@sanity/workflow-cli 0.10.0 → 0.11.0

package/dist/commands/tail.js

@@ -31,7 +31,11 @@ export default class Tail extends WorkflowCommand {
         this.log(styleText('dim', `tailing ${styleText('bold', args.instanceId)} (${initial.definition} v${initial.pinnedVersion}, ${initial.history.length} prior entries, currently in ${initial.currentStage})`));
         this.log(styleText('dim', 'Ctrl+C to stop'));
         this.log('');
-        let seen = initial.history.length;
+        let rejectListen;
+        const listenFailed = new Promise((_, reject) => {
+            rejectListen = reject;
+        });
+        let printChain = Promise.resolve(initial.history.length);
         const subscription = client
             .listen(`*[_id == $id]`, { id: args.instanceId }, {
             includeResult: false,
@@ -39,17 +43,13 @@ export default class Tail extends WorkflowCommand {
             tag: TAIL_TAG,
         })
             .subscribe({
-            next: async () => {
-                try {
-                    seen = await this.printNewEntries({ client, instanceId: args.instanceId, seen });
-                }
-                catch (err) {
+            next: () => {
+                printChain = printChain.then((seen) => this.printNewEntries({ client, instanceId: args.instanceId, seen }).catch((err) => {
                     process.stderr.write(`${styleText('red', `${logSymbols.error} fetch failed:`)} ${errorMessage(err)}\n`);
-                }
-            },
-            error: (err) => {
-                fail('Listen subscription error:', failureDetail(err));
+                    return seen;
+                }));
             },
+            error: rejectListen,
         });
         const shutdown = () => {
             subscription.unsubscribe();
@@ -58,7 +58,10 @@ export default class Tail extends WorkflowCommand {
         };
         process.on('SIGINT', shutdown);
         process.on('SIGTERM', shutdown);
-        await new Promise(() => { });
+        await listenFailed.catch((err) => {
+            subscription.unsubscribe();
+            fail('Listen subscription error:', failureDetail(err));
+        });
     }
     async printNewEntries({ client, instanceId, seen, }) {
         const next = await client.getDocument(instanceId, { tag: TAIL_TAG });
@@ -68,6 +71,6 @@ export default class Tail extends WorkflowCommand {
         for (const entry of newEntries) {
             this.log(`${styleText('dim', `[${formatTimestamp(entry.at)}]`)} ${styleText('cyan', displayTitle(entry._type))}`);
         }
-        return next.history.length;
+        return Math.max(seen, next.history.length);
     }
 }

package/dist/hooks/prerun/telemetry.d.ts

@@ -1,5 +1,8 @@
 import type { Hook } from '@oclif/core';
 /** Builds and installs the invocation's telemetry shell before the command
- *  runs; the `finally` hook completes the trace and flushes. Never throws. */
+ *  runs; the `finally` hook completes the trace and flushes. Never throws.
+ *  An explicit `--share-defs` forces the store to send despite CI /
+ *  `DO_NOT_TRACK` — resolved from raw argv here, since the store is built
+ *  before oclif parses flags. */
 declare const hook: Hook<'prerun'>;
 export default hook;

package/dist/hooks/prerun/telemetry.js

@@ -1,5 +1,9 @@
+import { shouldForceShareTelemetry } from "../../lib/share-definitions.js";
 import { setupCliTelemetry } from "../../lib/telemetry-setup.js";
-const hook = async function ({ config }) {
-    await setupCliTelemetry({ cliVersion: config.version });
+const hook = async function ({ config, Command, argv }) {
+    await setupCliTelemetry({
+        cliVersion: config.version,
+        forceSend: shouldForceShareTelemetry({ commandId: Command?.id, argv }),
+    });
 };
 export default hook;

package/dist/lib/definitions.d.ts

@@ -9,6 +9,16 @@ export declare function buildDefinitionShowQuery(flags: DefinitionShowQueryArgs)
     groq: string;
     params: Record<string, unknown>;
 };
+/**
+ * The tag partitions holding any version of a definition name within one
+ * dataset. An untagged lookup that would span several partitions must error
+ * (the highest version ACROSS partitions is meaningless — it could show a
+ * prod operator the dev definition), the same way a cross-dataset hit does.
+ */
+export declare function buildDefinitionTagsQuery(name: string): {
+    groq: string;
+    params: Record<string, unknown>;
+};
 /**
  * Fetch the deployed definition a command targets — latest unless pinned via
  * `version`. An absent pinned version always fails (the caller asked for

package/dist/lib/definitions.js

@@ -14,6 +14,12 @@ export function buildDefinitionShowQuery(flags) {
     const groq = `*[${filters.join(' && ')}] | order(version desc) [0]`;
     return { groq, params };
 }
+export function buildDefinitionTagsQuery(name) {
+    return {
+        groq: `array::unique(*[_type == "${WORKFLOW_DEFINITION_TYPE}" && name == $name].tag)`,
+        params: { name },
+    };
+}
 export async function fetchDeployedDefinition({ client, name, tag, version, }) {
     const { groq, params } = buildDefinitionShowQuery({ name, tag, version });
     const deployed = await client.fetch(groq, params, {

package/dist/lib/fail.d.ts

@@ -3,6 +3,13 @@
  * stderr — no oclif framing, no Node stack — so expected failures
  * (validation, missing input, conflicting flags) read clean.
  *
+ * Exits by THROWING oclif's `ExitError`, never `process.exit`: the error
+ * rides the normal command lifecycle, so the `finally` hook still runs —
+ * completing the command trace and flushing batched telemetry — before
+ * oclif's handler exits 1 without printing anything further. A raw
+ * `process.exit` here would silently drop the trace and every batched
+ * event (including already-logged events from earlier in the command).
+ *
  * For unexpected failures (network, engine throw) prefer letting the
  * error propagate so the stack is visible for debugging.
  */

package/dist/lib/fail.js

@@ -1,4 +1,5 @@
 import { styleText } from 'node:util';
+import { Errors } from '@oclif/core';
 import { ClientError } from '@sanity/client';
 import { errorMessage } from '@sanity/workflow-engine';
 import logSymbols from 'log-symbols';
@@ -10,7 +11,7 @@ export function fail(headline, detail) {
             process.stderr.write(`  ${styleText(['dim', 'red'], line)}\n`);
         }
     }
-    process.exit(1);
+    return Errors.exit(1);
 }
 export function failOnThrow(headline, fn) {
     try {

package/dist/lib/share-definitions.d.ts

@@ -1,20 +1,24 @@
 /**
- * Definition sharing — an explicit per-invocation opt-in, independent of
- * telemetry consent. Sharing deployed workflow definitions with Sanity is
+ * Definition sharing — donating deployed workflow definitions to Sanity is
  * CONTENT sharing, not telemetry: definitions carry customer-authored
  * strings (names, titles, GROQ filters) that the telemetry payload policy
  * bans, so the documents go to Sanity's first-party definition-feedback
- * endpoint — one POST per deploy invocation — and telemetry carries only
- * a content-free marker per shared definition.
+ * endpoint — one POST per deploy invocation — and telemetry carries only a
+ * content-free marker per shared definition plus a per-invocation decision
+ * event.
  *
- * Consent model: flag-only, never a prompt, nothing persists. Sharing
- * happens exactly when `--share-definitions-with-sanity` is on the
- * invocation; without it, an interactive deploy that created new
- * definition versions logs a one-line stderr hint instead. The telemetry
- * environment gates (`DO_NOT_TRACK`, account consent) do not apply to
- * the feedback POST: it is explicit first-party consent, not tracking.
+ * Consent model: opt-OUT. A deploy that creates new definition versions
+ * donates by default. The choice is skipped by an explicit flag:
+ * `--share-defs` (donate, no prompt) or `--no-share-defs` (don't). Without a
+ * flag, an interactive terminal takes a ONE-TIME acknowledgement (persisted
+ * in the shared Sanity user config, so it is asked once ever) before the
+ * first donation — notice must precede the send, since we cannot disclose
+ * taking content after taking it. Unattended runs (CI / `DO_NOT_TRACK` / a
+ * non-TTY pipe) can't prompt, so they donate nothing — the standard Sanity-CLI
+ * "silent in CI / `DO_NOT_TRACK`" rule; opt in per run with `--share-defs`.
  */
 import { type DeployDefinitionResult, type DeployedDefinition, type WorkflowResource } from '@sanity/workflow-engine';
+import type { UserConfigStore } from './telemetry-setup.ts';
 import { type WorkflowDefinitionSharedData } from './telemetry.ts';
 /** The client slice sharing uses — the read-back of just-deployed
  *  documents and the feedback POST, structurally, so a full
@@ -46,13 +50,22 @@ export interface ShareCandidate {
  *  routed project-agnostically through the API gateway). */
 export declare const SHARE_ENDPOINT_URI = "/workflow/definition-feedback";
 /**
- * The hint's full copy — a product contract, pinned by test: it must
- * state honestly what sharing sends (the document ships VERBATIM, plus
- * its deployment coordinates) and what never is sent. Logged to stderr
- * after an interactive deploy that created new definition versions
- * without the flag — never a prompt, and never on CI / non-TTY runs.
+ * The first-run consent prompt — a product contract, pinned by test. It must
+ * name the recipient (Sanity), state that the document ships VERBATIM with its
+ * deployment coordinates and is kept, name what is never shared, and disclose
+ * that the answer is remembered machine-wide (not just for this deploy) with
+ * the per-run override. Shown once (persisted) before the first donation on an
+ * interactive terminal; the answer decides and is remembered.
  */
-export declare const SHARE_HINT: string;
+export declare const SHARE_CONSENT_PROMPT: string;
+/**
+ * The one-line reminders printed on every flagless interactive deploy after the
+ * first — product contracts, pinned by test. They keep an ongoing donation (or
+ * a remembered decline) visible every run, never silent, and name the per-run
+ * override. `_ON` shows when the remembered answer shares, `_OFF` when it does not.
+ */
+export declare const SHARE_REMINDER_ON: string;
+export declare const SHARE_REMINDER_OFF: string;
 /**
  * The content-free telemetry marker for one shared definition — projected
  * from the engine's own deploy-event derivation ({@link definitionDeployedData})
@@ -66,21 +79,42 @@ export declare function definitionShareMarker(args: {
     deployId: string;
 }): WorkflowDefinitionSharedData;
 /**
- * The whole post-deploy sharing flow. With the flag: created versions →
- * read-back → ONE feedback POST for the invocation → a content-free
- * telemetry marker per shared definition. Without it: the stderr hint
- * (interactive runs only), nothing sent. No newly created versions
- * (unchanged re-deploys, dry runs, nothing succeeded) means no hint and
- * no POST. Any sharing-path failure warns and returns: the deploy
- * already succeeded, and sharing must never turn it into a failure.
+ * Whether the invocation's telemetry should send despite the environment
+ * denial (CI / `DO_NOT_TRACK`). Only an explicit `--share-defs` that actually
+ * donates forces it — a command-line arg beats env vars, and a `--share-defs`
+ * donation must never be recorded-less. Account-level consent is never
+ * overridden (the intake still reads `/intake/telemetry-status`).
+ *
+ * Computed from raw argv because the prerun hook builds the store before oclif
+ * parses flags, so it must land on the same value oclif will: repeated
+ * `allowNo` booleans are **last-token-wins**, and tokens after `--` aren't
+ * flags. `--dry-run` / `--check` never create versions, so they never donate —
+ * no telemetry to force. The `share-defs` flag has no char/alias/env source,
+ * so `--share-defs` / `--no-share-defs` are its only tokens (add one and this
+ * match must learn it too).
+ */
+export declare function shouldForceShareTelemetry(args: {
+    commandId: string | undefined;
+    argv: string[];
+}): boolean;
+/**
+ * The whole post-deploy sharing flow. Resolves the opt-out decision (explicit
+ * flag, one-time acknowledgement, or standing policy), donates when it lands
+ * on share, and always records the content-free per-invocation decision so
+ * adoption dashboards can measure opt-out rate. No newly created versions
+ * (unchanged re-deploys, dry runs, nothing succeeded) means no decision, no
+ * prompt, and no POST.
  *
- * The optional args exist for the hint's dependencies, mirroring
+ * The optional args exist for the flow's dependencies, mirroring
  * `setupCliTelemetry` — omitted, the real process surfaces apply.
  */
 export declare function shareDefinitionsAfterDeploy(args: {
-    flag: boolean;
+    flag: boolean | undefined;
     candidates: ShareCandidate[];
     warn: (message: string) => void;
     interactive?: boolean;
+    envDenied?: boolean;
     writeStderr?: (message: string) => void;
+    userConfig?: UserConfigStore;
+    confirmShare?: () => Promise<boolean>;
 }): Promise<void>;

package/dist/lib/share-definitions.js

@@ -1,14 +1,21 @@
 import { styleText } from 'node:util';
-import { isInteractive } from '@sanity/cli-core';
-import { definitionDeployedData, errorMessage, } from '@sanity/workflow-engine';
+import { getUserConfig, isInteractive } from '@sanity/cli-core';
+import { confirm } from '@sanity/cli-core/ux';
+import { definitionDeployedData, errorMessage, isTelemetryEnvDenied, } from '@sanity/workflow-engine';
 import { buildDefinitionShowQuery } from "./definitions.js";
-import { cliTelemetry, WorkflowDefinitionShared, } from "./telemetry.js";
+import { cliTelemetry, WorkflowDefinitionShared, WorkflowDefinitionSharingDecided, } from "./telemetry.js";
 export const SHARE_ENDPOINT_URI = '/workflow/definition-feedback';
 const SHARE_TAG = 'definition.share';
-export const SHARE_HINT = `\n${styleText('bold', 'Enjoying workflows?')} Show us how you use them: deploy with\n` +
-    `${styleText('cyan', '--share-definitions-with-sanity')} to share newly created definition documents\n` +
-    '(verbatim, with their deployment coordinates) with Sanity — never content\n' +
-    'documents, workflow instances, or your Sanity auth token.\n';
+const SHARE_DECISION_KEY = 'workflowCliDefinitionSharing';
+export const SHARE_CONSENT_PROMPT = `${styleText('bold', 'Share the workflow definitions this deploy creates with Sanity?')}\n` +
+    'They are sent verbatim (structure, names, filters, effect configuration,\n' +
+    'seeded values) with their deployment coordinates, and kept to improve\n' +
+    'Editorial Workflows — never your content documents, workflow instances, or\n' +
+    'your Sanity auth token. Your answer is remembered for future deploys on\n' +
+    `this machine; override any run with ${styleText('cyan', '--share-defs')} / ${styleText('cyan', '--no-share-defs')}.`;
+export const SHARE_REMINDER_ON = `${styleText('bold', 'Sharing new workflow definitions with Sanity')} to improve Editorial Workflows` +
+    ` — opt out with ${styleText('cyan', '--no-share-defs')}.\n`;
+export const SHARE_REMINDER_OFF = `Not sharing workflow definitions with Sanity — share with ${styleText('cyan', '--share-defs')}.\n`;
 export function definitionShareMarker(args) {
     const { status: _status, ...structural } = definitionDeployedData(args.definition, {
         contentHash: args.contentHash,
@@ -17,6 +24,18 @@ export function definitionShareMarker(args) {
     });
     return structural;
 }
+export function shouldForceShareTelemetry(args) {
+    const { commandId, argv } = args;
+    if (commandId !== 'deploy') {
+        return false;
+    }
+    const terminator = argv.indexOf('--');
+    const tokens = terminator === -1 ? argv : argv.slice(0, terminator);
+    if (tokens.includes('--dry-run') || tokens.includes('--check')) {
+        return false;
+    }
+    return tokens.lastIndexOf('--share-defs') > tokens.lastIndexOf('--no-share-defs');
+}
 async function loadShareEntry(args) {
     const { candidate, result, warn } = args;
     const deployed = await loadDeployedForShare(args);
@@ -58,31 +77,60 @@ async function loadDeployedForShare(args) {
         return undefined;
     }
 }
-export async function shareDefinitionsAfterDeploy(args) {
-    const created = args.candidates.flatMap((candidate) => candidate.results
+function collectCreated(candidates) {
+    return candidates.flatMap((candidate) => candidate.results
         .filter((result) => result.status === 'created')
         .map((result) => ({ candidate, result })));
-    if (created.length === 0) {
-        return;
+}
+function readShareDecision(userConfig) {
+    const value = userConfig.get(SHARE_DECISION_KEY);
+    return typeof value === 'boolean' ? value : undefined;
+}
+async function promptFirstRun(args) {
+    let share;
+    try {
+        share = await args.confirmShare();
     }
-    if (!args.flag) {
-        const interactive = args.interactive ?? (isInteractive() && process.stderr.isTTY === true);
-        if (interactive) {
-            const writeStderr = args.writeStderr ?? ((message) => void process.stderr.write(message));
-            writeStderr(SHARE_HINT);
-        }
-        return;
+    catch {
+        return false;
+    }
+    try {
+        args.userConfig.set(SHARE_DECISION_KEY, share);
+    }
+    catch {
+    }
+    return share;
+}
+async function resolveShareIntent(args) {
+    if (args.flag === true) {
+        return { share: true, decision: 'opt-in' };
+    }
+    if (args.flag === false) {
+        return { share: false, decision: 'opt-out' };
+    }
+    const unattended = args.envDenied || !args.interactive;
+    if (unattended) {
+        return { share: false, decision: 'unattended' };
     }
+    const remembered = readShareDecision(args.userConfig);
+    if (remembered !== undefined) {
+        args.writeStderr(remembered ? SHARE_REMINDER_ON : SHARE_REMINDER_OFF);
+        return { share: remembered, decision: remembered ? 'remembered-share' : 'remembered-decline' };
+    }
+    const accepted = await promptFirstRun(args);
+    return { share: accepted, decision: accepted ? 'prompt-accepted' : 'prompt-declined' };
+}
+async function donate(args) {
     const shared = [];
     try {
-        for (const item of created) {
+        for (const item of args.created) {
             const entry = await loadShareEntry({ ...item, warn: args.warn });
             if (entry !== undefined) {
                 shared.push({ entry, candidate: item.candidate });
             }
         }
         if (shared.length === 0) {
-            return;
+            return false;
         }
         await shared[0].candidate.client.request({
             uri: SHARE_ENDPOINT_URI,
@@ -93,8 +141,12 @@ export async function shareDefinitionsAfterDeploy(args) {
     }
     catch (error) {
         args.warn(`Definition sharing failed — nothing shared. ${errorMessage(error)}`);
-        return;
+        return false;
     }
+    emitShareMarkers(shared);
+    return true;
+}
+function emitShareMarkers(shared) {
     try {
         const { logger } = cliTelemetry();
         for (const { entry, candidate } of shared) {
@@ -104,3 +156,32 @@ export async function shareDefinitionsAfterDeploy(args) {
     catch {
     }
 }
+function emitSharingDecided(data) {
+    try {
+        cliTelemetry().logger.log(WorkflowDefinitionSharingDecided, data);
+    }
+    catch {
+    }
+}
+export async function shareDefinitionsAfterDeploy(args) {
+    const created = collectCreated(args.candidates);
+    if (created.length === 0) {
+        return;
+    }
+    try {
+        const { share, decision } = await resolveShareIntent({
+            flag: args.flag,
+            interactive: args.interactive ?? (isInteractive() && process.stderr.isTTY === true),
+            envDenied: args.envDenied ?? isTelemetryEnvDenied(process.env),
+            userConfig: args.userConfig ?? getUserConfig(),
+            writeStderr: args.writeStderr ?? ((message) => void process.stderr.write(message)),
+            confirmShare: args.confirmShare ??
+                (() => confirm({ message: SHARE_CONSENT_PROMPT, default: true }, { output: process.stderr })),
+        });
+        const shared = share ? await donate({ created, warn: args.warn }) : false;
+        emitSharingDecided({ decision, shared, definitionCount: created.length });
+    }
+    catch (error) {
+        args.warn(`Definition sharing skipped — ${errorMessage(error)}`);
+    }
+}

package/dist/lib/telemetry-setup.d.ts

@@ -39,6 +39,10 @@ export declare function setupCliTelemetry(args?: {
     writeStderr?: (message: string) => void;
     /** The oclif config's version — the prerun hook supplies it. */
     cliVersion?: string;
+    /** Override the environment denial (CI / `DO_NOT_TRACK`) — the prerun hook
+     *  sets this for a deploy that explicitly opts into definition sharing with
+     *  `--share-defs`. */
+    forceSend?: boolean;
     /** Intake client override — tests inject a fake here, like the other
      *  hook dependencies above; omitted, the real project client applies. */
     client?: TelemetryIntakeClient;

package/dist/lib/telemetry-setup.js

@@ -49,23 +49,30 @@ export async function setupCliTelemetry(args) {
             client,
             projectId: project.projectId,
             env: args?.env ?? process.env,
+            forceSend: args?.forceSend ?? false,
         });
         setCliTelemetry(telemetry);
-        if (!telemetry.envDenied) {
-            telemetry.store.logger.updateUserProperties(cliUserProperties({ project, cliVersion: args?.cliVersion }));
-            void resolveOrgId(client, project.projectId).then((orgId) => {
-                if (orgId !== undefined)
-                    telemetry.store.logger.updateUserProperties({ orgId });
-            });
-            maybeShowTelemetryDisclosure({
-                userConfig: args?.userConfig ?? getUserConfig(),
-                writeStderr: args?.writeStderr ?? ((message) => void process.stderr.write(message)),
-            });
-        }
+        attachBuiltinContext({ telemetry, project, client, deps: args });
     }
     catch {
     }
 }
+function attachBuiltinContext(args) {
+    const { telemetry, project, client, deps } = args;
+    if (!telemetry.envDenied || telemetry.forceSend) {
+        telemetry.store.logger.updateUserProperties(cliUserProperties({ project, cliVersion: deps?.cliVersion }));
+        void resolveOrgId(client, project.projectId).then((orgId) => {
+            if (orgId !== undefined)
+                telemetry.store.logger.updateUserProperties({ orgId });
+        });
+    }
+    if (!telemetry.envDenied) {
+        maybeShowTelemetryDisclosure({
+            userConfig: deps?.userConfig ?? getUserConfig(),
+            writeStderr: deps?.writeStderr ?? ((message) => void process.stderr.write(message)),
+        });
+    }
+}
 const ORG_LOOKUP_DEADLINE_MS = 2_000;
 const CONTEXT_TAG = 'telemetry.context';
 export function cliUserProperties(args) {

package/dist/lib/telemetry.d.ts

@@ -23,7 +23,9 @@
  * never flag values, arguments, or error text. `Editorial Workflows
  * Definition Shared` is a content-free marker (hash + structural counts); the shared
  * document itself rides the first-party feedback endpoint, never
- * telemetry (see `share-definitions.ts`).
+ * telemetry (see `share-definitions.ts`). `Editorial Workflows Definition
+ * Sharing Decided` records the per-invocation consent outcome (default /
+ * opt-in / opt-out and whether anything was donated) — also content-free.
  */
 import { type DefinedTelemetryTrace, type TelemetryStore } from '@sanity/telemetry';
 import { type TelemetryIntakeClient, type WorkflowDefinitionDeployedData, type WorkflowTelemetryLogger } from '@sanity/workflow-engine';
@@ -42,6 +44,26 @@ export declare const WorkflowCliCommandExecuted: DefinedTelemetryTrace<WorkflowC
  *  are ever shared, so status carries nothing. */
 export type WorkflowDefinitionSharedData = Omit<WorkflowDefinitionDeployedData, 'status'>;
 export declare const WorkflowDefinitionShared: import("@sanity/telemetry").DefinedTelemetryLog<WorkflowDefinitionSharedData>;
+/**
+ * How the donation decision was reached, and what it was. Paired with `shared`
+ * (whether it actually reached the endpoint) this keeps every case distinct —
+ * an explicit decline vs a run that couldn't ask, and a chosen share vs a
+ * failed POST:
+ * - `opt-in` / `opt-out` — an explicit `--share-defs` / `--no-share-defs`.
+ * - `prompt-accepted` / `prompt-declined` — the first-run consent prompt.
+ * - `remembered-share` / `remembered-decline` — a persisted earlier answer.
+ * - `unattended` — CI / `DO_NOT_TRACK` / non-TTY: never asked, never shares.
+ */
+export type DefinitionSharingDecision = 'opt-in' | 'opt-out' | 'prompt-accepted' | 'prompt-declined' | 'remembered-share' | 'remembered-decline' | 'unattended';
+export interface WorkflowDefinitionSharingDecidedData {
+    decision: DefinitionSharingDecision;
+    /** Whether the donation actually reached the feedback endpoint — `false` for
+     *  any non-sharing decision, and also for a chosen share whose POST failed. */
+    shared: boolean;
+    /** Newly created definition versions this invocation could have donated. */
+    definitionCount: number;
+}
+export declare const WorkflowDefinitionSharingDecided: import("@sanity/telemetry").DefinedTelemetryLog<WorkflowDefinitionSharingDecidedData>;
 /**
  * The shell for one CLI invocation. `builtin` is the Sanity-intake store;
  * `provided` is a config-supplied logger that replaces the shell and its
@@ -53,6 +75,10 @@ export type CliTelemetry = {
     logger: WorkflowTelemetryLogger;
     store: TelemetryStore<unknown>;
     envDenied: boolean;
+    /** The environment denial was overridden ({@link createBuiltinTelemetry}):
+     *  the store sends despite CI / `DO_NOT_TRACK`, subject only to
+     *  account consent. */
+    forceSend: boolean;
 } | {
     kind: 'provided';
     logger: WorkflowTelemetryLogger;
@@ -66,11 +92,16 @@ export declare function cliTelemetry(): CliTelemetry;
 export declare function setCliTelemetry(telemetry: CliTelemetry): void;
 export declare function clearCliTelemetry(): void;
 /** Build the built-in Sanity-intake shell over an authenticated,
- *  project-bound client. */
+ *  project-bound client. `forceSend` overrides the environment denial
+ *  (CI / `DO_NOT_TRACK`) — an explicit `--share-defs` opts the deploy
+ *  invocation's telemetry in regardless (a command-line arg beats env
+ *  vars). Account-level consent is unaffected: the intake still fetches
+ *  `/intake/telemetry-status`, so `sanity telemetry disable` still mutes. */
 export declare function createBuiltinTelemetry(args: {
     client: TelemetryIntakeClient;
     projectId: string;
     env: Record<string, string | undefined>;
+    forceSend?: boolean;
 }): Extract<CliTelemetry, {
     kind: 'builtin';
 }>;

package/dist/lib/telemetry.js

@@ -8,7 +8,12 @@ export const WorkflowCliCommandExecuted = defineTrace({
 export const WorkflowDefinitionShared = defineEvent({
     name: 'Editorial Workflows Definition Shared',
     version: 1,
-    description: 'A newly created workflow definition version was donated through the explicit definition-sharing opt-in. Content-free marker: the content hash plus the same structural counts Editorial Workflows Definition Deployed carries — the document itself goes to the first-party definition-feedback endpoint, never through telemetry.',
+    description: 'A newly created workflow definition version was donated to Sanity. Content-free marker: the content hash plus the same structural counts Editorial Workflows Definition Deployed carries — the document itself goes to the first-party definition-feedback endpoint, never through telemetry.',
+});
+export const WorkflowDefinitionSharingDecided = defineEvent({
+    name: 'Editorial Workflows Definition Sharing Decided',
+    version: 1,
+    description: 'One per deploy invocation that created new definition versions: how the donation decision was reached and what it was (explicit flag / prompt accept-or-decline / remembered / unattended), whether anything reached the endpoint, and how many versions were eligible. Content-free — lets adoption dashboards separate explicit opt-outs, prompt declines, and unattended runs, and measure the true opt-out rate, without ever carrying the document.',
 });
 const OFF = { kind: 'off', logger: noopTelemetry };
 let current = OFF;
@@ -28,10 +33,10 @@ export function clearCliTelemetry() {
     activeTrace = undefined;
 }
 export function createBuiltinTelemetry(args) {
-    const { client, projectId, env } = args;
+    const { client, projectId, env, forceSend = false } = args;
     const envDenied = isTelemetryEnvDenied(env);
-    const store = createBatchedStore(createSessionId(), createTelemetryIntake({ client, projectId, denied: envDenied }));
-    return { kind: 'builtin', logger: store.logger, store, envDenied };
+    const store = createBatchedStore(createSessionId(), createTelemetryIntake({ client, projectId, denied: forceSend ? false : envDenied }));
+    return { kind: 'builtin', logger: store.logger, store, envDenied, forceSend };
 }
 function traceAsLogEvent(trace) {
     const { name, version, description } = trace;

package/dist/lib/ui.js

@@ -44,7 +44,6 @@ export function resourceLabel(resource) {
 export const activityIcon = {
     done: logSymbols.success,
     active: styleText('cyan', '●'),
-    pending: styleText('dim', '○'),
     failed: logSymbols.error,
     skipped: styleText('dim', '⊘'),
 };