refactor: moving script into modules that makes sense

- instead of collecting all scripts into modules/scripts we are moving
  them to modules that makes sense (yazi-file-chooser.sh into yazi)

42 files changed, 452 insertions, 425 deletions

diff --git a/modules/communication/neomutt/default.nix b/modules/communication/neomutt/default.nix
index 8613032..8e5d51b 100644
--- a/modules/communication/neomutt/default.nix
+++ b/modules/communication/neomutt/default.nix
@@ -2,8 +2,32 @@
 {
   config,
   lib,
+  pkgs,
   ...
 }:
+let
+  inherit ((import ../../lib/script.nix { inherit lib pkgs; })) mkScriptModule;
+  neomuttSync = mkScriptModule {
+    scope = [
+      "communication"
+      "neomutt"
+    ];
+    name = "neomutt-sync";
+    path = ./neomutt-sync.sh;
+    description = "Neomutt-sync - Interactive mail sync with dialog progress bar";
+    deps = [
+      pkgs.bash
+      pkgs.dialog
+      pkgs.coreutils
+      pkgs.gawk
+      pkgs.gnused
+      pkgs.util-linux
+      config.programs.mbsync.package
+      config.programs.notmuch.package
+    ];
+    inherit config;
+  };
+in
 {
   imports = [
     ./account
@@ -23,10 +47,23 @@
       default = config.programs.neomutt.package;
       description = "The neomutt package to use, wrapped with urlscan in PATH.";
     };
-  };
+  }
+  // neomuttSync.options.communication.neomutt;
 
-  config = lib.mkIf config.communication.neomutt.enable {
-    accounts.email.maildirBasePath = "${config.home.homeDirectory}/.local/share/mail";
-    home.sessionVariables.MAILDIR = config.accounts.email.maildirBasePath;
-  };
+  config = lib.mkMerge [
+    (lib.mkIf config.communication.neomutt.enable {
+      accounts.email.maildirBasePath = "${config.home.homeDirectory}/.local/share/mail";
+      home.sessionVariables.MAILDIR = config.accounts.email.maildirBasePath;
+    })
+    neomuttSync.config
+    {
+      assertions = [
+        {
+          assertion =
+            !config.communication.neomutt.neomutt-sync.enable || config.communication.neomutt.enable;
+          message = "communication.neomutt.neomutt-sync is enabled but requires `communication.neomutt.enable`.";
+        }
+      ];
+    }
+  ];
 }
diff --git a/modules/communication/neomutt/macros.nix b/modules/communication/neomutt/macros.nix
index 57444d9..e5ff437 100644
--- a/modules/communication/neomutt/macros.nix
+++ b/modules/communication/neomutt/macros.nix
@@ -9,7 +9,7 @@
         "pager"
       ];
       key = "gs";
-      action = "<enter-command>set my_wait_key=$wait_key wait_key=no<enter><sync-mailbox><shell-escape>${lib.getExe config.scripts.neomutt-sync.package}<enter><sync-mailbox><enter-command>set wait_key=$my_wait_key<enter>";
+      action = "<enter-command>set my_wait_key=$wait_key wait_key=no<enter><sync-mailbox><shell-escape>${lib.getExe config.communication.neomutt.neomutt-sync.package}<enter><sync-mailbox><enter-command>set wait_key=$my_wait_key<enter>";
     }
     {
       # Extract every URL from the message via urlscan into a picker menu
diff --git a/modules/scripts/neomutt-sync/script.sh b/modules/communication/neomutt/neomutt-sync.sh
index d0dac63..d0dac63 100644
--- a/modules/scripts/neomutt-sync/script.sh
+++ b/modules/communication/neomutt/neomutt-sync.sh
diff --git a/modules/default.nix b/modules/default.nix
index f537af4..05b1dca 100644
--- a/modules/default.nix
+++ b/modules/default.nix
@@ -1,5 +1,5 @@
 # Top-level module aggregator importing all submodules
-{ config, ... }:
+{ ... }:
 {
   imports = [
     ./communication
@@ -8,10 +8,10 @@
     ./file-management
     ./fonts
     ./gaming
+    ./lib
     ./media
     ./networking
     ./office
-    ./scripts
     ./security
     ./system
     ./terminal
diff --git a/modules/file-management/yazi/default.nix b/modules/file-management/yazi/default.nix
index 8d59446..d704614 100644
--- a/modules/file-management/yazi/default.nix
+++ b/modules/file-management/yazi/default.nix
@@ -1,5 +1,29 @@
 # Terminal file manager with native previews
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit ((import ../../lib/script.nix { inherit lib pkgs; })) mkScriptModule;
+  yaziFileChooser = mkScriptModule {
+    scope = [
+      "file-management"
+      "yazi"
+    ];
+    name = "yazi-file-chooser";
+    path = ./yazi-file-chooser.sh;
+    description = "Yazi-based file chooser for XDG Desktop Portal";
+    deps = [
+      pkgs.bash
+      config.file-management.yazi.package
+      config.terminal.kitty.package
+    ];
+    extraLinks = [ "~/.config/xdg-desktop-portal-termfilechooser/config" ];
+    inherit config;
+  };
+in
 {
   imports = [
     ./theme.nix
@@ -15,40 +39,44 @@
       defaultText = lib.literalExpression "config.programs.yazi.finalPackage";
       description = "The yazi package to use. Defaults to the wrapped finalPackage from programs.yazi.";
     };
-  };
+  }
+  // yaziFileChooser.options.file-management.yazi;
 
-  config = lib.mkIf config.file-management.yazi.enable {
-    programs.yazi = {
-      enable = true;
-      shellWrapperName = "yy";
-      enableZshIntegration = config.terminal.zsh.enable;
-      settings = {
-        mgr = {
-          show_hidden = true;
+  config = lib.mkMerge [
+    (lib.mkIf config.file-management.yazi.enable {
+      programs.yazi = {
+        enable = true;
+        shellWrapperName = "yy";
+        enableZshIntegration = config.terminal.zsh.enable;
+        settings = {
+          mgr = {
+            show_hidden = true;
+          };
         };
       };
-    };
 
-    home.file.".local/share/icons/hicolor/scalable/apps/yazi.png" = {
-      source = config.lib.file.mkOutOfStoreSymlink "${config.file-management.yazi.package}/share/pixmaps/yazi.png";
-    };
+      home.file.".local/share/icons/hicolor/scalable/apps/yazi.png" = {
+        source = config.lib.file.mkOutOfStoreSymlink "${config.file-management.yazi.package}/share/pixmaps/yazi.png";
+      };
 
-    xdg.desktopEntries."yazi" = {
-      name = "Yazi";
-      exec = "${lib.getExe config.terminal.kitty.package} --class yazi -e ${lib.getExe config.file-management.yazi.package}";
-      icon = "yazi";
-      categories = [ "Utility" ];
-      comment = "Terminal file manager";
-      terminal = false;
-      type = "Application";
-    };
+      xdg.desktopEntries."yazi" = {
+        name = "Yazi";
+        exec = "${lib.getExe config.terminal.kitty.package} --class yazi -e ${lib.getExe config.file-management.yazi.package}";
+        icon = "yazi";
+        categories = [ "Utility" ];
+        comment = "Terminal file manager";
+        terminal = false;
+        type = "Application";
+      };
 
-    xdg.mimeApps.defaultApplications = {
-      "inode/directory" = "yazi.desktop";
-    };
+      xdg.mimeApps.defaultApplications = {
+        "inode/directory" = "yazi.desktop";
+      };
 
-    home.sessionVariables = {
-      TERMCMD = lib.mkIf config.terminal.kitty.enable "${lib.getExe config.terminal.kitty.package} --class file-explorer --title 'Yazi'";
-    };
-  };
+      home.sessionVariables = {
+        TERMCMD = lib.mkIf config.terminal.kitty.enable "${lib.getExe config.terminal.kitty.package} --class file-explorer --title 'Yazi'";
+      };
+    })
+    yaziFileChooser.config
+  ];
 }
diff --git a/modules/scripts/yazi-file-chooser/script.sh b/modules/file-management/yazi/yazi-file-chooser.sh
index 7978222..7978222 100644
--- a/modules/scripts/yazi-file-chooser/script.sh
+++ b/modules/file-management/yazi/yazi-file-chooser.sh
diff --git a/modules/lib/default.nix b/modules/lib/default.nix
new file mode 100644
index 0000000..fd54fa2
--- /dev/null
+++ b/modules/lib/default.nix
@@ -0,0 +1,48 @@
+# Internal aggregation for script modules registered via mkScriptModule
+{
+  config,
+  lib,
+  ...
+}:
+{
+  options.scriptPaths = lib.mkOption {
+    type = lib.types.listOf (lib.types.listOf lib.types.str);
+    default = [ ];
+    internal = true;
+    description = "Attr paths of script modules registered via mkScriptModule.";
+  };
+
+  config = {
+    home.packages = lib.filter (p: p != null) (
+      map (path: (lib.getAttrFromPath path config).package) config.scriptPaths
+    );
+
+    xdg.desktopEntries = lib.listToAttrs (
+      map
+        (
+          path:
+          let
+            name = lib.last path;
+            sc = lib.getAttrFromPath path config;
+          in
+          lib.nameValuePair name {
+            name = sc.desktop.displayName;
+            exec = "${lib.getExe config.terminal.kitty.package} --class ${name} -e ${lib.getExe sc.package}";
+            icon = sc.desktop.icon;
+            categories = [ "Utility" ];
+            terminal = false;
+            type = "Application";
+          }
+        )
+        (
+          lib.filter (
+            path:
+            let
+              sc = lib.getAttrFromPath path config;
+            in
+            sc.enable && sc.desktop.enable
+          ) config.scriptPaths
+        )
+    );
+  };
+}
diff --git a/modules/scripts/lib.nix b/modules/lib/script.nix
index 31d7e5b..9871b88 100644
--- a/modules/scripts/lib.nix
+++ b/modules/lib/script.nix
@@ -1,4 +1,8 @@
-{ lib, pkgs }:
+# Library for creating script modules
+{
+  lib,
+  pkgs,
+}:
 let
   shellArgs = {
     zsh = name: file: "--zsh --name _${name} ${file}";
@@ -47,8 +51,10 @@ let
         ];
         meta = base.meta or { };
       };
+
   mkScriptModule =
     {
+      scope ? [ ],
       name,
       path,
       env ? { },
@@ -60,10 +66,13 @@ let
       completion ? { },
     }:
     let
+      scriptAttrs = scope ++ [ name ];
+      dottedName = lib.concatStringsSep "." scriptAttrs;
+      c = lib.getAttrFromPath scriptAttrs config;
       scriptDrv = mkScript name path description env deps completion;
     in
     {
-      options.scripts.${name} = {
+      options = lib.setAttrByPath scriptAttrs {
         enable = lib.mkOption {
           type = lib.types.bool;
           default = true;
@@ -74,12 +83,10 @@ let
           readOnly = true;
           description = "The derivation for the ${name} script.";
         };
-        completion = {
-          enable = lib.mkOption {
-            type = lib.types.bool;
-            default = completion != { };
-            description = "Whether to install completions for the ${name} script.";
-          };
+        completion.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = completion != { };
+          description = "Whether to install completions for the ${name} script.";
         };
         desktop = {
           enable = lib.mkOption {
@@ -99,37 +106,39 @@ let
           };
         };
       };
-      moduleConfig = {
-        scripts.${name} = lib.mkIf config.scripts.${name}.enable (
-          {
-            package = scriptDrv;
-          }
-          // lib.optionalAttrs (desktop != null) { inherit desktop; }
-        );
-        home.file = lib.mkIf config.scripts.${name}.enable (
-          builtins.listToAttrs (
-            map (linkPath: {
-              name = lib.removePrefix "~/" linkPath;
-              value = {
-                source = "${scriptDrv}/bin/${name}";
-              };
-            }) extraLinks
+
+      config =
+        lib.setAttrByPath scriptAttrs (
+          lib.mkIf c.enable (
+            {
+              package = scriptDrv;
+            }
+            // lib.optionalAttrs (desktop != null) { inherit desktop; }
           )
-        );
-        assertions = [
-          {
-            assertion =
-              !config.scripts.${name}.enable
-              || !config.scripts.${name}.desktop.enable
-              || config.terminal.kitty.enable;
-            message = "scripts.${name}.desktop.enable requires terminal.kitty.enable because desktop entries launch scripts in kitty.";
-          }
-          {
-            assertion = !config.scripts.${name}.completion.enable || completion != { };
-            message = "scripts.${name}.completion.enable is true but no completion text was provided to mkScriptModule.";
-          }
-        ];
-      };
+        )
+        // {
+          home.file = lib.mkIf c.enable (
+            builtins.listToAttrs (
+              map (linkPath: {
+                name = lib.removePrefix "~/" linkPath;
+                value = {
+                  source = "${scriptDrv}/bin/${name}";
+                };
+              }) extraLinks
+            )
+          );
+          assertions = [
+            {
+              assertion = !c.enable || !c.desktop.enable || config.terminal.kitty.enable;
+              message = "${dottedName}.desktop.enable requires terminal.kitty.enable because desktop entries launch scripts in kitty.";
+            }
+            {
+              assertion = !c.completion.enable || completion != { };
+              message = "${dottedName}.completion.enable is true but no completion text was provided to mkScriptModule.";
+            }
+          ];
+          scriptPaths = [ scriptAttrs ];
+        };
     };
 in
 {
diff --git a/modules/media/default.nix b/modules/media/default.nix
index 74cc62d..0f466fa 100644
--- a/modules/media/default.nix
+++ b/modules/media/default.nix
@@ -6,6 +6,7 @@
     ./grim
     ./pamixer
     ./playerctl
+    ./screen-recording
     ./slurp
     ./vlc
     ./wf-recorder
diff --git a/modules/media/screen-recording/assertions.nix b/modules/media/screen-recording/assertions.nix
new file mode 100644
index 0000000..200d5ea
--- /dev/null
+++ b/modules/media/screen-recording/assertions.nix
@@ -0,0 +1,11 @@
+{ config, ... }:
+[
+  {
+    assertion = !config.media.screen-recording.enable || config.media.slurp.enable;
+    message = "media.screen-recording is enabled but requires `media.slurp.enable`.";
+  }
+  {
+    assertion = !config.media.screen-recording.enable || config.media.wf-recorder.enable;
+    message = "media.screen-recording is enabled but requires `media.wf-recorder.enable`.";
+  }
+]
diff --git a/modules/media/screen-recording/default.nix b/modules/media/screen-recording/default.nix
new file mode 100644
index 0000000..7a68f08
--- /dev/null
+++ b/modules/media/screen-recording/default.nix
@@ -0,0 +1,40 @@
+# Screen recording script using wf-recorder and slurp
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit ((import ../../lib/script.nix { inherit lib pkgs; })) mkScriptModule;
+  script = mkScriptModule {
+    scope = [ "media" ];
+    name = "screen-recording";
+    path = ./screen-recording.sh;
+    description = "Screen recording script using wf-recorder and slurp for region selection\nRecords Wayland screen to MP4\nUsage: screen-recording.sh [-s|--select]\n  -s, --select  Launch slurp to select recording region";
+    deps = [
+      pkgs.bash
+      config.media.slurp.package
+      config.media.wf-recorder.package
+    ];
+    completion.zsh = builtins.readFile ./screen-recording.zsh;
+    desktop = {
+      enable = true;
+      displayName = "Screen Recording";
+      icon = "obs";
+    };
+    inherit config;
+  };
+in
+{
+  options = script.options;
+  config = lib.mkMerge [
+    script.config
+    {
+      assertions = import ./assertions.nix { inherit config lib; };
+      home.file.".local/share/icons/hicolor/scalable/apps/obs.svg" = {
+        source = ../../../assets/icons/obs.svg;
+      };
+    }
+  ];
+}
diff --git a/modules/scripts/screen-recording/script.sh b/modules/media/screen-recording/screen-recording.sh
index 336c32e..336c32e 100644
--- a/modules/scripts/screen-recording/script.sh
+++ b/modules/media/screen-recording/screen-recording.sh
diff --git a/modules/scripts/screen-recording/completion.zsh b/modules/media/screen-recording/screen-recording.zsh
index 835ec43..835ec43 100644
--- a/modules/scripts/screen-recording/completion.zsh
+++ b/modules/media/screen-recording/screen-recording.zsh
diff --git a/modules/networking/usque/default.nix b/modules/networking/usque/default.nix
index b8c25ee..9d04ab7 100644
--- a/modules/networking/usque/default.nix
+++ b/modules/networking/usque/default.nix
@@ -5,6 +5,24 @@
   lib,
   ...
 }:
+let
+  inherit ((import ../../lib/script.nix { inherit lib pkgs; })) mkScriptModule;
+  usqueWarp = mkScriptModule {
+    scope = [
+      "networking"
+      "usque"
+    ];
+    name = "usque-warp";
+    path = ./usque-warp.sh;
+    description = "Connect/disconnect to Cloudflare WARP via usque MASQUE tunnel";
+    deps = [
+      config.networking.usque.package
+      pkgs.bash
+    ];
+    completion.zsh = builtins.readFile ./usque-warp.zsh;
+    inherit config;
+  };
+in
 {
   options.networking.usque = {
     enable = lib.mkEnableOption "Enables usque.";
@@ -13,9 +31,13 @@
       default = pkgs.usque;
       description = "The usque package to use.";
     };
-  };
+  }
+  // usqueWarp.options.networking.usque;
 
-  config = lib.mkIf config.networking.usque.enable {
-    home.packages = [ config.networking.usque.package ];
-  };
+  config = lib.mkMerge [
+    (lib.mkIf config.networking.usque.enable {
+      home.packages = [ config.networking.usque.package ];
+    })
+    usqueWarp.config
+  ];
 }
diff --git a/modules/scripts/usque-warp/script.sh b/modules/networking/usque/usque-warp.sh
index 9d32872..9d32872 100644
--- a/modules/scripts/usque-warp/script.sh
+++ b/modules/networking/usque/usque-warp.sh
diff --git a/modules/scripts/usque-warp/completion.zsh b/modules/networking/usque/usque-warp.zsh
index fbb340e..fbb340e 100644
--- a/modules/scripts/usque-warp/completion.zsh
+++ b/modules/networking/usque/usque-warp.zsh
diff --git a/modules/scripts/deep-clean/default.nix b/modules/scripts/deep-clean/default.nix
deleted file mode 100644
index 56f6aa0..0000000
--- a/modules/scripts/deep-clean/default.nix
+++ /dev/null
@@ -1,22 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  inherit ((import ../lib.nix { inherit lib pkgs; })) mkScriptModule;
-  base = mkScriptModule {
-    name = "deep-clean";
-    path = ./script.sh;
-    description = "Deep clean script for Nix systems\nRemoves old generations, garbage, and optimizes store\nWARNING: Do NOT run with sudo - run as normal user";
-    deps = [
-      pkgs.bash
-    ];
-    inherit config;
-  };
-in
-{
-  options = base.options;
-  config = base.moduleConfig;
-}
diff --git a/modules/scripts/default.nix b/modules/scripts/default.nix
deleted file mode 100644
index ae18329..0000000
--- a/modules/scripts/default.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-{
-  imports = [
-    ./deep-clean
-    ./gopass-ssh-load
-    ./gpg-backup
-    ./nix-update
-    ./neomutt-sync
-    ./screen-recording
-    ./system-monitor
-    ./usque-warp
-    ./yazi-file-chooser
-  ];
-
-  config = {
-    home.packages = lib.filter (x: x != null) (lib.mapAttrsToList (_: s: s.package) config.scripts);
-
-    xdg.desktopEntries = lib.mapAttrs' (
-      name: sc:
-      lib.nameValuePair name {
-        name = sc.desktop.displayName;
-        exec = "${lib.getExe config.terminal.kitty.package} --class ${name} -e ${lib.getExe sc.package}";
-        icon = sc.desktop.icon;
-        categories = [ "Utility" ];
-        terminal = false;
-        type = "Application";
-      }
-    ) (lib.filterAttrs (_: sc: sc.enable && sc.desktop.enable) config.scripts);
-  };
-}
diff --git a/modules/scripts/gopass-ssh-load/default.nix b/modules/scripts/gopass-ssh-load/default.nix
deleted file mode 100644
index 764f704..0000000
--- a/modules/scripts/gopass-ssh-load/default.nix
+++ /dev/null
@@ -1,32 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  inherit ((import ../lib.nix { inherit lib pkgs; })) mkScriptModule;
-
-  gopassKeys = config.security.ssh.gopassKeys;
-
-  base = mkScriptModule {
-    name = "gopass-ssh-load";
-    path = ./script.sh;
-    description = "Load SSH keys from gopass password store";
-    env = {
-      GNUPGHOME = config.home.sessionVariables.GNUPGHOME;
-      GOPASS_SSH_KEYS = lib.concatStringsSep " " gopassKeys;
-    };
-    deps = with pkgs; [
-      config.security.gopass.package
-      gnupg
-      openssh
-      bash
-    ];
-    inherit config;
-  };
-in
-{
-  options = base.options;
-  config = base.moduleConfig;
-}
diff --git a/modules/scripts/gpg-backup/default.nix b/modules/scripts/gpg-backup/default.nix
deleted file mode 100644
index b97aad8..0000000
--- a/modules/scripts/gpg-backup/default.nix
+++ /dev/null
@@ -1,27 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  inherit ((import ../lib.nix { inherit lib pkgs; })) mkScriptModule;
-  base = mkScriptModule {
-    name = "gpg-backup";
-    path = ./script.sh;
-    description = "Export/import all GPG keys as a single passphrase-protected file with maximum S2K iteration count\nUsage: gpg-backup export filename.gpg | gpg-backup import filename.gpg";
-    deps = [
-      pkgs.bash
-      pkgs.gnupg
-      pkgs.gnutar
-      pkgs.coreutils
-      pkgs.findutils
-    ];
-    completion.zsh = builtins.readFile ./completion.zsh;
-    inherit config;
-  };
-in
-{
-  options = base.options;
-  config = base.moduleConfig;
-}
diff --git a/modules/scripts/neomutt-sync/assertions.nix b/modules/scripts/neomutt-sync/assertions.nix
deleted file mode 100644
index 38f48e4..0000000
--- a/modules/scripts/neomutt-sync/assertions.nix
+++ /dev/null
@@ -1,7 +0,0 @@
-{ config, ... }:
-[
-  {
-    assertion = !config.scripts.neomutt-sync.enable || config.communication.neomutt.enable;
-    message = "scripts.neomutt-sync is enabled but requires `communication.neomutt.enable`.";
-  }
-]
diff --git a/modules/scripts/neomutt-sync/default.nix b/modules/scripts/neomutt-sync/default.nix
deleted file mode 100644
index d990210..0000000
--- a/modules/scripts/neomutt-sync/default.nix
+++ /dev/null
@@ -1,31 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  inherit ((import ../lib.nix { inherit lib pkgs; })) mkScriptModule;
-  base = mkScriptModule {
-    name = "neomutt-sync";
-    path = ./script.sh;
-    description = "Neomutt-sync - Interactive mail sync with dialog progress bar";
-    deps = [
-      pkgs.bash
-      pkgs.dialog
-      pkgs.coreutils
-      pkgs.gawk
-      pkgs.gnused
-      pkgs.util-linux
-      config.programs.mbsync.package
-      config.programs.notmuch.package
-    ];
-    inherit config;
-  };
-in
-{
-  options = base.options;
-  config = base.moduleConfig // {
-    assertions = base.moduleConfig.assertions ++ (import ./assertions.nix { inherit config lib; });
-  };
-}
diff --git a/modules/scripts/nix-update/default.nix b/modules/scripts/nix-update/default.nix
deleted file mode 100644
index 633ff3d..0000000
--- a/modules/scripts/nix-update/default.nix
+++ /dev/null
@@ -1,26 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  inherit ((import ../lib.nix { inherit lib pkgs; })) mkScriptModule;
-  base = mkScriptModule {
-    name = "nix-update";
-    path = ./script.sh;
-    description = "Update NixOS and/or Home Manager flake configuration\nRuns nix flake update and rebuilds the system";
-    deps = [
-      pkgs.git
-      pkgs.nix
-      config.programs.home-manager.package
-      pkgs.bash
-    ];
-    completion.zsh = builtins.readFile ./completion.zsh;
-    inherit config;
-  };
-in
-{
-  options = base.options;
-  config = base.moduleConfig;
-}
diff --git a/modules/scripts/screen-recording/assertions.nix b/modules/scripts/screen-recording/assertions.nix
deleted file mode 100644
index f858623..0000000
--- a/modules/scripts/screen-recording/assertions.nix
+++ /dev/null
@@ -1,11 +0,0 @@
-{ config, ... }:
-[
-  {
-    assertion = !config.scripts.screen-recording.enable || config.media.slurp.enable;
-    message = "scripts.screen-recording is enabled but requires `media.slurp.enable`.";
-  }
-  {
-    assertion = !config.scripts.screen-recording.enable || config.media.wf-recorder.enable;
-    message = "scripts.screen-recording is enabled but requires `media.wf-recorder.enable`.";
-  }
-]
diff --git a/modules/scripts/screen-recording/default.nix b/modules/scripts/screen-recording/default.nix
deleted file mode 100644
index 6aa0f89..0000000
--- a/modules/scripts/screen-recording/default.nix
+++ /dev/null
@@ -1,35 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  inherit ((import ../lib.nix { inherit lib pkgs; })) mkScriptModule;
-  base = mkScriptModule {
-    name = "screen-recording";
-    path = ./script.sh;
-    description = "Screen recording script using wf-recorder and slurp for region selection\nRecords Wayland screen to MP4\nUsage: screen-recording.sh [-s|--select]\n  -s, --select  Launch slurp to select recording region";
-    deps = [
-      pkgs.bash
-      config.media.slurp.package
-      config.media.wf-recorder.package
-    ];
-    completion.zsh = builtins.readFile ./completion.zsh;
-    desktop = {
-      enable = true;
-      displayName = "Screen Recording";
-      icon = "obs";
-    };
-    inherit config;
-  };
-in
-{
-  options = base.options;
-  config = base.moduleConfig // {
-    assertions = base.moduleConfig.assertions ++ (import ./assertions.nix { inherit config lib; });
-    home.file.".local/share/icons/hicolor/scalable/apps/obs.svg" = {
-      source = ../../../assets/icons/obs.svg;
-    };
-  };
-}
diff --git a/modules/scripts/system-monitor/assertions.nix b/modules/scripts/system-monitor/assertions.nix
deleted file mode 100644
index 0710fc3..0000000
--- a/modules/scripts/system-monitor/assertions.nix
+++ /dev/null
@@ -1,19 +0,0 @@
-{ config, ... }:
-[
-  {
-    assertion = !config.scripts.system-monitor.enable || config.system.bottom.enable;
-    message = "scripts.system-monitor is enabled but requires `system.bottom.enable`.";
-  }
-  {
-    assertion = !config.scripts.system-monitor.enable || config.system.nvtop.enable;
-    message = "scripts.system-monitor is enabled but requires `system.nvtop.enable`.";
-  }
-  {
-    assertion = !config.scripts.system-monitor.enable || config.terminal.tmux.enable;
-    message = "scripts.system-monitor is enabled but requires `terminal.tmux.enable`.";
-  }
-  {
-    assertion = !config.scripts.system-monitor.enable || config.terminal.kitty.enable;
-    message = "scripts.system-monitor is enabled but requires `terminal.kitty.enable`.";
-  }
-]
diff --git a/modules/scripts/usque-warp/default.nix b/modules/scripts/usque-warp/default.nix
deleted file mode 100644
index 1831a44..0000000
--- a/modules/scripts/usque-warp/default.nix
+++ /dev/null
@@ -1,24 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  inherit ((import ../lib.nix { inherit lib pkgs; })) mkScriptModule;
-  base = mkScriptModule {
-    name = "usque-warp";
-    path = ./script.sh;
-    description = "Connect/disconnect to Cloudflare WARP via usque MASQUE tunnel";
-    deps = [
-      config.networking.usque.package
-      pkgs.bash
-    ];
-    completion.zsh = builtins.readFile ./completion.zsh;
-    inherit config;
-  };
-in
-{
-  options = base.options;
-  config = base.moduleConfig;
-}
diff --git a/modules/scripts/yazi-file-chooser/default.nix b/modules/scripts/yazi-file-chooser/default.nix
deleted file mode 100644
index 3e99aad..0000000
--- a/modules/scripts/yazi-file-chooser/default.nix
+++ /dev/null
@@ -1,25 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  inherit ((import ../lib.nix { inherit lib pkgs; })) mkScriptModule;
-  base = mkScriptModule {
-    name = "yazi-file-chooser";
-    path = ./script.sh;
-    description = "Yazi-based file chooser for XDG Desktop Portal";
-    deps = [
-      pkgs.bash
-      config.file-management.yazi.package
-      config.terminal.kitty.package
-    ];
-    extraLinks = [ "~/.config/xdg-desktop-portal-termfilechooser/config" ];
-    inherit config;
-  };
-in
-{
-  options = base.options;
-  config = base.moduleConfig;
-}
diff --git a/modules/security/gopass/default.nix b/modules/security/gopass/default.nix
index d154226..4fefdd2 100644
--- a/modules/security/gopass/default.nix
+++ b/modules/security/gopass/default.nix
@@ -5,6 +5,32 @@
   pkgs,
   ...
 }:
+let
+  inherit ((import ../../lib/script.nix { inherit lib pkgs; })) mkScriptModule;
+
+  gopassKeys = config.security.ssh.gopassKeys;
+
+  gopassSshLoad = mkScriptModule {
+    scope = [
+      "security"
+      "gopass"
+    ];
+    name = "gopass-ssh-load";
+    path = ./gopass-ssh-load.sh;
+    description = "Load SSH keys from gopass password store";
+    env = {
+      GNUPGHOME = config.home.sessionVariables.GNUPGHOME;
+      GOPASS_SSH_KEYS = lib.concatStringsSep " " gopassKeys;
+    };
+    deps = with pkgs; [
+      config.security.gopass.package
+      gnupg
+      openssh
+      bash
+    ];
+    inherit config;
+  };
+in
 {
   options.security.gopass = {
     enable = lib.mkEnableOption "Enables gopass.";
@@ -15,33 +41,37 @@
       description = "The gopass package to use.";
     };
     ssh-agent.enable = lib.mkEnableOption "gopass-backed SSH keys for git";
-  };
+  }
+  // gopassSshLoad.options.security.gopass;
 
-  config = lib.mkIf config.security.gopass.enable {
-    programs.password-store = {
-      enable = true;
-      package = pkgs.gopass.override { passAlias = true; };
-      settings = {
-        PASSWORD_STORE_DIR = "${config.home.homeDirectory}/.local/share/pass";
+  config = lib.mkMerge [
+    (lib.mkIf config.security.gopass.enable {
+      programs.password-store = {
+        enable = true;
+        package = pkgs.gopass.override { passAlias = true; };
+        settings = {
+          PASSWORD_STORE_DIR = "${config.home.homeDirectory}/.local/share/pass";
+        };
       };
-    };
 
-    home.sessionVariables = {
-      PASSWORD_STORE_DIR = config.programs.password-store.settings.PASSWORD_STORE_DIR;
-    };
+      home.sessionVariables = {
+        PASSWORD_STORE_DIR = config.programs.password-store.settings.PASSWORD_STORE_DIR;
+      };
 
-    home.file.".local/share/icons/hicolor/scalable/apps/gopass.svg" = {
-      source = ../../../assets/icons/gopass.svg;
-    };
+      home.file.".local/share/icons/hicolor/scalable/apps/gopass.svg" = {
+        source = ../../../assets/icons/gopass.svg;
+      };
 
-    xdg.desktopEntries."gopass" = {
-      name = "gopass";
-      exec = "${lib.getExe config.terminal.kitty.package} --class gopass -e ${lib.getExe config.security.gopass.package}";
-      icon = "gopass";
-      comment = "Standard Unix password manager (Go implementation)";
-      categories = [ "Utility" ];
-      terminal = false;
-      type = "Application";
-    };
-  };
+      xdg.desktopEntries."gopass" = {
+        name = "gopass";
+        exec = "${lib.getExe config.terminal.kitty.package} --class gopass -e ${lib.getExe config.security.gopass.package}";
+        icon = "gopass";
+        comment = "Standard Unix password manager (Go implementation)";
+        categories = [ "Utility" ];
+        terminal = false;
+        type = "Application";
+      };
+    })
+    gopassSshLoad.config
+  ];
 }
diff --git a/modules/scripts/gopass-ssh-load/script.sh b/modules/security/gopass/gopass-ssh-load.sh
index c6b9a29..c6b9a29 100644
--- a/modules/scripts/gopass-ssh-load/script.sh
+++ b/modules/security/gopass/gopass-ssh-load.sh
diff --git a/modules/security/gpg/default.nix b/modules/security/gpg/default.nix
index 472270b..07d9d4b 100644
--- a/modules/security/gpg/default.nix
+++ b/modules/security/gpg/default.nix
@@ -5,6 +5,27 @@
   pkgs,
   ...
 }:
+let
+  inherit ((import ../../lib/script.nix { inherit lib pkgs; })) mkScriptModule;
+  gpgBackup = mkScriptModule {
+    scope = [
+      "security"
+      "gpg"
+    ];
+    name = "gpg-backup";
+    path = ./gpg-backup.sh;
+    description = "Export/import all GPG keys as a single passphrase-protected file with maximum S2K iteration count\nUsage: gpg-backup export filename.gpg | gpg-backup import filename.gpg";
+    deps = [
+      pkgs.bash
+      pkgs.gnupg
+      pkgs.gnutar
+      pkgs.coreutils
+      pkgs.findutils
+    ];
+    completion.zsh = builtins.readFile ./gpg-backup.zsh;
+    inherit config;
+  };
+in
 {
   options.security.gpg = {
     enable = lib.mkEnableOption "Enables gpg.";
@@ -16,25 +37,29 @@
       defaultText = lib.literalExpression "config.programs.gpg.package";
       description = "The gpg package to use.";
     };
-  };
+  }
+  // gpgBackup.options.security.gpg;
 
-  config = lib.mkIf config.security.gpg.enable {
-    programs.gpg = {
-      enable = true;
-      homedir = "${config.xdg.dataHome}/gnupg";
-    };
+  config = lib.mkMerge [
+    (lib.mkIf config.security.gpg.enable {
+      programs.gpg = {
+        enable = true;
+        homedir = "${config.xdg.dataHome}/gnupg";
+      };
 
-    home.sessionVariables = {
-      GNUPGHOME = config.programs.gpg.homedir;
-    };
+      home.sessionVariables = {
+        GNUPGHOME = config.programs.gpg.homedir;
+      };
 
-    services.gpg-agent = {
-      enable = true;
-      enableZshIntegration = true;
-      defaultCacheTtl = 3600;
-      maxCacheTtl = 86400;
-      enableSshSupport = config.security.ssh.enable;
-      pinentry.package = pkgs.pinentry-rofi;
-    };
-  };
+      services.gpg-agent = {
+        enable = true;
+        enableZshIntegration = true;
+        defaultCacheTtl = 3600;
+        maxCacheTtl = 86400;
+        enableSshSupport = config.security.ssh.enable;
+        pinentry.package = pkgs.pinentry-rofi;
+      };
+    })
+    gpgBackup.config
+  ];
 }
diff --git a/modules/scripts/gpg-backup/script.sh b/modules/security/gpg/gpg-backup.sh
index 57c216b..57c216b 100644
--- a/modules/scripts/gpg-backup/script.sh
+++ b/modules/security/gpg/gpg-backup.sh
diff --git a/modules/scripts/gpg-backup/completion.zsh b/modules/security/gpg/gpg-backup.zsh
index f47bbe8..f47bbe8 100644
--- a/modules/scripts/gpg-backup/completion.zsh
+++ b/modules/security/gpg/gpg-backup.zsh
diff --git a/modules/scripts/deep-clean/script.sh b/modules/system/deep-clean/deep-clean.sh
index bb28182..bb28182 100644
--- a/modules/scripts/deep-clean/script.sh
+++ b/modules/system/deep-clean/deep-clean.sh
diff --git a/modules/system/deep-clean/default.nix b/modules/system/deep-clean/default.nix
new file mode 100644
index 0000000..af75382
--- /dev/null
+++ b/modules/system/deep-clean/default.nix
@@ -0,0 +1,18 @@
+# Deep clean script for Nix systems
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit ((import ../../lib/script.nix { inherit lib pkgs; })) mkScriptModule;
+in
+mkScriptModule {
+  scope = [ "system" ];
+  name = "deep-clean";
+  path = ./deep-clean.sh;
+  description = "Deep clean script for Nix systems\nRemoves old generations, garbage, and optimizes store\nWARNING: Do NOT run with sudo - run as normal user";
+  deps = [ pkgs.bash ];
+  inherit config;
+}
diff --git a/modules/system/default.nix b/modules/system/default.nix
index 591cd10..9bd3a01 100644
--- a/modules/system/default.nix
+++ b/modules/system/default.nix
@@ -4,8 +4,11 @@
   imports = [
     ./bottom
     ./brightnessctl
+    ./deep-clean
     ./htop
+    ./nix-update
     ./nvtop
+    ./system-monitor
     ./systemctl-tui
   ];
 }
diff --git a/modules/system/nix-update/default.nix b/modules/system/nix-update/default.nix
new file mode 100644
index 0000000..13c15f6
--- /dev/null
+++ b/modules/system/nix-update/default.nix
@@ -0,0 +1,24 @@
+# Update NixOS and/or Home Manager flake configuration
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit ((import ../../lib/script.nix { inherit lib pkgs; })) mkScriptModule;
+in
+mkScriptModule {
+  scope = [ "system" ];
+  name = "nix-update";
+  path = ./nix-update.sh;
+  description = "Update NixOS and/or Home Manager flake configuration\nRuns nix flake update and rebuilds the system";
+  deps = [
+    pkgs.git
+    pkgs.nix
+    config.programs.home-manager.package
+    pkgs.bash
+  ];
+  completion.zsh = builtins.readFile ./nix-update.zsh;
+  inherit config;
+}
diff --git a/modules/scripts/nix-update/script.sh b/modules/system/nix-update/nix-update.sh
index 0f1c0c1..0f1c0c1 100644
--- a/modules/scripts/nix-update/script.sh
+++ b/modules/system/nix-update/nix-update.sh
diff --git a/modules/scripts/nix-update/completion.zsh b/modules/system/nix-update/nix-update.zsh
index a9500e6..a9500e6 100644
--- a/modules/scripts/nix-update/completion.zsh
+++ b/modules/system/nix-update/nix-update.zsh
diff --git a/modules/system/system-monitor/assertions.nix b/modules/system/system-monitor/assertions.nix
new file mode 100644
index 0000000..08b9f7c
--- /dev/null
+++ b/modules/system/system-monitor/assertions.nix
@@ -0,0 +1,19 @@
+{ config, ... }:
+[
+  {
+    assertion = !config.system.system-monitor.enable || config.system.bottom.enable;
+    message = "system.system-monitor is enabled but requires `system.bottom.enable`.";
+  }
+  {
+    assertion = !config.system.system-monitor.enable || config.system.nvtop.enable;
+    message = "system.system-monitor is enabled but requires `system.nvtop.enable`.";
+  }
+  {
+    assertion = !config.system.system-monitor.enable || config.terminal.tmux.enable;
+    message = "system.system-monitor is enabled but requires `terminal.tmux.enable`.";
+  }
+  {
+    assertion = !config.system.system-monitor.enable || config.terminal.kitty.enable;
+    message = "system.system-monitor is enabled but requires `terminal.kitty.enable`.";
+  }
+]
diff --git a/modules/scripts/system-monitor/default.nix b/modules/system/system-monitor/default.nix
index 65c1074..e103ed3 100644
--- a/modules/scripts/system-monitor/default.nix
+++ b/modules/system/system-monitor/default.nix
@@ -1,3 +1,4 @@
+# System monitor script using tmux to run bottom and nvtop side-by-side
 {
   config,
   lib,
@@ -5,10 +6,11 @@
   ...
 }:
 let
-  inherit ((import ../lib.nix { inherit lib pkgs; })) mkScriptModule;
-  base = mkScriptModule {
+  inherit ((import ../../lib/script.nix { inherit lib pkgs; })) mkScriptModule;
+  script = mkScriptModule {
+    scope = [ "system" ];
     name = "system-monitor";
-    path = ./script.sh;
+    path = ./system-monitor.sh;
     description = "System monitor script using tmux to run bottom and nvtop side-by-side\nOpens a tmux session with:\n  - Left pane: bottom (system/process monitor)\n  - Right pane: nvtop (GPU monitor)";
     deps = [
       config.system.bottom.package
@@ -26,11 +28,14 @@ let
   };
 in
 {
-  options = base.options;
-  config = base.moduleConfig // {
-    assertions = base.moduleConfig.assertions ++ (import ./assertions.nix { inherit config lib; });
-    home.file.".local/share/icons/hicolor/scalable/apps/bottom-system-monitor.svg" = {
-      source = ../../../assets/icons/bottom-system-monitor.svg;
-    };
-  };
+  options = script.options;
+  config = lib.mkMerge [
+    script.config
+    {
+      assertions = import ./assertions.nix { inherit config lib; };
+      home.file.".local/share/icons/hicolor/scalable/apps/bottom-system-monitor.svg" = {
+        source = ../../../assets/icons/bottom-system-monitor.svg;
+      };
+    }
+  ];
 }
diff --git a/modules/scripts/system-monitor/script.sh b/modules/system/system-monitor/system-monitor.sh
index 7a9e7ea..7a9e7ea 100644
--- a/modules/scripts/system-monitor/script.sh
+++ b/modules/system/system-monitor/system-monitor.sh