refactor: implement component-based architecture for enhanced maintainability

- Reorganize directory structure into core/, features/, and themes/
- Colocate application Nix logic, configs, scripts, and theme overrides
- Implement 'Inversion of Control' for theming: apps now pull theme-specific layouts
- Update flake.nix and shared library paths to match the new structure
- Document the new Feature-Centric architecture in README.md

core/system/audio.nix

@@ -0,0 +1,12 @@
+{ config, pkgs, lib, ... }:
+
+{
+  security.rtkit.enable = lib.mkDefault true;
+  services.pipewire = {
+    enable = lib.mkDefault true;
+    alsa.enable = lib.mkDefault true;
+    alsa.support32Bit = lib.mkDefault true;
+    pulse.enable = lib.mkDefault true;
+    jack.enable = lib.mkDefault true;
+  };
+}

core/system/bluetooth.nix

@@ -0,0 +1,7 @@
+{ config, pkgs, lib, ... }:
+
+{
+  hardware.bluetooth.enable = lib.mkDefault true;
+  hardware.bluetooth.powerOnBoot = lib.mkDefault true;
+  services.blueman.enable = lib.mkDefault true;
+}

core/system/hardware.nix

@@ -0,0 +1,68 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+let
+  cfg = config.nomarchy.hardware;
+in
+{
+  options.nomarchy.hardware = {
+    isXPS = mkEnableOption "Dell XPS specific hardware fixes";
+    isT2Mac = mkEnableOption "Apple T2 MacBook specific hardware fixes";
+    isFramework = mkEnableOption "Framework laptop specific hardware fixes";
+    hasIPU7Camera = mkEnableOption "Intel IPU7 camera support";
+  };
+
+  config = mkMerge [
+    (mkIf cfg.isXPS {
+      services.udev.extraRules = ''
+        ACTION=="add", SUBSYSTEM=="pci", KERNEL=="0000:00:19.0", ATTR{power/control}="on"
+        ACTION=="add", SUBSYSTEM=="platform", KERNEL=="i2c_designware.0", ATTR{power/control}="on"
+      '';
+
+      systemd.services.nomarchy-haptic-touchpad = {
+        description = "Dell XPS haptic touchpad feedback";
+        after = [ "systemd-udev-settle.service" ];
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          Type = "simple";
+          ExecStart = "${config.home-manager.users.${config.services.displayManager.autoLogin.user}.home.homeDirectory}/.nix-profile/bin/nomarchy-haptic-touchpad";
+          Restart = "on-failure";
+          RestartSec = "2";
+        };
+      };
+    })
+
+    (mkIf cfg.isFramework {
+      services.udev.extraRules = ''
+        # Framework 16 QMK HID
+        SUBSYSTEM=="usb", ATTR{idVendor}=="32ac", ATTR{idProduct}=="0012", MODE="0666", GROUP="users"
+      '';
+    })
+
+    (mkIf cfg.isT2Mac {
+      boot.kernelParams = [ "intel_iommu=on" "iommu=pt" "pcie_ports=compat" ];
+      boot.kernelModules = [ "apple-bce" ];
+      boot.extraModprobeConfig = ''
+        options brcmfmac feature_disable=0x82000
+      '';
+    })
+
+    # System Features
+    (mkIf config.nomarchy.system.features.fingerprint {
+      services.fprintd.enable = true;
+    })
+
+    (mkIf config.nomarchy.system.features.fido2 {
+      security.pam.u2f = {
+        enable = true;
+        control = "sufficient";
+        cue = true;
+      };
+    })
+
+    (mkIf config.nomarchy.system.features.hybridGPU {
+      services.supergfxd.enable = true;
+      systemd.services.supergfxd.serviceConfig.ExecStartPre = "-${pkgs.coreutils}/bin/sleep 5";
+    })
+  ];
+}

core/system/impermanence.nix

@@ -0,0 +1,75 @@
+{ config, lib, pkgs, inputs, ... }:
+
+let
+  cfg = config.nomarchy.system.impermanence;
+in
+{
+  imports = [
+    inputs.impermanence.nixosModules.impermanence
+  ];
+
+  options.nomarchy.system.impermanence = {
+    enable = lib.mkEnableOption "Erase Your Darlings (Impermanence) root wipe on boot";
+  };
+
+  config = lib.mkIf cfg.enable {
+    # 1. The Rollback Script: Runs in initrd before filesystems are mounted
+    boot.initrd.postDeviceCommands = lib.mkAfter ''
+      mkdir -p /btrfs_tmp
+      mount -o subvol=/ /dev/mapper/crypted /btrfs_tmp
+      
+      if [[ -e /btrfs_tmp/@ ]]; then
+          mkdir -p /btrfs_tmp/old_roots
+          timestamp=$(date --date="@$(stat -c %Y /btrfs_tmp/@)" "+%Y-%m-%-d_%H:%M:%S")
+          mv /btrfs_tmp/@ "/btrfs_tmp/old_roots/$timestamp"
+      fi
+
+      delete_subvolume_recursively() {
+          IFS=$'\n'
+          for i in $(btrfs subvolume list -o "$1" | cut -f 9- -d ' '); do
+              delete_subvolume_recursively "/btrfs_tmp/$i"
+          done
+          btrfs subvolume delete "$1"
+      }
+
+      for i in $(find /btrfs_tmp/old_roots/ -maxdepth 1 -mtime +30); do
+          delete_subvolume_recursively "$i"
+      done
+
+      btrfs subvolume snapshot /btrfs_tmp/root-blank /btrfs_tmp/@
+      umount /btrfs_tmp
+    '';
+
+    # 2. Persistence Configuration: What survives the wipe
+    environment.persistence."/persist" = {
+      hideMounts = true;
+      directories = [
+        "/var/log"
+        "/var/lib/nixos"
+        "/var/lib/systemd/coredump"
+        "/var/lib/NetworkManager"
+        "/etc/NetworkManager/system-connections"
+        "/var/lib/bluetooth"
+        "/var/lib/fprint"
+        "/etc/nixos"
+        "/etc/ssh"
+      ];
+      files = [
+        "/etc/machine-id"
+        "/etc/supergfxd.conf"
+      ];
+      users.nomarchy = {
+        directories = [
+          ".ssh"
+          ".gnupg"
+          ".local/share/keyrings"
+          "Documents"
+          "Downloads"
+          "Pictures"
+          "Videos"
+          "Projects"
+        ];
+      };
+    };
+  };
+}

core/system/network.nix

@@ -0,0 +1,28 @@
+{ config, pkgs, lib, ... }:
+
+let
+  cfg = config.nomarchy.system;
+in
+{
+  networking.networkmanager.enable = lib.mkDefault true;
+
+  networking.networkmanager.wifi.powersave = lib.mkDefault cfg.wifi.powersave;
+
+  # DNS Configuration
+  networking.nameservers = lib.mkDefault (
+    if cfg.dns == "Cloudflare" then [ "1.1.1.1" "1.0.0.1" ]
+    else if cfg.dns == "Google" then [ "8.8.8.8" "8.8.4.4" ]
+    else if cfg.dns == "Custom" then cfg.customDns
+    else [] # DHCP lets NM handle it
+  );
+
+  services.resolved = {
+    enable = lib.mkDefault (cfg.dns != "DHCP");
+    dnssec = lib.mkDefault "allow-downgrade";
+    domains = lib.mkDefault [ "~." ];
+    fallbackDns = lib.mkDefault [ "9.9.9.9" "149.112.112.112" ];
+    extraConfig = lib.mkDefault ''
+      DNSOverTLS=opportunistic
+    '';
+  };
+}

core/system/options.nix

@@ -0,0 +1,55 @@
+{ lib, ... }:
+
+{
+  options.nomarchy.system = {
+    dns = lib.mkOption {
+      type = lib.types.enum [ "Cloudflare" "Google" "DHCP" "Custom" ];
+      default = "DHCP";
+      description = "Selected DNS provider.";
+    };
+    customDns = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [];
+      description = "List of custom DNS servers.";
+    };
+    wifi = {
+      powersave = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = "Whether to enable wifi power saving.";
+      };
+    };
+    timezone = lib.mkOption {
+      type = lib.types.str;
+      default = "UTC";
+      description = "System timezone.";
+    };
+    features = {
+      fingerprint = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Whether to enable fingerprint support.";
+      };
+      fido2 = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Whether to enable FIDO2 support.";
+      };
+      hybridGPU = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Whether to enable hybrid GPU support (supergfxd).";
+      };
+      makima = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Whether to enable makima key remapper.";
+      };
+    };
+    theme = lib.mkOption {
+      type = lib.types.str;
+      default = "nord";
+      description = "Selected system theme.";
+    };
+  };
+}

core/system/scripts/nomarchy-battery-capacity

@@ -0,0 +1,11 @@
+#!/bin/bash
+
+# Returns the battery full capacity in Wh (rounded to whole number).
+# Used by nomarchy-battery-status for displaying battery capacity.
+
+battery_info=$(upower -i $(upower -e | grep BAT))
+
+echo "$battery_info" | awk '/energy-full:/ {
+    printf "%d", $2
+    exit
+}'

core/system/scripts/nomarchy-battery-monitor

@@ -0,0 +1,24 @@
+#!/bin/bash
+
+# Designed to be run by systemd timer every 30 seconds and alerts if battery is low
+
+BATTERY_THRESHOLD=10
+NOTIFICATION_FLAG="/run/user/$UID/nomarchy_battery_notified"
+BATTERY_LEVEL=$(nomarchy-battery-remaining)
+BATTERY_STATE=$(upower -i $(upower -e | grep 'BAT') | grep -E "state" | awk '{print $2}')
+
+send_notification() {
+  notify-send -u critical "󱐋 Time to recharge!" "Battery is down to ${1}%" -i battery-caution -t 30000
+  nomarchy-hook battery-low "$1"
+}
+
+if [[ -n $BATTERY_LEVEL && $BATTERY_LEVEL =~ ^[0-9]+$ ]]; then
+  if [[ $BATTERY_STATE == "discharging" ]] && (( BATTERY_LEVEL <= BATTERY_THRESHOLD )); then
+    if [[ ! -f $NOTIFICATION_FLAG ]]; then
+      send_notification $BATTERY_LEVEL
+      touch $NOTIFICATION_FLAG
+    fi
+  else
+    rm -f $NOTIFICATION_FLAG
+  fi
+fi

core/system/scripts/nomarchy-battery-present

@@ -0,0 +1,13 @@
+#!/bin/bash
+
+# Returns true if a battery is present on the system.
+# Used by the battery monitor and other battery-related checks.
+
+for bat in /sys/class/power_supply/BAT*; do
+  [[ -r $bat/present ]] &&
+  [[ $(cat $bat/present) == "1" ]] &&
+  [[ $(cat $bat/type) == "Battery" ]] &&
+  exit 0
+done
+
+exit 1

core/system/scripts/nomarchy-battery-remaining

@@ -0,0 +1,9 @@
+#!/bin/bash
+
+# Returns the battery percentage remaining as an integer.
+# Used by the battery monitor and the Ctrl + Shift + Super + B hotkey.
+
+upower -i $(upower -e | grep BAT) | awk '/percentage/ { 
+    print int($2)
+    exit
+}'

core/system/scripts/nomarchy-battery-remaining-time

@@ -0,0 +1,25 @@
+#!/bin/bash
+
+# Returns the battery time remaining (to empty or full) in a compact format.
+
+battery_info=$(upower -i $(upower -e | grep BAT))
+
+echo "$battery_info" | awk '/time to (empty|full)/ {
+    value = $4
+    unit = $5
+    if (unit == "minutes") {
+        hours = int(value / 60)
+        minutes = int(value % 60)
+    } else {
+        hours = int(value)
+        minutes = int((value - hours) * 60)
+    }
+    if (hours > 0 && minutes > 0) {
+        printf "%dh %dm", hours, minutes
+    } else if (hours > 0) {
+        printf "%dh", hours
+    } else {
+        printf "%dm", minutes
+    }
+    exit
+}'

core/system/scripts/nomarchy-battery-status

@@ -0,0 +1,28 @@
+#!/bin/bash
+
+# Returns a formatted battery status string with percentage and power draw/charge.
+# Used by the battery notification hotkey (Ctrl + Shift + Super + B).
+
+battery_info=$(upower -i $(upower -e | grep BAT))
+
+percentage=$(echo "$battery_info" | awk '/percentage/ {
+    print int($2)
+    exit
+}')
+
+power_rate=$(echo "$battery_info" | awk '/energy-rate/ {
+    rounded = sprintf("%.1f", $2)
+    sub(/\.0$/, "", rounded)
+    print rounded
+    exit
+}')
+
+state=$(echo "$battery_info" | awk '/state/ { print $2; exit }')
+time_remaining=$(nomarchy-battery-remaining-time)
+capacity=$(nomarchy-battery-capacity)
+
+if [[ $state == "charging" ]]; then
+    echo "󰁹    Battery ${percentage}%  ·  ${time_remaining} to full  ·   ${power_rate}W / ${capacity}Wh"
+else
+    echo "󰁹    Battery ${percentage}%  ·  ${time_remaining} left  ·   ${power_rate}W / ${capacity}Wh"
+fi

core/system/scripts/nomarchy-brightness-display

@@ -0,0 +1,21 @@
+#!/bin/bash
+
+# Adjust brightness on the most likely display device.
+# Usage: nomarchy-brightness-display <step>
+
+step="${1:-+5%}"
+
+# Start with the first possible output, then refine to the most likely given an order heuristic.
+device="$(ls -1 /sys/class/backlight 2>/dev/null | head -n1)"
+for candidate in amdgpu_bl* intel_backlight acpi_video*; do
+  if [[ -e /sys/class/backlight/$candidate ]]; then
+    device="$candidate"
+    break
+  fi
+done
+
+# Set the actual brightness of the display device.
+brightnessctl -d "$device" set "$step" >/dev/null
+
+# Use SwayOSD to display the new brightness setting.
+nomarchy-swayosd-brightness "$(brightnessctl -d "$device" -m | cut -d',' -f4 | tr -d '%')"

core/system/scripts/nomarchy-brightness-display-apple

@@ -0,0 +1,12 @@
+#!/bin/bash
+
+# Adjust the brightness on Apple Studio Displays and Apple XDR Displays using asdcontrol.
+
+if (( $# == 0 )); then
+  echo "Adjust Apple Display Brightness by passing +5000 or -5000 (or any range from 0-60000)"
+else
+  device="$(sudo asdcontrol --detect /dev/usb/hiddev* | grep ^/dev/usb/hiddev | cut -d: -f1)"
+  sudo asdcontrol "$device" -- "$1" >/dev/null
+  value="$(sudo asdcontrol "$device" | awk -F= '/BRIGHTNESS=/{print $2+0}')"
+  nomarchy-swayosd-brightness "$(( value * 100 / 60000 ))"
+fi

core/system/scripts/nomarchy-brightness-keyboard

@@ -0,0 +1,42 @@
+#!/bin/bash
+
+# Adjust keyboard backlight brightness using available steps.
+# Usage: nomarchy-brightness-keyboard <up|down|cycle>
+
+direction="${1:-up}"
+
+# Find keyboard backlight device (look for *kbd_backlight* pattern in leds class).
+device=""
+for candidate in /sys/class/leds/*kbd_backlight*; do
+  if [[ -e $candidate ]]; then
+    device="$(basename "$candidate")"
+    break
+  fi
+done
+
+if [[ -z $device ]]; then
+  echo "No keyboard backlight device found" >&2
+  exit 1
+fi
+
+# Get current and max brightness to determine step size.
+max_brightness="$(brightnessctl -d "$device" max)"
+current_brightness="$(brightnessctl -d "$device" get)"
+
+# Calculate step as one unit (keyboards typically have discrete levels like 0-3).
+if [[ $direction == "cycle" ]]; then
+  new_brightness=$(( (current_brightness + 1) % (max_brightness + 1) ))
+elif [[ $direction == "up" ]]; then
+  new_brightness=$((current_brightness + 1))
+  (( new_brightness > max_brightness )) && new_brightness=$max_brightness
+else
+  new_brightness=$((current_brightness - 1))
+  (( new_brightness < 0 )) && new_brightness=0
+fi
+
+# Set the new brightness.
+brightnessctl -d "$device" set "$new_brightness" >/dev/null
+
+# Use SwayOSD to display the new brightness setting.
+percent=$((new_brightness * 100 / max_brightness))
+nomarchy-swayosd-kbd-brightness "$percent"

core/system/scripts/nomarchy-haptic-touchpad

@@ -0,0 +1,95 @@
+#!/usr/bin/env python3
+
+"""Haptic feedback daemon for Synaptics touchpads with Manual Trigger.
+
+Monitors touchpad button press events and sends haptic pulses via HID
+feature reports. Required because the kernel's HID haptic subsystem only
+supports Auto Trigger with waveform enumeration, not the simpler Manual
+Trigger protocol used by these Synaptics touchpads.
+"""
+
+import fcntl, glob, os, struct, sys
+
+VENDOR = "06CB"
+PRODUCT = "D01A"
+REPORT_ID = 0x37
+INTENSITY = 40  # 0-100
+
+# input_event: struct timeval (16 bytes on 64-bit) + type(H) + code(H) + value(i)
+EVENT_FORMAT = "llHHi"
+EVENT_SIZE = struct.calcsize(EVENT_FORMAT)
+EV_KEY = 0x01
+BTN_LEFT = 272
+BTN_RIGHT = 273
+BTN_MIDDLE = 274
+
+# ioctl: HIDIOCSFEATURE(len) = _IOC(_IOC_WRITE|_IOC_READ, 'H', 0x06, len)
+def HIDIOCSFEATURE(length):
+    return 0xC0000000 | (length << 16) | (ord("H") << 8) | 0x06
+
+
+def find_hidraw():
+    for path in sorted(glob.glob("/sys/class/hidraw/hidraw*")):
+        uevent = os.path.join(path, "device", "uevent")
+        try:
+            with open(uevent) as f:
+                content = f.read().upper()
+            if f"0000{VENDOR}" in content and f"0000{PRODUCT}" in content:
+                return os.path.join("/dev", os.path.basename(path))
+        except OSError:
+            continue
+    return None
+
+
+def find_touchpad_event():
+    for path in sorted(glob.glob("/sys/class/input/event*/device/name")):
+        try:
+            with open(path) as f:
+                name = f.read().strip().upper()
+            if VENDOR in name and PRODUCT in name and "TOUCHPAD" in name:
+                event = path.split("/")[-3]
+                return os.path.join("/dev/input", event)
+        except OSError:
+            continue
+    return None
+
+
+def main():
+    hidraw = find_hidraw()
+    if not hidraw:
+        print("No Synaptics haptic touchpad hidraw device found", file=sys.stderr)
+        sys.exit(1)
+
+    event = find_touchpad_event()
+    if not event:
+        print("No Synaptics haptic touchpad input device found", file=sys.stderr)
+        sys.exit(1)
+
+    print(f"Haptic touchpad: hidraw={hidraw} input={event} intensity={INTENSITY}", flush=True)
+
+    haptic_report = struct.pack("BB", REPORT_ID, INTENSITY)
+    ioctl_req = HIDIOCSFEATURE(len(haptic_report))
+
+    hidraw_fd = os.open(hidraw, os.O_RDWR)
+    event_fd = os.open(event, os.O_RDONLY)
+
+    try:
+        while True:
+            data = os.read(event_fd, EVENT_SIZE)
+            if len(data) < EVENT_SIZE:
+                continue
+            _, _, ev_type, code, value = struct.unpack(EVENT_FORMAT, data)
+            if ev_type == EV_KEY and code in (BTN_LEFT, BTN_RIGHT, BTN_MIDDLE) and value == 1:
+                try:
+                    fcntl.ioctl(hidraw_fd, ioctl_req, haptic_report)
+                except OSError:
+                    pass
+    except KeyboardInterrupt:
+        pass
+    finally:
+        os.close(event_fd)
+        os.close(hidraw_fd)
+
+
+if __name__ == "__main__":
+    main()

core/system/scripts/nomarchy-hibernation-available

@@ -0,0 +1,18 @@
+#!/bin/bash
+
+# Check if hibernation is supported
+if [[ ! -f /sys/power/image_size ]]; then
+  exit 1
+fi
+
+# Sum all swap sizes (excluding zram)
+SWAPSIZE_KB=$(awk '!/Filename|zram/ {sum += $3} END {print sum+0}' /proc/swaps)
+SWAPSIZE=$(( 1024 * ${SWAPSIZE_KB:-0} ))
+
+HIBERNATION_IMAGE_SIZE=$(cat /sys/power/image_size)
+
+if (( SWAPSIZE > HIBERNATION_IMAGE_SIZE )) && [[ -f /etc/mkinitcpio.conf.d/nomarchy_resume.conf ]]; then
+  exit 0
+else
+  exit 1
+fi

core/system/scripts/nomarchy-hibernation-remove

@@ -0,0 +1,59 @@
+#!/bin/bash
+
+# Removes hibernation setup: disables swap, removes swapfile, removes fstab entry,
+# removes resume hook, and removes suspend-then-hibernate configuration.
+
+MKINITCPIO_CONF="/etc/mkinitcpio.conf.d/nomarchy_resume.conf"
+
+# Check if hibernation is configured
+if [[ ! -f $MKINITCPIO_CONF ]] || ! grep -q "^HOOKS+=(resume)$" "$MKINITCPIO_CONF"; then
+  echo "Hibernation is not set up"
+  exit 0
+fi
+
+if ! gum confirm "Remove hibernation setup?"; then
+  exit 0
+fi
+
+SWAP_SUBVOLUME="/swap"
+SWAP_FILE="$SWAP_SUBVOLUME/swapfile"
+
+# Disable swap if active
+if swapon --show | grep -q "$SWAP_FILE"; then
+  echo "Disabling swap on $SWAP_FILE"
+  sudo swapoff "$SWAP_FILE"
+fi
+
+# Remove swapfile
+if [[ -f $SWAP_FILE ]]; then
+  echo "Removing swapfile"
+  sudo rm "$SWAP_FILE"
+fi
+
+# Remove swap subvolume
+if sudo btrfs subvolume show "$SWAP_SUBVOLUME" &>/dev/null; then
+  echo "Removing Btrfs subvolume $SWAP_SUBVOLUME"
+  sudo btrfs subvolume delete "$SWAP_SUBVOLUME"
+fi
+
+# Remove fstab entry
+if grep -Fq "$SWAP_FILE" /etc/fstab; then
+  echo "Removing swapfile from /etc/fstab"
+  sudo cp -a /etc/fstab "/etc/fstab.$(date +%Y%m%d%H%M%S).back"
+  sudo sed -i "\|$SWAP_FILE|d" /etc/fstab
+  sudo sed -i '/^# Btrfs swapfile for system hibernation$/d' /etc/fstab
+fi
+
+# Remove suspend-then-hibernate configuration
+echo "Removing suspend-then-hibernate configuration"
+sudo rm -f /etc/systemd/logind.conf.d/lid.conf
+sudo rm -f /etc/systemd/sleep.conf.d/hibernate.conf
+
+# Remove mkinitcpio resume hook
+echo "Removing resume hook"
+sudo rm "$MKINITCPIO_CONF"
+
+echo "Regenerating initramfs..."
+sudo limine-mkinitcpio
+
+echo "Hibernation removed"

core/system/scripts/nomarchy-hibernation-setup

@@ -0,0 +1,99 @@
+#!/bin/bash
+
+# Creates a swap file in the btrfs subvolume, adds the swap file to /etc/fstab,
+# adds a resume hook to mkinitcpio, and configures suspend-then-hibernate.
+
+if [[ ! -f /sys/power/image_size ]]; then
+  echo -e "Hibernation is not supported on your system" >&2
+  exit 0
+fi
+
+if ! command -v limine-mkinitcpio &>/dev/null; then
+  echo "Skipping hibernation setup (requires Limine bootloader)"
+  exit 0
+fi
+
+MKINITCPIO_CONF="/etc/mkinitcpio.conf.d/nomarchy_resume.conf"
+
+# Check if hibernation is already configured
+if [[ -f $MKINITCPIO_CONF ]] && grep -q "^HOOKS+=(resume)$" "$MKINITCPIO_CONF"; then
+  echo "Hibernation is already set up"
+  exit 0
+fi
+
+if [[ $1 != "--force" ]]; then
+  MEM_TOTAL_HUMAN=$(free --human | awk '/Mem/ {print $2}')
+  if ! gum confirm "Use $MEM_TOTAL_HUMAN on boot drive to make hibernation available?"; then
+    exit 0
+  fi
+fi
+
+SWAP_SUBVOLUME="/swap"
+SWAP_FILE="$SWAP_SUBVOLUME/swapfile"
+
+# Create btrfs subvolume for swap
+if ! sudo btrfs subvolume show "$SWAP_SUBVOLUME" &>/dev/null; then
+  echo "Creating Btrfs subvolume"
+  sudo btrfs subvolume create "$SWAP_SUBVOLUME"
+  sudo chattr +C "$SWAP_SUBVOLUME"
+fi
+
+# Create swapfile
+if ! sudo swaplabel "$SWAP_FILE" &>/dev/null; then
+  echo "Creating swapfile in Btrfs subvolume"
+  MEM_TOTAL_KB="$(awk '/MemTotal/ {print $2}' /proc/meminfo)k"
+  sudo btrfs filesystem mkswapfile -s "$MEM_TOTAL_KB" "$SWAP_FILE"
+fi
+
+# Add swapfile to fstab
+if ! grep -Fq "$SWAP_FILE" /etc/fstab; then
+  echo "Adding swapfile to /etc/fstab"
+  sudo cp -a /etc/fstab "/etc/fstab.$(date +%Y%m%d%H%M%S).back"
+  printf "\n# Btrfs swapfile for system hibernation\n%s none swap defaults,pri=0 0 0\n" "$SWAP_FILE" | sudo tee -a /etc/fstab >/dev/null
+fi
+
+# Enable swap
+if ! swapon --show | grep -q "$SWAP_FILE"; then
+  echo "Enabling swap on $SWAP_FILE"
+  sudo swapon -p 0 "$SWAP_FILE"
+fi
+
+# Add resume hook to mkinitcpio
+sudo mkdir -p /etc/mkinitcpio.conf.d
+echo "Adding resume hook to $MKINITCPIO_CONF"
+echo "HOOKS+=(resume)" | sudo tee "$MKINITCPIO_CONF" >/dev/null
+
+# Add resume= kernel parameters so the initramfs resume hook knows where to find the
+# hibernation image. Without these, resume happens late (after GPU drivers load) and fails.
+RESUME_DROP_IN="/etc/limine-entry-tool.d/resume.conf"
+if [[ ! -f $RESUME_DROP_IN ]]; then
+  echo "Adding resume kernel parameters"
+  sudo swapon -p 0 "$SWAP_FILE" 2>/dev/null
+  RESUME_DEVICE=$(findmnt -no SOURCE -T "$SWAP_FILE" | sed 's/\[.*\]//')
+  RESUME_OFFSET=$(sudo btrfs inspect-internal map-swapfile -r "$SWAP_FILE")
+  sudo mkdir -p /etc/limine-entry-tool.d
+  echo "KERNEL_CMDLINE[default]+=\" resume=$RESUME_DEVICE resume_offset=$RESUME_OFFSET\"" | sudo tee "$RESUME_DROP_IN" >/dev/null
+  sudo tee -a /etc/default/limine < "$RESUME_DROP_IN" >/dev/null
+fi
+
+# Use ACPI alarm for RTC wakeup on s2idle systems (needed for suspend-then-hibernate)
+if grep -q "\[s2idle\]" /sys/power/mem_sleep 2>/dev/null; then
+  LIMINE_DROP_IN="/etc/limine-entry-tool.d/rtc-alarm.conf"
+  if [[ ! -f $LIMINE_DROP_IN ]]; then
+    echo "Enabling ACPI RTC alarm for s2idle suspend"
+    sudo mkdir -p /etc/limine-entry-tool.d
+    echo 'KERNEL_CMDLINE[default]+=" rtc_cmos.use_acpi_alarm=1"' | sudo tee "$LIMINE_DROP_IN" >/dev/null
+    sudo tee -a /etc/default/limine < "$LIMINE_DROP_IN" >/dev/null
+  fi
+fi
+
+# Regenerate initramfs and boot entry
+echo "Regenerating initramfs..."
+sudo limine-mkinitcpio
+sudo limine-update
+
+echo
+
+if [[ $1 != "--force" ]] && gum confirm "Reboot to enable hibernation?"; then
+  nomarchy-system-reboot
+fi

core/system/scripts/nomarchy-hw-asus-rog

@@ -0,0 +1,6 @@
+#!/bin/bash
+
+# Detect whether the computer is an Asus ROG machine.
+
+[[ $(cat /sys/class/dmi/id/sys_vendor 2>/dev/null) == "ASUSTeK COMPUTER INC." ]] &&
+   grep -q "ROG" /sys/class/dmi/id/product_family 2>/dev/null

core/system/scripts/nomarchy-hw-framework16

@@ -0,0 +1,6 @@
+#!/bin/bash
+
+# Detect whether the computer is a Framework Laptop 16.
+
+[[ $(cat /sys/class/dmi/id/sys_vendor 2>/dev/null) == "Framework" ]] &&
+  nomarchy-hw-match "Laptop 16"

core/system/scripts/nomarchy-hw-intel

@@ -0,0 +1,5 @@
+#!/bin/bash
+
+# Detect whether the computer has an Intel CPU.
+
+[[ $(grep -m1 "vendor_id" /proc/cpuinfo 2>/dev/null | cut -d: -f2 | tr -d ' ') == "GenuineIntel" ]]

core/system/scripts/nomarchy-hw-intel-ptl

@@ -0,0 +1,5 @@
+#!/bin/bash
+
+# Detect whether the computer has an Intel Panther Lake GPU.
+
+lspci | grep -iE 'vga|3d|display' | grep -qi 'panther lake'

core/system/scripts/nomarchy-hw-match

@@ -0,0 +1,6 @@
+#!/bin/bash
+
+# Match against the computer's DMI product name (case-insensitive).
+# Usage: nomarchy-hw-match "XPS"
+
+grep -qi "$1" /sys/class/dmi/id/product_name 2>/dev/null

core/system/scripts/nomarchy-hw-surface

@@ -0,0 +1,6 @@
+#!/bin/bash
+
+# Detect whether the computer is a Microsoft Surface device.
+
+[[ $(cat /sys/class/dmi/id/sys_vendor 2>/dev/null) == "Microsoft Corporation" ]] &&
+  nomarchy-hw-match "Surface"

core/system/scripts/nomarchy-hw-vulkan

@@ -0,0 +1,6 @@
+#!/bin/bash
+
+# Detect whether Vulkan is available.
+
+[[ -d /usr/share/vulkan/icd.d ]] &&
+  find /usr/share/vulkan/icd.d -maxdepth 1 -name "*.json" -print -quit | grep -q .

core/system/scripts/nomarchy-pkg-add

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+
+PKG_NAME="$1"
+
+if [ -z "$PKG_NAME" ]; then
+    echo "Usage: nomarchy-pkg-add <package-name>"
+    exit 1
+fi
+
+STATE_FILE="$HOME/.config/home-manager/user-packages.json"
+mkdir -p "$(dirname "$STATE_FILE")"
+
+if [ ! -f "$STATE_FILE" ]; then
+    echo "[]" > "$STATE_FILE"
+fi
+
+if jq -e --arg pkg "$PKG_NAME" '. | index($pkg)' "$STATE_FILE" >/dev/null; then
+    echo "Package $PKG_NAME is already in your user-packages.json"
+    exit 0
+fi
+
+# Append package to the JSON array safely
+jq --arg pkg "$PKG_NAME" '. + [$pkg]' "$STATE_FILE" > "${STATE_FILE}.tmp" && mv "${STATE_FILE}.tmp" "$STATE_FILE"
+
+echo "Package $PKG_NAME added declaratively to $STATE_FILE."
+echo "Applying changes with env-update..."
+env-update

core/system/scripts/nomarchy-pkg-remove

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+
+PKG_NAME="$1"
+
+if [ -z "$PKG_NAME" ]; then
+    echo "Usage: nomarchy-pkg-remove <package-name>"
+    exit 1
+fi
+
+STATE_FILE="$HOME/.config/home-manager/user-packages.json"
+
+if [ ! -f "$STATE_FILE" ]; then
+    echo "No packages managed by nomarchy-pkg yet."
+    exit 0
+fi
+
+if ! jq -e --arg pkg "$PKG_NAME" '. | index($pkg)' "$STATE_FILE" >/dev/null; then
+    echo "Package $PKG_NAME is not in your user-packages.json"
+    exit 0
+fi
+
+# Remove package from the JSON array safely
+jq --arg pkg "$PKG_NAME" '. - [$pkg]' "$STATE_FILE" > "${STATE_FILE}.tmp" && mv "${STATE_FILE}.tmp" "$STATE_FILE"
+
+echo "Package $PKG_NAME removed declaratively from $STATE_FILE."
+echo "Applying changes with env-update..."
+env-update

core/system/scripts/nomarchy-powerprofiles-list

@@ -0,0 +1,8 @@
+#!/bin/bash
+
+# Returns a list of all the available power profiles on the system.
+# Used by the Nomarchy Menu under Setup > Power Profile.
+
+powerprofilesctl list |
+  awk '/^\s*[* ]\s*[a-zA-Z0-9\-]+:$/ { gsub(/^[*[:space:]]+|:$/,""); print }' |
+  tac

core/system/scripts/nomarchy-preflight-migration

@@ -0,0 +1,93 @@
+#!/usr/bin/env bash
+# Nomarchy Pre-flight State Migration
+# Migrates legacy state files into the unified state.json before Nix evaluation
+
+STATE_DIR="$HOME/.config/nomarchy"
+OLD_STATE_DIR="$HOME/.config/home-manager"
+OLD_TOGGLES_DIR="$HOME/.local/state/nomarchy/toggles"
+IDLE_STATE_FILE="$OLD_STATE_DIR/idle-state.json"
+NIGHTLIGHT_STATE_FILE="$OLD_STATE_DIR/hyprsunset-state.json"
+HYPRLAND_STATE_FILE="$OLD_STATE_DIR/hyprland-state.json"
+THEME_STATE_FILE="$OLD_STATE_DIR/theme-state.nix"
+WALLPAPER_STATE_FILE="$OLD_STATE_DIR/wallpaper-state.nix"
+FONT_STATE_FILE="$OLD_STATE_DIR/font-state.nix"
+OLD_STATE_FILE="$OLD_STATE_DIR/state.json"
+NEW_STATE_FILE="$STATE_DIR/state.json"
+
+# We expect jq to be in PATH (it's a dependency of nomarchy-scripts)
+JQ="jq"
+
+mkdir -p "$STATE_DIR"
+[[ ! -f $NEW_STATE_FILE ]] && echo "{}" > "$NEW_STATE_FILE"
+
+# 0. Migrate from old home-manager state.json location
+if [[ -f "$OLD_STATE_FILE" ]] && [[ "$OLD_STATE_FILE" != "$NEW_STATE_FILE" ]]; then
+    # Merge old state into new state
+    TMP_FILE=$(mktemp)
+    $JQ -s '.[0] * .[1]' "$OLD_STATE_FILE" "$NEW_STATE_FILE" > "$TMP_FILE" && mv "$TMP_FILE" "$NEW_STATE_FILE"
+    rm "$OLD_STATE_FILE" 2>/dev/null || true
+fi
+
+# 1. Migrate .local/state/nomarchy/toggles
+if [[ -d $OLD_TOGGLES_DIR ]]; then
+    for file in "$OLD_TOGGLES_DIR"/*; do
+        [[ -e "$file" ]] || continue
+        filename=$(basename "$file")
+        case "$filename" in
+            suspend-off)
+                $JQ '.suspend = false' "$NEW_STATE_FILE" > "$NEW_STATE_FILE.tmp" && mv "$NEW_STATE_FILE.tmp" "$NEW_STATE_FILE"
+                ;;
+            screensaver-off)
+                $JQ '.screensaver = false' "$NEW_STATE_FILE" > "$NEW_STATE_FILE.tmp" && mv "$NEW_STATE_FILE.tmp" "$NEW_STATE_FILE"
+                ;;
+            skip-vscode-theme-changes)
+                $JQ '.skipVsCodeTheme = true' "$NEW_STATE_FILE" > "$NEW_STATE_FILE.tmp" && mv "$NEW_STATE_FILE.tmp" "$NEW_STATE_FILE"
+                ;;
+        esac
+        rm "$file"
+    done
+    rmdir "$OLD_TOGGLES_DIR" 2>/dev/null || true
+fi
+
+# 2. Migrate existing JSON state files
+if [[ -f $IDLE_STATE_FILE ]]; then
+    ENABLED=$($JQ '.enabled' "$IDLE_STATE_FILE")
+    if [[ "$ENABLED" == "true" || "$ENABLED" == "false" ]]; then
+        $JQ --argjson val "$ENABLED" '.idle = $val' "$NEW_STATE_FILE" > "$NEW_STATE_FILE.tmp" && mv "$NEW_STATE_FILE.tmp" "$NEW_STATE_FILE"
+    fi
+    rm "$IDLE_STATE_FILE"
+fi
+
+if [[ -f $NIGHTLIGHT_STATE_FILE ]]; then
+    ENABLED=$($JQ '.enabled' "$NIGHTLIGHT_STATE_FILE")
+    TEMP=$($JQ '.temperature' "$NIGHTLIGHT_STATE_FILE")
+    $JQ --argjson enabled "$ENABLED" --argjson temp "$TEMP" '.nightlight = $enabled | .nightlightTemperature = $temp' "$NEW_STATE_FILE" > "$NEW_STATE_FILE.tmp" && mv "$NEW_STATE_FILE.tmp" "$NEW_STATE_FILE"
+    rm "$NIGHTLIGHT_STATE_FILE"
+fi
+
+if [[ -f $HYPRLAND_STATE_FILE ]]; then
+    GAPS_OUT=$($JQ '.gaps_out' "$HYPRLAND_STATE_FILE")
+    GAPS_IN=$($JQ '.gaps_in' "$HYPRLAND_STATE_FILE")
+    BORDER_SIZE=$($JQ '.border_size' "$HYPRLAND_STATE_FILE")
+    $JQ --argjson go "$GAPS_OUT" --argjson gi "$GAPS_IN" --argjson bs "$BORDER_SIZE" '.hyprland = {"gaps_out": $go, "gaps_in": $gi, "border_size": $bs}' "$NEW_STATE_FILE" > "$NEW_STATE_FILE.tmp" && mv "$NEW_STATE_FILE.tmp" "$NEW_STATE_FILE"
+    rm "$HYPRLAND_STATE_FILE"
+fi
+
+# 3. Migrate plaintext string state files
+if [[ -f $THEME_STATE_FILE ]]; then
+    THEME=$(cat "$THEME_STATE_FILE" | tr -d '\n')
+    $JQ --arg theme "$THEME" '.theme = $theme' "$NEW_STATE_FILE" > "$NEW_STATE_FILE.tmp" && mv "$NEW_STATE_FILE.tmp" "$NEW_STATE_FILE"
+    rm "$THEME_STATE_FILE"
+fi
+
+if [[ -f $WALLPAPER_STATE_FILE ]]; then
+    WALLPAPER=$(cat "$WALLPAPER_STATE_FILE" | tr -d '\n')
+    $JQ --arg wp "$WALLPAPER" '.wallpaper = $wp' "$NEW_STATE_FILE" > "$NEW_STATE_FILE.tmp" && mv "$NEW_STATE_FILE.tmp" "$NEW_STATE_FILE"
+    rm "$WALLPAPER_STATE_FILE"
+fi
+
+if [[ -f $FONT_STATE_FILE ]]; then
+    FONT=$(cat "$FONT_STATE_FILE" | tr -d '\n')
+    $JQ --arg font "$FONT" '.font = $font' "$NEW_STATE_FILE" > "$NEW_STATE_FILE.tmp" && mv "$NEW_STATE_FILE.tmp" "$NEW_STATE_FILE"
+    rm "$FONT_STATE_FILE"
+fi

core/system/scripts/nomarchy-restart-bluetooth

@@ -0,0 +1,7 @@
+#!/bin/bash
+
+# Unblock and restart the bluetooth service.
+
+echo -e "Unblocking bluetooth...\n"
+rfkill unblock bluetooth
+rfkill list bluetooth

core/system/scripts/nomarchy-restart-makima

@@ -0,0 +1,5 @@
+#!/bin/bash
+
+# Restart makima - key remapping service for remapping Copilot key to Nomarchy Menu
+
+sudo systemctl restart makima

core/system/scripts/nomarchy-restart-pipewire

@@ -0,0 +1,6 @@
+#!/bin/bash
+
+# Restart the PipeWire audio service to fix audio issues or apply new configuration.
+
+echo -e "Restarting pipewire audio service...\n"
+systemctl --user restart pipewire.service

core/system/scripts/nomarchy-restart-trackpad

@@ -0,0 +1,8 @@
+#!/bin/bash
+
+# Reload the intel_quicki2c driver to fix a dead trackpad.
+# The THC (Touch Host Controller) can fail to initialize interrupts
+# during boot or after suspend, leaving the trackpad registered but
+# not delivering events.
+
+sudo modprobe -r intel_quicki2c && sudo modprobe intel_quicki2c

core/system/scripts/nomarchy-restart-wifi

@@ -0,0 +1,7 @@
+#!/bin/bash
+
+# Unblock and restart the Wi-Fi service.
+
+echo -e "Unblocking wifi...\n"
+rfkill unblock wifi
+rfkill list wifi

core/system/scripts/nomarchy-restart-xcompose

@@ -0,0 +1,5 @@
+#!/bin/bash
+
+# Restart the XCompose input method service (fcitx5) to apply new compose key settings.
+
+nomarchy-restart-app fcitx5 --disable notificationitem

core/system/scripts/nomarchy-setup-dns

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+
+# Configure DNS declaratively for Nomarchy NixOS.
+# Hybrid: updates /etc/nixos/state.json and runs sys-update.
+
+STATE_FILE="/etc/nixos/state.json"
+
+if [[ -z $1 ]]; then
+  dns=$(gum choose --height 6 --header "Select DNS provider" Cloudflare Google DHCP Custom)
+else
+  dns=$1
+fi
+
+case "$dns" in
+Cloudflare|Google|DHCP)
+  sudo jq --arg dns "$dns" '.dns = $dns' "$STATE_FILE" > /tmp/state.json && sudo mv /tmp/state.json "$STATE_FILE"
+  ;;
+
+Custom)
+  echo "Enter your DNS servers (space-separated, e.g. '192.168.1.1 1.1.1.1'):"
+  read -r dns_servers
+
+  if [[ -z $dns_servers ]]; then
+    echo "Error: No DNS servers provided."
+    exit 1
+  fi
+
+  # Convert to JSON array safely
+  dns_array=$(echo "$dns_servers" | jq -R 'split(" ")')
+  sudo jq --arg dns "Custom" --argjson servers "$dns_array" '.dns = $dns | .customDns = $servers' "$STATE_FILE" > /tmp/state.json && sudo mv /tmp/state.json "$STATE_FILE"
+  ;;
+esac
+
+echo "DNS configured to $dns. Applying changes..."
+sudo sys-update

core/system/scripts/nomarchy-setup-fido2

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+
+# Configure FIDO2 support declaratively for Nomarchy NixOS.
+
+STATE_FILE="/etc/nixos/state.json"
+
+if [[ "--remove" == $1 ]]; then
+    sudo jq '.features.fido2 = false' "$STATE_FILE" > /tmp/state.json && sudo mv /tmp/state.json "$STATE_FILE"
+    echo "FIDO2 support disabled. Applying changes..."
+    sudo sys-update
+    exit 0
+fi
+
+sudo jq '.features.fido2 = true' "$STATE_FILE" > /tmp/state.json && sudo mv /tmp/state.json "$STATE_FILE"
+echo "FIDO2 support enabled. Applying changes..."
+sudo sys-update
+
+# Enrollment is still an imperative action
+if command -v pamu2fcfg &> /dev/null; then
+    echo "Let's register your FIDO2 key now."
+    mkdir -p ~/.config/Yubico
+    pamu2fcfg > ~/.config/Yubico/u2f_keys
+    echo "FIDO2 key registered."
+else
+    echo "pamu2fcfg not found. It will be available after the next reboot or sys-update."
+fi

core/system/scripts/nomarchy-setup-fingerprint

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+
+# Configure fingerprint support declaratively for Nomarchy NixOS.
+
+STATE_FILE="/etc/nixos/state.json"
+
+if [[ "--remove" == $1 ]]; then
+    sudo jq '.features.fingerprint = false' "$STATE_FILE" > /tmp/state.json && sudo mv /tmp/state.json "$STATE_FILE"
+    echo "Fingerprint support disabled. Applying changes..."
+    sudo sys-update
+    exit 0
+fi
+
+sudo jq '.features.fingerprint = true' "$STATE_FILE" > /tmp/state.json && sudo mv /tmp/state.json "$STATE_FILE"
+echo "Fingerprint support enabled. Applying changes..."
+sudo sys-update
+
+# Enrollment is still an imperative action
+if command -v fprintd-enroll &> /dev/null; then
+    echo "Let's enroll your fingerprint now."
+    fprintd-enroll
+    echo "Fingerprint enrolled."
+else
+    echo "fprintd not found. It will be available after the next reboot or sys-update."
+fi

core/system/scripts/nomarchy-sudo-keepalive

@@ -0,0 +1,10 @@
+#!/bin/bash
+
+# Prompt for sudo once and keep the credential alive in the background.
+# Source this script so the trap applies to the calling shell:
+#   source nomarchy-sudo-keepalive
+
+sudo -v
+while true; do sudo -n true; sleep 60; done 2>/dev/null &
+SUDO_KEEPALIVE_PID=$!
+trap "kill $SUDO_KEEPALIVE_PID 2>/dev/null" EXIT

core/system/scripts/nomarchy-sudo-passwordless-toggle

@@ -0,0 +1,43 @@
+#!/bin/bash
+
+# Toggle passwordless sudo for the current user.
+# First run: enables passwordless sudo for 15 minutes (after confirmation).
+# Second run: disables it early.
+
+NOPASSWD_FILE="/etc/sudoers.d/99-nomarchy-nopasswd-${USER}"
+TIMER_NAME="nomarchy-nopasswd-expire-${USER}"
+
+# Safety: if the file exists but the timer doesn't (e.g. after reboot), clean up
+if sudo test -f "$NOPASSWD_FILE" && ! systemctl is-active "${TIMER_NAME}.timer" &>/dev/null; then
+  sudo rm "$NOPASSWD_FILE"
+fi
+
+# Check for the file directly — sudo -n can stay cached or be granted by other rules
+if sudo test -f "$NOPASSWD_FILE"; then
+  sudo rm "$NOPASSWD_FILE"
+  sudo systemctl stop "${TIMER_NAME}.timer" 2>/dev/null
+  echo "Passwordless sudo has been DISABLED. Sudo will require a password again."
+else
+  echo ""
+  echo "⚠️  WARNING: This will allow ANY process running as your user to"
+  echo "execute ANY command as root WITHOUT a password for 15 minutes."
+  echo ""
+  echo "This is useful for AI agents that need to run sudo commands,"
+  echo "but it significantly weakens the security of your system."
+  echo "Anyone or anything with access to your user account gets full root."
+  echo ""
+  echo "Passwordless sudo will automatically disable after 15 minutes."
+  echo "Run this command again to disable it early."
+  echo ""
+
+  if gum confirm "Enable passwordless sudo for 15 minutes? This is a significant security risk!"; then
+    echo "${USER} ALL=(ALL) NOPASSWD: ALL" | sudo tee "$NOPASSWD_FILE" > /dev/null
+    sudo chmod 440 "$NOPASSWD_FILE"
+    sudo systemd-run --on-active=15m --timer-property=AccuracySec=1s --unit="$TIMER_NAME" \
+      rm "$NOPASSWD_FILE"
+    echo "Passwordless sudo has been ENABLED. It will automatically disable in 15 minutes."
+    echo "Note: if you restart before then, run nomarchy-sudo-passwordless-toggle again to disable it."
+  else
+    echo "Aborted. No changes made."
+  fi
+fi

core/system/scripts/nomarchy-sudo-reset

@@ -0,0 +1,7 @@
+#!/bin/bash
+
+# Reset the sudo lockout/faillock for the current user.
+# This clears any failed authentication attempts that may have locked the user out.
+
+# Resetting sudo lockout for user
+su -c "faillock --reset --user $USER"

core/system/scripts/nomarchy-system-logout

@@ -0,0 +1,11 @@
+#!/bin/bash
+
+# Logout command that first closes all application windows (thus giving them a chance to save state),
+# then stops the session, returning to the SDDM login screen.
+
+# Schedule the session stop after closing windows (detached from terminal)
+nohup bash -c "sleep 2 && uwsm stop" >/dev/null 2>&1 &
+
+# Now close all windows
+nomarchy-hyprland-window-close-all
+sleep 1 # Allow apps like Chrome to shutdown correctly

core/system/scripts/nomarchy-system-reboot

@@ -0,0 +1,13 @@
+#!/bin/bash
+
+# Reboot command that first closes all application windows (thus giving them a chance to save state).
+# This is particularly helpful for applications like Chromium that otherwise won't shutdown cleanly.
+
+nomarchy-state clear re*-required
+
+# Schedule the reboot to happen after closing windows (detached from terminal)
+nohup bash -c "sleep 2 && systemctl reboot --no-wall" >/dev/null 2>&1 &
+
+# Now close all windows
+nomarchy-hyprland-window-close-all
+sleep 1 # Allow apps like Chrome to shutdown correctly

core/system/scripts/nomarchy-system-shutdown

@@ -0,0 +1,13 @@
+#!/bin/bash
+
+# Shutdown command that first closes all application windows (thus giving them a chance to save state).
+# This is particularly helpful for applications like Chromium that otherwise won't shutdown cleanly.
+
+nomarchy-state clear re*-required
+
+# Schedule the shutdown to happen after closing windows (detached from terminal)
+nohup bash -c "sleep 2 && systemctl poweroff --no-wall" >/dev/null 2>&1 &
+
+# Now close all windows
+nomarchy-hyprland-window-close-all
+sleep 1 # Allow apps like Chrome to shutdown correctly

core/system/scripts/nomarchy-toggle-hybrid-gpu

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+
+# Toggle dedicated vs integrated GPU mode via supergfxd (for hybrid gpu laptops, like Asus G14).
+# Declarative enablement + Runtime mode switching for Nomarchy NixOS.
+
+STATE_FILE="/etc/nixos/state.json"
+
+# Check if supergfxd is enabled in config
+if [[ $(sudo jq -r '.features.hybridGPU // false' "$STATE_FILE") != "true" ]]; then
+    if gum confirm "Hybrid GPU support is not enabled. Enable it now? (Requires sys-update)"; then
+        sudo jq '.features.hybridGPU = true' "$STATE_FILE" > /tmp/state.json && sudo mv /tmp/state.json "$STATE_FILE"
+        echo "Hybrid GPU support enabled in configuration. Applying changes..."
+        sudo sys-update
+        echo "Please run this command again after the update."
+        exit 0
+    fi
+    exit 1
+fi
+
+if ! command -v supergfxctl &> /dev/null; then
+    echo "supergfxctl not found. Is the system updated?"
+    exit 1
+fi
+
+gpu_mode=$(supergfxctl -g)
+echo "Current GPU mode: $gpu_mode"
+
+case "$gpu_mode" in
+"Integrated")
+  if gum confirm "Switch to Hybrid mode (enables dGPU) and reboot?"; then
+    supergfxctl -m Hybrid
+    echo "Switching to Hybrid mode..."
+    nomarchy-system-reboot
+  fi
+  ;;
+"Hybrid")
+  if gum confirm "Switch to Integrated mode (disables dGPU) and reboot?"; then
+    supergfxctl -m Integrated
+    echo "Switching to Integrated mode..."
+    nomarchy-system-reboot
+  fi
+  ;;
+*)
+  echo "Hybrid GPU in unknown mode: $gpu_mode. Try 'supergfxctl -m Hybrid' manually."
+  exit 1
+  ;;
+esac

core/system/scripts/nomarchy-toggle-idle

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+
+# Toggles the idle daemon (hypridle) between enabled and disabled.
+# Hybrid: updates state.json and provides instant feedback.
+
+STATE_DIR="$HOME/.config/nomarchy"
+STATE_FILE="$STATE_DIR/state.json"
+mkdir -p "$STATE_DIR"
+
+# Initialize if doesn't exist
+[[ ! -f $STATE_FILE ]] && echo "{}" > "$STATE_FILE"
+
+if [[ $NOMARCHY_TOGGLE_IDLE == "false" ]]; then
+    NEW_VALUE="true"
+    setsid hypridle >/dev/null 2>&1 &
+    notify-send -u low "  Now locking computer when idle"
+else
+    NEW_VALUE="false"
+    pkill -x hypridle
+    notify-send -u low "  Stop locking computer when idle"
+fi
+
+TMP_JSON=$(mktemp)
+jq --argjson val "$NEW_VALUE" '.idle = $val' "$STATE_FILE" > "$TMP_JSON" && mv "$TMP_JSON" "$STATE_FILE"
+
+echo "Idle state set to $NEW_VALUE. Environment will be fully updated on next rebuild."
+
+pkill -RTMIN+9 waybar # Signal waybar if needed

core/system/scripts/nomarchy-toggle-suspend

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+
+# Toggles the suspend menu option availability.
+# Hybrid: updates state.json and runs env-update for persistence.
+
+STATE_DIR="$HOME/.config/nomarchy"
+STATE_FILE="$STATE_DIR/state.json"
+mkdir -p "$STATE_DIR"
+
+# Initialize if doesn't exist
+[[ ! -f $STATE_FILE ]] && echo "{}" > "$STATE_FILE"
+
+# Get current state from env or state file
+if [[ $NOMARCHY_TOGGLE_SUSPEND == "false" ]]; then
+    NEW_VALUE="true"
+    notify-send -u low "   Suspend now available in system menu"
+else
+    NEW_VALUE="false"
+    notify-send -u low "   Suspend removed from system menu"
+fi
+
+# Update JSON using jq with --argjson for proper boolean handling
+TMP_JSON=$(mktemp)
+jq --argjson val "$NEW_VALUE" '.suspend = $val' "$STATE_FILE" > "$TMP_JSON" && mv "$TMP_JSON" "$STATE_FILE"
+
+echo "Suspend availability set to $NEW_VALUE. Updating environment..."
+
+# Run env-update to apply changes to the menu
+env-update

core/system/scripts/nomarchy-tz-select

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+
+# Select system timezone declaratively for Nomarchy NixOS.
+
+STATE_FILE="/etc/nixos/state.json"
+
+timezone=$(timedatectl list-timezones | gum filter --height 20 --header "Set timezone") || exit 1
+
+sudo jq --arg tz "$timezone" '.timezone = $tz' "$STATE_FILE" > /tmp/state.json && sudo mv /tmp/state.json "$STATE_FILE"
+
+echo "Timezone is now set to $timezone. Applying changes..."
+sudo sys-update

core/system/scripts/nomarchy-update

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+
+# Nomarchy Update Script
+# 1. Updates the flake inputs in /etc/nixos
+# 2. Applies system-wide NixOS changes
+# 3. Applies user-level Home Manager changes
+
+set -e
+
+REPO_DIR="/etc/nixos"
+
+if [ ! -d "$REPO_DIR" ]; then
+    echo "Error: $REPO_DIR not found. Are you running on a Nomarchy system?"
+    exit 1
+fi
+
+echo "--- Starting Nomarchy Update ---"
+
+# 1. Update Flake Lock
+echo "Updating flake inputs..."
+sudo nix --extra-experimental-features "nix-command flakes" flake update --flake "$REPO_DIR"
+
+# 2. Rebuild System
+echo "Applying system-level updates..."
+sudo nixos-rebuild switch --flake "$REPO_DIR#default" --impure
+
+# 3. Rebuild Home Environment
+echo "Applying user-level updates..."
+home-manager switch --flake "$REPO_DIR#default" --impure
+
+# 4. Commit changes if it's a git repo
+if [ -d "$REPO_DIR/.git" ]; then
+    echo "Committing update to local history..."
+    sudo git -C "$REPO_DIR" add flake.lock
+    sudo git -C "$REPO_DIR" commit -m "chore: update system (flake.lock)" || echo "No lockfile changes to commit."
+fi
+
+echo "--- Nomarchy Update Complete ---"

core/system/scripts/nomarchy-update-time

@@ -0,0 +1,4 @@
+#!/bin/bash
+
+echo "Updating time..."
+sudo systemctl restart systemd-timesyncd

core/system/scripts/nomarchy-wifi-powersave

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+
+# Toggles wifi power saving declaratively.
+# Usage: nomarchy-wifi-powersave <on|off>
+
+STATE_FILE="/etc/nixos/state.json"
+
+case "$1" in
+on)  value="true" ;;
+off) value="false" ;;
+*) echo "Usage: nomarchy-wifi-powersave <on|off>"; exit 1 ;;
+esac
+
+sudo jq --argjson val "$value" '.wifi.powersave = $val' "$STATE_FILE" > /tmp/state.json && sudo mv /tmp/state.json "$STATE_FILE"
+
+echo "Wifi powersave set to $1. Applying changes..."
+sudo sys-update

core/system/state.nix

@@ -0,0 +1,21 @@
+{ lib, ... }:
+
+let
+  nomarchyLib = import ../lib { inherit lib; };
+  systemState = nomarchyLib.readSystemState;
+in
+{
+  config.nomarchy.system = {
+    dns = systemState.dns or "DHCP";
+    customDns = systemState.customDns or [];
+    wifi.powersave = systemState.wifi.powersave or true;
+    timezone = systemState.timezone or "UTC";
+    features = {
+      fingerprint = systemState.features.fingerprint or false;
+      fido2 = systemState.features.fido2 or false;
+      hybridGPU = systemState.features.hybridGPU or false;
+      makima = systemState.features.makima or false;
+    };
+    theme = systemState.theme or "nord";
+  };
+}

core/system/systemd.nix

@@ -0,0 +1,64 @@
+{ config, pkgs, lib, ... }:
+
+{
+  systemd.settings.Manager.DefaultTimeoutStopSec = lib.mkDefault "5s";
+
+  systemd.services."user@".serviceConfig.TimeoutStopSec = lib.mkDefault "5s";
+
+  powerManagement.powerDownCommands = ''
+    # --- force-igpu ---
+    # Use the Vfio to Integrated trick to turn off NVIDIA dgpu when in integrated mode
+    if [[ $1 == "hibernate" ]] && ${pkgs.coreutils}/bin/lsmod | grep -q supergfxd; then
+      ${pkgs.supergfxctl}/bin/supergfxctl -m Vfio || true
+      sleep 1
+    fi
+
+    # --- keyboard-backlight ---
+    # Turn off keyboard backlight before hibernate to prevent hang on power-off.
+    if [[ $1 == "hibernate" ]]; then
+      device=""
+      for candidate in /sys/class/leds/*kbd_backlight*; do
+        if [[ -e "$candidate" ]]; then
+          device="$(${pkgs.coreutils}/bin/basename "$candidate")"
+          break
+        fi
+      done
+      if [[ -n "$device" ]]; then
+        ${pkgs.brightnessctl}/bin/brightnessctl -d "$device" set 0 >/dev/null 2>&1 || true
+      fi
+    fi
+
+    # --- unmount-fuse ---
+    # Lazy-unmount gvfsd-fuse filesystems before suspend/hibernate
+    while IFS=' ' read -r _ mountpoint fstype _; do
+      if [[ $fstype == fuse.gvfsd-fuse ]]; then
+        mountpoint=$(printf '%b' "$mountpoint")
+        ${pkgs.fuse3}/bin/fusermount3 -uz "$mountpoint" 2>/dev/null || ${pkgs.fuse}/bin/fusermount -uz "$mountpoint" 2>/dev/null || true
+      fi
+    done < /proc/mounts
+  '';
+
+  powerManagement.resumeCommands = ''
+    # --- force-igpu ---
+    if ${pkgs.coreutils}/bin/lsmod | grep -q supergfxd; then
+      sleep 4
+      ${pkgs.supergfxctl}/bin/supergfxctl -m Vfio || true
+      sleep 1
+      ${pkgs.supergfxctl}/bin/supergfxctl -m Integrated || true
+    fi
+
+    # --- unmount-fuse ---
+    (
+      sleep 5
+      for uid_dir in /run/user/*; do
+        uid="$(${pkgs.coreutils}/bin/basename "$uid_dir")"
+        if [[ -S $uid_dir/bus ]]; then
+          sudo -u "#$uid" env \
+            DBUS_SESSION_BUS_ADDRESS="unix:path=$uid_dir/bus" \
+            XDG_RUNTIME_DIR="$uid_dir" \
+            systemctl --user restart gvfs-daemon.service 2>/dev/null || true
+        fi
+      done
+    ) &
+  '';
+}

core/system/vm-guest.nix

@@ -0,0 +1,17 @@
+{ lib, ... }:
+
+{
+  # Shared VM configuration
+  virtualisation.vmVariant = {
+    virtualisation.graphics = true;
+    virtualisation.qemu.options = [ "-device virtio-vga" ];
+  };
+
+  # Dummy hardware config for VM
+  fileSystems."/" = { device = "/dev/disk/by-label/nixos"; };
+  boot.loader.grub.device = "/dev/vda";
+  boot.initrd.availableKernelModules = [ "virtio_pci" "virtio_blk" "virtio_gpu" "virtio_net" "virtio_mmio" ];
+  
+  # Force early KMS for Plymouth
+  boot.initrd.kernelModules = [ "virtio_gpu" ];
+}