fleetfizz 0.9.1 → 0.10.0

package/dist/fleetfizz.mjs

@@ -1849,7 +1849,7 @@ const emptyContext$1 = {
 * @category formatting
 * @since 2.0.0
 */
-function format$2(input, options) {
+function format$3(input, options) {
 	const space = options?.space ?? 0;
 	const ancestors = /* @__PURE__ */ new WeakSet();
 	const gap = !space ? "" : typeof space === "number" ? " ".repeat(space) : space;
@@ -2012,7 +2012,7 @@ function formatJson(input, options) {
 	return JSON.stringify(input, function(key, value) {
 		const original = Object.getOwnPropertyDescriptor(this, key)?.value;
 		const redacted = hasProperty(original, symbolRedactable) ? redact(original) : redact(value);
-		if (typeof redacted === "bigint") return format$2(redacted);
+		if (typeof redacted === "bigint") return format$3(redacted);
 		if (typeof redacted !== "object" || redacted === null) return redacted;
 		const current = redacted instanceof Error && !hasProperty(redacted, "toJSON") ? {
 			...redacted,
@@ -2148,7 +2148,7 @@ const toJson = (input) => {
 const toStringUnknown = (u, whitespace = 2) => {
 	if (typeof u === "string") return u;
 	try {
-		return typeof u === "object" ? formatJson(u, { space: whitespace }) : format$2(u, { space: whitespace });
+		return typeof u === "object" ? formatJson(u, { space: whitespace }) : format$3(u, { space: whitespace });
 	} catch {
 		return String(u);
 	}
@@ -2198,7 +2198,7 @@ const BaseProto = {
 		return this.toJSON();
 	},
 	toString() {
-		return format$2(this.toJSON());
+		return format$3(this.toJSON());
 	}
 };
 //#endregion
@@ -2361,7 +2361,7 @@ const PipeInspectableProto = {
 		return { ...this };
 	},
 	toString() {
-		return format$2(this.toJSON(), {
+		return format$3(this.toJSON(), {
 			ignoreToString: true,
 			space: 2
 		});
@@ -2411,7 +2411,7 @@ var CauseImpl = class {
 		};
 	}
 	toString() {
-		return `Cause(${format$2(this.reasons)})`;
+		return `Cause(${format$3(this.reasons)})`;
 	}
 	[NodeInspectSymbol]() {
 		return this.toJSON();
@@ -2454,7 +2454,7 @@ var ReasonBase = class {
 		return pipeArguments(this, arguments);
 	}
 	toString() {
-		return format$2(this);
+		return format$3(this);
 	}
 	[NodeInspectSymbol]() {
 		return this.toString();
@@ -2469,7 +2469,7 @@ var Fail = class extends ReasonBase {
 		this.error = error;
 	}
 	toString() {
-		return `Fail(${format$2(this.error)})`;
+		return `Fail(${format$3(this.error)})`;
 	}
 	toJSON() {
 		return {
@@ -2517,7 +2517,7 @@ var Die = class extends ReasonBase {
 		this.defect = defect;
 	}
 	toString() {
-		return `Die(${format$2(this.defect)})`;
+		return `Die(${format$3(this.defect)})`;
 	}
 	toJSON() {
 		return {
@@ -2578,7 +2578,7 @@ const makeExit = (options) => {
 		},
 		...makePrimitiveProto(options),
 		toString() {
-			return `${options.op}(${format$2(this[args])})`;
+			return `${options.op}(${format$3(this[args])})`;
 		},
 		toJSON() {
 			return {
@@ -2768,7 +2768,7 @@ const SomeProto = /*#__PURE__*/ Object.defineProperty(/*#__PURE__*/ Object.assig
 		return combine$1(hash(this._tag))(hash(this.value));
 	},
 	toString() {
-		return `some(${format$2(this.value)})`;
+		return `some(${format$3(this.value)})`;
 	},
 	toJSON() {
 		return {
@@ -2840,7 +2840,7 @@ const SuccessProto = /*#__PURE__*/ Object.assign(/*#__PURE__*/ Object.create(Com
 		return combine$1(hash(this._tag))(hash(this.success));
 	},
 	toString() {
-		return `success(${format$2(this.success)})`;
+		return `success(${format$3(this.success)})`;
 	},
 	toJSON() {
 		return {
@@ -2860,7 +2860,7 @@ const FailureProto = /*#__PURE__*/ Object.assign(/*#__PURE__*/ Object.create(Com
 		return combine$1(hash(this._tag))(hash(this.failure));
 	},
 	toString() {
-		return `failure(${format$2(this.failure)})`;
+		return `failure(${format$3(this.failure)})`;
 	},
 	toJSON() {
 		return {
@@ -4720,7 +4720,10 @@ const bigint0$3 = /*#__PURE__*/ BigInt(0);
 const bigint1$2 = /*#__PURE__*/ BigInt(1);
 const bigint2 = /*#__PURE__*/ BigInt(2);
 const bigint10$1 = /*#__PURE__*/ BigInt(10);
+const bigint24 = /*#__PURE__*/ BigInt(24);
+const bigint60 = /*#__PURE__*/ BigInt(60);
 const bigint1e3 = /*#__PURE__*/ BigInt(1e3);
+const bigint1e6 = /*#__PURE__*/ BigInt(1e6);
 const roundTiesAwayFromZero = (input) => BigInt(input < 0 ? Math.ceil(input - .5) : Math.floor(input + .5));
 const roundMillisToNanos = (millis) => roundTiesAwayFromZero(millis * 1e6);
 const parseNanos = (input, scale) => {
@@ -4930,6 +4933,79 @@ const isDuration = (u) => hasProperty(u, TypeId$32);
 */
 const isFinite$1 = (self) => self.value._tag !== "Infinity" && self.value._tag !== "NegativeInfinity";
 /**
+* Checks whether a Duration is zero.
+*
+* **Example** (Checking for zero durations)
+*
+* ```ts import.meta.vitest
+* import { Duration } from "effect"
+*
+* Duration.isZero(Duration.zero) // => true
+* Duration.isZero(Duration.seconds(1)) // => false
+* ```
+*
+* @stability stable
+* @category predicates
+* @since 3.5.0
+*/
+const isZero$1 = (self) => {
+	switch (self.value._tag) {
+		case "Millis": return self.value.millis === 0;
+		case "Nanos": return self.value.nanos === bigint0$3;
+		case "Infinity":
+		case "NegativeInfinity": return false;
+	}
+};
+/**
+* Returns `true` if the duration is negative (strictly less than zero).
+*
+* **Example** (Checking for negative durations)
+*
+* ```ts import.meta.vitest
+* import { Duration } from "effect"
+*
+* Duration.isNegative(Duration.seconds(-5)) // => true
+* Duration.isNegative(Duration.zero) // => false
+* Duration.isNegative(Duration.negativeInfinity) // => true
+* ```
+*
+* @stability stable
+* @category predicates
+* @since 4.0.0
+*/
+const isNegative = (self) => {
+	switch (self.value._tag) {
+		case "Millis": return self.value.millis < 0;
+		case "Nanos": return self.value.nanos < bigint0$3;
+		case "NegativeInfinity": return true;
+		case "Infinity": return false;
+	}
+};
+/**
+* Returns the absolute value of the duration.
+*
+* **Example** (Taking absolute duration values)
+*
+* ```ts import.meta.vitest
+* import { Duration } from "effect"
+*
+* Duration.abs(Duration.seconds(-5)) // => Duration.seconds(5)
+* Duration.abs(Duration.negativeInfinity) // => Duration.infinity
+* ```
+*
+* @stability stable
+* @category math
+* @since 4.0.0
+*/
+const abs = (self) => {
+	switch (self.value._tag) {
+		case "Infinity":
+		case "NegativeInfinity": return infinity;
+		case "Millis": return self.value.millis < 0 ? make$27(-self.value.millis) : self;
+		case "Nanos": return self.value.nanos < bigint0$3 ? make$27(-self.value.nanos) : self;
+	}
+};
+/**
 * A Duration representing zero time.
 *
 * **Example** (Referencing the zero duration)
@@ -5245,6 +5321,104 @@ const Equivalence$1 = (self, that) => matchPair(self, that, {
 * @since 2.0.0
 */
 const equals = /*#__PURE__*/ dual(2, (self, that) => Equivalence$1(self, that));
+/**
+* Decomposes a `Duration` into normalized signed components.
+*
+* **Details**
+*
+* Finite durations are returned as `{ days, hours, minutes, seconds, millis,
+* nanos }`. Infinite durations return every component as `Infinity` or
+* `-Infinity`.
+*
+* **Example** (Decomposing durations into parts)
+*
+* ```ts import.meta.vitest
+* import { Duration } from "effect"
+*
+* // Create a complex duration by adding multiple parts
+* const duration = Duration.sum(
+*   Duration.sum(
+*     Duration.sum(Duration.days(1), Duration.hours(2)),
+*     Duration.sum(Duration.minutes(30), Duration.seconds(45))
+*   ),
+*   Duration.millis(123)
+* )
+* Duration.parts(duration) // => ({ days: 1, hours: 2, minutes: 30, seconds: 45, millis: 123, nanos: 0 })
+*
+* const complex = Duration.sum(Duration.hours(25), Duration.minutes(90))
+* Duration.parts(complex) // => ({ days: 1, hours: 2, minutes: 30, seconds: 0, millis: 0, nanos: 0 })
+* ```
+*
+* @stability stable
+* @category converting
+* @since 3.8.0
+*/
+const parts = (self) => {
+	if (self.value._tag === "Infinity") return {
+		days: Infinity,
+		hours: Infinity,
+		minutes: Infinity,
+		seconds: Infinity,
+		millis: Infinity,
+		nanos: Infinity
+	};
+	if (self.value._tag === "NegativeInfinity") return {
+		days: -Infinity,
+		hours: -Infinity,
+		minutes: -Infinity,
+		seconds: -Infinity,
+		millis: -Infinity,
+		nanos: -Infinity
+	};
+	const n = toNanosUnsafe(self);
+	const neg = n < bigint0$3;
+	const a = neg ? -n : n;
+	const ms = a / bigint1e6;
+	const sec = ms / bigint1e3;
+	const min = sec / bigint60;
+	const hr = min / bigint60;
+	const d = hr / bigint24;
+	const sign = neg ? -1 : 1;
+	return {
+		days: sign * Number(d),
+		hours: sign * Number(hr % bigint24),
+		minutes: sign * Number(min % bigint60),
+		seconds: sign * Number(sec % bigint60),
+		millis: sign * Number(ms % bigint1e3),
+		nanos: sign * Number(a % bigint1e6)
+	};
+};
+/**
+* Converts a `Duration` to a human readable string.
+*
+* **Example** (Formatting durations)
+*
+* ```ts import.meta.vitest
+* import { Duration } from "effect"
+*
+* Duration.format(Duration.millis(1000)) // => "1s"
+* Duration.format(Duration.millis(1001)) // => "1s 1ms"
+* ```
+*
+* @stability stable
+* @category converting
+* @since 2.0.0
+*/
+const format$2 = (self) => {
+	if (self.value._tag === "Infinity") return "Infinity";
+	if (self.value._tag === "NegativeInfinity") return "-Infinity";
+	if (isZero$1(self)) return "0";
+	if (isNegative(self)) return "-" + format$2(abs(self));
+	const fragments = parts(self);
+	const pieces = [];
+	if (fragments.days !== 0) pieces.push(`${fragments.days}d`);
+	if (fragments.hours !== 0) pieces.push(`${fragments.hours}h`);
+	if (fragments.minutes !== 0) pieces.push(`${fragments.minutes}m`);
+	if (fragments.seconds !== 0) pieces.push(`${fragments.seconds}s`);
+	if (fragments.millis !== 0) pieces.push(`${fragments.millis}ms`);
+	if (fragments.nanos !== 0) pieces.push(`${fragments.nanos}ns`);
+	return pieces.join(" ");
+};
 //#endregion
 //#region ../../node_modules/.pnpm/effect@4.0.2/node_modules/effect/dist/Scheduler.js
 /**
@@ -7057,6 +7231,16 @@ const exitPrimitive = /*#__PURE__*/ makePrimitive$1({
 /** @internal */
 const timeoutOrElse$1 = /*#__PURE__*/ dual(2, (self, options) => flatMap$2(timeoutOption(self, options.duration), (option) => isNone(option) ? options.orElse() : succeed$6(option.value)));
 /** @internal */
+const timeoutErrorFromDuration = (duration) => new TimeoutError(`Operation timed out after '${format$2(duration)}'`);
+/** @internal */
+const timeout$1 = /*#__PURE__*/ dual(2, (self, duration) => {
+	const decoded = fromInputUnsafe$1(duration);
+	return timeoutOrElse$1(self, {
+		duration: decoded,
+		orElse: () => fail$4(timeoutErrorFromDuration(decoded))
+	});
+});
+/** @internal */
 const timeoutOption = /*#__PURE__*/ dual(2, (self, duration) => raceFirst$1(asSome(self), as$1(sleep$1(duration), none())));
 /** @internal */
 const ScopeTypeId = "~effect/Scope";
@@ -7809,6 +7993,15 @@ const sleep$1 = (duration) => clockWith$1((clock) => clock.sleep(fromInputUnsafe
 /** @internal */
 const currentTimeMillis$1 = /*#__PURE__*/ clockWith$1((clock) => clock.currentTimeMillis);
 /** @internal */
+const TimeoutErrorTypeId = "~effect/Cause/TimeoutError";
+/** @internal */
+var TimeoutError = class extends (/*#__PURE__*/ TaggedError$2("TimeoutError")) {
+	[TimeoutErrorTypeId] = TimeoutErrorTypeId;
+	constructor(message) {
+		super({ message });
+	}
+};
+/** @internal */
 const IllegalArgumentErrorTypeId = "~effect/Cause/IllegalArgumentError";
 /** @internal */
 var IllegalArgumentError$1 = class extends (/*#__PURE__*/ TaggedError$2("IllegalArgumentError")) {
@@ -11846,6 +12039,45 @@ const ignore = ignore$1;
 */
 const orElseSucceed = orElseSucceed$1;
 /**
+* Adds a time limit to an effect, triggering a timeout if the effect exceeds
+* the duration.
+*
+* **When to use**
+*
+* Use when you need a timeout of an `Effect` to be represented as a typed
+* failure.
+*
+* **Details**
+*
+* The `timeout` function allows you to specify a time limit for an
+* effect's execution. If the effect does not complete within the given time, a
+* `TimeoutError` is raised. This can be useful for controlling how long your
+* program waits for a task to finish, ensuring that it doesn't hang
+* indefinitely if the task takes too long.
+*
+* **Gotchas**
+*
+* If the timeout wins, the source effect is interrupted.
+*
+* **Example** (Failing when work takes too long)
+*
+* ```ts import.meta.vitest
+* import { Effect } from "effect"
+*
+* const timedEffect = Effect.never.pipe(Effect.timeout(0))
+* const error = await Effect.runPromise(Effect.flip(timedEffect))
+* error._tag // => "TimeoutError"
+* ```
+*
+* @see {@link timeoutOption} for returning `Option.none` on timeout.
+* @see {@link timeoutOrElse} for a version that allows specifying both success and timeout handlers.
+*
+* @stability stable
+* @category delays & timeouts
+* @since 2.0.0
+*/
+const timeout = timeout$1;
+/**
 * Applies a timeout to an effect, lazily evaluating `orElse` after interrupting
 * the source if the timeout is reached.
 *
@@ -18066,7 +18298,7 @@ const defaultLeafHook = (issue) => {
 */
 const defaultCheckHook = (issue) => findMessage(issue.issue) ?? findMessage(issue);
 function formatInput(issue) {
-	return hasInput(issue) ? format$2(issue.input) : void 0;
+	return hasInput(issue) ? format$3(issue.input) : void 0;
 }
 function findExpected(issue) {
 	const expected = issue.annotations?.expected;
@@ -18978,9 +19210,9 @@ const decodeJsonError = (input) => {
 const encodeUnknownAsJson = (input) => {
 	try {
 		const json = formatJson(input);
-		return json === void 0 ? format$2(input) : JSON.parse(json);
+		return json === void 0 ? format$3(input) : JSON.parse(json);
 	} catch {
-		return format$2(input);
+		return format$3(input);
 	}
 };
 const encodeJsonError = (input, options, encodeDefect) => {
@@ -19346,7 +19578,7 @@ const Literal$1 = class extends ASTNodeImpl {
 	literal;
 	constructor(literal, annotations, checks, encoding, context) {
 		super(annotations, checks, encoding, context);
-		if (typeof literal === "number" && !globalThis.Number.isFinite(literal)) throw new Error(`A numeric literal must be finite, got ${format$2(literal)}`);
+		if (typeof literal === "number" && !globalThis.Number.isFinite(literal)) throw new Error(`A numeric literal must be finite, got ${format$3(literal)}`);
 		this.literal = literal;
 	}
 	/** @internal */
@@ -25686,7 +25918,7 @@ function isPattern(regExp, annotations) {
 	const source = regExp.source;
 	const flags = regExp.flags;
 	const canExport = /^[dg]*uy?$/.test(flags);
-	const runtimeRegExp = flags === "" ? `new RegExp(${format$2(source)})` : `new RegExp(${format$2(source)}, ${format$2(flags)})`;
+	const runtimeRegExp = flags === "" ? `new RegExp(${format$3(source)})` : `new RegExp(${format$3(source)}, ${format$3(flags)})`;
 	return isPattern$1(regExp, {
 		toJsonSchema: () => canExport ? { pattern: flags.endsWith("y") ? `^(?:${source})` : source } : [{}, true],
 		toCode: () => ({ runtime: `Schema.isPattern(${runtimeRegExp})` }),
@@ -27118,7 +27350,7 @@ const String$5 = /*#__PURE__*/ makePrimitive("String", (value) => succeed$3(valu
 */
 const Choice = (choices) => {
 	const choiceMap = new Map(choices);
-	const validChoices = choices.map(([key]) => format$2(key)).join(" | ");
+	const validChoices = choices.map(([key]) => format$3(key)).join(" | ");
 	const primitive = makePrimitive("Choice", (value) => {
 		if (choiceMap.has(value)) return succeed$3(choiceMap.get(value));
 		return fail$1(validChoices);
@@ -33032,7 +33264,7 @@ const runWith = (command, config) => {
 };
 //#endregion
 //#region package.json
-var version = "0.9.1";
+var version = "0.10.0";
 //#endregion
 //#region ../../node_modules/.pnpm/effect@4.0.2/node_modules/effect/dist/Logger.js
 const TypeId = "~effect/Logger";
@@ -33877,7 +34109,7 @@ var ParseOptions;
 * Parses the given text and returns the object the JSON content represents. On invalid input, the parser tries to be as fault tolerant as possible, but still return a result.
 * Therefore always check the errors list to find out if the input was valid.
 */
-function parse$1(text, errors = [], options = ParseOptions.DEFAULT) {
+function parse$2(text, errors = [], options = ParseOptions.DEFAULT) {
 	let currentProperty = null;
 	let currentParent = [];
 	const previousParents = [];
@@ -34453,7 +34685,7 @@ var SyntaxKind;
 * Parses the given text and returns the object the JSON content represents. On invalid input, the parser tries to be as fault tolerant as possible, but still return a result.
 * Therefore, always check the errors list to find out if the input was valid.
 */
-const parse = parse$1;
+const parse$1 = parse$2;
 /**
 * Parses the given text and returns a tree representation the JSON content. On invalid input, the parser tries to be as fault tolerant as possible, but still return a result.
 */
@@ -35989,6 +36221,7 @@ const Origin = String$6.check(isPattern(/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/, {
 const Ref = NonEmptyString;
 const isPin = (ref) => /^[0-9a-f]{40}$/.test(ref);
 const ProviderName = Literals$2([
+	"files",
 	"vp",
 	"brew",
 	"cask",
@@ -36072,12 +36305,41 @@ const ReposSection = section({ cloneRoot: optionalKey(variants(withShorthand(Str
 	decode: (path) => ({ path }),
 	encode: (root) => root.path
 }))).annotateKey({ description: `Where a Machine keeps its Managed Clones: a path, or a list of \`{ path, platforms?, machines? }\` where a Machine gets the first that targets it. \`~\` expands on that Machine. Default: \`${DEFAULT_CLONE_ROOT}\`.` }) }, Record(NonEmptyString, variants(TrackedRepo)), `Tracked Repos, keyed by name, which names the Managed Clone and the \`repos:<name>\` Item. Each is \`{ origin, ref, install, ... }\`, ${VARIANTS}.`);
+const HomePath = NonEmptyString.check(isPattern(/^(\/|~\/)./, {
+	title: "path",
+	description: "an absolute path, or one under ~"
+}));
+const OWN_DIRS = ["~/.config/fleetfizz", "~/.local/state/fleetfizz"];
+const SharedFilePath = HomePath.check(makeFilter((path) => {
+	const p = path.replace(/\/+$/, "");
+	const dir = OWN_DIRS.find((d) => p === "~" || d === p || d.startsWith(`${p}/`) || p.startsWith(`${d}/`));
+	return dir === void 0 || `overlaps ${dir}, which a Ship writes itself`;
+}, {
+	title: "Shared File path",
+	description: "a path outside fleetfizz's own directories"
+}));
+const SharedFile = Struct({
+	...Targeting,
+	path: SharedFilePath.annotateKey({ description: "A file or directory, absolute or under `~`, which expands on each Machine." }),
+	exclude: optionalKey(ArraySchema(NonEmptyString)).annotateKey({ description: "Globs inside a directory that are neither copied nor deleted. One without a `/` matches a name at any depth. `.DS_Store` and `._*` are always excluded. Every Variant of one Shared File has the same exclude." })
+});
+const sameExclude = (a, b) => [...new Set(a.exclude ?? [])].toSorted().join("\n") === [...new Set(b.exclude ?? [])].toSorted().join("\n");
+const FilesSection = section({}, Record(NonEmptyString, variants(withShorthand(SharedFile, SharedFilePath, {
+	decode: (path) => ({ path }),
+	encode: (file) => file.path
+}))).check(makeFilter((items) => {
+	const badName = Object.keys(items).find((n) => !/^[A-Za-z0-9._-]+$/.test(n) || n === "." || n === "..");
+	if (badName !== void 0) return `"${badName}": a Shared File's name uses only letters, digits, ., _ and -, and is not . or ..`;
+	const name = Object.entries(items).find(([, item]) => Array.isArray(item) && item.some((v) => !sameExclude(v, item[0])))?.[0];
+	return name === void 0 || `"${name}": every Variant needs the same exclude`;
+}, {
+	title: "Shared Files",
+	description: "names of letters, digits, ., _ and -, and one exclude across a Shared File's Variants"
+})), `Shared Files, keyed by name, which names the \`files:<name>\` Item. Each is a path, \`{ path, exclude?, platforms?, machines? }\`, ${VARIANTS}.`);
 const FleetConfig = Struct({
 	$schema: optionalKey(String$6),
-	shippedAt: optionalKey(String$6),
-	shippedFrom: optionalKey(NonEmptyString),
-	shippedTo: optionalKey(Record(NonEmptyString, String$6)),
 	machines: ArraySchema(NonEmptyString).check(isMinLength(1, { message: "list at least one Machine" }), isUnique({ message: "list each Machine once" })).annotateKey({ description: "The Fleet: each Machine's tailnet name. A tailnet member that is not listed is not part of the Fleet." }),
+	files: optionalKey(FilesSection).annotateKey({ description: "Files and directories copied from the Starting Machine to every targeted Machine. A directory is mirrored." }),
 	repos: optionalKey(ReposSection).annotateKey({ description: "Each Tracked Repo is cloned on every targeted Machine and installed from its origin ref." }),
 	vp: optionalKey(VpSection).annotateKey({ description: "The vite-plus toolchain." }),
 	brew: optionalKey(BrewSection).annotateKey({ description: "Homebrew Formulae. Needs Homebrew on the Machine; a Ship never installs it." }),
@@ -36133,10 +36395,17 @@ const repeatedKeys = (text) => {
 	if (tree !== void 0) visit(tree, []);
 	return problems;
 };
+const STAMPS = [
+	"shippedAt",
+	"shippedFrom",
+	"shippedTo"
+];
 const movedKeys = (parsed) => {
 	if (typeof parsed !== "object" || parsed === null) return [];
 	const config = parsed;
+	const stamps = STAMPS.filter((key) => key in parsed);
 	return [
+		...stamps.length > 0 ? [`${stamps.join(", ")}: no longer written; a Ship keeps them in its Install Record now, so delete them`] : [],
 		...typeof config.machines === "object" && config.machines !== null && !Array.isArray(config.machines) ? ["machines is now a list of names, and machines.<name>.clones is repos.cloneRoot"] : [],
 		...Array.isArray(config.repos) ? ["repos is now { items: { <name>: { origin, ref, install } } }, keyed by each repo's name"] : [],
 		...typeof config.vp === "object" && config.vp !== null && "globals" in config.vp ? ["vp.globals is now vp.items"] : []
@@ -36144,7 +36413,7 @@ const movedKeys = (parsed) => {
 };
 const parseConfig = fn("parseConfig")(function* (path, text) {
 	const parseErrors = [];
-	const parsed = parse(text, parseErrors, { allowTrailingComma: true });
+	const parsed = parse$1(text, parseErrors, { allowTrailingComma: true });
 	if (parseErrors.length > 0) return yield* new ConfigError({
 		path,
 		problems: parseErrors.map((e) => `line ${lineOf(text, e.offset)}: ${printParseErrorCode(e.error)}`)
@@ -36171,49 +36440,26 @@ const loadConfig = fn("loadConfig")(function* (path) {
 	const text = yield* fs.readFileString(path);
 	return yield* parseConfig(path, text);
 });
-//#endregion
-//#region ../../packages/config/src/stamp.ts
-const insertAfter = (before) => (properties) => {
-	return before.map((key) => properties.indexOf(key)).reduce((a, b) => Math.max(a, b), -1) + 1;
-};
-const STAMP_KEYS = [
-	"$schema",
-	"shippedAt",
-	"shippedFrom",
-	"shippedTo"
-];
-const stampText = (text, stamp) => {
-	const options = { formattingOptions: {
-		insertSpaces: true,
-		tabSize: 2
-	} };
-	const set = (current, key, value) => applyEdits(current, modify(current, [key], value, {
-		...options,
-		getInsertionIndex: insertAfter(STAMP_KEYS.slice(0, STAMP_KEYS.indexOf(key)))
-	}));
-	const previous = parse(text, void 0, { allowTrailingComma: true });
-	const fleet = machinesOf(previous);
-	const shippedTo = {
-		...Object.fromEntries(Object.entries(shippedToOf(previous)).filter(([name]) => fleet.includes(name))),
-		...Object.fromEntries([...stamp.reached, ...stamp.own === void 0 ? [] : [stamp.own]].map((name) => [name, stamp.shippedAt]))
-	};
-	let out = set(text, "shippedAt", stamp.shippedAt);
-	out = set(out, "shippedFrom", stamp.shippedFrom);
-	return set(out, "shippedTo", shippedTo);
-};
-const machinesOf = (config) => {
-	if (typeof config !== "object" || config === null || !("machines" in config)) return [];
-	const value = config.machines;
-	return Array.isArray(value) ? value.filter((name) => typeof name === "string") : [];
-};
-const shippedToOf = (config) => {
-	if (typeof config !== "object" || config === null || !("shippedTo" in config)) return {};
-	const value = config.shippedTo;
-	if (typeof value !== "object" || value === null) return {};
-	return Object.fromEntries(Object.entries(value).filter((entry) => typeof entry[1] === "string"));
+const ConfigRecord = Struct({
+	ship: NonEmptyString,
+	sha: String$6,
+	reached: Record(NonEmptyString, String$6)
+});
+const decodeConfigRecord = decodeUnknownOption(ConfigRecord);
+const decodeConfigRecordJson = decodeUnknownOption(fromJsonString(ConfigRecord));
+const encodeConfigRecord = encodeSync(fromJsonString(ConfigRecord));
+const shaOf = (text) => promise(() => globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(text))).pipe(map$5((digest) => [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("")));
+const reachedAfter = (previous, at, machines, fleet) => ({
+	...Object.fromEntries(Object.entries(previous).filter(([name]) => fleet.includes(name))),
+	...Object.fromEntries(machines.map((name) => [name, at]))
+});
+const mergeReached = (all) => {
+	const merged = {};
+	for (const reached of all) for (const [name, at] of Object.entries(reached)) if (isNewer(at, merged[name])) merged[name] = at;
+	return merged;
 };
 const isNewer = (remote, local) => remote !== void 0 && (local === void 0 || remote > local);
-const staleCopies = (config, copies, own) => copies.filter((c) => c.machine !== own && isNewer(c.config.shippedTo?.[c.machine], config.shippedTo?.[c.machine]));
+const staleWhy = (copy, base) => copy.record === void 0 ? "unrecorded" : copy.record.sha !== copy.sha ? "edited" : isNewer(copy.record.reached[copy.machine], base[copy.machine]) ? "newer" : void 0;
 //#endregion
 //#region ../../packages/remote/src/shell.ts
 const quote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
@@ -36232,6 +36478,7 @@ const prelude = [
 	`export PATH="$PATH:/opt/homebrew/bin:/home/linuxbrew/.linuxbrew/bin"`,
 	`ff_json() { printf '%s' "$1" | sed -e 's/\\\\/\\\\\\\\/g' -e 's/"/\\\\"/g' | tr -d '\\n'; }`,
 	`ff_state() { printf 'ff-state %s\\n' "$1"; }`,
+	`ff_sha() { if command -v shasum >/dev/null 2>&1; then shasum -a 256; else sha256sum; fi | cut -d" " -f1; }`,
 	`ff_at() { ff_state "{\\"provider\\":\\"$(ff_json "$1")\\",\\"fact\\":\\"at\\",\\"item\\":\\"$(ff_json "$2")\\",\\"at\\":\\"$(ff_json "$3")\\"}"; }`
 ].join("\n");
 const fingerprintFn = [
@@ -36250,6 +36497,7 @@ const LOGS_DIR = `${STATE_DIR}/logs`;
 const CONFIG_DIR_SH = "\"${XDG_CONFIG_HOME:-$HOME/.config}/fleetfizz\"";
 const recordDir = (provider) => `${quotePath(RECORDS_DIR)}/${quote(provider)}`;
 const recordFile = (provider, item) => `${recordDir(provider)}/${quote(`${item}.json`)}`;
+const CONFIG_RECORD = `${RECORDS_DIR}/config.json`;
 const LEGACY_RECORD_PROVIDER = "repos";
 const recordFact = (provider, item) => [
 	`ff_r=${recordFile(provider, item)}`,
@@ -36266,7 +36514,7 @@ const checkScript = (input) => {
 		lines.push(provider.observe(items, input.scope));
 		if (provider.rule === "record") for (const item of items) lines.push(...recordFact(provider.name, item.name));
 	}
-	lines.push(`ff_c=${CONFIG_DIR_SH}/${quote(CONFIG_FILE)}`, `if [ -f "$ff_c" ]; then ff_state "{\\"fact\\":\\"config\\",\\"present\\":true,\\"base64\\":\\"$(base64 < "$ff_c" | tr -d '\\n')\\"}"; else ff_state '{"fact":"config","present":false}'; fi`);
+	lines.push(`ff_c=${CONFIG_DIR_SH}/${quote(CONFIG_FILE)}`, `if [ -f "$ff_c" ]; then ff_b=$(base64 < "$ff_c" | tr -d '\\n'); ff_state "{\\"fact\\":\\"config\\",\\"present\\":true,\\"sha\\":\\"$(printf '%s' "$ff_b" | base64 -d | ff_sha)\\",\\"base64\\":\\"$ff_b\\"}"; else ff_state '{"fact":"config","present":false}'; fi`, `ff_r=${quotePath(CONFIG_RECORD)}`, `if [ -f "$ff_r" ]; then ff_state "{\\"fact\\":\\"configRecord\\",\\"record\\":$(tr -d '\\n' < "$ff_r")}"; fi`);
 	lines.push(`ff_state '{"fact":"end"}'`);
 	return lines.join("\n");
 };
@@ -36283,7 +36531,7 @@ const StepSkip = Struct({
 	id: String$6,
 	reason: String$6
 });
-const decodeFact$3 = decodeUnknownResult(fromJsonString(Fact));
+const decodeFact$4 = decodeUnknownResult(fromJsonString(Fact));
 const decodeStart = decodeUnknownResult(fromJsonString(StepStart));
 const decodeDone = decodeUnknownResult(fromJsonString(StepDone));
 const decodeSkip = decodeUnknownResult(fromJsonString(StepSkip));
@@ -36293,7 +36541,7 @@ const DONE = "ff-done ";
 const SKIP = "ff-skip ";
 const parseLine = (line) => {
 	if (line.startsWith(STATE)) {
-		const result = decodeFact$3(line.slice(9));
+		const result = decodeFact$4(line.slice(9));
 		if (result._tag === "Success") return {
 			kind: "state",
 			fact: result.success
@@ -36339,12 +36587,14 @@ const marked = (id, run, failed = []) => [
 	doneLine(id, true),
 	"fi"
 ];
-const configStep = () => {
+const configStep = (record) => {
 	const dir = CONFIG_DIR_SH;
 	const write = (variable, file) => `printf '%s' "$${variable}" | base64 -d > ${dir}/${quote(`${file}.tmp`)} && mv -f ${dir}/${quote(`${file}.tmp`)} ${dir}/${quote(file)}`;
-	return marked(CONFIG_STEP, [`( mkdir -p ${dir} && ${write("ff_config", CONFIG_FILE)} && ${write("ff_schema", SCHEMA_FILE)} )`]);
+	const recordFile = quotePath(CONFIG_RECORD);
+	const recordTmp = quotePath(`${CONFIG_RECORD}.tmp`);
+	return marked(CONFIG_STEP, [`( mkdir -p ${dir} ${quotePath(RECORDS_DIR)} && ${write("ff_config", CONFIG_FILE)} && ${write("ff_schema", SCHEMA_FILE)} && printf '%s\\n' ${quote(record)} > ${recordTmp} && mv -f ${recordTmp} ${recordFile} )`]);
 };
-const providerSteps = (plan) => {
+const providerSteps = (plan, offsets) => {
 	if (plan.decisions.length === 0 && plan.steps.length === 0) return [];
 	const held = `ff_held_${plan.name}`;
 	const items = [...new Set(plan.steps.flatMap((step) => step.items))];
@@ -36353,6 +36603,7 @@ const providerSteps = (plan) => {
 		`if [ -n "${s.items.map((item) => `\${${flag(item)}:-}`).join("")}" ]; then`,
 		skipLine(s.id, "'an earlier step failed'"),
 		"else",
+		...(s.input ?? []).map((_, i) => `ff_input_${i}="$ff_in_${(offsets.get(s) ?? 0) + i}"`),
 		...marked(s.id, s.run, [...s.items.map((item) => `${flag(item)}=1`), `${held}=1`]),
 		"fi"
 	];
@@ -36368,10 +36619,21 @@ const providerSteps = (plan) => {
 		"fi"
 	];
 };
-const applyStdin = (token, config, schema) => [
+const inputsOf = (plan) => plan.providers.flatMap((p) => p.steps.flatMap((step) => step.input ?? []));
+const inputOffsets = (plan) => {
+	const offsets = /* @__PURE__ */ new Map();
+	let next = 0;
+	for (const step of plan.providers.flatMap((p) => p.steps)) {
+		offsets.set(step, next);
+		next += step.input?.length ?? 0;
+	}
+	return offsets;
+};
+const applyStdin = (token, config, schema, plan) => [
 	token ?? "",
 	encodeBase64(config),
-	encodeBase64(schema)
+	encodeBase64(schema),
+	...inputsOf(plan).map((input) => input.reveal())
 ];
 const encodeBase64 = (text) => {
 	const bytes = new TextEncoder().encode(text);
@@ -36379,18 +36641,30 @@ const encodeBase64 = (text) => {
 	for (const byte of bytes) binary += String.fromCharCode(byte);
 	return btoa(binary);
 };
-const applyScript = (plan) => [
+const applyScript = (plan, configRecord) => {
+	const offsets = inputOffsets(plan);
+	return [
+		prelude,
+		fingerprintFn,
+		`ff_lit() { printf '%s' "$1"; }`,
+		`IFS= read -r ff_token || ff_token=""`,
+		`IFS= read -r ff_config || ff_config=""`,
+		`IFS= read -r ff_schema || ff_schema=""`,
+		...inputsOf(plan).map((_, i) => `IFS= read -r ff_in_${i} || exit 1`),
+		`ff_git() { if [ -n "$ff_token" ]; then FF_TOKEN="$ff_token" git -c credential.helper= -c 'credential.helper=!f() { echo username=x-access-token; echo "password=$FF_TOKEN"; }; f' "$@"; else git "$@"; fi; }`,
+		...configStep(configRecord),
+		...plan.providers.flatMap((p) => providerSteps(p, offsets)),
+		doneLine("end", true)
+	].join("\n");
+};
+const stepScript = (step) => [
 	prelude,
 	fingerprintFn,
 	`ff_lit() { printf '%s' "$1"; }`,
-	`IFS= read -r ff_token || ff_token=""`,
-	`IFS= read -r ff_config || ff_config=""`,
-	`IFS= read -r ff_schema || ff_schema=""`,
-	`ff_git() { if [ -n "$ff_token" ]; then FF_TOKEN="$ff_token" git -c credential.helper= -c 'credential.helper=!f() { echo username=x-access-token; echo "password=$FF_TOKEN"; }; f' "$@"; else git "$@"; fi; }`,
-	...configStep(),
-	...plan.providers.flatMap(providerSteps),
-	doneLine("end", true)
+	...(step.input ?? []).flatMap((_, i) => [`IFS= read -r ff_in_${i} || ff_in_${i}=""`, `ff_input_${i}="$ff_in_${i}"`]),
+	...marked(step.id, step.run)
 ].join("\n");
+const stepStdin = (step) => (step.input ?? []).map((i) => i.reveal());
 //#endregion
 //#region ../../packages/remote/src/tailnet.ts
 const StatusNode = Struct({
@@ -36544,6 +36818,20 @@ const resolveVersions = fn("resolveVersions")(function* (packages) {
 	const entries = yield* forEach$1(unique, (pkg) => resolveOne(pkg).pipe(map$5((v) => [pkg, v])), { concurrency: 8 });
 	return Object.fromEntries(entries);
 });
+//#endregion
+//#region src/configRecord.ts
+const recordPath = () => CONFIG_RECORD.replace(/^~/, process.env.HOME ?? "~");
+const readConfigRecord = gen(function* () {
+	const text = yield* (yield* FileSystem).readFileString(recordPath()).pipe(option);
+	return getOrUndefined$1(flatMap$3(text, decodeConfigRecordJson));
+});
+const writeConfigRecord = fn("writeConfigRecord")(function* (json) {
+	const fs = yield* FileSystem;
+	const path = recordPath();
+	yield* fs.makeDirectory(path.slice(0, path.lastIndexOf("/")), { recursive: true });
+	yield* fs.writeFileString(`${path}.tmp`, `${json}\n`);
+	yield* fs.rename(`${path}.tmp`, path);
+});
 var LogsError = class extends Error {
 	name = "LogsError";
 };
@@ -36616,7 +36904,7 @@ const logs = fn("logs")(function* (flags) {
 		for (const id of local.toReversed()) yield* log(id);
 		return;
 	}
-	const id = flags.id ?? (yield* latestShip(local, self, targetOf));
+	const id = flags.id ?? (yield* latestShip(local, self));
 	const ship = parseShipId(id);
 	if (ship === void 0) return yield* fail$1(new LogsError(`not a Ship id: ${id} (fizz logs --list shows them)`));
 	let missing = false;
@@ -36627,17 +36915,13 @@ const logs = fn("logs")(function* (flags) {
 	});
 	if (missing) return yield* fail$1(new LogsError(`no log for ${id} on ${ship.from}; a Machine keeps its last 20`));
 });
-const latestShip = fn("latestShip")(function* (local, self, targetOf) {
+const latestShip = fn("latestShip")(function* (local, self) {
 	const newest = local.at(-1);
-	const config = getOrUndefined$1(yield* loadConfig(configPath(process.env)).pipe(option));
-	const from = config?.shippedFrom;
-	const at = Date.parse(config?.shippedAt ?? "");
+	const record = yield* readConfigRecord;
+	const from = parseShipId(record?.ship ?? "")?.from;
+	const at = self === void 0 ? Infinity : Date.parse(record?.reached[self] ?? "");
 	const newestStarted = parseShipId(newest ?? "")?.started ?? -Infinity;
-	if (from !== void 0 && from !== self && at > newestStarted) {
-		const there = (yield* shipIds(yield* targetOf(from))).filter((id) => (parseShipId(id)?.started ?? Infinity) <= at).at(-1);
-		if (there === void 0) return yield* fail$1(new LogsError(`the last Ship to reach this Machine (from ${from} at ${config?.shippedAt}) has no log there`));
-		return there;
-	}
+	if (record !== void 0 && from !== void 0 && from !== self && at > newestStarted) return record.ship;
 	if (newest === void 0) return yield* fail$1(new LogsError("no Ship Log on this Machine yet"));
 	return newest;
 });
@@ -64886,9 +65170,25 @@ const QUESTION_CHOICES = {
 		"downgrade"
 	],
 	config: ["overwrite", "stop"],
-	mode: ["managed", "skip"]
+	mode: ["managed", "skip"],
+	file: ["overwrite", "skip"]
 };
 const isQuestionKind = (kind) => kind in QUESTION_CHOICES;
+var Hidden = class {
+	#value;
+	constructor(value) {
+		this.#value = value;
+	}
+	reveal() {
+		return this.#value;
+	}
+	toJSON() {
+		return "[hidden]";
+	}
+	toString() {
+		return "[hidden]";
+	}
+};
 const rangeQuestion = (subject, installed, range, bumpPath) => ({
 	kind: "range",
 	subject,
@@ -65022,8 +65322,13 @@ const EngineFact = Union([
 	Struct({
 		fact: Literal("config"),
 		present: Boolean$4,
+		sha: optionalKey(String$6),
 		base64: optionalKey(String$6)
 	}),
+	Struct({
+		fact: Literal("configRecord"),
+		record: Unknown
+	}),
 	Struct({
 		fact: Literal("record"),
 		provider: String$6,
@@ -65066,9 +65371,18 @@ const assembleState = (facts) => {
 					};
 					break;
 				case "config":
-					if (f.present && f.base64 !== void 0) state = {
+					if (f.present && f.base64 !== void 0 && f.sha !== void 0) state = {
+						...state,
+						config: {
+							text: decodeBase64(f.base64),
+							sha: f.sha
+						}
+					};
+					break;
+				case "configRecord":
+					state = {
 						...state,
-						config: decodeBase64(f.base64)
+						configRecord: f.record
 					};
 					break;
 				case "record": state = {
@@ -65167,7 +65481,7 @@ const LedgerState = Struct({
 	started: Number$2,
 	ended: optionalKey(Number$2)
 });
-const itemsOf = (p) => [...p.providers.flatMap((pp) => pp.decisions.map((d) => {
+const itemsOf = (p, config) => [...p.providers.flatMap((pp) => pp.decisions.map((d) => {
 	const base = {
 		name: address(pp.name, d.item),
 		kind: pp.rule,
@@ -65210,7 +65524,8 @@ const itemsOf = (p) => [...p.providers.flatMap((pp) => pp.decisions.map((d) => {
 })), {
 	name: CONFIG_STEP,
 	kind: "config",
-	changes: false,
+	...config,
+	changes: config.from !== config.to,
 	status: "idle",
 	steps: [{
 		id: CONFIG_STEP,
@@ -65306,10 +65621,10 @@ const makeLedger = fn("makeLedger")(function* (input) {
 				}
 			})).pipe(andThen(logInfo(`resolving ${n} items`))),
 			resolved: update(({ resolving: _, ...state }) => state).pipe(andThen(logInfo("resolved"))),
-			plan: (name, p) => machine(name, (m) => ({
+			plan: (name, p, config) => machine(name, (m) => ({
 				...m,
 				status: "planned",
-				items: itemsOf(p)
+				items: itemsOf(p, config)
 			})).pipe(andThen(forEach$1(p.providers.flatMap((pp) => pp.decisions.map((d) => ({
 				pp,
 				d
@@ -67367,7 +67682,7 @@ const SPINNER = cli_spinners_default.dots;
 const runGlyph = (live, now) => (live ? SPINNER.frames[Math.floor(now / SPINNER.interval) % SPINNER.frames.length] : void 0) ?? "▸";
 const unchanged = (i) => ({
 	text: "",
-	detail: i.kind === "record" ? "up to date" : void 0
+	detail: i.kind === "record" || i.kind === "config" ? "up to date" : void 0
 });
 const statusOf = (i, dryRun, glyph) => {
 	switch (i.status) {
@@ -67386,11 +67701,11 @@ const statusOf = (i, dryRun, glyph) => {
 			detail: i.detail
 		};
 		case "ok":
+			if (!i.changes) return unchanged(i);
 			if (i.kind === "config") return {
 				text: "✓ copied",
-				tone: "dim"
+				tone: "ok"
 			};
-			if (!i.changes) return unchanged(i);
 			if (i.kind === "record") return i.from !== void 0 && i.from === i.to ? {
 				text: "✓ rebuilt",
 				tone: "ok",
@@ -67794,7 +68109,7 @@ const report = fn("report")(function* () {
 		]
 	})));
 });
-const decodeFact$2 = decodeUnknownOption(Union([Struct({
+const decodeFact$3 = decodeUnknownOption(Union([Struct({
 	fact: Literal("brew"),
 	version: NullOr(String$6)
 }), AtFact]));
@@ -67846,7 +68161,7 @@ function homebrew(name) {
 			let brew;
 			const at = /* @__PURE__ */ new Map();
 			for (const raw of facts) {
-				const fact = decodeFact$2(raw);
+				const fact = decodeFact$3(raw);
 				if (fact._tag === "None") continue;
 				const f = fact.value;
 				if (f.fact === "brew") brew = f.version ?? void 0;
@@ -67923,6 +68238,532 @@ function homebrew(name) {
 }
 const brew = homebrew("brew");
 const cask = homebrew("cask");
+//#endregion
+//#region ../../packages/providers/src/files/index.ts
+const ALWAYS_EXCLUDED = [".DS_Store", "._*"];
+const SIZE_LIMIT = 10485760;
+const decodeFact$2 = decodeUnknownOption(Union([Struct({
+	fact: Literal("entry"),
+	item: String$6,
+	path: String$6,
+	entry: String$6,
+	size: Number$2
+}), Struct({
+	fact: Literal("openssl"),
+	present: Boolean$4
+})]));
+const FileRecord = Struct({
+	at: String$6,
+	entries: Record(String$6, String$6)
+});
+const decodeRecord$1 = decodeUnknownOption(FileRecord);
+const jsonRecord = encodeSync(fromJsonString(FileRecord));
+const fingerprint = (entries) => [...entries].toSorted(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([rel, entry]) => `${rel}\t${entry}\n`).join("");
+const short$1 = (entries) => (string$1(fingerprint(entries)) >>> 0).toString(16).padStart(8, "0").slice(0, 7);
+const recordEntries = (record) => new Map(Object.entries(record.entries));
+const kindOf = (entries) => ({
+	f: "a file",
+	d: "a directory",
+	l: "a symlink",
+	"?": "something it cannot copy"
+})[entries.get(".")?.[0] ?? ""] ?? "missing";
+const depth = (rel) => rel === "." ? 0 : rel.split("/").length;
+const changedPaths = (a, b) => {
+	const paths = [.../* @__PURE__ */ new Set([...a.keys(), ...b.keys()])].filter((rel) => a.get(rel) !== b.get(rel)).toSorted();
+	const shown = paths.slice(0, 3).join(", ");
+	return paths.length > 3 ? `${shown} and ${paths.length - 3} more` : shown;
+};
+const SHELL_FNS = [
+	`ff_mode() { stat -c %a "$1" 2>/dev/null || stat -f %Lp "$1"; }`,
+	`ff_entry() {`,
+	`  if [ -L "$3" ]; then ff_e="l $(readlink "$3")"; ff_s=0`,
+	`  elif [ -d "$3" ]; then if [ -r "$3" ] && [ -x "$3" ]; then ff_e="d $(ff_mode "$3")"; else ff_e="?"; fi; ff_s=0`,
+	`  elif [ -f "$3" ]; then if [ -r "$3" ]; then ff_e="f $(ff_mode "$3") $(ff_sha < "$3")"; ff_s=$(wc -c < "$3" | tr -d " "); else ff_e="?"; ff_s=0; fi`,
+	`  else ff_e="?"; ff_s=0; fi`,
+	`  ff_state "{\\"provider\\":\\"files\\",\\"fact\\":\\"entry\\",\\"item\\":\\"$(ff_json "$1")\\",\\"path\\":\\"$(ff_json "$2")\\",\\"entry\\":\\"$(ff_json "$ff_e")\\",\\"size\\":$ff_s}"`,
+	`}`
+].join("\n");
+const pruneExpr = (exclude) => [...ALWAYS_EXCLUDED, ...exclude].map((pattern) => pattern.includes("/") ? `-path ${quote(`./${pattern.replace(/^(\.?\/)+|\/+$/g, "")}`)}` : `-name ${quote(pattern)}`).join(" -o ");
+const observe$1 = (items) => {
+	if (items.length === 0) return "";
+	return [
+		SHELL_FNS,
+		`if command -v openssl >/dev/null 2>&1; then ff_o=true; else ff_o=false; fi`,
+		`ff_state "{\\"provider\\":\\"files\\",\\"fact\\":\\"openssl\\",\\"present\\":$ff_o}"`,
+		...items.flatMap((item) => {
+			const name = quote(item.name);
+			return [
+				`ff_p=${quotePath(item.path)}`,
+				`if [ -d "$ff_p" ] && [ ! -L "$ff_p" ]; then`,
+				`  ff_entry ${name} . "$ff_p"`,
+				`  (cd "$ff_p" && find . -mindepth 1 \\( ${pruneExpr(item.exclude)} \\) -prune -o -print) | while IFS= read -r ff_rel; do ff_rel=\${ff_rel#./}; ff_entry ${name} "$ff_rel" "$ff_p/$ff_rel"; done`,
+				`elif [ -e "$ff_p" ] || [ -L "$ff_p" ]; then`,
+				`  ff_entry ${name} . "$ff_p"`,
+				"fi"
+			];
+		})
+	].join("\n");
+};
+const parse = (facts, records) => {
+	const items = /* @__PURE__ */ new Map();
+	let openssl = false;
+	for (const raw of facts) {
+		const fact = decodeFact$2(raw);
+		if (fact._tag === "None") continue;
+		const f = fact.value;
+		if (f.fact === "openssl") {
+			openssl = f.present;
+			continue;
+		}
+		const item = items.get(f.item) ?? {
+			entries: /* @__PURE__ */ new Map(),
+			size: 0
+		};
+		item.entries.set(f.path, f.entry);
+		item.size += f.size;
+		items.set(f.item, item);
+	}
+	const decoded = /* @__PURE__ */ new Map();
+	for (const [name, raw] of Object.entries(records)) {
+		const record = decodeRecord$1(raw);
+		if (record._tag === "Some") decoded.set(name, record.value);
+	}
+	return {
+		items,
+		records: decoded,
+		openssl
+	};
+};
+const at = (rel) => rel === "." ? `"$ff_p"` : `"$ff_p"/${quote(rel)}`;
+const readContents = (files) => gen(function* () {
+	const contents = /* @__PURE__ */ new Map();
+	const script = files.map(({ abs }, n) => `ff_b=$(base64 < ${abs}) || exit 1; printf 'ff-file ${n} %s\\n' "$(printf '%s' "$ff_b" | tr -d '\\n')"`).join("\n");
+	return (yield* runScript({
+		name: "local",
+		local: true
+	}, script, [], (line) => sync(() => {
+		const match = /^ff-file (\d+) (.*)$/.exec(line);
+		if (match !== null) contents.set(Number(match[1]), new Hidden(match[2] ?? ""));
+	}))) === 0 && contents.size === files.length ? contents : void 0;
+});
+const resolveSources = fn("resolveSources")(function* (items, scope) {
+	const facts = [];
+	yield* runScript({
+		name: scope.machine.name,
+		local: true
+	}, checkScript({
+		scope,
+		providers: [{
+			provider: files,
+			items
+		}]
+	}), [], (line) => sync(() => {
+		const parsed = parseLine(line);
+		if (parsed.kind === "state") facts.push(parsed.fact);
+	}));
+	const state = assembleState(facts);
+	const observed = parse(state.facts.files ?? [], state.records.files ?? {});
+	const sources = /* @__PURE__ */ new Map();
+	for (const item of items) {
+		const copy = observed.items.get(item.name);
+		if (!state.complete) {
+			sources.set(item.name, {
+				item,
+				kind: "unreadable",
+				reason: "could not read it here"
+			});
+			continue;
+		}
+		if (copy === void 0) {
+			sources.set(item.name, {
+				item,
+				kind: "missing"
+			});
+			continue;
+		}
+		const unreadable = [...copy.entries].find(([, entry]) => entry === "?")?.[0];
+		if (unreadable !== void 0) {
+			sources.set(item.name, {
+				item,
+				kind: "unreadable",
+				reason: `cannot read or copy ${unreadable === "." ? item.path : unreadable} here`
+			});
+			continue;
+		}
+		if (copy.size > 10485760) {
+			sources.set(item.name, {
+				item,
+				kind: "unreadable",
+				reason: `${(copy.size / 1024 / 1024).toFixed(1)} MB, over the ${SIZE_LIMIT / 1024 / 1024} MB limit`
+			});
+			continue;
+		}
+		const list = [...copy.entries].flatMap(([rel, entry]) => entry.startsWith("f ") ? [{
+			rel,
+			abs: rel === "." ? quotePath(item.path) : `${quotePath(item.path)}/${quote(rel)}`
+		}] : []);
+		const read = yield* readContents(list);
+		if (read === void 0) {
+			sources.set(item.name, {
+				item,
+				kind: "unreadable",
+				reason: "could not read it here"
+			});
+			continue;
+		}
+		const record = observed.records.get(item.name);
+		sources.set(item.name, {
+			item,
+			kind: "present",
+			entries: copy.entries,
+			...record === void 0 ? {} : { record },
+			contents: new Map(list.map(({ rel }, n) => [rel, read.get(n) ?? new Hidden("")]))
+		});
+	}
+	return {
+		sources,
+		openssl: observed.openssl
+	};
+});
+const copiesOf = (checked, from) => {
+	const copies = /* @__PURE__ */ new Map();
+	for (const { machine, items, facts, records } of checked) {
+		if (machine.name === from) continue;
+		const observed = parse(facts, records);
+		for (const item of items) {
+			const copy = observed.items.get(item.name);
+			if (copy === void 0 || copy.size > 10485760 || [...copy.entries.values()].includes("?")) continue;
+			const record = observed.records.get(item.name);
+			copies.set(item.name, [...copies.get(item.name) ?? [], {
+				machine: machine.name,
+				item,
+				entries: copy.entries,
+				...record === void 0 ? {} : { record },
+				openssl: observed.openssl
+			}]);
+		}
+	}
+	return copies;
+};
+const PULL = "pull:";
+const askWhy = (current, record, source, from) => {
+	if (record === void 0) return "differs, and no Ship wrote it";
+	const recorded = recordEntries(record);
+	if (fingerprint(recorded) !== fingerprint(current)) return `was edited there${current.size === 1 && recorded.size === 1 ? "" : ` (${changedPaths(recorded, current)})`}`;
+	if (fingerprint(recorded) !== (source.record === void 0 ? void 0 : fingerprint(recordEntries(source.record))) && record.at > (source.record?.at ?? "")) return `came from a Ship at ${record.at.slice(0, 16).replace("T", " ")} that ${from} missed`;
+};
+const fileQuestion = (subject, found, problem, pull, from) => ({
+	kind: "file",
+	subject,
+	found,
+	problem,
+	choices: [
+		{
+			value: "overwrite",
+			title: "overwrite it with this Machine's copy"
+		},
+		...pull === void 0 || !pull.openssl ? [] : [{
+			value: `${PULL}${pull.machine}`,
+			title: `use ${pull.machine}'s copy (${short$1(pull.entries)}) on ${from} instead`
+		}],
+		{
+			value: "skip",
+			title: "skip on these Machines (leave as is, shown as skipped)"
+		}
+	],
+	default: "skip"
+});
+const missingQuestion = (subject, found, copies, from) => ({
+	kind: "file",
+	subject,
+	found,
+	problem: `is not on ${from}`,
+	choices: [...Map.groupBy(copies.filter((c) => c.openssl), (c) => fingerprint(c.entries)).values().flatMap((same) => {
+		const [first] = same;
+		return first === void 0 ? [] : [{
+			value: `${PULL}${first.machine}`,
+			title: `pull ${short$1(first.entries)} from ${same.map((c) => c.machine).join(", ")}`
+		}];
+	}), {
+		value: "skip",
+		title: "skip it everywhere"
+	}],
+	default: "skip"
+});
+const decideFile = (item, observed, resolved, ctx) => {
+	const { from } = resolved;
+	const source = resolved.sources.get(item.name);
+	if (source === void 0) return {
+		kind: "skip",
+		item: item.name,
+		reason: `${from} has no Variant for it; ship from a Machine it targets`
+	};
+	const subject = address("files", item.name);
+	const answer = ctx.answer("file", subject);
+	const pulling = answer?.startsWith(PULL) === true;
+	const copies = resolved.copies.get(item.name) ?? [];
+	const mine = copies.find((c) => c.machine === ctx.machine.name);
+	if (source.kind === "missing") {
+		const notHere = {
+			kind: "skip",
+			item: item.name,
+			reason: `not on ${from}`
+		};
+		if (mine === void 0) return notHere;
+		if (pulling) return {
+			...notHere,
+			at: short$1(mine.entries),
+			reason: `pulling it from ${answer?.slice(5)}`
+		};
+		if (answer === "skip" || !resolved.openssl || !copies.some((c) => c.openssl)) {
+			const without = resolved.openssl ? copies.filter((c) => !c.openssl).map((c) => c.machine) : [from];
+			return {
+				...notHere,
+				at: short$1(mine.entries),
+				...answer !== "skip" && without.length > 0 ? { reason: `not on ${from}; install openssl on ${without.join(", ")} to pull it` } : {}
+			};
+		}
+		return {
+			kind: "ask",
+			item: item.name,
+			at: short$1(mine.entries),
+			question: missingQuestion(subject, short$1(mine.entries), copies, from)
+		};
+	}
+	if (source.kind === "unreadable") return {
+		kind: "fail",
+		item: item.name,
+		reason: `${from}: ${source.reason}`
+	};
+	const current = observed.items.get(item.name)?.entries;
+	const record = observed.records.get(item.name);
+	const ours = fingerprint(source.entries);
+	const change = {
+		item,
+		entries: source.entries,
+		...current === void 0 ? {} : { current },
+		contents: source.contents,
+		at: resolved.at
+	};
+	const recorded = record === void 0 ? void 0 : fingerprint(recordEntries(record));
+	if (ctx.machine.name === from || current !== void 0 && fingerprint(current) === ours) return {
+		kind: "leave",
+		item: item.name,
+		at: short$1(source.entries),
+		...recorded === ours ? {} : { upkeep: change }
+	};
+	const to = short$1(source.entries);
+	if (current === void 0) return {
+		kind: "change",
+		item: item.name,
+		to,
+		change
+	};
+	if (kindOf(current) !== kindOf(source.entries)) return {
+		kind: "fail",
+		item: item.name,
+		at: short$1(current),
+		reason: `${kindOf(current)} here, ${kindOf(source.entries)} on ${from}`
+	};
+	const fromAt = short$1(current);
+	const why = askWhy(current, record, source, from);
+	if (why === void 0) return {
+		kind: "change",
+		item: item.name,
+		from: fromAt,
+		to,
+		change
+	};
+	if (pulling) return {
+		kind: "skip",
+		item: item.name,
+		at: fromAt,
+		reason: `pulling it from ${answer?.slice(5)}`
+	};
+	if (answer === "skip") return {
+		kind: "skip",
+		item: item.name,
+		at: fromAt,
+		reason: why
+	};
+	if (answer === "overwrite") return {
+		kind: "change",
+		item: item.name,
+		from: fromAt,
+		to,
+		reason: why,
+		change
+	};
+	return {
+		kind: "ask",
+		item: item.name,
+		at: fromAt,
+		question: fileQuestion(subject, fromAt, why, resolved.openssl ? mine : void 0, from)
+	};
+};
+const CIPHER = "-aes-256-cbc -pbkdf2 -a -A";
+const writeRecord = (name, entries, at) => {
+	const file = recordFile("files", name);
+	const temporary = `${recordDir("files")}/${quote(`${name}.json.tmp`)}`;
+	return [
+		`mkdir -p ${recordDir("files")}`,
+		`ff_lit ${quote(jsonRecord({
+			at,
+			entries: Object.fromEntries(entries)
+		}))} > ${temporary}`,
+		`mv -f ${temporary} ${file}`
+	];
+};
+const copyStep = (change) => {
+	const { item, entries, current, contents } = change;
+	const typeOf = (entry) => entry?.[0];
+	const deletes = [...current ?? []].filter(([rel, entry]) => {
+		const ours = entries.get(rel);
+		return ours === void 0 || typeOf(ours) !== typeOf(entry);
+	}).toSorted(([a], [b]) => depth(b) - depth(a));
+	const writes = [...entries].filter(([rel, entry]) => current?.get(rel) !== entry).toSorted(([a], [b]) => depth(a) - depth(b));
+	const input = change.key === void 0 ? [] : [change.key];
+	const decode = change.key === void 0 ? "base64 -d" : `FF_KEY="$ff_input_0" openssl enc -d ${CIPHER} -pass env:FF_KEY`;
+	const write = ([rel, entry]) => {
+		const [type, mode = ""] = entry.split(" ");
+		if (type === "d") return [`(umask 077 && mkdir -p ${at(rel)})`];
+		if (type === "l") return [`rm -f ${at(rel)}`, `ln -s -- ${quote(entry.slice(2))} ${at(rel)}`];
+		const n = input.push(contents.get(rel) ?? new Hidden("")) - 1;
+		return [
+			`ff_t=$(mktemp "$(dirname ${at(rel)})/.fftmp.XXXXXX")`,
+			`printf '%s' "$ff_input_${n}" | ${decode} > "$ff_t"`,
+			`chmod ${mode} "$ff_t"`,
+			`mv -f "$ff_t" ${at(rel)}`,
+			`ff_t=""`
+		];
+	};
+	const modes = writes.filter(([, entry]) => entry.startsWith("d ")).toReversed().map(([rel, entry]) => `chmod ${entry.slice(2)} ${at(rel)}`);
+	const links = [...entries].filter(([, entry]) => entry.startsWith("l ")).map(([rel]) => rel);
+	const reached = short$1(entries);
+	return {
+		id: `files:${item.name}:copy`,
+		items: [item.name],
+		doing: "copying",
+		run: [
+			`ff_p=${quotePath(item.path)}`,
+			"(",
+			"  set -e",
+			`  ff_t=""`,
+			`  trap '[ -z "$ff_t" ] || rm -f "$ff_t"' EXIT`,
+			`  trap 'exit 1' HUP INT TERM`,
+			...[
+				`mkdir -p "$(dirname "$ff_p")"`,
+				...deletes.map(([rel, entry]) => entry.startsWith("d ") ? `rmdir ${at(rel)}` : `rm -f ${at(rel)}`),
+				...writes.flatMap(write),
+				...modes,
+				...writeRecord(item.name, entries, change.at)
+			].map((l) => `  ${l}`),
+			")",
+			`ff_rc=$?`,
+			`if [ "$ff_rc" -eq 0 ]; then`,
+			`  ff_dl=""`,
+			...links.map((rel) => `  [ -e ${at(rel)} ] || ff_dl="$ff_dl, "${quote(rel)}`),
+			`  if [ -n "$ff_dl" ]; then ff_at files ${quote(item.name)} "${reached}, dangling link: \${ff_dl#, }"; else ff_at files ${quote(item.name)} ${reached}; fi`,
+			"fi",
+			`(exit "$ff_rc")`
+		],
+		input
+	};
+};
+const pull = (name, machine, resolved) => gen(function* () {
+	const source = resolved.sources.get(name);
+	const copy = resolved.copies.get(name)?.find((c) => c.machine === machine);
+	if (source === void 0 || copy === void 0 || source.kind === "unreadable") return { error: `cannot pull ${machine}'s copy here` };
+	const key = [...globalThis.crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32))].map((b) => b.toString(16).padStart(2, "0")).join("");
+	const rels = [...copy.entries].flatMap(([rel, entry]) => entry.startsWith("f ") ? [rel] : []);
+	const contents = /* @__PURE__ */ new Map();
+	let finished = false;
+	const code = yield* runScript({
+		name: machine,
+		local: false
+	}, [
+		prelude,
+		`IFS= read -r FF_KEY || FF_KEY=""`,
+		"export FF_KEY",
+		`ff_p=${quotePath(copy.item.path)}`,
+		...rels.map((rel, n) => `ff_c=$(openssl enc ${CIPHER} -pass env:FF_KEY -in ${at(rel)}) || exit 1; printf 'ff-file ${n} %s\\n' "$ff_c"`),
+		`printf 'ff-pulled\\n'`
+	].join("\n"), [key], (line) => sync(() => {
+		const match = /^ff-file (\d+) (.*)$/.exec(line);
+		if (match !== null) contents.set(Number(match[1]), new Hidden(match[2] ?? ""));
+		else if (line === "ff-pulled") finished = true;
+	}));
+	if (!finished || contents.size !== rels.length) return { error: code === 255 ? `could not reach ${machine}` : `could not read its copy on ${machine}` };
+	const step = copyStep({
+		item: source.item,
+		entries: copy.entries,
+		...source.kind === "present" ? { current: source.entries } : {},
+		contents: new Map(rels.map((rel, n) => [rel, contents.get(n) ?? new Hidden("")])),
+		at: copy.record?.at ?? resolved.at,
+		key: new Hidden(key)
+	});
+	let written = false;
+	yield* runScript({
+		name: resolved.from,
+		local: true
+	}, stepScript(step), stepStdin(step), (line) => sync(() => {
+		const parsed = parseLine(line);
+		if (parsed.kind === "done" && parsed.done.id === step.id) written = parsed.done.ok;
+	}));
+	return written ? { done: `pulled ${short$1(copy.entries)} from ${machine}` } : { error: `could not write ${machine}'s copy on ${resolved.from}` };
+}).pipe(catch_((e) => succeed$3({ error: e.message })));
+const recordStep = (change) => ({
+	id: `files:${change.item.name}:record`,
+	items: [change.item.name],
+	doing: "recording",
+	run: [
+		"(",
+		"  set -e",
+		...writeRecord(change.item.name, change.entries, change.at).map((l) => `  ${l}`),
+		")"
+	]
+});
+const files = {
+	name: "files",
+	rule: "record",
+	dependsOn: [],
+	items: (_section, listed) => listed.map(({ name, def }) => ({
+		name,
+		path: def.path,
+		exclude: def.exclude ?? []
+	})),
+	observe: (items) => observe$1(items),
+	parse,
+	resolve: (items, { starting: all, checked }) => gen(function* () {
+		const at = formatIso(yield* now);
+		const needed = new Set(items.map((item) => item.name));
+		const starting = {
+			...all,
+			items: all.items.filter((item) => needed.has(item.name))
+		};
+		const { sources, openssl } = starting.items.length === 0 ? {
+			sources: /* @__PURE__ */ new Map(),
+			openssl: false
+		} : yield* resolveSources(starting.items, starting).pipe(timeout("2 minutes"), orElseSucceed(() => ({
+			sources: new Map(starting.items.map((item) => [item.name, {
+				item,
+				kind: "unreadable",
+				reason: "could not read it here"
+			}])),
+			openssl: false
+		})));
+		return {
+			from: starting.machine.name,
+			at,
+			sources,
+			copies: copiesOf(checked, starting.machine.name),
+			openssl
+		};
+	}),
+	decide: ({ items, observed, resolved, ctx }) => items.map((item) => decideFile(item, observed, resolved, ctx)),
+	act: (decisions) => decisions.flatMap((d) => d.kind === "change" ? [copyStep(d.change)] : d.kind === "leave" && d.upkeep !== void 0 ? [recordStep(d.upkeep)] : []),
+	adopt: (item, answer, resolved) => answer.startsWith(PULL) ? pull(item, answer.slice(5), resolved) : void 0
+};
 const decodeFact$1 = decodeUnknownOption(Union([
 	Struct({
 		fact: Literal("cloneRoot"),
@@ -68353,6 +69194,7 @@ const decideRanged = (item, observed, resolved, ctx) => {
 //#endregion
 //#region ../../packages/providers/src/index.ts
 const PROVIDERS = [
+	files,
 	{
 		name: "vp",
 		rule: "range",
@@ -68760,7 +69602,7 @@ const askQuestions = fn("askQuestions")(function* (input) {
 			yield* input.ledger.note("answer", "not asked (dry run)");
 			continue;
 		}
-		const choices = question.choices.map((c) => ({
+		const choices = [...new Map(group.flatMap((a) => a.question.choices).map((c) => [c.value, c])).values()].map((c) => ({
 			value: c.value,
 			title: c.value === "bump" && bumps.length > 0 ? `bump the config to ${bumps.map((b) => bumpedRange(b.range, b.newest)).join(" and ")}` : c.title
 		}));
@@ -68797,27 +69639,43 @@ const unshippable = (config, tailnet, only, source) => {
 	const outsideFleet = only.filter((name) => !fleet.has(name));
 	if (outsideFleet.length > 0) return `not in machines in ${source}: ${outsideFleet.join(", ")}`;
 };
-const staleConfigs = fn("staleConfigs")(function* (config, own, checked, ledger) {
+const minute = (iso) => iso?.slice(0, 16).replace("T", " ") ?? "an unknown time";
+const staleConfigs = fn("staleConfigs")(function* (text, base, own, checked, ledger) {
 	const copies = [];
 	for (const { machine, state } of checked) {
-		if (state.config === void 0) continue;
-		const parsed = yield* result(parseConfig(machine.name, state.config));
-		if (parsed._tag === "Failure") yield* ledger.note("info", `the config on ${machine.name} does not parse; it will be overwritten`);
-		else copies.push({
+		if (machine.name === own || state.config === void 0 || state.config.text === text) continue;
+		const parsed = yield* result(parseConfig(machine.name, state.config.text));
+		if (parsed._tag === "Failure") {
+			yield* ledger.note("info", `the config on ${machine.name} does not parse; it will be overwritten`);
+			continue;
+		}
+		const record = getOrUndefined$1(decodeConfigRecord(state.configRecord));
+		const why = staleWhy({
 			machine: machine.name,
+			sha: state.config.sha,
+			record
+		}, base);
+		if (why === void 0) continue;
+		copies.push({
+			machine: machine.name,
+			text: state.config.text,
+			sha: state.config.sha,
 			config: parsed.success,
-			text: state.config
+			record,
+			why: why === "unrecorded" ? "differs, and no Ship wrote it" : why === "edited" ? "was edited there" : `got a Ship from ${parseShipId(record?.ship ?? "")?.from ?? "another Machine"} at ${minute(record?.reached[machine.name])} that missed this Machine`
 		});
 	}
-	return [...Map.groupBy(staleCopies(config, copies, own), (c) => c.text)].flatMap(([text, [first, ...rest]]) => {
+	return [...Map.groupBy(copies, (c) => c.text)].flatMap(([text, group]) => {
+		const [first] = group;
 		if (first === void 0) return [];
-		const { config, machine } = first;
-		const machines = [machine, ...rest.map((c) => c.machine)];
+		const machines = group.map((c) => c.machine);
 		return [{
 			text,
-			config,
+			sha: first.sha,
+			config: first.config,
 			machines,
-			description: `${machines.join(", ")} (shipped ${config.shippedAt} from ${config.shippedFrom ?? "unknown"})`
+			reached: mergeReached(group.flatMap((c) => c.record === void 0 ? [] : [c.record.reached])),
+			description: `the config on ${machines.join(", ")} ${first.why}`
 		}];
 	});
 });
@@ -68832,10 +69690,10 @@ const ship = fn("ship")(function* (flags) {
 		yield* logInfo(`Ship ${id}: fleetfizz ${flags.version}, node ${process.version} on ${process.platform}`);
 		yield* logInfo(`fizz ${process.argv.slice(2).join(" ")}`);
 		for (const m of tailnet.fleet) yield* logInfo(`tailnet: ${m.name} ${m.platform}${m.online ? "" : " offline"}${m.ssh ? "" : " no-ssh"}${m.name === tailnet.self.name ? " (this Machine)" : ""}`);
-		while ((yield* shipPass(flags, tailnet, hidden)) === "adopted");
+		while ((yield* shipPass(flags, tailnet, hidden, id)) === "adopted");
 	}).pipe(onExit((exit) => isSuccess(exit) ? logInfo("the Ship ended") : logError("the Ship stopped", exit.cause)), provide(layer$1(logger === void 0 ? [] : [logger])), provideService(MinimumLogLevel, "Debug"));
 }, scoped);
-const shipPass = fn("shipPass")(function* (flags, tailnet, hidden) {
+const shipPass = fn("shipPass")(function* (flags, tailnet, hidden, id) {
 	const fs = yield* FileSystem;
 	const parsed = parseAnswers(flags.answers);
 	if ("invalid" in parsed) return yield* fail$1(new ShipError(parsed.invalid));
@@ -68853,6 +69711,7 @@ const shipPass = fn("shipPass")(function* (flags, tailnet, hidden) {
 	if (problem !== void 0) return yield* fail$1(new ShipError(problem));
 	const fleet = new Set(config.machines);
 	const own = flags.config === void 0 ? tailnet.self.name : void 0;
+	const base = (own === void 0 ? void 0 : yield* readConfigRecord)?.reached ?? {};
 	const order = config.machines;
 	const targetsList = tailnet.fleet.filter((m) => fleet.has(m.name) && (flags.only.length === 0 || flags.only.includes(m.name))).toSorted((a, b) => order.indexOf(a.name) - order.indexOf(b.name));
 	const count = `${targetsList.length} machine${targetsList.length === 1 ? "" : "s"}`;
@@ -68923,13 +69782,13 @@ const shipPass = fn("shipPass")(function* (flags, tailnet, hidden) {
 		machine: machine.name,
 		phase: "check"
 	})), { concurrency: "unbounded" }).pipe(map$5((list) => list.filter((g) => g !== void 0)));
-	const stale = yield* staleConfigs(config, own, checked, ledger);
+	const stale = yield* staleConfigs(yield* fs.readFileString(path), base, own, checked, ledger);
 	if (stale.length > 0) {
-		const what = `newer config on ${stale.map((s) => s.description).join(", ")}`;
+		const what = stale.map((s) => s.description).join("; ");
 		const answers = stale.flatMap((s) => s.machines).map((m) => given("config", m));
 		if (flags.dryRun) yield* ledger.note("info", `${what}; a Ship would ask before overwriting it`);
 		else if (answers.every((a) => a === "overwrite")) yield* ledger.note("info", `${what}; overwriting it, as answered`);
-		else if (answers.includes("stop")) return yield* fail$1(new ShipError("aborted: the config here is older"));
+		else if (answers.includes("stop")) return yield* fail$1(new ShipError("stopped before overwriting the config there"));
 		else if (live.ask === void 0) return yield* fail$1(new ShipError(`${what}; copy it here first, or pass --overwrite-config`));
 		else {
 			const usable = [];
@@ -68955,12 +69814,17 @@ const shipPass = fn("shipPass")(function* (flags, tailnet, hidden) {
 			]);
 			if (choice === "stop") {
 				yield* ledger.note("answer", "stop");
-				return yield* fail$1(new ShipError("aborted: the config here is older"));
+				return yield* fail$1(new ShipError("stopped before overwriting the config there"));
 			}
 			if (choice === "overwrite") yield* ledger.note("answer", "overwrite it");
 			else {
 				yield* ledger.note("answer", `use the config on ${choice.machines[0]}`);
 				yield* fs.writeFileString(path, choice.text);
+				if (own !== void 0) yield* writeConfigRecord(encodeConfigRecord({
+					ship: id,
+					sha: choice.sha,
+					reached: reachedAfter(mergeReached([base, choice.reached]), formatIso(yield* now), [own], choice.config.machines)
+				}));
 				adopted = true;
 				return "adopted";
 			}
@@ -68975,7 +69839,30 @@ const shipPass = fn("shipPass")(function* (flags, tailnet, hidden) {
 	if (lent.token !== void 0) hidden.add(lent.token);
 	yield* logInfo(lent.token !== void 0 ? "gh token: lent" : `gh token: none (${lent.reason ?? "no repos"})`);
 	if (lent.token === void 0 && lent.reason !== void 0) yield* ledger.note("info", `no gh token (${lent.reason}); private repos will fail`);
-	const resolved = Object.fromEntries(yield* forEach$1(targeted, ({ provider, items }) => provider.resolve(items, lent.token === void 0 ? {} : { token: lent.token }).pipe(map$5((r) => [provider.name, r])), { concurrency: "unbounded" }));
+	const self = {
+		name: tailnet.self.name,
+		platform: tailnet.self.platform
+	};
+	const resolved = Object.fromEntries(yield* forEach$1(targeted, ({ provider, items }) => provider.resolve(items, {
+		...lent.token === void 0 ? {} : { token: lent.token },
+		starting: {
+			machine: self,
+			config,
+			items: targetedItems(provider, config, self)
+		},
+		checked: checked.map(({ machine, state }) => {
+			const identity = {
+				name: machine.name,
+				platform: machine.platform
+			};
+			return {
+				machine: identity,
+				items: targetedItems(provider, config, identity),
+				facts: state.facts[provider.name] ?? [],
+				records: state.records[provider.name] ?? {}
+			};
+		})
+	}).pipe(map$5((r) => [provider.name, r])), { concurrency: "unbounded" }));
 	yield* ledger.resolved;
 	const planAll = (cfg, answer) => checked.map((g) => ({
 		...g,
@@ -69027,33 +69914,55 @@ const shipPass = fn("shipPass")(function* (flags, tailnet, hidden) {
 		if (!progressed) break;
 		planned = planAll(cfg, answer);
 	}
-	for (const { machine, plan: p } of planned) yield* ledger.plan(machine.name, p);
+	const adopting = [...decided].flatMap(([key, choice]) => {
+		const subject = key.slice(key.indexOf(":") + 1);
+		const at = parseAddress(subject);
+		const provider = providers.find((p) => p.name === at?.provider);
+		const run = at === void 0 || provider === void 0 ? void 0 : provider.adopt?.(at.item, choice, resolved[provider.name]);
+		return run === void 0 ? [] : [{
+			subject,
+			run
+		}];
+	});
+	if (adopting.length > 0 && !flags.dryRun) {
+		for (const { subject, run } of adopting) {
+			changing = true;
+			const result = yield* run;
+			if ("error" in result) return yield* fail$1(new ShipError(`${subject}: ${result.error}`));
+			yield* ledger.note("info", `${subject}: ${result.done}; starting over`);
+		}
+		adopted = true;
+		return "adopted";
+	}
+	const text = yield* fs.readFileString(path);
+	const sha = yield* shaOf(text);
+	for (const { machine, state, plan: p } of planned) yield* ledger.plan(machine.name, p, {
+		...state.config === void 0 ? {} : { from: state.config.sha.slice(0, 7) },
+		to: sha.slice(0, 7)
+	});
 	if (flags.dryRun) return;
-	const shippedAt = formatIso(yield* now);
-	changing = true;
-	const original = yield* fs.readFileString(path);
-	const stampWith = (reached) => stampText(original, {
-		shippedAt,
-		shippedFrom: tailnet.self.name,
-		reached,
-		own
+	const at = formatIso(yield* now);
+	const recordFor = (reached) => encodeConfigRecord({
+		ship: id,
+		sha,
+		reached: reachedAfter(base, at, [...reached, ...own === void 0 ? [] : [own]], cfg.machines)
 	});
-	const stamped = stampWith(planned.map((g) => g.machine.name));
-	yield* fs.writeFileString(path, stamped);
-	yield* logInfo(`stamped the config: shippedAt ${shippedAt}`);
+	changing = true;
+	const record = recordFor(planned.map((g) => g.machine.name));
+	if (own !== void 0) yield* writeConfigRecord(record);
+	yield* logInfo(`the config's record: ${record}`);
 	const schema = `${schemaJson(fleetConfigJsonSchema())}\n`;
-	const stdin = applyStdin(lent.token, stamped, schema);
 	const delivered = yield* forEach$1(planned, fn("applyOne")(function* ({ machine, local, plan: p }) {
 		return (yield* apply({
 			name: machine.name,
 			local
-		}, p, applyScript(p), stdin, ledger)).done.includes("config") ? machine.name : void 0;
+		}, p, applyScript(p, record), applyStdin(lent.token, text, schema, p), ledger)).done.includes("config") ? machine.name : void 0;
 	}, (effect, { machine }) => annotateLogs(effect, {
 		machine: machine.name,
 		phase: "apply"
 	})), { concurrency: "unbounded" }).pipe(map$5((list) => list.filter((name) => name !== void 0)));
 	yield* logInfo(`the config reached: ${delivered.join(", ")}`);
-	yield* fs.writeFileString(path, stampWith(delivered));
+	if (own !== void 0) yield* writeConfigRecord(recordFor(delivered));
 }, scoped);
 //#endregion
 //#region src/command.ts