Merge master into staging-next

##### `propagatedNativeBuildInputs` {#var-stdenv-propagatedNativeBuildInputs}

The propagated equivalent of `nativeBuildInputs`. This would be called `depsBuildHostPropagated` but for historical continuity. For example, if package `Y` has `propagatedNativeBuildInputs = [X]`, and package `Z` has `buildInputs = [Y]`, then package `Z` will be built as if it included package `X` in its `nativeBuildInputs`. If instead, package `Z` has `nativeBuildInputs = [Y]`, then `Z` will be built as if it included `X` in the `depsBuildBuild` of package `Z`, because of the sum of the two `-1` host offsets.

The propagated equivalent of `nativeBuildInputs`. This would be called `depsBuildHostPropagated` but for historical continuity. For example, if package `Y` has `propagatedNativeBuildInputs = [X]`, and package `Z` has `buildInputs = [Y]`, then package `Z` will be built as if it included package `X` in its `nativeBuildInputs`. Note that if instead, package `Z` has `nativeBuildInputs = [Y]`, then `X` will not be included at all.

##### `depsBuildTargetPropagated` {#var-stdenv-depsBuildTargetPropagated}

- `services.dex` now restarts upon changes to the `.environmentFile` or entries in `.settings.staticClients[].secretFile` when the entry is a `path` type.

- `nixos-rebuild-ng`, a full rewrite of `nixos-rebuild` in Python, is available for testing. You can enable it by setting [system.rebuild.enableNg](options.html#opt-system.rebuild.enableNg) in your configuration (this will replace the old `nixos-rebuild`), or by adding `nixos-rebuild-ng` to your `environment.systemPackages` (in this case, it will live side-by-side with `nixos-rebuild` as `nixos-rebuild-ng`). It is expected that the next major version of NixOS (25.11) will enable `system.rebuild.enableNg` by default.

- A `nixos-rebuild build-image` sub-command has been added.

  It allows users to build platform-specific (disk) images from their NixOS configurations. `nixos-rebuild build-image` works similar to the popular [nix-community/nixos-generators](https://github.com/nix-community/nixos-generators) project. See new [section on image building in the nixpkgs manual](https://nixos.org/manual/nixpkgs/unstable/#sec-image-nixos-rebuild-build-image). It is also available for `nixos-rebuild-ng`.

- `nixos-option` has been rewritten to a Nix expression called by a simple bash script. This lowers our maintenance threshold, makes eval errors less verbose, adds support for flake-based configurations, descending into `attrsOf` and `listOf` submodule options, and `--show-trace`.

  It allows users to build platform-specific (disk) images from their NixOS configurations. `nixos-rebuild build-image` works similar to the popular [nix-community/nixos-generators](https://github.com/nix-community/nixos-generators) project. See new [section on image building in the nixpkgs manual](https://nixos.org/manual/nixpkgs/unstable/#sec-image-nixos-rebuild-build-image).

<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

## New Modules {#sec-release-25.05-new-modules}

let

  inherit (lib)

    getExe

    isBool

    literalExpression

    maintainers

    mkEnableOption

    mkIf

    mkMerge

    mkOption

    mkPackageOption

    optionalString

    replaceChars

    substring

    toLower

    types

    ;

  inherit (types) str;

  inherit (types)

    bool

    either

    listOf

    str

    submodule

    ;

  cfg = config.programs.pay-respects;

  settingsFormat = pkgs.formats.toml { };

  inherit (settingsFormat) generate type;

  finalPackage =

    if cfg.aiIntegration != true then

      (pkgs.runCommand "pay-respects-wrapper"

        {

          nativeBuildInputs = [ pkgs.makeBinaryWrapper ];

          inherit (cfg.package) meta;

        }

        ''

          mkdir -p $out/bin

          makeWrapper ${getExe cfg.package} $out/bin/${cfg.package.meta.mainProgram} \

            ${optionalString (cfg.aiIntegration == false) "--set _PR_AI_DISABLE true"}

            ${optionalString (cfg.aiIntegration != false) ''

              --set _PR_AI_URL ${cfg.aiIntegration.url} \

              --set _PR_AI_MODEL ${cfg.aiIntegration.model} \

              --set _PR_AI_LOCALE ${cfg.aiIntegration.locale}

            ''}

        ''

      )

    else

      cfg.package;

  initScript =

    shell:

    if (shell != "fish") then

      ''

        eval $(${getExe pkgs.pay-respects} ${shell} --alias ${cfg.alias})

        eval $(${getExe finalPackage} ${shell} --alias ${cfg.alias})

      ''

    else

      ''

        ${getExe pkgs.pay-respects} ${shell} --alias ${cfg.alias} | source

        ${getExe finalPackage} ${shell} --alias ${cfg.alias} | source

      '';

in

{

    programs.pay-respects = {

      enable = mkEnableOption "pay-respects, an app which corrects your previous console command";

      package = mkPackageOption pkgs "pay-respects" { };

      alias = mkOption {

        default = "f";

        type = str;

          The default value is `f`, but you can use anything else as well.

        '';

      };

      runtimeRules = mkOption {

        type = listOf type;

        default = [ ];

        example = literalExpression ''

          [

            {

              command = "xl";

              match_err = [

                {

                  pattern = [

                    "Permission denied"

                  ];

                  suggest = [

                    '''

                      #[executable(sudo), !cmd_contains(sudo), err_contains(libxl: error:)]

                      sudo {{command}}

                    '''

                  ];

                }

              ];

            }

          ];

        '';

        description = ''

          List of rules to be added to `/etc/xdg/pay-respects/rules`.

          `pay-respects` will read the contents of these generated rules to recommend command corrections.

          Each rule module should start with the `command` attribute that specifies the command name. See the [upstream documentation](https://codeberg.org/iff/pay-respects/src/branch/main/rules.md) for more information.

        '';

      };

      aiIntegration = mkOption {

        default = false;

        example = {

          url = "http://127.0.0.1:11434/v1/chat/completions";

          model = "llama3";

          locale = "nl-be";

        };

        description = ''

          Whether to enable `pay-respects`' LLM integration. When there is no rule for a given error, `pay-respects` can query an OpenAI-compatible API endpoint for command corrections.

          - If this is set to `false`, all LLM-related features are disabled.

          - If this is set to `true`, the default OpenAI endpoint will be used, using upstream's API key. This default API key may be rate-limited.

          - You can also set a custom API endpoint, large language model and locale for command corrections. Simply access the `aiIntegration.url`, `aiIntegration.model` and `aiIntegration.locale` options, as described in the example.

            - Take a look at the [services.ollama](#opt-services.ollama.enable) NixOS module if you wish to host a local large language model for `pay-respects`.

          For all of these methods, you can set a custom secret API key by using the `_PR_AI_API_KEY` environment variable.

        '';

        type = either bool (submodule {

          options = {

            url = mkOption {

              default = "";

              example = "https://api.openai.com/v1/chat/completions";

              type = str;

              description = "The OpenAI-compatible API endpoint that `pay-respects` will query for command corrections.";

            };

            model = mkOption {

              default = "";

              example = "llama3";

              type = str;

              description = "The model used by `pay-respects` to generate command corrections.";

            };

            locale = mkOption {

              default = toLower (replaceChars [ "_" ] [ "-" ] (substring 0 5 config.i18n.defaultLocale));

              example = "nl-be";

              type = str;

              description = ''

                The locale to be used for LLM responses.

                The accepted format is a lowercase [`ISO 639-1` language code](https://en.wikipedia.org/wiki/List_of_ISO_639_language_codes), followed by a dash '-', followed by a lowercase [`ISO 3166-1 alpha-2` country code](https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2).

              '';

            };

          };

        });

      };

    };

  };

  config = mkIf cfg.enable {

    environment.systemPackages = [ pkgs.pay-respects ];

    assertions =

      map

        (attr: {

          assertion = (!isBool cfg.aiIntegration) -> (cfg.aiIntegration.${attr} != "");

          message = ''

            programs.pay-respects.aiIntegration is configured as a submodule, but you have not configured a value for programs.pay-respects.aiIntegration.${attr}!

          '';

        })

        [

          "url"

          "model"

        ];

    environment = mkMerge (

      [

        {

          systemPackages = [ finalPackage ];

        }

      ]

      ++ map (rule: {

        etc."xdg/pay-respects/rules/${rule.command}.toml".source = generate "${rule.command}.toml" rule;

      }) cfg.runtimeRules

    );

    programs = {

      bash.interactiveShellInit = initScript "bash";

A very basic configuration for backing up to a locally accessible directory is:

```nix

{

    opt.services.borgbackup.jobs = {

    services.borgbackup.jobs = {

      rootBackup = {

        paths = "/";

        exclude = [ "/nix" "/path/to/local/repo" ];

  cfg = config.services.wyoming.faster-whisper;

  inherit (lib)

    escapeShellArgs

    mkOption

    mkEnableOption

    mkPackageOption

                description = ''

                  Extra arguments to pass to the server commandline.

                '';

                apply = escapeShellArgs;

              };

            };

          }