@pebblehouse/odin-cli 0.13.0 → 0.14.1

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { Command as Command21 } from "commander";
+import { Command as Command23 } from "commander";
 
 // src/auth/login.ts
 import { createServer } from "http";
@@ -929,7 +929,7 @@ depsCmd.command("remove <slug> <bet-id>").description("Remove a blocked-by depen
 
 // src/commands/bets.ts
 var betsCmd = new Command14("bets").description("Manage bets");
-betsCmd.command("list <slug>").description("List bets for a pebble").option("--status <status>", "Filter by status").action(async (slug, opts) => {
+betsCmd.command("list <slug>").description("List bets for a pebble").option("--status <status>", "Filter by status (pitch, shaped, betting, active, blocked, building, done, archived)").action(async (slug, opts) => {
   const params = {};
   if (opts.status) params.status = opts.status;
   const res = await apiRequest(`/pebbles/${slug}/bets`, { params });
@@ -941,7 +941,7 @@ betsCmd.command("get <slug> <id>").description("Get a bet by ID").action(async (
   process.stdout.write(JSON.stringify(res) + "\n");
   if (res.error) process.exit(1);
 });
-betsCmd.command("create <slug> <title>").description("Create a bet").option("--source <source>", "Source agent", "claude-code").option("--content <content>", "Bet content").option("--file <path>", "Read content from file").option("--status <status>", "Bet status").option("--priority <priority>", "Bet priority").option("--appetite <appetite>", "Bet appetite").action(async (slug, title, opts) => {
+betsCmd.command("create <slug> <title>").description("Create a bet").option("--source <source>", "Source agent", "claude-code").option("--content <content>", "Bet content").option("--file <path>", "Read content from file").option("--status <status>", "Bet status (pitch, shaped, betting, active, blocked, building, done, archived)").option("--priority <priority>", "Bet priority").option("--appetite <appetite>", "Bet appetite").action(async (slug, title, opts) => {
   const content = opts.file ? readFileSync10(opts.file, "utf-8") : opts.content ?? "";
   const res = await apiRequest(`/pebbles/${slug}/bets`, {
     method: "POST",
@@ -950,7 +950,7 @@ betsCmd.command("create <slug> <title>").description("Create a bet").option("--s
   process.stdout.write(JSON.stringify(res) + "\n");
   if (res.error) process.exit(1);
 });
-betsCmd.command("update <slug> <id>").description("Update a bet").option("--title <title>", "New title").option("--content <content>", "New content").option("--file <path>", "Read content from file").option("--status <status>", "New status").option("--priority <priority>", "New priority").option("--appetite <appetite>", "New appetite").action(async (slug, id, opts) => {
+betsCmd.command("update <slug> <id>").description("Update a bet").option("--title <title>", "New title").option("--content <content>", "New content").option("--file <path>", "Read content from file").option("--status <status>", "New status (pitch, shaped, betting, active, blocked, building, done, archived)").option("--priority <priority>", "New priority").option("--appetite <appetite>", "New appetite").action(async (slug, id, opts) => {
   const body = {};
   if (opts.title) body.title = opts.title;
   if (opts.file) body.content = readFileSync10(opts.file, "utf-8");
@@ -974,9 +974,38 @@ betsCmd.command("delete <slug> <id>").description("Delete a bet").action(async (
 });
 betsCmd.addCommand(depsCmd);
 
-// src/commands/tasks.ts
+// src/commands/bet-comments.ts
 import { Command as Command15 } from "commander";
-var tasksCmd = new Command15("tasks").description("Manage tasks");
+import { readFileSync as readFileSync11 } from "fs";
+var betCommentsCmd = new Command15("bet-comments").description("Manage bet comments");
+betCommentsCmd.command("list <slug> <betId>").description("List comments for a bet (oldest first)").action(async (slug, betId) => {
+  const res = await apiRequest(`/pebbles/${slug}/bets/${betId}/comments`);
+  process.stdout.write(JSON.stringify(res) + "\n");
+  if (res.error) process.exit(1);
+});
+betCommentsCmd.command("create <slug> <betId> [body]").description("Post a comment on a bet (append-only)").option("--author-type <type>", "persona | human", "persona").option("--author-label <label>", "Verbatim author slug/handle").option("--parent <id>", "Reply to a top-level comment (one level only)").option("--kind <kind>", "metadata.kind: build-summary | escalation | note").option("--pipeline-stage <stage>", "metadata.pipeline_stage").option("--pr-url <url>", "metadata.pr_url").option("--file <path>", "Read body from file").action(async (slug, betId, body, opts) => {
+  const commentBody = opts.file ? readFileSync11(opts.file, "utf-8") : body ?? "";
+  const metadata = {};
+  if (opts.kind) metadata.kind = opts.kind;
+  if (opts.pipelineStage) metadata.pipeline_stage = opts.pipelineStage;
+  if (opts.prUrl) metadata.pr_url = opts.prUrl;
+  const res = await apiRequest(`/pebbles/${slug}/bets/${betId}/comments`, {
+    method: "POST",
+    body: {
+      author_type: opts.authorType,
+      author_label: opts.authorLabel,
+      body: commentBody,
+      parent_comment_id: opts.parent,
+      metadata: Object.keys(metadata).length ? metadata : void 0
+    }
+  });
+  process.stdout.write(JSON.stringify(res) + "\n");
+  if (res.error) process.exit(1);
+});
+
+// src/commands/tasks.ts
+import { Command as Command16 } from "commander";
+var tasksCmd = new Command16("tasks").description("Manage tasks");
 tasksCmd.command("list <slug>").description("List tasks for a pebble").option("--status <status>", "Filter by status").option("--bet <bet-id>", "Filter by bet ID").action(async (slug, opts) => {
   const params = {};
   if (opts.status) params.status = opts.status;
@@ -1021,9 +1050,9 @@ tasksCmd.command("delete <slug> <id>").description("Delete a task").action(async
 });
 
 // src/commands/roadmaps.ts
-import { Command as Command16 } from "commander";
-import { readFileSync as readFileSync11 } from "fs";
-var roadmapsCmd = new Command16("roadmaps").description("Manage roadmaps");
+import { Command as Command17 } from "commander";
+import { readFileSync as readFileSync12 } from "fs";
+var roadmapsCmd = new Command17("roadmaps").description("Manage roadmaps");
 roadmapsCmd.command("list <slug>").description("List roadmaps for a pebble").option("--status <status>", "Filter by status").action(async (slug, opts) => {
   const params = {};
   if (opts.status) params.status = opts.status;
@@ -1037,7 +1066,7 @@ roadmapsCmd.command("get <slug> <id>").description("Get a roadmap by ID (include
   if (res.error) process.exit(1);
 });
 roadmapsCmd.command("create <slug> <title>").description("Create a roadmap").option("--source <source>", "Source agent", "claude-code").option("--content <content>", "Roadmap content").option("--file <path>", "Read content from file").option("--status <status>", "Roadmap status").action(async (slug, title, opts) => {
-  const content = opts.file ? readFileSync11(opts.file, "utf-8") : opts.content ?? "";
+  const content = opts.file ? readFileSync12(opts.file, "utf-8") : opts.content ?? "";
   const res = await apiRequest(`/pebbles/${slug}/roadmaps`, {
     method: "POST",
     body: { title, source: opts.source, content, status: opts.status }
@@ -1048,7 +1077,7 @@ roadmapsCmd.command("create <slug> <title>").description("Create a roadmap").opt
 roadmapsCmd.command("update <slug> <id>").description("Update a roadmap").option("--title <title>", "New title").option("--content <content>", "New content").option("--file <path>", "Read content from file").option("--status <status>", "New status").action(async (slug, id, opts) => {
   const body = {};
   if (opts.title) body.title = opts.title;
-  if (opts.file) body.content = readFileSync11(opts.file, "utf-8");
+  if (opts.file) body.content = readFileSync12(opts.file, "utf-8");
   else if (opts.content) body.content = opts.content;
   if (opts.status) body.status = opts.status;
   const res = await apiRequest(`/pebbles/${slug}/roadmaps/${id}`, {
@@ -1067,11 +1096,11 @@ roadmapsCmd.command("delete <slug> <id>").description("Delete a roadmap").action
 });
 
 // src/commands/persona-runs.ts
-import { Command as Command17 } from "commander";
-import { readFileSync as readFileSync12 } from "fs";
+import { Command as Command18 } from "commander";
+import { readFileSync as readFileSync13 } from "fs";
 import { join as join2 } from "path";
 import { homedir as homedir2 } from "os";
-var personaRunsCmd = new Command17("persona-runs").description(
+var personaRunsCmd = new Command18("persona-runs").description(
   "Manage per-persona per-session token usage rows"
 );
 personaRunsCmd.command("list <slug>").description("List persona runs for a pebble").option("--bet-id <id>", "Filter by bet_id").option("--plan-id <id>", "Filter by plan_id").option("--persona <name>", "Filter by persona name").option("--limit <n>", "Max rows", "50").action(async (slug, opts) => {
@@ -1095,7 +1124,7 @@ personaRunsCmd.command("get <slug> <id>").description("Get a persona run by id")
   if (res.error) process.exit(1);
 });
 personaRunsCmd.command("create <slug>").description("Create/upsert a persona run from a JSON file").requiredOption("--file <path>", "JSON payload matching PersonaRunCreate").action(async (slug, opts) => {
-  const body = JSON.parse(readFileSync12(opts.file, "utf-8"));
+  const body = JSON.parse(readFileSync13(opts.file, "utf-8"));
   const res = await apiRequest(`/pebbles/${slug}/persona-runs`, {
     method: "POST",
     body
@@ -1107,7 +1136,7 @@ personaRunsCmd.command("capture").description("Read marker + transcript, compute
   const markerPath = opts.marker ?? join2(homedir2(), ".claude", "odin-context", `${opts.sessionId}.json`);
   let marker = {};
   try {
-    marker = JSON.parse(readFileSync12(markerPath, "utf-8"));
+    marker = JSON.parse(readFileSync13(markerPath, "utf-8"));
   } catch {
     process.exit(0);
   }
@@ -1117,7 +1146,7 @@ personaRunsCmd.command("capture").description("Read marker + transcript, compute
   let input = 0, output = 0, cacheRead = 0, cacheCreate = 0;
   let minTs = null, maxTs = null;
   try {
-    const raw = readFileSync12(opts.transcript, "utf-8");
+    const raw = readFileSync13(opts.transcript, "utf-8");
     for (const line of raw.split("\n")) {
       if (!line.trim()) continue;
       let obj;
@@ -1168,10 +1197,10 @@ personaRunsCmd.command("capture").description("Read marker + transcript, compute
 });
 
 // src/commands/blog.ts
-import { Command as Command18 } from "commander";
-import { readFileSync as readFileSync13 } from "fs";
-var blogCmd = new Command18("blog").description("Manage blog posts");
-blogCmd.command("list <slug>").description("List blog posts for a pebble").option("--status <status>", "Filter by status (draft, review, published, archived)").option("--tag <tag>", "Filter by tag").option("--page <page>", "Page number", "1").option("--per-page <perPage>", "Results per page", "20").action(async (slug, opts) => {
+import { Command as Command19 } from "commander";
+import { readFileSync as readFileSync14 } from "fs";
+var blogCmd = new Command19("blog").description("Manage blog posts");
+blogCmd.command("list <slug>").description("List blog posts for a pebble").option("--status <status>", "Filter by status (draft, review, scheduled, published, archived)").option("--tag <tag>", "Filter by tag").option("--page <page>", "Page number", "1").option("--per-page <perPage>", "Results per page", "20").action(async (slug, opts) => {
   const params = {};
   if (opts.status) params.status = opts.status;
   if (opts.tag) params.tag = opts.tag;
@@ -1186,10 +1215,10 @@ blogCmd.command("get <slug> <idOrSlug>").description("Get a blog post by UUID or
   process.stdout.write(JSON.stringify(res) + "\n");
   if (res.error) process.exit(1);
 });
-blogCmd.command("create <slug> <title>").description("Create a blog post").requiredOption("--post-slug <postSlug>", "URL slug for the post").option("--blocks <blocks>", "Content blocks as JSON string").option("--file <path>", "Read content blocks from JSON file").option("--status <status>", "Initial status (draft, review)", "draft").option("--metadata <metadata>", "Post metadata as JSON string").option("--campaign-id <campaignId>", "Link to a marketing campaign").action(async (slug, title, opts) => {
+blogCmd.command("create <slug> <title>").description("Create a blog post").requiredOption("--post-slug <postSlug>", "URL slug for the post").option("--blocks <blocks>", "Content blocks as JSON string").option("--file <path>", "Read content blocks from JSON file").option("--status <status>", "Initial status (draft, review, scheduled)", "draft").option("--scheduled-publish-at <iso>", "UTC ISO timestamp for scheduled publishing (required when --status scheduled)").option("--metadata <metadata>", "Post metadata as JSON string").option("--campaign-id <campaignId>", "Link to a marketing campaign").action(async (slug, title, opts) => {
   let blocks = [];
   if (opts.file) {
-    blocks = JSON.parse(readFileSync13(opts.file, "utf-8"));
+    blocks = JSON.parse(readFileSync14(opts.file, "utf-8"));
   } else if (opts.blocks) {
     blocks = JSON.parse(opts.blocks);
   }
@@ -1199,6 +1228,7 @@ blogCmd.command("create <slug> <title>").description("Create a blog post").requi
     blocks,
     status: opts.status
   };
+  if (opts.scheduledPublishAt) body.scheduled_publish_at = opts.scheduledPublishAt;
   if (opts.metadata) body.metadata = JSON.parse(opts.metadata);
   if (opts.campaignId) body.campaign_id = opts.campaignId;
   const res = await apiRequest(`/pebbles/${slug}/blog`, {
@@ -1208,13 +1238,15 @@ blogCmd.command("create <slug> <title>").description("Create a blog post").requi
   process.stdout.write(JSON.stringify(res) + "\n");
   if (res.error) process.exit(1);
 });
-blogCmd.command("update <slug> <id>").description("Update a blog post").option("--title <title>", "New title").option("--post-slug <postSlug>", "New URL slug").option("--blocks <blocks>", "Content blocks as JSON string").option("--file <path>", "Read content blocks from JSON file").option("--status <status>", "New status (draft, review, published, archived)").option("--metadata <metadata>", "Post metadata as JSON string").action(async (slug, id, opts) => {
+blogCmd.command("update <slug> <id>").description("Update a blog post").option("--title <title>", "New title").option("--post-slug <postSlug>", "New URL slug").option("--blocks <blocks>", "Content blocks as JSON string").option("--file <path>", "Read content blocks from JSON file").option("--status <status>", "New status (draft, review, scheduled, published, archived)").option("--scheduled-publish-at <iso>", "UTC ISO timestamp for scheduled publishing (required when --status scheduled). Pass empty string to clear.").option("--metadata <metadata>", "Post metadata as JSON string").action(async (slug, id, opts) => {
   const body = {};
   if (opts.title) body.title = opts.title;
   if (opts.postSlug) body.slug = opts.postSlug;
-  if (opts.file) body.blocks = JSON.parse(readFileSync13(opts.file, "utf-8"));
+  if (opts.file) body.blocks = JSON.parse(readFileSync14(opts.file, "utf-8"));
   else if (opts.blocks) body.blocks = JSON.parse(opts.blocks);
   if (opts.status) body.status = opts.status;
+  if (opts.scheduledPublishAt !== void 0)
+    body.scheduled_publish_at = opts.scheduledPublishAt === "" ? null : opts.scheduledPublishAt;
   if (opts.metadata) body.metadata = JSON.parse(opts.metadata);
   const res = await apiRequest(`/pebbles/${slug}/blog/${id}`, {
     method: "PUT",
@@ -1232,14 +1264,14 @@ blogCmd.command("delete <slug> <id>").description("Delete a blog post").action(a
 });
 
 // src/commands/api-keys.ts
-import { Command as Command19 } from "commander";
-var apiKeysCmd = new Command19("api-keys").description("Manage API keys for server-to-server access");
+import { Command as Command20 } from "commander";
+var apiKeysCmd = new Command20("api-keys").description("Manage API keys for server-to-server access");
 apiKeysCmd.command("list <slug>").description("List API keys for a pebble").action(async (slug) => {
   const res = await apiRequest(`/pebbles/${slug}/api-keys`);
   process.stdout.write(JSON.stringify(res) + "\n");
   if (res.error) process.exit(1);
 });
-apiKeysCmd.command("create <slug>").description("Create a new API key").requiredOption("--name <name>", "Human-readable key name").requiredOption("--scopes <scopes>", "Comma-separated scopes (e.g. blog:read,marketing_content:read)").option("--expires-at <expiresAt>", "Expiration timestamp (ISO 8601)").action(async (slug, opts) => {
+apiKeysCmd.command("create <slug>").description("Create a new API key").requiredOption("--name <name>", "Human-readable key name").requiredOption("--scopes <scopes>", "Comma-separated scopes (e.g. blog:read,marketing_content:read,faqs:read)").option("--expires-at <expiresAt>", "Expiration timestamp (ISO 8601)").action(async (slug, opts) => {
   const scopes = opts.scopes.split(",").map((s) => s.trim());
   const body = { name: opts.name, scopes };
   if (opts.expiresAt) body.expires_at = opts.expiresAt;
@@ -1275,7 +1307,7 @@ apiKeysCmd.command("delete <slug> <id>").description("Permanently delete an API
 });
 
 // src/commands/pebble/index.ts
-import { Command as Command20 } from "commander";
+import { Command as Command21 } from "commander";
 
 // src/commands/pebble/provisioner.ts
 async function runProvisioner(ctx, steps) {
@@ -1305,9 +1337,9 @@ async function runProvisioner(ctx, steps) {
 import { execFile } from "child_process";
 function run(cmd, args, opts = {}) {
   return new Promise((resolve3) => {
-    execFile(cmd, args, { cwd: opts.cwd, encoding: "utf-8" }, (err, stdout, stderr) => {
+    execFile(cmd, args, { cwd: opts.cwd, encoding: "utf-8" }, (err, stdout2, stderr) => {
       const code = err && typeof err.code === "number" ? err.code : err ? 1 : 0;
-      resolve3({ ok: code === 0, stdout: stdout ?? "", stderr: stderr ?? "", code });
+      resolve3({ ok: code === 0, stdout: stdout2 ?? "", stderr: stderr ?? "", code });
     });
   });
 }
@@ -1539,8 +1571,8 @@ var supabaseStep = {
     };
   }
 };
-function parseRef(stdout) {
-  const m = stdout.match(/[a-z]{20}/);
+function parseRef(stdout2) {
+  const m = stdout2.match(/[a-z]{20}/);
   return m ? m[0] : void 0;
 }
 
@@ -1688,7 +1720,7 @@ Hand off: /odin:eng-manager bet:${bet.data.id}
 }
 
 // src/commands/pebble/index.ts
-var pebbleCmd = new Command20("pebble").description(
+var pebbleCmd = new Command21("pebble").description(
   "Provision and initialize pebbles (eng-infra, run-once)"
 );
 pebbleCmd.command("new <name>").description("Provision a new pebble from pebble-template (day-one)").option("--run", "Hand off to eng-manager on the init bet").option("--dir <path>", "Parent dir to clone into").option("--dry-run", "Print the plan; mutate nothing").action(async (name, opts) => {
@@ -1708,12 +1740,488 @@ pebbleCmd.command("provision <provider> <slug>").description("Run one provider s
   process.exit(halted && report.steps[0]?.status === "failed" ? 1 : 0);
 });
 
+// src/commands/create/index.ts
+import { Command as Command22 } from "commander";
+
+// src/commands/create/topology.ts
+var ENVS = ["prd", "stg", "dev"];
+var stateBucket = (slug) => `${slug}-web-tfstate`;
+function appDomainFor(env, appDomain) {
+  if (env === "prd") return `app.${appDomain}`;
+  if (env === "stg") return `app-staging.${appDomain}`;
+  return "localhost:3000";
+}
+function productionUrlFor(env, appDomain) {
+  if (env === "dev") return "http://localhost:3000";
+  return `https://${appDomainFor(env, appDomain)}`;
+}
+var supabaseEnvKey = (env) => env === "prd" ? "prd" : "stg";
+
+// src/commands/create/steps/manual.ts
+var domainStep = {
+  id: "domain",
+  label: "Domain registration + Cloudflare nameservers",
+  kind: "manual",
+  async run(ctx, io) {
+    if (ctx.captured.appDomain) return {};
+    io.info(
+      "Register your project domain and point its registrar nameservers at Cloudflare."
+    );
+    const appDomain = await io.text("App domain (e.g. carepath.cloud):");
+    return { appDomain };
+  }
+};
+var accountsStep = {
+  id: "accounts",
+  label: "Provider accounts (Supabase / Vercel / Doppler / Cloudflare / Resend)",
+  kind: "manual",
+  async run(_ctx, io) {
+    io.info(
+      "Ensure billing-enabled accounts exist with each provider (2 Supabase projects exceed the free tier)."
+    );
+    await io.confirm("Accounts created and billing enabled?");
+    return {};
+  }
+};
+var cloudflareStep = {
+  id: "cloudflare",
+  label: "Cloudflare zone + account IDs + API token",
+  kind: "manual",
+  async run(ctx, io) {
+    if (ctx.captured.cloudflareZoneId) return {};
+    await io.openUrl(
+      "https://dash.cloudflare.com/?to=/:account/:zone/dns",
+      "Open your Cloudflare zone. Copy the Zone ID and Account ID from the overview:"
+    );
+    const cloudflareZoneId = await io.text("Cloudflare Zone ID:");
+    const cloudflareAccountId = await io.text("Cloudflare Account ID:");
+    await io.openUrl(
+      "https://dash.cloudflare.com/profile/api-tokens",
+      "Create a zone-scoped API token (DNS:Edit + Zone:Read), then paste it:"
+    );
+    const cloudflareApiToken = await io.secret("Cloudflare API Token:");
+    return { cloudflareZoneId, cloudflareAccountId, cloudflareApiToken };
+  }
+};
+var r2Step2 = {
+  id: "r2",
+  label: "Cloudflare R2 state bucket + S3 credentials",
+  kind: "manual",
+  async run(ctx, io) {
+    if (ctx.captured.r2AccessKeyId) return {};
+    const bucket = stateBucket(ctx.slug);
+    await io.openUrl(
+      "https://dash.cloudflare.com/?to=/:account/r2/new",
+      `Create an R2 bucket named "${bucket}", then create an R2 API token (Object Read & Write):`
+    );
+    const r2AccessKeyId = await io.secret("R2 Access Key ID:");
+    const r2SecretAccessKey = await io.secret("R2 Secret Access Key:");
+    return { r2AccessKeyId, r2SecretAccessKey };
+  }
+};
+var tokensStep = {
+  id: "tokens",
+  label: "Provider API tokens (Vercel + Supabase)",
+  kind: "manual",
+  async run(ctx, io) {
+    if (ctx.captured.vercelApiToken) return {};
+    await io.openUrl(
+      "https://vercel.com/account/tokens",
+      "Create a Vercel API token, then paste it:"
+    );
+    const vercelApiToken = await io.secret("Vercel API Token (TF_VAR_VERCEL_API_TOKEN):");
+    const vercelToken = await io.secret(
+      "Vercel CLI deploy token (VERCEL_TOKEN, may reuse the same value):"
+    );
+    const vercelTeamId = await io.text("Vercel Team ID (optional, blank for personal):");
+    await io.openUrl(
+      "https://supabase.com/dashboard/account/tokens",
+      "Create a Supabase access token, then paste it:"
+    );
+    const supabaseAccessToken = await io.secret(
+      "Supabase Access Token (TF_VAR_SUPABASE_ACCESS_TOKEN):"
+    );
+    const out = { vercelApiToken, vercelToken, supabaseAccessToken };
+    if (vercelTeamId) out.vercelTeamId = vercelTeamId;
+    return out;
+  }
+};
+var vercelStep2 = {
+  id: "vercel",
+  label: "Vercel project (branch-scoped prod/staging)",
+  kind: "manual",
+  async run(_ctx, io) {
+    io.info(
+      "The Vercel project + branch-scoped environments are created by the IaC apply from your Vercel API token \u2014 no manual project creation needed."
+    );
+    return {};
+  }
+};
+var githubProdEnvStep = {
+  id: "github-prod-env",
+  label: "GitHub production environment + required reviewer",
+  kind: "manual",
+  async run(ctx, io) {
+    await io.openUrl(
+      `https://github.com/pebblehouse/${ctx.slug}/settings/environments`,
+      "Create a 'production' GitHub Environment and add a required reviewer (human gate for prod migrations):"
+    );
+    await io.confirm("production environment created with a required reviewer?");
+    return {};
+  }
+};
+
+// src/commands/create/steps/supabase.ts
+import { randomBytes } from "crypto";
+var genPassword = () => randomBytes(18).toString("base64url");
+function supabaseStep2(env) {
+  return {
+    id: `supabase-${env}`,
+    label: `Supabase project (${env})`,
+    kind: "manual",
+    async run(ctx, io) {
+      if (ctx.captured[`${env}_supabaseProjectRef`]) return {};
+      const projectName = `${ctx.slug}-${env}`;
+      const dbPass = genPassword();
+      await io.openUrl(
+        "https://supabase.com/dashboard/new",
+        `Create the Supabase project "${projectName}" (use this DB password: ${dbPass}), then paste its details:`
+      );
+      const ref = await io.text(`Supabase ${env} project ref:`);
+      const supabaseUrl = await io.text(`Supabase ${env} Project URL (NEXT_PUBLIC_SUPABASE_URL):`);
+      const supabasePublishableKey = await io.secret(
+        `Supabase ${env} publishable key (sb_publishable_...):`
+      );
+      const supabaseSecretKey = await io.secret(`Supabase ${env} secret key (sb_secret_...):`);
+      return {
+        [`${env}_supabaseProjectRef`]: ref,
+        [`${env}_supabaseUrl`]: supabaseUrl,
+        [`${env}_supabasePublishableKey`]: supabasePublishableKey,
+        [`${env}_supabaseSecretKey`]: supabaseSecretKey,
+        [`${env}_supabaseDbPassword`]: dbPass
+      };
+    }
+  };
+}
+
+// src/commands/create/steps/index.ts
+var GUIDED_STEPS = [
+  domainStep,
+  accountsStep,
+  cloudflareStep,
+  r2Step2,
+  tokensStep,
+  supabaseStep2("prd"),
+  supabaseStep2("stg"),
+  vercelStep2,
+  githubProdEnvStep
+];
+var STEP_REGISTRY2 = Object.fromEntries(
+  GUIDED_STEPS.map((s) => [s.id, s])
+);
+
+// src/commands/create/manifest.ts
+function buildConfigManifest(env, inputs) {
+  const s = inputs.shared;
+  const e = inputs.envs[supabaseEnvKey(env)];
+  const m = {
+    // R2 remote state (bare — S3 backend)
+    AWS_ACCESS_KEY_ID: s.r2AccessKeyId,
+    AWS_SECRET_ACCESS_KEY: s.r2SecretAccessKey,
+    // Tofu provider creds/config (TF_VAR_ prefixed)
+    TF_VAR_VERCEL_API_TOKEN: s.vercelApiToken,
+    TF_VAR_CLOUDFLARE_API_TOKEN: s.cloudflareApiToken,
+    TF_VAR_SUPABASE_ACCESS_TOKEN: s.supabaseAccessToken,
+    TF_VAR_CLOUDFLARE_ZONE_ID: s.cloudflareZoneId,
+    TF_VAR_CLOUDFLARE_ACCOUNT_ID: s.cloudflareAccountId,
+    TF_VAR_SUPABASE_PROJECT_REF: e.supabaseProjectRef,
+    // drift-fix key
+    TF_VAR_APP_DOMAIN: appDomainFor(env, s.appDomain),
+    TF_VAR_PRODUCTION_URL: productionUrlFor(env, s.appDomain),
+    // Vercel CLI deploy
+    VERCEL_TOKEN: s.vercelToken,
+    // App-runtime (Doppler->Vercel synced)
+    NEXT_PUBLIC_SUPABASE_URL: e.supabaseUrl,
+    NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY: e.supabasePublishableKey,
+    SUPABASE_SECRET_KEY: e.supabaseSecretKey,
+    SUPABASE_DB_PASSWORD: e.supabaseDbPassword,
+    SUPABASE_PROJECT_REF: e.supabaseProjectRef
+    // bare — distinct consumer
+  };
+  if (s.vercelTeamId) m.TF_VAR_VERCEL_TEAM_ID = s.vercelTeamId;
+  return m;
+}
+var REQUIRED_KEYS = (hasTeamId) => [
+  "AWS_ACCESS_KEY_ID",
+  "AWS_SECRET_ACCESS_KEY",
+  "TF_VAR_VERCEL_API_TOKEN",
+  "TF_VAR_CLOUDFLARE_API_TOKEN",
+  "TF_VAR_SUPABASE_ACCESS_TOKEN",
+  "TF_VAR_CLOUDFLARE_ZONE_ID",
+  "TF_VAR_CLOUDFLARE_ACCOUNT_ID",
+  "TF_VAR_SUPABASE_PROJECT_REF",
+  "TF_VAR_APP_DOMAIN",
+  "TF_VAR_PRODUCTION_URL",
+  "VERCEL_TOKEN",
+  "NEXT_PUBLIC_SUPABASE_URL",
+  "NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY",
+  "SUPABASE_SECRET_KEY",
+  "SUPABASE_DB_PASSWORD",
+  "SUPABASE_PROJECT_REF",
+  ...hasTeamId ? ["TF_VAR_VERCEL_TEAM_ID"] : []
+];
+
+// src/commands/create/doppler-writer.ts
+import { spawn as spawn2 } from "child_process";
+var DopplerWriter = class {
+  constructor(slug, dryRun = false, exec = run) {
+    this.slug = slug;
+    this.dryRun = dryRun;
+    this.exec = exec;
+  }
+  async ensureConfig(config) {
+    if (this.dryRun) return;
+    await this.exec("doppler", ["projects", "create", this.slug]);
+    await this.exec("doppler", ["configs", "create", config, "-p", this.slug]);
+  }
+  async readExisting(config) {
+    const r = await this.exec("doppler", [
+      "secrets",
+      "download",
+      "--no-file",
+      "--format",
+      "json",
+      "-p",
+      this.slug,
+      "-c",
+      config
+    ]);
+    if (!r.ok) return {};
+    try {
+      return JSON.parse(r.stdout);
+    } catch {
+      return {};
+    }
+  }
+  // Returns the names actually written (missing or changed only).
+  async sync(config, manifest) {
+    const existing = await this.readExisting(config);
+    const toWrite = Object.entries(manifest).filter(([k, v]) => existing[k] !== v);
+    if (this.dryRun) return toWrite.map(([k]) => k);
+    const written = [];
+    for (const [name, value] of toWrite) {
+      const ok = await setSecretViaStdin2(
+        ["secrets", "set", name, "-p", this.slug, "-c", config],
+        value
+      );
+      if (ok) written.push(name);
+    }
+    return written;
+  }
+};
+function setSecretViaStdin2(args, value) {
+  return new Promise((resolve3) => {
+    const child = spawn2("doppler", args, { stdio: ["pipe", "ignore", "ignore"] });
+    child.on("error", () => resolve3(false));
+    child.on("close", (code) => resolve3(code === 0));
+    child.stdin.write(value);
+    child.stdin.end();
+  });
+}
+
+// src/commands/create/validate.ts
+async function validateConfigs(reader, hasTeamId) {
+  const required = REQUIRED_KEYS(hasTeamId);
+  const gaps = [];
+  for (const config of ENVS) {
+    const present = await reader(config);
+    const missing = required.filter((k) => !(k in present) || present[k] === "");
+    if (missing.length) gaps.push({ config, missing });
+  }
+  return gaps;
+}
+function formatGaps(gaps) {
+  if (!gaps.length) return "All required secrets present in prd/stg/dev.";
+  return gaps.map((g) => `${g.config}: missing ${g.missing.join(", ")}`).join("\n");
+}
+
+// src/commands/create/prompt.ts
+import * as readline from "readline/promises";
+import { stdin, stdout } from "process";
+import open2 from "open";
+var RealPrompter = class {
+  constructor(opener = open2) {
+    this.rl = readline.createInterface({ input: stdin, output: stdout });
+    this.opener = opener;
+  }
+  async text(q) {
+    return (await this.rl.question(`${q} `)).trim();
+  }
+  // Mask typed input (sudo-style: nothing echoes) so pasted secrets resist shoulder-surfing.
+  // Values are still never written to logs. Falls back to plain input if the private
+  // readline write hook is unavailable.
+  async secret(q) {
+    const rl = this.rl;
+    const original = rl._writeToOutput?.bind(rl);
+    if (!original) return (await this.rl.question(`${q} `)).trim();
+    let masking = false;
+    rl._writeToOutput = (s) => {
+      if (!masking || s.includes("\n") || s.includes("\r")) original(s);
+    };
+    try {
+      const pending = this.rl.question(`${q} `);
+      masking = true;
+      return (await pending).trim();
+    } finally {
+      rl._writeToOutput = original;
+    }
+  }
+  async confirm(q) {
+    const a = (await this.rl.question(`${q} [y/N] `)).trim().toLowerCase();
+    return a === "y" || a === "yes";
+  }
+  async openUrl(url, instruction) {
+    stdout.write(`
+${instruction}
+  ${url}
+`);
+    try {
+      await this.opener(url);
+    } catch {
+      stdout.write(`(could not launch a browser, open the URL above manually)
+`);
+    }
+  }
+  info(m) {
+    stdout.write(`${m}
+`);
+  }
+  close() {
+    this.rl.close();
+  }
+};
+
+// src/commands/create/create.ts
+async function runCreate(name, opts, deps = {}) {
+  const io = deps.prompter ?? new RealPrompter();
+  const resolvedName = name && name.trim() ? name.trim() : await io.text("Project name:");
+  const slug = resolvedName.toLowerCase().replace(/[^a-z0-9-]/g, "-");
+  const writer = deps.writer ?? new DopplerWriter(slug, !!opts.dryRun);
+  const createPebble = deps.createPebble ?? (async (s, n) => {
+    const r = await apiRequest("/pebbles", {
+      method: "POST",
+      body: { slug: s, name: n }
+    });
+    return { error: r.error && !/already exists/i.test(r.error) ? r.error : void 0 };
+  });
+  const id = await createPebble(slug, resolvedName);
+  if (id.error) {
+    io.info(`pebble create failed: ${id.error}`);
+    io.close();
+    return 1;
+  }
+  const ctx = {
+    slug,
+    name: resolvedName,
+    dryRun: !!opts.dryRun,
+    captured: capturedFromDoppler(await writer.readExisting("prd"), await writer.readExisting("stg"))
+  };
+  const steps = deps.steps ?? GUIDED_STEPS;
+  for (const step of steps) Object.assign(ctx.captured, await step.run(ctx, io));
+  const inputs = assembleInputs(ctx);
+  const planned = [];
+  for (const env of ENVS) {
+    await writer.ensureConfig(env);
+    const written = await writer.sync(env, buildConfigManifest(env, inputs));
+    if (ctx.dryRun) planned.push(...written.map((k) => `${env}: ${k}`));
+  }
+  if (ctx.dryRun) {
+    io.info(
+      planned.length ? `dry-run: would write ${planned.length} secret(s):
+${planned.join("\n")}` : "dry-run: all required secrets already present, nothing to write."
+    );
+    io.close();
+    return 0;
+  }
+  const gaps = await validateConfigs((c) => writer.readExisting(c), !!inputs.shared.vercelTeamId);
+  io.info(formatGaps(gaps));
+  io.close();
+  return gaps.length ? 1 : 0;
+}
+var SHARED_KEY_MAP = {
+  TF_VAR_VERCEL_API_TOKEN: "vercelApiToken",
+  TF_VAR_CLOUDFLARE_API_TOKEN: "cloudflareApiToken",
+  TF_VAR_SUPABASE_ACCESS_TOKEN: "supabaseAccessToken",
+  TF_VAR_CLOUDFLARE_ZONE_ID: "cloudflareZoneId",
+  TF_VAR_CLOUDFLARE_ACCOUNT_ID: "cloudflareAccountId",
+  TF_VAR_VERCEL_TEAM_ID: "vercelTeamId",
+  VERCEL_TOKEN: "vercelToken",
+  AWS_ACCESS_KEY_ID: "r2AccessKeyId",
+  AWS_SECRET_ACCESS_KEY: "r2SecretAccessKey"
+};
+var ENV_KEY_MAP = {
+  SUPABASE_PROJECT_REF: "supabaseProjectRef",
+  NEXT_PUBLIC_SUPABASE_URL: "supabaseUrl",
+  NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY: "supabasePublishableKey",
+  SUPABASE_SECRET_KEY: "supabaseSecretKey",
+  SUPABASE_DB_PASSWORD: "supabaseDbPassword"
+};
+function capturedFromDoppler(prd, stg) {
+  const out = {};
+  for (const [dopplerKey, capKey] of Object.entries(SHARED_KEY_MAP)) {
+    if (prd[dopplerKey]) out[capKey] = prd[dopplerKey];
+  }
+  if (prd.TF_VAR_APP_DOMAIN) out.appDomain = prd.TF_VAR_APP_DOMAIN.replace(/^app\./, "");
+  for (const [env, cfg] of [["prd", prd], ["stg", stg]]) {
+    for (const [dopplerKey, capKey] of Object.entries(ENV_KEY_MAP)) {
+      if (cfg[dopplerKey]) out[`${env}_${capKey}`] = cfg[dopplerKey];
+    }
+  }
+  return out;
+}
+function assembleInputs(ctx) {
+  const c = ctx.captured;
+  const shared = {
+    slug: ctx.slug,
+    appDomain: c.appDomain ?? "",
+    vercelApiToken: c.vercelApiToken ?? "",
+    cloudflareApiToken: c.cloudflareApiToken ?? "",
+    supabaseAccessToken: c.supabaseAccessToken ?? "",
+    cloudflareZoneId: c.cloudflareZoneId ?? "",
+    cloudflareAccountId: c.cloudflareAccountId ?? "",
+    vercelToken: c.vercelToken ?? "",
+    r2AccessKeyId: c.r2AccessKeyId ?? "",
+    r2SecretAccessKey: c.r2SecretAccessKey ?? ""
+  };
+  if (c.vercelTeamId) shared.vercelTeamId = c.vercelTeamId;
+  const envFrom = (env) => ({
+    supabaseProjectRef: c[`${env}_supabaseProjectRef`] ?? "",
+    supabaseUrl: c[`${env}_supabaseUrl`] ?? "",
+    supabasePublishableKey: c[`${env}_supabasePublishableKey`] ?? "",
+    supabaseSecretKey: c[`${env}_supabaseSecretKey`] ?? "",
+    supabaseDbPassword: c[`${env}_supabaseDbPassword`] ?? ""
+  });
+  const stg = envFrom("stg");
+  return { shared, envs: { prd: envFrom("prd"), stg, dev: stg } };
+}
+
+// src/commands/create/index.ts
+var createCmd = new Command22("create").description(
+  "Create and provision a new project end to end"
+);
+createCmd.command("project [name]").description("Guided self-serve project + parallel-env provisioning").option("--dry-run", "Print the plan; mutate nothing").action(
+  async (name, opts) => process.exit(await runCreate(name, { dryRun: opts.dryRun }))
+);
+var setupCmd = new Command22("setup").description("Alias for `create project`").arguments("[name]").option("--dry-run", "Print the plan; mutate nothing").action(
+  async (name, opts) => process.exit(await runCreate(name, { dryRun: opts.dryRun }))
+);
+
 // src/index.ts
-import { readFileSync as readFileSync14 } from "fs";
+import { readFileSync as readFileSync15 } from "fs";
 import { fileURLToPath } from "url";
 import { dirname as dirname2, resolve as resolve2 } from "path";
 var __dirname = dirname2(fileURLToPath(import.meta.url));
-var pkg = JSON.parse(readFileSync14(resolve2(__dirname, "../package.json"), "utf-8"));
+var pkg = JSON.parse(readFileSync15(resolve2(__dirname, "../package.json"), "utf-8"));
 var GOLD = "\x1B[33m";
 var DIM = "\x1B[2m";
 var RESET = "\x1B[0m";
@@ -1731,7 +2239,7 @@ ${RESET}
   ${DIM}${cwd}${RESET}
 `);
 }
-var program = new Command21();
+var program = new Command23();
 program.name("odin").description("CLI for Odin \u2014 the knowledge backbone for Pebble House").version(VERSION);
 program.command("login").description("Authenticate with Odin via browser").action(async () => {
   printBanner();
@@ -1760,12 +2268,15 @@ program.addCommand(rulesCmd);
 program.addCommand(briefsCmd);
 program.addCommand(blueprintsCmd);
 program.addCommand(betsCmd);
+program.addCommand(betCommentsCmd);
 program.addCommand(tasksCmd);
 program.addCommand(roadmapsCmd);
 program.addCommand(personaRunsCmd);
 program.addCommand(blogCmd);
 program.addCommand(apiKeysCmd);
 program.addCommand(pebbleCmd);
+program.addCommand(createCmd);
+program.addCommand(setupCmd);
 process.on("exit", () => {
   process.stderr.write("\n\n\n\n\n");
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pebblehouse/odin-cli",
-  "version": "0.13.0",
+  "version": "0.14.1",
   "type": "module",
   "description": "CLI for Odin — the knowledge backbone for Pebble House",
   "bin": {