@lanes-sh/link 0.1.0

package/src/cli/commands/owner/shared.ts

@@ -0,0 +1,125 @@
+import { ConfigError, type Config } from '#profile';
+import { announce, print, style } from '../../output.ts';
+import { confirm } from '../../prompt.ts';
+import { openRuntime, type GlobalFlags, type Runtime } from '../../runtime.ts';
+
+/**
+ * What `lanes link memory`, `lanes link skills` and `lanes link vault` all need: the flag shape, the
+ * runtime wrapper, connection resolution, and the two prompts.
+ *
+ * All four commands are the same shape — open a runtime, announce, act, close —
+ * so the wrapper lives here rather than three times over.
+ */
+
+export interface OwnerFlags extends GlobalFlags {
+  /** Which connection of this provider, when a profile has more than one. */
+  readonly connection?: string | undefined;
+  readonly title?: string | undefined;
+  readonly tag?: string | undefined;
+  readonly description?: string | undefined;
+  readonly file?: string | undefined;
+  /** Reveal a vault value on a terminal. */
+  readonly show?: boolean | undefined;
+  /** Print only the value, for `$(…)`. */
+  readonly raw?: boolean | undefined;
+  /** Skip the confirmation a destructive command would otherwise ask for. */
+  readonly yes?: boolean | undefined;
+}
+
+export async function withRuntime(
+  flags: OwnerFlags,
+  body: (runtime: Runtime) => Promise<void>,
+): Promise<void> {
+  const runtime = await openRuntime(flags);
+  try {
+    // Every command announces its profile and target before acting — except
+    // under `--raw`, whose entire purpose is that `$(…)` captures the value and
+    // nothing else. The same exception `lanes link token show --raw` makes.
+    if (!flags.raw) announce(runtime.resolution);
+    await body(runtime);
+  } finally {
+    await runtime.close();
+  }
+}
+
+/**
+ * Which connection of an owner provider to act on.
+ *
+ * A profile usually has exactly one of each, and typing `--connection` to reach
+ * your only one would be pure ceremony — the same trade ADR-012 §1 made for
+ * prompt routing. Two or more is genuinely ambiguous, so it refuses and names
+ * the candidates rather than picking.
+ */
+export function ownerConnection(config: Config, provider: string, flags: OwnerFlags): string {
+  const candidates = config.connections.filter((connection) => connection.provider === provider);
+
+  if (flags.connection) {
+    const match = candidates.find((connection) => connection.id === flags.connection);
+    if (!match) {
+      throw new ConfigError(
+        `No ${provider} connection "${flags.connection}" in this profile` +
+          (candidates.length > 0
+            ? ` (have: ${candidates.map((connection) => connection.id).join(', ')})`
+            : ''),
+      );
+    }
+    return match.id;
+  }
+
+  if (candidates.length === 0) {
+    throw new ConfigError(
+      `This profile has no ${provider} connection. Add one with: lanes link connect ${provider}`,
+    );
+  }
+  if (candidates.length > 1) {
+    throw new ConfigError(
+      `This profile has ${candidates.length} ${provider} connections ` +
+        `(${candidates.map((connection) => connection.id).join(', ')}). Name one with --connection.`,
+    );
+  }
+
+  return candidates[0]!.id;
+}
+
+/**
+ * Read a value from stdin, refusing a terminal.
+ *
+ * The same shape as `lanes link secrets set`, for the same two reasons: a value on argv
+ * lands in shell history, and a command that silently waits on a terminal that
+ * will never send anything is a hang rather than an error.
+ */
+export async function readStdin(usage: string, what: string): Promise<string> {
+  if (process.stdin.isTTY) {
+    throw new ConfigError(
+      `${usage} reads ${what} from stdin, and stdin is a terminal.\n` +
+        `  printf %s "<value>" | ${usage}\n` +
+        `  or: ${usage} < file.md`,
+    );
+  }
+
+  const text = (await Bun.stdin.text()).replace(/\n$/, '');
+  if (!text) throw new ConfigError(`Nothing on stdin. Pipe ${what} in:  ${usage} < file`);
+  return text;
+}
+
+/** Confirm a destructive action, unless `--yes` already answered. */
+export async function agreed(flags: OwnerFlags, question: string): Promise<boolean> {
+  if (flags.yes) return true;
+
+  if (!process.stdin.isTTY) {
+    throw new ConfigError(
+      `${question} — stdin is not a terminal, so there is nobody to ask. Pass --yes to proceed.`,
+    );
+  }
+
+  // Defaulting to no: the same choice `connect` makes where a prompt precedes
+  // something that cannot be undone.
+  const yes = await confirm(question, false);
+  if (!yes) print(style.dim('  cancelled'));
+  return yes;
+}
+
+export function required(value: string | undefined, usage: string): string {
+  if (!value) throw new ConfigError(`Usage: ${usage}`);
+  return value;
+}

package/src/cli/commands/owner/skills.ts

@@ -0,0 +1,92 @@
+import { ConfigError } from '#profile';
+import {
+  loadProfileSkills,
+  readSkill,
+  removeSkill,
+  writeSkill,
+} from '#providers/skills/store.ts';
+import { heading, ok, print, style, table } from '../../output.ts';
+import { agreed, readStdin, required, withRuntime, type OwnerFlags } from './shared.ts';
+
+/** `lanes link skills` — the reusable procedures agents can invoke. */
+
+export async function skillsList(flags: OwnerFlags): Promise<void> {
+  await withRuntime(flags, async (runtime) => {
+    const skills = await loadProfileSkills(runtime.skills);
+
+    heading(`Skills (${skills.length})`);
+    if (skills.length === 0) {
+      print(style.dim('  none — add one with: lanes link skills add <name>'));
+      return;
+    }
+
+    table(
+      skills.map((skill) => [
+        `  ${skill.name}`,
+        skill.arguments.length > 0
+          ? style.dim(
+              skill.arguments
+                .map((argument) => (argument.required ? argument.name : `${argument.name}?`))
+                .join(', '),
+            )
+          : '',
+        skill.description,
+      ]),
+    );
+
+    print('');
+    print(style.dim('  Each is the MCP prompt "skills_<name>", where policy allows it.'));
+  });
+}
+
+export async function skillsShow(name: string | undefined, flags: OwnerFlags): Promise<void> {
+  const skillName = required(name, 'lanes link skills show <name>');
+
+  await withRuntime(flags, async (runtime) => {
+    const skill = await readSkill(runtime.skills, skillName);
+    if (!skill) throw new ConfigError(`No skill "${skillName}" in this workspace.`);
+
+    const bytes = await runtime.skills.get(skill.path);
+    print('');
+    print(bytes ? new TextDecoder().decode(bytes) : skill.body);
+  });
+}
+
+export async function skillsAdd(name: string | undefined, flags: OwnerFlags): Promise<void> {
+  const skillName = required(name, 'lanes link skills add <name>   (document on stdin, or --file)');
+
+  const text = flags.file
+    ? await Bun.file(flags.file).text()
+    : await readStdin(
+        `lanes link skills add ${skillName}`,
+        'the skill document, frontmatter included',
+      );
+
+  await withRuntime(flags, async (runtime) => {
+    const existing = await readSkill(runtime.skills, skillName);
+    const skill = await writeSkill(runtime.skills, skillName, text);
+
+    print(ok(`${existing ? 'replaced' : 'added'} skill ${style.bold(skill.name)}`));
+    print(
+      style.dim(
+        `  Available as the prompt "skills_${skill.name}". A running endpoint picks it up within a few seconds.`,
+      ),
+    );
+  });
+}
+
+export async function skillsRemove(name: string | undefined, flags: OwnerFlags): Promise<void> {
+  const skillName = required(name, 'lanes link skills remove <name>');
+
+  await withRuntime(flags, async (runtime) => {
+    const skill = await readSkill(runtime.skills, skillName);
+    if (!skill) throw new ConfigError(`No skill "${skillName}" in this workspace.`);
+
+    print(`  ${style.bold(skill.name)}  ${skill.description}`);
+    print(style.dim(`  ${skill.path}`));
+    if (!(await agreed(flags, 'Remove this skill?'))) return;
+
+    await removeSkill(runtime.skills, skillName);
+    print(ok(`removed skill ${style.bold(skillName)}`));
+  });
+}

package/src/cli/commands/owner/vault.ts

@@ -0,0 +1,140 @@
+import { ConfigError } from '#profile';
+import { assertItemId, generateVaultKey } from '#providers/owner.ts';
+import { heading, ok, print, style, table } from '../../output.ts';
+import {
+  agreed,
+  ownerConnection,
+  readStdin,
+  required,
+  withRuntime,
+  type OwnerFlags,
+} from './shared.ts';
+
+/**
+ * `lanes link vault` — the owner's own secret material.
+ *
+ * `lanes link vault get` prints a value, which `lanes link secrets` deliberately never does.
+ * That is the two-kinds-of-secret distinction doing its job
+ * (`docs/detailed/security.md`): a credential authorises the system and is never
+ * disclosed, and a vault the owner cannot read without an agent is not a vault.
+ */
+
+export async function vaultList(flags: OwnerFlags): Promise<void> {
+  await withRuntime(flags, async (runtime) => {
+    const items = await runtime.vault.ids();
+
+    heading(`Vault items (${items.length})`);
+    if (items.length === 0) {
+      print(style.dim('  none — store one with: lanes link vault set <id>'));
+      return;
+    }
+
+    table(
+      items.map((item) => [
+        `  ${item.id}`,
+        style.dim(item.connectionId),
+        item.description ?? '',
+      ]),
+    );
+
+    print('');
+    print(
+      style.dim(
+        '  Names only. Each is readable over MCP as "vault.get.<id>", one grant at a time.',
+      ),
+    );
+  });
+}
+
+export async function vaultGet(id: string | undefined, flags: OwnerFlags): Promise<void> {
+  const itemId = required(id, 'lanes link vault get <id> [--show]');
+
+  await withRuntime(flags, async (runtime) => {
+    const connection = ownerConnection(runtime.config, 'vault', flags);
+    const item = await runtime.vault.get(connection, itemId);
+    if (!item) throw new ConfigError(`No vault item "${itemId}" in this profile.`);
+
+    // `--raw` writes the value and nothing else, so `$(…)` is not contaminated
+    // by the announce line every other command prints. Same shape as
+    // `lanes link token show --raw`.
+    if (flags.raw) {
+      process.stdout.write(`${item.value}\n`);
+      return;
+    }
+
+    print(
+      flags.show
+        ? item.value
+        : `${item.value.slice(0, 3)}…  ${style.dim(`(${item.value.length} chars — --show to reveal)`)}`,
+    );
+  });
+}
+
+export async function vaultSet(id: string | undefined, flags: OwnerFlags): Promise<void> {
+  const itemId = required(id, 'lanes link vault set <id>   (value on stdin)');
+  assertItemId(itemId);
+
+  const value = await readStdin(`lanes link vault set ${itemId}`, 'the secret');
+
+  await withRuntime(flags, async (runtime) => {
+    const connection = ownerConnection(runtime.config, 'vault', flags);
+    const replacing = (await runtime.vault.get(connection, itemId)) !== null;
+
+    await runtime.vault.put(connection, {
+      id: itemId,
+      value,
+      ...(flags.description ? { description: flags.description } : {}),
+    });
+
+    print(ok(`${replacing ? 'replaced' : 'stored'} vault item ${style.bold(itemId)}`));
+    if (!replacing) {
+      // Not a limitation being apologised for: the item list is read when the
+      // runtime is built, so a write cannot hand itself a read and granting a
+      // new secret is a deliberate act between two runs (ADR-012 §3).
+      print(
+        style.dim(
+          `  Not readable over MCP yet. Allow "vault.get.${itemId}" in policy, then restart the endpoint.`,
+        ),
+      );
+    }
+  });
+}
+
+export async function vaultRemove(id: string | undefined, flags: OwnerFlags): Promise<void> {
+  const itemId = required(id, 'lanes link vault remove <id>');
+
+  await withRuntime(flags, async (runtime) => {
+    const connection = ownerConnection(runtime.config, 'vault', flags);
+    const item = await runtime.vault.get(connection, itemId);
+    if (!item) throw new ConfigError(`No vault item "${itemId}" in this profile.`);
+
+    print(`  ${style.bold(itemId)}  ${item.description ?? style.dim('no description')}`);
+    if (!(await agreed(flags, 'Remove this item? The value cannot be recovered.'))) return;
+
+    await runtime.vault.delete(connection, itemId);
+    print(ok(`removed vault item ${style.bold(itemId)}`));
+    print(style.dim('  Its read capability disappears when the endpoint restarts.'));
+  });
+}
+
+/**
+ * Mint a vault key.
+ *
+ * Deliberately not written anywhere: a deployment's key belongs in that
+ * deployment's secret manager, and a command that helpfully stored it beside
+ * the ciphertext it protects would encrypt nothing.
+ */
+export function vaultKeyGenerate(flags: OwnerFlags): void {
+  const key = generateVaultKey();
+
+  if (flags.raw) {
+    process.stdout.write(`${key}\n`);
+    return;
+  }
+
+  print(key);
+  print('');
+  print(style.dim('  Store it as LANES_LINK_VAULT_KEY. It is not written anywhere by this command:'));
+  print(style.dim('  a key kept beside the document it protects protects nothing.'));
+  print(style.dim('  Separate from the credential-store key, deliberately — docs/detailed/security.md.'));
+}

package/src/cli/commands/owner.ts

@@ -0,0 +1,46 @@
+/**
+ * `lanes link memory`, `lanes link skills`, `lanes link vault` — the owner layer's control plane.
+ *
+ * The layer shipped in M4 with no CLI at all, so the two stores holding the
+ * owner's *own* data were reachable only by an agent, and the one thing that
+ * shapes agent behaviour was reachable only by editing a file and restarting.
+ * Putting a password into the vault meant asking a language model to type it.
+ * ADR-014.
+ *
+ * **These commands reach the same bytes the providers do**, through the same
+ * stores — `runtime.skills`, `runtime.vault`, and the blob namespace core
+ * scopes memory to. Nothing here reimplements a storage layout, because two
+ * spellings of one layout is exactly how a control plane and its data plane
+ * drift apart.
+ *
+ * This does not widen ADR-007. Its exclusion list is policy, tokens,
+ * credentials, connections, config, and audit — the things that authorise
+ * *future agent behaviour*. A memory entry and a vault item are the owner's own
+ * data. Skills are the interesting case and are deliberately reachable from
+ * both sides now: from here because this is the owner's control plane, and over
+ * MCP because ADR-014 §1 decided a policy-gated grant beats a missing path.
+ *
+ * One noun per file — `memory.ts`, `skills.ts`, `vault.ts` — over the shape all
+ * three share in `shared.ts`: the flag type, the open-announce-act-close
+ * wrapper, connection resolution, and the two prompts.
+ */
+
+export {
+  memoryForget,
+  memoryGet,
+  memoryList,
+  memoryStore,
+  memoryWrite,
+} from './owner/memory.ts';
+
+export { skillsAdd, skillsList, skillsRemove, skillsShow } from './owner/skills.ts';
+
+export {
+  vaultGet,
+  vaultKeyGenerate,
+  vaultList,
+  vaultRemove,
+  vaultSet,
+} from './owner/vault.ts';
+
+export { ownerConnection, type OwnerFlags } from './owner/shared.ts';

package/src/cli/commands/profile/removal.ts

@@ -0,0 +1,278 @@
+import { layout, profilePath, workspacePath, type Config, type TargetConfig } from '#profile';
+import type { SecretStore } from '#secrets';
+import type { BlobStore } from '#stores/blobs';
+import { credentialRefFor, ownClientRefsFor, type ProviderRegistry } from '#registry';
+import { print, style, warn } from '../../output.ts';
+
+/**
+ * What a profile's removal is allowed to delete, worked out before any of it
+ * happens.
+ *
+ * Everything here is a read. The plan is a value, and the preview an operator
+ * confirms from is that value rendered — which is what stops what they were
+ * shown and what runs from drifting apart. `../../../deployments/driver.ts`
+ * gives the same reason for the same shape.
+ */
+
+/**
+ * The credential references this profile declares, and only those.
+ *
+ * Locally the profile is the boundary: its credentials are a file inside its own
+ * directory, and deleting the directory is the whole operation. In Secret
+ * Manager they are flat names in one project, so two profiles deployed to the
+ * same project share a namespace and `list()` hands back the other one's as
+ * readily as its own. Deriving from what this profile declares is the only
+ * answer that cannot delete something that was never ours, and a secret deleted
+ * in the wrong project is not recoverable.
+ *
+ * The cost is that a genuinely orphaned ref — one whose connection was removed
+ * from config long ago — is not derivable and so is not deleted. The caller
+ * reports those rather than guessing, which is the honest position: a guess
+ * here is indistinguishable from another profile's credential.
+ */
+export function declaredRefs(
+  config: Config,
+  registry: ProviderRegistry,
+  declared: TargetConfig,
+): string[] {
+  const refs = new Set<string>([config.auth.token_ref]);
+
+  // Read off the *target*, not the profile. `vaultTargetSchema` sits inside
+  // `targetSchema`, so two targets may seal the same profile's items in
+  // different places; taking it from the profile would attach one target's
+  // vault to another target's removal.
+  if (declared.vault?.adapter === 'secret') {
+    refs.add(declared.vault.ref ?? 'vault/document');
+  }
+
+  for (const connection of config.connections) {
+    const manifest = registry.manifest(connection.provider);
+
+    // `credentialRefFor` rather than `credentialRefForConnection`: it is the
+    // single authority on where a connection's credential lives, and it exists
+    // because two callers once derived the answer differently and disagreed.
+    // Asking the lower-level one here would open that gap again from a third
+    // side — and it would miss a `local` provider, whose only ref is the one
+    // the connection declares itself.
+    const ref = credentialRefFor(connection, manifest);
+    if (ref) refs.add(ref);
+
+    if (manifest) {
+      for (const own of ownClientRefsFor(manifest, config.oauth_apps)) refs.add(own);
+    }
+  }
+
+  return [...refs];
+}
+
+export interface RemovalItem {
+  /** `null` for a workspace-level item — the config file, the default-profile key. */
+  readonly target: string | null;
+  readonly kind: 'secret' | 'blob' | 'file' | 'config' | 'workspace-key';
+  readonly id: string;
+  readonly note?: string;
+}
+
+export interface RemovalPlan {
+  readonly profile: string;
+  readonly items: readonly RemovalItem[];
+  /** Present in a target's store, not declared by this profile. Left alone. */
+  readonly untouched: readonly { readonly target: string; readonly refs: readonly string[] }[];
+  readonly warnings: readonly string[];
+}
+
+export interface PlanOptions {
+  /** Restrict to one target. The profile itself then survives. */
+  readonly target?: string | undefined;
+  readonly openSecrets: (target: string) => Promise<SecretStore>;
+  readonly openBlobs: (target: string, area?: string) => Promise<BlobStore>;
+  readonly readDefaultProfile?: (() => Promise<string | undefined>) | undefined;
+}
+
+const reason = (cause: unknown): string => (cause instanceof Error ? cause.message : String(cause));
+
+/**
+ * Everything removing this profile would delete, before any of it is deleted.
+ *
+ * Read-only. A store that will not open becomes a warning rather than a throw,
+ * because a target whose project is gone must not be able to strand a profile
+ * on the machine forever — and the operator sees that warning in the preview,
+ * before they confirm, rather than discovering it half way through.
+ */
+export async function removalPlan(
+  config: Config,
+  root: string,
+  profile: string,
+  registry: ProviderRegistry,
+  options: PlanOptions,
+): Promise<RemovalPlan> {
+  const items: RemovalItem[] = [];
+  const untouched: { target: string; refs: string[] }[] = [];
+  const warnings: string[] = [];
+
+  const names = options.target ? [options.target] : Object.keys(config.targets);
+
+  for (const name of names) {
+    const declared = config.targets[name];
+    if (!declared) {
+      warnings.push(`Target "${name}" is not declared by this profile, so nothing was planned.`);
+      continue;
+    }
+
+    // Secrets first, and this ordering is load-bearing rather than tidy:
+    // `layout.credentials(p)` is `data/<p>/credentials.enc`, *inside* the blob
+    // root `data/<p>`. For the file adapter the credential store is itself a
+    // blob, so blobs-first would delete the store the secret deletions read
+    // through and turn every one of them into a failure.
+    try {
+      const secrets = await options.openSecrets(name);
+      const present = await secrets.list();
+      const mine = new Set(declaredRefs(config, registry, declared));
+
+      for (const ref of present) if (mine.has(ref)) items.push({ target: name, kind: 'secret', id: ref });
+
+      const theirs = present.filter((ref) => !mine.has(ref));
+      if (theirs.length > 0) untouched.push({ target: name, refs: theirs });
+    } catch (cause) {
+      warnings.push(
+        `Target "${name}": its credential store could not be opened (${reason(cause)}), so nothing in it will be removed.`,
+      );
+    }
+
+    try {
+      const blobs = await options.openBlobs(name);
+      for (const blob of await blobs.list()) items.push({ target: name, kind: 'blob', id: blob.key });
+    } catch (cause) {
+      warnings.push(
+        `Target "${name}": its storage could not be opened (${reason(cause)}), so nothing in it will be removed.`,
+      );
+    }
+
+    // The blob store's root is the profile's own directory, and an adapter must
+    // never delete the root it was configured with — so emptying it leaves the
+    // directory. `layout.ts` frames that directory as the unit ("rm -r
+    // data/work is exactly remove the work profile's data"), and one left
+    // behind is silently reused by a later `profile add` of the same name.
+    if (declared.storage.adapter === 'filesystem') {
+      const blobRoot = declared.storage.path ?? layout.blobs(profile);
+      items.push({
+        target: name,
+        kind: 'file',
+        id: blobRoot,
+        note: 'the profile directory, once emptied',
+      });
+
+      // Skills and manifests sit at fixed areas under `data/<profile>/`, the
+      // same way state and the log do — an explicit area, so a profile that
+      // declares its own `storage.path` moves its provider blobs and leaves
+      // these where `layout` says they are. The sweep above walks the blob root
+      // and would then walk straight past them, so they are named. Ordinary
+      // case: both are already inside `blobRoot` and the sweep has them, which
+      // is why this only fires when the two have been pointed apart.
+      //
+      // Resolved before comparing, because they are not compared as paths
+      // otherwise: `newProfileTemplate` writes `./data/<profile>` and
+      // `layout.blobs` returns `data/<profile>`, which is one directory spelled
+      // two ways — the same leading `./` that `profile/layout.ts` has a
+      // paragraph about. Comparing the strings names every default profile's
+      // skills twice in the preview an operator confirms.
+      if (workspacePath(root, blobRoot) !== workspacePath(root, layout.blobs(profile))) {
+        for (const area of [layout.skills(profile), layout.providers(profile)]) {
+          items.push({
+            target: name,
+            kind: 'file',
+            id: area,
+            note: 'outside the declared storage path, so not swept with it',
+          });
+        }
+      }
+    }
+
+    // A deployed revision reads its config from the bucket rather than the
+    // image (ADR-023), so that copy is the profile too — and it is outside the
+    // profile's blob tree, which is why it needs its own area.
+    if (declared.storage.adapter === 'gcs' || declared.storage.adapter === 's3') {
+      items.push({
+        target: name,
+        kind: 'config',
+        id: `profiles/${profile}.yaml`,
+        note: 'the copy a deployed revision reads',
+      });
+    }
+
+    // `deploy` only: the schema folds the deprecated `cloudrun` block into it,
+    // so the resolved config has one answer rather than two that could differ.
+    if (declared.deploy) {
+      warnings.push(
+        `Target "${name}" is deployed. The service will keep answering, and every call will fail, because what it served is gone. Tearing it down is not part of this.`,
+      );
+    }
+  }
+
+  // Only when the whole profile is going. With `--target` it still exists.
+  if (!options.target) {
+    const defaultProfile = await options.readDefaultProfile?.();
+    if (defaultProfile === profile) {
+      items.push({
+        target: null,
+        kind: 'workspace-key',
+        id: 'default_profile',
+        note: 'cleared, not repointed at whatever remains',
+      });
+    }
+
+    // Last. It is the only record of where everything else lives, so a failure
+    // before this point leaves data a later run can still find.
+    items.push({ target: null, kind: 'config', id: profilePath(root, profile) });
+  }
+
+  return { profile, items, untouched, warnings };
+}
+
+const KIND_LABEL: Record<RemovalItem['kind'], string> = {
+  secret: 'credential',
+  blob: 'object',
+  file: 'file',
+  config: 'config',
+  'workspace-key': 'workspace',
+};
+
+/**
+ * The plan, as the thing an operator decides from.
+ *
+ * Rendered from the same value that is executed, so there is no second
+ * description of the work to fall out of step with the first. It prints
+ * references and keys and never a value — the plan holds no values to print.
+ */
+export function renderPlan(plan: RemovalPlan): void {
+  print();
+  print(`Removing profile ${style.bold(plan.profile)} would delete:`);
+  print();
+
+  if (plan.items.length === 0) {
+    print(style.dim('  nothing — there is no trace of this profile left to remove.'));
+  }
+
+  const targets = [...new Set(plan.items.map((item) => item.target))];
+  for (const target of targets) {
+    const items = plan.items.filter((item) => item.target === target);
+    print(`  ${style.bold(target ?? 'workspace')}`);
+    for (const item of items) {
+      const note = item.note ? style.dim(` — ${item.note}`) : '';
+      print(`    ${KIND_LABEL[item.kind].padEnd(10)} ${item.id}${note}`);
+    }
+    print();
+  }
+
+  for (const { target, refs } of plan.untouched) {
+    // Named rather than counted, because the operator is the only one who can
+    // tell an orphan from another profile's live credential — and this command
+    // deliberately will not guess.
+    print(`  ${style.bold(target)}: present but not declared by this profile, so left alone`);
+    for (const ref of refs) print(style.dim(`    ${ref}`));
+    print();
+  }
+
+  for (const warning of plan.warnings) print(warn(warning));
+  if (plan.warnings.length > 0) print();
+}