@@ -217,19 +217,32 @@ For each `name=id`:
   the workshop copy, the assets come from the install's);
 - `_night` variants are skipped, as for the install (consumers fold them
   onto the base map);
-- otherwise `<dir>/<id>/<name>.vpk`, or the item's only map VPK, is built,
-  published under `name` (the maps-table name the consumers look up, which
-  for a map added by hand is its numeric id) and read under the name inside
-  the VPK (its file name);
+- otherwise `<dir>/<id>/<name>.vpk`, or the item's only VPK, is opened.
+  Steam downloads an item as an addon VPK named after its id (`<id>.vpk`, or
+  `<id>_dir.vpk` with `<id>_000.vpk`… beside it), and the map's own VPK is an
+  entry inside it, `maps/<map>.vpk`, next to its skybox's
+  (`maps/de_rooftop_marius_skybox.vpk`). The entry named `name`, else the only
+  one that is not a skybox, is unpacked to TMPDIR for the build (an item that
+  is itself a map VPK is read where it is). The map is published under `name`
+  (the maps-table name the consumers look up, which for a map added by hand is
+  its numeric id) and read under the name inside the item;
 - an item this node never downloaded is skipped and keeps whatever entry
   the base manifest has: it is not dropped. Play the map once on a server on
   that node, or run the build on a node that has it.
 
-`source.vpk_sha256` is then the workshop VPK's hash, so a workshop update
-rebuilds the map at the next run.
+`source.vpk_sha256` is then the hash of the item's VPK (`<id>_dir.vpk`, whose
+directory holds every entry's CRC), so a workshop update rebuilds the map at
+the next run, and an unchanged item is never unpacked.
 
-The lower-level scripts take a single VPK too:
-`node scripts/extract-map-meshes.mjs --vpk <dir>/<id>/<map>.vpk`, and the same
+Prophunt items (Prophunt Inferno, Mirage and Office) are overlays: their map is
+a 12-triangle box plus prop templates, and the world players walk on is the
+stock map's. They build, but what they publish is that box.
+
+The lower-level scripts take a single map VPK too, unpacked first from a
+workshop item:
+`Source2Viewer-CLI -i <dir>/<id>/<id>_dir.vpk --vpk_filepath maps/<map>.vpk -o <out> -d`
+(with `<out>` an existing folder), then
+`node scripts/extract-map-meshes.mjs --vpk <out>/maps/<map>.vpk`, and the same
 for `extract-map-callouts.mjs` and `extract-map-blast.mjs`.
 
 ### Prep
 
@@ -35,7 +35,8 @@
 // game server's workshop downloads: --workshop <dir>, by default
 // <install>/game/bin/linuxsteamrt64/steamapps/workshop/content/730, holding
 // one <id>/ folder per item. A map is published under its maps-table name and
-// read from its VPK under the name inside it. A copy in the install wins over
+// read under the name inside the item, from the map VPK the item's addon VPK
+// carries (unpacked to TMPDIR for the build). A copy in the install wins over
 // a workshop one; `_night` variants are skipped (consumers fold them onto the
 // base map); an item this node never downloaded keeps whatever entry the base
 // manifest has.
@@ -92,12 +93,14 @@ import { createHash } from "node:crypto";
 import {
   existsSync,
   mkdirSync,
+  mkdtempSync,
   readdirSync,
   readFileSync,
   realpathSync,
   rmSync,
   writeFileSync,
 } from "node:fs";
+import { tmpdir } from "node:os";
 import { basename, dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { gzipSync } from "node:zlib";
@@ -127,7 +130,7 @@ import {
   retryMaps,
   sameContent,
 } from "./lib-manifest.mjs";
-import { resolveCli } from "./lib-s2v.mjs";
+import { decompile, listVpk, missingOutput, resolveCli } from "./lib-s2v.mjs";
 import { loadPrep, makePrep, prepFileName } from "./replay-stage/build-prep.mjs";
 
 const root = join(dirname(fileURLToPath(import.meta.url)), "..");
@@ -238,9 +241,10 @@ function workshopList(text) {
 }
 
 /**
- * The VPK a workshop item was downloaded as, and the map's name inside it:
- * `<root>/<id>/<name>.vpk` when there is one, else the item's only map VPK.
- * null when the item is not there, or holds several VPKs none named `name`.
+ * The VPK a workshop item was downloaded as: `<root>/<id>/<name>.vpk` when
+ * there is one, else the item's only VPK (`<id>.vpk`, or `<id>_dir.vpk` with
+ * its chunks beside it). null when the item is not there, or holds several
+ * VPKs none named `name`.
  */
 export function workshopVpk(root, id, name) {
   const dir = join(root, id);
@@ -251,7 +255,45 @@ export function workshopVpk(root, id, name) {
   const pick =
     vpks.find((f) => f === `${name}.vpk` || f === `${name}_dir.vpk`) ??
     (vpks.length === 1 ? vpks[0] : null);
-  return pick ? { vpk: join(dir, pick), inner: pick.replace(/(_dir)?\.vpk$/, "") } : null;
+  return pick ? { vpk: join(dir, pick) } : null;
+}
+
+/**
+ * The map VPK of a workshop item and the map's name inside it. Steam
+ * downloads an item as an addon VPK that carries the map's own VPK as
+ * maps/<map>.vpk, beside its skybox's, so that one is unpacked into `dir`;
+ * an item that is itself a map VPK is read where it is. The map is the one
+ * named `name`, else the only one that is not a skybox.
+ */
+export function workshopMap(cli, vpk, name, dir) {
+  const maps = [];
+  for (const path of listVpk(cli, vpk, "maps/")) {
+    const nested = /^maps\/([^/]+)\.vpk$/.exec(path)?.[1];
+    const own = /^maps\/([^/]+)\/world_physics\.vmdl_c$/.exec(path)?.[1];
+    if (nested || own) {
+      maps.push({ inner: nested ?? own, nested: Boolean(nested) });
+    }
+  }
+  const playable = maps.filter((m) => !m.inner.includes("skybox"));
+  const pick =
+    maps.find((m) => m.inner === name) ?? (playable.length === 1 ? playable[0] : null);
+  if (!pick) {
+    throw new Error(
+      playable.length
+        ? `${basename(vpk)} holds ${playable.map((m) => m.inner).join(", ")}, none of them ${name}`
+        : `${basename(vpk)} holds no map`,
+    );
+  }
+  if (!pick.nested) {
+    return { vpk, inner: pick.inner };
+  }
+  const file = `maps/${pick.inner}.vpk`;
+  const run = decompile(cli, vpk, file, dir);
+  const unpacked = join(dir, file);
+  if (!existsSync(unpacked)) {
+    throw missingOutput(file, run);
+  }
+  return { vpk: unpacked, inner: pick.inner };
 }
 
 /** Writes `body` raw and gzipped; returns the manifest's `{ file, sha256 }`. */
@@ -376,7 +418,7 @@ async function prepPatch(map, entry, { store, prep, assets, rawDir, filesDir })
   };
 }
 
-async function buildMap(map, { from, rawDir, filesDir, cli, pak, prep, assets }) {
+async function buildMap(map, { from, scratch, rawDir, filesDir, cli, pak, prep, assets }) {
   const start = performance.now();
   for (const asset of assets) {
     rmSync(join(filesDir, asset.file(map)), { force: true });
@@ -389,9 +431,13 @@ async function buildMap(map, { from, rawDir, filesDir, cli, pak, prep, assets })
     viewFailed: false,
   };
 
+  let input = from;
   let meshes;
   try {
-    meshes = await extractMap(map, { vpk: from.vpk, inner: from.inner, outDir: rawDir, cli });
+    if (from.workshop) {
+      input = workshopMap(cli, from.vpk, map, scratch);
+    }
+    meshes = await extractMap(map, { vpk: input.vpk, inner: input.inner, outDir: rawDir, cli });
     if (!meshes.tri) {
       throw new Error(`collision mesh over the cap (${meshes.note})`);
     }
@@ -404,7 +450,7 @@ async function buildMap(map, { from, rawDir, filesDir, cli, pak, prep, assets })
 
   let callouts;
   try {
-    callouts = extractCallouts(map, { vpk: from.vpk, inner: from.inner, pak, cli });
+    callouts = extractCallouts(map, { vpk: input.vpk, inner: input.inner, pak, cli });
   } catch (error) {
     callouts = { failed: error.message };
     result.calloutsFailed = true;
@@ -441,8 +487,8 @@ async function buildMap(map, { from, rawDir, filesDir, cli, pak, prep, assets })
   let blasted = false;
   try {
     const blast = extractBlast(map, {
-      vpk: from.vpk,
-      inner: from.inner,
+      vpk: input.vpk,
+      inner: input.inner,
       cli,
       targets: callouts.bombTargets ?? [],
       callouts: callouts.callouts ?? [],
@@ -491,7 +537,7 @@ async function buildMap(map, { from, rawDir, filesDir, cli, pak, prep, assets })
   console.log(
     `${map.padEnd(18)} ${describe(meshes)}; callouts ${calloutNote}; ` +
       `prep ${prepNote}; blast ${blastNote}` +
-      `${from.workshop ? `; workshop ${from.workshop} (${basename(from.vpk)})` : ""}\n` +
+      `${from.workshop ? `; workshop ${from.workshop} (${basename(input.vpk)})` : ""}\n` +
       `${"".padEnd(18)} ${sizes.join(", ")} ` +
       `[${seconds(performance.now() - start)}: ${stages}]`,
   );
@@ -828,11 +874,25 @@ async function build(args) {
       results.push({ map, unchanged: true });
       continue;
     }
-    const result = await buildMap(map, { from, rawDir, filesDir, cli, pak, prep, assets });
-    results.push({
-      ...result,
-      source: { ...source, ...(result.files.prep ? { prep: prep.PREP_VERSION } : {}) },
-    });
+    const scratch = mkdtempSync(join(tmpdir(), `map-${map}-`));
+    try {
+      const result = await buildMap(map, {
+        from,
+        scratch,
+        rawDir,
+        filesDir,
+        cli,
+        pak,
+        prep,
+        assets,
+      });
+      results.push({
+        ...result,
+        source: { ...source, ...(result.files.prep ? { prep: prep.PREP_VERSION } : {}) },
+      });
+    } finally {
+      rmSync(scratch, { recursive: true, force: true });
+    }
   }
   const attempted = results.filter((r) => !r.unchanged && !r.patch);
   const fresh = attempted.filter((r) => !r.triFailed).length;
 
@@ -4,7 +4,7 @@
 // `.cache/s2v/` unless CLI names one already on disk -- which is how these run
 // in-cluster, where the inventory plugin's model extraction has already put one
 // at /cs2-models/.work/cs2-model-extract/cli/Source2Viewer-CLI.
-import { execFileSync } from "node:child_process";
+import { execFileSync, spawnSync } from "node:child_process";
 import {
   closeSync,
   existsSync,
@@ -17,7 +17,7 @@ import {
   rmSync,
 } from "node:fs";
 import { tmpdir } from "node:os";
-import { dirname, join, resolve } from "node:path";
+import { basename, dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
 const cliDir = join(dirname(fileURLToPath(import.meta.url)), "..", ".cache", "s2v");
@@ -149,6 +149,38 @@ export function missingOutput(what, run) {
   );
 }
 
+/**
+ * The paths in `vpk` under `prefix`, a folder ending in a slash. A VPK the CLI
+ * cannot read still exits 0, with the exception on stderr, so a listing that
+ * comes back empty beside one is that failure, not an empty folder.
+ */
+export function listVpk(cli, vpk, prefix) {
+  const scratch = mkdtempSync(join(tmpdir(), "s2v-"));
+  try {
+    const run = spawnSync(
+      cli.includes("/") ? resolve(cli) : cli,
+      ["-i", resolve(vpk), "--vpk_list", "--vpk_filepath", prefix],
+      { cwd: scratch, encoding: "utf8", maxBuffer: 64 * 1024 * 1024 },
+    );
+    const paths = (run.stdout ?? "")
+      .split(/\r?\n/)
+      .filter((line) => / CRC:\S+ size:\d+$/.test(line))
+      .map((line) => line.split(" CRC:")[0]);
+    const stderr = tailLines(run.stderr ?? "", STDERR_LINES);
+    const failure =
+      run.error?.message ?? (run.status !== 0 ? `exit ${run.status ?? run.signal}` : null);
+    if (failure || (!paths.length && stderr.length)) {
+      throw new Error(
+        `Source2Viewer-CLI could not list ${basename(vpk)}` +
+          `${failure ? ` (${failure})` : ""}${stderr.length ? `: ${stderr.join(" | ")}` : ""}`,
+      );
+    }
+    return paths;
+  } finally {
+    rmSync(scratch, { recursive: true, force: true });
+  }
+}
+
 /**
  * Decompile one VPK entry, or a whole folder if the path ends in a slash.
  * `extra` carries export flags such as --gltf_export_format. Returns the tail
 
@@ -9,23 +9,48 @@ import { vi } from "vitest";
 // `{ stdout, stderr, repeat }`, printed before exiting (stdout `repeat`
 // times), with stderr also appended to ./exceptions.txt the way the real CLI
 // logs what it swallows. FAKE_S2V_VERSION is what --version reports; every
-// export is appended to FAKE_S2V_LOG, and the directory it ran in to
-// FAKE_S2V_CWD_LOG, when set.
+// export is appended to FAKE_S2V_LOG, its input VPK's name and the export to
+// FAKE_S2V_INPUT_LOG, and the directory it ran in to FAKE_S2V_CWD_LOG, when
+// set. FAKE_S2V_LIST maps an input VPK's name to the paths --vpk_list prints;
+// a listing is logged to FAKE_S2V_INPUT_LOG as `<vpk> --vpk_list <prefix>` and
+// prints FAKE_S2V_OUTPUT["--vpk_list"] too.
 const FAKE_CLI = `
 import { appendFileSync, copyFileSync, mkdirSync, writeSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { basename, dirname, join } from "node:path";
 const args = process.argv.slice(2);
 if (args.includes("--version")) {
   console.log("Version: " + (process.env.FAKE_S2V_VERSION ?? "fake-1"));
   console.log("OS: whatever the machine is");
   process.exit(0);
 }
 const at = (flag) => args[args.indexOf(flag) + 1];
+if (args.includes("--vpk_list")) {
+  const prefix = args.includes("--vpk_filepath") ? at("--vpk_filepath") : "";
+  if (process.env.FAKE_S2V_INPUT_LOG) {
+    appendFileSync(
+      process.env.FAKE_S2V_INPUT_LOG,
+      basename(at("-i")) + " --vpk_list " + prefix + "\\n",
+    );
+  }
+  const listing = JSON.parse(process.env.FAKE_S2V_OUTPUT ?? "{}")["--vpk_list"] ?? {};
+  if (listing.stderr) {
+    writeSync(2, listing.stderr);
+    appendFileSync("exceptions.txt", listing.stderr);
+  }
+  const listed = JSON.parse(process.env.FAKE_S2V_LIST ?? "{}")[basename(at("-i"))] ?? [];
+  for (const path of listed.filter((p) => p.startsWith(prefix))) {
+    console.log(path + " CRC:0000000000 size:1");
+  }
+  process.exit(0);
+}
 const filepath = at("--vpk_filepath");
 const format = args.includes("--gltf_export_format") ? at("--gltf_export_format") : null;
 if (process.env.FAKE_S2V_LOG) {
   appendFileSync(process.env.FAKE_S2V_LOG, filepath + "\\n");
 }
+if (process.env.FAKE_S2V_INPUT_LOG) {
+  appendFileSync(process.env.FAKE_S2V_INPUT_LOG, basename(at("-i")) + " " + filepath + "\\n");
+}
 if (process.env.FAKE_S2V_CWD_LOG) {
   appendFileSync(process.env.FAKE_S2V_CWD_LOG, process.cwd() + "\\n");
 }