebble/index.ts
+var pebbleCmd = new Command21("pebble").description(
+  "Provision and initialize pebbles (eng-infra, run-once)"
+);
+pebbleCmd.command("new <name>").description("Provision a new pebble from pebble-template (day-one)").option("--run", "Hand off to eng-manager on the init bet").option("--dir <path>", "Parent dir to clone into").option("--dry-run", "Print the plan; mutate nothing").action(async (name, opts) => {
+  process.exit(await runNew(name, { run: opts.run, dir: opts.dir, dryRun: opts.dryRun }));
+});
+pebbleCmd.command("provision <provider> <slug>").description("Run one provider step against an existing pebble").option("--dry-run", "Print; mutate nothing").action(async (provider, slug, opts) => {
+  const step = STEP_REGISTRY[provider];
+  if (!step) {
+    console.error(`Unknown provider: ${provider}`);
+    process.exit(1);
+  }
+  const { report, halted } = await runProvisioner(
+    { slug, name: slug, repoDir: null, dryRun: !!opts.dryRun, captured: {} },
+    [step]
+  );
+  process.stdout.write(JSON.stringify(report) + "\n");
+  process.exit(halted && report.steps[0]?.status === "failed" ? 1 : 0);
+});
+
+// src/commands/create/index.ts
+import { Command as Command22 } from "commander";
+
+// src/commands/create/topology.ts
+var ENVS = ["prd", "stg", "dev"];
+var stateBucket = (slug) => `${slug}-web-tfstate`;
+function appDomainFor(env, appDomain) {
+  if (env === "prd") return `app.${appDomain}`;
+  if (env === "stg") return `app-staging.${appDomain}`;
+  return "localhost:3000";
+}
+function productionUrlFor(env, appDomain) {
+  if (env === "dev") return "http://localhost:3000";
+  return `https://${appDomainFor(env, appDomain)}`;
+}
+var supabaseEnvKey = (env) => env === "prd" ? "prd" : "stg";
+
+// src/commands/create/steps/manual.ts
+var domainStep = {
+  id: "domain",
+  label: "Domain registration + Cloudflare nameservers",
+  kind: "manual",
+  async run(ctx, io) {
+    if (ctx.captured.appDomain) return {};
+    io.info(
+      "Register your project domain and point its registrar nameservers at Cloudflare."
+    );
+    const appDomain = await io.text("App domain (e.g. carepath.cloud):");
+    return { appDomain };
+  }
+};
+var accountsStep = {
+  id: "accounts",
+  label: "Provider accounts (Supabase / Vercel / Doppler / Cloudflare / Resend)",
+  kind: "manual",
+  async run(_ctx, io) {
+    io.info(
+      "Ensure billing-enabled accounts exist with each provider (2 Supabase projects exceed the free tier)."
+    );
+    await io.confirm("Accounts created and billing enabled?");
+    return {};
+  }
+};
+var cloudflareStep = {
+  id: "cloudflare",
+  label: "Cloudflare zone + account IDs + API token",
+  kind: "manual",
+  async run(ctx, io) {
+    if (ctx.captured.cloudflareZoneId) return {};
+    await io.openUrl(
+      "https://dash.cloudflare.com/?to=/:account/:zone/dns",
+      "Open your Cloudflare zone. Copy the Zone ID and Account ID from the overview:"
+    );
+    const cloudflareZoneId = await io.text("Cloudflare Zone ID:");
+    const cloudflareAccountId = await io.text("Cloudflare Account ID:");
+    await io.openUrl(
+      "https://dash.cloudflare.com/profile/api-tokens",
+      "Create a zone-scoped API token (DNS:Edit + Zone:Read), then paste it:"
+    );
+    const cloudflareApiToken = await io.secret("Cloudflare API Token:");
+    return { cloudflareZoneId, cloudflareAccountId, cloudflareApiToken };
+  }
+};
+var r2Step2 = {
+  id: "r2",
+  label: "Cloudflare R2 state bucket + S3 credentials",
+  kind: "manual",
+  async run(ctx, io) {
+    if (ctx.captured.r2AccessKeyId) return {};
+    const bucket = stateBucket(ctx.slug);
+    await io.openUrl(
+      "https://dash.cloudflare.com/?to=/:account/r2/new",
+      `Create an R2 bucket named "${bucket}", then create an R2 API token (Object Read & Write):`
+    );
+    const r2AccessKeyId = await io.secret("R2 Access Key ID:");
+    const r2SecretAccessKey = await io.secret("R2 Secret Access Key:");
+    return { r2AccessKeyId, r2SecretAccessKey };
+  }
+};
+var tokensStep = {
+  id: "tokens",
+  label: "Provider API tokens (Vercel + Supabase)",
+  kind: "manual",
+  async run(ctx, io) {
+    if (ctx.captured.vercelApiToken) return {};
+    await io.openUrl(
+      "https://vercel.com/account/tokens",
+      "Create a Vercel API token, then paste it:"
+    );
+    const vercelApiToken = await io.secret("Vercel API Token (TF_VAR_VERCEL_API_TOKEN):");
+    const vercelToken = await io.secret(
+      "Vercel CLI deploy token (VERCEL_TOKEN, may reuse the same value):"
+    );
+    const vercelTeamId = await io.text("Vercel Team ID (optional, blank for personal):");
+    await io.openUrl(
+      "https://supabase.com/dashboard/account/tokens",
+      "Create a Supabase access token, then paste it:"
+    );
+    const supabaseAccessToken = await io.secret(
+      "Supabase Access Token (TF_VAR_SUPABASE_ACCESS_TOKEN):"
+    );
+    const out = { vercelApiToken, vercelToken, supabaseAccessToken };
+    if (vercelTeamId) out.vercelTeamId = vercelTeamId;
+    return out;
+  }
+};
+var vercelStep2 = {
+  id: "vercel",
+  label: "Vercel project (branch-scoped prod/staging)",
+  kind: "manual",
+  async run(_ctx, io) {
+    io.info(
+      "The Vercel project + branch-scoped environments are created by the IaC apply from your Vercel API token \u2014 no manual project creation needed."
+    );
+    return {};
+  }
+};
+var githubProdEnvStep = {
+  id: "github-prod-env",
+  label: "GitHub production environment + required reviewer",
+  kind: "manual",
+  async run(ctx, io) {
+    await io.openUrl(
+      `https://github.com/pebblehouse/${ctx.slug}/settings/environments`,
+      "Create a 'production' GitHub Environment and add a required reviewer (human gate for prod migrations):"
+    );
+    await io.confirm("production environment created with a required reviewer?");
+    return {};
+  }
+};
+
+// src/commands/create/steps/supabase.ts
+import { randomBytes } from "crypto";
+var genPassword = () => randomBytes(18).toString("base64url");
+function supabaseStep2(env) {
+  return {
+    id: `supabase-${env}`,
+    label: `Supabase project (${env})`,
+    kind: "manual",
+    async run(ctx, io) {
+      if (ctx.captured[`${env}_supabaseProjectRef`]) return {};
+      const projectName = `${ctx.slug}-${env}`;
+      const dbPass = genPassword();
+      await io.openUrl(
+        "https://supabase.com/dashboard/new",
+        `Create the Supabase project "${projectName}" (use this DB password: ${dbPass}), then paste its details:`
+      );
+      const ref = await io.text(`Supabase ${env} project ref:`);
+      const supabaseUrl = await io.text(`Supabase ${env} Project URL (NEXT_PUBLIC_SUPABASE_URL):`);
+      const supabasePublishableKey = await io.secret(
+        `Supabase ${env} publishable key (sb_publishable_...):`
+      );
+      const supabaseSecretKey = await io.secret(`Supabase ${env} secret key (sb_secret_...):`);
+      return {
+        [`${env}_supabaseProjectRef`]: ref,
+        [`${env}_supabaseUrl`]: supabaseUrl,
+        [`${env}_supabasePublishableKey`]: supabasePublishableKey,
+        [`${env}_supabaseSecretKey`]: supabaseSecretKey,
+        [`${env}_supabaseDbPassword`]: dbPass
+      };
+    }
+  };
+}
+
+// src/commands/create/steps/index.ts
+var GUIDED_STEPS = [
+  domainStep,
+  accountsStep,
+  cloudflareStep,
+  r2Step2,
+  tokensStep,
+  supabaseStep2("prd"),
+  supabaseStep2("stg"),
+  vercelStep2,
+  githubProdEnvStep
+];
+var STEP_REGISTRY2 = Object.fromEntries(
+  GUIDED_STEPS.map((s) => [s.id, s])
+);
+
+// src/commands/create/manifest.ts
+function buildConfigManifest(env, inputs) {
+  const s = inputs.shared;
+  const e = inputs.envs[supabaseEnvKey(env)];
+  const m = {
+    // R2 remote state (bare — S3 backend)
+    AWS_ACCESS_KEY_ID: s.r2AccessKeyId,
+    AWS_SECRET_ACCESS_KEY: s.r2SecretAccessKey,
+    // Tofu provider creds/config (TF_VAR_ prefixed)
+    TF_VAR_VERCEL_API_TOKEN: s.vercelApiToken,
+    TF_VAR_CLOUDFLARE_API_TOKEN: s.cloudflareApiToken,
+    TF_VAR_SUPABASE_ACCESS_TOKEN: s.supabaseAccessToken,
+    TF_VAR_CLOUDFLARE_ZONE_ID: s.cloudflareZoneId,
+    TF_VAR_CLOUDFLARE_ACCOUNT_ID: s.cloudflareAccountId,
+    TF_VAR_SUPABASE_PROJECT_REF: e.supabaseProjectRef,
+    // drift-fix key
+    TF_VAR_APP_DOMAIN: appDomainFor(env, s.appDomain),
+    TF_VAR_PRODUCTION_URL: productionUrlFor(env, s.appDomain),
+    // Vercel CLI deploy
+    VERCEL_TOKEN: s.vercelToken,
+    // App-runtime (Doppler->Vercel synced)
+    NEXT_PUBLIC_SUPABASE_URL: e.supabaseUrl,
+    NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY: e.supabasePublishableKey,
+    SUPABASE_SECRET_KEY: e.supabaseSecretKey,
+    SUPABASE_DB_PASSWORD: e.supabaseDbPassword,
+    SUPABASE_PROJECT_REF: e.supabaseProjectRef
+    // bare — distinct consumer
+  };
+  if (s.vercelTeamId) m.TF_VAR_VERCEL_TEAM_ID = s.vercelTeamId;
+  return m;
+}
+var REQUIRED_KEYS = (hasTeamId) => [
+  "AWS_ACCESS_KEY_ID",
+  "AWS_SECRET_ACCESS_KEY",
+  "TF_VAR_VERCEL_API_TOKEN",
+  "TF_VAR_CLOUDFLARE_API_TOKEN",
+  "TF_VAR_SUPABASE_ACCESS_TOKEN",
+  "TF_VAR_CLOUDFLARE_ZONE_ID",
+  "TF_VAR_CLOUDFLARE_ACCOUNT_ID",
+  "TF_VAR_SUPABASE_PROJECT_REF",
+  "TF_VAR_APP_DOMAIN",
+  "TF_VAR_PRODUCTION_URL",
+  "VERCEL_TOKEN",
+  "NEXT_PUBLIC_SUPABASE_URL",
+  "NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY",
+  "SUPABASE_SECRET_KEY",
+  "SUPABASE_DB_PASSWORD",
+  "SUPABASE_PROJECT_REF",
+  ...hasTeamId ? ["TF_VAR_VERCEL_TEAM_ID"] : []
+];
+
+// src/commands/create/doppler-writer.ts
+import { spawn as spawn2 } from "child_process";
+var DopplerWriter = class {
+  constructor(slug, dryRun = false, exec = run) {
+    this.slug = slug;
+    this.dryRun = dryRun;
+    this.exec = exec;
+  }
+  async ensureConfig(config) {
+    if (this.dryRun) return;
+    await this.exec("doppler", ["projects", "create", this.slug]);
+    await this.exec("doppler", ["configs", "create", config, "-p", this.slug]);
+  }
+  async readExisting(config) {
+    const r = await this.exec("doppler", [
+      "secrets",
+      "download",
+      "--no-file",
+      "--format",
+      "json",
+      "-p",
+      this.slug,
+      "-c",
+      config
+    ]);
+    if (!r.ok) return {};
+    try {
+      return JSON.parse(r.stdout);
+    } catch {
+      return {};
+    }
+  }
+  // Returns the names actually written (missing or changed only).
+  async sync(config, manifest) {
+    const existing = await this.readExisting(config);
+    const toWrite = Object.entries(manifest).filter(([k, v]) => existing[k] !== v);
+    if (this.dryRun) return toWrite.map(([k]) => k);
+    const written = [];
+    for (const [name, value] of toWrite) {
+      const ok = await setSecretViaStdin2(
+        ["secrets", "set", name, "-p", this.slug, "-c", config],
+        value
+      );
+      if (ok) written.push(name);
+    }
+    return written;
+  }
+};
+function setSecretViaStdin2(args, value) {
+  return new Promise((resolve3) => {
+    const child = spawn2("doppler", args, { stdio: ["pipe", "ignore", "ignore"] });
+    child.on("error", () => resolve3(false));
+    child.on("close", (code) => resolve3(code === 0));
+    child.stdin.write(value);
+    child.stdin.end();
+  });
+}
+
+// src/commands/create/validate.ts
+async function validateConfigs(reader, hasTeamId) {
+  const required = REQUIRED_KEYS(hasTeamId);
+  const gaps = [];
+  for (const config of ENVS) {
+    const present = await reader(config);
+    const missing = required.filter((k) => !(k in present) || present[k] === "");
+    if (missing.length) gaps.push({ config, missing });
+  }
+  return gaps;
+}
+function formatGaps(gaps) {
+  if (!gaps.length) return "All required secrets present in prd/stg/dev.";
+  return gaps.map((g) => `${g.config}: missing ${g.missing.join(", ")}`).join("\n");
+}
+
+// src/commands/create/prompt.ts
+import * as readline from "readline/promises";
+import { stdin, stdout } from "process";
+import open2 from "open";
+var RealPrompter = class {
+  constructor(opener = open2) {
+    this.rl = readline.createInterface({ input: stdin, output: stdout });
+    this.opener = opener;
+  }
+  async text(q) {
+    return (await this.rl.question(`${q} `)).trim();
+  }
+  // Mask typed input (sudo-style: nothing echoes) so pasted secrets resist shoulder-surfing.
+  // Values are still never written to logs. Falls back to plain input if the private
+  // readline write hook is unavailable.
+  async secret(q) {
+    const rl = this.rl;
+    const original = rl._writeToOutput?.bind(rl);
+    if (!original) return (await this.rl.question(`${q} `)).trim();
+    let masking = false;
+    rl._writeToOutput = (s) => {
+      if (!masking || s.includes("\n") || s.includes("\r")) original(s);
+    };
+    try {
+      const pending = this.rl.question(`${q} `);
+      masking = true;
+      return (await pending).trim();
+    } finally {
+      rl._writeToOutput = original;
+    }
+  }
+  async confirm(q) {
+    const a = (await this.rl.question(`${q} [y/N] `)).trim().toLowerCase();
+    return a === "y" || a === "yes";
+  }
+  async openUrl(url, instruction) {
+    stdout.write(`
+${instruction}
+  ${url}
+`);
+    try {
+      await this.opener(url);
+    } catch {
+      stdout.write(`(could not launch a browser, open the URL above manually)
+`);
+    }
+  }
+  info(m) {
+    stdout.write(`${m}
+`);
+  }
+  close() {
+    this.rl.close();
+  }
+};
+
+// src/commands/create/create.ts
+async function runCreate(name, opts, deps = {}) {
+  const io = deps.prompter ?? new RealPrompter();
+  const resolvedName = name && name.trim() ? name.trim() : await io.text("Project name:");
+  const slug = resolvedName.toLowerCase().replace(/[^a-z0-9-]/g, "-");
+  const writer = deps.writer ?? new DopplerWriter(slug, !!opts.dryRun);
+  const createPebble = deps.createPebble ?? (async (s, n) => {
+    const r = await apiRequest("/pebbles", {
+      method: "POST",
+      body: { slug: s, name: n }
+    });
+    return { error: r.error && !/already exists/i.test(r.error) ? r.error : void 0 };
+  });
+  const id = await createPebble(slug, resolvedName);
+  if (id.error) {
+    io.info(`pebble create failed: ${id.error}`);
+    io.close();
+    return 1;
+  }
+  const ctx = {
+    slug,
+    name: resolvedName,
+    dryRun: !!opts.dryRun,
+    captured: capturedFromDoppler(await writer.readExisting("prd"), await writer.readExisting("stg"))
+  };
+  const steps = deps.steps ?? GUIDED_STEPS;
+  for (const step of steps) Object.assign(ctx.captured, await step.run(ctx, io));
+  const inputs = assembleInputs(ctx);
+  const planned = [];
+  for (const env of ENVS) {
+    await writer.ensureConfig(env);
+    const written = await writer.sync(env, buildConfigManifest(env, inputs));
+    if (ctx.dryRun) planned.push(...written.map((k) => `${env}: ${k}`));
+  }
+  if (ctx.dryRun) {
+    io.info(
+      planned.length ? `dry-run: would write ${planned.length} secret(s):
+${planned.join("\n")}` : "dry-run: all required secrets already present, nothing to write."
+    );
+    io.close();
+    return 0;
+  }
+  const gaps = await validateConfigs((c) => writer.readExisting(c), !!inputs.shared.vercelTeamId);
+  io.info(formatGaps(gaps));
+  io.close();
+  return gaps.length ? 1 : 0;
+}
+var SHARED_KEY_MAP = {
+  TF_VAR_VERCEL_API_TOKEN: "vercelApiToken",
+  TF_VAR_CLOUDFLARE_API_TOKEN: "cloudflareApiToken",
+  TF_VAR_SUPABASE_ACCESS_TOKEN: "supabaseAccessToken",
+  TF_VAR_CLOUDFLARE_ZONE_ID: "cloudflareZoneId",
+  TF_VAR_CLOUDFLARE_ACCOUNT_ID: "cloudflareAccountId",
+  TF_VAR_VERCEL_TEAM_ID: "vercelTeamId",
+  VERCEL_TOKEN: "vercelToken",
+  AWS_ACCESS_KEY_ID: "r2AccessKeyId",
+  AWS_SECRET_ACCESS_KEY: "r2SecretAccessKey"
+};
+var ENV_KEY_MAP = {
+  SUPABASE_PROJECT_REF: "supabaseProjectRef",
+  NEXT_PUBLIC_SUPABASE_URL: "supabaseUrl",
+  NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY: "supabasePublishableKey",
+  SUPABASE_SECRET_KEY: "supabaseSecretKey",
+  SUPABASE_DB_PASSWORD: "supabaseDbPassword"
+};
+function capturedFromDoppler(prd, stg) {
+  const out = {};
+  for (const [dopplerKey, capKey] of Object.entries(SHARED_KEY_MAP)) {
+    if (prd[dopplerKey]) out[capKey] = prd[dopplerKey];
+  }
+  if (prd.TF_VAR_APP_DOMAIN) out.appDomain = prd.TF_VAR_APP_DOMAIN.replace(/^app\./, "");
+  for (const [env, cfg] of [["prd", prd], ["stg", stg]]) {
+    for (const [dopplerKey, capKey] of Object.entries(ENV_KEY_MAP)) {
+      if (cfg[dopplerKey]) out[`${env}_${capKey}`] = cfg[dopplerKey];
+    }
+  }
+  return out;
+}
+function assembleInputs(ctx) {
+  const c = ctx.captured;
+  const shared = {
+    slug: ctx.slug,
+    appDomain: c.appDomain ?? "",
+    vercelApiToken: c.vercelApiToken ?? "",
+    cloudflareApiToken: c.cloudflareApiToken ?? "",
+    supabaseAccessToken: c.supabaseAccessToken ?? "",
+    cloudflareZoneId: c.cloudflareZoneId ?? "",
+    cloudflareAccountId: c.cloudflareAccountId ?? "",
+    vercelToken: c.vercelToken ?? "",
+    r2AccessKeyId: c.r2AccessKeyId ?? "",
+    r2SecretAccessKey: c.r2SecretAccessKey ?? ""
+  };
+  if (c.vercelTeamId) shared.vercelTeamId = c.vercelTeamId;
+  const envFrom = (env) => ({
+    supabaseProjectRef: c[`${env}_supabaseProjectRef`] ?? "",
+    supabaseUrl: c[`${env}_supabaseUrl`] ?? "",
+    supabasePublishableKey: c[`${env}_supabasePublishableKey`] ?? "",
+    supabaseSecretKey: c[`${env}_supabaseSecretKey`] ?? "",
+    supabaseDbPassword: c[`${env}_supabaseDbPassword`] ?? ""
+  });
+  const stg = envFrom("stg");
+  return { shared, envs: { prd: envFrom("prd"), stg, dev: stg } };
+}
+
+// src/commands/create/index.ts
+var createCmd = new Command22("create").description(
+  "Create and provision a new project end to end"
+);
+createCmd.command("project [name]").description("Guided self-serve project + parallel-env provisioning").option("--dry-run", "Print the plan; mutate nothing").action(
+  async (name, opts) => process.exit(await runCreate(name, { dryRun: opts.dryRun }))
+);
+var setupCmd = new Command22("setup").description("Alias for `create project`").arguments("[name]").option("--dry-run", "Print the plan; mutate nothing").action(
+  async (name, opts) => process.exit(await runCreate(name, { dryRun: opts.dryRun }))
+);
+
 // src/index.ts
-import { readFileSync as readFileSync14 } from "fs";
+import { readFileSync as readFileSync15 } from "fs";
 import { fileURLToPath } from "url";
-import { dirname as dirname2, resolve } from "path";
+import { dirname as dirname2, resolve as resolve2 } from "path";
 var __dirname = dirname2(fileURLToPath(import.meta.url));
-var pkg = JSON.parse(readFileSync14(resolve(__dirname, "../package.json"), "utf-8"));
+var pkg = JSON.parse(readFileSync15(resolve2(__dirname, "../package.json"), "utf-8"));
 var GOLD = "\x1B[33m";
 var DIM = "\x1B[2m";
 var RESET = "\x1B[0m";
@@ -1297,7 +2239,7 @@ ${RESET}
   ${DIM}${cwd}${RESET}
 `);
 }
-var program = new Command20();
+var program = new Command23();
 program.name("odin").description("CLI for Odin \u2014 the knowledge backbone for Pebble House").version(VERSION);
 program.command("login").description("Authenticate with Odin via browser").action(async () => {
   printBanner();
@@ -1326,11 +2268,15 @@ program.addCommand(rulesCmd);
 program.addCommand(briefsCmd);
 program.addCommand(blueprintsCmd);
 program.addCommand(betsCmd);
+program.addCommand(betCommentsCmd);
 program.addCommand(tasksCmd);
 program.addCommand(roadmapsCmd);
 program.addCommand(personaRunsCmd);
 program.addCommand(blogCmd);
 program.addCommand(apiKeysCmd);
+program.addCommand(pebbleCmd);
+program.addCommand(createCmd);
+program.addCommand(setupCmd);
 process.on("exit", () => {
   process.stderr.write("\n\n\n\n\n");
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pebblehouse/odin-cli",
-  "version": "0.12.0",
+  "version": "0.14.0",
   "type": "module",
   "description": "CLI for Odin — the knowledge backbone for Pebble House",
   "bin": {
@@ -34,7 +34,7 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@supabase/supabase-js": "^2.47.10",
+    "@supabase/supabase-js": "^2.105.0",
     "commander": "^12.0.0",
     "open": "^10.0.0"
   },