Exports POC

Reviewed-on: https://git.clan.lol/clan/clan-core/pulls/5701

clanServices/sshd/default.nix

@@ -39,6 +39,7 @@
             ...
           }:
           let
+            uniqueStrings = list: builtins.attrNames (builtins.groupBy lib.id list);
             # Collect searchDomains from all servers in this instance
             allServerSearchDomains = lib.flatten (
               lib.mapAttrsToList (_name: machineConfig: machineConfig.settings.certificate.searchDomains or [ ]) (
@@ -46,7 +47,7 @@
               )
             );
             # Merge client's searchDomains with all servers' searchDomains
-            searchDomains = lib.uniqueStrings (settings.certificate.searchDomains ++ allServerSearchDomains);
+            searchDomains = uniqueStrings (settings.certificate.searchDomains ++ allServerSearchDomains);
           in
           {
             clan.core.vars.generators.openssh-ca = lib.mkIf (searchDomains != [ ]) {

clanServices/wifi/tests/eval-tests.nix

@@ -41,14 +41,14 @@ let
   # In this case it is 'self-zerotier-redux'
   # This is usually only used internally, but we can use it to test the evaluation of service module in isolation
   # evaluatedService =
-  #   testFlake.clanInternals.inventoryClass.distributedServices.importedModulesEvaluated.self-zerotier-redux.config;
+  #   testFlake.clanInternals.inventoryClass.distributedServices.servicesEval.config.mappedServices.self-zerotier-redux.config;
 in
 {
   test_simple = {
     inherit testFlake;
 
     expr =
-      testFlake.config.clan.clanInternals.inventoryClass.distributedServices.importedModulesEvaluated.self-wifi.config;
+      testFlake.config.clan.clanInternals.inventoryClass.distributedServices.servicesEval.config.mappedServices.self-wifi.config;
     expected = 1;
 
     # expr = {

clanServices/zerotier/default.nix

@@ -140,6 +140,9 @@
             pkgs,
             ...
           }:
+          let
+            uniqueStrings = list: builtins.attrNames (builtins.groupBy lib.id list);
+          in
           {
             imports = [
               (import ./shared.nix {
@@ -156,7 +159,7 @@
             config = {
               systemd.services.zerotier-inventory-autoaccept =
                 let
-                  machines = lib.uniqueStrings (
+                  machines = uniqueStrings (
                     (lib.optionals (roles ? moon) (lib.attrNames roles.moon.machines))
                     ++ (lib.optionals (roles ? controller) (lib.attrNames roles.controller.machines))
                     ++ (lib.optionals (roles ? peer) (lib.attrNames roles.peer.machines))

devFlake/flake.lock

@@ -105,11 +105,11 @@
     },
     "nixpkgs-dev": {
       "locked": {
-        "lastModified": 1761631514,
-        "narHash": "sha256-VsXz+2W4DFBozzppbF9SXD9pNcv17Z+c/lYXvPJi/eI=",
+        "lastModified": 1761748483,
+        "narHash": "sha256-v7fttCB5lJ22Ok7+N7ZbLhDeM89QIz9YWtQP4XN7xgA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a0b0d4b52b5f375658ca8371dc49bff171dbda91",
+        "rev": "061c55856b29b8b9360e14231a0986c7f85f1130",
         "type": "github"
       },
       "original": {
@@ -128,11 +128,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1760652422,
-        "narHash": "sha256-C88Pgz38QIl9JxQceexqL2G7sw9vodHWx1Uaq+NRJrw=",
+        "lastModified": 1761730856,
+        "narHash": "sha256-t1i5p/vSWwueZSC0Z2BImxx3BjoUDNKyC2mk24krcMY=",
         "owner": "NuschtOS",
         "repo": "search",
-        "rev": "3ebeebe8b6a49dfb11f771f761e0310f7c48d726",
+        "rev": "e29de6db0cb3182e9aee75a3b1fd1919d995d85b",
         "type": "github"
       },
       "original": {

lib/default.nix

@@ -40,6 +40,9 @@ lib.fix (
       # TODO: Flatten our lib functions like this:
       resolveModule = clanLib.callLib ./resolve-module { };
 
+      # Functions to help define exports
+      exports = clanLib.callLib ./exports.nix { };
+
       fs = {
         inherit (builtins) pathExists readDir;
       };

lib/exports.nix

@@ -0,0 +1,88 @@
+{ lib }:
+let
+  /**
+    Creates a scope string for global exports
+
+    At least one of serviceName or machineName must be set.
+
+    The scope string has the format:
+
+    "/SERVICE/INSTANCE/ROLE/MACHINE"
+
+    If the parameter is not set, the corresponding part is left empty.
+    Semantically this means "all".
+
+    Examples:
+    mkScope { serviceName = "A"; }
+    -> "/A///"
+
+    mkScope { machineName = "jon"; }
+    -> "///jon"
+
+    mkScope { serviceName = "A"; instanceName = "i1"; roleName = "peer"; machineName = "jon"; }
+    -> "/A/i1/peer/jon"
+  */
+  mkScope =
+    {
+      serviceName ? "",
+      instanceName ? "",
+      roleName ? "",
+      machineName ? "",
+    }:
+    let
+      parts = [
+        serviceName
+        instanceName
+        roleName
+        machineName
+      ];
+      checkedParts = lib.map (
+        part:
+        lib.throwIf (builtins.match ".?/.?" part != null) ''
+          clanLib.exports.mkScope: ${part} cannot contain the "/" character
+        ''
+      ) parts;
+    in
+    lib.throwIf ((serviceName == "" && machineName == "")) ''
+      clanLib.exports.mkScope requires at least 'serviceName' or 'machineName' to be set
+
+      In case your use case requires neither
+    '' (lib.join "/" checkedParts);
+
+  /**
+    Parses a scope string into its components
+
+    Returns an attribute set with the keys:
+    - serviceName
+    - instanceName
+    - roleName
+    - machineName
+
+    Example:
+    parseScope "A/i1/peer/jon"
+    ->
+    {
+      serviceName = "A";
+      instanceName = "i1";
+      roleName = "peer";
+      machineName = "jon";
+    }
+  */
+  parseScope =
+    scopeStr:
+    let
+      parts = lib.splitString "/" scopeStr;
+      checkedParts = lib.throwIf (lib.length parts != 4) ''
+        clanLib.exports.parseScope: invalid scope string format, expected 4 parts separated by 3 "/"
+      '' (parts);
+    in
+    {
+      serviceName = lib.elemAt 0 checkedParts;
+      instanceName = lib.elemAt 1 checkedParts;
+      roleName = lib.elemAt 2 checkedParts;
+      machineName = lib.elemAt 3 checkedParts;
+    };
+in
+{
+  inherit mkScope parseScope;
+}

lib/flake-module.nix

@@ -103,6 +103,11 @@ rec {
         inherit lib;
         clan-core = self;
       };
+      # Run: nix-unit --extra-experimental-features flakes --flake .#legacyPackages.x86_64-linux.evalTests-build-clan
+      legacyPackages.eval-exports = import ./new_exports.nix {
+        inherit lib;
+        clan-core = self;
+      };
       checks = {
         eval-lib-build-clan = pkgs.runCommand "tests" { nativeBuildInputs = [ pkgs.nix-unit ]; } ''
           export HOME="$(realpath .)"

lib/inventory/default.nix

@@ -2,11 +2,7 @@
   lib,
   clanLib,
 }:
-let
-  services = clanLib.callLib ./distributed-service/inventory-adapter.nix { };
-in
 {
-  inherit (services) mapInstances;
   inventoryModule = {
     _file = "clanLib.inventory.module";
     imports = [

lib/inventory/distributed-service/all-services-wrapper.nix

@@ -2,6 +2,7 @@
 {
   # TODO: consume directly from clan.config
   directory,
+  exports,
 }:
 {
   lib,
@@ -17,10 +18,10 @@ in
 {
   # TODO: merge these options into clan options
   options = {
-    exportsModule = mkOption {
-      type = types.deferredModule;
-      readOnly = true;
-    };
+    # exportsModule = mkOption {
+    #   type = types.deferredModule;
+    #   readOnly = true;
+    # };
     mappedServices = mkOption {
       visible = false;
       type = attrsWith {
@@ -28,19 +29,17 @@ in
         elemType = submoduleWith {
           class = "clan.service";
           specialArgs = {
-            exports = config.exports;
-            directory = directory;
             clanLib = specialArgs.clanLib;
+            inherit
+              exports
+              directory
+              ;
           };
           modules = [
             (
               { name, ... }:
               {
                 _module.args._ctx = [ name ];
-                _module.args.clanLib = specialArgs.clanLib;
-                _module.args.exports = config.exports;
-                _module.args.directory = directory;
-
               }
             )
             ./service-module.nix
@@ -55,34 +54,13 @@ in
       default = { };
     };
     exports = mkOption {
-      type = submoduleWith {
-        modules = [
-          {
-            options = {
-              instances = lib.mkOption {
-                default = { };
-                # instances.<instanceName>...
-                type = types.attrsOf (submoduleWith {
-                  modules = [
-                    config.exportsModule
-                  ];
-                });
-              };
-              # instances.<machineName>...
-              machines = lib.mkOption {
-                default = { };
-                type = types.attrsOf (submoduleWith {
-                  modules = [
-                    config.exportsModule
-                  ];
-                });
-              };
-            };
-          }
-        ]
-        ++ lib.mapAttrsToList (_: service: service.exports) config.mappedServices;
-      };
-      default = { };
+      type = types.lazyAttrsOf types.deferredModule;
+
+      # collect exports from all services
+      # zipAttrs is needed until we use the record type.
+      default = lib.zipAttrsWith (_name: values: { imports = values; }) (
+        lib.mapAttrsToList (_name: service: service.exports) config.mappedServices
+      );
     };
   };
 }

lib/inventory/distributed-service/inventory-adapter.nix

@@ -1,171 +0,0 @@
-# Adapter function between the inventory.instances and the clan.service module
-#
-# Data flow:
-# - inventory.instances -> Adapter -> clan.service module -> Service Resources (i.e. NixosModules per Machine, Vars per Service, etc.)
-#
-# What this file does:
-#
-# - Resolves the [Module] to an actual module-path and imports it.
-# - Groups together all the same modules into a single import and creates all instances for it.
-# - Resolves the inventory tags into machines. Tags don't exist at the service level.
-#   Also combines the settings for 'machines' and 'tags'.
-{
-  lib,
-  clanLib,
-  ...
-}:
-{
-  mapInstances =
-    {
-      # This is used to resolve the module imports from 'flake.inputs'
-      flakeInputs,
-      # The clan inventory
-      inventory,
-      directory,
-      clanCoreModules,
-      prefix ? [ ],
-      exportsModule,
-    }:
-    let
-      # machineHasTag = machineName: tagName: lib.elem tagName inventory.machines.${machineName}.tags;
-
-      # map the instances into the module
-      importedModuleWithInstances = lib.mapAttrs (
-        instanceName: instance:
-        let
-          resolvedModule = clanLib.resolveModule {
-            moduleSpec = instance.module;
-            inherit flakeInputs clanCoreModules;
-          };
-
-          # Every instance includes machines via roles
-          # :: { client :: ... }
-          instanceRoles = lib.mapAttrs (
-            roleName: role:
-            let
-              resolvedMachines = clanLib.inventory.resolveTags {
-                members = {
-                  # Explicit members
-                  machines = lib.attrNames role.machines;
-                  # Resolved Members
-                  tags = lib.attrNames role.tags;
-                };
-                inherit (inventory) machines;
-                inherit instanceName roleName;
-              };
-            in
-            # instances.<instanceName>.roles.<roleName> =
-            # Remove "tags", they are resolved into "machines"
-            (removeAttrs role [ "tags" ])
-            // {
-              machines = lib.genAttrs resolvedMachines.machines (
-                machineName:
-                let
-                  machineSettings = instance.roles.${roleName}.machines.${machineName}.settings or { };
-                in
-                # TODO: tag settings
-                # Wait for this feature until option introspection for 'settings' is done.
-                # This might get too complex to handle otherwise.
-                # settingsViaTags = lib.filterAttrs (
-                #   tagName: _: machineHasTag machineName tagName
-                # ) instance.roles.${roleName}.tags;
-                {
-                  # TODO: Do we want to wrap settings with
-                  # setDefaultModuleLocation "inventory.instances.${instanceName}.roles.${roleName}.tags.${tagName}";
-                  settings = {
-                    imports = [
-                      machineSettings
-                    ]; # ++ lib.attrValues (lib.mapAttrs (_tagName: v: v.settings) settingsViaTags);
-                  };
-                }
-              );
-            }
-          ) instance.roles;
-        in
-        {
-          inherit (instance) module;
-          inherit resolvedModule instanceRoles;
-        }
-      ) inventory.instances or { };
-
-      # Group the instances by the module they resolve to
-      # This is necessary to evaluate the module in a single pass
-      # :: { <module.input>_<module.name> :: [ { name, value } ] }
-      # Since 'perMachine' needs access to all the instances we should include them as a whole
-      grouped = lib.foldlAttrs (
-        acc: instanceName: instance:
-        let
-          inputName = if instance.module.input == null then "<clan-core>" else instance.module.input;
-          id = inputName + "-" + instance.module.name;
-        in
-        acc
-        // {
-          ${id} = acc.${id} or [ ] ++ [
-            {
-              inherit instanceName instance;
-            }
-          ];
-        }
-      ) { } importedModuleWithInstances;
-
-      # servicesEval.config.mappedServices.self-A.result.final.jon.nixosModule
-      allMachines = lib.mapAttrs (machineName: _: {
-        # This is the list of nixosModules for each machine
-        machineImports = lib.foldlAttrs (
-          acc: _module_ident: serviceModule:
-          acc ++ [ serviceModule.result.final.${machineName}.nixosModule or { } ]
-        ) [ ] servicesEval.config.mappedServices;
-      }) inventory.machines or { };
-
-      evalServices =
-        { modules, prefix }:
-        lib.evalModules {
-          class = "clan";
-          specialArgs = {
-            inherit clanLib;
-            _ctx = prefix;
-          };
-          modules = [
-            (import ./all-services-wrapper.nix { inherit directory; })
-          ]
-          ++ modules;
-        };
-
-      servicesEval = evalServices {
-        inherit prefix;
-        modules = [
-          {
-            inherit exportsModule;
-            mappedServices = lib.mapAttrs (_module_ident: instances: {
-              imports = [
-                # Import the resolved module.
-                # i.e. clan.modules.admin
-                {
-                  options.module = lib.mkOption {
-                    type = lib.types.raw;
-                    default = (builtins.head instances).instance.module;
-                  };
-                }
-                (builtins.head instances).instance.resolvedModule
-              ] # Include all the instances that correlate to the resolved module
-              ++ (builtins.map (v: {
-                instances.${v.instanceName}.roles = v.instance.instanceRoles;
-              }) instances);
-            }) grouped;
-          }
-        ];
-      };
-      importedModulesEvaluated = servicesEval.config.mappedServices;
-
-    in
-    {
-      inherit
-        servicesEval
-        importedModuleWithInstances
-        # Exposed for testing
-        grouped
-        allMachines
-        importedModulesEvaluated
-        ;
-    };
-}

lib/inventory/distributed-service/service-module.nix

@@ -7,10 +7,14 @@
   ...
 }:
 let
-  inherit (lib) mkOption types uniqueStrings;
+  inherit (lib) mkOption types;
   inherit (types) attrsWith submoduleWith;
 
   errorContext = "Error context: ${lib.concatStringsSep "." _ctx}";
+  # TODO:
+  # Remove once this gets merged upstream; performs in O(n*log(n) instead of O(n^2))
+  # https://github.com/NixOS/nixpkgs/pull/355616/files
+  uniqueStrings = list: builtins.attrNames (builtins.groupBy lib.id list);
   /**
     Merges the role- and machine-settings using the role interface
 
@@ -500,7 +504,7 @@ in
                     staticModules = [
                       ({
                         options.exports = mkOption {
-                          type = types.deferredModule;
+                          type = types.lazyAttrsOf types.deferredModule;
                           default = { };
                           description = ''
                             !!! Danger "Experimental Feature"
@@ -630,8 +634,16 @@ in
       type = types.deferredModuleWith {
         staticModules = [
           ({
+            # exports."///".generator.name = { _file ... import = []; _type = }
+            # exports."///".networking = { _file ... import = []; }
+
+            # generators."///".name = { name, ...}: { _file ... import = [];}
+            # networks."///" = { _file ... import = []; }
+
+            # { _file ... import = []; }
+            # { _file ... import = []; }
             options.exports = mkOption {
-              type = types.deferredModule;
+              type = types.lazyAttrsOf types.deferredModule;
               default = { };
               description = ''
                 !!! Danger "Experimental Feature"
@@ -763,79 +775,38 @@ in
         ```
       '';
       default = { };
-      type = types.submoduleWith {
-        # Static modules
-        modules = [
-          {
-            options.instances = mkOption {
-              type = types.attrsOf types.deferredModule;
-              description = ''
-                export modules defined in 'perInstance'
-                mapped to their instance name
-
-                Example
-
-                with instances:
-
-                ```nix
-                instances.A = { ... };
-                instances.B= { ... };
-
-                roles.peer.perInstance = { instanceName, machine, ... }:
-                {
-                  exports.foo = 1;
-                }
-
-                This yields all other services can access these exports
-                =>
-                exports.instances.A.foo = 1;
-                exports.instances.B.foo = 1;
-                ```
-              '';
-            };
-            options.machines = mkOption {
-              type = types.attrsOf types.deferredModule;
-              description = ''
-                export modules defined in 'perMachine'
-                mapped to their machine name
-
-                Example
-
-                with machines:
-
-                ```nix
-                instances.A = { roles.peer.machines.jon = ... };
-                instances.B = { roles.peer.machines.jon = ... };
-
-                perMachine = { machine, ... }:
-                {
-                  exports.foo = 1;
-                }
-
-                This yields all other services can access these exports
-                =>
-                exports.machines.jon.foo = 1;
-                exports.machines.sara.foo = 1;
-                ```
-              '';
-            };
-            # Lazy default via imports
-            # should probably be moved to deferredModuleWith { staticModules = [ ]; }
-            imports =
-              if config._docs_rendering then
-                [ ]
-              else
-                lib.mapAttrsToList (_roleName: role: {
-                  instances = lib.mapAttrs (_instanceName: instance: {
-                    imports = lib.mapAttrsToList (_machineName: v: v.exports) instance.allMachines;
-                  }) role.allInstances;
-                }) config.result.allRoles
-                ++ lib.mapAttrsToList (machineName: machine: {
-                  machines.${machineName} = machine.exports;
-                }) config.result.allMachines;
-          }
-        ];
-      };
+      type = types.lazyAttrsOf (
+        types.deferredModuleWith {
+          # staticModules = [];
+          # lib.concatLists (
+          #   lib.concatLists (
+          #     lib.mapAttrsToList (
+          #       _roleName: role:
+          #       lib.mapAttrsToList (
+          #         _instanceName: instance: lib.mapAttrsToList (_machineName: v: v.exports) instance.allMachines
+          #       ) role.allInstances
+          #     ) config.result.allRoles
+          #   )
+          # )
+          # ++
+        }
+      );
+      #     # Lazy default via imports
+      #     # should probably be moved to deferredModuleWith { staticModules = [ ]; }
+      #     imports =
+      #       if config._docs_rendering then
+      #         [ ]
+      #       else
+      #         lib.mapAttrsToList (_roleName: role: {
+      #           instances = lib.mapAttrs (_instanceName: instance: {
+      #             imports = lib.mapAttrsToList (_machineName: v: v.exports) instance.allMachines;
+      #           }) role.allInstances;
+      #         }) config.result.allRoles
+      #         ++ lib.mapAttrsToList (machineName: machine: {
+      #           machines.${machineName} = machine.exports;
+      #         }) config.result.allMachines;
+      #   }
+      # ];
     };
     # ---
     # Place the result in _module.result to mark them as "internal" and discourage usage/overrides
@@ -1020,5 +991,39 @@ in
         }
       ) config.result.allMachines;
     };
+
+    debug = mkOption {
+      default = lib.zipAttrsWith (_name: values: { imports = values; }) (
+        lib.mapAttrsToList (_machineName: machine: machine.exports) config.result.allMachines
+      );
+    };
   };
+
+  imports = [
+    {
+      # collect exports from all machines
+      # zipAttrs is needed until we use the record type.
+      exports = lib.zipAttrsWith (_name: values: { imports = values; }) (
+        lib.mapAttrsToList (_machineName: machine: machine.exports) config.result.allMachines
+      );
+
+    }
+    {
+      # collect exports from all instances, roles and machines
+      # zipAttrs is needed until we use the record type.
+      exports = lib.zipAttrsWith (_name: values: { imports = values; }) (
+        lib.concatLists (
+          lib.concatLists (
+            lib.mapAttrsToList (
+              _roleName: role:
+              lib.mapAttrsToList (
+                _instanceName: instance: lib.mapAttrsToList (_machineName: v: v.exports) instance.allMachines
+              ) role.allInstances
+            ) config.result.allRoles
+          )
+        )
+      );
+    }
+  ];
+
 }

lib/inventory/distributed-service/tests/default.nix

@@ -4,63 +4,53 @@
   ...
 }:
 let
-  inherit (lib)
-    evalModules
-    ;
 
-  evalInventory =
-    m:
-    (evalModules {
-      # Static modules
-      modules = [
-        clanLib.inventory.inventoryModule
-        {
-          _file = "test file";
-          tags.all = [ ];
-          tags.nixos = [ ];
-          tags.darwin = [ ];
-        }
-        {
-          modules.test = { };
-        }
-        m
-      ];
-    }).config;
-
-  callInventoryAdapter =
-    inventoryModule:
-    let
-      inventory = evalInventory inventoryModule;
-      flakeInputsFixture = {
-        self.clan.modules = inventoryModule.modules or { };
-        # Example upstream module
-        upstream.clan.modules = {
-          uzzi = {
-            _class = "clan.service";
-            manifest = {
-              name = "uzzi-from-upstream";
-            };
-          };
+  flakeInputsFixture = {
+    upstream.clan.modules = {
+      uzzi = {
+        _class = "clan.service";
+        manifest = {
+          name = "uzzi-from-upstream";
         };
       };
-    in
-    clanLib.inventory.mapInstances {
-      directory = ./.;
-      clanCoreModules = { };
-      flakeInputs = flakeInputsFixture;
-      inherit inventory;
-      exportsModule = { };
     };
+  };
+
+  createTestClan =
+    testClan:
+    let
+      res = clanLib.clan ({
+        # Static / mocked
+        specialArgs = {
+          clan-core = {
+            clan.modules = { };
+          };
+        };
+        self.inputs = flakeInputsFixture // {
+          self.clan = res.config;
+        };
+        directory = ./.;
+        exportsModule = { };
+
+        imports = [
+          testClan
+        ];
+      });
+    in
+    res;
+
 in
 {
   extraModules = import ./extraModules.nix { inherit clanLib; };
   exports = import ./exports.nix { inherit lib clanLib; };
-  settings = import ./settings.nix { inherit lib callInventoryAdapter; };
-  specialArgs = import ./specialArgs.nix { inherit lib callInventoryAdapter; };
-  resolve_module_spec = import ./import_module_spec.nix { inherit lib callInventoryAdapter; };
+  settings = import ./settings.nix { inherit lib createTestClan; };
+  specialArgs = import ./specialArgs.nix { inherit lib createTestClan; };
+  resolve_module_spec = import ./import_module_spec.nix {
+    inherit lib createTestClan;
+  };
   test_simple =
     let
-      res = callInventoryAdapter {
+      res = createTestClan {
         # Authored module
         # A minimal module looks like this
         # It isn't exactly doing anything but it's a valid module that produces an output
@@ -71,7 +61,7 @@ in
           };
         };
         # User config
-        instances."instance_foo" = {
+        inventory.instances."instance_foo" = {
           module = {
             name = "simple-module";
           };
@@ -81,7 +71,7 @@ in
     {
       # Test that the module is mapped into the output
       # We might change the attribute name in the future
-      expr = res.importedModulesEvaluated ? "<clan-core>-simple-module";
+      expr = res.config._services.mappedServices ? "<clan-core>-simple-module";
       expected = true;
       inherit res;
     };
@@ -92,7 +82,7 @@ in
   # All instances should be included within one evaluation to make all of them available
   test_module_grouping =
     let
-      res = callInventoryAdapter {
+      res = createTestClan {
         # Authored module
         # A minimal module looks like this
         # It isn't exactly doing anything but it's a valid module that produces an output
@@ -112,18 +102,19 @@ in
 
           perMachine = { }: { };
         };
+
         # User config
-        instances."instance_foo" = {
+        inventory.instances."instance_foo" = {
           module = {
             name = "A";
           };
         };
-        instances."instance_bar" = {
+        inventory.instances."instance_bar" = {
           module = {
             name = "B";
           };
         };
-        instances."instance_baz" = {
+        inventory.instances."instance_baz" = {
           module = {
             name = "A";
           };
@@ -133,16 +124,16 @@ in
     {
       # Test that the module is mapped into the output
       # We might change the attribute name in the future
-      expr = lib.mapAttrs (_n: v: builtins.length v) res.grouped;
-      expected = {
-        "<clan-core>-A" = 2;
-        "<clan-core>-B" = 1;
-      };
+      expr = lib.attrNames res.config._services.mappedServices;
+      expected = [
+        "<clan-core>-A"
+        "<clan-core>-B"
+      ];
     };
 
   test_creates_all_instances =
     let
-      res = callInventoryAdapter {
+      res = createTestClan {
         # Authored module
         # A minimal module looks like this
         # It isn't exactly doing anything but it's a valid module that produces an output
@@ -154,22 +145,24 @@ in
 
           perMachine = { }: { };
         };
-        instances."instance_foo" = {
-          module = {
-            name = "A";
-            input = "self";
+        inventory = {
+          instances."instance_foo" = {
+            module = {
+              name = "A";
+              input = "self";
+            };
           };
-        };
-        instances."instance_bar" = {
-          module = {
-            name = "A";
-            input = "self";
+          instances."instance_bar" = {
+            module = {
+              name = "A";
+              input = "self";
+            };
           };
-        };
-        instances."instance_zaza" = {
-          module = {
-            name = "B";
-            input = null;
+          instances."instance_zaza" = {
+            module = {
+              name = "B";
+              input = null;
+            };
           };
         };
       };
@@ -177,7 +170,7 @@ in
     {
       # Test that the module is mapped into the output
       # We might change the attribute name in the future
-      expr = lib.attrNames res.importedModulesEvaluated.self-A.instances;
+      expr = lib.attrNames res.config._services.mappedServices.self-A.instances;
       expected = [
         "instance_bar"
         "instance_foo"
@@ -187,7 +180,7 @@ in
   # Membership via roles
   test_add_machines_directly =
     let
-      res = callInventoryAdapter {
+      res = createTestClan {
         # Authored module
         # A minimal module looks like this
         # It isn't exactly doing anything but it's a valid module that produces an output
@@ -202,38 +195,40 @@ in
 
           # perMachine = {}: {};
         };
-        machines = {
-          jon = { };
-          sara = { };
-          hxi = { };
-        };
-        instances."instance_foo" = {
-          module = {
-            name = "A";
-            input = "self";
+        inventory = {
+          machines = {
+            jon = { };
+            sara = { };
+            hxi = { };
           };
-          roles.peer.machines.jon = { };
-        };
-        instances."instance_bar" = {
-          module = {
-            name = "A";
-            input = "self";
+          instances."instance_foo" = {
+            module = {
+              name = "A";
+              input = "self";
+            };
+            roles.peer.machines.jon = { };
           };
-          roles.peer.machines.sara = { };
-        };
-        instances."instance_zaza" = {
-          module = {
-            name = "B";
-            input = null;
+          instances."instance_bar" = {
+            module = {
+              name = "A";
+              input = "self";
+            };
+            roles.peer.machines.sara = { };
+          };
+          instances."instance_zaza" = {
+            module = {
+              name = "B";
+              input = null;
+            };
+            roles.peer.tags.all = { };
           };
-          roles.peer.tags.all = { };
         };
       };
     in
     {
       # Test that the module is mapped into the output
       # We might change the attribute name in the future
-      expr = lib.attrNames res.importedModulesEvaluated.self-A.result.allMachines;
+      expr = lib.attrNames res.config._services.mappedServices.self-A.result.allMachines;
       expected = [
         "jon"
         "sara"
@@ -243,7 +238,7 @@ in
   # Membership via tags
   test_add_machines_via_tags =
     let
-      res = callInventoryAdapter {
+      res = createTestClan {
         # Authored module
         # A minimal module looks like this
         # It isn't exactly doing anything but it's a valid module that produces an output
@@ -257,35 +252,37 @@ in
 
           # perMachine = {}: {};
         };
-        machines = {
-          jon = {
-            tags = [ "foo" ];
+        inventory = {
+          machines = {
+            jon = {
+              tags = [ "foo" ];
+            };
+            sara = {
+              tags = [ "foo" ];
+            };
+            hxi = { };
           };
-          sara = {
-            tags = [ "foo" ];
+          instances."instance_foo" = {
+            module = {
+              name = "A";
+              input = "self";
+            };
+            roles.peer.tags.foo = { };
           };
-          hxi = { };
-        };
-        instances."instance_foo" = {
-          module = {
-            name = "A";
-            input = "self";
+          instances."instance_zaza" = {
+            module = {
+              name = "B";
+              input = null;
+            };
+            roles.peer.tags.all = { };
           };
-          roles.peer.tags.foo = { };
-        };
-        instances."instance_zaza" = {
-          module = {
-            name = "B";
-            input = null;
-          };
-          roles.peer.tags.all = { };
         };
       };
     in
     {
       # Test that the module is mapped into the output
       # We might change the attribute name in the future
-      expr = lib.attrNames res.importedModulesEvaluated.self-A.result.allMachines;
+      expr = lib.attrNames res.config._services.mappedServices.self-A.result.allMachines;
       expected = [
         "jon"
         "sara"
@@ -293,6 +290,9 @@ in
     };
 
   machine_imports = import ./machine_imports.nix { inherit lib clanLib; };
-  per_machine_args = import ./per_machine_args.nix { inherit lib callInventoryAdapter; };
-  per_instance_args = import ./per_instance_args.nix { inherit lib callInventoryAdapter; };
+  per_machine_args = import ./per_machine_args.nix { inherit lib createTestClan; };
+  per_instance_args = import ./per_instance_args.nix {
+    inherit lib;
+    callInventoryAdapter = createTestClan;
+  };
 }

lib/inventory/distributed-service/tests/import_module_spec.nix

@@ -1,4 +1,4 @@
-{ callInventoryAdapter, ... }:
+{ createTestClan, ... }:
 let
   # Authored module
   # A minimal module looks like this
@@ -23,10 +23,13 @@ let
 
   resolve =
     spec:
-    callInventoryAdapter {
-      inherit modules machines;
-      instances."instance_foo" = {
-        module = spec;
+    createTestClan {
+      inherit modules;
+      inventory = {
+        inherit machines;
+        instances."instance_foo" = {
+          module = spec;
+        };
       };
     };
 in
@@ -36,25 +39,16 @@ in
       (resolve {
         name = "A";
         input = "self";
-      }).importedModuleWithInstances.instance_foo.resolvedModule;
-    expected = {
-      _class = "clan.service";
-      manifest = {
-        name = "network";
-      };
-    };
+      }).config._services.mappedServices.self-A.manifest.name;
+    expected = "network";
   };
   test_import_remote_module_by_name = {
     expr =
       (resolve {
         name = "uzzi";
         input = "upstream";
-      }).importedModuleWithInstances.instance_foo.resolvedModule;
-    expected = {
-      _class = "clan.service";
-      manifest = {
-        name = "uzzi-from-upstream";
-      };
-    };
+      }).config._services.mappedServices.upstream-uzzi.manifest.name;
+    expected = "uzzi-from-upstream";
+
   };
 }

lib/inventory/distributed-service/tests/per_instance_args.nix

@@ -58,39 +58,43 @@ let
     sara = { };
   };
   res = callInventoryAdapter {
-    inherit modules machines;
-    instances."instance_foo" = {
-      module = {
-        name = "A";
-        input = "self";
+    inherit modules;
+
+    inventory = {
+      inherit machines;
+      instances."instance_foo" = {
+        module = {
+          name = "A";
+          input = "self";
+        };
+        roles.peer.machines.jon = {
+          settings.timeout = lib.mkForce "foo-peer-jon";
+        };
+        roles.peer = {
+          settings.timeout = "foo-peer";
+        };
+        roles.controller.machines.jon = { };
       };
-      roles.peer.machines.jon = {
-        settings.timeout = lib.mkForce "foo-peer-jon";
+      instances."instance_bar" = {
+        module = {
+          name = "A";
+          input = "self";
+        };
+        roles.peer.machines.jon = {
+          settings.timeout = "bar-peer-jon";
+        };
       };
-      roles.peer = {
-        settings.timeout = "foo-peer";
+      # TODO: move this into a seperate test.
+      # Seperate out the check that this module is never imported
+      # import the module "B" (undefined)
+      # All machines have this instance
+      instances."instance_zaza" = {
+        module = {
+          name = "B";
+          input = null;
+        };
+        roles.peer.tags.all = { };
       };
-      roles.controller.machines.jon = { };
-    };
-    instances."instance_bar" = {
-      module = {
-        name = "A";
-        input = "self";
-      };
-      roles.peer.machines.jon = {
-        settings.timeout = "bar-peer-jon";
-      };
-    };
-    # TODO: move this into a seperate test.
-    # Seperate out the check that this module is never imported
-    # import the module "B" (undefined)
-    # All machines have this instance
-    instances."instance_zaza" = {
-      module = {
-        name = "B";
-        input = null;
-      };
-      roles.peer.tags.all = { };
     };
   };
 
@@ -105,9 +109,10 @@ in
 {
   # settings should evaluate
   test_per_instance_arguments = {
+    inherit res;
     expr = {
       instanceName =
-        res.importedModulesEvaluated.self-A.result.allRoles.peer.allInstances."instance_foo".allMachines.jon.passthru.instanceName;
+        res.config._services.mappedServices.self-A.result.allRoles.peer.allInstances."instance_foo".allMachines.jon.passthru.instanceName;
 
       # settings are specific.
       # Below we access:
@@ -115,11 +120,11 @@ in
       # roles = peer
       # machines = jon
       settings =
-        res.importedModulesEvaluated.self-A.result.allRoles.peer.allInstances.instance_foo.allMachines.jon.passthru.settings;
+        res.config._services.mappedServices.self-A.result.allRoles.peer.allInstances.instance_foo.allMachines.jon.passthru.settings;
       machine =
-        res.importedModulesEvaluated.self-A.result.allRoles.peer.allInstances.instance_foo.allMachines.jon.passthru.machine;
+        res.config._services.mappedServices.self-A.result.allRoles.peer.allInstances.instance_foo.allMachines.jon.passthru.machine;
       roles =
-        res.importedModulesEvaluated.self-A.result.allRoles.peer.allInstances.instance_foo.allMachines.jon.passthru.roles;
+        res.config._services.mappedServices.self-A.result.allRoles.peer.allInstances.instance_foo.allMachines.jon.passthru.roles;
     };
     expected = {
       instanceName = "instance_foo";
@@ -160,9 +165,9 @@ in
 
   # TODO: Cannot be tested like this anymore
   test_per_instance_settings_vendoring = {
-    x = res.importedModulesEvaluated.self-A;
+    x = res.config._services.mappedServices.self-A;
     expr =
-      res.importedModulesEvaluated.self-A.result.allRoles.peer.allInstances.instance_foo.allMachines.jon.passthru.vendoredSettings;
+      res.config._services.mappedServices.self-A.result.allRoles.peer.allInstances.instance_foo.allMachines.jon.passthru.vendoredSettings;
     expected = {
       timeout = "config.thing";
     };

lib/inventory/distributed-service/tests/per_machine_args.nix

@@ -1,4 +1,4 @@
-{ lib, callInventoryAdapter }:
+{ lib, createTestClan }:
 let
   # Authored module
   # A minimal module looks like this
@@ -39,36 +39,40 @@ let
     jon = { };
     sara = { };
   };
-  res = callInventoryAdapter {
-    inherit modules machines;
-    instances."instance_foo" = {
-      module = {
-        name = "A";
-        input = "self";
+  res = createTestClan {
+    inherit modules;
+    inventory = {
+
+      inherit machines;
+      instances."instance_foo" = {
+        module = {
+          name = "A";
+          input = "self";
+        };
+        roles.peer.machines.jon = {
+          settings.timeout = lib.mkForce "foo-peer-jon";
+        };
+        roles.peer = {
+          settings.timeout = "foo-peer";
+        };
       };
-      roles.peer.machines.jon = {
-        settings.timeout = lib.mkForce "foo-peer-jon";
+      instances."instance_bar" = {
+        module = {
+          name = "A";
+          input = "self";
+        };
+        roles.peer.machines.jon = {
+          settings.timeout = "bar-peer-jon";
+        };
       };
-      roles.peer = {
-        settings.timeout = "foo-peer";
+      instances."instance_zaza" = {
+        module = {
+          name = "B";
+          input = null;
+        };
+        roles.peer.tags.all = { };
       };
     };
-    instances."instance_bar" = {
-      module = {
-        name = "A";
-        input = "self";
-      };
-      roles.peer.machines.jon = {
-        settings.timeout = "bar-peer-jon";
-      };
-    };
-    instances."instance_zaza" = {
-      module = {
-        name = "B";
-        input = null;
-      };
-      roles.peer.tags.all = { };
-    };
   };
 in
 
@@ -79,7 +83,7 @@ in
     inherit res;
     expr = {
       hasMachineSettings =
-        res.importedModulesEvaluated.self-A.result.allMachines.jon.passthru.instances.instance_foo.roles.peer.machines.jon
+        res.config._services.mappedServices.self-A.result.allMachines.jon.passthru.instances.instance_foo.roles.peer.machines.jon
         ? settings;
 
       # settings are specific.
@@ -88,10 +92,10 @@ in
       # roles = peer
       # machines = jon
       specificMachineSettings =
-        res.importedModulesEvaluated.self-A.result.allMachines.jon.passthru.instances.instance_foo.roles.peer.machines.jon.settings;
+        res.config._services.mappedServices.self-A.result.allMachines.jon.passthru.instances.instance_foo.roles.peer.machines.jon.settings;
 
       hasRoleSettings =
-        res.importedModulesEvaluated.self-A.result.allMachines.jon.passthru.instances.instance_foo.roles.peer
+        res.config._services.mappedServices.self-A.result.allMachines.jon.passthru.instances.instance_foo.roles.peer
         ? settings;
 
       # settings are specific.
@@ -100,7 +104,7 @@ in
       # roles = peer
       # machines = *
       specificRoleSettings =
-        res.importedModulesEvaluated.self-A.result.allMachines.jon.passthru.instances.instance_foo.roles.peer;
+        res.config._services.mappedServices.self-A.result.allMachines.jon.passthru.instances.instance_foo.roles.peer;
     };
     expected = {
       hasMachineSettings = true;

lib/inventory/distributed-service/tests/settings.nix

@@ -1,6 +1,6 @@
-{ callInventoryAdapter, lib, ... }:
+{ createTestClan, lib, ... }:
 let
-  res = callInventoryAdapter {
+  res = createTestClan {
     modules."A" = {
       _class = "clan.service";
       manifest = {
@@ -21,28 +21,31 @@ let
           };
         };
     };
-    machines = {
-      jon = { };
-      sara = { };
-    };
-    instances."instance_foo" = {
-      module = {
-        name = "A";
-        input = "self";
+    inventory = {
+
+      machines = {
+        jon = { };
+        sara = { };
       };
-      # Settings for both jon and sara
-      roles.peer.settings = {
-        timeout = 40;
+      instances."instance_foo" = {
+        module = {
+          name = "A";
+          input = "self";
+        };
+        # Settings for both jon and sara
+        roles.peer.settings = {
+          timeout = 40;
+        };
+        # Jon overrides timeout
+        roles.peer.machines.jon = {
+          settings.timeout = lib.mkForce 42;
+        };
+        roles.peer.machines.sara = { };
       };
-      # Jon overrides timeout
-      roles.peer.machines.jon = {
-        settings.timeout = lib.mkForce 42;
-      };
-      roles.peer.machines.sara = { };
     };
   };
 
-  config = res.servicesEval.config.mappedServices.self-A;
+  config = res.config._services.mappedServices.self-A;
 
   #
   applySettings =

lib/inventory/distributed-service/tests/specialArgs.nix

@@ -1,6 +1,6 @@
-{ callInventoryAdapter, lib, ... }:
+{ createTestClan, lib, ... }:
 let
-  res = callInventoryAdapter {
+  res = createTestClan {
     modules."A" = m: {
       _class = "clan.service";
       config = {
@@ -14,19 +14,21 @@ let
         default = m;
       };
     };
-    machines = {
-      jon = { };
-    };
-    instances."instance_foo" = {
-      module = {
-        name = "A";
-        input = "self";
+    inventory = {
+      machines = {
+        jon = { };
+      };
+      instances."instance_foo" = {
+        module = {
+          name = "A";
+          input = "self";
+        };
+        roles.peer.machines.jon = { };
       };
-      roles.peer.machines.jon = { };
     };
   };
 
-  specialArgs = lib.attrNames res.servicesEval.config.mappedServices.self-A.test.specialArgs;
+  specialArgs = lib.attrNames res.config._services.mappedServices.self-A.test.specialArgs;
 in
 {
   test_simple = {

lib/new_exports.nix

@@ -0,0 +1,221 @@
+{
+  clan-core,
+  lib,
+}:
+# TODO: TEST: define a clan without machines
+{
+  test_simple =
+    let
+      eval = clan-core.clanLib.clan {
+        exports."///".foo = lib.mkForce eval.config.exports."///".bar;
+
+        directory = ./.;
+        self = {
+          clan = eval.config;
+          inputs = { };
+        };
+
+        machines.jon = { };
+        machines.sara = { };
+
+        exportsModule =
+          { lib, ... }:
+          {
+            options.foo = lib.mkOption {
+              type = lib.types.number;
+              default = 0;
+            };
+            options.bar = lib.mkOption {
+              type = lib.types.number;
+              default = 0;
+            };
+          };
+
+        ####### Service module "A"
+        modules.service-A =
+          { ... }:
+          {
+            # config.exports
+            manifest.name = "A";
+
+            roles.default = {
+              # TODO: Remove automapping
+              # Currently exports are automapped
+              # scopes "/service=A/instance=hello/role=default/machine=jon"
+              # perInstance.exports.foo = 7;
+
+              # New style:
+              # Explizit scope
+              # perInstance.exports."service=A/instance=hello/role=default/machine=jon".foo = 7;
+              perInstance =
+                { instanceName, machine, exports, ... }:
+                {
+                  exports."A/${instanceName}/default/${machine.name}" = {
+                    foo = 7;
+                    # define export depending on B
+                    bar = exports."B/B/default/${machine.name}".foo + 35;
+                  };
+                  # exports."A/${instanceName}/default/${machine.name}".
+
+                  # default behavior
+                  # exports = scope.mkExports { foo = 7; };
+
+                  # We want to export things for different scopes from this scope;
+                  # If this scope is used.
+                  #
+                  # Explicit scope; different from the function scope above
+                  # exports = clanLib.scopedExport {
+                  #   # Different role export
+                  #   role = "peer";
+                  #   serviceName = config.manifest.name;
+                  #   inherit instanceName machineName;
+                  # } { foo = 7; };
+                };
+            };
+
+            perMachine =
+              { ... }:
+              {
+                #
+                # exports = scope.mkExports { foo = 7; };
+                # exports."A///${machine.name}".foo = 42;
+                # exports."B///".foo = 42;
+              };
+
+            # scope "/service=A/instance=??/role=??/machine=jon"
+            # perMachine.exports.foo = 42;
+
+            # scope "/service=A/instance=??/role=??/machine=??"
+            # exports."///".foo = 10;
+          };
+        ####### Service module "A"
+        modules.service-B =
+          { exports, ... }:
+          {
+            # config.exports
+            manifest.name = "B";
+
+            roles.default = {
+              # TODO: Remove automapping
+              # Currently exports are automapped
+              # scopes "/service=A/instance=hello/role=default/machine=jon"
+              # perInstance.exports.foo = 7;
+
+              # New style:
+              # Explizit scope
+              # perInstance.exports."service=A/instance=hello/role=default/machine=jon".foo = 7;
+              perInstance =
+                { instanceName, machine, ... }:
+                {
+                  # TODO: Test non-existing scope
+                  # define export depending on A
+                  exports."B/${instanceName}/default/${machine.name}".foo = exports."///".foo + exports."A/A/default/${machine.name}".foo;
+                  # exports."B/B/default/jon".foo = exports."A/A/default/jon".foo;
+
+                  # default behavior
+                  # exports = scope.mkExports { foo = 7; };
+
+                  # We want to export things for different scopes from this scope;
+                  # If this scope is used.
+                  #
+                  # Explicit scope; different from the function scope above
+                  # exports = clanLib.scopedExport {
+                  #   # Different role export
+                  #   role = "peer";
+                  #   serviceName = config.manifest.name;
+                  #   inherit instanceName machineName;
+                  # } { foo = 7; };
+                };
+            };
+
+            perMachine =
+              { ... }:
+              {
+                # exports = scope.mkExports { foo = 7; };
+                # exports."A///${machine.name}".foo = 42;
+                # exports."B///".foo = 42;
+              };
+
+            # scope "/service=A/instance=??/role=??/machine=jon"
+            # perMachine.exports.foo = 42;
+
+            # scope "/service=A/instance=??/role=??/machine=??"
+            exports."///".foo = 10;
+          };
+        #######
+
+        inventory = {
+          instances.A = {
+            module.name = "service-A";
+            module.input = "self";
+            roles.default.tags = [ "all" ];
+          };
+          instances.B = {
+            module.name = "service-B";
+            module.input = "self";
+            roles.default.tags = [ "all" ];
+          };
+        };
+        # <- inventory
+        #
+        # -> exports
+        /**
+          Current state
+          {
+            instances = {
+              hello = { networking = null; };
+            };
+            machines = {
+              jon = { networking = null; };
+            };
+          }
+        */
+        /**
+          Target state: (Flat attribute set)
+
+          tdlr;
+
+          # roles / instance level definitions may not exist on their own
+          # role and instance names are completely arbitrary.
+          # For example what does it mean: this is a export for all "peer" roles of all service-instances? That would be magic on the roleName.
+          # Or exports for all instances with name "ifoo" ? That would be magic on the instanceName.
+
+          # Practical combinations
+          # always include either the service name or the machine name
+
+          exports = {
+            # Clan level (1)
+            "///" networks generators
+
+            # Service anchored (8) : min 1 instance is needed ; machines may not exist
+            "A///" <- service specific
+            "A/instance//" <- instance of a service
+            "A//peer/" <- role of a service
+            "A/instance/peer/" <- instance+role of a service
+            "A///machine" <- machine of a service
+            "A/instance//machine" <- machine + instance of a service
+            "A//role/machine" <- machine + role of a service
+            "A/instance/role/machine" <- machine + role + instance of a service
+
+            # Machine anchored (1 or 2)
+            "///jon" <- this machine
+            "A///jon" <- role on a machine (dupped with service anchored)
+
+            # Unpractical; probably not needed (5)
+            "//peer/jon" <- role on a machine
+            "/instance//jon" <- role on a machine
+            "/instance//" <- instance: All "foo" instances everywhere?
+            "//role/" <- role: All "peer" roles everywhere?
+            "/instance/role/" <- instance role: Applies to all services, whose instance name has "ifoo" and role is "peer" (double magic)
+
+            # TODO: lazyattrs poc
+          }
+        */
+      };
+    in
+    {
+      inherit eval;
+      expr = eval;
+      expected = 42;
+    };
+}

lib/types/default.nix

@@ -1,4 +1,21 @@
 { lib, ... }:
+let
+  inherit (lib)
+    mapAttrs
+    attrNames
+    showOption
+    setDefaultModuleLocation
+    mkOptionType
+    isAttrs
+    filterAttrs
+    intersectAttrs
+    mapAttrsToList
+    mkOptionDefault
+    zipAttrsWith
+    seq
+    fix
+    ;
+in
 {
   /**
     A custom type for deferred modules that guarantee to be JSON serializable.
@@ -12,7 +29,7 @@
     - Enforces that the definition is JSON serializable
     - Disallows nested imports
   */
-  uniqueDeferredSerializableModule = lib.fix (
+  uniqueDeferredSerializableModule = fix (
     self:
     let
       checkDef =
@@ -23,19 +40,18 @@
           def;
     in
     # Essentially the "raw" type, but with a custom name and check
-    lib.mkOptionType {
+    mkOptionType {
       name = "deferredModule";
       description = "deferred custom module. Must be JSON serializable.";
       descriptionClass = "noun";
       # Unfortunately, tryEval doesn't catch JSON errors
-      check = value: lib.seq (builtins.toJSON value) (lib.isAttrs value);
+      check = value: seq (builtins.toJSON value) (isAttrs value);
       merge = lib.options.mergeUniqueOption {
         message = "------";
         merge = loc: defs: {
           imports = map (
             def:
-            lib.seq (checkDef loc def) lib.setDefaultModuleLocation
-              "${def.file}, via option ${lib.showOption loc}"
+            seq (checkDef loc def) setDefaultModuleLocation "${def.file}, via option ${showOption loc}"
               def.value
           ) defs;
         };
@@ -48,4 +64,113 @@
       };
     }
   );
+
+  /**
+    New submodule type that allows merging at the attribute level.
+
+    :::note
+    'record' type adopted from https://github.com/NixOS/nixpkgs/pull/334680
+    :::
+
+    It applies additional constraints to immediate child options:
+
+    - No support for 'readOnly'
+    - No support for 'apply'
+    - No support for type-merging: That means the modules options must be pre-declared directly.
+  */
+  record =
+    {
+      optional ? { },
+      required ? { },
+      wildcardType ? null,
+    }:
+    mkOptionType {
+      name = "record";
+      description =
+        if wildcardType == null then "record" else "open record of ${wildcardType.description}";
+      descriptionClass = if wildcardType == null then "noun" else "composite";
+      check = isAttrs;
+      merge.v2 =
+        { loc, defs }:
+        let
+          pushPositions = map (
+            def:
+            mapAttrs (_n: v: {
+              inherit (def) file;
+              value = v;
+            }) def.value
+          );
+
+          # Checks
+          intersection = intersectAttrs optional required;
+          optionalDefault = filterAttrs (_: opt: opt ? default) optional;
+
+          # Definitions + option defaults
+          allDefs =
+            defs
+            ++ (mapAttrsToList (name: opt: {
+              file = (builtins.unsafeGetAttrPos name required).file or "<unknown-file>";
+              value = {
+                ${name} = mkOptionDefault opt.default;
+              };
+            }) (filterAttrs (_n: opt: opt ? default) required));
+
+          merged = zipAttrsWith (
+            name: defs:
+            let
+              elemType = optional.${name}.type or required.${name}.type or wildcardType;
+            in
+            lib.modules.mergeDefinitions (loc ++ [ name ]) elemType defs
+          ) (pushPositions allDefs);
+        in
+        {
+          headError =
+            if intersection != { } then
+              {
+                message = "The following attributes of '${showOption loc}' are both declared in 'optional' and in 'required': ${lib.concatStringsSep ", " (attrNames intersection)}";
+              }
+            else if optionalDefault != { } then
+              {
+                message = "The following attributes of '${showOption loc}' are declared in 'optional' cannot have a default value: ${lib.concatStringsSep ", " (attrNames optionalDefault)}";
+              }
+            else
+              null;
+          # TODO: expose fields, fieldValues and extraValues
+          valueMeta = {
+            attrs = mapAttrs (_n: v: v.checkedAndMerged.valueMeta) merged;
+          };
+          value = mapAttrs (
+            name: v:
+            let
+              elemType = optional.${name}.type or required.${name}.type or wildcardType;
+            in
+            if required ? ${name} then
+              # Non-optional, lazy ?
+              v.mergedValue
+            else
+              # Optional, lazy
+              v.optionalValue.value or elemType.emptyValue.value or v.mergedValue
+          ) merged;
+        };
+      nestedTypes = lib.optionalAttrs (wildcardType != null) {
+        inherit wildcardType;
+      };
+      getSubOptions =
+        prefix:
+        # Since this type doesn't support type merging, we can safely use the original attrs to display documentation.
+        mapAttrs (
+          name: opt:
+          (
+            opt
+            // {
+              loc = prefix ++ [ name ];
+              inherit name;
+              declarations = [
+                (builtins.unsafeGetAttrPos name optional).file or (builtins.unsafeGetAttrPos name required).file
+                  or "<unknown-file>"
+              ];
+            }
+          )
+        ) (optional // required);
+    };
 }

lib/types/record_tests.nix

@@ -0,0 +1,44 @@
+{ lib, clanLib, ... }:
+let
+  inherit (lib) evalModules mkOption;
+  inherit (clanLib.types) record;
+in
+{
+  test_simple =
+    let
+      eval = evalModules {
+        modules = [
+          {
+            options.foo = mkOption {
+              type = record { };
+              default = { };
+            };
+          }
+        ];
+      };
+    in
+    {
+      inherit eval;
+      expr = eval.config.foo;
+      expected = { };
+    };
+
+  test_wildcard =
+    let
+      eval = evalModules {
+        modules = [
+          {
+            options.foo = mkOption {
+              type = record { };
+              default = { };
+            };
+          }
+        ];
+      };
+    in
+    {
+      inherit eval;
+      expr = eval.config.foo;
+      expected = { };
+    };
+}

lib/types/tests.nix

@@ -1,92 +1,5 @@
 { lib, clanLib, ... }:
-let
-  evalSettingsModule =
-    m:
-    lib.evalModules {
-      modules = [
-        {
-          options.foo = lib.mkOption {
-            type = clanLib.types.uniqueDeferredSerializableModule;
-          };
-        }
-        m
-      ];
-    };
-in
 {
-  test_simple =
-    let
-      eval = evalSettingsModule {
-        foo = { };
-      };
-    in
-    {
-      inherit eval;
-      expr = eval.config.foo;
-      expected = {
-        # Foo has imports
-        # This can only ever be one module due to the type of foo
-        imports = [
-          {
-            # This is the result of 'setDefaultModuleLocation'
-            # Which also returns exactly one module
-            _file = "<unknown-file>, via option foo";
-            imports = [
-              { }
-            ];
-          }
-        ];
-      };
-    };
-
-  test_no_nested_imports =
-    let
-      eval = evalSettingsModule {
-        foo = {
-          imports = [ ];
-        };
-      };
-    in
-    {
-      inherit eval;
-      expr = eval.config.foo;
-      expectedError = {
-        type = "ThrownError";
-        message = "*nested imports";
-      };
-    };
-
-  test_no_function_modules =
-    let
-      eval = evalSettingsModule {
-        foo =
-          { ... }:
-          {
-
-          };
-      };
-    in
-    {
-      inherit eval;
-      expr = eval.config.foo;
-      expectedError = {
-        type = "TypeError";
-        message = "cannot convert a function to JSON";
-      };
-    };
-
-  test_non_attrs_module =
-    let
-      eval = evalSettingsModule {
-        foo = "foo.nix";
-      };
-    in
-    {
-      inherit eval;
-      expr = eval.config.foo;
-      expectedError = {
-        type = "ThrownError";
-        message = ".*foo.* is not of type";
-      };
-    };
+  unique = import ./unique_tests.nix { inherit lib clanLib; };
+  record = import ./record_tests.nix { inherit lib clanLib; };
 }

lib/types/unique_tests.nix

@@ -0,0 +1,92 @@
+{ lib, clanLib, ... }:
+let
+  evalSettingsModule =
+    m:
+    lib.evalModules {
+      modules = [
+        {
+          options.foo = lib.mkOption {
+            type = clanLib.types.uniqueDeferredSerializableModule;
+          };
+        }
+        m
+      ];
+    };
+in
+{
+  test_not_defined =
+    let
+      eval = evalSettingsModule {
+        foo = { };
+      };
+    in
+    {
+      inherit eval;
+      expr = eval.config.foo;
+      expected = {
+        # Foo has imports
+        # This can only ever be one module due to the type of foo
+        imports = [
+          {
+            # This is the result of 'setDefaultModuleLocation'
+            # Which also returns exactly one module
+            _file = "<unknown-file>, via option foo";
+            imports = [
+              { }
+            ];
+          }
+        ];
+      };
+    };
+
+  test_no_nested_imports =
+    let
+      eval = evalSettingsModule {
+        foo = {
+          imports = [ ];
+        };
+      };
+    in
+    {
+      inherit eval;
+      expr = eval.config.foo;
+      expectedError = {
+        type = "ThrownError";
+        message = "*nested imports";
+      };
+    };
+
+  test_no_function_modules =
+    let
+      eval = evalSettingsModule {
+        foo =
+          { ... }:
+          {
+
+          };
+      };
+    in
+    {
+      inherit eval;
+      expr = eval.config.foo;
+      expectedError = {
+        type = "TypeError";
+        message = "cannot convert a function to JSON";
+      };
+    };
+
+  test_non_attrs_module =
+    let
+      eval = evalSettingsModule {
+        foo = "foo.nix";
+      };
+    in
+    {
+      inherit eval;
+      expr = eval.config.foo;
+      expectedError = {
+        type = "ThrownError";
+        message = ".*foo.* is not of type";
+      };
+    };
+}

modules/clan/default.nix

@@ -19,6 +19,7 @@
   imports = [
     ./top-level-interface.nix
     ./module.nix
+    ./distributed-services.nix
     ./checks.nix
   ];
 }

modules/clan/distributed-services.nix

@@ -0,0 +1,163 @@
+{
+  lib,
+  clanLib,
+  config,
+  clan-core,
+  ...
+}:
+let
+  inherit (lib) mkOption types;
+  # Keep a reference to top-level
+  clanConfig = config;
+
+  inventory = clanConfig.inventory;
+  flakeInputs = clanConfig.self.inputs;
+  clanCoreModules = clan-core.clan.modules;
+
+  grouped = lib.foldlAttrs (
+    acc: instanceName: instance:
+    let
+      inputName = if instance.module.input == null then "<clan-core>" else instance.module.input;
+      id = inputName + "-" + instance.module.name;
+    in
+    acc
+    // {
+      ${id} = acc.${id} or [ ] ++ [
+        {
+          inherit instanceName instance;
+        }
+      ];
+    }
+  ) { } importedModuleWithInstances;
+
+  importedModuleWithInstances = lib.mapAttrs (
+    instanceName: instance:
+    let
+      resolvedModule = clanLib.resolveModule {
+        moduleSpec = instance.module;
+        inherit flakeInputs clanCoreModules;
+      };
+
+      # Every instance includes machines via roles
+      # :: { client :: ... }
+      instanceRoles = lib.mapAttrs (
+        roleName: role:
+        let
+          resolvedMachines = clanLib.inventory.resolveTags {
+            members = {
+              # Explicit members
+              machines = lib.attrNames role.machines;
+              # Resolved Members
+              tags = lib.attrNames role.tags;
+            };
+            inherit (inventory) machines;
+            inherit instanceName roleName;
+          };
+        in
+        # instances.<instanceName>.roles.<roleName> =
+        # Remove "tags", they are resolved into "machines"
+        (removeAttrs role [ "tags" ])
+        // {
+          machines = lib.genAttrs resolvedMachines.machines (
+            machineName:
+            let
+              machineSettings = instance.roles.${roleName}.machines.${machineName}.settings or { };
+            in
+            # TODO: tag settings
+            # Wait for this feature until option introspection for 'settings' is done.
+            # This might get too complex to handle otherwise.
+            # settingsViaTags = lib.filterAttrs (
+            #   tagName: _: machineHasTag machineName tagName
+            # ) instance.roles.${roleName}.tags;
+            {
+              # TODO: Do we want to wrap settings with
+              # setDefaultModuleLocation "inventory.instances.${instanceName}.roles.${roleName}.tags.${tagName}";
+              settings = {
+                imports = [
+                  machineSettings
+                ]; # ++ lib.attrValues (lib.mapAttrs (_tagName: v: v.settings) settingsViaTags);
+              };
+            }
+          );
+        }
+      ) instance.roles;
+    in
+    {
+      inherit (instance) module;
+      inherit resolvedModule instanceRoles;
+    }
+  ) inventory.instances or { };
+in
+{
+  _class = "clan";
+  options._services = mkOption {
+    visible = false;
+    description = ''
+      All service instances
+
+      !!! Danger "Internal API"
+        Do not rely on this API yet.
+
+        - Will be renamed to just 'services' in the future.
+        Once the name can be claimed again.
+        - Structure will change.
+
+        API will be declared as public after beeing simplified.
+    '';
+    type = types.submoduleWith {
+      # TODO: Remove specialArgs
+      specialArgs = {
+        inherit clanLib;
+      };
+      modules = [
+        (import ../../lib/inventory/distributed-service/all-services-wrapper.nix {
+          inherit (clanConfig) directory exports;
+        })
+        # Dependencies
+        {
+          # exportsModule = clanConfig.exportsModule;
+        }
+        {
+          # TODO: Rename to "allServices"
+          # All services
+          mappedServices = lib.mapAttrs (_module_ident: instances: {
+            imports = [
+              # Import the resolved module.
+              # i.e. clan.modules.admin
+              {
+                options.module = lib.mkOption {
+                  type = lib.types.raw;
+                  default = (builtins.head instances).instance.module;
+                };
+              }
+              (builtins.head instances).instance.resolvedModule
+            ] # Include all the instances that correlate to the resolved module
+            ++ (builtins.map (v: {
+              instances.${v.instanceName}.roles = v.instance.instanceRoles;
+            }) instances);
+          }) grouped;
+        }
+      ];
+    };
+    default = { };
+  };
+  options._allMachines = mkOption {
+    internal = true;
+    type = types.raw;
+    default = lib.mapAttrs (machineName: _: {
+      # This is the list of nixosModules for each machine
+      machineImports = lib.foldlAttrs (
+        acc: _module_ident: serviceModule:
+        acc ++ [ serviceModule.result.final.${machineName}.nixosModule or { } ]
+      ) [ ] config._services.mappedServices;
+    }) inventory.machines or { };
+  };
+
+  config = {
+    clanInternals.inventoryClass.machines = config._allMachines;
+    # clanInternals.inventoryClass.distributedServices = config._services;
+
+    # Exports from distributed services
+    exports = config._services.exports;
+  };
+}

modules/clan/eval-docs.nix

@@ -3,12 +3,16 @@
   lib,
   clanModule,
   clanLib,
+  clan-core,
 }:
 let
   eval = lib.evalModules {
     modules = [
       clanModule
     ];
+    specialArgs = {
+      self = clan-core;
+    };
   };
 
   evalDocs = pkgs.nixosOptionsDoc {

modules/clan/flake-module.nix

@@ -12,6 +12,7 @@ in
     }:
     let
       jsonDocs = import ./eval-docs.nix {
+        clan-core = self;
         inherit
           pkgs
           lib

modules/clan/module.nix

@@ -219,8 +219,6 @@ in
     inherit nixosConfigurations;
     inherit darwinConfigurations;
 
-    exports = config.clanInternals.inventoryClass.distributedServices.servicesEval.config.exports;
-
     clanInternals = {
       inventoryClass =
         let
@@ -254,21 +252,9 @@ in
               exportsModule = config.exportsModule;
             }
             (
-              { config, ... }:
+              { ... }:
               {
                 staticModules = clan-core.clan.modules;
-
-                distributedServices = clanLib.inventory.mapInstances {
-                  inherit (config)
-                    inventory
-                    directory
-                    flakeInputs
-                    exportsModule
-                    ;
-                  clanCoreModules = clan-core.clan.modules;
-                  prefix = [ "distributedServices" ];
-                };
-                machines = config.distributedServices.allMachines;
               }
             )
           ];

modules/clan/top-level-interface.nix

@@ -110,9 +110,7 @@ in
 
     # TODO: make this writable by moving the options from inventoryClass into clan.
     exports = lib.mkOption {
-      readOnly = true;
-      visible = false;
-      internal = true;
+      type = types.lazyAttrsOf (types.submoduleWith { modules = [ config.exportsModule ]; });
     };
 
     exportsModule = lib.mkOption {

modules/inventoryClass/default.nix

@@ -67,9 +67,6 @@ in
       type = types.raw;
     };
 
-    distributedServices = mkOption {
-      type = types.raw;
-    };
     inventory = mkOption {
       type = types.raw;
     };

pkgs/docs-from-code/flake-module.nix

@@ -64,6 +64,9 @@
           '';
     in
     {
+      legacyPackages = {
+        inherit jsonDocs clanModulesViaService;
+      };
       packages = {
         inherit module-docs;
       };

pkgs/option-search/flake-module.nix

@@ -11,151 +11,10 @@
       ...
     }:
     let
-      inherit (lib)
-        mapAttrsToList
-        mapAttrs
-        mkOption
-        types
-        splitString
-        stringLength
-        substring
-        ;
-      inherit (self) clanLib;
-
-      serviceModules = self.clan.modules;
 
       baseHref = "/option-search/";
 
-      getRoles =
-        module:
-        (clanLib.evalService {
-          modules = [ module ];
-          prefix = [ ];
-        }).config.roles;
-
-      getManifest =
-        module:
-        (clanLib.evalService {
-          modules = [ module ];
-          prefix = [ ];
-        }).config.manifest;
-
-      settingsModules = module: mapAttrs (_roleName: roleConfig: roleConfig.interface) (getRoles module);
-
       # Map each letter to its capitalized version
-      capitalizeChar =
-        char:
-        {
-          a = "A";
-          b = "B";
-          c = "C";
-          d = "D";
-          e = "E";
-          f = "F";
-          g = "G";
-          h = "H";
-          i = "I";
-          j = "J";
-          k = "K";
-          l = "L";
-          m = "M";
-          n = "N";
-          o = "O";
-          p = "P";
-          q = "Q";
-          r = "R";
-          s = "S";
-          t = "T";
-          u = "U";
-          v = "V";
-          w = "W";
-          x = "X";
-          y = "Y";
-          z = "Z";
-        }
-        .${char};
-
-      title =
-        name:
-        let
-          # split by -
-          parts = splitString "-" name;
-          # capitalize first letter of each part
-          capitalize = part: (capitalizeChar (substring 0 1 part)) + substring 1 (stringLength part) part;
-          capitalizedParts = map capitalize parts;
-        in
-        builtins.concatStringsSep " " capitalizedParts;
-
-      fakeInstanceOptions =
-        name: module:
-        let
-          manifest = getManifest module;
-          description = ''
-            # ${title name} (Clan Service)
-
-            **${manifest.description}**
-
-            ${lib.optionalString (manifest ? readme) manifest.readme}
-
-            ${
-              if manifest.categories != [ ] then
-                "Categories: " + builtins.concatStringsSep ", " manifest.categories
-              else
-                "No categories defined"
-            }
-
-          '';
-        in
-        {
-          options = {
-            instances.${name} = lib.mkOption {
-              inherit description;
-              type = types.submodule {
-                options.roles = mapAttrs (
-                  roleName: roleSettingsModule:
-                  mkOption {
-                    type = types.submodule {
-                      _file = "docs flake-module";
-                      imports = [
-                        { _module.args = { inherit clanLib; }; }
-                        (import ../../modules/inventoryClass/role.nix {
-                          nestedSettingsOption = mkOption {
-                            type = types.raw;
-                            description = ''
-                              See [instances.${name}.roles.${roleName}.settings](${baseHref}?option_scope=0&option=inventory.instances.${name}.roles.${roleName}.settings)
-                            '';
-                          };
-                          settingsOption = mkOption {
-                            type = types.submoduleWith {
-                              modules = [ roleSettingsModule ];
-                            };
-                          };
-                        })
-                      ];
-                    };
-                  }
-                ) (settingsModules module);
-              };
-            };
-          };
-        };
-
-      docModules = [
-        {
-          inherit self;
-        }
-        self.modules.clan.default
-        {
-          options.inventory = lib.mkOption {
-            type = types.submoduleWith {
-              modules = [
-                { noInstanceOptions = true; }
-              ]
-              ++ mapAttrsToList fakeInstanceOptions serviceModules;
-            };
-          };
-        }
-      ];
 
       baseModule =
         # Module
@@ -208,12 +67,6 @@
               title = "Clan Options";
               # scopes = mapAttrsToList mkScope serviceModules;
               scopes = [
-                {
-                  inherit baseHref;
-                  name = "Flake Options (clan.nix file)";
-                  modules = docModules;
-                  urlPrefix = "https://git.clan.lol/clan/clan-core/src/branch/main/";
-                }
                 {
                   name = "Machine Options (clan.core NixOS options)";
                   optionsJSON = "${coreOptions}/share/doc/nixos/options.json";