@sous-io/sous 0.2.29 → 0.2.30

package/docs/markdown/_sidebar.md

@@ -28,3 +28,4 @@
   - [0007: Frozen index entries and tolerant readers](adrs/0007-frozen-index-dependencies.md)
   - [0008: One ref parser, told where the ref came from](adrs/0008-one-ref-parser.md)
   - [0009: One whole build, everywhere](adrs/0009-whole-build-everywhere.md)
+  - [0010: The index describes each version's dependencies and questions](adrs/0010-index-describes-recipes.md)

package/docs/markdown/commands.md

@@ -347,8 +347,9 @@ optionally carrying an `@<range>` and a `repo:` qualifier; see
 ### `sous subscription add REF`
 Subscribes this project to a recipe, or to a whole namespace of them, then builds the project so the recipe's
 files are on disk when the command returns. Also spelled `sous subscribe`. Takes `-y, --yes`, `--no-build`, and
-`--dry-run`, which also prints the questions of every recipe this machine already holds; a recipe not held here
-yet is named instead, because a dry run downloads nothing.
+`--dry-run`, which also prints every question the recipes would ask. A dry run downloads nothing, so a recipe
+not on this machine is described from its repository's index; one whose index entry predates the release that
+began recording questions there is named instead.
 
 - `--prerelease`: let prerelease versions take part in range matching.
 - `--always-pull`: install a newer in-range version whenever one exists, rather than holding the lock.
@@ -409,10 +410,13 @@ Lists the recipes the trusted repositories publish, across every namespace, with
 `namespace show` prints. Example: `sous recipe list --installed --latest`
 
 ### `sous recipe show REF`
-Describes one recipe completely: its repository and location, every published version, its dependencies as
-declared and as resolved at release time, the questions it asks with the environment variable each answer is
-stored under, and the directories its files are written into. `REF` is `namespace/recipe`, a recipe name alone,
-or either with a `repository:` qualifier. Example: `sous recipe show sous-recipes:core/about-sous`
+Describes one recipe completely: its repository and location, every published version, its dependencies (the
+manifest entry bringing each one in, such as a whole namespace, whether it is a co-subscription or a build
+dependency, and the version it was released against), every recipe a subscription to it would install, every
+question that would ask, laid out as `sous subscription add --dry-run` lays them out, and the directories its
+files are written into. Everything but the files comes from the index, so a recipe nothing has installed yet
+is described in full, offline. `REF` is `namespace/recipe`, a recipe name alone, or either with a
+`repository:` qualifier. Example: `sous recipe show omakase/house`
 
 ## lock
 

package/docs/markdown/repositories-authoring.md

@@ -243,9 +243,13 @@ this release's scope** is fine: the release depends on the last published versio
 ```
 
 Each version's resolved dependencies are written into the index, so a consumer installing that version gets what
-it was published with rather than ranges re-resolved months later. A published version never changes: its content
-hash and its dependencies are carried forward exactly as published, and a disagreement is an error telling you
-to bump rather than republish ([what is checked](repositories-file-formats.md#sousindexjson)). A version counts
+it was published with rather than ranges re-resolved months later. Each dependency also records the manifest
+entry that brought it in and whether it is a co-subscription or a build dependency, and each version records the
+variable definitions its manifest publishes, so `sous recipe show` and `sous subscription add --dry-run` can say
+what a recipe installs and asks before anything is fetched. A published version never changes: its content
+hash, its dependencies and its variable definitions are carried forward exactly as published, and a
+disagreement is an error telling you to bump rather than republish
+([what is checked](repositories-file-formats.md#sousindexjson)). A version counts
 as published once its tag exists, and the tags are the backstop, so a tagged version missing from the index is
 rebuilt from it, dependencies included, whenever the index is regenerated, which only happens on a run that
 publishes something. A bump edits the manifest in place, so comments, field order and layout survive; a folded

package/docs/markdown/repositories-consuming.md

@@ -65,22 +65,35 @@ The cache can be behind what a repository has published since. Every one of thes
 `sous recipe list --installed --latest` is the out-of-date view: every installed recipe, with
 upstream's newest version beside the installed one.
 
-Read `sous recipe show` before subscribing: every published version, what it depends on (as
-declared, beside the version the index resolved it to), and its questions and files once it has
-them here.
+Read `sous recipe show` before subscribing. It works offline, from the index alone: every published
+version, what the version depends on (the manifest entry that brings each dependency in, whether it
+is a co-subscription whose files land here or a build dependency, and the version it was released
+against), every recipe a subscription would install, and every question that would ask. Only the
+files it publishes wait until it is installed. A preset set, a recipe that only bundles others,
+reads like this:
 
 ```term
-$ sous recipe show workflow/qa-variables
-    Latest version : 0.1.0
+$ sous recipe show omakase/house
+    Latest version : 1.0.0
     Pinned version : this project pins none
     Subscribed     : no
-  Dependency          Declared as                     Resolved to  Repository       Kind
-  ------------------  ------------------------------  -----------  ---------------  ----------------
-  workflow/qa-helper  not declared in the manifest    0.1.0        this repository  unknown
-  The recipe's own files are not on this machine, so the questions it asks and the files it
-    publishes are not known here. Subscribing to it fetches them.
+  Dependency       Declared as                     Resolved to  Repository       Kind
+  ---------------  ------------------------------  -----------  ---------------  ----------------
+  tools/lint       tools/lint                      1.0.0        this repository  build dependency
+  workflow/notes   the whole 'workflow' namespace  1.0.0        this repository  co-subscription
+  workflow/review  the whole 'workflow' namespace  1.0.0        this repository  co-subscription
+➔ What subscribing asks you:
+  These recipes ask 3 questions, 3 of which nothing answers yet.
+  workflow/notes asks 1 question:
+    notesDir
+      about       : Where the notes skill keeps its notes.
+      stored-as   : SOUS_VAR_NOTES_DIR
+      answered    : no, and this recipe requires an answer
 ```
 
+?> A recipe released before sous recorded questions in the index is described from its files
+instead, so its questions are listed once it is installed, and named as unknown until then.
+
 ## Subscribe to a recipe
 
 ```bash
@@ -206,8 +219,9 @@ stored value nothing reads. Names are camelCase, as the recipe declares them; th
 `namespace/recipe.name` key works too when two recipes publish the same name, and everything after
 the first `=` is the answer. `--answers-file answers.yaml` reads a YAML or JSON file of them.
 
-?> A dry run downloads nothing, so a recipe your machine does not hold yet has no manifest to read
-and its questions cannot be listed; the run still succeeds and names them.
+?> A dry run downloads nothing. A recipe your machine does not hold yet is described from the
+questions its repository's index records; one released before sous recorded questions there cannot
+be, so the run still succeeds and names it.
 
 ## See what you have
 

package/docs/markdown/repositories-file-formats.md

@@ -201,8 +201,16 @@ fetches only this file; nothing more is downloaded until a project subscribes.
   "namespaces": { "quality": { "description": "Recipes that exercise the edges." } },
   "recipes": { "quality/qa-remote-dep": { "path": "recipes/quality/qa-remote-dep",
     "versions": { "0.1.0": {
-      "dependencies": { "workflow/qa-helper": { "version": "0.1.0" },
-        "workflow/sub-agent-delegation": { "range": "^1.0", "repo": "github.com/sous-io/sous-recipes" } },
+      "dependencies": {
+        "workflow/qa-helper": { "version": "0.1.0", "declared": "workflow", "kind": "subscribes" },
+        "workflow/sub-agent-delegation": { "range": "^1.0", "repo": "github.com/sous-io/sous-recipes",
+          "declared": "github://sous-io/sous-recipes/workflow/sub-agent-delegation@^1.0",
+          "kind": "depends" } },
+      "depends": [ "github://sous-io/sous-recipes/workflow/sub-agent-delegation@^1.0" ],
+      "subscribes": [ "workflow" ],
+      "variables": [ { "name": "qaNotesDir", "type": "path", "prompt": "Where should notes go?",
+        "description": "The directory QA notes are written to.", "example": "docs/qa",
+        "default": ".sous/qa-notes", "required": true, "secret": false, "scope": "shared" } ],
       "hash": "sha256-46e75442aeb368116c8830ad382707759f1ecd03974c4b5d42a5fabffce0324f",
       "prerelease": false, "releasedAt": "2026-09-12T07:06:33.236Z",
       "tag": "quality/qa-remote-dep@0.1.0"
@@ -216,12 +224,30 @@ fetches only this file; nothing more is downloaded until a project subscribes.
 | `recipes` | top level | Keyed `namespace/recipe`; a recipe whose namespace is not declared is an error. Each entry carries `path` (the recipe folder), `description`, and `versions`, keyed by exact version |
 | `hash`, `tag` | per version | The content hash verified after every fetch, and the tag, which must be exactly `namespace/recipe@version` so a version can never point at a branch |
 | `prerelease`, `releasedAt`, `seeded` | per version | Whether ranges skip it unless a subscription opts in, when it was released, and whether it is the copy sous folds in from its own package |
+| `dependencies` | per version | What the version was released against, keyed `namespace/recipe`; see below |
+| `variables` | per version | The version's variable definitions, exactly as its manifest publishes them (see [Variable definitions](#variable-definitions)), with `required`, `secret` and `scope` filled in; `[]` when it asks nothing |
+| `depends`, `subscribes` | per version | The version's manifest lists, exactly as written; `[]` when empty |
 
 Dependencies are resolved at release time and keyed `namespace/recipe`. An entry carries `version` (a
 sibling, resolved exactly) or `range` plus `repo` (the identity of the repository publishing it, whose own
 index resolves the range); at least one is required. Installing a version installs these rather than
 re-resolving the manifest's ranges.
 
+**Each version describes itself.** So that a recipe can be described before anything is fetched, every
+version a release records carries more than its dependencies. Each dependency records `declared`, the
+manifest entry that brings it in exactly as written (a recipe such as `workflow/qa-helper@^1.0`, a whole
+namespace such as `workflow`, or a locator), and `kind`: `subscribes` for a co-subscription, whose files
+land and whose questions are asked, or `depends` for a build dependency. When several entries cover one
+recipe, an entry naming it wins over a namespace, and it is a co-subscription when any entry covering it is
+one. The version records `variables`, its manifest's definitions, and `depends` and `subscribes`, its
+manifest's lists as written; the lists are what a consumer walks, because a namespace of another repository
+has no recipe key to record it under. All of them are written even when empty (`"dependencies": {}`,
+`"variables": []`), so "none" reads differently from "not recorded". From these, `sous recipe show` and
+`sous subscription add --dry-run` list everything a subscription installs and every question it asks, and
+the resolver walks a recipe whose files are not on the machine from its index entry just as it would walk
+its manifest. A version recorded before a release wrote these fields keeps its entry as it is; its questions
+are known only once its files are fetched, and the dry run names it as such.
+
 **A published version's entry is frozen.** Its dependencies are resolved once, when the version is first
 recorded, and every later release carries the entry forward exactly as published, like its hash; releasing
 other recipes, adding a recipe to a namespace it subscribes to, or raising a sibling it names changes nothing
@@ -234,9 +260,13 @@ against the repository as it stood at that tag, then frozen the same way. An ent
 recorded dependencies carries none, stays that way, and installs by resolving its manifest's ranges.
 
 **Fields this sous does not know are kept, not refused.** A later sous may add fields to the index, at any
-level. This one reads such an index, validates every field it defines as strictly as before, and ignores the
-rest; a release it runs carries a published version's entry forward with those fields intact. A sous older
-than the one that began tolerating unknown fields refuses the whole index once a repository publishes one.
+level, recorded variable definitions included. This one reads such an index, validates every field it
+defines as strictly as before, and ignores the rest; a release it runs carries a published version's entry
+forward with those fields intact.
+
+!> A sous older than 0.2.26, the first to tolerate unknown fields, refuses the whole index of any
+repository released with `declared`, `kind`, `variables`, `depends` or `subscribes` in it, the official
+one included. A project pinned to such a sous fails to read that index until it moves to 0.2.26 or later.
 
 **The `seeded` field.** Sous ships the `core` recipe in its own npm package, so a project can build before
 reaching the network. That copy is folded into the official repository's index in memory and resolved like

package/docs/markdown/repositories-variables.md

@@ -12,7 +12,10 @@ a separate, ceremony-free system; see [Variables](config-variables.md). The two
 
 A definition ships inside the recipe that needs it, in its manifest's `variables:` array, so it versions,
 resolves, pins and trusts like the rest of the recipe; every field it can carry is listed in
-[Variable definitions](repositories-file-formats.md#variable-definitions).
+[Variable definitions](repositories-file-formats.md#variable-definitions). `sous repo release` also copies
+each version's definitions into the repository's index, which is how `sous recipe show` and
+`sous subscription add --dry-run` list a recipe's questions before its files are on your machine. The index
+holds definitions only, never an answer; answers come from the ladder below and nowhere else.
 
 A definition is in play when your lockfile pins the recipe that declares it, whether you subscribed to that
 recipe or a dependency pulled it in. A recipe the store does not hold yet contributes nothing rather than

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sous-io/sous",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "description": "Compiles AI coding agent configuration (CLAUDE.md, skills, memories) from LiquidJS templates",
   "type": "module",
   "license": "Apache-2.0",

package/recipes/core/sous-skills/skills/about-sous-repos/SKILL.tpl.md

@@ -65,10 +65,13 @@ contribute: https://github.com/harbor-labs/team-recipes/blob/main/CONTRIBUTING.m
 A recipe's version lives in its manifest, which is the source of truth. A version is **published**
 once a git tag shaped `namespace/recipe@version` exists for it (for example
 `review/checklist@1.2.0`). The index records each published version with its content hash, its
-tag and the exact versions of its dependencies at release time; for the length of one release
-commit it also records the version each manifest declares, whose tag that release cuts next. A
-published version never changes: new files need a new version, and a release refuses to publish
-different content under a version already tagged. A lost index is rebuilt from the tags.
+tag, the exact versions of its dependencies at release time (each with the manifest entry that
+brought it in and whether it is a co-subscription or a build dependency) and the variable
+definitions it publishes, which is how a project lists what a recipe installs and asks before
+fetching it; for the length of one release commit it also records the version each manifest
+declares, whose tag that release cuts next. A published version never changes: new files need a
+new version, and a release refuses to publish different content under a version already tagged. A
+lost index is rebuilt from the tags.
 
 ## Releasing
 

package/recipes/core/sous-skills/sous.recipe.yaml

@@ -11,7 +11,7 @@ formatVersion: 1
 
 namespace: core
 name: sous-skills
-version: 0.2.29
+version: 0.2.30
 
 description: >-
   The skills that teach an agent what sous is and how it works: which files sous

package/src/commands/lock/rebuild.ts

@@ -150,7 +150,8 @@ export default class LockRebuild extends BaseCommand {
       repos,
       // A recipe's own manifest is what names its dependencies, and it is read
       // from the files this machine already holds. Nothing is fetched here, so a
-      // recipe that is not in the store yet comes back under `missingManifests`.
+      // recipe that is not in the store yet is walked from what its index entry
+      // records, and comes back under `missingManifests` when that is nothing.
       loadManifest: (recipe) => {
         const directory = recipeFilesDirectory({
           service,
@@ -208,9 +209,9 @@ export default class LockRebuild extends BaseCommand {
     if (result.missingManifests.length > 0) {
       blankLine();
       paragraph(
-        `The files of these recipes are not on this machine, so their own ` +
-          `dependencies could not be read and are not in the rebuilt lockfile: ` +
-          `${result.missingManifests.join(", ")}.`
+        `The files of these recipes are not on this machine, and their repository's ` +
+          `index does not record what they depend on, so their own dependencies are ` +
+          `not in the rebuilt lockfile: ${result.missingManifests.join(", ")}.`
       );
     }
 

package/src/commands/recipe/show.ts

@@ -2,27 +2,41 @@
  * `sous recipe show <ref>`.
  *
  * Shows one recipe in full: where it is published, every version it publishes,
- * what the version this project would use depends on, the questions it asks,
- * and where its files land in this project. It reads only what sous already has
- * on disk: the repository's cached index, the project's lockfile, and the
- * recipe's own files when they are in the store or a linked working copy.
- * `--latest` reads the repository's index from upstream instead, saving
- * nothing, and `--installed` looks the ref up among installed recipes only.
+ * what the version this project would use depends on and how each dependency is
+ * declared, everything subscribing to it would install, every question that
+ * would ask, and where its files land in this project. It reads only what sous
+ * already has on disk: the repository's cached index, the project's lockfile,
+ * and the recipe's own files when they are in the store or a linked working
+ * copy. The index describes each version's dependencies and questions, so a
+ * recipe nothing has installed is described as fully as one in the store, its
+ * files excepted. `--latest` reads the repository's index from upstream
+ * instead, saving nothing, and `--installed` looks the ref up among installed
+ * recipes only.
  */
 
 import { Args } from "@oclif/core";
+import semver from "semver";
 import { BaseCommand } from "../../base-command.js";
 import { resolveRootScope } from "../../lib/settings.js";
-import { subscriptionServiceFor } from "../../lib/repos/subscription-service.js";
+import {
+  subscriptionServiceFor,
+  type SubscriptionPreview,
+  type SubscriptionService,
+} from "../../lib/repos/subscription-service.js";
 import { loadCatalogContext } from "../../lib/repos/catalog-inputs.js";
 import {
   describeInstalled,
   describeRecipe,
+  type CatalogInputs,
   type RecipeContentListing,
   type RecipeDependencyListing,
-  type RecipeVariableListing,
+  type RecipeDetail,
   type RecipeVersionListing,
 } from "../../lib/repos/catalog.js";
+import { PROJECT_REQUESTER } from "../../lib/repos/resolver.js";
+import { describeDeclaration, describeDependencyKind } from "../../lib/repos/declarations.js";
+import { formatQuestionPlan } from "../../lib/vars/question-plan.js";
+import { describeError } from "../../lib/repos/release/validate.js";
 import {
   INDENT,
   describeIndexSource,
@@ -61,14 +75,19 @@ const DEPENDENCY_COLUMNS: TableColumn[] = [
   { key: "kind", header: "Kind", overflow: "wrap", priority: "medium", minWidth: 16 },
 ];
 
-/** The columns the variable listing shows. */
-const VARIABLE_COLUMNS: TableColumn[] = [
-  { key: "name", header: "Variable", overflow: "truncate", minWidth: 10 },
-  { key: "type", header: "Type", priority: "medium" },
-  { key: "env", header: "Environment variable", overflow: "truncate", minWidth: 12 },
-  { key: "required", header: "Required", priority: "medium" },
-  { key: "secret", header: "Secret", priority: "low" },
-  { key: "prompt", header: "What it asks", overflow: "wrap", flex: 1, priority: "low", minWidth: 16 },
+/** The columns the listing of everything a subscription installs shows. */
+const INSTALLS_COLUMNS: TableColumn[] = [
+  { key: "key", header: "Recipe", kind: "path", overflow: "truncate", minWidth: 12 },
+  { key: "version", header: "Version", overflow: "truncate", minWidth: 7 },
+  { key: "kind", header: "Kind", overflow: "wrap", minWidth: 16 },
+  {
+    key: "neededBy",
+    header: "Needed by",
+    overflow: "wrap",
+    flex: 1,
+    priority: "medium",
+    minWidth: 12,
+  },
 ];
 
 /** The columns the content listing shows. */
@@ -86,7 +105,8 @@ const CONTENT_COLUMNS: TableColumn[] = [
 ];
 
 export default class RecipeShow extends BaseCommand {
-  static description = "Show one recipe: its versions, dependencies, variables and files";
+  static description =
+    "Show one recipe: its versions, dependencies, what subscribing installs and asks, and its files";
 
   /**
    * The other spelling of the topic. It lives under a hidden topic, so it is
@@ -165,24 +185,76 @@ export default class RecipeShow extends BaseCommand {
     printBrowsingNotes({ notChecked: notChecked.filter((name) => name === detail.repo) });
 
     this.printVersions(detail.versions);
-    this.printDependencies(detail.dependencies, detail.manifestRead);
+    this.printDependencies(
+      detail.dependencies,
+      detail.manifestRead || detail.dependenciesRecorded
+    );
 
-    if (!detail.manifestRead) {
+    const preview = await this.preview(service, inputs, detail);
+    if (typeof preview === "string") {
+      blankLine();
+      paragraph(preview);
+    } else {
+      this.printInstalls(preview);
+      this.printQuestions(preview);
+    }
+
+    if (detail.manifestRead) {
+      this.printContents(detail.contents);
+    } else {
+      blankLine();
+      subheading("Where its files land in this project");
       blankLine();
       paragraph(
-        "The recipe's own files are not on this machine, so the questions it asks and " +
-          "the files it publishes are not known here. Subscribing to it fetches them."
+        "The recipe's own files are not on this machine, so the files it publishes are " +
+          "not known here. Subscribing to it fetches them."
       );
-      footer();
-      return;
     }
 
-    this.printVariables(detail.variables);
-    this.printContents(detail.contents);
-
     footer();
   }
 
+  /**
+   * Works out what subscribing to the described version would install and ask,
+   * from the same indexes the rest of the page reads, fetching nothing. The
+   * answer is a sentence instead when it cannot be worked out.
+   *
+   * @param service - The project's subscription service.
+   * @param inputs - The catalog's inputs, whose indexes the preview resolves against.
+   * @param detail - The recipe being described.
+   */
+  private async preview(
+    service: SubscriptionService,
+    inputs: CatalogInputs,
+    detail: RecipeDetail
+  ): Promise<SubscriptionPreview | string> {
+    if (detail.describing === undefined) {
+      return (
+        "This recipe publishes no version a subscription would install, so nothing " +
+        "is described below."
+      );
+    }
+    try {
+      return await service.previewSubscription(
+        {
+          repo: detail.repo,
+          namespace: detail.namespace,
+          recipe: detail.name,
+          range: detail.describing,
+        },
+        {
+          indexes: new Map(inputs.repos.map((repo) => [repo.name, repo.index])),
+          ...(semver.prerelease(detail.describing) === null ? {} : { prerelease: true }),
+        }
+      );
+    } catch (error) {
+      return (
+        `Sous could not work out what subscribing to version ${detail.describing} ` +
+        `would install. ${describeError(error)}`
+      );
+    }
+  }
+
   /**
    * Every published version, newest first, with what each one is to this
    * project.
@@ -207,24 +279,21 @@ export default class RecipeShow extends BaseCommand {
   }
 
   /**
-   * What the described version depends on, from both sides: what the recipe's
-   * manifest declares, and what its repository's index resolved that to when it
-   * was released.
+   * What the described version depends on: the manifest entry that brings each
+   * dependency in and whether it is a co-subscription or a build dependency,
+   * and what its repository's index resolved it to when it was released.
    *
    * @param dependencies - The dependencies the catalog listed.
-   * @param manifestRead - Whether the recipe's own manifest could be read.
+   * @param known - Whether the manifest or the index says what the version declares.
    */
-  private printDependencies(
-    dependencies: RecipeDependencyListing[],
-    manifestRead: boolean
-  ): void {
+  private printDependencies(dependencies: RecipeDependencyListing[], known: boolean): void {
     blankLine();
     subheading("What it depends on");
     blankLine();
 
     if (dependencies.length === 0) {
       paragraph(
-        manifestRead
+        known
           ? "This recipe depends on nothing else."
           : "The repository's index records no dependencies for this version."
       );
@@ -233,7 +302,10 @@ export default class RecipeShow extends BaseCommand {
 
     const rows = dependencies.map((entry) => ({
       key: entry.key,
-      declared: entry.declared ?? "not declared in the manifest",
+      declared:
+        entry.declared === undefined
+          ? "not recorded in the index"
+          : describeDeclaration(entry.declared),
       resolved:
         entry.resolvedVersion ??
         (entry.resolvedRange === undefined
@@ -249,32 +321,69 @@ export default class RecipeShow extends BaseCommand {
   }
 
   /**
-   * The questions the recipe asks, and the environment variable each answer is
-   * stored under.
+   * Every recipe a subscription to the described version would install, each
+   * with whether its files land in the project and what brings it in, and the
+   * repositories it would need that the project does not trust yet.
    *
-   * @param variables - The variables the catalog listed.
+   * @param preview - What subscribing would install and ask.
    */
-  private printVariables(variables: RecipeVariableListing[]): void {
+  private printInstalls(preview: SubscriptionPreview): void {
     blankLine();
-    subheading("What it asks you");
+    subheading("What subscribing installs");
     blankLine();
 
-    if (variables.length === 0) {
-      paragraph("This recipe asks no questions.");
-      return;
+    const rows = preview.resolved.map((recipe) => {
+      const subscribed = recipe.requestedBy.includes(PROJECT_REQUESTER);
+      const holders = recipe.requestedBy.filter((holder) => holder !== PROJECT_REQUESTER);
+      return {
+        key: recipe.key,
+        version: recipe.version,
+        kind: subscribed ? "the subscription itself" : describeDependencyKind(recipe.kind),
+        neededBy: holders.length === 0 ? "this subscription" : holders.join(", "),
+      };
+    });
+
+    for (const line of renderTable(INSTALLS_COLUMNS, rows, { indent: INDENT })) {
+      log(indent(line, INDENT));
     }
 
-    const rows = variables.map((entry) => ({
-      name: entry.name,
-      type: entry.type,
-      env: entry.env,
-      required: entry.required ? "yes" : "no",
-      secret: entry.secret ? "yes" : "no",
-      prompt: entry.prompt,
-    }));
+    if (preview.missingRepos.length > 0) {
+      blankLine();
+      paragraph(
+        `Subscribing also needs ${
+          preview.missingRepos.length === 1 ? "a repository" : "repositories"
+        } this project does not trust yet, so what ${
+          preview.missingRepos.length === 1 ? "it publishes" : "they publish"
+        } is not listed above: ` +
+          preview.missingRepos
+            .map(
+              (missing) =>
+                `${missing.name}${missing.url === undefined ? "" : ` (${missing.url})`}, ` +
+                `needed by ${missing.requiredBy.map((entry) => entry.requestedBy).join(", ")}`
+            )
+            .join("; ") +
+          "."
+      );
+    }
+  }
 
-    for (const line of renderTable(VARIABLE_COLUMNS, rows, { indent: INDENT })) {
-      log(indent(line, INDENT));
+  /**
+   * Every question a subscription to the described version would ask, laid out
+   * exactly as `sous subscription add --dry-run` lays them out, without the
+   * flags that answer them ahead of time.
+   *
+   * @param preview - What subscribing would install and ask.
+   */
+  private printQuestions(preview: SubscriptionPreview): void {
+    blankLine();
+    subheading("What subscribing asks you");
+    blankLine();
+
+    for (const line of formatQuestionPlan(preview.questions, {
+      unreadable: preview.unreadable,
+      answerHints: false,
+    })) {
+      log(line === "" ? "" : indent(line));
     }
   }
 
@@ -311,13 +420,3 @@ export default class RecipeShow extends BaseCommand {
   }
 }
 
-/**
- * Plain-language wording for how a dependency was declared.
- *
- * @param kind - What the manifest declared it as, when the manifest was read.
- */
-function describeDependencyKind(kind: "depends" | "subscribes" | undefined): string {
-  if (kind === "depends") return "build dependency";
-  if (kind === "subscribes") return "co-subscription";
-  return "unknown";
-}