fleetfizz 0.5.1 → 0.6.0

package/dist/fleetfizz.mjs

@@ -22876,6 +22876,10 @@ function decodeUnknownEffect$1(schema, options) {
 	const parser = run$3(schema.ast);
 	return options === void 0 ? parser : (input, overrideOptions) => parser(input, mergeParseOptions(options, overrideOptions));
 }
+/** @internal */
+function decodeUnknownOption$1(schema, options) {
+	return asOption(decodeUnknownEffect$1(schema, options));
+}
 /**
 * Creates a decoder for `unknown` input that reports failure safely as a
 * `Result`.
@@ -22961,6 +22965,16 @@ function runWithCompiler(compiler, ast) {
 function asExit(parser) {
 	return (input, options) => runSyncExit(parser(input, options));
 }
+/** @internal */
+function asOption(parser) {
+	const parserExit = asExit(parser);
+	return (input, options) => {
+		const exit = parserExit(input, options);
+		if (isSuccess(exit)) return some(exit.value);
+		getSchemaIssueOrThrow(exit.cause, "Option adapter can only return none for schema issues");
+		return none();
+	};
+}
 function asResult(parser) {
 	const parserExit = asExit(parser);
 	return (input, options) => {
@@ -24468,6 +24482,34 @@ function decodeUnknownEffect(schema, options) {
 */
 const decodeEffect = decodeUnknownEffect;
 /**
+* Decodes an `unknown` input against a schema, returning an `Option` that is
+* `Some` with the decoded value on success or `None` for schema mismatches.
+*
+* **When to use**
+*
+* Use when you do not know the input type statically and only need to know
+* whether decoding succeeded.
+*
+* **Details**
+*
+* Prefer this over {@link decodeUnknownExit} or {@link decodeUnknownEffect}
+* when you don't need error details. For input already typed as the schema's
+* `Encoded` type use {@link decodeOption}.
+* Options may be provided either when creating the decoder or when applying it;
+* application options override creation options.
+*
+* **Gotchas**
+*
+* Only causes made entirely of schema issues are converted to `None`. Causes
+* that contain defects, interruptions, or other non-schema reasons throw
+* instead.
+*
+* @stability stable
+* @category decoding
+* @since 3.10.0
+*/
+const decodeUnknownOption = decodeUnknownOption$1;
+/**
 * Decodes an `unknown` input against a schema, returning a `Result` that
 * succeeds with the decoded value or fails with a {@link SchemaError} for schema
 * mismatches.
@@ -25893,145 +25935,6 @@ function defaultShouldQuit(input) {
 */
 const layer = /*#__PURE__*/ provideMerge(layer$11, /*#__PURE__*/ mergeAll(layer$7, layer$9, layer$5, layer$3, layer$2));
 //#endregion
-//#region ../../node_modules/.pnpm/effect@4.0.2/node_modules/effect/dist/Console.js
-/**
-* Context reference for the current console service in the Effect system, allowing access to the active console implementation from within the Effect context.
-*
-* **When to use**
-*
-* Use when you need an effect to run against a provided console implementation,
-* such as tests or alternate runtimes, rather than the default console.
-*
-* **Details**
-*
-* When no override is provided, the reference resolves to `globalThis.console`.
-*
-* **Example** (Accessing the current console)
-*
-* ```ts import.meta.vitest
-* import { Console, Effect } from "effect"
-*
-* const messages: Array<unknown> = []
-* const testConsole: Console.Console = Object.assign(Object.create(console), {
-*   log: (...args: ReadonlyArray<unknown>) => messages.push(...args)
-* })
-* const program = Console.consoleWith((console) =>
-*   Effect.sync(() => {
-*     console.log("Hello from current console!")
-*   })
-* )
-*
-* Effect.runSync(Effect.provideService(program, Console.Console, testConsole))
-* messages // => ["Hello from current console!"]
-* ```
-*
-* @see {@link consoleWith} for using the current console service inside an effect
-*
-* @stability stable
-* @category services
-* @since 2.0.0
-*/
-const Console = ConsoleRef;
-/**
-* Creates an Effect that provides access to the current console service and lets you perform operations with it within an Effect context.
-*
-* **Example** (Accessing the current console service)
-*
-* ```ts import.meta.vitest
-* import { Console, Effect } from "effect"
-*
-* const messages: Array<unknown> = []
-* const testConsole: Console.Console = Object.assign(Object.create(console), {
-*   log: (...args: ReadonlyArray<unknown>) => messages.push(...args),
-*   error: (...args: ReadonlyArray<unknown>) => messages.push(...args)
-* })
-* const program = Console.consoleWith((console) =>
-*   Effect.sync(() => {
-*     console.log("Hello, world!")
-*     console.error("This is an error message")
-*   })
-* )
-*
-* Effect.runSync(Effect.provideService(program, Console.Console, testConsole))
-* messages // => ["Hello, world!", "This is an error message"]
-* ```
-*
-* @stability stable
-* @category constructors
-* @since 2.0.0
-*/
-const consoleWith = (f) => withFiber$1((fiber) => f(fiber.getRef(Console)));
-/**
-* Writes an error-level message to the console, typically displayed with error
-* styling by the active console implementation.
-*
-* **Example** (Writing error messages)
-*
-* ```ts import.meta.vitest
-* import { Console, Effect } from "effect"
-*
-* const messages: Array<ReadonlyArray<unknown>> = []
-* const testConsole: Console.Console = Object.assign(Object.create(console), {
-*   error: (...args: ReadonlyArray<unknown>) => messages.push(args)
-* })
-* const program = Effect.gen(function*() {
-*   yield* Console.error("Something went wrong!")
-*   yield* Console.error("Error details:", {
-*     code: 500,
-*     message: "Internal Server Error"
-*   })
-* })
-*
-* Effect.runSync(Effect.provideService(program, Console.Console, testConsole))
-* const expected = [
-*   ["Something went wrong!"],
-*   ["Error details:", { code: 500, message: "Internal Server Error" }]
-* ]
-* messages // => expected
-* ```
-*
-* @stability stable
-* @category accessors
-* @since 2.0.0
-*/
-const error = (...args) => consoleWith((console) => sync$1(() => {
-	console.error(...args);
-}));
-/**
-* Logs a general-purpose message to the console.
-*
-* **Example** (Writing log messages)
-*
-* ```ts import.meta.vitest
-* import { Console, Effect } from "effect"
-*
-* const messages: Array<ReadonlyArray<unknown>> = []
-* const testConsole: Console.Console = Object.assign(Object.create(console), {
-*   log: (...args: ReadonlyArray<unknown>) => messages.push(args)
-* })
-* const program = Effect.gen(function*() {
-*   yield* Console.log("Hello, world!")
-*   yield* Console.log("User data:", { name: "John", age: 30 })
-*   yield* Console.log("Processing", 42, "items")
-* })
-*
-* Effect.runSync(Effect.provideService(program, Console.Console, testConsole))
-* const expected = [
-*   ["Hello, world!"],
-*   ["User data:", { name: "John", age: 30 }],
-*   ["Processing", 42, "items"]
-* ]
-* messages // => expected
-* ```
-*
-* @stability stable
-* @category accessors
-* @since 2.0.0
-*/
-const log = (...args) => consoleWith((console) => sync$1(() => {
-	console.log(...args);
-}));
-//#endregion
 //#region ../../node_modules/.pnpm/effect@4.0.2/node_modules/effect/dist/cli/CliError.js
 /**
 * Defines structured errors for the unstable CLI parser and runner.
@@ -29124,6 +29027,145 @@ const getParamMetadata = (param) => {
 	});
 };
 //#endregion
+//#region ../../node_modules/.pnpm/effect@4.0.2/node_modules/effect/dist/Console.js
+/**
+* Context reference for the current console service in the Effect system, allowing access to the active console implementation from within the Effect context.
+*
+* **When to use**
+*
+* Use when you need an effect to run against a provided console implementation,
+* such as tests or alternate runtimes, rather than the default console.
+*
+* **Details**
+*
+* When no override is provided, the reference resolves to `globalThis.console`.
+*
+* **Example** (Accessing the current console)
+*
+* ```ts import.meta.vitest
+* import { Console, Effect } from "effect"
+*
+* const messages: Array<unknown> = []
+* const testConsole: Console.Console = Object.assign(Object.create(console), {
+*   log: (...args: ReadonlyArray<unknown>) => messages.push(...args)
+* })
+* const program = Console.consoleWith((console) =>
+*   Effect.sync(() => {
+*     console.log("Hello from current console!")
+*   })
+* )
+*
+* Effect.runSync(Effect.provideService(program, Console.Console, testConsole))
+* messages // => ["Hello from current console!"]
+* ```
+*
+* @see {@link consoleWith} for using the current console service inside an effect
+*
+* @stability stable
+* @category services
+* @since 2.0.0
+*/
+const Console = ConsoleRef;
+/**
+* Creates an Effect that provides access to the current console service and lets you perform operations with it within an Effect context.
+*
+* **Example** (Accessing the current console service)
+*
+* ```ts import.meta.vitest
+* import { Console, Effect } from "effect"
+*
+* const messages: Array<unknown> = []
+* const testConsole: Console.Console = Object.assign(Object.create(console), {
+*   log: (...args: ReadonlyArray<unknown>) => messages.push(...args),
+*   error: (...args: ReadonlyArray<unknown>) => messages.push(...args)
+* })
+* const program = Console.consoleWith((console) =>
+*   Effect.sync(() => {
+*     console.log("Hello, world!")
+*     console.error("This is an error message")
+*   })
+* )
+*
+* Effect.runSync(Effect.provideService(program, Console.Console, testConsole))
+* messages // => ["Hello, world!", "This is an error message"]
+* ```
+*
+* @stability stable
+* @category constructors
+* @since 2.0.0
+*/
+const consoleWith = (f) => withFiber$1((fiber) => f(fiber.getRef(Console)));
+/**
+* Writes an error-level message to the console, typically displayed with error
+* styling by the active console implementation.
+*
+* **Example** (Writing error messages)
+*
+* ```ts import.meta.vitest
+* import { Console, Effect } from "effect"
+*
+* const messages: Array<ReadonlyArray<unknown>> = []
+* const testConsole: Console.Console = Object.assign(Object.create(console), {
+*   error: (...args: ReadonlyArray<unknown>) => messages.push(args)
+* })
+* const program = Effect.gen(function*() {
+*   yield* Console.error("Something went wrong!")
+*   yield* Console.error("Error details:", {
+*     code: 500,
+*     message: "Internal Server Error"
+*   })
+* })
+*
+* Effect.runSync(Effect.provideService(program, Console.Console, testConsole))
+* const expected = [
+*   ["Something went wrong!"],
+*   ["Error details:", { code: 500, message: "Internal Server Error" }]
+* ]
+* messages // => expected
+* ```
+*
+* @stability stable
+* @category accessors
+* @since 2.0.0
+*/
+const error = (...args) => consoleWith((console) => sync$1(() => {
+	console.error(...args);
+}));
+/**
+* Logs a general-purpose message to the console.
+*
+* **Example** (Writing log messages)
+*
+* ```ts import.meta.vitest
+* import { Console, Effect } from "effect"
+*
+* const messages: Array<ReadonlyArray<unknown>> = []
+* const testConsole: Console.Console = Object.assign(Object.create(console), {
+*   log: (...args: ReadonlyArray<unknown>) => messages.push(args)
+* })
+* const program = Effect.gen(function*() {
+*   yield* Console.log("Hello, world!")
+*   yield* Console.log("User data:", { name: "John", age: 30 })
+*   yield* Console.log("Processing", 42, "items")
+* })
+*
+* Effect.runSync(Effect.provideService(program, Console.Console, testConsole))
+* const expected = [
+*   ["Hello, world!"],
+*   ["User data:", { name: "John", age: 30 }],
+*   ["Processing", 42, "items"]
+* ]
+* messages // => expected
+* ```
+*
+* @stability stable
+* @category accessors
+* @since 2.0.0
+*/
+const log = (...args) => consoleWith((console) => sync$1(() => {
+	console.log(...args);
+}));
+//#endregion
 //#region ../../node_modules/.pnpm/effect@4.0.2/node_modules/effect/dist/cli/CliOutput.js
 /**
 * Formats CLI help and errors as text.
@@ -32440,7 +32482,7 @@ const runWith = (command, config) => {
 };
 //#endregion
 //#region package.json
-var version = "0.5.1";
+var version = "0.6.0";
 //#endregion
 //#region ../../node_modules/.pnpm/jsonc-parser@3.3.1/node_modules/jsonc-parser/lib/esm/impl/scanner.js
 /**
@@ -35097,51 +35139,45 @@ var import_semver = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exp
 })))(), 1);
 var BumpError = class extends TaggedError()("BumpError", {
 	path: String$5,
-	package: String$5,
+	at: String$5,
 	reason: String$5
 }) {
 	get message() {
-		return `${this.path}: cannot bump ${this.package}: ${this.reason}`;
+		return `${this.path}: cannot bump ${this.at}: ${this.reason}`;
 	}
 };
-const rangePath = (pkg) => pkg === "vite-plus" ? ["vp", "version"] : pkg === "node" ? ["vp", "node"] : [
-	"vp",
-	"globals",
-	pkg
-];
 const bumpedRange = (current, installed) => import_semver.valid(current) !== null ? installed : `^${installed}`;
-const bumpText = (text, pkg, installed) => {
-	const path = rangePath(pkg);
+const bumpText = (text, path, installed) => {
 	const node = findNodeAtLocation(parseTree(text) ?? {
 		type: "null",
 		offset: 0,
 		length: 0
-	}, path);
+	}, [...path]);
 	if (node === void 0 || node.type !== "string" || typeof node.value !== "string") return { reason: `${path.join(".")} is not a string literal; change it by hand` };
 	const range = bumpedRange(node.value, installed);
 	return {
-		text: applyEdits(text, modify(text, path, range, { formattingOptions: {
+		text: applyEdits(text, modify(text, [...path], range, { formattingOptions: {
 			insertSpaces: true,
 			tabSize: 2
 		} })),
 		range
 	};
 };
-const bumpConfig = fn("bumpConfig")(function* (configPath, pkg, installed) {
+const bumpConfig = fn("bumpConfig")(function* (configPath, path, installed) {
 	const fs = yield* FileSystem;
 	const text = yield* fs.readFileString(configPath);
-	const result = bumpText(text, pkg, installed);
+	const result = bumpText(text, path, installed);
 	if ("reason" in result) return yield* new BumpError({
 		path: configPath,
-		package: pkg,
+		at: path.join("."),
 		reason: result.reason
 	});
 	yield* fs.writeFileString(configPath, result.text);
 	return result.range;
 });
 const Targeting = {
-	platforms: optionalKey(NonEmptyArray(Literals$2(["darwin", "linux"]))),
-	machines: optionalKey(NonEmptyArray(NonEmptyString))
+	platforms: optionalKey(NonEmptyArray(Literals$2(["darwin", "linux"]))).annotateKey({ description: "`darwin`, `linux`, or both." }),
+	machines: optionalKey(NonEmptyArray(NonEmptyString)).annotateKey({ description: "Machine names from `machines`." })
 };
 const Origin = String$5.check(isPattern(/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/, {
 	title: "GitHub origin",
@@ -35149,26 +35185,76 @@ const Origin = String$5.check(isPattern(/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/, {
 }));
 const Ref = NonEmptyString;
 const isPin = (ref) => /^[0-9a-f]{40}$/.test(ref);
+const ProviderName = Literals$2([
+	"vp",
+	"brew",
+	"cask",
+	"repos"
+]);
 const Range = NonEmptyString.check(makeFilter((range) => range === "latest" || import_semver.validRange(range) !== null, {
 	title: "Range",
-	description: "a semver range, \"*\", or \"latest\""
+	description: "a semver range (leave inside it, install below it, ask above it), \"*\" (install when missing, never upgrade), or \"latest\" (upgrade to the newest on every Ship)"
 }));
 const TrackedRepo = Struct({
 	...Targeting,
-	origin: Origin,
-	ref: Ref,
-	install: NonEmptyString,
-	name: optionalKey(NonEmptyString),
-	outputs: optionalKey(ArraySchema(NonEmptyString)),
-	files: optionalKey(Record(NonEmptyString, String$5))
+	origin: Origin.annotateKey({ description: "The GitHub `owner/repo`." }),
+	ref: Ref.annotateKey({ description: "A branch, or a full 40-character commit SHA to pin it." }),
+	install: NonEmptyString.annotateKey({ description: "The Install Command, run in a login shell inside the Managed Clone." }),
+	name: optionalKey(NonEmptyString).annotateKey({ description: "Names the clone's directory and the repo in output. Default: `<owner>-<repo>`." }),
+	outputs: optionalKey(ArraySchema(NonEmptyString)).annotateKey({ description: "Paths outside the clone the Install Command produces. If one changes by hand, the repo reinstalls." }),
+	files: optionalKey(Record(NonEmptyString, String$5)).annotateKey({ description: "Gitignored files written into the clone before every install, keyed by path. Never secrets." })
 });
+const Global = Union([Range, Struct({
+	...Targeting,
+	range: Range
+})]);
+const PACKAGE_MANAGERS = [
+	"npm",
+	"pnpm",
+	"yarn",
+	"bun"
+];
+const NOT_GLOBALS = {
+	vp: "the vp Item is vp itself; set it with vp.version",
+	mode: "the mode Item is vp's managed mode",
+	node: "set Node with vp.node",
+	...Object.fromEntries(PACKAGE_MANAGERS.map((pm) => [pm, `set ${pm} with vp.${pm}`])),
+	"vite-plus": "set vp with vp.version",
+	fleetfizz: "a Ship installs the fleetfizz that ships"
+};
 const VpSection = Struct({
 	...Targeting,
-	version: optionalKey(Range),
-	node: optionalKey(Range),
-	globals: optionalKey(Record(NonEmptyString, Range))
+	dependsOn: optionalKey(ArraySchema(ProviderName)).annotateKey({ description: "Providers whose Items must succeed on a Machine before vp changes there." }),
+	version: optionalKey(Range).annotateKey({ description: "The vp version. Pin it exactly." }),
+	node: optionalKey(Range).annotateKey({ description: "The default Node version. Pin it exactly." }),
+	npm: optionalKey(Range).annotateKey({ description: "The default npm version." }),
+	pnpm: optionalKey(Range).annotateKey({ description: "The default pnpm version." }),
+	yarn: optionalKey(Range).annotateKey({ description: "The default Yarn version." }),
+	bun: optionalKey(Range).annotateKey({ description: "The default Bun version." }),
+	globals: optionalKey(Record(NonEmptyString, Global).check(makeFilter((globals) => {
+		const name = Object.keys(globals).find((n) => n in NOT_GLOBALS);
+		return name === void 0 || `"${name}" is not a Global: ${NOT_GLOBALS[name]}`;
+	}, {
+		title: "Globals",
+		description: "npm packages other than vp, node, a package manager, vite-plus, and fleetfizz"
+	}))).annotateKey({ description: "Global packages, each with a Range, or `{ range, platforms?, machines? }` to target one." })
 });
-const MachineSettings = Struct({ clones: optionalKey(NonEmptyString) });
+const HomebrewRange = Literals$2(["*", "latest"]).annotate({ description: "\"*\" (install when missing, never upgrade) or \"latest\" (brew update, then upgrade on every Ship)" });
+const HomebrewItems = Record(NonEmptyString, Union([HomebrewRange, Struct({
+	...Targeting,
+	range: HomebrewRange
+})]));
+const homebrewSection = (items, noun) => Struct({
+	...Targeting,
+	dependsOn: optionalKey(ArraySchema(ProviderName)).annotateKey({ description: "Providers whose Items must succeed on a Machine before this one changes there." }),
+	items: optionalKey(items).annotateKey({ description: `${noun}, each \`"*"\` or \`"latest"\`, or \`{ range, platforms?, machines? }\` to target one. A tapped name (\`owner/tap/name\`) taps on install.` })
+});
+const BrewSection = homebrewSection(HomebrewItems.check(makeFilter((items) => !Object.hasOwn(items, "brew") || "\"brew\" is Homebrew itself", {
+	title: "Formulae",
+	description: "Formulae other than brew"
+})), "Formulae");
+const CaskSection = homebrewSection(HomebrewItems, "Casks");
+const MachineSettings = Struct({ clones: optionalKey(NonEmptyString).annotateKey({ description: `Where this Machine keeps its Managed Clones. \`~\` expands on that Machine. Default: \`~/.local/share/fleetfizz/clones\`.` }) });
 const FleetConfig = Struct({
 	$schema: optionalKey(String$5),
 	shippedAt: optionalKey(String$5),
@@ -35177,9 +35263,11 @@ const FleetConfig = Struct({
 	machines: Record(NonEmptyString, MachineSettings).check(makeFilter((machines) => Object.keys(machines).length > 0, {
 		title: "Fleet",
 		description: "at least one Machine"
-	})),
-	repos: optionalKey(ArraySchema(TrackedRepo)),
-	vp: optionalKey(VpSection)
+	})).annotateKey({ description: "The Fleet, keyed by each Machine's tailnet name. A tailnet member that is not listed is not part of the Fleet." }),
+	repos: optionalKey(ArraySchema(TrackedRepo)).annotateKey({ description: "Each Tracked Repo is cloned on every targeted Machine and installed from its origin ref." }),
+	vp: optionalKey(VpSection).annotateKey({ description: "The vite-plus toolchain." }),
+	brew: optionalKey(BrewSection).annotateKey({ description: "Homebrew Formulae. Needs Homebrew on the Machine; a Ship never installs it." }),
+	cask: optionalKey(CaskSection).annotateKey({ description: "Homebrew Casks, macOS only. Needs Homebrew on the Machine." })
 });
 const repoName = (repo) => repo.name ?? repo.origin.replace("/", "-");
 const SELF_PACKAGE = "fleetfizz";
@@ -35274,7 +35362,7 @@ const stampText = (text, stamp) => {
 	const fleet = machinesOf(previous);
 	const shippedTo = {
 		...Object.fromEntries(Object.entries(shippedToOf(previous)).filter(([name]) => fleet.includes(name))),
-		...Object.fromEntries(stamp.reached.map((name) => [name, stamp.shippedAt]))
+		...Object.fromEntries([...stamp.reached, ...stamp.own === void 0 ? [] : [stamp.own]].map((name) => [name, stamp.shippedAt]))
 	};
 	let out = set(text, "shippedAt", stamp.shippedAt);
 	out = set(out, "shippedFrom", stamp.shippedFrom);
@@ -35292,6 +35380,7 @@ const shippedToOf = (config) => {
 	return Object.fromEntries(Object.entries(value).filter((entry) => typeof entry[1] === "string"));
 };
 const isNewer = (remote, local) => remote !== void 0 && (local === void 0 || remote > local);
+const staleCopies = (config, copies, own) => copies.filter((c) => c.machine !== own && isNewer(c.config.shippedTo?.[c.machine], config.shippedTo?.[c.machine]));
 //#endregion
 //#region ../../packages/remote/src/shell.ts
 const quote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
@@ -35307,8 +35396,10 @@ const vpEnv = [
 ].join("\n");
 const prelude = [
 	vpEnv,
+	`export PATH="$PATH:/opt/homebrew/bin:/home/linuxbrew/.linuxbrew/bin"`,
 	`ff_json() { printf '%s' "$1" | sed -e 's/\\\\/\\\\\\\\/g' -e 's/"/\\\\"/g' | tr -d '\\n'; }`,
-	`ff_state() { printf 'ff-state %s\\n' "$1"; }`
+	`ff_state() { printf 'ff-state %s\\n' "$1"; }`,
+	`ff_at() { ff_state "{\\"provider\\":\\"$(ff_json "$1")\\",\\"fact\\":\\"at\\",\\"item\\":\\"$(ff_json "$2")\\",\\"at\\":\\"$(ff_json "$3")\\"}"; }`
 ].join("\n");
 const fingerprintFn = [
 	"ff_fp() {",
@@ -35319,474 +35410,56 @@ const fingerprintFn = [
 	"}"
 ].join("\n");
 //#endregion
-//#region ../../packages/remote/src/gather.ts
+//#region ../../packages/remote/src/check.ts
 const STATE_DIR = "~/.local/state/fleetfizz";
 const RECORDS_DIR = `${STATE_DIR}/records`;
 const CONFIG_DIR_SH = "\"${XDG_CONFIG_HOME:-$HOME/.config}/fleetfizz\"";
-const gatherScript = (input) => {
+const recordDir = (provider) => `${quotePath(RECORDS_DIR)}/${quote(provider)}`;
+const recordFile = (provider, item) => `${recordDir(provider)}/${quote(`${item}.json`)}`;
+const LEGACY_RECORD_PROVIDER = "repos";
+const recordFact = (provider, item) => [
+	`ff_r=${recordFile(provider, item)}`,
+	...provider === LEGACY_RECORD_PROVIDER ? [`[ -f "$ff_r" ] || ff_r=${quotePath(RECORDS_DIR)}/${quote(`${item}.json`)}`] : [],
+	`if [ -f "$ff_r" ]; then ff_state "{\\"fact\\":\\"record\\",\\"provider\\":\\"${provider}\\",\\"item\\":\\"$(ff_json ${quote(item)})\\",\\"record\\":$(tr -d '\\n' < "$ff_r")}"; fi`
+];
+const checkScript = (input) => {
 	const lines = [
 		prelude,
 		fingerprintFn,
-		`ff_state "{\\"fact\\":\\"home\\",\\"path\\":\\"$(ff_json "$HOME")\\"}"`,
-		"if command -v vp >/dev/null 2>&1; then",
-		`  ff_v=$(command vp --version 2>/dev/null | sed -n 's/^vp v\\{0,1\\}\\([^ ]*\\).*/\\1/p' | head -n 1)`,
-		`  ff_state "{\\"fact\\":\\"vp\\",\\"version\\":\\"$(ff_json "$ff_v")\\",\\"path\\":\\"$(ff_json "$(command -v vp)")\\"}"`,
-		`  ff_n=$(command vp env default 2>/dev/null | sed -n 's/^Default Node.js version: //p' | head -n 1)`,
-		`  if [ -n "$ff_n" ]; then ff_state "{\\"fact\\":\\"node\\",\\"version\\":\\"$(ff_json "$ff_n")\\"}"; else ff_state '{"fact":"node","version":null}'; fi`,
-		`  ff_g=$(command vp list --global --json 2>/dev/null | tr -d '\\n')`,
-		`  ff_state "{\\"fact\\":\\"globals\\",\\"list\\":\${ff_g:-[]}}"`,
-		"else",
-		`  ff_state '{"fact":"vp","version":null}'`,
-		"fi",
-		`ff_root=${quotePath(input.cloneRoot)}`,
-		`if [ -d "$ff_root" ]; then ff_present=true; else ff_present=false; fi`,
-		`ff_state "{\\"fact\\":\\"cloneRoot\\",\\"path\\":\\"$(ff_json "$ff_root")\\",\\"present\\":$ff_present}"`
+		`ff_state "{\\"fact\\":\\"home\\",\\"path\\":\\"$(ff_json "$HOME")\\"}"`
 	];
-	for (const repo of input.repos) {
-		const name = quote(repo.name);
-		lines.push(`ff_d="$ff_root"/${name}`, `if [ -d "$ff_d/.git" ]; then`, `  ff_state "{\\"fact\\":\\"repo\\",\\"name\\":\\"$(ff_json ${name})\\",\\"present\\":true,\\"head\\":\\"$(ff_json "$(git -C "$ff_d" rev-parse HEAD 2>/dev/null)")\\",\\"origin\\":\\"$(ff_json "$(git -C "$ff_d" remote get-url origin 2>/dev/null)")\\"}"`, "else", `  ff_state "{\\"fact\\":\\"repo\\",\\"name\\":\\"$(ff_json ${name})\\",\\"present\\":false}"`, "fi");
-		for (const output of repo.outputs) lines.push(`ff_p=${quotePath(output)}; ff_f=$(ff_fp "$ff_p")`, `if [ -n "$ff_f" ]; then ff_state "{\\"fact\\":\\"output\\",\\"repo\\":\\"$(ff_json ${name})\\",\\"path\\":\\"$(ff_json ${quote(output)})\\",\\"fingerprint\\":\\"$(ff_json "$ff_f")\\"}"; else ff_state "{\\"fact\\":\\"output\\",\\"repo\\":\\"$(ff_json ${name})\\",\\"path\\":\\"$(ff_json ${quote(output)})\\",\\"fingerprint\\":null}"; fi`);
-	}
-	for (const repo of input.repos) {
-		const name = quote(repo.name);
-		lines.push(`ff_r=${quotePath(RECORDS_DIR)}/${quote(`${repo.name}.json`)}`, `if [ -f "$ff_r" ]; then ff_state "{\\"fact\\":\\"record\\",\\"name\\":\\"$(ff_json ${name})\\",\\"record\\":$(tr -d '\\n' < "$ff_r")}"; fi`);
+	for (const { provider, items } of input.providers) {
+		lines.push(provider.observe(items, input.scope));
+		if (provider.rule === "record") for (const item of items) lines.push(...recordFact(provider.name, item.name));
 	}
 	lines.push(`ff_c=${CONFIG_DIR_SH}/${quote(CONFIG_FILE)}`, `if [ -f "$ff_c" ]; then ff_state "{\\"fact\\":\\"config\\",\\"present\\":true,\\"base64\\":\\"$(base64 < "$ff_c" | tr -d '\\n')\\"}"; else ff_state '{"fact":"config","present":false}'; fi`);
 	lines.push(`ff_state '{"fact":"end"}'`);
 	return lines.join("\n");
 };
 //#endregion
-//#region ../../packages/core/src/range.ts
-const newest$1 = (available) => available.filter((v) => import_semver.prerelease(v) === null).sort(import_semver.rcompare)[0];
-const decideRange = (range, installed, available) => {
-	if (range === "latest") {
-		const version = newest$1(available);
-		if (version === void 0) return { kind: "unavailable" };
-		return installed === version ? { kind: "leave" } : {
-			kind: "install",
-			version
-		};
-	}
-	if (range === "*") {
-		if (installed !== void 0) return { kind: "leave" };
-		const version = newest$1(available);
-		return version === void 0 ? { kind: "unavailable" } : {
-			kind: "install",
-			version
-		};
-	}
-	if (installed !== void 0 && import_semver.satisfies(installed, range)) return { kind: "leave" };
-	if (installed !== void 0 && import_semver.gtr(installed, range)) return {
-		kind: "ask",
-		installed
-	};
-	const version = import_semver.maxSatisfying([...available], range);
-	return version === null ? { kind: "unavailable" } : {
-		kind: "install",
-		version
-	};
-};
-//#endregion
-//#region ../../packages/core/src/record.ts
-const sameRecord = (a, b) => Object.keys(a).length === Object.keys(b).length && Object.entries(a).every(([k, v]) => b[k] === v);
-const decideInstall = (record, now, rebuild) => {
-	if (rebuild) return {
-		run: true,
-		reason: "--rebuild"
-	};
-	if (record === void 0) return {
-		run: true,
-		reason: "never installed"
-	};
-	if (record.commit !== now.commit) return {
-		run: true,
-		reason: `new commit ${now.commit.slice(0, 7)}`
-	};
-	if (record.path !== now.path) return {
-		run: true,
-		reason: "clone moved"
-	};
-	if (record.install !== now.install) return {
-		run: true,
-		reason: "install command changed"
-	};
-	if (!sameRecord(record.files, now.files)) return {
-		run: true,
-		reason: "files changed"
-	};
-	for (const [path, fingerprint] of Object.entries(now.outputs)) if (fingerprint === void 0 || record.outputs[path] !== fingerprint) return {
-		run: true,
-		reason: `drift: ${path}`
-	};
-	return { run: false };
-};
-//#endregion
-//#region ../../packages/core/src/targeting.ts
-const targets = (targeting, machine) => (targeting.platforms?.includes(machine.platform) ?? true) && (targeting.machines?.includes(machine.name) ?? true);
-//#endregion
-//#region ../../packages/core/src/plan.ts
-const VP_PACKAGE = "vite-plus";
-const NODE_PACKAGE = "node";
-const expandHome = (path, home) => path === "~" ? home : path.startsWith("~/") ? `${home}${path.slice(1)}` : path;
-const isHomebrew = (path) => path !== void 0 && (path.includes("/homebrew/") || path.includes("/Cellar/"));
-const planVp = (input) => {
-	const out = {
-		steps: [],
-		questions: [],
-		skipped: [],
-		failures: []
-	};
-	const { state, machine } = input;
-	const vp = input.config.vp;
-	const targeted = vp !== void 0 && targets(vp, machine);
-	const missing = state.vp === void 0 || state.vp.version === null;
-	if (missing) out.steps.push({ kind: "bootstrap" });
-	const installed = missing ? void 0 : state.vp?.version ?? void 0;
-	const decide = (pkg, range, current, shown = pkg) => {
-		if (range === void 0) return void 0;
-		const decision = decideRange(range, current, input.versions[pkg] ?? []);
-		switch (decision.kind) {
-			case "leave": return;
-			case "install": return decision.version;
-			case "unavailable":
-				out.failures.push({
-					what: shown,
-					reason: `no published version satisfies ${range}`
-				});
-				return;
-			case "ask": {
-				const answer = input.answers[pkg];
-				if (answer === "downgrade") {
-					const target = decideRange(range, void 0, input.versions[pkg] ?? []);
-					if (target.kind === "install") return target.version;
-					out.failures.push({
-						what: shown,
-						reason: `no published version satisfies ${range}`
-					});
-					return;
-				}
-				if (answer === "skip") {
-					out.skipped.push({
-						what: shown,
-						reason: `${decision.installed} is above ${range}`
-					});
-					return;
-				}
-				out.questions.push({
-					machine: machine.name,
-					package: pkg,
-					installed: decision.installed,
-					range
-				});
-				return;
-			}
-		}
-	};
-	const nodeNow = missing ? void 0 : state.node ?? void 0;
-	let nodeTarget;
-	if (targeted) {
-		const vpTarget = decide(VP_PACKAGE, vp.version, installed, "vp");
-		if (vpTarget !== void 0) {
-			if (isHomebrew(state.vp?.path)) out.failures.push({
-				what: "vp",
-				reason: `vp ${installed} was installed with Homebrew; run brew upgrade vite-plus to get ${vpTarget}`
-			});
-			else out.steps.push({
-				kind: "vp",
-				from: installed ?? null,
-				version: vpTarget
-			});
-		}
-		nodeTarget = decide(NODE_PACKAGE, vp.node, nodeNow, "node");
-		if (nodeTarget !== void 0) out.steps.push({
-			kind: "node",
-			from: nodeNow ?? null,
-			version: nodeTarget
-		});
-	}
-	const nodeDefault = nodeTarget ?? nodeNow;
-	const byName = new Map((missing ? [] : state.globals).map((g) => [g.name, g]));
-	const installs = [];
-	const wanted = Object.entries(targeted ? vp.globals ?? {} : {});
-	for (const [name, range] of [...wanted, [SELF_PACKAGE, input.self]]) {
-		const current = byName.get(name);
-		const version = name === "fleetfizz" ? decideSelf(current?.version, input.self, out) : decide(name, range, current?.version);
-		if (version !== void 0) installs.push(current === void 0 ? {
-			name,
-			version
-		} : {
-			name,
-			from: current.version,
-			version
-		});
-		else if (current !== void 0 && nodeDefault !== void 0 && current.platform?.node !== void 0 && current.platform.node !== nodeDefault) out.steps.push({
-			kind: "reinstall",
-			name,
-			version: current.version
-		});
-	}
-	if (installs.length > 0) out.steps.push({
-		kind: "globals",
-		packages: installs
-	});
-	return out;
-};
-const decideSelf = (installed, self, out) => {
-	if (installed === void 0 || import_semver.lt(installed, self)) return self;
-	if (import_semver.gt(installed, self)) out.failures.push({
-		what: SELF_PACKAGE,
-		reason: `runs ${SELF_PACKAGE} ${installed}, newer than this ${self}; upgrade here first`
-	});
-};
-const planRepos = (input) => {
-	const repos = [];
-	const failures = [];
-	const { config, machine, state } = input;
-	const home = state.home ?? "~";
-	const root = config.machines?.[machine.name]?.clones ?? "~/.local/share/fleetfizz/clones";
-	for (const repo of config.repos ?? []) {
-		if (!targets(repo, machine)) continue;
-		const name = repoName(repo);
-		if (state.cloneRoot !== void 0 && !state.cloneRoot.present && !root.startsWith("~")) {
-			failures.push({
-				what: name,
-				reason: `clone root not mounted: ${state.cloneRoot.path}`
-			});
-			continue;
-		}
-		const current = state.repos[name];
-		const expectedOrigin = `https://github.com/${repo.origin}.git`;
-		if (current?.present && current.origin !== void 0 && current.origin !== expectedOrigin) {
-			failures.push({
-				what: name,
-				reason: `managed clone has origin ${current.origin}, expected ${expectedOrigin}`
-			});
-			continue;
-		}
-		const path = `${root}/${name}`;
-		const expanded = expandHome(path, home);
-		const files = repo.files ?? {};
-		const outputs = repo.outputs ?? [];
-		const rebuild = input.rebuild === "all" || input.rebuild !== "none" && input.rebuild.includes(name);
-		const decision = decideInstall(state.records[name], {
-			commit: current?.head ?? "",
-			path: expanded,
-			install: repo.install,
-			files,
-			outputs: Object.fromEntries(outputs.map((o) => [o, state.outputs[name]?.[o] ?? void 0]))
-		}, rebuild);
-		repos.push({
-			name,
-			origin: repo.origin,
-			ref: repo.ref,
-			pin: isPin(repo.ref),
-			path,
-			expanded,
-			...current?.head === void 0 ? {} : { head: current.head },
-			install: repo.install,
-			files,
-			outputs,
-			decision
-		});
-	}
-	return {
-		repos,
-		failures
-	};
-};
-const plan = (input) => {
-	const vp = planVp(input);
-	const repos = planRepos(input);
-	return {
-		machine: input.machine,
-		vp: vp.steps,
-		repos: repos.repos,
-		questions: vp.questions,
-		skipped: vp.skipped,
-		failures: [...vp.failures.map((f) => ({
-			...f,
-			section: "vp"
-		})), ...repos.failures.map((f) => ({
-			...f,
-			section: "repos"
-		}))]
-	};
-};
-//#endregion
-//#region ../../packages/core/src/state.ts
-const GlobalEntry = Struct({
-	name: String$5,
-	version: String$5,
-	platform: optionalKey(Struct({ node: optionalKey(String$5) }))
-});
-const InstallRecordSchema = Struct({
-	commit: String$5,
-	path: String$5,
-	install: String$5,
-	files: Record(String$5, String$5),
-	outputs: Record(String$5, String$5)
-});
-const Fact = Union([
-	Struct({
-		fact: Literal("home"),
-		path: String$5
-	}),
-	Struct({ fact: Literal("end") }),
-	Struct({
-		fact: Literal("vp"),
-		version: NullOr(String$5),
-		path: optionalKey(String$5)
-	}),
-	Struct({
-		fact: Literal("node"),
-		version: NullOr(String$5)
-	}),
-	Struct({
-		fact: Literal("globals"),
-		list: ArraySchema(GlobalEntry)
-	}),
-	Struct({
-		fact: Literal("cloneRoot"),
-		path: String$5,
-		present: Boolean$4
-	}),
-	Struct({
-		fact: Literal("repo"),
-		name: String$5,
-		present: Boolean$4,
-		head: optionalKey(String$5),
-		origin: optionalKey(String$5)
-	}),
-	Struct({
-		fact: Literal("record"),
-		name: String$5,
-		record: InstallRecordSchema
-	}),
-	Struct({
-		fact: Literal("config"),
-		present: Boolean$4,
-		base64: optionalKey(String$5)
-	}),
-	Struct({
-		fact: Literal("output"),
-		repo: String$5,
-		path: String$5,
-		fingerprint: NullOr(String$5)
-	})
-]);
-const emptyState = {
-	complete: false,
-	globals: [],
-	repos: {},
-	records: {},
-	outputs: {}
-};
-const decodeBase64 = (base64) => new TextDecoder().decode(Uint8Array.from(atob(base64), (c) => c.charCodeAt(0)));
-const assembleState = (facts) => {
-	let state = emptyState;
-	for (const fact of facts) switch (fact.fact) {
-		case "home":
-			state = {
-				...state,
-				home: fact.path
-			};
-			break;
-		case "end":
-			state = {
-				...state,
-				complete: true
-			};
-			break;
-		case "vp":
-			state = {
-				...state,
-				vp: fact.path === void 0 ? { version: fact.version } : {
-					version: fact.version,
-					path: fact.path
-				}
-			};
-			break;
-		case "node":
-			state = {
-				...state,
-				node: fact.version
-			};
-			break;
-		case "globals":
-			state = {
-				...state,
-				globals: fact.list
-			};
-			break;
-		case "cloneRoot":
-			state = {
-				...state,
-				cloneRoot: {
-					path: fact.path,
-					present: fact.present
-				}
-			};
-			break;
-		case "repo": {
-			const repo = {
-				present: fact.present,
-				...fact.head === void 0 ? {} : { head: fact.head },
-				...fact.origin === void 0 ? {} : { origin: fact.origin }
-			};
-			state = {
-				...state,
-				repos: {
-					...state.repos,
-					[fact.name]: repo
-				}
-			};
-			break;
-		}
-		case "record":
-			state = {
-				...state,
-				records: {
-					...state.records,
-					[fact.name]: fact.record
-				}
-			};
-			break;
-		case "config":
-			if (fact.present && fact.base64 !== void 0) state = {
-				...state,
-				config: decodeBase64(fact.base64)
-			};
-			break;
-		case "output": state = {
-			...state,
-			outputs: {
-				...state.outputs,
-				[fact.repo]: {
-					...state.outputs[fact.repo],
-					[fact.path]: fact.fingerprint
-				}
-			}
-		};
-	}
-	return state;
-};
-//#endregion
 //#region ../../packages/remote/src/protocol.ts
+const Fact = Record(String$5, Unknown);
 const StepStart = Struct({ id: String$5 });
 const StepDone = Struct({
 	id: String$5,
 	ok: Boolean$4,
 	code: optionalKey(Number$2)
 });
-const decodeFact = decodeUnknownResult(fromJsonString(Fact));
+const StepSkip = Struct({
+	id: String$5,
+	reason: String$5
+});
+const decodeFact$3 = decodeUnknownResult(fromJsonString(Fact));
 const decodeStart = decodeUnknownResult(fromJsonString(StepStart));
 const decodeDone = decodeUnknownResult(fromJsonString(StepDone));
+const decodeSkip = decodeUnknownResult(fromJsonString(StepSkip));
 const STATE = "ff-state ";
 const STEP = "ff-step ";
 const DONE = "ff-done ";
+const SKIP = "ff-skip ";
 const parseLine = (line) => {
 	if (line.startsWith(STATE)) {
-		const result = decodeFact(line.slice(9));
+		const result = decodeFact$3(line.slice(9));
 		if (result._tag === "Success") return {
 			kind: "state",
 			fact: result.success
@@ -35803,6 +35476,12 @@ const parseLine = (line) => {
 			kind: "done",
 			done: result.success
 		};
+	} else if (line.startsWith(SKIP)) {
+		const result = decodeSkip(line.slice(8));
+		if (result._tag === "Success") return {
+			kind: "skip",
+			skip: result.success
+		};
 	}
 	return {
 		kind: "text",
@@ -35811,96 +35490,47 @@ const parseLine = (line) => {
 };
 const stepLine = (id) => `printf 'ff-step {"id":"%s"}\\n' '${id}'`;
 const doneLine = (id, ok, code) => code === void 0 ? `printf 'ff-done {"id":"%s","ok":${ok}}\\n' '${id}'` : `printf 'ff-done {"id":"%s","ok":${ok},"code":%s}\\n' '${id}' "${code}"`;
+const skipLine = (id, reason) => `printf 'ff-skip {"id":"%s","reason":"%s"}\\n' '${id}' ${reason}`;
 //#endregion
 //#region ../../packages/remote/src/apply.ts
-const jsonString = encodeSync(fromJsonString(String$5));
-const jsonRecord = encodeSync(fromJsonString(Record(String$5, String$5)));
-const stepId = (repo, step) => `repo:${repo}:${step}`;
-const vpStepId = (step) => step.kind === "reinstall" ? `vp:reinstall:${step.name}` : step.kind === "globals" ? "vp:globals" : `vp:${step.kind}`;
 const CONFIG_STEP = "config";
-const VP_INSTALL = [
-	"curl -fsSL https://vite.plus | bash",
-	...vpEnv.split("\n"),
-	"{ hash -r 2>/dev/null || true; }"
-].join(" && ");
-const vpStep = (step) => {
-	const id = vpStepId(step);
-	const command = (() => {
-		switch (step.kind) {
-			case "bootstrap": return VP_INSTALL;
-			case "vp": return `command vp upgrade ${quote(step.version)}`;
-			case "node": return `command vp env default ${quote(step.version)}`;
-			case "reinstall": return `command vp install -g ${quote(`${step.name}@${step.version}`)}`;
-			case "globals": return `command vp install -g ${step.packages.map((p) => quote(`${p.name}@${p.version}`)).join(" ")}`;
-		}
-	})();
-	return [
-		stepLine(id),
-		step.kind === "bootstrap" ? command : `( ${command} )`,
-		`ff_code=$?`,
-		`if [ "$ff_code" -ne 0 ]; then ${doneLine(id, false, "$ff_code")}; else ${doneLine(id, true)}; fi`
-	];
-};
+const marked = (id, run, failed = []) => [
+	stepLine(id),
+	...run,
+	`ff_code=$?`,
+	`if [ "$ff_code" -ne 0 ]; then`,
+	doneLine(id, false, "$ff_code"),
+	...failed,
+	"else",
+	doneLine(id, true),
+	"fi"
+];
 const configStep = () => {
 	const dir = CONFIG_DIR_SH;
 	const write = (variable, file) => `printf '%s' "$${variable}" | base64 -d > ${dir}/${quote(`${file}.tmp`)} && mv -f ${dir}/${quote(`${file}.tmp`)} ${dir}/${quote(file)}`;
-	return [
-		stepLine(CONFIG_STEP),
-		`( mkdir -p ${dir} && ${write("ff_config", CONFIG_FILE)} && ${write("ff_schema", SCHEMA_FILE)} )`,
-		`ff_code=$?`,
-		`if [ "$ff_code" -ne 0 ]; then ${doneLine(CONFIG_STEP, false, "$ff_code")}; else ${doneLine(CONFIG_STEP, true)}; fi`
-	];
-};
-const writeRecord = (repo) => {
-	return [
-		`ff_outs=""`,
-		...repo.outputs.map((o) => `ff_fpv=$(ff_fp ${quotePath(o)}); if [ -n "$ff_fpv" ]; then ff_outs="$ff_outs,\\"$(ff_json ${quote(o)})\\":\\"$(ff_json "$ff_fpv")\\""; fi`),
-		`mkdir -p ${quotePath(RECORDS_DIR)}`,
-		`printf '%s\\n' "{\\"commit\\":\\"$ff_after\\",\\"path\\":\\"$(ff_json "$ff_d")\\",\\"install\\":$(ff_lit ${quote(jsonString(repo.install))}),\\"files\\":$(ff_lit ${quote(jsonRecord(repo.files))}),\\"outputs\\":{\${ff_outs#,}}}" > ${quotePath(RECORDS_DIR)}/${quote(`${repo.name}.json.tmp`)}`,
-		`mv -f ${quotePath(RECORDS_DIR)}/${quote(`${repo.name}.json.tmp`)} ${quotePath(RECORDS_DIR)}/${quote(`${repo.name}.json`)}`
+	return marked(CONFIG_STEP, [`( mkdir -p ${dir} && ${write("ff_config", CONFIG_FILE)} && ${write("ff_schema", SCHEMA_FILE)} )`]);
+};
+const providerSteps = (plan) => {
+	if (plan.decisions.length === 0 && plan.steps.length === 0) return [];
+	const held = `ff_held_${plan.name}`;
+	const items = [...new Set(plan.steps.flatMap((step) => step.items))];
+	const flag = (item) => `ff_f_${plan.name}_${items.indexOf(item)}`;
+	const step = (s) => [
+		`if [ -n "${s.items.map((item) => `\${${flag(item)}:-}`).join("")}" ]; then`,
+		skipLine(s.id, "'an earlier step failed'"),
+		"else",
+		...marked(s.id, s.run, [...s.items.map((item) => `${flag(item)}=1`), `${held}=1`]),
+		"fi"
 	];
-};
-const writeFiles = (repo) => Object.entries(repo.files).flatMap(([path, content]) => [`mkdir -p "$(dirname "$ff_d"/${quote(path)})"`, `printf '%s' ${quote(content)} > "$ff_d"/${quote(path)}`]);
-const repoSteps = (repo, input) => {
-	const fetch = stepId(repo.name, "fetch");
-	const install = stepId(repo.name, "install");
-	const url = `https://github.com/${repo.origin}.git`;
-	const sync = repo.pin ? [
-		`if [ "$(git -C "$ff_d" rev-parse HEAD)" != ${quote(repo.ref)} ]; then ff_git -C "$ff_d" fetch --quiet origin ${quote(repo.ref)}; fi`,
-		`git -C "$ff_d" checkout --quiet --detach ${quote(repo.ref)}`,
-		`git -C "$ff_d" reset --quiet --hard ${quote(repo.ref)}`
-	] : [`ff_git -C "$ff_d" fetch --quiet origin ${quote(repo.ref)}`, `git -C "$ff_d" reset --quiet --hard ${quote(`origin/${repo.ref}`)}`];
-	const envPrefix = `FLEETFIZZ_MACHINE=${quote(input.env.machine)} FLEETFIZZ_PLATFORM=${quote(input.env.platform)} FLEETFIZZ_MACHINES=${quote(input.env.machines.join(","))}`;
+	const why = [`ff_why=""`, ...plan.dependsOn.map((dep) => `if [ -z "$ff_why" ] && [ -n "\${ff_held_${dep}:-}" ]; then ff_why=${quote(dep)}; fi`)];
+	if (plan.steps.length === 0) return [...why, `if [ -n "$ff_why" ]; then ${held}=1; fi`];
 	return [
-		`ff_d="$ff_root"/${quote(repo.name)}`,
-		`ff_before=$(git -C "$ff_d" rev-parse HEAD 2>/dev/null || true)`,
-		stepLine(fetch),
-		"(",
-		"  set -e",
-		`  if [ ! -d "$ff_d/.git" ]; then ff_git clone --quiet ${quote(url)} "$ff_d"; fi`,
-		`  if [ "$(git -C "$ff_d" remote get-url origin)" != ${quote(url)} ]; then echo "origin is $(git -C "$ff_d" remote get-url origin), expected ${url}"; exit 1; fi`,
-		...sync.map((l) => `  ${l}`),
-		`  git -C "$ff_d" clean --quiet -fd`,
-		...writeFiles(repo).map((l) => `  ${l}`),
-		")",
-		`ff_code=$?`,
-		`if [ "$ff_code" -ne 0 ]; then ${doneLine(fetch, false, "$ff_code")}; else`,
-		`${doneLine(fetch, true)}`,
-		`ff_after=$(git -C "$ff_d" rev-parse HEAD)`,
-		`ff_state "{\\"fact\\":\\"repo\\",\\"name\\":\\"$(ff_json ${quote(repo.name)})\\",\\"present\\":true,\\"head\\":\\"$(ff_json "$ff_after")\\"}"`,
-		`if [ ${repo.decision.run ? "true" : "false"} = true ] || [ "$ff_after" != "$ff_before" ]; then`,
-		`  ${stepLine(install)}`,
-		`  (cd "$ff_d" && ${envPrefix} "\${SHELL:-/bin/sh}" -lc ${quote(repo.install)})`,
-		`  ff_code=$?`,
-		`  if [ "$ff_code" -ne 0 ]; then ${doneLine(install, false, "$ff_code")}; else`,
-		"    (",
-		"      set -e",
-		...writeRecord(repo).map((l) => `      ${l}`),
-		"    )",
-		`    ff_code=$?`,
-		`    if [ "$ff_code" -ne 0 ]; then echo "could not write the install record"; ${doneLine(install, false, "$ff_code")}; else ${doneLine(install, true)}; fi`,
-		"  fi",
-		"fi",
+		...why,
+		`if [ -n "$ff_why" ]; then`,
+		`${held}=1`,
+		...plan.steps.map((s) => skipLine(s.id, `"depends on $ff_why"`)),
+		"else",
+		...plan.steps.flatMap(step),
 		"fi"
 	];
 };
@@ -35915,24 +35545,18 @@ const encodeBase64 = (text) => {
 	for (const byte of bytes) binary += String.fromCharCode(byte);
 	return btoa(binary);
 };
-const applyScript = (input) => {
-	const lines = [
-		prelude,
-		fingerprintFn,
-		`ff_lit() { printf '%s' "$1"; }`,
-		`IFS= read -r ff_token || ff_token=""`,
-		`IFS= read -r ff_config || ff_config=""`,
-		`IFS= read -r ff_schema || ff_schema=""`,
-		`ff_git() { if [ -n "$ff_token" ]; then FF_TOKEN="$ff_token" git -c credential.helper= -c 'credential.helper=!f() { echo username=x-access-token; echo "password=$FF_TOKEN"; }; f' "$@"; else git "$@"; fi; }`,
-		`ff_root=${quotePath(input.cloneRoot)}`,
-		...input.cloneRoot.startsWith("~") ? [`mkdir -p "$ff_root"`] : []
-	];
-	lines.push(...configStep());
-	for (const step of input.plan.vp) lines.push(...vpStep(step));
-	for (const repo of input.plan.repos) lines.push(...repoSteps(repo, input));
-	lines.push(doneLine("end", true));
-	return lines.join("\n");
-};
+const applyScript = (plan) => [
+	prelude,
+	fingerprintFn,
+	`ff_lit() { printf '%s' "$1"; }`,
+	`IFS= read -r ff_token || ff_token=""`,
+	`IFS= read -r ff_config || ff_config=""`,
+	`IFS= read -r ff_schema || ff_schema=""`,
+	`ff_git() { if [ -n "$ff_token" ]; then FF_TOKEN="$ff_token" git -c credential.helper= -c 'credential.helper=!f() { echo username=x-access-token; echo "password=$FF_TOKEN"; }; f' "$@"; else git "$@"; fi; }`,
+	...configStep(),
+	...plan.providers.flatMap(providerSteps),
+	doneLine("end", true)
+].join("\n");
 //#endregion
 //#region ../../packages/remote/src/tailnet.ts
 const StatusNode = Struct({
@@ -37489,8 +37113,8 @@ const exitAlternativeScreen = "\x1B[?1049l";
 //#endregion
 //#region ../../node_modules/.pnpm/is-in-ci@2.0.0/node_modules/is-in-ci/index.js
 var import_react = /* @__PURE__ */ __toESM(require_react(), 1);
-const check = (key) => key in env && env[key] !== "0" && env[key] !== "false";
-const isInCi = check("CI") || check("CONTINUOUS_INTEGRATION");
+const check$1 = (key) => key in env && env[key] !== "0" && env[key] !== "false";
+const isInCi = check$1("CI") || check$1("CONTINUOUS_INTEGRATION");
 //#endregion
 //#region ../../node_modules/.pnpm/auto-bind@5.0.1/node_modules/auto-bind/index.js
 const getAllProperties = (object) => {
@@ -64200,6 +63824,333 @@ const useWindowSize = () => {
 	return size;
 };
 //#endregion
+//#region ../../packages/core/src/targeting.ts
+const targets = (targeting, machine) => (targeting.platforms?.includes(machine.platform) ?? true) && (targeting.machines?.includes(machine.name) ?? true);
+//#endregion
+//#region ../../packages/core/src/engine.ts
+const isObjectSection = (section) => !Array.isArray(section);
+const sectionTargeting = (section) => isObjectSection(section) ? section : {};
+const dependenciesOf = (provider, config) => {
+	const section = config[provider.name];
+	const extra = section !== void 0 && isObjectSection(section) ? section.dependsOn ?? [] : [];
+	return [.../* @__PURE__ */ new Set([...provider.dependsOn, ...extra])];
+};
+const targetedItems = (provider, config, machine) => {
+	const section = config[provider.name];
+	const scoped = section !== void 0 && targets(sectionTargeting(section), machine) ? section : void 0;
+	return provider.items(scoped).filter((item) => targets(item, machine));
+};
+const machinesNamed = (provider, config) => {
+	const section = config[provider.name];
+	return [...section === void 0 ? [] : sectionTargeting(section).machines ?? [], ...provider.items(section).flatMap((item) => item.machines ?? [])];
+};
+const hold = (decisions, by) => decisions.map((d) => d.kind === "change" || d.kind === "ask" ? {
+	kind: "skip",
+	item: d.item,
+	...d.kind === "change" && d.from !== void 0 ? { at: d.from } : {},
+	...d.kind === "ask" && d.at !== void 0 ? { at: d.at } : {},
+	reason: `depends on ${by}`
+} : d);
+const planMachine = (input) => {
+	const ctx = {
+		...input.ctx,
+		home: input.state.home ?? "~"
+	};
+	const plans = /* @__PURE__ */ new Map();
+	const held = /* @__PURE__ */ new Set();
+	for (const provider of input.providers) {
+		const dependsOn = dependenciesOf(provider, ctx.config);
+		const items = targetedItems(provider, ctx.config, ctx.machine);
+		const decisions = provider.decide({
+			items,
+			observed: provider.parse(input.state.facts[provider.name] ?? [], input.state.records[provider.name] ?? {}),
+			resolved: input.resolved[provider.name],
+			ctx
+		});
+		const by = dependsOn.find((name) => {
+			const dep = plans.get(name);
+			return dep !== void 0 && dep.decisions.length > 0 && (held.has(name) || dep.decisions.some((d) => d.kind === "fail"));
+		});
+		if (by !== void 0) held.add(provider.name);
+		plans.set(provider.name, {
+			name: provider.name,
+			rule: provider.rule,
+			dependsOn,
+			decisions: by === void 0 ? decisions : hold(decisions, by),
+			steps: by === void 0 ? provider.act(decisions, ctx) : []
+		});
+	}
+	return {
+		machine: ctx.machine,
+		providers: [...plans.values()]
+	};
+};
+//#endregion
+//#region ../../packages/core/src/range.ts
+const newest = (available) => available.filter((v) => import_semver.prerelease(v) === null).sort(import_semver.rcompare)[0];
+const decideRange = (range, installed, available) => {
+	if (range === "latest") {
+		const version = newest(available);
+		if (version === void 0) return { kind: "unavailable" };
+		return installed === version ? { kind: "leave" } : {
+			kind: "install",
+			version
+		};
+	}
+	if (range === "*") {
+		if (installed !== void 0) return { kind: "leave" };
+		const version = newest(available);
+		return version === void 0 ? { kind: "unavailable" } : {
+			kind: "install",
+			version
+		};
+	}
+	if (installed !== void 0 && import_semver.satisfies(installed, range)) return { kind: "leave" };
+	if (installed !== void 0 && import_semver.gtr(installed, range)) return {
+		kind: "ask",
+		installed
+	};
+	const version = import_semver.maxSatisfying([...available], range);
+	return version === null ? { kind: "unavailable" } : {
+		kind: "install",
+		version
+	};
+};
+//#endregion
+//#region ../../packages/core/src/provider.ts
+const address = (provider, item) => `${provider}:${item}`;
+const parseAddress = (text) => {
+	const at = text.indexOf(":");
+	return at <= 0 || at === text.length - 1 ? void 0 : {
+		provider: text.slice(0, at),
+		item: text.slice(at + 1)
+	};
+};
+const QUESTION_CHOICES = {
+	range: [
+		"bump",
+		"skip",
+		"downgrade"
+	],
+	config: ["overwrite", "stop"],
+	mode: ["managed", "skip"]
+};
+const isQuestionKind = (kind) => kind in QUESTION_CHOICES;
+const rangeQuestion = (subject, installed, range, bumpPath) => ({
+	kind: "range",
+	subject,
+	found: installed,
+	problem: `is above ${range}`,
+	choices: [
+		{
+			value: "bump",
+			title: "bump the config"
+		},
+		{
+			value: "skip",
+			title: "skip on these Machines (leave as is, shown as skipped)"
+		},
+		{
+			value: "downgrade",
+			title: "downgrade into the range"
+		}
+	],
+	default: "skip",
+	bump: {
+		path: bumpPath,
+		range
+	}
+});
+const decideRangeItem = (input) => {
+	const { item, range, installed, available } = input;
+	const at = installed === void 0 ? {} : { at: installed };
+	const unavailable = {
+		kind: "fail",
+		item,
+		...at,
+		reason: `no published version satisfies ${range}`
+	};
+	const install = (version) => ({
+		kind: "change",
+		item,
+		...installed === void 0 ? {} : { from: installed },
+		to: version,
+		change: version
+	});
+	const decision = decideRange(range, installed, available);
+	switch (decision.kind) {
+		case "leave": return {
+			kind: "leave",
+			item,
+			...at
+		};
+		case "install": return install(decision.version);
+		case "unavailable": return unavailable;
+		case "ask": {
+			const subject = address(input.provider, item);
+			const answer = input.ctx.answer("range", subject);
+			if (answer === "skip") return {
+				kind: "skip",
+				item,
+				...at,
+				reason: `is above ${range}`
+			};
+			if (answer === "downgrade") {
+				const target = decideRange(range, void 0, available);
+				return target.kind === "install" ? install(target.version) : unavailable;
+			}
+			return {
+				kind: "ask",
+				item,
+				...at,
+				question: rangeQuestion(subject, decision.installed, range, input.bumpPath)
+			};
+		}
+	}
+};
+const orderProviders = (all, dependsOn) => {
+	const byName = new Map(all.map((p) => [p.name, p]));
+	const order = [];
+	const done = /* @__PURE__ */ new Set();
+	const visit = (p, path) => {
+		if (done.has(p.name)) return void 0;
+		if (path.includes(p.name)) return [...path.slice(path.indexOf(p.name)), p.name];
+		for (const name of dependsOn(p)) {
+			const dep = byName.get(name);
+			const cycle = dep === void 0 ? void 0 : visit(dep, [...path, p.name]);
+			if (cycle !== void 0) return cycle;
+		}
+		done.add(p.name);
+		order.push(p);
+	};
+	for (const p of all) {
+		const cycle = visit(p, []);
+		if (cycle !== void 0) return { cycle };
+	}
+	return { order };
+};
+//#endregion
+//#region ../../packages/core/src/record.ts
+const sameRecord = (a, b) => Object.keys(a).length === Object.keys(b).length && Object.entries(a).every(([k, v]) => b[k] === v);
+const decideInstall = (record, now, rebuild) => {
+	if (rebuild) return {
+		run: true,
+		reason: "--rebuild"
+	};
+	if (record === void 0) return {
+		run: true,
+		reason: "never installed"
+	};
+	if (record.commit !== now.commit) return {
+		run: true,
+		reason: `new commit ${now.commit.slice(0, 7)}`
+	};
+	if (record.path !== now.path) return {
+		run: true,
+		reason: "clone moved"
+	};
+	if (record.install !== now.install) return {
+		run: true,
+		reason: "install command changed"
+	};
+	if (!sameRecord(record.files, now.files)) return {
+		run: true,
+		reason: "files changed"
+	};
+	for (const [path, fingerprint] of Object.entries(now.outputs)) if (fingerprint === void 0 || record.outputs[path] !== fingerprint) return {
+		run: true,
+		reason: `drift: ${path}`
+	};
+	return { run: false };
+};
+//#endregion
+//#region ../../packages/core/src/state.ts
+const EngineFact = Union([
+	Struct({
+		fact: Literal("home"),
+		path: String$5
+	}),
+	Struct({ fact: Literal("end") }),
+	Struct({
+		fact: Literal("config"),
+		present: Boolean$4,
+		base64: optionalKey(String$5)
+	}),
+	Struct({
+		fact: Literal("record"),
+		provider: String$5,
+		item: String$5,
+		record: Unknown
+	})
+]);
+const ProviderFact = Struct({ provider: String$5 });
+const AtFact = Struct({
+	provider: String$5,
+	fact: Literal("at"),
+	item: String$5,
+	at: String$5
+});
+const decodeEngineFact = decodeUnknownOption(EngineFact);
+const decodeProviderFact = decodeUnknownOption(ProviderFact);
+const emptyState = {
+	complete: false,
+	records: {},
+	facts: {}
+};
+const decodeBase64 = (base64) => new TextDecoder().decode(Uint8Array.from(atob(base64), (c) => c.charCodeAt(0)));
+const assembleState = (facts) => {
+	let state = emptyState;
+	for (const raw of facts) {
+		const fact = decodeEngineFact(raw);
+		if (fact._tag === "Some") {
+			const f = fact.value;
+			switch (f.fact) {
+				case "home":
+					state = {
+						...state,
+						home: f.path
+					};
+					break;
+				case "end":
+					state = {
+						...state,
+						complete: true
+					};
+					break;
+				case "config":
+					if (f.present && f.base64 !== void 0) state = {
+						...state,
+						config: decodeBase64(f.base64)
+					};
+					break;
+				case "record": state = {
+					...state,
+					records: {
+						...state.records,
+						[f.provider]: {
+							...state.records[f.provider],
+							[f.item]: f.record
+						}
+					}
+				};
+			}
+			continue;
+		}
+		const owned = decodeProviderFact(raw);
+		if (owned._tag === "Some") {
+			const { provider } = owned.value;
+			state = {
+				...state,
+				facts: {
+					...state.facts,
+					[provider]: [...state.facts[provider] ?? [], raw]
+				}
+			};
+		}
+	}
+	return state;
+};
+//#endregion
 //#region src/ledger.ts
 const Note = Struct({
 	kind: Literals$2([
@@ -64212,8 +64163,8 @@ const Note = Struct({
 const Item = Struct({
 	name: String$5,
 	kind: Literals$2([
-		"version",
-		"repo",
+		"range",
+		"record",
 		"config"
 	]),
 	from: optionalKey(String$5),
@@ -64230,7 +64181,10 @@ const Item = Struct({
 	doing: optionalKey(String$5),
 	detail: optionalKey(String$5),
 	output: optionalKey(ArraySchema(String$5)),
-	steps: ArraySchema(String$5),
+	steps: ArraySchema(Struct({
+		id: String$5,
+		doing: String$5
+	})),
 	started: optionalKey(Number$2),
 	ended: optionalKey(Number$2)
 });
@@ -64259,99 +64213,58 @@ const LedgerState = Struct({
 	started: Number$2,
 	ended: optionalKey(Number$2)
 });
-const short = (sha) => sha === void 0 ? void 0 : sha.slice(0, 7);
-const FETCH = ":fetch";
-const doingOf = (id) => id === "config" ? "copying" : id.endsWith(FETCH) ? "fetching" : "installing";
-const itemsOf = (p, state) => {
-	const items = /* @__PURE__ */ new Map();
-	const key = (kind, name) => `${kind}:${name}`;
-	const base = (name, from, kind = "version") => ({
-		name,
-		kind,
-		...from === void 0 ? {} : { from },
-		changes: false,
-		status: "idle",
-		steps: []
-	});
-	const set = (name, change, kind = "version") => items.set(key(kind, name), change(items.get(key(kind, name)) ?? base(name, void 0, kind)));
-	const plans = (id, to, from, reason) => ({ from: checked, ...item }) => {
-		const now = from === void 0 ? checked : from ?? void 0;
-		return {
-			...item,
-			...now === void 0 ? {} : { from: now },
-			to,
-			...reason === void 0 ? {} : { reason },
+const itemsOf = (p) => [...p.providers.flatMap((pp) => pp.decisions.map((d) => {
+	const base = {
+		name: address(pp.name, d.item),
+		kind: pp.rule,
+		steps: pp.steps.filter((step) => step.items.includes(d.item)).map(({ id, doing }) => ({
+			id,
+			doing
+		}))
+	};
+	switch (d.kind) {
+		case "change": return {
+			...base,
+			...d.from === void 0 ? {} : { from: d.from },
+			to: d.to,
+			...d.reason === void 0 ? {} : { reason: d.reason },
 			changes: true,
-			steps: [...item.steps, id]
+			status: "idle"
+		};
+		case "leave": return {
+			...base,
+			...d.at === void 0 ? {} : { from: d.at },
+			changes: false,
+			status: "idle"
+		};
+		case "skip":
+		case "fail": return {
+			...base,
+			...d.at === void 0 ? {} : { from: d.at },
+			changes: d.kind === "fail",
+			status: d.kind === "fail" ? "failed" : "skipped",
+			detail: d.reason
+		};
+		case "ask": return {
+			...base,
+			...d.at === void 0 ? {} : { from: d.at },
+			changes: false,
+			status: "skipped",
+			detail: d.question.problem
 		};
-	};
-	const vp = state.vp?.version ?? void 0;
-	items.set(key("version", "vp"), base("vp", vp));
-	if (state.node != null) items.set(key("version", "node"), base("node", state.node));
-	for (const g of state.globals) items.set(key("version", g.name), base(g.name, g.version));
-	for (const step of p.vp) {
-		const id = vpStepId(step);
-		switch (step.kind) {
-			case "bootstrap":
-				set("vp", plans(id, "latest", null));
-				break;
-			case "vp":
-			case "node":
-				set(step.kind, plans(id, step.version, step.from));
-				break;
-			case "reinstall":
-				set(step.name, plans(id, step.version, step.version, "reinstall"));
-				break;
-			case "globals": for (const pkg of step.packages) set(pkg.name, plans(id, pkg.version, pkg.from ?? null));
-		}
-	}
-	for (const repo of p.repos) {
-		const from = short(state.records[repo.name]?.commit);
-		const to = short(repo.head);
-		items.set(key("repo", repo.name), {
-			name: repo.name,
-			kind: "repo",
-			...from === void 0 ? {} : { from },
-			...to === void 0 ? {} : { to },
-			...repo.decision.run ? { reason: repo.decision.reason } : {},
-			changes: repo.decision.run,
-			status: "idle",
-			steps: [stepId(repo.name, "fetch"), stepId(repo.name, "install")]
-		});
 	}
-	for (const s of p.skipped) set(s.what, (i) => ({
-		...i,
-		status: "skipped",
-		detail: s.reason
-	}));
-	for (const f of p.failures) {
-		const kind = f.section === "repos" ? "repo" : "version";
-		set(f.what, (i) => ({
-			...i,
-			changes: true,
-			status: "failed",
-			detail: f.reason
-		}), kind);
-	}
-	items.set(key("config", CONFIG_STEP), {
-		name: CONFIG_STEP,
-		kind: "config",
-		changes: false,
-		status: "idle",
-		steps: [CONFIG_STEP]
-	});
-	return [...items.values()];
-};
+})), {
+	name: CONFIG_STEP,
+	kind: "config",
+	changes: false,
+	status: "idle",
+	steps: [{
+		id: CONFIG_STEP,
+		doing: "copying"
+	}]
+}];
 const outcomeOf = (m, dryRun) => m.status === "skipped" ? "skipped" : m.status === "failed" || m.items.some((i) => i.status === "failed") ? "failed" : m.status === "ok" || m.status === "planned" && dryRun ? "ok" : void 0;
-const tally = (state) => {
-	const outcomes = state.machines.map((m) => outcomeOf(m, state.dryRun));
-	const n = (o) => outcomes.filter((x) => x === o).length;
-	return {
-		ok: n("ok"),
-		skipped: n("skipped"),
-		failed: n("failed")
-	};
-};
+const anyFailed = (state) => state.machines.some((m) => outcomeOf(m, state.dryRun) === "failed");
 const makeLedger = fn("makeLedger")(function* (input) {
 	const started = yield* currentTimeMillis;
 	let snapshot = {
@@ -64383,7 +64296,7 @@ const makeLedger = fn("makeLedger")(function* (input) {
 	}));
 	const items = (name, id, change) => machine(name, (m, now) => ({
 		...m,
-		items: m.items.map((i) => i.steps.includes(id) ? change(i, now) : i)
+		items: m.items.map((i) => i.steps.some((step) => step.id === id) ? change(i, now) : i)
 	}));
 	const store = {
 		get: () => snapshot,
@@ -64424,25 +64337,24 @@ const makeLedger = fn("makeLedger")(function* (input) {
 				...output.length === 0 ? {} : { output },
 				ended: now
 			})),
-			plan: (name, p, state) => machine(name, (m) => ({
+			plan: (name, p) => machine(name, (m) => ({
 				...m,
 				status: "planned",
-				items: itemsOf(p, state)
+				items: itemsOf(p)
 			})),
 			start: (name) => machine(name, (m, now) => ({
 				...m,
 				status: "running",
 				started: now
 			})),
-			stepStarted: (name, id) => items(name, id, (item, now) => item.status === "failed" ? item : {
+			stepStarted: (name, id) => items(name, id, (item, now) => item.status === "failed" || item.status === "skipped" ? item : {
 				...item,
-				changes: item.changes || !(id === "config" || id.endsWith(FETCH)),
 				status: "running",
-				doing: doingOf(id),
+				doing: item.steps.find((step) => step.id === id)?.doing ?? "running",
 				started: item.started ?? now
 			}),
 			stepDone: (name, id, result) => items(name, id, (item, now) => {
-				if (item.status === "failed") return item;
+				if (item.status === "failed" || item.status === "skipped") return item;
 				if (!result.ok) return {
 					...item,
 					changes: true,
@@ -64451,25 +64363,31 @@ const makeLedger = fn("makeLedger")(function* (input) {
 					...result.output.length === 0 ? {} : { output: result.output },
 					ended: now
 				};
+				if (item.steps.at(-1)?.id !== id) return item;
 				const { doing: _, ...rest } = item;
-				if (id.endsWith(FETCH)) return item.changes ? item : {
+				return {
 					...rest,
-					status: "idle",
+					status: "ok",
 					ended: now
 				};
+			}),
+			stepSkipped: (name, id, reason) => items(name, id, (item, now) => {
+				if (item.status === "failed") return item;
+				const { doing: _, ...rest } = item;
 				return {
 					...rest,
-					status: "ok",
+					status: "skipped",
+					detail: reason,
 					ended: now
 				};
 			}),
-			fetched: (name, repo, head) => machine(name, (m) => ({
+			reached: (name, item, at) => machine(name, (m) => ({
 				...m,
-				items: m.items.map((i) => i.kind === "repo" && i.name === repo ? {
+				items: m.items.map((i) => i.name !== item ? i : {
 					...i,
-					to: head.slice(0, 7),
-					changes: i.changes || head.slice(0, 7) !== i.from
-				} : i)
+					to: at,
+					changes: i.status === "failed" || i.from !== at
+				})
 			})),
 			finish: (name, outcome) => machine(name, (m, now) => ({
 				...m,
@@ -64811,6 +64729,10 @@ const Cell = (props) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Box, {
 	})
 });
 const value = (i) => i.to === void 0 ? i.from ?? "" : i.from === void 0 ? `+ ${i.to}` : i.from === i.to ? i.to : `${i.from} → ${i.to}`;
+const unchanged = (i) => ({
+	text: "",
+	detail: i.kind === "record" ? "up to date" : void 0
+});
 const statusOf = (i, dryRun) => {
 	switch (i.status) {
 		case "running": return {
@@ -64832,7 +64754,8 @@ const statusOf = (i, dryRun) => {
 				text: "✓ copied",
 				tone: "dim"
 			};
-			if (i.kind === "repo") return i.from !== void 0 && i.from === i.to ? {
+			if (!i.changes) return unchanged(i);
+			if (i.kind === "record") return i.from !== void 0 && i.from === i.to ? {
 				text: "✓ rebuilt",
 				tone: "ok",
 				detail: i.reason
@@ -64851,10 +64774,7 @@ const statusOf = (i, dryRun) => {
 				tone: "dim",
 				detail: i.reason
 			};
-			return {
-				text: "",
-				detail: i.kind === "repo" ? "up to date" : void 0
-			};
+			return unchanged(i);
 	}
 };
 const countsOf = (m) => {
@@ -64908,10 +64828,38 @@ const summaryOf = (m, dryRun) => {
 		text: `${skipped} skipped`,
 		tone: "skip"
 	});
-	return parts.flatMap((part, n) => n === 0 ? [part] : [{
-		text: ", ",
+	return joined(parts);
+};
+const joined = (parts) => parts.flatMap((part, n) => n === 0 ? [part] : [{
+	text: ", ",
+	tone: "dim"
+}, part]);
+const shipSummary = (state) => {
+	const outcomes = state.machines.map((m) => {
+		const outcome = outcomeOf(m, state.dryRun);
+		if (outcome !== "ok") return outcome;
+		const { changes, skipped } = countsOf(m);
+		if (changes > 0) return state.dryRun ? "to change" : "updated";
+		return skipped > 0 ? "skipped" : "up to date";
+	});
+	const counted = (outcome, tone) => {
+		const n = outcomes.filter((o) => o === outcome).length;
+		return n === 0 ? [] : [{
+			text: `${n} ${outcome}`,
+			tone
+		}];
+	};
+	const parts = joined([
+		...counted("updated", "ok"),
+		...counted("to change", "dim"),
+		...counted("up to date", "ok"),
+		...counted("failed", "fail"),
+		...counted("skipped", "skip")
+	]);
+	return parts.length === 0 ? [{
+		text: "nothing changed",
 		tone: "dim"
-	}, part]);
+	}] : parts;
 };
 const elapsed = (started, ended, now) => started === void 0 ? "" : duration((ended ?? now) - started);
 const Parts = (props) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Line, { children: props.parts.map((part, n) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)(T, {
@@ -65067,7 +65015,6 @@ const LedgerView = (props) => {
 	const shown = lines.length <= room ? lines : lines.slice(0, Math.max(0, room - 1));
 	const hidden = count(blocks) - (shown.length - cuts);
 	if (room < 1) return null;
-	const t = tally(state);
 	return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Box, {
 		flexDirection: "column",
 		marginTop: 1,
@@ -65079,26 +65026,10 @@ const LedgerView = (props) => {
 			}),
 			state.ended !== void 0 && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Box, {
 				marginTop: 1,
-				children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Parts, { parts: [
-					{
-						text: `${dryRun ? "planned" : "ok"} ${t.ok}`,
-						...t.ok > 0 ? { tone: "ok" } : {}
-					},
-					{ text: "  " },
-					{
-						text: `skipped ${t.skipped}`,
-						...t.skipped > 0 ? { tone: "skip" } : {}
-					},
-					{ text: "  " },
-					{
-						text: `failed ${t.failed}`,
-						...t.failed > 0 ? { tone: "fail" } : {}
-					},
-					...dryRun ? [] : [{
-						text: `  in ${duration(state.ended - state.started)}`,
-						tone: "dim"
-					}]
-				] })
+				children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Parts, { parts: [...shipSummary(state), ...dryRun ? [] : [{
+					text: `  in ${duration(state.ended - state.started)}`,
+					tone: "dim"
+				}]] })
 			}),
 			state.ended !== void 0 && props.hint !== void 0 && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Line, {
 				tone: "dim",
@@ -65186,6 +65117,757 @@ const report = fn("report")(function* () {
 		]
 	})));
 });
+const decodeFact$2 = decodeUnknownOption(Union([Struct({
+	fact: Literal("brew"),
+	version: NullOr(String$5)
+}), AtFact]));
+const NO_BREW = "Homebrew is not installed; install it first";
+const homebrew = (name) => {
+	const flag = name === "brew" ? "--formula" : "--cask";
+	const lookup = name === "brew" ? "\"$ff_i\"" : "\"${ff_i##*/}\"";
+	const report = (names) => `for ff_i in ${names.map(quote).join(" ")}; do ff_v=$(brew list --versions ${flag} ${lookup} 2>/dev/null | awk '{print $NF}'); [ -z "$ff_v" ] || ff_at ${name} "$ff_i" "$ff_v"; done`;
+	const step = (what, batch) => {
+		const names = batch.map((c) => c.name);
+		const update = batch.some((c) => c.range === "latest") ? "brew update && " : "";
+		return {
+			id: `${name}:${name === "brew" ? "formulae" : "casks"}:${what}`,
+			items: names,
+			doing: what === "install" ? "installing" : "upgrading",
+			run: [[
+				`( ${update}NONINTERACTIVE=1 brew ${what} ${flag} ${names.map(quote).join(" ")}`,
+				"ff_rc=$?",
+				report(names),
+				"exit $ff_rc )"
+			].join("; ")]
+		};
+	};
+	return {
+		name,
+		rule: "range",
+		dependsOn: name === "cask" ? ["brew"] : [],
+		items(section) {
+			if (section === void 0) return [];
+			const packages = Object.entries(section.items ?? {}).map(([item, entry]) => typeof entry === "string" ? {
+				name: item,
+				kind: "package",
+				range: entry
+			} : {
+				...entry,
+				name: item,
+				kind: "package"
+			});
+			return name === "brew" ? [{
+				name: "brew",
+				kind: "homebrew"
+			}, ...packages] : packages;
+		},
+		observe: (items) => [
+			"if command -v brew >/dev/null 2>&1; then",
+			`  ff_state "{\\"provider\\":\\"${name}\\",\\"fact\\":\\"brew\\",\\"version\\":\\"$(ff_json "$(brew --version 2>/dev/null | head -n 1 | sed 's/^Homebrew //')")\\"}"`,
+			`  ${report(items.flatMap((i) => i.kind === "package" ? [i.name] : []))}`,
+			"else",
+			`  ff_state '{"provider":"${name}","fact":"brew","version":null}'`,
+			"fi"
+		].join("\n"),
+		parse(facts) {
+			let brew;
+			const at = /* @__PURE__ */ new Map();
+			for (const raw of facts) {
+				const fact = decodeFact$2(raw);
+				if (fact._tag === "None") continue;
+				const f = fact.value;
+				if (f.fact === "brew") brew = f.version ?? void 0;
+				else at.set(f.item, f.at);
+			}
+			return {
+				...brew === void 0 ? {} : { brew },
+				at
+			};
+		},
+		resolve: () => void_,
+		decide({ items, observed, ctx }) {
+			return items.map((item) => {
+				const installed = observed.at.get(item.name);
+				if (item.kind === "homebrew") return observed.brew === void 0 ? {
+					kind: "fail",
+					item: item.name,
+					reason: NO_BREW
+				} : {
+					kind: "leave",
+					item: item.name,
+					at: observed.brew
+				};
+				if (name === "cask" && ctx.machine.platform !== "darwin") return {
+					kind: "fail",
+					item: item.name,
+					reason: "Casks need macOS"
+				};
+				if (observed.brew === void 0) return name === "brew" ? {
+					kind: "skip",
+					item: item.name,
+					reason: "needs Homebrew"
+				} : {
+					kind: "fail",
+					item: item.name,
+					reason: NO_BREW
+				};
+				if (installed === void 0) return {
+					kind: "change",
+					item: item.name,
+					to: "latest",
+					change: {
+						kind: "install",
+						name: item.name,
+						range: item.range
+					}
+				};
+				if (item.range === "latest") return {
+					kind: "change",
+					item: item.name,
+					from: installed,
+					to: "latest",
+					change: {
+						kind: "upgrade",
+						name: item.name,
+						range: item.range
+					}
+				};
+				return {
+					kind: "leave",
+					item: item.name,
+					at: installed
+				};
+			});
+		},
+		act(decisions) {
+			const changes = decisions.flatMap((d) => d.kind === "change" ? [d.change] : []);
+			return ["install", "upgrade"].flatMap((what) => {
+				const batch = changes.filter((c) => c.kind === what);
+				return batch.length === 0 ? [] : [step(what, batch)];
+			});
+		}
+	};
+};
+const brew = homebrew("brew");
+const cask = homebrew("cask");
+const decodeFact$1 = decodeUnknownOption(Union([
+	Struct({
+		fact: Literal("cloneRoot"),
+		path: String$5,
+		present: Boolean$4
+	}),
+	Struct({
+		fact: Literal("repo"),
+		name: String$5,
+		present: Boolean$4,
+		head: optionalKey(String$5),
+		origin: optionalKey(String$5)
+	}),
+	Struct({
+		fact: Literal("output"),
+		repo: String$5,
+		path: String$5,
+		fingerprint: NullOr(String$5)
+	})
+]));
+const decodeRecord = decodeUnknownOption(Struct({
+	commit: String$5,
+	path: String$5,
+	install: String$5,
+	files: Record(String$5, String$5),
+	outputs: Record(String$5, String$5)
+}));
+const cloneRoot = (config, machine) => config.machines[machine]?.clones ?? "~/.local/share/fleetfizz/clones";
+const originUrl = (origin) => `https://github.com/${origin}.git`;
+const short = (commit) => commit.slice(0, 7);
+const expandHome = (path, home) => path === "~" ? home : path.startsWith("~/") ? `${home}${path.slice(1)}` : path;
+const jsonString = encodeSync(fromJsonString(String$5));
+const jsonRecord = encodeSync(fromJsonString(Record(String$5, String$5)));
+const lsRemote = fn("lsRemote")(function* (repo, token) {
+	const spawner = yield* ChildProcessSpawner;
+	const auth = token === void 0 ? [] : [
+		"-c",
+		"credential.helper=",
+		"-c",
+		"credential.helper=!f() { echo username=x-access-token; echo \"password=$FF_TOKEN\"; }; f"
+	];
+	return yield* scoped(gen(function* () {
+		const handle = yield* spawner.spawn(make$12("git", [
+			...auth,
+			"ls-remote",
+			originUrl(repo.origin),
+			`refs/heads/${repo.ref}`
+		], {
+			stdout: "pipe",
+			stderr: "pipe",
+			env: {
+				GIT_TERMINAL_PROMPT: "0",
+				...token === void 0 ? {} : { FF_TOKEN: token }
+			},
+			extendEnv: true
+		}));
+		const [stdout, stderr, code] = yield* all([
+			runCollect(decodeText(handle.stdout)),
+			runCollect(decodeText(handle.stderr)),
+			handle.exitCode
+		], { concurrency: "unbounded" });
+		if (code !== 0) {
+			const lines = stderr.join("").trim().split("\n");
+			return { error: lines[lines.length - 1] || `git ls-remote exited ${code}` };
+		}
+		const commit = stdout.join("").split(/\s/)[0];
+		return commit === void 0 || commit === "" ? { error: `no branch ${repo.ref} on origin` } : { commit };
+	})).pipe(orElseSucceed(() => ({ error: "could not run git ls-remote" })));
+});
+const observe = (items, root) => {
+	if (items.length === 0) return "";
+	const lines = [
+		`ff_root=${quotePath(root)}`,
+		`if [ -d "$ff_root" ]; then ff_present=true; else ff_present=false; fi`,
+		`ff_state "{\\"provider\\":\\"repos\\",\\"fact\\":\\"cloneRoot\\",\\"path\\":\\"$(ff_json "$ff_root")\\",\\"present\\":$ff_present}"`
+	];
+	for (const repo of items) {
+		const name = quote(repo.name);
+		lines.push(`ff_d="$ff_root"/${name}`, `if [ -d "$ff_d/.git" ]; then`, `  ff_state "{\\"provider\\":\\"repos\\",\\"fact\\":\\"repo\\",\\"name\\":\\"$(ff_json ${name})\\",\\"present\\":true,\\"head\\":\\"$(ff_json "$(git -C "$ff_d" rev-parse HEAD 2>/dev/null)")\\",\\"origin\\":\\"$(ff_json "$(git -C "$ff_d" remote get-url origin 2>/dev/null)")\\"}"`, "else", `  ff_state "{\\"provider\\":\\"repos\\",\\"fact\\":\\"repo\\",\\"name\\":\\"$(ff_json ${name})\\",\\"present\\":false}"`, "fi");
+		for (const output of repo.outputs ?? []) lines.push(`ff_p=${quotePath(output)}; ff_f=$(ff_fp "$ff_p")`, `if [ -n "$ff_f" ]; then ff_fv="\\"$(ff_json "$ff_f")\\""; else ff_fv=null; fi`, `ff_state "{\\"provider\\":\\"repos\\",\\"fact\\":\\"output\\",\\"repo\\":\\"$(ff_json ${name})\\",\\"path\\":\\"$(ff_json ${quote(output)})\\",\\"fingerprint\\":$ff_fv}"`);
+	}
+	return lines.join("\n");
+};
+const decideRepo = (repo, root, observed, resolved, ctx) => {
+	const clone = observed.clones.get(repo.name);
+	const record = observed.records.get(repo.name);
+	const at = clone?.head === void 0 ? {} : { at: short(clone.head) };
+	const fail = (reason) => ({
+		kind: "fail",
+		item: repo.name,
+		...at,
+		reason
+	});
+	if (observed.cloneRoot?.present === false && !root.startsWith("~")) return fail(`clone root not mounted: ${observed.cloneRoot.path}`);
+	const url = originUrl(repo.origin);
+	if (clone?.present && clone.origin !== void 0 && clone.origin !== url) return fail(`managed clone has origin ${clone.origin}, expected ${url}`);
+	const target = isPin(repo.ref) ? { commit: repo.ref } : resolved[repo.name];
+	if (target === void 0) return fail(`could not resolve ${repo.ref}`);
+	if ("error" in target) return fail(target.error);
+	const { commit } = target;
+	const outputs = observed.outputs.get(repo.name);
+	const install = decideInstall(record, {
+		commit,
+		path: expandHome(`${root}/${repo.name}`, ctx.home),
+		install: repo.install,
+		files: repo.files ?? {},
+		outputs: Object.fromEntries((repo.outputs ?? []).map((o) => [o, outputs?.get(o)]))
+	}, ctx.rebuild(address("repos", repo.name)));
+	const reason = install.run ? install.reason : !clone?.present ? "not cloned" : clone.head !== commit ? `checked out at ${short(clone.head ?? "")}` : void 0;
+	const change = {
+		item: repo,
+		root,
+		commit
+	};
+	if (reason === void 0) return {
+		kind: "leave",
+		item: repo.name,
+		at: short(commit),
+		upkeep: change
+	};
+	const from = record?.commit ?? clone?.head;
+	return {
+		kind: "change",
+		item: repo.name,
+		...from === void 0 ? {} : { from: short(from) },
+		to: short(commit),
+		reason,
+		change
+	};
+};
+const fetchStep = ({ item, root, commit }) => {
+	const url = originUrl(item.origin);
+	const sync = isPin(item.ref) ? [
+		`if [ "$(git -C "$ff_d" rev-parse HEAD)" != ${quote(commit)} ]; then ff_git -C "$ff_d" fetch --quiet origin ${quote(commit)}; fi`,
+		`git -C "$ff_d" checkout --quiet --detach ${quote(commit)}`,
+		`git -C "$ff_d" reset --quiet --hard ${quote(commit)}`
+	] : [`ff_git -C "$ff_d" fetch --quiet origin ${quote(item.ref)}`, `git -C "$ff_d" reset --quiet --hard ${quote(commit)}`];
+	const files = Object.entries(item.files ?? {}).flatMap(([path, content]) => [`mkdir -p "$(dirname "$ff_d"/${quote(path)})"`, `printf '%s' ${quote(content)} > "$ff_d"/${quote(path)}`]);
+	return {
+		id: `repos:${item.name}:fetch`,
+		items: [item.name],
+		doing: "fetching",
+		run: [
+			`ff_root=${quotePath(root)}`,
+			...root.startsWith("~") ? [`mkdir -p "$ff_root"`] : [],
+			`ff_d="$ff_root"/${quote(item.name)}`,
+			"(",
+			"  set -e",
+			`  if [ ! -d "$ff_d/.git" ]; then ff_git clone --quiet ${quote(url)} "$ff_d"; fi`,
+			`  if [ "$(git -C "$ff_d" remote get-url origin)" != ${quote(url)} ]; then echo "origin is $(git -C "$ff_d" remote get-url origin), expected ${url}"; exit 1; fi`,
+			...[
+				...sync,
+				`git -C "$ff_d" clean --quiet -fd`,
+				...files
+			].map((l) => `  ${l}`),
+			")"
+		]
+	};
+};
+const installStep = ({ item, root }, ctx) => {
+	const env = [
+		`FLEETFIZZ_MACHINE=${quote(ctx.machine.name)}`,
+		`FLEETFIZZ_PLATFORM=${quote(ctx.machine.platform)}`,
+		`FLEETFIZZ_MACHINES=${quote(Object.keys(ctx.config.machines).join(","))}`
+	].join(" ");
+	const tmp = `${recordDir("repos")}/${quote(`${item.name}.json.tmp`)}`;
+	const record = [
+		`ff_after=$(git -C "$ff_d" rev-parse HEAD)`,
+		`ff_outs=""`,
+		...(item.outputs ?? []).map((o) => `ff_fpv=$(ff_fp ${quotePath(o)}); if [ -n "$ff_fpv" ]; then ff_outs="$ff_outs,\\"$(ff_json ${quote(o)})\\":\\"$(ff_json "$ff_fpv")\\""; fi`),
+		`mkdir -p ${recordDir("repos")}`,
+		`printf '%s\\n' "{\\"commit\\":\\"$ff_after\\",\\"path\\":\\"$(ff_json "$ff_d")\\",\\"install\\":$(ff_lit ${quote(jsonString(item.install))}),\\"files\\":$(ff_lit ${quote(jsonRecord(item.files ?? {}))}),\\"outputs\\":{\${ff_outs#,}}}" > ${tmp}`,
+		`mv -f ${tmp} ${recordFile("repos", item.name)}`,
+		`rm -f ${quotePath(RECORDS_DIR)}/${quote(`${item.name}.json`)}`
+	];
+	return {
+		id: `repos:${item.name}:install`,
+		items: [item.name],
+		doing: "installing",
+		run: [
+			`ff_root=${quotePath(root)}`,
+			`ff_d="$ff_root"/${quote(item.name)}`,
+			`(cd "$ff_d" && ${env} "\${SHELL:-/bin/sh}" -lc ${quote(item.install)})`,
+			`ff_rc=$?`,
+			`if [ "$ff_rc" -eq 0 ]; then`,
+			"  (",
+			"    set -e",
+			...record.map((l) => `    ${l}`),
+			"  )",
+			`  ff_rc=$?`,
+			`  if [ "$ff_rc" -ne 0 ]; then echo "could not write the install record"; fi`,
+			"fi",
+			`(exit "$ff_rc")`
+		]
+	};
+};
+const repos = {
+	name: "repos",
+	rule: "record",
+	dependsOn: ["vp"],
+	items: (section) => (section ?? []).map((repo) => ({
+		...repo,
+		name: repoName(repo)
+	})),
+	observe: (items, scope) => observe(items, cloneRoot(scope.config, scope.machine.name)),
+	parse(facts, records) {
+		let root;
+		const clones = /* @__PURE__ */ new Map();
+		const outputs = /* @__PURE__ */ new Map();
+		for (const raw of facts) {
+			const fact = decodeFact$1(raw);
+			if (fact._tag === "None") continue;
+			const f = fact.value;
+			switch (f.fact) {
+				case "cloneRoot":
+					root = {
+						path: f.path,
+						present: f.present
+					};
+					break;
+				case "repo":
+					clones.set(f.name, {
+						present: f.present,
+						...f.head === void 0 || f.head === "" ? {} : { head: f.head },
+						...f.origin === void 0 || f.origin === "" ? {} : { origin: f.origin }
+					});
+					break;
+				case "output": {
+					const paths = outputs.get(f.repo) ?? /* @__PURE__ */ new Map();
+					paths.set(f.path, f.fingerprint ?? void 0);
+					outputs.set(f.repo, paths);
+					break;
+				}
+			}
+		}
+		const decoded = /* @__PURE__ */ new Map();
+		for (const [name, raw] of Object.entries(records)) {
+			const record = decodeRecord(raw);
+			if (record._tag === "Some") decoded.set(name, record.value);
+		}
+		return {
+			...root === void 0 ? {} : { cloneRoot: root },
+			clones,
+			outputs,
+			records: decoded
+		};
+	},
+	resolve: (items, { token }) => forEach$1(items.filter((repo) => !isPin(repo.ref)), (repo) => lsRemote(repo, token).pipe(map$5((result) => [repo.name, result])), { concurrency: 8 }).pipe(map$5((entries) => Object.fromEntries(entries))),
+	decide: ({ items, observed, resolved, ctx }) => {
+		const root = cloneRoot(ctx.config, ctx.machine.name);
+		return items.map((repo) => decideRepo(repo, root, observed, resolved, ctx));
+	},
+	act: (decisions, ctx) => decisions.flatMap((d) => d.kind === "change" ? [fetchStep(d.change), installStep(d.change, ctx)] : d.kind === "leave" && d.upkeep !== void 0 ? [fetchStep(d.upkeep)] : [])
+};
+//#endregion
+//#region ../../packages/providers/src/vp/index.ts
+const VP_PACKAGE = "vite-plus";
+const TOOL_PACKAGES = {
+	node: ["node"],
+	npm: ["npm"],
+	pnpm: ["pnpm"],
+	yarn: ["yarn", "@yarnpkg/cli-dist"],
+	bun: ["bun"]
+};
+const GlobalEntry = Struct({
+	name: String$5,
+	version: String$5,
+	platform: optionalKey(Struct({ node: optionalKey(String$5) }))
+});
+const decodeFact = decodeUnknownOption(Union([
+	Struct({
+		fact: Literal("vp"),
+		version: NullOr(String$5),
+		path: optionalKey(String$5)
+	}),
+	Struct({
+		fact: Literal("default"),
+		tool: String$5,
+		version: String$5
+	}),
+	Struct({
+		fact: Literal("mode"),
+		mode: Literals$2(["managed", "system-first"])
+	}),
+	Struct({
+		fact: Literal("globals"),
+		list: ArraySchema(GlobalEntry)
+	})
+]));
+const VP_INSTALL = [
+	"curl -fsSL https://vite.plus | bash",
+	...vpEnv.split("\n"),
+	"{ hash -r 2>/dev/null || true; }"
+].join(" && ");
+const isHomebrew = (path) => path !== void 0 && (path.includes("/homebrew/") || path.includes("/Cellar/"));
+const OBSERVE = [
+	"if command -v vp >/dev/null 2>&1; then",
+	`  ff_v=$(command vp --version 2>/dev/null | sed -n 's/^vp v\\{0,1\\}\\([^ ]*\\).*/\\1/p' | head -n 1)`,
+	`  ff_state "{\\"provider\\":\\"vp\\",\\"fact\\":\\"vp\\",\\"version\\":\\"$(ff_json "$ff_v")\\",\\"path\\":\\"$(ff_json "$(command -v vp)")\\"}"`,
+	"  if command vp env doctor 2>/dev/null | grep -q 'system-first mode'; then ff_m=system-first; else ff_m=managed; fi",
+	`  ff_state "{\\"provider\\":\\"vp\\",\\"fact\\":\\"mode\\",\\"mode\\":\\"$ff_m\\"}"`,
+	`  command vp env default 2>/dev/null | sed -n -e 's/^Default Node.js version: /node /p' -e 's/^Default \\([a-z]*\\) version: /\\1 /p' | while read -r ff_t ff_n; do`,
+	`    ff_state "{\\"provider\\":\\"vp\\",\\"fact\\":\\"default\\",\\"tool\\":\\"$(ff_json "$ff_t")\\",\\"version\\":\\"$(ff_json "$ff_n")\\"}"`,
+	"  done",
+	`  ff_g=$(command vp list --global --json 2>/dev/null | tr -d '\\n')`,
+	`  ff_state "{\\"provider\\":\\"vp\\",\\"fact\\":\\"globals\\",\\"list\\":\${ff_g:-[]}}"`,
+	"else",
+	`  ff_state '{"provider":"vp","fact":"vp","version":null}'`,
+	"fi"
+].join("\n");
+const decideSelf = (item, installed, self) => {
+	const at = installed === void 0 ? {} : { at: installed };
+	if (installed === void 0 || import_semver.lt(installed, self)) return {
+		kind: "change",
+		item,
+		...installed === void 0 ? {} : { from: installed },
+		to: self,
+		change: {
+			kind: "global",
+			name: item,
+			version: self
+		}
+	};
+	if (import_semver.gt(installed, self)) return {
+		kind: "fail",
+		item,
+		...at,
+		reason: `runs ${SELF_PACKAGE} ${installed}, newer than this ${self}; upgrade here first`
+	};
+	return {
+		kind: "leave",
+		item,
+		...at
+	};
+};
+const MODE_SUBJECT = address("vp", "mode");
+const NOT_MANAGED = "needs managed mode";
+const decideMode = (observed, ctx) => {
+	if (observed.vp !== void 0 && observed.mode !== "system-first") return {
+		kind: "leave",
+		item: "mode",
+		at: "managed"
+	};
+	const from = observed.mode === void 0 ? {} : { from: observed.mode };
+	const answer = observed.vp === void 0 ? "managed" : ctx.answer("mode", MODE_SUBJECT);
+	if (answer === "managed") return {
+		kind: "change",
+		item: "mode",
+		...from,
+		to: "managed",
+		change: { kind: "mode" }
+	};
+	if (answer === "skip") return {
+		kind: "skip",
+		item: "mode",
+		at: "system-first",
+		reason: NOT_MANAGED
+	};
+	return {
+		kind: "ask",
+		item: "mode",
+		at: "system-first",
+		question: {
+			kind: "mode",
+			subject: MODE_SUBJECT,
+			found: "system-first",
+			problem: NOT_MANAGED,
+			choices: [{
+				value: "managed",
+				title: "switch to managed mode"
+			}, {
+				value: "skip",
+				title: "skip Node and package managers on these Machines"
+			}],
+			default: "skip"
+		}
+	};
+};
+const decideRanged = (item, observed, resolved, ctx) => {
+	const installed = item.kind === "vp" ? observed.vp?.version : item.kind === "default" ? observed.defaults.get(item.name) : observed.globals.get(item.name)?.version;
+	const decision = decideRangeItem({
+		provider: "vp",
+		item: item.name,
+		range: item.range,
+		installed,
+		available: item.packages.flatMap((p) => resolved[p] ?? []),
+		bumpPath: item.bumpPath,
+		ctx
+	});
+	if (item.kind === "vp" && observed.vp === void 0) {
+		if (decision.kind === "change") return {
+			...decision,
+			change: {
+				kind: "bootstrap",
+				version: decision.change
+			}
+		};
+		if (decision.kind === "fail" && (item.range === "*" || item.range === "latest")) return {
+			kind: "change",
+			item: item.name,
+			to: "latest",
+			change: { kind: "bootstrap" }
+		};
+		return decision;
+	}
+	if (decision.kind !== "change") return decision;
+	const version = decision.change;
+	if (item.kind === "vp" && isHomebrew(observed.vp?.path)) return {
+		kind: "fail",
+		item: item.name,
+		...installed === void 0 ? {} : { at: installed },
+		reason: `vp ${installed} was installed with Homebrew; run brew upgrade vite-plus to get ${version}`
+	};
+	const change = item.kind === "vp" ? {
+		kind: "upgrade",
+		version
+	} : item.kind === "default" ? {
+		kind: "default",
+		tool: item.name,
+		version
+	} : {
+		kind: "global",
+		name: item.name,
+		version
+	};
+	return {
+		...decision,
+		change
+	};
+};
+//#endregion
+//#region ../../packages/providers/src/index.ts
+const PROVIDERS = [
+	{
+		name: "vp",
+		rule: "range",
+		dependsOn: [],
+		items(section) {
+			const globals = Object.entries(section?.globals ?? {}).map(([name, global]) => {
+				const targeting = typeof global === "string" ? {} : global;
+				return {
+					...targeting.platforms === void 0 ? {} : { platforms: targeting.platforms },
+					...targeting.machines === void 0 ? {} : { machines: targeting.machines },
+					name,
+					kind: "global",
+					packages: [name],
+					range: typeof global === "string" ? global : global.range,
+					bumpPath: typeof global === "string" ? [
+						"vp",
+						"globals",
+						name
+					] : [
+						"vp",
+						"globals",
+						name,
+						"range"
+					]
+				};
+			});
+			const defaults = ["node", ...PACKAGE_MANAGERS].flatMap((tool) => {
+				const range = section?.[tool];
+				return range === void 0 ? [] : [{
+					name: tool,
+					kind: "default",
+					packages: TOOL_PACKAGES[tool],
+					range,
+					bumpPath: ["vp", tool]
+				}];
+			});
+			return [
+				{
+					name: "vp",
+					kind: "vp",
+					packages: [VP_PACKAGE],
+					range: section?.version ?? "*",
+					bumpPath: ["vp", "version"]
+				},
+				{
+					name: "mode",
+					kind: "mode"
+				},
+				...defaults,
+				...globals,
+				{
+					name: SELF_PACKAGE,
+					kind: "self"
+				}
+			];
+		},
+		observe: () => OBSERVE,
+		parse(facts) {
+			let vpFact;
+			let mode;
+			const defaults = /* @__PURE__ */ new Map();
+			let globals = [];
+			for (const raw of facts) {
+				const fact = decodeFact(raw);
+				if (fact._tag === "None") continue;
+				const f = fact.value;
+				if (f.fact === "vp" && f.version !== null) vpFact = {
+					version: f.version,
+					...f.path === void 0 ? {} : { path: f.path }
+				};
+				else if (f.fact === "mode") mode = f.mode;
+				else if (f.fact === "default") defaults.set(f.tool, f.version);
+				else if (f.fact === "globals") globals = f.list;
+			}
+			if (vpFact === void 0) return {
+				defaults: /* @__PURE__ */ new Map(),
+				globals: /* @__PURE__ */ new Map()
+			};
+			return {
+				vp: vpFact,
+				...mode === void 0 ? {} : { mode },
+				defaults,
+				globals: new Map(globals.map((g) => [g.name, g]))
+			};
+		},
+		resolve: (items) => resolveVersions(items.flatMap((item) => "packages" in item ? item.packages : [])),
+		decide({ items, observed, resolved, ctx }) {
+			const mode = decideMode(observed, ctx);
+			const managed = mode.kind === "leave" || mode.kind === "change";
+			const decisions = items.map((item) => {
+				switch (item.kind) {
+					case "mode": return mode;
+					case "self": return decideSelf(item.name, observed.globals.get(item.name)?.version, ctx.self);
+					case "default":
+						if (!managed) {
+							const at = observed.defaults.get(item.name);
+							return {
+								kind: "skip",
+								item: item.name,
+								...at === void 0 ? {} : { at },
+								reason: NOT_MANAGED
+							};
+						}
+						return decideRanged(item, observed, resolved, ctx);
+					default: return decideRanged(item, observed, resolved, ctx);
+				}
+			});
+			const nodeChange = decisions.find((d) => d.kind === "change" && d.change.kind === "default" && d.change.tool === "node");
+			const nodeDefault = nodeChange?.kind === "change" ? nodeChange.to : observed.defaults.get("node");
+			return decisions.map((d, i) => {
+				const item = items[i];
+				const current = observed.globals.get(d.item);
+				const node = current?.platform?.node;
+				if (d.kind !== "leave" || item === void 0 || item.kind !== "global" && item.kind !== "self" || current === void 0 || node === void 0 || nodeDefault === void 0 || node === nodeDefault) return d;
+				return {
+					kind: "change",
+					item: d.item,
+					from: current.version,
+					to: current.version,
+					reason: `Node ${node} → ${nodeDefault}`,
+					change: {
+						kind: "reinstall",
+						name: d.item,
+						version: current.version
+					}
+				};
+			});
+		},
+		act(decisions) {
+			const changes = decisions.flatMap((d) => d.kind === "change" ? [d.change] : []);
+			const steps = [];
+			for (const change of changes) switch (change.kind) {
+				case "bootstrap":
+					steps.push({
+						id: "vp:vp:install",
+						items: ["vp"],
+						doing: "installing",
+						run: [change.version === void 0 ? VP_INSTALL : `${VP_INSTALL} && command vp upgrade ${quote(change.version)}`]
+					});
+					break;
+				case "upgrade":
+					steps.push({
+						id: "vp:vp:upgrade",
+						items: ["vp"],
+						doing: "upgrading",
+						run: [`( command vp upgrade ${quote(change.version)} )`]
+					});
+					break;
+				case "mode":
+					steps.push({
+						id: "vp:mode:on",
+						items: ["mode"],
+						doing: "switching",
+						run: ["( command vp env on )"]
+					});
+					break;
+				case "default":
+					steps.push({
+						id: `vp:${change.tool}:default`,
+						items: [change.tool],
+						doing: "installing",
+						run: [`( command vp env default ${quote(change.tool === "node" ? change.version : `${change.tool}@${change.version}`)} )`]
+					});
+					break;
+				case "reinstall": steps.push({
+					id: `vp:${change.name}:reinstall`,
+					items: [change.name],
+					doing: "reinstalling",
+					run: [`( command vp install -g ${quote(`${change.name}@${change.version}`)} )`]
+				});
+			}
+			const installs = changes.flatMap((c) => c.kind === "global" ? [c] : []);
+			if (installs.length > 0) steps.push({
+				id: "vp:globals:install",
+				items: installs.map((c) => c.name),
+				doing: "installing",
+				run: [`( command vp install -g ${installs.map((c) => quote(`${c.name}@${c.version}`)).join(" ")} )`]
+			});
+			return steps;
+		}
+	},
+	brew,
+	cask,
+	repos
+];
 //#endregion
 //#region src/live.tsx
 const cell = (initial) => {
@@ -65271,6 +65953,7 @@ const noLive = { ask: void 0 };
 const canRedraw = () => Boolean(process.stdout.isTTY) && process.env.TERM !== "dumb";
 //#endregion
 //#region src/machine.ts
+const decodeAt = decodeUnknownOption(AtFact);
 const runOn = fn("runOn")(function* (target, script, secrets, onLine, ledger) {
 	let first;
 	const run = yield* runScript(target, script, secrets, (line) => {
@@ -65287,16 +65970,16 @@ const runOn = fn("runOn")(function* (target, script, secrets, onLine, ledger) {
 	}
 	return run;
 });
-const GATHER_TIMEOUT = "2 minutes";
-const gather = fn("gather")(function* (target, script, ledger) {
+const CHECK_TIMEOUT = "2 minutes";
+const check = fn("check")(function* (target, script, ledger) {
 	const facts = [];
 	const output = [];
 	const run = yield* runOn(target, script, [], (line) => sync(() => {
 		if (line.kind === "state") facts.push(line.fact);
 		else if (line.kind === "text" && line.text.trim() !== "") output.push(line.text.trimEnd());
 	}), ledger).pipe(timeoutOrElse({
-		duration: GATHER_TIMEOUT,
-		orElse: () => ledger.fail(target.name, [`checking took more than ${GATHER_TIMEOUT}; something on that Machine is blocking`, ...output]).pipe(as({ kind: "failed" }))
+		duration: CHECK_TIMEOUT,
+		orElse: () => ledger.fail(target.name, [`checking took more than ${CHECK_TIMEOUT}; something on that Machine is blocking`, ...output]).pipe(as({ kind: "failed" }))
 	}));
 	if (run.kind !== "ran") return { kind: run.kind };
 	const state = assembleState(facts);
@@ -65305,7 +65988,7 @@ const gather = fn("gather")(function* (target, script, ledger) {
 		return { kind: "failed" };
 	}
 	return {
-		kind: "gathered",
+		kind: "checked",
 		state
 	};
 });
@@ -65340,10 +66023,17 @@ const apply = fn("apply")(function* (target, p, script, secrets, ledger) {
 				});
 				break;
 			}
+			case "skip":
+				yield* ledger.stepSkipped(target.name, line.skip.id, line.skip.reason);
+				break;
 			case "text":
 				if (line.text.trim() !== "") (current?.output ?? head).push(line.text.trimEnd());
 				break;
-			case "state": if (line.fact.fact === "repo" && line.fact.head !== void 0) yield* ledger.fetched(target.name, line.fact.name, line.fact.head);
+			case "state": {
+				const at = decodeAt(line.fact);
+				if (at._tag === "Some") yield* ledger.reached(target.name, address(at.value.provider, at.value.item), at.value.at);
+				break;
+			}
 		}
 	}), ledger);
 	const finish = fn("finish")(function* (outcome) {
@@ -65364,43 +66054,53 @@ const apply = fn("apply")(function* (target, p, script, secrets, ledger) {
 		yield* ledger.fail(target.name, ["apply did not finish", ...head]);
 		return yield* finish("failed");
 	}
-	return yield* finish(failed.length > 0 || p.failures.length > 0 ? "failed" : "ok");
+	const planFailed = p.providers.some((pp) => pp.decisions.some((d) => d.kind === "fail"));
+	return yield* finish(failed.length > 0 || planFailed ? "failed" : "ok");
 });
 //#endregion
 //#region src/questions.ts
-const newest = (group) => [...group].map((q) => q.installed).sort((a, b) => b.localeCompare(a, void 0, { numeric: true }))[0] ?? "";
-const askQuestions = fn("askQuestions")(function* (questions, flags, ledger, ask) {
-	const groups = /* @__PURE__ */ new Map();
-	for (const q of questions) groups.set(q.package, [...groups.get(q.package) ?? [], q]);
-	const decided = {};
-	for (const [pkg, group] of groups) {
-		const where = group.map((q) => `${q.installed} on ${q.machine}`).join(", ");
-		const range = group[0]?.range ?? "";
-		const bump = {
-			kind: "bump",
-			installed: newest(group)
-		};
-		const bumpTitle = `bump the config to ${bumpedRange(range, newest(group))}`;
-		const answer = (decision) => decision.kind === "bump" ? bumpTitle : decision.kind === "skip" ? "skip on these Machines" : "downgrade into the range";
-		yield* ledger.note("ask", `${pkg} ${where} is above ${range}`);
-		const decision = flags.bump ? bump : flags.enforce ? { kind: "downgrade" } : ask === void 0 ? { kind: "skip" } : yield* ask([
-			{
-				title: bumpTitle,
-				value: bump
-			},
-			{
-				title: "skip on these Machines (leave as is, report SKIP)",
-				value: { kind: "skip" }
-			},
-			{
-				title: "downgrade into the range",
-				value: { kind: "downgrade" }
-			}
-		]);
-		yield* ledger.note("answer", answer(decision));
-		decided[pkg] = decision;
+const parseAnswers = (raw) => {
+	const given = /* @__PURE__ */ new Map();
+	for (const entry of raw) {
+		const at = entry.lastIndexOf("=");
+		const key = entry.slice(0, at);
+		const choice = entry.slice(at + 1);
+		const kind = key.split(":")[0] ?? "";
+		if (at <= 0 || !isQuestionKind(kind)) return { invalid: `--answer ${entry}: expected kind=choice or kind:subject=choice, kind one of ${Object.keys(QUESTION_CHOICES).join(", ")}` };
+		const choices = QUESTION_CHOICES[kind];
+		if (!choices.includes(choice)) return { invalid: `--answer ${entry}: ${kind} takes ${choices.join(", ")}` };
+		given.set(key, choice);
+	}
+	return { answer: (kind, subject) => given.get(`${kind}:${subject}`) ?? given.get(kind) };
+};
+const newestOf = (found) => found.toSorted((a, b) => b.localeCompare(a, void 0, { numeric: true }))[0] ?? "";
+const askQuestions = fn("askQuestions")(function* (input) {
+	const groups = Map.groupBy(input.asked, (a) => `${a.question.kind}:${a.question.subject}`);
+	const answered = [];
+	for (const group of groups.values()) {
+		const question = group[0]?.question;
+		if (question === void 0) continue;
+		const newest = newestOf(group.map((a) => a.question.found));
+		const where = group.map((a) => `${a.question.found} on ${a.machine}`).join(", ");
+		yield* input.ledger.note("ask", `${question.subject} ${where} ${question.problem}`);
+		if (input.dryRun) {
+			yield* input.ledger.note("answer", "not asked (dry run)");
+			continue;
+		}
+		const choices = question.choices.map((c) => ({
+			value: c.value,
+			title: c.value === "bump" && question.bump !== void 0 ? `bump the config to ${bumpedRange(question.bump.range, newest)}` : c.title
+		}));
+		const answer = input.answer(question.kind, question.subject) ?? (input.ask === void 0 ? question.default : yield* input.ask(choices));
+		yield* input.ledger.note("answer", choices.find((c) => c.value === answer)?.title ?? answer);
+		answered.push({
+			question,
+			machines: group.map((a) => a.machine),
+			newest,
+			answer
+		});
 	}
-	return decided;
+	return answered;
 });
 //#endregion
 //#region src/ship.ts
@@ -65411,48 +66111,64 @@ const unknownMachines = (config, tailnet, only) => {
 	const known = new Set(tailnet.fleet.map((m) => m.name));
 	const referenced = [
 		...Object.keys(config.machines),
-		...(config.repos ?? []).flatMap((r) => r.machines ?? []),
-		...config.vp?.machines ?? [],
+		...PROVIDERS.flatMap((p) => machinesNamed(p, config)),
 		...only
 	];
 	return [...new Set(referenced.filter((name) => !known.has(name)))];
 };
-const packagesToResolve = (config) => {
-	const vp = config.vp;
-	if (vp === void 0) return [];
-	return [
-		...vp.version === void 0 ? [] : [VP_PACKAGE],
-		...vp.node === void 0 ? [] : [NODE_PACKAGE],
-		...Object.keys(vp.globals ?? {})
-	];
-};
-const rebuildOf = (flags) => flags.rebuild.length === 0 ? "none" : flags.rebuild.includes("all") ? "all" : flags.rebuild;
-const staleConfigs = fn("staleConfigs")(function* (local, inputIsLocalFile, gathered, ledger) {
-	const stale = [];
-	for (const { machine, local: isLocal, state } of gathered) {
-		if (isLocal && inputIsLocalFile || state.config === void 0) continue;
+const unshippable = (config, tailnet, only, source) => {
+	const unknown = unknownMachines(config, tailnet, only);
+	if (unknown.length > 0) return `unknown Machine: ${unknown.join(", ")} (the tailnet has: ${tailnet.fleet.map((m) => m.name).join(", ")})`;
+	const fleet = new Set(Object.keys(config.machines));
+	if (!fleet.has(tailnet.self.name)) return `this Machine (${tailnet.self.name}) is not in machines in ${source}`;
+	const outsideFleet = only.filter((name) => !fleet.has(name));
+	if (outsideFleet.length > 0) return `not in machines in ${source}: ${outsideFleet.join(", ")}`;
+};
+const staleConfigs = fn("staleConfigs")(function* (config, own, checked, ledger) {
+	const copies = [];
+	for (const { machine, state } of checked) {
+		if (state.config === void 0) continue;
 		const parsed = yield* result(parseConfig(machine.name, state.config));
-		if (parsed._tag === "Failure") {
-			yield* ledger.note("info", `the config on ${machine.name} does not parse; it will be overwritten`);
-			continue;
-		}
-		const remote = parsed.success;
-		if (isNewer(remote.shippedTo?.[machine.name], local.shippedTo?.[machine.name])) stale.push(`${machine.name} (shipped ${remote.shippedAt} from ${remote.shippedFrom ?? "unknown"})`);
+		if (parsed._tag === "Failure") yield* ledger.note("info", `the config on ${machine.name} does not parse; it will be overwritten`);
+		else copies.push({
+			machine: machine.name,
+			config: parsed.success,
+			text: state.config
+		});
 	}
-	return stale;
+	return [...Map.groupBy(staleCopies(config, copies, own), (c) => c.text)].flatMap(([text, [first, ...rest]]) => {
+		if (first === void 0) return [];
+		const { config, machine } = first;
+		const machines = [machine, ...rest.map((c) => c.machine)];
+		return [{
+			text,
+			config,
+			machines,
+			description: `${machines.join(", ")} (shipped ${config.shippedAt} from ${config.shippedFrom ?? "unknown"})`
+		}];
+	});
 });
 const schemaJson = encodeSync(fromJsonString(Unknown, { space: 2 }));
 const ship = fn("ship")(function* (flags) {
+	while ((yield* shipPass(flags)) === "adopted");
+});
+const shipPass = fn("shipPass")(function* (flags) {
 	const fs = yield* FileSystem;
+	const parsed = parseAnswers(flags.answers);
+	if ("invalid" in parsed) return yield* fail$1(new ShipError(parsed.invalid));
+	const given = parsed.answer;
+	const notAddress = flags.rebuild.find((r) => r !== "all" && !PROVIDERS.some((p) => p.rule === "record" && p.name === parseAddress(r)?.provider));
+	if (notAddress !== void 0) return yield* fail$1(new ShipError(`--rebuild ${notAddress}: expected a record Item (repos:<name>) or all`));
 	const path = flags.config ?? configPath(process.env);
 	const config = yield* loadConfig(path);
+	const ordered = orderProviders(PROVIDERS, (p) => dependenciesOf(p, config));
+	if ("cycle" in ordered) return yield* fail$1(new ShipError(`dependsOn cycle: ${ordered.cycle.join(" → ")}`));
+	const providers = ordered.order;
 	const tailnet = yield* readTailnet();
-	const unknown = unknownMachines(config, tailnet, flags.only);
-	if (unknown.length > 0) return yield* fail$1(new ShipError(`unknown Machine: ${unknown.join(", ")} (the tailnet has: ${tailnet.fleet.map((m) => m.name).join(", ")})`));
+	const problem = unshippable(config, tailnet, flags.only, path);
+	if (problem !== void 0) return yield* fail$1(new ShipError(problem));
 	const fleet = new Set(Object.keys(config.machines));
-	if (!fleet.has(tailnet.self.name)) return yield* fail$1(new ShipError(`this Machine (${tailnet.self.name}) is not in machines in ${path}`));
-	const outsideFleet = flags.only.filter((name) => !fleet.has(name));
-	if (outsideFleet.length > 0) return yield* fail$1(new ShipError(`not in machines in ${path}: ${outsideFleet.join(", ")}`));
+	const own = flags.config === void 0 ? tailnet.self.name : void 0;
 	const order = Object.keys(config.machines);
 	const targetsList = tailnet.fleet.filter((m) => fleet.has(m.name) && (flags.only.length === 0 || flags.only.includes(m.name))).toSorted((a, b) => order.indexOf(a.name) - order.indexOf(b.name));
 	const count = `${targetsList.length} machine${targetsList.length === 1 ? "" : "s"}`;
@@ -65466,8 +66182,10 @@ const ship = fn("ship")(function* (flags) {
 	});
 	const redraw = canRedraw();
 	let changing = false;
+	let adopted = false;
 	const finish = fn("finish")(function* () {
 		const state = yield* ledger.end;
+		if (adopted) return;
 		const saved = changing && (yield* saveReport(state).pipe(as(true), catch_((e) => error(`could not save the report for fizz report: ${e.message}`).pipe(as(false)))));
 		yield* log(ledgerText(state, redraw ? {
 			full: false,
@@ -65477,16 +66195,11 @@ const ship = fn("ship")(function* (flags) {
 			full: true,
 			now: state.ended ?? 0
 		}, color));
-		if (tally(state).failed > 0) process.exitCode = 1;
+		if (anyFailed(state)) process.exitCode = 1;
 	});
 	yield* addFinalizer(() => finish());
 	const live = redraw ? yield* startLive(store, color) : noLive;
-	const cloneRootOf = (machine) => config.machines[machine.name]?.clones ?? "~/.local/share/fleetfizz/clones";
-	const gatherRepos = (config.repos ?? []).map((r) => ({
-		name: repoName(r),
-		outputs: r.outputs ?? []
-	}));
-	const gathered = yield* forEach$1(targetsList, fn("gatherOne")(function* (machine) {
+	const checked = yield* forEach$1(targetsList, fn("checkOne")(function* (machine) {
 		const local = machine.name === tailnet.self.name;
 		if (!machine.online) {
 			yield* ledger.skip(machine.name, "offline");
@@ -65496,15 +66209,25 @@ const ship = fn("ship")(function* (flags) {
 			yield* ledger.skip(machine.name, "no Tailscale SSH server");
 			return;
 		}
-		const script = gatherScript({
-			cloneRoot: cloneRootOf(machine),
-			repos: gatherRepos
+		const identity = {
+			name: machine.name,
+			platform: machine.platform
+		};
+		const script = checkScript({
+			scope: {
+				machine: identity,
+				config
+			},
+			providers: providers.map((provider) => ({
+				provider,
+				items: targetedItems(provider, config, identity)
+			}))
 		});
-		const result = yield* gather({
+		const result = yield* check({
 			name: machine.name,
 			local
 		}, script, ledger);
-		if (result.kind !== "gathered") return void 0;
+		if (result.kind !== "checked") return void 0;
 		yield* ledger.checked(machine.name);
 		return {
 			machine,
@@ -65512,60 +66235,109 @@ const ship = fn("ship")(function* (flags) {
 			state: result.state
 		};
 	}), { concurrency: "unbounded" }).pipe(map$5((list) => list.filter((g) => g !== void 0)));
-	const stale = yield* staleConfigs(config, flags.config === void 0, gathered, ledger);
+	const stale = yield* staleConfigs(config, own, checked, ledger);
 	if (stale.length > 0) {
-		const what = `newer config on ${stale.join(", ")}`;
+		const what = `newer config on ${stale.map((s) => s.description).join(", ")}`;
+		const answers = stale.flatMap((s) => s.machines).map((m) => given("config", m));
 		if (flags.dryRun) yield* ledger.note("info", `${what}; a Ship would ask before overwriting it`);
-		else if (flags.overwriteConfig) yield* ledger.note("info", `${what}; overwriting it (--overwrite-config)`);
+		else if (answers.every((a) => a === "overwrite")) yield* ledger.note("info", `${what}; overwriting it, as answered`);
+		else if (answers.includes("stop")) return yield* fail$1(new ShipError("aborted: the config here is older"));
 		else if (live.ask === void 0) return yield* fail$1(new ShipError(`${what}; copy it here first, or pass --overwrite-config`));
 		else {
+			const usable = [];
+			for (const s of stale) {
+				const why = unshippable(s.config, tailnet, flags.only, `the config on ${s.machines[0]}`);
+				if (why === void 0) usable.push(s);
+				else yield* ledger.note("info", `cannot ship from here: ${why}`);
+			}
 			yield* ledger.note("ask", what);
-			const overwrite = yield* live.ask([{
-				title: "overwrite it with this Machine's config",
-				value: true
-			}, {
-				title: "stop",
-				value: false
-			}]);
-			yield* ledger.note("answer", overwrite ? "overwrite it" : "stop");
-			if (!overwrite) return yield* fail$1(new ShipError("aborted: the config here is older"));
+			const choice = yield* live.ask([
+				...usable.map((s) => ({
+					title: `use the config on ${s.machines[0]} (replaces this one)`,
+					value: s
+				})),
+				{
+					title: "overwrite it with this Machine's config",
+					value: "overwrite"
+				},
+				{
+					title: "stop",
+					value: "stop"
+				}
+			]);
+			if (choice === "stop") {
+				yield* ledger.note("answer", "stop");
+				return yield* fail$1(new ShipError("aborted: the config here is older"));
+			}
+			if (choice === "overwrite") yield* ledger.note("answer", "overwrite it");
+			else {
+				yield* ledger.note("answer", `use the config on ${choice.machines[0]}`);
+				yield* fs.writeFileString(path, choice.text);
+				adopted = true;
+				return "adopted";
+			}
 		}
 	}
-	const versions = yield* resolveVersions(packagesToResolve(config));
-	const planAll = (cfg, answers) => gathered.map((g) => ({
+	const targeted = providers.map((provider) => {
+		const items = /* @__PURE__ */ new Map();
+		for (const { machine } of checked) for (const item of targetedItems(provider, config, machine)) items.set(item.name, item);
+		return {
+			provider,
+			items: [...items.values()]
+		};
+	});
+	const lent = targeted.some(({ provider, items }) => provider.name === "repos" && items.length > 0) ? yield* readLentToken() : { token: void 0 };
+	if (lent.token === void 0 && lent.reason !== void 0) yield* ledger.note("info", `no gh token (${lent.reason}); private repos will fail`);
+	const resolved = Object.fromEntries(yield* forEach$1(targeted, ({ provider, items }) => provider.resolve(items, lent.token === void 0 ? {} : { token: lent.token }).pipe(map$5((r) => [provider.name, r])), { concurrency: "unbounded" }));
+	const planAll = (cfg, answer) => checked.map((g) => ({
 		...g,
-		plan: plan({
-			config: cfg,
-			machine: {
-				name: g.machine.name,
-				platform: g.machine.platform
-			},
+		plan: planMachine({
+			providers,
 			state: g.state,
-			self: flags.version,
-			versions,
-			rebuild: rebuildOf(flags),
-			answers
+			resolved,
+			ctx: {
+				machine: {
+					name: g.machine.name,
+					platform: g.machine.platform
+				},
+				config: cfg,
+				self: flags.version,
+				rebuild: (address) => flags.rebuild.includes("all") || flags.rebuild.includes(address),
+				answer
+			}
 		})
 	}));
 	let cfg = config;
-	let planned = planAll(cfg, {});
-	const questions = planned.flatMap((g) => g.plan.questions);
-	if (questions.length > 0 && flags.dryRun) for (const q of questions) {
-		yield* ledger.note("ask", `${q.package} ${q.installed} on ${q.machine} is above ${q.range}`);
-		yield* ledger.note("answer", "not asked (dry run)");
-	}
-	if (questions.length > 0 && !flags.dryRun) {
-		const decided = yield* askQuestions(questions, flags, ledger, live.ask);
-		for (const [pkg, decision] of Object.entries(decided)) {
-			if (decision.kind !== "bump") continue;
+	const decided = /* @__PURE__ */ new Map();
+	const answer = (kind, subject) => decided.get(`${kind}:${subject}`) ?? given(kind, subject);
+	let planned = planAll(cfg, answer);
+	for (;;) {
+		const asked = planned.flatMap((g) => g.plan.providers.flatMap((pp) => pp.decisions.flatMap((d) => d.kind === "ask" ? [{
+			machine: g.machine.name,
+			question: d.question
+		}] : [])));
+		const answered = yield* askQuestions({
+			asked,
+			answer,
+			ledger,
+			ask: live.ask,
+			dryRun: flags.dryRun
+		});
+		let progressed = false;
+		for (const { question, newest, answer: choice } of answered) {
+			const key = `${question.kind}:${question.subject}`;
+			progressed ||= !decided.has(key);
+			decided.set(key, choice);
+			if (choice !== "bump" || question.bump === void 0) continue;
 			changing = true;
-			yield* bumpConfig(path, pkg, decision.installed);
+			const range = yield* bumpConfig(path, question.bump.path, newest);
+			progressed ||= range !== question.bump.range;
+			cfg = yield* loadConfig(path);
 		}
-		if (Object.values(decided).some((d) => d.kind === "bump")) cfg = yield* loadConfig(path);
-		const answers = Object.fromEntries(Object.entries(decided).flatMap(([pkg, d]) => d.kind === "bump" ? [] : [[pkg, d.kind]]));
-		planned = planAll(cfg, answers);
+		if (!progressed) break;
+		planned = planAll(cfg, answer);
 	}
-	for (const { machine, plan: p, state } of planned) yield* ledger.plan(machine.name, p, state);
+	for (const { machine, plan: p } of planned) yield* ledger.plan(machine.name, p);
 	if (flags.dryRun) return;
 	const shippedAt = formatIso(yield* now);
 	changing = true;
@@ -65573,49 +66345,42 @@ const ship = fn("ship")(function* (flags) {
 	const stampWith = (reached) => stampText(original, {
 		shippedAt,
 		shippedFrom: tailnet.self.name,
-		reached: [...reached, ...flags.config === void 0 ? [tailnet.self.name] : []]
+		reached,
+		own
 	});
 	const stamped = stampWith(planned.map((g) => g.machine.name));
 	yield* fs.writeFileString(path, stamped);
 	const schema = `${schemaJson(fleetConfigJsonSchema())}\n`;
-	const lent = planned.some((g) => g.plan.repos.length > 0) ? yield* readLentToken() : { token: void 0 };
-	if (lent.token === void 0 && lent.reason !== void 0) yield* ledger.note("info", `no gh token (${lent.reason}); private repos will fail`);
-	const machineNames = [...fleet];
 	const stdin = applyStdin(lent.token, stamped, schema);
 	const delivered = yield* forEach$1(planned, fn("applyOne")(function* ({ machine, local, plan: p }) {
-		const script = applyScript({
-			plan: p,
-			cloneRoot: cloneRootOf(machine),
-			env: {
-				machine: machine.name,
-				platform: machine.platform,
-				machines: machineNames
-			}
-		});
 		return (yield* apply({
 			name: machine.name,
 			local
-		}, p, script, stdin, ledger)).done.includes("config") ? machine.name : void 0;
+		}, p, applyScript(p), stdin, ledger)).done.includes("config") ? machine.name : void 0;
 	}), { concurrency: "unbounded" }).pipe(map$5((list) => list.filter((name) => name !== void 0)));
 	yield* fs.writeFileString(path, stampWith(delivered));
 }, scoped);
 //#endregion
-//#region src/bin.ts
+//#region src/command.ts
 const shipCommand = make("ship", {
 	dryRun: Boolean$1("dry-run").pipe(withDefault(false), withDescription$1("Check and plan only. Print every Machine's plan and change nothing.")),
-	only: String$1("only").pipe(atLeast(0), withDescription$1("Ship only to these Machines (repeat the flag).")),
-	rebuild: String$1("rebuild").pipe(atLeast(0), withDescription$1("Run a repo's Install Command even when its record matches; `all` for every repo.")),
-	bump: Boolean$1("bump").pipe(withDefault(false), withDescription$1("Answer every above-range question by bumping the config.")),
-	enforce: Boolean$1("enforce").pipe(withDefault(false), withDescription$1("Answer every above-range question by downgrading into the range.")),
-	overwriteConfig: Boolean$1("overwrite-config").pipe(withDefault(false), withDescription$1("Ship even when another Machine holds a newer config, overwriting it with this one.")),
-	config: String$1("config").pipe(optional, withDescription$1("Config file. Default: $XDG_CONFIG_HOME/fleetfizz/config.jsonc."))
+	only: String$1("only").pipe(atLeast(0), withMetavar("machine"), withDescription$1("Ship only to this Machine. Repeat the flag for more.")),
+	rebuild: String$1("rebuild").pipe(atLeast(0), withMetavar("item"), withDescription$1("Rebuild a record Item (`repos:<name>`) even when it is up to date. `all` for every one.")),
+	answer: String$1("answer").pipe(atLeast(0), withMetavar("answer"), withDescription$1("Answer a Question in advance: `kind=choice` or `kind:subject=choice`. Repeat the flag for more.")),
+	bump: Boolean$1("bump").pipe(withDefault(false), withDescription$1("Answer every above-range Question by bumping the config (`--answer range=bump`).")),
+	enforce: Boolean$1("enforce").pipe(withDefault(false), withDescription$1("Answer every above-range Question by downgrading into the Range (`--answer range=downgrade`).")),
+	overwriteConfig: Boolean$1("overwrite-config").pipe(withDefault(false), withDescription$1("Ship even when another Machine holds a newer config, overwriting it (`--answer config=overwrite`).")),
+	config: String$1("config").pipe(optional, withMetavar("path"), withDescription$1("The config file. Default: `$XDG_CONFIG_HOME/fleetfizz/config.jsonc`."))
 }).pipe(withDescription("Ship the config to every reachable Machine."), withHandler((flags) => ship({
 	dryRun: flags.dryRun,
 	only: flags.only,
 	rebuild: flags.rebuild,
-	bump: flags.bump,
-	enforce: flags.enforce,
-	overwriteConfig: flags.overwriteConfig,
+	answers: [
+		...flags.answer,
+		...flags.bump ? ["range=bump"] : [],
+		...flags.enforce ? ["range=downgrade"] : [],
+		...flags.overwriteConfig ? ["config=overwrite"] : []
+	],
 	config: flags.config._tag === "Some" ? flags.config.value : void 0,
 	version
 }).pipe(catch_((e) => gen(function* () {
@@ -65623,6 +66388,8 @@ const shipCommand = make("ship", {
 	process.exitCode = 1;
 })))));
 const reportCommand = make("report", {}).pipe(withDescription("Print the full Ledger of the last Ship from this Machine."), withHandler(() => report()));
+//#endregion
+//#region src/bin.ts
 run(make("fizz").pipe(withDescription("Keep every Machine on your tailnet in line with one config."), withSubcommands([shipCommand, reportCommand])), { version }).pipe(provide(layer), runMain);
 //#endregion
 export {};