@gamecrate/cli 2.3.1 → 2.4.0

package/dist/gamecrate.js

@@ -724,23 +724,27 @@ function applyPositionals(out, positional, games, help = false) {
   }
   const { sub, slots, rest } = routePositionals(out, first, positional, games);
   const left = fillSlots(out, slots, rest);
-  if (!help && (out.subverb === "add" || out.subverb === "rm")) {
+  if (!help)
+    requireSubverbArgs(out);
+  if (left.length > 0) {
+    const shape = sub ? `${sub.name} ${sub.usage}`.trim() : `${out.game} [profile]`;
+    throw usage(`unexpected argument ${left[0]}`, `gamecrate ${shape}`);
+  }
+}
+function requireSubverbArgs(out) {
+  if (out.subverb === "add" || out.subverb === "rm") {
     if (out.game === undefined)
       throw usage(`mods ${out.subverb} needs a game`);
     if (out.subverb === "rm" && out.rest.length === 0)
       throw usage("mods rm needs at least one mod id");
   }
-  if (!help && out.subcommand === "steam") {
-    if (out.subverb === undefined) {
-      throw usage("steam needs a subverb", "gamecrate steam build <game>, or gamecrate steam login");
-    }
-    if (out.subverb === "build" && out.game === undefined)
-      throw usage("steam build needs a game");
-  }
-  if (left.length > 0) {
-    const shape = sub ? `${sub.name} ${sub.usage}`.trim() : `${out.game} [profile]`;
-    throw usage(`unexpected argument ${left[0]}`, `gamecrate ${shape}`);
+  if (out.subcommand !== "steam")
+    return;
+  if (out.subverb === undefined) {
+    throw usage("steam needs a subverb", "gamecrate steam build <game>, or gamecrate steam login");
   }
+  if (out.subverb === "build" && out.game === undefined)
+    throw usage("steam build needs a game");
 }
 function routePositionals(out, first, positional, games) {
   const sub = SUBCOMMANDS.find((s) => s.name === first);
@@ -1033,2207 +1037,2240 @@ function requireGame(args, config) {
 }
 
 // src/image/refs.ts
-import { existsSync as existsSync8 } from "node:fs";
+import { existsSync as existsSync8, readlinkSync } from "node:fs";
 import { mkdir as mkdir3, readdir as readdir7, rename, rm as rm3, symlink, unlink as unlink3 } from "node:fs/promises";
 import { dirname as dirname6, join as join11 } from "node:path";
 
 // src/cli/output.ts
 import { closeSync, existsSync as existsSync2, lstatSync, mkdirSync as mkdirSync2, openSync, readdirSync, rmSync, symlinkSync, unlinkSync, writeSync } from "node:fs";
-import { basename as basename2, join as join4, resolve } from "node:path";
+import { basename as basename3, join as join6, resolve as resolve4 } from "node:path";
 
 // src/docker/run.ts
 import { spawn } from "node:child_process";
 import { createWriteStream, mkdirSync } from "node:fs";
-import { open, readdir, stat } from "node:fs/promises";
-import { join as join2 } from "node:path";
+import { open, readdir as readdir2, stat } from "node:fs/promises";
+import { join as join4 } from "node:path";
 import { setTimeout as sleep } from "node:timers/promises";
 import { TextDecoder } from "node:util";
 
 // src/docker/spec.ts
 import { existsSync, realpathSync } from "node:fs";
-import { homedir, hostname } from "node:os";
-import { basename, join } from "node:path";
-var CONTAINER_RUNTIME_DIR = "/tmp/xdg";
-var CONTAINER_LOG_DIR = "/logs";
-var X11_SOCKET_DIR = "/tmp/.X11-unix";
-var CONTAINER_XAUTHORITY = "/tmp/xauth";
-var CONTAINER_XDG_DIR = "/xdg";
-var RUNTIME_DIR_SIZE = "64m";
-var HOME_SIZE = "64m";
-var MASK_SIZE = "1m";
-function refuseProtonHeaded(game, mode, image) {
-  if (image?.launcher !== "proton" || mode !== "headed")
-    return;
-  throw new GamecrateError(`${game}: a proton image only runs offscreen`, Exit.Config, 'relaunch with --mode headless, or use a variant whose gamecrate.launcher is "direct"');
+import { homedir as homedir2, hostname } from "node:os";
+import { basename as basename2, isAbsolute as isAbsolute2, join as join3, resolve as resolve3 } from "node:path";
+
+// src/config/load.ts
+import { z as z2 } from "zod";
+import { access, readdir, readFile as readFile2 } from "node:fs/promises";
+import { homedir } from "node:os";
+import { basename, dirname as dirname2, join as join2, resolve as resolve2 } from "node:path";
+
+// src/plugin.ts
+import { readFileSync, statSync } from "node:fs";
+import { dirname, isAbsolute, join, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { exports as exportsField, legacy } from "resolve.exports";
+var PLUGIN_API_VERSION = 2;
+var REQUIRED_FUNCTIONS = [
+  "parseManifest",
+  "renderModsConfig",
+  "mergePrefs",
+  "parseVersion"
+];
+function fail(spec, message, detail) {
+  throw new GamecrateError(`plugin "${spec}": ${message}`, Exit.Config, detail);
 }
-function buildRunSpec(plan, modMounts, identity, image) {
-  const { gameConfig: game, settings } = plan;
-  const headed = plan.mode === "headed";
-  const mounts = [];
-  const env = {
-    HOME: identity.home,
-    USER: identity.user,
-    LOGNAME: identity.user
-  };
-  addGameFiles(mounts, plan);
-  addStage(mounts, plan, modMounts);
-  const proton = image?.launcher === "proton";
-  const executable = image?.executable ?? game.executable;
-  refuseProtonHeaded(plan.game, plan.mode, image);
-  const command = proton ? ["run-headless-windows", winPath(join(game.gameFiles.container, basename(executable)))] : headed ? [executable] : [
-    "xvfb-run",
-    "-a",
-    `--server-args=-screen 0 ${settings.width}x${settings.height}x24`,
-    executable
-  ];
-  if (proton) {
-    Object.assign(env, {
-      SCREEN: `${settings.width}x${settings.height}x24`,
-      DESKTOP: `${settings.width}x${settings.height}`,
-      STEAM_COMPAT_DATA_PATH: `${CONTAINER_XDG_DIR}/proton`
-    });
-  }
-  if (game.dataDir.mode === "arg") {
-    const arg = validateDataDirArg(game.dataDir);
-    const eq = arg.indexOf("=");
-    command.push(proton ? `${arg.slice(0, eq + 1)}${winPath(arg.slice(eq + 1))}` : arg);
-  } else
-    Object.assign(env, game.dataDir.env);
-  if (game.logFile.mode === "arg") {
-    mounts.push({ type: "bind", source: hostPath(plan.runDirHost), target: CONTAINER_LOG_DIR });
-    const log = `${CONTAINER_LOG_DIR}/Player.log`;
-    command.push(game.logFile.arg, proton ? winPath(log) : log);
-  }
-  addScratch(mounts, env, plan, identity);
-  if (headed)
-    addSession(mounts, env, plan);
-  const deviceCgroupRules = [];
-  if (settings.input) {
-    mounts.push({ type: "bind", source: "/dev/input", target: "/dev/input", readonly: true });
-    deviceCgroupRules.push("c 13:* rmw");
+function entryOf(dir) {
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync(join(dir, "package.json"), "utf8"));
+  } catch {
+    return resolve(dir, "index.js");
   }
-  const devices = [];
-  if (settings.gpu)
-    devices.push("nvidia.com/gpu=all");
-  Object.assign(env, glEnv(settings.gpu));
-  command.push(...settings.gameArgs ?? []);
-  return {
-    image: game.image.ref,
-    name: containerName(plan),
-    labels: {
-      "gamecrate.game": plan.game,
-      "gamecrate.profile": plan.profile,
-      ...plan.instance === undefined ? {} : { "gamecrate.instance": plan.instance }
-    },
-    identity,
-    env,
-    mounts,
-    devices,
-    deviceCgroupRules,
-    network: settings.network,
-    memory: settings.memory,
-    memorySwap: settings.memory,
-    cpus: settings.cpus,
-    pidsLimit: settings.pidsLimit,
-    ulimits: ["core=0"],
-    workdir: game.gameFiles.container,
-    ...headed && settings.display === "x11" ? { hostname: hostname() } : {},
-    command,
-    extraArgs: [...settings.dockerArgs ?? []]
-  };
+  let entry;
+  try {
+    entry = exportsField(manifest, ".", { conditions: ["bun"] })?.[0];
+  } catch {}
+  entry ??= legacy(manifest, { fields: ["module", "main"] });
+  return resolve(dir, entry ?? "index.js");
 }
-function addGameFiles(mounts, plan) {
-  const { gameFiles } = plan.gameConfig;
-  if (gameFiles.source !== "mount")
-    return;
-  if (!gameFiles.host) {
-    throw new GamecrateError(`gameFiles.source is "mount" but no host path is set for ${plan.game}`, Exit.Config);
+function packageDir(spec, from) {
+  let dir = resolve(from);
+  for (;; ) {
+    const candidate = join(dir, "node_modules", spec);
+    if (statSync(join(candidate, "package.json"), { throwIfNoEntry: false })?.isFile())
+      return candidate;
+    const parent = dirname(dir);
+    if (parent === dir)
+      return null;
+    dir = parent;
   }
-  mounts.push({ type: "bind", source: hostPath(gameFiles.host), target: gameFiles.container, readonly: true });
 }
-function addStage(mounts, plan, modMounts) {
-  const game = plan.gameConfig;
-  mounts.push({ type: "bind", source: hostPath(plan.stageDirHost), target: game.modsDir.container, readonly: true });
-  for (const mount of modMounts) {
-    mounts.push(mount.type === "bind" ? { ...mount, readonly: true } : mount);
+function locate(spec, from) {
+  const expanded = expandHome(spec);
+  let target;
+  if (expanded.startsWith(".") || isAbsolute(expanded)) {
+    target = resolve(from, expanded);
+  } else {
+    target = packageDir(expanded, from);
+    if (target === null) {
+      fail(spec, `cannot be resolved from ${from}`, "install it, or give a path starting with ./");
+    }
   }
-  mounts.push({ type: "bind", source: hostPath(plan.dataDirHost), target: game.dataDir.container });
+  return statSync(target, { throwIfNoEntry: false })?.isDirectory() ? entryOf(target) : target;
 }
-function addScratch(mounts, env, plan, identity) {
-  const { uid, gid } = identity;
-  for (const target of plan.gameConfig.modsDir.mask ?? []) {
-    mounts.push({ type: "tmpfs", target, size: MASK_SIZE, uid, gid, mode: "755" });
+function check(spec, value) {
+  if (typeof value !== "object" || value === null)
+    fail(spec, "has no default export");
+  const plugin = value;
+  if (plugin.apiVersion !== PLUGIN_API_VERSION) {
+    fail(spec, `speaks apiVersion ${String(plugin.apiVersion)}, this build speaks ${PLUGIN_API_VERSION}`);
   }
-  if (uid !== 0) {
-    mounts.push({ type: "tmpfs", target: identity.home, size: HOME_SIZE, uid, gid, mode: "700" });
+  if (typeof plugin.game !== "string" || plugin.game === "")
+    fail(spec, "declares no game name");
+  const missing = REQUIRED_FUNCTIONS.filter((name) => typeof plugin[name] !== "function");
+  if (missing.length > 0)
+    fail(spec, `is missing ${missing.join(", ")}`);
+  if (typeof plugin.defaults !== "object" || plugin.defaults === null) {
+    fail(spec, "declares no defaults object");
   }
-  mounts.push({ type: "tmpfs", target: CONTAINER_RUNTIME_DIR, size: RUNTIME_DIR_SIZE, uid, gid, mode: "700" });
-  env.XDG_RUNTIME_DIR = CONTAINER_RUNTIME_DIR;
-  mounts.push({ type: "bind", source: hostPath(plan.configDirHost), target: CONTAINER_XDG_DIR });
-  env.XDG_CONFIG_HOME = `${CONTAINER_XDG_DIR}/config`;
-  env.XDG_CACHE_HOME = `${CONTAINER_XDG_DIR}/cache`;
-  env.XDG_DATA_HOME ??= `${CONTAINER_XDG_DIR}/data`;
-}
-function addSession(mounts, env, plan) {
-  const { settings } = plan;
-  if (settings.display === "x11")
-    addX11(mounts, env);
-  else
-    addWayland(mounts, env);
-  if (!settings.audio)
-    return;
-  for (const socket of audioSockets()) {
-    mounts.push({ type: "bind", source: socket.source, target: `${CONTAINER_RUNTIME_DIR}/${socket.name}` });
+  if (typeof plugin.windowedPrefs !== "object" || plugin.windowedPrefs === null) {
+    fail(spec, "declares no windowedPrefs object");
   }
-  env.PULSE_SERVER = `unix:${CONTAINER_RUNTIME_DIR}/pulse/native`;
-}
-function addX11(mounts, env) {
-  const x11 = x11Session();
-  if (!x11)
-    return;
-  mounts.push({ type: "bind", source: X11_SOCKET_DIR, target: X11_SOCKET_DIR });
-  env.DISPLAY = x11.display;
-  env.XDG_SESSION_TYPE = "x11";
-  env.SDL_VIDEODRIVER = "x11";
-  env.QT_QPA_PLATFORM = "xcb";
-  if (!x11.xauthority)
-    return;
-  mounts.push({ type: "bind", source: x11.xauthority, target: CONTAINER_XAUTHORITY, readonly: true });
-  env.XAUTHORITY = CONTAINER_XAUTHORITY;
-}
-function addWayland(mounts, env) {
-  const wayland = waylandSocket();
-  if (!wayland)
-    return;
-  mounts.push({ type: "bind", source: wayland.source, target: `${CONTAINER_RUNTIME_DIR}/${wayland.name}` });
-  env.WAYLAND_DISPLAY = wayland.name;
-  env.XDG_SESSION_TYPE = "wayland";
-  env.SDL_VIDEODRIVER = "wayland";
-  env.QT_QPA_PLATFORM = "wayland";
+  return plugin;
 }
-function containerName(plan) {
-  const base = `gamecrate-${plan.game}-${plan.profile}`;
-  return plan.instance === undefined ? base : `${base}-${plan.instance}`;
+async function loadPlugins(specs, configFile) {
+  const from = dirname(configFile);
+  const out = new Map;
+  for (const spec of specs) {
+    const target = locate(spec, from);
+    let module;
+    try {
+      module = await import(pathToFileURL(target).href);
+    } catch (error) {
+      fail(spec, `failed to load ${target}`, error instanceof Error ? error.message : String(error));
+    }
+    const plugin = check(spec, module.default);
+    if (out.has(plugin.game))
+      fail(spec, `also claims the game "${plugin.game}"`);
+    out.set(plugin.game, plugin);
+  }
+  return out;
 }
-function windowTitle(plan) {
-  const base = `${plan.game} ${plan.profile}`;
-  return plan.instance === undefined ? base : `${base} / ${plan.instance}`;
+function requirePlugin(plugins, game) {
+  const plugin = plugins.get(game);
+  if (plugin === undefined) {
+    throw new GamecrateError(`no plugin provides the game "${game}"`, Exit.Config, `loaded plugins: ${[...plugins.keys()].join(", ") || "(none)"}`);
+  }
+  return plugin;
 }
-function toDockerArgs(spec) {
-  const args = ["run", "--rm", "--init", "--name", spec.name];
-  if (spec.hostname !== undefined)
-    args.push("--hostname", spec.hostname);
-  for (const [key, value] of Object.entries(spec.labels))
-    args.push("--label", `${key}=${value}`);
-  args.push("--user", `${spec.identity.uid}:${spec.identity.gid}`);
-  for (const [key, value] of Object.entries(spec.env))
-    args.push("--env", `${key}=${value}`);
-  for (const mount of spec.mounts)
-    args.push(...mountArgs(mount));
-  for (const device of spec.devices)
-    args.push("--device", device);
-  for (const rule of spec.deviceCgroupRules)
-    args.push("--device-cgroup-rule", rule);
-  for (const ulimit of spec.ulimits)
-    args.push("--ulimit", ulimit);
-  args.push("--network", spec.network, "--memory", spec.memory, "--memory-swap", spec.memorySwap, "--cpus", String(spec.cpus), "--pids-limit", String(spec.pidsLimit), "--workdir", spec.workdir, ...spec.extraArgs, "--pull=never");
-  const [entrypoint, ...rest] = spec.command;
-  if (entrypoint !== undefined)
-    args.push("--entrypoint", entrypoint);
-  args.push(spec.image, ...rest);
-  return args;
-}
-function mountArgs(mount) {
-  if (mount.type === "tmpfs") {
-    const opts = ["rw"];
-    if (mount.uid !== undefined)
-      opts.push(`uid=${mount.uid}`);
-    if (mount.gid !== undefined)
-      opts.push(`gid=${mount.gid}`);
-    if (mount.mode)
-      opts.push(`mode=${mount.mode}`);
-    opts.push(`size=${mount.size ?? RUNTIME_DIR_SIZE}`);
-    return ["--tmpfs", `${mount.target}:${opts.join(",")}`];
-  }
-  if (!mount.source) {
-    throw new GamecrateError(`bind mount at ${mount.target} has no source`, Exit.Config);
+
+// src/config/builtin.ts
+var DEFAULT_DATA_ROOT = "~/.local/share/gamecrate";
+var DEFAULT_SETTINGS = {
+  width: 1920,
+  height: 1080,
+  devMode: true,
+  runInBackground: true,
+  resetModsConfigOnCrash: false,
+  gpu: true,
+  audio: true,
+  input: false,
+  network: "bridge",
+  display: "x11",
+  memory: "8g",
+  cpus: 6,
+  pidsLimit: 1024
+};
+
+// src/config/read.ts
+import { readFile } from "node:fs/promises";
+import { extname } from "node:path";
+import { parseTree } from "jsonc-parser";
+import { isMap, parse as parseYaml, parseDocument } from "yaml";
+
+// src/config/jsonc.ts
+import { parse, printParseErrorCode } from "jsonc-parser";
+function parseJsonc(text) {
+  const errors = [];
+  const value = parse(text, errors, { allowTrailingComma: true, allowEmptyContent: false });
+  const first = errors[0];
+  if (first !== undefined) {
+    throw new GamecrateError("config is not valid JSON", Exit.Config, `${printParseErrorCode(first.error)} at offset ${first.offset}`);
   }
-  const fields = [`type=bind`, `src=${mount.source}`, `dst=${mount.target}`];
-  if (mount.readonly)
-    fields.push("readonly");
-  return ["--mount", fields.map(csvField).join(",")];
-}
-function csvField(field) {
-  if (!field.includes(",") && !field.includes('"'))
-    return field;
-  return `"${field.replaceAll('"', '""')}"`;
+  return value;
 }
-function winPath(unix) {
-  return `Z:${unix.replaceAll("/", "\\")}`;
+
+// src/config/read.ts
+var CONFIG_SUFFIXES = [".yml", ".yaml", ".json", ".jsonc"];
+function isYaml(path) {
+  const suffix = extname(path).toLowerCase();
+  if (suffix === ".yml" || suffix === ".yaml")
+    return true;
+  if (suffix === ".json" || suffix === ".jsonc")
+    return false;
+  throw new GamecrateError(`config is not a format gamecrate reads: ${path}`, Exit.Config, `use one of ${CONFIG_SUFFIXES.join(", ")}`);
 }
-function validateDataDirArg(dataDir) {
-  if (dataDir.container.includes("=")) {
-    throw new GamecrateError(`container data path contains "=": ${dataDir.container}`, Exit.Config, "RimWorld silently ignores -savedatafolder when the argv element does not split into exactly two parts, and the save is lost with --rm.");
-  }
-  const parts = dataDir.arg.split("=");
-  if (parts.length !== 2) {
-    throw new GamecrateError(`dataDir.arg must contain exactly one "=": ${dataDir.arg}`, Exit.Config);
-  }
-  if (trimSlash(parts[1] ?? "") !== trimSlash(dataDir.container)) {
-    throw new GamecrateError(`dataDir.arg points at ${parts[1]} but the mount target is ${dataDir.container}`, Exit.Config, "The engine would write to a path that is not the mounted data directory.");
+function readConfigText(text, path) {
+  if (!isYaml(path)) {
+    try {
+      return parseJsonc(text);
+    } catch (error) {
+      if (error instanceof GamecrateError) {
+        throw new GamecrateError(`${error.message}: ${path}`, error.code, error.detail);
+      }
+      throw error;
+    }
   }
-  return dataDir.arg;
-}
-function trimSlash(path) {
-  let end = path.length;
-  while (end > 1 && path[end - 1] === "/")
-    end--;
-  return path.slice(0, end);
-}
-function glEnv(gpu) {
-  if (!gpu)
-    return { LIBGL_ALWAYS_SOFTWARE: "1", GALLIUM_DRIVER: "llvmpipe" };
-  const env = { LIBGL_ALWAYS_SOFTWARE: "0", GALLIUM_DRIVER: "" };
-  if (hasNvidia()) {
-    env.__GLX_VENDOR_LIBRARY_NAME = "nvidia";
-    env.__NV_PRIME_RENDER_OFFLOAD = "1";
+  try {
+    return parseYaml(text);
+  } catch (error) {
+    throw new GamecrateError(`config is invalid: ${path}`, Exit.Config, error.message);
   }
-  return env;
-}
-function hasNvidia() {
-  return existsSync("/dev/nvidiactl") || existsSync("/etc/cdi/nvidia.yaml") || existsSync("/usr/share/vulkan/icd.d/nvidia_icd.json");
-}
-function x11Session() {
-  const display = process.env.DISPLAY;
-  if (!display)
-    return null;
-  const cookie = process.env.XAUTHORITY ?? join(homedir(), ".Xauthority");
-  return { display, xauthority: existsSync(cookie) ? cookie : null };
-}
-function waylandSocket() {
-  const display = process.env.WAYLAND_DISPLAY;
-  const runtime = process.env.XDG_RUNTIME_DIR;
-  if (!display)
-    return null;
-  let source = null;
-  if (display.startsWith("/"))
-    source = display;
-  else if (runtime)
-    source = join(runtime, display);
-  if (!source || !existsSync(source))
-    return null;
-  return { source, name: basename(source) };
 }
-function audioSockets() {
-  const runtime = process.env.XDG_RUNTIME_DIR;
-  if (!runtime)
-    return [];
-  const found = [];
-  for (const name of ["pipewire-0", "pulse/native"]) {
-    const source = join(runtime, name);
-    if (existsSync(source))
-      found.push({ source, name });
+async function readConfigFile(path) {
+  let text;
+  try {
+    text = await readFile(path, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return;
+    throw error;
   }
-  return found;
+  return readConfigText(text, path);
 }
-function hostPath(path) {
-  try {
-    return realpathSync(path);
-  } catch {
-    return path;
+function orderedKeys(text, path, key) {
+  if (isYaml(path)) {
+    const node = parseDocument(text).get(key, true);
+    if (!isMap(node))
+      return [];
+    return node.items.map((item) => String(item.key.value ?? item.key));
   }
+  const root = parseTree(text);
+  const holder = root?.children?.find((child) => child.children?.[0]?.value === key);
+  const value = holder?.children?.[1];
+  if (value?.type !== "object")
+    return [];
+  return (value.children ?? []).map((prop) => String(prop.children?.[0]?.value));
 }
 
-// src/docker/run.ts
-function spawnArgv(argv, stdio, detached = false) {
-  return spawn(argv[0], argv.slice(1), { stdio, detached });
-}
-function exited(proc) {
-  return new Promise((resolve, reject) => {
-    proc.once("error", reject);
-    proc.once("close", (code) => resolve(code ?? 1));
+// src/config/validate.ts
+import { z } from "zod";
+var MODES2 = ["headed", "headless", "screenshot"];
+var HINTS = "\x00gamecrate/hints:";
+function obj(shape) {
+  const known = Object.keys(shape);
+  return z.strictObject(shape, {
+    error: (issue) => issue.code === "unrecognized_keys" ? HINTS + JSON.stringify(issue.keys.map((key) => suggest(key, known) ?? null)) : "expected an object"
   });
 }
-async function collect2(stream) {
-  const chunks = [];
-  for await (const chunk of stream)
-    chunks.push(chunk);
-  return Buffer.concat(chunks).toString("utf8");
-}
-async function capture(argv) {
+function hintsFor(message) {
+  if (!message.startsWith(HINTS))
+    return [];
   try {
-    const proc = spawnArgv(argv, ["ignore", "pipe", "pipe"]);
-    const [stdout, stderr, code] = await Promise.all([
-      collect2(proc.stdout),
-      collect2(proc.stderr),
-      exited(proc)
-    ]);
-    return { code, stdout, stderr };
-  } catch (error) {
-    return { code: 127, stdout: "", stderr: error instanceof Error ? error.message : String(error) };
+    return JSON.parse(message.slice(HINTS.length));
+  } catch {
+    return [];
   }
 }
-async function captureLive(argv, env) {
-  const proc = spawn(argv[0], argv.slice(1), { stdio: ["ignore", "pipe", "pipe"], env });
-  const chunks = [];
-  const keep = async (stream) => {
-    for await (const chunk of stream) {
-      process.stderr.write(chunk);
-      chunks.push(chunk);
-    }
-  };
-  const [, , code] = await Promise.all([keep(proc.stdout), keep(proc.stderr), exited(proc)]);
-  return { code, text: Buffer.concat(chunks).toString("utf8") };
-}
-var STDOUT_LOG = "stdout.log";
-var MARKER_POLL_MS = 200;
-async function runContainer(spec, opts) {
-  const stopTimeout = opts.stopTimeoutSeconds ?? 10;
-  mkdirSync(opts.logDir, { recursive: true });
-  const sink = createWriteStream(join2(opts.logDir, STDOUT_LOG));
-  const proc = spawnArgv(["docker", ...toDockerArgs(spec)], ["inherit", "pipe", "pipe"]);
-  let interrupted = false;
-  const onSignal = () => {
-    if (interrupted)
+function requiredWhen(key, when) {
+  return (ctx) => {
+    if (!when(ctx.value) || ctx.value[key] !== undefined)
       return;
-    interrupted = true;
-    stopContainer(spec.name, stopTimeout);
+    ctx.issues.push({ code: "custom", message: `missing required key "${key}"`, path: [key], input: ctx.value });
   };
-  process.on("SIGINT", onSignal);
-  process.on("SIGTERM", onSignal);
-  const code = exited(proc);
-  try {
-    await Promise.all([
-      tee(proc.stdout, sink, process.stdout),
-      tee(proc.stderr, sink, process.stderr)
-    ]);
-    const status = await code;
-    return interrupted ? Exit.Interrupted : status;
-  } finally {
-    process.off("SIGINT", onSignal);
-    process.off("SIGTERM", onSignal);
-    await new Promise((resolve) => sink.end(resolve));
-  }
-}
-var STOP_TIMEOUT_SECONDS = 10;
-async function stopContainer(name, timeoutSeconds) {
-  const proc = spawnArgv(["docker", "stop", "--timeout", String(timeoutSeconds), name], "ignore");
-  await exited(proc).catch(() => {});
 }
-async function waitForMarker(sources, marker, timeoutSeconds) {
-  const deadline = Date.now() + timeoutSeconds * 1000;
-  const carry = Math.max(marker.length - 1, 0);
-  const seen = new Map;
-  const startedAt = Date.now();
-  while (true) {
-    for (const path of await expandSources(sources)) {
-      let state = seen.get(path);
-      if (state === undefined) {
-        state = { offset: await staleSize(path, startedAt), tail: "", decoder: new TextDecoder };
-        seen.set(path, state);
-      }
-      if (await scan(path, state, marker, carry))
-        return true;
-    }
-    if (Date.now() >= deadline)
-      return false;
-    await sleep(Math.min(MARKER_POLL_MS, Math.max(deadline - Date.now(), 0)));
-  }
-}
-async function staleSize(path, startedAt) {
-  return stat(path).then((info) => info.mtimeMs < startedAt ? info.size : 0, () => 0);
-}
-async function scan(path, state, marker, carry) {
-  const handle = await open(path, "r").catch(() => null);
-  if (handle === null)
-    return false;
-  try {
-    const { size } = await handle.stat();
-    if (size < state.offset) {
-      state.offset = 0;
-      state.tail = "";
-      state.decoder = new TextDecoder;
-    }
-    if (size <= state.offset)
-      return false;
-    const buffer = Buffer.alloc(size - state.offset);
-    const { bytesRead } = await handle.read(buffer, 0, buffer.length, state.offset);
-    state.offset += bytesRead;
-    const text = state.tail + state.decoder.decode(buffer.subarray(0, bytesRead), { stream: true });
-    if (text.includes(marker))
-      return true;
-    state.tail = carry > 0 ? text.slice(-carry) : "";
-    return false;
-  } catch {
-    return false;
-  } finally {
-    await handle.close().catch(() => {});
-  }
+var str = z.string({ error: "expected a string" });
+var num = z.number({ error: "expected a number" });
+var bool = z.boolean({ error: "expected a boolean" });
+var strArray = z.array(z.string({ error: "expected an array of strings" }), {
+  error: "expected an array of strings"
+});
+var strMap = z.record(z.string(), z.string({ error: "expected an object of string values" }), {
+  error: "expected an object of string values"
+});
+function oneOf(values) {
+  return z.enum(values, { error: `expected one of ${values.join(", ")}` });
 }
-async function expandSources(sources) {
-  const out = [];
-  for (const source of sources) {
-    const info = await stat(source).catch(() => null);
-    if (info === null) {
-      out.push(source);
-      continue;
-    }
-    if (!info.isDirectory()) {
-      out.push(source);
-      continue;
-    }
-    const entries = await readdir(source).catch(() => []);
-    for (const entry of entries) {
-      if (entry.toLowerCase().endsWith(".log"))
-        out.push(join2(source, entry));
-    }
+var modeName = z.unknown().check((ctx) => {
+  const value = ctx.value;
+  if (typeof value === "string" && MODES2.includes(value))
+    return;
+  const hint = typeof value === "string" ? suggest(value, MODES2) : undefined;
+  ctx.issues.push({
+    code: "custom",
+    message: `expected one of ${MODES2.join(", ")}`,
+    input: value,
+    ...hint === undefined ? {} : { params: { suggestion: `did you mean "${hint}"?` } }
+  });
+});
+var settings = obj({
+  width: num.optional(),
+  height: num.optional(),
+  devMode: bool.optional(),
+  runInBackground: bool.optional(),
+  resetModsConfigOnCrash: bool.optional(),
+  gpu: bool.optional(),
+  audio: bool.optional(),
+  input: bool.optional(),
+  network: oneOf(["none", "bridge", "host"]).optional(),
+  display: oneOf(["x11", "wayland"]).optional(),
+  memory: str.optional(),
+  cpus: num.optional(),
+  pidsLimit: num.optional(),
+  prefsExtra: strMap.optional(),
+  gameArgs: strArray.optional(),
+  dockerArgs: strArray.optional()
+});
+var dynamicModEntry = obj({
+  match: str,
+  first: strArray.optional(),
+  sort: oneOf(["alpha", "none"]).optional(),
+  minMatches: num.optional()
+});
+var objectModEntry = obj({
+  id: str,
+  workshop: num.optional(),
+  path: str.optional(),
+  optional: bool.optional()
+});
+var modEntry = z.unknown().check((ctx) => {
+  const value = ctx.value;
+  if (typeof value === "string") {
+    if (value.trim() === "")
+      ctx.issues.push({ code: "custom", message: "mod entry is empty", input: value });
+    return;
   }
-  return out;
-}
-async function tee(stream, sink, mirror) {
-  for await (const chunk of stream) {
-    mirror.write(chunk);
-    sink.write(chunk);
+  if (!isObj(value)) {
+    ctx.issues.push({ code: "custom", message: "expected a packageId string or an object", input: value });
+    return;
   }
-}
-
-// src/mods/staleness.ts
-import { readdir as readdir2, stat as stat2 } from "node:fs/promises";
-import { join as join3, relative } from "node:path";
-var SKIP_DIRS = new Set([".git", ".retired", ".vs", "bin", "node_modules", "obj"]);
-var ENTRY_LIMIT = 20000;
-async function scanBuildTimes(dir) {
-  const state = { root: dir, times: { sourceTimes: [] }, budget: ENTRY_LIMIT };
-  await walk(state, dir, false);
-  return state.times;
-}
-async function walk(state, current, inAssemblies) {
-  let entries;
-  try {
-    entries = await readdir2(current, { withFileTypes: true });
-  } catch {
+  const schema = value["match"] !== undefined ? dynamicModEntry : objectModEntry;
+  const result = schema.safeParse(value);
+  if (result.success)
     return;
+  for (const issue of result.error.issues)
+    ctx.issues.push({ ...issue, input: value });
+});
+var profile = obj({
+  mods: z.array(modEntry, { error: "expected an array" }).optional(),
+  extends: str.optional(),
+  exclude: strArray.optional(),
+  includeBase: bool.optional(),
+  autoDependencies: bool.optional(),
+  settings: settings.optional(),
+  instances: z.record(z.string(), obj({ worktree: str.optional(), settings: settings.optional() }), {
+    error: "expected an object"
+  }).optional(),
+  alias: str.optional(),
+  aliases: strArray.optional(),
+  description: str.optional(),
+  gameVersion: str.optional(),
+  image: str.optional(),
+  windowTitle: str.optional(),
+  windowIcon: str.optional(),
+  detach: bool.optional(),
+  replace: bool.optional(),
+  build: oneOf(["auto", "always", "never"]).optional()
+}).check((ctx) => {
+  const v = ctx.value;
+  if (v.alias !== undefined && (v.extends !== undefined || v.mods !== undefined)) {
+    ctx.issues.push({
+      code: "custom",
+      message: 'an alias profile cannot also declare "mods" or "extends"',
+      input: v
+    });
   }
-  for (const entry of entries) {
-    if (state.budget-- <= 0)
-      return;
-    const path = join3(current, entry.name);
-    if (entry.isDirectory()) {
-      if (!SKIP_DIRS.has(entry.name.toLowerCase())) {
-        await walk(state, path, inAssemblies || entry.name === "Assemblies");
-      }
-      continue;
+});
+var libraryEntry = obj({
+  workshop: num.optional(),
+  path: str.optional(),
+  git: str.optional(),
+  branch: str.optional(),
+  tag: str.optional(),
+  commit: str.optional(),
+  subdir: str.optional()
+}).check((ctx) => {
+  const v = ctx.value;
+  const push = (message, path) => {
+    ctx.issues.push({ code: "custom", message, input: v, ...path === undefined ? {} : { path } });
+  };
+  const sources = ["workshop", "path", "git"].filter((k) => v[k] !== undefined);
+  if (sources.length === 0)
+    push('library entry needs a "workshop" id, a "path", or a "git" url');
+  if (sources.length > 1)
+    push(`library entry takes only one of ${sources.join(", ")}`);
+  const refs = ["branch", "tag", "commit"].filter((k) => v[k] !== undefined);
+  if (refs.length > 1)
+    push(`library entry takes only one of branch, tag or commit, got ${refs.join(", ")}`);
+  if (v["git"] === undefined) {
+    for (const key of [...refs, ...v["subdir"] === undefined ? [] : ["subdir"]]) {
+      push(`"${key}" needs a "git" url`, [key]);
     }
-    if (entry.isFile())
-      await record(state, path, entry.name, inAssemblies);
-  }
-}
-async function record(state, path, name, inAssemblies) {
-  const lower = name.toLowerCase();
-  const isSource = lower.endsWith(".cs");
-  const isAssembly = inAssemblies && lower.endsWith(".dll");
-  if (!isSource && !isAssembly)
-    return;
-  let mtimeMs;
-  try {
-    mtimeMs = (await stat2(path)).mtimeMs;
-  } catch {
-    return;
   }
-  const { times } = state;
-  const found = { path: relative(state.root, path), mtimeMs };
-  if (isSource) {
-    times.sourceTimes.push(mtimeMs);
-    if (mtimeMs > (times.newestSource?.mtimeMs ?? -1))
-      times.newestSource = found;
-  } else if (mtimeMs > (times.newestAssembly?.mtimeMs ?? -1)) {
-    times.newestAssembly = found;
+  const subdir = v["subdir"];
+  if (typeof subdir === "string" && (subdir.startsWith("/") || subdir.split("/").includes(".."))) {
+    push('"subdir" must be a relative path inside the repo, with no ".." segment', ["subdir"]);
   }
+});
+function repeats(entries, key) {
+  const seen = new Set;
+  const found = [];
+  entries.forEach((entry, index) => {
+    const name = entry?.[key];
+    if (typeof name !== "string")
+      return;
+    if (seen.has(name))
+      found.push({ index, name });
+    else
+      seen.add(name);
+  });
+  return found;
 }
-var SKEW_MS = 1000;
-function newerThan(source, assembly) {
-  return source - assembly > SKEW_MS;
-}
-function decideStale(times) {
-  const { newestSource, newestAssembly } = times;
-  if (newestSource === undefined)
-    return false;
-  return newestAssembly === undefined || newerThan(newestSource.mtimeMs, newestAssembly.mtimeMs);
+function describe(value) {
+  return typeof value === "string" ? value : JSON.stringify(value);
 }
-function staleReport(times) {
-  const { newestSource, newestAssembly } = times;
-  if (newestSource === undefined || newestAssembly === undefined)
-    return null;
-  if (!newerThan(newestSource.mtimeMs, newestAssembly.mtimeMs))
-    return null;
-  return {
-    newestSource: newestSource.path,
-    newestSourceMs: newestSource.mtimeMs,
-    assembly: newestAssembly.path,
-    assemblyMs: newestAssembly.mtimeMs,
-    newerCount: times.sourceTimes.filter((t) => newerThan(t, newestAssembly.mtimeMs)).length
-  };
-}
-var INDENT = " ".repeat("warning: ".length);
-function staleWarning(packageId, report, now = Date.now()) {
-  const files = report.newerCount === 1 ? "1 source file" : `${report.newerCount} source files`;
-  return [
-    `${packageId} has ${files} newer than ${report.assembly}`,
-    `${INDENT}newest: ${report.newestSource} (${ago(report.newestSourceMs, now)})`,
-    `${INDENT}you are probably running a stale build`
-  ].join(`
-`);
-}
-function duration(ms) {
-  const seconds = Math.max(0, Math.round(ms / 1000));
-  if (seconds < 60)
-    return `${seconds}s`;
-  if (seconds < 3600)
-    return `${Math.floor(seconds / 60)}m`;
-  if (seconds < 86400)
-    return `${Math.floor(seconds / 3600)}h`;
-  return `${Math.floor(seconds / 86400)}d`;
-}
-function ago(mtimeMs, now = Date.now()) {
-  return `${duration(now - mtimeMs)} ago`;
-}
-
-// src/cli/output.ts
-function status(message) {
-  process.stderr.write(line(message));
-}
-function warn(message) {
-  process.stderr.write(line(`warning: ${message}`));
-}
-function redirectOutput(path, keep = false) {
-  const fd = openSync(path, keep ? "a" : "w");
-  const stdout = process.stdout.write;
-  const stderr = process.stderr.write;
-  let open = true;
-  const write = (chunk, encodingOrCallback, callback) => {
-    append(fd, chunk);
-    const done = typeof encodingOrCallback === "function" ? encodingOrCallback : callback;
-    done?.();
-    return true;
-  };
-  process.stdout.write = write;
-  process.stderr.write = write;
-  return {
-    close() {
-      if (!open)
-        return;
-      open = false;
-      process.stdout.write = stdout;
-      process.stderr.write = stderr;
-      closeSync(fd);
-    }
+var TAG_COMPONENT = /^\w[\w.-]*$/;
+function steamBuildRules(ctx) {
+  const push = (message, path, suggestion) => {
+    ctx.issues.push({
+      code: "custom",
+      message,
+      path,
+      input: ctx.value,
+      ...suggestion === undefined ? {} : { params: { suggestion } }
+    });
   };
-}
-async function forwardOutput(stream, target) {
-  for await (const chunk of stream)
-    target.write(chunk);
-}
-function line(message) {
-  return message.endsWith(`
-`) ? message : `${message}
-`;
-}
-function reportProblems(problems) {
-  if (problems.length === 0) {
-    throw new GamecrateError("resolution failed with no reported detail", Exit.Resolution);
-  }
-  const groups = new Map;
-  for (const problem of problems) {
-    const group = groups.get(problem.where);
-    if (group)
-      group.push(problem);
-    else
-      groups.set(problem.where, [problem]);
+  const branches = ctx.value["branches"];
+  const variants = ctx.value["variants"];
+  if (Array.isArray(variants) && variants.length === 0) {
+    push("steamBuild.variants cannot be empty", ["variants"]);
   }
-  const out = [];
-  for (const [where, group] of groups) {
-    out.push(`  ${where}`);
-    for (const problem of group) {
-      out.push(`    ${problem.message}`);
-      if (problem.suggestion)
-        out.push(`      did you mean ${problem.suggestion}?`);
+  if (Array.isArray(branches)) {
+    if (branches.length === 0)
+      push("steamBuild.branches cannot be empty", ["branches"]);
+    for (const dup of repeats(branches, "name")) {
+      push(`duplicate branch name "${dup.name}"`, ["branches", dup.index, "name"]);
     }
+    branches.forEach((branch, index) => {
+      const name = branch?.["name"];
+      if (typeof name === "string" && !TAG_COMPONENT.test(name)) {
+        push(`branch name "${name}" must match ${TAG_COMPONENT.source}`, ["branches", index, "name"]);
+      }
+      const tags = branch?.["tags"];
+      if (!Array.isArray(tags))
+        return;
+      tags.forEach((tag, at) => {
+        if (typeof tag !== "string" || TAG_COMPONENT.test(tag))
+          return;
+        push(`branch tag "${String(tag)}" must match ${TAG_COMPONENT.source}`, ["branches", index, "tags", at]);
+      });
+    });
   }
-  throw new GamecrateError(`${problems.length} problem${problems.length === 1 ? "" : "s"}`, Exit.Resolution, out.join(`
-`));
-}
-function planWarnings(plan) {
-  if (!plan.warnOnStale)
-    return plan.warnings;
-  const stale = plan.mods.filter((mod) => mod.staleReport !== undefined).map((mod) => staleWarning(mod.packageId, mod.staleReport));
-  return [...plan.warnings, ...stale];
-}
-function planPayload(plan) {
-  return {
-    game: plan.game,
-    profile: plan.profile,
-    ...plan.instance === undefined ? {} : { instance: plan.instance },
-    mode: plan.mode,
-    ...plan.marker === undefined ? {} : { marker: plan.marker },
-    timeoutSeconds: plan.timeoutSeconds,
-    renderWaitSeconds: plan.renderWaitSeconds,
-    profileDir: resolve(plan.profileDir),
-    instanceDir: resolve(plan.instanceDir),
-    containerName: containerName(plan),
-    dataDirHost: resolve(plan.dataDirHost),
-    stageDirHost: resolve(plan.stageDirHost),
-    logsDirHost: resolve(plan.logsDirHost),
-    mods: plan.mods.map((mod) => ({
-      packageId: mod.packageId,
-      kind: mod.kind,
-      hostDir: resolve(mod.hostDir),
-      containerDir: mod.containerDir,
-      origin: mod.explicit ? "explicit" : "auto",
-      stale: mod.stale === true,
-      ...mod.staleReport === undefined ? {} : { staleReport: mod.staleReport },
-      ...mod.workshopId === undefined ? {} : { workshopId: mod.workshopId }
-    })),
-    warnings: planWarnings(plan)
-  };
-}
-function printPlan(plan, asJson) {
-  const payload = planPayload(plan);
-  if (asJson) {
-    process.stdout.write(`${JSON.stringify(payload, null, 2)}
-`);
+  if (!Array.isArray(variants))
     return;
+  for (const dup of repeats(variants, "name")) {
+    push(`duplicate variant name "${dup.name}"`, ["variants", dup.index, "name"]);
   }
-  const title = payload.instance === undefined ? `${payload.game} ${payload.profile} (${payload.mode})` : `${payload.game} ${payload.profile} / ${payload.instance} (${payload.mode})`;
-  const out = [
-    title,
-    `  profile   ${payload.profileDir}`,
-    `  instance  ${payload.instanceDir}`,
-    `  container ${payload.containerName}`,
-    `  data      ${payload.dataDirHost}`,
-    `  stage     ${payload.stageDirHost}`,
-    `  logs      ${payload.logsDirHost}`
-  ];
-  if (payload.marker !== undefined)
-    out.push(`  marker    ${payload.marker}`);
-  out.push(`  timeout   ${payload.timeoutSeconds}s, render wait ${payload.renderWaitSeconds}s`, `  mods      ${payload.mods.length}`);
-  const width = Math.max(0, ...payload.mods.map((m) => m.packageId.length));
-  for (const mod of payload.mods) {
-    const notes = [mod.kind, mod.origin];
-    if (mod.stale)
-      notes.push("stale");
-    out.push(`    ${mod.packageId.padEnd(width)}  ${notes.join(" ")}  ${mod.hostDir} -> ${mod.containerDir}`);
-  }
-  for (const warning of payload.warnings)
-    out.push(`  warning: ${warning}`);
-  process.stdout.write(`${out.join(`
-`)}
-`);
-}
-function runTimestamp(now = new Date) {
-  return now.toISOString().replaceAll(/[-:.]/g, "");
-}
-function openRunLog(logsDir, now) {
-  const runsDir = join4(logsDir, "runs");
-  mkdirSync2(runsDir, { recursive: true });
-  const dir = uniqueRunDir(runsDir, runTimestamp(now));
-  mkdirSync2(dir);
-  linkCurrent(logsDir, dir);
-  rotateRuns(logsDir, 10);
-  return dir;
-}
-var encoder = new TextEncoder;
-function append(fd, chunk) {
-  writeSync(fd, typeof chunk === "string" ? encoder.encode(chunk) : chunk);
-}
-function uniqueRunDir(runsDir, stamp) {
-  let candidate = join4(runsDir, stamp);
-  let n = 2;
-  while (existsSync2(candidate)) {
-    candidate = join4(runsDir, `${stamp}-${n}`);
-    n++;
-  }
-  return candidate;
-}
-var WAIT_NOTICE = { firstMs: 2000, everyMs: 30000 };
-function waitNotice(waitedMs, lastNoticeMs, schedule = WAIT_NOTICE) {
-  if (waitedMs < schedule.firstMs)
-    return;
-  if (lastNoticeMs > 0 && waitedMs - lastNoticeMs < schedule.everyMs)
-    return;
-  return waitedMs < 60000 ? `${Math.floor(waitedMs / 1000)}s` : `${Math.floor(waitedMs / 60000)}m`;
-}
-function runStartedAt(name) {
-  const m = /^(\d{4})(\d{2})(\d{2})T(\d{2})(\d{2})(\d{2})(\d{3})Z/.exec(name);
-  if (m === null)
-    return;
-  const at = Date.parse(`${m[1]}-${m[2]}-${m[3]}T${m[4]}:${m[5]}:${m[6]}.${m[7]}Z`);
-  return Number.isNaN(at) ? undefined : at;
-}
-function currentLog(instanceDir) {
-  return join4(instanceDir, "logs", "current", STDOUT_LOG);
-}
-function tailArgv(file, fromStart, livePid) {
-  const argv = ["tail"];
-  if (fromStart)
-    argv.push("-n", "+1");
-  if (livePid !== undefined)
-    argv.push("-f", "--pid", String(livePid));
-  argv.push(file);
-  return argv;
-}
-function linkCurrent(logsDir, target) {
-  const link = join4(logsDir, "current");
-  try {
-    lstatSync(link);
-    unlinkSync(link);
-  } catch {}
-  symlinkSync(join4("runs", basename2(target)), link, "dir");
-}
-function rotateRuns(logsDir, keep) {
-  const runsDir = join4(logsDir, "runs");
-  if (keep < 1 || !existsSync2(runsDir))
-    return [];
-  const dirs = readdirSync(runsDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name).sort().reverse();
-  const removed = dirs.slice(keep);
-  for (const name of removed)
-    rmSync(join4(runsDir, name), { recursive: true, force: true });
-  return removed;
-}
-
-// src/launch/prepare.ts
-import { existsSync as existsSync3, readFileSync } from "node:fs";
-import { open as open2, readdir as readdir3, readFile, unlink, writeFile } from "node:fs/promises";
-import { join as join5 } from "node:path";
-import { setTimeout as sleep2 } from "node:timers/promises";
-async function inherit(argv) {
-  const proc = spawnArgv(argv, ["ignore", "pipe", "pipe"]);
-  const code = exited(proc);
-  await Promise.all([
-    forwardOutput(proc.stdout, process.stdout),
-    forwardOutput(proc.stderr, process.stderr)
-  ]);
-  return code;
-}
-async function imageDigest(ref) {
-  const { code, stdout } = await capture(["docker", "image", "inspect", "--format", "{{.Id}}", ref]);
-  const id = stdout.trim();
-  return code === 0 && id.length > 0 ? id : null;
-}
-async function readFromImage(ref, path) {
-  const { code, stdout } = await capture(["docker", "run", "--rm", "--entrypoint", "cat", ref, path]);
-  return code === 0 ? stdout : null;
-}
-async function imageLabel(ref, label) {
-  const format = `{{index .Config.Labels "${label}"}}`;
-  const { code, stdout } = await capture(["docker", "image", "inspect", "--format", format, ref]);
-  const value = stdout.trim();
-  if (code !== 0 || value.length === 0 || value === "<no value>")
-    return null;
-  return value;
-}
-async function acquireImage(game, config, pull) {
-  const { image } = config;
-  const present = await imageDigest(image.ref) !== null;
-  if (image.acquire === "build")
-    return await buildImage(game, image, present, pull);
-  if (pull === "never") {
-    if (present)
+  variants.forEach((variant, index) => {
+    const v = variant;
+    const base = v?.["base"];
+    if (base !== "xvfb" && base !== "proton")
       return;
-    throw new GamecrateError(`--pull never but ${image.ref} is not present locally`, Exit.Environment);
-  }
-  if (pull === "missing" && present)
-    return;
-  if (await inherit(["docker", "pull", image.ref]) !== 0) {
-    if (present)
+    const depot = v?.["depot"] ?? "linux";
+    if (depot === "macos") {
+      push("a macos depot cannot be runnable", ["variants", index, "base"], 'set base to "none"; no macos container runtime exists');
       return;
-    throw new GamecrateError(`docker pull failed for ${image.ref}`, Exit.Environment);
-  }
+    }
+    const wants = depot === "windows" ? "proton" : "xvfb";
+    if (base === wants)
+      return;
+    push(`a ${describe(depot)} depot cannot run on the "${base}" base`, ["variants", index, "base"], depot === "windows" ? 'set base to "proton"; it is the only base with wine' : 'set base to "xvfb", or set depot to "windows" if the image should run under wine');
+  });
 }
-async function buildImage(game, image, present, pull) {
-  if (image.context === undefined) {
-    throw new GamecrateError(`${game} has image.acquire "build" but no context`, Exit.Config);
+var steamBuildSchema = obj({
+  branches: z.array(obj({
+    name: str,
+    password: bool.optional(),
+    tags: strArray.optional(),
+    executable: z.record(str, str).optional()
+  }), {
+    error: "expected an array"
+  }),
+  variants: z.array(obj({
+    name: str,
+    depot: oneOf(["linux", "windows", "macos"]).optional(),
+    base: oneOf(["xvfb", "proton", "none"]),
+    include: strArray,
+    executable: str.optional()
+  }), { error: "expected an array" })
+}).check(steamBuildRules);
+var game = obj({
+  gameFiles: obj({ source: oneOf(["mount", "image"]), host: str.optional(), container: str }).check(requiredWhen("host", (v) => v["source"] === "mount")),
+  dataDir: obj({
+    container: str,
+    mode: oneOf(["arg", "env"]),
+    arg: str.optional(),
+    env: strMap.optional()
+  }).check(requiredWhen("arg", (v) => v["mode"] === "arg"), requiredWhen("env", (v) => v["mode"] === "env")),
+  modsDir: obj({ container: str, mask: strArray.optional() }),
+  logFile: obj({ mode: oneOf(["arg", "copy-out"]), arg: str.optional(), from: str.optional() }).check(requiredWhen("arg", (v) => v["mode"] === "arg"), requiredWhen("from", (v) => v["mode"] === "copy-out")),
+  image: obj({
+    ref: str,
+    acquire: oneOf(["pull", "build"]),
+    context: str.optional(),
+    updates: obj({ check: bool.optional(), everyHours: num.optional() }).optional()
+  }).check(requiredWhen("context", (v) => v["acquire"] === "build")),
+  executable: str,
+  managed: strArray.optional(),
+  steamAppId: num,
+  workshopRoot: z.union([z.string(), z.null()], { error: "expected a string or null" }),
+  scanRoots: z.array(obj({ path: str, maxDepth: num, exclude: strArray.optional() }), {
+    error: "expected an array"
+  }),
+  manifest: obj({ file: str }),
+  modsConfig: obj({ file: str }),
+  prefs: obj({ file: str }),
+  version: obj({ file: str }),
+  steamBuild: steamBuildSchema,
+  saveExtensions: strArray,
+  core: str,
+  dlc: strArray,
+  preCore: strArray.optional(),
+  base: strArray.optional(),
+  library: z.record(z.string(), libraryEntry, { error: "expected an object" }).optional(),
+  modes: z.array(modeName, { error: "expected a non-empty array" }).min(1, {
+    error: "expected a non-empty array"
+  }),
+  aliases: strMap.optional(),
+  settings: settings.optional(),
+  ignoresWmDelete: bool.optional(),
+  profiles: z.record(z.string(), profile, { error: "expected an object" })
+});
+var root = obj({
+  plugins: strArray.optional(),
+  dataRoot: str,
+  defaults: obj({ settings: settings.optional() }).optional(),
+  steamcmd: obj({ path: str.optional() }).optional(),
+  games: z.unknown()
+});
+function validateConfig(cfg) {
+  const problems = [];
+  if (!isObj(cfg)) {
+    problems.push({ where: "", message: "expected the config to be an object" });
+    return { config: { dataRoot: "", games: {} }, problems };
   }
-  if (present && pull !== "always")
-    return;
-  if (await inherit(["docker", "build", "--tag", image.ref, image.context]) !== 0) {
-    throw new GamecrateError(`docker build failed for ${image.ref}`, Exit.Environment);
+  collect2(problems, "", root, cfg);
+  const games = cfg["games"];
+  if (!isObj(games)) {
+    problems.push({ where: "/games", message: 'missing required key "games", or it is not an object' });
+    return { config: cfg, problems };
   }
-}
-async function buildTarget(dir) {
-  let entries;
-  try {
-    entries = await readdir3(dir);
-  } catch {
-    return null;
+  for (const [name, entry] of Object.entries(games)) {
+    collect2(problems, `/games/${esc(name)}`, game, entry);
   }
-  const slnx = entries.find((e) => e.endsWith(".slnx"));
-  if (slnx)
-    return join5(dir, slnx);
-  const csproj = entries.find((e) => e.endsWith(".csproj"));
-  return csproj ? join5(dir, csproj) : null;
+  crossReference(problems, games);
+  return { config: cfg, problems };
 }
-async function buildLocalMods(plan, policy) {
-  if (policy === "never")
-    return;
-  const wanted = plan.mods.filter((m) => m.kind === "local" && (policy === "always" || m.stale === true));
-  if (wanted.length === 0)
+function collect2(problems, prefix, schema, value) {
+  const result = schema.safeParse(value);
+  if (result.success)
     return;
-  for (const mod of wanted) {
-    const target = await buildTarget(mod.hostDir);
-    if (target === null)
+  for (const issue of result.error.issues) {
+    if (issue.code === "unrecognized_keys") {
+      const hints = hintsFor(issue.message);
+      issue.keys.forEach((key, i) => {
+        const problem = {
+          where: `${prefix}${pointer(issue.path)}/${esc(key)}`,
+          message: `unknown key "${key}"`
+        };
+        const hint = hints[i];
+        if (hint != null)
+          problem.suggestion = `did you mean "${hint}"?`;
+        problems.push(problem);
+      });
       continue;
-    const code = await inherit(["dotnet", "build", target, "-v", "quiet", "--nologo"]);
-    if (code !== 0) {
-      throw new GamecrateError(`dotnet build failed for ${mod.packageId}`, Exit.Environment, target);
     }
-    mod.stale = false;
-    delete mod.staleReport;
-  }
-}
-async function clearLock(plan) {
-  const path = lockPath(plan);
-  const what = plan.instance === undefined ? plan.profile : `${plan.profile} (${plan.instance})`;
-  const name = containerName(plan);
-  const up = await capture(["docker", "ps", "--quiet", "--filter", `name=^${name}$`]);
-  if (up.stdout.trim().length > 0) {
-    throw new GamecrateError(`${plan.game} ${what} is already running (container ${name})`, Exit.Refused, `stop it with: docker stop ${name}
-or relaunch with --replace`);
-  }
-  const held = await readLock(path);
-  if (held !== undefined && isRunning(held.pid, held.startedAt)) {
-    throw new GamecrateError(`${plan.game} ${what} is already running (pid ${held.pid})`, Exit.Refused, `if that is wrong, delete ${path}
-or relaunch with --replace`);
+    const key = issue.path.at(-1);
+    const missing = typeof key === "string" && valueAt(value, issue.path) === undefined;
+    const problem = {
+      where: `${prefix}${pointer(issue.path)}`,
+      message: missing ? `missing required key "${key}"` : issue.message
+    };
+    const hint = issue.params?.suggestion;
+    if (hint !== undefined)
+      problem.suggestion = hint;
+    problems.push(problem);
   }
-  if (existsSync3(path))
-    await unlink(path).catch(() => {});
-}
-async function unlinkHeld(path, pid, startedAt) {
-  const held = await readLock(path);
-  if (held === undefined)
-    return;
-  if (held.pid !== pid)
-    return;
-  if (startedAt !== undefined && held.startedAt !== startedAt)
-    return;
-  await unlink(path).catch(() => {});
 }
-function heldLock(plan) {
-  const path = lockPath(plan);
-  return {
-    release: async () => {
-      await unlinkHeld(path, process.pid);
-    }
-  };
+function pointer(path) {
+  return path.map((segment) => `/${esc(String(segment))}`).join("");
 }
-async function takeLock(plan) {
-  await clearLock(plan);
-  await writeLock(plan, {
-    pid: process.pid,
-    container: containerName(plan),
-    game: plan.game,
-    profile: plan.profile,
-    ...plan.instance === undefined ? {} : { instance: plan.instance },
-    detached: false,
-    mode: plan.mode
-  });
-  return heldLock(plan);
+function valueAt(root_, path) {
+  let current = root_;
+  for (const segment of path) {
+    if (current === null || typeof current !== "object")
+      return;
+    current = own(current, String(segment));
+  }
+  return current;
 }
-function lockPath(plan) {
-  return join5(plan.instanceDir, ".gamecrate", "lock");
+function crossReference(p, games) {
+  const containers = new Map;
+  for (const [gameName, game_] of Object.entries(games)) {
+    const where = `/games/${esc(gameName)}`;
+    checkName(p, where, gameName, "game");
+    if (!isObj(game_))
+      continue;
+    checkVariantNames(p, where, game_);
+    const profiles = game_["profiles"];
+    if (!isObj(profiles))
+      continue;
+    for (const [name, prof] of Object.entries(profiles)) {
+      const w = `${where}/profiles/${esc(name)}`;
+      checkName(p, w, name, "profile");
+      if (isObj(prof))
+        checkProfile(p, w, name, prof, profiles);
+    }
+    checkCollisions(p, where, gameName, profiles, containers);
+  }
 }
-async function readLock(path) {
-  const text = await readFile(path, "utf8").catch(() => {
+function checkVariantNames(p, where, game_) {
+  const steamBuild = game_["steamBuild"];
+  const variants = isObj(steamBuild) ? steamBuild["variants"] : undefined;
+  if (!Array.isArray(variants))
     return;
+  variants.forEach((variant, index) => {
+    const name = isObj(variant) ? variant["name"] : undefined;
+    if (typeof name !== "string")
+      return;
+    checkName(p, `${where}/steamBuild/variants/${index}/name`, name, "variant");
   });
-  if (text === undefined)
+}
+function checkProfile(p, w, name, prof, profiles) {
+  const names = Object.keys(profiles);
+  checkExtends(p, w, prof, profiles, names);
+  checkAlias(p, w, name, prof, profiles, names);
+  checkAliases(p, w, prof, names);
+  checkInstances(p, w, prof);
+}
+function checkExtends(p, w, prof, profiles, names) {
+  const parent = prof["extends"];
+  if (typeof parent !== "string" || resolves(profiles, parent))
     return;
-  try {
-    const value = JSON.parse(text);
-    return Number.isInteger(value?.pid) && value.pid > 0 ? value : undefined;
-  } catch {
+  const prob = { where: `${w}/extends`, message: `extends unknown profile "${parent}"` };
+  const hint = suggest(parent, names);
+  if (hint)
+    prob.suggestion = `did you mean "${hint}"?`;
+  p.push(prob);
+}
+function checkAlias(p, w, name, prof, profiles, names) {
+  const alias = prof["alias"];
+  if (typeof alias !== "string")
     return;
+  if (!resolves(profiles, alias)) {
+    const prob = { where: `${w}/alias`, message: `alias of unknown profile "${alias}"` };
+    const hint = suggest(alias, [...names, "modless"]);
+    if (hint)
+      prob.suggestion = `did you mean "${hint}"?`;
+    p.push(prob);
+  }
+  if (alias.toLowerCase() === name.toLowerCase()) {
+    p.push({ where: `${w}/alias`, message: "a profile cannot alias itself" });
   }
 }
-async function writeLock(plan, record) {
-  const path = lockPath(plan);
-  const handle = await open2(path, "wx").catch(() => null);
-  if (handle === null) {
-    throw new GamecrateError(`could not take the launch lock at ${path}`, Exit.Environment);
+function checkAliases(p, w, prof, names) {
+  const aliases = prof["aliases"];
+  if (!Array.isArray(aliases))
+    return;
+  for (const [i, entry] of aliases.entries()) {
+    if (typeof entry !== "string")
+      continue;
+    const at = `${w}/aliases/${i}`;
+    checkName(p, at, entry, "profile alias");
+    if (names.some((k) => k.toLowerCase() === entry.toLowerCase())) {
+      p.push({ where: at, message: `alias "${entry}" is already a profile name` });
+    }
   }
-  await handle.writeFile(JSON.stringify({ ...record, startedAt: new Date().toISOString() }));
-  await handle.close();
 }
-var RELEASE_POLL_MS = 100;
-var DRAIN_ALLOWANCE_MS = 1e4;
-var STOP_RELEASE_WAIT_MS = STOP_TIMEOUT_SECONDS * 1000 + DRAIN_ALLOWANCE_MS;
-async function stopRun(record, lockFile) {
-  let signalled = false;
-  if (isRunning(record.pid, record.startedAt)) {
-    try {
-      process.kill(record.pid, "SIGTERM");
-      signalled = true;
-    } catch {}
+function checkInstances(p, w, prof) {
+  const instances = prof["instances"];
+  if (!isObj(instances))
+    return;
+  for (const instance of Object.keys(instances)) {
+    checkName(p, `${w}/instances/${esc(instance)}`, instance, "instance");
   }
-  if (!signalled)
-    await stopContainer(record.container, STOP_TIMEOUT_SECONDS);
-  const deadline = Date.now() + STOP_RELEASE_WAIT_MS;
-  while (existsSync3(lockFile)) {
-    const held = await readLock(lockFile);
-    if (held === undefined)
-      break;
-    if (!isRunning(held.pid, held.startedAt)) {
-      await unlinkHeld(lockFile, record.pid, record.startedAt);
-      break;
+}
+function resolves(profiles, name) {
+  if (name.toLowerCase() === "modless")
+    return true;
+  return profileKey({ profiles }, name) !== undefined;
+}
+function checkCollisions(p, where, gameName, profiles, containers) {
+  const names = new Map;
+  const aliasOwners = new Map;
+  const prefix = `${gameName.toLowerCase()}-`;
+  for (const [name, prof] of Object.entries(profiles)) {
+    const w = `${where}/profiles/${esc(name)}`;
+    const lower = name.toLowerCase();
+    const twin = names.get(lower);
+    if (twin !== undefined) {
+      p.push({
+        where: w,
+        message: `profile "${name}" differs from "${twin}" only in case, so both share one data directory`
+      });
+      continue;
     }
-    if (Date.now() >= deadline)
-      return "held";
-    await sleep2(RELEASE_POLL_MS);
+    names.set(lower, name);
+    const clash = containers.get(prefix + lower);
+    if (clash !== undefined) {
+      p.push({ where: w, message: `container name collides with ${clash}` });
+      continue;
+    }
+    containers.set(prefix + lower, w);
+    if (!isObj(prof))
+      continue;
+    checkAliasOwners(p, w, prof, name, aliasOwners);
+    checkInstanceContainers(p, w, profiles, name, `${prefix}${lower}`, containers);
   }
-  return signalled ? "signalled" : "orphaned";
 }
-async function replacePrevious(plan) {
-  const name = containerName(plan);
-  const path = lockPath(plan);
-  const up = await capture(["docker", "ps", "--quiet", "--filter", `name=^${name}$`]);
-  const running = up.stdout.trim().length > 0;
-  const held = await readLock(path);
-  if (!running && held === undefined && !existsSync3(path))
-    return;
-  if (held !== undefined) {
-    status(`stopping ${held.container}`);
-    await stopRun(held, path);
+function checkAliasOwners(p, w, prof, name, owners) {
+  const aliases = prof["aliases"];
+  if (!Array.isArray(aliases))
     return;
+  for (const [i, entry] of aliases.entries()) {
+    if (typeof entry !== "string")
+      continue;
+    const owner = owners.get(entry.toLowerCase());
+    if (owner !== undefined) {
+      p.push({
+        where: `${w}/aliases/${i}`,
+        message: `alias "${entry}" is already declared by profile "${owner}"`
+      });
+      continue;
+    }
+    owners.set(entry.toLowerCase(), name);
   }
-  if (running) {
-    status(`stopping ${name}`);
-    await stopContainer(name, STOP_TIMEOUT_SECONDS);
+}
+function checkInstanceContainers(p, w, profiles, name, prefix, containers) {
+  const prof = profiles[name];
+  if (!isObj(prof))
+    return;
+  const declared = prof["instances"];
+  for (const instance of instanceNames(profiles, name, prof)) {
+    const container = `${prefix}-${instance.toLowerCase()}`;
+    const at = isObj(declared) && Object.hasOwn(declared, instance) ? `${w}/instances/${esc(instance)}` : w;
+    const first = containers.get(container);
+    if (first !== undefined) {
+      p.push({
+        where: at,
+        message: `instance "${instance}" makes a container name that collides with ${first}`
+      });
+      continue;
+    }
+    containers.set(container, at);
   }
 }
-var CLOCK_TICKS_PER_SECOND = 100;
-var START_TIME_SLACK_MS = 2000;
-function isRunning(pid, startedAt) {
+function instanceNames(profiles, name, prof) {
   try {
-    process.kill(pid, 0);
+    const resolved = resolveProfile({ profiles }, name).instances;
+    return isObj(resolved) ? Object.keys(resolved) : [];
   } catch {
-    return false;
+    const declared = prof["instances"];
+    return isObj(declared) ? Object.keys(declared) : [];
   }
-  if (startedAt === undefined)
-    return true;
-  const written = Date.parse(startedAt);
-  if (Number.isNaN(written))
-    return true;
-  const began = processStart(pid);
-  return began === undefined || began <= written + START_TIME_SLACK_MS;
 }
-function processStart(pid) {
-  try {
-    const stat = readFileSync(`/proc/${pid}/stat`, "utf8");
-    const fields = stat.slice(stat.lastIndexOf(")") + 2).split(" ");
-    const ticks = Number(fields[19]);
-    const boot = bootTime();
-    if (!Number.isFinite(ticks) || boot === undefined)
-      return;
-    return boot + ticks / CLOCK_TICKS_PER_SECOND * 1000;
-  } catch {
+function checkName(p, where, name, kind) {
+  if (RESERVED_NAMES.includes(name.toLowerCase())) {
+    p.push({ where, message: `"${name}" is a reserved name and cannot be used as a ${kind} name` });
     return;
   }
+  if (!NAME_PATTERN.test(name)) {
+    p.push({ where, message: `${kind} name "${name}" must match ${NAME_PATTERN.source}` });
+  }
+}
+function esc(segment) {
+  return segment.replaceAll("~", "~0").replaceAll("/", "~1");
+}
+function isObj(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
 }
-function bootTime() {
-  const line = readFileSync("/proc/stat", "utf8").split(`
-`).find((each) => each.startsWith("btime "));
-  const seconds = Number(line?.slice("btime ".length));
-  return Number.isFinite(seconds) && seconds > 0 ? seconds * 1000 : undefined;
-}
-async function captureScreenshot(container, plan) {
-  const name = `${plan.game}.png`;
-  const target = `${CONTAINER_LOG_DIR}/${name}`;
-  const script = 'D=":$(ls /tmp/.X11-unix 2>/dev/null | head -1 | tr -d X)";' + ' [ "$D" = ":" ] && { echo "no X socket in the container" >&2; exit 1; };' + " X=$(ls -d /tmp/xvfb-run.*/Xauthority 2>/dev/null | head -1);" + ' [ -n "$X" ] && export XAUTHORITY="$X";' + " M=$(command -v magick || command -v convert);" + ' [ -z "$M" ] && { echo "no imagemagick in the container" >&2; exit 1; };' + ` import -display "$D" -window root ${target} 2>/dev/null` + ` || xwd -root -display "$D" | "$M" xwd:- ${target}`;
-  const code = await inherit(["docker", "exec", container, "sh", "-c", script]);
-  const host = join5(plan.runDirHost, name);
-  if (code !== 0 || !existsSync3(host))
-    return null;
-  return host;
-}
-async function writeLaunchRecord(plan, image) {
-  const digest = await imageDigest(image);
-  const line = JSON.stringify({
-    at: new Date().toISOString(),
-    game: plan.game,
-    profile: plan.profile,
-    ...plan.instance === undefined ? {} : { instance: plan.instance },
-    image,
-    digest,
-    mode: plan.mode,
-    mods: plan.mods.map((m) => ({
-      packageId: m.packageId,
-      hostDir: m.hostDir,
-      ...m.worktree === undefined ? {} : { worktree: m.worktree }
-    }))
-  });
-  const path = join5(plan.instanceDir, ".gamecrate", "launches.jsonl");
-  await writeFile(path, `${line}
-`, { flag: "a" });
-}
-
-// src/mods/modindex.ts
-import { createHash as createHash2 } from "node:crypto";
-import { existsSync as existsSync7, readFileSync as readFileSync4, statSync as statSync3 } from "node:fs";
-import { mkdir as mkdir2, readdir as readdir6, readFile as readFile5, writeFile as writeFile2 } from "node:fs/promises";
-import { homedir as homedir3 } from "node:os";
-import { dirname as dirname5, join as join10, relative as relative2, sep as sep2, resolve as resolvePath } from "node:path";
-import picomatch from "picomatch";
 
 // src/config/load.ts
-import { z as z2 } from "zod";
-import { access, readdir as readdir4, readFile as readFile3 } from "node:fs/promises";
-import { homedir as homedir2 } from "node:os";
-import { basename as basename3, dirname as dirname2, join as join7, resolve as resolve3 } from "node:path";
-
-// src/plugin.ts
-import { readFileSync as readFileSync2, statSync } from "node:fs";
-import { dirname, isAbsolute, join as join6, resolve as resolve2 } from "node:path";
-import { pathToFileURL } from "node:url";
-import { exports as exportsField, legacy } from "resolve.exports";
-var PLUGIN_API_VERSION = 2;
-var REQUIRED_FUNCTIONS = [
-  "parseManifest",
-  "renderModsConfig",
-  "mergePrefs",
-  "parseVersion"
-];
-function fail(spec, message, detail) {
-  throw new GamecrateError(`plugin "${spec}": ${message}`, Exit.Config, detail);
+function globalConfigDir() {
+  const base = process.env["XDG_CONFIG_HOME"] ?? join2(homedir(), ".config");
+  return join2(base, "gamecrate");
 }
-function entryOf(dir) {
-  let manifest;
-  try {
-    manifest = JSON.parse(readFileSync2(join6(dir, "package.json"), "utf8"));
-  } catch {
-    return resolve2(dir, "index.js");
+async function findGlobalConfig() {
+  return probe(globalConfigDir(), "profiles");
+}
+async function probe(dir, stem) {
+  const found = [];
+  for (const suffix of CONFIG_SUFFIXES) {
+    const file = join2(dir, `${stem}${suffix}`);
+    try {
+      await access(file);
+      found.push(file);
+    } catch (error) {
+      if (error.code !== "ENOENT")
+        throw error;
+    }
   }
-  let entry;
-  try {
-    entry = exportsField(manifest, ".", { conditions: ["bun"] })?.[0];
-  } catch {}
-  entry ??= legacy(manifest, { fields: ["module", "main"] });
-  return resolve2(dir, entry ?? "index.js");
+  if (found.length > 1) {
+    const rows = found.map((f) => `  ${basename(f)}`).join(`
+`);
+    throw new GamecrateError(`two configs in ${dir}`, Exit.Config, `${rows}
+keep one`);
+  }
+  return found[0];
 }
-function packageDir(spec, from) {
-  let dir = resolve2(from);
+var projectName = z2.custom((v) => typeof v === "string" && NAME_PATTERN.test(v), "expected a name");
+var projectStr = z2.string({ error: "expected a string" });
+var projectBool = z2.boolean({ error: "expected true or false" });
+var projectList = z2.custom((v) => Array.isArray(v) && v.every((entry) => typeof entry === "string"), "expected an array of strings");
+var projectSeconds = z2.custom((v) => Number.isSafeInteger(v) && v >= 0, "expected a whole number of seconds");
+function oneOf2(values) {
+  return z2.enum(values, { error: `expected one of ${values.join(", ")}` });
+}
+var BUILD_POLICIES2 = ["auto", "always", "never"];
+var projectResolution = z2.string({ error: "expected dimensions like 1920x1080" }).check((ctx) => {
+  try {
+    parseResolution(ctx.value);
+  } catch (error) {
+    ctx.issues.push({ code: "custom", message: error.message, input: ctx.value });
+  }
+}).transform(parseResolution);
+var PROJECT_OBJECT = z2.strictObject({
+  game: projectName.optional(),
+  defaultProfile: projectName.optional(),
+  profiles: z2.record(z2.string(), z2.unknown()).optional(),
+  settings: z2.record(z2.string(), z2.unknown()).optional(),
+  library: z2.record(z2.string(), z2.unknown()).optional(),
+  detach: projectBool.optional(),
+  mods: projectList.optional(),
+  without: projectList.optional(),
+  only: projectList.optional(),
+  dockerArgs: projectList.optional(),
+  gameArgs: projectList.optional(),
+  worktree: projectList.optional(),
+  use: projectList.optional(),
+  marker: projectStr.optional(),
+  instance: projectStr.optional(),
+  log: projectStr.optional(),
+  timeout: projectSeconds.optional(),
+  renderWait: projectSeconds.optional(),
+  dryRun: projectBool.optional(),
+  printPlan: projectBool.optional(),
+  json: projectBool.optional(),
+  root: projectBool.optional(),
+  noWorktree: projectBool.optional(),
+  noStaleCheck: projectBool.optional(),
+  replace: projectBool.optional(),
+  mode: oneOf2(["headed", "headless", "screenshot"]).optional(),
+  pull: oneOf2(["always", "missing", "never"]).optional(),
+  sort: oneOf2(["topo", "none"]).optional(),
+  network: oneOf2(["none", "bridge", "host"]).optional(),
+  build: z2.union([z2.boolean().transform((on) => on ? "always" : "never"), z2.enum(BUILD_POLICIES2)], {
+    error: `expected one of ${BUILD_POLICIES2.join(", ")}`
+  }).optional(),
+  resolution: projectResolution.optional()
+}, { error: "expected an object" });
+var PROJECT_SCHEMA = PROJECT_OBJECT.check((ctx) => {
+  const { game, profiles, settings, library } = ctx.value;
+  if (game !== undefined)
+    return;
+  for (const [key, value] of [
+    ["profiles", profiles],
+    ["settings", settings],
+    ["library", library]
+  ]) {
+    if (value === undefined)
+      continue;
+    ctx.issues.push({
+      code: "custom",
+      path: [key],
+      message: "needs a top-level game: to say which game it belongs to",
+      input: ctx.value
+    });
+  }
+});
+async function findProjectConfig(start = process.cwd()) {
+  let dir = resolve2(start);
   for (;; ) {
-    const candidate = join6(dir, "node_modules", spec);
-    if (statSync(join6(candidate, "package.json"), { throwIfNoEntry: false })?.isFile())
-      return candidate;
-    const parent = dirname(dir);
+    const file = await probe(dir, ".gamecrate");
+    if (file !== undefined)
+      return file;
+    const parent = dirname2(dir);
     if (parent === dir)
-      return null;
+      return;
     dir = parent;
   }
 }
-function locate(spec, from) {
-  const expanded = expandHome(spec);
-  let target;
-  if (expanded.startsWith(".") || isAbsolute(expanded)) {
-    target = resolve2(from, expanded);
-  } else {
-    target = packageDir(expanded, from);
-    if (target === null) {
-      fail(spec, `cannot be resolved from ${from}`, "install it, or give a path starting with ./");
+async function loadProjectDefaults(start = process.cwd()) {
+  const file = await findProjectConfig(start);
+  if (file === undefined)
+    return {};
+  const text = await readFile2(file, "utf8");
+  const defaults = validateProjectDefaults(readConfigText(text, file), file);
+  const profiles = defaults.profiles;
+  if (profiles !== undefined) {
+    const order = orderedKeys(text, file, "profiles");
+    if (order.length !== Object.keys(profiles).length || order.some((key) => !Object.hasOwn(profiles, key))) {
+      throw new GamecrateError(`config is invalid: ${file}`, Exit.Config, "duplicate profiles key");
     }
+    defaults.profileOrder = order;
   }
-  return statSync(target, { throwIfNoEntry: false })?.isDirectory() ? entryOf(target) : target;
+  defaults.configPath = file;
+  return defaults;
 }
-function check(spec, value) {
-  if (typeof value !== "object" || value === null)
-    fail(spec, "has no default export");
-  const plugin = value;
-  if (plugin.apiVersion !== PLUGIN_API_VERSION) {
-    fail(spec, `speaks apiVersion ${String(plugin.apiVersion)}, this build speaks ${PLUGIN_API_VERSION}`);
+function validateProjectDefaults(raw, file) {
+  if (raw === null)
+    return {};
+  const result = PROJECT_SCHEMA.safeParse(raw);
+  if (result.success)
+    return result.data;
+  const problems = [];
+  for (const issue of result.error.issues) {
+    if (issue.code === "unrecognized_keys") {
+      for (const key of issue.keys)
+        problems.push(`  /${key}: unknown key`);
+      continue;
+    }
+    problems.push(`  /${issue.path.join("/")}: ${issue.message}`);
   }
-  if (typeof plugin.game !== "string" || plugin.game === "")
-    fail(spec, "declares no game name");
-  const missing = REQUIRED_FUNCTIONS.filter((name) => typeof plugin[name] !== "function");
-  if (missing.length > 0)
-    fail(spec, `is missing ${missing.join(", ")}`);
-  if (typeof plugin.defaults !== "object" || plugin.defaults === null) {
-    fail(spec, "declares no defaults object");
+  throw new GamecrateError(`project config is invalid: ${file}`, Exit.Config, problems.join(`
+`));
+}
+async function loadConfig(path, project) {
+  const file = path ?? await findGlobalConfig() ?? join2(globalConfigDir(), "profiles.yml");
+  const user = await readConfigFile(file);
+  const specs = isObj(user) && user["plugins"] !== undefined ? user["plugins"] : [];
+  if (!Array.isArray(specs) || specs.some((s) => typeof s !== "string")) {
+    throw new GamecrateError(`config is invalid: ${file}`, Exit.Config, "  /plugins: expected an array of strings");
   }
-  if (typeof plugin.windowedPrefs !== "object" || plugin.windowedPrefs === null) {
-    fail(spec, "declares no windowedPrefs object");
+  const plugins = await loadPlugins(specs, file);
+  const base = {
+    dataRoot: DEFAULT_DATA_ROOT,
+    defaults: { settings: structuredClone(DEFAULT_SETTINGS) },
+    games: Object.fromEntries([...plugins].map(([name, plugin]) => [name, structuredClone(plugin.defaults)]))
+  };
+  const merged = user === undefined || user === null ? base : mergeUserConfig(base, user);
+  const spliced = applyProject(merged, project);
+  const { config, problems } = validateConfig(spliced);
+  if (problems.length > 0) {
+    const detail = problems.map((p) => {
+      const hint = p.suggestion ? ` (${p.suggestion})` : "";
+      return `  ${p.where || "/"}: ${p.message}${hint}${origin(p.where, user, plugins, project)}`;
+    }).join(`
+`);
+    const from = plugins.size === 0 ? "" : ` (merged with defaults from: ${[...plugins.keys()].join(", ")})`;
+    throw new GamecrateError(`config is invalid: ${file}${from}`, Exit.Config, detail);
   }
-  return plugin;
+  return { config: expandPaths(config), plugins };
 }
-async function loadPlugins(specs, configFile) {
-  const from = dirname(configFile);
-  const out = new Map;
-  for (const spec of specs) {
-    const target = locate(spec, from);
-    let module;
-    try {
-      module = await import(pathToFileURL(target).href);
-    } catch (error) {
-      fail(spec, `failed to load ${target}`, error instanceof Error ? error.message : String(error));
-    }
-    const plugin = check(spec, module.default);
-    if (out.has(plugin.game))
-      fail(spec, `also claims the game "${plugin.game}"`);
-    out.set(plugin.game, plugin);
+function applyProject(config, project) {
+  if (project === undefined)
+    return config;
+  const game = project.game;
+  if (game === undefined)
+    return config;
+  if (project.profiles === undefined && project.settings === undefined && project.library === undefined) {
+    return config;
+  }
+  const existing = own(config.games, game);
+  if (existing === undefined) {
+    throw new GamecrateError(`the project config names game "${game}", which is not configured`, Exit.Config, `known games: ${Object.keys(config.games).join(", ") || "none"}`);
+  }
+  const target = {
+    ...existing,
+    profiles: { ...existing.profiles, ...project.profiles },
+    ...project.library === undefined ? {} : { library: spliceLibrary(existing.library, project.library) }
+  };
+  config.games[game] = target;
+  if (project.settings !== undefined) {
+    target.settings = deepMerge(target.settings ?? {}, project.settings);
+  }
+  return config;
+}
+function spliceLibrary(global, project) {
+  const replaced = new Set(Object.keys(project).map((id) => id.toLowerCase()));
+  const kept = Object.entries(global ?? {}).filter(([id]) => !replaced.has(id.toLowerCase()));
+  return { ...Object.fromEntries(kept), ...project };
+}
+var GAME_SCOPED_KEYS = ["profiles", "settings", "library"];
+function origin(where, user, plugins, project) {
+  if (!where.startsWith("/"))
+    return "";
+  const segments = where.slice(1).split("/").map((s) => s.replaceAll("~1", "/").replaceAll("~0", "~"));
+  const [section, name, sub, ...rest] = segments;
+  const repoGame = project?.game;
+  const repoSection = GAME_SCOPED_KEYS.find((k) => k === sub);
+  if (repoGame !== undefined && section === "games" && name === repoGame && repoSection !== undefined && valueAt2(project?.[repoSection], rest) !== undefined) {
+    return "  <- from the .gamecrate project config, not this file";
   }
-  return out;
+  if (valueAt2(user, segments) !== undefined)
+    return "";
+  const plugin = section === "games" && name !== undefined ? plugins.get(name) : undefined;
+  if (plugin === undefined)
+    return "  <- not in this file";
+  return valueAt2(plugin.defaults, [sub, ...rest].filter((s) => s !== undefined)) === undefined ? `  <- not in this file, and the ${name} plugin's defaults do not supply it` : `  <- from the ${name} plugin's defaults, not this file`;
 }
-function requirePlugin(plugins, game) {
-  const plugin = plugins.get(game);
-  if (plugin === undefined) {
-    throw new GamecrateError(`no plugin provides the game "${game}"`, Exit.Config, `loaded plugins: ${[...plugins.keys()].join(", ") || "(none)"}`);
+function valueAt2(value, segments) {
+  let current = value;
+  for (const segment of segments) {
+    if (Array.isArray(current))
+      current = current[Number(segment)];
+    else if (isObj(current))
+      current = own(current, segment);
+    else
+      return;
   }
-  return plugin;
+  return current;
 }
-
-// src/config/builtin.ts
-var DEFAULT_DATA_ROOT = "~/.local/share/gamecrate";
-var DEFAULT_SETTINGS = {
-  width: 1920,
-  height: 1080,
-  devMode: true,
-  runInBackground: true,
-  resetModsConfigOnCrash: false,
-  gpu: true,
-  audio: true,
-  input: false,
-  network: "bridge",
-  display: "x11",
-  memory: "8g",
-  cpus: 6,
-  pidsLimit: 1024
-};
-
-// src/config/read.ts
-import { readFile as readFile2 } from "node:fs/promises";
-import { extname } from "node:path";
-import { parseTree } from "jsonc-parser";
-import { isMap, parse as parseYaml, parseDocument } from "yaml";
-
-// src/config/jsonc.ts
-import { parse, printParseErrorCode } from "jsonc-parser";
-function parseJsonc(text) {
-  const errors = [];
-  const value = parse(text, errors, { allowTrailingComma: true, allowEmptyContent: false });
-  const first = errors[0];
-  if (first !== undefined) {
-    throw new GamecrateError("config is not valid JSON", Exit.Config, `${printParseErrorCode(first.error)} at offset ${first.offset}`);
+function resolveSettings(root, game, profile, ...overrides) {
+  let out = structuredClone(DEFAULT_SETTINGS);
+  for (const layer of [root.defaults?.settings, game.settings, profile.settings, ...overrides]) {
+    if (layer)
+      out = deepMerge(out, layer, true);
   }
-  return value;
+  return out;
 }
-
-// src/config/read.ts
-var CONFIG_SUFFIXES = [".yml", ".yaml", ".json", ".jsonc"];
-function isYaml(path) {
-  const suffix = extname(path).toLowerCase();
-  if (suffix === ".yml" || suffix === ".yaml")
-    return true;
-  if (suffix === ".json" || suffix === ".jsonc")
-    return false;
-  throw new GamecrateError(`config is not a format gamecrate reads: ${path}`, Exit.Config, `use one of ${CONFIG_SUFFIXES.join(", ")}`);
+function resolveProfile(game, name) {
+  return resolveNamed(game, name, []);
 }
-function readConfigText(text, path) {
-  if (!isYaml(path)) {
-    try {
-      return parseJsonc(text);
-    } catch (error) {
-      if (error instanceof GamecrateError) {
-        throw new GamecrateError(`${error.message}: ${path}`, error.code, error.detail);
-      }
-      throw error;
-    }
+function resolveNamed(game, name, seen) {
+  if (name.toLowerCase() === "modless")
+    return { mods: [], exclude: [], includeBase: false };
+  const key = profileKey(game, name);
+  if (key === undefined) {
+    throw new GamecrateError(`unknown profile "${name}"`, Exit.Resolution, `known profiles: ${Object.keys(game.profiles).join(", ") || "(none)"}, modless`);
   }
-  try {
-    return parseYaml(text);
-  } catch (error) {
-    throw new GamecrateError(`config is invalid: ${path}`, Exit.Config, error.message);
+  if (seen.includes(key)) {
+    throw new GamecrateError(`profile "${key}" inherits from itself`, Exit.Config, [...seen, key].join(" -> "));
   }
-}
-async function readConfigFile(path) {
-  let text;
-  try {
-    text = await readFile2(path, "utf8");
-  } catch (error) {
-    if (error.code === "ENOENT")
-      return;
-    throw error;
+  const self = own(game.profiles, key);
+  if (self.alias !== undefined)
+    return resolveNamed(game, self.alias, [...seen, key]);
+  const parent = self.extends !== undefined ? resolveNamed(game, self.extends, [...seen, key]) : {};
+  const exclude = [...parent.exclude ?? [], ...self.exclude ?? []];
+  const out = {
+    mods: subtract([...parent.mods ?? [], ...self.mods ?? []], exclude),
+    exclude,
+    settings: deepMerge(parent.settings ?? {}, self.settings ?? {}, true)
+  };
+  const instances = deepMerge(parent.instances ?? {}, self.instances ?? {}, true);
+  if (Object.keys(instances).length > 0)
+    out.instances = instances;
+  const includeBase = self.includeBase ?? parent.includeBase;
+  if (includeBase !== undefined)
+    out.includeBase = includeBase;
+  const auto = self.autoDependencies ?? parent.autoDependencies;
+  if (auto !== undefined)
+    out.autoDependencies = auto;
+  for (const field of ["detach", "replace", "build", "gameVersion", "image", "windowTitle", "windowIcon"]) {
+    const value = self[field] ?? parent[field];
+    if (value !== undefined)
+      Object.assign(out, { [field]: value });
   }
-  return readConfigText(text, path);
+  return out;
 }
-function orderedKeys(text, path, key) {
-  if (isYaml(path)) {
-    const node = parseDocument(text).get(key, true);
-    if (!isMap(node))
-      return [];
-    return node.items.map((item) => String(item.key.value ?? item.key));
+function canonicalProfile(game, name) {
+  if (name.toLowerCase() === "modless")
+    return "modless";
+  const seen = [];
+  let current = name;
+  for (;; ) {
+    const key = profileKey(game, current);
+    if (key === undefined || seen.includes(key))
+      return key ?? current;
+    const next = own(game.profiles, key)?.alias;
+    if (next === undefined)
+      return key;
+    seen.push(key);
+    current = next;
   }
-  const root = parseTree(text);
-  const holder = root?.children?.find((child) => child.children?.[0]?.value === key);
-  const value = holder?.children?.[1];
-  if (value?.type !== "object")
-    return [];
-  return (value.children ?? []).map((prop) => String(prop.children?.[0]?.value));
 }
-
-// src/config/validate.ts
-import { z } from "zod";
-var MODES2 = ["headed", "headless", "screenshot"];
-var HINTS = "\x00gamecrate/hints:";
-function obj(shape) {
-  const known = Object.keys(shape);
-  return z.strictObject(shape, {
-    error: (issue) => issue.code === "unrecognized_keys" ? HINTS + JSON.stringify(issue.keys.map((key) => suggest(key, known) ?? null)) : "expected an object"
+function profileDataDir(root, game, profile) {
+  return resolve2(expandHome(root.dataRoot), game, canonicalProfile(own(root.games, game), profile));
+}
+async function profileDirs(root, game, profile) {
+  if (profile !== undefined)
+    return [profileDataDir(root, game, profile)];
+  const dir = join2(expandHome(root.dataRoot), game);
+  return (await readdir(dir).catch(() => [])).map((name) => join2(dir, name));
+}
+function profileKey(game, name) {
+  if (Object.hasOwn(game.profiles, name))
+    return name;
+  const lower = name.toLowerCase();
+  const direct = Object.keys(game.profiles).find((k) => k.toLowerCase() === lower);
+  if (direct !== undefined)
+    return direct;
+  return Object.keys(game.profiles).find((k) => (own(game.profiles, k)?.aliases ?? []).some((a) => typeof a === "string" && a.toLowerCase() === lower));
+}
+function subtract(mods, exclude) {
+  if (exclude.length === 0)
+    return mods;
+  const patterns = exclude.map(globToRegExp);
+  return mods.filter((entry) => {
+    const ids = entryIds(entry);
+    if (ids.length === 0)
+      return true;
+    return !ids.some((id) => patterns.some((re) => re.test(id)));
   });
 }
-function hintsFor(message) {
-  if (!message.startsWith(HINTS))
-    return [];
-  try {
-    return JSON.parse(message.slice(HINTS.length));
-  } catch {
-    return [];
-  }
+function entryIds(entry) {
+  if (typeof entry === "string")
+    return [entry, entry.replace(/^(workshop|path):/, "")];
+  if ("id" in entry)
+    return [entry.id];
+  return [];
 }
-function requiredWhen(key, when) {
-  return (ctx) => {
-    if (!when(ctx.value) || ctx.value[key] !== undefined)
-      return;
-    ctx.issues.push({ code: "custom", message: `missing required key "${key}"`, path: [key], input: ctx.value });
-  };
+function globToRegExp(pattern) {
+  const body = pattern.replaceAll(/[.+^${}()|[\]\\]/g, String.raw`\$&`).replaceAll("*", ".*").replaceAll("?", ".");
+  return new RegExp(`^${body}$`, "i");
 }
-var str = z.string({ error: "expected a string" });
-var num = z.number({ error: "expected a number" });
-var bool = z.boolean({ error: "expected a boolean" });
-var strArray = z.array(z.string({ error: "expected an array of strings" }), {
-  error: "expected an array of strings"
-});
-var strMap = z.record(z.string(), z.string({ error: "expected an object of string values" }), {
-  error: "expected an object of string values"
-});
-function oneOf(values) {
-  return z.enum(values, { error: `expected one of ${values.join(", ")}` });
+function mergeUserConfig(base, user) {
+  const out = deepMerge(base, user);
+  const games = isObj(user) ? user["games"] : undefined;
+  if (!isObj(games))
+    return out;
+  for (const name of Object.keys(games)) {
+    const theirs = own(games, name);
+    const steamBuild = isObj(theirs) ? theirs["steamBuild"] : undefined;
+    const added = isObj(steamBuild) ? steamBuild["branches"] : undefined;
+    const declared = own(base.games, name)?.steamBuild?.branches;
+    const target = own(out.games, name);
+    if (!Array.isArray(added) || !Array.isArray(declared) || target === undefined)
+      continue;
+    target.steamBuild.branches = concatBranches(declared, added);
+  }
+  return out;
 }
-var modeName = z.unknown().check((ctx) => {
-  const value = ctx.value;
-  if (typeof value === "string" && MODES2.includes(value))
-    return;
-  const hint = typeof value === "string" ? suggest(value, MODES2) : undefined;
-  ctx.issues.push({
-    code: "custom",
-    message: `expected one of ${MODES2.join(", ")}`,
-    input: value,
-    ...hint === undefined ? {} : { params: { suggestion: `did you mean "${hint}"?` } }
+function branchName(entry) {
+  return isObj(entry) && typeof entry["name"] === "string" ? entry["name"] : undefined;
+}
+function concatBranches(declared, added) {
+  const out = [...declared];
+  const at = new Map;
+  out.forEach((branch, index) => {
+    const name = branchName(branch);
+    if (name !== undefined && !at.has(name))
+      at.set(name, index);
   });
-});
-var settings = obj({
-  width: num.optional(),
-  height: num.optional(),
-  devMode: bool.optional(),
-  runInBackground: bool.optional(),
-  resetModsConfigOnCrash: bool.optional(),
-  gpu: bool.optional(),
-  audio: bool.optional(),
-  input: bool.optional(),
-  network: oneOf(["none", "bridge", "host"]).optional(),
-  display: oneOf(["x11", "wayland"]).optional(),
-  memory: str.optional(),
-  cpus: num.optional(),
-  pidsLimit: num.optional(),
-  prefsExtra: strMap.optional(),
-  gameArgs: strArray.optional(),
-  dockerArgs: strArray.optional()
-});
-var dynamicModEntry = obj({
-  match: str,
-  first: strArray.optional(),
-  sort: oneOf(["alpha", "none"]).optional(),
-  minMatches: num.optional()
-});
-var objectModEntry = obj({
-  id: str,
-  workshop: num.optional(),
-  path: str.optional(),
-  optional: bool.optional()
-});
-var modEntry = z.unknown().check((ctx) => {
-  const value = ctx.value;
-  if (typeof value === "string") {
-    if (value.trim() === "")
-      ctx.issues.push({ code: "custom", message: "mod entry is empty", input: value });
-    return;
+  for (const entry of added) {
+    const name = branchName(entry);
+    const index = name === undefined ? undefined : at.get(name);
+    if (index === undefined) {
+      if (name !== undefined)
+        at.set(name, out.length);
+      out.push(entry);
+      continue;
+    }
+    out[index] = deepMerge(out[index], entry);
   }
-  if (!isObj(value)) {
-    ctx.issues.push({ code: "custom", message: "expected a packageId string or an object", input: value });
-    return;
+  return out;
+}
+function deepMerge(base, over, concatArrays = false) {
+  if (Array.isArray(base) && Array.isArray(over)) {
+    return concatArrays ? [...base, ...over] : [...over];
   }
-  const schema = value["match"] !== undefined ? dynamicModEntry : objectModEntry;
-  const result = schema.safeParse(value);
-  if (result.success)
-    return;
-  for (const issue of result.error.issues)
-    ctx.issues.push({ ...issue, input: value });
-});
-var profile = obj({
-  mods: z.array(modEntry, { error: "expected an array" }).optional(),
-  extends: str.optional(),
-  exclude: strArray.optional(),
-  includeBase: bool.optional(),
-  autoDependencies: bool.optional(),
-  settings: settings.optional(),
-  instances: z.record(z.string(), obj({ worktree: str.optional(), settings: settings.optional() }), {
-    error: "expected an object"
-  }).optional(),
-  alias: str.optional(),
-  aliases: strArray.optional(),
-  description: str.optional(),
-  gameVersion: str.optional(),
-  image: str.optional(),
-  detach: bool.optional(),
-  replace: bool.optional(),
-  build: oneOf(["auto", "always", "never"]).optional()
-}).check((ctx) => {
-  const v = ctx.value;
-  if (v.alias !== undefined && (v.extends !== undefined || v.mods !== undefined)) {
-    ctx.issues.push({
-      code: "custom",
-      message: 'an alias profile cannot also declare "mods" or "extends"',
-      input: v
-    });
+  if (isObj(base) && isObj(over)) {
+    const out = { ...base };
+    for (const [k, v] of Object.entries(over)) {
+      if (v === undefined)
+        continue;
+      out[k] = Object.hasOwn(out, k) ? deepMerge(out[k], v, concatArrays) : v;
+    }
+    return out;
   }
-});
-var libraryEntry = obj({
-  workshop: num.optional(),
-  path: str.optional(),
-  git: str.optional(),
-  branch: str.optional(),
-  tag: str.optional(),
-  commit: str.optional(),
-  subdir: str.optional()
-}).check((ctx) => {
-  const v = ctx.value;
-  const push = (message, path) => {
-    ctx.issues.push({ code: "custom", message, input: v, ...path === undefined ? {} : { path } });
-  };
-  const sources = ["workshop", "path", "git"].filter((k) => v[k] !== undefined);
-  if (sources.length === 0)
-    push('library entry needs a "workshop" id, a "path", or a "git" url');
-  if (sources.length > 1)
-    push(`library entry takes only one of ${sources.join(", ")}`);
-  const refs = ["branch", "tag", "commit"].filter((k) => v[k] !== undefined);
-  if (refs.length > 1)
-    push(`library entry takes only one of branch, tag or commit, got ${refs.join(", ")}`);
-  if (v["git"] === undefined) {
-    for (const key of [...refs, ...v["subdir"] === undefined ? [] : ["subdir"]]) {
-      push(`"${key}" needs a "git" url`, [key]);
+  return over;
+}
+function expandPaths(config) {
+  config.dataRoot = expandHome(config.dataRoot);
+  if (config.steamcmd?.path !== undefined)
+    config.steamcmd.path = expandHome(config.steamcmd.path);
+  for (const game of Object.values(config.games)) {
+    if (game.gameFiles.host !== undefined)
+      game.gameFiles.host = expandHome(game.gameFiles.host);
+    if (game.image.context !== undefined)
+      game.image.context = expandHome(game.image.context);
+    if (game.workshopRoot !== null)
+      game.workshopRoot = expandHome(game.workshopRoot);
+    for (const root of game.scanRoots)
+      root.path = expandHome(root.path);
+    for (const entry of Object.values(game.library ?? {})) {
+      if (entry.path !== undefined)
+        entry.path = expandHome(entry.path);
     }
   }
-  const subdir = v["subdir"];
-  if (typeof subdir === "string" && (subdir.startsWith("/") || subdir.split("/").includes(".."))) {
-    push('"subdir" must be a relative path inside the repo, with no ".." segment', ["subdir"]);
+  return config;
+}
+function expandHome(p) {
+  if (p === "~")
+    return homedir();
+  return p.startsWith("~/") ? join2(homedir(), p.slice(2)) : p;
+}
+
+// src/docker/spec.ts
+var CONTAINER_RUNTIME_DIR = "/tmp/xdg";
+var CONTAINER_LOG_DIR = "/logs";
+var X11_SOCKET_DIR = "/tmp/.X11-unix";
+var CONTAINER_XAUTHORITY = "/tmp/xauth";
+var CONTAINER_XDG_DIR = "/xdg";
+var RUNTIME_DIR_SIZE = "64m";
+var HOME_SIZE = "64m";
+var MASK_SIZE = "1m";
+function refuseProtonHeaded(game, mode, image) {
+  if (image?.launcher !== "proton" || mode !== "headed")
+    return;
+  throw new GamecrateError(`${game}: a proton image only runs offscreen`, Exit.Config, 'relaunch with --mode headless, or use a variant whose gamecrate.launcher is "direct"');
+}
+function launchCommand(plan, executable, proton) {
+  const { gameConfig: game, settings } = plan;
+  if (proton) {
+    return ["run-headless-windows", winPath(join3(game.gameFiles.container, basename2(executable)))];
   }
-});
-function repeats(entries, key) {
-  const seen = new Set;
-  const found = [];
-  entries.forEach((entry, index) => {
-    const name = entry?.[key];
-    if (typeof name !== "string")
-      return;
-    if (seen.has(name))
-      found.push({ index, name });
-    else
-      seen.add(name);
-  });
-  return found;
+  if (plan.mode === "headed")
+    return [executable];
+  return ["xvfb-run", "-a", `--server-args=-screen 0 ${settings.width}x${settings.height}x24`, executable];
 }
-function describe(value) {
-  return typeof value === "string" ? value : JSON.stringify(value);
+function appendGameArgs(command, mounts, env, plan, proton) {
+  const { gameConfig: game } = plan;
+  if (game.dataDir.mode === "arg") {
+    const arg = validateDataDirArg(game.dataDir);
+    const eq = arg.indexOf("=");
+    command.push(proton ? `${arg.slice(0, eq + 1)}${winPath(arg.slice(eq + 1))}` : arg);
+  } else
+    Object.assign(env, game.dataDir.env);
+  if (game.logFile.mode !== "arg")
+    return;
+  mounts.push({ type: "bind", source: hostPath(plan.runDirHost), target: CONTAINER_LOG_DIR });
+  const log = `${CONTAINER_LOG_DIR}/Player.log`;
+  command.push(game.logFile.arg, proton ? winPath(log) : log);
 }
-var TAG_COMPONENT = /^\w[\w.-]*$/;
-function steamBuildRules(ctx) {
-  const push = (message, path, suggestion) => {
-    ctx.issues.push({
-      code: "custom",
-      message,
-      path,
-      input: ctx.value,
-      ...suggestion === undefined ? {} : { params: { suggestion } }
+function buildRunSpec(plan, modMounts, identity, image) {
+  const { gameConfig: game, settings } = plan;
+  const headed = plan.mode === "headed";
+  const mounts = [];
+  const env = {
+    HOME: identity.home,
+    USER: identity.user,
+    LOGNAME: identity.user
+  };
+  addGameFiles(mounts, plan);
+  addStage(mounts, plan, modMounts);
+  const proton = image?.launcher === "proton";
+  const executable = image?.executable ?? game.executable;
+  refuseProtonHeaded(plan.game, plan.mode, image);
+  const command = launchCommand(plan, executable, proton);
+  if (proton) {
+    Object.assign(env, {
+      SCREEN: `${settings.width}x${settings.height}x24`,
+      DESKTOP: `${settings.width}x${settings.height}`,
+      STEAM_COMPAT_DATA_PATH: `${CONTAINER_XDG_DIR}/proton`
     });
+  }
+  appendGameArgs(command, mounts, env, plan, proton);
+  addScratch(mounts, env, plan, identity);
+  if (headed)
+    addSession(mounts, env, plan);
+  const deviceCgroupRules = [];
+  if (settings.input) {
+    mounts.push({ type: "bind", source: "/dev/input", target: "/dev/input", readonly: true });
+    deviceCgroupRules.push("c 13:* rmw");
+  }
+  const devices = [];
+  if (settings.gpu)
+    devices.push("nvidia.com/gpu=all");
+  Object.assign(env, glEnv(settings.gpu));
+  command.push(...settings.gameArgs ?? []);
+  return {
+    image: game.image.ref,
+    name: containerName(plan),
+    labels: {
+      "gamecrate.game": plan.game,
+      "gamecrate.profile": plan.profile,
+      ...plan.instance === undefined ? {} : { "gamecrate.instance": plan.instance }
+    },
+    identity,
+    env,
+    mounts,
+    devices,
+    deviceCgroupRules,
+    network: settings.network,
+    memory: settings.memory,
+    memorySwap: settings.memory,
+    cpus: settings.cpus,
+    pidsLimit: settings.pidsLimit,
+    ulimits: ["core=0"],
+    workdir: game.gameFiles.container,
+    ...headed && settings.display === "x11" ? { hostname: hostname() } : {},
+    command,
+    extraArgs: [...settings.dockerArgs ?? []]
   };
-  const branches = ctx.value["branches"];
-  const variants = ctx.value["variants"];
-  if (Array.isArray(variants) && variants.length === 0) {
-    push("steamBuild.variants cannot be empty", ["variants"]);
+}
+function addGameFiles(mounts, plan) {
+  const { gameFiles } = plan.gameConfig;
+  if (gameFiles.source !== "mount")
+    return;
+  if (!gameFiles.host) {
+    throw new GamecrateError(`gameFiles.source is "mount" but no host path is set for ${plan.game}`, Exit.Config);
   }
-  if (Array.isArray(branches)) {
-    if (branches.length === 0)
-      push("steamBuild.branches cannot be empty", ["branches"]);
-    for (const dup of repeats(branches, "name")) {
-      push(`duplicate branch name "${dup.name}"`, ["branches", dup.index, "name"]);
-    }
-    branches.forEach((branch, index) => {
-      const name = branch?.["name"];
-      if (typeof name === "string" && !TAG_COMPONENT.test(name)) {
-        push(`branch name "${name}" must match ${TAG_COMPONENT.source}`, ["branches", index, "name"]);
-      }
-      const tags = branch?.["tags"];
-      if (!Array.isArray(tags))
-        return;
-      tags.forEach((tag, at) => {
-        if (typeof tag !== "string" || TAG_COMPONENT.test(tag))
-          return;
-        push(`branch tag "${String(tag)}" must match ${TAG_COMPONENT.source}`, ["branches", index, "tags", at]);
-      });
-    });
+  mounts.push({ type: "bind", source: hostPath(gameFiles.host), target: gameFiles.container, readonly: true });
+}
+function addStage(mounts, plan, modMounts) {
+  const game = plan.gameConfig;
+  mounts.push({ type: "bind", source: hostPath(plan.stageDirHost), target: game.modsDir.container, readonly: true });
+  for (const mount of modMounts) {
+    mounts.push(mount.type === "bind" ? { ...mount, readonly: true } : mount);
   }
-  if (!Array.isArray(variants))
+  mounts.push({ type: "bind", source: hostPath(plan.dataDirHost), target: game.dataDir.container });
+}
+function addScratch(mounts, env, plan, identity) {
+  const { uid, gid } = identity;
+  for (const target of plan.gameConfig.modsDir.mask ?? []) {
+    mounts.push({ type: "tmpfs", target, size: MASK_SIZE, uid, gid, mode: "755" });
+  }
+  if (uid !== 0) {
+    mounts.push({ type: "tmpfs", target: identity.home, size: HOME_SIZE, uid, gid, mode: "700" });
+  }
+  mounts.push({ type: "tmpfs", target: CONTAINER_RUNTIME_DIR, size: RUNTIME_DIR_SIZE, uid, gid, mode: "700" });
+  env.XDG_RUNTIME_DIR = CONTAINER_RUNTIME_DIR;
+  mounts.push({ type: "bind", source: hostPath(plan.configDirHost), target: CONTAINER_XDG_DIR });
+  env.XDG_CONFIG_HOME = `${CONTAINER_XDG_DIR}/config`;
+  env.XDG_CACHE_HOME = `${CONTAINER_XDG_DIR}/cache`;
+  env.XDG_DATA_HOME ??= `${CONTAINER_XDG_DIR}/data`;
+}
+function addSession(mounts, env, plan) {
+  const { settings } = plan;
+  if (settings.display === "x11")
+    addX11(mounts, env);
+  else
+    addWayland(mounts, env);
+  if (!settings.audio)
     return;
-  for (const dup of repeats(variants, "name")) {
-    push(`duplicate variant name "${dup.name}"`, ["variants", dup.index, "name"]);
+  for (const socket of audioSockets()) {
+    mounts.push({ type: "bind", source: socket.source, target: `${CONTAINER_RUNTIME_DIR}/${socket.name}` });
   }
-  variants.forEach((variant, index) => {
-    const v = variant;
-    const base = v?.["base"];
-    if (base !== "xvfb" && base !== "proton")
-      return;
-    const depot = v?.["depot"] ?? "linux";
-    if (depot === "macos") {
-      push("a macos depot cannot be runnable", ["variants", index, "base"], 'set base to "none"; no macos container runtime exists');
-      return;
-    }
-    const wants = depot === "windows" ? "proton" : "xvfb";
-    if (base === wants)
-      return;
-    push(`a ${describe(depot)} depot cannot run on the "${base}" base`, ["variants", index, "base"], depot === "windows" ? 'set base to "proton"; it is the only base with wine' : 'set base to "xvfb", or set depot to "windows" if the image should run under wine');
-  });
+  env.PULSE_SERVER = `unix:${CONTAINER_RUNTIME_DIR}/pulse/native`;
 }
-var steamBuildSchema = obj({
-  branches: z.array(obj({
-    name: str,
-    password: bool.optional(),
-    tags: strArray.optional(),
-    executable: z.record(str, str).optional()
-  }), {
-    error: "expected an array"
-  }),
-  variants: z.array(obj({
-    name: str,
-    depot: oneOf(["linux", "windows", "macos"]).optional(),
-    base: oneOf(["xvfb", "proton", "none"]),
-    include: strArray,
-    executable: str.optional()
-  }), { error: "expected an array" })
-}).check(steamBuildRules);
-var game = obj({
-  gameFiles: obj({ source: oneOf(["mount", "image"]), host: str.optional(), container: str }).check(requiredWhen("host", (v) => v["source"] === "mount")),
-  dataDir: obj({
-    container: str,
-    mode: oneOf(["arg", "env"]),
-    arg: str.optional(),
-    env: strMap.optional()
-  }).check(requiredWhen("arg", (v) => v["mode"] === "arg"), requiredWhen("env", (v) => v["mode"] === "env")),
-  modsDir: obj({ container: str, mask: strArray.optional() }),
-  logFile: obj({ mode: oneOf(["arg", "copy-out"]), arg: str.optional(), from: str.optional() }).check(requiredWhen("arg", (v) => v["mode"] === "arg"), requiredWhen("from", (v) => v["mode"] === "copy-out")),
-  image: obj({
-    ref: str,
-    acquire: oneOf(["pull", "build"]),
-    context: str.optional(),
-    updates: obj({ check: bool.optional(), everyHours: num.optional() }).optional()
-  }).check(requiredWhen("context", (v) => v["acquire"] === "build")),
-  executable: str,
-  managed: strArray.optional(),
-  steamAppId: num,
-  workshopRoot: z.union([z.string(), z.null()], { error: "expected a string or null" }),
-  scanRoots: z.array(obj({ path: str, maxDepth: num, exclude: strArray.optional() }), {
-    error: "expected an array"
-  }),
-  manifest: obj({ file: str }),
-  modsConfig: obj({ file: str }),
-  prefs: obj({ file: str }),
-  version: obj({ file: str }),
-  steamBuild: steamBuildSchema,
-  saveExtensions: strArray,
-  core: str,
-  dlc: strArray,
-  preCore: strArray.optional(),
-  base: strArray.optional(),
-  library: z.record(z.string(), libraryEntry, { error: "expected an object" }).optional(),
-  modes: z.array(modeName, { error: "expected a non-empty array" }).min(1, {
-    error: "expected a non-empty array"
-  }),
-  aliases: strMap.optional(),
-  settings: settings.optional(),
-  ignoresWmDelete: bool.optional(),
-  profiles: z.record(z.string(), profile, { error: "expected an object" })
-});
-var root = obj({
-  plugins: strArray.optional(),
-  dataRoot: str,
-  defaults: obj({ settings: settings.optional() }).optional(),
-  steamcmd: obj({ path: str.optional() }).optional(),
-  games: z.unknown()
-});
-function validateConfig(cfg) {
-  const problems = [];
-  if (!isObj(cfg)) {
-    problems.push({ where: "", message: "expected the config to be an object" });
-    return { config: { dataRoot: "", games: {} }, problems };
+function addX11(mounts, env) {
+  const x11 = x11Session();
+  if (!x11)
+    return;
+  mounts.push({ type: "bind", source: X11_SOCKET_DIR, target: X11_SOCKET_DIR });
+  env.DISPLAY = x11.display;
+  env.XDG_SESSION_TYPE = "x11";
+  env.SDL_VIDEODRIVER = "x11";
+  env.QT_QPA_PLATFORM = "xcb";
+  if (!x11.xauthority)
+    return;
+  mounts.push({ type: "bind", source: x11.xauthority, target: CONTAINER_XAUTHORITY, readonly: true });
+  env.XAUTHORITY = CONTAINER_XAUTHORITY;
+}
+function addWayland(mounts, env) {
+  const wayland = waylandSocket();
+  if (!wayland)
+    return;
+  mounts.push({ type: "bind", source: wayland.source, target: `${CONTAINER_RUNTIME_DIR}/${wayland.name}` });
+  env.WAYLAND_DISPLAY = wayland.name;
+  env.XDG_SESSION_TYPE = "wayland";
+  env.SDL_VIDEODRIVER = "wayland";
+  env.QT_QPA_PLATFORM = "wayland";
+}
+function containerName(plan) {
+  const base = `gamecrate-${plan.game}-${plan.profile}`;
+  return plan.instance === undefined ? base : `${base}-${plan.instance}`;
+}
+function windowIcon(plan, configDir) {
+  const named = resolveProfile(plan.gameConfig, plan.profile).windowIcon;
+  if (named === undefined)
+    return;
+  const path = expandHome(named);
+  return isAbsolute2(path) ? path : resolve3(configDir, path);
+}
+function windowTitle(plan) {
+  const own = resolveProfile(plan.gameConfig, plan.profile).windowTitle;
+  const base = own ?? `${plan.game} ${plan.profile}`;
+  return plan.instance === undefined ? base : `${base} / ${plan.instance}`;
+}
+function toDockerArgs(spec) {
+  const args = ["run", "--rm", "--init", "--name", spec.name];
+  if (spec.hostname !== undefined)
+    args.push("--hostname", spec.hostname);
+  for (const [key, value] of Object.entries(spec.labels))
+    args.push("--label", `${key}=${value}`);
+  args.push("--user", `${spec.identity.uid}:${spec.identity.gid}`);
+  for (const [key, value] of Object.entries(spec.env))
+    args.push("--env", `${key}=${value}`);
+  for (const mount of spec.mounts)
+    args.push(...mountArgs(mount));
+  for (const device of spec.devices)
+    args.push("--device", device);
+  for (const rule of spec.deviceCgroupRules)
+    args.push("--device-cgroup-rule", rule);
+  for (const ulimit of spec.ulimits)
+    args.push("--ulimit", ulimit);
+  args.push("--network", spec.network, "--memory", spec.memory, "--memory-swap", spec.memorySwap, "--cpus", String(spec.cpus), "--pids-limit", String(spec.pidsLimit), "--workdir", spec.workdir, ...spec.extraArgs, "--pull=never");
+  const [entrypoint, ...rest] = spec.command;
+  if (entrypoint !== undefined)
+    args.push("--entrypoint", entrypoint);
+  args.push(spec.image, ...rest);
+  return args;
+}
+function mountArgs(mount) {
+  if (mount.type === "tmpfs") {
+    const opts = ["rw"];
+    if (mount.uid !== undefined)
+      opts.push(`uid=${mount.uid}`);
+    if (mount.gid !== undefined)
+      opts.push(`gid=${mount.gid}`);
+    if (mount.mode)
+      opts.push(`mode=${mount.mode}`);
+    opts.push(`size=${mount.size ?? RUNTIME_DIR_SIZE}`);
+    return ["--tmpfs", `${mount.target}:${opts.join(",")}`];
   }
-  collect3(problems, "", root, cfg);
-  const games = cfg["games"];
-  if (!isObj(games)) {
-    problems.push({ where: "/games", message: 'missing required key "games", or it is not an object' });
-    return { config: cfg, problems };
+  if (!mount.source) {
+    throw new GamecrateError(`bind mount at ${mount.target} has no source`, Exit.Config);
   }
-  for (const [name, entry] of Object.entries(games)) {
-    collect3(problems, `/games/${esc(name)}`, game, entry);
+  const fields = [`type=bind`, `src=${mount.source}`, `dst=${mount.target}`];
+  if (mount.readonly)
+    fields.push("readonly");
+  return ["--mount", fields.map(csvField).join(",")];
+}
+function csvField(field) {
+  if (!field.includes(",") && !field.includes('"'))
+    return field;
+  return `"${field.replaceAll('"', '""')}"`;
+}
+function winPath(unix) {
+  return `Z:${unix.replaceAll("/", "\\")}`;
+}
+function validateDataDirArg(dataDir) {
+  if (dataDir.container.includes("=")) {
+    throw new GamecrateError(`container data path contains "=": ${dataDir.container}`, Exit.Config, "RimWorld silently ignores -savedatafolder when the argv element does not split into exactly two parts, and the save is lost with --rm.");
   }
-  crossReference(problems, games);
-  return { config: cfg, problems };
+  const parts = dataDir.arg.split("=");
+  if (parts.length !== 2) {
+    throw new GamecrateError(`dataDir.arg must contain exactly one "=": ${dataDir.arg}`, Exit.Config);
+  }
+  if (trimSlash(parts[1] ?? "") !== trimSlash(dataDir.container)) {
+    throw new GamecrateError(`dataDir.arg points at ${parts[1]} but the mount target is ${dataDir.container}`, Exit.Config, "The engine would write to a path that is not the mounted data directory.");
+  }
+  return dataDir.arg;
+}
+function trimSlash(path) {
+  let end = path.length;
+  while (end > 1 && path[end - 1] === "/")
+    end--;
+  return path.slice(0, end);
 }
-function collect3(problems, prefix, schema, value) {
-  const result = schema.safeParse(value);
-  if (result.success)
-    return;
-  for (const issue of result.error.issues) {
-    if (issue.code === "unrecognized_keys") {
-      const hints = hintsFor(issue.message);
-      issue.keys.forEach((key, i) => {
-        const problem = {
-          where: `${prefix}${pointer(issue.path)}/${esc(key)}`,
-          message: `unknown key "${key}"`
-        };
-        const hint = hints[i];
-        if (hint != null)
-          problem.suggestion = `did you mean "${hint}"?`;
-        problems.push(problem);
-      });
-      continue;
-    }
-    const key = issue.path.at(-1);
-    const missing = typeof key === "string" && valueAt(value, issue.path) === undefined;
-    const problem = {
-      where: `${prefix}${pointer(issue.path)}`,
-      message: missing ? `missing required key "${key}"` : issue.message
-    };
-    const hint = issue.params?.suggestion;
-    if (hint !== undefined)
-      problem.suggestion = hint;
-    problems.push(problem);
+function glEnv(gpu) {
+  if (!gpu)
+    return { LIBGL_ALWAYS_SOFTWARE: "1", GALLIUM_DRIVER: "llvmpipe" };
+  const env = { LIBGL_ALWAYS_SOFTWARE: "0", GALLIUM_DRIVER: "" };
+  if (hasNvidia()) {
+    env.__GLX_VENDOR_LIBRARY_NAME = "nvidia";
+    env.__NV_PRIME_RENDER_OFFLOAD = "1";
   }
+  return env;
 }
-function pointer(path) {
-  return path.map((segment) => `/${esc(String(segment))}`).join("");
+function hasNvidia() {
+  return existsSync("/dev/nvidiactl") || existsSync("/etc/cdi/nvidia.yaml") || existsSync("/usr/share/vulkan/icd.d/nvidia_icd.json");
 }
-function valueAt(root_, path) {
-  let current = root_;
-  for (const segment of path) {
-    if (current === null || typeof current !== "object")
-      return;
-    current = own(current, String(segment));
+function x11Session() {
+  const display = process.env.DISPLAY;
+  if (!display)
+    return null;
+  const cookie = process.env.XAUTHORITY ?? join3(homedir2(), ".Xauthority");
+  return { display, xauthority: existsSync(cookie) ? cookie : null };
+}
+function waylandSocket() {
+  const display = process.env.WAYLAND_DISPLAY;
+  const runtime = process.env.XDG_RUNTIME_DIR;
+  if (!display)
+    return null;
+  let source = null;
+  if (display.startsWith("/"))
+    source = display;
+  else if (runtime)
+    source = join3(runtime, display);
+  if (!source || !existsSync(source))
+    return null;
+  return { source, name: basename2(source) };
+}
+function audioSockets() {
+  const runtime = process.env.XDG_RUNTIME_DIR;
+  if (!runtime)
+    return [];
+  const found = [];
+  for (const name of ["pipewire-0", "pulse/native"]) {
+    const source = join3(runtime, name);
+    if (existsSync(source))
+      found.push({ source, name });
   }
-  return current;
+  return found;
 }
-function crossReference(p, games) {
-  const containers = new Map;
-  for (const [gameName, game_] of Object.entries(games)) {
-    const where = `/games/${esc(gameName)}`;
-    checkName(p, where, gameName, "game");
-    if (!isObj(game_))
-      continue;
-    checkVariantNames(p, where, game_);
-    const profiles = game_["profiles"];
-    if (!isObj(profiles))
-      continue;
-    for (const [name, prof] of Object.entries(profiles)) {
-      const w = `${where}/profiles/${esc(name)}`;
-      checkName(p, w, name, "profile");
-      if (isObj(prof))
-        checkProfile(p, w, name, prof, profiles);
-    }
-    checkCollisions(p, where, gameName, profiles, containers);
+function hostPath(path) {
+  try {
+    return realpathSync(path);
+  } catch {
+    return path;
   }
 }
-function checkVariantNames(p, where, game_) {
-  const steamBuild = game_["steamBuild"];
-  const variants = isObj(steamBuild) ? steamBuild["variants"] : undefined;
-  if (!Array.isArray(variants))
-    return;
-  variants.forEach((variant, index) => {
-    const name = isObj(variant) ? variant["name"] : undefined;
-    if (typeof name !== "string")
-      return;
-    checkName(p, `${where}/steamBuild/variants/${index}/name`, name, "variant");
-  });
+
+// src/docker/run.ts
+function spawnArgv(argv, stdio, detached = false) {
+  return spawn(argv[0], argv.slice(1), { stdio, detached });
 }
-function checkProfile(p, w, name, prof, profiles) {
-  const names = Object.keys(profiles);
-  checkExtends(p, w, prof, profiles, names);
-  checkAlias(p, w, name, prof, profiles, names);
-  checkAliases(p, w, prof, names);
-  checkInstances(p, w, prof);
+function exited(proc) {
+  return new Promise((resolve, reject) => {
+    proc.once("error", reject);
+    proc.once("close", (code) => resolve(code ?? 1));
+  });
 }
-function checkExtends(p, w, prof, profiles, names) {
-  const parent = prof["extends"];
-  if (typeof parent !== "string" || resolves(profiles, parent))
-    return;
-  const prob = { where: `${w}/extends`, message: `extends unknown profile "${parent}"` };
-  const hint = suggest(parent, names);
-  if (hint)
-    prob.suggestion = `did you mean "${hint}"?`;
-  p.push(prob);
+async function collect3(stream) {
+  const chunks = [];
+  for await (const chunk of stream)
+    chunks.push(chunk);
+  return Buffer.concat(chunks).toString("utf8");
 }
-function checkAlias(p, w, name, prof, profiles, names) {
-  const alias = prof["alias"];
-  if (typeof alias !== "string")
-    return;
-  if (!resolves(profiles, alias)) {
-    const prob = { where: `${w}/alias`, message: `alias of unknown profile "${alias}"` };
-    const hint = suggest(alias, [...names, "modless"]);
-    if (hint)
-      prob.suggestion = `did you mean "${hint}"?`;
-    p.push(prob);
+async function capture(argv) {
+  try {
+    const proc = spawnArgv(argv, ["ignore", "pipe", "pipe"]);
+    const [stdout, stderr, code] = await Promise.all([
+      collect3(proc.stdout),
+      collect3(proc.stderr),
+      exited(proc)
+    ]);
+    return { code, stdout, stderr };
+  } catch (error) {
+    return { code: 127, stdout: "", stderr: error instanceof Error ? error.message : String(error) };
   }
-  if (alias.toLowerCase() === name.toLowerCase()) {
-    p.push({ where: `${w}/alias`, message: "a profile cannot alias itself" });
+}
+async function captureLive(argv, env) {
+  const proc = spawn(argv[0], argv.slice(1), { stdio: ["ignore", "pipe", "pipe"], env });
+  const chunks = [];
+  const keep = async (stream) => {
+    for await (const chunk of stream) {
+      process.stderr.write(chunk);
+      chunks.push(chunk);
+    }
+  };
+  const [, , code] = await Promise.all([keep(proc.stdout), keep(proc.stderr), exited(proc)]);
+  return { code, text: Buffer.concat(chunks).toString("utf8") };
+}
+var STDOUT_LOG = "stdout.log";
+var MARKER_POLL_MS = 200;
+async function runContainer(spec, opts) {
+  const stopTimeout = opts.stopTimeoutSeconds ?? 10;
+  mkdirSync(opts.logDir, { recursive: true });
+  const sink = createWriteStream(join4(opts.logDir, STDOUT_LOG));
+  const proc = spawnArgv(["docker", ...toDockerArgs(spec)], ["inherit", "pipe", "pipe"]);
+  let interrupted = false;
+  const onSignal = () => {
+    if (interrupted)
+      return;
+    interrupted = true;
+    stopContainer(spec.name, stopTimeout);
+  };
+  process.on("SIGINT", onSignal);
+  process.on("SIGTERM", onSignal);
+  const code = exited(proc);
+  try {
+    await Promise.all([
+      tee(proc.stdout, sink, process.stdout),
+      tee(proc.stderr, sink, process.stderr)
+    ]);
+    const status = await code;
+    return interrupted ? Exit.Interrupted : status;
+  } finally {
+    process.off("SIGINT", onSignal);
+    process.off("SIGTERM", onSignal);
+    await new Promise((resolve) => sink.end(resolve));
   }
 }
-function checkAliases(p, w, prof, names) {
-  const aliases = prof["aliases"];
-  if (!Array.isArray(aliases))
-    return;
-  for (const [i, entry] of aliases.entries()) {
-    if (typeof entry !== "string")
-      continue;
-    const at = `${w}/aliases/${i}`;
-    checkName(p, at, entry, "profile alias");
-    if (names.some((k) => k.toLowerCase() === entry.toLowerCase())) {
-      p.push({ where: at, message: `alias "${entry}" is already a profile name` });
+var STOP_TIMEOUT_SECONDS = 10;
+async function stopContainer(name, timeoutSeconds) {
+  const proc = spawnArgv(["docker", "stop", "--timeout", String(timeoutSeconds), name], "ignore");
+  await exited(proc).catch(() => {});
+}
+async function waitForMarker(sources, marker, timeoutSeconds) {
+  const deadline = Date.now() + timeoutSeconds * 1000;
+  const carry = Math.max(marker.length - 1, 0);
+  const seen = new Map;
+  const startedAt = Date.now();
+  while (true) {
+    for (const path of await expandSources(sources)) {
+      let state = seen.get(path);
+      if (state === undefined) {
+        state = { offset: await staleSize(path, startedAt), tail: "", decoder: new TextDecoder };
+        seen.set(path, state);
+      }
+      if (await scan(path, state, marker, carry))
+        return true;
     }
+    if (Date.now() >= deadline)
+      return false;
+    await sleep(Math.min(MARKER_POLL_MS, Math.max(deadline - Date.now(), 0)));
   }
 }
-function checkInstances(p, w, prof) {
-  const instances = prof["instances"];
-  if (!isObj(instances))
-    return;
-  for (const instance of Object.keys(instances)) {
-    checkName(p, `${w}/instances/${esc(instance)}`, instance, "instance");
+async function staleSize(path, startedAt) {
+  return stat(path).then((info) => info.mtimeMs < startedAt ? info.size : 0, () => 0);
+}
+async function scan(path, state, marker, carry) {
+  const handle = await open(path, "r").catch(() => null);
+  if (handle === null)
+    return false;
+  try {
+    const { size } = await handle.stat();
+    if (size < state.offset) {
+      state.offset = 0;
+      state.tail = "";
+      state.decoder = new TextDecoder;
+    }
+    if (size <= state.offset)
+      return false;
+    const buffer = Buffer.alloc(size - state.offset);
+    const { bytesRead } = await handle.read(buffer, 0, buffer.length, state.offset);
+    state.offset += bytesRead;
+    const text = state.tail + state.decoder.decode(buffer.subarray(0, bytesRead), { stream: true });
+    if (text.includes(marker))
+      return true;
+    state.tail = carry > 0 ? text.slice(-carry) : "";
+    return false;
+  } catch {
+    return false;
+  } finally {
+    await handle.close().catch(() => {});
   }
 }
-function resolves(profiles, name) {
-  if (name.toLowerCase() === "modless")
-    return true;
-  return profileKey({ profiles }, name) !== undefined;
-}
-function checkCollisions(p, where, gameName, profiles, containers) {
-  const names = new Map;
-  const aliasOwners = new Map;
-  const prefix = `${gameName.toLowerCase()}-`;
-  for (const [name, prof] of Object.entries(profiles)) {
-    const w = `${where}/profiles/${esc(name)}`;
-    const lower = name.toLowerCase();
-    const twin = names.get(lower);
-    if (twin !== undefined) {
-      p.push({
-        where: w,
-        message: `profile "${name}" differs from "${twin}" only in case, so both share one data directory`
-      });
+async function expandSources(sources) {
+  const out = [];
+  for (const source of sources) {
+    const info = await stat(source).catch(() => null);
+    if (info === null) {
+      out.push(source);
       continue;
     }
-    names.set(lower, name);
-    const clash = containers.get(prefix + lower);
-    if (clash !== undefined) {
-      p.push({ where: w, message: `container name collides with ${clash}` });
+    if (!info.isDirectory()) {
+      out.push(source);
       continue;
     }
-    containers.set(prefix + lower, w);
-    if (!isObj(prof))
-      continue;
-    checkAliasOwners(p, w, prof, name, aliasOwners);
-    checkInstanceContainers(p, w, profiles, name, `${prefix}${lower}`, containers);
+    const entries = await readdir2(source).catch(() => []);
+    for (const entry of entries) {
+      if (entry.toLowerCase().endsWith(".log"))
+        out.push(join4(source, entry));
+    }
   }
+  return out;
 }
-function checkAliasOwners(p, w, prof, name, owners) {
-  const aliases = prof["aliases"];
-  if (!Array.isArray(aliases))
-    return;
-  for (const [i, entry] of aliases.entries()) {
-    if (typeof entry !== "string")
-      continue;
-    const owner = owners.get(entry.toLowerCase());
-    if (owner !== undefined) {
-      p.push({
-        where: `${w}/aliases/${i}`,
-        message: `alias "${entry}" is already declared by profile "${owner}"`
-      });
-      continue;
-    }
-    owners.set(entry.toLowerCase(), name);
+async function tee(stream, sink, mirror) {
+  for await (const chunk of stream) {
+    mirror.write(chunk);
+    sink.write(chunk);
   }
 }
-function checkInstanceContainers(p, w, profiles, name, prefix, containers) {
-  const prof = profiles[name];
-  if (!isObj(prof))
+
+// src/mods/staleness.ts
+import { readdir as readdir3, stat as stat2 } from "node:fs/promises";
+import { join as join5, relative } from "node:path";
+var SKIP_DIRS = new Set([".git", ".retired", ".vs", "bin", "node_modules", "obj"]);
+var ENTRY_LIMIT = 20000;
+async function scanBuildTimes(dir) {
+  const state = { root: dir, times: { sourceTimes: [] }, budget: ENTRY_LIMIT };
+  await walk(state, dir, false);
+  return state.times;
+}
+async function walk(state, current, inAssemblies) {
+  let entries;
+  try {
+    entries = await readdir3(current, { withFileTypes: true });
+  } catch {
     return;
-  const declared = prof["instances"];
-  for (const instance of instanceNames(profiles, name, prof)) {
-    const container = `${prefix}-${instance.toLowerCase()}`;
-    const at = isObj(declared) && Object.hasOwn(declared, instance) ? `${w}/instances/${esc(instance)}` : w;
-    const first = containers.get(container);
-    if (first !== undefined) {
-      p.push({
-        where: at,
-        message: `instance "${instance}" makes a container name that collides with ${first}`
-      });
+  }
+  for (const entry of entries) {
+    if (state.budget-- <= 0)
+      return;
+    const path = join5(current, entry.name);
+    if (entry.isDirectory()) {
+      if (!SKIP_DIRS.has(entry.name.toLowerCase())) {
+        await walk(state, path, inAssemblies || entry.name === "Assemblies");
+      }
       continue;
     }
-    containers.set(container, at);
+    if (entry.isFile())
+      await record(state, path, entry.name, inAssemblies);
   }
 }
-function instanceNames(profiles, name, prof) {
+async function record(state, path, name, inAssemblies) {
+  const lower = name.toLowerCase();
+  const isSource = lower.endsWith(".cs");
+  const isAssembly = inAssemblies && lower.endsWith(".dll");
+  if (!isSource && !isAssembly)
+    return;
+  let mtimeMs;
   try {
-    const resolved = resolveProfile({ profiles }, name).instances;
-    return isObj(resolved) ? Object.keys(resolved) : [];
+    mtimeMs = (await stat2(path)).mtimeMs;
   } catch {
-    const declared = prof["instances"];
-    return isObj(declared) ? Object.keys(declared) : [];
+    return;
+  }
+  const { times } = state;
+  const found = { path: relative(state.root, path), mtimeMs };
+  if (isSource) {
+    times.sourceTimes.push(mtimeMs);
+    if (mtimeMs > (times.newestSource?.mtimeMs ?? -1))
+      times.newestSource = found;
+  } else if (mtimeMs > (times.newestAssembly?.mtimeMs ?? -1)) {
+    times.newestAssembly = found;
+  }
+}
+var SKEW_MS = 1000;
+function newerThan(source, assembly) {
+  return source - assembly > SKEW_MS;
+}
+function decideStale(times) {
+  const { newestSource, newestAssembly } = times;
+  if (newestSource === undefined)
+    return false;
+  return newestAssembly === undefined || newerThan(newestSource.mtimeMs, newestAssembly.mtimeMs);
+}
+function staleReport(times) {
+  const { newestSource, newestAssembly } = times;
+  if (newestSource === undefined || newestAssembly === undefined)
+    return null;
+  if (!newerThan(newestSource.mtimeMs, newestAssembly.mtimeMs))
+    return null;
+  return {
+    newestSource: newestSource.path,
+    newestSourceMs: newestSource.mtimeMs,
+    assembly: newestAssembly.path,
+    assemblyMs: newestAssembly.mtimeMs,
+    newerCount: times.sourceTimes.filter((t) => newerThan(t, newestAssembly.mtimeMs)).length
+  };
+}
+var INDENT = " ".repeat("warning: ".length);
+function staleWarning(packageId, report, now = Date.now()) {
+  const files = report.newerCount === 1 ? "1 source file" : `${report.newerCount} source files`;
+  return [
+    `${packageId} has ${files} newer than ${report.assembly}`,
+    `${INDENT}newest: ${report.newestSource} (${ago(report.newestSourceMs, now)})`,
+    `${INDENT}you are probably running a stale build`
+  ].join(`
+`);
+}
+function duration(ms) {
+  const seconds = Math.max(0, Math.round(ms / 1000));
+  if (seconds < 60)
+    return `${seconds}s`;
+  if (seconds < 3600)
+    return `${Math.floor(seconds / 60)}m`;
+  if (seconds < 86400)
+    return `${Math.floor(seconds / 3600)}h`;
+  return `${Math.floor(seconds / 86400)}d`;
+}
+function ago(mtimeMs, now = Date.now()) {
+  return `${duration(now - mtimeMs)} ago`;
+}
+
+// src/cli/output.ts
+function status(message) {
+  process.stderr.write(line(message));
+}
+function warn(message) {
+  process.stderr.write(line(`warning: ${message}`));
+}
+function redirectOutput(path, keep = false) {
+  const fd = openSync(path, keep ? "a" : "w");
+  const stdout = process.stdout.write;
+  const stderr = process.stderr.write;
+  let open = true;
+  const write = (chunk, encodingOrCallback, callback) => {
+    append(fd, chunk);
+    const done = typeof encodingOrCallback === "function" ? encodingOrCallback : callback;
+    done?.();
+    return true;
+  };
+  process.stdout.write = write;
+  process.stderr.write = write;
+  return {
+    close() {
+      if (!open)
+        return;
+      open = false;
+      process.stdout.write = stdout;
+      process.stderr.write = stderr;
+      closeSync(fd);
+    }
+  };
+}
+async function forwardOutput(stream, target) {
+  for await (const chunk of stream)
+    target.write(chunk);
+}
+function line(message) {
+  return message.endsWith(`
+`) ? message : `${message}
+`;
+}
+function reportProblems(problems) {
+  if (problems.length === 0) {
+    throw new GamecrateError("resolution failed with no reported detail", Exit.Resolution);
+  }
+  const groups = new Map;
+  for (const problem of problems) {
+    const group = groups.get(problem.where);
+    if (group)
+      group.push(problem);
+    else
+      groups.set(problem.where, [problem]);
+  }
+  const out = [];
+  for (const [where, group] of groups) {
+    out.push(`  ${where}`);
+    for (const problem of group) {
+      out.push(`    ${problem.message}`);
+      if (problem.suggestion)
+        out.push(`      did you mean ${problem.suggestion}?`);
+    }
   }
+  throw new GamecrateError(`${problems.length} problem${problems.length === 1 ? "" : "s"}`, Exit.Resolution, out.join(`
+`));
+}
+function planWarnings(plan) {
+  if (!plan.warnOnStale)
+    return plan.warnings;
+  const stale = plan.mods.filter((mod) => mod.staleReport !== undefined).map((mod) => staleWarning(mod.packageId, mod.staleReport));
+  return [...plan.warnings, ...stale];
+}
+function planPayload(plan) {
+  return {
+    game: plan.game,
+    profile: plan.profile,
+    ...plan.instance === undefined ? {} : { instance: plan.instance },
+    mode: plan.mode,
+    ...plan.marker === undefined ? {} : { marker: plan.marker },
+    timeoutSeconds: plan.timeoutSeconds,
+    renderWaitSeconds: plan.renderWaitSeconds,
+    profileDir: resolve4(plan.profileDir),
+    instanceDir: resolve4(plan.instanceDir),
+    containerName: containerName(plan),
+    dataDirHost: resolve4(plan.dataDirHost),
+    stageDirHost: resolve4(plan.stageDirHost),
+    logsDirHost: resolve4(plan.logsDirHost),
+    mods: plan.mods.map((mod) => ({
+      packageId: mod.packageId,
+      kind: mod.kind,
+      hostDir: resolve4(mod.hostDir),
+      containerDir: mod.containerDir,
+      origin: mod.explicit ? "explicit" : "auto",
+      stale: mod.stale === true,
+      ...mod.staleReport === undefined ? {} : { staleReport: mod.staleReport },
+      ...mod.workshopId === undefined ? {} : { workshopId: mod.workshopId }
+    })),
+    warnings: planWarnings(plan)
+  };
 }
-function checkName(p, where, name, kind) {
-  if (RESERVED_NAMES.includes(name.toLowerCase())) {
-    p.push({ where, message: `"${name}" is a reserved name and cannot be used as a ${kind} name` });
+function printPlan(plan, asJson) {
+  const payload = planPayload(plan);
+  if (asJson) {
+    process.stdout.write(`${JSON.stringify(payload, null, 2)}
+`);
     return;
   }
-  if (!NAME_PATTERN.test(name)) {
-    p.push({ where, message: `${kind} name "${name}" must match ${NAME_PATTERN.source}` });
+  const title = payload.instance === undefined ? `${payload.game} ${payload.profile} (${payload.mode})` : `${payload.game} ${payload.profile} / ${payload.instance} (${payload.mode})`;
+  const out = [
+    title,
+    `  profile   ${payload.profileDir}`,
+    `  instance  ${payload.instanceDir}`,
+    `  container ${payload.containerName}`,
+    `  data      ${payload.dataDirHost}`,
+    `  stage     ${payload.stageDirHost}`,
+    `  logs      ${payload.logsDirHost}`
+  ];
+  if (payload.marker !== undefined)
+    out.push(`  marker    ${payload.marker}`);
+  out.push(`  timeout   ${payload.timeoutSeconds}s, render wait ${payload.renderWaitSeconds}s`, `  mods      ${payload.mods.length}`);
+  const width = Math.max(0, ...payload.mods.map((m) => m.packageId.length));
+  for (const mod of payload.mods) {
+    const notes = [mod.kind, mod.origin];
+    if (mod.stale)
+      notes.push("stale");
+    out.push(`    ${mod.packageId.padEnd(width)}  ${notes.join(" ")}  ${mod.hostDir} -> ${mod.containerDir}`);
   }
+  for (const warning of payload.warnings)
+    out.push(`  warning: ${warning}`);
+  process.stdout.write(`${out.join(`
+`)}
+`);
 }
-function esc(segment) {
-  return segment.replaceAll("~", "~0").replaceAll("/", "~1");
-}
-function isObj(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
+function runTimestamp(now = new Date) {
+  return now.toISOString().replaceAll(/[-:.]/g, "");
 }
-
-// src/config/load.ts
-function globalConfigDir() {
-  const base = process.env["XDG_CONFIG_HOME"] ?? join7(homedir2(), ".config");
-  return join7(base, "gamecrate");
+function openRunLog(logsDir, now) {
+  const runsDir = join6(logsDir, "runs");
+  mkdirSync2(runsDir, { recursive: true });
+  const dir = uniqueRunDir(runsDir, runTimestamp(now));
+  mkdirSync2(dir);
+  linkCurrent(logsDir, dir);
+  rotateRuns(logsDir, 10);
+  return dir;
 }
-async function findGlobalConfig() {
-  return probe(globalConfigDir(), "profiles");
+var encoder = new TextEncoder;
+function append(fd, chunk) {
+  writeSync(fd, typeof chunk === "string" ? encoder.encode(chunk) : chunk);
 }
-async function probe(dir, stem) {
-  const found = [];
-  for (const suffix of CONFIG_SUFFIXES) {
-    const file = join7(dir, `${stem}${suffix}`);
-    try {
-      await access(file);
-      found.push(file);
-    } catch (error) {
-      if (error.code !== "ENOENT")
-        throw error;
-    }
-  }
-  if (found.length > 1) {
-    const rows = found.map((f) => `  ${basename3(f)}`).join(`
-`);
-    throw new GamecrateError(`two configs in ${dir}`, Exit.Config, `${rows}
-keep one`);
+function uniqueRunDir(runsDir, stamp) {
+  let candidate = join6(runsDir, stamp);
+  let n = 2;
+  while (existsSync2(candidate)) {
+    candidate = join6(runsDir, `${stamp}-${n}`);
+    n++;
   }
-  return found[0];
+  return candidate;
 }
-var projectName = z2.custom((v) => typeof v === "string" && NAME_PATTERN.test(v), "expected a name");
-var projectStr = z2.string({ error: "expected a string" });
-var projectBool = z2.boolean({ error: "expected true or false" });
-var projectList = z2.custom((v) => Array.isArray(v) && v.every((entry) => typeof entry === "string"), "expected an array of strings");
-var projectSeconds = z2.custom((v) => Number.isSafeInteger(v) && v >= 0, "expected a whole number of seconds");
-function oneOf2(values) {
-  return z2.enum(values, { error: `expected one of ${values.join(", ")}` });
+var WAIT_NOTICE = { firstMs: 2000, everyMs: 30000 };
+function waitNotice(waitedMs, lastNoticeMs, schedule = WAIT_NOTICE) {
+  if (waitedMs < schedule.firstMs)
+    return;
+  if (lastNoticeMs > 0 && waitedMs - lastNoticeMs < schedule.everyMs)
+    return;
+  return waitedMs < 60000 ? `${Math.floor(waitedMs / 1000)}s` : `${Math.floor(waitedMs / 60000)}m`;
 }
-var BUILD_POLICIES2 = ["auto", "always", "never"];
-var projectResolution = z2.string({ error: "expected dimensions like 1920x1080" }).check((ctx) => {
-  try {
-    parseResolution(ctx.value);
-  } catch (error) {
-    ctx.issues.push({ code: "custom", message: error.message, input: ctx.value });
-  }
-}).transform(parseResolution);
-var PROJECT_OBJECT = z2.strictObject({
-  game: projectName.optional(),
-  defaultProfile: projectName.optional(),
-  profiles: z2.record(z2.string(), z2.unknown()).optional(),
-  settings: z2.record(z2.string(), z2.unknown()).optional(),
-  library: z2.record(z2.string(), z2.unknown()).optional(),
-  detach: projectBool.optional(),
-  mods: projectList.optional(),
-  without: projectList.optional(),
-  only: projectList.optional(),
-  dockerArgs: projectList.optional(),
-  gameArgs: projectList.optional(),
-  worktree: projectList.optional(),
-  use: projectList.optional(),
-  marker: projectStr.optional(),
-  instance: projectStr.optional(),
-  log: projectStr.optional(),
-  timeout: projectSeconds.optional(),
-  renderWait: projectSeconds.optional(),
-  dryRun: projectBool.optional(),
-  printPlan: projectBool.optional(),
-  json: projectBool.optional(),
-  root: projectBool.optional(),
-  noWorktree: projectBool.optional(),
-  noStaleCheck: projectBool.optional(),
-  replace: projectBool.optional(),
-  mode: oneOf2(["headed", "headless", "screenshot"]).optional(),
-  pull: oneOf2(["always", "missing", "never"]).optional(),
-  sort: oneOf2(["topo", "none"]).optional(),
-  network: oneOf2(["none", "bridge", "host"]).optional(),
-  build: z2.union([z2.boolean().transform((on) => on ? "always" : "never"), z2.enum(BUILD_POLICIES2)], {
-    error: `expected one of ${BUILD_POLICIES2.join(", ")}`
-  }).optional(),
-  resolution: projectResolution.optional()
-}, { error: "expected an object" });
-var PROJECT_SCHEMA = PROJECT_OBJECT.check((ctx) => {
-  const { game, profiles, settings, library } = ctx.value;
-  if (game !== undefined)
+function runStartedAt(name) {
+  const m = /^(\d{4})(\d{2})(\d{2})T(\d{2})(\d{2})(\d{2})(\d{3})Z/.exec(name);
+  if (m === null)
     return;
-  for (const [key, value] of [
-    ["profiles", profiles],
-    ["settings", settings],
-    ["library", library]
-  ]) {
-    if (value === undefined)
-      continue;
-    ctx.issues.push({
-      code: "custom",
-      path: [key],
-      message: "needs a top-level game: to say which game it belongs to",
-      input: ctx.value
-    });
-  }
-});
-async function findProjectConfig(start = process.cwd()) {
-  let dir = resolve3(start);
-  for (;; ) {
-    const file = await probe(dir, ".gamecrate");
-    if (file !== undefined)
-      return file;
-    const parent = dirname2(dir);
-    if (parent === dir)
-      return;
-    dir = parent;
-  }
+  const at = Date.parse(`${m[1]}-${m[2]}-${m[3]}T${m[4]}:${m[5]}:${m[6]}.${m[7]}Z`);
+  return Number.isNaN(at) ? undefined : at;
 }
-async function loadProjectDefaults(start = process.cwd()) {
-  const file = await findProjectConfig(start);
-  if (file === undefined)
-    return {};
-  const text = await readFile3(file, "utf8");
-  const defaults = validateProjectDefaults(readConfigText(text, file), file);
-  const profiles = defaults.profiles;
-  if (profiles !== undefined) {
-    const order = orderedKeys(text, file, "profiles");
-    if (order.length !== Object.keys(profiles).length || order.some((key) => !Object.hasOwn(profiles, key))) {
-      throw new GamecrateError(`config is invalid: ${file}`, Exit.Config, "duplicate profiles key");
-    }
-    defaults.profileOrder = order;
-  }
-  defaults.configPath = file;
-  return defaults;
+function currentLog(instanceDir) {
+  return join6(instanceDir, "logs", "current", STDOUT_LOG);
 }
-function validateProjectDefaults(raw, file) {
-  if (raw === null)
-    return {};
-  const result = PROJECT_SCHEMA.safeParse(raw);
-  if (result.success)
-    return result.data;
-  const problems = [];
-  for (const issue of result.error.issues) {
-    if (issue.code === "unrecognized_keys") {
-      for (const key of issue.keys)
-        problems.push(`  /${key}: unknown key`);
-      continue;
-    }
-    problems.push(`  /${issue.path.join("/")}: ${issue.message}`);
-  }
-  throw new GamecrateError(`project config is invalid: ${file}`, Exit.Config, problems.join(`
-`));
+function tailArgv(file, fromStart, livePid) {
+  const argv = ["tail"];
+  if (fromStart)
+    argv.push("-n", "+1");
+  if (livePid !== undefined)
+    argv.push("-f", "--pid", String(livePid));
+  argv.push(file);
+  return argv;
 }
-async function loadConfig(path, project) {
-  const file = path ?? await findGlobalConfig() ?? join7(globalConfigDir(), "profiles.yml");
-  const user = await readConfigFile(file);
-  const specs = isObj(user) && user["plugins"] !== undefined ? user["plugins"] : [];
-  if (!Array.isArray(specs) || specs.some((s) => typeof s !== "string")) {
-    throw new GamecrateError(`config is invalid: ${file}`, Exit.Config, "  /plugins: expected an array of strings");
-  }
-  const plugins = await loadPlugins(specs, file);
-  const base = {
-    dataRoot: DEFAULT_DATA_ROOT,
-    defaults: { settings: structuredClone(DEFAULT_SETTINGS) },
-    games: Object.fromEntries([...plugins].map(([name, plugin]) => [name, structuredClone(plugin.defaults)]))
-  };
-  const merged = user === undefined || user === null ? base : mergeUserConfig(base, user);
-  const spliced = applyProject(merged, project);
-  const { config, problems } = validateConfig(spliced);
-  if (problems.length > 0) {
-    const detail = problems.map((p) => {
-      const hint = p.suggestion ? ` (${p.suggestion})` : "";
-      return `  ${p.where || "/"}: ${p.message}${hint}${origin(p.where, user, plugins, project)}`;
-    }).join(`
-`);
-    const from = plugins.size === 0 ? "" : ` (merged with defaults from: ${[...plugins.keys()].join(", ")})`;
-    throw new GamecrateError(`config is invalid: ${file}${from}`, Exit.Config, detail);
-  }
-  return { config: expandPaths(config), plugins };
+function linkCurrent(logsDir, target) {
+  const link = join6(logsDir, "current");
+  try {
+    lstatSync(link);
+    unlinkSync(link);
+  } catch {}
+  symlinkSync(join6("runs", basename3(target)), link, "dir");
+}
+function rotateRuns(logsDir, keep) {
+  const runsDir = join6(logsDir, "runs");
+  if (keep < 1 || !existsSync2(runsDir))
+    return [];
+  const dirs = readdirSync(runsDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name).sort().reverse();
+  const removed = dirs.slice(keep);
+  for (const name of removed)
+    rmSync(join6(runsDir, name), { recursive: true, force: true });
+  return removed;
 }
-function applyProject(config, project) {
-  if (project === undefined)
-    return config;
-  const game = project.game;
-  if (game === undefined)
-    return config;
-  if (project.profiles === undefined && project.settings === undefined && project.library === undefined) {
-    return config;
-  }
-  const existing = own(config.games, game);
-  if (existing === undefined) {
-    throw new GamecrateError(`the project config names game "${game}", which is not configured`, Exit.Config, `known games: ${Object.keys(config.games).join(", ") || "none"}`);
-  }
-  const target = {
-    ...existing,
-    profiles: { ...existing.profiles, ...project.profiles },
-    ...project.library === undefined ? {} : { library: spliceLibrary(existing.library, project.library) }
-  };
-  config.games[game] = target;
-  if (project.settings !== undefined) {
-    target.settings = deepMerge(target.settings ?? {}, project.settings);
-  }
-  return config;
+
+// src/launch/prepare.ts
+import { existsSync as existsSync3, readFileSync as readFileSync2 } from "node:fs";
+import { open as open2, readdir as readdir4, readFile as readFile3, unlink, writeFile } from "node:fs/promises";
+import { join as join7 } from "node:path";
+import { setTimeout as sleep2 } from "node:timers/promises";
+async function inherit(argv) {
+  const proc = spawnArgv(argv, ["ignore", "pipe", "pipe"]);
+  const code = exited(proc);
+  await Promise.all([
+    forwardOutput(proc.stdout, process.stdout),
+    forwardOutput(proc.stderr, process.stderr)
+  ]);
+  return code;
 }
-function spliceLibrary(global, project) {
-  const replaced = new Set(Object.keys(project).map((id) => id.toLowerCase()));
-  const kept = Object.entries(global ?? {}).filter(([id]) => !replaced.has(id.toLowerCase()));
-  return { ...Object.fromEntries(kept), ...project };
+async function imageDigest(ref) {
+  const { code, stdout } = await capture(["docker", "image", "inspect", "--format", "{{.Id}}", ref]);
+  const id = stdout.trim();
+  return code === 0 && id.length > 0 ? id : null;
 }
-var GAME_SCOPED_KEYS = ["profiles", "settings", "library"];
-function origin(where, user, plugins, project) {
-  if (!where.startsWith("/"))
-    return "";
-  const segments = where.slice(1).split("/").map((s) => s.replaceAll("~1", "/").replaceAll("~0", "~"));
-  const [section, name, sub, ...rest] = segments;
-  const repoGame = project?.game;
-  const repoSection = GAME_SCOPED_KEYS.find((k) => k === sub);
-  if (repoGame !== undefined && section === "games" && name === repoGame && repoSection !== undefined && valueAt2(project?.[repoSection], rest) !== undefined) {
-    return "  <- from the .gamecrate project config, not this file";
-  }
-  if (valueAt2(user, segments) !== undefined)
-    return "";
-  const plugin = section === "games" && name !== undefined ? plugins.get(name) : undefined;
-  if (plugin === undefined)
-    return "  <- not in this file";
-  return valueAt2(plugin.defaults, [sub, ...rest].filter((s) => s !== undefined)) === undefined ? `  <- not in this file, and the ${name} plugin's defaults do not supply it` : `  <- from the ${name} plugin's defaults, not this file`;
+async function repoDigest(ref) {
+  const format = "{{range .RepoDigests}}{{.}}{{break}}{{end}}";
+  const { code, stdout } = await capture(["docker", "image", "inspect", "--format", format, ref]);
+  const at = stdout.trim().lastIndexOf("@");
+  return code === 0 && at !== -1 ? stdout.trim().slice(at + 1) : null;
 }
-function valueAt2(value, segments) {
-  let current = value;
-  for (const segment of segments) {
-    if (Array.isArray(current))
-      current = current[Number(segment)];
-    else if (isObj(current))
-      current = own(current, segment);
-    else
+async function readFromImage(ref, path) {
+  const { code, stdout } = await capture(["docker", "run", "--rm", "--entrypoint", "cat", ref, path]);
+  return code === 0 ? stdout : null;
+}
+async function imageLabel(ref, label) {
+  const format = `{{index .Config.Labels "${label}"}}`;
+  const { code, stdout } = await capture(["docker", "image", "inspect", "--format", format, ref]);
+  const value = stdout.trim();
+  if (code !== 0 || value.length === 0 || value === "<no value>")
+    return null;
+  return value;
+}
+async function acquireImage(game, config, pull) {
+  const { image } = config;
+  const present = await imageDigest(image.ref) !== null;
+  if (image.acquire === "build")
+    return await buildImage(game, image, present, pull);
+  if (pull === "never") {
+    if (present)
       return;
+    throw new GamecrateError(`--pull never but ${image.ref} is not present locally`, Exit.Environment);
   }
-  return current;
-}
-function resolveSettings(root, game, profile, ...overrides) {
-  let out = structuredClone(DEFAULT_SETTINGS);
-  for (const layer of [root.defaults?.settings, game.settings, profile.settings, ...overrides]) {
-    if (layer)
-      out = deepMerge(out, layer, true);
+  if (pull === "missing" && present)
+    return;
+  if (await inherit(["docker", "pull", image.ref]) !== 0) {
+    if (present)
+      return;
+    throw new GamecrateError(`docker pull failed for ${image.ref}`, Exit.Environment);
   }
-  return out;
 }
-function resolveProfile(game, name) {
-  return resolveNamed(game, name, []);
-}
-function resolveNamed(game, name, seen) {
-  if (name.toLowerCase() === "modless")
-    return { mods: [], exclude: [], includeBase: false };
-  const key = profileKey(game, name);
-  if (key === undefined) {
-    throw new GamecrateError(`unknown profile "${name}"`, Exit.Resolution, `known profiles: ${Object.keys(game.profiles).join(", ") || "(none)"}, modless`);
-  }
-  if (seen.includes(key)) {
-    throw new GamecrateError(`profile "${key}" inherits from itself`, Exit.Config, [...seen, key].join(" -> "));
+async function buildImage(game, image, present, pull) {
+  if (image.context === undefined) {
+    throw new GamecrateError(`${game} has image.acquire "build" but no context`, Exit.Config);
   }
-  const self = own(game.profiles, key);
-  if (self.alias !== undefined)
-    return resolveNamed(game, self.alias, [...seen, key]);
-  const parent = self.extends !== undefined ? resolveNamed(game, self.extends, [...seen, key]) : {};
-  const exclude = [...parent.exclude ?? [], ...self.exclude ?? []];
-  const out = {
-    mods: subtract([...parent.mods ?? [], ...self.mods ?? []], exclude),
-    exclude,
-    settings: deepMerge(parent.settings ?? {}, self.settings ?? {}, true)
-  };
-  const instances = deepMerge(parent.instances ?? {}, self.instances ?? {}, true);
-  if (Object.keys(instances).length > 0)
-    out.instances = instances;
-  const includeBase = self.includeBase ?? parent.includeBase;
-  if (includeBase !== undefined)
-    out.includeBase = includeBase;
-  const auto = self.autoDependencies ?? parent.autoDependencies;
-  if (auto !== undefined)
-    out.autoDependencies = auto;
-  for (const field of ["detach", "replace", "build", "gameVersion", "image"]) {
-    const value = self[field] ?? parent[field];
-    if (value !== undefined)
-      Object.assign(out, { [field]: value });
+  if (present && pull !== "always")
+    return;
+  if (await inherit(["docker", "build", "--tag", image.ref, image.context]) !== 0) {
+    throw new GamecrateError(`docker build failed for ${image.ref}`, Exit.Environment);
   }
-  return out;
 }
-function canonicalProfile(game, name) {
-  if (name.toLowerCase() === "modless")
-    return "modless";
-  const seen = [];
-  let current = name;
-  for (;; ) {
-    const key = profileKey(game, current);
-    if (key === undefined || seen.includes(key))
-      return key ?? current;
-    const next = own(game.profiles, key)?.alias;
-    if (next === undefined)
-      return key;
-    seen.push(key);
-    current = next;
+async function buildTarget(dir) {
+  let entries;
+  try {
+    entries = await readdir4(dir);
+  } catch {
+    return null;
   }
+  const slnx = entries.find((e) => e.endsWith(".slnx"));
+  if (slnx)
+    return join7(dir, slnx);
+  const csproj = entries.find((e) => e.endsWith(".csproj"));
+  return csproj ? join7(dir, csproj) : null;
 }
-function profileDataDir(root, game, profile) {
-  return resolve3(expandHome(root.dataRoot), game, canonicalProfile(own(root.games, game), profile));
+async function buildLocalMods(plan, policy, refsNote) {
+  if (policy === "never")
+    return;
+  const wanted = plan.mods.filter((m) => m.kind === "local" && (policy === "always" || m.stale === true));
+  if (wanted.length === 0)
+    return;
+  const failed = [];
+  for (const mod of wanted) {
+    const target = await buildTarget(mod.hostDir);
+    if (target === null)
+      continue;
+    const code = await inherit(["dotnet", "build", target, "-v", "quiet", "--nologo"]);
+    if (code !== 0) {
+      failed.push(`${mod.packageId}  ${target}`);
+      continue;
+    }
+    mod.stale = false;
+    delete mod.staleReport;
+  }
+  if (failed.length === 0)
+    return;
+  const what = failed.length === 1 ? failed[0].split("  ")[0] : `${failed.length} mods`;
+  throw new GamecrateError(`dotnet build failed for ${what}`, Exit.Environment, [...failed, refsNote].filter((part) => part !== undefined).join(`
+`));
 }
-async function profileDirs(root, game, profile) {
-  if (profile !== undefined)
-    return [profileDataDir(root, game, profile)];
-  const dir = join7(expandHome(root.dataRoot), game);
-  return (await readdir4(dir).catch(() => [])).map((name) => join7(dir, name));
+async function clearLock(plan) {
+  const path = lockPath(plan);
+  const what = plan.instance === undefined ? plan.profile : `${plan.profile} (${plan.instance})`;
+  const name = containerName(plan);
+  const up = await capture(["docker", "ps", "--quiet", "--filter", `name=^${name}$`]);
+  if (up.stdout.trim().length > 0) {
+    throw new GamecrateError(`${plan.game} ${what} is already running (container ${name})`, Exit.Refused, `stop it with: docker stop ${name}
+or relaunch with --replace`);
+  }
+  const held = await readLock(path);
+  if (held !== undefined && isRunning(held.pid, held.startedAt)) {
+    throw new GamecrateError(`${plan.game} ${what} is already running (pid ${held.pid})`, Exit.Refused, `if that is wrong, delete ${path}
+or relaunch with --replace`);
+  }
+  if (existsSync3(path))
+    await unlink(path).catch(() => {});
 }
-function profileKey(game, name) {
-  if (Object.hasOwn(game.profiles, name))
-    return name;
-  const lower = name.toLowerCase();
-  const direct = Object.keys(game.profiles).find((k) => k.toLowerCase() === lower);
-  if (direct !== undefined)
-    return direct;
-  return Object.keys(game.profiles).find((k) => (own(game.profiles, k)?.aliases ?? []).some((a) => typeof a === "string" && a.toLowerCase() === lower));
+async function unlinkHeld(path, pid, startedAt) {
+  const held = await readLock(path);
+  if (held === undefined)
+    return;
+  if (held.pid !== pid)
+    return;
+  if (startedAt !== undefined && held.startedAt !== startedAt)
+    return;
+  await unlink(path).catch(() => {});
 }
-function subtract(mods, exclude) {
-  if (exclude.length === 0)
-    return mods;
-  const patterns = exclude.map(globToRegExp);
-  return mods.filter((entry) => {
-    const ids = entryIds(entry);
-    if (ids.length === 0)
-      return true;
-    return !ids.some((id) => patterns.some((re) => re.test(id)));
-  });
+function heldLock(plan) {
+  const path = lockPath(plan);
+  return {
+    release: async () => {
+      await unlinkHeld(path, process.pid);
+    }
+  };
 }
-function entryIds(entry) {
-  if (typeof entry === "string")
-    return [entry, entry.replace(/^(workshop|path):/, "")];
-  if ("id" in entry)
-    return [entry.id];
-  return [];
+async function takeLock(plan) {
+  await clearLock(plan);
+  await writeLock(plan, {
+    pid: process.pid,
+    container: containerName(plan),
+    game: plan.game,
+    profile: plan.profile,
+    ...plan.instance === undefined ? {} : { instance: plan.instance },
+    detached: false,
+    mode: plan.mode
+  });
+  return heldLock(plan);
 }
-function globToRegExp(pattern) {
-  const body = pattern.replaceAll(/[.+^${}()|[\]\\]/g, String.raw`\$&`).replaceAll("*", ".*").replaceAll("?", ".");
-  return new RegExp(`^${body}$`, "i");
+function lockPath(plan) {
+  return join7(plan.instanceDir, ".gamecrate", "lock");
 }
-function mergeUserConfig(base, user) {
-  const out = deepMerge(base, user);
-  const games = isObj(user) ? user["games"] : undefined;
-  if (!isObj(games))
-    return out;
-  for (const name of Object.keys(games)) {
-    const theirs = own(games, name);
-    const steamBuild = isObj(theirs) ? theirs["steamBuild"] : undefined;
-    const added = isObj(steamBuild) ? steamBuild["branches"] : undefined;
-    const declared = own(base.games, name)?.steamBuild?.branches;
-    const target = own(out.games, name);
-    if (!Array.isArray(added) || !Array.isArray(declared) || target === undefined)
-      continue;
-    target.steamBuild.branches = concatBranches(declared, added);
+async function readLock(path) {
+  const text = await readFile3(path, "utf8").catch(() => {
+    return;
+  });
+  if (text === undefined)
+    return;
+  try {
+    const value = JSON.parse(text);
+    return Number.isInteger(value?.pid) && value.pid > 0 ? value : undefined;
+  } catch {
+    return;
   }
-  return out;
 }
-function branchName(entry) {
-  return isObj(entry) && typeof entry["name"] === "string" ? entry["name"] : undefined;
+async function writeLock(plan, record) {
+  const path = lockPath(plan);
+  const handle = await open2(path, "wx").catch(() => null);
+  if (handle === null) {
+    throw new GamecrateError(`could not take the launch lock at ${path}`, Exit.Environment);
+  }
+  await handle.writeFile(JSON.stringify({ ...record, startedAt: new Date().toISOString() }));
+  await handle.close();
 }
-function concatBranches(declared, added) {
-  const out = [...declared];
-  const at = new Map;
-  out.forEach((branch, index) => {
-    const name = branchName(branch);
-    if (name !== undefined && !at.has(name))
-      at.set(name, index);
-  });
-  for (const entry of added) {
-    const name = branchName(entry);
-    const index = name === undefined ? undefined : at.get(name);
-    if (index === undefined) {
-      if (name !== undefined)
-        at.set(name, out.length);
-      out.push(entry);
-      continue;
+var RELEASE_POLL_MS = 100;
+var DRAIN_ALLOWANCE_MS = 1e4;
+var STOP_RELEASE_WAIT_MS = STOP_TIMEOUT_SECONDS * 1000 + DRAIN_ALLOWANCE_MS;
+async function stopRun(record, lockFile) {
+  let signalled = false;
+  if (isRunning(record.pid, record.startedAt)) {
+    try {
+      process.kill(record.pid, "SIGTERM");
+      signalled = true;
+    } catch {}
+  }
+  if (!signalled)
+    await stopContainer(record.container, STOP_TIMEOUT_SECONDS);
+  const deadline = Date.now() + STOP_RELEASE_WAIT_MS;
+  while (existsSync3(lockFile)) {
+    const held = await readLock(lockFile);
+    if (held === undefined)
+      break;
+    if (!isRunning(held.pid, held.startedAt)) {
+      await unlinkHeld(lockFile, record.pid, record.startedAt);
+      break;
     }
-    out[index] = deepMerge(out[index], entry);
+    if (Date.now() >= deadline)
+      return "held";
+    await sleep2(RELEASE_POLL_MS);
   }
-  return out;
+  return signalled ? "signalled" : "orphaned";
 }
-function deepMerge(base, over, concatArrays = false) {
-  if (Array.isArray(base) && Array.isArray(over)) {
-    return concatArrays ? [...base, ...over] : [...over];
+async function replacePrevious(plan) {
+  const name = containerName(plan);
+  const path = lockPath(plan);
+  const up = await capture(["docker", "ps", "--quiet", "--filter", `name=^${name}$`]);
+  const running = up.stdout.trim().length > 0;
+  const held = await readLock(path);
+  if (!running && held === undefined && !existsSync3(path))
+    return;
+  if (held !== undefined) {
+    status(`stopping ${held.container}`);
+    await stopRun(held, path);
+    return;
   }
-  if (isObj(base) && isObj(over)) {
-    const out = { ...base };
-    for (const [k, v] of Object.entries(over)) {
-      if (v === undefined)
-        continue;
-      out[k] = Object.hasOwn(out, k) ? deepMerge(out[k], v, concatArrays) : v;
-    }
-    return out;
+  if (running) {
+    status(`stopping ${name}`);
+    await stopContainer(name, STOP_TIMEOUT_SECONDS);
   }
-  return over;
 }
-function expandPaths(config) {
-  config.dataRoot = expandHome(config.dataRoot);
-  if (config.steamcmd?.path !== undefined)
-    config.steamcmd.path = expandHome(config.steamcmd.path);
-  for (const game of Object.values(config.games)) {
-    if (game.gameFiles.host !== undefined)
-      game.gameFiles.host = expandHome(game.gameFiles.host);
-    if (game.image.context !== undefined)
-      game.image.context = expandHome(game.image.context);
-    if (game.workshopRoot !== null)
-      game.workshopRoot = expandHome(game.workshopRoot);
-    for (const root of game.scanRoots)
-      root.path = expandHome(root.path);
-    for (const entry of Object.values(game.library ?? {})) {
-      if (entry.path !== undefined)
-        entry.path = expandHome(entry.path);
-    }
+var CLOCK_TICKS_PER_SECOND = 100;
+var START_TIME_SLACK_MS = 2000;
+function isRunning(pid, startedAt) {
+  try {
+    process.kill(pid, 0);
+  } catch {
+    return false;
   }
-  return config;
+  if (startedAt === undefined)
+    return true;
+  const written = Date.parse(startedAt);
+  if (Number.isNaN(written))
+    return true;
+  const began = processStart(pid);
+  return began === undefined || began <= written + START_TIME_SLACK_MS;
 }
-function expandHome(p) {
-  if (p === "~")
-    return homedir2();
-  return p.startsWith("~/") ? join7(homedir2(), p.slice(2)) : p;
+function processStart(pid) {
+  try {
+    const stat = readFileSync2(`/proc/${pid}/stat`, "utf8");
+    const fields = stat.slice(stat.lastIndexOf(")") + 2).split(" ");
+    const ticks = Number(fields[19]);
+    const boot = bootTime();
+    if (!Number.isFinite(ticks) || boot === undefined)
+      return;
+    return boot + ticks / CLOCK_TICKS_PER_SECOND * 1000;
+  } catch {
+    return;
+  }
+}
+function bootTime() {
+  const line = readFileSync2("/proc/stat", "utf8").split(`
+`).find((each) => each.startsWith("btime "));
+  const seconds = Number(line?.slice("btime ".length));
+  return Number.isFinite(seconds) && seconds > 0 ? seconds * 1000 : undefined;
+}
+async function captureScreenshot(container, plan) {
+  const name = `${plan.game}.png`;
+  const target = `${CONTAINER_LOG_DIR}/${name}`;
+  const script = 'D=":$(ls /tmp/.X11-unix 2>/dev/null | head -1 | tr -d X)";' + ' [ "$D" = ":" ] && { echo "no X socket in the container" >&2; exit 1; };' + " X=$(ls -d /tmp/xvfb-run.*/Xauthority 2>/dev/null | head -1);" + ' [ -n "$X" ] && export XAUTHORITY="$X";' + " M=$(command -v magick || command -v convert);" + ' [ -z "$M" ] && { echo "no imagemagick in the container" >&2; exit 1; };' + ` import -display "$D" -window root ${target} 2>/dev/null` + ` || xwd -root -display "$D" | "$M" xwd:- ${target}`;
+  const code = await inherit(["docker", "exec", container, "sh", "-c", script]);
+  const host = join7(plan.runDirHost, name);
+  if (code !== 0 || !existsSync3(host))
+    return null;
+  return host;
+}
+async function writeLaunchRecord(plan, image) {
+  const digest = await imageDigest(image);
+  const line = JSON.stringify({
+    at: new Date().toISOString(),
+    game: plan.game,
+    profile: plan.profile,
+    ...plan.instance === undefined ? {} : { instance: plan.instance },
+    image,
+    digest,
+    mode: plan.mode,
+    mods: plan.mods.map((m) => ({
+      packageId: m.packageId,
+      hostDir: m.hostDir,
+      ...m.worktree === undefined ? {} : { worktree: m.worktree }
+    }))
+  });
+  const path = join7(plan.instanceDir, ".gamecrate", "launches.jsonl");
+  await writeFile(path, `${line}
+`, { flag: "a" });
 }
 
+// src/mods/modindex.ts
+import { createHash as createHash2 } from "node:crypto";
+import { existsSync as existsSync7, readFileSync as readFileSync4, statSync as statSync3 } from "node:fs";
+import { mkdir as mkdir2, readdir as readdir6, readFile as readFile5, writeFile as writeFile2 } from "node:fs/promises";
+import { homedir as homedir3 } from "node:os";
+import { dirname as dirname5, join as join10, relative as relative2, sep as sep2, resolve as resolvePath } from "node:path";
+import picomatch from "picomatch";
+
 // src/mods/acf.ts
 var MAX_DEPTH = 100;
 function isSpace(c) {
@@ -3926,7 +3963,7 @@ function buildIdFor(output, branch) {
 // src/mods/worktree.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
 import { existsSync as existsSync6, realpathSync as realpathSync2 } from "node:fs";
-import { isAbsolute as isAbsolute2, resolve as resolve4, sep } from "node:path";
+import { isAbsolute as isAbsolute3, resolve as resolve5, sep } from "node:path";
 function inspect(dir) {
   const r = spawnSync3("git", ["-C", dir, "rev-parse", "--path-format=absolute", "--show-toplevel", "--git-dir", "--git-common-dir", "--abbrev-ref", "HEAD"], { encoding: "utf8" });
   if (r.status !== 0 || typeof r.stdout !== "string")
@@ -3942,12 +3979,12 @@ function canonical(p) {
   try {
     return realpathSync2(p);
   } catch {
-    return resolve4(p);
+    return resolve5(p);
   }
 }
 function resolveWorktree(dir, source, order) {
   const raw = expandHome(dir);
-  const abs = isAbsolute2(raw) ? raw : resolve4(process.cwd(), raw);
+  const abs = isAbsolute3(raw) ? raw : resolve5(process.cwd(), raw);
   if (!existsSync6(abs)) {
     return { where: abs, message: `--worktree path does not exist`, suggestion: "check the path, or drop the flag" };
   }
@@ -4524,6 +4561,14 @@ function refsRoot() {
 function refsLink(game) {
   return join11(refsRoot(), "current", game);
 }
+function currentRefs(game) {
+  try {
+    const target = readlinkSync(refsLink(game));
+    return `refs in use: ${target.replace(/^.*\/refs\//, "")}`;
+  } catch {
+    return;
+  }
+}
 var MARK2 = "@@gamecrate@@ ";
 function extractScript(candidates, container) {
   const quoted = candidates.map((c) => {
@@ -4676,7 +4721,7 @@ function profileRows(profile, spec, width, notes) {
 // src/cli/mods.ts
 import { existsSync as existsSync9 } from "node:fs";
 import { mkdir as mkdir4, readFile as readFile8, readdir as readdir8, writeFile as writeFile4 } from "node:fs/promises";
-import { dirname as dirname9, join as join14, relative as relative3, resolve as resolve5 } from "node:path";
+import { dirname as dirname9, join as join14, relative as relative3, resolve as resolve6 } from "node:path";
 
 // src/config/write.ts
 import { chmod, readFile as readFile6, realpath, rename as rename2, stat as stat3, writeFile as writeFile3 } from "node:fs/promises";
@@ -5094,7 +5139,7 @@ function existingKey(library, id) {
 }
 async function discover(source, game, plugin, ctx) {
   if (source.kind === "path") {
-    const dir = resolve5(ctx.cwd, expandHome(source.value));
+    const dir = resolve6(ctx.cwd, expandHome(source.value));
     const id = await readId(dir, game.manifest.file, plugin);
     return id === undefined ? [] : [{ id, entry: { path: dir } }];
   }
@@ -5534,8 +5579,12 @@ async function resolveSteamBuildInput(game, config, overrides, cwd, configFile)
 // src/image/tags.ts
 function sanitizeVersion(raw, fallback) {
   const first = raw.trim().split(/\s+/)[0] ?? "";
-  const mapped = first.replaceAll(/[^A-Za-z0-9._-]/g, "-").replace(/-+$/, "");
-  return mapped.length > 0 ? mapped : fallback;
+  const mapped = first.replaceAll(/[^\w.-]/g, "-");
+  let end = mapped.length;
+  while (end > 0 && mapped.charAt(end - 1) === "-")
+    end -= 1;
+  const trimmed = mapped.slice(0, end);
+  return trimmed.length > 0 ? trimmed : fallback;
 }
 function versionPrefixes(version) {
   const parts = version.split(".");
@@ -6224,6 +6273,10 @@ async function checkImage(plan, problems, asShell) {
       problems.push(marker);
     return;
   }
+  await checkAbsentImage(plan, problems, where, problem);
+}
+async function checkAbsentImage(plan, problems, where, problem) {
+  const image = plan.gameConfig.image;
   if (image.ref.trim() === "") {
     if (problem)
       problems.push(problem);
@@ -6393,11 +6446,143 @@ function message2(error) {
 import { readFileSync as readFileSync8 } from "node:fs";
 import { basename as basename7 } from "node:path";
 import { setTimeout as sleep6 } from "node:timers/promises";
+
+// src/docker/icon.ts
+import { execFile } from "node:child_process";
+import { connect } from "node:net";
+import { promisify } from "node:util";
+var run2 = promisify(execFile);
+var CHANGE_PROPERTY = 18;
+var INTERN_ATOM = 16;
+var CARDINAL = 6;
+function padding(length) {
+  return (4 - length % 4) % 4;
+}
+function displayNumber(display) {
+  return display.replace(/^.*:/, "").split(".")[0] ?? "0";
+}
+async function cookieFor(display) {
+  const wanted = displayNumber(display);
+  try {
+    const { stdout } = await run2("xauth", ["list"]);
+    for (const line of stdout.split(`
+`)) {
+      const match = /^\S+:(\d+)\s+MIT-MAGIC-COOKIE-1\s+([0-9a-f]+)$/.exec(line.trim());
+      if (match && match[1] === wanted)
+        return Buffer.from(match[2], "hex");
+    }
+  } catch {
+    return null;
+  }
+  return null;
+}
+async function argbPixels(path, size) {
+  for (const tool of ["magick", "convert"]) {
+    try {
+      const { stdout } = await run2(tool, [path, "-resize", `${size}x${size}!`, "-depth", "8", "RGBA:-"], { encoding: "buffer", maxBuffer: 64 * 1024 * 1024 });
+      if (stdout.length === size * size * 4)
+        return stdout;
+    } catch {
+      continue;
+    }
+  }
+  return null;
+}
+async function openDisplay(display) {
+  const cookie = await cookieFor(display);
+  if (cookie === null)
+    return null;
+  const socket = connect(`/tmp/.X11-unix/X${displayNumber(display)}`);
+  try {
+    await new Promise((resolve, reject) => {
+      socket.once("connect", resolve);
+      socket.once("error", reject);
+    });
+  } catch {
+    return null;
+  }
+  const name = Buffer.from("MIT-MAGIC-COOKIE-1");
+  const head = Buffer.alloc(12);
+  head.write("l", 0, "ascii");
+  head.writeUInt16LE(11, 2);
+  head.writeUInt16LE(name.length, 6);
+  head.writeUInt16LE(cookie.length, 8);
+  socket.write(Buffer.concat([
+    head,
+    name,
+    Buffer.alloc(padding(name.length)),
+    cookie,
+    Buffer.alloc(padding(cookie.length))
+  ]));
+  const reply = await new Promise((resolve) => socket.once("data", resolve));
+  if (reply[0] !== 1) {
+    socket.destroy();
+    return null;
+  }
+  return socket;
+}
+function internAtom(socket, name) {
+  const length = 8 + name.length + padding(name.length);
+  const request = Buffer.alloc(length);
+  request.writeUInt8(INTERN_ATOM, 0);
+  request.writeUInt16LE(length / 4, 2);
+  request.writeUInt16LE(name.length, 4);
+  request.write(name, 8, "ascii");
+  socket.write(request);
+  return new Promise((resolve) => socket.once("data", (d) => resolve(d.readUInt32LE(8))));
+}
+function iconProperty(rgba, size) {
+  const body = Buffer.alloc(8 + size * size * 4);
+  body.writeUInt32LE(size, 0);
+  body.writeUInt32LE(size, 4);
+  for (let i = 0;i < size * size; i += 1) {
+    const [r, g, b, a] = [rgba[i * 4], rgba[i * 4 + 1], rgba[i * 4 + 2], rgba[i * 4 + 3]];
+    body.writeUInt32LE((a << 24 | r << 16 | g << 8 | b) >>> 0, 8 + i * 4);
+  }
+  return body;
+}
+var ICON_SIZE = 64;
+async function setWindowIcon(windowId, iconPath) {
+  const display = process.env.DISPLAY;
+  if (display === undefined || display === "")
+    return;
+  const rgba = await argbPixels(iconPath, ICON_SIZE);
+  if (rgba === null) {
+    warn(`could not read ${iconPath}, so the window keeps its own icon`);
+    return;
+  }
+  const socket = await openDisplay(display);
+  if (socket === null) {
+    warn("could not reach the X server to set the window icon");
+    return;
+  }
+  try {
+    const atom = await internAtom(socket, "_NET_WM_ICON");
+    const body = iconProperty(rgba, ICON_SIZE);
+    const request = Buffer.alloc(24);
+    request.writeUInt8(CHANGE_PROPERTY, 0);
+    request.writeUInt16LE((24 + body.length) / 4, 2);
+    request.writeUInt32LE(Number.parseInt(windowId, 16), 4);
+    request.writeUInt32LE(atom, 8);
+    request.writeUInt32LE(CARDINAL, 12);
+    request.writeUInt8(32, 16);
+    request.writeUInt32LE(body.length / 4, 20);
+    socket.write(Buffer.concat([request, body]));
+    await new Promise((resolve) => setTimeout(resolve, 100));
+  } finally {
+    socket.end();
+  }
+}
+
+// src/docker/window.ts
 var WAIT_MS = 180000;
 var POLL_MS = 500;
 function newMatches(now, seen, executable) {
   const wanted = basename7(executable).toLowerCase();
-  return now.filter((w) => !seen.has(w.id) && w.wmClass.toLowerCase().includes(wanted));
+  return now.filter((w) => !seen.has(w.id) && classMatches(w.wmClass, wanted));
+}
+function classMatches(wmClass, wanted) {
+  return wmClass.toLowerCase().split(".").some((part) => part.length >= 3 && (wanted.includes(part) || part.includes(wanted)));
 }
 function parseWindowPid(stdout) {
   const match = /_NET_WM_PID\(CARDINAL\)\s*=\s*(\d+)/.exec(stdout);
@@ -6466,6 +6651,8 @@ async function adoptFirstMatch(seen, opts, stopped) {
     if (!await adopt(match.id, opts))
       continue;
     await capture(["wmctrl", "-i", "-r", match.id, "-N", opts.title]);
+    if (opts.icon !== undefined)
+      await setWindowIcon(match.id, opts.icon);
     if (opts.stripDelete)
       await watchForClose(match.id, stopped, opts.onClosed);
     return true;
@@ -7598,7 +7785,7 @@ function published2(value) {
 }
 
 // src/index.ts
-var VERSION = "2.3.1";
+var VERSION = "2.4.0";
 async function main(argv) {
   const supervised = supervisedDir(argv);
   try {
@@ -7678,17 +7865,21 @@ async function dispatch(argv, args, config, plugins, defaults) {
     case "wait":
       return waitFor(args, config, defaults);
     case "shell":
-      return run2(argv, args, config, plugins, defaults, true);
+      return run3(argv, args, config, plugins, defaults, true);
     case "config":
       return configEdit(args);
     case "fix-perms":
       return fixPerms(args, config);
     case "run":
-      return run2(argv, args, config, plugins, defaults, false);
+      return run3(argv, args, config, plugins, defaults, false);
     default:
       throw new GamecrateError(`no such subcommand ${args.subcommand}`, Exit.Usage);
   }
 }
+function iconOption(plan, configFile) {
+  const icon = windowIcon(plan, dirname14(configFile));
+  return icon === undefined ? {} : { icon };
+}
 function helpTopic(args) {
   if (args.subcommand === "help")
     return args.rest[0];
@@ -7730,7 +7921,7 @@ function reportEnvironment(problems) {
   throw new GamecrateError(`${problems.length} environment problem(s)`, Exit.Environment, out.join(`
 `));
 }
-async function run2(argv, args, config, plugins, defaults, asShell) {
+async function run3(argv, args, config, plugins, defaults, asShell) {
   const game = requireGame(args, config);
   const profile = launchProfile(args, defaults, config.games[game]);
   const gameConfig = gameForImage(args, config, defaults, game);
@@ -7821,7 +8012,7 @@ run: gamecrate fix-perms ${game} ${profile}`);
 }
 async function execute(inputs) {
   const { plan, args, config, identity, asShell, profileSpec, runDir, releaseSources } = inputs;
-  await buildLocalMods(plan, buildPolicy(args, profileSpec));
+  await buildLocalMods(plan, buildPolicy(args, profileSpec), currentRefs(plan.game));
   await releaseSources();
   const { facts, imageStart } = await readyImage(plan, config, args, asShell);
   const modMounts = await stageMods(plan);
@@ -7910,6 +8101,7 @@ async function dispatchRun(spec, plan, runDir, trustExit, asShell) {
   const window = asShell || plan.settings.display !== "x11" ? null : await adoptNewWindow({
     executable: plan.gameConfig.executable,
     title: windowTitle(plan),
+    ...iconOption(plan, await globalConfigPath()),
     stripDelete: plan.gameConfig.ignoresWmDelete === true,
     onClosed: () => {
       windowClosed = true;
@@ -8088,12 +8280,38 @@ async function doctor(config, plugins) {
     const gameConfig = config.games[game];
     const sources = cachedSources(gameConfig, "modless", {}, config.dataRoot);
     const { plan, problems } = await resolvePlan({ game, profile: "modless", root: config, plugins, sources });
-    const all = [...problems, ...await preflight(plan), ...steamcmdProblems(game, gameConfig, config)];
+    const all = [
+      ...problems,
+      ...await preflight(plan),
+      ...steamcmdProblems(game, gameConfig, config),
+      ...await baseDriftProblems(game, gameConfig)
+    ];
     if (!reportDoctor(game, all))
       failed = true;
   }
   return failed ? Exit.Environment : Exit.Ok;
 }
+async function baseDriftProblems(game, gameConfig) {
+  const ref = gameConfig.image.ref;
+  if (ref.trim() === "")
+    return [];
+  const facts = await readImageFacts(ref);
+  if (!facts.present || facts.runtime === null)
+    return [];
+  const base = RUNTIME_BASE[facts.launcher === "proton" ? "proton" : "xvfb"];
+  const current = await repoDigest(base);
+  if (current === null)
+    return [];
+  if (facts.runtime.endsWith(current))
+    return [];
+  return [
+    {
+      where: `/games/${game}/image/ref`,
+      message: `${ref} was built on an older ${base}`,
+      suggestion: `gamecrate steam build ${game} to rebuild it on the base you have`
+    }
+  ];
+}
 function steamcmdProblems(game, gameConfig, config) {
   if (!usesWorkshop(gameConfig))
     return [];