From cb74273da49bdd51c5892723ab78562c854f95d8 Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Mon, 19 May 2025 18:16:59 +0200
Subject: [PATCH] clan-cli: move clan_cli.nix to clan_lib.nix

---
 pkgs/clan-app/tests/conftest.py                      |  2 +-
 pkgs/clan-cli/clan_cli/bwrap/__init__.py             |  3 ++-
 pkgs/clan-cli/clan_cli/clan/create.py                |  2 +-
 pkgs/clan-cli/clan_cli/clan/inspect.py               | 12 ++++++------
 pkgs/clan-cli/clan_cli/clan/show.py                  |  2 +-
 pkgs/clan-cli/clan_cli/completions.py                |  3 ++-
 pkgs/clan-cli/clan_cli/facts/generate.py             |  2 +-
 .../clan_cli/facts/secret_modules/password_store.py  |  3 ++-
 pkgs/clan-cli/clan_cli/flash/flash.py                |  2 +-
 pkgs/clan-cli/clan_cli/flash/list.py                 |  2 +-
 pkgs/clan-cli/clan_cli/git.py                        |  2 +-
 pkgs/clan-cli/clan_cli/machines/hardware.py          |  2 +-
 pkgs/clan-cli/clan_cli/machines/install.py           |  2 +-
 pkgs/clan-cli/clan_cli/machines/machines.py          |  2 +-
 pkgs/clan-cli/clan_cli/machines/morph.py             |  2 +-
 pkgs/clan-cli/clan_cli/machines/update.py            |  2 +-
 pkgs/clan-cli/clan_cli/secrets/import_sops.py        |  2 +-
 pkgs/clan-cli/clan_cli/secrets/sops.py               |  2 +-
 pkgs/clan-cli/clan_cli/ssh/deploy_info.py            |  2 +-
 pkgs/clan-cli/clan_cli/ssh/host.py                   |  2 +-
 pkgs/clan-cli/clan_cli/ssh/tor.py                    |  2 +-
 pkgs/clan-cli/clan_cli/state/list.py                 |  2 +-
 pkgs/clan-cli/clan_cli/tests/fixtures_flakes.py      |  2 +-
 pkgs/clan-cli/clan_cli/tests/git_repo.py             |  2 +-
 .../clan-cli/clan_cli/tests/test_clan_nix_attrset.py |  2 +-
 pkgs/clan-cli/clan_cli/tests/test_create_flake.py    |  2 +-
 pkgs/clan-cli/clan_cli/tests/test_modules.py         |  2 +-
 pkgs/clan-cli/clan_cli/tests/test_vars.py            |  4 ++--
 pkgs/clan-cli/clan_cli/tests/test_vars_deployment.py |  2 +-
 pkgs/clan-cli/clan_cli/vars/generate.py              |  2 +-
 .../clan_cli/vars/secret_modules/password_store.py   |  2 +-
 pkgs/clan-cli/clan_cli/vms/run.py                    |  2 +-
 pkgs/clan-cli/clan_cli/vms/virtiofsd.py              |  3 +--
 pkgs/clan-cli/clan_cli/vms/waypipe.py                |  3 +--
 pkgs/clan-cli/clan_lib/api/directory.py              |  2 +-
 pkgs/clan-cli/clan_lib/api/mdns_discovery.py         |  3 ++-
 pkgs/clan-cli/clan_lib/flake/flake.py                | 12 ++++++++----
 pkgs/clan-cli/{clan_cli => clan_lib}/nix/__init__.py |  4 ++--
 .../{clan_cli => clan_lib}/nix/allowed-packages.json |  0
 pkgs/clan-cli/clan_lib/tests/test_create.py          |  2 +-
 pkgs/clan-cli/default.nix                            |  2 +-
 pkgs/clan-cli/flake-module.nix                       |  2 +-
 pkgs/clan-cli/pyproject.toml                         |  4 +++-
 pkgs/clan-vm-manager/tests/conftest.py               |  2 +-
 pkgs/generate-test-vars/generate_test_vars/cli.py    |  2 +-
 45 files changed, 64 insertions(+), 56 deletions(-)
 rename pkgs/clan-cli/{clan_cli => clan_lib}/nix/__init__.py (100%)
 rename pkgs/clan-cli/{clan_cli => clan_lib}/nix/allowed-packages.json (100%)

diff --git a/pkgs/clan-app/tests/conftest.py b/pkgs/clan-app/tests/conftest.py
index 047f8724a..377d1b5f9 100644
--- a/pkgs/clan-app/tests/conftest.py
+++ b/pkgs/clan-app/tests/conftest.py
@@ -5,7 +5,7 @@ from pathlib import Path
 
 import pytest
 from clan_cli.custom_logger import setup_logging
-from clan_cli.nix import nix_shell
+from clan_lib.nix import nix_shell
 
 pytest_plugins = [
     "temporary_dir",
diff --git a/pkgs/clan-cli/clan_cli/bwrap/__init__.py b/pkgs/clan-cli/clan_cli/bwrap/__init__.py
index 430b993a1..f55944644 100644
--- a/pkgs/clan-cli/clan_cli/bwrap/__init__.py
+++ b/pkgs/clan-cli/clan_cli/bwrap/__init__.py
@@ -2,8 +2,9 @@ import os
 import shutil
 from pathlib import Path
 
+from clan_lib.nix import nix_shell
+
 from clan_cli.cmd import Log, RunOpts, run
-from clan_cli.nix import nix_shell
 
 _works: bool | None = None
 
diff --git a/pkgs/clan-cli/clan_cli/clan/create.py b/pkgs/clan-cli/clan_cli/clan/create.py
index fe62ed652..ca6a2bf6e 100644
--- a/pkgs/clan-cli/clan_cli/clan/create.py
+++ b/pkgs/clan-cli/clan_cli/clan/create.py
@@ -7,11 +7,11 @@ from pathlib import Path
 from clan_lib.api import API
 from clan_lib.errors import ClanError
 from clan_lib.flake import Flake
+from clan_lib.nix import nix_command, nix_metadata, nix_shell
 from clan_lib.nix_models.inventory import Inventory
 from clan_lib.persist.inventory_store import InventoryStore
 
 from clan_cli.cmd import CmdOut, RunOpts, run
-from clan_cli.nix import nix_command, nix_metadata, nix_shell
 from clan_cli.templates import (
     InputPrio,
     TemplateName,
diff --git a/pkgs/clan-cli/clan_cli/clan/inspect.py b/pkgs/clan-cli/clan_cli/clan/inspect.py
index 11a654882..bb0c5bbbd 100644
--- a/pkgs/clan-cli/clan_cli/clan/inspect.py
+++ b/pkgs/clan-cli/clan_cli/clan/inspect.py
@@ -5,18 +5,18 @@ from typing import Any
 
 from clan_lib.errors import ClanError
 from clan_lib.flake import Flake
-
-from clan_cli.cmd import run
-from clan_cli.dirs import machine_gcroot
-from clan_cli.machines.list import list_machines
-from clan_cli.machines.machines import Machine
-from clan_cli.nix import (
+from clan_lib.nix import (
     nix_add_to_gcroots,
     nix_build,
     nix_config,
     nix_eval,
     nix_metadata,
 )
+
+from clan_cli.cmd import run
+from clan_cli.dirs import machine_gcroot
+from clan_cli.machines.list import list_machines
+from clan_cli.machines.machines import Machine
 from clan_cli.vms.inspect import VmConfig, inspect_vm
 
 
diff --git a/pkgs/clan-cli/clan_cli/clan/show.py b/pkgs/clan-cli/clan_cli/clan/show.py
index 6aac94da7..522cf3d88 100644
--- a/pkgs/clan-cli/clan_cli/clan/show.py
+++ b/pkgs/clan-cli/clan_cli/clan/show.py
@@ -7,10 +7,10 @@ from urllib.parse import urlparse
 from clan_lib.api import API
 from clan_lib.errors import ClanCmdError, ClanError
 from clan_lib.flake import Flake
+from clan_lib.nix import nix_eval
 from clan_lib.nix_models.inventory import Meta
 
 from clan_cli.cmd import run
-from clan_cli.nix import nix_eval
 
 log = logging.getLogger(__name__)
 
diff --git a/pkgs/clan-cli/clan_cli/completions.py b/pkgs/clan-cli/clan_cli/completions.py
index 495ff5757..45074e46d 100644
--- a/pkgs/clan-cli/clan_cli/completions.py
+++ b/pkgs/clan-cli/clan_cli/completions.py
@@ -7,8 +7,9 @@ from collections.abc import Callable, Iterable
 from types import ModuleType
 from typing import Any
 
+from clan_lib.nix import nix_eval
+
 from .cmd import run
-from .nix import nix_eval
 
 """
 This module provides dynamic completions.
diff --git a/pkgs/clan-cli/clan_cli/facts/generate.py b/pkgs/clan-cli/clan_cli/facts/generate.py
index ed6900d8c..761fb99c9 100644
--- a/pkgs/clan-cli/clan_cli/facts/generate.py
+++ b/pkgs/clan-cli/clan_cli/facts/generate.py
@@ -8,6 +8,7 @@ from pathlib import Path
 from tempfile import TemporaryDirectory
 
 from clan_lib.errors import ClanError
+from clan_lib.nix import nix_shell
 
 from clan_cli.cmd import RunOpts, run
 from clan_cli.completions import (
@@ -18,7 +19,6 @@ from clan_cli.completions import (
 from clan_cli.git import commit_files
 from clan_cli.machines.list import list_machines
 from clan_cli.machines.machines import Machine
-from clan_cli.nix import nix_shell
 
 from .check import check_secrets
 from .public_modules import FactStoreBase
diff --git a/pkgs/clan-cli/clan_cli/facts/secret_modules/password_store.py b/pkgs/clan-cli/clan_cli/facts/secret_modules/password_store.py
index 876358753..6c13b42c4 100644
--- a/pkgs/clan-cli/clan_cli/facts/secret_modules/password_store.py
+++ b/pkgs/clan-cli/clan_cli/facts/secret_modules/password_store.py
@@ -3,9 +3,10 @@ import subprocess
 from pathlib import Path
 from typing import override
 
+from clan_lib.nix import nix_shell
+
 from clan_cli.cmd import Log, RunOpts
 from clan_cli.machines.machines import Machine
-from clan_cli.nix import nix_shell
 from clan_cli.ssh.host import Host
 
 from . import SecretStoreBase
diff --git a/pkgs/clan-cli/clan_cli/flash/flash.py b/pkgs/clan-cli/clan_cli/flash/flash.py
index 4fef17f69..40dbb4014 100644
--- a/pkgs/clan-cli/clan_cli/flash/flash.py
+++ b/pkgs/clan-cli/clan_cli/flash/flash.py
@@ -8,11 +8,11 @@ from typing import Any
 
 from clan_lib.api import API
 from clan_lib.errors import ClanError
+from clan_lib.nix import nix_shell
 
 from clan_cli.cmd import Log, RunOpts, cmd_with_root, run
 from clan_cli.facts.generate import generate_facts
 from clan_cli.machines.machines import Machine
-from clan_cli.nix import nix_shell
 from clan_cli.vars.generate import generate_vars
 from clan_cli.vars.upload import populate_secret_vars
 
diff --git a/pkgs/clan-cli/clan_cli/flash/list.py b/pkgs/clan-cli/clan_cli/flash/list.py
index 835aa2f73..7a881512d 100644
--- a/pkgs/clan-cli/clan_cli/flash/list.py
+++ b/pkgs/clan-cli/clan_cli/flash/list.py
@@ -5,9 +5,9 @@ from pathlib import Path
 
 from clan_lib.api import API
 from clan_lib.errors import ClanError
+from clan_lib.nix import nix_build
 
 from clan_cli.cmd import Log, RunOpts, run
-from clan_cli.nix import nix_build
 
 log = logging.getLogger(__name__)
 
diff --git a/pkgs/clan-cli/clan_cli/git.py b/pkgs/clan-cli/clan_cli/git.py
index e87e6f692..197edc4ed 100644
--- a/pkgs/clan-cli/clan_cli/git.py
+++ b/pkgs/clan-cli/clan_cli/git.py
@@ -2,10 +2,10 @@ import os
 from pathlib import Path
 
 from clan_lib.errors import ClanError
+from clan_lib.nix import nix_shell
 
 from .cmd import Log, RunOpts, run
 from .locked_open import locked_open
-from .nix import nix_shell
 
 
 def commit_file(
diff --git a/pkgs/clan-cli/clan_cli/machines/hardware.py b/pkgs/clan-cli/clan_cli/machines/hardware.py
index c9eda5ff2..fbd20aab9 100644
--- a/pkgs/clan-cli/clan_cli/machines/hardware.py
+++ b/pkgs/clan-cli/clan_cli/machines/hardware.py
@@ -7,13 +7,13 @@ from pathlib import Path
 
 from clan_lib.api import API
 from clan_lib.errors import ClanCmdError, ClanError
+from clan_lib.nix import nix_config, nix_eval
 
 from clan_cli.cmd import RunOpts, run
 from clan_cli.completions import add_dynamic_completer, complete_machines
 from clan_cli.dirs import specific_machine_dir
 from clan_cli.git import commit_file
 from clan_cli.machines.machines import Machine
-from clan_cli.nix import nix_config, nix_eval
 
 from .types import machine_name_type
 
diff --git a/pkgs/clan-cli/clan_cli/machines/install.py b/pkgs/clan-cli/clan_cli/machines/install.py
index 0330a1d5b..4a7d18cef 100644
--- a/pkgs/clan-cli/clan_cli/machines/install.py
+++ b/pkgs/clan-cli/clan_cli/machines/install.py
@@ -9,6 +9,7 @@ from tempfile import TemporaryDirectory
 
 from clan_lib.api import API
 from clan_lib.errors import ClanError
+from clan_lib.nix import nix_shell
 
 from clan_cli.cmd import Log, RunOpts, run
 from clan_cli.completions import (
@@ -19,7 +20,6 @@ from clan_cli.completions import (
 from clan_cli.facts.generate import generate_facts
 from clan_cli.machines.hardware import HardwareConfig
 from clan_cli.machines.machines import Machine
-from clan_cli.nix import nix_shell
 from clan_cli.ssh.deploy_info import DeployInfo, find_reachable_host, ssh_command_parse
 from clan_cli.ssh.host_key import HostKeyCheck
 from clan_cli.vars.generate import generate_vars
diff --git a/pkgs/clan-cli/clan_cli/machines/machines.py b/pkgs/clan-cli/clan_cli/machines/machines.py
index 2ba76f001..5e3d7c875 100644
--- a/pkgs/clan-cli/clan_cli/machines/machines.py
+++ b/pkgs/clan-cli/clan_cli/machines/machines.py
@@ -11,11 +11,11 @@ from typing import TYPE_CHECKING, Any
 
 from clan_lib.errors import ClanCmdError, ClanError
 from clan_lib.flake import Flake
+from clan_lib.nix import nix_config, nix_eval, nix_test_store
 
 from clan_cli.cmd import Log, RunOpts, run
 from clan_cli.facts import public_modules as facts_public_modules
 from clan_cli.facts import secret_modules as facts_secret_modules
-from clan_cli.nix import nix_config, nix_eval, nix_test_store
 from clan_cli.ssh.host import Host
 from clan_cli.ssh.host_key import HostKeyCheck
 from clan_cli.ssh.parse import parse_deployment_address
diff --git a/pkgs/clan-cli/clan_cli/machines/morph.py b/pkgs/clan-cli/clan_cli/machines/morph.py
index 30dc05351..0ea9967fc 100644
--- a/pkgs/clan-cli/clan_cli/machines/morph.py
+++ b/pkgs/clan-cli/clan_cli/machines/morph.py
@@ -9,13 +9,13 @@ from tempfile import TemporaryDirectory
 
 from clan_lib.errors import ClanError
 from clan_lib.flake import Flake
+from clan_lib.nix import nix_build, nix_command
 from clan_lib.nix_models.inventory import Machine as InventoryMachine
 
 from clan_cli.cmd import Log, RunOpts, run
 from clan_cli.dirs import get_clan_flake_toplevel_or_env
 from clan_cli.machines.create import CreateOptions, create_machine
 from clan_cli.machines.machines import Machine
-from clan_cli.nix import nix_build, nix_command
 from clan_cli.vars.generate import generate_vars
 
 log = logging.getLogger(__name__)
diff --git a/pkgs/clan-cli/clan_cli/machines/update.py b/pkgs/clan-cli/clan_cli/machines/update.py
index a1daad667..03ed9ea4b 100644
--- a/pkgs/clan-cli/clan_cli/machines/update.py
+++ b/pkgs/clan-cli/clan_cli/machines/update.py
@@ -9,6 +9,7 @@ from contextlib import ExitStack
 
 from clan_lib.api import API
 from clan_lib.errors import ClanError
+from clan_lib.nix import nix_command, nix_config, nix_metadata
 
 from clan_cli.async_run import AsyncContext, AsyncOpts, AsyncRuntime, is_async_cancelled
 from clan_cli.cmd import Log, MsgColor, RunOpts, run
@@ -21,7 +22,6 @@ from clan_cli.facts.generate import generate_facts
 from clan_cli.facts.upload import upload_secrets
 from clan_cli.machines.list import list_machines
 from clan_cli.machines.machines import Machine
-from clan_cli.nix import nix_command, nix_config, nix_metadata
 from clan_cli.ssh.host import Host, HostKeyCheck
 from clan_cli.vars.generate import generate_vars
 from clan_cli.vars.upload import upload_secret_vars
diff --git a/pkgs/clan-cli/clan_cli/secrets/import_sops.py b/pkgs/clan-cli/clan_cli/secrets/import_sops.py
index 5a388403b..4dc5b43b4 100644
--- a/pkgs/clan-cli/clan_cli/secrets/import_sops.py
+++ b/pkgs/clan-cli/clan_cli/secrets/import_sops.py
@@ -4,6 +4,7 @@ import sys
 from pathlib import Path
 
 from clan_lib.errors import ClanError
+from clan_lib.nix import nix_shell
 
 from clan_cli.cmd import RunOpts, run
 from clan_cli.completions import (
@@ -12,7 +13,6 @@ from clan_cli.completions import (
     complete_machines,
     complete_users,
 )
-from clan_cli.nix import nix_shell
 
 from .secrets import encrypt_secret, sops_secrets_folder
 
diff --git a/pkgs/clan-cli/clan_cli/secrets/sops.py b/pkgs/clan-cli/clan_cli/secrets/sops.py
index 6a718a35e..9726376ca 100644
--- a/pkgs/clan-cli/clan_cli/secrets/sops.py
+++ b/pkgs/clan-cli/clan_cli/secrets/sops.py
@@ -16,10 +16,10 @@ from typing import IO, Any
 from clan_lib.api import API
 from clan_lib.errors import ClanError
 from clan_lib.flake import Flake
+from clan_lib.nix import nix_shell
 
 from clan_cli.cmd import Log, RunOpts, run
 from clan_cli.dirs import user_config_dir
-from clan_cli.nix import nix_shell
 
 from .folders import sops_users_folder
 
diff --git a/pkgs/clan-cli/clan_cli/ssh/deploy_info.py b/pkgs/clan-cli/clan_cli/ssh/deploy_info.py
index 2f9e9356f..494d33874 100644
--- a/pkgs/clan-cli/clan_cli/ssh/deploy_info.py
+++ b/pkgs/clan-cli/clan_cli/ssh/deploy_info.py
@@ -7,6 +7,7 @@ from pathlib import Path
 from typing import Any
 
 from clan_lib.errors import ClanError
+from clan_lib.nix import nix_shell
 
 from clan_cli.async_run import AsyncRuntime
 from clan_cli.cmd import run
@@ -15,7 +16,6 @@ from clan_cli.completions import (
     complete_machines,
 )
 from clan_cli.machines.machines import Machine
-from clan_cli.nix import nix_shell
 from clan_cli.ssh.host import Host, is_ssh_reachable
 from clan_cli.ssh.host_key import HostKeyCheck
 from clan_cli.ssh.parse import parse_deployment_address
diff --git a/pkgs/clan-cli/clan_cli/ssh/host.py b/pkgs/clan-cli/clan_cli/ssh/host.py
index f171bea94..2a6eaf04a 100644
--- a/pkgs/clan-cli/clan_cli/ssh/host.py
+++ b/pkgs/clan-cli/clan_cli/ssh/host.py
@@ -14,10 +14,10 @@ from tempfile import TemporaryDirectory
 from typing import Any
 
 from clan_lib.errors import ClanError
+from clan_lib.nix import nix_shell
 
 from clan_cli.cmd import CmdOut, RunOpts, run
 from clan_cli.colors import AnsiColor
-from clan_cli.nix import nix_shell
 from clan_cli.ssh.host_key import HostKeyCheck
 
 cmdlog = logging.getLogger(__name__)
diff --git a/pkgs/clan-cli/clan_cli/ssh/tor.py b/pkgs/clan-cli/clan_cli/ssh/tor.py
index 13cab4dfa..1ab7df22b 100755
--- a/pkgs/clan-cli/clan_cli/ssh/tor.py
+++ b/pkgs/clan-cli/clan_cli/ssh/tor.py
@@ -8,10 +8,10 @@ import time
 from dataclasses import dataclass
 
 from clan_lib.errors import TorConnectionError, TorSocksError
+from clan_lib.nix import nix_shell
 
 from clan_cli.async_run import AsyncRuntime
 from clan_cli.cmd import Log, RunOpts, run
-from clan_cli.nix import nix_shell
 
 log = logging.getLogger(__name__)
 
diff --git a/pkgs/clan-cli/clan_cli/state/list.py b/pkgs/clan-cli/clan_cli/state/list.py
index 234af1929..c7626230f 100644
--- a/pkgs/clan-cli/clan_cli/state/list.py
+++ b/pkgs/clan-cli/clan_cli/state/list.py
@@ -4,6 +4,7 @@ import logging
 from pathlib import Path
 
 from clan_lib.errors import ClanCmdError, ClanError
+from clan_lib.nix import nix_eval
 
 from clan_cli.cmd import RunOpts, run
 from clan_cli.completions import (
@@ -13,7 +14,6 @@ from clan_cli.completions import (
 )
 from clan_cli.dirs import get_clan_flake_toplevel_or_env
 from clan_cli.machines.machines import Machine
-from clan_cli.nix import nix_eval
 
 log = logging.getLogger(__name__)
 
diff --git a/pkgs/clan-cli/clan_cli/tests/fixtures_flakes.py b/pkgs/clan-cli/clan_cli/tests/fixtures_flakes.py
index 70aa3e2b5..f5ab68e45 100644
--- a/pkgs/clan-cli/clan_cli/tests/fixtures_flakes.py
+++ b/pkgs/clan-cli/clan_cli/tests/fixtures_flakes.py
@@ -18,12 +18,12 @@ from clan_cli.dirs import (
 )
 from clan_cli.locked_open import locked_open
 from clan_cli.machines.machines import Machine
-from clan_cli.nix import nix_test_store
 from clan_cli.tests import age_keys
 from clan_cli.tests.fixture_error import FixtureError
 from clan_cli.tests.root import CLAN_CORE
 from clan_cli.tests.temporary_dir import TEMPDIR
 from clan_lib.flake import Flake
+from clan_lib.nix import nix_test_store
 
 log = logging.getLogger(__name__)
 
diff --git a/pkgs/clan-cli/clan_cli/tests/git_repo.py b/pkgs/clan-cli/clan_cli/tests/git_repo.py
index 073ce5aa4..57b02b51f 100644
--- a/pkgs/clan-cli/clan_cli/tests/git_repo.py
+++ b/pkgs/clan-cli/clan_cli/tests/git_repo.py
@@ -2,7 +2,7 @@ import subprocess
 from pathlib import Path
 
 import pytest
-from clan_cli.nix import nix_shell
+from clan_lib.nix import nix_shell
 
 
 # fixture for git_repo
diff --git a/pkgs/clan-cli/clan_cli/tests/test_clan_nix_attrset.py b/pkgs/clan-cli/clan_cli/tests/test_clan_nix_attrset.py
index 7b48214db..1a2d45368 100644
--- a/pkgs/clan-cli/clan_cli/tests/test_clan_nix_attrset.py
+++ b/pkgs/clan-cli/clan_cli/tests/test_clan_nix_attrset.py
@@ -8,7 +8,6 @@ import pytest
 from clan_cli.cmd import run
 from clan_cli.git import commit_file
 from clan_cli.locked_open import locked_open
-from clan_cli.nix import nix_command
 from clan_cli.templates import (
     ClanExports,
     InputName,
@@ -20,6 +19,7 @@ from clan_cli.templates import (
 )
 from clan_cli.tests.fixtures_flakes import FlakeForTest
 from clan_lib.flake import Flake
+from clan_lib.nix import nix_command
 
 
 # Function to write clan attributes to a file
diff --git a/pkgs/clan-cli/clan_cli/tests/test_create_flake.py b/pkgs/clan-cli/clan_cli/tests/test_create_flake.py
index 07f673858..5c47cb9a8 100644
--- a/pkgs/clan-cli/clan_cli/tests/test_create_flake.py
+++ b/pkgs/clan-cli/clan_cli/tests/test_create_flake.py
@@ -4,10 +4,10 @@ from pathlib import Path
 
 import pytest
 from clan_cli.cmd import run
-from clan_cli.nix import nix_flake_show
 from clan_cli.tests.fixtures_flakes import FlakeForTest, substitute
 from clan_cli.tests.helpers import cli
 from clan_cli.tests.stdout import CaptureOutput
+from clan_lib.nix import nix_flake_show
 
 log = logging.getLogger(__name__)
 
diff --git a/pkgs/clan-cli/clan_cli/tests/test_modules.py b/pkgs/clan-cli/clan_cli/tests/test_modules.py
index 69be97ee8..671fe90b6 100644
--- a/pkgs/clan-cli/clan_cli/tests/test_modules.py
+++ b/pkgs/clan-cli/clan_cli/tests/test_modules.py
@@ -4,10 +4,10 @@ from typing import TYPE_CHECKING
 
 import pytest
 from clan_cli.machines.create import CreateOptions, create_machine
-from clan_cli.nix import nix_eval, run
 from clan_cli.tests.fixtures_flakes import FlakeForTest
 from clan_lib.api.modules import list_modules
 from clan_lib.flake import Flake
+from clan_lib.nix import nix_eval, run
 from clan_lib.nix_models.inventory import (
     Inventory,
     Machine,
diff --git a/pkgs/clan-cli/clan_cli/tests/test_vars.py b/pkgs/clan-cli/clan_cli/tests/test_vars.py
index 80c083bc2..acf95cffa 100644
--- a/pkgs/clan-cli/clan_cli/tests/test_vars.py
+++ b/pkgs/clan-cli/clan_cli/tests/test_vars.py
@@ -5,7 +5,6 @@ from pathlib import Path
 
 import pytest
 from clan_cli.machines.machines import Machine
-from clan_cli.nix import nix_eval, run
 from clan_cli.tests.age_keys import SopsSetup
 from clan_cli.tests.fixtures_flakes import ClanFlake
 from clan_cli.tests.helpers import cli
@@ -24,6 +23,7 @@ from clan_cli.vars.secret_modules import password_store, sops
 from clan_cli.vars.set import set_var
 from clan_lib.errors import ClanError
 from clan_lib.flake import Flake
+from clan_lib.nix import nix_eval, run
 
 
 def test_dependencies_as_files(temp_dir: Path) -> None:
@@ -451,7 +451,7 @@ def test_generate_secret_for_multiple_machines(
 ) -> None:
     flake = flake_with_sops
 
-    from clan_cli.nix import nix_config
+    from clan_lib.nix import nix_config
 
     local_system = nix_config()["system"]
 
diff --git a/pkgs/clan-cli/clan_cli/tests/test_vars_deployment.py b/pkgs/clan-cli/clan_cli/tests/test_vars_deployment.py
index 367bc5ed0..9d66bd47d 100644
--- a/pkgs/clan-cli/clan_cli/tests/test_vars_deployment.py
+++ b/pkgs/clan-cli/clan_cli/tests/test_vars_deployment.py
@@ -6,13 +6,13 @@ from contextlib import ExitStack
 import pytest
 from clan_cli import cmd
 from clan_cli.machines.machines import Machine
-from clan_cli.nix import nix_eval, run
 from clan_cli.tests.age_keys import SopsSetup
 from clan_cli.tests.fixtures_flakes import ClanFlake
 from clan_cli.tests.helpers import cli
 from clan_cli.tests.nix_config import ConfigItem
 from clan_cli.vms.run import inspect_vm, spawn_vm
 from clan_lib.flake import Flake
+from clan_lib.nix import nix_eval, run
 
 
 @pytest.mark.impure
diff --git a/pkgs/clan-cli/clan_cli/vars/generate.py b/pkgs/clan-cli/clan_cli/vars/generate.py
index 4a2b37685..62b520bb4 100644
--- a/pkgs/clan-cli/clan_cli/vars/generate.py
+++ b/pkgs/clan-cli/clan_cli/vars/generate.py
@@ -17,12 +17,12 @@ from clan_cli.completions import (
 )
 from clan_cli.git import commit_files
 from clan_cli.machines.list import list_machines
-from clan_cli.nix import nix_config, nix_shell, nix_test_store
 from clan_cli.vars._types import StoreBase
 from clan_cli.vars.migration import check_can_migrate, migrate_files
 from clan_lib.api import API
 from clan_lib.errors import ClanError
 from clan_lib.flake import Flake
+from clan_lib.nix import nix_config, nix_shell, nix_test_store
 
 from .check import check_vars
 from .graph import (
diff --git a/pkgs/clan-cli/clan_cli/vars/secret_modules/password_store.py b/pkgs/clan-cli/clan_cli/vars/secret_modules/password_store.py
index a1e4beb7a..9c11ab578 100644
--- a/pkgs/clan-cli/clan_cli/vars/secret_modules/password_store.py
+++ b/pkgs/clan-cli/clan_cli/vars/secret_modules/password_store.py
@@ -9,11 +9,11 @@ from tempfile import TemporaryDirectory
 
 from clan_cli.cmd import CmdOut, Log, RunOpts, run
 from clan_cli.machines.machines import Machine
-from clan_cli.nix import nix_shell
 from clan_cli.ssh.host import Host
 from clan_cli.ssh.upload import upload
 from clan_cli.vars._types import StoreBase
 from clan_cli.vars.generate import Generator, Var
+from clan_lib.nix import nix_shell
 
 log = logging.getLogger(__name__)
 
diff --git a/pkgs/clan-cli/clan_cli/vms/run.py b/pkgs/clan-cli/clan_cli/vms/run.py
index 062e81e45..461c64bf9 100644
--- a/pkgs/clan-cli/clan_cli/vms/run.py
+++ b/pkgs/clan-cli/clan_cli/vms/run.py
@@ -13,13 +13,13 @@ from pathlib import Path
 from tempfile import TemporaryDirectory
 
 from clan_lib.errors import ClanCmdError, ClanError
+from clan_lib.nix import nix_shell
 
 from clan_cli.cmd import CmdOut, Log, RunOpts, handle_io, run
 from clan_cli.completions import add_dynamic_completer, complete_machines
 from clan_cli.dirs import module_root, user_cache_dir, vm_state_dir
 from clan_cli.facts.generate import generate_facts
 from clan_cli.machines.machines import Machine
-from clan_cli.nix import nix_shell
 from clan_cli.qemu.qga import QgaSession
 from clan_cli.qemu.qmp import QEMUMonitorProtocol
 from clan_cli.vars.generate import generate_vars
diff --git a/pkgs/clan-cli/clan_cli/vms/virtiofsd.py b/pkgs/clan-cli/clan_cli/vms/virtiofsd.py
index 7d60d2352..f010ebeed 100644
--- a/pkgs/clan-cli/clan_cli/vms/virtiofsd.py
+++ b/pkgs/clan-cli/clan_cli/vms/virtiofsd.py
@@ -6,8 +6,7 @@ from collections.abc import Iterator
 from pathlib import Path
 
 from clan_lib.errors import ClanError
-
-from clan_cli.nix import nix_shell
+from clan_lib.nix import nix_shell
 
 
 @contextlib.contextmanager
diff --git a/pkgs/clan-cli/clan_cli/vms/waypipe.py b/pkgs/clan-cli/clan_cli/vms/waypipe.py
index adea37033..c92a56d02 100644
--- a/pkgs/clan-cli/clan_cli/vms/waypipe.py
+++ b/pkgs/clan-cli/clan_cli/vms/waypipe.py
@@ -6,8 +6,7 @@ import time
 from collections.abc import Iterator
 
 from clan_lib.errors import ClanError
-
-from clan_cli.nix import nix_shell
+from clan_lib.nix import nix_shell
 
 VMADDR_CID_HYPERVISOR = 2
 
diff --git a/pkgs/clan-cli/clan_lib/api/directory.py b/pkgs/clan-cli/clan_lib/api/directory.py
index 131b02524..f9eebaa84 100644
--- a/pkgs/clan-cli/clan_lib/api/directory.py
+++ b/pkgs/clan-cli/clan_lib/api/directory.py
@@ -5,10 +5,10 @@ from pathlib import Path
 from typing import Any, Literal
 
 from clan_cli.cmd import RunOpts, run
-from clan_cli.nix import nix_shell
 
 from clan_lib.errors import ClanError
 from clan_lib.flake import Flake
+from clan_lib.nix import nix_shell
 
 from . import API
 
diff --git a/pkgs/clan-cli/clan_lib/api/mdns_discovery.py b/pkgs/clan-cli/clan_lib/api/mdns_discovery.py
index 043b18522..908603436 100644
--- a/pkgs/clan-cli/clan_lib/api/mdns_discovery.py
+++ b/pkgs/clan-cli/clan_lib/api/mdns_discovery.py
@@ -3,7 +3,8 @@ import re
 from dataclasses import dataclass
 
 from clan_cli.cmd import run
-from clan_cli.nix import nix_shell
+
+from clan_lib.nix import nix_shell
 
 from . import API
 
diff --git a/pkgs/clan-cli/clan_lib/flake/flake.py b/pkgs/clan-cli/clan_lib/flake/flake.py
index 794dc57eb..bdeb1a8ff 100644
--- a/pkgs/clan-cli/clan_lib/flake/flake.py
+++ b/pkgs/clan-cli/clan_lib/flake/flake.py
@@ -620,7 +620,8 @@ class Flake:
         Loads the flake into the store and populates self.store_path and self.hash such that the flake can evaluate locally and offline
         """
         from clan_cli.cmd import run
-        from clan_cli.nix import (
+
+        from clan_lib.nix import (
             nix_command,
         )
 
@@ -650,7 +651,8 @@ class Flake:
         This method is used to refresh the cache by reloading it from the flake.
         """
         from clan_cli.dirs import user_cache_dir
-        from clan_cli.nix import (
+
+        from clan_lib.nix import (
             nix_metadata,
         )
 
@@ -704,7 +706,8 @@ class Flake:
         """
         from clan_cli.cmd import Log, RunOpts, run
         from clan_cli.dirs import nixpkgs_source, select_source
-        from clan_cli.nix import (
+
+        from clan_lib.nix import (
             nix_build,
             nix_config,
             nix_test_store,
@@ -818,7 +821,8 @@ class Flake:
 
         """
         from clan_cli.cmd import Log, RunOpts, run
-        from clan_cli.nix import (
+
+        from clan_lib.nix import (
             nix_eval,
             nix_test_store,
         )
diff --git a/pkgs/clan-cli/clan_cli/nix/__init__.py b/pkgs/clan-cli/clan_lib/nix/__init__.py
similarity index 100%
rename from pkgs/clan-cli/clan_cli/nix/__init__.py
rename to pkgs/clan-cli/clan_lib/nix/__init__.py
index 7ff247366..0d1c4420d 100644
--- a/pkgs/clan-cli/clan_cli/nix/__init__.py
+++ b/pkgs/clan-cli/clan_lib/nix/__init__.py
@@ -7,12 +7,12 @@ from functools import cache
 from pathlib import Path
 from typing import Any
 
-from clan_lib.errors import ClanError
-
 from clan_cli.cmd import run
 from clan_cli.dirs import nixpkgs_flake, nixpkgs_source
 from clan_cli.locked_open import locked_open
 
+from clan_lib.errors import ClanError
+
 log = logging.getLogger(__name__)
 
 
diff --git a/pkgs/clan-cli/clan_cli/nix/allowed-packages.json b/pkgs/clan-cli/clan_lib/nix/allowed-packages.json
similarity index 100%
rename from pkgs/clan-cli/clan_cli/nix/allowed-packages.json
rename to pkgs/clan-cli/clan_lib/nix/allowed-packages.json
diff --git a/pkgs/clan-cli/clan_lib/tests/test_create.py b/pkgs/clan-cli/clan_lib/tests/test_create.py
index 515b98217..e3e13b9a2 100644
--- a/pkgs/clan-cli/clan_lib/tests/test_create.py
+++ b/pkgs/clan-cli/clan_lib/tests/test_create.py
@@ -14,7 +14,6 @@ from clan_cli.inventory import patch_inventory_with
 from clan_cli.machines.create import CreateOptions as ClanCreateOptions
 from clan_cli.machines.create import create_machine
 from clan_cli.machines.machines import Machine
-from clan_cli.nix import nix_command
 from clan_cli.secrets.key import generate_key
 from clan_cli.secrets.sops import maybe_get_admin_public_key
 from clan_cli.secrets.users import add_user
@@ -26,6 +25,7 @@ from clan_lib.api.disk import hw_main_disk_options, set_machine_disk_schema
 from clan_lib.api.network import check_machine_online
 from clan_lib.errors import ClanError
 from clan_lib.flake import Flake
+from clan_lib.nix import nix_command
 from clan_lib.nix_models.inventory import Machine as InventoryMachine
 from clan_lib.nix_models.inventory import MachineDeploy
 
diff --git a/pkgs/clan-cli/default.nix b/pkgs/clan-cli/default.nix
index 76389259e..78458ba11 100644
--- a/pkgs/clan-cli/default.nix
+++ b/pkgs/clan-cli/default.nix
@@ -38,7 +38,7 @@ let
   # load nixpkgs runtime dependencies from a json file
   # This file represents an allow list at the same time that is checked by the run_cmd
   #   implementation in nix.py
-  allDependencies = lib.importJSON ./clan_cli/nix/allowed-packages.json;
+  allDependencies = lib.importJSON ./clan_lib/nix/allowed-packages.json;
   generateRuntimeDependenciesMap =
     deps:
     lib.filterAttrs (_: pkg: !pkg.meta.unsupported or false) (lib.genAttrs deps (name: pkgs.${name}));
diff --git a/pkgs/clan-cli/flake-module.nix b/pkgs/clan-cli/flake-module.nix
index 83fb44fb5..7ff498cc2 100644
--- a/pkgs/clan-cli/flake-module.nix
+++ b/pkgs/clan-cli/flake-module.nix
@@ -54,7 +54,7 @@
           clan-core-path = clanCoreWithVendoredDeps;
           templateDerivation = templateDerivation;
           pythonRuntime = pkgs.python3;
-          includedRuntimeDeps = lib.importJSON ./clan_cli/nix/allowed-packages.json;
+          includedRuntimeDeps = lib.importJSON ./clan_lib/nix/allowed-packages.json;
         };
         clan-cli-docs = pkgs.stdenv.mkDerivation {
           name = "clan-cli-docs";
diff --git a/pkgs/clan-cli/pyproject.toml b/pkgs/clan-cli/pyproject.toml
index 547caa939..7e8aee817 100644
--- a/pkgs/clan-cli/pyproject.toml
+++ b/pkgs/clan-cli/pyproject.toml
@@ -20,13 +20,15 @@ exclude = ["clan_cli.nixpkgs*", "result"]
 
 [tool.setuptools.package-data]
 clan_cli = [
-    "**/allowed-packages.json",
     "py.typed",
     "templates/**/*",
     "vms/mimetypes/**/*",
     "webui/assets/**/*",
     "flash/*.sh",
 ]
+clan_lib = [
+    "**/allowed-packages.json",
+]
 
 [tool.pytest.ini_options]
 testpaths = ["tests", "clan_cli", "clan_lib"]
diff --git a/pkgs/clan-vm-manager/tests/conftest.py b/pkgs/clan-vm-manager/tests/conftest.py
index 4db37f1ca..6b0a25fcb 100644
--- a/pkgs/clan-vm-manager/tests/conftest.py
+++ b/pkgs/clan-vm-manager/tests/conftest.py
@@ -4,7 +4,7 @@ from pathlib import Path
 
 import pytest
 from clan_cli.custom_logger import setup_logging
-from clan_cli.nix import nix_shell
+from clan_lib.nix import nix_shell
 
 sys.path.append(str(Path(__file__).parent / "helpers"))
 sys.path.append(
diff --git a/pkgs/generate-test-vars/generate_test_vars/cli.py b/pkgs/generate-test-vars/generate_test_vars/cli.py
index 68a2509ba..9fef3021a 100755
--- a/pkgs/generate-test-vars/generate_test_vars/cli.py
+++ b/pkgs/generate-test-vars/generate_test_vars/cli.py
@@ -12,9 +12,9 @@ from typing import Any, override
 
 from clan_cli.dirs import find_git_repo_root
 from clan_cli.machines.machines import Machine
-from clan_cli.nix import nix_config, nix_eval
 from clan_cli.vars.generate import generate_vars
 from clan_lib.flake.flake import Flake
+from clan_lib.nix import nix_config, nix_eval
 
 sops_priv_key = (
     "AGE-SECRET-KEY-1PL0M9CWRCG3PZ9DXRTTLMCVD57U6JDFE8K7DNVQ35F4JENZ6G3MQ0RQLRV"