libretto 0.6.26 → 0.6.28

package/dist/cli/commands/cloud-sharing.js

@@ -0,0 +1,93 @@
+import { z } from "zod";
+import { SimpleCLI } from "affordance";
+import { orpcCall, resolveApiUrl } from "../core/auth-fetch.js";
+function requireCloudApiKey() {
+  const apiKey = process.env.LIBRETTO_API_KEY?.trim();
+  if (!apiKey) {
+    throw new Error(
+      "LIBRETTO_API_KEY is required to share Libretto Cloud workflow code. Issue one with `libretto cloud auth api-key issue --label <label>`."
+    );
+  }
+  return {
+    apiUrl: resolveApiUrl(null),
+    credential: { source: "env-api-key", apiKey }
+  };
+}
+const shareWorkflowCommand = SimpleCLI.command({
+  description: "Share one hosted workflow's code publicly"
+}).input(SimpleCLI.input({
+  positionals: [
+    SimpleCLI.positional("workflow", z.string().min(1), {
+      help: "Hosted workflow name to share"
+    })
+  ],
+  named: {
+    refresh: SimpleCLI.flag({
+      help: "Refresh an existing share from the workflow's current deployment"
+    })
+  }
+})).handle(async ({ input }) => {
+  const { apiUrl, credential } = requireCloudApiKey();
+  const response = await orpcCall({
+    apiUrl,
+    path: "/v1/workflows/share",
+    input: { workflow: input.workflow, refresh: input.refresh },
+    credential
+  });
+  if (response.status === "existing") {
+    console.log(`Workflow is already shared: ${response.workflow}`);
+    console.log("Use --refresh to update the shared code from the current deployment.");
+  } else if (response.status === "refreshed") {
+    console.log(`Refreshed shared workflow: ${response.workflow}`);
+  } else {
+    console.log(`Shared workflow: ${response.workflow}`);
+  }
+  console.log(`Marketplace URL: ${response.marketplace_url}`);
+  console.log(`Code URL: ${response.code_url}`);
+  return response.marketplace_url;
+});
+const codeSharingStatusCommand = SimpleCLI.command({
+  description: "Show whether tenant code sharing is enabled"
+}).input(SimpleCLI.input({ positionals: [], named: {} })).handle(async () => {
+  const { apiUrl, credential } = requireCloudApiKey();
+  const response = await orpcCall({
+    apiUrl,
+    path: "/v1/tenant/codeSharing",
+    input: {},
+    credential
+  });
+  console.log(`Code sharing: ${response.enabled ? "enabled" : "disabled"}`);
+  return response.enabled;
+});
+async function updateCodeSharing(enabled) {
+  const { apiUrl, credential } = requireCloudApiKey();
+  const response = await orpcCall({
+    apiUrl,
+    path: "/v1/tenant/updateCodeSharing",
+    input: { enabled },
+    credential
+  });
+  console.log(`Code sharing: ${response.enabled ? "enabled" : "disabled"}`);
+  return response.enabled;
+}
+const enableCodeSharingCommand = SimpleCLI.command({
+  description: "Enable public workflow code sharing for this tenant"
+}).input(SimpleCLI.input({ positionals: [], named: {} })).handle(async () => updateCodeSharing(true));
+const disableCodeSharingCommand = SimpleCLI.command({
+  description: "Disable public workflow code sharing for this tenant"
+}).input(SimpleCLI.input({ positionals: [], named: {} })).handle(async () => updateCodeSharing(false));
+const codeSharingCommands = SimpleCLI.group({
+  description: "Manage tenant workflow code sharing",
+  routes: {
+    status: codeSharingStatusCommand,
+    enable: enableCodeSharingCommand,
+    disable: disableCodeSharingCommand
+  }
+});
+export {
+  codeSharingCommands,
+  codeSharingStatusCommand,
+  disableCodeSharingCommand,
+  enableCodeSharingCommand,
+  shareWorkflowCommand
+};

package/dist/cli/core/deploy-artifact.js

@@ -12,7 +12,7 @@ import {
 } from "node:fs";
 import { createRequire, Module } from "node:module";
 import { tmpdir } from "node:os";
-import { dirname, isAbsolute, join, resolve } from "node:path";
+import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { gzipSync } from "node:zlib";
 import { build } from "esbuild";
@@ -337,7 +337,7 @@ function resolveWorkspaceSourcePath(info, subpath) {
   const directSubpath = subpath === "." ? "index" : subpath.slice(2);
   return resolvePathCandidates(info.dir, directSubpath);
 }
-function workspaceSourcePlugin(workspacePackages, externalPackages) {
+function workspaceSourcePlugin(workspacePackages, externalPackages, unresolvedWorkspaceImports) {
   return {
     name: "workspace-source-resolver",
     setup(buildApi) {
@@ -357,9 +357,8 @@ function workspaceSourcePlugin(workspacePackages, externalPackages) {
           match.subpath
         );
         if (!resolvedPath) {
-          throw new Error(
-            `Unable to resolve workspace import "${args.path}" from ${match.info.dir}.`
-          );
+          unresolvedWorkspaceImports?.set(args.path, match.info.dir);
+          return { path: args.path, external: true };
         }
         return { path: resolvedPath };
       });
@@ -438,6 +437,29 @@ function writeDeployMetadata(args) {
     JSON.stringify({ workflows: args.workflows }, null, 2) + "\n"
   );
 }
+function toPortableRelativePath(args) {
+  const relPath = relative(args.absSourceDir, args.absPath).replaceAll("\\", "/");
+  if (relPath.startsWith("../") || relPath === ".." || relPath.startsWith("/")) {
+    throw new Error(
+      `Deploy entry point must be inside the source directory to support cloud code sharing: ${args.absPath}`
+    );
+  }
+  return relPath;
+}
+function writeShareableSourceFiles(args) {
+  const relPaths = [...new Set(args.absSourcePaths.map(
+    (absPath) => toPortableRelativePath({
+      absPath,
+      absSourceDir: args.absSourceDir
+    })
+  ))].sort();
+  for (const relPath of relPaths) {
+    const targetPath = join(args.outputDir, ".libretto-share", "source", relPath);
+    mkdirSync(dirname(targetPath), { recursive: true });
+    cpSync(resolve(args.absSourceDir, relPath), targetPath);
+  }
+  return relPaths;
+}
 function shouldVendorCurrentLibretto(versionSpec) {
   return versionSpec.startsWith("file:") || versionSpec.startsWith("link:") || versionSpec.startsWith("workspace:") || versionSpec.startsWith("portal:") || versionSpec.includes("&path:");
 }
@@ -693,6 +715,7 @@ ${exportLines}
 }
 async function writeBundledDeployEntrypoint(args) {
   try {
+    const unresolvedWorkspaceImports = /* @__PURE__ */ new Map();
     const implementationBuild = await build({
       absWorkingDir: args.absSourceDir,
       bundle: true,
@@ -701,13 +724,25 @@ async function writeBundledDeployEntrypoint(args) {
       format: "cjs",
       outfile: "prebundled.cjs",
       platform: "node",
+      metafile: true,
       plugins: [
-        workspaceSourcePlugin(args.workspacePackages, args.externalPackages)
+        workspaceSourcePlugin(
+          args.workspacePackages,
+          args.externalPackages,
+          unresolvedWorkspaceImports
+        )
       ],
       splitting: false,
       target: "node20",
       write: false
     });
+    const [unresolvedImport] = unresolvedWorkspaceImports;
+    if (unresolvedImport) {
+      const [importPath, packageDir] = unresolvedImport;
+      throw new Error(
+        `Unable to resolve workspace import "${importPath}" from ${packageDir}.`
+      );
+    }
     const bundledImplementation = implementationBuild.outputFiles?.find(
       (file) => file.path.endsWith("prebundled.cjs")
     );
@@ -730,7 +765,13 @@ async function writeBundledDeployEntrypoint(args) {
         workflows
       })
     );
-    return workflows;
+    const shareableSourceFiles = Object.keys(implementationBuild.metafile?.inputs ?? {}).map(
+      (inputPath) => isAbsolute(inputPath) ? resolve(inputPath) : resolve(args.absSourceDir, inputPath)
+    ).filter((absPath) => {
+      const relPath = relative(args.absSourceDir, absPath);
+      return relPath !== "" && !relPath.startsWith("../") && relPath !== ".." && !isAbsolute(relPath);
+    });
+    return { shareableSourceFiles, workflows };
   } catch (error) {
     throw new Error(
       `Failed to bundle deploy entry point ${args.absEntryPoint}.
@@ -754,7 +795,7 @@ async function createHostedDeployPackage(args) {
   const workspacePackages = discoverWorkspacePackages(absSourceDir);
   let callerOwnsTempRoot = false;
   try {
-    const workflows = await writeBundledDeployEntrypoint({
+    const { shareableSourceFiles, workflows } = await writeBundledDeployEntrypoint({
       absEntryPoint,
       absSourceDir,
       deploymentName: args.deploymentName,
@@ -762,6 +803,20 @@ async function createHostedDeployPackage(args) {
       outputDir,
       workspacePackages
     });
+    const sourceFiles = writeShareableSourceFiles({
+      absSourceDir,
+      absSourcePaths: [...shareableSourceFiles, absEntryPoint],
+      outputDir
+    });
+    const sourceFile = toPortableRelativePath({
+      absPath: absEntryPoint,
+      absSourceDir
+    });
+    const workflowsWithShareableSource = workflows.map((workflow) => ({
+      ...workflow,
+      sourceFile,
+      sourceFiles
+    }));
     if (librettoDependency === "file:./libretto") {
       copyCurrentLibrettoPackage(outputDir);
     }
@@ -772,7 +827,7 @@ async function createHostedDeployPackage(args) {
       outputDir,
       sourceDir: absSourceDir
     });
-    writeDeployMetadata({ outputDir, workflows });
+    writeDeployMetadata({ outputDir, workflows: workflowsWithShareableSource });
     callerOwnsTempRoot = true;
     return {
       cleanup: () => {
@@ -780,7 +835,7 @@ async function createHostedDeployPackage(args) {
       },
       entryPoint: "index.js",
       outputDir,
-      workflows
+      workflows: workflowsWithShareableSource
     };
   } finally {
     if (!callerOwnsTempRoot) {

package/dist/cli/router.js

@@ -2,6 +2,7 @@ import { authCommands } from "./commands/auth.js";
 import { billingCommands } from "./commands/billing.js";
 import { browserCommands } from "./commands/browser.js";
 import { cloudCredentialCommands } from "./commands/cloud-credentials.js";
+import { codeSharingCommands, shareWorkflowCommand } from "./commands/cloud-sharing.js";
 import { deployCommand } from "./commands/deploy.js";
 import { executionCommands } from "./commands/execution.js";
 import { experimentsCommand } from "./commands/experiments.js";
@@ -23,7 +24,9 @@ const cliRoutes = {
       auth: authCommands,
       billing: billingCommands,
       credentials: cloudCredentialCommands,
-      profiles: profileCommands
+      profiles: profileCommands,
+      share: shareWorkflowCommand,
+      sharing: codeSharingCommands
     }
   }),
   experiments: experimentsCommand,

package/docs/releasing.md

@@ -66,10 +66,13 @@ The root `scripts/prepare-release.sh` script does the following:
 1. Checks that the working tree is clean.
 2. Updates local `main` from `origin/main`.
 3. Runs `pnpm install --frozen-lockfile`, `pnpm --filter libretto type-check`, and `pnpm --filter libretto test`.
-4. Bumps the version in `packages/libretto/package.json`.
-5. Creates a release branch.
-6. Commits the version bump.
-7. Pushes the branch and opens a PR to `main` with the `release` label.
+4. Checks whether `packages/affordance` changed since the current Libretto release tag. If it changed, the script runs Affordance type-check/tests and bumps `packages/affordance/package.json` by one patch version when the current Affordance version is already published to npm.
+5. Bumps the version in `packages/libretto/package.json`.
+6. Creates a release branch.
+7. Commits the version bump.
+8. Pushes the branch and opens a PR to `main` with the `release` label.
+
+Affordance is published before Libretto in `.github/workflows/release.yml`. Keeping this automatic patch bump in the release PR prevents Libretto from depending on unpublished Affordance APIs while still avoiding unnecessary Affordance releases when its package contents did not change.
 
 Release PRs also run the eval workflow. That workflow records score, duration, token, cost, and tool-call metrics for review. Scores are informational: low scores do not fail the workflow, but setup/runtime failures and zero completed records do.
 
@@ -80,12 +83,12 @@ After the release PR merges, `.github/workflows/release.yml` runs on `main`.
 The workflow:
 
 1. Reads the version from `packages/libretto/package.json`.
-2. Checks whether that version already exists on npm and in GitHub Releases.
+2. Checks whether that version already exists on npm and in GitHub Releases. It also checks whether the current `packages/affordance/package.json` version and matching `create-libretto` version already exist on npm.
 3. Runs install, type-check, and tests for the `libretto` package in a verification job.
 4. Publishes `affordance` first, then `libretto@X.Y.Z`, then `create-libretto@X.Y.Z` with trusted publishing.
 5. Creates GitHub release `vX.Y.Z` with generated release notes if it does not already exist.
 
-This makes the workflow safe to re-run after partial failures. For example, if npm publish succeeds but GitHub release creation fails, a re-run will skip npm and only create the missing release.
+This makes the workflow safe to re-run after partial failures. For example, if npm publish succeeds but GitHub release creation fails, a re-run will skip npm and only create the missing release. It also means Affordance can still be published if its version is missing even when the Libretto npm package and GitHub release for the current Libretto version already exist.
 
 ## Eval gating on release PRs
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "libretto",
-  "version": "0.6.26",
+  "version": "0.6.28",
   "description": "AI-powered browser automation library and CLI built on Playwright",
   "license": "MIT",
   "homepage": "https://libretto.sh",
@@ -8,6 +8,9 @@
     "type": "git",
     "url": "https://github.com/saffron-health/libretto"
   },
+  "bugs": {
+    "url": "https://github.com/saffron-health/libretto/issues"
+  },
   "type": "module",
   "publishConfig": {
     "access": "public"
@@ -67,7 +70,7 @@
     "playwright": "^1.58.2",
     "tsx": "^4.21.0",
     "zod": "^4.3.6",
-    "affordance": "^0.2.0"
+    "affordance": "^0.2.1"
   },
   "scripts": {
     "sync:mirrors": "node ../dev-tools/scripts/sync-mirrors.mjs",

package/skills/libretto/SKILL.md

@@ -4,7 +4,7 @@ description: "Browser automation CLI for building, maintaining, and running brow
 license: MIT
 metadata:
   author: saffron-health
-  version: "0.6.26"
+  version: "0.6.28"
 ---
 
 ## How Libretto Works
@@ -15,17 +15,7 @@ metadata:
 
 ## Shipped Source & Documentation
 
-The npm package includes `src/` (full TypeScript source) and `docs/` for deeper understanding of internals and design decisions. Read these when you need implementation context beyond what this skill file covers. Resolve paths from the package root (e.g. `node_modules/libretto/`).
-
-Full documentation is published at [libretto.sh](https://libretto.sh). Available pages:
-
-- Get started: [quickstart](https://libretto.sh/docs/get-started/quickstart), [first workflow](https://libretto.sh/docs/get-started/first-workflow), [deploying](https://libretto.sh/docs/get-started/deploying)
-- Fundamentals: [core concepts](https://libretto.sh/docs/understand-libretto/core-concepts), [how workflow generation works](https://libretto.sh/docs/understand-libretto/how-workflow-generation-works), [automation and bot detection](https://libretto.sh/docs/understand-libretto/automation-and-bot-detection), [website authentication](https://libretto.sh/docs/understand-libretto/website-authentication)
-- Workflow guides: [one-shot generation](https://libretto.sh/docs/guides/one-shot-workflow-generation), [interactive building](https://libretto.sh/docs/guides/interactive-workflow-building), [debugging workflows](https://libretto.sh/docs/guides/debugging-workflows), [convert to network requests](https://libretto.sh/docs/guides/convert-to-network-requests)
-- CLI reference: [open and connect](https://libretto.sh/docs/reference/cli/open-and-connect), [sessions](https://libretto.sh/docs/reference/cli/sessions), [profiles](https://libretto.sh/docs/reference/cli/profiles), [snapshot](https://libretto.sh/docs/reference/cli/snapshot), [exec](https://libretto.sh/docs/reference/cli/exec), [run and resume](https://libretto.sh/docs/reference/cli/run-and-resume), [session logs](https://libretto.sh/docs/reference/cli/session-logs), [pages](https://libretto.sh/docs/reference/cli/pages)
-- Library API: [workflow](https://libretto.sh/docs/reference/runtime/workflow), [network requests](https://libretto.sh/docs/reference/runtime/network-requests), [file downloads](https://libretto.sh/docs/reference/runtime/file-downloads)
-- Libretto Cloud Hosting: [overview](https://libretto.sh/docs/libretto-cloud-hosting/overview), [authentication](https://libretto.sh/docs/libretto-cloud-hosting/authentication), [deployments](https://libretto.sh/docs/libretto-cloud-hosting/deployments), [stealth](https://libretto.sh/docs/libretto-cloud-hosting/stealth)
-- Alternative providers: [overview](https://libretto.sh/docs/alternative-providers/overview), [Kernel](https://libretto.sh/docs/alternative-providers/kernel), [Browserbase](https://libretto.sh/docs/alternative-providers/browserbase), [Steel](https://libretto.sh/docs/alternative-providers/steel), [GCP](https://libretto.sh/docs/alternative-providers/gcp), [AWS](https://libretto.sh/docs/alternative-providers/aws)
+Read `references/shipped-source-and-documentation.md` for shipped source details, published documentation links, and implementation context beyond what this skill file covers.
 
 ## Default Integration Approach
 
@@ -48,6 +38,7 @@ Prefer to enter sites at a user-facing URL (homepage, login, etc.) on the first
 - Use the package manager convention for the target project. The examples use `npx libretto`; pnpm, yarn, and bun projects should use their equivalent package-manager execution form.
 - Use `npx libretto setup` for first-time workspace onboarding. It installs Chromium and syncs skills.
 - Use `npx libretto status` to inspect open sessions without triggering setup.
+- Use `npx libretto update` to upgrade the project-local Libretto package. Use `npx libretto update --dry-run` to preview the package-manager command first.
 
 ## Experiments
 

package/skills/libretto/references/shipped-source-and-documentation.md

@@ -0,0 +1,13 @@
+# Shipped Source & Documentation
+
+The npm package includes `src/` (full TypeScript source) and `docs/` for deeper understanding of internals and design decisions. Resolve paths from the package root, such as `node_modules/libretto/`.
+
+Full documentation is published at [libretto.sh](https://libretto.sh). Available pages:
+
+- Get started: [quickstart](https://libretto.sh/docs/get-started/quickstart), [first workflow](https://libretto.sh/docs/get-started/first-workflow), [deploying](https://libretto.sh/docs/get-started/deploying)
+- Fundamentals: [core concepts](https://libretto.sh/docs/understand-libretto/core-concepts), [how workflow generation works](https://libretto.sh/docs/understand-libretto/how-workflow-generation-works), [automation and bot detection](https://libretto.sh/docs/understand-libretto/automation-and-bot-detection), [website authentication](https://libretto.sh/docs/understand-libretto/website-authentication)
+- Workflow guides: [one-shot generation](https://libretto.sh/docs/guides/one-shot-workflow-generation), [interactive building](https://libretto.sh/docs/guides/interactive-workflow-building), [debugging workflows](https://libretto.sh/docs/guides/debugging-workflows), [convert to network requests](https://libretto.sh/docs/guides/convert-to-network-requests)
+- CLI reference: [open and connect](https://libretto.sh/docs/reference/cli/open-and-connect), [sessions](https://libretto.sh/docs/reference/cli/sessions), [profiles](https://libretto.sh/docs/reference/cli/profiles), [snapshot](https://libretto.sh/docs/reference/cli/snapshot), [exec](https://libretto.sh/docs/reference/cli/exec), [run and resume](https://libretto.sh/docs/reference/cli/run-and-resume), [session logs](https://libretto.sh/docs/reference/cli/session-logs), [pages](https://libretto.sh/docs/reference/cli/pages)
+- Library API: [workflow](https://libretto.sh/docs/reference/runtime/workflow), [network requests](https://libretto.sh/docs/reference/runtime/network-requests), [file downloads](https://libretto.sh/docs/reference/runtime/file-downloads)
+- Libretto Cloud Hosting: [overview](https://libretto.sh/docs/libretto-cloud-hosting/overview), [authentication](https://libretto.sh/docs/libretto-cloud-hosting/authentication), [deployments](https://libretto.sh/docs/libretto-cloud-hosting/deployments), [stealth](https://libretto.sh/docs/libretto-cloud-hosting/stealth)
+- Alternative providers: [overview](https://libretto.sh/docs/alternative-providers/overview), [Kernel](https://libretto.sh/docs/alternative-providers/kernel), [Browserbase](https://libretto.sh/docs/alternative-providers/browserbase), [Steel](https://libretto.sh/docs/alternative-providers/steel), [GCP](https://libretto.sh/docs/alternative-providers/gcp), [AWS](https://libretto.sh/docs/alternative-providers/aws)

package/skills/libretto-readonly/SKILL.md

@@ -4,7 +4,7 @@ description: "Read-only Libretto workflow for diagnosing live browser state with
 license: MIT
 metadata:
   author: saffron-health
-  version: "0.6.26"
+  version: "0.6.28"
 ---
 
 ## How Libretto Read-Only Works

package/src/cli/commands/cloud-sharing.ts

@@ -0,0 +1,114 @@
+import { z } from "zod";
+import { SimpleCLI } from "affordance";
+import { orpcCall, resolveApiUrl } from "../core/auth-fetch.js";
+
+type CodeSharingStatusResponse = {
+  enabled: boolean;
+};
+
+type ShareWorkflowResponse = {
+  id: string;
+  status: "created" | "existing" | "refreshed";
+  workflow: string;
+  marketplace_url: string;
+  code_url: string;
+};
+
+function requireCloudApiKey() {
+  const apiKey = process.env.LIBRETTO_API_KEY?.trim();
+  if (!apiKey) {
+    throw new Error(
+      "LIBRETTO_API_KEY is required to share Libretto Cloud workflow code. Issue one with `libretto cloud auth api-key issue --label <label>`.",
+    );
+  }
+  return {
+    apiUrl: resolveApiUrl(null),
+    credential: { source: "env-api-key" as const, apiKey },
+  };
+}
+
+export const shareWorkflowCommand = SimpleCLI.command({
+  description: "Share one hosted workflow's code publicly",
+})
+  .input(SimpleCLI.input({
+    positionals: [
+      SimpleCLI.positional("workflow", z.string().min(1), {
+        help: "Hosted workflow name to share",
+      }),
+    ],
+    named: {
+      refresh: SimpleCLI.flag({
+        help: "Refresh an existing share from the workflow's current deployment",
+      }),
+    },
+  }))
+  .handle(async ({ input }) => {
+    const { apiUrl, credential } = requireCloudApiKey();
+    const response = await orpcCall<ShareWorkflowResponse>({
+      apiUrl,
+      path: "/v1/workflows/share",
+      input: { workflow: input.workflow, refresh: input.refresh },
+      credential,
+    });
+
+    if (response.status === "existing") {
+      console.log(`Workflow is already shared: ${response.workflow}`);
+      console.log("Use --refresh to update the shared code from the current deployment.");
+    } else if (response.status === "refreshed") {
+      console.log(`Refreshed shared workflow: ${response.workflow}`);
+    } else {
+      console.log(`Shared workflow: ${response.workflow}`);
+    }
+    console.log(`Marketplace URL: ${response.marketplace_url}`);
+    console.log(`Code URL: ${response.code_url}`);
+    return response.marketplace_url;
+  });
+
+export const codeSharingStatusCommand = SimpleCLI.command({
+  description: "Show whether tenant code sharing is enabled",
+})
+  .input(SimpleCLI.input({ positionals: [], named: {} }))
+  .handle(async () => {
+    const { apiUrl, credential } = requireCloudApiKey();
+    const response = await orpcCall<CodeSharingStatusResponse>({
+      apiUrl,
+      path: "/v1/tenant/codeSharing",
+      input: {},
+      credential,
+    });
+    console.log(`Code sharing: ${response.enabled ? "enabled" : "disabled"}`);
+    return response.enabled;
+  });
+
+async function updateCodeSharing(enabled: boolean): Promise<boolean> {
+  const { apiUrl, credential } = requireCloudApiKey();
+  const response = await orpcCall<CodeSharingStatusResponse>({
+    apiUrl,
+    path: "/v1/tenant/updateCodeSharing",
+    input: { enabled },
+    credential,
+  });
+  console.log(`Code sharing: ${response.enabled ? "enabled" : "disabled"}`);
+  return response.enabled;
+}
+
+export const enableCodeSharingCommand = SimpleCLI.command({
+  description: "Enable public workflow code sharing for this tenant",
+})
+  .input(SimpleCLI.input({ positionals: [], named: {} }))
+  .handle(async () => updateCodeSharing(true));
+
+export const disableCodeSharingCommand = SimpleCLI.command({
+  description: "Disable public workflow code sharing for this tenant",
+})
+  .input(SimpleCLI.input({ positionals: [], named: {} }))
+  .handle(async () => updateCodeSharing(false));
+
+export const codeSharingCommands = SimpleCLI.group({
+  description: "Manage tenant workflow code sharing",
+  routes: {
+    status: codeSharingStatusCommand,
+    enable: enableCodeSharingCommand,
+    disable: disableCodeSharingCommand,
+  },
+});

package/src/cli/core/deploy-artifact.ts

@@ -12,7 +12,7 @@ import {
 } from "node:fs";
 import { createRequire, Module } from "node:module";
 import { tmpdir } from "node:os";
-import { dirname, isAbsolute, join, resolve } from "node:path";
+import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { gzipSync } from "node:zlib";
 import { build } from "esbuild";
@@ -57,6 +57,8 @@ export type WorkflowDeployMetadata = {
   credentialNames: string[];
   authProfileName?: string;
   authProfileRefresh?: boolean;
+  sourceFile?: string;
+  sourceFiles?: string[];
 };
 
 type BuildHostedDeployTarballArgs = {
@@ -473,13 +475,17 @@ function resolveWorkspaceSourcePath(
 function workspaceSourcePlugin(
   workspacePackages: Map<string, WorkspacePackage>,
   externalPackages: ReadonlySet<string>,
+  unresolvedWorkspaceImports?: Map<string, string>,
 ) {
   return {
     name: "workspace-source-resolver",
     setup(buildApi: {
       onResolve: (
         options: { filter: RegExp },
-        callback: (args: { path: string }) => { path: string } | null,
+        callback: (args: { path: string }) =>
+          | { path: string }
+          | { path: string; external: true }
+          | null,
       ) => void;
     }) {
       // Workspace imports are treated as bundle input, so their code is
@@ -503,9 +509,8 @@ function workspaceSourcePlugin(
           match.subpath,
         );
         if (!resolvedPath) {
-          throw new Error(
-            `Unable to resolve workspace import "${args.path}" from ${match.info.dir}.`,
-          );
+          unresolvedWorkspaceImports?.set(args.path, match.info.dir);
+          return { path: args.path, external: true };
         }
 
         return { path: resolvedPath };
@@ -618,6 +623,40 @@ function writeDeployMetadata(args: {
   );
 }
 
+function toPortableRelativePath(args: {
+  absSourceDir: string;
+  absPath: string;
+}): string {
+  const relPath = relative(args.absSourceDir, args.absPath).replaceAll("\\", "/");
+  if (relPath.startsWith("../") || relPath === ".." || relPath.startsWith("/")) {
+    throw new Error(
+      `Deploy entry point must be inside the source directory to support cloud code sharing: ${args.absPath}`,
+    );
+  }
+  return relPath;
+}
+
+function writeShareableSourceFiles(args: {
+  absSourceDir: string;
+  absSourcePaths: readonly string[];
+  outputDir: string;
+}): string[] {
+  const relPaths = [...new Set(args.absSourcePaths.map((absPath) =>
+    toPortableRelativePath({
+      absPath,
+      absSourceDir: args.absSourceDir,
+    }),
+  ))].sort();
+
+  for (const relPath of relPaths) {
+    const targetPath = join(args.outputDir, ".libretto-share", "source", relPath);
+    mkdirSync(dirname(targetPath), { recursive: true });
+    cpSync(resolve(args.absSourceDir, relPath), targetPath);
+  }
+
+  return relPaths;
+}
+
 function shouldVendorCurrentLibretto(versionSpec: string): boolean {
   return (
     versionSpec.startsWith("file:") ||
@@ -963,8 +1002,12 @@ async function writeBundledDeployEntrypoint(args: {
   externalPackages: ReadonlySet<string>;
   outputDir: string;
   workspacePackages: Map<string, WorkspacePackage>;
-}): Promise<WorkflowDeployMetadata[]> {
+}): Promise<{
+  shareableSourceFiles: string[];
+  workflows: WorkflowDeployMetadata[];
+}> {
   try {
+    const unresolvedWorkspaceImports = new Map<string, string>();
     // The implementation bundle is CommonJS so the bootstrap can load it lazily
     // with createRequire() after workflow discovery, while external packages
     // continue to load through normal Node module resolution.
@@ -976,13 +1019,25 @@ async function writeBundledDeployEntrypoint(args: {
       format: "cjs",
       outfile: "prebundled.cjs",
       platform: "node",
+      metafile: true,
       plugins: [
-        workspaceSourcePlugin(args.workspacePackages, args.externalPackages),
+        workspaceSourcePlugin(
+          args.workspacePackages,
+          args.externalPackages,
+          unresolvedWorkspaceImports,
+        ),
       ],
       splitting: false,
       target: "node20",
       write: false,
     });
+    const [unresolvedImport] = unresolvedWorkspaceImports;
+    if (unresolvedImport) {
+      const [importPath, packageDir] = unresolvedImport;
+      throw new Error(
+        `Unable to resolve workspace import "${importPath}" from ${packageDir}.`,
+      );
+    }
 
     const bundledImplementation = implementationBuild.outputFiles?.find(
       (file) => file.path.endsWith("prebundled.cjs"),
@@ -1008,7 +1063,22 @@ async function writeBundledDeployEntrypoint(args: {
         workflows,
       }),
     );
-    return workflows;
+    const shareableSourceFiles = Object.keys(implementationBuild.metafile?.inputs ?? {})
+      .map((inputPath) =>
+        isAbsolute(inputPath)
+          ? resolve(inputPath)
+          : resolve(args.absSourceDir, inputPath),
+      )
+      .filter((absPath) => {
+        const relPath = relative(args.absSourceDir, absPath);
+        return (
+          relPath !== "" &&
+          !relPath.startsWith("../") &&
+          relPath !== ".." &&
+          !isAbsolute(relPath)
+        );
+      });
+    return { shareableSourceFiles, workflows };
   } catch (error) {
     throw new Error(
       `Failed to bundle deploy entry point ${args.absEntryPoint}.\n${formatBuildError(error)}`,
@@ -1040,7 +1110,7 @@ export async function createHostedDeployPackage(
   let callerOwnsTempRoot = false;
 
   try {
-    const workflows = await writeBundledDeployEntrypoint({
+    const { shareableSourceFiles, workflows } = await writeBundledDeployEntrypoint({
       absEntryPoint,
       absSourceDir,
       deploymentName: args.deploymentName,
@@ -1048,6 +1118,20 @@ export async function createHostedDeployPackage(
       outputDir,
       workspacePackages,
     });
+    const sourceFiles = writeShareableSourceFiles({
+      absSourceDir,
+      absSourcePaths: [...shareableSourceFiles, absEntryPoint],
+      outputDir,
+    });
+    const sourceFile = toPortableRelativePath({
+      absPath: absEntryPoint,
+      absSourceDir,
+    });
+    const workflowsWithShareableSource = workflows.map((workflow) => ({
+      ...workflow,
+      sourceFile,
+      sourceFiles,
+    }));
 
     if (librettoDependency === "file:./libretto") {
       copyCurrentLibrettoPackage(outputDir);
@@ -1063,7 +1147,7 @@ export async function createHostedDeployPackage(
       outputDir,
       sourceDir: absSourceDir,
     });
-    writeDeployMetadata({ outputDir, workflows });
+    writeDeployMetadata({ outputDir, workflows: workflowsWithShareableSource });
 
     // Success transfers ownership of the temp directory to the caller, who is
     // responsible for invoking cleanup() after the tarball/upload step.
@@ -1074,7 +1158,7 @@ export async function createHostedDeployPackage(
         },
         entryPoint: "index.js",
         outputDir,
-        workflows,
+        workflows: workflowsWithShareableSource,
       };
   } finally {
     // On any failure before we return, this function still owns the temp dir

package/src/cli/router.ts

@@ -2,6 +2,7 @@ import { authCommands } from "./commands/auth.js";
 import { billingCommands } from "./commands/billing.js";
 import { browserCommands } from "./commands/browser.js";
 import { cloudCredentialCommands } from "./commands/cloud-credentials.js";
+import { codeSharingCommands, shareWorkflowCommand } from "./commands/cloud-sharing.js";
 import { deployCommand } from "./commands/deploy.js";
 import { executionCommands } from "./commands/execution.js";
 import { experimentsCommand } from "./commands/experiments.js";
@@ -25,6 +26,8 @@ export const cliRoutes = {
       billing: billingCommands,
       credentials: cloudCredentialCommands,
       profiles: profileCommands,
+      share: shareWorkflowCommand,
+      sharing: codeSharingCommands,
     },
   }),
   experiments: experimentsCommand,