From 51f35b781dd3c6c53a17ca7ca2aa5738a28679ea Mon Sep 17 00:00:00 2001
From: Soup <50962850+soupy-boy@users.noreply.github.com>
Date: Sun, 26 Jul 2026 16:50:29 -0600
Subject: [PATCH] config: added clap and figment

---
 '                                             |  972 ++++++++++
 .github/workflows/pr.yml                      |    3 -
 .github/workflows/rust.yml                    |    4 -
 Cargo.lock                                    |  836 +++++----
 Cargo.toml                                    |    6 +
 contrib/man/tuigreet-1                        |  312 ++++
 contrib/man/tuigreet-1.scd                    |  155 --
 crates/tuigreet-config/Cargo.toml             |   18 +-
 crates/tuigreet-config/src/config.rs          |  619 +++++++
 crates/tuigreet-config/src/env.rs             |  585 ------
 crates/tuigreet-config/src/error.rs           |   77 +
 crates/tuigreet-config/src/lib.rs             |   96 +-
 crates/tuigreet-config/src/loader.rs          |  142 ++
 crates/tuigreet-config/src/parser.rs          | 1621 -----------------
 crates/tuigreet-config/src/schema.rs          |  700 -------
 crates/tuigreet-config/src/tests.rs           |  582 ++++++
 crates/tuigreet-config/src/validation.rs      |  409 +++++
 crates/tuigreet-system/src/lib.rs             |    2 +-
 crates/tuigreet-theme/src/config.rs           |   83 -
 crates/tuigreet-theme/src/lib.rs              |  169 +-
 crates/tuigreet-theme/src/style.rs            |  148 --
 crates/tuigreet-types/src/lib.rs              |   18 +
 crates/tuigreet/Cargo.toml                    |    8 +
 crates/tuigreet/src/greeter.rs                | 1317 +++----------
 crates/tuigreet/src/info.rs                   |   48 +-
 crates/tuigreet/src/integration/common/mod.rs |    5 -
 crates/tuigreet/src/integration/display.rs    |    8 +-
 crates/tuigreet/src/integration/menus.rs      |    8 +-
 crates/tuigreet/src/integration/remember.rs   |    2 +-
 crates/tuigreet/src/ipc.rs                    |   23 +-
 crates/tuigreet/src/keyboard.rs               |   26 +-
 crates/tuigreet/src/main.rs                   |   29 +-
 crates/tuigreet/src/power.rs                  |    4 +-
 crates/tuigreet/src/ui/command.rs             |    4 +-
 crates/tuigreet/src/ui/common/menu.rs         |    2 +-
 crates/tuigreet/src/ui/mod.rs                 |   88 +-
 crates/tuigreet/src/ui/processing.rs          |    2 +-
 crates/tuigreet/src/ui/prompt.rs              |   30 +-
 crates/tuigreet/src/ui/tests.rs               |  126 +-
 crates/tuigreet/src/ui/util.rs                |   79 +-
 crates/tuigreet/src/watcher.rs                |  146 +-
 crates/tuigreet/tools/gen-manpage.rs          |   27 +
 nix/package.nix                               |    4 +-
 43 files changed, 4361 insertions(+), 5182 deletions(-)
 create mode 100644 '
 create mode 100644 contrib/man/tuigreet-1
 delete mode 100644 contrib/man/tuigreet-1.scd
 create mode 100644 crates/tuigreet-config/src/config.rs
 delete mode 100644 crates/tuigreet-config/src/env.rs
 create mode 100644 crates/tuigreet-config/src/error.rs
 create mode 100644 crates/tuigreet-config/src/loader.rs
 delete mode 100644 crates/tuigreet-config/src/parser.rs
 delete mode 100644 crates/tuigreet-config/src/schema.rs
 create mode 100644 crates/tuigreet-config/src/tests.rs
 create mode 100644 crates/tuigreet-config/src/validation.rs
 delete mode 100644 crates/tuigreet-theme/src/config.rs
 delete mode 100644 crates/tuigreet-theme/src/style.rs
 create mode 100644 crates/tuigreet/tools/gen-manpage.rs

diff --git a/' b/'
new file mode 100644
index 0000000..be989d4
--- /dev/null
+++ b/'
@@ -0,0 +1,972 @@
+use std::{convert::TryInto, env, path::PathBuf, process, sync::Arc};
+
+use chrono::Locale;
+use i18n_embed::DesktopLanguageRequester;
+use tokio::{
+  net::UnixStream,
+  sync::{RwLock, RwLockWriteGuard, mpsc::Sender},
+};
+use tracing_appender::non_blocking::WorkerGuard;
+use tuigreet_config::config::{
+  AlignGreeting,
+  BackgroundConfig,
+  Config,
+  SecretMode,
+};
+use tuigreet_theme::Theme;
+use tuigreet_types::{AuthStatus, GreetAlign, Mode, SecretDisplay};
+use zeroize::Zeroize;
+
+use crate::{
+  event::Event,
+  info::{
+    get_issue,
+    get_last_command,
+    get_last_session_path,
+    get_last_user_command,
+    get_last_user_name,
+    get_last_user_session,
+    get_last_user_username,
+    get_sessions,
+  },
+  power::PowerOption,
+  ui::{
+    background::Background,
+    bg_animation::{self, Animation, AnimationSpec},
+    common::{masked::MaskedString, menu::Menu},
+    power::Power,
+    sessions::{Session, SessionSource, SessionType},
+    users::User,
+  },
+};
+
+/// Default render rate when animation is enabled
+pub const ANIMATION_DEFAULT_FPS: u32 = 30;
+/// Base/floor render rate
+pub const DEFAULT_FPS: u32 = 2;
+
+const DEFAULT_LOCALE: Locale = Locale::en_US;
+
+/// Core greeter state managing authentication, UI, and session selection.
+pub struct Greeter {
+  pub logger: Option<WorkerGuard>,
+
+  pub locale: Locale,
+  pub config: Config, // store config
+  pub socket: String,
+  pub stream: Option<Arc<RwLock<UnixStream>>>,
+  pub events: Option<Sender<Event>>,
+
+  // Current mode of the application, will define what actions are permitted.
+  pub mode:          Mode,
+  // Mode the application will return to when exiting the current mode.
+  pub previous_mode: Mode,
+  // Offset the cursor should be at from its base position for the current
+  // mode.
+  pub cursor_offset: i16,
+
+  // Buffer to be used as a temporary editing zone for the various modes.
+  // Previous buffer is saved when a transient screen has to use the buffer, to
+  // be able to restore it when leaving the transient screen.
+  pub previous_buffer: Option<String>,
+  pub buffer:          String,
+
+  // Define the selected session and how to resolve it.
+  pub session_source: SessionSource,
+  // List of session files found on disk.
+  pub session_paths:  Vec<(PathBuf, SessionType)>,
+  // Menu for session selection.
+  pub sessions:       Menu<Session>,
+
+  // Menu for user selection.
+  pub users:    Menu<User>,
+  // Current username. Masked to display the full name if available.
+  pub username: MaskedString,
+  // Prompt that should be displayed to ask for entry.
+  pub prompt:   Option<String>,
+
+  // Whether the current edition prompt should be hidden.
+  pub asking_for_secret: bool,
+  // How should secrets be displayed?
+  pub secret_display:    SecretDisplay,
+
+  // Style object for the terminal UI
+  pub themeui:  Theme,
+  // Greeting message (MOTD) to use to welcome the user.
+  pub greeting: Option<String>,
+  // Transaction message to show to the user.
+  pub message:  Option<String>,
+
+  // Menu for power options.
+  pub powers: Menu<Power>,
+
+  // Background animation, drawn before the login UI.
+  pub animation:   Option<Box<dyn Animation>>,
+  // Menu for the on-the-fly background switcher (F4 by default).
+  pub backgrounds: Menu<Background>,
+
+  // The software is waiting for a response from `greetd`.
+  pub working: bool,
+  // We are done working.
+  pub done:    bool,
+  // Should we exit?
+  pub exit:    Option<AuthStatus>,
+}
+
+impl std::ops::Deref for Greeter {
+  type Target = Config;
+  fn deref(&self) -> &Self::Target {
+    &self.config
+  }
+}
+
+impl std::ops::DerefMut for Greeter {
+  fn deref_mut(&mut self) -> &mut Self::Target {
+    &mut self.config
+  }
+}
+
+impl Default for Greeter {
+  fn default() -> Self {
+    Self {
+      logger:            None,
+      locale:            DEFAULT_LOCALE,
+      config:            Config::defaults(),
+      socket:            String::new(),
+      stream:            None,
+      events:            None,
+      mode:              Mode::default(),
+      previous_mode:     Mode::default(),
+      cursor_offset:     0,
+      previous_buffer:   None,
+      buffer:            String::new(),
+      session_source:    SessionSource::default(),
+      session_paths:     Vec::new(),
+      sessions:          Menu::default(),
+      users:             Menu::default(),
+      username:          MaskedString::default(),
+      prompt:            None,
+      asking_for_secret: false,
+      secret_display:    SecretDisplay::default(),
+      themeui:           Theme::default(),
+      greeting:          None,
+      message:           None,
+      powers:            Menu::default(),
+      animation:         None,
+      backgrounds:       Menu::default(),
+      working:           false,
+      done:              false,
+      exit:              None,
+    }
+  }
+}
+
+impl Drop for Greeter {
+  fn drop(&mut self) {
+    self.scrub(true, false);
+  }
+}
+
+impl Greeter {
+  pub async fn new(events: Sender<Event>) -> Self {
+    let mut greeter = Self::default();
+
+    greeter.events = Some(events);
+    greeter.set_locale();
+
+    greeter.powers = Menu {
+      title:    fl!("title_power"),
+      options:  Default::default(),
+      selected: 0,
+    };
+
+    #[cfg(not(test))]
+    {
+      let mut config_error_str: Option<String> = None;
+//Result<(Config, Vec<ConfigError>), (Config, (Vec<ConfigError>, Vec<ConfigError>))>
+
+      let (config, (errors, warnings)) = match tuigreet_config::loader::load_config() {
+        Ok(config) => {
+          tracing::debug!("Config loaded successfully");
+          // Apply config to greeter only if validation passed
+          config
+        },
+        Err(e) => {
+          config_error_str = Some(e.to_string());
+          (Config::defaults(), Vec::new())
+        },
+      };
+      greeter.apply_config(config);
+
+      // Apply terminal sizing based on [[outputs]] / [terminal]
+      // config.  This must happen before the TUI is started so
+      // that ratatui sees the correct terminal dimensions.
+      if !greeter.outputs.is_empty() || greeter.terminal.cols.is_some() {
+        tuigreet_system::apply_output_config(
+          &greeter.outputs,
+          &greeter.terminal,
+        );
+      }
+
+      greeter.logger = crate::init_logger(&greeter);
+
+      // show config warnings and errors now that the logger is initialized
+      if let Some(err) = config_error_str {
+        tracing::error!(err);
+      }
+      for warning in warnings {
+        tracing::error!(warning);
+      }
+
+      greeter.connect().await;
+    }
+
+    let mut sessions = get_sessions(&greeter).unwrap_or_default();
+
+    if greeter.general.mock && sessions.is_empty() {
+      sessions = mock_sessions();
+    }
+
+    if matches!(greeter.session_source, SessionSource::None)
+      && !sessions.is_empty()
+    {
+      greeter.session_source = SessionSource::Session(0);
+    }
+
+    greeter.sessions = Menu {
+      title:    fl!("title_session"),
+      options:  sessions,
+      selected: 0,
+    };
+
+    // If a default user is specified, use it.
+    if let Some(ref default_user) = greeter.remember.default_user {
+      greeter.username = MaskedString::from(default_user.clone(), None);
+    }
+
+    // If we should remember the last logged-in user.
+    if greeter.remember.username
+      && let Some(username) = get_last_user_username()
+    {
+      greeter.username = MaskedString::from(username, get_last_user_name());
+
+      // If, on top of that, we should remember their last session.
+      if greeter.remember.user_session {
+        // See if we have the last free-form command from the user.
+        if let Ok(command) = get_last_user_command(greeter.username.get()) {
+          greeter.session_source = SessionSource::Command(command);
+        }
+
+        // If a session was saved, use it and its name.
+        if let Ok(ref session_path) =
+          get_last_user_session(greeter.username.get())
+        {
+          // Set the selected menu option and the session source.
+          if let Some(index) = greeter.sessions.options.iter().position(
+            |Session { path, .. }| path.as_deref() == Some(session_path),
+          ) {
+            greeter.sessions.selected = index;
+            greeter.session_source =
+              SessionSource::Session(greeter.sessions.selected);
+          }
+        }
+      }
+    }
+
+    // Same thing, but not user specific.
+    if greeter.remember.session {
+      if let Ok(command) = get_last_command() {
+        greeter.session_source =
+          SessionSource::Command(command.trim().to_string());
+      }
+
+      if let Ok(ref session_path) = get_last_session_path()
+        && let Some(index) = greeter.sessions.options.iter().position(
+          |Session { path, .. }| path.as_deref() == Some(session_path),
+        )
+      {
+        greeter.sessions.selected = index;
+        greeter.session_source =
+          SessionSource::Session(greeter.sessions.selected);
+      }
+    }
+
+    greeter
+  }
+
+  // Scrub memory of all data, unless `soft` is true, in which case, we will
+  // keep the username (can happen if a wrong password was entered, we want to
+  // give the user another chance, as PAM would).
+  fn scrub(&mut self, scrub_message: bool, soft: bool) {
+    self.buffer.zeroize();
+    self.prompt.zeroize();
+
+    if !soft {
+      self.username.zeroize();
+    }
+
+    if scrub_message {
+      self.message.zeroize();
+    }
+  }
+
+  // Reset the software to its initial state.
+  pub async fn reset(&mut self, soft: bool) {
+    if soft {
+      self.mode = Mode::Password;
+      self.previous_mode = Mode::Password;
+    } else {
+      self.mode = Mode::Username;
+      self.previous_mode = Mode::Username;
+    }
+
+    self.working = false;
+    self.done = false;
+
+    self.scrub(false, soft);
+    self.connect().await;
+  }
+
+  // Connect to `greetd` and return a stream we can safely write to.
+  pub async fn connect(&mut self) {
+    if self.general.mock {
+      tracing::info!("mock mode: skipping greetd socket connect");
+      return;
+    }
+
+    // If socket is not already set (by tests), read from environment
+    if self.socket.is_empty() {
+      self.socket = if let Ok(socket) = env::var("GREETD_SOCK") {
+        socket
+      } else {
+        eprintln!("GREETD_SOCK must be defined");
+        process::exit(1);
+      };
+    }
+
+    match UnixStream::connect(&self.socket).await {
+      Ok(stream) => {
+        self.stream = Some(Arc::new(RwLock::new(stream)));
+      },
+
+      Err(err) => {
+        eprintln!("{err}");
+        process::exit(1);
+      },
+    }
+  }
+
+  pub async fn stream(&self) -> RwLockWriteGuard<'_, UnixStream> {
+    self
+      .stream
+      .as_ref()
+      .expect("stream accessed before connect")
+      .write()
+      .await
+  }
+
+  #[must_use]
+  pub fn greet_align(&self) -> GreetAlign {
+    match self.display.align_greeting {
+      AlignGreeting::Left => GreetAlign::Left,
+      AlignGreeting::Right => GreetAlign::Right,
+      AlignGreeting::Center => GreetAlign::Center,
+    }
+  }
+
+  // Sets the locale that will be used for this invocation from environment.
+  fn set_locale(&mut self) {
+    let locale = DesktopLanguageRequester::requested_languages()
+      .into_iter()
+      .next()
+      .and_then(|locale| {
+        locale
+          .region
+          .map(|region| format!("{}_{region}", locale.language))
+      })
+      .and_then(|id| id.as_str().try_into().ok());
+
+    if let Some(locale) = locale {
+      self.locale = locale;
+    }
+  }
+
+  fn populate_backgrounds_menu(&mut self) {
+    let title = fl!("title_background");
+    let none_label = fl!("background_none");
+    let options = crate::ui::background::options(&none_label);
+    // Highlight the first concrete kind when an animation is active,
+    // otherwise the synthetic "None" at index 0.
+    let selected = if self.animation.is_none() {
+      0
+    } else {
+      1.min(options.len() - 1)
+    };
+
+    self.backgrounds = Menu {
+      title,
+      options,
+      selected,
+    };
+  }
+
+  pub fn apply_background_selection(&mut self) {
+    let Some(item) = self.backgrounds.options.get(self.backgrounds.selected)
+    else {
+      return;
+    };
+    match item.kind {
+      None => {
+        self.animation = None;
+      },
+      Some(kind) => {
+        self.animation = Some(bg_animation::build_default(kind));
+      },
+    }
+    self.push_frame_rate();
+    if let Some(ref sender) = self.events {
+      let sender = sender.clone();
+      tokio::spawn(async move {
+        let _ = sender.send(crate::event::Event::Refresh).await;
+      });
+    }
+  }
+
+  fn set_background_from_config(&mut self, cfg: &BackgroundConfig) {
+    use crate::ui::bg_animation::{Kind, doom, matrix};
+
+    let Some(kind) = cfg.kind.as_deref().and_then(Kind::from_name) else {
+      if let Some(name) = cfg.kind.as_deref()
+        && !name.trim().is_empty()
+        && !name.eq_ignore_ascii_case("none")
+      {
+        tracing::warn!(
+          "unknown background animation kind '{}', ignoring",
+          name
+        );
+      }
+      self.animation = None;
+      self.push_frame_rate();
+      return;
+    };
+
+    let parse = |s: &str, fallback: tui::style::Color| {
+      bg_animation::parse_color(s).unwrap_or(fallback)
+    };
+
+    let spec = match kind {
+      Kind::Doom => {
+        let d = doom::Options::default();
+        AnimationSpec::Doom(doom::Options {
+          height: cfg.doom.height,
+          spread: cfg.doom.spread,
+          top:    parse(&cfg.doom.top_color, d.top),
+          middle: parse(&cfg.doom.middle_color, d.middle),
+          bottom: parse(&cfg.doom.bottom_color, d.bottom),
+        })
+      },
+      Kind::Matrix => {
+        let d = matrix::Options::default();
+        AnimationSpec::Matrix(matrix::Options {
+          head:          parse(&cfg.matrix.head_color, d.head),
+          bright:        parse(&cfg.matrix.bright_color, d.bright),
+          dim:           parse(&cfg.matrix.dim_color, d.dim),
+          min_length:    cfg.matrix.min_length,
+          max_length:    cfg.matrix.max_length,
+          min_speed:     cfg.matrix.min_speed,
+          max_speed:     cfg.matrix.max_speed,
+          mutate_chance: cfg.matrix.mutate_chance,
+        })
+      },
+    };
+    self.animation = Some(bg_animation::build(&spec));
+    self.push_frame_rate();
+  }
+
+  /// Render rate for the event loop.
+  #[must_use]
+  pub fn frame_rate(&self) -> f64 {
+    if self.animation.is_some() {
+      self.background.fps.max(DEFAULT_FPS) as f64
+    } else {
+      DEFAULT_FPS as f64
+    }
+  }
+
+  /// Push the current frame rate to the event loop.
+  fn push_frame_rate(&self) {
+    if let Some(tx) = &self.events {
+      let fps = self.frame_rate();
+      let tx = tx.clone();
+      tokio::spawn(async move {
+        let _ = tx.send(Event::SetFrameRate(fps)).await;
+      });
+    }
+  }
+
+  fn add_session_path(&mut self, path: PathBuf, session_type: SessionType) {
+    if self.session_paths.iter().any(|(known_path, known_type)| {
+      known_path == &path && known_type == &session_type
+    }) {
+      return;
+    }
+
+    self.session_paths.push((path, session_type));
+  }
+
+  fn set_power_command(
+    &mut self,
+    action: PowerOption,
+    command: Option<String>,
+  ) {
+    if let Some(power) = self
+      .powers
+      .options
+      .iter_mut()
+      .find(|power| power.action == action)
+    {
+      power.command = command;
+      return;
+    }
+
+    let label = match action {
+      PowerOption::Shutdown => fl!("shutdown"),
+      PowerOption::Reboot => fl!("reboot"),
+      PowerOption::Suspend => fl!("suspend"),
+      PowerOption::Hibernate => fl!("hibernate"),
+    };
+
+    self.powers.options.push(Power {
+      action,
+      label,
+      command,
+    });
+  }
+
+  pub fn set_prompt(&mut self, prompt: &str) {
+    self.prompt = if prompt.ends_with(' ') {
+      Some(prompt.into())
+    } else {
+      Some(format!("{prompt} "))
+    };
+  }
+
+  pub fn remove_prompt(&mut self) {
+    self.prompt = None;
+  }
+
+  // Computes the size of the prompt to help determine where input should start.
+  #[must_use]
+  pub fn prompt_width(&self) -> usize {
+    match &self.prompt {
+      None => 0,
+      Some(prompt) => prompt.chars().count(),
+    }
+  }
+
+  // Apply configuration settings to the greeter, respecting CLI overrides
+  pub fn apply_config(&mut self, config: Config) {
+    use SecretMode;
+    // Session
+    self.session_source = config.session.command.as_ref().map_or_else(
+      SessionSource::default,
+      |command| {
+        SessionSource::DefaultCommand(
+          command.clone(),
+          (!config.session.environments.is_empty())
+            .then(|| config.session.environments.clone()),
+        )
+      },
+    );
+    self.session_paths.clear();
+    for dir in &config.session.sessions_dirs {
+      self.add_session_path(PathBuf::from(dir), SessionType::Wayland);
+    }
+    for dir in &config.session.xsessions_dirs {
+      self.add_session_path(PathBuf::from(dir), SessionType::X11);
+    }
+    // Display
+    self.greeting = if config.display.issue {
+      get_issue()
+    } else {
+      config.display.greeting.clone()
+    };
+    // User menu
+    if config.user_menu.enabled {
+      use crate::info::get_users;
+      self.users = Menu {
+        title:    fl!("title_users"),
+        options:  get_users(config.user_menu.min_uid, config.user_menu.max_uid),
+        selected: 0,
+      };
+    } else {
+      self.users = Menu::default();
+    }
+    // Power
+    self
+      .set_power_command(PowerOption::Shutdown, config.power.shutdown.clone());
+    self.set_power_command(PowerOption::Reboot, config.power.reboot.clone());
+    self.set_power_command(PowerOption::Suspend, config.power.suspend.clone());
+    self.set_power_command(
+      PowerOption::Hibernate,
+      config.power.hibernate.clone(),
+    );
+    // Secret
+    self.secret_display = match config.secret.mode {
+      SecretMode::Hidden => SecretDisplay::Hidden,
+      SecretMode::Characters => {
+        SecretDisplay::Character(config.secret.characters.clone())
+      },
+    };
+    // Animation
+    self.set_background_from_config(&config.background);
+    self.populate_backgrounds_menu();
+
+    // Apply theme config
+    self.themeui = Theme::from_config(&config.theme);
+
+    // set config of greeter
+    self.config = config;
+  }
+
+  pub fn reload_sessions(&mut self) {
+    let selected_path = self
+      .sessions
+      .options
+      .get(self.sessions.selected)
+      .and_then(|session| session.path.clone());
+    let sessions = get_sessions(self).unwrap_or_default();
+    self.sessions.options = sessions;
+    self.sessions.selected = selected_path
+      .as_ref()
+      .and_then(|path| {
+        self
+          .sessions
+          .options
+          .iter()
+          .position(|session| session.path.as_ref() == Some(path))
+      })
+      .unwrap_or(0);
+    if matches!(self.session_source, SessionSource::Session(_)) {
+      self.session_source = if self.sessions.options.is_empty() {
+        SessionSource::default()
+      } else {
+        SessionSource::Session(self.sessions.selected)
+      };
+    }
+  }
+}
+
+// Mock session list used to pad otherwise empty session menu
+fn mock_sessions() -> Vec<Session> {
+  [
+    ("mock-wayland", "Mock Wayland", SessionType::Wayland),
+    ("mock-x11", "Mock X11", SessionType::X11),
+    ("mock-shell", "Mock shell", SessionType::None),
+  ]
+  .into_iter()
+  .map(|(slug, name, session_type)| {
+    Session {
+      slug: Some(slug.to_string()),
+      name: name.to_string(),
+      command: "true".to_string(),
+      session_type,
+      path: None,
+      xdg_desktop_names: None,
+    }
+  })
+  .collect()
+}
+
+#[cfg(test)]
+mod test {
+  use tuigreet_types::SecretDisplay;
+
+  use crate::{
+    Greeter,
+    power::PowerOption,
+    ui::sessions::{SessionSource, SessionType},
+  };
+
+  #[test]
+  fn test_prompt_width() {
+    let mut greeter = Greeter::default();
+    greeter.prompt = None;
+
+    assert_eq!(greeter.prompt_width(), 0);
+
+    greeter.prompt = Some("Hello:".into());
+
+    assert_eq!(greeter.prompt_width(), 6);
+  }
+
+  #[test]
+  fn test_set_prompt() {
+    let mut greeter = Greeter::default();
+
+    greeter.set_prompt("Hello:");
+
+    assert_eq!(greeter.prompt, Some("Hello: ".into()));
+
+    greeter.set_prompt("Hello World: ");
+
+    assert_eq!(greeter.prompt, Some("Hello World: ".into()));
+
+    greeter.remove_prompt();
+
+    assert_eq!(greeter.prompt, None);
+  }
+
+  // #[test]
+  // fn applying_config_replaces_session_state() {
+  // let mut greeter = Greeter::default();
+  // greeter.config = Some(
+  // Greeter::options()
+  // .parse(Vec::<String>::new())
+  // .expect("empty CLI parses"),
+  // );
+  //
+  // let mut configured = Config::default();
+  // configured.session.command = Some("first".into());
+  // configured.session.sessions_dirs = vec!["/first".into()];
+  // configured.session.session_wrapper = Some("wrapper".into());
+  // configured.user_menu.enabled = true;
+  // greeter.apply_config(&configured);
+  //
+  // let mut replacement = Config::default();
+  // replacement.session.sessions_dirs = vec!["/second".into()];
+  // greeter.apply_config(&replacement);
+  //
+  // assert!(matches!(greeter.session_source, SessionSource::None));
+  // assert_eq!(greeter.session_paths.len(), 2);
+  // assert!(
+  // greeter
+  // .session_paths
+  // .iter()
+  // .any(|(path, _)| path == "/second")
+  // );
+  // assert!(greeter.session_wrapper.is_none());
+  // assert!(!greeter.user_menu);
+  // assert!(greeter.users.options.is_empty());
+  // }dump-config
+  //
+  // #[test]
+  // fn applying_config_updates_log_file() {
+  // let mut greeter = Greeter::default();
+  // let mut config = Config::default();
+  // config.general.log_file = "/tmp/configured-tuigreet.log".into();
+  // greeter.config = Some(
+  // Greeter::options()
+  // .parse(Vec::<String>::new())
+  // .expect("empty CLI parses"),
+  // );
+  //
+  // greeter.apply_config(&config);
+  //
+  // assert_eq!(greeter.logfile, "/tmp/configured-tuigreet.log");
+  // }
+  //
+  // #[tokio::test]
+  // async fn test_command_line_arguments() {
+  // let table: &[CommandLineTest] = &[
+  // No arguments
+  // (&[], true, None),
+  // Valid combinations
+  // (&["--cmd", "hello"], true, None),
+  // (
+  // &[
+  // "--cmd",
+  // "uname",
+  // "--env",
+  // "A=B",
+  // "--env",
+  // "C=D=E",
+  // "--asterisks",
+  // "--asterisks-char",
+  // ".",
+  // "--issue",
+  // "--time",
+  // "--prompt-padding",
+  // "0",
+  // "--window-padding",
+  // "1",
+  // "--container-padding",
+  // "12",
+  // "--user-menu",
+  // ],
+  // true,
+  // Some(|greeter| {
+  // assert!(
+  // matches!(&greeter.session_source, SessionSource::DefaultCommand(cmd,
+  // Some(env)) if cmd == "uname" && env.len() == 2) );
+  //
+  // if let SessionSource::DefaultCommand(_, Some(env)) =
+  // &greeter.session_source
+  // {
+  // assert_eq!(env[0], "A=B");
+  // assert_eq!(env[1], "C=D=E");
+  // }
+  //
+  // assert!(
+  // matches!(&greeter.secret_display, SecretDisplay::Character(c) if c == ".")
+  // );
+  // assert_eq!(greeter.prompt_padding(), 0);
+  // assert_eq!(greeter.window_padding(), 1);
+  // assert_eq!(greeter.container_padding(), 13);
+  // assert!(greeter.user_menu);
+  // assert!(matches!(
+  // greeter.xsession_wrapper.as_deref(),
+  // Some("startx")
+  // ));
+  // }),
+  // ),
+  // (
+  // &["--xsession-wrapper", "mywrapper.sh"],
+  // true,
+  // Some(|greeter| {
+  // assert!(matches!(
+  // greeter.xsession_wrapper.as_deref(),
+  // Some("mywrapper.sh")
+  // ));
+  // }),
+  // ),
+  // (
+  // &["--no-xsession-wrapper"],
+  // true,
+  // Some(|greeter| {
+  // assert!(greeter.xsession_wrapper.is_none());
+  // }),
+  // ),
+  // Invalid combinations
+  // (
+  // &["--remember-session", "--remember-user-session"],
+  // false,
+  // None,
+  // ),
+  // (&["--asterisk-char", ""], false, None),
+  // (&["--remember-user-session"], false, None),
+  // (&["--min-uid", "10000", "--max-uid", "5000"], false, None),
+  // (&["--issue", "--greeting", "Hello, world!"], false, None),
+  // (&["--kb-command", "F2", "--kb-sessions", "F2"], false, None),
+  // (&["--time-format", "%i %"], false, None),
+  // (&["--cmd", "cmd", "--env"], false, None),
+  // (&["--cmd", "cmd", "--env", "A"], false, None),
+  // ];
+  //
+  // for (opts, valid, check) in table {
+  // let mut greeter = Greeter::default();
+  //
+  // match valid {
+  // true => {
+  // assert!(
+  // matches!(greeter.parse_options(opts).await, Ok(())),
+  // "{opts:?} cannot be parsed"
+  // );
+  //
+  // if let Some(check) = check {
+  // check(&greeter);
+  // }
+  // },
+  // false => assert!((greeter.parse_options(opts).await).is_err()),
+  // }
+  // }
+  // }
+  //
+  // #[tokio::test]
+  // async fn test_session_paths_are_deduplicated_after_config_overlay() {
+  // let mut greeter = Greeter::default();
+  //
+  // assert!(
+  // greeter
+  // .parse_options(&["--sessions", "/usr/share/wayland-sessions"])
+  // .await
+  // .is_ok()
+  // );
+  //
+  // let config = Config::default();
+  // greeter.apply_config(&config);
+  //
+  // assert_eq!(
+  // greeter
+  // .session_paths
+  // .iter()
+  // .filter(|(path, session_type)| {
+  // path == &std::path::PathBuf::from("/usr/share/wayland-sessions")
+  // && session_type == &SessionType::Wayland
+  // })
+  // .count(),
+  // 1
+  // );
+  // }
+  //
+  // #[tokio::test]
+  // async fn test_config_session_environments_survive_cli_overlay() {
+  // let mut greeter = Greeter::default();
+  //
+  // assert!(
+  // greeter
+  // .parse_options(&[
+  // "--cmd",
+  // "sway",
+  // "--env",
+  // "XDG_CURRENT_DESKTOP=sway",
+  // "--env",
+  // "XDG_SESSION_TYPE=wayland",
+  // ])
+  // .await
+  // .is_ok()
+  // );
+  //
+  // let mut config = Config::default();
+  // config.session.command = Some("sway".to_string());
+  // config.session.environments = vec![
+  // "XDG_CURRENT_DESKTOP=sway".to_string(),
+  // "XDG_SESSION_TYPE=wayland".to_string(),
+  // ];
+  // greeter.apply_config(&config);
+  //
+  // assert!(matches!(
+  // &greeter.session_source,
+  // SessionSource::DefaultCommand(command, Some(environments))
+  // if command == "sway"
+  // && environments
+  // == &vec![
+  // "XDG_CURRENT_DESKTOP=sway".to_string(),
+  // "XDG_SESSION_TYPE=wayland".to_string()
+  // ]
+  // ));
+  // }
+  //
+  // #[tokio::test]
+  // async fn test_config_power_options_are_applied() {
+  // let mut greeter = Greeter::default();
+  //
+  // assert!(greeter.parse_options(&[] as &[&str]).await.is_ok());
+  //
+  // let mut config = Config::default();
+  // config.power.shutdown = Some("loginctl poweroff".to_string());
+  // config.power.reboot = Some("loginctl reboot".to_string());
+  // config.power.suspend = Some("loginctl suspend".to_string());
+  // config.power.hibernate = Some("loginctl hibernate".to_string());
+  // config.power.use_setsid = false;
+  // greeter.apply_config(&config);
+  //
+  // assert!(!greeter.power_setsid);
+  // assert!(greeter.powers.options.iter().any(|power| {
+  // power.action == PowerOption::Shutdown
+  // && power.command.as_deref() == Some("loginctl poweroff")
+  // }));
+  // assert!(greeter.powers.options.iter().any(|power| {
+  // power.action == PowerOption::Reboot
+  // && power.command.as_deref() == Some("loginctl reboot")
+  // }));
+  // assert!(greeter.powers.options.iter().any(|power| {
+  // power.action == PowerOption::Suspend
+  // && power.command.as_deref() == Some("loginctl suspend")
+  // }));
+  // assert!(greeter.powers.options.iter().any(|power| {
+  // power.action == PowerOption::Hibernate
+  // && power.command.as_deref() == Some("loginctl hibernate")
+  // }));
+  // }
+}
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 0d3bfb0..1bb9eb8 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -32,9 +32,6 @@ jobs:
         run: |
           cargo test
           LD_PRELOAD=libnss_wrapper.so cargo test --features nsswrapper nsswrapper_
-      - name: Generate manpage
-        run: |
-          scdoc < contrib/man/tuigreet-1.scd > /dev/null
 
   build:
     strategy:
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index 8fe1dc2..3b0c352 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -61,7 +61,3 @@ jobs:
         run: |
           cargo test
           LD_PRELOAD=libnss_wrapper.so cargo test --features nsswrapper nsswrapper_
-
-      - name: Generate manpage
-        run: |
-          scdoc < contrib/man/tuigreet-1.scd > /dev/null
diff --git a/Cargo.lock b/Cargo.lock
index da8db85..2825811 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -10,9 +10,9 @@ checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
 
 [[package]]
 name = "android_system_properties"
-version = "0.1.5"
+version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
+checksum = "ae221649c9976a6f6c56ae1facf410f3ddb33cc661c4b7b61020a912d4237fbc"
 dependencies = [
  "libc",
 ]
@@ -27,14 +27,58 @@ dependencies = [
  "ratatui-core",
  "simdutf8",
  "smallvec",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
+]
+
+[[package]]
+name = "anstream"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d"
+dependencies = [
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is_terminal_polyfill",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
+
+[[package]]
+name = "anstyle-parse"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52ce7f38b242319f7cabaa6813055467063ecdc9d355bbb4ce0c68908cd8130e"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
+dependencies = [
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
-name = "anyhow"
-version = "1.0.102"
+name = "anstyle-wincon"
+version = "3.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
+checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
+dependencies = [
+ "anstyle",
+ "once_cell_polyfill",
+ "windows-sys 0.61.2",
+]
 
 [[package]]
 name = "approx"
@@ -47,29 +91,38 @@ dependencies = [
 
 [[package]]
 name = "arc-swap"
-version = "1.9.1"
+version = "1.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a3a1fd6f75306b68087b831f025c712524bcb19aad54e557b1129cfa0a2b207"
+checksum = "c049c0be4daef0b145cb3555416b3b8ef5b7888a38aea1a3a155801fe7b0810b"
 dependencies = [
  "rustversion",
 ]
 
 [[package]]
 name = "async-trait"
-version = "0.1.89"
+version = "0.1.91"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb"
+checksum = "ae36dc4177970ef04fde5178d3e2429882def40e57a451f919c098f72baa6cec"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "atomic"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89cbf775b137e9b968e67227ef7f775587cde3fd31b0d8599dbd0f598a48340"
+dependencies = [
+ "bytemuck",
 ]
 
 [[package]]
 name = "autocfg"
-version = "1.5.0"
+version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
 
 [[package]]
 name = "basic-toml"
@@ -80,12 +133,6 @@ dependencies = [
  "serde",
 ]
 
-[[package]]
-name = "bitflags"
-version = "1.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
-
 [[package]]
 name = "bitflags"
 version = "2.13.1"
@@ -103,9 +150,9 @@ dependencies = [
 
 [[package]]
 name = "bumpalo"
-version = "3.20.2"
+version = "3.20.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d20789868f4b01b2f2caec9f5c4e0213b41e3e5702a50157d699ae31ced2fcb"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
 
 [[package]]
 name = "by_address"
@@ -113,6 +160,12 @@ version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "64fa3c856b712db6612c019f14756e64e4bcea13337a6b33b696333a9eaa2d06"
 
+[[package]]
+name = "bytemuck"
+version = "1.25.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95832e849adfb21180ccb6826a99da14e5d266ae5c2e668e1602cf234f153797"
+
 [[package]]
 name = "byteorder"
 version = "1.5.0"
@@ -121,9 +174,9 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "bytes"
-version = "1.11.1"
+version = "1.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
+checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
 
 [[package]]
 name = "castaway"
@@ -136,9 +189,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.2.60"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "43c5703da9466b66a946814e1adf53ea2c90f10063b86290cc9eb67ce3478a20"
+checksum = "5add81bb678e6cb321aff7fa0dc7689ad82b112dbc032cea19f91d6b8e3582b9"
 dependencies = [
  "find-msvc-tools",
  "shlex",
@@ -152,15 +205,15 @@ checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 
 [[package]]
 name = "cfg_aliases"
-version = "0.2.1"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
+checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
 
 [[package]]
 name = "chacha20"
-version = "0.10.0"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601"
+checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
 dependencies = [
  "cfg-if",
  "cpufeatures",
@@ -181,6 +234,56 @@ dependencies = [
  "windows-link",
 ]
 
+[[package]]
+name = "clap"
+version = "4.6.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "473c7e07f409a8d772161724aa8db6a765a2532a70f9667eeb7b49d3d02fbdca"
+dependencies = [
+ "clap_builder",
+ "clap_derive",
+]
+
+[[package]]
+name = "clap_builder"
+version = "4.6.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b48fea5a88e9ae728a2dcbedbfc0e730f7d60da42e1cb049a83c9fb8b789889"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "clap_lex",
+ "strsim",
+]
+
+[[package]]
+name = "clap_derive"
+version = "4.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d012d2b9d65aca7f18f4d9878a045bc17899bba951561ba5ec3c2ba1eed9a061"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "clap_lex"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
+
+[[package]]
+name = "clap_mangen"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c630ddc90572b3d9abd3f887f0007b4e048faf5c5a59ae607f8ac1c5e3790873"
+dependencies = [
+ "clap",
+ "roff",
+]
+
 [[package]]
 name = "codespan-reporting"
 version = "0.13.1"
@@ -192,6 +295,12 @@ dependencies = [
  "unicode-width",
 ]
 
+[[package]]
+name = "colorchoice"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
+
 [[package]]
 name = "compact_str"
 version = "0.9.1"
@@ -258,18 +367,18 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-channel"
-version = "0.5.15"
+version = "0.5.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82b8f8f868b36967f9606790d1903570de9ceaf870a7bf9fbbd3016d636a2cb2"
+checksum = "d85363c37faeca707aef026efa9f3b34d077bce547e48f770770625c6013679e"
 dependencies = [
  "crossbeam-utils",
 ]
 
 [[package]]
 name = "crossbeam-utils"
-version = "0.8.21"
+version = "0.8.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
+checksum = "61803da095bee82a81bb1a452ecc25d3b2f1416d1897eb86430c6159ef717c17"
 
 [[package]]
 name = "crossterm"
@@ -277,7 +386,7 @@ version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d8b9f2e4c67f833b660cdb0a3523065869fb35570177239812ed4c905aeff87b"
 dependencies = [
- "bitflags 2.13.1",
+ "bitflags",
  "crossterm_winapi",
  "derive_more",
  "document-features",
@@ -316,9 +425,9 @@ dependencies = [
 
 [[package]]
 name = "darling"
-version = "0.23.0"
+version = "0.24.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25ae13da2f202d56bd7f91c25fba009e7717a1e4a1cc98a76d844b65ae912e9d"
+checksum = "88490bf1b990d87eaaa7ac8aa887f629a08e7359765b4911faf63c3763347d23"
 dependencies = [
  "darling_core",
  "darling_macro",
@@ -326,26 +435,26 @@ dependencies = [
 
 [[package]]
 name = "darling_core"
-version = "0.23.0"
+version = "0.24.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9865a50f7c335f53564bb694ef660825eb8610e0a53d3e11bf1b0d3df31e03b0"
+checksum = "084e274f91c482280130e1e34e0b8d6e66776a060d7b6de7b84289ca778868c4"
 dependencies = [
  "ident_case",
  "proc-macro2",
  "quote",
  "strsim",
- "syn 2.0.117",
+ "syn 3.0.3",
 ]
 
 [[package]]
 name = "darling_macro"
-version = "0.23.0"
+version = "0.24.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac3984ec7bd6cfa798e62b4a642426a5be0e68f9401cfc2a01e3fa9ea2fcdb8d"
+checksum = "68f5792fa0d41cd2325ce0ffa64f0a340eaebd4971a3a0c5e1ffd2cc488a355e"
 dependencies = [
  "darling_core",
  "quote",
- "syn 2.0.117",
+ "syn 3.0.3",
 ]
 
 [[package]]
@@ -353,9 +462,6 @@ name = "deranged"
 version = "0.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
-dependencies = [
- "powerfmt",
-]
 
 [[package]]
 name = "derive_more"
@@ -376,7 +482,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "rustc_version",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -413,13 +519,13 @@ dependencies = [
 
 [[package]]
 name = "displaydoc"
-version = "0.2.5"
+version = "0.2.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
+checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 3.0.3",
 ]
 
 [[package]]
@@ -442,9 +548,9 @@ dependencies = [
 
 [[package]]
 name = "either"
-version = "1.15.0"
+version = "1.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
+checksum = "9e5e8f6c15a24b9a3ee5efec809ccd006d3b30e8b3bb63c39af737c7f87daa1d"
 
 [[package]]
 name = "equivalent"
@@ -463,16 +569,26 @@ dependencies = [
 ]
 
 [[package]]
-name = "fast-srgb8"
-version = "1.0.0"
+name = "fastrand"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd2e7510819d6fbf51a5545c8f922716ecfb14df168a3242f7d33e0239efe6a1"
+checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223"
 
 [[package]]
-name = "fastrand"
-version = "2.4.1"
+name = "figment"
+version = "0.10.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6"
+checksum = "8cb01cd46b0cf372153850f4c6c272d9cbea2da513e07538405148f95bd789f3"
+dependencies = [
+ "atomic",
+ "parking_lot",
+ "pear",
+ "serde",
+ "tempfile",
+ "toml 0.8.23",
+ "uncased",
+ "version_check",
+]
 
 [[package]]
 name = "find-crate"
@@ -531,15 +647,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "54f0d287c53ffd184d04d8677f590f4ac5379785529e5e08b1c8083acdd5c198"
 dependencies = [
  "memchr",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
 ]
 
-[[package]]
-name = "foldhash"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
-
 [[package]]
 name = "foldhash"
 version = "0.2.0"
@@ -611,7 +721,7 @@ checksum = "2d6d3cde68c518367be28956066ddfef33813991b77a55005a69dae04bf3b10b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -665,16 +775,14 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.4.2"
+version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0de51e6874e94e7bf76d726fc5d13ba782deca734ff60d5bb2fb2607c7406555"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
 dependencies = [
  "cfg-if",
  "libc",
  "r-efi",
  "rand_core",
- "wasip2",
- "wasip3",
 ]
 
 [[package]]
@@ -710,15 +818,6 @@ version = "0.14.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
 
-[[package]]
-name = "hashbrown"
-version = "0.15.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
-dependencies = [
- "foldhash 0.1.5",
-]
-
 [[package]]
 name = "hashbrown"
 version = "0.16.1"
@@ -727,18 +826,18 @@ checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
 dependencies = [
  "allocator-api2",
  "equivalent",
- "foldhash 0.2.0",
+ "foldhash",
 ]
 
 [[package]]
 name = "hashbrown"
-version = "0.17.0"
+version = "0.17.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f467dd6dccf739c208452f8014c75c18bb8301b050ad1cfb27153803edb0f51"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
 dependencies = [
  "allocator-api2",
  "equivalent",
- "foldhash 0.2.0",
+ "foldhash",
 ]
 
 [[package]]
@@ -749,9 +848,9 @@ checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 
 [[package]]
 name = "hybrid-array"
-version = "0.4.13"
+version = "0.4.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "818356c5132c1fede50f837ca96afbe78ff42413047f4abb886217845e1b6c8c"
+checksum = "707114b52a152fa7bdb290cd7cd5912d9467273b6d74e21b8d81aca1f8533f6b"
 dependencies = [
  "typenum",
 ]
@@ -806,7 +905,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "strsim",
- "syn 2.0.117",
+ "syn 2.0.119",
  "unic-langid",
 ]
 
@@ -820,7 +919,7 @@ dependencies = [
  "i18n-config",
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -847,12 +946,6 @@ dependencies = [
  "cc",
 ]
 
-[[package]]
-name = "id-arena"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"
-
 [[package]]
 name = "ident_case"
 version = "1.0.1"
@@ -866,9 +959,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
 dependencies = [
  "equivalent",
- "hashbrown 0.17.0",
- "serde",
- "serde_core",
+ "hashbrown 0.17.1",
 ]
 
 [[package]]
@@ -880,37 +971,43 @@ dependencies = [
  "rustversion",
 ]
 
+[[package]]
+name = "inlinable_string"
+version = "0.1.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8fae54786f62fb2918dcfae3d568594e50eb9b5c25bf04371af6fe7516452fb"
+
 [[package]]
 name = "inotify"
-version = "0.11.1"
+version = "0.11.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd5b3eaf1a28b758ac0faa5a4254e8ab2705605496f1b1f3fbbc3988ad73d199"
+checksum = "153be1941a183ec9ccd095ddbe17a8b8d435ef6c76e9e02451b933c3999af2c8"
 dependencies = [
- "bitflags 2.13.1",
+ "bitflags",
  "inotify-sys",
  "libc",
 ]
 
 [[package]]
 name = "inotify-sys"
-version = "0.1.5"
+version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e05c02b5e89bff3b946cedeca278abc628fe811e604f027c45a8aa3cf793d0eb"
+checksum = "c033f80b2c113cdf91ab7a33faa9cbc014726dcad99880c8609af2a370edf37d"
 dependencies = [
  "libc",
 ]
 
 [[package]]
 name = "instability"
-version = "0.3.12"
+version = "0.3.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5eb2d60ef19920a3a9193c3e371f726ec1dafc045dac788d0fb3704272458971"
+checksum = "2bf84e73fa6f27f299dec58e13223cf70db80da872eb921d4f6138342a0eabc8"
 dependencies = [
  "darling",
  "indoc",
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 3.0.3",
 ]
 
 [[package]]
@@ -932,6 +1029,12 @@ dependencies = [
  "unic-langid",
 ]
 
+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
+
 [[package]]
 name = "itertools"
 version = "0.14.0"
@@ -949,11 +1052,12 @@ checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 
 [[package]]
 name = "js-sys"
-version = "0.3.95"
+version = "0.3.103"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2964e92d1d9dc3364cae4d718d93f227e3abb088e747d92e0395bfdedf1c12ca"
+checksum = "53b44bfcdb3f8d5837a46dae1ca9660a837176eee74a28b229bc626816589102"
 dependencies = [
- "once_cell",
+ "cfg-if",
+ "futures-util",
  "wasm-bindgen",
 ]
 
@@ -965,14 +1069,14 @@ checksum = "bde5057d6143cc94e861d90f591b9303d6716c6b9602309150bd068853c10899"
 dependencies = [
  "hashbrown 0.16.1",
  "portable-atomic",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
 ]
 
 [[package]]
 name = "kqueue"
-version = "1.1.1"
+version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eac30106d7dce88daf4a3fcb4879ea939476d5074a9b7ddd0fb97fa4bed5596a"
+checksum = "8d763e5b24120b4ddf50de6c92308156765aabfbbccebf401da7cff2d70a41ea"
 dependencies = [
  "kqueue-sys",
  "libc",
@@ -980,11 +1084,11 @@ dependencies = [
 
 [[package]]
 name = "kqueue-sys"
-version = "1.0.4"
+version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed9625ffda8729b85e45cf04090035ac368927b8cebc34898e7c120f52e4838b"
+checksum = "07293a4e297ac234359b510362495713f75ea345d5307140414f20c69ffeb087"
 dependencies = [
- "bitflags 1.3.2",
+ "bitflags",
  "libc",
 ]
 
@@ -994,17 +1098,11 @@ version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
 
-[[package]]
-name = "leb128fmt"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
-
 [[package]]
 name = "libc"
-version = "0.2.186"
+version = "0.2.189"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
+checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
 
 [[package]]
 name = "libm"
@@ -1014,20 +1112,20 @@ checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
 
 [[package]]
 name = "libredox"
-version = "0.1.16"
+version = "0.1.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e02f3bb43d335493c96bf3fd3a321600bf6bd07ed34bc64118e9293bdffea46c"
+checksum = "2026a5056764a10b2bf5d56488cba40da507f5493a6a429340e2004d9ed085fa"
 dependencies = [
  "libc",
 ]
 
 [[package]]
 name = "line-clipping"
-version = "0.3.7"
+version = "0.3.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f50e8f47623268b5407192d26876c4d7f89d686ca130fdc53bced4814cd29f8"
+checksum = "e752191d037c44ad111a8caa762921926658402f01cc1253f7bef2020ece4f5e"
 dependencies = [
- "bitflags 2.13.1",
+ "bitflags",
 ]
 
 [[package]]
@@ -1053,24 +1151,24 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.29"
+version = "0.4.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
+checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
 
 [[package]]
 name = "lru"
-version = "0.18.1"
+version = "0.18.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b6180140927ee907000b0aa540091f6ea512ead4447c92b8fc35bc72788a5a6"
+checksum = "5d2f2f9b4ba7e6b24d95e7e899329d35be83bcded72c8540cdd5368932d1d90a"
 dependencies = [
- "hashbrown 0.17.0",
+ "hashbrown 0.17.1",
 ]
 
 [[package]]
 name = "memchr"
-version = "2.8.0"
+version = "2.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
 
 [[package]]
 name = "mime"
@@ -1090,9 +1188,9 @@ dependencies = [
 
 [[package]]
 name = "mio"
-version = "1.2.0"
+version = "1.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50b7e5b27aa02a74bac8c3f23f448f8d87ff11f92d3aac1a6ed369ee08cc56c1"
+checksum = "30d65c71f1ce40ab09135ce117d742b9f8a19ff91a41a8b57ed50bc2de59c427"
 dependencies = [
  "libc",
  "log",
@@ -1106,7 +1204,7 @@ version = "0.31.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
 dependencies = [
- "bitflags 2.13.1",
+ "bitflags",
  "cfg-if",
  "cfg_aliases",
  "libc",
@@ -1127,7 +1225,7 @@ version = "8.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4d3d07927151ff8575b7087f245456e549fea62edf0ec4e565a5ee50c8402bc3"
 dependencies = [
- "bitflags 2.13.1",
+ "bitflags",
  "fsevent-sys",
  "inotify",
  "kqueue",
@@ -1145,7 +1243,7 @@ version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "42b8cfee0e339a0337359f3c88165702ac6e600dc01c0cc9579a92d62b08477a"
 dependencies = [
- "bitflags 2.13.1",
+ "bitflags",
 ]
 
 [[package]]
@@ -1159,9 +1257,9 @@ dependencies = [
 
 [[package]]
 name = "num-conv"
-version = "0.2.1"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6673768db2d862beb9b39a78fdcb1a69439615d5794a1be50caa9bc92c81967"
+checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
 
 [[package]]
 name = "num-traits"
@@ -1193,6 +1291,12 @@ version = "1.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
 
+[[package]]
+name = "once_cell_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
+
 [[package]]
 name = "option-ext"
 version = "0.2.0"
@@ -1211,26 +1315,35 @@ dependencies = [
 
 [[package]]
 name = "palette"
-version = "0.7.6"
+version = "0.7.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4cbf71184cc5ecc2e4e1baccdb21026c20e5fc3dcf63028a086131b3ab00b6e6"
+checksum = "ddeed8580d347d2abf3dcf06a5f0b3dc020258338526b277847cd4248a70fc64"
 dependencies = [
  "approx",
- "fast-srgb8",
  "libm",
  "palette_derive",
+ "palette_math",
 ]
 
 [[package]]
 name = "palette_derive"
-version = "0.7.6"
+version = "0.7.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f5030daf005bface118c096f510ffb781fc28f9ab6a32ab224d8631be6851d30"
+checksum = "88537020289b719d81be994ccf1bbf4990f477e2f69ee52fe3e45f43a02e56be"
 dependencies = [
  "by_address",
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "palette_math"
+version = "0.7.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e6eb142958d64335fb0e345c5b9ead2ecd6fc438c307e9d7d3c4fd428dbaf12"
+dependencies = [
+ "libm",
 ]
 
 [[package]]
@@ -1256,6 +1369,29 @@ dependencies = [
  "windows-link",
 ]
 
+[[package]]
+name = "pear"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bdeeaa00ce488657faba8ebf44ab9361f9365a97bd39ffb8a60663f57ff4b467"
+dependencies = [
+ "inlinable_string",
+ "pear_codegen",
+ "yansi",
+]
+
+[[package]]
+name = "pear_codegen"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4bab5b985dc082b345f812b7df84e1bef27e7207b39e448439ba8bd69c93f147"
+dependencies = [
+ "proc-macro2",
+ "proc-macro2-diagnostics",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "pin-project-lite"
 version = "0.2.17"
@@ -1274,16 +1410,6 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
 
-[[package]]
-name = "prettyplease"
-version = "0.2.37"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
-dependencies = [
- "proc-macro2",
- "syn 2.0.117",
-]
-
 [[package]]
 name = "proc-macro-error-attr3"
 version = "3.1.0"
@@ -1308,13 +1434,26 @@ dependencies = [
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.106"
+version = "1.0.107"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
 dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "proc-macro2-diagnostics"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af066a9c399a26e020ada66a034357a868728e72cd426f3adcd35f80d88d88c8"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "version_check",
+ "yansi",
+]
+
 [[package]]
 name = "pure-rust-locales"
 version = "0.8.2"
@@ -1323,9 +1462,9 @@ checksum = "869675ad2d7541aea90c6d88c81f46a7f4ea9af8cd0395d38f11a95126998a0d"
 
 [[package]]
 name = "quote"
-version = "1.0.45"
+version = "1.0.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
 dependencies = [
  "proc-macro2",
 ]
@@ -1343,7 +1482,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
 dependencies = [
  "chacha20",
- "getrandom 0.4.2",
+ "getrandom 0.4.3",
  "rand_core",
 ]
 
@@ -1374,16 +1513,16 @@ version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cbb175c433c8e28a809d1f5773a2ae96e68c0ce40db865cbab1020bf33ae479c"
 dependencies = [
- "bitflags 2.13.1",
+ "bitflags",
  "compact_str",
- "hashbrown 0.17.0",
+ "hashbrown 0.17.1",
  "itertools",
  "kasuari",
  "lru",
  "palette",
  "serde",
  "strum",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "unicode-segmentation",
  "unicode-truncate",
  "unicode-width",
@@ -1429,8 +1568,8 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "66e3d19bcc9130ca376277d93b60767ff121ace3be06f5f95f81dd68956407d1"
 dependencies = [
- "bitflags 2.13.1",
- "hashbrown 0.17.0",
+ "bitflags",
+ "hashbrown 0.17.1",
  "indoc",
  "instability",
  "itertools",
@@ -1449,7 +1588,7 @@ version = "0.5.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
 dependencies = [
- "bitflags 2.13.1",
+ "bitflags",
 ]
 
 [[package]]
@@ -1460,9 +1599,15 @@ checksum = "a4e608c6638b9c18977b00b475ac1f28d14e84b27d8d42f70e0bf1e3dec127ac"
 dependencies = [
  "getrandom 0.2.17",
  "libredox",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
 ]
 
+[[package]]
+name = "roff"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "323c417e1d9665a65b263ec744ba09030cfb277e9daa0b018a4ab62e57bc8189"
+
 [[package]]
 name = "rust-embed"
 version = "8.12.0"
@@ -1484,7 +1629,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "rust-embed-utils",
- "syn 2.0.117",
+ "syn 2.0.119",
  "walkdir",
 ]
 
@@ -1510,9 +1655,9 @@ dependencies = [
 
 [[package]]
 name = "rustc-hash"
-version = "2.1.2"
+version = "2.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94300abf3f1ae2e2b8ffb7b58043de3d399c73fa6f4b73826402a5c457614dbe"
+checksum = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d"
 
 [[package]]
 name = "rustc_version"
@@ -1529,7 +1674,7 @@ version = "1.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
 dependencies = [
- "bitflags 2.13.1",
+ "bitflags",
  "errno",
  "libc",
  "linux-raw-sys",
@@ -1538,9 +1683,9 @@ dependencies = [
 
 [[package]]
 name = "rustversion"
-version = "1.0.22"
+version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
+checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
 
 [[package]]
 name = "ryu"
@@ -1565,9 +1710,9 @@ checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
 [[package]]
 name = "self_cell"
-version = "1.2.2"
+version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b12e76d157a900eb52e81bc6e9f3069344290341720e9178cde2407113ac8d89"
+checksum = "2ab42ca02749e120097e328d91d415325bdf43b1c72c4c8badf37375fe40a813"
 
 [[package]]
 name = "semver"
@@ -1607,9 +1752,9 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.149"
+version = "1.0.151"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86"
+checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
 dependencies = [
  "itoa",
  "memchr",
@@ -1618,6 +1763,15 @@ dependencies = [
  "zmij",
 ]
 
+[[package]]
+name = "serde_spanned"
+version = "0.6.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf41e0cfaf7226dca15e8197172c295a782857fcb97fad1808a166870dee75a3"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "serde_spanned"
 version = "1.1.1"
@@ -1649,9 +1803,9 @@ dependencies = [
 
 [[package]]
 name = "shlex"
-version = "1.3.0"
+version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
 
 [[package]]
 name = "signal-hook"
@@ -1698,15 +1852,15 @@ checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
 
 [[package]]
 name = "smallvec"
-version = "1.15.1"
+version = "1.15.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
+checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
 
 [[package]]
 name = "socket2"
-version = "0.6.3"
+version = "0.6.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a766e1110788c36f4fa1c2b71b387a7815aa65f88ce0229841826633d93723e"
+checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4"
 dependencies = [
  "libc",
  "windows-sys 0.61.2",
@@ -1742,7 +1896,7 @@ dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -1753,9 +1907,9 @@ checksum = "a7973cce6668464ea31f176d85b13c7ab3bba2cb3b77a2ed26abd7801688010a"
 
 [[package]]
 name = "syn"
-version = "2.0.117"
+version = "2.0.119"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1789,7 +1943,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
- "getrandom 0.4.2",
+ "getrandom 0.4.3",
  "once_cell",
  "rustix",
  "windows-sys 0.61.2",
@@ -1810,7 +1964,7 @@ version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9048a889effe34a5cddee0af7f53285198b16dca3be510858d38dfdb3e62a04e"
 dependencies = [
- "bitflags 2.13.1",
+ "bitflags",
  "parking_lot",
  "rustix",
  "signal-hook",
@@ -1838,11 +1992,11 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "2.0.18"
+version = "2.0.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
+checksum = "09a43598840e33d5b0331f38c5e30d13bb11c11210a4b58f0d9b18a5a5eefcd9"
 dependencies = [
- "thiserror-impl 2.0.18",
+ "thiserror-impl 2.0.19",
 ]
 
 [[package]]
@@ -1853,37 +2007,36 @@ checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "2.0.18"
+version = "2.0.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
+checksum = "43cbfe0cf76104d42a574802844187e84a305e531ed54455f11fbde0f10541cd"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 3.0.3",
 ]
 
 [[package]]
 name = "thread_local"
-version = "1.1.9"
+version = "1.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f60246a4944f24f6e018aa17cdeffb7818b76356965d03b07d6a9886e8962185"
+checksum = "1ad99c4c6d32803332c548b1af0540b357b3f5fc0be8f6c6bfe8b2e6ae784070"
 dependencies = [
  "cfg-if",
 ]
 
 [[package]]
 name = "time"
-version = "0.3.47"
+version = "0.3.55"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "743bd48c283afc0388f9b8827b976905fb217ad9e647fae3a379a9283c4def2c"
+checksum = "cdb87b95ec50ddfa440816d227a17b2ccbdda963a316a727fda0fc4334f7d134"
 dependencies = [
  "deranged",
- "itoa",
  "libc",
  "num-conv",
  "num_threads",
@@ -1895,15 +2048,15 @@ dependencies = [
 
 [[package]]
 name = "time-core"
-version = "0.1.8"
+version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7694e1cfe791f8d31026952abf09c69ca6f6fa4e1a1229e18988f06a04a12dca"
+checksum = "9e1c906769ad99c88eaa54e728060edef082f8e358ff32030cb7c7d315e81109"
 
 [[package]]
 name = "time-macros"
-version = "0.2.27"
+version = "0.2.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e70e4c5a0e0a8a4823ad65dfe1a6930e4f4d756dcd9dd7939022b5e8c501215"
+checksum = "7e689342a48d2ea927c87ea50cabf8594854bf940e9310208848d680d668ed85"
 dependencies = [
  "num-conv",
  "time-core",
@@ -1947,13 +2100,13 @@ dependencies = [
 
 [[package]]
 name = "tokio-macros"
-version = "2.7.0"
+version = "2.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "385a6cb71ab9ab790c5fe8d67f1645e6c450a7ce006a33de03daa956cf70a496"
+checksum = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 3.0.3",
 ]
 
 [[package]]
@@ -1965,6 +2118,18 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "toml"
+version = "0.8.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc1beb996b9d83529a9e75c17a1686767d148d70663143c7854d8b4a09ced362"
+dependencies = [
+ "serde",
+ "serde_spanned 0.6.9",
+ "toml_datetime 0.6.11",
+ "toml_edit",
+]
+
 [[package]]
 name = "toml"
 version = "1.1.4+spec-1.1.0"
@@ -1973,11 +2138,20 @@ checksum = "3aace63f4bbcdfc2c965b059de67119c89c4017a70d633be6c104910f67056f5"
 dependencies = [
  "indexmap",
  "serde_core",
- "serde_spanned",
- "toml_datetime",
+ "serde_spanned 1.1.1",
+ "toml_datetime 1.1.1+spec-1.1.0",
  "toml_parser",
  "toml_writer",
- "winnow",
+ "winnow 1.0.4",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "0.6.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22cddaf88f4fbc13c51aebbf5f8eceb5c7c5a9da2ac40a13519eb5b0a0e8f11c"
+dependencies = [
+ "serde",
 ]
 
 [[package]]
@@ -1989,15 +2163,35 @@ dependencies = [
  "serde_core",
 ]
 
+[[package]]
+name = "toml_edit"
+version = "0.22.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41fe8c660ae4257887cf66394862d21dbca4a6ddd26f04a3560410406a2f819a"
+dependencies = [
+ "indexmap",
+ "serde",
+ "serde_spanned 0.6.9",
+ "toml_datetime 0.6.11",
+ "toml_write",
+ "winnow 0.7.15",
+]
+
 [[package]]
 name = "toml_parser"
 version = "1.1.3+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1d38ac1cf9b95face32296c0a3ede1fdc270627c9d9c02a7274dd6d960dc4d56"
 dependencies = [
- "winnow",
+ "winnow 1.0.4",
 ]
 
+[[package]]
+name = "toml_write"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d99f8c9a7727884afe522e9bd5edbfc91a3312b36a77b5fb8926e4c31a41801"
+
 [[package]]
 name = "toml_writer"
 version = "1.1.2+spec-1.1.0"
@@ -2023,7 +2217,7 @@ checksum = "050686193eb999b4bb3bc2acfa891a13da00f79734704c4b8b4ef1a10b368a3c"
 dependencies = [
  "crossbeam-channel",
  "symlink",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "time",
  "tracing-subscriber",
 ]
@@ -2036,7 +2230,7 @@ checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -2080,8 +2274,11 @@ version = "0.11.0"
 dependencies = [
  "ansi-to-tui",
  "chrono",
+ "clap",
+ "clap_mangen",
  "crossterm",
  "dirs",
+ "figment",
  "futures",
  "getopts",
  "greetd-stub",
@@ -2114,12 +2311,15 @@ name = "tuigreet-config"
 version = "0.11.0"
 dependencies = [
  "chrono",
+ "clap",
  "codespan-reporting",
  "dirs",
+ "figment",
  "getopts",
  "serde",
  "toml 1.1.4+spec-1.1.0",
  "tracing",
+ "tuigreet-types",
 ]
 
 [[package]]
@@ -2163,9 +2363,18 @@ dependencies = [
 
 [[package]]
 name = "typenum"
-version = "1.20.0"
+version = "1.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "40ce102ab67701b8526c123c1bab5cbe42d7040ccfd0f64af1a385808d2f43de"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
+
+[[package]]
+name = "uncased"
+version = "0.9.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1b88fcfe09e89d3866a5c11019378088af2d24c3fbd4f0543f96b479ec90697"
+dependencies = [
+ "version_check",
+]
 
 [[package]]
 name = "unic-langid"
@@ -2200,9 +2409,9 @@ checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
 
 [[package]]
 name = "unicode-segmentation"
-version = "1.13.2"
+version = "1.13.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9629274872b2bfaf8d66f5f15725007f635594914870f65218920345aa11aa8c"
+checksum = "c6f5d3c3b1bf09027a88a6bc961fc00497d651009560b5463668dc81b0fa87a8"
 
 [[package]]
 name = "unicode-truncate"
@@ -2222,10 +2431,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
 
 [[package]]
-name = "unicode-xid"
-version = "0.2.6"
+name = "utf8parse"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
 [[package]]
 name = "utmp-raw"
@@ -2267,6 +2476,12 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
 
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
 [[package]]
 name = "walkdir"
 version = "2.5.0"
@@ -2283,29 +2498,11 @@ version = "0.11.1+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 
-[[package]]
-name = "wasip2"
-version = "1.0.3+wasi-0.2.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "20064672db26d7cdc89c7798c48a0fdfac8213434a1186e5ef29fd560ae223d6"
-dependencies = [
- "wit-bindgen 0.57.1",
-]
-
-[[package]]
-name = "wasip3"
-version = "0.4.0+wasi-0.3.0-rc-2026-01-06"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5428f8bf88ea5ddc08faddef2ac4a67e390b88186c703ce6dbd955e1c145aca5"
-dependencies = [
- "wit-bindgen 0.51.0",
-]
-
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.118"
+version = "0.2.126"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0bf938a0bacb0469e83c1e148908bd7d5a6010354cf4fb73279b7447422e3a89"
+checksum = "4b067c0c11094aef6b7a801c1e34a26affafdf3d051dba08456b868789aaf9a4"
 dependencies = [
  "cfg-if",
  "once_cell",
@@ -2316,9 +2513,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.118"
+version = "0.2.126"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eeff24f84126c0ec2db7a449f0c2ec963c6a49efe0698c4242929da037ca28ed"
+checksum = "167ce5e579f6bcf889c4f7175a8a5a585de84e8ff93976ce393efa5f2837aab1"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -2326,60 +2523,26 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.118"
+version = "0.2.126"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d08065faf983b2b80a79fd87d8254c409281cf7de75fc4b773019824196c904"
+checksum = "f3997c7839262f4ef12cf90b818d6340c18e80f263f1a94bf157d0ec4420380e"
 dependencies = [
  "bumpalo",
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.118"
+version = "0.2.126"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5fd04d9e306f1907bd13c6361b5c6bfc7b3b3c095ed3f8a9246390f8dbdee129"
+checksum = "dc1b4cb0cc549fcf58d7dfc081778139b3d283a081644e833e84682ad71cea24"
 dependencies = [
  "unicode-ident",
 ]
 
-[[package]]
-name = "wasm-encoder"
-version = "0.244.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "990065f2fe63003fe337b932cfb5e3b80e0b4d0f5ff650e6985b1048f62c8319"
-dependencies = [
- "leb128fmt",
- "wasmparser",
-]
-
-[[package]]
-name = "wasm-metadata"
-version = "0.244.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb0e353e6a2fbdc176932bbaab493762eb1255a7900fe0fea1a2f96c296cc909"
-dependencies = [
- "anyhow",
- "indexmap",
- "wasm-encoder",
- "wasmparser",
-]
-
-[[package]]
-name = "wasmparser"
-version = "0.244.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe"
-dependencies = [
- "bitflags 2.13.1",
- "hashbrown 0.15.5",
- "indexmap",
- "semver",
-]
-
 [[package]]
 name = "winapi"
 version = "0.3.9"
@@ -2432,7 +2595,7 @@ checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -2443,7 +2606,7 @@ checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -2555,103 +2718,24 @@ checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
 
 [[package]]
 name = "winnow"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09dac053f1cd375980747450bfc7250c264eaae0583872e845c0c7cd578872b5"
-
-[[package]]
-name = "wit-bindgen"
-version = "0.51.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5"
-dependencies = [
- "wit-bindgen-rust-macro",
-]
-
-[[package]]
-name = "wit-bindgen"
-version = "0.57.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
-
-[[package]]
-name = "wit-bindgen-core"
-version = "0.51.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea61de684c3ea68cb082b7a88508a8b27fcc8b797d738bfc99a82facf1d752dc"
-dependencies = [
- "anyhow",
- "heck",
- "wit-parser",
-]
-
-[[package]]
-name = "wit-bindgen-rust"
-version = "0.51.0"
+version = "0.7.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7c566e0f4b284dd6561c786d9cb0142da491f46a9fbed79ea69cdad5db17f21"
+checksum = "df79d97927682d2fd8adb29682d1140b343be4ac0f08fd68b7765d9c059d3945"
 dependencies = [
- "anyhow",
- "heck",
- "indexmap",
- "prettyplease",
- "syn 2.0.117",
- "wasm-metadata",
- "wit-bindgen-core",
- "wit-component",
-]
-
-[[package]]
-name = "wit-bindgen-rust-macro"
-version = "0.51.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c0f9bfd77e6a48eccf51359e3ae77140a7f50b1e2ebfe62422d8afdaffab17a"
-dependencies = [
- "anyhow",
- "prettyplease",
- "proc-macro2",
- "quote",
- "syn 2.0.117",
- "wit-bindgen-core",
- "wit-bindgen-rust",
+ "memchr",
 ]
 
 [[package]]
-name = "wit-component"
-version = "0.244.0"
+name = "winnow"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2"
-dependencies = [
- "anyhow",
- "bitflags 2.13.1",
- "indexmap",
- "log",
- "serde",
- "serde_derive",
- "serde_json",
- "wasm-encoder",
- "wasm-metadata",
- "wasmparser",
- "wit-parser",
-]
+checksum = "23b97319f7b8343df12cc98938e5c3eb436064524c8d2b4e30a1d3a36eecdf81"
 
 [[package]]
-name = "wit-parser"
-version = "0.244.0"
+name = "yansi"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ecc8ac4bc1dc3381b7f59c34f00b67e18f910c2c0f50015669dde7def656a736"
-dependencies = [
- "anyhow",
- "id-arena",
- "indexmap",
- "log",
- "semver",
- "serde",
- "serde_derive",
- "serde_json",
- "unicode-xid",
- "wasmparser",
-]
+checksum = "cfe53a6657fd280eaa890a3bc59152892ffa3e30101319d168b781ed6529b049"
 
 [[package]]
 name = "zerocopy"
@@ -2671,14 +2755,14 @@ checksum = "fa4f8080344d4671fb4e831a13ad1e68092748387dfc4f55e356242fae12ce3e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.119",
 ]
 
 [[package]]
 name = "zerofrom"
-version = "0.1.7"
+version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69faa1f2a1ea75661980b013019ed6687ed0e83d069bc1114e2cc74c6c04c4df"
+checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
 
 [[package]]
 name = "zeroize"
@@ -2698,6 +2782,6 @@ dependencies = [
 
 [[package]]
 name = "zmij"
-version = "1.0.21"
+version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
diff --git a/Cargo.toml b/Cargo.toml
index 0b1e895..2c77dbd 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -20,9 +20,11 @@ tuigreet-types   = { path = "crates/tuigreet-types", version = "0.11.0" }
 # External
 ansi-to-tui = "8.0.1"
 chrono = { version = "0.4.45", features = [ "unstable-locales" ] }
+clap = { version = "4.6.4", features = ["derive"] }
 codespan-reporting = "0.13.1"
 crossterm = { version = "0.29.0", features = [ "event-stream" ] }
 dirs = "6.0.0"
+figment = { version = "0.10.19", features = [ "env", "toml", "test" ] }
 futures = "0.3.33"
 getopts = "0.2.24"
 greetd_ipc = { version = "0.10.3", features = [ "tokio-codec" ] }
@@ -34,6 +36,7 @@ rand = "0.10.2"
 rust-embed = "8.12.0"
 rust-ini = "0.21.3"
 serde = { version = "1.0.229", features = [ "derive" ] }
+serde_default_utils = { version = "0.3.1", features = ["inline"] }
 tokio = { version = "1.53.1", default-features = false, features = [
   "macros",
   "rt-multi-thread",
@@ -55,6 +58,9 @@ utmp-rs = "0.4.0"
 uzers = "0.12.2"
 zeroize = "1.9.0"
 
+# build time tools
+clap_mangen   = { version = "0.3.1" }
+
 # Dev
 greetd-stub   = "0.3.0"
 tempfile      = "3.27.0"
diff --git a/contrib/man/tuigreet-1 b/contrib/man/tuigreet-1
new file mode 100644
index 0000000..bdfad4d
--- /dev/null
+++ b/contrib/man/tuigreet-1
@@ -0,0 +1,312 @@
+.ie \n(.g .ds Aq \(aq
+.el .ds Aq '
+.TH tuigreet 1  "tuigreet 0.11.0" 
+.SH NAME
+tuigreet \- Stylish graphical console greeter for greetd
+.SH SYNOPSIS
+\fBtuigreet\fR [\fB\-\-system\-config\fR] [\fB\-\-config\fR] [\fB\-\-no\-config\fR] [\fB\-d\fR|\fB\-\-debug\fR] [\fB\-l\fR|\fB\-\-log\-file\fR] [\fB\-m\fR|\fB\-\-mock\fR] [\fB\-n\fR|\fB\-\-numlock\fR] [\fB\-c\fR|\fB\-\-cmd\fR] [\fB\-s\fR|\fB\-\-sessions\fR] [\fB\-x\fR|\fB\-\-xsessions\fR] [\fB\-\-session\-wrapper\fR] [\fB\-\-xsession\-wrapper\fR] [\fB\-\-env\fR] [\fB\-t\fR|\fB\-\-time\fR] [\fB\-\-time\-format\fR] [\fB\-g\fR|\fB\-\-greeting\fR] [\fB\-\-title\fR] [\fB\-\-custom\-title\fR] [\fB\-i\fR|\fB\-\-issue\fR] [\fB\-b\fR|\fB\-\-battery\fR] [\fB\-\-greet\-align\fR] [\fB\-u\fR|\fB\-\-user\fR] [\fB\-r\fR|\fB\-\-remember\fR] [\fB\-\-remember\-session\fR] [\fB\-\-remember\-user\-session\fR] [\fB\-\-user\-menu\fR] [\fB\-\-user\-menu\-min\-uid\fR] [\fB\-\-user\-menu\-max\-uid\fR] [\fB\-\-secret\-mode\fR] [\fB\-\-secret\-characters\fR] [\fB\-w\fR|\fB\-\-width\fR] [\fB\-\-window\-padding\fR] [\fB\-\-container\-padding\fR] [\fB\-\-prompt\-padding\fR] [\fB\-\-time\-position\fR] [\fB\-\-status\-position\fR] [\fB\-\-battery\-position\fR] [\fB\-\-show\-reset\fR] [\fB\-\-show\-command\fR] [\fB\-\-show\-session\fR] [\fB\-\-show\-power\fR] [\fB\-\-show\-background\fR] [\fB\-\-show\-session\-status\fR] [\fB\-\-show\-caps\-lock\fR] [\fB\-\-power\-shutdown\fR] [\fB\-\-power\-reboot\fR] [\fB\-\-power\-suspend\fR] [\fB\-\-power\-hibernate\fR] [\fB\-\-power\-use\-setsid\fR] [\fB\-\-kb\-command\fR] [\fB\-\-kb\-sessions\fR] [\fB\-\-kb\-power\fR] [\fB\-\-kb\-background\fR] [\fB\-\-theme\-border\fR] [\fB\-\-theme\-text\fR] [\fB\-\-theme\-time\fR] [\fB\-\-theme\-container\fR] [\fB\-\-theme\-title\fR] [\fB\-\-theme\-greet\fR] [\fB\-\-theme\-prompt\fR] [\fB\-\-theme\-input\fR] [\fB\-\-theme\-action\fR] [\fB\-\-theme\-button\fR] [\fB\-\-background\fR] [\fB\-\-background\-fps\fR] [\fB\-\-doom\-height\fR] [\fB\-\-doom\-spread\fR] [\fB\-\-doom\-top\-color\fR] [\fB\-\-doom\-middle\-color\fR] [\fB\-\-doom\-bottom\-color\fR] [\fB\-\-matrix\-head\-color\fR] [\fB\-\-matrix\-bright\-color\fR] [\fB\-\-matrix\-dim\-color\fR] [\fB\-\-matrix\-min\-length\fR] [\fB\-\-matrix\-max\-length\fR] [\fB\-\-matrix\-min\-speed\fR] [\fB\-\-matrix\-max\-speed\fR] [\fB\-\-matrix\-mutate\-chance\fR] [\fB\-h\fR|\fB\-\-help\fR] [\fB\-V\fR|\fB\-\-version\fR] 
+.SH DESCRIPTION
+Stylish graphical console greeter for greetd
+.SH OPTIONS
+.TP
+\fB\-\-system\-config\fR \fI<SYSTEM_CONFIG_PATH>\fR [default: /etc/tuigreet/config.toml]
+path to system configuration toml file
+.TP
+\fB\-\-config\fR \fI<USER_CONFIG_PATH>\fR [default: ~/.config/tuigreet/config.toml]
+path to user configuration toml file
+.TP
+\fB\-\-no\-config\fR
+disable loading toml configuration files
+.TP
+\fB\-d\fR, \fB\-\-debug\fR
+Enable debug logging
+.TP
+\fB\-l\fR, \fB\-\-log\-file\fR \fI<LOG_FILE>\fR [default: /tmp/tuigreet.log]
+Log file path
+.TP
+\fB\-m\fR, \fB\-\-mock\fR
+visual mock\-up mode: skip the greetd socket and fake the auth flow locally
+.TP
+\fB\-n\fR, \fB\-\-numlock\fR
+Enable numlock on startup
+.TP
+\fB\-c\fR, \fB\-\-cmd\fR \fI<COMMAND>\fR
+Override session with a specific command
+.TP
+\fB\-s\fR, \fB\-\-sessions\fR \fI<SESSIONS_DIRS>\fR
+Directories containing Wayland session files
+.TP
+\fB\-x\fR, \fB\-\-xsessions\fR \fI<XSESSIONS_DIRS>\fR [default: /usr/share/xsessions]
+Directories containing X11 session files
+.TP
+\fB\-\-session\-wrapper\fR \fI<SESSION_WRAPPER>\fR
+Wrapper command for non\-X11 sessions
+.TP
+\fB\-\-xsession\-wrapper\fR \fI<XSESSION_WRAPPER>\fR [default: startx]
+Wrapper command for X11 sessions (set to empty string "" for no wrapper)
+.TP
+\fB\-\-env\fR \fI<ENVIRONMENTS>\fR
+Environment variables for default session
+.TP
+\fB\-t\fR, \fB\-\-time\fR
+Show current time
+.TP
+\fB\-\-time\-format\fR \fI<TIME_FORMAT>\fR
+Custom time format (strftime)
+.TP
+\fB\-g\fR, \fB\-\-greeting\fR \fI<GREETING>\fR
+Custom greeting message
+.TP
+\fB\-\-title\fR
+Show login form title
+.TP
+\fB\-\-custom\-title\fR \fI<CUSTOM_TITLE>\fR
+Custom login form title
+.TP
+\fB\-i\fR, \fB\-\-issue\fR
+Show /etc/issue file
+.TP
+\fB\-b\fR, \fB\-\-battery\fR
+Show battery percentage
+.TP
+\fB\-\-greet\-align\fR \fI<ALIGN_GREETING>\fR [default: center]
+Greeting text alignment
+.br
+
+.br
+\fIPossible values:\fR
+.RS 14
+.IP \(bu 2
+left
+.IP \(bu 2
+center
+.IP \(bu 2
+right
+.RE
+.TP
+\fB\-u\fR, \fB\-\-user\fR \fI<DEFAULT_USER>\fR
+Default user to pre\-fill
+.TP
+\fB\-r\fR, \fB\-\-remember\fR
+Remember last logged\-in username
+.TP
+\fB\-\-remember\-session\fR
+Remember last selected session (global)
+.TP
+\fB\-\-remember\-user\-session\fR
+Remember last selected session per user
+.TP
+\fB\-\-user\-menu\fR
+Enable user selection menu
+.TP
+\fB\-\-user\-menu\-min\-uid\fR \fI<MIN_UID>\fR [default: 1000]
+Minimum UID to display in user menu
+.TP
+\fB\-\-user\-menu\-max\-uid\fR \fI<MAX_UID>\fR [default: 60000]
+Maximum UID to display in user menu
+.TP
+\fB\-\-secret\-mode\fR \fI<MODE>\fR [default: hidden]
+How to display secrets
+.br
+
+.br
+\fIPossible values:\fR
+.RS 14
+.IP \(bu 2
+hidden
+.IP \(bu 2
+characters
+.RE
+.TP
+\fB\-\-secret\-characters\fR \fI<CHARACTERS>\fR [default: *]
+Characters to use when mode is Characters
+.TP
+\fB\-w\fR, \fB\-\-width\fR \fI<WIDTH>\fR [default: 80]
+Width of the main prompt container
+.TP
+\fB\-\-window\-padding\fR \fI<WINDOW_PADDING>\fR [default: 0]
+Padding around the terminal window
+.TP
+\fB\-\-container\-padding\fR \fI<CONTAINER_PADDING>\fR [default: 2]
+Padding inside the main container
+.TP
+\fB\-\-prompt\-padding\fR \fI<PROMPT_PADDING>\fR [default: 1]
+Padding between prompt rows
+.TP
+\fB\-\-time\-position\fR \fI<TIME_POSITION>\fR [default: default]
+Position of time widget
+.br
+
+.br
+\fIPossible values:\fR
+.RS 14
+.IP \(bu 2
+default
+.IP \(bu 2
+top
+.IP \(bu 2
+bottom
+.IP \(bu 2
+hidden
+.RE
+.TP
+\fB\-\-status\-position\fR \fI<STATUS_POSITION>\fR [default: default]
+Position of status bar widget
+.br
+
+.br
+\fIPossible values:\fR
+.RS 14
+.IP \(bu 2
+default
+.IP \(bu 2
+top
+.IP \(bu 2
+bottom
+.IP \(bu 2
+hidden
+.RE
+.TP
+\fB\-\-battery\-position\fR \fI<BATTERY_POSITION>\fR [default: left]
+Position of battery widget
+.br
+
+.br
+\fIPossible values:\fR
+.RS 14
+.IP \(bu 2
+left
+.IP \(bu 2
+right
+.RE
+.TP
+\fB\-\-show\-reset\fR
+Show the ESC/Reset button
+.TP
+\fB\-\-show\-command\fR
+Show the command button
+.TP
+\fB\-\-show\-session\fR
+Show the session button
+.TP
+\fB\-\-show\-power\fR
+Show the power button
+.TP
+\fB\-\-show\-background\fR
+Show the background button
+.TP
+\fB\-\-show\-session\-status\fR
+Show the current session/command indicator
+.TP
+\fB\-\-show\-caps\-lock\fR
+Show the caps lock indicator
+.TP
+\fB\-\-power\-shutdown\fR \fI<SHUTDOWN>\fR
+Custom shutdown command
+.TP
+\fB\-\-power\-reboot\fR \fI<REBOOT>\fR
+Custom reboot command
+.TP
+\fB\-\-power\-suspend\fR \fI<SUSPEND>\fR
+Custom suspend command
+.TP
+\fB\-\-power\-hibernate\fR \fI<HIBERNATE>\fR
+Custom hibernate command
+.TP
+\fB\-\-power\-use\-setsid\fR
+Use setsid to detach power commands
+.TP
+\fB\-\-kb\-command\fR \fI<kb_command>\fR [default: 2]
+F\-key for command menu (1\-12)
+.TP
+\fB\-\-kb\-sessions\fR \fI<SESSIONS>\fR [default: 3]
+F\-key for sessions menu (1\-12)
+.TP
+\fB\-\-kb\-power\fR \fI<POWER>\fR [default: 12]
+F\-key for power menu (1\-12)
+.TP
+\fB\-\-kb\-background\fR \fI<BACKGROUND>\fR [default: 4]
+F\-key for the on\-the\-fly background switcher menu (1\-12)
+.TP
+\fB\-\-theme\-border\fR \fI<BORDER>\fR
+Border color
+.TP
+\fB\-\-theme\-text\fR \fI<TEXT>\fR
+Base text color
+.TP
+\fB\-\-theme\-time\fR \fI<TIME>\fR
+Time display color
+.TP
+\fB\-\-theme\-container\fR \fI<CONTAINER>\fR
+Container background color
+.TP
+\fB\-\-theme\-title\fR \fI<TITLE>\fR
+Container title color
+.TP
+\fB\-\-theme\-greet\fR \fI<GREET>\fR
+Greeting text color
+.TP
+\fB\-\-theme\-prompt\fR \fI<PROMPT>\fR
+Prompt text color
+.TP
+\fB\-\-theme\-input\fR \fI<INPUT>\fR
+User input color
+.TP
+\fB\-\-theme\-action\fR \fI<ACTION>\fR
+Action text color
+.TP
+\fB\-\-theme\-button\fR \fI<BUTTON>\fR
+Action button color
+.TP
+\fB\-\-background\fR \fI<KIND>\fR
+Which animation to run. `None` or `"none"` disables animations. Currently supported: `"doom"`, `"matrix"`
+.TP
+\fB\-\-background\-fps\fR \fI<FPS>\fR [default: 30]
+Render frame rate when an animation is active. Defaults to 30 FPS when `kind` is set; the base UI tick (2 FPS) otherwise
+.TP
+\fB\-\-doom\-height\fR \fI<HEIGHT>\fR [default: 6]
+Decay control (1..=9). Higher = taller flames
+.TP
+\fB\-\-doom\-spread\fR \fI<SPREAD>\fR [default: 2]
+Horizontal jitter range (0..=4)
+.TP
+\fB\-\-doom\-top\-color\fR \fI<TOP_COLOR>\fR [default: #9F2707]
+Color of the coolest flame tips. Accepts `#RRGGBB`, `0xRRGGBB`, or any color name accepted by ratatui (e.g. `red`, `magenta`)
+.TP
+\fB\-\-doom\-middle\-color\fR \fI<MIDDLE_COLOR>\fR [default: #C78F17]
+Color of the mid\-band flames
+.TP
+\fB\-\-doom\-bottom\-color\fR \fI<BOTTOM_COLOR>\fR [default: #FFFFFF]
+Color of the hottest flames at the base
+.TP
+\fB\-\-matrix\-head\-color\fR \fI<HEAD_COLOR>\fR [default: #CCFFCC]
+Color of the leading glyph in each falling stream. Accepts `#RRGGBB`, `0xRRGGBB`, or any color name accepted by ratatui
+.TP
+\fB\-\-matrix\-bright\-color\fR \fI<BRIGHT_COLOR>\fR [default: #33FF66]
+Color of the brightest part of the trail (just behind the head)
+.TP
+\fB\-\-matrix\-dim\-color\fR \fI<DIM_COLOR>\fR [default: #006622]
+Color of the dim tail before each glyph fades out
+.TP
+\fB\-\-matrix\-min\-length\fR \fI<MIN_LENGTH>\fR [default: 6]
+Inclusive minimum trail length in rows
+.TP
+\fB\-\-matrix\-max\-length\fR \fI<MAX_LENGTH>\fR [default: 18]
+Inclusive maximum trail length in rows
+.TP
+\fB\-\-matrix\-min\-speed\fR \fI<MIN_SPEED>\fR [default: 0.3]
+Inclusive minimum stream speed, in rows\-per\-frame. Lower = slower
+.TP
+\fB\-\-matrix\-max\-speed\fR \fI<MAX_SPEED>\fR [default: 1.1]
+Inclusive maximum stream speed, in rows\-per\-frame
+.TP
+\fB\-\-matrix\-mutate\-chance\fR \fI<MUTATE_CHANCE>\fR [default: 0.02]
+Per\-cell, per\-frame probability of a glyph mutating (the faint trail shimmer). `0.0` disables
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+Print help (see a summary with \*(Aq\-h\*(Aq)
+.TP
+\fB\-V\fR, \fB\-\-version\fR
+Print version
+.SH VERSION
+v0.11.0
diff --git a/contrib/man/tuigreet-1.scd b/contrib/man/tuigreet-1.scd
deleted file mode 100644
index 3e7603c..0000000
--- a/contrib/man/tuigreet-1.scd
+++ /dev/null
@@ -1,155 +0,0 @@
-tuigreet(1)
-
-# NAME
-
-tuigreet - A graphical console greeter for greetd
-
-# SYNOPSIS
-
-*tuigreet* [OPTIONS]...
-
-# OPTIONS
-
-*-h, --help*
-	Show usage and exit.
-
-*-v, --version*
-	Print program version and exit.
-
-*-d, --debug [FILE]*
-	Enables debug logging to the provided FILE path, or to /tmp/tuigreet.log if no
-	file is specified.
-
-*-c, --cmd CMD*
-	Specify which command to run on successful authentication. This can be
-	overridden by manual selection within *tuigreet*.
-
-*--env KEY=VALUE*
-	Environment variables to run the default session with (can appear more then once).
-
-*-s, --sessions DIR1[:DIR2]...*
-	Location of desktop-files to be used as Wayland session definitions. By
-	default, Wayland sessions are fetched from */usr/share/wayland-sessions*.
-
-*--session-wrapper 'CMD [ARGS]...'*
-	Specify a wrapper command to execute instead of the session for non-X11
-	sessions. This command will receive the session command as its arguments.
-
-*-x, --xsessions DIR1[:DIR2]...*
-	Location of desktop-files to be used as X11 session definitions. By
-	default, X11 sessions are fetched from */usr/share/xsessions*.
-
-*--xsession-wrapper 'CMD [ARGS]...'*
-	Specify a wrapper command to initialize X server and launch X11 sessions.
-	By default, *startx /usr/bin/env* will be prepended to all X11 session
-	commands.
-
-*--no-xsession-wrapper*
-	Do not wrap commands for X11 sessions.
-
-*-w, --width COLS*
-	Number of columns the main prompt area should take on the screen.
-
-*-i, --issue*
-	Print the content of */etc/issue* at the top of the prompt area.
-
-	This option is mutually exclusive with *--greeting*.
-
-*-g, --greeting GREETING*
-	Specify the text to be displayed at the top of the prompt area.
-
-	This option is mutually exclusive with *--issue*.
-
-*-t, --time*
-	Print the current date and time at the top of the screen.
-
-*--time-format FORMAT*
-	Configure a custom strftime-compliant format string for the current date
-	and time.
-
-*--user-menu*
-	Allow selecting a user from a graphical menu.
-
-*--user-menu-min-uid*
-	Minimum UID of the users to display in the selection menu.
-
-*--user-menu-max-uid*
-	Maximum UID of the users to display in the selection menu.
-
-*-r, --remember*
-	Remember the username of the last successfully opened session, so the
-	username field will be pre-filled on the next run.
-
-*--remember-session*
-	Remember the last selected session, effectively overriding the given *--cmd*
-	option on subsequent runs.
-
-*--remember-user-session*
-	Remember the last opened session, per user (requires *--remember*).
-
-*--theme SPEC*
-	Define colors to be used to draw the UI components. You can find the proper
-	syntax in the project's README.
-
-*--asterisks*
-	Add visual feedback when typing secrets, as one asterisk character for every
-	keystroke. By default, no feedback is given at all.
-
-*--asterisks-char CHARS*
-	Change the default feedback character from an asterisk to a random
-	distribution of the provided characters.
-
-*--window-padding COLS*
-	Add spacing between the edge of the screen area the drawing area.
-
-*--container-padding COLS*
-	Add spacing between the border of the main prompt area and its contents.
-
-*--prompt-padding ROWS*
-	Add spacing between form fields.
-
-*--greet-align [left|center|right]*
-	Alignment of the greeting text in the main prompt container
-	(default: 'center').
-
-*--power-shutdown CMD [ARGS]...*
-	Customize the command run when instructed to shut down the machine. This must
-	be a non-interactive command (sudo cannot prompt for a password, for example).
-
-*--power-reboot CMD [ARGS]...*
-	Customize the command run when instructed to reboot the machine. This must be
-	a non-interactive command (sudo cannot prompt for a password, for example).
-
-*--power-suspend CMD [ARGS]...*
-	Customize the command run when instructed to suspend the machine (default:
-	'loginctl suspend'). This must be a non-interactive command (sudo cannot
-	prompt for a password, for example).
-
-*--power-hibernate CMD [ARGS]...*
-	Customize the command run when instructed to hibernate the machine (default:
-	'loginctl hibernate'). This must be a non-interactive command (sudo cannot
-	prompt for a password, for example).
-
-*--power-no-setsid*
-	Do not prefix power commands with *setsid*, which is used to detach it from
-	current TTY.
-
-*--kb-[command|sessions|power] [1-12]*
-	change the default F-key keybindings to access the command, sessions and power
-	menus.
-
-# AUTHORS
-
-Maintained by NotAShelf <git@notashelf.dev>.
-
-Contributed to by great people at
-https://github.com/NotAShelf/tuigreet/graphs/contributors.
-
-# DEVELOPMENT
-
-Issue reporting and development discussion should happen at
-https://github.com/NotAShelf/tuigreet.
-
-# SEE ALSO
-
-*greetd*(1)
diff --git a/crates/tuigreet-config/Cargo.toml b/crates/tuigreet-config/Cargo.toml
index 881c962..9937416 100644
--- a/crates/tuigreet-config/Cargo.toml
+++ b/crates/tuigreet-config/Cargo.toml
@@ -7,10 +7,14 @@ license.workspace      = true
 rust-version.workspace = true
 
 [dependencies]
-chrono             = { workspace = true }
-codespan-reporting = { workspace = true }
-dirs               = { workspace = true }
-getopts            = { workspace = true }
-serde              = { workspace = true }
-toml               = { workspace = true }
-tracing            = { workspace = true }
+tuigreet-types      = { workspace = true }
+
+chrono              = { workspace = true }
+clap                = { workspace = true }
+codespan-reporting  = { workspace = true }
+dirs                = { workspace = true }
+figment             = { workspace = true }
+getopts             = { workspace = true }
+serde               = { workspace = true }
+toml                = { workspace = true }
+tracing             = { workspace = true }
diff --git a/crates/tuigreet-config/src/config.rs b/crates/tuigreet-config/src/config.rs
new file mode 100644
index 0000000..f25246e
--- /dev/null
+++ b/crates/tuigreet-config/src/config.rs
@@ -0,0 +1,619 @@
+use clap::{ArgAction, Args, Parser, ValueEnum};
+use serde::{Deserialize, Serialize};
+use tuigreet_types::{
+  DEFAULT_LOG_FILE,
+  DEFAULT_SYSTEM_TOML_PATH,
+  DEFAULT_USER_TOML_PATH,
+  DEFAULT_XSESSION_WRAPPER,
+};
+
+/// Root configuration structure
+#[derive(Parser, Debug, Clone, Deserialize, Serialize, PartialEq)]
+#[clap(
+  author,
+  version,
+  about = "Stylish graphical console greeter for greetd",
+  name = "tuigreet"
+)]
+pub struct Config {
+  #[command(flatten)]
+  pub general: GeneralConfig,
+
+  #[command(flatten)]
+  pub session: SessionConfig,
+
+  #[command(flatten)]
+  pub display: DisplayConfig,
+
+  #[command(flatten)]
+  pub remember: RememberConfig,
+
+  #[command(flatten)]
+  pub user_menu: UserMenuConfig,
+
+  #[command(flatten)]
+  pub secret: SecretConfig,
+
+  #[command(flatten)]
+  pub layout: LayoutConfig,
+
+  #[command(flatten)]
+  pub power: PowerConfig,
+
+  #[command(flatten)]
+  pub keybindings: KeybindingsConfig,
+
+  #[command(flatten)]
+  pub theme: ThemeConfig,
+
+  #[command(flatten)]
+  pub background: BackgroundConfig,
+
+  /// Per-output (display/monitor) configuration.
+  /// Use `[[outputs]]` array of tables in TOML.
+  #[serde(default)]
+  #[clap(skip)]
+  pub outputs: Vec<OutputConfig>,
+
+  /// Explicit terminal size override. When both `cols` and `rows` are set
+  /// they take precedence over output-derived sizing.
+  #[serde(default)]
+  #[clap(skip)]
+  pub terminal: TerminalConfig,
+}
+
+impl Config {
+  // clap defaults config
+  #[must_use]
+  pub fn defaults() -> Self {
+    Self::parse_from(std::iter::empty::<&str>())
+  }
+}
+
+/// Configuration for a single DRM output (monitor/display).
+///
+/// Example:
+/// ```toml
+/// [[outputs]]
+/// connector = "DP-1"
+/// primary = true
+///
+/// [[outputs]]
+/// connector = "HDMI-A-1"
+/// enabled = false
+/// ```
+#[derive(Debug, Clone, Deserialize, Serialize, PartialEq, Eq)]
+pub struct OutputConfig {
+  /// DRM connector name as it appears in `/sys/class/drm/` (e.g. `"DP-1"`,
+  /// `"HDMI-A-1"`).
+  #[serde(default)]
+  pub connector: String,
+
+  /// Whether tuigreet should use this output. Defaults to `true`.
+  #[serde(default = "default_true")]
+  pub enabled: bool,
+
+  /// If `true`, size the terminal to match this output's native resolution.
+  /// At most one output should be marked primary. If none is marked primary
+  /// the first enabled output is used for sizing.
+  #[serde(default)]
+  pub primary: bool,
+}
+
+/// Explicit terminal character-cell size override.
+///
+/// When both `cols` and `rows` are provided they take highest priority over
+/// output-derived sizing. Providing only one of the two fields is an error.
+#[derive(Debug, Clone, Deserialize, Serialize, PartialEq, Eq, Default)]
+pub struct TerminalConfig {
+  /// Number of character columns.
+  #[serde(default)]
+  pub cols: Option<u16>,
+  /// Number of character rows.
+  #[serde(default)]
+  pub rows: Option<u16>,
+}
+
+/// General configuration options
+#[derive(Args, Debug, Clone, Deserialize, Serialize, PartialEq, Eq)]
+pub struct GeneralConfig {
+  /// path to system configuration toml file
+  #[arg(long = "system-config", default_value_t = DEFAULT_SYSTEM_TOML_PATH.to_string())]
+  pub system_config_path: String,
+
+  /// path to user configuration toml file
+  #[arg(long = "config", default_value_t = DEFAULT_USER_TOML_PATH.to_string())]
+  pub user_config_path: String,
+
+  /// disable loading toml configuration files
+  #[arg(long, action = ArgAction::Set,
+      num_args = 0..=1, require_equals = true,
+      default_missing_value = "true",
+      default_value_t = false)]
+  pub no_config: bool,
+
+  /// Enable debug logging
+  #[arg(short, long, action = ArgAction::Set,
+      num_args = 0..=1, require_equals = true,
+      default_missing_value = "true",
+      default_value_t = false)]
+  pub debug: bool,
+
+  /// Log file path
+  #[arg(short, long, default_value_t = DEFAULT_LOG_FILE.to_string())]
+  pub log_file: String,
+
+  /// visual mock-up mode: skip the greetd socket and fake the auth flow
+  /// locally
+  #[arg(short, long, action = ArgAction::Set,
+      num_args = 0..=1, require_equals = true,
+      default_missing_value = "true",
+      default_value_t = false)]
+  pub mock: bool,
+
+  /// Enable numlock on startup
+  #[arg(short, long, action = ArgAction::Set,
+      num_args = 0..=1, require_equals = true,
+      default_missing_value = "true",
+      default_value_t = false)]
+  pub numlock: bool,
+}
+
+/// Session management configuration
+#[derive(Args, Debug, Clone, Deserialize, Serialize, PartialEq, Eq)]
+pub struct SessionConfig {
+  /// Override session with a specific command
+  #[arg(short = 'c', long = "cmd")]
+  pub command: Option<String>,
+
+  /// Directories containing Wayland session files
+  #[arg(short, long = "sessions")]
+  pub sessions_dirs: Vec<String>,
+
+  /// Directories containing X11 session files
+  #[arg(short, long = "xsessions", default_values_t = vec!["/usr/share/xsessions".to_string()])]
+  pub xsessions_dirs: Vec<String>,
+
+  /// Wrapper command for non-X11 sessions
+  #[arg(long)]
+  pub session_wrapper: Option<String>,
+
+  /// Wrapper command for X11 sessions (set to empty string "" for no wrapper)
+  #[arg(long, default_value_t = DEFAULT_XSESSION_WRAPPER.to_string())]
+  pub xsession_wrapper: String,
+
+  /// Environment variables for default session
+  #[arg(long = "env")]
+  pub environments: Vec<String>,
+}
+
+/// Display and visual configuration
+#[derive(
+  Args, Debug, Clone, Deserialize, Serialize, Default, PartialEq, Eq,
+)]
+pub struct DisplayConfig {
+  /// Show current time
+  #[arg(short = 't', long = "time", action = ArgAction::Set,
+      num_args = 0..=1, require_equals = true,
+      default_missing_value = "true",
+      default_value_t = false)]
+  pub show_time: bool,
+
+  /// Custom time format (strftime)
+  #[arg(long)]
+  pub time_format: Option<String>,
+
+  /// Custom greeting message
+  #[arg(short, long)]
+  pub greeting: Option<String>,
+
+  /// Show login form title
+  #[arg(long = "title", action = ArgAction::Set,
+      num_args = 0..=1, require_equals = true,
+      default_missing_value = "true",
+      default_value_t = true)]
+  pub show_title: bool,
+
+  /// Custom login form title
+  #[arg(long)]
+  pub custom_title: Option<String>,
+
+  /// Show /etc/issue file
+  #[arg(short, long, action = ArgAction::Set,
+      num_args = 0..=1, require_equals = true,
+      default_missing_value = "true",
+      default_value_t = false)]
+  #[arg(short, long, default_value_t = false)]
+  pub issue: bool,
+
+  /// Show battery percentage
+  #[arg(short, long, action = ArgAction::Set,
+      num_args = 0..=1, require_equals = true,
+      default_missing_value = "true",
+      default_value_t = false)]
+  pub battery: bool,
+
+  /// Greeting text alignment
+  #[arg(long = "greet-align", value_enum, default_value_t = AlignGreeting::default())]
+  pub align_greeting: AlignGreeting,
+}
+
+/// Remember/cache configuration
+#[derive(Args, Debug, Clone, Deserialize, Serialize, PartialEq, Eq)]
+pub struct RememberConfig {
+  /// Default user to pre-fill
+  #[arg(short = 'u', long = "user")]
+  pub default_user: Option<String>,
+
+  /// Remember last logged-in username
+  #[arg(short = 'r', long = "remember", action = ArgAction::Set,
+      num_args = 0..=1, require_equals = true,
+      default_missing_value = "true",
+      default_value_t = false)]
+  pub username: bool,
+
+  /// Remember last selected session (global)
+  #[arg(long = "remember-session", action = ArgAction::Set,
+      num_args = 0..=1, require_equals = true,
+      default_missing_value = "true",
+      default_value_t = false)]
+  pub session: bool,
+
+  /// Remember last selected session per user
+  #[arg(long = "remember-user-session", action = ArgAction::Set,
+      num_args = 0..=1, require_equals = true,
+      default_missing_value = "true",
+      default_value_t = false)]
+  pub user_session: bool,
+}
+
+/// User menu configuration
+#[derive(Args, Debug, Clone, Deserialize, Serialize, PartialEq, Eq)]
+pub struct UserMenuConfig {
+  /// Enable user selection menu
+  #[arg(long = "remember-user-session", action = ArgAction::Set,
+      num_args = 0..=1, require_equals = true,
+      default_missing_value = "true",
+      default_value_t = false)]
+  #[arg(long = "user-menu", default_value_t = false)]
+  pub enabled: bool,
+
+  /// Minimum UID to display in user menu
+  #[arg(long = "user-menu-min-uid", default_value_t = 1000)]
+  pub min_uid: u32,
+
+  /// Maximum UID to display in user menu
+  #[arg(long = "user-menu-max-uid", default_value_t = 60000)]
+  pub max_uid: u32,
+}
+
+/// Secret display configuration
+#[derive(Args, Debug, Clone, Deserialize, Serialize, PartialEq, Eq)]
+pub struct SecretConfig {
+  /// How to display secrets
+  #[arg(long = "secret-mode", value_enum, default_value_t = SecretMode::default())]
+  pub mode: SecretMode,
+
+  /// Characters to use when mode is Characters
+  #[arg(long = "secret-characters", default_value_t = "*".to_string())]
+  pub characters: String,
+}
+
+/// Layout and sizing configuration
+#[derive(Args, Debug, Clone, Deserialize, Serialize, PartialEq, Eq)]
+pub struct LayoutConfig {
+  /// Width of the main prompt container
+  #[arg(short, long, default_value_t = 80)]
+  pub width: u16,
+
+  /// Padding around the terminal window
+  #[arg(long, default_value_t = 0)]
+  pub window_padding: u16,
+
+  /// Padding inside the main container
+  #[arg(long, default_value_t = 2)]
+  pub container_padding: u16,
+
+  /// Padding between prompt rows
+  #[arg(long, default_value_t = 1)]
+  pub prompt_padding: u16,
+
+  /// Widget positioning options
+  #[command(flatten)]
+  pub widgets: WidgetConfig,
+}
+
+/// Battery widget placement
+#[derive(
+  Debug, Clone, Deserialize, Serialize, Default, PartialEq, Eq, ValueEnum,
+)]
+#[serde(rename_all = "snake_case")]
+pub enum BatteryPosition {
+  #[default]
+  Left,
+  Right,
+}
+
+/// Widget positioning configuration
+#[derive(Args, Debug, Clone, Deserialize, Serialize, PartialEq, Eq)]
+pub struct WidgetConfig {
+  /// Position of time widget
+  #[arg(long, value_enum, default_value_t = WidgetPosition::default())]
+  pub time_position: WidgetPosition,
+
+  /// Position of status bar widget
+  #[arg(long, value_enum, default_value_t = WidgetPosition::default())]
+  pub status_position: WidgetPosition,
+
+  /// Position of battery widget
+  #[arg(long, value_enum, default_value_t = BatteryPosition::default())]
+  pub battery_position: BatteryPosition,
+
+  /// Status bar item visibility
+  #[command(flatten)]
+  pub status_bar: StatusBarConfig,
+}
+
+/// Status bar item visibility configuration
+#[derive(Args, Debug, Clone, Deserialize, Serialize, PartialEq, Eq)]
+pub struct StatusBarConfig {
+  /// Show the ESC/Reset button
+  #[arg(long, action = ArgAction::Set,
+      num_args = 0..=1, require_equals = true,
+      default_missing_value = "true",
+      default_value_t = true)]
+  pub show_reset: bool,
+
+  /// Show the command button
+  #[arg(long, action = ArgAction::Set,
+      num_args = 0..=1, require_equals = true,
+      default_missing_value = "true",
+      default_value_t = true)]
+  pub show_command: bool,
+
+  /// Show the session button
+  #[arg(long, action = ArgAction::Set,
+      num_args = 0..=1, require_equals = true,
+      default_missing_value = "true",
+      default_value_t = true)]
+  pub show_session: bool,
+
+  /// Show the power button
+  #[arg(long, action = ArgAction::Set,
+      num_args = 0..=1, require_equals = true,
+      default_missing_value = "true",
+      default_value_t = true)]
+  pub show_power: bool,
+
+  /// Show the background button
+  #[arg(long, action = ArgAction::Set,
+      num_args = 0..=1, require_equals = true,
+      default_missing_value = "true",
+      default_value_t = true)]
+  pub show_background: bool,
+
+  /// Show the current session/command indicator
+  #[arg(long, action = ArgAction::Set,
+      num_args = 0..=1, require_equals = true,
+      default_missing_value = "true",
+      default_value_t = true)]
+  pub show_session_status: bool,
+
+  /// Show the caps lock indicator
+  #[arg(long, action = ArgAction::Set,
+      num_args = 0..=1, require_equals = true,
+      default_missing_value = "true",
+      default_value_t = true)]
+  pub show_caps_lock: bool,
+}
+
+/// Power management configuration
+#[derive(Args, Debug, Clone, Deserialize, Serialize, PartialEq, Eq)]
+pub struct PowerConfig {
+  /// Custom shutdown command
+  #[arg(long = "power-shutdown")]
+  pub shutdown: Option<String>,
+
+  /// Custom reboot command
+  #[arg(long = "power-reboot")]
+  pub reboot: Option<String>,
+
+  /// Custom suspend command
+  #[arg(long = "power-suspend")]
+  pub suspend: Option<String>,
+
+  /// Custom hibernate command
+  #[arg(long = "power-hibernate")]
+  pub hibernate: Option<String>,
+
+  /// Use setsid to detach power commands
+  #[arg(long = "power-use-setsid", action = ArgAction::Set,
+      num_args = 0..=1, require_equals = true,
+      default_missing_value = "true",
+      default_value_t = false)]
+  pub use_setsid: bool,
+}
+
+/// Keybindings configuration
+#[derive(Args, Debug, Clone, Deserialize, Serialize, PartialEq, Eq)]
+pub struct KeybindingsConfig {
+  /// F-key for command menu (1-12)
+  #[arg(long = "kb-command", id = "kb_command", default_value_t = 2)]
+  pub command: u8,
+
+  /// F-key for sessions menu (1-12)
+  #[arg(long = "kb-sessions", default_value_t = 3)]
+  pub sessions: u8,
+
+  /// F-key for power menu (1-12)
+  #[arg(long = "kb-power", default_value_t = 12)]
+  pub power: u8,
+
+  /// F-key for the on-the-fly background switcher menu (1-12)
+  #[arg(long = "kb-background", default_value_t = 4)]
+  pub background: u8,
+}
+
+/// Theme/color configuration
+#[derive(Args, Debug, Clone, Deserialize, Serialize, PartialEq, Eq)]
+pub struct ThemeConfig {
+  /// Border color
+  #[arg(long = "theme-border")]
+  pub border:    Option<String>,
+  /// Base text color
+  #[arg(long = "theme-text")]
+  pub text:      Option<String>,
+  /// Time display color
+  #[arg(long = "theme-time")]
+  pub time:      Option<String>,
+  /// Container background color
+  #[arg(long = "theme-container")]
+  pub container: Option<String>,
+  /// Container title color
+  #[arg(long = "theme-title")]
+  pub title:     Option<String>,
+  /// Greeting text color
+  #[arg(long = "theme-greet")]
+  pub greet:     Option<String>,
+  /// Prompt text color
+  #[arg(long = "theme-prompt")]
+  pub prompt:    Option<String>,
+  /// User input color
+  #[arg(long = "theme-input")]
+  pub input:     Option<String>,
+  /// Action text color
+  #[arg(long = "theme-action")]
+  pub action:    Option<String>,
+  /// Action button color
+  #[arg(long = "theme-button")]
+  pub button:    Option<String>,
+}
+
+/// Background animation configuration. Each animation kind owns its own
+/// namespaced sub-section so new animations can be added without collisions.
+/// Distinct from upstream's `[animations]` section, which configures the
+/// foreground tachyonfx post-processor.
+#[derive(Args, Debug, Clone, Deserialize, Serialize, PartialEq)]
+pub struct BackgroundConfig {
+  /// Which animation to run. `None` or `"none"` disables animations.
+  /// Currently supported: `"doom"`, `"matrix"`.
+  #[arg(long = "background")]
+  pub kind: Option<String>,
+
+  /// Render frame rate when an animation is active. Defaults to 30 FPS when
+  /// `kind` is set; the base UI tick (2 FPS) otherwise.
+  #[arg(long = "background-fps", default_value_t = 30)]
+  pub fps: u32,
+
+  /// Parameters for the DOOM-style fire effect.
+  #[command(flatten)]
+  pub doom: DoomConfig,
+
+  /// Parameters for the cmatrix-style digital rain effect.
+  #[command(flatten)]
+  pub matrix: MatrixConfig,
+}
+
+/// Parameters for the DOOM-style fire animation. Field names mirror Ly's
+/// `doom_fire_*` config keys.
+#[derive(Args, Debug, Clone, Deserialize, Serialize, PartialEq, Eq)]
+pub struct DoomConfig {
+  /// Decay control (1..=9). Higher = taller flames.
+  #[arg(long = "doom-height", default_value_t = 6)]
+  pub height: u8,
+
+  /// Horizontal jitter range (0..=4).
+  #[arg(long = "doom-spread", default_value_t = 2)]
+  pub spread: u8,
+
+  /// Color of the coolest flame tips. Accepts `#RRGGBB`, `0xRRGGBB`, or any
+  /// color name accepted by ratatui (e.g. `red`, `magenta`).
+  #[arg(long = "doom-top-color", default_value_t = "#9F2707".to_string())]
+  pub top_color: String,
+
+  /// Color of the mid-band flames.
+  #[arg(long = "doom-middle-color", default_value_t = "#C78F17".to_string())]
+  pub middle_color: String,
+
+  /// Color of the hottest flames at the base.
+  #[arg(long = "doom-bottom-color", default_value_t = "#FFFFFF".to_string())]
+  pub bottom_color: String,
+}
+
+/// Parameters for the cmatrix-style digital rain animation.
+#[derive(Args, Debug, Clone, Deserialize, Serialize, PartialEq)]
+pub struct MatrixConfig {
+  /// Color of the leading glyph in each falling stream. Accepts `#RRGGBB`,
+  /// `0xRRGGBB`, or any color name accepted by ratatui.
+  #[arg(long = "matrix-head-color", default_value_t = "#CCFFCC".to_string())]
+  pub head_color: String,
+
+  /// Color of the brightest part of the trail (just behind the head).
+  #[arg(long = "matrix-bright-color", default_value_t = "#33FF66".to_string())]
+  pub bright_color: String,
+
+  /// Color of the dim tail before each glyph fades out.
+  #[arg(long = "matrix-dim-color", default_value_t = "#006622".to_string())]
+  pub dim_color: String,
+
+  /// Inclusive minimum trail length in rows.
+  #[arg(long = "matrix-min-length", default_value_t = 6)]
+  pub min_length: u16,
+
+  /// Inclusive maximum trail length in rows.
+  #[arg(long = "matrix-max-length", default_value_t = 18)]
+  pub max_length: u16,
+
+  /// Inclusive minimum stream speed, in rows-per-frame. Lower = slower.
+  #[arg(long = "matrix-min-speed", default_value_t = 0.30)]
+  pub min_speed: f32,
+
+  /// Inclusive maximum stream speed, in rows-per-frame.
+  #[arg(long = "matrix-max-speed", default_value_t = 1.10)]
+  pub max_speed: f32,
+
+  /// Per-cell, per-frame probability of a glyph mutating (the faint trail
+  /// shimmer). `0.0` disables.
+  #[arg(long = "matrix-mutate-chance", default_value_t = 0.02)]
+  pub mutate_chance: f32,
+}
+
+/// Greeting alignment options
+#[derive(
+  Debug, Clone, Deserialize, Serialize, Default, PartialEq, Eq, ValueEnum,
+)]
+#[serde(rename_all = "snake_case")]
+pub enum AlignGreeting {
+  Left,
+  #[default]
+  Center,
+  Right,
+}
+
+/// Secret display modes
+#[derive(
+  Debug, Clone, Deserialize, Serialize, Default, PartialEq, Eq, ValueEnum,
+)]
+#[serde(rename_all = "snake_case")]
+pub enum SecretMode {
+  #[default]
+  Hidden,
+  Characters,
+}
+
+/// Widget position options
+#[derive(
+  Debug, Clone, Deserialize, Serialize, Default, PartialEq, Eq, ValueEnum,
+)]
+#[serde(rename_all = "snake_case")]
+pub enum WidgetPosition {
+  #[default]
+  Default,
+  Top,
+  Bottom,
+  Hidden,
+}
+
+fn default_true() -> bool {
+  true
+}
diff --git a/crates/tuigreet-config/src/env.rs b/crates/tuigreet-config/src/env.rs
deleted file mode 100644
index 71873a1..0000000
--- a/crates/tuigreet-config/src/env.rs
+++ /dev/null
@@ -1,585 +0,0 @@
-use std::env;
-
-use crate::{
-  Config,
-  schema::{AlignGreeting, SecretMode, WidgetPosition},
-};
-
-/// Apply environment variable overrides to configuration.
-///
-/// Supported variables: `TUIGREET_DEBUG`, `TUIGREET_LOG_FILE`,
-/// `TUIGREET_SESSION_COMMAND`, etc. Invalid boolean values are logged as
-/// warnings and ignored.
-pub fn load_env_variables() -> Config {
-  let mut config = Config::default();
-  // General config
-  if let Ok(value) = env::var("TUIGREET_DEBUG") {
-    if let Ok(debug) = parse_bool(&value) {
-      config.general.debug = debug;
-    } else {
-      tracing::warn!(
-        "Invalid TUIGREET_DEBUG value: '{}', expected true/false",
-        value
-      );
-    }
-  }
-
-  if let Ok(value) = env::var("TUIGREET_LOG_FILE") {
-    config.general.log_file = value;
-  }
-
-  if let Ok(value) = env::var("TUIGREET_NUMLOCK") {
-    if let Ok(numlock) = parse_bool(&value) {
-      config.general.numlock = numlock;
-    } else {
-      tracing::warn!(
-        "Invalid TUIGREET_NUMLOCK value: '{}', expected true/false",
-        value
-      );
-    }
-  }
-
-  // Session config
-  if let Ok(value) = env::var("TUIGREET_SESSION_COMMAND") {
-    config.session.command = Some(value);
-  }
-
-  // Display config
-  if let Ok(value) = env::var("TUIGREET_TIME") {
-    if let Ok(show_time) = parse_bool(&value) {
-      config.display.show_time = show_time;
-    } else {
-      tracing::warn!(
-        "Invalid TUIGREET_TIME value: '{}', expected true/false",
-        value
-      );
-    }
-  }
-
-  if let Ok(value) = env::var("TUIGREET_TIME_FORMAT") {
-    config.display.time_format = Some(value);
-  }
-
-  if let Ok(value) = env::var("TUIGREET_GREETING") {
-    config.display.greeting = Some(value);
-  }
-
-  if let Ok(value) = env::var("TUIGREET_TITLE") {
-    if let Ok(show_title) = parse_bool(&value) {
-      config.display.show_title = show_title;
-    } else {
-      tracing::warn!(
-        "Invalid TUIGREET_TITLE: '{}', expected true/false",
-        value
-      );
-    }
-  }
-
-  if let Ok(value) = env::var("TUIGREET_CUSTOM_TITLE") {
-    config.display.custom_title = Some(value);
-  }
-
-  if let Ok(value) = env::var("TUIGREET_ISSUE") {
-    if let Ok(issue) = parse_bool(&value) {
-      config.display.issue = issue;
-    } else {
-      tracing::warn!(
-        "Invalid TUIGREET_ISSUE value: '{}', expected true/false",
-        value
-      );
-    }
-  }
-
-  // Remember config
-  if let Ok(value) = env::var("TUIGREET_REMEMBER") {
-    if let Ok(remember) = parse_bool(&value) {
-      config.remember.username = remember;
-    } else {
-      tracing::warn!(
-        "Invalid TUIGREET_REMEMBER value: '{}', expected true/false",
-        value
-      );
-    }
-  }
-
-  if let Ok(value) = env::var("TUIGREET_REMEMBER_SESSION") {
-    if let Ok(remember) = parse_bool(&value) {
-      config.remember.session = remember;
-    } else {
-      tracing::warn!(
-        "Invalid TUIGREET_REMEMBER_SESSION value: '{}', expected true/false",
-        value
-      );
-    }
-  }
-
-  if let Ok(value) = env::var("TUIGREET_REMEMBER_USER_SESSION") {
-    if let Ok(remember) = parse_bool(&value) {
-      config.remember.user_session = remember;
-    } else {
-      tracing::warn!(
-        "Invalid TUIGREET_REMEMBER_USER_SESSION value: '{}', expected \
-         true/false",
-        value
-      );
-    }
-  }
-
-  // User menu config
-  if let Ok(value) = env::var("TUIGREET_USER_MENU") {
-    if let Ok(enabled) = parse_bool(&value) {
-      config.user_menu.enabled = enabled;
-    } else {
-      tracing::warn!(
-        "Invalid TUIGREET_USER_MENU value: '{}', expected true/false",
-        value
-      );
-    }
-  }
-
-  if let Ok(value) = env::var("TUIGREET_USER_MENU_MIN_UID") {
-    if let Ok(uid) = value.parse::<u32>() {
-      config.user_menu.min_uid = uid;
-    } else {
-      tracing::warn!(
-        "Invalid TUIGREET_USER_MENU_MIN_UID value: '{}', expected number",
-        value
-      );
-    }
-  }
-
-  if let Ok(value) = env::var("TUIGREET_USER_MENU_MAX_UID") {
-    if let Ok(uid) = value.parse::<u32>() {
-      config.user_menu.max_uid = uid;
-    } else {
-      tracing::warn!(
-        "Invalid TUIGREET_USER_MENU_MAX_UID value: '{}', expected number",
-        value
-      );
-    }
-  }
-
-  // Layout config
-  if let Ok(value) = env::var("TUIGREET_WIDTH") {
-    if let Ok(width) = value.parse::<u16>() {
-      config.layout.width = width;
-    } else {
-      tracing::warn!(
-        "Invalid TUIGREET_WIDTH value: '{}', expected number",
-        value
-      );
-    }
-  }
-
-  if let Ok(value) = env::var("TUIGREET_WINDOW_PADDING") {
-    if let Ok(padding) = value.parse::<u16>() {
-      config.layout.window_padding = Some(padding);
-    } else {
-      tracing::warn!(
-        "Invalid TUIGREET_WINDOW_PADDING value: '{}', expected number",
-        value
-      );
-    }
-  }
-
-  if let Ok(value) = env::var("TUIGREET_CONTAINER_PADDING") {
-    if let Ok(padding) = value.parse::<u16>() {
-      config.layout.container_padding = Some(padding);
-    } else {
-      tracing::warn!(
-        "Invalid TUIGREET_CONTAINER_PADDING value: '{}', expected number",
-        value
-      );
-    }
-  }
-
-  if let Ok(value) = env::var("TUIGREET_PROMPT_PADDING") {
-    if let Ok(padding) = value.parse::<u16>() {
-      config.layout.prompt_padding = Some(padding);
-    } else {
-      tracing::warn!(
-        "Invalid TUIGREET_PROMPT_PADDING value: '{}', expected number",
-        value
-      );
-    }
-  }
-
-  // Power config
-  if let Ok(value) = env::var("TUIGREET_POWER_SHUTDOWN") {
-    config.power.shutdown = Some(value);
-  }
-
-  if let Ok(value) = env::var("TUIGREET_POWER_REBOOT") {
-    config.power.reboot = Some(value);
-  }
-
-  if let Ok(value) = env::var("TUIGREET_POWER_SUSPEND") {
-    config.power.suspend = Some(value);
-  }
-
-  if let Ok(value) = env::var("TUIGREET_POWER_HIBERNATE") {
-    config.power.hibernate = Some(value);
-  }
-
-  if let Ok(value) = env::var("TUIGREET_POWER_USE_SETSID") {
-    if let Ok(use_setsid) = parse_bool(&value) {
-      config.power.use_setsid = use_setsid;
-    } else {
-      tracing::warn!(
-        "Invalid TUIGREET_POWER_USE_SETSID value: '{}', expected true/false",
-        value
-      );
-    }
-  }
-
-  // Keybindings config
-  if let Ok(value) = env::var("TUIGREET_KB_COMMAND") {
-    if let Ok(key) = value.parse::<u8>() {
-      if (1..=12).contains(&key) {
-        config.keybindings.command = key;
-      } else {
-        tracing::warn!(
-          "Invalid TUIGREET_KB_COMMAND value: '{}', expected 1-12",
-          value
-        );
-      }
-    } else {
-      tracing::warn!(
-        "Invalid TUIGREET_KB_COMMAND value: '{}', expected number",
-        value
-      );
-    }
-  }
-
-  if let Ok(value) = env::var("TUIGREET_KB_SESSIONS") {
-    if let Ok(key) = value.parse::<u8>() {
-      if (1..=12).contains(&key) {
-        config.keybindings.sessions = key;
-      } else {
-        tracing::warn!(
-          "Invalid TUIGREET_KB_SESSIONS value: '{}', expected 1-12",
-          value
-        );
-      }
-    } else {
-      tracing::warn!(
-        "Invalid TUIGREET_KB_SESSIONS value: '{}', expected number",
-        value
-      );
-    }
-  }
-
-  if let Ok(value) = env::var("TUIGREET_KB_POWER") {
-    if let Ok(key) = value.parse::<u8>() {
-      if (1..=12).contains(&key) {
-        config.keybindings.power = key;
-      } else {
-        tracing::warn!(
-          "Invalid TUIGREET_KB_POWER value: '{}', expected 1-12",
-          value
-        );
-      }
-    } else {
-      tracing::warn!(
-        "Invalid TUIGREET_KB_POWER value: '{}', expected number",
-        value
-      );
-    }
-  }
-
-  // Theme config - parse TUIGREET_THEME environment variable
-  if let Ok(value) = env::var("TUIGREET_THEME") {
-    // Parse theme string using the existing `Theme::parse` logic
-    // Format: "border=white;text=green;container=blue" etc.
-    let mut applied = false;
-
-    // Parse the semicolon-separated theme specification
-    for part in value.split(';') {
-      if let Some((key, color)) = part.split_once('=') {
-        let key = key.trim();
-        let color = color.trim();
-
-        match key {
-          "border" => config.theme.border = Some(color.to_string()),
-          "text" => config.theme.text = Some(color.to_string()),
-          "time" => config.theme.time = Some(color.to_string()),
-          "container" => config.theme.container = Some(color.to_string()),
-          "title" => config.theme.title = Some(color.to_string()),
-          "greet" => config.theme.greet = Some(color.to_string()),
-          "prompt" => config.theme.prompt = Some(color.to_string()),
-          "input" => config.theme.input = Some(color.to_string()),
-          "action" => config.theme.action = Some(color.to_string()),
-          "button" => {
-            config.theme.button = Some(color.to_string());
-          },
-          _ => {
-            tracing::warn!(
-              "Unknown theme component '{}' in TUIGREET_THEME environment \
-               variable",
-              key
-            );
-            continue;
-          },
-        }
-
-        applied = true;
-      } else {
-        tracing::warn!(
-          "Invalid theme specification '{}' in TUIGREET_THEME, expected \
-           format 'component=color'",
-          part.trim()
-        );
-      }
-    }
-
-    if applied {
-      tracing::info!(
-        "Applied theme from TUIGREET_THEME environment variable: {}",
-        value
-      );
-    }
-  }
-
-  // Display configuration
-  if let Ok(value) = env::var("TUIGREET_ALIGN_GREETING") {
-    match value.to_lowercase().as_str() {
-      "left" => config.display.align_greeting = AlignGreeting::Left,
-      "center" => config.display.align_greeting = AlignGreeting::Center,
-      "right" => config.display.align_greeting = AlignGreeting::Right,
-      _ => {
-        tracing::warn!(
-          "Invalid TUIGREET_ALIGN_GREETING value: '{}', expected 'left', \
-           'center', or 'right'",
-          value
-        );
-      },
-    }
-  }
-
-  // Secret configuration
-  if let Ok(value) = env::var("TUIGREET_SECRET_MODE") {
-    match value.to_lowercase().as_str() {
-      "hidden" => {
-        config.secret.mode = SecretMode::Hidden;
-        config.secret_mode_specified = true;
-      },
-      "character" | "characters" => {
-        config.secret.mode = SecretMode::Characters;
-        config.secret_mode_specified = true;
-        if let Ok(chars) = env::var("TUIGREET_SECRET_CHARACTERS") {
-          config.secret.characters = chars;
-        }
-      },
-      _ => {
-        tracing::warn!(
-          "Invalid TUIGREET_SECRET_MODE value: '{}', expected 'hidden' or \
-           'characters'",
-          value
-        );
-      },
-    }
-  }
-
-  if let Ok(value) = env::var("TUIGREET_SECRET_CHARACTERS") {
-    config.secret.characters = value;
-  }
-
-  // Session configuration
-  if let Ok(value) = env::var("TUIGREET_SESSIONS_DIRS") {
-    config.session.sessions_dirs = value
-      .split(':')
-      .map(|s| s.trim().to_string())
-      .filter(|s| !s.is_empty())
-      .collect();
-  }
-
-  if let Ok(value) = env::var("TUIGREET_XSESSIONS_DIRS") {
-    config.session.xsessions_dirs = value
-      .split(':')
-      .map(|s| s.trim().to_string())
-      .filter(|s| !s.is_empty())
-      .collect();
-  }
-
-  if let Ok(value) = env::var("TUIGREET_SESSION_WRAPPER") {
-    config.session.session_wrapper = Some(value);
-  }
-
-  if let Ok(value) = env::var("TUIGREET_XSESSION_WRAPPER") {
-    config.session.xsession_wrapper = Some(value);
-  }
-
-  if let Ok(value) = env::var("TUIGREET_ENVIRONMENTS") {
-    config.session.environments = value
-      .split(':')
-      .map(|s| s.trim().to_string())
-      .filter(|s| !s.is_empty())
-      .collect();
-  }
-
-  // Widget positioning configuration
-  if let Ok(value) = env::var("TUIGREET_TIME_POSITION") {
-    match value.to_lowercase().as_str() {
-      "default" => {
-        config.layout.widgets.time_position = WidgetPosition::Default;
-      },
-      "top" => config.layout.widgets.time_position = WidgetPosition::Top,
-      "bottom" => config.layout.widgets.time_position = WidgetPosition::Bottom,
-      "hidden" => config.layout.widgets.time_position = WidgetPosition::Hidden,
-      _ => {
-        tracing::warn!(
-          "Invalid TUIGREET_TIME_POSITION value: '{}', expected 'default', \
-           'top', 'bottom', or 'hidden'",
-          value
-        );
-      },
-    }
-  }
-
-  if let Ok(value) = env::var("TUIGREET_STATUS_POSITION") {
-    match value.to_lowercase().as_str() {
-      "default" => {
-        config.layout.widgets.status_position = WidgetPosition::Default;
-      },
-      "top" => config.layout.widgets.status_position = WidgetPosition::Top,
-      "bottom" => {
-        config.layout.widgets.status_position = WidgetPosition::Bottom;
-      },
-      "hidden" => {
-        config.layout.widgets.status_position = WidgetPosition::Hidden;
-      },
-      _ => {
-        tracing::warn!(
-          "Invalid TUIGREET_STATUS_POSITION value: '{}', expected 'default', \
-           'top', 'bottom', or 'hidden'",
-          value
-        );
-      },
-    }
-  }
-
-  // Status bar item visibility
-  if let Ok(value) = env::var("TUIGREET_STATUS_SHOW_RESET") {
-    config.layout.widgets.status_bar.show_reset =
-      value.to_lowercase() == "true";
-  }
-  if let Ok(value) = env::var("TUIGREET_STATUS_SHOW_COMMAND") {
-    config.layout.widgets.status_bar.show_command =
-      value.to_lowercase() == "true";
-  }
-  if let Ok(value) = env::var("TUIGREET_STATUS_SHOW_SESSION") {
-    config.layout.widgets.status_bar.show_session =
-      value.to_lowercase() == "true";
-  }
-  if let Ok(value) = env::var("TUIGREET_STATUS_SHOW_POWER") {
-    config.layout.widgets.status_bar.show_power =
-      value.to_lowercase() == "true";
-  }
-  if let Ok(value) = env::var("TUIGREET_STATUS_SHOW_BACKGROUND") {
-    config.layout.widgets.status_bar.show_background =
-      value.to_lowercase() == "true";
-  }
-  if let Ok(value) = env::var("TUIGREET_STATUS_SHOW_SESSION_STATUS") {
-    config.layout.widgets.status_bar.show_session_status =
-      value.to_lowercase() == "true";
-  }
-  if let Ok(value) = env::var("TUIGREET_STATUS_SHOW_CAPS_LOCK") {
-    config.layout.widgets.status_bar.show_caps_lock =
-      value.to_lowercase() == "true";
-  }
-
-  // Individual theme component environment variables
-  if let Ok(value) = env::var("TUIGREET_THEME_BORDER") {
-    config.theme.border = Some(value);
-  }
-  if let Ok(value) = env::var("TUIGREET_THEME_TEXT") {
-    config.theme.text = Some(value);
-  }
-  if let Ok(value) = env::var("TUIGREET_THEME_TIME") {
-    config.theme.time = Some(value);
-  }
-  if let Ok(value) = env::var("TUIGREET_THEME_CONTAINER") {
-    config.theme.container = Some(value);
-  }
-  if let Ok(value) = env::var("TUIGREET_THEME_TITLE") {
-    config.theme.title = Some(value);
-  }
-  if let Ok(value) = env::var("TUIGREET_THEME_GREET") {
-    config.theme.greet = Some(value);
-  }
-  if let Ok(value) = env::var("TUIGREET_THEME_PROMPT") {
-    config.theme.prompt = Some(value);
-  }
-  if let Ok(value) = env::var("TUIGREET_THEME_INPUT") {
-    config.theme.input = Some(value);
-  }
-  if let Ok(value) = env::var("TUIGREET_THEME_ACTION") {
-    config.theme.action = Some(value);
-  }
-  if let Ok(value) = env::var("TUIGREET_THEME_BUTTON") {
-    config.theme.button = Some(value);
-  }
-  config
-}
-
-/// Parse a boolean value from string
-/// Accepts: "true", "1", "yes" for true; "false", "0", "no" for false
-fn parse_bool(value: &str) -> Result<bool, ()> {
-  match value.to_lowercase().as_str() {
-    "true" | "1" | "yes" => Ok(true),
-    "false" | "0" | "no" => Ok(false),
-    _ => Err(()),
-  }
-}
-
-#[cfg(test)]
-mod tests {
-  use super::*;
-
-  #[test]
-  fn test_parse_bool() {
-    assert_eq!(parse_bool("true"), Ok(true));
-    assert_eq!(parse_bool("TRUE"), Ok(true));
-    assert_eq!(parse_bool("1"), Ok(true));
-    assert_eq!(parse_bool("yes"), Ok(true));
-    assert_eq!(parse_bool("YES"), Ok(true));
-
-    assert_eq!(parse_bool("false"), Ok(false));
-    assert_eq!(parse_bool("FALSE"), Ok(false));
-    assert_eq!(parse_bool("0"), Ok(false));
-    assert_eq!(parse_bool("no"), Ok(false));
-    assert_eq!(parse_bool("NO"), Ok(false));
-
-    assert_eq!(parse_bool("invalid"), Err(()));
-    assert_eq!(parse_bool(""), Err(()));
-  }
-
-  #[test]
-  fn test_env_vars_processed_once_with_multiple_theme_components() {
-    unsafe {
-      env::set_var("TUIGREET_THEME", "border=red;text=blue;container=green");
-      env::set_var("TUIGREET_SESSIONS_DIRS", "/test:/usr/share");
-      env::set_var("TUIGREET_ALIGN_GREETING", "center");
-    }
-
-    let config = load_env_variables();
-
-    // Verify all theme components applied
-    assert_eq!(config.theme.border, Some("red".to_string()));
-    assert_eq!(config.theme.text, Some("blue".to_string()));
-    assert_eq!(config.theme.container, Some("green".to_string()));
-
-    // Verify other env vars applied correctly (once, not per-component)
-    assert_eq!(config.session.sessions_dirs, vec![
-      "/test".to_string(),
-      "/usr/share".to_string()
-    ]);
-    assert_eq!(config.display.align_greeting, AlignGreeting::Center);
-
-    unsafe {
-      env::remove_var("TUIGREET_THEME");
-      env::remove_var("TUIGREET_SESSIONS_DIRS");
-      env::remove_var("TUIGREET_ALIGN_GREETING");
-    }
-  }
-}
diff --git a/crates/tuigreet-config/src/error.rs b/crates/tuigreet-config/src/error.rs
new file mode 100644
index 0000000..2ca5854
--- /dev/null
+++ b/crates/tuigreet-config/src/error.rs
@@ -0,0 +1,77 @@
+use std::{fmt, path::PathBuf};
+
+/// Errors that can occur during configuration loading or validation
+#[derive(Debug)]
+pub enum ConfigError {
+  /// Error surfaced by figment while merging/deserializing TOML, env, or
+  /// CLI-baseline layers (covers I/O errors reading `config.toml`, TOML
+  /// parse errors, and type-mismatch deserialization errors).
+  Figment(figment::Error),
+
+  /// General validation error with description
+  Validation(String),
+
+  /// Two options that cannot be used together
+  MutuallyExclusive(String, String),
+
+  /// Option that depends on another option being set
+  Dependency(String),
+
+  /// Invalid range (e.g., `min_uid` >= `max_uid`)
+  InvalidRange(String),
+
+  /// Duplicate keybindings
+  DuplicateKeybindings,
+
+  /// Invalid F-key value
+  InvalidFKey(String, u8),
+
+  /// Invalid time format string
+  InvalidTimeFormat,
+
+  /// Warning, non fatal error
+  Warning(String),
+
+  /// Session wrapper executable not found
+  WrapperExecutableNotFound(PathBuf),
+}
+
+impl fmt::Display for ConfigError {
+  fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+    match self {
+      Self::Figment(err) => write!(f, "config error: {err}"),
+      Self::Validation(msg) => write!(f, "validation error: {msg}"),
+      Self::MutuallyExclusive(opt1, opt2) => {
+        write!(f, "options '{opt1}' and '{opt2}' are mutually exclusive")
+      },
+      Self::Dependency(msg) => write!(f, "dependency error: {msg}"),
+      Self::InvalidRange(msg) => write!(f, "invalid range: {msg}"),
+      Self::DuplicateKeybindings => {
+        write!(f, "duplicate keybindings detected")
+      },
+      Self::InvalidFKey(name, key) => {
+        write!(
+          f,
+          "invalid F-key value for '{name}': F{key} (must be F1-F12)"
+        )
+      },
+      Self::InvalidTimeFormat => write!(f, "invalid time format string"),
+      Self::Warning(msg) => {
+        write!(f, "non-fatal config issue found: {msg}")
+      },
+      Self::WrapperExecutableNotFound(path) => {
+        write!(
+          f,
+          "session wrapper executable not found: {}",
+          path.display()
+        )
+      },
+    }
+  }
+}
+
+impl From<figment::Error> for ConfigError {
+  fn from(err: figment::Error) -> Self {
+    Self::Figment(err)
+  }
+}
diff --git a/crates/tuigreet-config/src/lib.rs b/crates/tuigreet-config/src/lib.rs
index 79cb50e..9af533f 100644
--- a/crates/tuigreet-config/src/lib.rs
+++ b/crates/tuigreet-config/src/lib.rs
@@ -1,92 +1,6 @@
-pub mod env;
-pub mod parser;
-pub mod schema;
+pub mod config;
+pub mod error;
+pub mod loader;
+pub mod validation;
 
-use std::{fmt, io, path::PathBuf};
-
-pub use schema::*;
-
-/// Errors that can occur during configuration loading or validation
-#[derive(Debug)]
-pub enum ConfigError {
-  /// I/O error when reading config files
-  Io(io::Error),
-
-  /// TOML parsing error
-  Parse(toml::de::Error),
-
-  /// TOML parsing error with file context (rendered via codespan)
-  ParseWithContext { source: String },
-  /// General validation error with description
-  Validation(String),
-
-  /// Two options that cannot be used together
-  MutuallyExclusive(String, String),
-
-  /// Option that depends on another option
-  Dependency(String),
-
-  /// Invalid range (e.g., `min_uid` >= `max_uid`)
-  InvalidRange(String),
-
-  /// Duplicate keybindings
-  DuplicateKeybindings,
-
-  /// Invalid F-key value
-  InvalidFKey(String, u8),
-
-  /// Invalid time format string
-  InvalidTimeFormat,
-
-  /// Session wrapper executable not found
-  WrapperExecutableNotFound(PathBuf),
-}
-
-impl fmt::Display for ConfigError {
-  fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-    match self {
-      Self::Io(err) => write!(f, "I/O error: {err}"),
-      Self::Parse(err) => write!(f, "TOML parse error: {err}"),
-      Self::ParseWithContext { source } => {
-        write!(f, "{}", source)
-      },
-      Self::Validation(msg) => write!(f, "Validation error: {msg}"),
-      Self::MutuallyExclusive(opt1, opt2) => {
-        write!(f, "Options '{opt1}' and '{opt2}' are mutually exclusive")
-      },
-      Self::Dependency(msg) => write!(f, "Dependency error: {msg}"),
-      Self::InvalidRange(msg) => write!(f, "Invalid range: {msg}"),
-      Self::DuplicateKeybindings => {
-        write!(f, "Duplicate keybindings detected")
-      },
-      Self::InvalidFKey(name, key) => {
-        write!(
-          f,
-          "Invalid F-key value for '{name}': F{key} (must be F1-F12)"
-        )
-      },
-      Self::InvalidTimeFormat => write!(f, "Invalid time format string"),
-      Self::WrapperExecutableNotFound(path) => {
-        write!(
-          f,
-          "Session wrapper executable not found: {}",
-          path.display()
-        )
-      },
-    }
-  }
-}
-
-impl std::error::Error for ConfigError {}
-
-impl From<io::Error> for ConfigError {
-  fn from(err: io::Error) -> Self {
-    Self::Io(err)
-  }
-}
-
-impl From<toml::de::Error> for ConfigError {
-  fn from(err: toml::de::Error) -> Self {
-    Self::Parse(err)
-  }
-}
+#[cfg(test)] mod tests;
diff --git a/crates/tuigreet-config/src/loader.rs b/crates/tuigreet-config/src/loader.rs
new file mode 100644
index 0000000..6a76127
--- /dev/null
+++ b/crates/tuigreet-config/src/loader.rs
@@ -0,0 +1,142 @@
+use clap::{
+  ArgMatches,
+  CommandFactory,
+  FromArgMatches,
+  Parser,
+  parser::ValueSource,
+};
+use figment::{
+  Figment,
+  providers::{Env, Format, Serialized, Toml},
+};
+use tuigreet_types::expand_tilde;
+
+use crate::{config::Config, error::ConfigError};
+
+/// Clears any argument whose value came from clap's `default_value` (not
+/// genuinely supplied by the user via CLI or env), leaving a sparse
+/// `ArgMatches` containing only explicitly-provided values.
+///
+/// This is the key trick that lets CLI-provided values act as the highest
+/// priority layer without clap's own defaults unconditionally clobbering
+/// TOML/env layers underneath them.
+fn strip_defaults(matches: &ArgMatches) -> ArgMatches {
+  let mut stripped = matches.clone();
+  for id in matches.ids() {
+    let key = id.as_str();
+    if matches.value_source(key) == Some(ValueSource::DefaultValue) {
+      let _ = stripped.try_clear_id(key);
+    }
+  }
+  stripped
+}
+
+/// Loads config layering TOML -> env -> CLI (CLI wins, but only for
+/// explicitly-supplied values; clap's own defaults act as the floor), then
+/// validates the fully-resolved result.
+///
+/// Takes an explicit argv (including program name at index 0) so this can be
+/// exercised deterministically in tests instead of reading `std::env::args()`.
+pub fn load_config_from<I, T>(
+  args: I,
+) -> Result<
+  (Config, Vec<ConfigError>),
+  (Config, (Vec<ConfigError>, Vec<ConfigError>)),
+>
+where
+  I: IntoIterator<Item = T>,
+  T: Into<std::ffi::OsString> + Clone,
+{
+  let args_vec: Vec<std::ffi::OsString> =
+    args.into_iter().map(Into::into).collect();
+  let matches = Config::command().get_matches_from(args_vec.clone());
+  let matches_no_defaults = strip_defaults(&matches);
+
+  // clap-derived defaults become the lowest priority figment layer
+  let cli_defaults = Config::from_arg_matches(&matches)
+    .expect("matches were produced by Config::command()");
+
+  let cli = Config::parse_from(args_vec);
+
+  // Access directly as struct fields
+  let no_config = cli.general.no_config;
+  let system_config_path = expand_tilde(&cli.general.system_config_path);
+  let user_config_path = expand_tilde(&cli.general.user_config_path);
+
+  let mut figment = Figment::new().merge(Serialized::defaults(cli_defaults)); // baseline = clap defaults
+  // set config in case next steps fail, still have options from cli
+  let mut config: Config = match figment.extract() {
+    Ok(c) => c,
+    Err(e) => {
+      return Err((
+        Config::defaults(),
+        (vec![ConfigError::Figment(e)], vec![]),
+      ));
+    },
+  };
+
+  if !no_config {
+    // Only merge system config if it exists
+    if system_config_path.exists() {
+      figment = figment.merge(Toml::file(&system_config_path));
+      config = match figment.extract() {
+        Ok(c) => c,
+        Err(e) => {
+          return Err((config, (vec![ConfigError::Figment(e)], vec![])));
+        },
+      };
+    } else {
+      tracing::debug!(
+        "System config not found, skipping: {}",
+        &cli.general.system_config_path
+      );
+    }
+
+    // Only merge user config if it exists
+    if user_config_path.exists() {
+      figment = figment.merge(Toml::file(&user_config_path));
+      config = match figment.extract() {
+        Ok(c) => c,
+        Err(e) => {
+          return Err((config, (vec![ConfigError::Figment(e)], vec![])));
+        },
+      };
+    } else {
+      tracing::debug!(
+        "User config not found, skipping: {}",
+        &cli.general.user_config_path
+      );
+    }
+  }
+  // NOTE: use a double underscore as the section/field separator, not a
+  // single underscore. `log_level` (and any other snake_case field
+  // name) contains an underscore itself, so splitting on a single "_"
+  // would incorrectly turn `TUIGREET_LOG_LEVEL` into the nested
+  // path `general.log.level` instead of `general.log_level`.
+  figment = figment.merge(Env::prefixed("TUIGREET_").split("__")); // overrides toml
+
+  config = match figment.extract() {
+    Ok(c) => c,
+    Err(e) => {
+      return Err((config, (vec![ConfigError::Figment(e)], vec![])));
+    },
+  };
+
+  // apply only args the user actually supplied on the CLI (final override)
+  config
+    .update_from_arg_matches(&matches_no_defaults)
+    .expect("matches were derived from same Config type");
+
+  match config.validate(false) {
+    Ok(warnings) => Ok((config, warnings)),
+    Err((errors, warnings)) => Err((config, (errors, warnings))),
+  }
+}
+
+/// Loads config using the real process argv.
+pub fn load_config() -> Result<
+  (Config, Vec<ConfigError>),
+  (Config, (Vec<ConfigError>, Vec<ConfigError>)),
+> {
+  load_config_from(std::env::args())
+}
diff --git a/crates/tuigreet-config/src/parser.rs b/crates/tuigreet-config/src/parser.rs
deleted file mode 100644
index d1fdd11..0000000
--- a/crates/tuigreet-config/src/parser.rs
+++ /dev/null
@@ -1,1621 +0,0 @@
-use std::{
-  collections::HashSet,
-  fs,
-  path::{Path, PathBuf},
-};
-
-use codespan_reporting::{
-  diagnostic::{Diagnostic, Label},
-  files::{Files, SimpleFiles},
-  term,
-};
-use dirs::config_dir;
-
-use crate::{
-  AlignGreeting,
-  Config,
-  ConfigError,
-  SecretMode,
-  env::load_env_variables,
-};
-
-/// Loads the effective configuration from files, environment, and CLI options.
-///
-/// Without an explicit path, system and user files are layered over defaults.
-/// An explicit path replaces those file layers. Environment variables and CLI
-/// options are always applied last.
-///
-/// # Arguments
-///
-/// * `cli_config_path` - An optional configuration file. When present, it
-///   replaces the system and user file layers.
-/// * `cli_matches` - Optional parsed command-line options to apply after all
-///   other configuration sources.
-///
-/// # Returns
-///
-/// The effective configuration after applying the selected file layers,
-/// environment variables, and command-line options.
-///
-/// # Errors
-///
-/// Returns an error if a selected configuration file cannot be read or parsed.
-pub fn load_config(
-  cli_config_path: Option<&Path>,
-  cli_matches: Option<&getopts::Matches>,
-) -> Result<Config, ConfigError> {
-  let mut config = if let Some(path) = cli_config_path {
-    load_config_from_path(path)?
-  } else {
-    load_default_file_layers()?
-  };
-
-  let env_vars = load_env_variables();
-  apply_config_layer(&mut config, env_vars);
-
-  if let Some(cli) = cli_matches {
-    let cli_config = extract_cli_config(cli);
-    apply_config_layer(&mut config, cli_config);
-  }
-
-  normalize_legacy_asterisks(&mut config);
-  Ok(config)
-}
-
-/// Merges src into dest, only overwriting fields that differ from their
-/// defaults. Used for layering: defaults -> system -> user -> env -> CLI
-fn apply_config_layer(dest: &mut Config, src: Config) {
-  let defaults = Config::default();
-
-  // General
-  if src.general.debug != defaults.general.debug {
-    dest.general.debug = src.general.debug;
-  }
-  if src.general.log_file != defaults.general.log_file {
-    dest.general.log_file = src.general.log_file;
-  }
-  if src.general.numlock != defaults.general.numlock {
-    dest.general.numlock = src.general.numlock;
-  }
-
-  // Session
-  if src.session.command != defaults.session.command {
-    dest.session.command = src.session.command;
-  }
-  if src.session.sessions_dirs != defaults.session.sessions_dirs {
-    dest.session.sessions_dirs = src.session.sessions_dirs;
-  }
-  if src.session.xsessions_dirs != defaults.session.xsessions_dirs {
-    dest.session.xsessions_dirs = src.session.xsessions_dirs;
-  }
-  if src.session.session_wrapper != defaults.session.session_wrapper {
-    dest.session.session_wrapper = src.session.session_wrapper;
-  }
-  if src.session.xsession_wrapper != defaults.session.xsession_wrapper {
-    dest.session.xsession_wrapper = src.session.xsession_wrapper;
-  }
-  if src.session.environments != defaults.session.environments {
-    dest.session.environments = src.session.environments;
-  }
-
-  // Display
-  if src.display.show_time != defaults.display.show_time {
-    dest.display.show_time = src.display.show_time;
-  }
-  if src.display.time_format != defaults.display.time_format {
-    dest.display.time_format = src.display.time_format;
-  }
-  if src.display.greeting != defaults.display.greeting {
-    dest.display.greeting = src.display.greeting;
-  }
-  if src.display.show_title != defaults.display.show_title {
-    dest.display.show_title = src.display.show_title;
-  }
-  if src.display.custom_title != defaults.display.custom_title {
-    dest.display.custom_title = src.display.custom_title.clone();
-  }
-  if src.display.issue != defaults.display.issue {
-    dest.display.issue = src.display.issue;
-  }
-  if src.display.battery != defaults.display.battery {
-    dest.display.battery = src.display.battery;
-  }
-  if src.display.align_greeting != defaults.display.align_greeting {
-    dest.display.align_greeting = src.display.align_greeting;
-  }
-
-  // Remember
-  if src.remember.default_user != defaults.remember.default_user {
-    dest.remember.default_user = src.remember.default_user;
-  }
-  if src.remember.username != defaults.remember.username {
-    dest.remember.username = src.remember.username;
-  }
-  if src.remember.session != defaults.remember.session {
-    dest.remember.session = src.remember.session;
-  }
-  if src.remember.user_session != defaults.remember.user_session {
-    dest.remember.user_session = src.remember.user_session;
-  }
-
-  // User menu
-  if src.user_menu.enabled != defaults.user_menu.enabled {
-    dest.user_menu.enabled = src.user_menu.enabled;
-  }
-  if src.user_menu.min_uid != defaults.user_menu.min_uid {
-    dest.user_menu.min_uid = src.user_menu.min_uid;
-  }
-  if src.user_menu.max_uid != defaults.user_menu.max_uid {
-    dest.user_menu.max_uid = src.user_menu.max_uid;
-  }
-
-  // Secret
-  if src.display.asterisks.is_some() {
-    dest.display.asterisks = src.display.asterisks;
-  }
-  if src.secret_mode_specified || src.secret.mode != defaults.secret.mode {
-    dest.secret.mode = src.secret.mode;
-    dest.secret_mode_specified = true;
-  } else if let Some(asterisks) = src.display.asterisks {
-    dest.secret.mode = legacy_secret_mode(asterisks);
-  }
-  if src.secret.characters != defaults.secret.characters {
-    dest.secret.characters = src.secret.characters;
-  }
-
-  // Layout
-  if src.layout.width != defaults.layout.width {
-    dest.layout.width = src.layout.width;
-  }
-  if src.layout.window_padding != defaults.layout.window_padding {
-    dest.layout.window_padding = src.layout.window_padding;
-  }
-  if src.layout.container_padding != defaults.layout.container_padding {
-    dest.layout.container_padding = src.layout.container_padding;
-  }
-  if src.layout.prompt_padding != defaults.layout.prompt_padding {
-    dest.layout.prompt_padding = src.layout.prompt_padding;
-  }
-  if src.layout.widgets.time_position != defaults.layout.widgets.time_position {
-    dest.layout.widgets.time_position = src.layout.widgets.time_position;
-  }
-  if src.layout.widgets.status_position
-    != defaults.layout.widgets.status_position
-  {
-    dest.layout.widgets.status_position = src.layout.widgets.status_position;
-  }
-  if src.layout.widgets.battery_position
-    != defaults.layout.widgets.battery_position
-  {
-    dest.layout.widgets.battery_position =
-      src.layout.widgets.battery_position.clone();
-  }
-
-  // Status bar item visibility
-  if src.layout.widgets.status_bar.show_reset
-    != defaults.layout.widgets.status_bar.show_reset
-  {
-    dest.layout.widgets.status_bar.show_reset =
-      src.layout.widgets.status_bar.show_reset;
-  }
-  if src.layout.widgets.status_bar.show_command
-    != defaults.layout.widgets.status_bar.show_command
-  {
-    dest.layout.widgets.status_bar.show_command =
-      src.layout.widgets.status_bar.show_command;
-  }
-  if src.layout.widgets.status_bar.show_session
-    != defaults.layout.widgets.status_bar.show_session
-  {
-    dest.layout.widgets.status_bar.show_session =
-      src.layout.widgets.status_bar.show_session;
-  }
-  if src.layout.widgets.status_bar.show_power
-    != defaults.layout.widgets.status_bar.show_power
-  {
-    dest.layout.widgets.status_bar.show_power =
-      src.layout.widgets.status_bar.show_power;
-  }
-  if src.layout.widgets.status_bar.show_background
-    != defaults.layout.widgets.status_bar.show_background
-  {
-    dest.layout.widgets.status_bar.show_background =
-      src.layout.widgets.status_bar.show_background;
-  }
-  if src.layout.widgets.status_bar.show_session_status
-    != defaults.layout.widgets.status_bar.show_session_status
-  {
-    dest.layout.widgets.status_bar.show_session_status =
-      src.layout.widgets.status_bar.show_session_status;
-  }
-  if src.layout.widgets.status_bar.show_caps_lock
-    != defaults.layout.widgets.status_bar.show_caps_lock
-  {
-    dest.layout.widgets.status_bar.show_caps_lock =
-      src.layout.widgets.status_bar.show_caps_lock;
-  }
-
-  // Power
-  if src.power.shutdown != defaults.power.shutdown {
-    dest.power.shutdown = src.power.shutdown;
-  }
-  if src.power.reboot != defaults.power.reboot {
-    dest.power.reboot = src.power.reboot;
-  }
-  if src.power.suspend != defaults.power.suspend {
-    dest.power.suspend = src.power.suspend;
-  }
-  if src.power.hibernate != defaults.power.hibernate {
-    dest.power.hibernate = src.power.hibernate;
-  }
-  if src.power.use_setsid != defaults.power.use_setsid {
-    dest.power.use_setsid = src.power.use_setsid;
-  }
-
-  // Keybindings
-  if src.keybindings.command != defaults.keybindings.command {
-    dest.keybindings.command = src.keybindings.command;
-  }
-  if src.keybindings.sessions != defaults.keybindings.sessions {
-    dest.keybindings.sessions = src.keybindings.sessions;
-  }
-  if src.keybindings.power != defaults.keybindings.power {
-    dest.keybindings.power = src.keybindings.power;
-  }
-  if src.keybindings.background != defaults.keybindings.background {
-    dest.keybindings.background = src.keybindings.background;
-  }
-
-  // Background animation
-  if src.background.kind.is_some() {
-    dest.background.kind = src.background.kind;
-  }
-  if src.background.fps.is_some() {
-    dest.background.fps = src.background.fps;
-  }
-  if src.background.doom.height.is_some() {
-    dest.background.doom.height = src.background.doom.height;
-  }
-  if src.background.doom.spread.is_some() {
-    dest.background.doom.spread = src.background.doom.spread;
-  }
-  if src.background.doom.top_color.is_some() {
-    dest.background.doom.top_color = src.background.doom.top_color;
-  }
-  if src.background.doom.middle_color.is_some() {
-    dest.background.doom.middle_color = src.background.doom.middle_color;
-  }
-  if src.background.doom.bottom_color.is_some() {
-    dest.background.doom.bottom_color = src.background.doom.bottom_color;
-  }
-  if src.background.matrix.head_color.is_some() {
-    dest.background.matrix.head_color = src.background.matrix.head_color;
-  }
-  if src.background.matrix.bright_color.is_some() {
-    dest.background.matrix.bright_color = src.background.matrix.bright_color;
-  }
-  if src.background.matrix.dim_color.is_some() {
-    dest.background.matrix.dim_color = src.background.matrix.dim_color;
-  }
-  if src.background.matrix.min_length.is_some() {
-    dest.background.matrix.min_length = src.background.matrix.min_length;
-  }
-  if src.background.matrix.max_length.is_some() {
-    dest.background.matrix.max_length = src.background.matrix.max_length;
-  }
-  if src.background.matrix.min_speed.is_some() {
-    dest.background.matrix.min_speed = src.background.matrix.min_speed;
-  }
-  if src.background.matrix.max_speed.is_some() {
-    dest.background.matrix.max_speed = src.background.matrix.max_speed;
-  }
-  if src.background.matrix.mutate_chance.is_some() {
-    dest.background.matrix.mutate_chance = src.background.matrix.mutate_chance;
-  }
-
-  // Outputs: a non-empty list from a higher-priority layer fully replaces
-  if !src.outputs.is_empty() {
-    dest.outputs = src.outputs;
-  }
-
-  // Terminal: replace individual fields only if source specifies them
-  if src.terminal.cols.is_some() {
-    dest.terminal.cols = src.terminal.cols;
-  }
-  if src.terminal.rows.is_some() {
-    dest.terminal.rows = src.terminal.rows;
-  }
-
-  // Theme: all fields are Option<String>, default is None
-  if src.theme.border.is_some() {
-    dest.theme.border = src.theme.border;
-  }
-  if src.theme.text.is_some() {
-    dest.theme.text = src.theme.text;
-  }
-  if src.theme.time.is_some() {
-    dest.theme.time = src.theme.time;
-  }
-  if src.theme.container.is_some() {
-    dest.theme.container = src.theme.container;
-  }
-  if src.theme.title.is_some() {
-    dest.theme.title = src.theme.title;
-  }
-  if src.theme.greet.is_some() {
-    dest.theme.greet = src.theme.greet;
-  }
-  if src.theme.prompt.is_some() {
-    dest.theme.prompt = src.theme.prompt;
-  }
-  if src.theme.input.is_some() {
-    dest.theme.input = src.theme.input;
-  }
-  if src.theme.action.is_some() {
-    dest.theme.action = src.theme.action;
-  }
-  if src.theme.button.is_some() {
-    dest.theme.button = src.theme.button;
-  }
-}
-
-/// Load configuration from a specific path.
-///
-/// # Errors
-///
-/// Returns error if file cannot be read or contains invalid TOML
-fn load_config_from_path(path: &Path) -> Result<Config, ConfigError> {
-  let content = fs::read_to_string(path)?;
-  match toml::from_str::<Config>(&content) {
-    Ok(mut config) => {
-      config.secret_mode_specified = toml::from_str::<toml::Table>(&content)
-        .is_ok_and(|table| {
-          table
-            .get("secret")
-            .and_then(toml::Value::as_table)
-            .is_some_and(|secret| secret.contains_key("mode"))
-        });
-      Ok(config)
-    },
-    Err(e) => Err(toml_error(path, &content, e)),
-  }
-}
-
-/// Load system and user config as TOML tables before deserializing them.
-/// This preserves explicit default-valued settings in the higher-priority file.
-fn load_default_file_layers() -> Result<Config, ConfigError> {
-  let mut merged = toml::Table::new();
-  let mut paths = vec![PathBuf::from("/etc/tuigreet/config.toml")];
-  if let Some(config_dir) = config_dir() {
-    paths.push(config_dir.join("tuigreet").join("config.toml"));
-  }
-
-  for path in paths {
-    if !path.exists() {
-      continue;
-    }
-    let content = fs::read_to_string(&path)?;
-    let mut table = toml::from_str::<toml::Table>(&content)
-      .map_err(|error| toml_error(&path, &content, error))?;
-    normalize_legacy_asterisks_table(&mut table);
-    merge_toml_tables(&mut merged, table);
-  }
-
-  let config_value = toml::Value::Table(merged);
-  let secret_mode_specified = config_value
-    .get("secret")
-    .and_then(toml::Value::as_table)
-    .is_some_and(|secret| secret.contains_key("mode"));
-  let mut config: Config = config_value.try_into()?;
-  config.secret_mode_specified = secret_mode_specified;
-  Ok(config)
-}
-
-fn merge_toml_tables(dest: &mut toml::Table, src: toml::Table) {
-  for (key, value) in src {
-    match (dest.get_mut(&key), value) {
-      (Some(toml::Value::Table(dest)), toml::Value::Table(src)) => {
-        merge_toml_tables(dest, src);
-      },
-      (_, value) => {
-        dest.insert(key, value);
-      },
-    }
-  }
-}
-
-fn normalize_legacy_asterisks_table(table: &mut toml::Table) {
-  let Some(asterisks) = table
-    .get("display")
-    .and_then(toml::Value::as_table)
-    .and_then(|display| display.get("asterisks"))
-    .and_then(toml::Value::as_bool)
-  else {
-    return;
-  };
-
-  let secret = table
-    .entry("secret")
-    .or_insert_with(|| toml::Value::Table(toml::Table::new()));
-  let Some(secret) = secret.as_table_mut() else {
-    return;
-  };
-  secret.entry("mode").or_insert_with(|| {
-    toml::Value::String(
-      if asterisks { "characters" } else { "hidden" }.to_string(),
-    )
-  });
-}
-
-fn legacy_secret_mode(asterisks: bool) -> SecretMode {
-  if asterisks {
-    SecretMode::Characters
-  } else {
-    SecretMode::Hidden
-  }
-}
-
-/// Applies the compatibility alias only if the canonical field was absent.
-fn normalize_legacy_asterisks(config: &mut Config) {
-  if !config.secret_mode_specified
-    && let Some(asterisks) = config.display.asterisks
-  {
-    config.secret.mode = legacy_secret_mode(asterisks);
-  }
-}
-
-/// Create a TOML error with file/line context for better error messages.
-///
-/// # Arguments
-///
-/// * `path` - Path to the config file
-/// * `content` - Full file content
-/// * `original_error` - TOML parsing error
-///
-/// # Returns
-///
-/// [`ConfigError`] with line numbers and additiona context
-fn toml_error(
-  path: &Path,
-  content: &str,
-  original_error: toml::de::Error,
-) -> ConfigError {
-  let span = match original_error.span() {
-    Some(span) => span,
-    None => return ConfigError::Parse(original_error),
-  };
-
-  let mut files = SimpleFiles::new();
-  let file_id = files.add(path.to_string_lossy(), content);
-
-  let diagnostic = Diagnostic::error()
-    .with_message(original_error.message())
-    .with_labels(vec![
-      Label::primary(file_id, span.start..span.end)
-        .with_message("TOML parse error"),
-    ]);
-
-  let config = term::Config::default();
-  let writer = term::termcolor::StandardStream::stderr(
-    term::termcolor::ColorChoice::Always,
-  );
-  term::emit_to_io_write(&mut writer.lock(), &config, &files, &diagnostic)
-    .unwrap_or_else(|_| {
-      eprintln!("TOML parse error: {}", original_error.message())
-    });
-
-  ConfigError::ParseWithContext {
-    source: format!(
-      "TOML parse error: {} at {}:{} (byte {})",
-      original_error.message(),
-      path.display(),
-      files.line_index(file_id, span.start).unwrap_or(0) + 1,
-      span.start
-    ),
-  }
-}
-
-/// Extract CLI arguments into a Config struct (highest priority source)
-pub fn extract_cli_config(matches: &getopts::Matches) -> Config {
-  let mut config = Config::default();
-  // General config
-  if matches.opt_present("debug") {
-    config.general.debug = true;
-  }
-  if matches.opt_present("numlock") {
-    config.general.numlock = true;
-  }
-  // Display config
-  if matches.opt_present("time") {
-    config.display.show_time = true;
-  }
-  if let Some(format) = matches.opt_str("time-format") {
-    config.display.time_format = Some(format);
-  }
-  if matches.opt_present("title") {
-    config.display.show_title = true;
-  }
-  if let Some(custom_title) = matches.opt_str("custom-title") {
-    config.display.custom_title = Some(custom_title);
-  }
-  if let Some(greeting) = matches.opt_str("greeting") {
-    config.display.greeting = Some(greeting);
-  }
-  if matches.opt_present("issue") {
-    config.display.issue = true;
-  }
-  if matches.opt_present("battery") {
-    config.display.battery = true;
-  }
-  if let Some(align) = matches.opt_str("greet-align") {
-    config.display.align_greeting = match align.as_str() {
-      "left" => AlignGreeting::Left,
-      "right" => AlignGreeting::Right,
-      _ => AlignGreeting::Center,
-    };
-  }
-  // Remember config
-  if let Some(user) = matches.opt_str("user") {
-    config.remember.default_user = Some(user);
-  }
-  if matches.opt_present("remember") {
-    config.remember.username = true;
-  }
-  if matches.opt_present("remember-session") {
-    config.remember.session = true;
-  }
-  if matches.opt_present("remember-user-session") {
-    config.remember.user_session = true;
-  }
-  // User menu config
-  if matches.opt_present("user-menu") {
-    config.user_menu.enabled = true;
-  }
-  if let Some(min_uid) = matches.opt_str("user-menu-min-uid")
-    && let Ok(uid) = min_uid.parse::<u32>()
-  {
-    config.user_menu.min_uid = uid;
-  }
-  if let Some(max_uid) = matches.opt_str("user-menu-max-uid")
-    && let Ok(uid) = max_uid.parse::<u32>()
-  {
-    config.user_menu.max_uid = uid;
-  }
-  // Session config
-  if let Some(cmd) = matches.opt_str("cmd") {
-    config.session.command = Some(cmd);
-  }
-  if matches.opt_present("env") {
-    config.session.environments = matches.opt_strs("env");
-  }
-  if let Some(dirs) = matches.opt_str("sessions") {
-    config.session.sessions_dirs = dirs.split(':').map(String::from).collect();
-  }
-  if let Some(dirs) = matches.opt_str("xsessions") {
-    config.session.xsessions_dirs = dirs.split(':').map(String::from).collect();
-  }
-  if let Some(wrapper) = matches.opt_str("session-wrapper") {
-    config.session.session_wrapper = Some(wrapper);
-  }
-  if !matches.opt_present("no-xsession-wrapper")
-    && let Some(wrapper) = matches.opt_str("xsession-wrapper")
-  {
-    config.session.xsession_wrapper = Some(wrapper);
-  }
-  // Layout config
-  if let Some(width) = matches.opt_str("width")
-    && let Ok(w) = width.parse::<u16>()
-  {
-    config.layout.width = w;
-  }
-  if let Some(padding) = matches.opt_str("window-padding")
-    && let Ok(p) = padding.parse::<u16>()
-  {
-    config.layout.window_padding = Some(p);
-  }
-  if let Some(padding) = matches.opt_str("container-padding")
-    && let Ok(p) = padding.parse::<u16>()
-  {
-    config.layout.container_padding = Some(p);
-  }
-  if let Some(padding) = matches.opt_str("prompt-padding")
-    && let Ok(p) = padding.parse::<u16>()
-  {
-    config.layout.prompt_padding = Some(p);
-  }
-  // Keybindings config
-  if let Some(key) = matches.opt_str("kb-command")
-    && let Ok(k) = key.parse::<u8>()
-  {
-    config.keybindings.command = k;
-  }
-  if let Some(key) = matches.opt_str("kb-sessions")
-    && let Ok(k) = key.parse::<u8>()
-  {
-    config.keybindings.sessions = k;
-  }
-  if let Some(key) = matches.opt_str("kb-power")
-    && let Ok(k) = key.parse::<u8>()
-  {
-    config.keybindings.power = k;
-  }
-  if let Some(key) = matches.opt_str("kb-background")
-    && let Ok(k) = key.parse::<u8>()
-  {
-    config.keybindings.background = k;
-  }
-  // Secret config
-  if matches.opt_present("asterisks") {
-    config.secret.mode = SecretMode::Characters;
-  }
-  if let Some(chars) = matches.opt_str("asterisks-char") {
-    config.secret.characters = chars;
-  }
-  // Power config
-  if let Some(cmd) = matches.opt_str("power-shutdown") {
-    config.power.shutdown = Some(cmd);
-  }
-  if let Some(cmd) = matches.opt_str("power-reboot") {
-    config.power.reboot = Some(cmd);
-  }
-  if let Some(cmd) = matches.opt_str("power-suspend") {
-    config.power.suspend = Some(cmd);
-  }
-  if let Some(cmd) = matches.opt_str("power-hibernate") {
-    config.power.hibernate = Some(cmd);
-  }
-  if matches.opt_present("power-no-setsid") {
-    config.power.use_setsid = false;
-  }
-  // Background animation config
-  if let Some(kind) = matches.opt_str("background") {
-    config.background.kind = Some(kind);
-  }
-  if let Some(fps) = matches.opt_str("background-fps")
-    && let Ok(v) = fps.parse::<u32>()
-  {
-    config.background.fps = Some(v);
-  }
-  if let Some(h) = matches.opt_str("doom-height")
-    && let Ok(v) = h.parse::<u8>()
-  {
-    config.background.doom.height = Some(v);
-  }
-  if let Some(s) = matches.opt_str("doom-spread")
-    && let Ok(v) = s.parse::<u8>()
-  {
-    config.background.doom.spread = Some(v);
-  }
-  if let Some(colors) = matches.opt_str("doom-colors") {
-    let parts: Vec<&str> = colors.split(',').map(str::trim).collect();
-    if parts.len() == 3 {
-      config.background.doom.top_color = Some(parts[0].to_string());
-      config.background.doom.middle_color = Some(parts[1].to_string());
-      config.background.doom.bottom_color = Some(parts[2].to_string());
-    }
-  }
-  if let Some(colors) = matches.opt_str("matrix-colors") {
-    let parts: Vec<&str> = colors.split(',').map(str::trim).collect();
-    if parts.len() == 3 {
-      config.background.matrix.head_color = Some(parts[0].to_string());
-      config.background.matrix.bright_color = Some(parts[1].to_string());
-      config.background.matrix.dim_color = Some(parts[2].to_string());
-    }
-  }
-  if let Some(s) = matches.opt_str("matrix-length") {
-    let parts: Vec<&str> = s.split(',').map(str::trim).collect();
-    if parts.len() == 2
-      && let (Ok(lo), Ok(hi)) =
-        (parts[0].parse::<u16>(), parts[1].parse::<u16>())
-    {
-      config.background.matrix.min_length = Some(lo);
-      config.background.matrix.max_length = Some(hi);
-    }
-  }
-  if let Some(s) = matches.opt_str("matrix-speed") {
-    let parts: Vec<&str> = s.split(',').map(str::trim).collect();
-    if parts.len() == 2
-      && let (Ok(lo), Ok(hi)) =
-        (parts[0].parse::<f32>(), parts[1].parse::<f32>())
-    {
-      config.background.matrix.min_speed = Some(lo);
-      config.background.matrix.max_speed = Some(hi);
-    }
-  }
-  config
-}
-
-impl Config {
-  /// Validates cross-field configuration constraints.
-  ///
-  /// Returns non-fatal configuration warnings when validation succeeds.
-  ///
-  /// # Errors
-  ///
-  /// Returns an error when mutually exclusive settings, invalid ranges,
-  /// malformed values, or invalid wrapper commands are configured.
-  pub fn validate(
-    &self,
-    validate_wrappers: bool,
-  ) -> Result<Vec<String>, ConfigError> {
-    let mut warnings = Vec::new();
-
-    if self.display.asterisks.is_some() {
-      warnings.push(
-        "display.asterisks is deprecated; use secret.mode = \"characters\" or \
-         \"hidden\" instead"
-          .to_string(),
-      );
-    }
-
-    // Check mutually exclusive options
-    if self.display.issue && self.display.greeting.is_some() {
-      return Err(ConfigError::MutuallyExclusive(
-        "display.issue".to_string(),
-        "display.greeting".to_string(),
-      ));
-    }
-
-    // Check dependencies
-    if self.remember.user_session && !self.remember.username {
-      return Err(ConfigError::Dependency(
-        "remember.user_session requires remember.username".to_string(),
-      ));
-    }
-
-    // Check UID ranges
-    if self.user_menu.min_uid > self.user_menu.max_uid {
-      return Err(ConfigError::InvalidRange(
-        "user_menu.min_uid must not exceed user_menu.max_uid".to_string(),
-      ));
-    }
-
-    if self.layout.width == 0 {
-      return Err(ConfigError::Validation(
-        "layout.width must be greater than 0".to_string(),
-      ));
-    }
-    for (name, padding) in [
-      ("layout.window_padding", self.layout.window_padding),
-      ("layout.container_padding", self.layout.container_padding),
-      ("layout.prompt_padding", self.layout.prompt_padding),
-    ] {
-      if padding.is_some_and(|padding| padding > 10) {
-        return Err(ConfigError::Validation(format!(
-          "{name} must not exceed 10"
-        )));
-      }
-    }
-
-    // Check keybindings are distinct
-    let keys = [
-      self.keybindings.command,
-      self.keybindings.sessions,
-      self.keybindings.power,
-      self.keybindings.background,
-    ];
-    if keys.iter().collect::<HashSet<_>>().len() != keys.len() {
-      return Err(ConfigError::DuplicateKeybindings);
-    }
-
-    // Check F-key ranges
-    for (name, key) in [
-      ("command", self.keybindings.command),
-      ("sessions", self.keybindings.sessions),
-      ("power", self.keybindings.power),
-      ("background", self.keybindings.background),
-    ] {
-      if !(1..=12).contains(&key) {
-        return Err(ConfigError::InvalidFKey(name.to_string(), key));
-      }
-    }
-
-    // Validate time format if provided
-    if let Some(ref format) = self.display.time_format
-      && chrono::format::StrftimeItems::new(format)
-        .any(|item| matches!(item, chrono::format::Item::Error))
-    {
-      return Err(ConfigError::InvalidTimeFormat);
-    }
-
-    // Validate session wrapper executables if requested
-    if validate_wrappers {
-      if let Some(ref wrapper) = self.session.session_wrapper {
-        self.validate_wrapper_command(wrapper)?;
-      }
-      if let Some(ref wrapper) = self.session.xsession_wrapper {
-        self.validate_wrapper_command(wrapper)?;
-      }
-    }
-
-    // Validate [[outputs]] entries
-    {
-      let primary_count = self.outputs.iter().filter(|o| o.primary).count();
-      if primary_count > 1 {
-        return Err(ConfigError::Validation(format!(
-          "At most one output may be marked `primary = true`, but \
-           {primary_count} are"
-        )));
-      }
-
-      for output in &self.outputs {
-        if output.connector.contains('/') || output.connector.contains("..") {
-          return Err(ConfigError::Validation(format!(
-            "Output connector name '{}' must not contain path separators",
-            output.connector
-          )));
-        }
-        if output.connector.is_empty() {
-          return Err(ConfigError::Validation(
-            "Output connector name must not be empty".to_string(),
-          ));
-        }
-      }
-
-      // Warn if [[outputs]] is configured but all are disabled
-      if !self.outputs.is_empty() && self.outputs.iter().all(|o| !o.enabled) {
-        warnings.push(
-          "All [[outputs]] entries have `enabled = false`; no output will be \
-           used for terminal sizing"
-            .to_string(),
-        );
-      }
-    }
-
-    // Validate [terminal].
-    // Both cols and rows must be set together
-    if let Some(reason) = self.terminal.invalid_reason() {
-      return Err(ConfigError::Validation(reason));
-    }
-
-    // Add validation warnings for potentially problematic configurations
-    self.check_warnings(&mut warnings);
-
-    Ok(warnings)
-  }
-
-  /// Check for configuration warnings
-  fn check_warnings(&self, warnings: &mut Vec<String>) {
-    // Warn about excessively high padding values
-    if let Some(padding) = self.layout.window_padding
-      && padding > 10
-    {
-      warnings.push(format!(
-        "window_padding is very high ({padding}), this may cause display \
-         issues"
-      ));
-    }
-
-    if let Some(padding) = self.layout.container_padding
-      && padding > 10
-    {
-      warnings.push(format!(
-        "container_padding is very high ({padding}), this may cause display \
-         issues"
-      ));
-    }
-
-    // Warn about very wide width settings
-    if self.layout.width > 200 {
-      warnings.push(format!(
-        "width is very high ({}), this may cause display issues on smaller \
-         terminals",
-        self.layout.width
-      ));
-    }
-
-    // Warn if user menu is enabled but UID range might be empty
-    if self.user_menu.enabled && self.user_menu.min_uid > 65000 {
-      warnings.push(
-        "user_menu.min_uid is very high, you may not see any users".to_string(),
-      );
-    }
-
-    // Warn about potentially conflicting session directories
-    let mut all_session_dirs = self.session.sessions_dirs.clone();
-    all_session_dirs.extend(self.session.xsessions_dirs.clone());
-
-    if all_session_dirs.len()
-      != all_session_dirs
-        .iter()
-        .collect::<std::collections::HashSet<_>>()
-        .len()
-    {
-      warnings.push(
-        "Duplicate session directories detected in sessions_dirs and \
-         xsessions_dirs"
-          .to_string(),
-      );
-    }
-
-    // Warn about hidden widgets but enabled features
-    if matches!(
-      self.layout.widgets.time_position,
-      crate::WidgetPosition::Hidden
-    ) && self.display.show_time
-    {
-      warnings
-        .push("time widget is hidden but show_time is enabled".to_string());
-    }
-
-    // Warn about potential security issues with power commands
-    if let Some(ref cmd) = self.power.shutdown
-      && !self.power.use_setsid
-      && !cmd.contains("sudo")
-      && !cmd.contains("doas")
-    {
-      warnings.push(
-        "shutdown command without setsid or privilege escalation may fail"
-          .to_string(),
-      );
-    }
-
-    if let Some(ref cmd) = self.power.reboot
-      && !self.power.use_setsid
-      && !cmd.contains("sudo")
-      && !cmd.contains("doas")
-    {
-      warnings.push(
-        "reboot command without setsid or privilege escalation may fail"
-          .to_string(),
-      );
-    }
-
-    if let Some(ref cmd) = self.power.suspend
-      && !self.power.use_setsid
-      && !cmd.contains("sudo")
-      && !cmd.contains("doas")
-    {
-      warnings.push(
-        "suspend command without setsid or privilege escalation may fail"
-          .to_string(),
-      );
-    }
-
-    if let Some(ref cmd) = self.power.hibernate
-      && !self.power.use_setsid
-      && !cmd.contains("sudo")
-      && !cmd.contains("doas")
-    {
-      warnings.push(
-        "hibernate command without setsid or privilege escalation may fail"
-          .to_string(),
-      );
-    }
-
-    // Warn about empty session directories
-    if self.session.sessions_dirs.is_empty()
-      && self.session.xsessions_dirs.is_empty()
-    {
-      warnings.push(
-        "No session directories configured, users may not be able to select \
-         sessions"
-          .to_string(),
-      );
-    }
-
-    // Warn about potentially invalid time formats
-    if let Some(ref format) = self.display.time_format
-      && format.is_empty()
-    {
-      warnings.push(
-        "time_format is empty, this will result in no time display".to_string(),
-      );
-    }
-
-    // Warn about conflicting remember options
-    if self.remember.session && self.remember.user_session {
-      // This should be caught as an error above, but just in case
-      warnings.push(
-        "Both remember.session and remember.user_session are enabled"
-          .to_string(),
-      );
-    }
-
-    // Warn about invalid fps settings
-    if self.background.fps.is_some_and(|f| f == 0) {
-      warnings
-        .push("Background fps is set to 0, this will be ignored".to_string());
-    }
-  }
-
-  /// Validate that a wrapper command exists and is executable
-  fn validate_wrapper_command(&self, command: &str) -> Result<(), ConfigError> {
-    let trimmed = command.trim();
-    if trimmed.is_empty() {
-      return Err(ConfigError::WrapperExecutableNotFound(PathBuf::from(
-        command,
-      )));
-    }
-
-    let parts: Vec<&str> = trimmed.split_whitespace().collect();
-    if let Some(executable) = parts.first() {
-      // Check if it's an absolute path
-      let path = PathBuf::from(executable);
-      if path.is_absolute() {
-        if !path.exists() || !is_executable(&path) {
-          return Err(ConfigError::WrapperExecutableNotFound(path));
-        }
-      } else {
-        // Search in PATH
-        if !command_exists(executable) {
-          return Err(ConfigError::WrapperExecutableNotFound(PathBuf::from(
-            executable,
-          )));
-        }
-      }
-    }
-    Ok(())
-  }
-}
-
-/// Check if a file is executable
-fn is_executable(path: &Path) -> bool {
-  #[cfg(unix)]
-  {
-    use std::os::unix::fs::PermissionsExt;
-    if let Ok(metadata) = fs::metadata(path) {
-      let permissions = metadata.permissions();
-      return permissions.mode() & 0o111 != 0;
-    }
-  }
-
-  #[cfg(not(unix))]
-  {
-    // On non-Unix systems, just check if file exists
-    return path.exists();
-  }
-
-  false
-}
-
-/// Check if a command exists in PATH
-fn command_exists(command: &str) -> bool {
-  if let Ok(path) = std::env::var("PATH") {
-    for dir in std::env::split_paths(&path) {
-      let full_path = dir.join(command);
-      if full_path.exists() && is_executable(&full_path) {
-        return true;
-      }
-    }
-  }
-  false
-}
-
-#[cfg(test)]
-mod tests {
-  use super::*;
-
-  #[test]
-  fn toml_layers_preserve_explicit_default_values() {
-    let mut system: toml::Table =
-      toml::from_str("[display]\nshow_time = true\n[layout]\nwidth = 120\n")
-        .expect("system config is valid");
-    let user: toml::Table =
-      toml::from_str("[display]\nshow_time = false\n[layout]\nwidth = 80\n")
-        .expect("user config is valid");
-
-    merge_toml_tables(&mut system, user);
-    let config: Config = toml::Value::Table(system)
-      .try_into()
-      .expect("merged config is valid");
-
-    assert!(!config.display.show_time);
-    assert_eq!(config.layout.width, 80);
-  }
-
-  #[test]
-  fn canonical_secret_mode_wins_over_legacy_alias() {
-    let mut config: Config = toml::from_str(
-      r#"
-[display]
-asterisks = true
-
-[secret]
-mode = "hidden"
-"#,
-    )
-    .expect("configuration must parse");
-    config.secret_mode_specified = true;
-
-    normalize_legacy_asterisks(&mut config);
-
-    assert_eq!(config.secret.mode, SecretMode::Hidden);
-  }
-
-  #[test]
-  fn legacy_false_overrides_a_lower_characters_layer() {
-    let mut resolved = Config::default();
-    resolved.secret.mode = SecretMode::Characters;
-
-    let mut legacy_layer = Config::default();
-    legacy_layer.display.asterisks = Some(false);
-    apply_config_layer(&mut resolved, legacy_layer);
-
-    assert_eq!(resolved.secret.mode, SecretMode::Hidden);
-    assert!(
-      resolved
-        .validate(false)
-        .expect("legacy configuration is valid")
-        .iter()
-        .any(|warning| warning.contains("display.asterisks is deprecated"))
-    );
-  }
-
-  #[test]
-  fn canonical_higher_layer_overrides_legacy_alias() {
-    let mut resolved = Config::default();
-    resolved.display.asterisks = Some(true);
-
-    let mut canonical_layer = Config::default();
-    canonical_layer.secret.mode = SecretMode::Hidden;
-    canonical_layer.secret_mode_specified = true;
-    apply_config_layer(&mut resolved, canonical_layer);
-    normalize_legacy_asterisks(&mut resolved);
-
-    assert_eq!(resolved.secret.mode, SecretMode::Hidden);
-  }
-
-  #[test]
-  fn test_mutual_exclusive_remember_flags() {
-    let toml_content = r"
-[remember]
-username = true
-session = true
-user_session = true
-";
-
-    let config: Config =
-      toml::from_str(toml_content).expect("Failed to parse TOML");
-
-    assert!(config.remember.session);
-    assert!(config.remember.user_session);
-
-    // Both flags being set is now a warning, not a hard error, so that the
-    // rest of the config is still applied. user_session takes behavioral
-    // precedence when both are true.
-    let result = config.validate(false);
-    assert!(
-      result.is_ok(),
-      "Both remember.session and remember.user_session being true should \
-       produce a warning, not an error"
-    );
-
-    let warnings = result.unwrap();
-    assert!(
-      warnings.iter().any(|w| {
-        w.contains("remember.session") && w.contains("remember.user_session")
-      }),
-      "Expected a warning about conflicting remember options, got: \
-       {warnings:?}"
-    );
-  }
-
-  #[test]
-  fn test_keybindings_distinctness_in_config() {
-    let toml_content = r"
-[keybindings]
-command = 3
-sessions = 3
-power = 7
-";
-
-    let config: Config =
-      toml::from_str(toml_content).expect("Failed to parse TOML");
-    let validation_result = config.validate(false);
-
-    match validation_result {
-      Err(ConfigError::DuplicateKeybindings) => {},
-      _ => {
-        panic!(
-          "Expected DuplicateKeybindings error, got: {validation_result:?}"
-        );
-      },
-    }
-  }
-
-  #[test]
-  fn test_session_config_default_consistency() {
-    let default_config = Config::default();
-
-    let partial_toml = r#"
-[session]
-command = "test"
-"#;
-    let partial_config: Config =
-      toml::from_str(partial_toml).expect("Failed to parse partial TOML");
-
-    assert_eq!(
-      default_config.session.sessions_dirs,
-      partial_config.session.sessions_dirs,
-      "Default and partially deserialized sessions_dirs should match"
-    );
-  }
-
-  #[test]
-  fn test_power_config_default_consistency() {
-    let default_config = Config::default();
-
-    let partial_toml = r#"
-[power]
-shutdown = "poweroff"
-"#;
-    let partial_config: Config =
-      toml::from_str(partial_toml).expect("Failed to parse partial TOML");
-
-    assert_eq!(
-      default_config.power.use_setsid, partial_config.power.use_setsid,
-      "Default and partially deserialized use_setsid should match"
-    );
-  }
-
-  #[test]
-  fn test_wrapper_validation_empty_string() {
-    let empty_wrapper = r#"
-[session]
-session_wrapper = ""
-"#;
-
-    let mut config: Config =
-      toml::from_str(empty_wrapper).expect("Failed to parse TOML");
-
-    config.session.xsession_wrapper = None;
-
-    let result = config.validate(true);
-
-    assert!(
-      result.is_err(),
-      "Empty wrapper command should fail validation"
-    );
-  }
-
-  // [[outputs]] validation
-  #[test]
-  fn test_outputs_toml_roundtrip() {
-    let toml_content = r#"
-[[outputs]]
-connector = "DP-1"
-primary = true
-
-[[outputs]]
-connector = "HDMI-A-1"
-enabled = false
-"#;
-    let config: Config =
-      toml::from_str(toml_content).expect("Failed to parse [[outputs]] TOML");
-
-    assert_eq!(config.outputs.len(), 2);
-    assert_eq!(config.outputs[0].connector, "DP-1");
-    assert!(config.outputs[0].primary);
-    assert!(config.outputs[0].enabled); // default = true
-    assert_eq!(config.outputs[1].connector, "HDMI-A-1");
-    assert!(!config.outputs[1].primary); // default = false
-    assert!(!config.outputs[1].enabled);
-
-    // Validation should pass
-    assert!(config.validate(false).is_ok());
-  }
-
-  #[test]
-  fn test_outputs_multiple_primary_is_error() {
-    let toml_content = r#"
-[[outputs]]
-connector = "DP-1"
-primary = true
-
-[[outputs]]
-connector = "HDMI-A-1"
-primary = true
-"#;
-    let config: Config =
-      toml::from_str(toml_content).expect("Failed to parse TOML");
-    let result = config.validate(false);
-    assert!(
-      matches!(result, Err(ConfigError::Validation(_))),
-      "Multiple primary outputs should be a Validation error, got: {result:?}"
-    );
-  }
-
-  #[test]
-  fn test_outputs_empty_connector_is_error() {
-    let toml_content = r#"
-[[outputs]]
-connector = ""
-"#;
-    let config: Config =
-      toml::from_str(toml_content).expect("Failed to parse TOML");
-    let result = config.validate(false);
-    assert!(
-      matches!(result, Err(ConfigError::Validation(_))),
-      "Empty connector name should be a Validation error, got: {result:?}"
-    );
-  }
-
-  #[test]
-  fn test_outputs_path_separator_in_connector_is_error() {
-    for bad in &["../DP-1", "/sys/class/drm/DP-1", "foo/bar"] {
-      let config: Config =
-        toml::from_str(&format!("[[outputs]]\nconnector = \"{bad}\"\n"))
-          .expect("Failed to parse TOML");
-      let result = config.validate(false);
-      assert!(
-        matches!(result, Err(ConfigError::Validation(_))),
-        "Connector '{bad}' with path separator should be a Validation error, \
-         got: {result:?}"
-      );
-    }
-  }
-
-  #[test]
-  fn test_outputs_valid_connector_names() {
-    // Typical DRM connector name patterns that must pass
-    for good in &[
-      "DP-1",
-      "HDMI-A-1",
-      "DisplayPort-2",
-      "eDP-1",
-      "VGA-1",
-      "DVI-D-1",
-    ] {
-      let config: Config =
-        toml::from_str(&format!("[[outputs]]\nconnector = \"{good}\"\n"))
-          .expect("Failed to parse TOML");
-      assert!(
-        config.validate(false).is_ok(),
-        "Connector '{good}' should be valid, but validation failed"
-      );
-    }
-  }
-
-  #[test]
-  fn test_outputs_all_disabled_is_warning() {
-    let toml_content = r#"
-[[outputs]]
-connector = "DP-1"
-enabled = false
-
-[[outputs]]
-connector = "HDMI-A-1"
-enabled = false
-"#;
-    let config: Config =
-      toml::from_str(toml_content).expect("Failed to parse TOML");
-    let result = config.validate(false);
-    assert!(
-      result.is_ok(),
-      "All-disabled outputs should not be an error"
-    );
-    let warnings = result.unwrap();
-    assert!(
-      warnings.iter().any(|w| w.contains("enabled = false")),
-      "Expected a warning about all outputs being disabled, got: {warnings:?}"
-    );
-  }
-
-  #[test]
-  fn test_outputs_single_primary_passes() {
-    let toml_content = r#"
-[[outputs]]
-connector = "DP-1"
-primary = true
-
-[[outputs]]
-connector = "HDMI-A-1"
-"#;
-    let config: Config =
-      toml::from_str(toml_content).expect("Failed to parse TOML");
-    assert!(config.validate(false).is_ok());
-  }
-
-  // [terminal] validation
-  #[test]
-  fn test_terminal_both_set_passes() {
-    let toml_content = r"
-[terminal]
-cols = 237
-rows = 52
-";
-    let config: Config =
-      toml::from_str(toml_content).expect("Failed to parse TOML");
-    assert_eq!(config.terminal.cols, Some(237));
-    assert_eq!(config.terminal.rows, Some(52));
-    assert!(config.validate(false).is_ok());
-  }
-
-  #[test]
-  fn test_terminal_cols_without_rows_is_error() {
-    let toml_content = r"
-[terminal]
-cols = 237
-";
-    let config: Config =
-      toml::from_str(toml_content).expect("Failed to parse TOML");
-    let result = config.validate(false);
-    assert!(
-      matches!(result, Err(ConfigError::Validation(_))),
-      "cols without rows should be a Validation error, got: {result:?}"
-    );
-  }
-
-  #[test]
-  fn test_terminal_rows_without_cols_is_error() {
-    let toml_content = r"
-[terminal]
-rows = 52
-";
-    let config: Config =
-      toml::from_str(toml_content).expect("Failed to parse TOML");
-    let result = config.validate(false);
-    assert!(
-      matches!(result, Err(ConfigError::Validation(_))),
-      "rows without cols should be a Validation error, got: {result:?}"
-    );
-  }
-
-  #[test]
-  fn test_terminal_neither_set_passes() {
-    let config = Config::default();
-    assert!(config.validate(false).is_ok());
-  }
-
-  #[test]
-  fn test_terminal_zero_cols_is_error() {
-    let mut config = Config::default();
-    config.terminal.cols = Some(0);
-    config.terminal.rows = Some(52);
-    let result = config.validate(false);
-    assert!(
-      matches!(result, Err(ConfigError::Validation(_))),
-      "cols = 0 should be a Validation error, got: {result:?}"
-    );
-  }
-
-  #[test]
-  fn test_terminal_zero_rows_is_error() {
-    let mut config = Config::default();
-    config.terminal.cols = Some(237);
-    config.terminal.rows = Some(0);
-    let result = config.validate(false);
-    assert!(
-      matches!(result, Err(ConfigError::Validation(_))),
-      "rows = 0 should be a Validation error, got: {result:?}"
-    );
-  }
-
-  #[test]
-  fn test_wrapper_validation_whitespace_only() {
-    let whitespace_wrapper = r#"
-[session]
-session_wrapper = "   "
-"#;
-
-    let mut config: Config =
-      toml::from_str(whitespace_wrapper).expect("Failed to parse TOML");
-
-    config.session.xsession_wrapper = None;
-
-    let result = config.validate(true);
-
-    assert!(
-      result.is_err(),
-      "Whitespace-only wrapper command should fail validation"
-    );
-  }
-
-  // Config priority tests
-
-  #[test]
-  fn test_cli_only_no_config() {
-    let mut config = Config::default();
-
-    let mut cli = Config::default();
-    cli.keybindings.sessions = 5;
-
-    apply_config_layer(&mut config, cli);
-
-    assert_eq!(config.keybindings.sessions, 5);
-  }
-
-  #[test]
-  fn test_config_overrides_defaults() {
-    let mut config = Config::default();
-
-    let mut file_config = Config::default();
-    file_config.keybindings.command = 3;
-
-    apply_config_layer(&mut config, file_config);
-
-    assert_eq!(config.keybindings.command, 3);
-  }
-
-  #[test]
-  fn test_user_overrides_system() {
-    let mut config = Config::default();
-    config.keybindings.command = 5;
-
-    let mut user = Config::default();
-    user.keybindings.command = 7;
-
-    apply_config_layer(&mut config, user);
-
-    assert_eq!(config.keybindings.command, 7);
-  }
-
-  #[test]
-  fn test_env_overrides_user() {
-    let mut config = Config::default();
-    config.keybindings.power = 10;
-
-    let mut env = Config::default();
-    env.keybindings.power = 8;
-
-    apply_config_layer(&mut config, env);
-
-    assert_eq!(config.keybindings.power, 8);
-  }
-
-  #[test]
-  fn test_cli_overrides_env() {
-    let mut config = Config::default();
-    config.keybindings.sessions = 3;
-
-    let mut cli = Config::default();
-    cli.keybindings.sessions = 9;
-
-    apply_config_layer(&mut config, cli);
-
-    assert_eq!(config.keybindings.sessions, 9);
-  }
-
-  #[test]
-  fn test_full_priority_chain() {
-    let mut config = Config::default();
-    assert_eq!(config.keybindings.command, 2);
-
-    let mut system = Config::default();
-    system.keybindings.command = 5;
-    apply_config_layer(&mut config, system);
-    assert_eq!(config.keybindings.command, 5);
-
-    let mut user = Config::default();
-    user.keybindings.command = 7;
-    apply_config_layer(&mut config, user);
-    assert_eq!(config.keybindings.command, 7);
-
-    let mut env = Config::default();
-    env.keybindings.command = 9;
-    apply_config_layer(&mut config, env);
-    assert_eq!(config.keybindings.command, 9);
-
-    let mut cli = Config::default();
-    cli.keybindings.command = 11;
-    apply_config_layer(&mut config, cli);
-    assert_eq!(config.keybindings.command, 11);
-  }
-
-  #[test]
-  fn test_lower_layer_preserved_when_higher_layer_uses_defaults() {
-    // System config sets a non-default value
-    let mut config = Config::default();
-    config.keybindings.power = 10;
-    config.display.show_time = true;
-    config.remember.username = true;
-
-    // User config only touches one unrelated field; all others remain at
-    // their defaults and must NOT overwrite the system values above.
-    let mut user = Config::default();
-    user.display.greeting = Some("hello".to_string());
-    apply_config_layer(&mut config, user);
-
-    assert_eq!(
-      config.keybindings.power, 10,
-      "system keybinding must survive"
-    );
-    assert!(config.display.show_time, "system show_time must survive");
-    assert!(
-      config.remember.username,
-      "system remember.username must survive"
-    );
-    assert_eq!(config.display.greeting, Some("hello".to_string()));
-  }
-}
diff --git a/crates/tuigreet-config/src/schema.rs b/crates/tuigreet-config/src/schema.rs
deleted file mode 100644
index 172f158..0000000
--- a/crates/tuigreet-config/src/schema.rs
+++ /dev/null
@@ -1,700 +0,0 @@
-use serde::{Deserialize, Serialize};
-
-/// Root configuration structure
-#[derive(Debug, Clone, Deserialize, Serialize, Default)]
-pub struct Config {
-  /// Parser metadata used to preserve explicit default-valued secret modes
-  /// during configuration layering.
-  #[serde(skip)]
-  pub(crate) secret_mode_specified: bool,
-
-  #[serde(default)]
-  pub general: GeneralConfig,
-
-  #[serde(default)]
-  pub session: SessionConfig,
-
-  #[serde(default)]
-  pub display: DisplayConfig,
-
-  #[serde(default)]
-  pub remember: RememberConfig,
-
-  #[serde(default)]
-  pub user_menu: UserMenuConfig,
-
-  #[serde(default)]
-  pub secret: SecretConfig,
-
-  #[serde(default)]
-  pub layout: LayoutConfig,
-
-  #[serde(default)]
-  pub power: PowerConfig,
-
-  #[serde(default)]
-  pub keybindings: KeybindingsConfig,
-
-  #[serde(default)]
-  pub theme: ThemeConfig,
-
-  #[serde(default)]
-  pub background: BackgroundConfig,
-
-  /// Per-output (display/monitor) configuration.
-  /// Use `[[outputs]]` array of tables in TOML.
-  #[serde(default)]
-  pub outputs: Vec<OutputConfig>,
-
-  /// Explicit terminal size override. When both `cols` and `rows` are set
-  /// they take precedence over output-derived sizing.
-  #[serde(default)]
-  pub terminal: TerminalConfig,
-}
-
-/// Configuration for a single DRM output (monitor/display).
-///
-/// Example:
-/// ```toml
-/// [[outputs]]
-/// connector = "DP-1"
-/// primary = true
-///
-/// [[outputs]]
-/// connector = "HDMI-A-1"
-/// enabled = false
-/// ```
-#[derive(Debug, Clone, Deserialize, Serialize, PartialEq, Eq)]
-pub struct OutputConfig {
-  /// DRM connector name as it appears in `/sys/class/drm/` (e.g. `"DP-1"`,
-  /// `"HDMI-A-1"`).
-  pub connector: String,
-
-  /// Whether tuigreet should use this output. Defaults to `true`.
-  #[serde(default = "default_true")]
-  pub enabled: bool,
-
-  /// If `true`, size the terminal to match this output's native resolution.
-  /// At most one output should be marked primary. If none is marked primary
-  /// the first enabled output is used for sizing.
-  #[serde(default)]
-  pub primary: bool,
-}
-
-/// Explicit terminal character-cell size override.
-///
-/// When both `cols` and `rows` are provided they take highest priority over
-/// output-derived sizing. Providing only one of the two fields is an error.
-#[derive(Debug, Clone, Deserialize, Serialize, Default, PartialEq, Eq)]
-pub struct TerminalConfig {
-  /// Number of character columns.
-  pub cols: Option<u16>,
-  /// Number of character rows.
-  pub rows: Option<u16>,
-}
-
-impl TerminalConfig {
-  /// Returns `true` when the config is consistent: either both fields are
-  /// absent, or both are `Some(v)` with `v > 0`.  Any other combination is
-  /// invalid.
-  #[must_use]
-  pub fn is_valid(&self) -> bool {
-    self.invalid_reason().is_none()
-  }
-
-  /// Returns a human-readable error string describing the first invalid
-  /// condition found, or `None` when the config is consistent.
-  #[must_use]
-  pub fn invalid_reason(&self) -> Option<String> {
-    match (self.cols, self.rows) {
-      (Some(_), None) => {
-        Some(
-          "`terminal.cols` is set but `terminal.rows` is missing; both must \
-           be provided together"
-            .to_string(),
-        )
-      },
-      (None, Some(_)) => {
-        Some(
-          "`terminal.rows` is set but `terminal.cols` is missing; both must \
-           be provided together"
-            .to_string(),
-        )
-      },
-      (Some(0), Some(_)) => {
-        Some("`terminal.cols` must be greater than 0".to_string())
-      },
-      (Some(_), Some(0)) => {
-        Some("`terminal.rows` must be greater than 0".to_string())
-      },
-      _ => None,
-    }
-  }
-}
-
-/// General configuration options
-#[derive(Debug, Clone, Deserialize, Serialize, PartialEq, Eq)]
-pub struct GeneralConfig {
-  /// Enable debug logging
-  #[serde(default)]
-  pub debug: bool,
-
-  /// Log file path
-  #[serde(default = "default_log_file")]
-  pub log_file: String,
-
-  /// Enable numlock on startup
-  #[serde(default)]
-  pub numlock: bool,
-}
-
-impl Default for GeneralConfig {
-  fn default() -> Self {
-    Self {
-      debug:    false,
-      log_file: default_log_file(),
-      numlock:  false,
-    }
-  }
-}
-
-/// Session management configuration
-#[derive(Debug, Clone, Deserialize, Serialize, PartialEq, Eq)]
-pub struct SessionConfig {
-  /// Override session with a specific command
-  #[serde(default)]
-  pub command: Option<String>,
-
-  /// Directories containing Wayland session files
-  #[serde(default = "default_sessions_dirs")]
-  pub sessions_dirs: Vec<String>,
-
-  /// Directories containing X11 session files
-  #[serde(default = "default_xsessions_dirs")]
-  pub xsessions_dirs: Vec<String>,
-
-  /// Wrapper command for non-X11 sessions
-  #[serde(default)]
-  pub session_wrapper: Option<String>,
-
-  /// Wrapper command for X11 sessions
-  #[serde(default = "default_xsession_wrapper")]
-  pub xsession_wrapper: Option<String>,
-
-  /// Environment variables for default session
-  #[serde(default)]
-  pub environments: Vec<String>,
-}
-
-impl Default for SessionConfig {
-  fn default() -> Self {
-    Self {
-      command:          None,
-      sessions_dirs:    default_sessions_dirs(),
-      xsessions_dirs:   default_xsessions_dirs(),
-      session_wrapper:  None,
-      xsession_wrapper: default_xsession_wrapper(),
-      environments:     Vec::new(),
-    }
-  }
-}
-
-/// Display and visual configuration
-#[derive(Debug, Clone, Deserialize, Serialize, Default, PartialEq, Eq)]
-pub struct DisplayConfig {
-  /// Legacy secret-mask toggle. Prefer `[secret] mode = "characters"`.
-  #[serde(default, skip_serializing)]
-  pub(crate) asterisks: Option<bool>,
-
-  /// Show current time
-  #[serde(default)]
-  pub show_time: bool,
-
-  /// Custom time format (strftime)
-  #[serde(default)]
-  pub time_format: Option<String>,
-
-  /// Custom greeting message
-  #[serde(default)]
-  pub greeting: Option<String>,
-
-  /// Show login form title
-  #[serde(default = "default_show_title")]
-  pub show_title: bool,
-
-  /// Custom login form title
-  #[serde(default)]
-  pub custom_title: Option<String>,
-
-  /// Show /etc/issue file
-  #[serde(default)]
-  pub issue: bool,
-
-  /// Show battery percentage
-  #[serde(default)]
-  pub battery: bool,
-
-  /// Greeting text alignment
-  #[serde(default)]
-  pub align_greeting: AlignGreeting,
-}
-
-/// Remember/cache configuration
-#[derive(Debug, Clone, Deserialize, Serialize, Default, PartialEq, Eq)]
-pub struct RememberConfig {
-  /// Default user to pre-fill
-  #[serde(default)]
-  pub default_user: Option<String>,
-
-  /// Remember last logged-in username
-  #[serde(default)]
-  pub username: bool,
-
-  /// Remember last selected session (global)
-  #[serde(default)]
-  pub session: bool,
-
-  /// Remember last selected session per user
-  #[serde(default)]
-  pub user_session: bool,
-}
-
-/// User menu configuration
-#[derive(Debug, Clone, Deserialize, Serialize, PartialEq, Eq)]
-pub struct UserMenuConfig {
-  /// Enable user selection menu
-  #[serde(default)]
-  pub enabled: bool,
-
-  /// Minimum UID to display in user menu
-  #[serde(default = "default_min_uid")]
-  pub min_uid: u32,
-
-  /// Maximum UID to display in user menu
-  #[serde(default = "default_max_uid")]
-  pub max_uid: u32,
-}
-
-impl Default for UserMenuConfig {
-  fn default() -> Self {
-    Self {
-      enabled: false,
-      min_uid: default_min_uid(),
-      max_uid: default_max_uid(),
-    }
-  }
-}
-
-/// Secret display configuration
-#[derive(Debug, Clone, Deserialize, Serialize, PartialEq, Eq)]
-pub struct SecretConfig {
-  /// How to display secrets
-  #[serde(default)]
-  pub mode: SecretMode,
-
-  /// Characters to use when mode is Characters
-  #[serde(default = "default_secret_characters")]
-  pub characters: String,
-}
-
-impl Default for SecretConfig {
-  fn default() -> Self {
-    Self {
-      mode:       SecretMode::Hidden,
-      characters: default_secret_characters(),
-    }
-  }
-}
-
-/// Layout and sizing configuration
-#[derive(Debug, Clone, Deserialize, Serialize, PartialEq, Eq)]
-pub struct LayoutConfig {
-  /// Width of the main prompt container
-  #[serde(default = "default_width")]
-  pub width: u16,
-
-  /// Padding around the terminal window
-  #[serde(default)]
-  pub window_padding: Option<u16>,
-
-  /// Padding inside the main container
-  #[serde(default)]
-  pub container_padding: Option<u16>,
-
-  /// Padding between prompt rows
-  #[serde(default)]
-  pub prompt_padding: Option<u16>,
-
-  /// Widget positioning options
-  #[serde(default)]
-  pub widgets: WidgetConfig,
-}
-
-impl Default for LayoutConfig {
-  fn default() -> Self {
-    Self {
-      width:             default_width(),
-      window_padding:    None,
-      container_padding: None,
-      prompt_padding:    None,
-      widgets:           WidgetConfig::default(),
-    }
-  }
-}
-
-/// Battery widget placement
-#[derive(Debug, Clone, Deserialize, Serialize, Default, PartialEq, Eq)]
-#[serde(rename_all = "snake_case")]
-pub enum BatteryPosition {
-  #[default]
-  Left,
-  Right,
-}
-
-/// Widget positioning configuration
-#[derive(Debug, Clone, Deserialize, Serialize, Default, PartialEq, Eq)]
-pub struct WidgetConfig {
-  /// Position of time widget
-  #[serde(default)]
-  pub time_position: WidgetPosition,
-
-  /// Position of status bar widget
-  #[serde(default)]
-  pub status_position: WidgetPosition,
-
-  /// Position of battery widget
-  #[serde(default)]
-  pub battery_position: BatteryPosition,
-
-  /// Status bar item visibility
-  #[serde(default)]
-  pub status_bar: StatusBarConfig,
-}
-
-/// Status bar item visibility configuration
-#[derive(Debug, Clone, Deserialize, Serialize, PartialEq, Eq)]
-pub struct StatusBarConfig {
-  /// Show the ESC/Reset button
-  #[serde(default = "default_true")]
-  pub show_reset: bool,
-
-  /// Show the command button
-  #[serde(default = "default_true")]
-  pub show_command: bool,
-
-  /// Show the session button
-  #[serde(default = "default_true")]
-  pub show_session: bool,
-
-  /// Show the power button
-  #[serde(default = "default_true")]
-  pub show_power: bool,
-
-  /// Show the background button
-  #[serde(default = "default_true")]
-  pub show_background: bool,
-
-  /// Show the current session/command indicator
-  #[serde(default = "default_true")]
-  pub show_session_status: bool,
-
-  /// Show the caps lock indicator
-  #[serde(default = "default_true")]
-  pub show_caps_lock: bool,
-}
-
-impl Default for StatusBarConfig {
-  fn default() -> Self {
-    Self {
-      show_reset:          default_true(),
-      show_command:        default_true(),
-      show_session:        default_true(),
-      show_power:          default_true(),
-      show_background:     default_true(),
-      show_session_status: default_true(),
-      show_caps_lock:      default_true(),
-    }
-  }
-}
-
-/// Power management configuration
-#[derive(Debug, Clone, Deserialize, Serialize, PartialEq, Eq)]
-pub struct PowerConfig {
-  /// Custom shutdown command
-  #[serde(default)]
-  pub shutdown: Option<String>,
-
-  /// Custom reboot command
-  #[serde(default)]
-  pub reboot: Option<String>,
-
-  /// Custom suspend command
-  #[serde(default)]
-  pub suspend: Option<String>,
-
-  /// Custom hibernate command
-  #[serde(default)]
-  pub hibernate: Option<String>,
-
-  /// Use setsid to detach power commands
-  #[serde(default = "default_use_setsid")]
-  pub use_setsid: bool,
-}
-
-impl Default for PowerConfig {
-  fn default() -> Self {
-    Self {
-      shutdown:   None,
-      reboot:     None,
-      suspend:    None,
-      hibernate:  None,
-      use_setsid: default_use_setsid(),
-    }
-  }
-}
-
-/// Keybindings configuration
-#[derive(Debug, Clone, Deserialize, Serialize, PartialEq, Eq)]
-pub struct KeybindingsConfig {
-  /// F-key for command menu (1-12)
-  #[serde(default = "default_kb_command")]
-  pub command: u8,
-
-  /// F-key for sessions menu (1-12)
-  #[serde(default = "default_kb_sessions")]
-  pub sessions: u8,
-
-  /// F-key for power menu (1-12)
-  #[serde(default = "default_kb_power")]
-  pub power: u8,
-
-  /// F-key for the on-the-fly background switcher menu (1-12)
-  #[serde(default = "default_kb_background")]
-  pub background: u8,
-}
-
-impl Default for KeybindingsConfig {
-  fn default() -> Self {
-    Self {
-      command:    default_kb_command(),
-      sessions:   default_kb_sessions(),
-      power:      default_kb_power(),
-      background: default_kb_background(),
-    }
-  }
-}
-
-/// Theme/color configuration
-#[derive(Debug, Clone, Deserialize, Serialize, Default, PartialEq, Eq)]
-pub struct ThemeConfig {
-  /// Border color
-  #[serde(default)]
-  pub border:    Option<String>,
-  /// Base text color
-  #[serde(default)]
-  pub text:      Option<String>,
-  /// Time display color
-  #[serde(default)]
-  pub time:      Option<String>,
-  /// Container background color
-  #[serde(default)]
-  pub container: Option<String>,
-  /// Container title color
-  #[serde(default)]
-  pub title:     Option<String>,
-  /// Greeting text color
-  #[serde(default)]
-  pub greet:     Option<String>,
-  /// Prompt text color
-  #[serde(default)]
-  pub prompt:    Option<String>,
-  /// User input color
-  #[serde(default)]
-  pub input:     Option<String>,
-  /// Action text color
-  #[serde(default)]
-  pub action:    Option<String>,
-  /// Action button color
-  #[serde(default)]
-  pub button:    Option<String>,
-}
-
-/// Background animation configuration. Each animation kind owns its own
-/// namespaced sub-section so new animations can be added without collisions.
-/// Distinct from upstream's `[animations]` section, which configures the
-/// foreground tachyonfx post-processor.
-#[derive(Debug, Clone, Deserialize, Serialize, Default, PartialEq)]
-pub struct BackgroundConfig {
-  /// Which animation to run. `None` or `"none"` disables animations.
-  /// Currently supported: `"doom"`, `"matrix"`.
-  #[serde(default)]
-  pub kind: Option<String>,
-
-  /// Render frame rate when an animation is active. Defaults to 30 FPS when
-  /// `kind` is set; the base UI tick (2 FPS) otherwise.
-  #[serde(default)]
-  pub fps: Option<u32>,
-
-  /// Parameters for the DOOM-style fire effect.
-  #[serde(default)]
-  pub doom: DoomConfig,
-
-  /// Parameters for the cmatrix-style digital rain effect.
-  #[serde(default)]
-  pub matrix: MatrixConfig,
-}
-
-/// Parameters for the DOOM-style fire animation. Field names mirror Ly's
-/// `doom_fire_*` config keys.
-#[derive(Debug, Clone, Deserialize, Serialize, Default, PartialEq, Eq)]
-pub struct DoomConfig {
-  /// Decay control (1..=9). Higher = taller flames.
-  #[serde(default)]
-  pub height: Option<u8>,
-
-  /// Horizontal jitter range (0..=4).
-  #[serde(default)]
-  pub spread: Option<u8>,
-
-  /// Color of the coolest flame tips. Accepts `#RRGGBB`, `0xRRGGBB`, or any
-  /// color name accepted by ratatui (e.g. `red`, `magenta`).
-  #[serde(default)]
-  pub top_color: Option<String>,
-
-  /// Color of the mid-band flames.
-  #[serde(default)]
-  pub middle_color: Option<String>,
-
-  /// Color of the hottest flames at the base.
-  #[serde(default)]
-  pub bottom_color: Option<String>,
-}
-
-/// Parameters for the cmatrix-style digital rain animation.
-#[derive(Debug, Clone, Deserialize, Serialize, Default, PartialEq)]
-pub struct MatrixConfig {
-  /// Color of the leading glyph in each falling stream. Accepts `#RRGGBB`,
-  /// `0xRRGGBB`, or any color name accepted by ratatui.
-  #[serde(default)]
-  pub head_color: Option<String>,
-
-  /// Color of the brightest part of the trail (just behind the head).
-  #[serde(default)]
-  pub bright_color: Option<String>,
-
-  /// Color of the dim tail before each glyph fades out.
-  #[serde(default)]
-  pub dim_color: Option<String>,
-
-  /// Inclusive minimum trail length in rows.
-  #[serde(default)]
-  pub min_length: Option<u16>,
-
-  /// Inclusive maximum trail length in rows.
-  #[serde(default)]
-  pub max_length: Option<u16>,
-
-  /// Inclusive minimum stream speed, in rows-per-frame. Lower = slower.
-  #[serde(default)]
-  pub min_speed: Option<f32>,
-
-  /// Inclusive maximum stream speed, in rows-per-frame.
-  #[serde(default)]
-  pub max_speed: Option<f32>,
-
-  /// Per-cell, per-frame probability of a glyph mutating (the faint trail
-  /// shimmer). `0.0` disables.
-  #[serde(default)]
-  pub mutate_chance: Option<f32>,
-}
-
-/// Greeting alignment options
-#[derive(Debug, Clone, Deserialize, Serialize, Default, PartialEq, Eq)]
-#[serde(rename_all = "snake_case")]
-pub enum AlignGreeting {
-  Left,
-  #[default]
-  Center,
-  Right,
-}
-
-/// Secret display modes
-#[derive(Debug, Clone, Deserialize, Serialize, Default, PartialEq, Eq)]
-#[serde(rename_all = "snake_case")]
-pub enum SecretMode {
-  #[default]
-  Hidden,
-  Characters,
-}
-
-/// Widget position options
-#[derive(Debug, Clone, Deserialize, Serialize, Default, PartialEq, Eq)]
-#[serde(rename_all = "snake_case")]
-pub enum WidgetPosition {
-  #[default]
-  Default,
-  Top,
-  Bottom,
-  Hidden,
-}
-
-// Default value functions
-const fn default_true() -> bool {
-  true
-}
-
-const fn default_show_title() -> bool {
-  true
-}
-
-fn default_log_file() -> String {
-  "/tmp/tuigreet.log".to_string()
-}
-
-fn default_sessions_dirs() -> Vec<String> {
-  vec!["/usr/share/wayland-sessions".to_string()]
-}
-
-fn default_xsessions_dirs() -> Vec<String> {
-  vec!["/usr/share/xsessions".to_string()]
-}
-
-fn default_xsession_wrapper() -> Option<String> {
-  Some("startx /usr/bin/env".to_string())
-}
-
-const fn default_min_uid() -> u32 {
-  1000
-}
-
-const fn default_max_uid() -> u32 {
-  60000
-}
-
-fn default_secret_characters() -> String {
-  "*".to_string()
-}
-
-const fn default_width() -> u16 {
-  80
-}
-
-const fn default_use_setsid() -> bool {
-  true
-}
-
-const fn default_kb_command() -> u8 {
-  2
-}
-
-const fn default_kb_sessions() -> u8 {
-  3
-}
-
-const fn default_kb_power() -> u8 {
-  12
-}
-
-const fn default_kb_background() -> u8 {
-  4
-}
diff --git a/crates/tuigreet-config/src/tests.rs b/crates/tuigreet-config/src/tests.rs
new file mode 100644
index 0000000..be41e03
--- /dev/null
+++ b/crates/tuigreet-config/src/tests.rs
@@ -0,0 +1,582 @@
+#[cfg(test)]
+mod tests {
+  use figment::Jail;
+  use tuigreet_types::DEFAULT_LOG_FILE;
+
+  use crate::loader::load_config_from;
+
+  /// No TOML, no env, no CLI args beyond program name -> pure clap defaults.
+  #[test]
+  fn defaults_when_nothing_provided() {
+    Jail::expect_with(|_jail| {
+      let (cfg, warnings) = load_config_from(["tuigreet"]).unwrap();
+
+      assert!(!cfg.general.debug);
+      assert_eq!(cfg.general.log_file, DEFAULT_LOG_FILE.to_string());
+      assert_eq!(cfg.general.numlock, false);
+      assert!(warnings.is_empty(), "Expected no warnings");
+
+      Ok(())
+    });
+  }
+  // #[test]
+  // fn test_env_vars_processed_once_with_multiple_theme_components() {
+  // unsafe {
+  // env::set_var("TUIGREET_THEME", "border=red;text=blue;container=green");
+  // env::set_var("TUIGREET_SESSIONS_DIRS", "/test:/usr/share");
+  // env::set_var("TUIGREET_ALIGN_GREETING", "center");
+  // }
+  //
+  // let config = load_env_variables();
+  //
+  // Verify all theme components applied
+  // assert_eq!(config.theme.border, Some("red".to_string()));
+  // assert_eq!(config.theme.text, Some("blue".to_string()));
+  // assert_eq!(config.theme.container, Some("green".to_string()));
+  //
+  // Verify other env vars applied correctly (once, not per-component)
+  // assert_eq!(config.session.sessions_dirs, vec![
+  // "/test".to_string(),
+  // "/usr/share".to_string()
+  // ]);
+  // assert_eq!(config.display.align_greeting, AlignGreeting::Center);
+  //
+  // unsafe {
+  // env::remove_var("TUIGREET_THEME");
+  // env::remove_var("TUIGREET_SESSIONS_DIRS");
+  // env::remove_var("TUIGREET_ALIGN_GREETING");
+  // }
+  // }
+  // #[test]
+  // fn toml_layers_preserve_explicit_default_values() {
+  // let mut system: toml::Table =
+  // toml::from_str("[display]\nshow_time = true\n[layout]\nwidth = 120\n")
+  // .expect("system config is valid");
+  // let user: toml::Table =
+  // toml::from_str("[display]\nshow_time = false\n[layout]\nwidth = 80\n")
+  // .expect("user config is valid");
+  //
+  // merge_toml_tables(&mut system, user);
+  // let config: Config = toml::Value::Table(system)
+  // .try_into()
+  // .expect("merged config is valid");
+  //
+  // assert!(!config.display.show_time);
+  // assert_eq!(config.layout.width, 80);
+  // }
+  //
+  // #[test]
+  // fn canonical_secret_mode_wins_over_legacy_alias() {
+  // let mut config: Config = toml::from_str(
+  // r#"
+  // [display]
+  // asterisks = true
+  //
+  // [secret]
+  // mode = "hidden"
+  // "#,
+  // )
+  // .expect("configuration must parse");
+  // config.secret_mode_specified = true;
+  //
+  // normalize_legacy_asterisks(&mut config);
+  //
+  // assert_eq!(config.secret.mode, SecretMode::Hidden);
+  // }
+  //
+  // #[test]
+  // fn legacy_false_overrides_a_lower_characters_layer() {
+  // let mut resolved = Config::default();
+  // resolved.secret.mode = SecretMode::Characters;
+  //
+  // let mut legacy_layer = Config::default();
+  // legacy_layer.display.asterisks = Some(false);
+  // apply_config_layer(&mut resolved, legacy_layer);
+  //
+  // assert_eq!(resolved.secret.mode, SecretMode::Hidden);
+  // assert!(
+  // resolved
+  // .validate(false)
+  // .expect("legacy configuration is valid")
+  // .iter()
+  // .any(|warning| warning.contains("display.asterisks is deprecated"))
+  // );
+  // }
+  //
+  // #[test]
+  // fn canonical_higher_layer_overrides_legacy_alias() {
+  // let mut resolved = Config::default();
+  // resolved.display.asterisks = Some(true);
+  //
+  // let mut canonical_layer = Config::default();
+  // canonical_layer.secret.mode = SecretMode::Hidden;
+  // canonical_layer.secret_mode_specified = true;
+  // apply_config_layer(&mut resolved, canonical_layer);
+  // normalize_legacy_asterisks(&mut resolved);
+  //
+  // assert_eq!(resolved.secret.mode, SecretMode::Hidden);
+  // }
+  //
+  // #[test]
+  // fn test_mutual_exclusive_remember_flags() {
+  // let toml_content = r"
+  // [remember]
+  // username = true
+  // session = true
+  // user_session = true
+  // ";
+  //
+  // let config: Config =
+  // toml::from_str(toml_content).expect("Failed to parse TOML");
+  //
+  // assert!(config.remember.session);
+  // assert!(config.remember.user_session);
+  //
+  // Both flags being set is now a warning, not a hard error, so that the
+  // rest of the config is still applied. user_session takes behavioral
+  // precedence when both are true.
+  // let result = config.validate(false);
+  // assert!(
+  // result.is_ok(),
+  // "Both remember.session and remember.user_session being true should \
+  // produce a warning, not an error"
+  // );
+  //
+  // let warnings = result.unwrap();
+  // assert!(
+  // warnings.iter().any(|w| {
+  // w.contains("remember.session") && w.contains("remember.user_session")
+  // }),
+  // "Expected a warning about conflicting remember options, got: \
+  // {warnings:?}"
+  // );
+  // }
+  //
+  // #[test]
+  // fn test_keybindings_distinctness_in_config() {
+  // let toml_content = r"
+  // [keybindings]
+  // command = 3
+  // sessions = 3
+  // power = 7
+  // ";
+  //
+  // let config: Config =
+  // toml::from_str(toml_content).expect("Failed to parse TOML");
+  // let validation_result = config.validate(false);
+  //
+  // match validation_result {
+  // Err(ConfigError::DuplicateKeybindings) => {},
+  // _ => {
+  // panic!(
+  // "Expected DuplicateKeybindings error, got: {validation_result:?}"
+  // );
+  // },
+  // }
+  // }
+  //
+  // #[test]
+  // fn test_session_config_default_consistency() {
+  // let default_config = Config::default();
+  //
+  // let partial_toml = r#"
+  // [session]
+  // command = "test"
+  // "#;
+  // let partial_config: Config =
+  // toml::from_str(partial_toml).expect("Failed to parse partial TOML");
+  //
+  // assert_eq!(
+  // default_config.session.sessions_dirs,
+  // partial_config.session.sessions_dirs,
+  // "Default and partially deserialized sessions_dirs should match"
+  // );
+  // }
+  //
+  // #[test]
+  // fn test_power_config_default_consistency() {
+  // let default_config = Config::default();
+  //
+  // let partial_toml = r#"
+  // [power]
+  // shutdown = "poweroff"
+  // "#;
+  // let partial_config: Config =
+  // toml::from_str(partial_toml).expect("Failed to parse partial TOML");
+  //
+  // assert_eq!(
+  // default_config.power.use_setsid, partial_config.power.use_setsid,
+  // "Default and partially deserialized use_setsid should match"
+  // );
+  // }
+  //
+  // #[test]
+  // fn test_wrapper_validation_empty_string() {
+  // let empty_wrapper = r#"
+  // [session]
+  // session_wrapper = ""
+  // "#;
+  //
+  // let mut config: Config =
+  // toml::from_str(empty_wrapper).expect("Failed to parse TOML");
+  //
+  // config.session.xsession_wrapper = None;
+  //
+  // let result = config.validate(true);
+  //
+  // assert!(
+  // result.is_err(),
+  // "Empty wrapper command should fail validation"
+  // );
+  // }
+  //
+  // [[outputs]] validation
+  // #[test]
+  // fn test_outputs_toml_roundtrip() {
+  // let toml_content = r#"
+  // [[outputs]]
+  // connector = "DP-1"
+  // primary = true
+  //
+  // [[outputs]]
+  // connector = "HDMI-A-1"
+  // enabled = false
+  // "#;
+  // let config: Config =
+  // toml::from_str(toml_content).expect("Failed to parse [[outputs]] TOML");
+  //
+  // assert_eq!(config.outputs.len(), 2);
+  // assert_eq!(config.outputs[0].connector, "DP-1");
+  // assert!(config.outputs[0].primary);
+  // assert!(config.outputs[0].enabled); // default = true
+  // assert_eq!(config.outputs[1].connector, "HDMI-A-1");
+  // assert!(!config.outputs[1].primary); // default = false
+  // assert!(!config.outputs[1].enabled);
+  //
+  // Validation should pass
+  // assert!(config.validate(false).is_ok());
+  // }
+  //
+  // #[test]
+  // fn test_outputs_multiple_primary_is_error() {
+  // let toml_content = r#"
+  // [[outputs]]
+  // connector = "DP-1"
+  // primary = true
+  //
+  // [[outputs]]
+  // connector = "HDMI-A-1"
+  // primary = true
+  // "#;
+  // let config: Config =
+  // toml::from_str(toml_content).expect("Failed to parse TOML");
+  // let result = config.validate(false);
+  // assert!(
+  // matches!(result, Err(ConfigError::Validation(_))),
+  // "Multiple primary outputs should be a Validation error, got: {result:?}"
+  // );
+  // }
+  //
+  // #[test]
+  // fn test_outputs_empty_connector_is_error() {
+  // let toml_content = r#"
+  // [[outputs]]
+  // connector = ""
+  // "#;
+  // let config: Config =
+  // toml::from_str(toml_content).expect("Failed to parse TOML");
+  // let result = config.validate(false);
+  // assert!(
+  // matches!(result, Err(ConfigError::Validation(_))),
+  // "Empty connector name should be a Validation error, got: {result:?}"
+  // );
+  // }
+  //
+  // #[test]
+  // fn test_outputs_path_separator_in_connector_is_error() {
+  // for bad in &["../DP-1", "/sys/class/drm/DP-1", "foo/bar"] {
+  // let config: Config =
+  // toml::from_str(&format!("[[outputs]]\nconnector = \"{bad}\"\n"))
+  // .expect("Failed to parse TOML");
+  // let result = config.validate(false);
+  // assert!(
+  // matches!(result, Err(ConfigError::Validation(_))),
+  // "Connector '{bad}' with path separator should be a Validation error, \
+  // got: {result:?}"
+  // );
+  // }
+  // }
+  //
+  // #[test]
+  // fn test_outputs_valid_connector_names() {
+  // Typical DRM connector name patterns that must pass
+  // for good in &[
+  // "DP-1",
+  // "HDMI-A-1",
+  // "DisplayPort-2",
+  // "eDP-1",
+  // "VGA-1",
+  // "DVI-D-1",
+  // ] {
+  // let config: Config =
+  // toml::from_str(&format!("[[outputs]]\nconnector = \"{good}\"\n"))
+  // .expect("Failed to parse TOML");
+  // assert!(
+  // config.validate(false).is_ok(),
+  // "Connector '{good}' should be valid, but validation failed"
+  // );
+  // }
+  // }
+  //
+  // #[test]
+  // fn test_outputs_all_disabled_is_warning() {
+  // let toml_content = r#"
+  // [[outputs]]
+  // connector = "DP-1"
+  // enabled = false
+  //
+  // [[outputs]]
+  // connector = "HDMI-A-1"
+  // enabled = false
+  // "#;
+  // let config: Config =
+  // toml::from_str(toml_content).expect("Failed to parse TOML");
+  // let result = config.validate(false);
+  // assert!(
+  // result.is_ok(),
+  // "All-disabled outputs should not be an error"
+  // );
+  // let warnings = result.unwrap();
+  // assert!(
+  // warnings.iter().any(|w| w.contains("enabled = false")),
+  // "Expected a warning about all outputs being disabled, got: {warnings:?}"
+  // );
+  // }
+  //
+  // #[test]
+  // fn test_outputs_single_primary_passes() {
+  // let toml_content = r#"
+  // [[outputs]]
+  // connector = "DP-1"
+  // primary = true
+  //
+  // [[outputs]]
+  // connector = "HDMI-A-1"
+  // "#;
+  // let config: Config =
+  // toml::from_str(toml_content).expect("Failed to parse TOML");
+  // assert!(config.validate(false).is_ok());
+  // }
+  //
+  // [terminal] validation
+  // #[test]
+  // fn test_terminal_both_set_passes() {
+  // let toml_content = r"
+  // [terminal]
+  // cols = 237
+  // rows = 52
+  // ";
+  // let config: Config =
+  // toml::from_str(toml_content).expect("Failed to parse TOML");
+  // assert_eq!(config.terminal.cols, Some(237));
+  // assert_eq!(config.terminal.rows, Some(52));
+  // assert!(config.validate(false).is_ok());
+  // }
+  //
+  // #[test]
+  // fn test_terminal_cols_without_rows_is_error() {
+  // let toml_content = r"
+  // [terminal]
+  // cols = 237
+  // ";
+  // let config: Config =
+  // toml::from_str(toml_content).expect("Failed to parse TOML");
+  // let result = config.validate(false);
+  // assert!(
+  // matches!(result, Err(ConfigError::Validation(_))),
+  // "cols without rows should be a Validation error, got: {result:?}"
+  // );
+  // }
+  //
+  // #[test]
+  // fn test_terminal_rows_without_cols_is_error() {
+  // let toml_content = r"
+  // [terminal]
+  // rows = 52
+  // ";
+  // let config: Config =
+  // toml::from_str(toml_content).expect("Failed to parse TOML");
+  // let result = config.validate(false);
+  // assert!(
+  // matches!(result, Err(ConfigError::Validation(_))),
+  // "rows without cols should be a Validation error, got: {result:?}"
+  // );
+  // }
+  //
+  // #[test]
+  // fn test_terminal_neither_set_passes() {
+  // let config = Config::default();
+  // assert!(config.validate(false).is_ok());
+  // }
+  //
+  // #[test]
+  // fn test_terminal_zero_cols_is_error() {
+  // let mut config = Config::default();
+  // config.terminal.cols = Some(0);
+  // config.terminal.rows = Some(52);
+  // let result = config.validate(false);
+  // assert!(
+  // matches!(result, Err(ConfigError::Validation(_))),
+  // "cols = 0 should be a Validation error, got: {result:?}"
+  // );
+  // }
+  //
+  // #[test]
+  // fn test_terminal_zero_rows_is_error() {
+  // let mut config = Config::default();
+  // config.terminal.cols = Some(237);
+  // config.terminal.rows = Some(0);
+  // let result = config.validate(false);
+  // assert!(
+  // matches!(result, Err(ConfigError::Validation(_))),
+  // "rows = 0 should be a Validation error, got: {result:?}"
+  // );
+  // }
+  //
+  // #[test]
+  // fn test_wrapper_validation_whitespace_only() {
+  // let whitespace_wrapper = r#"
+  // [session]
+  // session_wrapper = "   "
+  // "#;
+  //
+  // let mut config: Config =
+  // toml::from_str(whitespace_wrapper).expect("Failed to parse TOML");
+  //
+  // config.session.xsession_wrapper = None;
+  //
+  // let result = config.validate(true);
+  //
+  // assert!(
+  // result.is_err(),
+  // "Whitespace-only wrapper command should fail validation"
+  // );
+  // }
+  //
+  // Config priority tests
+  //
+  // #[test]
+  // fn test_cli_only_no_config() {
+  // let mut config = Config::default();
+  //
+  // let mut cli = Config::default();
+  // cli.keybindings.sessions = 5;
+  //
+  // apply_config_layer(&mut config, cli);
+  //
+  // assert_eq!(config.keybindings.sessions, 5);
+  // }
+  //
+  // #[test]
+  // fn test_config_overrides_defaults() {
+  // let mut config = Config::default();
+  //
+  // let mut file_config = Config::default();
+  // file_config.keybindings.command = 3;
+  //
+  // apply_config_layer(&mut config, file_config);
+  //
+  // assert_eq!(config.keybindings.command, 3);
+  // }
+  //
+  // #[test]
+  // fn test_user_overrides_system() {
+  // let mut config = Config::default();
+  // config.keybindings.command = 5;
+  //
+  // let mut user = Config::default();
+  // user.keybindings.command = 7;
+  //
+  // apply_config_layer(&mut config, user);
+  //
+  // assert_eq!(config.keybindings.command, 7);
+  // }
+  //
+  // #[test]
+  // fn test_env_overrides_user() {
+  // let mut config = Config::default();
+  // config.keybindings.power = 10;
+  //
+  // let mut env = Config::default();
+  // env.keybindings.power = 8;
+  //
+  // apply_config_layer(&mut config, env);
+  //
+  // assert_eq!(config.keybindings.power, 8);
+  // }
+  //
+  // #[test]
+  // fn test_cli_overrides_env() {
+  // let mut config = Config::default();
+  // config.keybindings.sessions = 3;
+  //
+  // let mut cli = Config::default();
+  // cli.keybindings.sessions = 9;
+  //
+  // apply_config_layer(&mut config, cli);
+  //
+  // assert_eq!(config.keybindings.sessions, 9);
+  // }
+  //
+  // #[test]
+  // fn test_full_priority_chain() {
+  // let mut config = Config::default();
+  // assert_eq!(config.keybindings.command, 2);
+  //
+  // let mut system = Config::default();
+  // system.keybindings.command = 5;
+  // apply_config_layer(&mut config, system);
+  // assert_eq!(config.keybindings.command, 5);
+  //
+  // let mut user = Config::default();
+  // user.keybindings.command = 7;
+  // apply_config_layer(&mut config, user);
+  // assert_eq!(config.keybindings.command, 7);
+  //
+  // let mut env = Config::default();
+  // env.keybindings.command = 9;
+  // apply_config_layer(&mut config, env);
+  // assert_eq!(config.keybindings.command, 9);
+  //
+  // let mut cli = Config::default();
+  // cli.keybindings.command = 11;
+  // apply_config_layer(&mut config, cli);
+  // assert_eq!(config.keybindings.command, 11);
+  // }
+  //
+  // #[test]
+  // fn test_lower_layer_preserved_when_higher_layer_uses_defaults() {
+  // System config sets a non-default value
+  // let mut config = Config::default();
+  // config.keybindings.power = 10;
+  // config.display.show_time = true;
+  // config.remember.username = true;
+  //
+  // User config only touches one unrelated field; all others remain at
+  // their defaults and must NOT overwrite the system values above.
+  // let mut user = Config::default();
+  // user.display.greeting = Some("hello".to_string());
+  // apply_config_layer(&mut config, user);
+  //
+  // assert_eq!(
+  // config.keybindings.power, 10,
+  // "system keybinding must survive"
+  // );
+  // assert!(config.display.show_time, "system show_time must survive");
+  // assert!(
+  // config.remember.username,
+  // "system remember.username must survive"
+  // );
+  // assert_eq!(config.display.greeting, Some("hello".to_string()));
+  // }
+}
diff --git a/crates/tuigreet-config/src/validation.rs b/crates/tuigreet-config/src/validation.rs
new file mode 100644
index 0000000..cf51be3
--- /dev/null
+++ b/crates/tuigreet-config/src/validation.rs
@@ -0,0 +1,409 @@
+use std::{
+  collections::HashSet,
+  fs,
+  path::{Path, PathBuf},
+};
+
+use crate::{
+  config::{Config, SecretMode, WidgetPosition},
+  error::ConfigError,
+};
+
+impl Config {
+  /// Validates rules on the fully-resolved config, after TOML,
+  /// env, and CLI are merged
+  ///
+  /// Returns non-fatal configuration warnings when validation succeeds.
+  ///
+  /// # Errors
+  ///
+  /// Returns an error when mutually exclusive settings, invalid ranges,
+  /// malformed values, or invalid wrapper commands are configured.
+  pub fn validate(
+    &self,
+    validate_wrappers: bool,
+  ) -> Result<Vec<ConfigError>, (Vec<ConfigError>, Vec<ConfigError>)> {
+    let mut errors = Vec::new();
+    let mut warnings = Vec::new();
+
+    // Check mutually exclusive options
+    if self.display.issue && self.display.greeting.is_some() {
+      errors.push(ConfigError::MutuallyExclusive(
+        "display.issue".to_string(),
+        "display.greeting".to_string(),
+      ));
+    }
+
+    // Check dependencies
+    if self.remember.user_session && !self.remember.username {
+      errors.push(ConfigError::Dependency(
+        "remember.user_session requires remember.username".to_string(),
+      ));
+    }
+
+    // Check UID ranges
+    if self.user_menu.min_uid > self.user_menu.max_uid {
+      errors.push(ConfigError::InvalidRange(
+        "user_menu.min_uid must not exceed user_menu.max_uid".to_string(),
+      ));
+    }
+
+    if self.layout.width == 0 {
+      errors.push(ConfigError::Validation(
+        "layout.width must be greater than 0".to_string(),
+      ));
+    }
+    for (name, padding) in [
+      ("layout.window_padding", self.layout.window_padding),
+      ("layout.container_padding", self.layout.container_padding),
+      ("layout.prompt_padding", self.layout.prompt_padding),
+    ] {
+      if padding > 10 {
+        errors.push(ConfigError::Validation(format!(
+          "{name} must not exceed 10"
+        )));
+      }
+    }
+
+    // Check keybindings are distinct
+    let keys = [
+      self.keybindings.command,
+      self.keybindings.sessions,
+      self.keybindings.power,
+      self.keybindings.background,
+    ];
+    if keys.iter().collect::<HashSet<_>>().len() != keys.len() {
+      errors.push(ConfigError::DuplicateKeybindings);
+    }
+
+    // Check F-key ranges
+    for (name, key) in [
+      ("command", self.keybindings.command),
+      ("sessions", self.keybindings.sessions),
+      ("power", self.keybindings.power),
+      ("background", self.keybindings.background),
+    ] {
+      if !(1..=12).contains(&key) {
+        errors.push(ConfigError::InvalidFKey(name.to_string(), key));
+      }
+    }
+
+    // Validate time format if provided
+    if let Some(ref format) = self.display.time_format
+      && chrono::format::StrftimeItems::new(format)
+        .any(|item| matches!(item, chrono::format::Item::Error))
+    {
+      errors.push(ConfigError::InvalidTimeFormat);
+    }
+
+    // Validate session wrapper executables if requested
+    if validate_wrappers {
+      if let Some(ref wrapper) = self.session.session_wrapper
+        && let Some(error) = self.validate_wrapper_command(wrapper)
+      {
+        errors.push(error);
+      }
+      if !self.session.xsession_wrapper.is_empty()
+        && let Some(error) =
+          self.validate_wrapper_command(&self.session.xsession_wrapper)
+      {
+        errors.push(error);
+      }
+    }
+
+    // Validate [[outputs]] entries
+    {
+      let primary_count = self.outputs.iter().filter(|o| o.primary).count();
+      if primary_count > 1 {
+        errors.push(ConfigError::Validation(format!(
+          "At most one output may be marked `primary = true`, but \
+           {primary_count} are"
+        )));
+      }
+
+      for output in &self.outputs {
+        if output.connector.contains('/') || output.connector.contains("..") {
+          errors.push(ConfigError::Validation(format!(
+            "Output connector name '{}' must not contain path separators",
+            output.connector
+          )));
+        }
+        if output.connector.is_empty() {
+          errors.push(ConfigError::Validation(
+            "Output connector name must not be empty".to_string(),
+          ));
+        }
+      }
+
+      // Warn if [[outputs]] is configured but all are disabled
+      if !self.outputs.is_empty() && self.outputs.iter().all(|o| !o.enabled) {
+        warnings.push(ConfigError::Warning(
+          "All [[outputs]] entries have `enabled = false`; no output will be \
+           used for terminal sizing"
+            .to_string(),
+        ));
+      }
+    }
+    if self.secret.mode == SecretMode::Characters
+      && self.secret.characters.is_empty()
+    {
+      errors.push(ConfigError::Validation(
+        "When using characters secret mode, cannot have empty secret \
+         characters"
+          .to_string(),
+      ));
+    }
+
+    for env in &self.session.environments {
+      if !env.contains('=') {
+        errors.push(ConfigError::Validation(format!(
+          "malformed environment variable definition for '{env}'"
+        )));
+      }
+    }
+
+    // Validate [terminal].
+    // Both cols and rows must be set together
+    match (self.terminal.cols, self.terminal.rows) {
+      (Some(_), None) => {
+        errors.push(ConfigError::Validation(
+          "`terminal.cols` is set but `terminal.rows` is missing; both must \
+           be provided together"
+            .to_string(),
+        ));
+      },
+      (None, Some(_)) => {
+        errors.push(ConfigError::Validation(
+          "`terminal.rows` is set but `terminal.cols` is missing; both must \
+           be provided together"
+            .to_string(),
+        ));
+      },
+      (Some(0), Some(_)) => {
+        errors.push(ConfigError::Validation(
+          "`terminal.cols` must be greater than 0".to_string(),
+        ));
+      },
+      (Some(_), Some(0)) => {
+        errors.push(ConfigError::Validation(
+          "`terminal.rows` must be greater than 0".to_string(),
+        ));
+      },
+      _ => (),
+    }
+
+    // Add validation warnings for potentially problematic configurations
+    warnings.extend(self.check_warnings());
+
+    if errors.is_empty() {
+      Ok(warnings)
+    } else {
+      Err((errors, warnings))
+    }
+  }
+
+  /// Check for configuration warnings
+  fn check_warnings(&self) -> Vec<ConfigError> {
+    let mut warnings = Vec::new();
+    // Warn about excessively high padding values
+    if self.layout.window_padding > 10 {
+      warnings.push(ConfigError::Warning(format!(
+        "window_padding is very high ({}), this may cause display issues",
+        self.layout.window_padding
+      )));
+    }
+
+    if self.layout.container_padding > 10 {
+      warnings.push(ConfigError::Warning(format!(
+        "container_padding is very high ({}), this may cause display issues",
+        self.layout.container_padding
+      )));
+    }
+
+    // Warn about very wide width settings
+    if self.layout.width > 200 {
+      warnings.push(ConfigError::Warning(format!(
+        "width is very high ({}), this may cause display issues on smaller \
+         terminals",
+        self.layout.width
+      )));
+    }
+
+    // Warn if user menu is enabled but UID range might be empty
+    if self.user_menu.enabled && self.user_menu.min_uid > 65000 {
+      warnings.push(ConfigError::Warning(
+        "user_menu.min_uid is very high, you may not see any users".to_string(),
+      ));
+    }
+
+    // Warn about potentially conflicting session directories
+    let mut all_session_dirs = self.session.sessions_dirs.clone();
+    all_session_dirs.extend(self.session.xsessions_dirs.clone());
+
+    if all_session_dirs.len()
+      != all_session_dirs
+        .iter()
+        .collect::<std::collections::HashSet<_>>()
+        .len()
+    {
+      warnings.push(ConfigError::Warning(
+        "Duplicate session directories detected in sessions_dirs and \
+         xsessions_dirs"
+          .to_string(),
+      ));
+    }
+
+    // Warn about hidden widgets but enabled features
+    if matches!(self.layout.widgets.time_position, WidgetPosition::Hidden)
+      && self.display.show_time
+    {
+      warnings.push(ConfigError::Warning(
+        "time widget is hidden but show_time is enabled".to_string(),
+      ));
+    }
+
+    // Warn about potential security issues with power commands
+    if let Some(ref cmd) = self.power.shutdown
+      && !self.power.use_setsid
+      && !cmd.contains("sudo")
+      && !cmd.contains("doas")
+    {
+      warnings.push(ConfigError::Warning(
+        "shutdown command without setsid or privilege escalation may fail"
+          .to_string(),
+      ));
+    }
+
+    if let Some(ref cmd) = self.power.reboot
+      && !self.power.use_setsid
+      && !cmd.contains("sudo")
+      && !cmd.contains("doas")
+    {
+      warnings.push(ConfigError::Warning(
+        "reboot command without setsid or privilege escalation may fail"
+          .to_string(),
+      ));
+    }
+
+    if let Some(ref cmd) = self.power.suspend
+      && !self.power.use_setsid
+      && !cmd.contains("sudo")
+      && !cmd.contains("doas")
+    {
+      warnings.push(ConfigError::Warning(
+        "suspend command without setsid or privilege escalation may fail"
+          .to_string(),
+      ));
+    }
+
+    if let Some(ref cmd) = self.power.hibernate
+      && !self.power.use_setsid
+      && !cmd.contains("sudo")
+      && !cmd.contains("doas")
+    {
+      warnings.push(ConfigError::Warning(
+        "hibernate command without setsid or privilege escalation may fail"
+          .to_string(),
+      ));
+    }
+
+    // Warn about empty session directories
+    if self.session.sessions_dirs.is_empty()
+      && self.session.xsessions_dirs.is_empty()
+    {
+      warnings.push(ConfigError::Warning(
+        "No session directories configured, users may not be able to select \
+         sessions"
+          .to_string(),
+      ));
+    }
+
+    // Warn about potentially invalid time formats
+    if let Some(ref format) = self.display.time_format
+      && format.is_empty()
+    {
+      warnings.push(ConfigError::Warning(
+        "time_format is empty, this will result in no time display".to_string(),
+      ));
+    }
+
+    // Warn about conflicting remember options
+    if self.remember.session && self.remember.user_session {
+      // This should be caught as an error above, but just in case
+      warnings.push(ConfigError::Warning(
+        "Both remember.session and remember.user_session are enabled"
+          .to_string(),
+      ));
+    }
+
+    // Warn about invalid fps settings
+    if self.background.fps == 0 {
+      warnings.push(ConfigError::Warning(
+        "Background fps is set to 0, this will be ignored".to_string(),
+      ));
+    }
+    warnings
+  }
+
+  /// Validate that a wrapper command exists and is executable
+  fn validate_wrapper_command(&self, command: &str) -> Option<ConfigError> {
+    let trimmed = command.trim();
+    if trimmed.is_empty() {
+      return Some(ConfigError::WrapperExecutableNotFound(PathBuf::from(
+        command,
+      )));
+    }
+
+    let parts: Vec<&str> = trimmed.split_whitespace().collect();
+    if let Some(executable) = parts.first() {
+      // Check if it's an absolute path
+      let path = PathBuf::from(executable);
+      if path.is_absolute() {
+        if !path.exists() || !is_executable(&path) {
+          return Some(ConfigError::WrapperExecutableNotFound(path));
+        }
+      } else {
+        // Search in PATH
+        if !command_exists(executable) {
+          return Some(ConfigError::WrapperExecutableNotFound(PathBuf::from(
+            executable,
+          )));
+        }
+      }
+    }
+    None
+  }
+}
+
+/// Check if a file is executable
+fn is_executable(path: &Path) -> bool {
+  #[cfg(unix)]
+  {
+    use std::os::unix::fs::PermissionsExt;
+    if let Ok(metadata) = fs::metadata(path) {
+      let permissions = metadata.permissions();
+      return permissions.mode() & 0o111 != 0;
+    }
+  }
+
+  #[cfg(not(unix))]
+  {
+    // On non-Unix systems, just check if file exists
+    return path.exists();
+  }
+
+  false
+}
+
+/// Check if a command exists in PATH
+fn command_exists(command: &str) -> bool {
+  if let Ok(path) = std::env::var("PATH") {
+    for dir in std::env::split_paths(&path) {
+      let full_path = dir.join(command);
+      if full_path.exists() && is_executable(&full_path) {
+        return true;
+      }
+    }
+  }
+  false
+}
diff --git a/crates/tuigreet-system/src/lib.rs b/crates/tuigreet-system/src/lib.rs
index 5a7bddf..d668f0d 100644
--- a/crates/tuigreet-system/src/lib.rs
+++ b/crates/tuigreet-system/src/lib.rs
@@ -8,7 +8,7 @@
 use std::{fs, process};
 
 #[cfg(not(test))]
-use tuigreet_config::{OutputConfig, TerminalConfig};
+use tuigreet_config::config::{OutputConfig, TerminalConfig};
 
 /// Raw FFI bindings for the two terminal-sizing ioctls.
 ///
diff --git a/crates/tuigreet-theme/src/config.rs b/crates/tuigreet-theme/src/config.rs
deleted file mode 100644
index 763fabc..0000000
--- a/crates/tuigreet-theme/src/config.rs
+++ /dev/null
@@ -1,83 +0,0 @@
-use tuigreet_config::ThemeConfig;
-
-use crate::Theme;
-
-/// Parse theme from TOML configuration.
-///
-/// # Arguments
-///
-/// * `theme_config` - Theme configuration from TOML file
-///
-/// # Returns
-///
-/// Theme with colors specified in config, defaulting unspecified elements
-#[must_use]
-pub fn theme_from_config(theme_config: &ThemeConfig) -> Theme {
-  let mut theme = Theme::default();
-
-  // Build theme spec string from config
-  let mut spec_parts = Vec::new();
-
-  if let Some(ref color) = theme_config.border {
-    spec_parts.push(format!("border={color}"));
-  }
-  if let Some(ref color) = theme_config.text {
-    spec_parts.push(format!("text={color}"));
-  }
-  if let Some(ref color) = theme_config.time {
-    spec_parts.push(format!("time={color}"));
-  }
-  if let Some(ref color) = theme_config.container {
-    spec_parts.push(format!("container={color}"));
-  }
-  if let Some(ref color) = theme_config.title {
-    spec_parts.push(format!("title={color}"));
-  }
-  if let Some(ref color) = theme_config.greet {
-    spec_parts.push(format!("greet={color}"));
-  }
-  if let Some(ref color) = theme_config.prompt {
-    spec_parts.push(format!("prompt={color}"));
-  }
-  if let Some(ref color) = theme_config.input {
-    spec_parts.push(format!("input={color}"));
-  }
-  if let Some(ref color) = theme_config.action {
-    spec_parts.push(format!("action={color}"));
-  }
-  if let Some(ref color) = theme_config.button {
-    spec_parts.push(format!("button={color}"));
-  }
-
-  if !spec_parts.is_empty() {
-    let spec = spec_parts.join(";");
-    theme = Theme::parse(&spec);
-  }
-
-  theme
-}
-
-/// Apply CLI theme string over config theme.
-///
-/// CLI theme completely overrides config theme if present.
-///
-/// # Arguments
-///
-/// * `base_theme` - Theme from config file
-/// * `cli_theme_spec` - Optional theme string from CLI (e.g., "--theme
-///   border=blue;text=white")
-///
-/// # Returns
-///
-/// CLI theme if specified, otherwise base theme
-#[must_use]
-pub fn apply_cli_theme(
-  mut base_theme: Theme,
-  cli_theme_spec: Option<&str>,
-) -> Theme {
-  if let Some(spec) = cli_theme_spec {
-    // CLI theme completely overrides config theme
-    base_theme = Theme::parse(spec);
-  }
-  base_theme
-}
diff --git a/crates/tuigreet-theme/src/lib.rs b/crates/tuigreet-theme/src/lib.rs
index 5c3320b..1a43129 100644
--- a/crates/tuigreet-theme/src/lib.rs
+++ b/crates/tuigreet-theme/src/lib.rs
@@ -1,6 +1,167 @@
-//! Theme and styling for UI components
+use std::str::FromStr;
 
-pub mod config;
-pub mod style;
+use tui::style::{Color, Style};
+use tuigreet_config::config::ThemeConfig;
 
-pub use style::{Theme, Themed};
+/// Color component (foreground or background)
+#[derive(Clone)]
+enum Component {
+  Bg,
+  Fg,
+}
+
+/// UI element that can be themed
+pub enum Themed {
+  Container,
+  Time,
+  Text,
+  Border,
+  Title,
+  Greet,
+  Prompt,
+  Input,
+  Action,
+  ActionButton,
+}
+
+/// Color theme for all UI elements
+#[derive(Default)]
+pub struct Theme {
+  container: Option<(Component, Color)>,
+  time:      Option<(Component, Color)>,
+  text:      Option<(Component, Color)>,
+  border:    Option<(Component, Color)>,
+  title:     Option<(Component, Color)>,
+  greet:     Option<(Component, Color)>,
+  prompt:    Option<(Component, Color)>,
+  input:     Option<(Component, Color)>,
+  action:    Option<(Component, Color)>,
+  button:    Option<(Component, Color)>,
+}
+
+impl Theme {
+  /// Parse theme from ThemeConfig.
+  ///
+  /// * `theme_config` - ThemeConfig struct
+  ///
+  /// # Returns
+  ///
+  /// Theme with parsed colors, using fallbacks for unspecified elements
+  #[must_use]
+  pub fn from_config(theme_config: &ThemeConfig) -> Self {
+    use Component::{Bg, Fg};
+
+    let mut style = Self::default();
+
+    if let Ok(color) =
+      Color::from_str(theme_config.container.as_deref().unwrap_or_default())
+    {
+      style.container = Some((Bg, color));
+    }
+    if let Ok(color) =
+      Color::from_str(theme_config.time.as_deref().unwrap_or_default())
+    {
+      style.time = Some((Fg, color));
+    }
+    if let Ok(color) =
+      Color::from_str(theme_config.border.as_deref().unwrap_or_default())
+    {
+      style.border = Some((Fg, color));
+    }
+    if let Ok(color) =
+      Color::from_str(theme_config.title.as_deref().unwrap_or_default())
+    {
+      style.title = Some((Fg, color));
+    }
+    if let Ok(color) =
+      Color::from_str(theme_config.greet.as_deref().unwrap_or_default())
+    {
+      style.greet = Some((Fg, color));
+    }
+    if let Ok(color) =
+      Color::from_str(theme_config.prompt.as_deref().unwrap_or_default())
+    {
+      style.prompt = Some((Fg, color));
+    }
+    if let Ok(color) =
+      Color::from_str(theme_config.input.as_deref().unwrap_or_default())
+    {
+      style.input = Some((Fg, color));
+    }
+    if let Ok(color) =
+      Color::from_str(theme_config.action.as_deref().unwrap_or_default())
+    {
+      style.action = Some((Fg, color));
+    }
+    if let Ok(color) =
+      Color::from_str(theme_config.button.as_deref().unwrap_or_default())
+    {
+      style.button = Some((Fg, color));
+    }
+
+    if style.time.is_none() {
+      style.time.clone_from(&style.text);
+    }
+    if style.greet.is_none() {
+      style.greet.clone_from(&style.text);
+    }
+    if style.title.is_none() {
+      style.title.clone_from(&style.border);
+    }
+    if style.button.is_none() {
+      style.button.clone_from(&style.action);
+    }
+
+    style
+  }
+
+  /// Builds a style by applying each target's configured color in order.
+  ///
+  /// Later targets override earlier targets when they affect the same style
+  /// property.
+  #[must_use]
+  pub fn of(&self, targets: &[Themed]) -> Style {
+    targets
+      .iter()
+      .fold(Style::default(), |style, target| self.apply(style, target))
+  }
+
+  const fn apply(&self, style: Style, target: &Themed) -> Style {
+    use Themed::{
+      Action,
+      ActionButton,
+      Border,
+      Container,
+      Greet,
+      Input,
+      Prompt,
+      Text,
+      Time,
+      Title,
+    };
+
+    let color = match target {
+      Container => &self.container,
+      Time => &self.time,
+      Text => &self.text,
+      Border => &self.border,
+      Title => &self.title,
+      Greet => &self.greet,
+      Prompt => &self.prompt,
+      Input => &self.input,
+      Action => &self.action,
+      ActionButton => &self.button,
+    };
+
+    match color {
+      Some((component, color)) => {
+        match component {
+          Component::Fg => style.fg(*color),
+          Component::Bg => style.bg(*color),
+        }
+      },
+
+      None => style,
+    }
+  }
+}
diff --git a/crates/tuigreet-theme/src/style.rs b/crates/tuigreet-theme/src/style.rs
deleted file mode 100644
index 3649cc5..0000000
--- a/crates/tuigreet-theme/src/style.rs
+++ /dev/null
@@ -1,148 +0,0 @@
-use std::str::FromStr;
-
-use tui::style::{Color, Style};
-
-/// Color component (foreground or background)
-#[derive(Clone)]
-enum Component {
-  Bg,
-  Fg,
-}
-
-/// UI element that can be themed
-pub enum Themed {
-  Container,
-  Time,
-  Text,
-  Border,
-  Title,
-  Greet,
-  Prompt,
-  Input,
-  Action,
-  ActionButton,
-}
-
-/// Color theme for all UI elements
-#[derive(Default)]
-pub struct Theme {
-  container: Option<(Component, Color)>,
-  time:      Option<(Component, Color)>,
-  text:      Option<(Component, Color)>,
-  border:    Option<(Component, Color)>,
-  title:     Option<(Component, Color)>,
-  greet:     Option<(Component, Color)>,
-  prompt:    Option<(Component, Color)>,
-  input:     Option<(Component, Color)>,
-  action:    Option<(Component, Color)>,
-  button:    Option<(Component, Color)>,
-}
-
-impl Theme {
-  /// Parse theme from CLI format string.
-  ///
-  /// # Format
-  ///
-  /// Semicolon-separated key=value pairs:
-  /// "container=black;text=white;border=blue"
-  ///
-  /// # Arguments
-  ///
-  /// * `spec` - Theme specification string
-  ///
-  /// # Returns
-  ///
-  /// Theme with parsed colors, using fallbacks for unspecified elements
-  #[must_use]
-  pub fn parse(spec: &str) -> Self {
-    use Component::{Bg, Fg};
-
-    let directives = spec
-      .split(';')
-      .filter_map(|directive| directive.split_once('='));
-    let mut style = Self::default();
-
-    for (key, value) in directives {
-      if let Ok(color) = Color::from_str(value) {
-        match key {
-          "container" => style.container = Some((Bg, color)),
-          "time" => style.time = Some((Fg, color)),
-          "text" => style.text = Some((Fg, color)),
-          "border" => style.border = Some((Fg, color)),
-          "title" => style.title = Some((Fg, color)),
-          "greet" => style.greet = Some((Fg, color)),
-          "prompt" => style.prompt = Some((Fg, color)),
-          "input" => style.input = Some((Fg, color)),
-          "action" => style.action = Some((Fg, color)),
-          "button" => style.button = Some((Fg, color)),
-          _ => {},
-        }
-      }
-    }
-
-    if style.time.is_none() {
-      style.time.clone_from(&style.text);
-    }
-    if style.greet.is_none() {
-      style.greet.clone_from(&style.text);
-    }
-    if style.title.is_none() {
-      style.title.clone_from(&style.border);
-    }
-    if style.button.is_none() {
-      style.button.clone_from(&style.action);
-    }
-
-    style
-  }
-
-  /// Builds a style by applying each target's configured color in order.
-  ///
-  /// Later targets override earlier targets when they affect the same style
-  /// property.
-  #[must_use]
-  pub fn of(&self, targets: &[Themed]) -> Style {
-    targets
-      .iter()
-      .fold(Style::default(), |style, target| self.apply(style, target))
-  }
-
-  const fn apply(&self, style: Style, target: &Themed) -> Style {
-    use Themed::{
-      Action,
-      ActionButton,
-      Border,
-      Container,
-      Greet,
-      Input,
-      Prompt,
-      Text,
-      Time,
-      Title,
-    };
-
-    let color = match target {
-      Container => &self.container,
-      Time => &self.time,
-      Text => &self.text,
-      Border => &self.border,
-      Title => &self.title,
-      Greet => &self.greet,
-      Prompt => &self.prompt,
-      Input => &self.input,
-      Action => &self.action,
-      ActionButton => &self.button,
-    };
-
-    match color {
-      Some((component, color)) => {
-        match component {
-          Component::Fg => style.fg(*color),
-          Component::Bg => style.bg(*color),
-        }
-      },
-
-      None => style,
-    }
-  }
-}
diff --git a/crates/tuigreet-types/src/lib.rs b/crates/tuigreet-types/src/lib.rs
index 37e510b..ed5c25e 100644
--- a/crates/tuigreet-types/src/lib.rs
+++ b/crates/tuigreet-types/src/lib.rs
@@ -1,8 +1,13 @@
 use std::{
   error::Error,
   fmt::{self, Display},
+  path::PathBuf,
 };
 
+/// Default system toml path
+pub const DEFAULT_SYSTEM_TOML_PATH: &str = "/etc/tuigreet/config.toml";
+/// Default user toml path
+pub const DEFAULT_USER_TOML_PATH: &str = "~/.config/tuigreet/config.toml";
 /// Default log file path
 pub const DEFAULT_LOG_FILE: &str = "/tmp/tuigreet.log";
 /// Default asterisk character for password masking
@@ -94,3 +99,16 @@ pub enum GreetAlign {
   /// Right alignment
   Right,
 }
+
+/// to create absolute path from string containing ~ to represent home
+pub fn expand_tilde(path: &str) -> PathBuf {
+  match path.strip_prefix("~/") {
+    Some(rest) => {
+      match std::env::var_os("HOME") {
+        Some(home) => PathBuf::from(home).join(rest),
+        None => PathBuf::from(path),
+      }
+    },
+    None => PathBuf::from(path),
+  }
+}
diff --git a/crates/tuigreet/Cargo.toml b/crates/tuigreet/Cargo.toml
index 0f6e99e..9347d91 100644
--- a/crates/tuigreet/Cargo.toml
+++ b/crates/tuigreet/Cargo.toml
@@ -11,6 +11,11 @@ repository             = "https://github.com/notashelf/tuigreet"
 name = "tuigreet"
 path = "src/main.rs"
 
+# Man page generator
+[[bin]]
+name = "gen-manpage"
+path = "tools/gen-manpage.rs"
+
 [features]
 default    = [  ]
 nsswrapper = [  ]
@@ -24,8 +29,11 @@ tuigreet-types   = { workspace = true }
 
 ansi-to-tui        = { workspace = true }
 chrono             = { workspace = true }
+clap               = { workspace = true }
+clap_mangen        = { workspace = true }
 crossterm          = { workspace = true }
 dirs               = { workspace = true }
+figment            = { workspace = true }
 futures            = { workspace = true }
 getopts            = { workspace = true }
 greetd_ipc         = { workspace = true }
diff --git a/crates/tuigreet/src/greeter.rs b/crates/tuigreet/src/greeter.rs
index 9f19e66..c4927c1 100644
--- a/crates/tuigreet/src/greeter.rs
+++ b/crates/tuigreet/src/greeter.rs
@@ -1,34 +1,20 @@
-use std::{
-  convert::TryInto,
-  env,
-  error::Error,
-  ffi::OsStr,
-  path::PathBuf,
-  process,
-  sync::Arc,
-};
+use std::{convert::TryInto, env, path::PathBuf, process, sync::Arc};
 
-use chrono::{
-  Locale,
-  format::{Item, StrftimeItems},
-};
-use getopts::{Matches, Options};
+use chrono::Locale;
 use i18n_embed::DesktopLanguageRequester;
 use tokio::{
   net::UnixStream,
   sync::{RwLock, RwLockWriteGuard, mpsc::Sender},
 };
 use tracing_appender::non_blocking::WorkerGuard;
-use tuigreet_theme::Theme;
-use tuigreet_types::{
-  AuthStatus,
-  DEFAULT_ASTERISKS_CHARS,
-  DEFAULT_LOG_FILE,
-  DEFAULT_XSESSION_WRAPPER,
-  GreetAlign,
-  Mode,
-  SecretDisplay,
+use tuigreet_config::config::{
+  AlignGreeting,
+  BackgroundConfig,
+  Config,
+  SecretMode,
 };
+use tuigreet_theme::Theme;
+use tuigreet_types::{AuthStatus, GreetAlign, Mode, SecretDisplay};
 use zeroize::Zeroize;
 
 use crate::{
@@ -41,9 +27,7 @@ use crate::{
     get_last_user_name,
     get_last_user_session,
     get_last_user_username,
-    get_min_max_uids,
     get_sessions,
-    get_users,
   },
   power::PowerOption,
   ui::{
@@ -65,18 +49,13 @@ const DEFAULT_LOCALE: Locale = Locale::en_US;
 
 /// Core greeter state managing authentication, UI, and session selection.
 pub struct Greeter {
-  pub debug:   bool,
-  pub logfile: String,
-  pub logger:  Option<WorkerGuard>,
-
-  pub numlock:       bool,
-  pub locale:        Locale,
-  pub config:        Option<Matches>,
-  pub loaded_config: Option<tuigreet_config::Config>, /* store loaded TOML
-                                                       * config */
-  pub socket:        String,
-  pub stream:        Option<Arc<RwLock<UnixStream>>>,
-  pub events:        Option<Sender<Event>>,
+  pub logger: Option<WorkerGuard>,
+
+  pub locale: Locale,
+  pub config: Config, // store config
+  pub socket: String,
+  pub stream: Option<Arc<RwLock<UnixStream>>>,
+  pub events: Option<Sender<Event>>,
 
   // Current mode of the application, will define what actions are permitted.
   pub mode:          Mode,
@@ -93,80 +72,38 @@ pub struct Greeter {
   pub buffer:          String,
 
   // Define the selected session and how to resolve it.
-  pub session_source:   SessionSource,
+  pub session_source: SessionSource,
   // List of session files found on disk.
-  pub session_paths:    Vec<(PathBuf, SessionType)>,
+  pub session_paths:  Vec<(PathBuf, SessionType)>,
   // Menu for session selection.
-  pub sessions:         Menu<Session>,
-  // Wrapper command to prepend to non-X11 sessions.
-  pub session_wrapper:  Option<String>,
-  // Wrapper command to prepend to X11 sessions.
-  pub xsession_wrapper: Option<String>,
-
-  // Whether user menu is enabled.
-  pub user_menu:    bool,
+  pub sessions:       Menu<Session>,
+
   // Menu for user selection.
-  pub users:        Menu<User>,
-  // Default user to pre-fill.
-  pub default_user: Option<String>,
+  pub users:    Menu<User>,
   // Current username. Masked to display the full name if available.
-  pub username:     MaskedString,
+  pub username: MaskedString,
   // Prompt that should be displayed to ask for entry.
-  pub prompt:       Option<String>,
+  pub prompt:   Option<String>,
 
   // Whether the current edition prompt should be hidden.
   pub asking_for_secret: bool,
   // How should secrets be displayed?
   pub secret_display:    SecretDisplay,
 
-  // Whether last logged-in user should be remembered.
-  pub remember:              bool,
-  // Whether last launched session (regardless of user) should be remembered.
-  pub remember_session:      bool,
-  // Whether last launched session for the current user should be remembered.
-  pub remember_user_session: bool,
-
   // Style object for the terminal UI
-  pub theme:       Theme,
-  // Display the current time
-  pub time:        bool,
-  // Time format
-  pub time_format: Option<String>,
-  // Display battery percentage
-  pub battery:     bool,
+  pub themeui:  Theme,
   // Greeting message (MOTD) to use to welcome the user.
-  pub greeting:    Option<String>,
-  // Container's title configuration
-  pub title:       TitleOption,
+  pub greeting: Option<String>,
   // Transaction message to show to the user.
-  pub message:     Option<String>,
+  pub message:  Option<String>,
 
   // Menu for power options.
-  pub powers:       Menu<Power>,
-  // Whether to prefix the power commands with `setsid`.
-  pub power_setsid: bool,
-
-  pub kb_command:    u8,
-  pub kb_sessions:   u8,
-  pub kb_power:      u8,
-  pub kb_background: u8,
-
-  pub status_show_reset:          bool,
-  pub status_show_command:        bool,
-  pub status_show_session:        bool,
-  pub status_show_power:          bool,
-  pub status_show_background:     bool,
-  pub status_show_session_status: bool,
-  pub status_show_caps_lock:      bool,
+  pub powers: Menu<Power>,
 
   // Background animation, drawn before the login UI.
-  pub animation:     Option<Box<dyn Animation>>,
-  // Configured animation FPS, when an animation is active.
-  pub animation_fps: Option<u32>,
-  // Skip greetd socket and simulate auth flow locally for UI testing
-  pub mock:          bool,
+  pub animation:   Option<Box<dyn Animation>>,
   // Menu for the on-the-fly background switcher (F4 by default).
-  pub backgrounds:   Menu<Background>,
+  pub backgrounds: Menu<Background>,
 
   // The software is waiting for a response from `greetd`.
   pub working: bool,
@@ -176,66 +113,50 @@ pub struct Greeter {
   pub exit:    Option<AuthStatus>,
 }
 
+impl std::ops::Deref for Greeter {
+  type Target = Config;
+  fn deref(&self) -> &Self::Target {
+    &self.config
+  }
+}
+
+impl std::ops::DerefMut for Greeter {
+  fn deref_mut(&mut self) -> &mut Self::Target {
+    &mut self.config
+  }
+}
+
 impl Default for Greeter {
   fn default() -> Self {
     Self {
-      debug:                      false,
-      logfile:                    DEFAULT_LOG_FILE.to_string(),
-      logger:                     None,
-      numlock:                    false,
-      locale:                     DEFAULT_LOCALE,
-      config:                     None,
-      loaded_config:              None,
-      socket:                     String::new(),
-      stream:                     None,
-      events:                     None,
-      mode:                       Mode::default(),
-      previous_mode:              Mode::default(),
-      cursor_offset:              0,
-      previous_buffer:            None,
-      buffer:                     String::new(),
-      session_source:             SessionSource::default(),
-      session_paths:              Vec::new(),
-      sessions:                   Menu::default(),
-      session_wrapper:            None,
-      xsession_wrapper:           None,
-      user_menu:                  false,
-      users:                      Menu::default(),
-      default_user:               None,
-      username:                   MaskedString::default(),
-      prompt:                     None,
-      asking_for_secret:          false,
-      secret_display:             SecretDisplay::default(),
-      remember:                   false,
-      remember_session:           false,
-      remember_user_session:      false,
-      theme:                      Theme::default(),
-      time:                       false,
-      time_format:                None,
-      battery:                    false,
-      greeting:                   None,
-      title:                      Default::default(),
-      message:                    None,
-      powers:                     Menu::default(),
-      power_setsid:               false,
-      kb_command:                 2,
-      kb_sessions:                3,
-      kb_power:                   12,
-      kb_background:              4,
-      status_show_reset:          true,
-      status_show_command:        true,
-      status_show_session:        true,
-      status_show_power:          true,
-      status_show_background:     true,
-      status_show_session_status: true,
-      status_show_caps_lock:      true,
-      animation:                  None,
-      animation_fps:              None,
-      mock:                       false,
-      backgrounds:                Menu::default(),
-      working:                    false,
-      done:                       false,
-      exit:                       None,
+      logger:            None,
+      locale:            DEFAULT_LOCALE,
+      config:            Config::defaults(),
+      socket:            String::new(),
+      stream:            None,
+      events:            None,
+      mode:              Mode::default(),
+      previous_mode:     Mode::default(),
+      cursor_offset:     0,
+      previous_buffer:   None,
+      buffer:            String::new(),
+      session_source:    SessionSource::default(),
+      session_paths:     Vec::new(),
+      sessions:          Menu::default(),
+      users:             Menu::default(),
+      username:          MaskedString::default(),
+      prompt:            None,
+      asking_for_secret: false,
+      secret_display:    SecretDisplay::default(),
+      themeui:           Theme::default(),
+      greeting:          None,
+      message:           None,
+      powers:            Menu::default(),
+      animation:         None,
+      backgrounds:       Menu::default(),
+      working:           false,
+      done:              false,
+      exit:              None,
     }
   }
 }
@@ -261,87 +182,43 @@ impl Greeter {
 
     #[cfg(not(test))]
     {
-      let args = env::args().collect::<Vec<String>>();
+      let (config, errors, warnings) =
+        match tuigreet_config::loader::load_config() {
+          Ok((config, warnings)) => {
+            tracing::debug!("Config loaded successfully");
+            // Apply config to greeter only if validation passed
+            (config, vec![], warnings)
+          },
+          Err((config, (errors, warnings))) => (config, errors, warnings),
+        };
+      greeter.apply_config(config);
+
+      // Apply terminal sizing based on [[outputs]] / [terminal]
+      // config.  This must happen before the TUI is started so
+      // that ratatui sees the correct terminal dimensions.
+      if !greeter.outputs.is_empty() || greeter.terminal.cols.is_some() {
+        tuigreet_system::apply_output_config(
+          &greeter.outputs,
+          &greeter.terminal,
+        );
+      }
 
-      if let Err(err) = greeter.parse_options(&args).await {
-        eprintln!("{err}");
-        print_usage(Self::options());
+      greeter.logger = crate::init_logger(&greeter);
 
-        process::exit(1);
+      // show config warnings and errors now that the logger is initialized
+      for error in errors {
+        tracing::error!("{}", error);
       }
-
-      // Load configuration after CLI parsing
-      if !greeter.config().opt_present("no-config") {
-        let config_path = greeter
-          .config()
-          .opt_str("config")
-          .map(std::path::PathBuf::from);
-        match tuigreet_config::parser::load_config(
-          config_path.as_deref(),
-          greeter.config.as_ref(),
-        ) {
-          Ok(config) => {
-            // Validate config
-            match config.validate(false) {
-              Ok(warnings) => {
-                for warning in warnings {
-                  tracing::warn!("Config warning: {}", warning);
-                }
-
-                // Apply config to greeter only if validation passed
-                greeter.apply_config(&config);
-
-                // Apply theme config
-                let cli_theme = greeter.config().opt_str("theme");
-                greeter.apply_theme_config(&config.theme, cli_theme.as_deref());
-
-                // Store config for later use
-                greeter.loaded_config = Some(config.clone());
-
-                // Apply terminal sizing based on [[outputs]] / [terminal]
-                // config.  This must happen before the TUI is started so
-                // that ratatui sees the correct terminal dimensions.
-                if !config.outputs.is_empty() || config.terminal.cols.is_some()
-                {
-                  tuigreet_system::apply_output_config(
-                    &config.outputs,
-                    &config.terminal,
-                  );
-                }
-
-                // Handle --dump-config
-                if greeter.config().opt_present("dump-config") {
-                  let toml_str = toml::to_string_pretty(&config)
-                    .unwrap_or_else(|_| {
-                      "# Failed to serialize config".to_string()
-                    });
-                  println!("{toml_str}");
-                  process::exit(0);
-                }
-              },
-              Err(e) => {
-                tracing::error!("Config validation failed: {}", e);
-                tracing::error!(
-                  "Skipping invalid configuration, using CLI options and \
-                   defaults"
-                );
-                // Do not apply invalid config - continue with CLI options
-              },
-            }
-          },
-          Err(e) => {
-            tracing::warn!("Failed to load config: {}", e);
-          },
-        }
+      for warning in warnings {
+        tracing::warn!("{}", warning);
       }
 
-      greeter.logger = crate::init_logger(&greeter);
       greeter.connect().await;
     }
 
     let mut sessions = get_sessions(&greeter).unwrap_or_default();
 
-    if greeter.mock && sessions.is_empty() {
+    if greeter.general.mock && sessions.is_empty() {
       sessions = mock_sessions();
     }
 
@@ -358,18 +235,18 @@ impl Greeter {
     };
 
     // If a default user is specified, use it.
-    if let Some(ref default_user) = greeter.default_user {
+    if let Some(ref default_user) = greeter.remember.default_user {
       greeter.username = MaskedString::from(default_user.clone(), None);
     }
 
     // If we should remember the last logged-in user.
-    if greeter.remember
+    if greeter.remember.username
       && let Some(username) = get_last_user_username()
     {
       greeter.username = MaskedString::from(username, get_last_user_name());
 
       // If, on top of that, we should remember their last session.
-      if greeter.remember_user_session {
+      if greeter.remember.user_session {
         // See if we have the last free-form command from the user.
         if let Ok(command) = get_last_user_command(greeter.username.get()) {
           greeter.session_source = SessionSource::Command(command);
@@ -392,7 +269,7 @@ impl Greeter {
     }
 
     // Same thing, but not user specific.
-    if greeter.remember_session {
+    if greeter.remember.session {
       if let Ok(command) = get_last_command() {
         greeter.session_source =
           SessionSource::Command(command.trim().to_string());
@@ -447,7 +324,7 @@ impl Greeter {
 
   // Connect to `greetd` and return a stream we can safely write to.
   pub async fn connect(&mut self) {
-    if self.mock {
+    if self.general.mock {
       tracing::info!("mock mode: skipping greetd socket connect");
       return;
     }
@@ -474,14 +351,6 @@ impl Greeter {
     }
   }
 
-  #[must_use]
-  pub const fn config(&self) -> &Matches {
-    self
-      .config
-      .as_ref()
-      .expect("config accessed before parse_options")
-  }
-
   pub async fn stream(&self) -> RwLockWriteGuard<'_, UnixStream> {
     self
       .stream
@@ -491,117 +360,13 @@ impl Greeter {
       .await
   }
 
-  #[must_use]
-  pub fn option(&self, name: &str) -> Option<String> {
-    self.config().opt_str(name)
-  }
-
-  #[must_use]
-  pub fn options_multi(&self, name: &str) -> Option<Vec<String>> {
-    if self.config().opt_present(name) {
-      Some(self.config().opt_strs(name))
-    } else {
-      None
-    }
-  }
-
-  // Returns the width of the main window where content is displayed from the
-  // provided arguments.
-  #[must_use]
-  pub fn width(&self) -> u16 {
-    if let Some(value) = self.option("width")
-      && let Ok(width) = value.parse::<u16>()
-    {
-      return width;
-    }
-
-    if let Some(ref config) = self.loaded_config {
-      return config.layout.width;
-    }
-
-    80
-  }
-
-  // Returns the padding of the screen from the provided arguments.
-  #[must_use]
-  pub fn window_padding(&self) -> u16 {
-    // Check CLI override first
-    if let Some(value) = self.option("window-padding")
-      && let Ok(padding) = value.parse::<u16>()
-    {
-      return padding;
-    }
-
-    // Then check loaded config
-    if let Some(ref config) = self.loaded_config
-      && let Some(padding) = config.layout.window_padding
-    {
-      return padding;
-    }
-
-    0
-  }
-
-  // Returns the padding of the main window where content is displayed from the
-  // provided arguments.
-  #[must_use]
-  pub fn container_padding(&self) -> u16 {
-    // Check CLI override first
-    if let Some(value) = self.option("container-padding")
-      && let Ok(padding) = value.parse::<u16>()
-    {
-      return padding.saturating_add(1);
-    }
-
-    // Then check loaded config
-    if let Some(ref config) = self.loaded_config
-      && let Some(padding) = config.layout.container_padding
-    {
-      return padding.saturating_add(1);
-    }
-
-    2
-  }
-
-  // Returns the spacing between each prompt from the provided arguments.
-  #[must_use]
-  pub fn prompt_padding(&self) -> u16 {
-    // Check CLI override first
-    if let Some(value) = self.option("prompt-padding")
-      && let Ok(padding) = value.parse::<u16>()
-    {
-      return padding;
-    }
-
-    // Then check loaded config
-    if let Some(ref config) = self.loaded_config
-      && let Some(padding) = config.layout.prompt_padding
-    {
-      return padding;
-    }
-
-    1
-  }
-
   #[must_use]
   pub fn greet_align(&self) -> GreetAlign {
-    if let Some(value) = self.option("greet-align") {
-      return match value.as_str() {
-        "left" => GreetAlign::Left,
-        "right" => GreetAlign::Right,
-        _ => GreetAlign::Center,
-      };
-    }
-
-    if let Some(ref config) = self.loaded_config {
-      return match config.display.align_greeting {
-        tuigreet_config::AlignGreeting::Left => GreetAlign::Left,
-        tuigreet_config::AlignGreeting::Right => GreetAlign::Right,
-        tuigreet_config::AlignGreeting::Center => GreetAlign::Center,
-      };
+    match self.display.align_greeting {
+      AlignGreeting::Left => GreetAlign::Left,
+      AlignGreeting::Right => GreetAlign::Right,
+      AlignGreeting::Center => GreetAlign::Center,
     }
-
-    GreetAlign::default()
   }
 
   // Sets the locale that will be used for this invocation from environment.
@@ -621,518 +386,6 @@ impl Greeter {
     }
   }
 
-  #[must_use]
-  pub fn options() -> Options {
-    let mut opts = Options::new();
-
-    let xsession_wrapper_desc = format!(
-      "wrapper command to initialize X server and launch X11 sessions \
-       (default: {DEFAULT_XSESSION_WRAPPER})"
-    );
-
-    opts.optflag("h", "help", "show this usage information");
-    opts.optflag("v", "version", "print version information");
-    opts.optflagopt(
-      "d",
-      "debug",
-      "enable debug logging to the provided file, or to /tmp/tuigreet.log",
-      "FILE",
-    );
-    opts.optopt("c", "cmd", "command to run", "COMMAND");
-    opts.optmulti(
-      "",
-      "env",
-      "environment variables to run the default session with (can appear more \
-       than once)",
-      "KEY=VALUE",
-    );
-    opts.optopt(
-      "s",
-      "sessions",
-      "colon-separated list of Wayland session paths",
-      "DIRS",
-    );
-    opts.optopt(
-      "",
-      "session-wrapper",
-      "wrapper command to initialize the non-X11 session",
-      "'CMD [ARGS]...'",
-    );
-    opts.optopt(
-      "x",
-      "xsessions",
-      "colon-separated list of X11 session paths",
-      "DIRS",
-    );
-    opts.optopt(
-      "",
-      "xsession-wrapper",
-      xsession_wrapper_desc.as_str(),
-      "'CMD [ARGS]...'",
-    );
-    opts.optflag(
-      "",
-      "no-xsession-wrapper",
-      "do not wrap commands for X11 sessions",
-    );
-    opts.optopt(
-      "w",
-      "width",
-      "width of the main prompt (default: 80)",
-      "WIDTH",
-    );
-    opts.optflag("i", "issue", "show the host's issue file");
-    opts.optopt(
-      "g",
-      "greeting",
-      "show custom text above login prompt",
-      "GREETING",
-    );
-    opts.optflag("", "title", "show the container's title");
-    opts.optopt(
-      "",
-      "custom-title",
-      "custom title for the login form",
-      "TITLE",
-    );
-    opts.optflag("t", "time", "display the current date and time");
-    opts.optopt(
-      "",
-      "time-format",
-      "custom strftime format for displaying date and time",
-      "FORMAT",
-    );
-    opts.optflag("b", "battery", "display battery percentage");
-    opts.optopt("u", "user", "pre-fill username field", "USER");
-    opts.optflag("r", "remember", "remember last logged-in username");
-    opts.optflag("", "remember-session", "remember last selected session");
-    opts.optflag(
-      "",
-      "remember-user-session",
-      "remember last selected session for each user",
-    );
-    opts.optflag(
-      "",
-      "user-menu",
-      "allow graphical selection of users from a menu",
-    );
-    opts.optopt(
-      "",
-      "user-menu-min-uid",
-      "minimum UID to display in the user selection menu",
-      "UID",
-    );
-    opts.optopt(
-      "",
-      "user-menu-max-uid",
-      "maximum UID to display in the user selection menu",
-      "UID",
-    );
-    opts.optopt("", "theme", "define the application theme colors", "THEME");
-    opts.optflag("", "asterisks", "display asterisks when a secret is typed");
-    opts.optopt(
-      "",
-      "asterisks-char",
-      "characters to be used to redact secrets (default: *)",
-      "CHARS",
-    );
-    opts.optopt(
-      "",
-      "window-padding",
-      "padding inside the terminal area (default: 0)",
-      "PADDING",
-    );
-    opts.optopt(
-      "",
-      "container-padding",
-      "padding inside the main prompt container (default: 1)",
-      "PADDING",
-    );
-    opts.optopt(
-      "",
-      "prompt-padding",
-      "padding between prompt rows (default: 1)",
-      "PADDING",
-    );
-    opts.optopt(
-      "",
-      "greet-align",
-      "alignment of the greeting text in the main prompt container (default: \
-       'center')",
-      "[left|center|right]",
-    );
-
-    opts.optopt(
-      "",
-      "power-shutdown",
-      "command to run to shut down the system",
-      "'CMD [ARGS]...'",
-    );
-    opts.optopt(
-      "",
-      "power-reboot",
-      "command to run to reboot the system",
-      "'CMD [ARGS]...'",
-    );
-    opts.optopt(
-      "",
-      "power-suspend",
-      "command to run to suspend the system",
-      "'CMD [ARGS]...'",
-    );
-    opts.optopt(
-      "",
-      "power-hibernate",
-      "command to run to hibernate the system",
-      "'CMD [ARGS]...'",
-    );
-    opts.optflag(
-      "",
-      "power-no-setsid",
-      "do not prefix power commands with setsid",
-    );
-
-    opts.optopt(
-      "",
-      "kb-command",
-      "F-key to use to open the command menu",
-      "[1-12]",
-    );
-    opts.optopt(
-      "",
-      "kb-sessions",
-      "F-key to use to open the sessions menu",
-      "[1-12]",
-    );
-    opts.optopt(
-      "",
-      "kb-power",
-      "F-key to use to open the power menu",
-      "[1-12]",
-    );
-    opts.optopt(
-      "",
-      "kb-background",
-      "F-key to use to open the background animation switcher menu",
-      "[1-12]",
-    );
-
-    opts.optopt("", "config", "path to configuration file", "PATH");
-    opts.optflag("", "no-config", "disable loading configuration files");
-    opts.optflag("", "dump-config", "print effective configuration and exit");
-    opts.optflag("", "numlock", "enable numlock on startup");
-    opts.optflag("", "list-outputs", "list available DRM outputs and exit");
-
-    opts.optopt(
-      "",
-      "background",
-      "background animation to render behind the login UI ('doom' or 'none')",
-      "NAME",
-    );
-    opts.optopt(
-      "",
-      "background-fps",
-      "render rate when a background animation is active (default: 30)",
-      "FPS",
-    );
-    opts.optopt(
-      "",
-      "doom-height",
-      "DOOM fire decay control, higher means taller flames (1-9, default: 6)",
-      "N",
-    );
-    opts.optopt(
-      "",
-      "doom-spread",
-      "DOOM fire horizontal jitter (0-4, default: 2)",
-      "N",
-    );
-    opts.optopt(
-      "",
-      "doom-colors",
-      "DOOM fire colors as TOP,MIDDLE,BOTTOM (each #RRGGBB or named)",
-      "TOP,MIDDLE,BOTTOM",
-    );
-    opts.optflag(
-      "",
-      "mock",
-      "visual mock-up mode: skip the greetd socket and fake the auth flow \
-       locally",
-    );
-    opts.optopt(
-      "",
-      "matrix-colors",
-      "matrix rain colors as HEAD,BRIGHT,DIM (each #RRGGBB or named)",
-      "HEAD,BRIGHT,DIM",
-    );
-    opts.optopt(
-      "",
-      "matrix-length",
-      "matrix trail length range as MIN,MAX in rows (default: 6,18)",
-      "MIN,MAX",
-    );
-    opts.optopt(
-      "",
-      "matrix-speed",
-      "matrix fall speed range as MIN,MAX in rows-per-frame (default: \
-       0.30,1.10)",
-      "MIN,MAX",
-    );
-
-    opts
-  }
-
-  // Parses command line arguments to configured the software accordingly.
-  pub async fn parse_options<S>(
-    &mut self,
-    args: &[S],
-  ) -> Result<(), Box<dyn Error>>
-  where
-    S: AsRef<OsStr>,
-  {
-    let opts = Self::options();
-
-    self.config = match opts.parse(args) {
-      Ok(matches) => Some(matches),
-      Err(err) => return Err(err.into()),
-    };
-
-    if self.config().opt_present("help") {
-      print_usage(opts);
-      process::exit(0);
-    }
-    if self.config().opt_present("version") {
-      print_version();
-      process::exit(0);
-    }
-
-    if self.config().opt_present("list-outputs") {
-      tuigreet_system::list_outputs();
-    }
-
-    self.mock = self.config().opt_present("mock");
-
-    if self.config().opt_present("debug") {
-      self.debug = true;
-
-      self.logfile = match self.config().opt_str("debug") {
-        Some(file) => file,
-        None => DEFAULT_LOG_FILE.to_string(),
-      }
-    }
-
-    if self.config().opt_present("issue")
-      && self.config().opt_present("greeting")
-    {
-      return Err(
-        "Only one of --issue and --greeting may be used at the same time"
-          .into(),
-      );
-    }
-
-    if self.config().opt_present("theme")
-      && let Some(spec) = self.config().opt_str("theme")
-    {
-      self.theme = Theme::parse(spec.as_str());
-    }
-
-    if self.config().opt_present("asterisks") {
-      let asterisk =
-        if let Some(value) = self.config().opt_str("asterisks-char") {
-          if value.chars().count() < 1 {
-            return Err(
-              "--asterisks-char must have at least one character as its value"
-                .into(),
-            );
-          }
-
-          value
-        } else {
-          DEFAULT_ASTERISKS_CHARS.to_string()
-        };
-
-      self.secret_display = SecretDisplay::Character(asterisk);
-    }
-
-    self.time = self.config().opt_present("time");
-    self.battery = self.config().opt_present("battery");
-
-    if let Some(format) = self.config().opt_str("time-format") {
-      if StrftimeItems::new(&format).any(|item| item == Item::Error) {
-        return Err("Invalid strftime format provided in --time-format".into());
-      }
-
-      self.time_format = Some(format);
-    }
-
-    self.title.enable = self.config().opt_present("title");
-    if let Some(custom_title) = self.option("custom-title") {
-      self.title.custom = Some(custom_title);
-    }
-
-    if self.config().opt_present("user-menu") {
-      self.user_menu = true;
-
-      let min_uid = self
-        .config()
-        .opt_str("user-menu-min-uid")
-        .and_then(|uid| uid.parse::<u32>().ok());
-      let max_uid = self
-        .config()
-        .opt_str("user-menu-max-uid")
-        .and_then(|uid| uid.parse::<u32>().ok());
-      let (min_uid, max_uid) = get_min_max_uids(min_uid, max_uid);
-
-      tracing::info!("min/max UIDs are {}/{}", min_uid, max_uid);
-
-      if min_uid > max_uid {
-        return Err(
-          "Minimum UID ({min_uid}) must not exceed maximum UID ({max_uid})"
-            .into(),
-        );
-      }
-
-      self.users = Menu {
-        title:    fl!("title_users"),
-        options:  get_users(min_uid, max_uid),
-        selected: 0,
-      };
-
-      tracing::info!("found {} users", self.users.options.len());
-    }
-
-    if self.config().opt_present("remember-session")
-      && self.config().opt_present("remember-user-session")
-    {
-      return Err(
-        "Only one of --remember-session and --remember-user-session may be \
-         used at the same time"
-          .into(),
-      );
-    }
-    if self.config().opt_present("remember-user-session")
-      && !self.config().opt_present("remember")
-    {
-      return Err("--remember-session must be used with --remember".into());
-    }
-
-    self.default_user = self.option("user");
-    self.remember = self.config().opt_present("remember");
-    self.remember_session = self.config().opt_present("remember-session");
-    self.remember_user_session =
-      self.config().opt_present("remember-user-session");
-    self.greeting = self.option("greeting");
-
-    // If the `--cmd` argument is provided, it will override the selected
-    // session.
-    if let Some(command) = self.option("cmd") {
-      let envs = self.options_multi("env");
-
-      if let Some(envs) = envs {
-        for env in envs {
-          if !env.contains('=') {
-            return Err(
-              format!("malformed environment variable definition for '{env}'")
-                .into(),
-            );
-          }
-        }
-      }
-
-      self.session_source =
-        SessionSource::DefaultCommand(command, self.options_multi("env"));
-    }
-
-    if let Some(dirs) = self.option("sessions") {
-      for dir in env::split_paths(&dirs) {
-        self.add_session_path(dir, SessionType::Wayland);
-      }
-    }
-
-    if let Some(dirs) = self.option("xsessions") {
-      for dir in env::split_paths(&dirs) {
-        self.add_session_path(dir, SessionType::X11);
-      }
-    }
-
-    if let Some(wrapper) = self.option("session-wrapper") {
-      self.session_wrapper = Some(wrapper);
-    }
-
-    if !self.config().opt_present("no-xsession-wrapper") {
-      self.xsession_wrapper = self
-        .option("xsession-wrapper")
-        .or_else(|| Some(DEFAULT_XSESSION_WRAPPER.to_string()));
-    }
-
-    if self.config().opt_present("issue") {
-      self.greeting = get_issue();
-    }
-
-    self.powers.options.push(Power {
-      action:  PowerOption::Shutdown,
-      label:   fl!("shutdown"),
-      command: self.config().opt_str("power-shutdown"),
-    });
-
-    self.powers.options.push(Power {
-      action:  PowerOption::Reboot,
-      label:   fl!("reboot"),
-      command: self.config().opt_str("power-reboot"),
-    });
-
-    self.powers.options.push(Power {
-      action:  PowerOption::Suspend,
-      label:   fl!("suspend"),
-      command: self.config().opt_str("power-suspend"),
-    });
-
-    self.powers.options.push(Power {
-      action:  PowerOption::Hibernate,
-      label:   fl!("hibernate"),
-      command: self.config().opt_str("power-hibernate"),
-    });
-
-    self.power_setsid = !self.config().opt_present("power-no-setsid");
-
-    self.kb_command = self
-      .config()
-      .opt_str("kb-command")
-      .map_or(2, |i| i.parse::<u8>().unwrap_or_default());
-    self.kb_sessions = self
-      .config()
-      .opt_str("kb-sessions")
-      .map_or(3, |i| i.parse::<u8>().unwrap_or_default());
-    self.kb_power = self
-      .config()
-      .opt_str("kb-power")
-      .map_or(12, |i| i.parse::<u8>().unwrap_or_default());
-    self.kb_background = self
-      .config()
-      .opt_str("kb-background")
-      .map_or(4, |i| i.parse::<u8>().unwrap_or_default());
-
-    let kbs = [
-      self.kb_command,
-      self.kb_sessions,
-      self.kb_power,
-      self.kb_background,
-    ];
-    for i in 0..kbs.len() {
-      for j in (i + 1)..kbs.len() {
-        if kbs[i] == kbs[j] {
-          return Err("keybindings must all be distinct".into());
-        }
-      }
-    }
-
-    let cli_config = tuigreet_config::parser::extract_cli_config(self.config());
-    self.set_background_from_config(&cli_config.background);
-    self.populate_backgrounds_menu();
-
-    Ok(())
-  }
-
   fn populate_backgrounds_menu(&mut self) {
     let title = fl!("title_background");
     let none_label = fl!("background_none");
@@ -1160,11 +413,9 @@ impl Greeter {
     match item.kind {
       None => {
         self.animation = None;
-        self.animation_fps = None;
       },
       Some(kind) => {
         self.animation = Some(bg_animation::build_default(kind));
-        self.animation_fps = Some(ANIMATION_DEFAULT_FPS);
       },
     }
     self.push_frame_rate();
@@ -1176,10 +427,7 @@ impl Greeter {
     }
   }
 
-  fn set_background_from_config(
-    &mut self,
-    cfg: &tuigreet_config::BackgroundConfig,
-  ) {
+  fn set_background_from_config(&mut self, cfg: &BackgroundConfig) {
     use crate::ui::bg_animation::{Kind, doom, matrix};
 
     let Some(kind) = cfg.kind.as_deref().and_then(Kind::from_name) else {
@@ -1193,23 +441,20 @@ impl Greeter {
         );
       }
       self.animation = None;
-      self.animation_fps = None;
       self.push_frame_rate();
       return;
     };
 
-    let parse = |s: &Option<String>, fallback: tui::style::Color| {
-      s.as_deref()
-        .and_then(bg_animation::parse_color)
-        .unwrap_or(fallback)
+    let parse = |s: &str, fallback: tui::style::Color| {
+      bg_animation::parse_color(s).unwrap_or(fallback)
     };
 
     let spec = match kind {
       Kind::Doom => {
         let d = doom::Options::default();
         AnimationSpec::Doom(doom::Options {
-          height: cfg.doom.height.unwrap_or(d.height),
-          spread: cfg.doom.spread.unwrap_or(d.spread),
+          height: cfg.doom.height,
+          spread: cfg.doom.spread,
           top:    parse(&cfg.doom.top_color, d.top),
           middle: parse(&cfg.doom.middle_color, d.middle),
           bottom: parse(&cfg.doom.bottom_color, d.bottom),
@@ -1221,25 +466,26 @@ impl Greeter {
           head:          parse(&cfg.matrix.head_color, d.head),
           bright:        parse(&cfg.matrix.bright_color, d.bright),
           dim:           parse(&cfg.matrix.dim_color, d.dim),
-          min_length:    cfg.matrix.min_length.unwrap_or(d.min_length),
-          max_length:    cfg.matrix.max_length.unwrap_or(d.max_length),
-          min_speed:     cfg.matrix.min_speed.unwrap_or(d.min_speed),
-          max_speed:     cfg.matrix.max_speed.unwrap_or(d.max_speed),
-          mutate_chance: cfg.matrix.mutate_chance.unwrap_or(d.mutate_chance),
+          min_length:    cfg.matrix.min_length,
+          max_length:    cfg.matrix.max_length,
+          min_speed:     cfg.matrix.min_speed,
+          max_speed:     cfg.matrix.max_speed,
+          mutate_chance: cfg.matrix.mutate_chance,
         })
       },
     };
     self.animation = Some(bg_animation::build(&spec));
-    self.animation_fps = Some(cfg.fps.unwrap_or(ANIMATION_DEFAULT_FPS));
     self.push_frame_rate();
   }
 
   /// Render rate for the event loop.
   #[must_use]
   pub fn frame_rate(&self) -> f64 {
-    self
-      .animation_fps
-      .map_or(DEFAULT_FPS as f64, |fps| fps.max(DEFAULT_FPS) as f64)
+    if self.animation.is_some() {
+      self.background.fps.max(DEFAULT_FPS) as f64
+    } else {
+      DEFAULT_FPS as f64
+    }
   }
 
   /// Push the current frame rate to the event loop.
@@ -1314,12 +560,8 @@ impl Greeter {
   }
 
   // Apply configuration settings to the greeter, respecting CLI overrides
-  pub fn apply_config(&mut self, config: &tuigreet_config::Config) {
-    use tuigreet_config::SecretMode;
-    // General
-    self.debug = config.general.debug;
-    self.logfile.clone_from(&config.general.log_file);
-    self.numlock = config.general.numlock;
+  pub fn apply_config(&mut self, config: Config) {
+    use SecretMode;
     // Session
     self.session_source = config.session.command.as_ref().map_or_else(
       SessionSource::default,
@@ -1338,31 +580,14 @@ impl Greeter {
     for dir in &config.session.xsessions_dirs {
       self.add_session_path(PathBuf::from(dir), SessionType::X11);
     }
-    self
-      .session_wrapper
-      .clone_from(&config.session.session_wrapper);
-    if !self.config().opt_present("no-xsession-wrapper") {
-      self.xsession_wrapper = config.session.xsession_wrapper.clone();
-    }
     // Display
-    self.time = config.display.show_time;
-    self.time_format = config.display.time_format.clone();
-    self.battery = config.display.battery;
     self.greeting = if config.display.issue {
       get_issue()
     } else {
       config.display.greeting.clone()
     };
-    self.title.enable = config.display.show_title;
-    self.title.custom = config.display.custom_title.clone();
-    // Remember
-    self.default_user = config.remember.default_user.clone();
-    self.remember = config.remember.username;
-    self.remember_session = config.remember.session;
-    self.remember_user_session = config.remember.user_session;
     // User menu
-    self.user_menu = config.user_menu.enabled;
-    if self.user_menu {
+    if config.user_menu.enabled {
       use crate::info::get_users;
       self.users = Menu {
         title:    fl!("title_users"),
@@ -1381,34 +606,22 @@ impl Greeter {
       PowerOption::Hibernate,
       config.power.hibernate.clone(),
     );
-    self.power_setsid = config.power.use_setsid;
     // Secret
-    match config.secret.mode {
-      SecretMode::Hidden => self.secret_display = SecretDisplay::Hidden,
+    self.secret_display = match config.secret.mode {
+      SecretMode::Hidden => SecretDisplay::Hidden,
       SecretMode::Characters => {
-        self.secret_display =
-          SecretDisplay::Character(config.secret.characters.clone());
+        SecretDisplay::Character(config.secret.characters.clone())
       },
-    }
-    // Keybindings
-    self.kb_command = config.keybindings.command;
-    self.kb_sessions = config.keybindings.sessions;
-    self.kb_power = config.keybindings.power;
-    self.kb_background = config.keybindings.background;
-    // Status bar visibility
-    self.status_show_reset = config.layout.widgets.status_bar.show_reset;
-    self.status_show_command = config.layout.widgets.status_bar.show_command;
-    self.status_show_session = config.layout.widgets.status_bar.show_session;
-    self.status_show_power = config.layout.widgets.status_bar.show_power;
-    self.status_show_background =
-      config.layout.widgets.status_bar.show_background;
-    self.status_show_session_status =
-      config.layout.widgets.status_bar.show_session_status;
-    self.status_show_caps_lock =
-      config.layout.widgets.status_bar.show_caps_lock;
+    };
     // Animation
     self.set_background_from_config(&config.background);
     self.populate_backgrounds_menu();
+
+    // Apply theme config
+    self.themeui = Theme::from_config(&config.theme);
+
+    // set config of greeter
+    self.config = config;
   }
 
   pub fn reload_sessions(&mut self) {
@@ -1437,38 +650,6 @@ impl Greeter {
       };
     }
   }
-
-  // Apply theme configuration
-  pub fn apply_theme_config(
-    &mut self,
-    theme_config: &tuigreet_config::ThemeConfig,
-    cli_theme: Option<&str>,
-  ) {
-    use tuigreet_theme::config::{apply_cli_theme, theme_from_config};
-
-    // Start with theme from config
-    let config_theme = theme_from_config(theme_config);
-
-    // Apply CLI theme override if present
-    self.theme = apply_cli_theme(config_theme, cli_theme);
-  }
-}
-
-// Parsed title option
-pub struct TitleOption {
-  // Display the container's title
-  pub enable: bool,
-  // Custom title text
-  pub custom: Option<String>,
-}
-
-impl Default for TitleOption {
-  fn default() -> Self {
-    Self {
-      enable: true,
-      custom: None,
-    }
-  }
 }
 
 // Mock session list used to pad otherwise empty session menu
@@ -1492,28 +673,9 @@ fn mock_sessions() -> Vec<Session> {
   .collect()
 }
 
-fn print_usage(opts: Options) {
-  eprint!("{}", opts.usage("Usage: tuigreet [OPTIONS]"));
-}
-
-fn print_version() {
-  println!("tuigreet {} ({})", env!("VERSION"), env!("TARGET"));
-  println!(
-    "Copyright (C) 2020 Antoine POPINEAU <https://github.com/apognu/tuigreet>."
-  );
-  println!("Maintained by NotAShelf <https://github.com/NotAShelf/tuigreet>.");
-  println!("Licensed under GPLv3+ (GNU GPL version 3 or later).");
-  println!();
-  println!(
-    "This is free software, you are welcome to redistribute it under some \
-     conditions."
-  );
-  println!("There is NO WARRANTY, to the extent provided by law.");
-}
-
 #[cfg(test)]
 mod test {
-  use tuigreet_config::Config;
+  use tuigreet_config::config::Config;
   use tuigreet_types::SecretDisplay;
 
   use crate::{
@@ -1556,22 +718,17 @@ mod test {
   #[test]
   fn applying_config_replaces_session_state() {
     let mut greeter = Greeter::default();
-    greeter.config = Some(
-      Greeter::options()
-        .parse(Vec::<String>::new())
-        .expect("empty CLI parses"),
-    );
 
-    let mut configured = Config::default();
+    let mut configured = Config::defaults();
     configured.session.command = Some("first".into());
     configured.session.sessions_dirs = vec!["/first".into()];
     configured.session.session_wrapper = Some("wrapper".into());
     configured.user_menu.enabled = true;
-    greeter.apply_config(&configured);
+    greeter.apply_config(configured);
 
-    let mut replacement = Config::default();
+    let mut replacement = Config::defaults();
     replacement.session.sessions_dirs = vec!["/second".into()];
-    greeter.apply_config(&replacement);
+    greeter.apply_config(replacement);
 
     assert!(matches!(greeter.session_source, SessionSource::None));
     assert_eq!(greeter.session_paths.len(), 2);
@@ -1581,25 +738,20 @@ mod test {
         .iter()
         .any(|(path, _)| path == "/second")
     );
-    assert!(greeter.session_wrapper.is_none());
-    assert!(!greeter.user_menu);
+    assert!(greeter.session.session_wrapper.is_none());
+    assert!(!greeter.user_menu.enabled);
     assert!(greeter.users.options.is_empty());
   }
 
   #[test]
   fn applying_config_updates_log_file() {
     let mut greeter = Greeter::default();
-    let mut config = Config::default();
+    let mut config = Config::defaults();
     config.general.log_file = "/tmp/configured-tuigreet.log".into();
-    greeter.config = Some(
-      Greeter::options()
-        .parse(Vec::<String>::new())
-        .expect("empty CLI parses"),
-    );
 
-    greeter.apply_config(&config);
+    greeter.apply_config(config);
 
-    assert_eq!(greeter.logfile, "/tmp/configured-tuigreet.log");
+    assert_eq!(greeter.general.log_file, "/tmp/configured-tuigreet.log");
   }
 
   #[tokio::test]
@@ -1617,23 +769,23 @@ mod test {
           "A=B",
           "--env",
           "C=D=E",
-          "--asterisks",
-          "--asterisks-char",
+          "--secret-mode=characters",
+          "--secret-characters",
           ".",
-          "--issue",
           "--time",
           "--prompt-padding",
           "0",
           "--window-padding",
           "1",
           "--container-padding",
-          "12",
+          "10",
           "--user-menu",
         ],
         true,
         Some(|greeter| {
           assert!(
-            matches!(&greeter.session_source, SessionSource::DefaultCommand(cmd, Some(env)) if cmd == "uname" && env.len() == 2)
+            matches!(&greeter.session_source, SessionSource::DefaultCommand(cmd,
+  Some(env)) if cmd == "uname" && env.len() == 2)
           );
 
           if let SessionSource::DefaultCommand(_, Some(env)) =
@@ -1646,81 +798,118 @@ mod test {
           assert!(
             matches!(&greeter.secret_display, SecretDisplay::Character(c) if c == ".")
           );
-          assert_eq!(greeter.prompt_padding(), 0);
-          assert_eq!(greeter.window_padding(), 1);
-          assert_eq!(greeter.container_padding(), 13);
-          assert!(greeter.user_menu);
-          assert!(matches!(
-            greeter.xsession_wrapper.as_deref(),
-            Some("startx")
-          ));
+          assert_eq!(greeter.layout.prompt_padding, 0);
+          assert_eq!(greeter.layout.window_padding, 1);
+          assert_eq!(greeter.layout.container_padding, 10);
+          assert!(greeter.user_menu.enabled);
+          assert_eq!(greeter.session.xsession_wrapper, "startx");
         }),
       ),
       (
         &["--xsession-wrapper", "mywrapper.sh"],
         true,
         Some(|greeter| {
-          assert!(matches!(
-            greeter.xsession_wrapper.as_deref(),
-            Some("mywrapper.sh")
-          ));
+          assert_eq!(greeter.session.xsession_wrapper, "mywrapper.sh");
         }),
       ),
       (
-        &["--no-xsession-wrapper"],
+        &["--xsession-wrapper", ""],
         true,
         Some(|greeter| {
-          assert!(greeter.xsession_wrapper.is_none());
+          assert_eq!(greeter.session.xsession_wrapper, "");
         }),
       ),
       // Invalid combinations
       (
-        &["--remember-session", "--remember-user-session"],
+        &["--secret-mode", "characters", "--secret-characters", ""],
+        false,
+        None,
+      ),
+      (
+        &[
+          "--user-menu-min-uid",
+          "10000",
+          "--user-menu-max-uid",
+          "5000",
+        ],
         false,
         None,
       ),
-      (&["--asterisk-char", ""], false, None),
-      (&["--remember-user-session"], false, None),
-      (&["--min-uid", "10000", "--max-uid", "5000"], false, None),
       (&["--issue", "--greeting", "Hello, world!"], false, None),
-      (&["--kb-command", "F2", "--kb-sessions", "F2"], false, None),
+      (&["--kb-command", "2", "--kb-sessions", "2"], false, None),
       (&["--time-format", "%i %"], false, None),
-      (&["--cmd", "cmd", "--env"], false, None),
       (&["--cmd", "cmd", "--env", "A"], false, None),
     ];
 
     for (opts, valid, check) in table {
-      let mut greeter = Greeter::default();
+      // Convert opts to Vec<String> for load_config_from
+      let mut args = vec![std::ffi::OsString::from("tuigreet")];
+      for opt in opts.iter() {
+        args.push(opt.into()); // Then append the flags
+      }
 
       match valid {
         true => {
-          assert!(
-            matches!(greeter.parse_options(opts).await, Ok(())),
-            "{opts:?} cannot be parsed"
-          );
-
-          if let Some(check) = check {
-            check(&greeter);
+          // Parse CLI args using load_config_from
+          match tuigreet_config::loader::load_config_from(args.clone()) {
+            Ok((config, warnings)) => {
+              // Optionally log warnings
+              for w in &warnings {
+                tracing::warn!("{}", w);
+              }
+
+              // Apply config to greeter
+              let mut greeter = Greeter::default();
+              greeter.apply_config(config);
+
+              // Run check closure if present
+              if let Some(check_fn) = check {
+                check_fn(&greeter);
+              }
+            },
+            Err((_, (errors, _warnings))) => {
+              // Unexpected success case returned an error
+              for e in &errors {
+                tracing::error!("{}", e);
+              }
+              panic!(
+                "Unexpected config load error for {:?}: {:?}",
+                opts, errors
+              );
+            },
+          }
+        },
+        false => {
+          // Expect error for invalid combinations
+          match tuigreet_config::loader::load_config_from(args) {
+            Ok(_) => {
+              panic!("Expected config load error for {:?} but got Ok", opts)
+            },
+            Err((_, (errors, _))) => {
+              // Expected failure - optionally log for debugging
+              for e in &errors {
+                tracing::debug!("Expected error: {}", e);
+              }
+            },
           }
         },
-        false => assert!((greeter.parse_options(opts).await).is_err()),
       }
     }
   }
-
   #[tokio::test]
   async fn test_session_paths_are_deduplicated_after_config_overlay() {
-    let mut greeter = Greeter::default();
+    // Build args with program name at index 0 (required by load_config_from)
+    let args: Vec<std::ffi::OsString> = std::iter::once("tuigreet")
+    .chain(["--sessions=/usr/share/wayland-sessions"])
+    .map(Into::into)  // ← Convert all &str to OsString
+    .collect();
 
-    assert!(
-      greeter
-        .parse_options(&["--sessions", "/usr/share/wayland-sessions"])
-        .await
-        .is_ok()
-    );
+    // Parse CLI args using load_config_from
+    let (config, _) = tuigreet_config::loader::load_config_from(args)
+      .expect("Expected successful config load");
 
-    let config = Config::default();
-    greeter.apply_config(&config);
+    let mut greeter = Greeter::default();
+    greeter.apply_config(config);
 
     assert_eq!(
       greeter
@@ -1737,39 +926,39 @@ mod test {
 
   #[tokio::test]
   async fn test_config_session_environments_survive_cli_overlay() {
-    let mut greeter = Greeter::default();
+    // Build args with program name at index 0 (required by load_config_from)
+    let args: Vec<std::ffi::OsString> = std::iter::once("tuigreet")
+      .chain([
+        "--cmd=sway",
+        "--env=XDG_CURRENT_DESKTOP=sway",
+        "--env=XDG_SESSION_TYPE=wayland",
+      ])
+      .map(Into::into)
+      .collect();
+
+    // Parse CLI args using load_config_from
+    tuigreet_config::loader::load_config_from(args)
+      .expect("Expected successful config load");
 
-    assert!(
-      greeter
-        .parse_options(&[
-          "--cmd",
-          "sway",
-          "--env",
-          "XDG_CURRENT_DESKTOP=sway",
-          "--env",
-          "XDG_SESSION_TYPE=wayland",
-        ])
-        .await
-        .is_ok()
-    );
+    let mut greeter = Greeter::default();
 
-    let mut config = Config::default();
+    let mut config = Config::defaults();
     config.session.command = Some("sway".to_string());
     config.session.environments = vec![
       "XDG_CURRENT_DESKTOP=sway".to_string(),
       "XDG_SESSION_TYPE=wayland".to_string(),
     ];
-    greeter.apply_config(&config);
+    greeter.apply_config(config);
 
     assert!(matches!(
-      &greeter.session_source,
-      SessionSource::DefaultCommand(command, Some(environments))
-        if command == "sway"
-          && environments
-            == &vec![
-              "XDG_CURRENT_DESKTOP=sway".to_string(),
-              "XDG_SESSION_TYPE=wayland".to_string()
-            ]
+    &greeter.session_source,
+    SessionSource::DefaultCommand(command, Some(environments))
+    if command == "sway"
+    && environments
+    == &vec![
+    "XDG_CURRENT_DESKTOP=sway".to_string(),
+    "XDG_SESSION_TYPE=wayland".to_string()
+    ]
     ));
   }
 
@@ -1777,17 +966,15 @@ mod test {
   async fn test_config_power_options_are_applied() {
     let mut greeter = Greeter::default();
 
-    assert!(greeter.parse_options(&[] as &[&str]).await.is_ok());
-
-    let mut config = Config::default();
+    let mut config = Config::defaults();
     config.power.shutdown = Some("loginctl poweroff".to_string());
     config.power.reboot = Some("loginctl reboot".to_string());
     config.power.suspend = Some("loginctl suspend".to_string());
     config.power.hibernate = Some("loginctl hibernate".to_string());
     config.power.use_setsid = false;
-    greeter.apply_config(&config);
+    greeter.apply_config(config);
 
-    assert!(!greeter.power_setsid);
+    assert!(!greeter.power.use_setsid);
     assert!(greeter.powers.options.iter().any(|power| {
       power.action == PowerOption::Shutdown
         && power.command.as_deref() == Some("loginctl poweroff")
diff --git a/crates/tuigreet/src/info.rs b/crates/tuigreet/src/info.rs
index df119b9..773d3bd 100644
--- a/crates/tuigreet/src/info.rs
+++ b/crates/tuigreet/src/info.rs
@@ -1,8 +1,8 @@
 use std::{
   env,
   error::Error,
-  fs::{self, File},
-  io::{self, BufRead, BufReader},
+  fs,
+  io,
   path::{Path, PathBuf},
   process::Command,
   sync::OnceLock,
@@ -28,10 +28,6 @@ const LAST_USER_NAME: &str = "/var/cache/tuigreet/lastuser-name";
 const LAST_COMMAND: &str = "/var/cache/tuigreet/lastsession";
 const LAST_SESSION: &str = "/var/cache/tuigreet/lastsession-path";
 
-/// Default UID range for user menu
-const DEFAULT_MIN_UID: u32 = 1000;
-const DEFAULT_MAX_UID: u32 = 60000;
-
 static XDG_DATA_DIRS: OnceLock<Vec<PathBuf>> = OnceLock::new();
 static DEFAULT_SESSION_PATHS: OnceLock<Vec<(PathBuf, SessionType)>> =
   OnceLock::new();
@@ -249,46 +245,6 @@ pub fn get_users(min_uid: u32, max_uid: u32) -> Vec<User> {
     .collect()
 }
 
-pub fn get_min_max_uids(
-  min_uid: Option<u32>,
-  max_uid: Option<u32>,
-) -> (u32, u32) {
-  if let (Some(min_uid), Some(max_uid)) = (min_uid, max_uid) {
-    return (min_uid, max_uid);
-  }
-
-  let overrides = (min_uid, max_uid);
-  let default = (
-    min_uid.unwrap_or(DEFAULT_MIN_UID),
-    max_uid.unwrap_or(DEFAULT_MAX_UID),
-  );
-
-  match File::open("/etc/login.defs") {
-    Err(_) => default,
-    Ok(file) => {
-      let file = BufReader::new(file);
-
-      let uids: (u32, u32) = file.lines().fold(default, |acc, line| {
-        line.map_or(acc, |line| {
-          let mut tokens = line.split_whitespace();
-
-          match (overrides, tokens.next(), tokens.next()) {
-            ((None, _), Some("UID_MIN"), Some(value)) => {
-              (value.parse::<u32>().unwrap_or(acc.0), acc.1)
-            },
-            ((_, None), Some("UID_MAX"), Some(value)) => {
-              (acc.0, value.parse::<u32>().unwrap_or(acc.1))
-            },
-            _ => acc,
-          }
-        })
-      });
-
-      uids
-    },
-  }
-}
-
 pub fn get_sessions(greeter: &Greeter) -> Result<Vec<Session>, Box<dyn Error>> {
   let paths = if greeter.session_paths.is_empty() {
     default_session_paths()
diff --git a/crates/tuigreet/src/integration/common/mod.rs b/crates/tuigreet/src/integration/common/mod.rs
index eea948f..41a2be3 100644
--- a/crates/tuigreet/src/integration/common/mod.rs
+++ b/crates/tuigreet/src/integration/common/mod.rs
@@ -81,11 +81,6 @@ impl IntegrationRunner {
         builder(&mut greeter);
       }
 
-      if greeter.config.is_none() {
-        greeter.config = Greeter::options().parse(&[""]).ok();
-      }
-
-      greeter.logfile = "/tmp/tuigreet.log".to_string();
       greeter.socket = socket.to_str().unwrap().to_string();
       greeter.events = Some(events.sender());
       greeter.connect().await;
diff --git a/crates/tuigreet/src/integration/display.rs b/crates/tuigreet/src/integration/display.rs
index 9e4d12b..9108dda 100644
--- a/crates/tuigreet/src/integration/display.rs
+++ b/crates/tuigreet/src/integration/display.rs
@@ -88,8 +88,8 @@ async fn show_time() {
   let mut runner = IntegrationRunner::new(
     opts,
     Some(|greeter| {
-      greeter.time = true;
-      greeter.time_format = Some(TIME_FORMAT.to_string());
+      greeter.display.show_time = true;
+      greeter.display.time_format = Some(TIME_FORMAT.to_string());
     }),
   )
   .await;
@@ -124,8 +124,8 @@ async fn show_custom_title_overrides_localization() {
   let mut runner = IntegrationRunner::new_with_size(
     opts,
     Some(|greeter| {
-      greeter.title.enable = true;
-      greeter.title.custom = Some("Welcome to My System".to_string());
+      greeter.display.show_title = true;
+      greeter.display.custom_title = Some("Welcome to My System".to_string());
     }),
     (30, 10),
   )
diff --git a/crates/tuigreet/src/integration/menus.rs b/crates/tuigreet/src/integration/menus.rs
index 52cb751..5ba00a9 100644
--- a/crates/tuigreet/src/integration/menus.rs
+++ b/crates/tuigreet/src/integration/menus.rs
@@ -43,9 +43,9 @@ async fn menus_labels_with_custom_bindings() {
   let mut runner = IntegrationRunner::new(
     opts,
     Some(|greeter| {
-      greeter.kb_command = 11;
-      greeter.kb_sessions = 1;
-      greeter.kb_power = 6;
+      greeter.keybindings.command = 11;
+      greeter.keybindings.sessions = 1;
+      greeter.keybindings.power = 6;
     }),
   )
   .await;
@@ -226,7 +226,7 @@ async fn users_menu() {
   let mut runner = IntegrationRunner::new(
     opts,
     Some(|greeter| {
-      greeter.user_menu = true;
+      greeter.user_menu.enabled = true;
       greeter.users = Menu::<User> {
         title:    "The users".to_string(),
         options:  vec![
diff --git a/crates/tuigreet/src/integration/remember.rs b/crates/tuigreet/src/integration/remember.rs
index 13ab5bc..8a32beb 100644
--- a/crates/tuigreet/src/integration/remember.rs
+++ b/crates/tuigreet/src/integration/remember.rs
@@ -15,7 +15,7 @@ async fn remember_username() {
   let mut runner = IntegrationRunner::new(
     opts,
     Some(|greeter| {
-      greeter.remember = true;
+      greeter.remember.username = true;
       greeter.username = MaskedString::from("apognu".to_string(), None);
     }),
   )
diff --git a/crates/tuigreet/src/ipc.rs b/crates/tuigreet/src/ipc.rs
index 2569b22..7dcb72c 100644
--- a/crates/tuigreet/src/ipc.rs
+++ b/crates/tuigreet/src/ipc.rs
@@ -171,12 +171,12 @@ impl Ipc {
         if greeter.done {
           tracing::info!("greetd acknowledged session start, exiting");
 
-          if greeter.remember {
+          if greeter.remember.username {
             tracing::info!("caching last successful username");
 
             write_last_username(&greeter.username);
 
-            if greeter.remember_user_session {
+            if greeter.remember.user_session {
               match greeter.session_source {
                 SessionSource::Command(ref command) => {
                   tracing::info!("caching last user command: {command}");
@@ -374,10 +374,17 @@ fn wrap_session_command<'a>(
       }
 
       if *session_type == SessionType::X11 {
-        if let Some(ref wrap) = greeter.xsession_wrapper {
-          return (Cow::Owned(format!("{} {}", wrap, default.command())), env);
+        if !greeter.session.xsession_wrapper.is_empty() {
+          return (
+            Cow::Owned(format!(
+              "{} {}",
+              greeter.session.xsession_wrapper,
+              default.command()
+            )),
+            env,
+          );
         }
-      } else if let Some(ref wrap) = greeter.session_wrapper {
+      } else if let Some(ref wrap) = greeter.session.session_wrapper {
         return (Cow::Owned(format!("{} {}", wrap, default.command())), env);
       }
     },
@@ -385,7 +392,7 @@ fn wrap_session_command<'a>(
     _ => {
       // If a wrapper script is used, assume that it is able to set up the
       // required environment.
-      if let Some(ref wrap) = greeter.session_wrapper {
+      if let Some(ref wrap) = greeter.session.session_wrapper {
         return (Cow::Owned(format!("{} {}", wrap, default.command())), env);
       }
       // Otherwise, set up the environment from the provided argument.
@@ -432,7 +439,7 @@ mod test {
   #[test]
   fn wayland_wrapper() {
     let mut greeter = Greeter::default();
-    greeter.session_wrapper = Some("/wrapper.sh".into());
+    greeter.session.session_wrapper = Some("/wrapper.sh".into());
 
     let session = Session {
       name: "Session1".into(),
@@ -453,7 +460,7 @@ mod test {
   #[test]
   fn x11_wrapper() {
     let mut greeter = Greeter::default();
-    greeter.xsession_wrapper = Some("startx".into());
+    greeter.session.xsession_wrapper = "startx".to_string();
 
     let session = Session {
       slug:              Some("thede".to_string()),
diff --git a/crates/tuigreet/src/keyboard.rs b/crates/tuigreet/src/keyboard.rs
index bc02fa4..b8db330 100644
--- a/crates/tuigreet/src/keyboard.rs
+++ b/crates/tuigreet/src/keyboard.rs
@@ -116,7 +116,7 @@ pub async fn handle(
     KeyEvent {
       code: KeyCode::F(i),
       ..
-    } if i == greeter.kb_command => {
+    } if i == greeter.keybindings.command => {
       greeter.previous_mode = match greeter.mode {
         Mode::Users
         | Mode::Command
@@ -143,7 +143,9 @@ pub async fn handle(
     KeyEvent {
       code: KeyCode::F(i),
       ..
-    } if i == greeter.kb_sessions && !greeter.sessions.options.is_empty() => {
+    } if i == greeter.keybindings.sessions
+      && !greeter.sessions.options.is_empty() =>
+    {
       greeter.previous_mode = match greeter.mode {
         Mode::Users
         | Mode::Command
@@ -162,7 +164,9 @@ pub async fn handle(
     KeyEvent {
       code: KeyCode::F(i),
       ..
-    } if i == greeter.kb_power && !greeter.powers.options.is_empty() => {
+    } if i == greeter.keybindings.power
+      && !greeter.powers.options.is_empty() =>
+    {
       greeter.previous_mode = match greeter.mode {
         Mode::Users
         | Mode::Command
@@ -179,7 +183,7 @@ pub async fn handle(
     KeyEvent {
       code: KeyCode::F(i),
       ..
-    } if i == greeter.kb_background => {
+    } if i == greeter.keybindings.background => {
       greeter.previous_mode = match greeter.mode {
         Mode::Users
         | Mode::Command
@@ -290,7 +294,7 @@ pub async fn handle(
         },
 
         Mode::Username
-          if greeter.user_menu && !greeter.users.options.is_empty() =>
+          if greeter.user_menu.enabled && !greeter.users.options.is_empty() =>
         {
           greeter.previous_mode = match greeter.mode {
             Mode::Users | Mode::Command | Mode::Sessions | Mode::Power => {
@@ -323,7 +327,7 @@ pub async fn handle(
           greeter.session_source =
             SessionSource::Command(greeter.buffer.clone());
 
-          if greeter.remember_session {
+          if greeter.remember.session {
             write_last_command(&greeter.buffer);
             delete_last_session();
           }
@@ -353,7 +357,7 @@ pub async fn handle(
             .cloned();
 
           if let Some(Session { path, .. }) = session {
-            if greeter.remember_session
+            if greeter.remember.session
               && let Some(ref path) = path
             {
               write_last_session_path(path);
@@ -492,7 +496,7 @@ async fn validate_username(greeter: &mut Greeter, ipc: &Ipc) {
     .await;
   greeter.buffer = String::new();
 
-  if greeter.remember_user_session {
+  if greeter.remember.user_session {
     if let Ok(last_session) = get_last_user_session(&greeter.username.value)
       && let Some(last_session) =
         Session::from_path(greeter, last_session).cloned()
@@ -828,9 +832,9 @@ mod test {
     ] {
       {
         let mut greeter = greeter.write().await;
-        greeter.kb_command = 3;
-        greeter.kb_sessions = 1;
-        greeter.kb_power = 11;
+        greeter.keybindings.command = 3;
+        greeter.keybindings.sessions = 1;
+        greeter.keybindings.power = 11;
         greeter.mode = Mode::Username;
         greeter.buffer = "apognu".to_string();
       }
diff --git a/crates/tuigreet/src/main.rs b/crates/tuigreet/src/main.rs
index 90e9ae6..de77b49 100644
--- a/crates/tuigreet/src/main.rs
+++ b/crates/tuigreet/src/main.rs
@@ -32,7 +32,7 @@ use greetd_ipc::Request;
 use power::PowerPostAction;
 use tokio::sync::RwLock;
 use tui::{Terminal, backend::CrosstermBackend};
-use tuigreet_types::AuthStatus;
+use tuigreet_types::{AuthStatus, expand_tilde};
 
 pub use self::greeter::*;
 use self::{event::Events, ipc::Ipc};
@@ -69,7 +69,7 @@ where
 
   register_panic_handler();
 
-  if greeter.numlock {
+  if greeter.general.numlock {
     enable_numlock();
   }
 
@@ -88,7 +88,7 @@ where
 
   let ipc = Ipc::new();
 
-  if greeter.remember && !greeter.username.value.is_empty() {
+  if greeter.remember.username && !greeter.username.value.is_empty() {
     greeter.working = true;
 
     tracing::info!(
@@ -103,7 +103,7 @@ where
       .await;
   }
 
-  if greeter.user_menu
+  if greeter.user_menu.enabled
     && greeter.users.options.len() == 1
     && let Some(user) = greeter.users.options.first().cloned()
   {
@@ -120,21 +120,19 @@ where
       .await;
   }
 
+  let _system_config_path = expand_tilde(&greeter.general.system_config_path);
+  let _user_config_path = expand_tilde(&greeter.general.user_config_path);
+
   let greeter = Arc::new(RwLock::new(greeter));
 
+  #[cfg(not(test))]
+  let mut _config_watchers: Vec<crate::watcher::ConfigWatcher> = Vec::new();
+
   // Initialize config watcher for hot reloading
   #[cfg(not(test))]
   let _config_watcher = {
-    let config_path = {
-      let greeter_guard = greeter.read().await;
-      greeter_guard
-        .config()
-        .opt_str("config")
-        .map(std::path::PathBuf::from)
-    };
-
     match crate::watcher::ConfigWatcher::new(
-      config_path,
+      vec![_system_config_path, _user_config_path],
       greeter.clone(),
       events.sender(),
     ) {
@@ -283,7 +281,10 @@ fn init_logger(
     .append(true)
     .clone();
 
-  match (greeter.debug, logfile.open(&greeter.logfile)) {
+  match (
+    greeter.general.debug,
+    logfile.open(&greeter.general.log_file),
+  ) {
     (true, Ok(file)) => {
       let (appender, guard) = tracing_appender::non_blocking(file);
       let target = Targets::new().with_target("tuigreet", LevelFilter::DEBUG);
diff --git a/crates/tuigreet/src/power.rs b/crates/tuigreet/src/power.rs
index c6b574a..0c4ae73 100644
--- a/crates/tuigreet/src/power.rs
+++ b/crates/tuigreet/src/power.rs
@@ -17,7 +17,7 @@ pub enum PowerOption {
 
 /// Execute a power command (shutdown or reboot).
 pub async fn power(greeter: &mut Greeter, option: PowerOption) {
-  if greeter.mock {
+  if greeter.general.mock {
     if let Some(ref sender) = greeter.events {
       let _ = sender
         .send(Event::Exit(tuigreet_types::AuthStatus::Cancel))
@@ -38,7 +38,7 @@ pub async fn power(greeter: &mut Greeter, option: PowerOption) {
       command: Some(args),
       ..
     }) => {
-      let command = if greeter.power_setsid {
+      let command = if greeter.power.use_setsid {
         let mut command = Command::new("setsid");
         command.args(args.split(' '));
         command
diff --git a/crates/tuigreet/src/ui/command.rs b/crates/tuigreet/src/ui/command.rs
index eff718c..20a6294 100644
--- a/crates/tuigreet/src/ui/command.rs
+++ b/crates/tuigreet/src/ui/command.rs
@@ -21,12 +21,12 @@ pub fn draw_with_area(
   f: &mut Frame,
   area: Rect,
 ) -> Result<(u16, u16), Box<dyn Error>> {
-  let theme = &greeter.theme;
+  let theme = &greeter.themeui;
 
   let size = area;
   let (x, y, width, height) = get_rect_bounds(greeter, size, 0);
 
-  let container_padding = greeter.container_padding();
+  let container_padding = greeter.layout.container_padding;
 
   let container = Rect::new(x, y, width, height);
   let frame = Rect::new(
diff --git a/crates/tuigreet/src/ui/common/menu.rs b/crates/tuigreet/src/ui/common/menu.rs
index 2ce9918..38e5a6b 100644
--- a/crates/tuigreet/src/ui/common/menu.rs
+++ b/crates/tuigreet/src/ui/common/menu.rs
@@ -51,7 +51,7 @@ where
     f: &mut Frame,
     area: Rect,
   ) -> Result<(u16, u16), Box<dyn Error>> {
-    let theme = &greeter.theme;
+    let theme = &greeter.themeui;
 
     let size = area;
     let (x, y, width, height) =
diff --git a/crates/tuigreet/src/ui/mod.rs b/crates/tuigreet/src/ui/mod.rs
index aca5efb..e252669 100644
--- a/crates/tuigreet/src/ui/mod.rs
+++ b/crates/tuigreet/src/ui/mod.rs
@@ -31,7 +31,7 @@ use tui::{
   text::{Line, Span},
   widgets::Paragraph,
 };
-use tuigreet_config::{BatteryPosition, WidgetPosition};
+use tuigreet_config::config::{BatteryPosition, WidgetPosition};
 use tuigreet_types::Mode;
 use util::buttonize;
 
@@ -59,14 +59,10 @@ enum Button {
 
 /// Get widget position from config
 fn get_widget_position(greeter: &Greeter, widget_name: &str) -> WidgetPosition {
-  if let Some(ref config) = greeter.loaded_config {
-    match widget_name {
-      "time" => config.layout.widgets.time_position.clone(),
-      "status" => config.layout.widgets.status_position.clone(),
-      _ => WidgetPosition::Default,
-    }
-  } else {
-    WidgetPosition::Default
+  match widget_name {
+    "time" => greeter.layout.widgets.time_position.clone(),
+    "status" => greeter.layout.widgets.status_position.clone(),
+    _ => WidgetPosition::Default,
   }
 }
 
@@ -89,18 +85,18 @@ where
       anim.render(area, f.buffer_mut());
     }
 
-    let theme = &greeter.theme;
+    let theme = &greeter.themeui;
     let size = area;
     let time_position = get_widget_position(&greeter, "time");
     let status_position = get_widget_position(&greeter, "status");
 
-    let time_at_top = greeter.time
+    let time_at_top = greeter.display.show_time
       && !matches!(
         time_position,
         WidgetPosition::Hidden | WidgetPosition::Bottom
       );
-    let time_at_bottom =
-      greeter.time && matches!(time_position, WidgetPosition::Bottom);
+    let time_at_bottom = greeter.display.show_time
+      && matches!(time_position, WidgetPosition::Bottom);
 
     // Dynamic layout
     let mut constraints = vec![];
@@ -109,10 +105,10 @@ where
     let mut status_slot = None;
 
     // Top padding
-    constraints.push(Constraint::Length(greeter.window_padding()));
+    constraints.push(Constraint::Length(greeter.layout.window_padding));
 
     // Top info row: time centered, battery overlaid on left or right.
-    if greeter.battery || time_at_top {
+    if greeter.display.battery || time_at_top {
       info_top_slot = Some(constraints.len());
       constraints.push(Constraint::Length(1));
     }
@@ -143,7 +139,7 @@ where
     }
 
     // Bottom padding
-    constraints.push(Constraint::Length(greeter.window_padding()));
+    constraints.push(Constraint::Length(greeter.layout.window_padding));
 
     let chunks = Layout::default().constraints(constraints).split(size);
 
@@ -153,9 +149,9 @@ where
         .direction(Direction::Horizontal)
         .constraints(
           [
-            Constraint::Length(greeter.window_padding()),
+            Constraint::Length(greeter.layout.window_padding),
             Constraint::Fill(1),
-            Constraint::Length(greeter.window_padding()),
+            Constraint::Length(greeter.layout.window_padding),
           ]
           .as_ref(),
         )
@@ -183,7 +179,7 @@ where
         );
       }
 
-      if greeter.battery
+      if greeter.display.battery
         && let Some(info) = get_battery_info()
       {
         let battery_text = if info.charging {
@@ -192,11 +188,7 @@ where
           format!("{}%", info.percentage)
         };
 
-        let battery_pos = greeter
-          .loaded_config
-          .as_ref()
-          .map(|c| c.layout.widgets.battery_position.clone())
-          .unwrap_or_default();
+        let battery_pos = greeter.layout.widgets.battery_position.clone();
 
         let (bat_slot, cons) = match battery_pos {
           BatteryPosition::Left => {
@@ -234,11 +226,11 @@ where
         .direction(Direction::Horizontal)
         .constraints(
           [
-            Constraint::Length(greeter.window_padding()),
+            Constraint::Length(greeter.layout.window_padding),
             Constraint::Fill(1),
             Constraint::Length(time_text.chars().count() as u16),
             Constraint::Fill(1),
-            Constraint::Length(greeter.window_padding()),
+            Constraint::Length(greeter.layout.window_padding),
           ]
           .as_ref(),
         )
@@ -258,11 +250,11 @@ where
         .direction(Direction::Horizontal)
         .constraints(
           [
-            Constraint::Length(greeter.window_padding()),
+            Constraint::Length(greeter.layout.window_padding),
             Constraint::Min(1),
             Constraint::Length(1),
             Constraint::Length(status_block_size_right),
-            Constraint::Length(greeter.window_padding()),
+            Constraint::Length(greeter.layout.window_padding),
           ]
           .as_ref(),
         )
@@ -278,7 +270,7 @@ where
 
       let mut status_spans: Vec<Span> = vec![];
 
-      if greeter.status_show_reset {
+      if greeter.layout.widgets.status_bar.show_reset {
         status_spans.push(status_label(theme, "ESC"));
         status_spans.push(status_value(
           &greeter,
@@ -288,9 +280,11 @@ where
         ));
         status_spans.push(Span::from(" "));
       }
-      if greeter.status_show_command {
-        status_spans
-          .push(status_label(theme, format!("F{}", greeter.kb_command)));
+      if greeter.layout.widgets.status_bar.show_command {
+        status_spans.push(status_label(
+          theme,
+          format!("F{}", greeter.keybindings.command),
+        ));
         status_spans.push(status_value(
           &greeter,
           theme,
@@ -299,9 +293,11 @@ where
         ));
         status_spans.push(Span::from(" "));
       }
-      if greeter.status_show_session {
-        status_spans
-          .push(status_label(theme, format!("F{}", greeter.kb_sessions)));
+      if greeter.layout.widgets.status_bar.show_session {
+        status_spans.push(status_label(
+          theme,
+          format!("F{}", greeter.keybindings.sessions),
+        ));
         status_spans.push(status_value(
           &greeter,
           theme,
@@ -310,9 +306,11 @@ where
         ));
         status_spans.push(Span::from(" "));
       }
-      if greeter.status_show_power {
-        status_spans
-          .push(status_label(theme, format!("F{}", greeter.kb_power)));
+      if greeter.layout.widgets.status_bar.show_power {
+        status_spans.push(status_label(
+          theme,
+          format!("F{}", greeter.keybindings.power),
+        ));
         status_spans.push(status_value(
           &greeter,
           theme,
@@ -321,9 +319,11 @@ where
         ));
         status_spans.push(Span::from(" "));
       }
-      if greeter.status_show_background {
-        status_spans
-          .push(status_label(theme, format!("F{}", greeter.kb_background)));
+      if greeter.layout.widgets.status_bar.show_background {
+        status_spans.push(status_label(
+          theme,
+          format!("F{}", greeter.keybindings.background),
+        ));
         status_spans.push(status_value(
           &greeter,
           theme,
@@ -332,7 +332,7 @@ where
         ));
         status_spans.push(Span::from(" "));
       }
-      if greeter.status_show_session_status {
+      if greeter.layout.widgets.status_bar.show_session_status {
         status_spans.push(status_label(theme, session_source_label));
         status_spans.push(status_value(
           &greeter,
@@ -347,7 +347,7 @@ where
 
       f.render_widget(status_left, status_chunks[STATUSBAR_LEFT_INDEX]);
 
-      if greeter.status_show_caps_lock && capslock_status() {
+      if greeter.layout.widgets.status_bar.show_caps_lock && capslock_status() {
         let status_right_text = status_label(theme, fl!("status_caps"));
         let status_right = Paragraph::new(status_right_text);
 
@@ -390,7 +390,7 @@ where
 }
 
 fn get_time(greeter: &Greeter) -> String {
-  let format = match &greeter.time_format {
+  let format = match &greeter.display.time_format {
     Some(format) => Cow::Borrowed(format),
     None => Cow::Owned(fl!("date")),
   };
diff --git a/crates/tuigreet/src/ui/processing.rs b/crates/tuigreet/src/ui/processing.rs
index c2fa703..8230572 100644
--- a/crates/tuigreet/src/ui/processing.rs
+++ b/crates/tuigreet/src/ui/processing.rs
@@ -24,7 +24,7 @@ pub fn draw_with_area(
     f.render_widget(Clear, container);
   }
 
-  let container_padding = greeter.container_padding();
+  let container_padding = greeter.layout.container_padding;
   let frame = Rect::new(
     x.saturating_add(container_padding),
     y.saturating_add(container_padding),
diff --git a/crates/tuigreet/src/ui/prompt.rs b/crates/tuigreet/src/ui/prompt.rs
index b16be3e..c2de0c4 100644
--- a/crates/tuigreet/src/ui/prompt.rs
+++ b/crates/tuigreet/src/ui/prompt.rs
@@ -35,13 +35,13 @@ pub fn draw_with_area(
   f: &mut Frame,
   area: Rect,
 ) -> Result<(u16, u16), Box<dyn Error>> {
-  let theme = &greeter.theme;
+  let theme = &greeter.themeui;
 
   let size = area;
   let (x, y, width, height) = get_rect_bounds(greeter, size, 0);
 
-  let container_padding = greeter.container_padding();
-  let prompt_padding = greeter.prompt_padding();
+  let container_padding = greeter.layout.container_padding;
+  let prompt_padding = greeter.layout.prompt_padding;
   let greeting_alignment = match greeter.greet_align() {
     GreetAlign::Center => Alignment::Center,
     GreetAlign::Left => Alignment::Left,
@@ -70,8 +70,8 @@ pub fn draw_with_area(
     .border_type(BorderType::Plain)
     .border_style(theme.of(&[Themed::Border]));
 
-  if greeter.title.enable {
-    let title_text = if let Some(ref custom) = greeter.title.custom {
+  if greeter.display.show_title {
+    let title_text = if let Some(ref custom) = greeter.display.custom_title {
       custom.clone()
     } else {
       fl!("title_authenticate", hostname = get_hostname())
@@ -114,16 +114,16 @@ pub fn draw_with_area(
     f.render_widget(greeting_label, chunks[GREETING_INDEX]);
   }
 
-  let username_label = if greeter.user_menu && greeter.username.value.is_empty()
-  {
-    let prompt_text = Span::from(fl!("select_user"));
+  let username_label =
+    if greeter.user_menu.enabled && greeter.username.value.is_empty() {
+      let prompt_text = Span::from(fl!("select_user"));
 
-    Paragraph::new(prompt_text).alignment(Alignment::Center)
-  } else {
-    let username_text = prompt_value(theme, Some(fl!("username")));
+      Paragraph::new(prompt_text).alignment(Alignment::Center)
+    } else {
+      let username_text = prompt_value(theme, Some(fl!("username")));
 
-    Paragraph::new(username_text)
-  };
+      Paragraph::new(username_text)
+    };
 
   let username = greeter.username.get();
   let username_value_text = Span::from(username);
@@ -134,7 +134,7 @@ pub fn draw_with_area(
     Mode::Username | Mode::Password | Mode::Action => {
       f.render_widget(username_label, chunks[USERNAME_INDEX]);
 
-      if !greeter.user_menu || !greeter.username.value.is_empty() {
+      if !greeter.user_menu.enabled || !greeter.username.value.is_empty() {
         f.render_widget(
           username_value,
           Rect::new(
@@ -205,7 +205,7 @@ pub fn draw_with_area(
       if let Some(message) = message {
         let message = message
           .alignment(Alignment::Center)
-          .style(greeter.theme.of(&[Themed::Text]));
+          .style(theme.of(&[Themed::Text]));
 
         f.render_widget(
           message,
diff --git a/crates/tuigreet/src/ui/tests.rs b/crates/tuigreet/src/ui/tests.rs
index 40a9649..d389e3d 100644
--- a/crates/tuigreet/src/ui/tests.rs
+++ b/crates/tuigreet/src/ui/tests.rs
@@ -1,5 +1,6 @@
 use std::sync::Arc;
 
+use figment::Jail;
 use tokio::sync::RwLock;
 use tui::{
   Terminal,
@@ -7,7 +8,10 @@ use tui::{
   layout::{Constraint, Direction, Layout, Rect},
   style::Color,
 };
-use tuigreet_config::{Config, WidgetPosition};
+use tuigreet_config::{
+  config::{Config, WidgetPosition},
+  loader::load_config_from,
+};
 use tuigreet_types::Mode;
 
 use crate::{Greeter, integration::common::backend::TestBackend, ui};
@@ -17,7 +21,7 @@ fn test_greeter() -> Arc<RwLock<Greeter>> {
   let mut greeter = Greeter::default();
   greeter.working = false;
   // Initialize config to avoid unwrap panics
-  greeter.config = Greeter::options().parse(&[""]).ok();
+  greeter.config = Config::defaults();
   Arc::new(RwLock::new(greeter))
 }
 
@@ -94,12 +98,11 @@ async fn test_status_bar_top_position() {
   {
     let mut g = greeter.write().await;
     g.mode = Mode::Username;
-    let mut config = Config::default();
+    let mut config = Config::defaults();
     config.layout.widgets.status_position = WidgetPosition::Top;
 
     // NOTE: loaded_config is what the UI actually reads
-    g.loaded_config = Some(config.clone());
-    g.apply_config(&config);
+    g.apply_config(config);
   }
 
   let buffer = render_ui(greeter, 80, 24).await;
@@ -135,10 +138,10 @@ async fn test_status_bar_hidden() {
   {
     let mut g = greeter.write().await;
     g.mode = Mode::Username;
-    let mut config = Config::default();
+    let mut config = Config::defaults();
     config.layout.widgets.status_position = WidgetPosition::Hidden;
-    g.loaded_config = Some(config.clone());
-    g.apply_config(&config);
+    g.config = config.clone();
+    g.apply_config(config);
   }
 
   let buffer = render_ui(greeter, 80, 24).await;
@@ -161,7 +164,7 @@ async fn test_time_widget_top_default() {
   let greeter = test_greeter();
   {
     let mut g = greeter.write().await;
-    g.time = true;
+    g.display.show_time = true;
     g.mode = Mode::Username;
   }
 
@@ -188,12 +191,12 @@ async fn test_time_widget_bottom_position() {
   let greeter = test_greeter();
   {
     let mut g = greeter.write().await;
-    g.time = true;
+    g.display.show_time = true;
     g.mode = Mode::Username;
-    let mut config = Config::default();
+    let mut config = Config::defaults();
     config.layout.widgets.time_position = WidgetPosition::Bottom;
-    g.loaded_config = Some(config.clone());
-    g.apply_config(&config);
+    g.config = config.clone();
+    g.apply_config(config);
   }
 
   let buffer = render_ui(greeter, 80, 24).await;
@@ -326,10 +329,10 @@ async fn test_window_padding() {
   {
     let mut g = greeter.write().await;
     g.mode = Mode::Username;
-    let mut config = Config::default();
-    config.layout.window_padding = Some(2);
-    g.loaded_config = Some(config.clone());
-    g.apply_config(&config);
+    let mut config = Config::defaults();
+    config.layout.window_padding = 2;
+    g.config = config.clone();
+    g.apply_config(config);
   }
 
   let buffer = render_ui(greeter, 80, 24).await;
@@ -399,12 +402,12 @@ async fn test_combined_time_and_status_positions() {
       {
         let mut g = greeter.write().await;
         g.mode = Mode::Username;
-        g.time = true;
-        let mut config = Config::default();
+        g.display.show_time = true;
+        let mut config = Config::defaults();
         config.layout.widgets.time_position = time_pos.clone();
         config.layout.widgets.status_position = status_pos.clone();
-        g.loaded_config = Some(config.clone());
-        g.apply_config(&config);
+        g.config = config.clone();
+        g.apply_config(config);
       }
 
       let buffer = render_ui(greeter, 80, 24).await;
@@ -423,12 +426,11 @@ async fn test_theme_border_color_applied() {
     let mut g = greeter.write().await;
     g.mode = Mode::Username;
 
-    let mut config = Config::default();
+    let mut config = Config::defaults();
     config.theme.border = Some("red".to_string());
 
-    g.loaded_config = Some(config.clone());
-    g.apply_config(&config);
-    g.apply_theme_config(&config.theme, None);
+    g.config = config.clone();
+    g.apply_config(config);
   }
 
   let buffer = render_ui(greeter, 80, 24).await;
@@ -469,12 +471,11 @@ async fn test_theme_prompt_color_applied() {
     let mut g = greeter.write().await;
     g.mode = Mode::Username;
 
-    let mut config = Config::default();
+    let mut config = Config::defaults();
     config.theme.prompt = Some("yellow".to_string());
 
-    g.loaded_config = Some(config.clone());
-    g.apply_config(&config);
-    g.apply_theme_config(&config.theme, None);
+    g.config = config.clone();
+    g.apply_config(config);
   }
 
   let buffer = render_ui(greeter, 80, 24).await;
@@ -507,12 +508,11 @@ async fn test_theme_container_background_applied() {
     let mut g = greeter.write().await;
     g.mode = Mode::Username;
 
-    let mut config = Config::default();
+    let mut config = Config::defaults();
     config.theme.container = Some("blue".to_string());
 
-    g.loaded_config = Some(config.clone());
-    g.apply_config(&config);
-    g.apply_theme_config(&config.theme, None);
+    g.config = config.clone();
+    g.apply_config(config);
   }
 
   let buffer = render_ui(greeter, 80, 24).await;
@@ -545,13 +545,12 @@ async fn test_theme_greeting_color_applied() {
     let mut g = greeter.write().await;
     g.mode = Mode::Username;
 
-    let mut config = Config::default();
+    let mut config = Config::defaults();
     config.display.greeting = Some("Welcome to the system!".to_string());
     config.theme.greet = Some("green".to_string());
 
-    g.loaded_config = Some(config.clone());
-    g.apply_config(&config);
-    g.apply_theme_config(&config.theme, None);
+    g.config = config.clone();
+    g.apply_config(config);
   }
 
   let buffer = render_ui(greeter, 80, 24).await;
@@ -587,12 +586,11 @@ async fn test_theme_hex_colors_applied() {
     let mut g = greeter.write().await;
     g.mode = Mode::Username;
 
-    let mut config = Config::default();
+    let mut config = Config::defaults();
     config.theme.border = Some("#ff0000".to_string()); // Red in hex
 
-    g.loaded_config = Some(config.clone());
-    g.apply_config(&config);
-    g.apply_theme_config(&config.theme, None);
+    g.config = config.clone();
+    g.apply_config(config);
   }
 
   let buffer = render_ui(greeter, 80, 24).await;
@@ -633,15 +631,14 @@ async fn test_theme_multiple_colors_applied() {
     let mut g = greeter.write().await;
     g.mode = Mode::Username;
 
-    let mut config = Config::default();
+    let mut config = Config::defaults();
     config.display.greeting = Some("Test".to_string());
     config.theme.border = Some("red".to_string());
     config.theme.text = Some("cyan".to_string());
     config.theme.greet = Some("green".to_string());
 
-    g.loaded_config = Some(config.clone());
-    g.apply_config(&config);
-    g.apply_theme_config(&config.theme, None);
+    g.config = config.clone();
+    g.apply_config(config);
   }
 
   let buffer = render_ui(greeter, 80, 24).await;
@@ -672,6 +669,27 @@ async fn test_theme_multiple_colors_applied() {
   );
 }
 
+#[test]
+fn test_cli_theme_overrides_config_theme_jail() {
+  Jail::expect_with(|jail| {
+    jail.create_file(
+      "config.toml",
+      r#"
+            [theme]
+            theme_border_color = red
+            "#,
+    )?;
+
+    let (config, warnings) =
+      load_config_from(["tuigreet", "--theme-border", "blue"]).unwrap();
+
+    assert_eq!(config.theme.border.unwrap(), "blue");
+    assert!(warnings.is_empty(), "Expected no warnings");
+
+    Ok(())
+  });
+}
+
 #[tokio::test]
 async fn test_cli_theme_overrides_config_theme() {
   let greeter = test_greeter();
@@ -679,13 +697,12 @@ async fn test_cli_theme_overrides_config_theme() {
     let mut g = greeter.write().await;
     g.mode = Mode::Username;
 
-    let mut config = Config::default();
-    config.theme.border = Some("red".to_string());
+    let (config, warnings) =
+      load_config_from(["tuigreet", "--theme-border", "blue"]).unwrap();
 
+    assert!(warnings.is_empty(), "Warnings should be empty");
     // CLI theme overrides with blue
-    g.loaded_config = Some(config.clone());
-    g.apply_config(&config);
-    g.apply_theme_config(&config.theme, Some("border=blue"));
+    g.apply_config(config);
   }
 
   let buffer = render_ui(greeter, 80, 24).await;
@@ -731,15 +748,14 @@ async fn test_theme_with_time_widget() {
   {
     let mut g = greeter.write().await;
     g.mode = Mode::Username;
-    g.time = true;
+    g.display.show_time = true;
 
-    let mut config = Config::default();
+    let mut config = Config::defaults();
     config.display.show_time = true;
     config.theme.time = Some("lightred".to_string());
 
-    g.loaded_config = Some(config.clone());
-    g.apply_config(&config);
-    g.apply_theme_config(&config.theme, None);
+    g.config = config.clone();
+    g.apply_config(config);
   }
 
   let buffer = render_ui(greeter, 80, 24).await;
diff --git a/crates/tuigreet/src/ui/util.rs b/crates/tuigreet/src/ui/util.rs
index 3392e87..01b29ed 100644
--- a/crates/tuigreet/src/ui/util.rs
+++ b/crates/tuigreet/src/ui/util.rs
@@ -22,7 +22,7 @@ pub fn buttonize(message: &str) -> String {
 pub fn should_hide_cursor(greeter: &Greeter) -> bool {
   greeter.working
     || greeter.done
-    || (greeter.user_menu
+    || (greeter.user_menu.enabled
       && greeter.mode == Mode::Username
       && greeter.username.value.is_empty())
     || (greeter.mode == Mode::Password && greeter.prompt.is_none())
@@ -46,8 +46,8 @@ pub fn should_hide_cursor(greeter: &Greeter) -> bool {
 // +------------------------+
 pub fn get_height(greeter: &Greeter) -> u16 {
   let (_, greeting_height) = get_greeting_height(greeter, 1, 0);
-  let container_padding = greeter.container_padding();
-  let prompt_padding = greeter.prompt_padding();
+  let container_padding = greeter.layout.container_padding;
+  let prompt_padding = greeter.layout.prompt_padding;
 
   let initial = match greeter.mode {
     Mode::Username | Mode::Action | Mode::Command => {
@@ -88,7 +88,7 @@ pub fn get_rect_bounds(
   area: Rect,
   items: usize,
 ) -> (u16, u16, u16, u16) {
-  let width = greeter.width().min(area.width);
+  let width = greeter.layout.width.min(area.width);
   let box_height = get_height(greeter)
     .saturating_add(u16::try_from(items).unwrap_or(u16::MAX))
     .min(area.height);
@@ -96,7 +96,7 @@ pub fn get_rect_bounds(
   // Account for the message area rendered below the container so that the
   // combined block (box + message) is centered rather than just the box.
   let (_, message_height) =
-    get_message_height(greeter, greeter.container_padding(), 0);
+    get_message_height(greeter, greeter.layout.container_padding, 0);
   let total_height = box_height.saturating_add(message_height);
 
   let x = if width < area.width {
@@ -131,7 +131,7 @@ pub fn get_input_width(
   width: u16,
   label: &Option<String>,
 ) -> u16 {
-  let width = std::cmp::min(greeter.width(), width);
+  let width = std::cmp::min(greeter.layout.width, width);
 
   let label_width = match label {
     None => 0,
@@ -165,7 +165,7 @@ pub fn get_greeting_height(
   fallback: u16,
 ) -> (Option<Paragraph<'_>>, u16) {
   if let Some(greeting) = &greeter.greeting {
-    let width = greeter.width();
+    let width = greeter.layout.width;
 
     let text = match greeting.clone().into_text() {
       Ok(text) => text,
@@ -189,7 +189,7 @@ pub fn get_message_height(
   fallback: u16,
 ) -> (Option<Paragraph<'_>>, u16) {
   if let Some(message) = &greeter.message {
-    let width = greeter.width();
+    let width = greeter.layout.width;
     let paragraph =
       Paragraph::new(message.trim_end()).wrap(Wrap { trim: true });
     let height = paragraph.line_count(width.saturating_sub(4).max(1));
@@ -227,17 +227,15 @@ mod test {
   #[test]
   fn test_container_height_username_padding_zero() {
     let mut greeter = Greeter::default();
-    greeter.config =
-      Greeter::options().parse(&["--container-padding", "0"]).ok();
+    greeter.layout.container_padding = 0;
     greeter.mode = Mode::Username;
 
-    assert_eq!(get_height(&greeter), 3);
+    assert_eq!(get_height(&greeter), 1);
   }
 
   #[test]
   fn tiny_width_has_no_underflow() {
-    let mut greeter = Greeter::default();
-    greeter.config = Greeter::options().parse(Vec::<String>::new()).ok();
+    let greeter = Greeter::default();
     assert_eq!(get_input_width(&greeter, 1, &Some("Username".into())), 0);
     assert_eq!(
       get_rect_bounds(&greeter, Rect::new(0, 0, 1, 1), 0),
@@ -253,11 +251,10 @@ mod test {
   #[test]
   fn test_container_height_username_padding_one() {
     let mut greeter = Greeter::default();
-    greeter.config =
-      Greeter::options().parse(&["--container-padding", "1"]).ok();
+    greeter.layout.container_padding = 1;
     greeter.mode = Mode::Username;
 
-    assert_eq!(get_height(&greeter), 5);
+    assert_eq!(get_height(&greeter), 3);
   }
 
   // +-----------+
@@ -270,12 +267,11 @@ mod test {
   #[test]
   fn test_container_height_username_greeting_padding_one() {
     let mut greeter = Greeter::default();
-    greeter.config =
-      Greeter::options().parse(&["--container-padding", "1"]).ok();
+    greeter.layout.container_padding = 1;
     greeter.greeting = Some("Hello".into());
     greeter.mode = Mode::Username;
 
-    assert_eq!(get_height(&greeter), 7);
+    assert_eq!(get_height(&greeter), 5);
   }
 
   // +-----------+
@@ -290,13 +286,12 @@ mod test {
   #[test]
   fn test_container_height_password_greeting_padding_one_prompt_padding_1() {
     let mut greeter = Greeter::default();
-    greeter.config =
-      Greeter::options().parse(&["--container-padding", "1"]).ok();
+    greeter.layout.container_padding = 1;
     greeter.greeting = Some("Hello".into());
     greeter.mode = Mode::Password;
     greeter.prompt = Some("Password:".into());
 
-    assert_eq!(get_height(&greeter), 9);
+    assert_eq!(get_height(&greeter), 7);
   }
 
   // +-----------+
@@ -310,20 +305,19 @@ mod test {
   #[test]
   fn test_container_height_password_greeting_padding_one_prompt_padding_0() {
     let mut greeter = Greeter::default();
-    greeter.config = Greeter::options()
-      .parse(&["--container-padding", "1", "--prompt-padding", "0"])
-      .ok();
+    greeter.layout.container_padding = 1;
+    greeter.layout.prompt_padding = 0;
     greeter.greeting = Some("Hello".into());
     greeter.mode = Mode::Password;
     greeter.prompt = Some("Password:".into());
 
-    assert_eq!(get_height(&greeter), 8);
+    assert_eq!(get_height(&greeter), 6);
   }
 
   #[test]
   fn test_rect_bounds() {
     let mut greeter = Greeter::default();
-    greeter.config = Greeter::options().parse(&["--width", "50"]).ok();
+    greeter.layout.width = 50;
 
     let (x, y, width, height) =
       get_rect_bounds(&greeter, Rect::new(0, 0, 100, 100), 1);
@@ -348,7 +342,6 @@ mod test {
     // total_height   = 8
     // y = (100 - 8) / 2 = 46  (vs. (100 - 5) / 2 = 47 without the fix)
     let mut greeter = Greeter::default();
-    greeter.config = Greeter::options().parse::<&[&str]>(&[]).ok();
     greeter.message = Some("Wrong password".into());
 
     let (x, y, width, height) =
@@ -363,9 +356,8 @@ mod test {
   #[test]
   fn input_width() {
     let mut greeter = Greeter::default();
-    greeter.config = Greeter::options()
-      .parse(&["--width", "40", "--container-padding", "1"])
-      .ok();
+    greeter.layout.width = 40;
+    greeter.layout.container_padding = 1;
 
     let input_width = get_input_width(&greeter, 40, &Some("Username:".into()));
 
@@ -375,9 +367,8 @@ mod test {
   #[test]
   fn greeting_height_one_line() {
     let mut greeter = Greeter::default();
-    greeter.config = Greeter::options()
-      .parse(&["--width", "15", "--container-padding", "1"])
-      .ok();
+    greeter.layout.width = 15;
+    greeter.layout.container_padding = 1;
     greeter.greeting = Some("Hello World".into());
 
     let (_, height) = get_greeting_height(&greeter, 1, 0);
@@ -388,9 +379,8 @@ mod test {
   #[test]
   fn greeting_height_two_lines() {
     let mut greeter = Greeter::default();
-    greeter.config = Greeter::options()
-      .parse(&["--width", "8", "--container-padding", "1"])
-      .ok();
+    greeter.layout.width = 8;
+    greeter.layout.container_padding = 1;
     greeter.greeting = Some("Hello World".into());
 
     let (_, height) = get_greeting_height(&greeter, 1, 0);
@@ -401,9 +391,8 @@ mod test {
   #[test]
   fn ansi_greeting_height_one_line() {
     let mut greeter = Greeter::default();
-    greeter.config = Greeter::options()
-      .parse(&["--width", "15", "--container-padding", "1"])
-      .ok();
+    greeter.layout.width = 15;
+    greeter.layout.container_padding = 1;
     greeter.greeting = Some("\x1b[31mHello\x1b[0m World".into());
 
     let (text, height) = get_greeting_height(&greeter, 1, 0);
@@ -421,9 +410,8 @@ mod test {
   #[test]
   fn ansi_greeting_height_two_lines() {
     let mut greeter = Greeter::default();
-    greeter.config = Greeter::options()
-      .parse(&["--width", "8", "--container-padding", "1"])
-      .ok();
+    greeter.layout.width = 8;
+    greeter.layout.container_padding = 1;
     greeter.greeting = Some("\x1b[31mHello\x1b[0m World".into());
 
     let (text, height) = get_greeting_height(&greeter, 1, 0);
@@ -441,9 +429,8 @@ mod test {
   #[test]
   fn greeting_preserves_trailing_whitespace() {
     let mut greeter = Greeter::default();
-    greeter.config = Greeter::options()
-      .parse(&["--width", "30", "--container-padding", "1"])
-      .ok();
+    greeter.layout.width = 30;
+    greeter.layout.container_padding = 1;
     // Simulate /etc/issue with trailing spaces for ASCII art alignment
     greeter.greeting = Some("Hello     \nWorld    ".into());
 
diff --git a/crates/tuigreet/src/watcher.rs b/crates/tuigreet/src/watcher.rs
index 26a03c4..57832fb 100644
--- a/crates/tuigreet/src/watcher.rs
+++ b/crates/tuigreet/src/watcher.rs
@@ -1,8 +1,4 @@
-use std::{
-  path::{Path, PathBuf},
-  sync::Arc,
-  time::Duration,
-};
+use std::{path::PathBuf, sync::Arc, time::Duration};
 
 use notify::{
   Config as NotifyConfig,
@@ -14,7 +10,7 @@ use notify::{
 };
 use tokio::sync::{RwLock, mpsc};
 use tracing::{debug, error, info, warn};
-use tuigreet_config::{Config, parser::load_config};
+use tuigreet_config::{config::Config, loader::load_config};
 
 use crate::{Greeter, event::Event as GreeterEvent};
 
@@ -44,7 +40,7 @@ impl ConfigWatcher {
   /// # Errors
   /// Returns error if file watcher cannot be initialized
   pub fn new(
-    config_path: Option<PathBuf>,
+    config_paths: Vec<PathBuf>,
     greeter: Arc<RwLock<Greeter>>,
     event_sender: mpsc::Sender<GreeterEvent>,
   ) -> Result<Self, Box<dyn std::error::Error + Send + Sync>> {
@@ -61,59 +57,43 @@ impl ConfigWatcher {
     )?;
 
     // Determine which config file to watch
-    let watch_path = if let Some(ref path) = config_path {
-      path.clone()
-    } else {
-      // Use XDG config path
-      if let Some(config_dir) = dirs::config_dir() {
-        let user_config = config_dir.join("tuigreet").join("config.toml");
-        if user_config.exists() {
-          user_config
-        } else {
-          // Fall back to system config
-          PathBuf::from("/etc/tuigreet/config.toml")
-        }
-      } else {
-        PathBuf::from("/etc/tuigreet/config.toml")
-      }
-    };
+    let mut watched_paths = Vec::new();
 
-    // Only watch if the config file exists
-    if watch_path.exists() {
-      info!("Starting config file watcher for: {}", watch_path.display());
+    // watch all provided config paths that exist
+    for path in config_paths {
+      let Some(parent) = path.parent() else {
+        continue;
+      };
 
-      // Watch the parent directory to catch file recreations
-      if let Some(parent) = watch_path.parent() {
-        watcher.watch(parent, RecursiveMode::NonRecursive)?;
+      // watch the parent directory (notify works on dirs, not files)
+      let watch_root = parent.ancestors().find(|p| p.exists());
+
+      if let Some(root) = watch_root {
+        watcher.watch(root, RecursiveMode::NonRecursive)?;
+        watched_paths.push(path.clone());
+        info!("Watching config: {}", path.display());
       }
-    } else {
-      info!(
-        "Config file does not exist, hot reloading disabled: {}",
-        watch_path.display()
-      );
+    }
+
+    // Only watch if the config file exists
+    if watched_paths.is_empty() {
+      info!("No config files exist, hot reloading disabled");
     }
 
     // Spawn background task to handle file events
+    let watched_paths_clone = watched_paths.clone();
     tokio::spawn(async move {
       while let Some(result) = rx.recv().await {
         match result {
           Ok(event) => {
-            // Check if this is a modification to our config file
-            if Self::is_config_event(&event, &watch_path) {
+            // Check if this is a modification to any of our config files
+            if Self::is_config_event(&event, &watched_paths_clone) {
               debug!("Config file change detected: {:?}", event);
 
               // Add a small delay to avoid partial writes
               tokio::time::sleep(Duration::from_millis(100)).await;
 
-              let new_config = {
-                let greeter_guard = greeter.read().await;
-                Self::reload_config(
-                  config_path.as_deref(),
-                  greeter_guard.config.as_ref(),
-                )
-              };
-
-              match new_config {
+              match Self::reload_config() {
                 Ok(new_config) => {
                   if let Err(e) =
                     Self::apply_config_to_greeter(&greeter, new_config).await
@@ -145,37 +125,53 @@ impl ConfigWatcher {
     Ok(Self { watcher })
   }
 
-  fn is_config_event(event: &Event, config_path: &Path) -> bool {
+  fn is_config_event(event: &Event, config_paths: &[PathBuf]) -> bool {
     match event.kind {
       EventKind::Modify(_) | EventKind::Create(_) => {
-        event.paths.iter().any(|path| path == config_path)
+        event.paths.iter().any(|path| config_paths.contains(path))
       },
       _ => false,
     }
   }
 
-  fn reload_config(
-    cli_config_path: Option<&Path>,
-    cli_matches: Option<&getopts::Matches>,
-  ) -> Result<Config, Box<dyn std::error::Error + Send + Sync>> {
+  fn reload_config() -> Result<Config, Box<dyn std::error::Error + Send + Sync>>
+  {
     debug!("Reloading configuration");
 
-    let config = load_config(cli_config_path, cli_matches)?;
-
-    match config.validate(false) {
-      Ok(warnings) => {
-        for warning in warnings {
-          warn!("Config warning after reload: {}", warning);
+    match load_config() {
+      Ok((config, warnings)) => {
+        for warning in &warnings {
+          tracing::warn!("{}", warning);
         }
+        Ok(config)
       },
-      Err(e) => {
-        return Err(
-          format!("Config validation failed after reload: {e}").into(),
-        );
+      Err((config, (errors, warnings))) => {
+        // Log all errors and warnings from the failed load
+        for error in &errors {
+          tracing::error!("{}", error);
+        }
+        for warning in &warnings {
+          tracing::warn!("{}", warning);
+        }
+
+        // Decide: do you want to:
+        // A) Still return the partial config?
+        // B) Fail and return an error?
+
+        if errors.is_empty() {
+          // Only warnings, so it's effectively OK
+          Ok(config)
+        } else {
+          // Return a meaningful error with collected errors
+          let err_msg = errors
+            .iter()
+            .map(|e| e.to_string())
+            .collect::<Vec<_>>()
+            .join(", ");
+          Err(err_msg.into())
+        }
       },
     }
-
-    Ok(config)
   }
 
   async fn apply_config_to_greeter(
@@ -186,27 +182,23 @@ impl ConfigWatcher {
 
     // A tracing subscriber is installed once at startup and cannot be safely
     // replaced here. Keep its settings stable until the next restart.
-    let logger_settings = (greeter_guard.debug, greeter_guard.logfile.clone());
-    if greeter_guard.loaded_config.as_ref().is_some_and(|old| {
-      old.general.debug != config.general.debug
-        || old.general.log_file != config.general.log_file
-    }) {
+    let logger_settings = (
+      greeter_guard.general.debug,
+      greeter_guard.general.log_file.clone(),
+    );
+    if greeter_guard.general.debug != config.general.debug
+      || greeter_guard.general.log_file != config.general.log_file
+    {
       warn!("general.debug and general.log_file changes require a restart");
     }
 
     // Applying an already validated configuration replaces all
     // configuration-owned runtime state while holding this write lock.
-    greeter_guard.apply_config(&config);
-    (greeter_guard.debug, greeter_guard.logfile) = logger_settings;
+    greeter_guard.apply_config(config);
+    (greeter_guard.general.debug, greeter_guard.general.log_file) =
+      logger_settings;
     greeter_guard.reload_sessions();
 
-    // Apply theme configuration
-    let cli_theme = greeter_guard.config().opt_str("theme");
-    greeter_guard.apply_theme_config(&config.theme, cli_theme.as_deref());
-
-    // Store the new config
-    greeter_guard.loaded_config = Some(config);
-
     info!("Config hot reload completed successfully");
     Ok(())
   }
diff --git a/crates/tuigreet/tools/gen-manpage.rs b/crates/tuigreet/tools/gen-manpage.rs
new file mode 100644
index 0000000..103d2a6
--- /dev/null
+++ b/crates/tuigreet/tools/gen-manpage.rs
@@ -0,0 +1,27 @@
+use std::fs;
+
+use clap::CommandFactory;
+use clap_mangen::Man;
+
+fn main() -> Result<(), Box<dyn std::error::Error>> {
+  let app = tuigreet_config::config::Config::command();
+
+  // Get about text and convert to owned String
+  let about = app
+    .get_about()
+    .map(|styled| styled.to_string())
+    .unwrap_or_default();
+
+  let cmd = app.long_about(about);
+
+  let mut buffer = Vec::<u8>::new();
+  Man::new(cmd).render(&mut buffer)?;
+
+  // Write to contrib/man directory
+  let output_path = "contrib/man/tuigreet-1";
+  fs::write(output_path, &buffer)?;
+
+  eprintln!("Generated {output_path}");
+
+  Ok(())
+}
diff --git a/nix/package.nix b/nix/package.nix
index dd18dd9..e8f49cd 100644
--- a/nix/package.nix
+++ b/nix/package.nix
@@ -36,12 +36,10 @@ in
 
       nativeBuildInputs = [
         installShellFiles
-        scdoc
       ];
 
       postInstall = ''
-        scdoc < ${../contrib}/man/tuigreet-1.scd > tuigreet.1
-        installManPage tuigreet.1
+        installManPage ${../contrib}/man/tuigreet.1
       '';
 
       meta = {