libretto 0.6.25 → 0.6.27

package/README.md

@@ -95,7 +95,7 @@ All Libretto state lives in a `.libretto/` directory at your project root. See t
 
 ## Telemetry
 
-Libretto records anonymous CLI telemetry to help understand CLI usage and help us prioritize improvements. Each resolved command can send only an install id, timestamp, command event name such as `libretto run`, and an error boolean. Libretto does not send command arguments, URLs, project paths, auth state, API keys, error messages or details, or user identity.
+Libretto records anonymous CLI telemetry to help understand CLI usage and help us prioritize improvements. Each resolved command can send only an install id, timestamp, command event name such as `libretto run`, error boolean, package version, and build channel (`node_modules`, `source`, or `unknown`). Libretto does not send command arguments, URLs, project paths, auth state, API keys, error messages or details, or user identity.
 
 The install id is stored in the telemetry file at `~/.libretto/telemetry.json`. The implementation lives in [`src/cli/core/telemetry.ts`](src/cli/core/telemetry.ts).
 

package/README.template.md

@@ -93,7 +93,7 @@ All Libretto state lives in a `.libretto/` directory at your project root. See t
 
 ## Telemetry
 
-Libretto records anonymous CLI telemetry to help understand CLI usage and help us prioritize improvements. Each resolved command can send only an install id, timestamp, command event name such as `libretto run`, and an error boolean. Libretto does not send command arguments, URLs, project paths, auth state, API keys, error messages or details, or user identity.
+Libretto records anonymous CLI telemetry to help understand CLI usage and help us prioritize improvements. Each resolved command can send only an install id, timestamp, command event name such as `libretto run`, error boolean, package version, and build channel (`node_modules`, `source`, or `unknown`). Libretto does not send command arguments, URLs, project paths, auth state, API keys, error messages or details, or user identity.
 
 The install id is stored in the telemetry file at `~/.libretto/telemetry.json`. The implementation lives in [`{{LIBRETTO_PATH_PREFIX}}src/cli/core/telemetry.ts`]({{LIBRETTO_PATH_PREFIX}}src/cli/core/telemetry.ts).
 

package/dist/cli/commands/cloud-sharing.js

@@ -0,0 +1,93 @@
+import { z } from "zod";
+import { SimpleCLI } from "affordance";
+import { orpcCall, resolveApiUrl } from "../core/auth-fetch.js";
+function requireCloudApiKey() {
+  const apiKey = process.env.LIBRETTO_API_KEY?.trim();
+  if (!apiKey) {
+    throw new Error(
+      "LIBRETTO_API_KEY is required to share Libretto Cloud workflow code. Issue one with `libretto cloud auth api-key issue --label <label>`."
+    );
+  }
+  return {
+    apiUrl: resolveApiUrl(null),
+    credential: { source: "env-api-key", apiKey }
+  };
+}
+const shareWorkflowCommand = SimpleCLI.command({
+  description: "Share one hosted workflow's code publicly"
+}).input(SimpleCLI.input({
+  positionals: [
+    SimpleCLI.positional("workflow", z.string().min(1), {
+      help: "Hosted workflow name to share"
+    })
+  ],
+  named: {
+    refresh: SimpleCLI.flag({
+      help: "Refresh an existing share from the workflow's current deployment"
+    })
+  }
+})).handle(async ({ input }) => {
+  const { apiUrl, credential } = requireCloudApiKey();
+  const response = await orpcCall({
+    apiUrl,
+    path: "/v1/workflows/share",
+    input: { workflow: input.workflow, refresh: input.refresh },
+    credential
+  });
+  if (response.status === "existing") {
+    console.log(`Workflow is already shared: ${response.workflow}`);
+    console.log("Use --refresh to update the shared code from the current deployment.");
+  } else if (response.status === "refreshed") {
+    console.log(`Refreshed shared workflow: ${response.workflow}`);
+  } else {
+    console.log(`Shared workflow: ${response.workflow}`);
+  }
+  console.log(`Marketplace URL: ${response.marketplace_url}`);
+  console.log(`Code URL: ${response.code_url}`);
+  return response.marketplace_url;
+});
+const codeSharingStatusCommand = SimpleCLI.command({
+  description: "Show whether tenant code sharing is enabled"
+}).input(SimpleCLI.input({ positionals: [], named: {} })).handle(async () => {
+  const { apiUrl, credential } = requireCloudApiKey();
+  const response = await orpcCall({
+    apiUrl,
+    path: "/v1/tenant/codeSharing",
+    input: {},
+    credential
+  });
+  console.log(`Code sharing: ${response.enabled ? "enabled" : "disabled"}`);
+  return response.enabled;
+});
+async function updateCodeSharing(enabled) {
+  const { apiUrl, credential } = requireCloudApiKey();
+  const response = await orpcCall({
+    apiUrl,
+    path: "/v1/tenant/updateCodeSharing",
+    input: { enabled },
+    credential
+  });
+  console.log(`Code sharing: ${response.enabled ? "enabled" : "disabled"}`);
+  return response.enabled;
+}
+const enableCodeSharingCommand = SimpleCLI.command({
+  description: "Enable public workflow code sharing for this tenant"
+}).input(SimpleCLI.input({ positionals: [], named: {} })).handle(async () => updateCodeSharing(true));
+const disableCodeSharingCommand = SimpleCLI.command({
+  description: "Disable public workflow code sharing for this tenant"
+}).input(SimpleCLI.input({ positionals: [], named: {} })).handle(async () => updateCodeSharing(false));
+const codeSharingCommands = SimpleCLI.group({
+  description: "Manage tenant workflow code sharing",
+  routes: {
+    status: codeSharingStatusCommand,
+    enable: enableCodeSharingCommand,
+    disable: disableCodeSharingCommand
+  }
+});
+export {
+  codeSharingCommands,
+  codeSharingStatusCommand,
+  disableCodeSharingCommand,
+  enableCodeSharingCommand,
+  shareWorkflowCommand
+};

package/dist/cli/core/deploy-artifact.js

@@ -12,7 +12,7 @@ import {
 } from "node:fs";
 import { createRequire, Module } from "node:module";
 import { tmpdir } from "node:os";
-import { dirname, isAbsolute, join, resolve } from "node:path";
+import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { gzipSync } from "node:zlib";
 import { build } from "esbuild";
@@ -337,7 +337,7 @@ function resolveWorkspaceSourcePath(info, subpath) {
   const directSubpath = subpath === "." ? "index" : subpath.slice(2);
   return resolvePathCandidates(info.dir, directSubpath);
 }
-function workspaceSourcePlugin(workspacePackages, externalPackages) {
+function workspaceSourcePlugin(workspacePackages, externalPackages, unresolvedWorkspaceImports) {
   return {
     name: "workspace-source-resolver",
     setup(buildApi) {
@@ -357,9 +357,8 @@ function workspaceSourcePlugin(workspacePackages, externalPackages) {
           match.subpath
         );
         if (!resolvedPath) {
-          throw new Error(
-            `Unable to resolve workspace import "${args.path}" from ${match.info.dir}.`
-          );
+          unresolvedWorkspaceImports?.set(args.path, match.info.dir);
+          return { path: args.path, external: true };
         }
         return { path: resolvedPath };
       });
@@ -438,6 +437,29 @@ function writeDeployMetadata(args) {
     JSON.stringify({ workflows: args.workflows }, null, 2) + "\n"
   );
 }
+function toPortableRelativePath(args) {
+  const relPath = relative(args.absSourceDir, args.absPath).replaceAll("\\", "/");
+  if (relPath.startsWith("../") || relPath === ".." || relPath.startsWith("/")) {
+    throw new Error(
+      `Deploy entry point must be inside the source directory to support cloud code sharing: ${args.absPath}`
+    );
+  }
+  return relPath;
+}
+function writeShareableSourceFiles(args) {
+  const relPaths = [...new Set(args.absSourcePaths.map(
+    (absPath) => toPortableRelativePath({
+      absPath,
+      absSourceDir: args.absSourceDir
+    })
+  ))].sort();
+  for (const relPath of relPaths) {
+    const targetPath = join(args.outputDir, ".libretto-share", "source", relPath);
+    mkdirSync(dirname(targetPath), { recursive: true });
+    cpSync(resolve(args.absSourceDir, relPath), targetPath);
+  }
+  return relPaths;
+}
 function shouldVendorCurrentLibretto(versionSpec) {
   return versionSpec.startsWith("file:") || versionSpec.startsWith("link:") || versionSpec.startsWith("workspace:") || versionSpec.startsWith("portal:") || versionSpec.includes("&path:");
 }
@@ -693,6 +715,7 @@ ${exportLines}
 }
 async function writeBundledDeployEntrypoint(args) {
   try {
+    const unresolvedWorkspaceImports = /* @__PURE__ */ new Map();
     const implementationBuild = await build({
       absWorkingDir: args.absSourceDir,
       bundle: true,
@@ -701,13 +724,25 @@ async function writeBundledDeployEntrypoint(args) {
       format: "cjs",
       outfile: "prebundled.cjs",
       platform: "node",
+      metafile: true,
       plugins: [
-        workspaceSourcePlugin(args.workspacePackages, args.externalPackages)
+        workspaceSourcePlugin(
+          args.workspacePackages,
+          args.externalPackages,
+          unresolvedWorkspaceImports
+        )
       ],
       splitting: false,
       target: "node20",
       write: false
     });
+    const [unresolvedImport] = unresolvedWorkspaceImports;
+    if (unresolvedImport) {
+      const [importPath, packageDir] = unresolvedImport;
+      throw new Error(
+        `Unable to resolve workspace import "${importPath}" from ${packageDir}.`
+      );
+    }
     const bundledImplementation = implementationBuild.outputFiles?.find(
       (file) => file.path.endsWith("prebundled.cjs")
     );
@@ -730,7 +765,13 @@ async function writeBundledDeployEntrypoint(args) {
         workflows
       })
     );
-    return workflows;
+    const shareableSourceFiles = Object.keys(implementationBuild.metafile?.inputs ?? {}).map(
+      (inputPath) => isAbsolute(inputPath) ? resolve(inputPath) : resolve(args.absSourceDir, inputPath)
+    ).filter((absPath) => {
+      const relPath = relative(args.absSourceDir, absPath);
+      return relPath !== "" && !relPath.startsWith("../") && relPath !== ".." && !isAbsolute(relPath);
+    });
+    return { shareableSourceFiles, workflows };
   } catch (error) {
     throw new Error(
       `Failed to bundle deploy entry point ${args.absEntryPoint}.
@@ -754,7 +795,7 @@ async function createHostedDeployPackage(args) {
   const workspacePackages = discoverWorkspacePackages(absSourceDir);
   let callerOwnsTempRoot = false;
   try {
-    const workflows = await writeBundledDeployEntrypoint({
+    const { shareableSourceFiles, workflows } = await writeBundledDeployEntrypoint({
       absEntryPoint,
       absSourceDir,
       deploymentName: args.deploymentName,
@@ -762,6 +803,20 @@ async function createHostedDeployPackage(args) {
       outputDir,
       workspacePackages
     });
+    const sourceFiles = writeShareableSourceFiles({
+      absSourceDir,
+      absSourcePaths: [...shareableSourceFiles, absEntryPoint],
+      outputDir
+    });
+    const sourceFile = toPortableRelativePath({
+      absPath: absEntryPoint,
+      absSourceDir
+    });
+    const workflowsWithShareableSource = workflows.map((workflow) => ({
+      ...workflow,
+      sourceFile,
+      sourceFiles
+    }));
     if (librettoDependency === "file:./libretto") {
       copyCurrentLibrettoPackage(outputDir);
     }
@@ -772,7 +827,7 @@ async function createHostedDeployPackage(args) {
       outputDir,
       sourceDir: absSourceDir
     });
-    writeDeployMetadata({ outputDir, workflows });
+    writeDeployMetadata({ outputDir, workflows: workflowsWithShareableSource });
     callerOwnsTempRoot = true;
     return {
       cleanup: () => {
@@ -780,7 +835,7 @@ async function createHostedDeployPackage(args) {
       },
       entryPoint: "index.js",
       outputDir,
-      workflows
+      workflows: workflowsWithShareableSource
     };
   } finally {
     if (!callerOwnsTempRoot) {

package/dist/cli/core/telemetry.js

@@ -1,11 +1,38 @@
 import { randomUUID } from "node:crypto";
+import { existsSync, readFileSync } from "node:fs";
 import { promises as fs } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { basename, dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
 import { resolveHostedApiUrl } from "./auth-fetch.js";
 const TELEMETRY_FILE_NAME = "telemetry.json";
 const TELEMETRY_ENDPOINT_PATH = "/v1/telemetry/recordCliEvent";
 const TELEMETRY_TIMEOUT_MS = 250;
+function packageRoot() {
+  return join(dirname(fileURLToPath(import.meta.url)), "../../..");
+}
+function readPackageVersion() {
+  try {
+    const parsed = JSON.parse(
+      readFileSync(join(packageRoot(), "package.json"), "utf8")
+    );
+    return typeof parsed.version === "string" ? parsed.version : "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+function resolveBuildChannel() {
+  const root = packageRoot();
+  const workspaceRoot = join(root, "../..");
+  if (basename(dirname(root)) === "packages" && existsSync(join(workspaceRoot, "pnpm-workspace.yaml"))) {
+    return "source";
+  }
+  const pathSegments = root.split(/[\\/]+/);
+  if (pathSegments.includes("node_modules")) return "node_modules";
+  return "unknown";
+}
+const packageVersion = readPackageVersion();
+const buildChannel = resolveBuildChannel();
 function telemetryDir() {
   return join(homedir(), ".libretto");
 }
@@ -39,7 +66,7 @@ function writeTelemetryNotice() {
   if (!process.stderr.isTTY) return;
   process.stderr.write(
     [
-      "Libretto collects anonymous CLI telemetry: install id, timestamp, command event, and error status only.",
+      "Libretto collects anonymous CLI telemetry: install id, timestamp, command event, error status, package version, and build channel only.",
       "Set LIBRETTO_TELEMETRY_DISABLED=1 or DO_NOT_TRACK=1 to disable it, or set enabled:false in ~/.libretto/telemetry.json."
     ].join(" ") + "\n"
   );
@@ -59,7 +86,9 @@ async function recordCliTelemetryEvent(command, error) {
     installId,
     timestamp: (/* @__PURE__ */ new Date()).toISOString(),
     event: `libretto ${command.path.join(" ")}`,
-    error
+    error,
+    packageVersion,
+    buildChannel
   });
 }
 async function sendWithTimeout(payload) {

package/dist/cli/router.js

@@ -2,6 +2,7 @@ import { authCommands } from "./commands/auth.js";
 import { billingCommands } from "./commands/billing.js";
 import { browserCommands } from "./commands/browser.js";
 import { cloudCredentialCommands } from "./commands/cloud-credentials.js";
+import { codeSharingCommands, shareWorkflowCommand } from "./commands/cloud-sharing.js";
 import { deployCommand } from "./commands/deploy.js";
 import { executionCommands } from "./commands/execution.js";
 import { experimentsCommand } from "./commands/experiments.js";
@@ -23,7 +24,9 @@ const cliRoutes = {
       auth: authCommands,
       billing: billingCommands,
       credentials: cloudCredentialCommands,
-      profiles: profileCommands
+      profiles: profileCommands,
+      share: shareWorkflowCommand,
+      sharing: codeSharingCommands
     }
   }),
   experiments: experimentsCommand,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "libretto",
-  "version": "0.6.25",
+  "version": "0.6.27",
   "description": "AI-powered browser automation library and CLI built on Playwright",
   "license": "MIT",
   "homepage": "https://libretto.sh",

package/skills/libretto/SKILL.md

@@ -4,7 +4,7 @@ description: "Browser automation CLI for building, maintaining, and running brow
 license: MIT
 metadata:
   author: saffron-health
-  version: "0.6.25"
+  version: "0.6.27"
 ---
 
 ## How Libretto Works

package/skills/libretto-readonly/SKILL.md

@@ -4,7 +4,7 @@ description: "Read-only Libretto workflow for diagnosing live browser state with
 license: MIT
 metadata:
   author: saffron-health
-  version: "0.6.25"
+  version: "0.6.27"
 ---
 
 ## How Libretto Read-Only Works

package/src/cli/commands/cloud-sharing.ts

@@ -0,0 +1,114 @@
+import { z } from "zod";
+import { SimpleCLI } from "affordance";
+import { orpcCall, resolveApiUrl } from "../core/auth-fetch.js";
+
+type CodeSharingStatusResponse = {
+  enabled: boolean;
+};
+
+type ShareWorkflowResponse = {
+  id: string;
+  status: "created" | "existing" | "refreshed";
+  workflow: string;
+  marketplace_url: string;
+  code_url: string;
+};
+
+function requireCloudApiKey() {
+  const apiKey = process.env.LIBRETTO_API_KEY?.trim();
+  if (!apiKey) {
+    throw new Error(
+      "LIBRETTO_API_KEY is required to share Libretto Cloud workflow code. Issue one with `libretto cloud auth api-key issue --label <label>`.",
+    );
+  }
+  return {
+    apiUrl: resolveApiUrl(null),
+    credential: { source: "env-api-key" as const, apiKey },
+  };
+}
+
+export const shareWorkflowCommand = SimpleCLI.command({
+  description: "Share one hosted workflow's code publicly",
+})
+  .input(SimpleCLI.input({
+    positionals: [
+      SimpleCLI.positional("workflow", z.string().min(1), {
+        help: "Hosted workflow name to share",
+      }),
+    ],
+    named: {
+      refresh: SimpleCLI.flag({
+        help: "Refresh an existing share from the workflow's current deployment",
+      }),
+    },
+  }))
+  .handle(async ({ input }) => {
+    const { apiUrl, credential } = requireCloudApiKey();
+    const response = await orpcCall<ShareWorkflowResponse>({
+      apiUrl,
+      path: "/v1/workflows/share",
+      input: { workflow: input.workflow, refresh: input.refresh },
+      credential,
+    });
+
+    if (response.status === "existing") {
+      console.log(`Workflow is already shared: ${response.workflow}`);
+      console.log("Use --refresh to update the shared code from the current deployment.");
+    } else if (response.status === "refreshed") {
+      console.log(`Refreshed shared workflow: ${response.workflow}`);
+    } else {
+      console.log(`Shared workflow: ${response.workflow}`);
+    }
+    console.log(`Marketplace URL: ${response.marketplace_url}`);
+    console.log(`Code URL: ${response.code_url}`);
+    return response.marketplace_url;
+  });
+
+export const codeSharingStatusCommand = SimpleCLI.command({
+  description: "Show whether tenant code sharing is enabled",
+})
+  .input(SimpleCLI.input({ positionals: [], named: {} }))
+  .handle(async () => {
+    const { apiUrl, credential } = requireCloudApiKey();
+    const response = await orpcCall<CodeSharingStatusResponse>({
+      apiUrl,
+      path: "/v1/tenant/codeSharing",
+      input: {},
+      credential,
+    });
+    console.log(`Code sharing: ${response.enabled ? "enabled" : "disabled"}`);
+    return response.enabled;
+  });
+
+async function updateCodeSharing(enabled: boolean): Promise<boolean> {
+  const { apiUrl, credential } = requireCloudApiKey();
+  const response = await orpcCall<CodeSharingStatusResponse>({
+    apiUrl,
+    path: "/v1/tenant/updateCodeSharing",
+    input: { enabled },
+    credential,
+  });
+  console.log(`Code sharing: ${response.enabled ? "enabled" : "disabled"}`);
+  return response.enabled;
+}
+
+export const enableCodeSharingCommand = SimpleCLI.command({
+  description: "Enable public workflow code sharing for this tenant",
+})
+  .input(SimpleCLI.input({ positionals: [], named: {} }))
+  .handle(async () => updateCodeSharing(true));
+
+export const disableCodeSharingCommand = SimpleCLI.command({
+  description: "Disable public workflow code sharing for this tenant",
+})
+  .input(SimpleCLI.input({ positionals: [], named: {} }))
+  .handle(async () => updateCodeSharing(false));
+
+export const codeSharingCommands = SimpleCLI.group({
+  description: "Manage tenant workflow code sharing",
+  routes: {
+    status: codeSharingStatusCommand,
+    enable: enableCodeSharingCommand,
+    disable: disableCodeSharingCommand,
+  },
+});

package/src/cli/core/deploy-artifact.ts

@@ -12,7 +12,7 @@ import {
 } from "node:fs";
 import { createRequire, Module } from "node:module";
 import { tmpdir } from "node:os";
-import { dirname, isAbsolute, join, resolve } from "node:path";
+import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { gzipSync } from "node:zlib";
 import { build } from "esbuild";
@@ -57,6 +57,8 @@ export type WorkflowDeployMetadata = {
   credentialNames: string[];
   authProfileName?: string;
   authProfileRefresh?: boolean;
+  sourceFile?: string;
+  sourceFiles?: string[];
 };
 
 type BuildHostedDeployTarballArgs = {
@@ -473,13 +475,17 @@ function resolveWorkspaceSourcePath(
 function workspaceSourcePlugin(
   workspacePackages: Map<string, WorkspacePackage>,
   externalPackages: ReadonlySet<string>,
+  unresolvedWorkspaceImports?: Map<string, string>,
 ) {
   return {
     name: "workspace-source-resolver",
     setup(buildApi: {
       onResolve: (
         options: { filter: RegExp },
-        callback: (args: { path: string }) => { path: string } | null,
+        callback: (args: { path: string }) =>
+          | { path: string }
+          | { path: string; external: true }
+          | null,
       ) => void;
     }) {
       // Workspace imports are treated as bundle input, so their code is
@@ -503,9 +509,8 @@ function workspaceSourcePlugin(
           match.subpath,
         );
         if (!resolvedPath) {
-          throw new Error(
-            `Unable to resolve workspace import "${args.path}" from ${match.info.dir}.`,
-          );
+          unresolvedWorkspaceImports?.set(args.path, match.info.dir);
+          return { path: args.path, external: true };
         }
 
         return { path: resolvedPath };
@@ -618,6 +623,40 @@ function writeDeployMetadata(args: {
   );
 }
 
+function toPortableRelativePath(args: {
+  absSourceDir: string;
+  absPath: string;
+}): string {
+  const relPath = relative(args.absSourceDir, args.absPath).replaceAll("\\", "/");
+  if (relPath.startsWith("../") || relPath === ".." || relPath.startsWith("/")) {
+    throw new Error(
+      `Deploy entry point must be inside the source directory to support cloud code sharing: ${args.absPath}`,
+    );
+  }
+  return relPath;
+}
+
+function writeShareableSourceFiles(args: {
+  absSourceDir: string;
+  absSourcePaths: readonly string[];
+  outputDir: string;
+}): string[] {
+  const relPaths = [...new Set(args.absSourcePaths.map((absPath) =>
+    toPortableRelativePath({
+      absPath,
+      absSourceDir: args.absSourceDir,
+    }),
+  ))].sort();
+
+  for (const relPath of relPaths) {
+    const targetPath = join(args.outputDir, ".libretto-share", "source", relPath);
+    mkdirSync(dirname(targetPath), { recursive: true });
+    cpSync(resolve(args.absSourceDir, relPath), targetPath);
+  }
+
+  return relPaths;
+}
+
 function shouldVendorCurrentLibretto(versionSpec: string): boolean {
   return (
     versionSpec.startsWith("file:") ||
@@ -963,8 +1002,12 @@ async function writeBundledDeployEntrypoint(args: {
   externalPackages: ReadonlySet<string>;
   outputDir: string;
   workspacePackages: Map<string, WorkspacePackage>;
-}): Promise<WorkflowDeployMetadata[]> {
+}): Promise<{
+  shareableSourceFiles: string[];
+  workflows: WorkflowDeployMetadata[];
+}> {
   try {
+    const unresolvedWorkspaceImports = new Map<string, string>();
     // The implementation bundle is CommonJS so the bootstrap can load it lazily
     // with createRequire() after workflow discovery, while external packages
     // continue to load through normal Node module resolution.
@@ -976,13 +1019,25 @@ async function writeBundledDeployEntrypoint(args: {
       format: "cjs",
       outfile: "prebundled.cjs",
       platform: "node",
+      metafile: true,
       plugins: [
-        workspaceSourcePlugin(args.workspacePackages, args.externalPackages),
+        workspaceSourcePlugin(
+          args.workspacePackages,
+          args.externalPackages,
+          unresolvedWorkspaceImports,
+        ),
       ],
       splitting: false,
       target: "node20",
       write: false,
     });
+    const [unresolvedImport] = unresolvedWorkspaceImports;
+    if (unresolvedImport) {
+      const [importPath, packageDir] = unresolvedImport;
+      throw new Error(
+        `Unable to resolve workspace import "${importPath}" from ${packageDir}.`,
+      );
+    }
 
     const bundledImplementation = implementationBuild.outputFiles?.find(
       (file) => file.path.endsWith("prebundled.cjs"),
@@ -1008,7 +1063,22 @@ async function writeBundledDeployEntrypoint(args: {
         workflows,
       }),
     );
-    return workflows;
+    const shareableSourceFiles = Object.keys(implementationBuild.metafile?.inputs ?? {})
+      .map((inputPath) =>
+        isAbsolute(inputPath)
+          ? resolve(inputPath)
+          : resolve(args.absSourceDir, inputPath),
+      )
+      .filter((absPath) => {
+        const relPath = relative(args.absSourceDir, absPath);
+        return (
+          relPath !== "" &&
+          !relPath.startsWith("../") &&
+          relPath !== ".." &&
+          !isAbsolute(relPath)
+        );
+      });
+    return { shareableSourceFiles, workflows };
   } catch (error) {
     throw new Error(
       `Failed to bundle deploy entry point ${args.absEntryPoint}.\n${formatBuildError(error)}`,
@@ -1040,7 +1110,7 @@ export async function createHostedDeployPackage(
   let callerOwnsTempRoot = false;
 
   try {
-    const workflows = await writeBundledDeployEntrypoint({
+    const { shareableSourceFiles, workflows } = await writeBundledDeployEntrypoint({
       absEntryPoint,
       absSourceDir,
       deploymentName: args.deploymentName,
@@ -1048,6 +1118,20 @@ export async function createHostedDeployPackage(
       outputDir,
       workspacePackages,
     });
+    const sourceFiles = writeShareableSourceFiles({
+      absSourceDir,
+      absSourcePaths: [...shareableSourceFiles, absEntryPoint],
+      outputDir,
+    });
+    const sourceFile = toPortableRelativePath({
+      absPath: absEntryPoint,
+      absSourceDir,
+    });
+    const workflowsWithShareableSource = workflows.map((workflow) => ({
+      ...workflow,
+      sourceFile,
+      sourceFiles,
+    }));
 
     if (librettoDependency === "file:./libretto") {
       copyCurrentLibrettoPackage(outputDir);
@@ -1063,7 +1147,7 @@ export async function createHostedDeployPackage(
       outputDir,
       sourceDir: absSourceDir,
     });
-    writeDeployMetadata({ outputDir, workflows });
+    writeDeployMetadata({ outputDir, workflows: workflowsWithShareableSource });
 
     // Success transfers ownership of the temp directory to the caller, who is
     // responsible for invoking cleanup() after the tarball/upload step.
@@ -1074,7 +1158,7 @@ export async function createHostedDeployPackage(
         },
         entryPoint: "index.js",
         outputDir,
-        workflows,
+        workflows: workflowsWithShareableSource,
       };
   } finally {
     // On any failure before we return, this function still owns the temp dir

package/src/cli/core/telemetry.ts

@@ -1,7 +1,9 @@
 import { randomUUID } from "node:crypto";
+import { existsSync, readFileSync } from "node:fs";
 import { promises as fs } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { basename, dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
 import type { SimpleCLICommandMeta, SimpleCLIMiddleware } from "affordance";
 import { resolveHostedApiUrl } from "./auth-fetch.js";
 
@@ -9,6 +11,8 @@ const TELEMETRY_FILE_NAME = "telemetry.json";
 const TELEMETRY_ENDPOINT_PATH = "/v1/telemetry/recordCliEvent";
 const TELEMETRY_TIMEOUT_MS = 250;
 
+type BuildChannel = "node_modules" | "source" | "unknown";
+
 type StoredTelemetryState = {
   installId?: string;
   enabled?: boolean;
@@ -19,8 +23,48 @@ type CliTelemetryPayload = {
   timestamp: string;
   event: string;
   error: boolean;
+  packageVersion: string;
+  buildChannel: BuildChannel;
+};
+
+type PackageJson = {
+  version?: unknown;
 };
 
+function packageRoot(): string {
+  return join(dirname(fileURLToPath(import.meta.url)), "../../..");
+}
+
+function readPackageVersion(): string {
+  try {
+    const parsed = JSON.parse(
+      readFileSync(join(packageRoot(), "package.json"), "utf8"),
+    ) as PackageJson;
+    return typeof parsed.version === "string" ? parsed.version : "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+
+function resolveBuildChannel(): BuildChannel {
+  const root = packageRoot();
+  const workspaceRoot = join(root, "../..");
+  if (
+    basename(dirname(root)) === "packages" &&
+    existsSync(join(workspaceRoot, "pnpm-workspace.yaml"))
+  ) {
+    return "source";
+  }
+
+  const pathSegments = root.split(/[\\/]+/);
+  if (pathSegments.includes("node_modules")) return "node_modules";
+
+  return "unknown";
+}
+
+const packageVersion = readPackageVersion();
+const buildChannel = resolveBuildChannel();
+
 function telemetryDir(): string {
   return join(homedir(), ".libretto");
 }
@@ -65,7 +109,7 @@ function writeTelemetryNotice(): void {
   if (!process.stderr.isTTY) return;
   process.stderr.write(
     [
-      "Libretto collects anonymous CLI telemetry: install id, timestamp, command event, and error status only.",
+      "Libretto collects anonymous CLI telemetry: install id, timestamp, command event, error status, package version, and build channel only.",
       "Set LIBRETTO_TELEMETRY_DISABLED=1 or DO_NOT_TRACK=1 to disable it, or set enabled:false in ~/.libretto/telemetry.json.",
     ].join(" ") + "\n",
   );
@@ -92,6 +136,8 @@ async function recordCliTelemetryEvent(
     timestamp: new Date().toISOString(),
     event: `libretto ${command.path.join(" ")}`,
     error,
+    packageVersion,
+    buildChannel,
   });
 }
 

package/src/cli/router.ts

@@ -2,6 +2,7 @@ import { authCommands } from "./commands/auth.js";
 import { billingCommands } from "./commands/billing.js";
 import { browserCommands } from "./commands/browser.js";
 import { cloudCredentialCommands } from "./commands/cloud-credentials.js";
+import { codeSharingCommands, shareWorkflowCommand } from "./commands/cloud-sharing.js";
 import { deployCommand } from "./commands/deploy.js";
 import { executionCommands } from "./commands/execution.js";
 import { experimentsCommand } from "./commands/experiments.js";
@@ -25,6 +26,8 @@ export const cliRoutes = {
       billing: billingCommands,
       credentials: cloudCredentialCommands,
       profiles: profileCommands,
+      share: shareWorkflowCommand,
+      sharing: codeSharingCommands,
     },
   }),
   experiments: experimentsCommand,