{
  description = "Improvise — Multi-Dimensional Data Modeling Terminal Application";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
    beads.url = "github:gastownhall/beads/v1.3.0";
    rust-overlay = {
      url = "github:oxalica/rust-overlay";
    };
    flake-utils.url = "github:numtide/flake-utils";
    crate2nix.url = "github:nix-community/crate2nix";
    crane.url = "github:ipetkov/crane";
  };

  outputs = {
    self,
    beads,
    nixpkgs,
    rust-overlay,
    flake-utils,
    crate2nix,
    crane,
  }:
    flake-utils.lib.eachDefaultSystem (system: let
      pkgs = import nixpkgs {
        inherit system;
        overlays = [(import rust-overlay)];
      };

      rustToolchain = pkgs.rust-bin.stable.latest.default.override {
        extensions = ["rust-src" "clippy" "rustfmt" "llvm-tools-preview"];
        # The browser deployment targets wasm; without this, the wasm audit
        # (improvise-ywd) and the OPFS backend (improvise-i34) cannot even be
        # checked, let alone fixed.
        targets = ["wasm32-unknown-unknown"];
      };

      cargoNix = import ./Cargo.nix {
        inherit nixpkgs pkgs;
      };
      # wasm-pack downloads wasm-bindgen and binaryen from GitHub releases
      # unless they are on PATH, and its downloader ignores SSL_CERT_FILE, so
      # behind the runners' TLS-auditing proxy those downloads fail (binaryen
      # with no fallback). On PATH, it downloads nothing. wasm-pack only takes
      # a PATH wasm-bindgen whose version equals Cargo.lock's `wasm-bindgen`,
      # so this pin moves with the lock: on a mismatch the sandboxed build fails.
      wasmBindgenCli = pkgs.buildWasmBindgenCli rec {
        src = pkgs.fetchCrate {
          pname = "wasm-bindgen-cli";
          version = "0.2.129";
          hash = "sha256-pcecKQd7E8Opw6bkFoE569epUi7gh5qpQF1e5PJY6V8=";
        };
        cargoDeps = pkgs.rustPlatform.fetchCargoVendor {
          inherit src;
          inherit (src) pname version;
          hash = "sha256-vmUrWVU7kPJJxO5qIVeAkwQyWDELO1Z4Z5gitz2kco8=";
        };
      };

      # Everything CI runs, and nothing else: `devShells.ci` is exactly this,
      # and the default shell is this plus editor and release tooling, so a
      # local `nix develop` runs the toolchain the checks run.
      ciInputs = [
        rustToolchain
        pkgs.pkg-config

        # `scripts/kb` and the CI knowledge-base check both run trealla. It
        # was reached through `nix shell nixpkgs#trealla` per invocation,
        # which cost more than the work: the tool's first real use took past
        # two minutes for a write that takes half a second on PATH.
        pkgs.trealla

        # `web/build.sh` — and so the Pages job's local dry run — needs this.
        # The `wasm` CI job only runs `cargo check`, which does not, so the
        # shell was missing the one tool that turns a passing check into a
        # loadable page (improvise-d31). CI takes whatever version this is.
        pkgs.wasm-pack
        wasmBindgenCli
        pkgs.binaryen

        # The js and browser jobs once ran 22 while `build` ran 24; one shell
        # means one node.
        pkgs.nodejs_24
        pkgs.python3
        pkgs.jq
      ];

      # scripts/repo-stats runs code-maat (improvise-1xfb.5.1). The JRE is about
      # 0.6 GB, so it is kept out of ciInputs; only `nix-build` takes it.

      codeMaatJar = pkgs.fetchurl {
        url = "https://github.com/adamtornhill/code-maat/releases/download/v1.0.4/code-maat-1.0.4-standalone.jar";
        hash = "sha256-QoeuIDSQGERFD3aVR7xEl6DaGm0cf6b63IWHBeZ0O18=";
      };
      codeMaat = pkgs.writeShellScriptBin "code-maat" ''
        exec ${pkgs.jre_headless}/bin/java -jar ${codeMaatJar} "$@"
      '';

      # Playwright's downloaded browsers are generic-Linux builds that cannot
      # start on NixOS, so nixpkgs' build is used. harness/package.json pins
      # @playwright/test to this playwright-driver's version: they must match.
      craneLib = (crane.mkLib pkgs).overrideToolchain (_: rustToolchain);
      ci = import ./nix/ci.nix {
        inherit pkgs craneLib wasmBindgenCli;
        src = self;
        # What the site's cache-bust token names; CI checks out a clean tree.
        rev = self.rev or "dirty";
      };

      playwrightEnv = {
        PLAYWRIGHT_BROWSERS_PATH = "${pkgs.playwright-driver.browsers}";
        PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD = "1";
        PLAYWRIGHT_SKIP_VALIDATE_HOST_REQUIREMENTS = "true";
        RUST_BACKTRACE = "1";
      };
    in {
      inherit cargoNix;
      devShells.ci = pkgs.mkShell (playwrightEnv // {nativeBuildInputs = ciInputs;});
      devShells.default = pkgs.mkShell (playwrightEnv // {
        nativeBuildInputs = ciInputs ++ [
          pkgs.rust-analyzer
          crate2nix.packages.${system}.default
          pkgs.cargo-expand
          pkgs.cargo-llvm-cov
          pkgs.global
          pkgs.universal-ctags
          beads.packages.${system}.default
          codeMaat

          # Demo recording and release tooling
          pkgs.asciinema
          pkgs.vhs
          pkgs.cargo-dist
          # nixpkgs cargo-dist installs as "dist"; alias so `cargo dist` works
          (pkgs.writeShellScriptBin "cargo-dist" ''exec ${pkgs.cargo-dist}/bin/dist "$@"'')
        ];
      });

      packages =
        ci.packages
        // {
          improvise = cargoNix.workspaceMembers.improvise.build;
          default = self.packages.${system}.improvise;
          code-maat = codeMaat;
          # What the repo-stats pipeline runs besides the ci shell: one
          # installable, because check-ci-graph reads `nix shell <one> --command`.
          repo-stats-tools = pkgs.symlinkJoin {
            name = "repo-stats-tools";
            paths = [self.packages.${system}.improvise codeMaat];
          };
        };

      # `nix flake check` builds every CI build: crane's checks plus the
      # crate2nix package and the bundles.
      checks =
        ci.checks
        // {
          inherit (self.packages.${system}) improvise web;
        };
    });
}