@sanity/workflow-cli 0.10.0 → 0.12.0

package/dist/lib/fail.js

@@ -1,4 +1,5 @@
 import { styleText } from 'node:util';
+import { Errors } from '@oclif/core';
 import { ClientError } from '@sanity/client';
 import { errorMessage } from '@sanity/workflow-engine';
 import logSymbols from 'log-symbols';
@@ -10,7 +11,7 @@ export function fail(headline, detail) {
             process.stderr.write(`  ${styleText(['dim', 'red'], line)}\n`);
         }
     }
-    process.exit(1);
+    return Errors.exit(1);
 }
 export function failOnThrow(headline, fn) {
     try {

package/dist/lib/nuke.d.ts

@@ -0,0 +1,89 @@
+import { type WorkflowClient, type WorkflowResource } from '@sanity/workflow-engine';
+/** A resource a nuke may delete from, with the client that reads/writes it and
+ *  whether it is the engine's own resource — the only one that holds instances
+ *  and definitions (guards can co-locate with subjects in any resource). */
+export interface NukeTarget {
+    resource: WorkflowResource;
+    client: WorkflowClient;
+    holdsEngineDocs: boolean;
+}
+/** One resolved resource of a {@link NukePlan}: the ids to delete, by doc type. */
+export interface NukeResourcePlan {
+    resource: WorkflowResource;
+    /** The `project.dataset` (or `<type>:<id>`) label the operator confirms by. */
+    label: string;
+    client: WorkflowClient;
+    holdsEngineDocs: boolean;
+    instanceIds: string[];
+    definitionIds: string[];
+    guardIds: string[];
+}
+/** The dry-run plan: what a `nuke --tag <tag>` would delete, per resource. */
+export interface NukePlan {
+    tag: string;
+    resources: NukeResourcePlan[];
+}
+/** Per-doc-type totals across the whole plan, plus the count of resources that
+ *  actually hold something to delete ({@link involvedTargets}). */
+export interface PlanCounts {
+    instances: number;
+    definitions: number;
+    guards: number;
+    datasets: number;
+    total: number;
+}
+/**
+ * Resolve what a tag-scoped nuke would delete, per resource — the dry-run plan
+ * printed before any deletion. Instances and definitions are read only from the
+ * engine's own resource; guards are read from every target, since a guard
+ * co-locates with the subject it locks and may live in a foreign dataset.
+ *
+ * Every read uses the raw perspective, so a draft-form or otherwise
+ * perspective-hidden copy is still surfaced (and swept).
+ */
+export declare function resolveNukePlan(args: {
+    tag: string;
+    targets: NukeTarget[];
+}): Promise<NukePlan>;
+/**
+ * Does a guard doc belong to `tag`? A guard's `sourceInstanceId` is the id of
+ * the instance that registered it (`<tag>.wf-instance.<random>`), and its own
+ * `_id` embeds that same instance id
+ * (`temp.system.guard.<tag>.wf-instance.<random>.<name>`). Matching on either —
+ * with the trailing `.` so `prod` never matches `prod-eu` — catches guards
+ * whose `sourceInstanceId` was never written as well as guards whose instance
+ * is already gone.
+ */
+export declare function guardMatchesTag(guard: {
+    _id: string;
+    sourceInstanceId?: string;
+}, tag: string): boolean;
+/** The `project.dataset` labels of resources the plan actually deletes from —
+ *  the exact set the operator must type back to confirm. A resource with
+ *  nothing to delete is not "involved" and is omitted. */
+export declare function involvedTargets(plan: NukePlan): string[];
+/** Roll the plan up into per-doc-type totals for the summary and the
+ *  nothing-to-do short-circuit. */
+export declare function planCounts(plan: NukePlan): PlanCounts;
+/**
+ * Does the operator's typed confirmation name every involved target, and only
+ * those? Order-independent, whitespace-tolerant set equality: the operator
+ * pastes back all `project.dataset` targets the plan listed.
+ */
+export declare function confirmationMatches(input: string, targets: string[]): boolean;
+/** The dry-run plan as printable lines: a heading, the content-safety
+ *  invariant, the API host the deletes will hit (plan rows alone can't tell
+ *  same-named projects on different environments apart), and a per-resource,
+ *  per-doc-type count table. A guard-only foreign resource shows `—` for the
+ *  engine-only columns, since those docs can't live there. */
+export declare function renderNukePlan(plan: NukePlan, apiHost: string): string[];
+/** The success line: what was deleted, and across how many datasets. */
+export declare function formatNukeSummary(tag: string, counts: PlanCounts): string;
+/**
+ * Delete exactly what the plan printed, in uniform waves over every resource.
+ * Wave order is referrers-first — instances, then definitions, then guards —
+ * a nicety for an interrupted run (engine docs link by plain strings, so the
+ * lake enforces no order); non-engine resources simply carry empty
+ * instance/definition lists. Idempotent: an empty plan deletes nothing.
+ */
+export declare function executeNuke(plan: NukePlan): Promise<void>;

package/dist/lib/nuke.js

@@ -0,0 +1,111 @@
+import { styleText } from 'node:util';
+import { GUARD_DOC_TYPE, WORKFLOW_DEFINITION_TYPE, WORKFLOW_INSTANCE_TYPE, tagScopeFilter, } from '@sanity/workflow-engine';
+import { formatTable, resourceLabel, sectionHeader } from "./ui.js";
+const CHUNK = 200;
+const REQUEST_TAG = 'nuke';
+export async function resolveNukePlan(args) {
+    const { tag, targets } = args;
+    const resources = await Promise.all(targets.map((target) => resolveResourcePlan({ tag, target })));
+    return { tag, resources };
+}
+async function resolveResourcePlan(args) {
+    const { tag, target } = args;
+    const { resource, client, holdsEngineDocs } = target;
+    const noIds = [];
+    const [instanceIds, definitionIds, guardIds] = await Promise.all([
+        holdsEngineDocs ? engineDocIds({ client, type: WORKFLOW_INSTANCE_TYPE, tag }) : noIds,
+        holdsEngineDocs ? engineDocIds({ client, type: WORKFLOW_DEFINITION_TYPE, tag }) : noIds,
+        tagGuardIds({ client, tag }),
+    ]);
+    return {
+        resource,
+        label: resourceLabel(resource),
+        client,
+        holdsEngineDocs,
+        instanceIds,
+        definitionIds,
+        guardIds,
+    };
+}
+function engineDocIds(args) {
+    return args.client.fetch(`*[_type == $type && ${tagScopeFilter()}]._id`, { type: args.type, tag: args.tag }, { perspective: 'raw', tag: REQUEST_TAG });
+}
+async function tagGuardIds(args) {
+    const guards = await args.client.fetch(`*[_type == $type]{_id, sourceInstanceId}`, { type: GUARD_DOC_TYPE }, { perspective: 'raw', tag: REQUEST_TAG });
+    return guards.filter((guard) => guardMatchesTag(guard, args.tag)).map((guard) => guard._id);
+}
+export function guardMatchesTag(guard, tag) {
+    const instancePrefix = `${tag}.wf-instance.`;
+    const guardIdPrefix = `${GUARD_DOC_TYPE}.${instancePrefix}`;
+    return ((guard.sourceInstanceId?.startsWith(instancePrefix) ?? false) ||
+        guard._id.startsWith(guardIdPrefix));
+}
+export function involvedTargets(plan) {
+    return plan.resources
+        .filter((resource) => resourceTotal(resource) > 0)
+        .map((resource) => resource.label);
+}
+function resourceTotal(resource) {
+    return resource.instanceIds.length + resource.definitionIds.length + resource.guardIds.length;
+}
+export function planCounts(plan) {
+    const totals = plan.resources.reduce((acc, resource) => ({
+        instances: acc.instances + resource.instanceIds.length,
+        definitions: acc.definitions + resource.definitionIds.length,
+        guards: acc.guards + resource.guardIds.length,
+    }), { instances: 0, definitions: 0, guards: 0 });
+    return {
+        ...totals,
+        datasets: involvedTargets(plan).length,
+        total: totals.instances + totals.definitions + totals.guards,
+    };
+}
+export function confirmationMatches(input, targets) {
+    const typed = new Set(input.trim().split(/\s+/).filter(Boolean));
+    const expected = new Set(targets);
+    return typed.size === expected.size && [...expected].every((target) => typed.has(target));
+}
+export function renderNukePlan(plan, apiHost) {
+    const rows = plan.resources.map((resource) => [
+        resource.label,
+        resource.holdsEngineDocs ? String(resource.instanceIds.length) : styleText('dim', '—'),
+        resource.holdsEngineDocs ? String(resource.definitionIds.length) : styleText('dim', '—'),
+        String(resource.guardIds.length),
+    ]);
+    return [
+        sectionHeader(`nuke — tag "${plan.tag}"`),
+        styleText('dim', 'engine-owned documents only — content is never touched'),
+        styleText('dim', `API host: ${apiHost}`),
+        ...formatTable(['target', 'instances', 'definitions', 'guards'], rows),
+    ];
+}
+export function formatNukeSummary(tag, counts) {
+    const parts = [
+        pluralize(counts.instances, 'instance'),
+        pluralize(counts.definitions, 'definition'),
+        pluralize(counts.guards, 'guard'),
+    ].join(', ');
+    return `Nuked tag "${tag}": ${parts} across ${pluralize(counts.datasets, 'dataset')}.`;
+}
+function pluralize(count, noun) {
+    return `${count} ${noun}${count === 1 ? '' : 's'}`;
+}
+export async function executeNuke(plan) {
+    for (const resource of plan.resources) {
+        await deleteIds(resource.client, resource.instanceIds);
+    }
+    for (const resource of plan.resources) {
+        await deleteIds(resource.client, resource.definitionIds);
+    }
+    for (const resource of plan.resources) {
+        await deleteIds(resource.client, resource.guardIds);
+    }
+}
+async function deleteIds(client, ids) {
+    for (let start = 0; start < ids.length; start += CHUNK) {
+        const tx = client.transaction();
+        for (const id of ids.slice(start, start + CHUNK))
+            tx.delete(id);
+        await tx.commit({ tag: REQUEST_TAG });
+    }
+}

package/dist/lib/operation-args.d.ts

@@ -3,7 +3,9 @@ import { type EngineScopeArgs, type OperationArgs, type WorkflowTelemetryLogger
  * The engine-scope a CLI verb needs: which tag partition and which resource
  * the engine's own data lives in — {@link EngineScopeArgs} minus the client.
  * A {@link import('@sanity/workflow-engine').WorkflowDeployment} satisfies it,
- * so commands pass their resolved deployment straight through.
+ * so commands pass their resolved deployment straight through. The CLI passes
+ * no `resourceClients`, so its writes admit runtime-supplied refs to the
+ * workflow resource only.
  */
 export type EngineScope = Pick<EngineScopeArgs, 'tag' | 'workflowResource'>;
 /**

package/dist/lib/ops-report.d.ts

@@ -38,7 +38,8 @@ export declare function cascadeTail(cascaded: number): string;
  * emit the report — warn and bail on a no-op (`changed: false`), otherwise
  * succeed and print the ops block. A throw fails the spinner and exits
  * through {@link fail}. The one spinner + report + catch shape every write
- * command (abort, set-stage, fire-action, start, definition delete) shares.
+ * command (abort, set-stage, fire-action, start, definition delete, nuke)
+ * shares.
  */
 export declare function runWriteVerb<T>({ startLabel, failLabel, failHeadline, run, report, log, }: {
     startLabel: string;

package/dist/lib/prompt.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Can this process ask a question on stderr? A strict superset of the
+ * {@link isInteractive} gate cli-core's own prompts enforce (stdin TTY,
+ * `TERM` not dumb, no `CI` — so its `NonInteractiveError` can never escape a
+ * caller that checked here first), adding stderr-TTY because this package's
+ * prompts render on stderr: a redirected stderr must refuse rather than block
+ * on stdin with the question swallowed. The one predicate every prompt site
+ * (the deploy consent prompt, nuke's confirmation) shares.
+ */
+export declare function canPromptOnStderr(): boolean;

package/dist/lib/prompt.js

@@ -0,0 +1,4 @@
+import { isInteractive } from '@sanity/cli-core';
+export function canPromptOnStderr() {
+    return isInteractive() && process.stderr.isTTY === true;
+}

package/dist/lib/share-definitions.d.ts

@@ -1,20 +1,24 @@
 /**
- * Definition sharing — an explicit per-invocation opt-in, independent of
- * telemetry consent. Sharing deployed workflow definitions with Sanity is
+ * Definition sharing — donating deployed workflow definitions to Sanity is
  * CONTENT sharing, not telemetry: definitions carry customer-authored
  * strings (names, titles, GROQ filters) that the telemetry payload policy
  * bans, so the documents go to Sanity's first-party definition-feedback
- * endpoint — one POST per deploy invocation — and telemetry carries only
- * a content-free marker per shared definition.
+ * endpoint — one POST per deploy invocation — and telemetry carries only a
+ * content-free marker per shared definition plus a per-invocation decision
+ * event.
  *
- * Consent model: flag-only, never a prompt, nothing persists. Sharing
- * happens exactly when `--share-definitions-with-sanity` is on the
- * invocation; without it, an interactive deploy that created new
- * definition versions logs a one-line stderr hint instead. The telemetry
- * environment gates (`DO_NOT_TRACK`, account consent) do not apply to
- * the feedback POST: it is explicit first-party consent, not tracking.
+ * Consent model: opt-OUT. A deploy that creates new definition versions
+ * donates by default. The choice is skipped by an explicit flag:
+ * `--share-defs` (donate, no prompt) or `--no-share-defs` (don't). Without a
+ * flag, an interactive terminal takes a ONE-TIME acknowledgement (persisted
+ * in the shared Sanity user config, so it is asked once ever) before the
+ * first donation — notice must precede the send, since we cannot disclose
+ * taking content after taking it. Unattended runs (CI / `DO_NOT_TRACK` / a
+ * non-TTY pipe) can't prompt, so they donate nothing — the standard Sanity-CLI
+ * "silent in CI / `DO_NOT_TRACK`" rule; opt in per run with `--share-defs`.
  */
 import { type DeployDefinitionResult, type DeployedDefinition, type WorkflowResource } from '@sanity/workflow-engine';
+import type { UserConfigStore } from './telemetry-setup.ts';
 import { type WorkflowDefinitionSharedData } from './telemetry.ts';
 /** The client slice sharing uses — the read-back of just-deployed
  *  documents and the feedback POST, structurally, so a full
@@ -46,13 +50,22 @@ export interface ShareCandidate {
  *  routed project-agnostically through the API gateway). */
 export declare const SHARE_ENDPOINT_URI = "/workflow/definition-feedback";
 /**
- * The hint's full copy — a product contract, pinned by test: it must
- * state honestly what sharing sends (the document ships VERBATIM, plus
- * its deployment coordinates) and what never is sent. Logged to stderr
- * after an interactive deploy that created new definition versions
- * without the flag — never a prompt, and never on CI / non-TTY runs.
+ * The first-run consent prompt — a product contract, pinned by test. It must
+ * name the recipient (Sanity), state that the document ships VERBATIM with its
+ * deployment coordinates and is kept, name what is never shared, and disclose
+ * that the answer is remembered machine-wide (not just for this deploy) with
+ * the per-run override. Shown once (persisted) before the first donation on an
+ * interactive terminal; the answer decides and is remembered.
  */
-export declare const SHARE_HINT: string;
+export declare const SHARE_CONSENT_PROMPT: string;
+/**
+ * The one-line reminders printed on every flagless interactive deploy after the
+ * first — product contracts, pinned by test. They keep an ongoing donation (or
+ * a remembered decline) visible every run, never silent, and name the per-run
+ * override. `_ON` shows when the remembered answer shares, `_OFF` when it does not.
+ */
+export declare const SHARE_REMINDER_ON: string;
+export declare const SHARE_REMINDER_OFF: string;
 /**
  * The content-free telemetry marker for one shared definition — projected
  * from the engine's own deploy-event derivation ({@link definitionDeployedData})
@@ -66,21 +79,42 @@ export declare function definitionShareMarker(args: {
     deployId: string;
 }): WorkflowDefinitionSharedData;
 /**
- * The whole post-deploy sharing flow. With the flag: created versions →
- * read-back → ONE feedback POST for the invocation → a content-free
- * telemetry marker per shared definition. Without it: the stderr hint
- * (interactive runs only), nothing sent. No newly created versions
- * (unchanged re-deploys, dry runs, nothing succeeded) means no hint and
- * no POST. Any sharing-path failure warns and returns: the deploy
- * already succeeded, and sharing must never turn it into a failure.
+ * Whether the invocation's telemetry should send despite the environment
+ * denial (CI / `DO_NOT_TRACK`). Only an explicit `--share-defs` that actually
+ * donates forces it — a command-line arg beats env vars, and a `--share-defs`
+ * donation must never be recorded-less. Account-level consent is never
+ * overridden (the intake still reads `/intake/telemetry-status`).
+ *
+ * Computed from raw argv because the prerun hook builds the store before oclif
+ * parses flags, so it must land on the same value oclif will: repeated
+ * `allowNo` booleans are **last-token-wins**, and tokens after `--` aren't
+ * flags. `--dry-run` / `--check` never create versions, so they never donate —
+ * no telemetry to force. The `share-defs` flag has no char/alias/env source,
+ * so `--share-defs` / `--no-share-defs` are its only tokens (add one and this
+ * match must learn it too).
+ */
+export declare function shouldForceShareTelemetry(args: {
+    commandId: string | undefined;
+    argv: string[];
+}): boolean;
+/**
+ * The whole post-deploy sharing flow. Resolves the opt-out decision (explicit
+ * flag, one-time acknowledgement, or standing policy), donates when it lands
+ * on share, and always records the content-free per-invocation decision so
+ * adoption dashboards can measure opt-out rate. No newly created versions
+ * (unchanged re-deploys, dry runs, nothing succeeded) means no decision, no
+ * prompt, and no POST.
  *
- * The optional args exist for the hint's dependencies, mirroring
+ * The optional args exist for the flow's dependencies, mirroring
  * `setupCliTelemetry` — omitted, the real process surfaces apply.
  */
 export declare function shareDefinitionsAfterDeploy(args: {
-    flag: boolean;
+    flag: boolean | undefined;
     candidates: ShareCandidate[];
     warn: (message: string) => void;
     interactive?: boolean;
+    envDenied?: boolean;
     writeStderr?: (message: string) => void;
+    userConfig?: UserConfigStore;
+    confirmShare?: () => Promise<boolean>;
 }): Promise<void>;

package/dist/lib/share-definitions.js

@@ -1,14 +1,22 @@
 import { styleText } from 'node:util';
-import { isInteractive } from '@sanity/cli-core';
-import { definitionDeployedData, errorMessage, } from '@sanity/workflow-engine';
+import { getUserConfig } from '@sanity/cli-core';
+import { confirm } from '@sanity/cli-core/ux';
+import { assertReadableModel, definitionDeployedData, errorMessage, isTelemetryEnvDenied, } from '@sanity/workflow-engine';
 import { buildDefinitionShowQuery } from "./definitions.js";
-import { cliTelemetry, WorkflowDefinitionShared, } from "./telemetry.js";
+import { canPromptOnStderr } from "./prompt.js";
+import { cliTelemetry, WorkflowDefinitionShared, WorkflowDefinitionSharingDecided, } from "./telemetry.js";
 export const SHARE_ENDPOINT_URI = '/workflow/definition-feedback';
 const SHARE_TAG = 'definition.share';
-export const SHARE_HINT = `\n${styleText('bold', 'Enjoying workflows?')} Show us how you use them: deploy with\n` +
-    `${styleText('cyan', '--share-definitions-with-sanity')} to share newly created definition documents\n` +
-    '(verbatim, with their deployment coordinates) with Sanity — never content\n' +
-    'documents, workflow instances, or your Sanity auth token.\n';
+const SHARE_DECISION_KEY = 'workflowCliDefinitionSharing';
+export const SHARE_CONSENT_PROMPT = `${styleText('bold', 'Share the workflow definitions this deploy creates with Sanity?')}\n` +
+    'They are sent verbatim (structure, names, filters, effect configuration,\n' +
+    'seeded values) with their deployment coordinates, and kept to improve\n' +
+    'Editorial Workflows — never your content documents, workflow instances, or\n' +
+    'your Sanity auth token. Your answer is remembered for future deploys on\n' +
+    `this machine; override any run with ${styleText('cyan', '--share-defs')} / ${styleText('cyan', '--no-share-defs')}.`;
+export const SHARE_REMINDER_ON = `${styleText('bold', 'Sharing new workflow definitions with Sanity')} to improve Editorial Workflows` +
+    ` — opt out with ${styleText('cyan', '--no-share-defs')}.\n`;
+export const SHARE_REMINDER_OFF = `Not sharing workflow definitions with Sanity — share with ${styleText('cyan', '--share-defs')}.\n`;
 export function definitionShareMarker(args) {
     const { status: _status, ...structural } = definitionDeployedData(args.definition, {
         contentHash: args.contentHash,
@@ -17,6 +25,18 @@ export function definitionShareMarker(args) {
     });
     return structural;
 }
+export function shouldForceShareTelemetry(args) {
+    const { commandId, argv } = args;
+    if (commandId !== 'deploy') {
+        return false;
+    }
+    const terminator = argv.indexOf('--');
+    const tokens = terminator === -1 ? argv : argv.slice(0, terminator);
+    if (tokens.includes('--dry-run') || tokens.includes('--check')) {
+        return false;
+    }
+    return tokens.lastIndexOf('--share-defs') > tokens.lastIndexOf('--no-share-defs');
+}
 async function loadShareEntry(args) {
     const { candidate, result, warn } = args;
     const deployed = await loadDeployedForShare(args);
@@ -51,6 +71,7 @@ async function loadDeployedForShare(args) {
             warn(`Could not read back ${result.name} v${result.version} — not shared.`);
             return undefined;
         }
+        assertReadableModel(deployed);
         return deployed;
     }
     catch (error) {
@@ -58,31 +79,60 @@ async function loadDeployedForShare(args) {
         return undefined;
     }
 }
-export async function shareDefinitionsAfterDeploy(args) {
-    const created = args.candidates.flatMap((candidate) => candidate.results
+function collectCreated(candidates) {
+    return candidates.flatMap((candidate) => candidate.results
         .filter((result) => result.status === 'created')
         .map((result) => ({ candidate, result })));
-    if (created.length === 0) {
-        return;
+}
+function readShareDecision(userConfig) {
+    const value = userConfig.get(SHARE_DECISION_KEY);
+    return typeof value === 'boolean' ? value : undefined;
+}
+async function promptFirstRun(args) {
+    let share;
+    try {
+        share = await args.confirmShare();
     }
-    if (!args.flag) {
-        const interactive = args.interactive ?? (isInteractive() && process.stderr.isTTY === true);
-        if (interactive) {
-            const writeStderr = args.writeStderr ?? ((message) => void process.stderr.write(message));
-            writeStderr(SHARE_HINT);
-        }
-        return;
+    catch {
+        return false;
+    }
+    try {
+        args.userConfig.set(SHARE_DECISION_KEY, share);
+    }
+    catch {
+    }
+    return share;
+}
+async function resolveShareIntent(args) {
+    if (args.flag === true) {
+        return { share: true, decision: 'opt-in' };
+    }
+    if (args.flag === false) {
+        return { share: false, decision: 'opt-out' };
+    }
+    const unattended = args.envDenied || !args.interactive;
+    if (unattended) {
+        return { share: false, decision: 'unattended' };
     }
+    const remembered = readShareDecision(args.userConfig);
+    if (remembered !== undefined) {
+        args.writeStderr(remembered ? SHARE_REMINDER_ON : SHARE_REMINDER_OFF);
+        return { share: remembered, decision: remembered ? 'remembered-share' : 'remembered-decline' };
+    }
+    const accepted = await promptFirstRun(args);
+    return { share: accepted, decision: accepted ? 'prompt-accepted' : 'prompt-declined' };
+}
+async function donate(args) {
     const shared = [];
     try {
-        for (const item of created) {
+        for (const item of args.created) {
             const entry = await loadShareEntry({ ...item, warn: args.warn });
             if (entry !== undefined) {
                 shared.push({ entry, candidate: item.candidate });
             }
         }
         if (shared.length === 0) {
-            return;
+            return false;
         }
         await shared[0].candidate.client.request({
             uri: SHARE_ENDPOINT_URI,
@@ -93,8 +143,12 @@ export async function shareDefinitionsAfterDeploy(args) {
     }
     catch (error) {
         args.warn(`Definition sharing failed — nothing shared. ${errorMessage(error)}`);
-        return;
+        return false;
     }
+    emitShareMarkers(shared);
+    return true;
+}
+function emitShareMarkers(shared) {
     try {
         const { logger } = cliTelemetry();
         for (const { entry, candidate } of shared) {
@@ -104,3 +158,32 @@ export async function shareDefinitionsAfterDeploy(args) {
     catch {
     }
 }
+function emitSharingDecided(data) {
+    try {
+        cliTelemetry().logger.log(WorkflowDefinitionSharingDecided, data);
+    }
+    catch {
+    }
+}
+export async function shareDefinitionsAfterDeploy(args) {
+    const created = collectCreated(args.candidates);
+    if (created.length === 0) {
+        return;
+    }
+    try {
+        const { share, decision } = await resolveShareIntent({
+            flag: args.flag,
+            interactive: args.interactive ?? canPromptOnStderr(),
+            envDenied: args.envDenied ?? isTelemetryEnvDenied(process.env),
+            userConfig: args.userConfig ?? getUserConfig(),
+            writeStderr: args.writeStderr ?? ((message) => void process.stderr.write(message)),
+            confirmShare: args.confirmShare ??
+                (() => confirm({ message: SHARE_CONSENT_PROMPT, default: true }, { output: process.stderr })),
+        });
+        const shared = share ? await donate({ created, warn: args.warn }) : false;
+        emitSharingDecided({ decision, shared, definitionCount: created.length });
+    }
+    catch (error) {
+        args.warn(`Definition sharing skipped — ${errorMessage(error)}`);
+    }
+}

package/dist/lib/telemetry-setup.d.ts

@@ -39,6 +39,10 @@ export declare function setupCliTelemetry(args?: {
     writeStderr?: (message: string) => void;
     /** The oclif config's version — the prerun hook supplies it. */
     cliVersion?: string;
+    /** Override the environment denial (CI / `DO_NOT_TRACK`) — the prerun hook
+     *  sets this for a deploy that explicitly opts into definition sharing with
+     *  `--share-defs`. */
+    forceSend?: boolean;
     /** Intake client override — tests inject a fake here, like the other
      *  hook dependencies above; omitted, the real project client applies. */
     client?: TelemetryIntakeClient;

package/dist/lib/telemetry-setup.js

@@ -49,23 +49,30 @@ export async function setupCliTelemetry(args) {
             client,
             projectId: project.projectId,
             env: args?.env ?? process.env,
+            forceSend: args?.forceSend ?? false,
         });
         setCliTelemetry(telemetry);
-        if (!telemetry.envDenied) {
-            telemetry.store.logger.updateUserProperties(cliUserProperties({ project, cliVersion: args?.cliVersion }));
-            void resolveOrgId(client, project.projectId).then((orgId) => {
-                if (orgId !== undefined)
-                    telemetry.store.logger.updateUserProperties({ orgId });
-            });
-            maybeShowTelemetryDisclosure({
-                userConfig: args?.userConfig ?? getUserConfig(),
-                writeStderr: args?.writeStderr ?? ((message) => void process.stderr.write(message)),
-            });
-        }
+        attachBuiltinContext({ telemetry, project, client, deps: args });
     }
     catch {
     }
 }
+function attachBuiltinContext(args) {
+    const { telemetry, project, client, deps } = args;
+    if (!telemetry.envDenied || telemetry.forceSend) {
+        telemetry.store.logger.updateUserProperties(cliUserProperties({ project, cliVersion: deps?.cliVersion }));
+        void resolveOrgId(client, project.projectId).then((orgId) => {
+            if (orgId !== undefined)
+                telemetry.store.logger.updateUserProperties({ orgId });
+        });
+    }
+    if (!telemetry.envDenied) {
+        maybeShowTelemetryDisclosure({
+            userConfig: deps?.userConfig ?? getUserConfig(),
+            writeStderr: deps?.writeStderr ?? ((message) => void process.stderr.write(message)),
+        });
+    }
+}
 const ORG_LOOKUP_DEADLINE_MS = 2_000;
 const CONTEXT_TAG = 'telemetry.context';
 export function cliUserProperties(args) {