{
  description = "RadiantWave kiosk application (SDL3, C++17)";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
    flake-utils.url = "github:numtide/flake-utils";
  };

  outputs =
    {
      self,
      nixpkgs,
      flake-utils,
    }:
    nixpkgs.lib.recursiveUpdate
    (
      # nixpkgs dropped x86_64-darwin support, so this is the full set of
      # supported systems: Intel/ARM Linux and Apple Silicon macOS.
      flake-utils.lib.eachSystem
        [
          "x86_64-linux"
          "aarch64-linux"
          "aarch64-darwin"
        ]
        (
          system:
          let
            pkgs = import nixpkgs {
              inherit system;
              # The app itself is proprietary; let it build without the
              # global `allowUnfree = true` in the user's config.
              config.allowUnfreePredicate = pkg:
                (nixpkgs.lib.getName pkg) == "radiantwave";
            };
          in
          {
            # Version is injected from the ambient environment on
            # impure evals (CI sets APP_VERSION from the git ref). Pure evals
            # (`nix flake check`, local `nix build`) can't see the
            # environment, so builtins.getEnv returns "" and the package
            # falls back to its 0.1.0 default.
            packages.default =
              let
                envVersion = builtins.getEnv "APP_VERSION";
                packageArgs =
                  nixpkgs.lib.optionalAttrs (envVersion != "") { version = envVersion; };
              in
              pkgs.callPackage ./nix/package.nix packageArgs;

            devShells.default = pkgs.mkShell {
              inputsFrom = [ self.packages.${system}.default ];
              packages = [ ];
              env = {
                # APP_VERSION is a CMake cache variable with no default; on a
                # fresh configure cmake seeds its cache from the environment
                # variable of the same name, so a plain `cmake -S . -B build`
                # bakes it into the binary.
                APP_VERSION = "dev";
              };
              shellHook = ''
                echo "RadiantWave dev shell (APP_VERSION=dev)"
                echo "  Configure: cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Debug"
                echo "  Bake version:  cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Debug -DAPP_VERSION=\"1.2.3\""
                echo "  Nix build (env version, impure): APP_VERSION=... nix build --impure .#default"
                echo "  Build:     cmake --build build"
                echo "  Run:       ./build/radiantwave"
                echo "  Tests:     ./build/test_assets && ./build/test_<name>"
              '';
            };

            # `nix flake check` builds this, which runs the offline test suite.
            checks.default = self.packages.${system}.default;
          }
        )
    )
    {
      nixosModules.default = import ./nixos/module.nix self;

      nixosConfigurations.test-vm = nixpkgs.lib.nixosSystem {
        system = "x86_64-linux";
        modules = [
          "${nixpkgs}/nixos/modules/virtualisation/qemu-vm.nix"
          self.nixosModules.default
          ./nixos/vm.nix
        ];
      };

      packages.x86_64-linux.test-vm =
        self.nixosConfigurations.test-vm.config.system.build.vm;
    };
}